diff --git a/apps/web/__tests__/unit/mobile-cap-summary.test.ts b/apps/web/__tests__/unit/mobile-cap-summary.test.ts
new file mode 100644
index 00000000000..4efd10aa788
--- /dev/null
+++ b/apps/web/__tests__/unit/mobile-cap-summary.test.ts
@@ -0,0 +1,87 @@
+import { User, Video } from "@cap/web-domain";
+import { describe, expect, it } from "vitest";
+import {
+	type MobileCapRow,
+	toMobileCapSummary,
+} from "@/lib/mobile-cap-summary";
+
+const row: MobileCapRow = {
+	id: Video.VideoId.make("example-video"),
+	ownerId: User.UserId.make("example-owner"),
+	ownerPreferences: null,
+	name: "Team update",
+	createdAt: new Date("2024-01-01"),
+	updatedAt: new Date("2024-01-02"),
+	ownerName: "Example Owner",
+	duration: 12,
+	folderId: null,
+	public: true,
+	videoSharingRestrictedToOrg: false,
+	hasPassword: false,
+	hasInheritedPassword: false,
+	commentCount: 0,
+	reactionCount: 0,
+	uploadVideoId: null,
+	uploadUploaded: null,
+	uploadTotal: null,
+	uploadPhase: null,
+	processingProgress: null,
+	processingMessage: null,
+	processingError: null,
+	metadata: null,
+	transcriptionStatus: "COMPLETE",
+};
+const member = User.UserId.make("example-member");
+const summarize = (overrides: Partial<MobileCapRow>, viewer = member) =>
+	toMobileCapSummary(
+		{ ...row, ...overrides },
+		0,
+		"https://example.invalid",
+		viewer,
+	);
+
+describe("mobile recording sharing indicators", () => {
+	it.each([
+		{ hasPassword: true },
+		{ hasInheritedPassword: true },
+		{ hasPassword: true, hasInheritedPassword: true },
+	])(
+		"overrides saved password flags for organization-only recordings",
+		(saved) => {
+			const summary = summarize({
+				...saved,
+				videoSharingRestrictedToOrg: true,
+			});
+			expect(summary.public).toBe(false);
+			expect(summary.protected).toBe(false);
+			expect(summary.thumbnailUrl).toContain(`/caps/${row.id}/thumbnail`);
+			expect(summary.thumbnailCacheKey).not.toBeNull();
+		},
+	);
+
+	it.each([{ hasPassword: true }, { hasInheritedPassword: true }])(
+		"restores saved protection when organization-only access is disabled",
+		(saved) => {
+			const summary = summarize(saved);
+			expect(summary.public).toBe(true);
+			expect(summary.protected).toBe(true);
+			expect(summary.thumbnailUrl).toBeNull();
+		},
+	);
+
+	it("preserves owner thumbnails for normal password-protected recordings", () => {
+		expect(
+			summarize({ hasPassword: true }, row.ownerId).thumbnailUrl,
+		).not.toBeNull();
+	});
+
+	it("keeps in-progress upload thumbnails hidden under the organization policy", () => {
+		const summary = summarize({
+			videoSharingRestrictedToOrg: true,
+			uploadVideoId: row.id,
+			uploadPhase: "uploading",
+		});
+		expect(summary.thumbnailUrl).toBeNull();
+		expect(summary.upload?.phase).toBe("uploading");
+	});
+});
diff --git a/apps/web/__tests__/unit/og-images.test.ts b/apps/web/__tests__/unit/og-images.test.ts
index f6b67c69238..c811ee879c1 100644
--- a/apps/web/__tests__/unit/og-images.test.ts
+++ b/apps/web/__tests__/unit/og-images.test.ts
@@ -85,19 +85,17 @@ describe("/api/og", () => {
 });
 
