feat: Cloudflare Turnstile on auth, CSP fixes, admin/SEO/analytics additions

Turnstile bot protection (sign-in, sign-up, password-reset):
- Register Better Auth's captcha plugin with the cloudflare-turnstile
  provider; endpoints listed explicitly rather than relying on defaults.
  /reset-password is intentionally excluded — it is reached only via a
  single-use emailed token.
- Add an explicit-render Turnstile widget component. Tokens are single-use,
  so each form resets the challenge after a failed submit; submit stays
  disabled until a token is held.
- Read the site key server-side and pass it down as a prop, so rotating it
  does not require a rebuild.
- Fail fast in production when TURNSTILE_SECRET_KEY is missing, and when a
  secret is set without a site key (that combination would demand a token
  no form can produce, locking every user out).
- Pass a throwaway secret during `next build` in the Dockerfile, mirroring
  the existing BETTER_AUTH_SECRET treatment, so image builds don't need it.

CSP fixes in middleware (these blocked Turnstile entirely):
- Add frame-src for challenges.cloudflare.com. Without it the widget's
  iframe fell back to default-src 'self' and was blocked outright.
- Allow 'unsafe-eval' and websockets in DEVELOPMENT only. `next dev`
  compiles with eval(), so the strict policy threw EvalError and killed
  hydration — no client JS ran at all, which also meant form submit
  handlers never fired. Production policy is unchanged and still strict.

Also included (concurrent work in the tree):
- Admin organizations pages and lib/admin/orgs.
- Episode moderation migration, SEO metadata (sitemap, robots, JSON-LD,
  OG/Twitter images, manifest), Umami analytics, not-found page.

Local dev database: docker-compose.dev.yml provisions Postgres 18 on port
5443 (5432-5442 are in use by other local projects).

Note: `npx tsc --noEmit` currently fails in app/(app)/team/page.tsx — an
`invitations` prop the component does not accept. This predates the commit
and will fail `next build` until fixed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -15,3 +15,7 @@ Dockerfile
 .dockerignore
 README.md
 deploy
+
+# database dumps / backups — must never enter the image (contain user PII + password hashes)
+*.sql
+!prisma/migrations/**/*.sql

.env.example

@@ -5,12 +5,43 @@ DATABASE_URL="postgresql://user:password@host:5432/podcast-distribution-ai?schem
 # Better Auth — generate a strong secret: `openssl rand -base64 32`
 BETTER_AUTH_SECRET="change-me"
 BETTER_AUTH_URL="http://localhost:3000"
+# The canonical public origin. Also the SEO source of truth: canonical tags, the
+# sitemap, robots.txt and Open Graph URLs are all built from it, so it must be the
+# exact production origin (https, correct www/non-www, no trailing slash).
+# It is a NEXT_PUBLIC_* var, so it is inlined at BUILD time — set it as a build arg
+# too (see Dockerfile). A production build fails fast if it is missing, rather than
+# shipping canonicals that point at localhost.
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
 
+# ─────────────────────────── SEO / search consoles ──────────
+# Optional site-ownership tokens. Leave empty to omit the verification meta tags.
+NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION=""
+NEXT_PUBLIC_BING_SITE_VERIFICATION=""
+
+# ─────────────────────────── Analytics (Umami) ──────────────
+# Self-hosted Umami. Leave either value empty to disable analytics entirely
+# (the default in development) — no script is rendered and no rewrite is added.
+# The tracker is proxied through this app at /_a, so the CSP stays untouched and
+# content blockers leave it alone; nothing needs allowlisting.
+# Both are read at BUILD time by statically rendered pages, so they must also be
+# passed as build args (see Dockerfile).
+UMAMI_HOST_URL="https://fickanalytics.phluit.net"
+UMAMI_WEBSITE_ID="98f83e69-cea1-435d-a002-6facea09764a"
+
 # ─────────────────────────── OAuth ──────────────────────────
 GOOGLE_CLIENT_ID=""
 GOOGLE_CLIENT_SECRET=""
 
+# ─────────────────────────── Bot protection ─────────────────
+# Cloudflare Turnstile guards the sign-in, sign-up and password-reset endpoints.
+# Create a widget at https://dash.cloudflare.com → Turnstile.
+# REQUIRED in production — the app refuses to boot without the secret key.
+# Leave both blank in dev to skip the challenge entirely.
+# The site key is read at RUNTIME (server-rendered into the page), so it does not
+# need to be a Docker build arg.
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=""
+TURNSTILE_SECRET_KEY=""
+
 # ─────────────────────────── AI providers ───────────────────
 OPENAI_API_KEY=""
 ELEVENLABS_API_KEY=""

.gitignore

@@ -28,6 +28,7 @@ yarn-error.log*
 .env
 .env*.local
 .env.production
+.env.*.bak
 
 # editor / os
 .vscode/*
@@ -39,3 +40,7 @@ yarn-error.log*
 
 # typescript
 *.tsbuildinfo
+
+# database dumps / backups — never commit (contain user PII + password hashes)
+*.sql
+!prisma/migrations/**/*.sql

Dockerfile

@@ -3,7 +3,7 @@
 # Includes ffmpeg (audio stitching) + the full node_modules so the worker can run
 # via tsx and `prisma migrate deploy` can run on web startup.
 
-FROM node:20-bookworm-slim AS base
+FROM node:22-bookworm-slim AS base
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ffmpeg openssl ca-certificates \
   && rm -rf /var/lib/apt/lists/*
@@ -23,13 +23,31 @@ COPY . .
 # provided as build args (Dokploy passes them from the env — see docker-compose.yml).
 ARG NEXT_PUBLIC_APP_URL
 ARG NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
+ARG NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION
+ARG NEXT_PUBLIC_BING_SITE_VERIFICATION
+ARG UMAMI_HOST_URL
+ARG UMAMI_WEBSITE_ID
+ARG NEXT_PUBLIC_TURNSTILE_SITE_KEY
 ENV NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL
 ENV NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=$NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
+ENV NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION=$NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION
+ENV NEXT_PUBLIC_BING_SITE_VERIFICATION=$NEXT_PUBLIC_BING_SITE_VERIFICATION
+# Not NEXT_PUBLIC_, but still needed at build time: the root layout is statically
+# rendered, so the website id is baked into the prerendered HTML.
+ENV UMAMI_HOST_URL=$UMAMI_HOST_URL
+ENV UMAMI_WEBSITE_ID=$UMAMI_WEBSITE_ID
+ENV NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY
 # A throwaway BETTER_AUTH_SECRET, scoped to THIS command only (not a persisted ENV
 # layer), satisfies the prod-secret guard in lib/auth/auth.ts during `next build`.
 # Must be >= 32 chars (and not a known placeholder) to pass that guard; the real
 # secret is injected at run time and is never baked into the bundle.
-RUN BETTER_AUTH_SECRET=build-time-placeholder-not-a-real-secret npm run build
+# TURNSTILE_SECRET_KEY gets the same treatment for the Turnstile guard in
+# lib/auth/auth.ts: a throwaway value satisfies it during `next build`, while the
+# real secret is injected at run time and never baked into the image. (The SITE
+# key is not a secret and is a real build arg above.)
+RUN BETTER_AUTH_SECRET=build-time-placeholder-not-a-real-secret \
+    TURNSTILE_SECRET_KEY=build-time-placeholder-not-a-real-secret \
+    npm run build
 
 # ---- runtime ----
 FROM base AS runner
@@ -46,6 +64,10 @@ COPY --from=build /app ./
 # unaffected: `next start` serves prebuilt output and never relies on the throw.
 RUN cp node_modules/server-only/empty.js node_modules/server-only/index.js
 RUN mkdir -p /app/storage/mp3 /app/storage/art /app/storage/exports
+# Drop root. `node` (uid 1000) ships with the official image. /app/storage is the
+# only path written at run time, so it (and the Next.js cache) must be owned by it.
+RUN chown -R node:node /app/storage /app/.next
+USER node
 EXPOSE 3000
 # Default = web; the worker service overrides this command in docker-compose.yml.
 CMD ["npm", "run", "start"]

app/(admin)/admin/actions.ts

@@ -55,6 +55,123 @@ export async function setRoleAction(userId: string, role: "admin" | "user"): Pro
   return { ok: true };
 }
 
+/**
+ * Permanently delete a user and everything they own (GDPR erasure request).
+ *
+ * Guards mirror the ban/demote ones: an admin cannot delete themselves, and
+ * cannot delete another admin — demote them first, so removing a privileged
+ * account is always a deliberate two-step action.
+ *
+ * The User row cascades to sessions, accounts, episodes, scripts, media rows,
+ * API keys, usage and memberships (see onDelete: Cascade in schema.prisma).
+ * Generated MP3/PNG files on disk are NOT removed here — see the note below.
+ */
+export async function deleteUserAction(userId: string): Promise<ActionResult> {
+  const s = await adminSession();
+  if (!s) return { ok: false, error: "Not allowed." };
+  if (userId === s.user.id) return { ok: false, error: "You can't delete your own account here." };
+
+  const target = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { id: true, email: true, role: true },
+  });
+  if (!target) return { ok: false, error: "User not found." };
+  if (target.role === "admin") {
+    return { ok: false, error: "Demote this admin before deleting the account." };
+  }
+
+  // Audit BEFORE the delete: the row references the actor, not the target, so it
+  // survives the cascade — but writing it first means a failed delete still
+  // leaves a record of the attempt.
+  await audit(s.user.id, "user.delete", target.id, { email: target.email });
+  await prisma.user.delete({ where: { id: target.id } });
+
+  revalidatePath("/admin/users");
+  return { ok: true };
+}
+
+/**
+ * Export everything held about one user, for a GDPR access request an admin is
+ * fulfilling on their behalf. Mirrors the self-serve export in
+ * app/(app)/settings/actions.ts and likewise excludes credentials.
+ */
+export async function exportUserDataAction(
+  userId: string
+): Promise<{ ok: boolean; error?: string; json?: string }> {
+  const s = await adminSession();
+  if (!s) return { ok: false, error: "Not allowed." };
+
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      emailVerified: true,
+      createdAt: true,
+      role: true,
+      banned: true,
+    },
+  });
+  if (!user) return { ok: false, error: "User not found." };
+
+  const [preferences, episodes, series, subscriptions, usage, apiKeys, memberships] =
+    await Promise.all([
+      prisma.userPreferences.findUnique({ where: { userId } }),
+      prisma.episode.findMany({
+        where: { userId },
+        orderBy: { createdAt: "desc" },
+        select: {
+          id: true,
+          title: true,
+          topic: true,
+          status: true,
+          language: true,
+          shareId: true,
+          createdAt: true,
+          script: { select: { content: true } },
+          audioAsset: { select: { storageKey: true, durationSec: true } },
+          coverArt: { select: { storageKey: true } },
+          repurposed: { select: { type: true, content: true, createdAt: true } },
+        },
+      }),
+      prisma.series.findMany({ where: { userId } }),
+      prisma.subscription.findMany({ where: { referenceId: userId } }),
+      prisma.usageRecord.findMany({ where: { ownerId: userId, ownerType: "user" } }),
+      prisma.apiKey.findMany({
+        where: { userId },
+        select: { id: true, name: true, prefix: true, createdAt: true, revokedAt: true },
+      }),
+      prisma.member.findMany({
+        where: { userId },
+        select: { role: true, createdAt: true, organization: { select: { id: true, name: true } } },
+      }),
+    ]);
+
+  await audit(s.user.id, "user.export", userId, { email: user.email });
+
+  return {
+    ok: true,
+    json: JSON.stringify(
+      {
+        exportedAt: new Date().toISOString(),
+        exportedBy: s.user.email,
+        note: "Credentials and authentication tokens are intentionally excluded. Media is referenced by storage key.",
+        user,
+        preferences,
+        episodes,
+        series,
+        subscriptions,
+        usage,
+        apiKeys,
+        memberships,
+      },
+      null,
+      2
+    ),
+  };
+}
+
 export async function toggleFeatureFlagAction(
   key: string,
   enabled: boolean
@@ -68,14 +185,70 @@ export async function toggleFeatureFlagAction(
   return { ok: true };
 }
 
+/**
+ * Resolve a content flag.
+ *
+ * "reviewed" clears the flag and leaves the episode alone. "removed" is a real
+ * takedown: it stamps Episode.moderatedAt and clears shareId, which together
+ * block the public page, the media routes, export and re-sharing (all of them
+ * check moderatedAt). Previously this only changed the flag row, so a
+ * destructive-looking "Remove" left violating audio publicly streamable.
+ */
 export async function reviewContentFlagAction(
   flagId: string,
   status: "reviewed" | "removed"
 ): Promise<{ ok: boolean; error?: string }> {
   const s = await adminSession();
   if (!s) return { ok: false, error: "Not allowed." };
-  await prisma.contentFlag.update({ where: { id: flagId }, data: { status, reviewedBy: s.user.id } });
-  await audit(s.user.id, "content.review", flagId, { status });
+
+  const parsedStatus = z.enum(["reviewed", "removed"]).safeParse(status);
+  if (!parsedStatus.success) return { ok: false, error: "Invalid status." };
+
+  const flag = await prisma.contentFlag.findUnique({
+    where: { id: flagId },
+    select: { id: true, episodeId: true },
+  });
+  if (!flag) return { ok: false, error: "Flag not found." };
+
+  await prisma.$transaction(async (tx) => {
+    await tx.contentFlag.update({
+      where: { id: flag.id },
+      data: { status: parsedStatus.data, reviewedBy: s.user.id },
+    });
+    if (parsedStatus.data === "removed") {
+      await tx.episode.update({
+        where: { id: flag.episodeId },
+        data: { moderatedAt: new Date(), moderatedBy: s.user.id, shareId: null, sharedAt: null },
+      });
+    }
+  });
+
+  await audit(s.user.id, "content.review", flagId, {
+    status: parsedStatus.data,
+    episodeId: flag.episodeId,
+  });
+  revalidatePath("/admin/moderation");
+  return { ok: true };
+}
+
+/** Reinstate an episode taken down in error. */
+export async function restoreEpisodeAction(episodeId: string): Promise<ActionResult> {
+  const s = await adminSession();
+  if (!s) return { ok: false, error: "Not allowed." };
+
+  const episode = await prisma.episode.findUnique({
+    where: { id: episodeId },
+    select: { id: true, moderatedAt: true },
+  });
+  if (!episode) return { ok: false, error: "Episode not found." };
+  if (!episode.moderatedAt) return { ok: false, error: "That episode is not removed." };
+
+  // shareId is deliberately NOT restored — the owner re-shares if they want to.
+  await prisma.episode.update({
+    where: { id: episode.id },
+    data: { moderatedAt: null, moderatedBy: null },
+  });
+  await audit(s.user.id, "content.restore", episodeId);
   revalidatePath("/admin/moderation");
   return { ok: true };
 }

app/(admin)/admin/ai-usage/page.tsx

@@ -10,6 +10,7 @@ import { BarSeries } from "@/components/admin/ui/charts";
 import { RangePicker } from "@/components/admin/ui/table-controls";
 import { DataTable, type Column } from "@/components/admin/ui/data-table";
 import { CHART } from "@/components/admin/ui/chart-theme";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · AI usage" };
 
@@ -20,6 +21,11 @@ export default async function AdminAiUsagePage({
 }: {
   searchParams: Promise<{ range?: string }>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const range = parseRange((await searchParams).range);
   const [breakdown, series] = await Promise.all([getCostBreakdown(range), getAiCostSeries(range)]);
   const usd = (n: number) => `$${n.toFixed(2)}`;

app/(admin)/admin/audit/page.tsx

@@ -6,6 +6,7 @@ import { SearchInput, FilterSelect, Pagination } from "@/components/admin/ui/tab
 import { AuditExport } from "@/components/admin/audit-export";
 import { AuditMetaViewer } from "@/components/admin/audit-meta-viewer";
 import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Audit log" };
 
@@ -16,6 +17,11 @@ export default async function AdminAuditPage({
 }: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const sp = await searchParams;
   const page = Math.max(1, Number(sp.page ?? "1"));
   const [{ rows, total }, actions] = await Promise.all([

app/(admin)/admin/flags/page.tsx

@@ -2,10 +2,16 @@ import type { Metadata } from "next";
 import { PageHeader } from "@/components/app/page-header";
 import { FlagsClient } from "@/components/admin/flags-client";
 import { getAdminFlags } from "@/lib/admin/flags";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Feature flags" };
 
 export default async function AdminFlagsPage() {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const flags = await getAdminFlags();
   const serialized = flags.map((f) => ({
     ...f,

app/(admin)/admin/health/page.tsx

@@ -9,10 +9,16 @@ import { ChartCard } from "@/components/admin/ui/chart-card";
 import { AutoRefresh } from "@/components/admin/ui/auto-refresh";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · System health" };
 
 export default async function AdminHealthPage() {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const t0 = Date.now();
   await prisma.$queryRawUnsafe("SELECT 1");
   const dbMs = Date.now() - t0;

app/(admin)/admin/jobs/page.tsx

@@ -8,6 +8,7 @@ import { DataTable, TableToolbar, type Column } from "@/components/admin/ui/data
 import { FilterSelect, Pagination } from "@/components/admin/ui/table-controls";
 import { JobRowActions } from "@/components/admin/job-row-actions";
 import { Badge, type BadgeProps } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Jobs" };
 
@@ -30,6 +31,11 @@ export default async function AdminJobsPage({
 }: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const sp = await searchParams;
   const page = Math.max(1, Number(sp.page ?? "1"));
   const [{ rows, total }, counts] = await Promise.all([

app/(admin)/admin/moderation/page.tsx

@@ -1,11 +1,13 @@
 import type { Metadata } from "next";
 import Link from "next/link";
 import { ShieldCheck } from "lucide-react";
-import { getModerationQueue } from "@/lib/admin/ops";
+import { getModerationQueue, MODERATION_PAGE_SIZE } from "@/lib/admin/ops";
+import { Pagination } from "@/components/admin/ui/table-controls";
 import { PageHeader } from "@/components/app/page-header";
 import { Card, CardContent } from "@/components/ui/card";
 import { Badge, type BadgeProps } from "@/components/ui/badge";
 import { ModerationActions } from "@/components/admin/moderation-actions";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Moderation" };
 
@@ -15,14 +17,25 @@ const SEVERITY: Record<string, BadgeProps["variant"]> = {
   low: "secondary",
 };
 
-export default async function AdminModerationPage() {
-  const flags = await getModerationQueue();
+export default async function AdminModerationPage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | undefined>>;
+}) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
+  const sp = await searchParams;
+  const page = Math.max(1, Number(sp.page ?? "1"));
+  const { rows: flags, total } = await getModerationQueue({ page });
 
   return (
     <>
       <PageHeader
         title="Content moderation"
-        description="Episodes auto-flagged by AI moderation, awaiting review."
+        description={`${total} open flag${total === 1 ? "" : "s"} awaiting review.`}
       />
       {flags.length === 0 ? (
         <Card>
@@ -55,6 +68,7 @@ export default async function AdminModerationPage() {
               </CardContent>
             </Card>
           ))}
+          <Pagination page={page} pageSize={MODERATION_PAGE_SIZE} total={total} />
         </div>
       )}
     </>

app/(admin)/admin/organizations/[id]/page.tsx

@@ -0,0 +1,151 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { Building2, Users, Mic, Palette } from "lucide-react";
+import { getOrgDetail } from "@/lib/admin/orgs";
+import { PageHeader } from "@/components/app/page-header";
+import { StatCard } from "@/components/admin/ui/stat-card";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
+
+export const metadata: Metadata = { title: "Admin · Organization" };
+
+export default async function AdminOrgDetailPage({
+  params,
+}: {
+  params: Promise<{ id: string }>;
+}) {
+  await requireAdmin();
+
+  const { id } = await params;
+  const org = await getOrgDetail(id);
+  if (!org) notFound();
+
+  const overCapacity = org.members.length > org.seats;
+
+  return (
+    <>
+      <PageHeader
+        title={org.name}
+        description={`${org.slug ?? org.id} · created ${org.createdAt.toLocaleDateString()}`}
+      />
+
+      <div className="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+        <StatCard label="Plan" value={org.plan} icon={Building2} hint={org.status ?? "no subscription"} />
+        <StatCard
+          label="Seats"
+          value={`${org.members.length} / ${org.seats}`}
+          icon={Users}
+          hint={overCapacity ? "over capacity" : `${org.invitations.length} pending invite(s)`}
+        />
+        <StatCard label="Episodes" value={String(org.episodeCount)} icon={Mic} hint="Billed to this org" />
+        <StatCard
+          label="White-label"
+          value={org.branding?.removePoweredBy ? "On" : "Off"}
+          icon={Palette}
+          hint={org.branding?.customDomain ?? "no custom domain"}
+        />
+      </div>
+
+      <div className="grid gap-6 lg:grid-cols-2">
+        <Card>
+          <CardHeader>
+            <CardTitle>Members</CardTitle>
+          </CardHeader>
+          <CardContent>
+            {org.members.length === 0 ? (
+              <p className="text-sm text-muted-foreground">No members.</p>
+            ) : (
+              <div className="divide-y rounded-2xl border">
+                {org.members.map((m) => (
+                  <div key={m.memberId} className="flex items-center gap-3 p-3">
+                    <div className="min-w-0 flex-1">
+                      <Link
+                        href={`/admin/users/${m.userId}`}
+                        className="truncate text-sm font-medium hover:underline"
+                      >
+                        {m.name}
+                      </Link>
+                      <p className="truncate text-xs text-muted-foreground">{m.email}</p>
+                    </div>
+                    {m.banned ? <Badge variant="destructive">banned</Badge> : null}
+                    <Badge variant="outline" className="capitalize">
+                      {m.role}
+                    </Badge>
+                  </div>
+                ))}
+              </div>
+            )}
+
+            {org.invitations.length > 0 ? (
+              <div className="mt-4 space-y-2">
+                <p className="text-xs font-medium text-muted-foreground">
+                  Pending invitations ({org.invitations.length}) — each holds a seat
+                </p>
+                <div className="divide-y rounded-2xl border border-dashed">
+                  {org.invitations.map((i) => (
+                    <div key={i.id} className="flex items-center gap-3 p-3">
+                      <span className="min-w-0 flex-1 truncate text-sm">{i.email}</span>
+                      <span className="text-xs text-muted-foreground">
+                        expires {i.expiresAt.toLocaleDateString()}
+                      </span>
+                    </div>
+                  ))}
+                </div>
+              </div>
+            ) : null}
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Recent episodes</CardTitle>
+          </CardHeader>
+          <CardContent>
+            {org.recentEpisodes.length === 0 ? (
+              <p className="text-sm text-muted-foreground">No episodes billed to this workspace yet.</p>
+            ) : (
+              <div className="divide-y rounded-2xl border">
+                {org.recentEpisodes.map((e) => (
+                  <div key={e.id} className="flex items-center gap-3 p-3">
+                    <div className="min-w-0 flex-1">
+                      <p className="truncate text-sm font-medium">{e.title}</p>
+                      <p className="text-xs text-muted-foreground">
+                        {e.createdAt.toLocaleDateString()}
+                      </p>
+                    </div>
+                    <Badge variant="outline">{e.status}</Badge>
+                  </div>
+                ))}
+              </div>
+            )}
+          </CardContent>
+        </Card>
+      </div>
+
+      {org.branding ? (
+        <Card className="mt-6">
+          <CardHeader>
+            <CardTitle>Branding</CardTitle>
+          </CardHeader>
+          <CardContent className="grid gap-3 sm:grid-cols-2">
+            <Field label="Brand name" value={org.branding.brandName} />
+            <Field label="Primary colour" value={org.branding.primaryColor} />
+            <Field label="Logo URL" value={org.branding.logoUrl} />
+            <Field label="Custom domain" value={org.branding.customDomain} />
+          </CardContent>
+        </Card>
+      ) : null}
+    </>
+  );
+}
+
+function Field({ label, value }: { label: string; value: string | null }) {
+  return (
+    <div>
+      <p className="text-xs text-muted-foreground">{label}</p>
+      <p className="truncate text-sm">{value ?? "—"}</p>
+    </div>
+  );
+}

