┌─────────────────────────────────────────────────────────────┐
│                    Customer's Cloudflare Account             │
│                                                             │
│  ┌──────────────┐    ┌────────────────────────────────────┐ │
│  │  React SPA   │◄──►│  Cloudflare Worker (API + Webhooks)│ │
│  │  (Worker)    │    │  routes: /api/*, /webhooks/*       │ │
│  │  RTK UI Kit  │    └──────┬──────┬──────┬───────┬───────┘ │
│  │  RTK Core SDK│          │      │      │       │         │
│  └──────┬───────┘          │      │      │       │         │
│         │                  ▼      ▼      ▼       ▼         │
│         │              ┌─────┐ ┌────┐ ┌────┐ ┌──────┐     │
│         │              │ D1  │ │ R2 │ │ KV │ │  DO  │     │
│         │              │(DB) │ │(fs)│ │(ch)│ │(agt) │     │
│         │              └─────┘ └────┘ └────┘ └──────┘     │
│         │                                                   │
│         ▼                                                   │
│  ┌──────────────────┐                                       │
│  │  RealtimeKit     │  ◄── SDK connects directly from      │
│  │  (SFU + services)│      browser to RTK infrastructure    │
│  └──────────────────┘                                       │
└─────────────────────────────────────────────────────────────┘
         │ (optional)
         ▼
┌──────────────────┐
│  Sentry (SaaS)   │  ◄── Error tracking from Worker + SPA (vendor DSN + optional customer DSN)
└──────────────────┘

-- Users table — see Section 4.2 for canonical schema
-- Key columns: id (nanoid), org_id, email, name, password_hash (nullable), role (owner|admin|host|member), is_active, avatar_url

-- Meetings table — see Section 6.2 for canonical schema
-- Key columns: id (nanoid), org_id, title, slug, meeting_type, status (draft|scheduled|active|ended|cancelled), created_by, scheduling_type, is_locked

-- Meeting scheduling: See Section 6.2 for canonical scheduling schema
-- (recurring_patterns, meeting_occurrences, meeting_invites)

-- Sessions table — see Section 9.4 for canonical schema
-- Key columns: id, meeting_id, org_id, started_at, ended_at, duration_seconds, participant_count, peak_participant_count, status (active|ended), has_recording, has_transcript, has_summary, has_chat

-- Session participants table (canonical definition)
-- Tracks per-session participation (one row per user per session join)
CREATE TABLE session_participants (
  id TEXT PRIMARY KEY,              -- ulid
  org_id TEXT NOT NULL,
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  user_id TEXT REFERENCES users(id),  -- null for guests
  rtk_participant_id TEXT,          -- RTK participant ID
  display_name TEXT NOT NULL,
  role TEXT NOT NULL,
  joined_at TEXT NOT NULL DEFAULT (datetime('now')),
  left_at TEXT,
  duration_seconds INTEGER,
  is_guest INTEGER NOT NULL DEFAULT 0,
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_session_participants_session ON session_participants(session_id);
CREATE INDEX idx_session_participants_meeting ON session_participants(meeting_id);
CREATE INDEX idx_session_participants_user ON session_participants(user_id);

-- Recordings table — see Section 9.4 for canonical schema
-- Key columns: id (RTK recording ID), org_id, meeting_id, session_id, status, download_url, duration_seconds

-- Transcripts table — see Section 9.4 for canonical schema
-- Key columns: id, org_id, meeting_id, session_id, download_url, transcript_json, language

-- Summaries table — see Section 9.4 for canonical schema (table name: summaries)
-- Key columns: id, org_id, meeting_id, session_id, summary_markdown, summary_type

CREATE TABLE org_settings (
  id TEXT PRIMARY KEY DEFAULT 'default',  -- single-row table
  org_name TEXT NOT NULL,
  org_slug TEXT NOT NULL UNIQUE,
  rtk_app_id TEXT,                  -- RealtimeKit App ID
  logo_url TEXT,                    -- R2 key
  brand_color TEXT DEFAULT '#2563EB',
  default_meeting_type TEXT DEFAULT 'video',
  max_meeting_duration_minutes INTEGER DEFAULT 480,
  max_participants_per_meeting INTEGER DEFAULT 200,
  guest_access_global INTEGER NOT NULL DEFAULT 1,
  waiting_room_default INTEGER NOT NULL DEFAULT 1,
  recording_storage_provider TEXT DEFAULT 'r2',
  recording_storage_config TEXT,    -- JSON: bucket, credentials (encrypted)
  transcription_default INTEGER NOT NULL DEFAULT 0,
  phone_home_enabled INTEGER NOT NULL DEFAULT 0,
  phone_home_url TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

// wrangler.jsonc (relevant section)
{
  "durable_objects": {
    "bindings": [
      { "class_name": "RealtimeAgent", "name": "REALTIME_AGENT" }
    ]
  },
  "migrations": [
    { "new_sqlite_classes": ["RealtimeAgent"], "tag": "v1" }
  ]
}

// wrangler.jsonc bindings
{
  "d1_databases": [
    { "binding": "DB", "database_name": "rtk-platform", "database_id": "..." }
  ],
  "r2_buckets": [
    { "binding": "R2_BRANDING", "bucket_name": "rtk-branding" },
    { "binding": "R2_RECORDINGS", "bucket_name": "rtk-recordings" },
    { "binding": "R2_EXPORTS", "bucket_name": "rtk-exports" }
  ],
  "kv_namespaces": [
    { "binding": "KV_SESSIONS", "id": "..." },
    { "binding": "KV_RATE_LIMITS", "id": "..." },
    { "binding": "KV_MEETING_STATE", "id": "..." },
    { "binding": "KV_CACHE", "id": "..." }
  ],
  "vars": {
    "RTK_API_BASE": "https://api.cloudflare.com/client/v4/accounts",
    "PHONE_HOME_URL": ""
  },
  "secrets": ["ACCOUNT_ID", "RTK_API_TOKEN", "JWT_SECRET", "RESEND_API_KEY", "SENTRY_DSN_VENDOR", "SENTRY_DSN_CUSTOMER", "SENTRY_RELEASE"],
  "triggers": {
    "crons": [
      "* * * * *",     // Every minute: activate scheduled meetings (Section 6.3)
      "0 0 * * *",     // Daily midnight UTC: materialize recurring occurrences (Section 6.4)
      "0 3 * * *"      // Daily 3 AM UTC: diagnostic cleanup (Section 3.11)
    ]
  }
}

User clicks "Join Meeting"
  → SPA calls POST /api/meetings/:meetingId/join (with JWT)
  → Worker validates JWT, checks user role + meeting permissions
  → Worker calls RTK REST API: POST /realtime/kit/{APP_ID}/meetings/{MEETING_ID}/participants
     with preset matching user's role
  → RTK returns { id, token }  (Worker maps token → authToken for client response)
  → Worker stores participant record in D1
  → Worker updates KV meeting-state (increment participant count)
  → Worker returns { authToken, meetingConfig, preset_name } to SPA
  → SPA initializes RTK SDK: RealtimeKitClient.init({ authToken })
  → SDK connects to RTK SFU (direct browser → Cloudflare edge)
  → Meeting UI renders via RTK UI Kit components

RTK fires webhook event (e.g., recording.statusUpdate)
  → POST /api/webhooks/rtk
  → Worker validates webhook signature
  → Worker classifies event type
  → Worker routes to handler:
     ├── recording.statusUpdate → update recordings table, notify via WS if active
     ├── meeting.chatSynced → store chat export reference
     ├── meeting.summary → store summary in D1
     ├── meeting.started → create session record, update KV meeting-state
     ├── meeting.ended → close session record, compute duration, update analytics
     ├── meeting.participantJoined → update participant count
     ├── meeting.participantLeft → update participant record, compute duration
     ├── meeting.transcript → store transcript in D1
     └── livestreaming.statusUpdate → update livestream state
  → Handler writes to D1 + KV as needed
  → Handler writes to diagnostic_webhook_deliveries (success or failure); errors captured by Sentry automatically
  → Worker returns 200 OK (or 500 + logs failure for retry)

import * as Sentry from "@sentry/cloudflare";

// The entire Worker handler is wrapped with Sentry's withSentry()
export default Sentry.withSentry(
  (env: Env) => ({
    dsn: env.SENTRY_DSN_VENDOR,
    environment: env.ENVIRONMENT || "production",
    release: env.SENTRY_RELEASE,          // git SHA, set at deploy time
    tracesSampleRate: 0.1,                // 10% of transactions
    beforeSend(event) {
      // Strip PII: redact email, IP, auth tokens
      event = redactPII(event);
      // Forward to customer DSN if configured
      if (env.SENTRY_DSN_CUSTOMER && env.SENTRY_CUSTOMER_ENABLED !== "false") {
        forwardToCustomerSentry(event, env.SENTRY_DSN_CUSTOMER);
      }
      // Check if vendor DSN is disabled by org
      if (env.SENTRY_VENDOR_ENABLED === "false") return null; // drop event
      return event;
    },
  }),
  {
    async fetch(request, env, ctx) {
      // Sentry automatically captures unhandled exceptions,
      // attaches request data, and traces fetch() sub-requests
      return router.handle(request, env, ctx);
    },
    async scheduled(event, env, ctx) {
      ctx.waitUntil(runHealthCheck(env));
      ctx.waitUntil(cleanupOldDiagnostics(env));
    },
  }
);

import * as Sentry from "@sentry/react";