 describe("video og", () => {
-	it("renders the video layout with caching headers", async () => {
+	it("renders video previews without caching access-sensitive content", async () => {
 		const res = await renderVideoOg({
 			kind: "video",
 			video: {
 				title: "Cap walkthrough",
-				ownerName: "Richie",
+				ownerName: "Example Owner",
 				duration: 204,
 			},
 		});
 		expect(res.status).toBe(200);
-		expect(res.headers.get("cache-control")).toContain(
-			"stale-while-revalidate",
-		);
+		expect(res.headers.get("cache-control")).toContain("no-store");
 		const { width, height } = pngSize(Buffer.from(await res.arrayBuffer()));
 		expect(width).toBe(1200);
 		expect(height).toBe(630);
diff --git a/apps/web/__tests__/unit/organization-video-sharing.test.ts b/apps/web/__tests__/unit/organization-video-sharing.test.ts
new file mode 100644
index 00000000000..ebb5cd0a180
--- /dev/null
+++ b/apps/web/__tests__/unit/organization-video-sharing.test.ts
@@ -0,0 +1,131 @@
+import { Organisation, User } from "@cap/web-domain";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { updateOrganizationVideoSharing } from "@/actions/organization/default-video-visibility";
+
+const mocks = vi.hoisted(() => ({
+	user: vi.fn(),
+	access: vi.fn(),
+	set: vi.fn(),
+	where: vi.fn(),
+	revalidate: vi.fn(),
+}));
+
+vi.mock("@cap/database/auth/session", () => ({ getCurrentUser: mocks.user }));
+vi.mock("next/cache", () => ({ revalidatePath: mocks.revalidate }));
+vi.mock("@cap/database", () => ({
+	db: () => ({
+		select: () => ({
+			from: () => ({
+				leftJoin: () => ({ where: () => ({ limit: mocks.access }) }),
+			}),
+		}),
+		update: () => ({ set: mocks.set }),
+	}),
+}));
+
+const userId = User.UserId.make("fixture-user");
+const organizationId = Organisation.OrganisationId.make("fixture-org");
+
+describe("organization-only sharing settings", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mocks.user.mockResolvedValue({
+			id: userId,
+			activeOrganizationId: organizationId,
+		});
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: userId,
+				memberId: "fixture-member",
+				memberRole: "owner",
+			},
+		]);
+		mocks.set.mockReturnValue({ where: mocks.where });
+		mocks.where.mockResolvedValue(undefined);
+	});
+
+	it.each([true, false])(
+		"lets the owner set the lock to %s without rewriting videos",
+		async (restricted) => {
+			await expect(
+				updateOrganizationVideoSharing(organizationId, restricted),
+			).resolves.toEqual({ success: true });
+			expect(mocks.set).toHaveBeenCalledExactlyOnceWith({
+				videoSharingRestrictedToOrg: restricted,
+			});
+			expect(mocks.revalidate).toHaveBeenCalledWith("/s/[videoId]", "page");
+			expect(mocks.revalidate).toHaveBeenCalledWith("/embed/[videoId]", "page");
+		},
+	);
+
+	it("lets organization admins manage the lock", async () => {
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: "other-owner",
+				memberId: "fixture-member",
+				memberRole: "admin",
+			},
+		]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).resolves.toEqual({
+			success: true,
+		});
+	});
+
+	it("keeps the displayed organization when another tab switches context", async () => {
+		mocks.user.mockResolvedValue({
+			id: userId,
+			activeOrganizationId: "other-org",
+		});
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).resolves.toEqual({ success: true });
+		expect(mocks.set).toHaveBeenCalledExactlyOnceWith({
+			videoSharingRestrictedToOrg: true,
+		});
+	});
+
+	it("denies ordinary members", async () => {
+		mocks.access.mockResolvedValue([
+			{
+				id: organizationId,
+				ownerId: "other-owner",
+				memberId: "fixture-member",
+				memberRole: "member",
+			},
+		]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, false),
+		).rejects.toThrow("only available to admins and owners");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("denies users without organization access", async () => {
+		mocks.access.mockResolvedValue([]);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, false),
+		).rejects.toThrow("Forbidden");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("requires sign-in", async () => {
+		mocks.user.mockResolvedValue(null);
+		await expect(
+			updateOrganizationVideoSharing(organizationId, true),
+		).rejects.toThrow("Unauthorized");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+
+	it("validates direct action inputs", async () => {
+		await expect(
+			updateOrganizationVideoSharing(
+				organizationId,
+				"true" as unknown as boolean,
+			),
+		).rejects.toThrow("Invalid sharing setting");
+		expect(mocks.set).not.toHaveBeenCalled();
+	});
+});
diff --git a/apps/web/__tests__/unit/public-collection-member-access.test.ts b/apps/web/__tests__/unit/public-collection-member-access.test.ts
new file mode 100644
index 00000000000..d806a785ff7
--- /dev/null
+++ b/apps/web/__tests__/unit/public-collection-member-access.test.ts
@@ -0,0 +1,157 @@
+import type { SQL } from "drizzle-orm";
+import { MySqlDialect } from "drizzle-orm/mysql-core";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { getPublicCollectionPageData } from "@/lib/public-collections";
+
+const mocks = vi.hoisted(() => ({
+	user: vi.fn(),
+	passwords: vi.fn(),
+	results: [] as unknown[][],
+	conditions: [] as unknown[],
+}));
+
+vi.mock("server-only", () => ({}));
+vi.mock("@cap/database/auth/session", () => ({ getCurrentUser: mocks.user }));
+vi.mock("@/lib/password-cookie", () => ({
+	getVerifiedPasswordHashes: mocks.passwords,
+}));
+vi.mock("@/lib/server", () => ({ runPromise: vi.fn() }));
+vi.mock("@cap/database", () => ({
+	db: () => ({
+		select: () => {
+			const result = mocks.results.shift() ?? [];
+			const query = Object.assign(Promise.resolve(result), {
+				from: () => query,
+				innerJoin: () => query,
+				leftJoin: () => query,
+				where: (condition: unknown) => {
+					mocks.conditions.push(condition);
+					return query;
+				},
+				limit: () => query,
+				groupBy: () => query,
+				orderBy: () => query,
+				offset: () => query,
+			});
+			return query;
+		},
+	}),
+}));
+
+const space = {
+	id: "example-space",
+	name: "Team library",
+	organizationId: "example-org",
+	organizationName: "Example Studio",
+	organizationTombstoneAt: null,
+	public: true,
+	allowedEmailDomain: null,
+	passwordHash: "saved-space-password",
+};
+const video = {
+	id: "example-video",
+	name: "Team update",
+	createdAt: new Date("2024-01-01"),
+	metadata: null,
+	duration: 12,
+	totalComments: 0,
+	totalReactions: 0,
+	ownerName: "Example Owner",
+	hasPassword: true,
+	hasActiveUpload: false,
+};
+const dialect = new MySqlDialect();
+const queryAt = (index: number) =>
+	dialect.sqlToQuery(mocks.conditions[index] as SQL);
+
+describe("organization members in restricted public collections", () => {
+	beforeEach(() => {
+		mocks.results.length = 0;
+		mocks.conditions.length = 0;
+		mocks.user.mockResolvedValue({
+			id: "example-member",
+			email: "member@example.invalid",
+		});
+		mocks.passwords.mockResolvedValue([]);
+	});
+
+	it.each([
+		{ passwordHash: "saved-space-password", allowedEmailDomain: null },
+		{ passwordHash: null, allowedEmailDomain: "different.example.invalid" },
+	])(
+		"lets locked organization members bypass saved restrictions",
+		async (rule) => {
+			mocks.results.push(
+				[],
+				[{ ...space, ...rule }],
+				[{ id: space.organizationId }],
+				[],
+				[video],
+				[{ count: 1 }],
+			);
+			const page = await getPublicCollectionPageData(space.id, 1);
+			expect(page?.access).toEqual({ state: "allowed" });
+			expect(page?.videos.map((item) => item.id)).toEqual([video.id]);
+			const membership = queryAt(2);
+			expect(membership.sql).toContain(
+				"`organizations`.`videoSharingRestrictedToOrg` = ?",
+			);
+			expect(membership.sql).toContain("`organizations`.`tombstoneAt` is null");
+			expect(membership.params).toContain("example-member");
+			for (const index of [4, 5]) {
+				const selection = queryAt(index);
+				expect(selection.sql).toContain("`videos`.`public` = ?");
+				expect(selection.sql).toContain("`videos`.`password` IS NULL");
+				expect(selection.sql).toContain("NOT EXISTS");
+				expect(selection.params).toContain("example-member");
+				expect(selection.params).not.toContain(space.organizationId);
+			}
+		},
+	);
+
+	it("retains eligible public recordings shared from another organization", async () => {
+		mocks.results.push(
+			[],
+			[
+				{
+					...space,
+					passwordHash: null,
+					allowedEmailDomain: "different.example.invalid",
+				},
+			],
+			[{ id: space.organizationId }],
+			[],
+			[{ ...video, id: "external-video", hasPassword: false }],
+			[{ count: 1 }],
+		);
+		const page = await getPublicCollectionPageData(space.id, 1);
+		expect(page?.access).toEqual({ state: "allowed" });
+		expect(page?.videos.map((item) => item.id)).toEqual(["external-video"]);
+		expect(page?.totalCount).toBe(1);
+		expect(queryAt(4).params).not.toContain(space.organizationId);
+	});
+
+	it("retains the password gate for outsiders and unlocked organizations", async () => {
+		mocks.results.push([], [space], []);
+		const page = await getPublicCollectionPageData(space.id, 1);
+		expect(page?.access).toEqual({ state: "password_required" });
+		expect(page?.videos).toEqual([]);
+		expect(mocks.conditions).toHaveLength(3);
+	});
+
+	it("does not run member bypass queries for anonymous visitors", async () => {
+		mocks.user.mockResolvedValue(null);
+		mocks.results.push([], [space]);
+		const page = await getPublicCollectionPageData(space.id, 1);
+		expect(page?.access).toEqual({ state: "password_required" });
+		expect(mocks.conditions).toHaveLength(2);
+	});
+
+	it("keeps normal collection scope after the saved password is verified", async () => {
+		mocks.passwords.mockResolvedValue([space.passwordHash]);
+		mocks.results.push([], [space], [], [video], [{ count: 1 }]);
+		const page = await getPublicCollectionPageData(space.id, 1);
+		expect(page?.access).toEqual({ state: "allowed" });
+		expect(queryAt(3).params).not.toContain(space.organizationId);
+	});
+});
diff --git a/apps/web/__tests__/unit/public-share-video.test.ts b/apps/web/__tests__/unit/public-share-video.test.ts
index 70c5c5cd4f3..13da7eab44e 100644
--- a/apps/web/__tests__/unit/public-share-video.test.ts
+++ b/apps/web/__tests__/unit/public-share-video.test.ts
@@ -9,8 +9,9 @@ const candidate = (
 	id: Video.VideoId.make("video123"),
 	name: "Demo",
 	ownerId: "owner123",
-	ownerName: "Richie",
+	ownerName: "Example Owner",
 	public: true,
+	videoSharingRestrictedToOrg: false,
 	hasPassword: false,
 	hasInheritedPassword: false,
 	allowedEmailDomain: null,
@@ -32,6 +33,7 @@ describe("public share video eligibility", () => {
 