app/(admin)/admin/organizations/page.tsx

@@ -0,0 +1,109 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { listOrganizations, ORGS_PAGE_SIZE, type AdminOrgRow } from "@/lib/admin/orgs";
+import { PageHeader } from "@/components/app/page-header";
+import { DataTable, TableToolbar, type Column } from "@/components/admin/ui/data-table";
+import { SearchInput, FilterSelect, Pagination } from "@/components/admin/ui/table-controls";
+import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
+
+export const metadata: Metadata = { title: "Admin · Organizations" };
+
+export default async function AdminOrganizationsPage({
+  searchParams,
+}: {
+  searchParams: Promise<Record<string, string | undefined>>;
+}) {
+  await requireAdmin();
+
+  const sp = await searchParams;
+  const page = Math.max(1, Number(sp.page ?? "1"));
+  const { rows, total } = await listOrganizations({
+    search: sp.q,
+    plan: sp.plan,
+    sort: sp.sort,
+    page,
+  });
+
+  const columns: Column<AdminOrgRow>[] = [
+    {
+      key: "org",
+      header: "Organization",
+      sortKey: "name",
+      cell: (o) => (
+        <div className="min-w-0">
+          <Link href={`/admin/organizations/${o.id}`} className="truncate font-medium hover:underline">
+            {o.name}
+          </Link>
+          <p className="truncate text-xs text-muted-foreground">{o.slug ?? o.id}</p>
+        </div>
+      ),
+    },
+    { key: "plan", header: "Plan", cell: (o) => <span className="capitalize">{o.plan}</span> },
+    {
+      key: "seats",
+      header: "Seats",
+      cell: (o) => (
+        <span className={o.memberCount > o.seats ? "font-medium text-destructive" : undefined}>
+          {o.memberCount} / {o.seats}
+        </span>
+      ),
+    },
+    {
+      key: "status",
+      header: "Status",
+      cell: (o) =>
+        o.status === "active" || o.status === "trialing" ? (
+          <Badge variant="success">{o.status}</Badge>
+        ) : o.status ? (
+          <Badge variant="destructive">{o.status}</Badge>
+        ) : (
+          <span className="text-muted-foreground">none</span>
+        ),
+    },
+    {
+      key: "whiteLabel",
+      header: "White-label",
+      cell: (o) =>
+        o.whiteLabel ? <Badge variant="secondary">on</Badge> : <span className="text-muted-foreground">—</span>,
+    },
+    {
+      key: "createdAt",
+      header: "Created",
+      sortKey: "createdAt",
+      cell: (o) => <span className="text-muted-foreground">{o.createdAt.toLocaleDateString()}</span>,
+    },
+  ];
+
+  return (
+    <>
+      <PageHeader
+        title="Organizations"
+        description={`${total} workspace${total === 1 ? "" : "s"}. Seats over capacity are highlighted.`}
+      />
+      <TableToolbar>
+        <SearchInput placeholder="Search name or slug…" />
+        <FilterSelect
+          param="plan"
+          placeholder="Plan"
+          allLabel="All plans"
+          options={[
+            { value: "free", label: "Free" },
+            { value: "creator", label: "Creator" },
+            { value: "pro", label: "Pro" },
+            { value: "agency", label: "Agency" },
+          ]}
+        />
+      </TableToolbar>
+      <DataTable
+        columns={columns}
+        rows={rows}
+        getRowKey={(o) => o.id}
+        empty="No organizations match your filters."
+      />
+      <div className="mt-4">
+        <Pagination page={page} pageSize={ORGS_PAGE_SIZE} total={total} />
+      </div>
+    </>
+  );
+}

app/(admin)/admin/page.tsx

@@ -11,6 +11,7 @@ import { ChartCard } from "@/components/admin/ui/chart-card";
 import { BarSeries, Donut } from "@/components/admin/ui/charts";
 import { RangePicker } from "@/components/admin/ui/table-controls";
 import { CHART, TIER_COLORS } from "@/components/admin/ui/chart-theme";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Overview" };
 
@@ -19,6 +20,11 @@ export default async function AdminOverviewPage({
 }: {
   searchParams: Promise<{ range?: string }>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const range = parseRange((await searchParams).range);
   const [m, signups, revenue] = await Promise.all([
     getOverview(range),

app/(admin)/admin/revenue/page.tsx

@@ -13,6 +13,7 @@ import { RangePicker } from "@/components/admin/ui/table-controls";
 import { DataTable, type Column } from "@/components/admin/ui/data-table";
 import { CHART, TIER_COLORS } from "@/components/admin/ui/chart-theme";
 import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Revenue" };
 
@@ -23,6 +24,11 @@ export default async function AdminRevenuePage({
 }: {
   searchParams: Promise<{ range?: string }>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const range = parseRange((await searchParams).range);
   const [m, revenue, extras] = await Promise.all([
     getOverview(range),

app/(admin)/admin/settings/page.tsx

@@ -4,6 +4,7 @@ import { prisma } from "@/lib/db";
 import { PLANS, PLAN_ORDER, type PlanKey, type PlanLimits } from "@/lib/billing/plans";
 import { PageHeader } from "@/components/app/page-header";
 import { PlanEditor, type EditablePlan, type PlanLimitsValue } from "@/components/admin/plan-editor";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Settings" };
 
@@ -25,6 +26,11 @@ function coerceLimits(raw: unknown, fallback: PlanLimits): PlanLimitsValue {
 }
 
 export default async function AdminSettingsPage() {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const dbPlans = await prisma.plan.findMany();
   const byKey = new Map(dbPlans.map((p) => [p.key, p]));
 

app/(admin)/admin/subscriptions/page.tsx

@@ -9,6 +9,7 @@ import { DataTable, TableToolbar, type Column } from "@/components/admin/ui/data
 import { SearchInput, FilterSelect, Pagination } from "@/components/admin/ui/table-controls";
 import { SubscriptionRowActions } from "@/components/admin/subscription-row-actions";
 import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Subscriptions" };
 
@@ -17,6 +18,11 @@ export default async function AdminSubscriptionsPage({
 }: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const sp = await searchParams;
   const page = Math.max(1, Number(sp.page ?? "1"));
   const [m, { rows, total }] = await Promise.all([

app/(admin)/admin/users/[id]/page.tsx

@@ -13,6 +13,7 @@ import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Progress } from "@/components/ui/progress";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · User detail" };
 
@@ -42,6 +43,11 @@ export default async function AdminUserDetailPage({
 }: {
   params: Promise<{ id: string }>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const { id } = await params;
   const detail = await getUserDetail(id);
   if (!detail) notFound();

app/(admin)/admin/users/page.tsx

@@ -5,6 +5,7 @@ import { DataTable, TableToolbar, type Column } from "@/components/admin/ui/data
 import { SearchInput, FilterSelect, Pagination } from "@/components/admin/ui/table-controls";
 import { UserRowActions } from "@/components/admin/user-row-actions";
 import { Badge } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Users" };
 
@@ -13,6 +14,11 @@ export default async function AdminUsersPage({
 }: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const sp = await searchParams;
   const page = Math.max(1, Number(sp.page ?? "1"));
   const { rows, total } = await listUsers({

app/(admin)/admin/webhooks/page.tsx

@@ -6,6 +6,7 @@ import { StatCard } from "@/components/admin/ui/stat-card";
 import { DataTable, TableToolbar, type Column } from "@/components/admin/ui/data-table";
 import { FilterSelect, Pagination } from "@/components/admin/ui/table-controls";
 import { Badge, type BadgeProps } from "@/components/ui/badge";
+import { requireAdmin } from "@/lib/auth/guards";
 
 export const metadata: Metadata = { title: "Admin · Webhooks" };
 
@@ -22,6 +23,11 @@ export default async function AdminWebhooksPage({
 }: {
   searchParams: Promise<Record<string, string | undefined>>;
 }) {
+  // Defence in depth: the (admin) layout also guards, but a layout is not an
+  // authorization boundary — pages render concurrently with it, and a route moved
+  // out of the group would silently lose its only check.
+  await requireAdmin();
+
   const sp = await searchParams;
   const page = Math.max(1, Number(sp.page ?? "1"));
   const { rows, total, recentFailures, recentTotal } = await listWebhookEvents({

app/(admin)/layout.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import Link from "next/link";
 import { ArrowLeft } from "lucide-react";
 import { requireAdmin } from "@/lib/auth/guards";
@@ -6,10 +7,15 @@ import { AdminMobileNav } from "@/components/admin/admin-mobile-nav";
 import { UserMenu } from "@/components/app/user-menu";
 import { Button } from "@/components/ui/button";
 import { Logo } from "@/components/ui/logo";
+import { NO_INDEX } from "@/lib/seo";
 
 // Authed, DB-backed admin surface — never statically prerender.
 export const dynamic = "force-dynamic";
 
+// Authenticated surface — never indexable. Metadata merges down, so every route
+// in this group inherits `noindex, nofollow` unless it explicitly overrides it.
+export const metadata: Metadata = NO_INDEX;
+
 export default async function AdminLayout({ children }: { children: React.ReactNode }) {
   const session = await requireAdmin();
 

app/(app)/dashboard/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import Link from "next/link";
 import { Mic2, Plus, Sparkles, ArrowRight, Mic, Gauge, Crown, Infinity as InfinityIcon } from "lucide-react";
 import { requireAuth } from "@/lib/auth/guards";
@@ -21,6 +22,8 @@ const METRIC_LABELS: Record<UsageMetric, string> = {
   repurpose: "Repurposed content",
 };
 
+export const metadata: Metadata = { title: "Dashboard" };
+
 export default async function DashboardPage() {
   const session = await requireAuth();
   const { plan, key, subjectId } = await getEffectivePlan(

app/(app)/episodes/[id]/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import Link from "next/link";
 import { Mic2, Repeat } from "lucide-react";
@@ -12,6 +13,17 @@ import { Card, CardContent } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import type { StructuredScript } from "@/lib/ai/types";
 
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ id: string }>;
+}): Promise<Metadata> {
+  const { id } = await params;
+  // Title only — this is an authed page and the route group is already noindex.
+  const episode = await prisma.episode.findUnique({ where: { id }, select: { title: true } });
+  return { title: episode?.title ?? "Episode" };
+}
+
 export default async function EpisodePage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   const session = await requireAuth();
@@ -33,12 +45,24 @@ export default async function EpisodePage({ params }: { params: Promise<{ id: st
         title={episode.title}
         description={`${episode.format.replace("_", "-").toLowerCase()} · ${episode.language.toUpperCase()} · ${episode.targetLengthMin} min`}
         action={
-          !inProgress ? (
+          !inProgress && !episode.moderatedAt ? (
             <EpisodeActions episodeId={episode.id} initialShareId={episode.shareId} />
           ) : undefined
         }
       />
 
+      {episode.moderatedAt ? (
+        <div className="mb-6 rounded-2xl border border-destructive/30 bg-destructive/5 p-4">
+          <p className="font-medium text-destructive">This episode was removed</p>
+          <p className="mt-1 text-sm text-muted-foreground">
+            It was reviewed against our Acceptable Use Policy and taken down on{" "}
+            {episode.moderatedAt.toLocaleDateString()}. Its public link and downloads are
+            disabled. If you think this was a mistake, reply to your support thread and we
+            will take another look.
+          </p>
+        </div>
+      ) : null}
+
       {episode.status === "FAILED" || inProgress ? (
         <GenerationProgress
           episodeId={episode.id}

app/(app)/episodes/[id]/repurpose/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import Link from "next/link";
 import { ArrowLeft } from "lucide-react";
@@ -10,6 +11,8 @@ import { Button } from "@/components/ui/button";
 type Format = "blog" | "social_thread" | "newsletter";
 type Content = { title: string; body: string } | null;
 
+export const metadata: Metadata = { title: "Repurpose episode" };
+
 export default async function RepurposePage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   const session = await requireAuth();

app/(app)/episodes/actions.ts

@@ -432,13 +432,20 @@ export async function setEpisodeShareAction(
 
   const episode = await prisma.episode.findUnique({
     where: { id: episodeId },
-    select: { userId: true, shareId: true, status: true },
+    select: { userId: true, shareId: true, status: true, moderatedAt: true },
   });
   if (!episode || (episode.userId !== session.user.id && session.user.role !== "admin")) {
     return { ok: false, error: "Not allowed." };
   }
 
   if (enabled) {
+    // An admin takedown must not be reversible by the owner simply re-sharing.
+    if (episode.moderatedAt) {
+      return {
+        ok: false,
+        error: "This episode was removed for a policy violation and can't be shared.",
+      };
+    }
     if (episode.status !== "READY") {
       return { ok: false, error: "Finish generating the episode before sharing it." };
     }

app/(app)/layout.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import Link from "next/link";
 import { Plus, Wrench } from "lucide-react";
 import { requireAuth } from "@/lib/auth/guards";
@@ -12,10 +13,15 @@ import { ImpersonationBanner } from "@/components/app/impersonation-banner";
 import { ThemeProvider } from "@/components/providers/theme-provider";
 import { Button } from "@/components/ui/button";
 import { Logo } from "@/components/ui/logo";
+import { NO_INDEX } from "@/lib/seo";
 
 // Authed, DB-backed dashboard — never statically prerender.
 export const dynamic = "force-dynamic";
 
+// Authenticated surface — never indexable. Metadata merges down, so every route
+// in this group inherits `noindex, nofollow` unless it explicitly overrides it.
+export const metadata: Metadata = NO_INDEX;
+
 export default async function AppLayout({ children }: { children: React.ReactNode }) {
   const session = await requireAuth();
   const activeOrgId = session.session.activeOrganizationId;

app/(app)/series/[id]/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import { notFound } from "next/navigation";
 import Link from "next/link";
 import { ArrowLeft } from "lucide-react";
@@ -9,6 +10,17 @@ import { EpisodeStatusBadge } from "@/components/app/episode-status-badge";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ id: string }>;
+}): Promise<Metadata> {
+  const { id } = await params;
+  // Title only — this is an authed page and the route group is already noindex.
+  const series = await prisma.series.findUnique({ where: { id }, select: { title: true } });
+  return { title: series?.title ?? "Series" };
+}
+
 export default async function SeriesDetailPage({ params }: { params: Promise<{ id: string }> }) {
   const { id } = await params;
   const session = await requireAuth();

app/(app)/series/actions.ts

@@ -13,6 +13,7 @@ import type { UsageMetric } from "@/lib/billing/plans";
 import { FORMAT_SPEAKERS } from "@/lib/episodes/options";
 import { DEFAULT_VOICE_IDS, VOICE_CATALOG } from "@/lib/ai/voices";
 import { isFlagEnabled } from "@/lib/flags";
+import { rateLimit, LIMITS } from "@/lib/ratelimit";
 
 const createSchema = z.object({
   theme: z.string().min(5).max(500),
@@ -30,6 +31,16 @@ export async function createSeriesAction(
   if (!(await subjectHasFeature(session.user.id, "series_generator", session.session.activeOrganizationId))) {
     return { ok: false, error: "The series generator requires the Pro plan." };
   }
+
+  // planSeason() below is an uncapped GPT-4o completion that is NOT metered
+  // against a monthly quota (unlike script/audio/art), so the rate limit is the
+  // only thing bounding AI spend here. Keep it tight — a season plan is a rare,
+  // deliberate action, so an hourly bucket is the right shape.
+  const rl = await rateLimit("series-plan", session.user.id, LIMITS.seriesPlan);
+  if (!rl.ok) {
+    return { ok: false, error: `Too many series plans. Try again in ${Math.ceil(rl.retryAfterSec! / 60)}m.` };
+  }
+
   if (!(await isFlagEnabled("episode_generation_enabled"))) {
     return { ok: false, error: "Generation is temporarily paused. Please try again shortly." };
   }
@@ -60,6 +71,11 @@ export async function generateFromSeriesAction(
   const session = await getServerSession();
   if (!session) return { ok: false, error: "You must be signed in." };
 
+  const rl = await rateLimit("generation", session.user.id, LIMITS.generation);
+  if (!rl.ok) {
+    return { ok: false, error: `Too many requests. Try again in ${rl.retryAfterSec}s.` };
+  }
+
   if (!(await isFlagEnabled("episode_generation_enabled"))) {
     return { ok: false, error: "Episode generation is temporarily paused. Please try again shortly." };
   }

app/(app)/settings/actions.ts

@@ -75,6 +75,193 @@ export async function savePreferencesAction(
  * cascades to sessions, accounts, episodes, series, usage and preferences. The
  * client signs out after a successful response.
  */
+export interface ActiveSession {
+  id: string;
+  createdAt: string;
+  expiresAt: string;
+  ipAddress: string | null;
+  userAgent: string | null;
+  current: boolean;
+}
+
+/**
+ * List the signed-in devices for the current user.
+ *
+ * Sessions are read straight from the DB (not the cookie cache) so a revoked
+ * session disappears immediately rather than lingering for the 60s cache window.
+ */
+export async function listSessionsAction(): Promise<{
+  ok: boolean;
+  error?: string;
+  sessions?: ActiveSession[];
+}> {
+  const session = await getServerSession();
+  if (!session) return { ok: false, error: "You must be signed in." };
+
+  const rows = await prisma.session.findMany({
+    where: { userId: session.user.id, expiresAt: { gt: new Date() } },
+    orderBy: { createdAt: "desc" },
+    select: {
+      id: true,
+      token: true,
+      createdAt: true,
+      expiresAt: true,
+      ipAddress: true,
+      userAgent: true,
+    },
+  });
+
+  return {
+    ok: true,
+    sessions: rows.map((r) => ({
+      id: r.id,
+      createdAt: r.createdAt.toISOString(),
+      expiresAt: r.expiresAt.toISOString(),
+      ipAddress: r.ipAddress,
+      userAgent: r.userAgent,
+      // Compare on the session token, never on the id: the token is what the
+      // cookie actually carries, so this is the reliable "this device" marker.
+      current: r.token === session.session.token,
+    })),
+  };
+}
+
+/**
+ * Revoke one of the current user's sessions (sign out that device).
+ *
+ * Scoped by userId so a session id belonging to someone else can never be
+ * revoked, and the current session is protected — signing yourself out from
+ * here would be indistinguishable from a bug. Use the normal sign-out for that.
+ */
+export async function revokeSessionAction(
+  sessionId: string
+): Promise<{ ok: boolean; error?: string }> {
+  const session = await getServerSession();
+  if (!session) return { ok: false, error: "You must be signed in." };
+
+  const target = await prisma.session.findFirst({
+    where: { id: sessionId, userId: session.user.id },
+    select: { id: true, token: true },
+  });
+  if (!target) return { ok: false, error: "Session not found." };
+  if (target.token === session.session.token) {
+    return { ok: false, error: "That's your current device — use Sign out instead." };
+  }
+
+  await prisma.session.delete({ where: { id: target.id } });
+  revalidatePath("/settings");
+  return { ok: true };
+}
+
+/** Sign out every other device, keeping the current one. */
+export async function revokeOtherSessionsAction(): Promise<{
+  ok: boolean;
+  error?: string;
+  count?: number;
+}> {
+  const session = await getServerSession();
+  if (!session) return { ok: false, error: "You must be signed in." };
+
+  const res = await prisma.session.deleteMany({
+    where: { userId: session.user.id, token: { not: session.session.token } },
+  });
+  revalidatePath("/settings");
+  return { ok: true, count: res.count };
+}
+
+/**
+ * Export everything we hold about the current user, as JSON (GDPR access
+ * request, self-serve).
+ *
+ * Deliberately excludes credentials: the `account` table holds password hashes
+ * and OAuth tokens, and nothing there is user-facing data. Media is referenced
+ * by storage key rather than inlined so the payload stays a reasonable size.
+ */
+export async function exportMyDataAction(): Promise<{
+  ok: boolean;
+  error?: string;
+  json?: string;
+}> {
+  const session = await getServerSession();
+  if (!session) return { ok: false, error: "You must be signed in." };
+  const userId = session.user.id;
+
+  const [user, preferences, episodes, series, subscriptions, usage, apiKeys, memberships] =
+    await Promise.all([
+      prisma.user.findUnique({
+        where: { id: userId },
+        select: {
+          id: true,
+          name: true,
+          email: true,
+          emailVerified: true,
+          image: true,
+          createdAt: true,
+          updatedAt: true,
+        },
+      }),
+      prisma.userPreferences.findUnique({ where: { userId } }),
+      prisma.episode.findMany({
+        where: { userId },
+        orderBy: { createdAt: "desc" },
+        select: {
+          id: true,
+          title: true,
+          topic: true,
+          tone: true,
+          format: true,
+          language: true,
+          targetLengthMin: true,
+          status: true,
+          shareId: true,
+          createdAt: true,
+          script: { select: { content: true } },
+          audioAsset: { select: { storageKey: true, durationSec: true, format: true } },
+          coverArt: { select: { storageKey: true } },
+          repurposed: { select: { type: true, content: true, createdAt: true } },
+        },
+      }),
+      prisma.series.findMany({ where: { userId } }),
+      prisma.subscription.findMany({
+        where: { referenceId: userId },
+        select: {
+          plan: true,
+          status: true,
+          billingInterval: true,
+          provider: true,
+          periodStart: true,
+          periodEnd: true,
+          cancelAtPeriodEnd: true,
+          createdAt: true,
+        },
+      }),
+      prisma.usageRecord.findMany({ where: { ownerId: userId, ownerType: "user" } }),
+      prisma.apiKey.findMany({
+        where: { userId },
+        select: { id: true, name: true, createdAt: true, revokedAt: true },
+      }),
+      prisma.member.findMany({
+        where: { userId },
+        select: { role: true, createdAt: true, organization: { select: { name: true } } },
+      }),
+    ]);
+
+  const payload = {
+    exportedAt: new Date().toISOString(),
+    note: "Credentials and authentication tokens are intentionally excluded. Audio and cover art are referenced by storage key; download them from each episode page.",
+    user,
+    preferences,
+    episodes,
+    series,
+    subscriptions,
+    usage,
+    apiKeys,
+    memberships,
+  };
+
+  return { ok: true, json: JSON.stringify(payload, null, 2) };
+}
+
 export async function deleteAccountAction(
   confirmEmail: string
 ): Promise<{ ok: boolean; error?: string }> {

app/(app)/team/actions.ts

@@ -93,6 +93,107 @@ export async function inviteMemberAction(
   return { ok: true };
 }
 