Sentry.init({
  dsn: config.sentryDsnVendor,  // fetched from Worker config endpoint
  environment: config.environment,
  release: config.release,
  integrations: [
    Sentry.browserTracingIntegration(),
    Sentry.replayIntegration({ maskAllText: false, blockAllMedia: false }),
  ],
  tracesSampleRate: 0.1,
  replaysSessionSampleRate: 0.1,  // 10% of sessions
  replaysOnErrorSampleRate: 1.0,  // 100% of sessions with errors
  beforeSend(event) {
    event = redactPII(event);
    if (config.sentryDsnCustomer) {
      forwardToCustomerSentry(event, config.sentryDsnCustomer);
    }
    if (!config.sentryVendorEnabled) return null;
    return event;
  },
});

function makeDualTransport(vendorDsn: string, customerDsn?: string) {
  const vendorTransport = Sentry.makeFetchTransport({ dsn: vendorDsn });
  const customerTransport = customerDsn
    ? Sentry.makeFetchTransport({ dsn: customerDsn })
    : null;

  return (options: Sentry.TransportOptions) => ({
    send: async (envelope: Sentry.Envelope) => {
      const results = await Promise.allSettled([
        vendorTransport(options).send(envelope),
        customerTransport ? customerTransport(options).send(envelope) : Promise.resolve(),
      ]);
      return results[0].status === "fulfilled" ? results[0].value : results[1].value;
    },
    flush: (timeout?: number) => vendorTransport(options).flush(timeout),
  });
}

# Deploy script uploads source maps to Sentry
SENTRY_RELEASE=$(sentry-cli releases propose-version)
wrangler deploy --var SENTRY_RELEASE:$SENTRY_RELEASE
sentry-cli sourcemaps upload --release=$SENTRY_RELEASE dist/

# wrangler.toml
[observability]
enabled = true

[observability.logs]
head_sampling_rate = 1  # 1.0 = 100% of requests logged (adjust for cost)

[observability.traces]
enabled = true
head_sampling_rate = 0.01  # 1% of requests traced (adjust for cost vs visibility)

// In the RTK API client wrapper (auth/retries layer)
if (!res.ok) {
  const body = await res.text();
  console.error(JSON.stringify({
    rtk_api_error: { method, endpoint, status: res.status, body: body.slice(0, 500) }
  }));
  // Workers Observability captures this console.error, making it searchable
}

# wrangler.toml (if using direct OTel export — alternative to SDK-based tracing)
[observability]
enabled = true

[observability.logs]
enabled = true
invocation_logs = true  # log start/end of each invocation

# Export config is set via Cloudflare dashboard or API:
# Destination: Sentry OTLP endpoint
# Protocol: OTLP/HTTP

CREATE TABLE diagnostic_webhook_deliveries (
  id TEXT PRIMARY KEY,              -- ulid (time-sortable)
  org_id TEXT NOT NULL,
  webhook_event_type TEXT NOT NULL, -- e.g., recording.statusUpdate, meeting.summary
  rtk_event_id TEXT,                -- event ID from RTK payload
  meeting_id TEXT,
  session_id TEXT,
  status TEXT NOT NULL CHECK(status IN ('received','processing','processed','failed','retry_exhausted')),
  processing_duration_ms INTEGER,
  error_message TEXT,               -- null if success
  payload_summary TEXT,             -- truncated/redacted payload for debugging
  received_at TEXT NOT NULL DEFAULT (datetime('now')),
  processed_at TEXT
);
CREATE INDEX idx_webhook_org_time ON diagnostic_webhook_deliveries(org_id, received_at DESC);
CREATE INDEX idx_webhook_status ON diagnostic_webhook_deliveries(org_id, status);
CREATE INDEX idx_webhook_event ON diagnostic_webhook_deliveries(org_id, webhook_event_type, received_at DESC);
CREATE INDEX idx_webhook_meeting ON diagnostic_webhook_deliveries(meeting_id, received_at DESC);

CREATE TABLE diagnostic_health_snapshots (
  id TEXT PRIMARY KEY,              -- ulid
  org_id TEXT NOT NULL,
  check_type TEXT NOT NULL CHECK(check_type IN ('scheduled','manual','phone_home')),
  status TEXT NOT NULL CHECK(status IN ('healthy','degraded','unhealthy')),
  d1_latency_ms INTEGER,
  kv_latency_ms INTEGER,
  r2_latency_ms INTEGER,
  rtk_api_latency_ms INTEGER,
  rtk_api_reachable INTEGER NOT NULL DEFAULT 1,
  active_meetings_count INTEGER NOT NULL DEFAULT 0,
  active_participants_count INTEGER NOT NULL DEFAULT 0,
  details TEXT,                     -- JSON: per-check details
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_health_org_time ON diagnostic_health_snapshots(org_id, created_at DESC);
CREATE INDEX idx_health_status ON diagnostic_health_snapshots(org_id, status);

// In the React meeting component, after RTK meeting is initialized:

// Media permission errors
meeting.self.on("mediaPermissionError", ({ message, kind }) => {
  // message: DENIED | SYSTEM_DENIED | COULD_NOT_START
  // kind: audio | video | screenshare
  Sentry.captureException(new Error(`Media permission: ${kind} - ${message}`), {
    tags: { component: "rtk-sdk", error_type: "media_permission", meeting_id: meeting.meta.meetingId },
  });
});

// WebRTC media connection state
meeting.meta.on("mediaConnectionUpdate", ({ transport, state }) => {
  if (state === "failed") {
    Sentry.captureException(new Error(`WebRTC ${transport} connection failed`), {
      tags: { component: "rtk-sdk", error_type: "media_connection", meeting_id: meeting.meta.meetingId },
    });
  }
  Sentry.addBreadcrumb({ category: "rtk", message: `Media ${transport}: ${state}`, level: "info" });
});

// Signaling WebSocket state
meeting.meta.on("socketConnectionUpdate", ({ state, reconnectionAttempt, reconnected }) => {
  if (state === "failed") {
    Sentry.captureException(new Error("Signaling WebSocket connection failed"), {
      tags: { component: "rtk-sdk", error_type: "socket_connection", meeting_id: meeting.meta.meetingId },
    });
  }
  Sentry.addBreadcrumb({ category: "rtk", message: `Socket: ${state}${reconnected ? " (reconnected)" : ""}`, level: "info" });
});

// Per-participant media quality (score 0-10)
meeting.self.on("mediaScoreUpdate", ({ kind, score, scoreStats }) => {
  Sentry.addBreadcrumb({ category: "rtk", message: `Quality ${kind}: ${score}/10`, level: "info", data: scoreStats });
});

// Join flow — each step adds a breadcrumb, failure at any step fires captureException with full trail
async function joinMeeting(meetingId: string) {
  const addStep = (step: string) =>
    Sentry.addBreadcrumb({ category: "join_flow", message: step, level: "info" });

  try {
    addStep("join_flow:requesting_token");
    const { authToken, participantId } = await api.post(`/meetings/${meetingId}/join`);

    Sentry.setTag("participant_id", participantId);
    addStep("join_flow:token_received");

    addStep("join_flow:sdk_init");
    const meeting = await RTKClient.init({ authToken });

    addStep("join_flow:connecting");
    await meeting.join();

    // Track room state transitions via roomJoined + roomLeft events
    meeting.self.on("roomJoined", () => {
      Sentry.addBreadcrumb({ category: "rtk", message: "Room joined", level: "info" });
    });
    meeting.self.on("roomLeft", ({ state }) => {
      // state: left | kicked | ended | rejected | disconnected | failed
      if (["disconnected", "kicked", "rejected", "failed"].includes(state)) {
        Sentry.captureMessage(`Meeting ended unexpectedly: ${state}`, {
          level: "warning",
          tags: { component: "rtk-sdk", meeting_id: meetingId },
        });
      }
      Sentry.addBreadcrumb({ category: "rtk", message: `Room left: ${state}`, level: "info" });
    });

    addStep("join_flow:joined");
  } catch (err) {
    // All breadcrumbs from prior steps are attached automatically
    Sentry.captureException(err, {
      tags: { component: "join_flow", meeting_id: meetingId },
    });
    throw err;
  }
}

<Sentry.ErrorBoundary fallback={<MeetingErrorFallback />} showDialog>
  <RtkMeeting meeting={meeting} />
</Sentry.ErrorBoundary>

Request arrives → Sentry withSentry() wrapper
  → Handler executes
  → On unhandled error:
     ├── Sentry captures automatically (stack trace, request context, breadcrumbs)
     ├── Workers Observability logs the error + full fetch trace
     └── Worker returns error response
  → No custom error logging code needed

POST /api/webhooks/rtk arrives
  → Validate webhook signature
     ├── Invalid: Sentry.captureMessage("Invalid webhook signature"), return 401
     └── Valid: continue
  → Parse event type from payload
  → INSERT INTO diagnostic_webhook_deliveries (status: 'processing')
  → Route to event handler
  → On success:
     ├── UPDATE webhook delivery (status: 'processed', processing_duration_ms)
     └── Return 200
  → On failure:
     ├── Sentry.captureException(err, { tags: { webhook_event_type, meeting_id } })
     ├── UPDATE webhook delivery (status: 'failed', error_message)
     └── Return 500 (RTK will retry)

Scheduled CRON trigger (every 5 minutes) OR GET /api/diagnostics/health
  → Run parallel health probes:
     ├── D1: SELECT 1 → measure latency
     ├── KV: get test key → measure latency
     ├── R2: head test object → measure latency
     └── RTK API: GET /meetings?limit=1 → measure latency + confirm auth
  → Compute status:
     ├── healthy: all probes pass
     ├── degraded: any probe > 2s
     └── unhealthy: any probe fails
  → INSERT INTO diagnostic_health_snapshots
  → If phone_home_enabled AND (degraded OR unhealthy):
     ├── POST to vendor phone-home endpoint
     └── Log delivery result
  → Return health JSON

RTK SDK error event fires in browser
  → Our event listener calls Sentry.captureException() with tags
  → Sentry SDK sends to vendor DSN (and customer DSN if configured)
  → No Worker round-trip needed — Sentry SDK sends directly to Sentry

React component crash in meeting UI
  → Sentry.ErrorBoundary catches it
  → Sentry SDK sends crash report with component tree
  → Fallback UI shown to user