 	it.each([
 		{ public: false },
+		{ videoSharingRestrictedToOrg: true },
 		{ hasPassword: true },
 		{ hasInheritedPassword: true },
 		{ allowedEmailDomain: "@cap.so" },
diff --git a/apps/web/__tests__/unit/recording-storage-lifecycle.test.ts b/apps/web/__tests__/unit/recording-storage-lifecycle.test.ts
index 45896b27bd7..e06f5a7612f 100644
--- a/apps/web/__tests__/unit/recording-storage-lifecycle.test.ts
+++ b/apps/web/__tests__/unit/recording-storage-lifecycle.test.ts
@@ -158,6 +158,11 @@ function databaseFixture(video = recording()) {
 	const mutations: DatabaseMutation[] = [];
 	const events: string[] = [];
 	const objectDeleteConditions: SQL[] = [];
+	const organization = {
+		allowedEmailDomain: null,
+		videoSharingRestrictedToOrg: false,
+		tombstoneAt: null,
+	};
 	let beforeJobDelete: (() => Promise<void>) | undefined;
 	let beforePrepareDelete: (() => Promise<void>) | undefined;
 	let loseNextCreateResponse = false;
@@ -167,6 +172,7 @@ function databaseFixture(video = recording()) {
 		return id;
 	};
 	const read = (table: unknown, condition: SQL) => {
+		if (table === Db.organizations) return [organization];
 		const source =
 			table === Db.videos
 				? rows
@@ -275,18 +281,36 @@ function databaseFixture(video = recording()) {
 	mocks.database.mockReturnValue({
 		select: () => ({
 			from: (table: unknown) => ({
-				where: async (condition: SQL) => read(table, condition),
-				leftJoin: (joined: unknown) => ({
-					where: async (condition: SQL) => {
-						if (table !== Db.videoUploads || joined !== Db.videoProcessingJobs)
-							throw new Error("Unexpected joined progress read");
-						const id = idFrom(condition);
-						const upload = uploads.get(id);
-						return upload
-							? [{ ...upload, processingJobState: jobs.get(id)?.state ?? null }]
-							: [];
-					},
-				}),
+				where: (condition: SQL) => {
+					const result = read(table, condition);
+					return Object.assign(Promise.resolve(result), {
+						limit: async () => result,
+					});
+				},
+				leftJoin: (joined: unknown) =>
+					table === Db.organizations
+						? {
+								where: async () => [],
+							}
+						: {
+								where: async (condition: SQL) => {
+									if (
+										table !== Db.videoUploads ||
+										joined !== Db.videoProcessingJobs
+									)
+										throw new Error("Unexpected joined progress read");
+									const id = idFrom(condition);
+									const upload = uploads.get(id);
+									return upload
+										? [
+												{
+													...upload,
+													processingJobState: jobs.get(id)?.state ?? null,
+												},
+											]
+										: [];
+								},
+							},
 			}),
 		}),
 		delete: (table: unknown) => ({
@@ -300,6 +324,7 @@ function databaseFixture(video = recording()) {
 		transaction,
 	});
 	return {
+		organization,
 		rows,
 		jobs,
 		uploads,
@@ -797,6 +822,31 @@ afterEach(() => {
 });
 