+/**
+ * Shared authorization for every workspace mutation: the caller must be an
+ * owner/admin of THIS organization. Returns the caller's role, or an error.
+ */
+async function requireOrgAdmin(
+  organizationId: string
+): Promise<{ ok: true; userId: string; role: string } | { ok: false; error: string }> {
+  const session = await getServerSession();
+  if (!session) return { ok: false, error: "You must be signed in." };
+  const member = await prisma.member.findFirst({
+    where: { organizationId, userId: session.user.id },
+    select: { role: true },
+  });
+  if (!member || !["owner", "admin"].includes(member.role)) {
+    return { ok: false, error: "Only workspace owners can manage members." };
+  }
+  return { ok: true, userId: session.user.id, role: member.role };
+}
+
+/**
+ * Remove a member, freeing their seat.
+ *
+ * Guards: only owner/admin may remove; nobody may remove themselves (that would
+ * orphan the workspace from the UI); and the last remaining owner is protected,
+ * otherwise a workspace can be left with no one able to administer it.
+ */
+export async function removeMemberAction(
+  organizationId: string,
+  memberId: string
+): Promise<{ ok: boolean; error?: string }> {
+  const auth = await requireOrgAdmin(organizationId);
+  if (!auth.ok) return { ok: false, error: auth.error };
+
+  const target = await prisma.member.findFirst({
+    where: { id: memberId, organizationId },
+    select: { id: true, userId: true, role: true },
+  });
+  if (!target) return { ok: false, error: "Member not found." };
+  if (target.userId === auth.userId) {
+    return { ok: false, error: "You can't remove yourself from the workspace." };
+  }
+  if (target.role === "owner") {
+    const owners = await prisma.member.count({ where: { organizationId, role: "owner" } });
+    if (owners <= 1) return { ok: false, error: "The workspace must keep at least one owner." };
+  }
+
+  await prisma.member.delete({ where: { id: target.id } });
+  revalidatePath("/team");
+  return { ok: true };
+}
+
+/** Change a member's workspace role. Same last-owner protection as removal. */
+export async function updateMemberRoleAction(
+  organizationId: string,
+  memberId: string,
+  role: "owner" | "admin" | "member"
+): Promise<{ ok: boolean; error?: string }> {
+  const auth = await requireOrgAdmin(organizationId);
+  if (!auth.ok) return { ok: false, error: auth.error };
+
+  // `role` is client-supplied and only TS-typed — validate it at runtime.
+  const parsedRole = z.enum(["owner", "admin", "member"]).safeParse(role);
+  if (!parsedRole.success) return { ok: false, error: "Invalid role." };
+
+  const target = await prisma.member.findFirst({
+    where: { id: memberId, organizationId },
+    select: { id: true, userId: true, role: true },
+  });
+  if (!target) return { ok: false, error: "Member not found." };
+  if (target.role === "owner" && parsedRole.data !== "owner") {
+    const owners = await prisma.member.count({ where: { organizationId, role: "owner" } });
+    if (owners <= 1) return { ok: false, error: "The workspace must keep at least one owner." };
+  }
+
+  await prisma.member.update({ where: { id: target.id }, data: { role: parsedRole.data } });
+  revalidatePath("/team");
+  return { ok: true };
+}
+
+/**
+ * Revoke a pending invitation, freeing the seat it was holding.
+ * Scoped to the organization so an id from another workspace can't be cancelled.
+ */
+export async function revokeInvitationAction(
+  organizationId: string,
+  invitationId: string
+): Promise<{ ok: boolean; error?: string }> {
+  const auth = await requireOrgAdmin(organizationId);
+  if (!auth.ok) return { ok: false, error: auth.error };
+
+  const invite = await prisma.invitation.findFirst({
+    where: { id: invitationId, organizationId, status: "pending" },
+    select: { id: true },
+  });
+  if (!invite) return { ok: false, error: "Invitation not found." };
+
+  await prisma.invitation.update({ where: { id: invite.id }, data: { status: "canceled" } });
+  revalidatePath("/team");
+  return { ok: true };
+}
+
 export async function saveBrandingAction(
   organizationId: string,
   data: z.infer<typeof brandingSchema>

app/(app)/team/page.tsx

@@ -43,7 +43,31 @@ export default async function TeamPage() {
   });
   const org = membership?.organization ?? null;
   const members =
-    org?.members.map((m) => ({ id: m.id, name: m.user.name, email: m.user.email, role: m.role })) ?? [];
+    org?.members.map((m) => ({
+      id: m.id,
+      userId: m.userId,
+      name: m.user.name,
+      email: m.user.email,
+      role: m.role,
+    })) ?? [];
+
+  // Pending invitations hold a seat until accepted or revoked, so they belong on
+  // this screen next to members — otherwise a workspace can look under-capacity
+  // while every seat is actually spoken for.
+  const invitations = org
+    ? (
+        await prisma.invitation.findMany({
+          where: { organizationId: org.id, status: "pending" },
+          orderBy: { expiresAt: "desc" },
+          select: { id: true, email: true, role: true, expiresAt: true },
+        })
+      ).map((i) => ({
+        id: i.id,
+        email: i.email,
+        role: i.role ?? "member",
+        expiresAt: i.expiresAt.toISOString(),
+      }))
+    : [];
 
   return (
     <>
@@ -51,6 +75,8 @@ export default async function TeamPage() {
       <TeamClient
         org={org ? { id: org.id, name: org.name } : null}
         members={members}
+        invitations={invitations}
+        currentUserId={session.user.id}
         branding={
           org?.branding
             ? {

app/(auth)/forgot-password/page.tsx

@@ -1,8 +1,9 @@
 import type { Metadata } from "next";
 import { ForgotPasswordForm } from "@/components/auth/forgot-password-form";
+import { getTurnstileSiteKey } from "@/lib/auth/turnstile";
 
 export const metadata: Metadata = { title: "Forgot password" };
 
 export default function ForgotPasswordPage() {
-  return <ForgotPasswordForm />;
+  return <ForgotPasswordForm turnstileSiteKey={getTurnstileSiteKey()} />;
 }

app/(auth)/layout.tsx

@@ -1,5 +1,12 @@
+import type { Metadata } from "next";
 import Link from "next/link";
 import { Logo } from "@/components/ui/logo";
+import { NO_INDEX } from "@/lib/seo";
+
+// Sign-in / sign-up / password-reset screens. Thin, duplicate-prone, and the
+// middleware appends a ?redirect= query to /sign-in for every gated URL — which
+// would otherwise generate unlimited indexable variants of the same page.
+export const metadata: Metadata = NO_INDEX;
 
 export default function AuthLayout({ children }: { children: React.ReactNode }) {
   return (

app/(auth)/sign-in/page.tsx

@@ -3,6 +3,7 @@ import type { Metadata } from "next";
 import { redirect } from "next/navigation";
 import { getServerSession } from "@/lib/auth/guards";
 import { SignInForm } from "@/components/auth/sign-in-form";
+import { getTurnstileSiteKey } from "@/lib/auth/turnstile";
 
 export const metadata: Metadata = { title: "Sign in" };
 
@@ -12,7 +13,7 @@ export default async function SignInPage() {
   const googleEnabled = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
   return (
     <Suspense>
-      <SignInForm googleEnabled={googleEnabled} />
+      <SignInForm googleEnabled={googleEnabled} turnstileSiteKey={getTurnstileSiteKey()} />
     </Suspense>
   );
 }

app/(auth)/sign-up/page.tsx

@@ -4,6 +4,7 @@ import { redirect } from "next/navigation";
 import { getServerSession } from "@/lib/auth/guards";
 import { isFlagEnabled } from "@/lib/flags";
 import { SignUpForm } from "@/components/auth/sign-up-form";
+import { getTurnstileSiteKey } from "@/lib/auth/turnstile";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 
@@ -32,5 +33,5 @@ export default async function SignUpPage() {
   }
 
   const googleEnabled = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
-  return <SignUpForm googleEnabled={googleEnabled} />;
+  return <SignUpForm googleEnabled={googleEnabled} turnstileSiteKey={getTurnstileSiteKey()} />;
 }

app/(marketing)/about/page.tsx

@@ -10,12 +10,19 @@ import {
   ArrowRight,
 } from "lucide-react";
 import { Button } from "@/components/ui/button";
+import { JsonLd } from "@/components/seo/json-ld";
+import { breadcrumbSchema, graph, webPageSchema } from "@/lib/schema";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = {
+/** Shared by the page metadata and this page's structured data. */
+const DESCRIPTION =
+  "Podcast Distribution AI is an AI studio that turns a single idea into a finished, publishable podcast — script, voices, and cover art — in minutes. Learn why we built it and what we believe.";
+
+export const metadata: Metadata = pageMetadata({
   title: "About",
-  description:
-    "Podcast Distribution AI is an AI studio that turns a single idea into a finished, publishable podcast — script, voices, and cover art — in minutes. Learn why we built it and what we believe.",
-};
+  description: DESCRIPTION,
+  path: "/about",
+});
 
 const STATS = [
   { value: "3", label: "AI models in one workflow" },
@@ -60,6 +67,20 @@ const VALUES = [
 export default function AboutPage() {
   return (
     <>
+      <JsonLd
+        data={graph(
+          {
+            ...webPageSchema({
+              path: "/about",
+              name: "About",
+              description: DESCRIPTION,
+            }),
+            "@type": "AboutPage",
+          },
+          breadcrumbSchema([{ name: "About", path: "/about" }])
+        )}
+      />
+
       {/* Hero */}
       <section className="bg-hero-wash">
         <div className="container max-w-4xl py-24 text-center md:py-32">

app/(marketing)/acceptable-use/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Acceptable Use Policy" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/acceptable-use";
+const DESCRIPTION =
+  "What you may and may not create with Podcast Distribution AI — prohibited content, voice and likeness rules, rate limits, and how we enforce them.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Acceptable Use Policy",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -60,6 +70,8 @@ export default function AcceptableUsePage() {
       updated={UPDATED}
       intro="We want Podcast Distribution AI to be a safe, trustworthy place to create. This policy describes the content and conduct that are not allowed on the platform."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(marketing)/cookies/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Cookie Policy" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/cookies";
+const DESCRIPTION =
+  "Which cookies Podcast Distribution AI sets and what each one does. We use only the cookies required to keep you signed in and the service secure.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Cookie Policy",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -52,6 +62,8 @@ export default function CookiePolicyPage() {
       updated={UPDATED}
       intro="This Cookie Policy explains how Podcast Distribution AI uses cookies and similar technologies, and the choices available to you. It should be read together with our Privacy Policy."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(marketing)/faq/page.tsx

@@ -2,12 +2,19 @@ import type { Metadata } from "next";
 import Link from "next/link";
 import { ChevronDown, ArrowRight } from "lucide-react";
 import { Button } from "@/components/ui/button";
+import { JsonLd } from "@/components/seo/json-ld";
+import { breadcrumbSchema, faqPageSchema, graph, webPageSchema } from "@/lib/schema";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = {
+/** Shared by the page metadata and this page's structured data. */
+const DESCRIPTION =
+  "Answers to common questions about creating AI podcasts with Podcast Distribution AI — generation, voices, languages, plans, billing, repurposing, the API, and teams.";
+
+export const metadata: Metadata = pageMetadata({
   title: "FAQ",
-  description:
-    "Answers to common questions about creating AI podcasts with Podcast Distribution AI — generation, voices, languages, plans, billing, repurposing, the API, and teams.",
-};
+  description: DESCRIPTION,
+  path: "/faq",
+});
 
 interface QA {
   q: string;
@@ -129,6 +136,14 @@ const FAQ: Category[] = [
 export default function FaqPage() {
   return (
     <div className="bg-hero-wash">
+      <JsonLd
+        data={graph(
+          webPageSchema({ path: "/faq", name: "FAQ", description: DESCRIPTION }),
+          breadcrumbSchema([{ name: "FAQ", path: "/faq" }]),
+          // Flattened across categories — FAQPage takes one list of questions.
+          faqPageSchema(FAQ.flatMap((category) => category.items))
+        )}
+      />
       <div className="container max-w-3xl py-20 md:py-28">
         <div className="text-center">
           <p className="text-[13px] font-semibold uppercase tracking-[0.04em] text-brand">Support</p>

app/(marketing)/features/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from "next";
+import Image from "next/image";
 import Link from "next/link";
 import {
   ArrowRight,
@@ -33,12 +34,19 @@ import {
 import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
+import { JsonLd } from "@/components/seo/json-ld";
+import { breadcrumbSchema, graph, softwareApplicationSchema, webPageSchema } from "@/lib/schema";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = {
+/** Shared by the page metadata and this page's structured data. */
+const DESCRIPTION =
+  "Everything Podcast Distribution AI does — AI scriptwriting, realistic multi-voice audio, cover art, repurposing, a season generator, 13+ languages, team white-label, an API, and more.";
+
+export const metadata: Metadata = pageMetadata({
   title: "Features",
-  description:
-    "Everything Podcast Distribution AI does — AI scriptwriting, realistic multi-voice audio, cover art, repurposing, a season generator, 13+ languages, team white-label, an API, and more.",
-};
+  description: DESCRIPTION,
+  path: "/features",
+});
 
 const HERO_IMG =
   "https://images.unsplash.com/photo-1590602847861-f357a9332bbc?auto=format&fit=crop&w=1600&q=80";
@@ -50,6 +58,18 @@ const TEAM_IMG =
 export default function FeaturesPage() {
   return (
     <>
+      <JsonLd
+        data={graph(
+          webPageSchema({
+            path: "/features",
+            name: "Features",
+            description: DESCRIPTION,
+          }),
+          breadcrumbSchema([{ name: "Features", path: "/features" }]),
+          softwareApplicationSchema()
+        )}
+      />
+
       {/* 1 — Hero */}
       <section className="relative overflow-hidden bg-hero-wash">
         <div className="container grid items-center gap-12 py-20 md:grid-cols-2 md:py-28">
@@ -79,13 +99,16 @@ export default function FeaturesPage() {
           </div>
           <div className="relative">
             <div className="overflow-hidden rounded-3xl border border-border shadow-xl">
-              {/* eslint-disable-next-line @next/next/no-img-element */}
-              <img
+              {/* Above the fold — the LCP element on this page, so it is
+                  fetched eagerly at high priority rather than lazily. */}
+              <Image
                 src={HERO_IMG}
                 alt="Studio condenser microphone"
                 className="h-full w-full object-cover"
                 width={1600}
                 height={1067}
+                sizes="(max-width: 768px) 100vw, 50vw"
+                priority
               />
             </div>
             <div className="absolute -bottom-5 -left-5 hidden rounded-2xl border border-border bg-card p-4 shadow-lg sm:block">
@@ -534,8 +557,16 @@ function FeatureBand({
         <div className={reverse ? "md:order-1" : ""}>
           {image ? (
             <div className="overflow-hidden rounded-3xl border border-border shadow-xl">
-              {/* eslint-disable-next-line @next/next/no-img-element */}
-              <img src={image} alt={imageAlt ?? ""} className="h-full w-full object-cover" width={1400} height={933} />
+              {/* Below the fold — lazy by default, and served in a modern
+                  format at the size the column actually renders at. */}
+              <Image
+                src={image}
+                alt={imageAlt ?? ""}
+                className="h-full w-full object-cover"
+                width={1400}
+                height={933}
+                sizes="(max-width: 768px) 100vw, 50vw"
+              />
             </div>
           ) : (
             visual

app/(marketing)/layout.tsx

@@ -1,9 +1,14 @@
 import { SiteHeader } from "@/components/marketing/site-header";
 import { SiteFooter } from "@/components/marketing/site-footer";
+import { JsonLd } from "@/components/seo/json-ld";
+import { graph, organizationSchema, websiteSchema } from "@/lib/schema";
 
 export default function MarketingLayout({ children }: { children: React.ReactNode }) {
   return (
     <div className="flex min-h-screen flex-col">
+      {/* Publisher identity, emitted once for every public marketing page. Pages
+          add their own nodes (WebPage, BreadcrumbList, FAQPage…) on top. */}
+      <JsonLd data={graph(organizationSchema(), websiteSchema())} />
       <SiteHeader />
       <main className="flex-1">{children}</main>
       <SiteFooter />

app/(marketing)/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import Link from "next/link";
 import {
   ArrowRight,
@@ -14,12 +15,32 @@ import {
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent } from "@/components/ui/card";
+import { JsonLd } from "@/components/seo/json-ld";
 import { PLAN_ORDER, PLANS } from "@/lib/billing/plans";
+import { graph, softwareApplicationSchema, webPageSchema } from "@/lib/schema";
+import { SITE_DESCRIPTION, SITE_TAGLINE, absoluteUrl } from "@/lib/seo";
 import { formatPrice } from "@/lib/utils";
 