When enabled (org_settings.phone_home_enabled = 1):
  → On every health check (scheduled or manual):
     POST {PHONE_HOME_URL}/api/telemetry/health
     Body: {
       orgId (SHA-256 hashed),
       status,                    // healthy | degraded | unhealthy
       activeMeetings,
       activeParticipants,
       d1Latency, kvLatency, r2Latency, rtkApiLatency,
       workerVersion,
       sdkVersion,
       timestamp
     }
  → On FATAL Sentry event (via beforeSend hook):
     POST {PHONE_HOME_URL}/api/telemetry/alert
     Body: {
       orgId (SHA-256 hashed),
       severity: 'fatal',
       errorMessage (truncated, no PII),
       component,
       timestamp
     }

{
  "meeting_id": "...",
  "session": { "id": "...", "started_at": "...", "ended_at": "...", "duration_seconds": 3600 },
  "participants": [
    {
      "id": "...", "display_name": "...", "custom_participant_id": "...",
      "joined_at": "...", "left_at": "...", "duration": 3540,
      "device": { "os": "macOS", "browser": "Chrome 120", "is_mobile": false },
      "network": { "city": "London", "country": "GB", "asn": "AS2856", "effective_type": "4g" },
      "quality_summary": {
        "audio_mos_avg": 4.2, "audio_packet_loss_avg": 0.3, "audio_rtt_avg": 45,
        "video_mos_avg": 3.8, "video_packet_loss_avg": 1.2,
        "ice_candidate_type": "relay", "turn_used": true
      }
    }
  ],
  "webhook_deliveries": [ { "event_type": "recording.statusUpdate", "status": "processed", "...": "..." } ],
  "sentry_link": "https://sentry.io/organizations/.../issues/?query=meeting_id:..."
}

[triggers]
crons = ["0 3 * * *"]  # Daily at 03:00 UTC

# Observability — logs + traces, zero code
[observability]
enabled = true

[observability.logs]
head_sampling_rate = 1
invocation_logs = true

[observability.traces]
enabled = true
head_sampling_rate = 0.01

SENTRY_DSN_VENDOR     # Vendor's Sentry DSN (set by deployment app)
SENTRY_DSN_CUSTOMER   # Customer's Sentry DSN (optional, set via org settings)
SENTRY_RELEASE        # Git SHA (set at deploy time)
PHONE_HOME_URL        # Vendor telemetry endpoint (set by deployment app)

-- Organizations table
CREATE TABLE organizations (
  id TEXT PRIMARY KEY,              -- nanoid
  name TEXT NOT NULL,
  slug TEXT NOT NULL UNIQUE,        -- URL-safe org identifier (e.g., "acme-corp")
  rtk_app_id TEXT NOT NULL,         -- RealtimeKit App ID for this org
  owner_id TEXT NOT NULL,           -- references users.id
  settings_json TEXT DEFAULT '{}',  -- org-wide settings (JSON blob)
  guest_access_default TEXT NOT NULL DEFAULT 'link_only', -- 'disabled' | 'link_only' | 'open'
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);
-- Circular FK: organizations.owner_id → users.id, users.org_id → organizations.id

-- **Insert order**: Registration uses `PRAGMA defer_foreign_keys = ON` within a D1 `batch()` call.
-- Insert organization first (with placeholder owner_id), then user, then UPDATE organization.owner_id.
-- D1 batch() is transactional — if any statement fails, the entire batch rolls back.

-- Users table
CREATE TABLE users (
  id TEXT PRIMARY KEY,              -- nanoid
  -- > **ID and token generation**:
  -- > - Entity IDs: `nanoid(21)` with default alphabet (A-Za-z0-9_-). Package: `nanoid` (works in Workers).
  -- > - Refresh tokens: 32 random bytes via `crypto.getRandomValues(new Uint8Array(32))`, encoded as base64url. Stored as SHA-256 hash in DB.
  -- > - Guest tokens: Same generation as refresh tokens.
  -- > - JWT secret: Set via `wrangler secret put JWT_SECRET`. Generate with `openssl rand -base64 32` (minimum 256 bits).
  org_id TEXT NOT NULL REFERENCES organizations(id),
  email TEXT NOT NULL,
  name TEXT NOT NULL,
  password_hash TEXT,               -- null for SSO/guest users
  role TEXT NOT NULL DEFAULT 'member', -- 'owner' | 'admin' | 'host' | 'member'
  avatar_url TEXT,
  is_active INTEGER NOT NULL DEFAULT 1,
  last_login_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
  UNIQUE(org_id, email)
);

-- Guest access tokens (for unauthenticated meeting access)
CREATE TABLE guest_tokens (
  id TEXT PRIMARY KEY,              -- nanoid
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  display_name TEXT NOT NULL,
  email TEXT,                       -- optional, for follow-up
  token_hash TEXT NOT NULL UNIQUE,  -- hashed access token
  rtk_participant_id TEXT,          -- RTK participant ID once joined
  expires_at TEXT NOT NULL,
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_users_org ON users(org_id);
-- Note: No separate index on (org_id, email) — the UNIQUE(org_id, email) constraint auto-creates one in SQLite/D1.
CREATE INDEX idx_guest_tokens_meeting ON guest_tokens(meeting_id);
CREATE INDEX idx_guest_tokens_hash ON guest_tokens(token_hash);

1. POST /api/auth/register
   Body: { email, password, name, orgName }

   > The org is implicit per deployment — each deployed instance IS one organization.
   > orgSlug is auto-generated from orgName (slugified, URL-safe). No user input needed.

   Step 1: Create RTK app via REST API (POST /accounts/{ACCOUNT_ID}/realtime/kit/apps)
   Step 2: D1 batch() with PRAGMA defer_foreign_keys = ON:
     - INSERT organization (with rtk_app_id from step 1)
     - INSERT user with role='owner'
     - UPDATE organization SET owner_id = user.id
   Step 3: Create default presets in RTK (12 presets via POST /presets — see Section 5)

   On Step 2 failure: DELETE the RTK app (compensating action)
   On Step 3 failure: Non-fatal — presets can be created lazily on first meeting creation

   Return: { accessToken, refreshToken, user, org }

1. POST /api/auth/login
   Body: { email, password }
   →  Lookup user by email (only one org per deployment — no org selection needed)
   →  Verify password_hash (scrypt)
   →  If password_hash is NULL (SSO-provisioned user), reject with 401: 'Password login not available for this account'
   →  Return { accessToken, refreshToken, user }

2. Access token: JWT, 15-minute expiry
   Payload: { sub: user.id, org: org.id, role: user.role, iat, exp }
   Signed with: HS256 using Worker secret (JWT_SECRET env var)
   JWT implementation uses the `jose` library (panva/jose) — zero dependencies, Web Crypto API native, works in Cloudflare Workers without polyfills.

3. Refresh token: opaque token, 30-day expiry, stored hashed in D1
   POST /api/auth/refresh → new access token + rotated refresh token

1. User visits meeting link: /m/{meetingSlug}
2. If not authenticated → show guest join form (display name, optional email)
3. POST /api/meetings/{meetingId}/join
   Headers: (no Authorization header)
   Body: { displayName, email?, meetingToken }
   →  Check meeting exists and is ACTIVE
   →  Check org guest_access_global (master switch) and meeting-level guest_access override
   →  If guest access disabled → 403
   →  Validate meetingToken (from the meeting link)
   →  Create guest_tokens row
   →  Create RTK participant via REST API (preset = guest preset for this meeting type)
   →  Return { guestToken, rtk_authToken, meetingConfig }
4. Client SDK initializes with rtk_authToken
5. If waiting room enabled → guest enters waiting room; host admits/rejects

Guest Auth Context:
The join endpoint skips JWT middleware when no Authorization header is present.
The Worker creates a GuestAuthContext: { guestTokenId, orgId, role: 'guest' }.
This is passed to resolvePreset('guest', meetingType, false) to select the
correct preset. Downstream code (e.g., participant_events) uses guest_token_id
instead of user_id.

// Every authenticated route runs through this middleware
async function authMiddleware(request: Request, env: Env): Promise<AuthContext> {
  const token = request.headers.get('Authorization')?.replace('Bearer ', '');
  if (!token) throw new HTTPError(401, 'Missing token');

  // jose library — Web Crypto native, works in Workers
  // import { jwtVerify, SignJWT } from 'jose';
  // async function verifyJWT(token: string, secret: string): Promise<JWTPayload> {
  //   const key = new TextEncoder().encode(secret);
  //   const { payload } = await jwtVerify(token, key);
  //   return payload;
  // }
  const payload = await verifyJWT(token, env.JWT_SECRET);
  const user = await env.DB.prepare('SELECT id, org_id, role, is_active FROM users WHERE id = ?')
    .bind(payload.sub).first();

  if (!user || !user.is_active) throw new HTTPError(401, 'Invalid user');

  return { userId: user.id, orgId: user.org_id, role: user.role };
}

CREATE TABLE refresh_tokens (
  id TEXT PRIMARY KEY,
  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  token_hash TEXT NOT NULL UNIQUE,
  expires_at TEXT NOT NULL,
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_refresh_tokens_user ON refresh_tokens(user_id);
CREATE INDEX idx_refresh_tokens_hash ON refresh_tokens(token_hash);

Platform Role + Meeting Type → RTK Preset Name → Participant Created with That Preset

function resolvePreset(
  userRole: 'owner' | 'admin' | 'host' | 'member' | 'guest',
  meetingType: 'video' | 'audio' | 'webinar' | 'livestream',
  isCreator: boolean
): string {
  // Owner and Admin always get host preset
  if (userRole === 'owner' || userRole === 'admin') {
    return `${meetingType}_host`;
  }

  // Host gets host preset for own meetings, participant for others
  if (userRole === 'host') {
    return isCreator ? `${meetingType}_host` : `${meetingType}_participant`;
  }

  // Guest gets guest or viewer preset
  if (userRole === 'guest') {
    if (meetingType === 'webinar' || meetingType === 'livestream') {
      return `${meetingType}_viewer`;
    }
    return `${meetingType}_guest`;
  }