 describe("recording storage lifecycle", () => {
+	it.each(["thumbnail", "upload-status"] as const)(
+		"denies a former owner access to %s when the organization is locked",
+		async (operation) => {
+			const database = databaseFixture();
+			database.organization.videoSharingRestrictedToOrg = true;
+			const storage = await storageFixture([]);
+			const result = await Effect.runPromiseExit(
+				Effect.gen(function* () {
+					const videos = yield* Videos;
+					if (operation === "thumbnail") yield* videos.getThumbnailURL(videoId);
+					else yield* videos.getUploadProgress(videoId);
+				}).pipe(
+					Effect.provide(Videos.Default),
+					Effect.provideService(CurrentUser, currentUser),
+					Effect.provide(Logger.remove(Logger.defaultLogger)),
+				),
+			);
+			expect(Exit.isFailure(result)).toBe(true);
+			if (Exit.isFailure(result))
+				expect(Cause.pretty(result.cause)).toContain(
+					"organization_only_denied",
+				);
+			expect(storage.requests).toEqual([]);
+		},
+	);
 	it.each(["desktopMP4", "webMP4"] as const)(
 		"uses the published %s thumbnail without discovering older objects",
 		async (type) => {
diff --git a/apps/web/__tests__/unit/share-audience.test.ts b/apps/web/__tests__/unit/share-audience.test.ts
index 77aa8b74f7c..403f94b5a8f 100644
--- a/apps/web/__tests__/unit/share-audience.test.ts
+++ b/apps/web/__tests__/unit/share-audience.test.ts
@@ -139,3 +139,16 @@ describe("describeShareAudience", () => {
 		);
 	});
 });
+
+it("describes the enforced organization audience before public or invited access", () => {
+	expect(
+		describeShareAudience({
+			isPublic: true,
+			videoSharingRestrictedToOrg: true,
+			allowedEmailDomain: "example.com",
+			passwordProtected: true,
+			audienceNames: ["Another organization"],
+			viewerCount: 2,
+		}).label,
+	).toBe("Organization only");
+});
diff --git a/apps/web/__tests__/unit/sso-settings.test.ts b/apps/web/__tests__/unit/sso-settings.test.ts
index b0567b12e54..24e28dceb59 100644
--- a/apps/web/__tests__/unit/sso-settings.test.ts
+++ b/apps/web/__tests__/unit/sso-settings.test.ts
@@ -179,6 +179,7 @@ function makeFixture({
 		tombstoneAt: null,
 		allowedEmailDomain: null,
 		defaultVideoVisibility: null,
+		videoSharingRestrictedToOrg: false,
 		customDomain: null,
 		domainVerified: null,
 		settings: null,
diff --git a/apps/web/__tests__/unit/video-download-permissions.test.ts b/apps/web/__tests__/unit/video-download-permissions.test.ts
index 5737566ef28..da7e1e50d09 100644
--- a/apps/web/__tests__/unit/video-download-permissions.test.ts
+++ b/apps/web/__tests__/unit/video-download-permissions.test.ts
@@ -1,6 +1,11 @@
 import type { Organisation, User, Video } from "@cap/web-domain";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+const organizationAccess = vi.hoisted(() => ({ get: vi.fn() }));
+vi.mock("@cap/database/video-organization-access", () => ({
+	getVideoOrganizationAccess: organizationAccess.get,
+}));
+
 const schema = {
 	organizationMembers: { table: "organizationMembers" },
 	sharedVideos: { table: "sharedVideos" },
@@ -48,10 +53,37 @@ function call(userId: User.UserId) {
 
 describe("canUserDownloadVideo", () => {
 	beforeEach(() => {
+		organizationAccess.get.mockResolvedValue({
+			restricted: false,
+			allowed: true,
+		});
 		queued = [];
 		tablesRead.length = 0;
 	});
 
+	it("denies a former owner while organization-only access is enabled", async () => {
+		organizationAccess.get.mockResolvedValue({
+			restricted: true,
+			allowed: false,
+		});
+		expect(await call(OWNER)).toBe(false);
+	});
+	it("denies external share members while organization-only access is enabled", async () => {
+		organizationAccess.get.mockResolvedValue({
+			restricted: true,
+			allowed: false,
+		});
+		queued = [[{ organizationId: VIDEO_ORG }], [{ id: "external-member" }]];
+		expect(await call(OTHER)).toBe(false);
+		expect(tablesRead).toEqual([]);
+	});
+	it("allows an organization member while organization-only access is enabled", async () => {
+		organizationAccess.get.mockResolvedValue({
+			restricted: true,
+			allowed: true,
+		});
+		expect(await call(OTHER)).toBe(true);
+	});
 	it("allows the owner without querying shares", async () => {
 		expect(await call(OWNER)).toBe(true);
 		expect(tablesRead).toEqual([]);
diff --git a/apps/web/__tests__/unit/video-viewer-invites.test.ts b/apps/web/__tests__/unit/video-viewer-invites.test.ts
index 3719694de16..bf735601120 100644
--- a/apps/web/__tests__/unit/video-viewer-invites.test.ts
+++ b/apps/web/__tests__/unit/video-viewer-invites.test.ts
@@ -10,7 +10,12 @@ const fixtures = vi.hoisted(() => ({
 	user: vi.fn(),
 	sendEmail: vi.fn(),
 	revalidatePath: vi.fn(),
-	video: { id: "video-1", ownerId: "owner-1", name: "Demo" },
+	video: {
+		id: "video-1",
+		ownerId: "owner-1",
+		name: "Demo",
+		videoSharingRestrictedToOrg: false,
+	},
 	grants: [] as string[],
 	revokedEmails: [] as string[],
 	inserted: vi.fn(),
@@ -18,6 +23,10 @@ const fixtures = vi.hoisted(() => ({
 }));
 
 const schema = vi.hoisted(() => ({
+	organizations: {
+		id: "organizationId",
+		videoSharingRestrictedToOrg: "videoSharingRestrictedToOrg",
+	},
 	videos: { id: "videoId", name: "videoName", ownerId: "videoOwnerId" },
 	videoViewerGrants: {
 		videoId: "grantVideoId",
@@ -33,20 +42,19 @@ vi.mock("@cap/database", () => ({
 			select: () => ({
 				from: (table: unknown) => {
 					selectedTable = table;
-					return {
-						where: () => ({
-							limit: async () =>
-								selectedTable === schema.videos
-									? [fixtures.video]
-									: fixtures.grants.map((email) => ({
-											email,
-											revokedAt: fixtures.revokedEmails.includes(email)
-												? new Date(0)
-												: null,
-										})),
-							orderBy: async () => fixtures.grants.map((email) => ({ email })),
-						}),
-					};
+					const where = () => ({
+						limit: async () =>
+							selectedTable === schema.videos
+								? [fixtures.video]
+								: fixtures.grants.map((email) => ({
+										email,
+										revokedAt: fixtures.revokedEmails.includes(email)
+											? new Date(0)
+											: null,
+									})),
+						orderBy: async () => fixtures.grants.map((email) => ({ email })),
+					});
+					return { where, innerJoin: () => ({ where }) };
 				},
 			}),
 			insert: () => ({
@@ -96,6 +104,7 @@ describe("recording viewer invitations", () => {
 		fixtures.grants = [];
 		fixtures.revokedEmails = [];
 		fixtures.video.ownerId = "owner-1";
+		fixtures.video.videoSharingRestrictedToOrg = false;
 		fixtures.user.mockResolvedValue({ id: "owner-1" });
 		fixtures.sendEmail.mockResolvedValue({
 			data: { id: "email-1" },
@@ -103,6 +112,15 @@ describe("recording viewer invitations", () => {
 		});
 	});
 