+export const metadata: Metadata = {
+  // The homepage keeps the root layout's title/description (they are already
+  // written for it); it only needs an explicit self-referencing canonical.
+  alternates: { canonical: absoluteUrl("/") },
+};
+
 export default function LandingPage() {
   return (
     <>
+      <JsonLd
+        data={graph(
+          webPageSchema({
+            path: "/",
+            name: SITE_TAGLINE,
+            description: SITE_DESCRIPTION,
+          }),
+          softwareApplicationSchema()
+        )}
+      />
+
       {/* Hero */}
       <section className="relative overflow-hidden bg-hero-wash">
         <div className="container flex flex-col items-center gap-7 py-24 text-center md:py-36">

app/(marketing)/pricing/page.tsx

@@ -6,15 +6,34 @@ import { Badge } from "@/components/ui/badge";
 import { Card, CardContent } from "@/components/ui/card";
 import { PLAN_ORDER, PLANS } from "@/lib/billing/plans";
 import { formatPrice } from "@/lib/utils";
+import { JsonLd } from "@/components/seo/json-ld";
+import { breadcrumbSchema, graph, softwareApplicationSchema, webPageSchema } from "@/lib/schema";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = {
+/** Shared by the page metadata and this page's structured data. */
+const DESCRIPTION =
+  "Simple plans for every podcaster — start free with 3 scripts a month and upgrade for unlimited scripts, longer episodes, an API, and a white-label team workspace.";
+
+export const metadata: Metadata = pageMetadata({
   title: "Pricing",
-  description: "Simple plans for every podcaster — start free and upgrade as you grow.",
-};
+  description: DESCRIPTION,
+  path: "/pricing",
+});
 
 export default function PricingPage() {
   return (
     <div className="bg-hero-wash">
+      <JsonLd
+        data={graph(
+          webPageSchema({
+            path: "/pricing",
+            name: "Pricing",
+            description: DESCRIPTION,
+          }),
+          breadcrumbSchema([{ name: "Pricing", path: "/pricing" }]),
+          softwareApplicationSchema()
+        )}
+      />
       <div className="container py-24 md:py-28">
         <div className="mx-auto max-w-2xl text-center">
           <p className="text-[13px] font-semibold uppercase tracking-[0.04em] text-brand">Pricing</p>

app/(marketing)/privacy/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Privacy Policy" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/privacy";
+const DESCRIPTION =
+  "How Podcast Distribution AI collects, uses, stores and protects your personal data and generated content — and the rights you have over it.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Privacy Policy",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -102,6 +112,8 @@ export default function PrivacyPage() {
       updated={UPDATED}
       intro="This Privacy Policy explains what information Podcast Distribution AI collects, how we use it, who we share it with, and the choices you have. It applies to your use of the Podcast Distribution AI website and application."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(marketing)/refunds/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Refund & Cancellation Policy" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/refunds";
+const DESCRIPTION =
+  "How subscriptions, renewals, cancellations and refunds work at Podcast Distribution AI, including statutory withdrawal rights and billing disputes.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Refund & Cancellation Policy",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -61,6 +71,8 @@ export default function RefundsPage() {
       updated={UPDATED}
       intro="This policy explains how billing, renewals, cancellations, and refunds work for Podcast Distribution AI subscriptions. It forms part of our Terms of Service."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(marketing)/subprocessors/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Subprocessors" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/subprocessors";
+const DESCRIPTION =
+  "The third-party providers that process data on behalf of Podcast Distribution AI — AI generation, payments, transactional email and hosting.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Subprocessors",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -60,6 +70,8 @@ export default function SubprocessorsPage() {
       updated={UPDATED}
       intro="This page lists the third-party providers Podcast Distribution AI relies on to deliver the service and the data each one processes. It supports our Privacy Policy and is provided for transparency."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(marketing)/terms/page.tsx

@@ -1,7 +1,17 @@
 import type { Metadata } from "next";
 import { LegalDoc, type LegalSection } from "@/components/marketing/legal-doc";
+import { pageMetadata } from "@/lib/seo";
 
-export const metadata: Metadata = { title: "Terms of Service" };
+/** Shared by the page metadata and the document's structured data. */
+const PATH = "/terms";
+const DESCRIPTION =
+  "The Terms of Service governing your use of Podcast Distribution AI — accounts, plans and billing, acceptable use, content ownership, warranties and liability.";
+
+export const metadata: Metadata = pageMetadata({
+  title: "Terms of Service",
+  description: DESCRIPTION,
+  path: PATH,
+});
 
 const UPDATED = "June 7, 2026";
 
@@ -101,6 +111,8 @@ export default function TermsPage() {
       updated={UPDATED}
       intro="These Terms of Service govern your access to and use of Podcast Distribution AI. Please read them carefully — they include important information about your rights, billing, acceptable use, and the limits of our liability."
       sections={SECTIONS}
+      path={PATH}
+      description={DESCRIPTION}
     />
   );
 }

app/(public)/p/[shareId]/page.tsx

@@ -8,17 +8,28 @@ import { WaveformPlayer } from "@/components/app/waveform-player";
 import { Card, CardContent } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { Logo } from "@/components/ui/logo";
+import { SITE_NAME, absoluteUrl } from "@/lib/seo";
 import type { StructuredScript } from "@/lib/ai/types";
 
 export const dynamic = "force-dynamic";
 
+/** Trim to `max` characters on a word boundary, for meta descriptions. */
+function truncate(text: string, max: number): string {
+  const collapsed = text.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= max) return collapsed;
+  const cut = collapsed.slice(0, max - 1);
+  const lastSpace = cut.lastIndexOf(" ");
+  return `${(lastSpace > max * 0.6 ? cut.slice(0, lastSpace) : cut).trimEnd()}…`;
+}
+
 async function loadShared(shareId: string) {
   const episode = await prisma.episode.findUnique({
     where: { shareId },
     include: { audioAsset: true, coverArt: true, script: true, speakers: true },
   });
   // 404 when no episode, sharing disabled, or not finished.
-  if (!episode || !episode.shareId || episode.status !== "READY") return null;
+  // moderatedAt = taken down by an admin: treat exactly like a missing share.
+  if (!episode || !episode.shareId || episode.moderatedAt || episode.status !== "READY") return null;
   return episode;
 }
 
@@ -29,11 +40,33 @@ export async function generateMetadata({
 }): Promise<Metadata> {
   const { shareId } = await params;
   const episode = await loadShared(shareId);
-  if (!episode) return { title: "Episode not found" };
+  if (!episode) return { title: "Episode not found", robots: { index: false, follow: false } };
+
+  const url = absoluteUrl(`/p/${shareId}`);
+  const description = truncate(episode.topic, 160);
+  // Share links are unlisted by design, so they stay out of the index — but they
+  // are made to be pasted into chat and social, so the unfurl has to be complete.
+  const cover = episode.coverArt ? absoluteUrl(`/api/public/episodes/${shareId}/cover`) : undefined;
+
   return {
     title: episode.title,
-    description: episode.topic.slice(0, 160),
-    robots: { index: false },
+    description,
+    robots: { index: false, follow: false, nocache: true },
+    openGraph: {
+      type: "article",
+      title: episode.title,
+      description,
+      url,
+      siteName: SITE_NAME,
+      ...(cover ? { images: [{ url: cover, alt: `Cover art for ${episode.title}` }] } : {}),
+    },
+    twitter: {
+      // The cover is square, so the compact card frames it better than a wide one.
+      card: cover ? "summary" : "summary_large_image",
+      title: episode.title,
+      description,
+      ...(cover ? { images: [cover] } : {}),
+    },
   };
 }
 

app/api/assets/[...key]/route.ts

@@ -33,15 +33,25 @@ export async function GET(
 
   // Resolve the owning episode from the asset record so we can authorize.
   const [audio, art] = await Promise.all([
-    prisma.audioAsset.findFirst({ where: { storageKey: key }, select: { episode: { select: { userId: true } } } }),
-    prisma.coverArt.findFirst({ where: { storageKey: key }, select: { episode: { select: { userId: true } } } }),
+    prisma.audioAsset.findFirst({
+      where: { storageKey: key },
+      select: { episode: { select: { userId: true, moderatedAt: true } } },
+    }),
+    prisma.coverArt.findFirst({
+      where: { storageKey: key },
+      select: { episode: { select: { userId: true, moderatedAt: true } } },
+    }),
   ]);
-  const ownerId = audio?.episode.userId ?? art?.episode.userId;
-  if (!ownerId) return new Response("Not found", { status: 404 });
+  const owningEpisode = audio?.episode ?? art?.episode;
+  if (!owningEpisode) return new Response("Not found", { status: 404 });
 
-  const isOwner = ownerId === session.user.id;
+  const isOwner = owningEpisode.userId === session.user.id;
   const isAdmin = session.user.role === "admin";
   if (!isOwner && !isAdmin) return new Response("Forbidden", { status: 403 });
+  // Admins keep access to removed media for appeals; the owner does not.
+  if (owningEpisode.moderatedAt && !isAdmin) {
+    return new Response("This episode was removed for a policy violation.", { status: 451 });
+  }
 
   // Stream off disk instead of buffering the whole file into memory.
   const total = await storage().size(key);

app/api/episodes/[id]/export/route.ts

@@ -3,6 +3,7 @@ import JSZip from "jszip";
 import { getServerSession } from "@/lib/auth/guards";
 import { prisma } from "@/lib/db";
 import { storage } from "@/lib/storage";
+import { rateLimit, LIMITS } from "@/lib/ratelimit";
 import type { StructuredScript } from "@/lib/ai/types";
 
 export const dynamic = "force-dynamic";
@@ -25,6 +26,16 @@ export async function GET(
   const session = await getServerSession();
   if (!session) return new Response("Unauthorized", { status: 401 });
 
+  // This handler buffers the full MP3 + cover into a JSZip in memory, so an
+  // authenticated user looping it is a cheap way to exhaust the heap.
+  const rl = await rateLimit("export", session.user.id, LIMITS.export);
+  if (!rl.ok) {
+    return new Response("Too many exports. Please slow down.", {
+      status: 429,
+      headers: { "Retry-After": String(rl.retryAfterSec ?? 60) },
+    });
+  }
+
   const episode = await prisma.episode.findUnique({
     where: { id },
     include: {
@@ -38,6 +49,11 @@ export async function GET(
   if (episode.userId !== session.user.id && session.user.role !== "admin") {
     return new Response("Forbidden", { status: 403 });
   }
+  // Removed content stays downloadable for admins (evidence/appeals) but not
+  // for the owner, who would otherwise just re-publish it elsewhere.
+  if (episode.moderatedAt && session.user.role !== "admin") {
+    return new Response("This episode was removed for a policy violation.", { status: 451 });
+  }
 
   const speakerNames: Record<string, string> = {};
   for (const s of episode.speakers) speakerNames[s.speakerKey] = s.displayName;

app/api/public/episodes/[shareId]/audio/route.ts

@@ -37,7 +37,9 @@ export async function GET(
   const { shareId } = await params;
 
   const episode = await prisma.episode.findUnique({
-    where: { shareId },
+    // A removed episode must be unreachable even if a share link is still
+    // circulating; moderatedAt is the takedown marker.
+    where: { shareId, moderatedAt: null },
     select: { audioAsset: { select: { storageKey: true } } },
   });
   const key = episode?.audioAsset?.storageKey;

app/api/public/episodes/[shareId]/cover/route.ts

@@ -42,7 +42,9 @@ export async function GET(
   const { shareId } = await params;
 
   const episode = await prisma.episode.findUnique({
-    where: { shareId },
+    // A removed episode must be unreachable even if a share link is still
+    // circulating; moderatedAt is the takedown marker.
+    where: { shareId, moderatedAt: null },
     select: { coverArt: { select: { storageKey: true } } },
   });
   const key = episode?.coverArt?.storageKey;

app/api/v1/episodes/route.ts

@@ -2,7 +2,7 @@ import { NextRequest } from "next/server";
 import { z } from "zod";
 import { verifyApiKey, bearerKey } from "@/lib/apikeys";
 import { prisma } from "@/lib/db";
-import { getEffectivePlan } from "@/lib/billing/subscription";
+import { getEffectivePlan, subjectHasFeature } from "@/lib/billing/subscription";
 import { reserveLimit, LimitExceededError } from "@/lib/usage/limits";
 import { refundUsage } from "@/lib/usage/meter";
 import { enqueueEpisodeGeneration } from "@/lib/queue/pgboss";
@@ -19,11 +19,30 @@ async function authorize(req: NextRequest) {
   return verifyApiKey(bearerKey(req.headers.get("authorization")));
 }
 
+/**
+ * Re-check the `api_access` entitlement on every request.
+ *
+ * Key CREATION gates on this feature, but a key outlives the subscription that
+ * minted it: without this check a user could subscribe, mint a key, downgrade to
+ * Free, and keep programmatic access to a paid feature indefinitely.
+ * Returns a 402 Response when the entitlement is gone, else null.
+ */
+async function requireApiAccess(userId: string): Promise<Response | null> {
+  if (await subjectHasFeature(userId, "api_access")) return null;
+  return Response.json(
+    { error: "API access requires an active Pro or Agency plan." },
+    { status: 402 }
+  );
+}
+
 /** GET /api/v1/episodes — list the caller's episodes. */
 export async function GET(req: NextRequest) {
   const auth = await authorize(req);
   if (!auth) return Response.json({ error: "Invalid API key" }, { status: 401 });
 
+  const denied = await requireApiAccess(auth.userId);
+  if (denied) return denied;
+
   const rl = await rateLimit("read", auth.userId, LIMITS.read);
   if (!rl.ok) {
     return Response.json(
@@ -56,6 +75,9 @@ export async function POST(req: NextRequest) {
   const auth = await authorize(req);
   if (!auth) return Response.json({ error: "Invalid API key" }, { status: 401 });
 
+  const denied = await requireApiAccess(auth.userId);
+  if (denied) return denied;
+
   const rl = await rateLimit("api", auth.userId, LIMITS.api);
   if (!rl.ok) {
     return Response.json(

app/api/webhooks/paypal/route.ts

@@ -2,9 +2,20 @@ import { NextRequest } from "next/server";
 import { verifyPaypalWebhook } from "@/lib/billing/paypal";
 import { handlePaypalEvent } from "@/lib/billing/webhooks/paypal";
 import { alreadyProcessed, logWebhook } from "@/lib/billing/webhook-log";
+import { rateLimit, LIMITS } from "@/lib/ratelimit";
 
 export const dynamic = "force-dynamic";
 
+/** Best-effort client IP for anonymous rate limiting. */
+function clientKey(req: NextRequest): string {
+  const fwd = req.headers.get("x-forwarded-for");
+  if (fwd) return fwd.split(",")[0].trim();
+  return req.headers.get("x-real-ip") ?? "anon";
+}
+
+// PayPal webhook bodies are small; anything larger is not a real event.
+const MAX_BODY_BYTES = 1_000_000;
+
 const SIG_HEADERS = [
   "paypal-auth-algo",
   "paypal-cert-url",
@@ -14,9 +25,44 @@ const SIG_HEADERS = [
 ];
 
 export async function POST(req: NextRequest) {
-  const body = await req.text();
+  // This endpoint is unauthenticated and verification is done by CALLING PayPal,
+  // so every request costs us an outbound API call. Throttle per IP, and reject
+  // obviously-bogus requests before spending anything.
+  const rl = await rateLimit("paypal-webhook", clientKey(req), LIMITS.webhook);
+  if (!rl.ok) {
+    return new Response("Too many requests", {
+      status: 429,
+      headers: { "Retry-After": String(rl.retryAfterSec ?? 60) },
+    });
+  }
+
   const headers: Record<string, string | undefined> = {};
   for (const h of SIG_HEADERS) headers[h] = req.headers.get(h) ?? undefined;
+  // A genuine PayPal delivery always carries all five signature headers. Bailing
+  // here costs nothing, whereas verifyPaypalWebhook() would hit the network.
+  if (SIG_HEADERS.some((h) => !headers[h])) {
+    return new Response("Invalid signature", { status: 400 });
+  }
+
+  // Check the declared size BEFORE reading, so an oversized body is never
+  // materialized in memory. The post-read check still backstops a missing or
+  // lying Content-Length.
+  const declared = Number(req.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+    return new Response("Payload too large", { status: 413 });
+  }
+
+  const body = await req.text();
+  if (body.length > MAX_BODY_BYTES) {
+    return new Response("Payload too large", { status: 413 });
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return new Response("Invalid payload", { status: 400 });
+  }
 
   const verified = await verifyPaypalWebhook(headers, body).catch(() => false);
   if (!verified) {
@@ -24,7 +70,7 @@ export async function POST(req: NextRequest) {
     return new Response("Invalid signature", { status: 400 });
   }
 
-  const event = JSON.parse(body) as { id?: string; event_type?: string };
+  const event = parsed as { id?: string; event_type?: string };
   const eventId = event.id ?? `paypal_${Date.now()}`;
   if (event.id && (await alreadyProcessed(eventId))) return new Response("ok (duplicate)");
 

app/layout.tsx

@@ -1,6 +1,9 @@
-import type { Metadata } from "next";
+import type { Metadata, Viewport } from "next";
 import { Wix_Madefor_Text, Wix_Madefor_Display } from "next/font/google";
 import { Toaster } from "sonner";
+import { UmamiAnalytics } from "@/components/analytics/umami";
+import { umamiConfig } from "@/lib/analytics";
+import { SITE_DESCRIPTION, SITE_NAME, SITE_TAGLINE, SITE_URL, absoluteUrl } from "@/lib/seo";
 import "./globals.css";
 
 // Wix Madefor — the platform typeface (body + UI)
@@ -18,21 +21,78 @@ const madeforDisplay = Wix_Madefor_Display({
 });
 
 export const metadata: Metadata = {
+  metadataBase: new URL(SITE_URL),
   title: {
-    default: "Podcast Distribution AI — From topic idea to published podcast in minutes",
-    template: "%s · Podcast Distribution AI",
+    default: `${SITE_NAME} — ${SITE_TAGLINE}`,
+    template: `%s · ${SITE_NAME}`,
   },
-  description:
-    "Podcast Distribution AI is an all-in-one AI platform that writes your script, records realistic multi-voice audio, and designs cover art — turning a topic into a finished episode in minutes.",
-  metadataBase: new URL(process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000"),
+  description: SITE_DESCRIPTION,
+  applicationName: SITE_NAME,
+  authors: [{ name: SITE_NAME, url: absoluteUrl("/") }],
+  creator: SITE_NAME,
+  publisher: SITE_NAME,
+  category: "technology",
+  keywords: [
+    "AI podcast generator",
+    "podcast script generator",
+    "AI voice over",
+    "text to speech podcast",
+    "podcast cover art generator",
+    "AI podcast production",
+    "content repurposing",
+    "multi-voice AI audio",
+  ],
+  // Every route gets a self-referencing canonical; pages override this with their
+  // own absolute URL via `pageMetadata()` so query strings never fragment a page.
+  alternates: { canonical: absoluteUrl("/") },
   openGraph: {
-    title: "Podcast Distribution AI",
-    description: "Create scripted, narrated, illustrated podcasts with AI — no recording gear required.",
     type: "website",
+    siteName: SITE_NAME,
+    title: `${SITE_NAME} — ${SITE_TAGLINE}`,
+    description: SITE_DESCRIPTION,
+    url: absoluteUrl("/"),
+    locale: "en_US",
+  },
+  twitter: {
+    card: "summary_large_image",
+    title: `${SITE_NAME} — ${SITE_TAGLINE}`,
+    description: SITE_DESCRIPTION,
+  },
+  robots: {
+    index: true,
+    follow: true,
+    googleBot: {
+      index: true,
+      follow: true,
+      "max-image-preview": "large",
+      "max-snippet": -1,
+      "max-video-preview": -1,
+    },
+  },
+  formatDetection: { telephone: false, address: false, email: false },
+  // Search-console ownership tokens; unset values are simply omitted.
+  verification: {
+    google: process.env.NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION,
+    other: process.env.NEXT_PUBLIC_BING_SITE_VERIFICATION
+      ? { "msvalidate.01": process.env.NEXT_PUBLIC_BING_SITE_VERIFICATION }
+      : {},
   },
 };
 
+export const viewport: Viewport = {
+  themeColor: [
+    { media: "(prefers-color-scheme: light)", color: "#ffffff" },
+    { media: "(prefers-color-scheme: dark)", color: "#0d0d0d" },
+  ],
+  colorScheme: "light dark",
+  width: "device-width",
+  initialScale: 1,
+};
+
 export default function RootLayout({ children }: { children: React.ReactNode }) {
+  // Absent config (the default in development) renders nothing at all.
+  const umami = umamiConfig();
+
   return (
     <html lang="en" suppressHydrationWarning>
       <body
@@ -40,6 +100,7 @@ export default function RootLayout({ children }: { children: React.ReactNode })
       >
         {children}
         <Toaster richColors position="top-center" />
+        {umami && <UmamiAnalytics websiteId={umami.websiteId} />}
       </body>
     </html>
   );

app/manifest.ts

@@ -0,0 +1,25 @@
+import type { MetadataRoute } from "next";
+import { BRAND_HEX, SITE_DESCRIPTION, SITE_NAME } from "@/lib/seo";
+
+/** Web app manifest — installability + correct branding in browser UI. */
+export default function manifest(): MetadataRoute.Manifest {
+  return {
+    name: SITE_NAME,
+    short_name: "Podcast AI",
+    description: SITE_DESCRIPTION,
+    start_url: "/dashboard",
+    scope: "/",
+    display: "standalone",
+    background_color: "#ffffff",
+    theme_color: BRAND_HEX,
+    categories: ["productivity", "music", "business"],
+    // Both files live in app/ as Next icon conventions, so these URLs are stable.
+    icons: [
+      { src: "/icon.png", sizes: "512x512", type: "image/png", purpose: "any" },
+      // Maskable: Android crops to a circle/squircle, and the brand mark has
+      // enough padding inside the 512 canvas to survive that crop.
+      { src: "/icon.png", sizes: "512x512", type: "image/png", purpose: "maskable" },
+      { src: "/apple-icon.png", sizes: "180x180", type: "image/png", purpose: "any" },
+    ],
+  };
+}

app/not-found.tsx

@@ -0,0 +1,65 @@
+import type { Metadata } from "next";
+import Link from "next/link";
+import { ArrowRight } from "lucide-react";
+import { SiteFooter } from "@/components/marketing/site-footer";
+import { SiteHeader } from "@/components/marketing/site-header";
+import { Button } from "@/components/ui/button";
+import { NO_INDEX } from "@/lib/seo";
+
+// A 404 already carries the right status code; the meta tag is belt-and-braces
+// for crawlers that reach this shell through a soft link.
+export const metadata: Metadata = { title: "Page not found", ...NO_INDEX };
+
+/** Popular destinations, so a bad URL still routes the visitor somewhere useful. */
+const LINKS: [string, string][] = [
+  ["Features", "/features"],
+  ["Pricing", "/pricing"],
+  ["FAQ", "/faq"],
+  ["About", "/about"],
+];
+
+export default function NotFound() {
+  return (
+    <div className="flex min-h-screen flex-col">
+      <SiteHeader />
+      <main className="flex flex-1 items-center bg-hero-wash">
+        <div className="container max-w-2xl py-24 text-center md:py-32">
+          <p className="text-[13px] font-semibold uppercase tracking-[0.04em] text-brand">
+            Error 404
+          </p>
+          <h1 className="mt-3 font-display text-5xl font-extrabold tracking-tight md:text-6xl">
+            We couldn&apos;t find that page
+          </h1>
+          <p className="mx-auto mt-4 max-w-lg text-lg text-muted-foreground">
+            The link may be broken, or the page may have moved. Here are a few places to
+            pick things back up.
+          </p>
+
+          <div className="mt-9 flex flex-col justify-center gap-3 sm:flex-row">
+            <Button asChild size="lg">
+              <Link href="/">
+                Back to home <ArrowRight className="h-4 w-4" />
+              </Link>
+            </Button>
+            <Button asChild size="lg" variant="outline">
+              <Link href="/sign-up">Start free</Link>
+            </Button>
+          </div>
+
+          <nav aria-label="Popular pages" className="mt-12">
+            <ul className="flex flex-wrap justify-center gap-x-6 gap-y-3 text-sm">
+              {LINKS.map(([label, href]) => (
+                <li key={href}>
+                  <Link href={href} className="font-semibold text-brand hover:underline">
+                    {label}
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          </nav>
+        </div>
+      </main>
+      <SiteFooter />
+    </div>
+  );
+}