  // Member gets participant preset
  return `${meetingType}_participant`;
}

{
  "name": "video_host",
  "config": {
    "view_type": "GROUP_CALL",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 },
      "audio": { "enable_high_bitrate": false, "enable_stereo": false }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "ALLOWED" },
      "screenshare": { "can_produce": "ALLOWED" }
    },
    "kick_participant": true,
    "pin_participant": true,
    "can_spotlight": true,
    "disable_participant_audio": true,
    "disable_participant_video": true,
    "disable_participant_screensharing": true,
    "accept_waiting_requests": true,
    "can_accept_production_requests": true,
    "can_change_participant_permissions": true,
    "can_record": true,
    "can_livestream": false,
    "can_edit_display_name": true,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": true, "can_vote": true, "can_view": true },
    "plugins": { "can_start": true, "can_close": true, "can_edit_config": true, "config": { "access_control": "FULL_ACCESS", "handles_view_only": false } },
    "connected_meetings": { "can_alter_connected_meetings": true, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": {
    "design_tokens": {
      "theme": "dark",
      "border_radius": "rounded",
      "border_width": "thin",
      "spacing_base": 4,
      "logo": "",
      "colors": {
        "brand": { "300": "#844d1c", "400": "#9d5b22", "500": "#b56927", "600": "#d37c30", "700": "#d9904f" },
        "background": { "600": "#222222", "700": "#1f1f1f", "800": "#1b1b1b", "900": "#181818", "1000": "#141414" },
        "text": "#EEEEEE", "text_on_brand": "#EEEEEE",
        "danger": "#FF2D2D", "success": "#62A504", "warning": "#FFCD07", "video_bg": "#191919"
      }
    }
  }
}

{
  "name": "video_participant",
  "config": { "view_type": "GROUP_CALL", "...": "same as video_host" },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "ALLOWED" },
      "screenshare": { "can_produce": "ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": true,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "video_guest",
  "config": { "view_type": "GROUP_CALL", "...": "same as video_host" },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "ALLOWED" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": false,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": false },
      "private": { "can_send": false, "can_receive": true, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": false, "can_switch_to_parent_meeting": false }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "audio_host",
  "config": {
    "view_type": "AUDIO_ROOM",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 },
      "audio": { "enable_high_bitrate": true, "enable_stereo": false }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "NOT_ALLOWED" },
      "screenshare": { "can_produce": "ALLOWED" }
    },
    "kick_participant": true,
    "pin_participant": true,
    "can_spotlight": true,
    "disable_participant_audio": true,
    "disable_participant_video": true,
    "disable_participant_screensharing": true,
    "accept_waiting_requests": true,
    "can_accept_production_requests": true,
    "can_change_participant_permissions": true,
    "can_record": true,
    "can_livestream": false,
    "can_edit_display_name": true,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": true, "can_vote": true, "can_view": true },
    "plugins": { "can_start": true, "can_close": true, "can_edit_config": true, "config": { "access_control": "FULL_ACCESS", "handles_view_only": false } },
    "connected_meetings": { "can_alter_connected_meetings": true, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "audio_participant",
  "config": {
    "view_type": "AUDIO_ROOM",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 },
      "audio": { "enable_high_bitrate": true, "enable_stereo": false }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "NOT_ALLOWED" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": true,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "audio_guest",
  "config": {
    "view_type": "AUDIO_ROOM",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 },
      "audio": { "enable_high_bitrate": true, "enable_stereo": false }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "NOT_ALLOWED" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": false,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": false },
      "private": { "can_send": false, "can_receive": true, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": false, "can_switch_to_parent_meeting": false }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "webinar_host",
  "config": {
    "view_type": "WEBINAR",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "ALLOWED" },
      "screenshare": { "can_produce": "ALLOWED" }
    },
    "kick_participant": true,
    "pin_participant": true,
    "can_spotlight": true,
    "disable_participant_audio": true,
    "disable_participant_video": true,
    "disable_participant_screensharing": true,
    "accept_waiting_requests": true,
    "can_accept_production_requests": true,
    "can_change_participant_permissions": true,
    "can_record": true,
    "can_livestream": true,
    "can_edit_display_name": true,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": true, "can_vote": true, "can_view": true },
    "plugins": { "can_start": true, "can_close": true, "can_edit_config": true, "config": { "access_control": "FULL_ACCESS", "handles_view_only": false } },
    "connected_meetings": { "can_alter_connected_meetings": true, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "webinar_participant",
  "config": { "view_type": "WEBINAR", "...": "same as webinar_host" },
  "permissions": {
    "media": {
      "audio": { "can_produce": "CAN_REQUEST" },
      "video": { "can_produce": "CAN_REQUEST" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_record": false,
    "can_livestream": false,
    "show_participant_list": true,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "chat": {
      "public": { "can_send": true, "text": true, "files": false },
      "private": { "can_send": false, "can_receive": true, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "pin_participant": true,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "can_change_participant_permissions": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "recorder_type": "NONE",
    "is_recorder": false,
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "webinar_viewer",
  "config": { "view_type": "WEBINAR", "...": "same as webinar_host" },
  "permissions": {
    "media": {
      "audio": { "can_produce": "NOT_ALLOWED" },
      "video": { "can_produce": "NOT_ALLOWED" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_record": false,
    "can_livestream": false,
    "show_participant_list": false,
    "hidden_participant": false,
    "waiting_room_type": "SKIP",
    "chat": {
      "public": { "can_send": false, "text": false, "files": false },
      "private": { "can_send": false, "can_receive": false, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "pin_participant": false,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "can_change_participant_permissions": false,
    "can_edit_display_name": false,
    "hidden_participant": false,
    "recorder_type": "NONE",
    "is_recorder": false,
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": false, "can_switch_to_parent_meeting": false }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "livestream_host",
  "config": {
    "view_type": "WEBINAR",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "ALLOWED" },
      "video": { "can_produce": "ALLOWED" },
      "screenshare": { "can_produce": "ALLOWED" }
    },
    "kick_participant": true,
    "pin_participant": true,
    "can_spotlight": true,
    "disable_participant_audio": true,
    "disable_participant_video": true,
    "disable_participant_screensharing": true,
    "accept_waiting_requests": true,
    "can_accept_production_requests": true,
    "can_change_participant_permissions": true,
    "can_record": true,
    "can_livestream": true,
    "can_edit_display_name": true,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": true },
      "private": { "can_send": true, "can_receive": true, "text": true, "files": true }
    },
    "polls": { "can_create": true, "can_vote": true, "can_view": true },
    "plugins": { "can_start": true, "can_close": true, "can_edit_config": true, "config": { "access_control": "FULL_ACCESS", "handles_view_only": false } },
    "connected_meetings": { "can_alter_connected_meetings": true, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "livestream_participant",
  "config": {
    "view_type": "WEBINAR",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "CAN_REQUEST" },
      "video": { "can_produce": "CAN_REQUEST" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": true,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": true,
    "hidden_participant": false,
    "waiting_room_type": "ON_PRIVILEGED_USER_ENTRY",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": true, "text": true, "files": false },
      "private": { "can_send": false, "can_receive": true, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": true, "can_switch_to_parent_meeting": true }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

{
  "name": "livestream_viewer",
  "config": {
    "view_type": "WEBINAR",
    "max_video_streams": { "desktop": 25, "mobile": 6 },
    "max_screenshare_count": 1,
    "media": {
      "video": { "quality": "hd", "frame_rate": 30 },
      "screenshare": { "quality": "hd", "frame_rate": 15 }
    }
  },
  "permissions": {
    "media": {
      "audio": { "can_produce": "NOT_ALLOWED" },
      "video": { "can_produce": "NOT_ALLOWED" },
      "screenshare": { "can_produce": "NOT_ALLOWED" }
    },
    "kick_participant": false,
    "pin_participant": false,
    "can_spotlight": false,
    "disable_participant_audio": false,
    "disable_participant_video": false,
    "disable_participant_screensharing": false,
    "accept_waiting_requests": false,
    "can_accept_production_requests": false,
    "can_change_participant_permissions": false,
    "can_record": false,
    "can_livestream": false,
    "can_edit_display_name": false,
    "show_participant_list": false,
    "hidden_participant": false,
    "waiting_room_type": "SKIP",
    "recorder_type": "NONE",
    "is_recorder": false,
    "chat": {
      "public": { "can_send": false, "text": false, "files": false },
      "private": { "can_send": false, "can_receive": false, "text": false, "files": false }
    },
    "polls": { "can_create": false, "can_vote": true, "can_view": true },
    "plugins": { "can_start": false, "can_close": false, "can_edit_config": false, "config": { "access_control": "VIEW_ONLY", "handles_view_only": true } },
    "connected_meetings": { "can_alter_connected_meetings": false, "can_switch_connected_meetings": false, "can_switch_to_parent_meeting": false }
  },
  "ui": { "design_tokens": "...same as video_host..." }
}

PATCH /accounts/{ACCOUNT_ID}/realtime/kit/{APP_ID}/meetings/{MEETING_ID}/participants/{PARTICIPANT_ID}
Body: { "preset_name": "video_host" }

CREATE TABLE participant_events (
  id TEXT PRIMARY KEY,
  org_id TEXT NOT NULL REFERENCES organizations(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  user_id TEXT,                     -- null for guests
  guest_token_id TEXT,              -- null for authenticated users
  event_type TEXT NOT NULL,         -- 'joined' | 'left' | 'promoted' | 'demoted' | 'kicked' | 'admitted'
  preset_from TEXT,
  preset_to TEXT,
  performed_by TEXT REFERENCES users(id),  -- user_id of the person who did it
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_participant_events_meeting ON participant_events(meeting_id);
CREATE INDEX idx_participant_events_user ON participant_events(user_id);