+	it("rejects invitations while organization-only access is enabled", async () => {
+		fixtures.video.videoSharingRestrictedToOrg = true;
+		await expect(
+			inviteVideoViewer(VIDEO_ID, "viewer@example.com"),
+		).rejects.toThrow("Invitations are disabled");
+		expect(fixtures.inserted).not.toHaveBeenCalled();
+		expect(fixtures.sendEmail).not.toHaveBeenCalled();
+	});
+
 	it("rejects a non-owner before writing a grant or sending email", async () => {
 		fixtures.user.mockResolvedValue({ id: "other-1" });
 
diff --git a/apps/web/__tests__/unit/videos-policy.test.ts b/apps/web/__tests__/unit/videos-policy.test.ts
index 6d1acb79672..0dfb98b7642 100644
--- a/apps/web/__tests__/unit/videos-policy.test.ts
+++ b/apps/web/__tests__/unit/videos-policy.test.ts
@@ -52,6 +52,8 @@ function makeDeps(config: {
 	spaceMembership?: boolean;
 	allowedEmailDomain?: Option.Option<string>;
 	viewerGrantEmail?: string;
+	organizationOnly?: boolean;
+	owningOrgMember?: boolean;
 }): VideosPolicyDeps {
 	const {
 		video,
@@ -61,6 +63,8 @@ function makeDeps(config: {
 		spaceMembership = false,
 		allowedEmailDomain = Option.none<string>(),
 		viewerGrantEmail,
+		organizationOnly = false,
+		owningOrgMember = false,
 	} = config;
 
 	return {
@@ -74,7 +78,20 @@ function makeDeps(config: {
 		orgsRepo: {
 			membershipForVideo: () =>
 				Effect.succeed(orgMembership ? [{ membershipId: "mem-1" }] : []),
-			allowedEmailDomain: () => Effect.succeed(allowedEmailDomain),
+			videoSharingSettings: () =>
+				Effect.succeed(
+					Option.some({
+						allowedEmailDomain: Option.getOrNull(allowedEmailDomain),
+						videoSharingRestrictedToOrg: organizationOnly,
+						tombstoneAt: null,
+					}),
+				),
+			membership: (_, orgId) =>
+				Effect.succeed(
+					owningOrgMember && orgId === TEST_ORG_ID
+						? Option.some({ membershipId: "owning-org-member" })
+						: Option.none(),
+				),
 		},
 		spacesRepo: {
 			membershipForVideo: () =>
@@ -422,6 +439,22 @@ describe("VideosPolicy.canView", () => {
 	describe("public video WITH email restriction (comma-separated)", () => {
 		const restriction = "company.com, partner.org, vip@gmail.com";
 
+		it.each([
+			["member,team@example.invalid", "member,team@example.invalid", "denied"],
+			["member,team@example.invalid", "example.invalid", "allowed"],
+			["team@example.invalid", "member,team@example.invalid", "allowed"],
+		])(
+			"checks complete restriction entries for %s against %s",
+			async (email, savedRestriction, expected) => {
+				const deps = makeDeps({
+					video: makeVideo({ public: true }),
+					allowedEmailDomain: Option.some(savedRestriction),
+				});
+
+				expect(await runCanView(deps, makeUser(email))).toBe(expected);
+			},
+		);
+
 		it("allows user matching first domain", async () => {
 			const deps = makeDeps({
 				video: makeVideo({ public: true }),
@@ -788,3 +821,83 @@ describe("VideosPolicy.canViewLoaded", () => {
 		expect(getByIdCalls).toBe(0);
 	});
 });
+
+describe("organization-only access", () => {
+	for (const loaded of [false, true]) {
+		for (const isPublic of [false, true]) {
+			for (const outsider of [
+				"anonymous",
+				"invited",
+				"shared-org",
+				"shared-space",
+				"matching-email",
+				"former-owner",
+			] as const) {
+				it(`denies ${outsider} with public=${isPublic} and loaded=${loaded}`, async () => {
+					const video = makeVideo({ public: isPublic });
+					const deps = makeDeps({
+						video,
+						organizationOnly: true,
+						viewerGrantEmail: "viewer@example.com",
+						orgMembership: outsider === "shared-org",
+						spaceMembership: outsider === "shared-space",
+						allowedEmailDomain: Option.some("example.com"),
+						password: Option.some("password"),
+						spacePasswords: ["space-password"],
+					});
+					const user =
+						outsider === "anonymous"
+							? noUser
+							: makeUser(
+									"viewer@example.com",
+									outsider === "former-owner"
+										? TEST_OWNER_ID
+										: TEST_OTHER_USER_ID,
+								);
+					const result = loaded
+						? await runCanViewLoaded(
+								deps,
+								video,
+								Option.some("password"),
+								user,
+								["password", "space-password"],
+							)
+						: await runCanView(deps, user, ["password", "space-password"]);
+					expect(result).toBe("denied");
+				});
+			}
+			it(`allows a current member and overrides individual access with public=${isPublic} and loaded=${loaded}`, async () => {
+				const video = makeVideo({ public: isPublic });
+				const deps = makeDeps({
+					video,
+					organizationOnly: true,
+					owningOrgMember: true,
+					allowedEmailDomain: Option.some("other.example"),
+					password: Option.some("password"),
+					spacePasswords: ["space-password"],
+				});
+				const user = makeUser("member@example.com");
+				expect(
+					loaded
+						? await runCanViewLoaded(deps, video, Option.some("password"), user)
+						: await runCanView(deps, user),
+				).toBe("allowed");
+			});
+		}
+	}
+	it("restores the original policy when the lock is disabled", async () => {
+		const config = {
+			video: makeVideo({ public: false }),
+			owningOrgMember: true,
+		};
+		expect(
+			await runCanView(
+				makeDeps({ ...config, organizationOnly: true }),
+				makeUser("member@example.com"),
+			),
+		).toBe("allowed");
+		expect(
+			await runCanView(makeDeps(config), makeUser("member@example.com")),
+		).toBe("denied");
+	});
+});
diff --git a/apps/web/actions/caps/share.ts b/apps/web/actions/caps/share.ts
index 707e0e4d659..285a6f7f13b 100644
--- a/apps/web/actions/caps/share.ts
+++ b/apps/web/actions/caps/share.ts
@@ -36,6 +36,18 @@ export async function shareCap({
 		if (!cap || cap.ownerId !== user.id) {
 			return { success: false, error: "Unauthorized" };
 		}
+		const [organization] = await db()
+			.select({ restricted: organizations.videoSharingRestrictedToOrg })
+			.from(organizations)
+			.where(eq(organizations.id, cap.orgId))
+			.limit(1);
+		if (organization?.restricted) {
+			return {
+				success: false,
+				error:
+					"Sharing is managed by your organization. Only organization members can view this recording.",
+			};
+		}
 