app/opengraph-image.tsx

@@ -0,0 +1,89 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { ImageResponse } from "next/og";
+import { BRAND_HEX, SITE_NAME } from "@/lib/seo";
+
+/**
+ * The default social card for every route that does not define its own.
+ * Rendered at build/request time by Satori — no binary asset to keep in sync.
+ */
+export const alt = `${SITE_NAME} — from a topic idea to a finished podcast in minutes`;
+export const size = { width: 1200, height: 630 };
+export const contentType = "image/png";
+
+/**
+ * The real brand mark, inlined as a data URI. Satori cannot fetch a relative URL
+ * (there is no origin while rendering), so the PNG is read off disk and embedded.
+ */
+async function brandMarkDataUri() {
+  const file = await readFile(join(process.cwd(), "app", "icon.png"));
+  return `data:image/png;base64,${file.toString("base64")}`;
+}
+
+export default async function OpengraphImage() {
+  const mark = await brandMarkDataUri();
+
+  return new ImageResponse(
+    (
+      <div
+        style={{
+          width: "100%",
+          height: "100%",
+          display: "flex",
+          flexDirection: "column",
+          justifyContent: "space-between",
+          background: "#0d0d0d",
+          padding: 72,
+        }}
+      >
+        {/* Brand accent — a soft corner glow. Satori has no blur filter, so the
+            falloff is a radial gradient rather than an opaque disc, which would
+            otherwise cut a hard edge straight through the headline. */}
+        <div
+          style={{
+            position: "absolute",
+            top: -340,
+            right: -300,
+            width: 900,
+            height: 900,
+            borderRadius: 9999,
+            background: `radial-gradient(circle, ${BRAND_HEX}cc 0%, ${BRAND_HEX}33 45%, ${BRAND_HEX}00 70%)`,
+            display: "flex",
+          }}
+        />
+
+        <div style={{ display: "flex", alignItems: "center", gap: 20 }}>
+          {/* eslint-disable-next-line @next/next/no-img-element */}
+          <img src={mark} alt="" width={64} height={64} />
+          <div style={{ display: "flex", fontSize: 30, fontWeight: 700, color: "#ffffff" }}>
+            {SITE_NAME}
+          </div>
+        </div>
+
+        <div style={{ display: "flex", flexDirection: "column", gap: 24 }}>
+          <div
+            style={{
+              display: "flex",
+              fontSize: 76,
+              fontWeight: 800,
+              lineHeight: 1.08,
+              letterSpacing: -2,
+              color: "#ffffff",
+              maxWidth: 940,
+            }}
+          >
+            From a topic idea to a finished podcast in minutes
+          </div>
+          <div style={{ display: "flex", fontSize: 30, color: "#a3a3a3", maxWidth: 900 }}>
+            AI writes the script, records multi-voice audio, and designs the cover art.
+          </div>
+        </div>
+
+        <div style={{ display: "flex", fontSize: 26, color: BRAND_HEX, fontWeight: 600 }}>
+          Script · Voice · Cover art — one workflow
+        </div>
+      </div>
+    ),
+    size
+  );
+}

app/robots.ts

@@ -0,0 +1,42 @@
+import type { MetadataRoute } from "next";
+import { SITE_URL, absoluteUrl } from "@/lib/seo";
+
+/**
+ * /robots.txt — generated so the host always matches the deployment origin.
+ *
+ * Everything behind auth (the app shell, admin, auth screens), the API surface,
+ * and unlisted share links are disallowed. Those routes also emit a `noindex`
+ * meta tag; robots.txt keeps crawlers from spending budget on them at all.
+ */
+export default function robots(): MetadataRoute.Robots {
+  return {
+    rules: [
+      {
+        userAgent: "*",
+        allow: "/",
+        disallow: [
+          "/api/",
+          "/admin",
+          "/dashboard",
+          "/episodes",
+          "/series",
+          "/usage",
+          "/billing",
+          "/team",
+          "/api-keys",
+          "/settings",
+          "/sign-in",
+          "/sign-up",
+          "/forgot-password",
+          "/reset-password",
+          // Unlisted, per-episode share links — shareable, never indexable.
+          "/p/",
+          // Proxied analytics tracker + beacon (see next.config.mjs).
+          "/_a/",
+        ],
+      },
+    ],
+    sitemap: absoluteUrl("/sitemap.xml"),
+    host: SITE_URL,
+  };
+}

app/sitemap.ts

@@ -0,0 +1,40 @@
+import type { MetadataRoute } from "next";
+import { absoluteUrl } from "@/lib/seo";
+
+/**
+ * /sitemap.xml — the public, indexable surface only.
+ *
+ * Authed routes, auth screens and unlisted /p/<shareId> share pages are
+ * deliberately absent: they are `noindex` and disallowed in robots.ts, and a
+ * sitemap that lists non-indexable URLs is a Search Console error.
+ */
+
+/** Legal pages change rarely; keep their stamp tied to the published revision. */
+const LEGAL_UPDATED = new Date("2026-06-07T00:00:00.000Z");
+
+type Entry = {
+  path: string;
+  priority: number;
+  changeFrequency: MetadataRoute.Sitemap[number]["changeFrequency"];
+  lastModified: Date;
+};
+
+const NOW = new Date();
+
+const ROUTES: Entry[] = [
+  { path: "/", priority: 1.0, changeFrequency: "weekly", lastModified: NOW },
+  { path: "/features", priority: 0.9, changeFrequency: "monthly", lastModified: NOW },
+  { path: "/pricing", priority: 0.9, changeFrequency: "monthly", lastModified: NOW },
+  { path: "/faq", priority: 0.8, changeFrequency: "monthly", lastModified: NOW },
+  { path: "/about", priority: 0.6, changeFrequency: "yearly", lastModified: NOW },
+  { path: "/terms", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+  { path: "/privacy", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+  { path: "/cookies", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+  { path: "/acceptable-use", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+  { path: "/refunds", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+  { path: "/subprocessors", priority: 0.3, changeFrequency: "yearly", lastModified: LEGAL_UPDATED },
+];
+
+export default function sitemap(): MetadataRoute.Sitemap {
+  return ROUTES.map(({ path, ...rest }) => ({ url: absoluteUrl(path), ...rest }));
+}

app/twitter-image.tsx

@@ -0,0 +1 @@
+export { default, alt, size, contentType } from "./opengraph-image";

components/admin/admin-sidebar.tsx

@@ -2,20 +2,7 @@
 
 import Link from "next/link";
 import { usePathname } from "next/navigation";
-import {
-  LayoutDashboard,
-  TrendingUp,
-  BarChart3,
-  Users,
-  CreditCard,
-  ListChecks,
-  Activity,
-  Webhook,
-  ShieldAlert,
-  Flag,
-  ScrollText,
-  Settings,
-} from "lucide-react";
+import { LayoutDashboard, TrendingUp, BarChart3, Users, CreditCard, ListChecks, Activity, Webhook, ShieldAlert, Flag, ScrollText, Settings, Building2 } from "lucide-react";
 import { cn } from "@/lib/utils";
 
 interface Item {
@@ -38,6 +25,7 @@ const GROUPS: { label: string; items: Item[] }[] = [
     label: "Operations",
     items: [
       { label: "Users", href: "/admin/users", icon: Users },
+      { label: "Organizations", href: "/admin/organizations", icon: Building2 },
       { label: "Subscriptions", href: "/admin/subscriptions", icon: CreditCard },
       { label: "Jobs", href: "/admin/jobs", icon: ListChecks },
       { label: "System health", href: "/admin/health", icon: Activity },

components/admin/user-detail-actions.tsx

@@ -2,7 +2,7 @@
 
 import { useState } from "react";
 import { useRouter } from "next/navigation";
-import { LogIn, ShieldCheck, ShieldOff, Ban, UserCheck, Gift } from "lucide-react";
+import { LogIn, ShieldCheck, ShieldOff, Ban, UserCheck, Gift, Download, Trash2 } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@/components/ui/button";
 import { Label } from "@/components/ui/label";
@@ -19,6 +19,8 @@ import {
   banUserAction,
   setRoleAction,
   compPlanAction,
+  deleteUserAction,
+  exportUserDataAction,
 } from "@/app/(admin)/admin/actions";
 
 type CompPlan = "creator" | "pro" | "agency";
@@ -31,6 +33,7 @@ export function UserDetailActions({
 }) {
   const router = useRouter();
   const [impersonating, setImpersonating] = useState(false);
+  const [exporting, setExporting] = useState(false);
   const [compPlan, setCompPlan] = useState<CompPlan>("pro");
   const [compInterval, setCompInterval] = useState<CompInterval>("month");
 
@@ -44,6 +47,23 @@ export function UserDetailActions({
     }
   }
 
+  async function exportData() {
+    setExporting(true);
+    const res = await exportUserDataAction(user.id);
+    setExporting(false);
+    if (!res.ok || !res.json) {
+      toast.error(res.error ?? "Could not export");
+      return;
+    }
+    const url = URL.createObjectURL(new Blob([res.json], { type: "application/json" }));
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = `user-${user.id}-export.json`;
+    a.click();
+    URL.revokeObjectURL(url);
+    toast.success("Export downloaded");
+  }
+
   async function impersonate() {
     setImpersonating(true);
     try {
@@ -159,6 +179,29 @@ export function UserDetailActions({
           onConfirm={() => banUserAction(user.id, true)}
         />
       )}
+
+      <Button variant="outline" size="sm" onClick={exportData} disabled={exporting}>
+        <Download className="h-4 w-4" />
+        {exporting ? "Exporting…" : "Export data"}
+      </Button>
+
+      <ConfirmDialog
+        trigger={
+          <Button variant="destructive" size="sm">
+            <Trash2 className="h-4 w-4" /> Delete
+          </Button>
+        }
+        title="Permanently delete this user?"
+        description="Erases the account and every episode, script, series, API key and usage record it owns. This cannot be undone — export their data first if this is a GDPR request."
+        confirmLabel="Delete permanently"
+        successMessage="User deleted"
+        onConfirm={async () => {
+          const res = await deleteUserAction(user.id);
+          // The user page no longer exists once the row is gone.
+          if (res.ok) router.push("/admin/users");
+          return res;
+        }}
+      />
     </div>
   );
 }

components/analytics/umami.tsx

@@ -0,0 +1,51 @@
+"use client";
+
+import Script from "next/script";
+import { ANALYTICS_PROXY_PATH, redactPayload, type UmamiPayload } from "@/lib/analytics";
+
+/** Name of the global the tracker's `data-before-send` hook resolves. */
+const BEFORE_SEND = "__umamiBeforeSend";
+
+declare global {
+  interface Window {
+    [BEFORE_SEND]?: (type: string, payload: UmamiPayload) => UmamiPayload;
+  }
+}
+
+// Registered at module scope rather than in an effect: the tracker reads
+// `window[BEFORE_SEND]` at send time, and this client chunk is evaluated before
+// next/script injects the tag, so there is no window in which an unredacted
+// event could slip out.
+if (typeof window !== "undefined") {
+  window[BEFORE_SEND] = (_type, payload) => redactPayload(payload);
+}
+
+/**
+ * Self-hosted Umami analytics.
+ *
+ * The tracker and its beacon are both served from this origin via the
+ * `/_a` rewrite in next.config.mjs. That matters for more than ad-blockers: the
+ * CSP in middleware.ts uses `'strict-dynamic'`, which makes browsers ignore host
+ * allowlists in `script-src` entirely — so allowlisting the Umami domain there
+ * would not have worked, and `connect-src 'self'` would still have blocked the
+ * beacon. Proxying keeps both same-origin and the policy unrelaxed.
+ */
+export function UmamiAnalytics({ websiteId }: { websiteId: string }) {
+  return (
+    <Script
+      src={`${ANALYTICS_PROXY_PATH}/script.js`}
+      strategy="afterInteractive"
+      data-website-id={websiteId}
+      // Point the beacon at the proxied path instead of letting the tracker
+      // derive it from its own src.
+      data-host-url={ANALYTICS_PROXY_PATH}
+      // Drop query strings and fragments at the source. /reset-password carries a
+      // live reset token in `?token=` and /sign-in carries `?redirect=`.
+      data-exclude-search="true"
+      data-exclude-hash="true"
+      data-before-send={BEFORE_SEND}
+      // Honour the browser's Do Not Track signal.
+      data-do-not-track="true"
+    />
+  );
+}

components/app/settings-client.tsx

@@ -2,7 +2,7 @@
 
 import { useState } from "react";
 import { useRouter } from "next/navigation";
-import { Loader2, Save } from "lucide-react";
+import { Loader2, Save, Monitor, LogOut, Download, ShieldCheck } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -20,7 +20,16 @@ import { ConfirmDialog } from "@/components/admin/ui/confirm-dialog";
 import { authClient, signOut } from "@/lib/auth/auth-client";
 import { VOICE_CATALOG } from "@/lib/ai/voices";
 import { LANGUAGES } from "@/lib/episodes/options";
-import { savePreferencesAction, deleteAccountAction } from "@/app/(app)/settings/actions";
+import {
+  savePreferencesAction,
+  deleteAccountAction,
+  listSessionsAction,
+  revokeSessionAction,
+  revokeOtherSessionsAction,
+  exportMyDataAction,
+  type ActiveSession,
+} from "@/app/(app)/settings/actions";
+import { Badge } from "@/components/ui/badge";
 
 const NO_VOICE = "__none__";
 
@@ -252,6 +261,10 @@ export function SettingsClient({
         </CardContent>
       </Card>
 
+      <SessionsCard />
+
+      <DataExportCard />
+
       <Card className="border-destructive/30">
         <CardHeader>
           <CardTitle className="text-destructive">Danger zone</CardTitle>
@@ -294,3 +307,190 @@ export function SettingsClient({
     </div>
   );
 }
+
+/**
+ * Best-effort, dependency-free user-agent summary. Deliberately coarse: this is
+ * a recognition aid ("is that my laptop?"), not analytics, so an unknown agent
+ * degrading to "Unknown browser" is fine.
+ */
+function describeUserAgent(ua: string | null): { browser: string; os: string } {
+  if (!ua) return { browser: "Unknown browser", os: "unknown device" };
+  const browser = /Edg\//.test(ua)
+    ? "Edge"
+    : /OPR\//.test(ua)
+      ? "Opera"
+      : /Chrome\//.test(ua)
+        ? "Chrome"
+        : /Safari\//.test(ua)
+          ? "Safari"
+          : /Firefox\//.test(ua)
+            ? "Firefox"
+            : "Unknown browser";
+  const os = /Windows/.test(ua)
+    ? "Windows"
+    : /Android/.test(ua)
+      ? "Android"
+      : /iPhone|iPad|iOS/.test(ua)
+        ? "iOS"
+        : /Mac OS X|Macintosh/.test(ua)
+          ? "macOS"
+          : /Linux/.test(ua)
+            ? "Linux"
+            : "unknown device";
+  return { browser, os };
+}
+
+/** Signed-in devices, with per-device and bulk revocation. */
+function SessionsCard() {
+  const [sessions, setSessions] = useState<ActiveSession[] | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [busy, setBusy] = useState<string | null>(null);
+
+  async function load() {
+    setLoading(true);
+    const res = await listSessionsAction();
+    setLoading(false);
+    if (!res.ok || !res.sessions) {
+      toast.error(res.error ?? "Could not load sessions");
+      return;
+    }
+    setSessions(res.sessions);
+  }
+
+  async function revoke(id: string) {
+    setBusy(id);
+    const res = await revokeSessionAction(id);
+    setBusy(null);
+    if (!res.ok) {
+      toast.error(res.error ?? "Could not sign out that device");
+      return;
+    }
+    toast.success("Device signed out");
+    await load();
+  }
+
+  async function revokeOthers() {
+    setBusy("all");
+    const res = await revokeOtherSessionsAction();
+    setBusy(null);
+    if (!res.ok) {
+      toast.error(res.error ?? "Failed");
+      return;
+    }
+    toast.success(res.count ? "Signed out " + res.count + " other device(s)" : "No other devices");
+    await load();
+  }
+
+  const others = sessions?.filter((x) => !x.current) ?? [];
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <ShieldCheck className="h-4 w-4" />
+          Active sessions
+        </CardTitle>
+        <CardDescription>
+          Devices currently signed in to your account. Sign out anything you don&apos;t recognise.
+        </CardDescription>
+      </CardHeader>
+      <CardContent className="space-y-3">
+        {sessions === null ? (
+          <Button variant="outline" onClick={load} disabled={loading}>
+            {loading ? <Loader2 className="h-4 w-4 animate-spin" /> : <Monitor className="h-4 w-4" />}
+            Show active sessions
+          </Button>
+        ) : (
+          <>
+            <div className="divide-y rounded-2xl border">
+              {sessions.map((x) => {
+                const parts = describeUserAgent(x.userAgent);
+                return (
+                  <div key={x.id} className="flex items-center gap-3 p-3">
+                    <Monitor className="h-4 w-4 shrink-0 text-muted-foreground" />
+                    <div className="min-w-0 flex-1">
+                      <p className="truncate text-sm font-medium">
+                        {`${parts.browser} on ${parts.os}`}
+                        {x.current ? (
+                          <Badge variant="secondary" className="ml-2">
+                            This device
+                          </Badge>
+                        ) : null}
+                      </p>
+                      <p className="truncate text-xs text-muted-foreground">
+                        {x.ipAddress ?? "unknown IP"} · signed in{" "}
+                        {new Date(x.createdAt).toLocaleDateString()}
+                      </p>
+                    </div>
+                    {x.current ? null : (
+                      <Button
+                        variant="ghost"
+                        size="sm"
+                        disabled={busy === x.id}
+                        onClick={() => revoke(x.id)}
+                      >
+                        <LogOut className="h-4 w-4" />
+                        Sign out
+                      </Button>
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+            {others.length > 0 ? (
+              <Button variant="outline" onClick={revokeOthers} disabled={busy === "all"}>
+                {busy === "all" ? <Loader2 className="h-4 w-4 animate-spin" /> : null}
+                Sign out all other devices ({others.length})
+              </Button>
+            ) : null}
+          </>
+        )}
+      </CardContent>
+    </Card>
+  );
+}
+
+/** Self-serve GDPR access request: download everything we hold, as JSON. */
+function DataExportCard() {
+  const [busy, setBusy] = useState(false);
+
+  async function download() {
+    setBusy(true);
+    const res = await exportMyDataAction();
+    setBusy(false);
+    if (!res.ok || !res.json) {
+      toast.error(res.error ?? "Could not export your data");
+      return;
+    }
+    // Build the file in the browser so the JSON never has to round-trip through
+    // a route handler that would need its own authorization.
+    const url = URL.createObjectURL(new Blob([res.json], { type: "application/json" }));
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = `podcast-distribution-ai-export-${new Date().toISOString().slice(0, 10)}.json`;
+    a.click();
+    URL.revokeObjectURL(url);
+    toast.success("Export downloaded");
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2">
+          <Download className="h-4 w-4" />
+          Export your data
+        </CardTitle>
+        <CardDescription>
+          Download your profile, episodes, scripts, series, usage and billing history as JSON.
+          Passwords and access tokens are excluded.
+        </CardDescription>
+      </CardHeader>
+      <CardContent>
+        <Button variant="outline" onClick={download} disabled={busy}>
+          {busy ? <Loader2 className="h-4 w-4 animate-spin" /> : <Download className="h-4 w-4" />}
+          Download my data
+        </Button>
+      </CardContent>
+    </Card>
+  );
+}

components/app/team-client.tsx

@@ -2,7 +2,7 @@
 
 import { useState } from "react";
 import { useRouter } from "next/navigation";
-import { Loader2, UserPlus, Building2, Save, Mic, Plus } from "lucide-react";
+import { Loader2, UserPlus, Building2, Save, Mic, Plus, Trash2, MailX, Clock } from "lucide-react";
 import { toast } from "sonner";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -12,7 +12,21 @@ import { Badge } from "@/components/ui/badge";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { Avatar, AvatarFallback } from "@/components/ui/avatar";
 import { authClient } from "@/lib/auth/auth-client";
-import { inviteMemberAction, saveBrandingAction } from "@/app/(app)/team/actions";
+import {
+  inviteMemberAction,
+  saveBrandingAction,
+  removeMemberAction,
+  updateMemberRoleAction,
+  revokeInvitationAction,
+} from "@/app/(app)/team/actions";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { ConfirmDialog } from "@/components/admin/ui/confirm-dialog";
 
 /**
  * Pure client-side #rrggbb → "H S% L%" converter for the live branding preview.
@@ -51,6 +65,7 @@ function hexToHslTriplet(hex: string): string | null {
 
 interface Member {
   id: string;
+  userId: string;
   name: string;
   email: string;
   role: string;
@@ -62,14 +77,25 @@ interface Branding {
   removePoweredBy: boolean;
 }
 