-- Meetings table
CREATE TABLE meetings (
  id TEXT PRIMARY KEY,              -- nanoid
  org_id TEXT NOT NULL REFERENCES organizations(id),
  rtk_meeting_id TEXT,              -- RTK meeting ID (set after RTK API call)
  title TEXT NOT NULL,
  slug TEXT NOT NULL,               -- URL-friendly meeting identifier
  description TEXT,
  meeting_type TEXT NOT NULL DEFAULT 'video', -- 'video' | 'audio' | 'webinar' | 'livestream'
  scheduling_type TEXT NOT NULL DEFAULT 'instant', -- 'instant' | 'scheduled' | 'recurring' | 'permanent'
  status TEXT NOT NULL DEFAULT 'draft', -- 'draft' | 'scheduled' | 'active' | 'ended' | 'cancelled'
  created_by TEXT NOT NULL REFERENCES users(id),

  -- Scheduling fields (null for instant meetings)
  scheduled_start TEXT,             -- ISO 8601 datetime
  scheduled_end TEXT,               -- ISO 8601 datetime
  actual_start TEXT,                -- set when first participant joins
  actual_end TEXT,                  -- set when last participant leaves
  timezone TEXT DEFAULT 'UTC',

  -- Permanent room fields
  is_permanent INTEGER NOT NULL DEFAULT 0,
  vanity_slug TEXT UNIQUE,          -- e.g., "standup" → /acme-corp/m/standup

  -- Guest access (overrides org default)
  guest_access TEXT,                -- null = inherit org default | 'disabled' | 'link_only' | 'open'

  -- Meeting configuration
  waiting_room_enabled INTEGER NOT NULL DEFAULT 1,
  is_locked INTEGER NOT NULL DEFAULT 0,
  recording_auto_start INTEGER NOT NULL DEFAULT 0,
  -- Recording policy interaction (see Section 12 org_settings):
  -- org recording_policy='never' → recording_auto_start is ignored, Worker rejects all recording starts
  -- org recording_policy='always' → RTK meeting created with record_on_start=true regardless of this field
  -- org recording_policy='host_decides' → this field is honored (host's choice)
  transcription_enabled INTEGER NOT NULL DEFAULT 1,
  max_participants INTEGER DEFAULT 100,

  -- Cloud storage override (null = use org default R2)
  cloud_storage_config TEXT,        -- JSON: { provider, bucket, region, credentials_ref }

  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now')),
  UNIQUE(org_id, slug)
);

-- Recurring meeting patterns
CREATE TABLE recurring_patterns (
  id TEXT PRIMARY KEY,
  meeting_id TEXT NOT NULL REFERENCES meetings(id) ON DELETE CASCADE,
  rrule TEXT NOT NULL,              -- iCal RRULE string (e.g., "FREQ=WEEKLY;BYDAY=MO,WE,FR")
  dtstart TEXT NOT NULL,            -- pattern start date (ISO 8601)
  until_date TEXT,                  -- pattern end date (null = no end)
  occurrence_count INTEGER,         -- alternative to until_date
  exceptions TEXT DEFAULT '[]',     -- JSON array of excluded dates
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

-- Individual occurrences of recurring meetings (materialized)
CREATE TABLE meeting_occurrences (
  id TEXT PRIMARY KEY,
  meeting_id TEXT NOT NULL REFERENCES meetings(id) ON DELETE CASCADE,
  pattern_id TEXT NOT NULL REFERENCES recurring_patterns(id) ON DELETE CASCADE,
  occurrence_date TEXT NOT NULL,    -- the specific date/time of this occurrence
  status TEXT NOT NULL DEFAULT 'scheduled', -- 'scheduled' | 'active' | 'ended' | 'cancelled'
  rtk_meeting_id TEXT,              -- each occurrence gets its own RTK meeting
  actual_start TEXT,
  actual_end TEXT,
  override_json TEXT,               -- per-occurrence overrides (title, description, etc.)
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  UNIQUE(meeting_id, occurrence_date)
);

-- Meeting invites
CREATE TABLE meeting_invites (
  id TEXT PRIMARY KEY,
  meeting_id TEXT NOT NULL REFERENCES meetings(id) ON DELETE CASCADE,
  user_id TEXT REFERENCES users(id),
  email TEXT,                       -- for inviting non-members
  role_override TEXT,               -- override the user's default preset mapping
  rsvp_status TEXT DEFAULT 'pending', -- 'pending' | 'accepted' | 'declined' | 'tentative'
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  UNIQUE(meeting_id, user_id)
);

CREATE INDEX idx_meetings_org ON meetings(org_id);
CREATE INDEX idx_meetings_status ON meetings(org_id, status);
CREATE INDEX idx_meetings_vanity ON meetings(vanity_slug);
CREATE INDEX idx_meetings_scheduled ON meetings(org_id, scheduling_type, scheduled_start);
CREATE INDEX idx_occurrences_meeting ON meeting_occurrences(meeting_id, occurrence_date);
CREATE INDEX idx_occurrences_date ON meeting_occurrences(occurrence_date, status);
CREATE INDEX idx_invites_user ON meeting_invites(user_id);
CREATE INDEX idx_invites_meeting ON meeting_invites(meeting_id);
CREATE INDEX idx_meetings_creator ON meetings(created_by);
CREATE UNIQUE INDEX idx_invites_email ON meeting_invites(meeting_id, email) WHERE user_id IS NULL;

                  create
                    │
            ┌───────┴────────┐
            │                │
        (scheduled/       (instant)
         recurring)          │
            │                │
            ▼                │
  ┌──────[DRAFT]─────┐      │
  │         │         │      │
  │ schedule│         │cancel│
  │         │         │      │
  ▼         │         ▼      │
[SCHEDULED] │    [CANCELLED]◄┘
  │         │         ▲
  │ activate│         │ cancel
  │ (cron   │         │
  │ or host)│         │
  ▼         ▼         │
[ACTIVE] ◄────────────┤
  │                    │
  │ end (non-permanent)│
  ▼                    │
[ENDED]────────────────┘

Permanent rooms (never reach ENDED):

[ACTIVE] ◄──► [INACTIVE/idle]
  join →         ← last leave
  (cycle indefinitely, RTK meeting ID reused)

  Owner/Admin can cancel a permanent room.
  Cancelled permanent rooms can be reactivated:
  cancelled → draft (re-schedule) or cancelled → active (reopen immediately)

1. POST /api/meetings
   Body: { title, meetingType: "video", schedulingType: "instant" }

2. Worker validates auth (must be Owner/Admin/Host)

3. Generate meeting slug (nanoid, 10 chars, URL-safe)

4. Create RTK meeting:
   POST /realtime/kit/{APP_ID}/meetings
   Body: { title }
   → Returns rtk_meeting_id

5. Activate RTK meeting:
   PATCH /realtime/kit/{APP_ID}/meetings/{rtk_meeting_id}
   Body: { status: "ACTIVE" }

6. Insert meeting row in D1 (status = 'active', rtk_meeting_id set)
   -- timezone defaults to org_settings.timezone (resolved by Worker at creation time, not a DB default)

7. Return { meetingId, slug, joinUrl: "/m/{slug}" }

1. POST /api/meetings
   Body: { title, meetingType, schedulingType: "scheduled", scheduledStart, scheduledEnd, timezone }

2. Worker validates auth + time is in the future

3. Insert meeting row in D1 (status = 'scheduled', rtk_meeting_id = null)

4. RTK meeting is NOT created yet (saves resources, avoids stale meetings)

5. When scheduled time arrives:
   - Workers Cron (`* * * * *` — every minute) queries meetings WHERE status='scheduled' AND scheduled_start <= now
   - Creates RTK meeting via API
   - Updates D1 row: status='active', rtk_meeting_id set
   - Optionally sends notification (webhook/email) to invitees

1. POST /api/meetings
   Body: { title, meetingType, schedulingType: "recurring", rrule: "FREQ=WEEKLY;BYDAY=MO,WE,FR", dtstart, timezone }

2. Create meeting row (template) in D1

3. Create recurring_patterns row with RRULE

4. Materialize next 4 weeks of occurrences into meeting_occurrences table

5. Each occurrence is activated independently via the same cron mechanism (`* * * * *`)

6. Daily cron (`0 0 * * *` UTC) checks each recurring meeting:
   - If fewer than 7 future occurrences remain, materialize the next 4-week batch
   - This ensures there are always enough upcoming occurrences for calendar display

7. Each occurrence gets its own RTK meeting (created at activation time, NOT at materialization time)

1. POST /api/meetings
   Body: { title, meetingType, schedulingType: "permanent", vanitySlug: "standup" }

2. Validate vanity slug uniqueness within org

3. Create meeting row with is_permanent=1, vanity_slug set, D1 status='active' (always joinable)

4. Create RTK meeting immediately (persistent room):
   POST /realtime/kit/{APP_ID}/meetings
   Body: { title, status: "INACTIVE" }

5. Room URL: /m/{vanitySlug} (e.g., /m/standup)

6. Room is always available but INACTIVE until someone joins:
   - On join request → PATCH RTK meeting to ACTIVE
   - On last leave → PATCH RTK meeting to INACTIVE
   - RTK meeting ID is reused across sessions (never deleted)

7. Permanent rooms never expire. Owner/Admin can deactivate (soft delete) by setting meeting status to 'cancelled'.

1. Client navigates to /m/{meetingSlug}

2. POST /api/meetings/{meetingId}/join
   - Authenticated: Headers: Authorization: Bearer <jwt>
   - Guest: Body includes { guestToken, displayName } (no Authorization header)
   Guest detection: if no Authorization header, check for guestToken in body or query param.
   Guest must provide displayName (2-50 chars, HTML/script stripped).

3. Worker checks:
   a. Meeting exists and is in joinable state (active, or permanent-room idle)
   b. Meeting is not locked (check D1 is_locked — see Section 6.8)
   c. Capacity not exceeded (participant count < max_participants)

4. Worker resolves identity and preset:
   - Authenticated: user identity from JWT, platform role from D1
   - Guest: generate guest ID (crypto.randomUUID()), role = 'guest'
   - Resolve preset: resolvePreset(role, meetingType, isCreator)

5. Create RTK participant:
   POST /realtime/kit/{APP_ID}/meetings/{RTK_MEETING_ID}/participants
   Body: {
     name: user.name || displayName,
     preset_name: resolvedPreset,
     custom_participant_id: user.id || guestUUID  // REQUIRED — links RTK participant to our user
   }
   → Returns { id: rtk_participant_id, token: rtk_auth_token }
   Note: RTK API returns the field as `token`, not `authToken`.