 		const userOrganizations = await db()
 			.select({
diff --git a/apps/web/actions/organization/default-video-visibility.ts b/apps/web/actions/organization/default-video-visibility.ts
index 2bd8a16a497..085230d79d7 100644
--- a/apps/web/actions/organization/default-video-visibility.ts
+++ b/apps/web/actions/organization/default-video-visibility.ts
@@ -3,7 +3,8 @@
 import { db } from "@cap/database";
 import { getCurrentUser } from "@cap/database/auth/session";
 import { organizations } from "@cap/database/schema";
-import { eq } from "drizzle-orm";
+import type { Organisation } from "@cap/web-domain";
+import { and, eq, isNull } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requireOrganizationSettingsManager } from "./authorization";
 
@@ -23,3 +24,34 @@ export async function updateDefaultVideoVisibility(privateByDefault: boolean) {
 	revalidatePath("/dashboard/caps");
 	return { success: true };
 }
+
+export async function updateOrganizationVideoSharing(
+	organizationId: Organisation.OrganisationId,
+	restricted: boolean,
+) {
+	if (
+		typeof restricted !== "boolean" ||
+		typeof organizationId !== "string" ||
+		!organizationId
+	)
+		throw new Error("Invalid sharing setting");
+	const user = await getCurrentUser();
+	if (!user) throw new Error("Unauthorized");
+
+	await requireOrganizationSettingsManager(user.id, organizationId);
+
+	await db()
+		.update(organizations)
+		.set({ videoSharingRestrictedToOrg: restricted })
+		.where(
+			and(
+				eq(organizations.id, organizationId),
+				isNull(organizations.tombstoneAt),
+			),
+		);
+
+	revalidatePath("/dashboard", "layout");
+	revalidatePath("/s/[videoId]", "page");
+	revalidatePath("/embed/[videoId]", "page");
+	return { success: true };
+}
diff --git a/apps/web/actions/videos/download.ts b/apps/web/actions/videos/download.ts
index 5ced7ae8cf8..3ebce986582 100644
--- a/apps/web/actions/videos/download.ts
+++ b/apps/web/actions/videos/download.ts
@@ -42,7 +42,10 @@ export async function downloadVideo(videoId: Video.VideoId) {
 		throw new Error("Video not found");
 	}
 
-	if (video.ownerId !== userId) {
+	if (
+		video.ownerId !== userId ||
+		!(await canUserDownloadVideo({ userId, ownerId: video.ownerId, videoId }))
+	) {
 		throw new Error("You don't have permission to download this video");
 	}
 
diff --git a/apps/web/actions/videos/get-og-image.tsx b/apps/web/actions/videos/get-og-image.tsx
index 96a7a56ad9a..6f52f74bed4 100644
--- a/apps/web/actions/videos/get-og-image.tsx
+++ b/apps/web/actions/videos/get-og-image.tsx
@@ -1,10 +1,14 @@
 import { db } from "@cap/database";
 import { users, videos } from "@cap/database/schema";
-import { findScreenshotObjectKey, Storage } from "@cap/web-backend";
+import {
+	findScreenshotObjectKey,
+	Storage,
+	VideosPolicy,
+} from "@cap/web-backend";
 import { getPublishedRecordingThumbnailKey } from "@cap/web-backend/src/Storage/recording-output";
 import type { Video } from "@cap/web-domain";
 import { eq } from "drizzle-orm";
-import { Effect } from "effect";
+import { Effect, Option } from "effect";
 import { extractPosterFrameDataUri } from "@/lib/og/poster-frame";
 import { renderVideoOg } from "@/lib/og/video-og";
 import { runPromise } from "@/lib/server";
@@ -16,9 +20,17 @@ export async function generateVideoOgImage(videoId: Video.VideoId) {
 	if (!videoData) return renderVideoOg({ kind: "not-found" });
 
 	const { video, ownerName } = videoData;
-
 	if (video.password) return renderVideoOg({ kind: "password" });
 	if (video.public === false) return renderVideoOg({ kind: "locked" });
+	const publiclyViewable = await Effect.gen(function* () {
+		const policy = yield* VideosPolicy;
+		yield* policy.canViewLoaded(video, Option.fromNullable(video.password));
+		return true;
+	}).pipe(
+		Effect.catchAll(() => Effect.succeed(false)),
+		runPromise,
+	);
+	if (!publiclyViewable) return renderVideoOg({ kind: "locked" });
 
 	let screenshotUrl: string | undefined;
 
diff --git a/apps/web/actions/videos/viewer-invites.ts b/apps/web/actions/videos/viewer-invites.ts
index ffa895abdbc..01f5c11381f 100644
--- a/apps/web/actions/videos/viewer-invites.ts
+++ b/apps/web/actions/videos/viewer-invites.ts
@@ -5,7 +5,7 @@ import { getCurrentUser } from "@cap/database/auth/session";
 import { sendEmail } from "@cap/database/emails/config";
 import { VideoViewerInvite } from "@cap/database/emails/video-viewer-invite";
 import { nanoId } from "@cap/database/helpers";
-import { videos, videoViewerGrants } from "@cap/database/schema";
+import { organizations, videos, videoViewerGrants } from "@cap/database/schema";
 import { serverEnv } from "@cap/env";
 import type { Video } from "@cap/web-domain";
 import { and, eq, isNull } from "drizzle-orm";
@@ -18,8 +18,14 @@ async function getOwnedVideo(videoId: Video.VideoId) {
 	if (!user) throw new Error("Unauthorized");
 
 	const [video] = await db()
-		.select({ id: videos.id, name: videos.name, ownerId: videos.ownerId })
+		.select({
+			id: videos.id,
+			name: videos.name,
+			ownerId: videos.ownerId,
+			videoSharingRestrictedToOrg: organizations.videoSharingRestrictedToOrg,
+		})
 		.from(videos)
+		.innerJoin(organizations, eq(videos.orgId, organizations.id))
 		.where(eq(videos.id, videoId))
 		.limit(1);
 