+export interface Invitation {
+  id: string;
+  email: string;
+  role: string;
+  expiresAt: string;
+}
+
 export function TeamClient({
   org,
   members,
+  invitations,
+  currentUserId,
   branding,
   seats,
 }: {
   org: { id: string; name: string } | null;
   members: Member[];
+  invitations: Invitation[];
+  currentUserId: string;
   branding: Branding | null;
   seats: number;
 }) {
@@ -79,7 +105,13 @@ export function TeamClient({
 
   return (
     <div className="space-y-6">
-      <MembersCard orgId={org.id} members={members} seats={seats} />
+      <MembersCard
+        orgId={org.id}
+        members={members}
+        invitations={invitations}
+        currentUserId={currentUserId}
+        seats={seats}
+      />
       <BrandingCard orgId={org.id} branding={branding} />
     </div>
   );
@@ -129,15 +161,49 @@ function CreateWorkspace() {
   );
 }
 
-function MembersCard({ orgId, members, seats }: { orgId: string; members: Member[]; seats: number }) {
+function MembersCard({
+  orgId,
+  members,
+  invitations,
+  currentUserId,
+  seats,
+}: {
+  orgId: string;
+  members: Member[];
+  invitations: Invitation[];
+  currentUserId: string;
+  seats: number;
+}) {
   const router = useRouter();
   const [email, setEmail] = useState("");
   const [busy, setBusy] = useState(false);
+  const [rowBusy, setRowBusy] = useState<string | null>(null);
+
+  // A pending invite holds a seat, so it counts towards the cap — this mirrors
+  // the server-side check in inviteMemberAction.
+  const used = members.length + invitations.length;
+  const owners = members.filter((m) => m.role === "owner").length;
+
+  async function run(
+    id: string,
+    action: () => Promise<{ ok: boolean; error?: string }>,
+    msg: string
+  ) {
+    setRowBusy(id);
+    const res = await action();
+    setRowBusy(null);
+    if (!res.ok) {
+      toast.error(res.error ?? "Failed");
+      return;
+    }
+    toast.success(msg);
+    router.refresh();
+  }
 
   async function invite(e: React.FormEvent) {
     e.preventDefault();
     // Fast UX guard only — the server action is the real seat-limit authority.
-    if (members.length >= seats) {
+    if (used >= seats) {
       toast.error(`Your plan includes ${seats} seats.`);
       return;
     }
@@ -159,7 +225,7 @@ function MembersCard({ orgId, members, seats }: { orgId: string; members: Member
         <CardTitle className="flex items-center justify-between">
           <span>Members</span>
           <Badge variant="secondary">
-            {members.length} / {seats} seats
+            {used} / {seats} seats
           </Badge>
         </CardTitle>
       </CardHeader>
@@ -174,10 +240,91 @@ function MembersCard({ orgId, members, seats }: { orgId: string; members: Member
                 <p className="truncate text-sm font-medium">{m.name}</p>
                 <p className="truncate text-xs text-muted-foreground">{m.email}</p>
               </div>
-              <Badge variant="outline" className="capitalize">{m.role}</Badge>
+              {m.userId === currentUserId ? (
+                <Badge variant="outline" className="capitalize">
+                  {m.role} (you)
+                </Badge>
+              ) : (
+                <div className="flex items-center gap-2">
+                  <Select
+                    value={m.role}
+                    disabled={rowBusy === m.id}
+                    onValueChange={(role) =>
+                      run(
+                        m.id,
+                        () =>
+                          updateMemberRoleAction(
+                            orgId,
+                            m.id,
+                            role as "owner" | "admin" | "member"
+                          ),
+                        "Role updated"
+                      )
+                    }
+                  >
+                    <SelectTrigger className="h-8 w-28 capitalize">
+                      <SelectValue />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="owner">Owner</SelectItem>
+                      <SelectItem value="admin">Admin</SelectItem>
+                      <SelectItem value="member">Member</SelectItem>
+                    </SelectContent>
+                  </Select>
+                  <ConfirmDialog
+                    trigger={
+                      <Button
+                        variant="ghost"
+                        size="icon"
+                        className="h-8 w-8 text-destructive"
+                        disabled={rowBusy === m.id || (m.role === "owner" && owners <= 1)}
+                        aria-label={`Remove ${m.name}`}
+                      >
+                        <Trash2 className="h-4 w-4" />
+                      </Button>
+                    }
+                    title={`Remove ${m.name}?`}
+                    description="They lose access to this workspace immediately and their seat is freed. Their own episodes are not deleted."
+                    confirmLabel="Remove"
+                    onConfirm={() => removeMemberAction(orgId, m.id)}
+                  />
+                </div>
+              )}
             </div>
           ))}
         </div>
+
+        {invitations.length > 0 ? (
+          <div className="space-y-2">
+            <p className="text-xs font-medium text-muted-foreground">
+              Pending invitations ({invitations.length})
+            </p>
+            <div className="divide-y rounded-2xl border border-dashed">
+              {invitations.map((inv) => (
+                <div key={inv.id} className="flex items-center gap-3 p-3">
+                  <Clock className="h-4 w-4 shrink-0 text-muted-foreground" />
+                  <div className="min-w-0 flex-1">
+                    <p className="truncate text-sm">{inv.email}</p>
+                    <p className="text-xs text-muted-foreground">
+                      Expires {new Date(inv.expiresAt).toLocaleDateString()} · holds a seat
+                    </p>
+                  </div>
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    disabled={rowBusy === inv.id}
+                    onClick={() =>
+                      run(inv.id, () => revokeInvitationAction(orgId, inv.id), "Invitation revoked")
+                    }
+                  >
+                    <MailX className="h-4 w-4" />
+                    Revoke
+                  </Button>
+                </div>
+              ))}
+            </div>
+          </div>
+        ) : null}
         <form onSubmit={invite} className="flex gap-2">
           <Input
             type="email"

components/auth/forgot-password-form.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 import Link from "next/link";
 import { Loader2, MailCheck } from "lucide-react";
 import { toast } from "sonner";
@@ -9,21 +9,31 @@ import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { authClient } from "@/lib/auth/auth-client";
+import { Turnstile, type TurnstileHandle } from "./turnstile";
 
-export function ForgotPasswordForm() {
+export function ForgotPasswordForm({ turnstileSiteKey }: { turnstileSiteKey: string | null }) {
   const [loading, setLoading] = useState(false);
   const [sent, setSent] = useState(false);
+  // See sign-in-form: rendered only when configured, verified server-side.
+  const [captchaToken, setCaptchaToken] = useState("");
+  const turnstileRef = useRef<TurnstileHandle>(null);
+  const captchaRequired = !!turnstileSiteKey;
 
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault();
     setLoading(true);
     const form = new FormData(e.currentTarget);
-    const { error } = await authClient.requestPasswordReset({
+    const { error } = await authClient.requestPasswordReset(
+      {
         email: String(form.get("email")),
         redirectTo: "/reset-password",
-    });
+      },
+      captchaRequired ? { headers: { "x-captcha-response": captchaToken } } : undefined
+    );
     setLoading(false);
     if (error) {
+      // Single-use token: re-challenge so the retry fails on its real cause.
+      turnstileRef.current?.reset();
       toast.error(error.message ?? "Something went wrong");
       return;
     }
@@ -62,7 +72,20 @@ export function ForgotPasswordForm() {
             <Label htmlFor="email">Email</Label>
             <Input id="email" name="email" type="email" autoComplete="email" required />
           </div>
-          <Button type="submit" className="w-full" disabled={loading}>
+          {turnstileSiteKey && (
+            <Turnstile
+              ref={turnstileRef}
+              siteKey={turnstileSiteKey}
+              onToken={setCaptchaToken}
+              onError={() => toast.error("Could not load the security check. Please refresh.")}
+              className="flex justify-center"
+            />
+          )}
+          <Button
+            type="submit"
+            className="w-full"
+            disabled={loading || (captchaRequired && !captchaToken)}
+          >
             {loading && <Loader2 className="h-4 w-4 animate-spin" />}
             Send reset link
           </Button>

components/auth/sign-in-form.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
 import { Loader2 } from "lucide-react";
@@ -12,23 +12,42 @@ import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/com
 import { signIn } from "@/lib/auth/auth-client";
 import { safeRedirect } from "@/lib/utils";
 import { GoogleButton } from "./google-button";
+import { Turnstile, type TurnstileHandle } from "./turnstile";
 
-export function SignInForm({ googleEnabled }: { googleEnabled: boolean }) {
+export function SignInForm({
+  googleEnabled,
+  turnstileSiteKey,
+}: {
+  googleEnabled: boolean;
+  turnstileSiteKey: string | null;
+}) {
   const router = useRouter();
   const params = useSearchParams();
   // Validate the ?redirect param to prevent open-redirect attacks.
   const redirectTo = safeRedirect(params.get("redirect"));
   const [loading, setLoading] = useState(false);
+  // Turnstile is only rendered when configured; when it is, a solved token is
+  // required before the form can be submitted. The server rejects a missing or
+  // reused token regardless, so this is UX, not the security boundary.
+  const [captchaToken, setCaptchaToken] = useState("");
+  const turnstileRef = useRef<TurnstileHandle>(null);
+  const captchaRequired = !!turnstileSiteKey;
 
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault();
     setLoading(true);
     const form = new FormData(e.currentTarget);
-    const { error } = await signIn.email({
+    const { error } = await signIn.email(
+      {
         email: String(form.get("email")),
         password: String(form.get("password")),
-    });
+      },
+      captchaRequired ? { headers: { "x-captcha-response": captchaToken } } : undefined
+    );
     if (error) {
+      // Turnstile tokens are single-use — issue a fresh challenge for the retry,
+      // otherwise the next submit fails verification instead of on credentials.
+      turnstileRef.current?.reset();
       toast.error(error.message ?? "Invalid email or password");
       setLoading(false);
       return;
@@ -71,7 +90,20 @@ export function SignInForm({ googleEnabled }: { googleEnabled: boolean }) {
             </div>
             <Input id="password" name="password" type="password" autoComplete="current-password" required />
           </div>
-          <Button type="submit" className="w-full" disabled={loading}>
+          {turnstileSiteKey && (
+            <Turnstile
+              ref={turnstileRef}
+              siteKey={turnstileSiteKey}
+              onToken={setCaptchaToken}
+              onError={() => toast.error("Could not load the security check. Please refresh.")}
+              className="flex justify-center"
+            />
+          )}
+          <Button
+            type="submit"
+            className="w-full"
+            disabled={loading || (captchaRequired && !captchaToken)}
+          >
             {loading && <Loader2 className="h-4 w-4 animate-spin" />}
             Sign in
           </Button>

components/auth/sign-up-form.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { Loader2 } from "lucide-react";
@@ -11,21 +11,37 @@ import { Label } from "@/components/ui/label";
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { signUp } from "@/lib/auth/auth-client";
 import { GoogleButton } from "./google-button";
+import { Turnstile, type TurnstileHandle } from "./turnstile";
 
-export function SignUpForm({ googleEnabled }: { googleEnabled: boolean }) {
+export function SignUpForm({
+  googleEnabled,
+  turnstileSiteKey,
+}: {
+  googleEnabled: boolean;
+  turnstileSiteKey: string | null;
+}) {
   const router = useRouter();
   const [loading, setLoading] = useState(false);
+  // See sign-in-form: rendered only when configured, verified server-side.
+  const [captchaToken, setCaptchaToken] = useState("");
+  const turnstileRef = useRef<TurnstileHandle>(null);
+  const captchaRequired = !!turnstileSiteKey;
 
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault();
     setLoading(true);
     const form = new FormData(e.currentTarget);
-    const { error } = await signUp.email({
+    const { error } = await signUp.email(
+      {
         name: String(form.get("name")),
         email: String(form.get("email")),
         password: String(form.get("password")),
-    });
+      },
+      captchaRequired ? { headers: { "x-captcha-response": captchaToken } } : undefined
+    );
     if (error) {
+      // Single-use token: re-challenge so the retry fails on its real cause.
+      turnstileRef.current?.reset();
       // Accepted tradeoff (L8): the raw Better Auth message can reveal that an
       // email is already registered (account enumeration). We keep the specific
       // message for UX clarity; the signup endpoint is rate-limited server-side.
@@ -79,7 +95,20 @@ export function SignUpForm({ googleEnabled }: { googleEnabled: boolean }) {
             />
             <p className="text-xs text-muted-foreground">At least 8 characters.</p>
           </div>
-          <Button type="submit" className="w-full" disabled={loading}>
+          {turnstileSiteKey && (
+            <Turnstile
+              ref={turnstileRef}
+              siteKey={turnstileSiteKey}
+              onToken={setCaptchaToken}
+              onError={() => toast.error("Could not load the security check. Please refresh.")}
+              className="flex justify-center"
+            />
+          )}
+          <Button
+            type="submit"
+            className="w-full"
+            disabled={loading || (captchaRequired && !captchaToken)}
+          >
             {loading && <Loader2 className="h-4 w-4 animate-spin" />}
             Create account
           </Button>

components/auth/turnstile.tsx

@@ -0,0 +1,146 @@
+"use client";
+
+import { forwardRef, useEffect, useImperativeHandle, useRef } from "react";
+
+const SCRIPT_ID = "cf-turnstile-script";
+const SCRIPT_SRC = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";
+
+type TurnstileApi = {
+  render: (el: HTMLElement, opts: Record<string, unknown>) => string;
+  reset: (id: string) => void;
+  remove: (id: string) => void;
+};
+
+declare global {
+  // eslint-disable-next-line no-var
+  var turnstile: TurnstileApi | undefined;
+}
+
+/**
+ * Load Cloudflare's script once per page, no matter how many widgets mount.
+ * `render=explicit` keeps control in our hands so the widget can be reset —
+ * Turnstile tokens are single-use, so every failed submit needs a fresh one.
+ */
+let scriptPromise: Promise<void> | null = null;
+function loadTurnstileScript(): Promise<void> {
+  if (typeof window === "undefined") return Promise.resolve();
+  if (window.turnstile) return Promise.resolve();
+  if (scriptPromise) return scriptPromise;
+
+  scriptPromise = new Promise<void>((resolve, reject) => {
+    const existing = document.getElementById(SCRIPT_ID) as HTMLScriptElement | null;
+    if (existing) {
+      existing.addEventListener("load", () => resolve());
+      existing.addEventListener("error", () => reject(new Error("Turnstile failed to load")));
+      return;
+    }
+    const script = document.createElement("script");
+    script.id = SCRIPT_ID;
+    script.src = SCRIPT_SRC;
+    script.async = true;
+    script.defer = true;
+    script.onload = () => resolve();
+    script.onerror = () => {
+      // Allow a later mount to retry (e.g. the user was briefly offline).
+      scriptPromise = null;
+      reject(new Error("Turnstile failed to load"));
+    };
+    document.head.appendChild(script);
+  });
+  return scriptPromise;
+}
+
+/**
+ * `script.onload` does not guarantee `window.turnstile` is assigned yet, and the
+ * original code silently gave up forever when it wasn't — the widget would just
+ * never appear. Poll briefly instead so a slow parse still resolves.
+ */
+async function waitForTurnstileApi(timeoutMs = 10_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!window.turnstile && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 50));
+  }
+}
+
+export type TurnstileHandle = { reset: () => void };
+
+type TurnstileProps = {
+  siteKey: string;
+  /** Fires with the solved token, or "" whenever the token becomes unusable. */
+  onToken: (token: string) => void;
+  onError?: () => void;
+  className?: string;
+};
+
+/**
+ * Renders the Turnstile challenge. The parent owns the token and must send it
+ * as the `x-captcha-response` header; verification happens server-side in
+ * `lib/auth/auth.ts`.
+ */
+export const Turnstile = forwardRef<TurnstileHandle, TurnstileProps>(function Turnstile(
+  { siteKey, onToken, onError, className },
+  ref
+) {
+  const containerRef = useRef<HTMLDivElement>(null);
+  const widgetIdRef = useRef<string | null>(null);
+
+  // Hold the callbacks in refs so re-renders never tear down the widget —
+  // re-rendering it would drop a token the user already solved.
+  const onTokenRef = useRef(onToken);
+  const onErrorRef = useRef(onError);
+  onTokenRef.current = onToken;
+  onErrorRef.current = onError;
+
+  useImperativeHandle(
+    ref,
+    () => ({
+      reset() {
+        if (widgetIdRef.current && window.turnstile) {
+          window.turnstile.reset(widgetIdRef.current);
+          onTokenRef.current("");
+        }
+      },
+    }),
+    []
+  );
+
+  useEffect(() => {
+    let cancelled = false;
+
+    loadTurnstileScript()
+      .then(() => waitForTurnstileApi())
+      .then(() => {
+        if (cancelled || widgetIdRef.current || !containerRef.current || !window.turnstile) return;
+        widgetIdRef.current = window.turnstile.render(containerRef.current, {
+          sitekey: siteKey,
+          // The auth screens render outside next-themes' provider, so let the
+          // widget follow the OS colour scheme instead of the app's theme.
+          theme: "auto",
+          callback: (token: string) => onTokenRef.current(token),
+          // Any of these means we no longer hold a usable token.
+          "error-callback": () => {
+            onTokenRef.current("");
+            onErrorRef.current?.();
+          },
+          "expired-callback": () => onTokenRef.current(""),
+          "timeout-callback": () => onTokenRef.current(""),
+        });
+      })
+      .catch(() => onErrorRef.current?.());
+
+    return () => {
+      cancelled = true;
+      const id = widgetIdRef.current;
+      widgetIdRef.current = null;
+      if (id && window.turnstile) {
+        try {
+          window.turnstile.remove(id);
+        } catch {
+          // Widget already gone (e.g. React 18/19 StrictMode double-invoke).
+        }
+      }
+    };
+  }, [siteKey]);
+
+  return <div ref={containerRef} className={className} />;
+});

components/marketing/legal-doc.tsx

@@ -1,23 +1,50 @@
+import { JsonLd } from "@/components/seo/json-ld";
+import { breadcrumbSchema, graph, webPageSchema } from "@/lib/schema";
+import { toIsoDate } from "@/lib/seo";
+
 export interface LegalSection {
   heading: string;
   paragraphs: string[];
   bullets?: string[];
 }
 
-/** Shared layout for long-form legal documents (Privacy, Terms). */
+/**
+ * Shared layout for long-form legal documents (Privacy, Terms, …).
+ *
+ * Also emits the page's structured data: every legal page has the same shape, so
+ * the WebPage + BreadcrumbList nodes are built here from `path`/`description`
+ * rather than repeated in each of the six route files.
+ */
 export function LegalDoc({
   title,
   updated,
   intro,
   sections,
+  path,
+  description,
 }: {
   title: string;
   updated: string;
   intro: string;
   sections: LegalSection[];
+  /** Root-relative URL of this document, e.g. "/terms". */
+  path: string;
+  /** Same one-line summary used for the page's meta description. */
+  description: string;
 }) {
+  const dateModified = toIsoDate(updated);
+
   return (
     <div className="container max-w-3xl py-20 md:py-24">
+      <JsonLd
+        data={graph(
+          {
+            ...webPageSchema({ path, name: title, description }),
+            ...(dateModified ? { dateModified } : {}),
+          },
+          breadcrumbSchema([{ name: title, path }])
+        )}
+      />
       <p className="text-[13px] font-semibold uppercase tracking-[0.04em] text-brand">Legal</p>
       <h1 className="mt-3 font-display text-4xl font-extrabold tracking-tight md:text-5xl">
         {title}

components/seo/json-ld.tsx

@@ -0,0 +1,23 @@
+/**
+ * Renders a JSON-LD structured-data block.
+ *
+ * No CSP nonce is applied — deliberately. `application/ld+json` is a data block,
+ * not an executable script: browsers bail out of script preparation before the
+ * `script-src` check runs, so the strict nonce policy set in middleware.ts never
+ * blocks it. Threading a nonce through would require reading `headers()`, which
+ * would opt every marketing page out of static rendering for no benefit.
+ *
+ * The payload is serialized with `<` escaped so a value containing "</script>"
+ * cannot break out of the block.
+ */
+export function JsonLd({ data }: { data: Record<string, unknown> | Record<string, unknown>[] }) {
+  return (
+    <script
+      type="application/ld+json"
+      // eslint-disable-next-line react/no-danger
+      dangerouslySetInnerHTML={{
+        __html: JSON.stringify(data).replace(/</g, "\\u003c"),
+      }}
+    />
+  );
+}

docker-compose.dev.yml

@@ -0,0 +1,30 @@
+# Local development database only.
+# The production stack (web + worker) lives in docker-compose.yml; this file is
+# separate so `docker compose -f docker-compose.dev.yml up -d` never touches it.
+#
+#   Start:   docker compose -f docker-compose.dev.yml up -d
+#   Stop:    docker compose -f docker-compose.dev.yml down
+#   Reset:   docker compose -f docker-compose.dev.yml down -v
+services:
+  db:
+    image: postgres:18
+    container_name: podcast-distribution-ai-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: podcast-distribution-ai
+    ports:
+      # 5432-5442 are in use by other local projects; 5443 keeps this isolated.
+      - "5443:5432"
+    volumes:
+      # PG18+ images manage major-version subdirs; mount here, not at /data.
+      - pgdata:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d podcast-distribution-ai"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+volumes:
+  pgdata:

docker-compose.yml

@@ -8,6 +8,11 @@ services:
       args:
         NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
         NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY}
+        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY}
+        NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION: ${NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION:-}
+        NEXT_PUBLIC_BING_SITE_VERIFICATION: ${NEXT_PUBLIC_BING_SITE_VERIFICATION:-}
+        UMAMI_HOST_URL: ${UMAMI_HOST_URL:-}
+        UMAMI_WEBSITE_ID: ${UMAMI_WEBSITE_ID:-}
     image: podcast-distribution-ai:latest
     # Apply pending migrations on boot, then serve.
     command: sh -c "npx prisma migrate deploy && npm run start"
@@ -15,6 +20,11 @@ services:
     environment:
       STORAGE_DIR: /app/storage
       PORT: "3000"
+      # Also needed at run time, not just as build args: the app and admin route
+      # groups are `force-dynamic`, so the root layout re-reads these on every
+      # request rather than using the value baked into the prerendered HTML.
+      UMAMI_HOST_URL: ${UMAMI_HOST_URL:-}
+      UMAMI_WEBSITE_ID: ${UMAMI_WEBSITE_ID:-}
     volumes:
       - storage:/app/storage
     expose:

lib/admin/ops.ts

@@ -33,12 +33,30 @@ export async function getEpisodeStatusCounts() {
   return groups.map((g) => ({ status: g.status as string, count: g._count }));
 }
 