6. Log participant_events row (event_type = 'joined')

7. Return to client:
   {
     authToken: data.token,  // renamed from RTK's `token` for clarity in our API
     meetingId: rtkMeetingId,
     preset_name,
     meetingConfig: {
       title, type, waitingRoomEnabled, transcriptionEnabled, ...
     }
   }

8. Client initializes RTK SDK:
   const meeting = await RealtimeKitClient.init({ authToken });
   await meeting.join();

POST /api/meetings/{meetingId}/end

1. Validate caller is Owner/Admin/Host-of-meeting
2. RTK: kick all participants
   POST /realtime/kit/{APP_ID}/meetings/{RTK_MEETING_ID}/active-session/kick-all
3. RTK: set meeting inactive
   PATCH /realtime/kit/{APP_ID}/meetings/{RTK_MEETING_ID}
   Body: { status: "INACTIVE" }
4. D1: update meeting status = 'ended', actual_end = now
5. Trigger post-meeting processing (recording finalization, transcript, summary)

1. RTK fires `meeting.ended` webhook when last participant leaves (after `session_keep_alive_time_in_secs` elapses — default 60s, configurable 60-600s per meeting)
2. Worker webhook handler:
   - Look up meeting by rtk_meeting_id
   - If scheduling_type != 'permanent':
       Set meeting status = 'ended', actual_end = now
   - If scheduling_type == 'permanent':
       Set RTK meeting to INACTIVE (keep D1 status as 'active' for rejoining)
   - Trigger post-meeting processing

Effective guest access = meeting.guest_access ?? org.guest_access_default

// Rate limit configuration per endpoint category
const RATE_LIMITS = {
  'auth.login':       { requests: 5,   window: 60 },    // 5 login attempts per minute
  'auth.register':    { requests: 3,   window: 3600 },  // 3 registrations per hour (per IP)
  'meeting.create':   { requests: 10,  window: 60 },    // 10 meetings per minute (per org)
  'meeting.join':     { requests: 30,  window: 60 },    // 30 joins per minute (per meeting)
  'guest.join':       { requests: 20,  window: 60 },    // 20 guest joins per minute (per meeting)
  'chat.send':        { requests: 30,  window: 60 },    // 30 messages per minute (per user)
  'api.general':      { requests: 100, window: 60 },    // 100 requests per minute (per user)
};

Success: { success: true, data: { ... } }
Error:   { success: false, error: { code: "MEETING_LOCKED", message: "This meeting has been locked by the host" } }

Meeting Ends
    │
    ├─→ Recording: Poll RTK recording status via REST API until 'completed'
    │   └─→ Store recording metadata in D1 (duration, size, R2 path)
    │
    ├─→ Transcript: Wait for meeting.transcript webhook OR poll REST API
    │   └─→ Store transcript in D1 (full text + timestamped segments)
    │
    ├─→ AI Summary: Wait for meeting.summary webhook
    │   └─→ Store summary in D1
    │
    ├─→ Chat Export: Wait for meeting.chatSynced webhook
    │   └─→ Store chat log in D1
    │
    └─→ Analytics: Aggregate session data
        └─→ Update analytics tables (session duration, participant count, peak concurrent, etc.)

+------------------------------------------------------------------+
| Session Header                                                     |
|  Meeting Title | Date & Time | Duration | Participant Count       |
|  Host: Name    | Type: Video/Voice/Webinar | Status: Ended        |
+------------------------------------------------------------------+
| [Summary] [Transcript] [Recording] [Chat] [Analytics]             |
+------------------------------------------------------------------+
|                                                                    |
|  (Active tab content)                                             |
|                                                                    |
+------------------------------------------------------------------+

[
  {
    "start_ms": 12340,
    "end_ms": 15670,
    "participant_id": "rtk_part_abc123",
    "speaker_name": "Jane Doe",
    "text": "Hello everyone, let's get started."
  }
]

// Notification channel interface (Worker implementation)
interface NotificationChannel {
  readonly type: 'email' | 'push' | 'sms' | 'webhook';
  send(params: {
    to: string;              // email address, device token, phone number, or URL
    subject?: string;        // used by email
    body: string;            // plain text body
    html?: string;           // rich body (email, push)
    metadata?: Record<string, string>;  // channel-specific data
  }): Promise<{ id: string; success: boolean }>;
}

-- Core entities — see canonical schemas in their respective sections
-- Organizations table — see Section 4.2 for canonical schema
-- Key columns: id (nanoid), name, slug, rtk_app_id, owner_id, settings_json, guest_access_default

-- Users table — see Section 4.2 for canonical schema
-- Key columns: id (nanoid), org_id, email, name, password_hash (nullable), role (owner|admin|host|member), is_active, avatar_url

-- RTK App ID is stored in org_settings.rtk_app_id (single app per deployment)

-- Meetings table — see Section 6.2 for canonical schema
-- Key columns: id (nanoid), org_id, title, slug, meeting_type, status (draft|scheduled|active|ended|cancelled), created_by, scheduling_type

-- Session tracking (populated by webhooks + REST API)
CREATE TABLE sessions (
  id TEXT PRIMARY KEY,
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  started_at TEXT,
  ended_at TEXT,
  duration_seconds INTEGER, -- calculated on end
  participant_count INTEGER DEFAULT 0,
  peak_participant_count INTEGER DEFAULT 0,
  has_recording INTEGER NOT NULL DEFAULT 0,
  has_transcript INTEGER NOT NULL DEFAULT 0,
  has_summary INTEGER NOT NULL DEFAULT 0,
  has_chat INTEGER NOT NULL DEFAULT 0,
  status TEXT NOT NULL CHECK (status IN ('active', 'ended')) DEFAULT 'active',
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_sessions_meeting ON sessions(meeting_id);
CREATE INDEX idx_sessions_org ON sessions(org_id);
CREATE INDEX idx_sessions_status ON sessions(status);
CREATE INDEX idx_sessions_started ON sessions(started_at);

-- Session participant snapshots (from polling during active sessions)
CREATE TABLE session_snapshots (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  session_id TEXT NOT NULL REFERENCES sessions(id),
  participant_count INTEGER NOT NULL,
  recorded_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_snapshots_session ON session_snapshots(session_id);

-- Recording metadata (from recording.statusUpdate webhook)
CREATE TABLE recordings (
  id TEXT PRIMARY KEY,
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  status TEXT NOT NULL CHECK (status IN ('invoked', 'recording', 'paused', 'uploading', 'uploaded', 'errored')),
  download_url TEXT,
  download_url_expiry TEXT,
  duration_seconds INTEGER,
  file_size_bytes INTEGER,
  codec TEXT, -- 'h264' or 'vp8'
  storage_location TEXT, -- 'default' (RTK/R2) | 'aws' | 'azure' | 'digitalocean' | 'gcs' | 'sftp'
  has_watermark INTEGER NOT NULL DEFAULT 0,
  started_at TEXT,
  ended_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_recordings_session ON recordings(session_id);
CREATE INDEX idx_recordings_org ON recordings(org_id);
CREATE INDEX idx_recordings_status ON recordings(status);

-- Transcript metadata (from meeting.transcript webhook)
CREATE TABLE transcripts (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  download_url TEXT NOT NULL,
  download_url_expiry TEXT NOT NULL,
  transcript_json TEXT, -- full parsed transcript for in-app display
  language TEXT DEFAULT 'en-US',
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_transcripts_session ON transcripts(session_id);

-- Summary metadata (from meeting.summary webhook)
CREATE TABLE summaries (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  download_url TEXT NOT NULL,
  download_url_expiry TEXT NOT NULL,
  summary_markdown TEXT, -- full summary content for in-app display
  summary_type TEXT, -- e.g. 'team_meeting'
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_summaries_session ON summaries(session_id);

-- Chat messages (from meeting.chatSynced webhook + CSV download)
CREATE TABLE chat_messages (
  id TEXT PRIMARY KEY,              -- RTK chat message ID
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  participant_id TEXT,              -- RTK participantId from CSV
  sender_name TEXT,                 -- displayName from CSV
  message_type TEXT NOT NULL CHECK (message_type IN ('text', 'image', 'file')),
  -- CSV payloadType mapping: TEXT_MESSAGE→'text', IMAGE_MESSAGE→'image', FILE_MESSAGE→'file'
  content TEXT,                     -- payload from CSV
  is_pinned INTEGER NOT NULL DEFAULT 0,  -- pinned from CSV
  is_edited INTEGER NOT NULL DEFAULT 0,  -- isEdited from CSV
  is_private INTEGER NOT NULL DEFAULT 0, -- private messages (not in CSV, set by our logic if needed)
  recipient_user_id TEXT,           -- for private messages
  sent_at TEXT NOT NULL,            -- createdAt from CSV
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX idx_chat_session ON chat_messages(session_id);
CREATE INDEX idx_chat_pinned ON chat_messages(session_id, is_pinned) WHERE is_pinned = 1;

-- Webhook event log (all raw webhook payloads for debugging/replay)
CREATE TABLE webhook_events (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  event_type TEXT NOT NULL,
  meeting_id TEXT,
  session_id TEXT,
  payload_json TEXT NOT NULL,
  processed INTEGER NOT NULL DEFAULT 0,
  error_message TEXT,
  retry_count INTEGER NOT NULL DEFAULT 0,
  received_at TEXT NOT NULL DEFAULT (datetime('now')),
  processed_at TEXT
);

CREATE INDEX idx_webhook_type ON webhook_events(event_type);
CREATE INDEX idx_webhook_unprocessed ON webhook_events(processed) WHERE processed = 0;