@@ -49,8 +55,18 @@ export async function getVideoViewerGrants(videoId: Video.VideoId) {
 		.orderBy(videoViewerGrants.email);
 }
 
+export async function getVideoSharingPolicy(videoId: Video.VideoId) {
+	const { video } = await getOwnedVideo(videoId);
+	return { videoSharingRestrictedToOrg: video.videoSharingRestrictedToOrg };
+}
+
 export async function inviteVideoViewer(videoId: Video.VideoId, email: string) {
 	const { user, video } = await getOwnedVideo(videoId);
+	if (video.videoSharingRestrictedToOrg) {
+		throw new Error(
+			"Only organization members can view this recording. Invitations are disabled by your organization.",
+		);
+	}
 	const normalizedEmail = normalizeEmail(email);
 
 	const [existingGrant] = await db()
diff --git a/apps/web/app/(org)/dashboard/caps/components/SharingDialog.tsx b/apps/web/app/(org)/dashboard/caps/components/SharingDialog.tsx
index 163b396410f..dba44792bdf 100644
--- a/apps/web/app/(org)/dashboard/caps/components/SharingDialog.tsx
+++ b/apps/web/app/(org)/dashboard/caps/components/SharingDialog.tsx
@@ -25,6 +25,7 @@ import {
 	setVideoPassword,
 } from "@/actions/videos/password";
 import {
+	getVideoSharingPolicy,
 	getVideoViewerGrants,
 	inviteVideoViewer,
 	revokeVideoViewer,
@@ -56,6 +57,7 @@ interface SharingDialogProps {
 	spacesData?: Spaces[] | null;
 	hasPassword?: boolean;
 	allowedEmailDomain?: string | null;
+	videoSharingRestrictedToOrg?: boolean;
 	inheritedPasswordSources?: SpaceRuleSource[];
 	onPasswordUpdated?: (protectedStatus: boolean) => void;
 	user?: CurrentUser | null;
@@ -73,6 +75,7 @@ export const SharingDialog: React.FC<SharingDialogProps> = ({
 	spacesData: propSpacesData = null,
 	hasPassword = false,
 	allowedEmailDomain: propAllowedEmailDomain,
+	videoSharingRestrictedToOrg: propRestricted,
 	inheritedPasswordSources = [],
 	onPasswordUpdated,
 	user: propUser,
@@ -107,6 +110,13 @@ export const SharingDialog: React.FC<SharingDialogProps> = ({
 	const router = useRouter();
 	const { webUrl } = usePublicEnv();
 	const shareUrl = `${webUrl}/s/${capId}`;
+	const sharingPolicy = useQuery({
+		queryKey: ["video-sharing-policy", capId],
+		queryFn: () => getVideoSharingPolicy(capId),
+		enabled: isOpen,
+	});
+	const restricted =
+		sharingPolicy.data?.videoSharingRestrictedToOrg ?? propRestricted ?? false;
 	const viewerGrants = useQuery({
 		queryKey: ["video-viewer-grants", capId],
 		queryFn: () => getVideoViewerGrants(capId),
@@ -417,7 +427,25 @@ export const SharingDialog: React.FC<SharingDialogProps> = ({
 				</div>
 
 				<div className="p-5">
-					{activeTab === "Share" ? (
+					{restricted ? (
+						<div className="space-y-3 rounded-lg border border-gray-4 bg-gray-1 p-4">
+							<p className="text-sm font-medium text-gray-12">
+								Organization only
+							</p>
+							<p className="text-sm text-gray-10">
+								Only signed-in members of this recording’s organization can view
+								it. Your organization overrides public links, invitations,
+								passwords, and individual sharing settings.
+							</p>
+							<p className="text-xs text-gray-10">
+								An organization admin or owner can change this in organization
+								preferences.
+							</p>
+							<Button size="sm" variant="dark" onClick={copyShareUrl}>
+								Copy link for organization members
+							</Button>
+						</div>
+					) : activeTab === "Share" ? (
 						<>
 							{/* Public sharing toggle */}
 							<div className="flex justify-between items-center p-3 mb-4 rounded-lg border bg-gray-1 border-gray-4">
@@ -654,7 +682,7 @@ export const SharingDialog: React.FC<SharingDialogProps> = ({
 				</div>
 
 				<DialogFooter className="p-5 border-t border-gray-4">
-					{activeTab === "Share" ? (
+					{activeTab === "Share" && !restricted ? (
 						<>
 							<Button size="sm" variant="gray" onClick={onClose}>
 								Cancel
diff --git a/apps/web/app/(org)/dashboard/settings/organization/components/DefaultVideoVisibility.tsx b/apps/web/app/(org)/dashboard/settings/organization/components/DefaultVideoVisibility.tsx
index b5bc8465116..210e323ee23 100644
--- a/apps/web/app/(org)/dashboard/settings/organization/components/DefaultVideoVisibility.tsx
+++ b/apps/web/app/(org)/dashboard/settings/organization/components/DefaultVideoVisibility.tsx
@@ -2,18 +2,31 @@
 
 import { Card, CardDescription, CardHeader, CardTitle, Switch } from "@cap/ui";
 import { useRouter } from "next/navigation";
-import { useEffect, useState } from "react";
+import { useEffect, useId, useState } from "react";
 import { toast } from "sonner";
-import { updateDefaultVideoVisibility } from "@/actions/organization/default-video-visibility";
+import {
+	updateDefaultVideoVisibility,
+	updateOrganizationVideoSharing,
+} from "@/actions/organization/default-video-visibility";
 import { useDashboardContext } from "../../../Contexts";
 
 export const DefaultVideoVisibility = () => {
 	const router = useRouter();
+	const restrictionId = useId();
+	const descriptionId = useId();
+	const privateId = useId();
 	const { activeOrganization } = useDashboardContext();
 	const savedPrivate =
 		activeOrganization?.organization.defaultVideoVisibility === "private";
 	const [privateByDefault, setPrivateByDefault] = useState(savedPrivate);
 	const [saving, setSaving] = useState(false);
+	const savedRestricted =
+		activeOrganization?.organization.videoSharingRestrictedToOrg ?? false;
+	const [restricted, setRestricted] = useState(savedRestricted);
+
+	useEffect(() => {
+		setRestricted(savedRestricted);
+	}, [savedRestricted]);
 
 	useEffect(() => {
 		setPrivateByDefault(savedPrivate);
@@ -38,29 +51,80 @@ export const DefaultVideoVisibility = () => {
 		}
 	};
 