-export async function getModerationQueue() {
-  return prisma.contentFlag.findMany({
-    where: { status: "open" },
+export const MODERATION_PAGE_SIZE = 25;
+
+/**
+ * Open content flags, newest first.
+ *
+ * Paginated: this used to load every open flag, so a moderation backlog grew
+ * the page (and its memory cost) without bound. Every other admin list is
+ * paginated for the same reason.
+ */
+export async function getModerationQueue(params: { page?: number; pageSize?: number } = {}) {
+  const page = Math.max(1, params.page ?? 1);
+  const pageSize = params.pageSize ?? MODERATION_PAGE_SIZE;
+  const where = { status: "open" };
+  const [rows, total] = await Promise.all([
+    prisma.contentFlag.findMany({
+      where,
       orderBy: { createdAt: "desc" },
-    include: { episode: { select: { id: true, title: true } } },
-  });
+      skip: (page - 1) * pageSize,
+      take: pageSize,
+      include: { episode: { select: { id: true, title: true, userId: true } } },
+    }),
+    prisma.contentFlag.count({ where }),
+  ]);
+  return { rows, total };
 }
 
 export async function listWebhookEvents(params: {

lib/admin/orgs.ts

@@ -0,0 +1,193 @@
+import type { Prisma } from "@prisma/client";
+import { prisma } from "@/lib/db";
+import { PLANS, type PlanKey } from "@/lib/billing/plans";
+
+export const ORGS_PAGE_SIZE = 25;
+
+export interface AdminOrgRow {
+  id: string;
+  name: string;
+  slug: string | null;
+  memberCount: number;
+  seats: number;
+  plan: string;
+  status: string | null;
+  whiteLabel: boolean;
+  createdAt: Date;
+}
+
+function orderBy(sort?: string): Prisma.OrganizationOrderByWithRelationInput {
+  const [key, dir] = (sort ?? "createdAt.desc").split(".");
+  const d = dir === "asc" ? "asc" : "desc";
+  if (key === "name") return { name: d };
+  return { createdAt: d };
+}
+
+/**
+ * Organization list for the admin console.
+ *
+ * Subscriptions are keyed by `referenceId`, which holds either a user id or an
+ * organization id — so an org's plan is looked up by its own id, in one batched
+ * query rather than per row.
+ */
+export async function listOrganizations(params: {
+  search?: string;
+  plan?: string;
+  sort?: string;
+  page: number;
+  pageSize?: number;
+}): Promise<{ rows: AdminOrgRow[]; total: number }> {
+  const pageSize = params.pageSize ?? ORGS_PAGE_SIZE;
+  const where: Prisma.OrganizationWhereInput = {};
+  if (params.search) {
+    where.OR = [
+      { name: { contains: params.search, mode: "insensitive" } },
+      { slug: { contains: params.search, mode: "insensitive" } },
+    ];
+  }
+
+  const [orgs, total] = await Promise.all([
+    prisma.organization.findMany({
+      where,
+      orderBy: orderBy(params.sort),
+      skip: (params.page - 1) * pageSize,
+      take: pageSize,
+      include: {
+        branding: { select: { removePoweredBy: true } },
+        _count: { select: { members: true } },
+      },
+    }),
+    prisma.organization.count({ where }),
+  ]);
+
+  const subs = await prisma.subscription.findMany({
+    where: {
+      referenceId: { in: orgs.map((o) => o.id) },
+      status: { in: ["active", "trialing", "past_due"] },
+    },
+    select: { referenceId: true, plan: true, status: true, seats: true },
+  });
+  const subByOrg = new Map(subs.map((s) => [s.referenceId, s]));
+
+  const rows = orgs
+    .map((o) => {
+      const sub = subByOrg.get(o.id);
+      const planKey = (sub?.plan ?? "free") as PlanKey;
+      return {
+        id: o.id,
+        name: o.name,
+        slug: o.slug,
+        memberCount: o._count.members,
+        seats: sub?.seats ?? PLANS[planKey]?.limits.seats ?? 1,
+        plan: planKey,
+        status: sub?.status ?? null,
+        whiteLabel: o.branding?.removePoweredBy ?? false,
+        createdAt: o.createdAt,
+      };
+    })
+    // Plan lives on the subscription table, not the org row, so this filter is
+    // applied after the join rather than in the SQL WHERE.
+    .filter((r) => !params.plan || r.plan === params.plan);
+
+  return { rows, total };
+}
+
+export interface AdminOrgDetail {
+  id: string;
+  name: string;
+  slug: string | null;
+  createdAt: Date;
+  plan: string;
+  status: string | null;
+  seats: number;
+  members: {
+    memberId: string;
+    userId: string;
+    name: string;
+    email: string;
+    role: string;
+    banned: boolean;
+    joinedAt: Date;
+  }[];
+  invitations: { id: string; email: string; role: string | null; expiresAt: Date }[];
+  branding: {
+    brandName: string | null;
+    primaryColor: string | null;
+    logoUrl: string | null;
+    removePoweredBy: boolean;
+    customDomain: string | null;
+  } | null;
+  episodeCount: number;
+  recentEpisodes: { id: string; title: string; status: string; createdAt: Date }[];
+}
+
+/** Full detail for one organization, or null when it does not exist. */
+export async function getOrgDetail(orgId: string): Promise<AdminOrgDetail | null> {
+  const org = await prisma.organization.findUnique({
+    where: { id: orgId },
+    include: {
+      branding: true,
+      members: {
+        include: { user: { select: { id: true, name: true, email: true, banned: true } } },
+        orderBy: { createdAt: "asc" },
+      },
+      invitations: {
+        where: { status: "pending" },
+        select: { id: true, email: true, role: true, expiresAt: true },
+      },
+    },
+  });
+  if (!org) return null;
+
+  const [sub, episodeCount, recentEpisodes] = await Promise.all([
+    prisma.subscription.findFirst({
+      where: { referenceId: org.id, status: { in: ["active", "trialing", "past_due"] } },
+      select: { plan: true, status: true, seats: true },
+    }),
+    prisma.episode.count({ where: { organizationId: org.id } }),
+    prisma.episode.findMany({
+      where: { organizationId: org.id },
+      orderBy: { createdAt: "desc" },
+      take: 10,
+      select: { id: true, title: true, status: true, createdAt: true },
+    }),
+  ]);
+
+  const planKey = (sub?.plan ?? "free") as PlanKey;
+
+  return {
+    id: org.id,
+    name: org.name,
+    slug: org.slug,
+    createdAt: org.createdAt,
+    plan: planKey,
+    status: sub?.status ?? null,
+    seats: sub?.seats ?? PLANS[planKey]?.limits.seats ?? 1,
+    members: org.members.map((m) => ({
+      memberId: m.id,
+      userId: m.user.id,
+      name: m.user.name,
+      email: m.user.email,
+      role: m.role,
+      banned: !!m.user.banned,
+      joinedAt: m.createdAt,
+    })),
+    invitations: org.invitations.map((i) => ({
+      id: i.id,
+      email: i.email,
+      role: i.role,
+      expiresAt: i.expiresAt,
+    })),
+    branding: org.branding
+      ? {
+          brandName: org.branding.brandName,
+          primaryColor: org.branding.primaryColor,
+          logoUrl: org.branding.logoUrl,
+          removePoweredBy: org.branding.removePoweredBy,
+          customDomain: org.branding.customDomain,
+        }
+      : null,
+    episodeCount,
+    recentEpisodes,
+  };
+}

lib/analytics.ts

@@ -0,0 +1,122 @@
+/**
+ * Umami (self-hosted) analytics configuration and payload redaction.
+ *
+ * Two deliberate choices are encoded here:
+ *
+ * 1. The tracker is served same-origin through a rewrite (see `ANALYTICS_PROXY_PATH`
+ *    and next.config.mjs) rather than from the Umami host directly. That keeps the
+ *    strict CSP in middleware.ts untouched — `script-src`/`connect-src` stay
+ *    `'self'` — and stops content blockers from dropping the request.
+ *
+ * 2. Nothing that identifies a user's content ever reaches the analytics database.
+ *    See `redactUrl` / `redactTitle`.
+ */
+
+/** Same-origin prefix the tracker and its beacon are proxied through. */
+export const ANALYTICS_PROXY_PATH = "/_a";
+
+export interface UmamiConfig {
+  /** Origin of the Umami instance, e.g. "https://analytics.example.com". */
+  hostUrl: string;
+  websiteId: string;
+}
+
+/**
+ * Resolve the Umami config from the environment. Returns null when either value
+ * is absent, which disables analytics entirely (the default in development).
+ *
+ * Both are read at build time for statically rendered pages, so they must be
+ * present as build args in Docker — see the Dockerfile.
+ */
+export function umamiConfig(): UmamiConfig | null {
+  const hostUrl = process.env.UMAMI_HOST_URL?.trim().replace(/\/+$/, "");
+  const websiteId = process.env.UMAMI_WEBSITE_ID?.trim();
+  if (!hostUrl || !websiteId) return null;
+  return { hostUrl, websiteId };
+}
+
+/**
+ * Path segments that are opaque identifiers rather than page names.
+ *
+ * Sending them would put episode IDs, series IDs and — worst — unlisted share
+ * IDs into the analytics database. Share links are secret by design, so leaking
+ * one there effectively publishes it. Collapsing them also makes the reports
+ * useful: one "/episodes/[id]" row instead of thousands of singletons.
+ */
+export function redactPath(pathname: string): string {
+  const seg = pathname.split("/").filter(Boolean);
+
+  // "/episodes/new" is a real page; "/episodes/<cuid>" is not.
+  if (seg[0] === "episodes" && seg[1] && seg[1] !== "new") seg[1] = "[id]";
+  else if (seg[0] === "series" && seg[1]) seg[1] = "[id]";
+  else if (seg[0] === "p" && seg[1]) seg[1] = "[shareId]";
+  else if (seg[0] === "admin" && seg[1] === "users" && seg[2]) seg[2] = "[id]";
+
+  return `/${seg.join("/")}`;
+}
+
+/**
+ * Redact a full URL: collapse identifier segments and drop the query string and
+ * hash outright.
+ *
+ * The query string is the sharper hazard — /reset-password carries a live
+ * password-reset token in `?token=`, and /sign-in carries the visitor's intended
+ * destination in `?redirect=`. `data-exclude-search` already strips it; this is
+ * the second line of defence, and it also covers the referrer field, which the
+ * tracker fills from the previous URL.
+ */
+export function redactUrl(raw: string): string {
+  if (!raw) return raw;
+  try {
+    // Bare paths are the common case; the base only matters for absolute URLs.
+    const url = new URL(raw, "http://localhost");
+    const path = redactPath(url.pathname);
+    return url.origin === "http://localhost" && !raw.startsWith("http")
+      ? path
+      : `${url.origin}${path}`;
+  } catch {
+    // Unparseable — return just the redacted path portion, never the raw value.
+    return redactPath(raw.split(/[?#]/)[0]);
+  }
+}
+
+/** Whether a path carries user content that its <title> would expose. */
+function isRedacted(pathname: string): boolean {
+  return redactPath(pathname) !== pathname;
+}
+
+/**
+ * Page titles on detail routes are the user's own content — `generateMetadata`
+ * returns the episode or series title verbatim. Swap those for the route name so
+ * the reports stay readable without storing anyone's content.
+ */
+export function redactTitle(title: string, url: string): string {
+  let pathname: string;
+  try {
+    pathname = new URL(url, "http://localhost").pathname;
+  } catch {
+    pathname = url.split(/[?#]/)[0];
+  }
+  return isRedacted(pathname) ? `${redactPath(pathname)} · Podcast Distribution AI` : title;
+}
+
+/** The Umami event payload we are allowed to inspect and rewrite. */
+export interface UmamiPayload {
+  url?: string;
+  referrer?: string;
+  title?: string;
+  [key: string]: unknown;
+}
+
+/** Apply every redaction rule to one outgoing event payload. */
+export function redactPayload(payload: UmamiPayload): UmamiPayload {
+  const url = payload.url ? redactUrl(payload.url) : payload.url;
+  return {
+    ...payload,
+    ...(url !== undefined ? { url } : {}),
+    ...(payload.referrer ? { referrer: redactUrl(payload.referrer) } : {}),
+    ...(payload.title && payload.url
+      ? { title: redactTitle(payload.title, payload.url) }
+      : {}),
+  };
+}

lib/auth/auth.ts

@@ -1,10 +1,30 @@
 import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
-import { admin, organization } from "better-auth/plugins";
+import { admin, captcha, organization } from "better-auth/plugins";
 import { nextCookies } from "better-auth/next-js";
+import { createAuthMiddleware, APIError } from "better-auth/api";
 import { prisma } from "@/lib/db";
 import { sendEmail, emailLayout } from "@/lib/email";
 
+/**
+ * Enforce the `signups_enabled` kill-switch on the REAL registration path.
+ *
+ * The sign-up page also checks this flag, but that only hides the form — a
+ * client can still POST /api/auth/sign-up/email directly. This is the actual
+ * boundary. `@/lib/flags` is imported dynamically because it pulls in
+ * `server-only`, which throws when lib/* is loaded outside Next's RSC bundler
+ * (the worker runs under plain tsx); a lazy import keeps that cost off the
+ * module graph until an actual sign-up is attempted.
+ */
+async function assertSignupsEnabled(): Promise<void> {
+  const { isFlagEnabled } = await import("@/lib/flags");
+  if (!(await isFlagEnabled("signups_enabled"))) {
+    throw new APIError("FORBIDDEN", {
+      message: "Sign-ups are currently paused. Please check back soon.",
+    });
+  }
+}
+
 const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000";
 
 const googleConfigured = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
@@ -24,6 +44,81 @@ if (secretIsWeak && process.env.NODE_ENV === "production") {
   );
 }
 
+/**
+ * Guard impersonation — the single most powerful action in the platform.
+ *
+ * Two problems with leaving this to the better-auth admin plugin alone:
+ *   1. It is the ONLY admin mutation with no entry in our audit log, so a
+ *      compromised admin account can read every user's data untraceably.
+ *   2. Nothing stops one admin impersonating another, which is lateral
+ *      movement between privileged accounts rather than support access.
+ *
+ * Enforcing it here (rather than in the server action) means a direct POST to
+ * /api/auth/admin/impersonate-user is covered too.
+ */
+async function guardImpersonation(headers: Headers, targetUserId: unknown): Promise<void> {
+  if (typeof targetUserId !== "string" || !targetUserId) {
+    throw new APIError("BAD_REQUEST", { message: "A target user id is required." });
+  }
+  // `auth` is referenced lazily: this runs per-request, long after module init.
+  const session = await auth.api.getSession({ headers });
+  if (!session || session.user.role !== "admin") {
+    throw new APIError("FORBIDDEN", { message: "Not allowed." });
+  }
+  const target = await prisma.user.findUnique({
+    where: { id: targetUserId },
+    select: { id: true, role: true, email: true },
+  });
+  if (!target) throw new APIError("NOT_FOUND", { message: "User not found." });
+  if (target.role === "admin") {
+    throw new APIError("FORBIDDEN", {
+      message: "Admins cannot impersonate other admins.",
+    });
+  }
+  await prisma.auditLog.create({
+    data: {
+      actorId: session.user.id,
+      actorType: "admin",
+      action: "user.impersonate",
+      target: target.id,
+      metadata: { targetEmail: target.email },
+    },
+  });
+}
+
+/**
+ * Cloudflare Turnstile — bot protection on the public auth endpoints.
+ *
+ * The plugin verifies the `x-captcha-response` header server-side against
+ * Cloudflare's siteverify API BEFORE the handler runs, so it is the real
+ * boundary: hiding/!rendering the widget client-side proves nothing, and a
+ * bot POSTing straight to /api/auth/sign-in/email is rejected here.
+ *
+ * Enabled whenever TURNSTILE_SECRET_KEY is set. Required in production so a
+ * misconfigured deploy cannot silently ship with bot protection switched off
+ * (same fail-fast posture as BETTER_AUTH_SECRET above); left optional in
+ * dev/test so local work stays frictionless without Cloudflare keys.
+ */
+const turnstileSecretKey = process.env.TURNSTILE_SECRET_KEY?.trim();
+const turnstileEnabled = !!turnstileSecretKey;
+if (!turnstileEnabled && process.env.NODE_ENV === "production") {
+  throw new Error(
+    "TURNSTILE_SECRET_KEY must be set in production — Turnstile guards the sign-in, sign-up and password-reset endpoints."
+  );
+}
+// Guard the asymmetric misconfiguration: with a secret but no site key the server
+// would demand a captcha token that no form can produce, locking every user out
+// of sign-in. Fail the boot (and the production build) instead of shipping that.
+if (
+  turnstileEnabled &&
+  !process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY?.trim() &&
+  process.env.NODE_ENV === "production"
+) {
+  throw new Error(
+    "NEXT_PUBLIC_TURNSTILE_SITE_KEY must be set alongside TURNSTILE_SECRET_KEY — without it the auth forms cannot render the Turnstile widget and every sign-in would be rejected."
+  );
+}
+
 export const auth = betterAuth({
   appName: "Podcast Distribution AI",
   secret: process.env.BETTER_AUTH_SECRET,
@@ -93,6 +188,30 @@ export const auth = betterAuth({
     accountLinking: { enabled: true, trustedProviders: ["google"] },
   },
 
+  hooks: {
+    before: createAuthMiddleware(async (ctx) => {
+      if (ctx.path === "/sign-up/email") await assertSignupsEnabled();
+      if (ctx.path === "/admin/impersonate-user") {
+        await guardImpersonation(ctx.headers ?? new Headers(), (ctx.body as { userId?: unknown } | undefined)?.userId);
+      }
+    }),
+  },
+
+  // Catch-all: a user row is only ever created by registration, so this also
+  // covers first-time Google sign-in, which does not hit /sign-up/email.
+  // (scripts/create-admin.ts and scripts/seed-demo.ts write via Prisma directly
+  // and are intentionally unaffected.)
+  databaseHooks: {
+    user: {
+      create: {
+        before: async (user) => {
+          await assertSignupsEnabled();
+          return { data: user };
+        },
+      },
+    },
+  },
+
   plugins: [
     admin({ defaultRole: "user", adminRoles: ["admin"] }),
     organization({
@@ -100,6 +219,20 @@ export const auth = betterAuth({
       // Agency seat cap is enforced in app logic against the subscription's seat count.
       membershipLimit: 5,
     }),
+    // Bot protection. Endpoints listed explicitly rather than relying on the
+    // plugin default so adding one is a deliberate, reviewable change.
+    // `/reset-password` is intentionally absent: it is reached only with a
+    // single-use token emailed to a verified address, and challenging it would
+    // break the emailed-link flow.
+    ...(turnstileEnabled
+      ? [
+          captcha({
+            provider: "cloudflare-turnstile",
+            secretKey: turnstileSecretKey!,
+            endpoints: ["/sign-in/email", "/sign-up/email", "/request-password-reset"],
+          }),
+        ]
+      : []),
     // Must remain last: lets Server Actions / route handlers set auth cookies.
     nextCookies(),
   ],

lib/auth/turnstile.ts

@@ -0,0 +1,16 @@
+/**
+ * Cloudflare Turnstile site key, resolved server-side.
+ *
+ * Read at request time and passed down to the auth forms as a prop (the same
+ * pattern `googleEnabled` uses) rather than referenced inside a client
+ * component. `NEXT_PUBLIC_*` values referenced in client code are inlined at
+ * BUILD time, which would bake the key into the Docker image and require a
+ * rebuild to rotate it; reading it here keeps it a runtime concern.
+ *
+ * Null when unset — the forms then render without a challenge. The server-side
+ * enforcement in `lib/auth/auth.ts` is keyed off TURNSTILE_SECRET_KEY, which is
+ * mandatory in production.
+ */
+export function getTurnstileSiteKey(): string | null {
+  return process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY?.trim() || null;
+}

lib/billing/paypal.ts

@@ -24,7 +24,24 @@ export function isPaypalConfigured(): boolean {
   return !!(process.env.PAYPAL_CLIENT_ID && process.env.PAYPAL_CLIENT_SECRET);
 }
 