-- Aggregate analytics (computed daily by Cron Trigger)
CREATE TABLE daily_analytics (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  org_id TEXT NOT NULL REFERENCES organizations(id),
  date TEXT NOT NULL, -- YYYY-MM-DD
  total_sessions INTEGER NOT NULL DEFAULT 0,
  total_participants INTEGER NOT NULL DEFAULT 0,
  total_duration_minutes INTEGER NOT NULL DEFAULT 0,
  total_recordings INTEGER NOT NULL DEFAULT 0,
  total_recording_minutes INTEGER NOT NULL DEFAULT 0,
  total_chat_messages INTEGER NOT NULL DEFAULT 0,
  total_transcripts INTEGER NOT NULL DEFAULT 0,
  total_summaries INTEGER NOT NULL DEFAULT 0,
  meeting_type_video INTEGER NOT NULL DEFAULT 0,
  meeting_type_audio INTEGER NOT NULL DEFAULT 0,
  meeting_type_webinar INTEGER NOT NULL DEFAULT 0,
  meeting_type_livestream INTEGER NOT NULL DEFAULT 0,
  computed_at TEXT NOT NULL DEFAULT (datetime('now')),
  UNIQUE(org_id, date)
);

CREATE INDEX idx_daily_org_date ON daily_analytics(org_id, date);

-- Livestream tracking (from livestreaming.statusUpdate webhook)
CREATE TABLE livestreams (
  id TEXT PRIMARY KEY,              -- RTK livestream ID
  session_id TEXT NOT NULL REFERENCES sessions(id),
  meeting_id TEXT NOT NULL REFERENCES meetings(id),
  org_id TEXT NOT NULL REFERENCES organizations(id),
  status TEXT NOT NULL CHECK (status IN ('started', 'stopped', 'errored')),
  rtmp_url TEXT,
  playback_url TEXT,
  started_at TEXT,
  ended_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_livestreams_session ON livestreams(session_id);
CREATE INDEX idx_livestreams_meeting ON livestreams(meeting_id);

Incoming POST /api/webhooks/rtk
        |
        v
  1. Validate payload (signature check or cross-reference)
  2. Store raw event in webhook_events table (payload_json)
  3. Route by event_type:
        |
        +-- meeting.started ----------> createSession()
        +-- meeting.ended ------------> processSessionEnd()
        +-- meeting.participantJoined -> updateParticipantJoined()
        +-- meeting.participantLeft --> updateParticipantLeft()
        +-- recording.statusUpdate ---> processRecordingUpdate()
        +-- meeting.transcript -------> processTranscript()
        +-- meeting.summary ----------> processSummary()
        +-- meeting.chatSynced -------> processChatSync()
        +-- livestreaming.statusUpdate > updateLivestreamState()
        |
  4. Mark webhook_events.processed = 1
  5. On error: set error_message, keep processed = 0 for retry

Top Nav Bar (persistent, all authenticated pages):
+------------------------------------------------------------------+
| [Org Logo]  Dashboard  Recordings  |  [Profile Avatar] [Logout]  |
+------------------------------------------------------------------+
       |                                        |
       | (Admin/Owner only)                     |
       +-- Admin dropdown:                      +-- Profile
           Settings | Members | Analytics |         Change password
           Presets | Branding | Storage |            Notification prefs
           Diagnostics

+------------------------------------------------------------------+
| rtk-header: [Logo] [Meeting Title] [Clock] [Recording Indicator] |
+------------------------------------------------------------------+
|                                              |                    |
|                                              | rtk-sidebar:       |
|     rtk-grid (or rtk-spotlight-grid          |  - rtk-chat        |
|              or rtk-mixed-grid)              |  - rtk-participants |
|                                              |  - rtk-polls        |
|     Contains: rtk-participant-tile           |  - rtk-ai           |
|               rtk-screenshare-view           |  - rtk-plugins      |
|               rtk-name-tag                   |  - rtk-breakout-    |
|               rtk-audio-visualizer           |    rooms-manager    |
|                                              |                    |
+------------------------------------------------------------------+
| rtk-controlbar:                                                   |
| [Mic] [Camera] [Screenshare] [Recording] [More...] [Leave]       |
| Sidebar toggles: [Chat] [Participants] [Polls] [AI] [Plugins]    |
+------------------------------------------------------------------+

// Route guard logic (pseudocode for React Router loaders/wrappers)

// 1. Auth guard — protects all authenticated routes
if (!isAuthenticated && route.requiresAuth) {
  redirect(`/login?redirect=${encodeURIComponent(currentPath)}`);
}

// 2. Already authenticated — redirect away from public auth pages
if (isAuthenticated && route.isAuthPage) {  // /login, /register, /forgot-password
  redirect('/');
}

// 3. Role guard — protects admin and host routes
if (route.requiredRole === 'admin' && user.role !== 'owner' && user.role !== 'admin') {
  redirect('/');  // silent redirect to dashboard (no 403 page needed for v1)
}
if (route.requiredRole === 'host' && user.role === 'member') {
  redirect('/');
}

// 4. Meeting room guard — must go through pre-join
if (route === '/meetings/:meetingId/live' && !hasCompletedPreJoin) {
  redirect(`/meetings/${meetingId}/setup`);
}

// 5. Post-login redirect
onLoginSuccess(() => {
  const redirectTo = searchParams.get('redirect') || '/';
  navigate(redirectTo);
});

// Route tree — layout routes group pages that share UI chrome

const router = createBrowserRouter([
  // Public routes (no auth required)
  {
    element: <PublicLayout />,  // minimal: org logo, centered content
    children: [
      { path: '/login', element: <LoginPage /> },
      { path: '/register', element: <RegisterPage /> },
      { path: '/forgot-password', element: <ForgotPasswordPage /> },
      { path: '/reset-password/:token', element: <ResetPasswordPage /> },
    ],
  },

  // Meeting access routes (auth-optional, depend on guest settings)
  { path: '/m/:slug', element: <MeetingLinkResolver /> },
  { path: '/meetings/:meetingId/guest', element: <GuestJoinPage /> },
  { path: '/live/:meetingId', element: <LivestreamViewerPage /> },

  // Authenticated routes (any role)
  {
    element: <AuthLayout />,  // top nav bar, auth guard
    errorElement: <ErrorBoundary />,  // Sentry ErrorBoundary (Section 3)
    children: [
      { path: '/', element: <DashboardPage /> },
      { path: '/profile', element: <ProfilePage /> },
      { path: '/recordings', element: <RecordingsPage /> },
      { path: '/recordings/:recordingId', element: <RecordingPlayerPage /> },
      { path: '/meetings/new', element: <ScheduleMeetingPage /> },  // Host+ guard inside
      { path: '/meetings/:meetingId/setup', element: <PreJoinPage /> },
      { path: '/meetings/:meetingId/settings', element: <MeetingSettingsPage /> },  // Host+ guard
      { path: '/meetings/:meetingId/history', element: <MeetingHistoryPage /> },  // Host+ guard
      { path: '/meetings/:meetingId/sessions/:sessionId', element: <PostMeetingPage /> },
    ],
  },

  // Meeting room (full-screen, no nav bar)
  {
    element: <MeetingLayout />,  // auth guard, no top nav
    children: [
      { path: '/meetings/:meetingId/live', element: <MeetingRoomPage /> },
    ],
  },

  // Admin routes (Admin/Owner guard)
  {
    element: <AdminLayout />,  // auth guard + admin role guard, admin nav
    children: [
      { path: '/admin/settings', element: <OrgSettingsPage /> },
      { path: '/admin/members', element: <MembersPage /> },
      { path: '/admin/invite', element: <InvitePage /> },
      { path: '/admin/analytics', element: <AnalyticsPage /> },
      { path: '/admin/presets', element: <PresetsPage /> },
      { path: '/admin/branding', element: <BrandingPage /> },
      { path: '/admin/storage', element: <RecordingStoragePage /> },
      { path: '/admin/diagnostics', element: <DiagnosticsPage /> },
    ],
  },

  // Catch-all 404
  { path: '*', element: <NotFoundPage /> },
]);

// In Worker fetch handler (simplified)
if (url.pathname.startsWith('/api/') || url.pathname.startsWith('/webhooks/')) {
  return handleApiRoute(request);
}
// All other paths → serve SPA
return serveStaticAsset(request, 'index.html');

// At app initialization, before rendering any RTK components
import { provideRtkDesignSystem } from '@cloudflare/realtimekit-react-ui';

provideRtkDesignSystem({
  theme: orgSettings.theme,          // from org_settings table
  colors: {
    brand: { 500: orgSettings.brandColor },
    background: { 1000: orgSettings.backgroundColor },
    text: orgSettings.textColor,
    "text-on-primary": orgSettings.textOnPrimaryColor,
    "video-bg": orgSettings.videoBgColor,
  },
  fontFamily: orgSettings.fontFamily,
  googleFont: orgSettings.googleFont, // mutually exclusive with fontFamily
  borderWidth: orgSettings.borderWidth,
  borderRadius: orgSettings.borderRadius,
});

Org-Wide Defaults (org_settings table)
  └── Per-Meeting Overrides (meetings table columns)
        └── Runtime Overrides (RTK preset / SDK calls during session)

CREATE TABLE org_settings (
  id TEXT PRIMARY KEY DEFAULT 'default',  -- single-row table, always 'default'
  org_name TEXT NOT NULL,
  org_slug TEXT NOT NULL UNIQUE,          -- URL-safe org identifier