+// PayPal client-credentials tokens are valid for hours. Minting a fresh one per
+// call turned every inbound webhook into two outbound PayPal requests, which an
+// anonymous caller could amplify until our PayPal rate limits were exhausted.
+// Cache it in-process and refresh a minute before expiry.
+let tokenCache: { token: string; expiresAt: number } | null = null;
+let tokenInFlight: Promise<string> | null = null;
+
 async function accessToken(): Promise<string> {
+  if (tokenCache && Date.now() < tokenCache.expiresAt) return tokenCache.token;
+  // Collapse concurrent misses onto a single token request.
+  if (tokenInFlight) return tokenInFlight;
+  tokenInFlight = fetchAccessToken().finally(() => {
+    tokenInFlight = null;
+  });
+  return tokenInFlight;
+}
+
+async function fetchAccessToken(): Promise<string> {
   const { id, secret } = creds();
   const res = await fetch(`${base()}/v1/oauth2/token`, {
     method: "POST",
@@ -35,7 +52,10 @@ async function accessToken(): Promise<string> {
     body: "grant_type=client_credentials",
   });
   if (!res.ok) throw new Error(`PayPal token error ${res.status}`);
-  const data = (await res.json()) as { access_token: string };
+  const data = (await res.json()) as { access_token: string; expires_in?: number };
+  // Default to 5 minutes if PayPal omits expires_in; refresh 60s early.
+  const ttlSec = Math.max((data.expires_in ?? 300) - 60, 60);
+  tokenCache = { token: data.access_token, expiresAt: Date.now() + ttlSec * 1000 };
   return data.access_token;
 }
 

lib/billing/webhooks/stripe.ts

@@ -28,9 +28,13 @@ async function syncStripeSubscription(
   const item = sub.items.data[0];
   const priceId = item?.price?.id;
   const mapped = priceId ? planFromStripePrice(priceId) : null;
-  // metadata.plan is attacker-influenceable; only honour it if it's a known plan.
-  // The price-mapping fallback (derived from the real Stripe price) is preferred.
-  const plan: PlanKey = planFromMetadata(metadata?.plan) ?? mapped?.plan ?? "free";
+  // The PRICE is authoritative: it is what the customer is actually charged, and
+  // Stripe updates it on every plan change. metadata.plan is only written once at
+  // checkout (lib/billing/stripe.ts) and is NOT rewritten when a customer switches
+  // plans in the Billing Portal — trusting it first would let a downgraded customer
+  // keep the higher tier's entitlements. Metadata is a fallback for the case where
+  // a price is missing or unmapped, and is still narrowed to a known PlanKey.
+  const plan: PlanKey = mapped?.plan ?? planFromMetadata(metadata?.plan) ?? "free";
   const referenceId = metadata?.subjectId || sub.metadata?.subjectId;
   if (!referenceId || referenceId.trim() === "") {
     console.warn("[stripe] subscription without subjectId metadata, skipping", sub.id);

lib/episodes/status.ts

@@ -41,6 +41,36 @@ export async function finishJob(
   });
 }
 
+/**
+ * Generic, user-safe copy for a failed generation.
+ *
+ * Episode.errorMessage is rendered straight to the end user (see
+ * app/(app)/episodes/[id]/page.tsx) and streamed over SSE, so it must never
+ * carry raw pipeline text: ffmpeg stderr leaks internal binary paths, and an
+ * ElevenLabs/OpenAI response body leaks our upstream quota and billing state.
+ */
+export const GENERIC_FAILURE =
+  "Generation failed. Our team has been notified — please try again shortly.";
+
+/**
+ * Record a terminal pipeline failure.
+ *
+ * The RAW error is preserved on GenerationJob.error, which is only ever surfaced
+ * in the admin UI (lib/admin/ops.ts), so debuggability is unchanged. The episode
+ * itself gets the generic message above.
+ */
+export async function failEpisode(
+  episodeId: string,
+  rawError: string,
+  userMessage: string = GENERIC_FAILURE
+): Promise<void> {
+  await prisma.generationJob.updateMany({
+    where: { episodeId, status: { in: ["queued", "running"] } },
+    data: { status: "failed", error: rawError, finishedAt: new Date() },
+  });
+  await setEpisodeStatus(episodeId, "FAILED", { errorMessage: userMessage });
+}
+
 /** Terminal episode states — used by the UI/SSE to stop polling. */
 export function isTerminal(status: EpisodeStatus): boolean {
   return status === "READY" || status === "FAILED";

lib/ratelimit/index.ts

@@ -87,4 +87,7 @@ export const LIMITS = {
   read: { points: 120, durationSec: 60 }, // 120 read/list calls / min / key
   stream: { points: 30, durationSec: 60 }, // SSE (re)connects / min / user
   publicMedia: { points: 120, durationSec: 60 }, // anon audio/cover (Range) reqs / min / IP
+  seriesPlan: { points: 5, durationSec: 3600 }, // season plans / hr / user (uncapped GPT-4o call)
+  export: { points: 10, durationSec: 60 }, // zip exports / min / user (buffers MP3 in memory)
+  webhook: { points: 60, durationSec: 60 }, // anon webhook posts / min / IP
 } as const;

lib/schema.ts

@@ -0,0 +1,143 @@
+import { PLANS, PLAN_ORDER } from "@/lib/billing/plans";
+import { SITE_DESCRIPTION, SITE_NAME, SITE_URL, absoluteUrl } from "@/lib/seo";
+
+/**
+ * schema.org JSON-LD builders.
+ *
+ * Everything is emitted into a single `@graph` per page with stable `@id`s, so
+ * nodes can reference each other (e.g. the software product is `publisher`-ed by
+ * the organization) instead of being repeated on every route.
+ */
+
+const ORG_ID = `${SITE_URL}/#organization`;
+const SITE_ID = `${SITE_URL}/#website`;
+const APP_ID = `${SITE_URL}/#software`;
+
+export function organizationSchema() {
+  return {
+    "@type": "Organization",
+    "@id": ORG_ID,
+    name: SITE_NAME,
+    url: absoluteUrl("/"),
+    description: SITE_DESCRIPTION,
+    logo: {
+      "@type": "ImageObject",
+      url: absoluteUrl("/logo-dark.png"),
+      contentUrl: absoluteUrl("/logo-dark.png"),
+    },
+    contactPoint: [
+      {
+        "@type": "ContactPoint",
+        contactType: "customer support",
+        email: "support@podcastdistributionai.com",
+        availableLanguage: ["English"],
+      },
+    ],
+  };
+}
+
+export function websiteSchema() {
+  return {
+    "@type": "WebSite",
+    "@id": SITE_ID,
+    url: absoluteUrl("/"),
+    name: SITE_NAME,
+    description: SITE_DESCRIPTION,
+    publisher: { "@id": ORG_ID },
+    inLanguage: "en",
+  };
+}
+
+/**
+ * The product itself, with one Offer per plan. Prices come from the plan catalog
+ * so the markup can never drift from what the pricing page actually charges.
+ */
+export function softwareApplicationSchema() {
+  return {
+    "@type": "SoftwareApplication",
+    "@id": APP_ID,
+    name: SITE_NAME,
+    url: absoluteUrl("/"),
+    description: SITE_DESCRIPTION,
+    applicationCategory: "MultimediaApplication",
+    applicationSubCategory: "Podcast production",
+    operatingSystem: "Web browser",
+    publisher: { "@id": ORG_ID },
+    featureList: [
+      "AI podcast script generation",
+      "Realistic multi-voice text-to-speech",
+      "AI-generated episode cover art",
+      "Content repurposing to blog and social posts",
+      "Series and season generator",
+      "13+ languages",
+      "Team workspace and white-label branding",
+      "REST API access",
+    ],
+    offers: PLAN_ORDER.map((key) => {
+      const plan = PLANS[key];
+      return {
+        "@type": "Offer",
+        name: `${plan.name} plan`,
+        description: plan.tagline,
+        price: (plan.priceMonthly / 100).toFixed(2),
+        priceCurrency: "USD",
+        category: plan.priceMonthly === 0 ? "Free" : "Subscription",
+        url: absoluteUrl("/pricing"),
+        availability: "https://schema.org/InStock",
+      };
+    }),
+  };
+}
+
+/** A single page node, linked to the site — gives each URL an explicit identity. */
+export function webPageSchema({
+  path,
+  name,
+  description,
+}: {
+  path: string;
+  name: string;
+  description: string;
+}) {
+  return {
+    "@type": "WebPage",
+    "@id": `${absoluteUrl(path)}#webpage`,
+    url: absoluteUrl(path),
+    name,
+    description,
+    isPartOf: { "@id": SITE_ID },
+    about: { "@id": ORG_ID },
+    inLanguage: "en",
+  };
+}
+
+/** Breadcrumbs from Home to the current page. Pass the trail without Home. */
+export function breadcrumbSchema(trail: { name: string; path: string }[]) {
+  return {
+    "@type": "BreadcrumbList",
+    "@id": `${absoluteUrl(trail[trail.length - 1]?.path ?? "/")}#breadcrumb`,
+    itemListElement: [{ name: "Home", path: "/" }, ...trail].map((item, i) => ({
+      "@type": "ListItem",
+      position: i + 1,
+      name: item.name,
+      item: absoluteUrl(item.path),
+    })),
+  };
+}
+
+export function faqPageSchema(items: { q: string; a: string }[]) {
+  return {
+    "@type": "FAQPage",
+    "@id": `${absoluteUrl("/faq")}#faq`,
+    mainEntity: items.map(({ q, a }) => ({
+      "@type": "Question",
+      name: q,
+      acceptedAnswer: { "@type": "Answer", text: a },
+    })),
+  };
+}
+
+/** Wrap nodes into the `@graph` envelope every page emits. */
+export function graph(...nodes: Record<string, unknown>[]) {
+  return { "@context": "https://schema.org", "@graph": nodes };
+}

lib/seo.ts

@@ -0,0 +1,160 @@
+import type { Metadata } from "next";
+
+/**
+ * Central SEO configuration — the single source of truth for the canonical
+ * origin, brand naming, and shared metadata construction. Every page that needs
+ * a canonical URL, an Open Graph card, or JSON-LD should build it from here so
+ * the values can never drift between routes.
+ */
+
+export const SITE_NAME = "Podcast Distribution AI";
+
+export const SITE_TAGLINE = "From topic idea to published podcast in minutes";
+
+export const SITE_DESCRIPTION =
+  "Podcast Distribution AI is an all-in-one AI platform that writes your script, records realistic multi-voice audio, and designs cover art — turning a topic into a finished episode in minutes.";
+
+/** Brand accent (--brand, light theme) as a hex literal for OG image rendering. */
+export const BRAND_HEX = "#e65000";
+
+/**
+ * The canonical, absolute origin of the deployment (no trailing slash).
+ *
+ * Canonical tags, sitemap entries and OG URLs are only correct if this is the
+ * real public origin, so a production build refuses to silently fall back to
+ * localhost: an unset NEXT_PUBLIC_APP_URL would otherwise ship canonicals
+ * pointing at http://localhost:3000 and de-index the whole site.
+ */
+function resolveSiteUrl(): string {
+  const raw = process.env.NEXT_PUBLIC_APP_URL?.trim();
+
+  if (raw) {
+    try {
+      const url = new URL(raw);
+      // Strip any trailing slash so `${SITE_URL}${path}` never doubles up.
+      return url.origin;
+    } catch {
+      throw new Error(
+        `[seo] NEXT_PUBLIC_APP_URL is not a valid absolute URL: ${JSON.stringify(raw)}`
+      );
+    }
+  }
+
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(
+      "[seo] NEXT_PUBLIC_APP_URL must be set in production — it is the canonical origin used for canonical tags, the sitemap, robots.txt and Open Graph URLs."
+    );
+  }
+
+  return "http://localhost:3000";
+}
+
+export const SITE_URL = resolveSiteUrl();
+
+/** Resolve a root-relative path to its absolute canonical URL. */
+export function absoluteUrl(path = "/"): string {
+  return path === "/" ? `${SITE_URL}/` : `${SITE_URL}${path.startsWith("/") ? path : `/${path}`}`;
+}
+
+/**
+ * The site-wide social card (app/opengraph-image.tsx).
+ *
+ * It has to be restated on every page: Next merges `metadata` shallowly, so a
+ * page that defines its own `openGraph` object replaces the root layout's
+ * entirely — including the images the file convention contributed. Leaving this
+ * out silently drops og:image from every page but the homepage.
+ */
+const DEFAULT_OG_IMAGE = {
+  url: "/opengraph-image",
+  width: 1200,
+  height: 630,
+  alt: `${SITE_NAME} — from a topic idea to a finished podcast in minutes`,
+};
+
+interface PageMetaOptions {
+  title: string;
+  description: string;
+  /** Root-relative path, e.g. "/pricing". Used for the canonical + OG URL. */
+  path: string;
+  /** Keep the page out of the index (authed surfaces, share links, utilities). */
+  noIndex?: boolean;
+  /** Override the social card image path (defaults to the site-wide OG card). */
+  image?: string;
+  type?: "website" | "article";
+}
+
+/**
+ * Build a complete, canonical-tagged Metadata object for a page. Next.js merges
+ * this over the root layout's metadata, so only the differing fields are set.
+ */
+export function pageMetadata({
+  title,
+  description,
+  path,
+  noIndex = false,
+  image,
+  type = "website",
+}: PageMetaOptions): Metadata {
+  const url = absoluteUrl(path);
+  const images = image ? [{ url: image }] : [DEFAULT_OG_IMAGE];
+
+  return {
+    title,
+    description,
+    alternates: { canonical: url },
+    openGraph: {
+      title: `${title} · ${SITE_NAME}`,
+      description,
+      url,
+      siteName: SITE_NAME,
+      type,
+      locale: "en_US",
+      images,
+    },
+    twitter: {
+      card: "summary_large_image",
+      title: `${title} · ${SITE_NAME}`,
+      description,
+      images,
+    },
+    ...(noIndex
+      ? { robots: { index: false, follow: false, nocache: true, googleBot: { index: false, follow: false } } }
+      : {}),
+  };
+}
+
+/** Metadata for surfaces that must never be indexed (app, admin, auth). */
+export const NO_INDEX: Metadata = {
+  robots: {
+    index: false,
+    follow: false,
+    nocache: true,
+    googleBot: { index: false, follow: false, noimageindex: true },
+  },
+};
+
+const MONTHS = [
+  "january", "february", "march", "april", "may", "june",
+  "july", "august", "september", "october", "november", "december",
+];
+
+/**
+ * Convert a human "Month D, YYYY" stamp (as rendered on the legal pages) into a
+ * calendar-only ISO-8601 date for schema.org `dateModified`.
+ *
+ * Parsed explicitly rather than via `new Date(...)` so the result can never be
+ * shifted a day by the server's timezone. Returns undefined for anything it does
+ * not recognise, so callers omit the property instead of emitting a bad date.
+ */
+export function toIsoDate(display: string): string | undefined {
+  const match = /^([A-Za-z]+)\s+(\d{1,2}),\s*(\d{4})$/.exec(display.trim());
+  if (!match) return undefined;
+
+  const month = MONTHS.indexOf(match[1].toLowerCase());
+  if (month < 0) return undefined;
+
+  const day = Number(match[2]);
+  if (day < 1 || day > 31) return undefined;
+
+  return `${match[3]}-${String(month + 1).padStart(2, "0")}-${String(day).padStart(2, "0")}`;
+}

middleware.ts

@@ -38,13 +38,41 @@ export function middleware(req: NextRequest) {
 
   // Per-request nonce (base64). randomUUID is Edge-runtime safe and unguessable.
   const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
+  // Cloudflare Turnstile needs three allowances: its script, the IFRAME the widget
+  // actually renders into, and the XHRs that script makes. Without frame-src the
+  // iframe falls back to default-src 'self' and the challenge silently never
+  // appears — leaving the submit button permanently disabled.
+  const TURNSTILE_ORIGIN = "https://challenges.cloudflare.com";
+  // `next dev` compiles client chunks with eval() (HMR + cheap source maps) and
+  // talks to the dev server over a websocket. Without these two dev-only
+  // relaxations the CSP throws EvalError, hydration dies, and NOTHING on the page
+  // is interactive — no Turnstile widget, and form submit handlers never fire.
+  // Production builds need neither, so the shipped policy stays strict.
+  const isDev = process.env.NODE_ENV !== "production";
+  const devScriptSrc = isDev ? " 'unsafe-eval'" : "";
+  const devConnectSrc = isDev ? " ws: http://localhost:* http://127.0.0.1:*" : "";
   const csp = [
     "default-src 'self'",
-    `script-src 'self' 'nonce-${nonce}' 'strict-dynamic'`,
+    // NOTE: deliberately NOT 'strict-dynamic'.
+    //
+    // 'strict-dynamic' makes browsers ignore 'self' and every host-source in this
+    // directive, leaving the nonce as the only way in. That works on dynamically
+    // rendered routes, where Next stamps the per-request nonce onto its <script>
+    // tags — but a statically prerendered page has no request to take a nonce
+    // from, so its HTML ships without one. With 'strict-dynamic' the browser then
+    // blocked every framework chunk on /, /pricing, /features, /faq, /about and
+    // the legal pages: React never hydrated and the marketing surface was inert.
+    //
+    // Without it, 'self' covers the same-origin /_next/static chunks (and the
+    // proxied analytics tracker at /_a), and the Turnstile host-source actually
+    // takes effect instead of being silently ignored. The nonce is kept, so
+    // dynamic routes and any inline script still get the stronger guarantee.
+    `script-src 'self' 'nonce-${nonce}' ${TURNSTILE_ORIGIN}${devScriptSrc}`,
     "style-src 'self' 'unsafe-inline'",
     "img-src 'self' data: https://oaidalleapiprodscus.blob.core.windows.net https://images.unsplash.com",
     "media-src 'self'",
-    "connect-src 'self'",
+    `connect-src 'self' ${TURNSTILE_ORIGIN}${devConnectSrc}`,
+    `frame-src 'self' ${TURNSTILE_ORIGIN}`,
     "frame-ancestors 'none'",
     "base-uri 'self'",
     "form-action 'self'",

next.config.mjs

@@ -16,6 +16,23 @@ const nextConfig = {
       { protocol: "https", hostname: "images.unsplash.com" },
     ],
   },
+  // Serve the self-hosted Umami tracker and its /api/send beacon from this
+  // origin. The CSP in middleware.ts uses 'strict-dynamic', which makes browsers
+  // ignore host allowlists in script-src, and connect-src is 'self' — so a
+  // third-party tracker could not be allowlisted without weakening the policy.
+  // Proxying keeps both same-origin, and content blockers leave it alone.
+  async rewrites() {
+    const host = process.env.UMAMI_HOST_URL?.trim().replace(/\/+$/, "");
+    if (!host) return [];
+    return [{ source: "/_a/:path*", destination: `${host}/:path*` }];
+  },
+  // The OG image route reads the brand mark off disk. That path is built at
+  // runtime so Next's static file tracing cannot infer it — list it explicitly so
+  // the asset is copied into the standalone output as well.
+  outputFileTracingIncludes: {
+    "/opengraph-image": ["./app/icon.png"],
+    "/twitter-image": ["./app/icon.png"],
+  },
   // Server-only packages that should be required at runtime, not bundled by webpack.
   // better-auth ships internal adapters (kysely) that break webpack's ESM analysis.
   serverExternalPackages: ["pg-boss", "@prisma/client", "better-auth"],

package.json

@@ -35,7 +35,7 @@
     "@radix-ui/react-switch": "^1.1.2",
     "@radix-ui/react-tabs": "^1.1.2",
     "@radix-ui/react-tooltip": "^1.1.6",
-    "better-auth": "^1.1.0",
+    "better-auth": "~1.6.30",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
@@ -73,5 +73,8 @@
     "prisma": "^6.2.0",
     "tailwindcss": "^3.4.17",
     "typescript": "^5.7.0"
+  },
+  "overrides": {
+    "postcss": "^8.4.49"
   }
 }

prisma/migrations/20260907000000_episode_moderation/migration.sql

@@ -0,0 +1,7 @@
+-- Admin takedown for policy-violating episodes.
+-- Purely additive: two nullable columns + one index. No backfill required —
+-- NULL means "not moderated", which is the correct state for every existing row.
+ALTER TABLE "episode" ADD COLUMN "moderatedAt" TIMESTAMP(3);
+ALTER TABLE "episode" ADD COLUMN "moderatedBy" TEXT;
+
+CREATE INDEX "episode_moderatedAt_idx" ON "episode"("moderatedAt");

prisma/schema.prisma

@@ -308,6 +308,12 @@ model Episode {
   shareId  String?   @unique
   sharedAt DateTime?
 
+  // Admin takedown. Non-null = removed for a policy violation: the public page,
+  // the media routes, export and re-sharing are all blocked, and the owner sees
+  // a removal notice instead of the episode. Nullable so it is purely additive.
+  moderatedAt DateTime?
+  moderatedBy String?
+
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
@@ -323,6 +329,7 @@ model Episode {
   @@index([organizationId])
   @@index([seriesId])
   @@index([status])
+  @@index([moderatedAt])
   @@index([createdAt])
   @@map("episode")
 }

worker/index.ts

@@ -8,7 +8,7 @@ import {
   type EchoPayload,
 } from "@/lib/queue/jobs";
 import { runEpisodeGeneration, refundEpisodeUsage } from "@/lib/ai/pipeline/generate-episode";
-import { setEpisodeStatus } from "@/lib/episodes/status";
+import { failEpisode } from "@/lib/episodes/status";
 import { recordHeartbeat } from "@/lib/queue/health";
 
 const HEARTBEAT_NAME = "generation-worker";
@@ -89,7 +89,8 @@ async function handleGenerate(job: {
       } catch (refundErr) {
         console.error(`[generate] ${episodeId} usage refund failed`, refundErr);
       }
-      await setEpisodeStatus(episodeId, "FAILED", { errorMessage: message });
+      // Raw `message` goes to the job row (admin-only); the user sees generic copy.
+      await failEpisode(episodeId, message);
     } else {
       throw err; // let pg-boss retry with backoff
     }