  -- Branding: Theme
  theme TEXT NOT NULL DEFAULT 'dark',                  -- 'light' | 'dark' | 'darkest'
  brand_color TEXT NOT NULL DEFAULT '#2563EB',          -- hex, maps to brand.500
  background_color TEXT,                                -- hex, maps to background.1000 (null = theme default)
  text_color TEXT,                                      -- hex (null = theme default)
  text_on_primary_color TEXT,                           -- hex (null = auto)
  video_bg_color TEXT,                                  -- hex (null = theme default)
  font_family TEXT,                                     -- CSS font-family (null = system default)
  google_font TEXT,                                     -- Google Font name (null = use font_family)
  border_width TEXT NOT NULL DEFAULT 'thin',            -- 'none' | 'thin' | 'fat'
  border_radius TEXT NOT NULL DEFAULT 'rounded',        -- 'sharp' | 'rounded' | 'extra-rounded' | 'circular'

  -- Branding: Assets
  logo_url TEXT,                           -- R2 URL for org logo
  logo_height INTEGER DEFAULT 32,          -- px
  favicon_url TEXT,                        -- R2 URL for favicon
  custom_icon_pack TEXT,                   -- JSON blob for RTK icon pack (nullable)

  -- Watermark
  watermark_enabled INTEGER NOT NULL DEFAULT 0,    -- boolean
  watermark_image_url TEXT,                         -- R2 URL
  watermark_position TEXT DEFAULT 'right bottom',   -- 'left top' | 'right top' | 'left bottom' | 'right bottom'
  watermark_width INTEGER DEFAULT 120,              -- px
  watermark_height INTEGER DEFAULT 40,              -- px

  -- Meeting Defaults
  default_meeting_type TEXT NOT NULL DEFAULT 'video',  -- 'video' | 'audio' | 'webinar' | 'livestream' (maps to RTK view_type: GROUP_CALL, AUDIO_ROOM, WEBINAR, WEBINAR+can_livestream)
  default_waiting_room INTEGER NOT NULL DEFAULT 0,          -- boolean
  default_recording_autostart INTEGER NOT NULL DEFAULT 0,   -- boolean
  default_max_participants INTEGER NOT NULL DEFAULT 100,
  -- Guest access resolution:
  -- 1. If guest_access_global = 0 → all guest access disabled (overrides everything)
  -- 2. Else: effective = meeting.guest_access ?? organizations.guest_access_default
  -- See Section 6.7 for full guest access hierarchy
  default_chat_enabled INTEGER NOT NULL DEFAULT 1,          -- boolean
  default_polls_enabled INTEGER NOT NULL DEFAULT 1,         -- boolean
  default_breakout_rooms_enabled INTEGER NOT NULL DEFAULT 0, -- boolean (beta)
  default_transcription_enabled INTEGER NOT NULL DEFAULT 0, -- boolean
  default_ai_summaries_enabled INTEGER NOT NULL DEFAULT 0,  -- boolean
  default_plugins_enabled INTEGER NOT NULL DEFAULT 1,       -- boolean
  default_livestream_enabled INTEGER NOT NULL DEFAULT 0,    -- boolean

  -- Org Policies (not overridable per-meeting)
  virtual_backgrounds_allowed INTEGER NOT NULL DEFAULT 1,   -- boolean
  guest_access_global INTEGER NOT NULL DEFAULT 1,           -- boolean, master switch
  invite_only_registration INTEGER NOT NULL DEFAULT 0,      -- boolean
  simulcast_enabled INTEGER NOT NULL DEFAULT 1,             -- boolean

  -- Recording Policy
  recording_policy TEXT NOT NULL DEFAULT 'host_decides' CHECK(recording_policy IN ('always', 'host_decides', 'never')),
  -- When `recording_policy = 'never'`, the Worker rejects all recording start requests regardless of preset `can_record` value.
  -- The frontend checks this setting via `GET /api/org/settings` and hides the record button when policy is `never`.
  -- When `recording_policy = 'always'`, meetings auto-start recording via `record_on_start: true` at meeting creation time — the Worker enforces this.

  -- Recording Storage
  recording_storage_provider TEXT NOT NULL DEFAULT 'r2',    -- 'r2' | 'aws' | 'azure' | 'digitalocean' | 'gcs' | 'sftp'
  recording_storage_config TEXT,                            -- JSON: bucket, region, credentials ref

  -- i18n
  timezone TEXT NOT NULL DEFAULT 'UTC',  -- Org timezone (IANA format, e.g. 'America/New_York'). Used as default for meeting scheduling, analytics display, and cron context.
  default_locale TEXT NOT NULL DEFAULT 'en-US',
  custom_strings TEXT,                                      -- JSON blob for i18n overrides

  -- Notifications (channel abstraction — see Section 8.9)
  notification_channels TEXT DEFAULT '["email"]',    -- JSON array of enabled channels: 'email', 'push', 'sms', 'webhook'
  email_provider TEXT DEFAULT 'resend',              -- which email provider: 'resend' | 'sendgrid' | 'ses' | 'smtp' (extensible)
  email_from_address TEXT,                           -- sender address (e.g. 'noreply@meetings.example.com'), null = provider default

  -- Abuse Protection & Capacity Caps (see Section 6.8)
  rate_limit_joins_per_minute INTEGER NOT NULL DEFAULT 60,
  max_concurrent_meetings INTEGER NOT NULL DEFAULT 25,
  max_meeting_duration_minutes INTEGER NOT NULL DEFAULT 1440,  -- 24 hours
  max_recording_storage_gb INTEGER NOT NULL DEFAULT 50,        -- R2 storage cap per org

  -- Meeting Defaults (continued)
  default_persist_chat INTEGER NOT NULL DEFAULT 1,             -- boolean: save chat messages to D1 after meeting

  -- RTK App Config
  rtk_app_id TEXT NOT NULL,                -- RealtimeKit App ID
  rtk_api_key_encrypted TEXT NOT NULL,     -- Encrypted RTK API key

  -- Metadata
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

-- Trigger to auto-update updated_at
CREATE TRIGGER org_settings_updated_at
  AFTER UPDATE ON org_settings
  BEGIN
    UPDATE org_settings SET updated_at = datetime('now') WHERE id = NEW.id;
  END;

CREATE TABLE deploy_users (
  id TEXT PRIMARY KEY,                    -- ulid
  email TEXT NOT NULL UNIQUE,
  display_name TEXT NOT NULL,
  password_hash TEXT NOT NULL,            -- argon2id via @noble/hashes
  email_verified INTEGER NOT NULL DEFAULT 0,
  verification_token TEXT,
  verification_expires_at TEXT,
  reset_token TEXT,
  reset_expires_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE TABLE deploy_sessions (
  id TEXT PRIMARY KEY,                    -- random 32-byte hex
  user_id TEXT NOT NULL REFERENCES deploy_users(id),
  expires_at TEXT NOT NULL,
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_sessions_user ON deploy_sessions(user_id);
CREATE INDEX idx_sessions_expires ON deploy_sessions(expires_at);

CREATE TABLE deployments (
  id TEXT PRIMARY KEY,                    -- ulid
  user_id TEXT NOT NULL REFERENCES deploy_users(id),
  cf_account_id TEXT NOT NULL,
  org_name TEXT NOT NULL,
  org_slug TEXT NOT NULL,
  status TEXT NOT NULL DEFAULT 'pending'
    CHECK(status IN ('pending','deploying','active','failed','suspended','deleted')),
  worker_name TEXT NOT NULL,
  custom_domain TEXT,
  d1_database_id TEXT,
  r2_branding_bucket TEXT,
  r2_recordings_bucket TEXT,
  r2_exports_bucket TEXT,
  kv_sessions_id TEXT,
  kv_rate_limits_id TEXT,
  kv_meeting_state_id TEXT,
  kv_cache_id TEXT,
  rtk_app_id TEXT,
  last_health_check TEXT,
  health_status TEXT DEFAULT 'unknown',
  deployed_version TEXT,
  -- Pre-deploy configuration (applied to platform at deploy time)
  config_brand_color TEXT DEFAULT '#0055FF',
  config_guest_access INTEGER DEFAULT 1,
  config_recording_policy TEXT DEFAULT 'host_decides',
  config_default_meeting_type TEXT DEFAULT 'video',
  config_waiting_room INTEGER DEFAULT 1,
  config_transcription INTEGER DEFAULT 0,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_deployments_user ON deployments(user_id);

CREATE TABLE deploy_activity (
  id TEXT PRIMARY KEY,                    -- ulid
  deployment_id TEXT NOT NULL REFERENCES deployments(id),
  user_id TEXT NOT NULL REFERENCES deploy_users(id),
  action TEXT NOT NULL,                   -- 'deployed' | 'updated' | 'rolled_back' | 'health_check' | 'config_changed' | 'domain_added' | 'domain_removed' | 'suspended' | 'deleted'
  details TEXT,                           -- JSON: version numbers, error messages, etc.
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_activity_deployment ON deploy_activity(deployment_id);
CREATE INDEX idx_activity_user ON deploy_activity(user_id);

CREATE TABLE deploy_notification_prefs (
  user_id TEXT PRIMARY KEY REFERENCES deploy_users(id),
  email_health_alerts INTEGER NOT NULL DEFAULT 1,    -- boolean
  email_update_available INTEGER NOT NULL DEFAULT 1, -- boolean
  email_deploy_status INTEGER NOT NULL DEFAULT 1,    -- boolean
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

PUT /accounts/{id}/workers/domains
Body: { "hostname": "meet.example.com", "service": "{worker_name}", "zone_id": "{zone_id}" }

{
  "latest": "1.2.3",
  "minimum_supported": "1.0.0",
  "released_at": "2026-03-06T00:00:00Z",
  "changelog_url": "https://updates.vendor.com/changelog/1.2.3.md",
  "bundle_url": "https://updates.vendor.com/bundles/1.2.3.bundle.js",
  "migrations": ["0005_add_column.sql", "0006_add_index.sql"],
  "sha256": "abc123...",
  "breaking": false,
  "notes": "Bug fixes and performance improvements"
}

[triggers]
crons = ["0 * * * *"]  # every hour

CREATE TABLE _migrations (
  version INTEGER PRIMARY KEY,
  name TEXT NOT NULL,
  applied_at TEXT NOT NULL DEFAULT (datetime('now')),
  platform_version TEXT NOT NULL
);