+	const handleRestrictionChange = async (checked: boolean) => {
+		setRestricted(checked);
+		setSaving(true);
+		try {
+			if (!activeOrganization) throw new Error("No organization selected");
+			await updateOrganizationVideoSharing(
+				activeOrganization.organization.id,
+				checked,
+			);
+			router.refresh();
+			toast.success(
+				checked
+					? "All recordings are now organization-only"
+					: "Individual sharing settings restored",
+			);
+		} catch {
+			setRestricted(!checked);
+			toast.error("Failed to update organization sharing");
+		} finally {
+			setSaving(false);
+		}
+	};
+
 	return (
 		<Card className="flex flex-col gap-4">
 			<CardHeader>
-				<CardTitle>Sharing default</CardTitle>
+				<CardTitle>Recording access</CardTitle>
 				<CardDescription>
-					Choose how new recordings in this organization start. Owners can
-					change access on each recording later.
+					Control who can view recordings in this organization.
 				</CardDescription>
 			</CardHeader>
+			<div className="flex items-center justify-between gap-6 p-4 mx-4 rounded-xl border bg-gray-2 border-gray-3">
+				<div className="space-y-1">
+					<label htmlFor={restrictionId} className="text-sm text-gray-12">
+						Only members of this organization
+					</label>
+					<p className="text-xs text-gray-10" id={descriptionId}>
+						Applies to all existing and new recordings. Every member can view
+						with a signed-in organization account. People outside the
+						organization cannot view them.
+					</p>
+					<p className="text-xs text-gray-10">
+						Overrides public links, invitations, passwords, and individual
+						sharing settings. Only admins and owners can change this. Turning it
+						off restores those settings.
+					</p>
+				</div>
+				<Switch
+					id={restrictionId}
+					aria-describedby={descriptionId}
+					checked={restricted}
+					disabled={saving}
+					onCheckedChange={handleRestrictionChange}
+				/>
+			</div>
 			<div className="flex items-center justify-between gap-6 p-4 mx-4 mb-4 rounded-xl border bg-gray-2 border-gray-3">
 				<div className="space-y-1">
-					<p className="text-sm text-gray-12">Start new recordings private</p>
+					<label htmlFor={privateId} className="text-sm text-gray-12">
+						Start new recordings private
+					</label>
 					<p className="text-xs text-gray-10">
 						Only people given access can view them. When off, recordings follow
 						the current server default.
 					</p>
 					<p className="text-xs text-gray-10">
-						Existing recordings keep their current sharing setting.
+						{restricted
+							? "Organization-only access takes precedence while enabled."
+							: "Existing recordings keep their current sharing setting."}
 					</p>
 				</div>
 				<Switch
+					id={privateId}
 					checked={privateByDefault}
-					disabled={saving}
+					disabled={saving || restricted}
 					onCheckedChange={handleChange}
 				/>
 			</div>
diff --git a/apps/web/app/(org)/dashboard/spaces/[spaceId]/page.tsx b/apps/web/app/(org)/dashboard/spaces/[spaceId]/page.tsx
index f267ce43385..664adf77242 100644
--- a/apps/web/app/(org)/dashboard/spaces/[spaceId]/page.tsx
+++ b/apps/web/app/(org)/dashboard/spaces/[spaceId]/page.tsx
@@ -13,6 +13,7 @@ import {
 	videos,
 	videoUploads,
 } from "@cap/database/schema";
+import { organizationVideoAccessCondition } from "@cap/database/video-organization-access";
 import { serverEnv } from "@cap/env";
 import {
 	Database,
@@ -282,6 +283,7 @@ export default async function SharedCapsPage(props: {
 	const limit = Number(searchParams.limit) || 15;
 	const user = await getCurrentUser();
 	if (!user) notFound();
+	const viewerUserId = user.id;
 
 	const spaceOrOrg = await Effect.flatMap(Spaces, (s) =>
 		s.getSpaceOrOrg(Space.SpaceId.make(params.spaceId)),
@@ -350,6 +352,7 @@ export default async function SharedCapsPage(props: {
 					.where(
 						and(
 							eq(spaceVideos.spaceId, spaceId),
+							organizationVideoAccessCondition(viewerUserId),
 							isNull(spaceVideos.folderId),
 							isNull(organizations.tombstoneAt),
 						),
@@ -373,8 +376,13 @@ export default async function SharedCapsPage(props: {
 				db()
 					.select({ count: count() })
 					.from(spaceVideos)
+					.innerJoin(videos, eq(spaceVideos.videoId, videos.id))
 					.where(
-						and(eq(spaceVideos.spaceId, spaceId), isNull(spaceVideos.folderId)),
+						and(
+							eq(spaceVideos.spaceId, spaceId),
+							isNull(spaceVideos.folderId),
+							organizationVideoAccessCondition(viewerUserId),
+						),
 					),
 			]);
 			return {
@@ -480,6 +488,7 @@ export default async function SharedCapsPage(props: {
 					.where(
 						and(
 							eq(sharedVideos.organizationId, orgId),
+							organizationVideoAccessCondition(viewerUserId),
 							isNull(sharedVideos.folderId),
 						),
 					)
@@ -506,6 +515,7 @@ export default async function SharedCapsPage(props: {
 					.where(
 						and(
 							eq(sharedVideos.organizationId, orgId),
+							organizationVideoAccessCondition(viewerUserId),
 							isNull(videos.folderId),
 						),
 					),
diff --git a/apps/web/app/api/mobile/[...route]/route.ts b/apps/web/app/api/mobile/[...route]/route.ts
index 3298f890c5e..f7d77ef203f 100644
--- a/apps/web/app/api/mobile/[...route]/route.ts
+++ b/apps/web/app/api/mobile/[...route]/route.ts
@@ -6,6 +6,7 @@ import { sendEmail } from "@cap/database/emails/config";
 import { OTPEmail } from "@cap/database/emails/otp-email";
 import { nanoId } from "@cap/database/helpers";
 import * as Db from "@cap/database/schema";
+import { organizationVideoAccessCondition } from "@cap/database/video-organization-access";
 import { getNewVideoPublic } from "@cap/database/video-sharing-default";
 import { serverEnv } from "@cap/env";
 import { userIsPro } from "@cap/utils";
@@ -58,6 +59,10 @@ import {
 	hasPendingAccountDeletion,
 } from "@/lib/account-deletion-request";
 import { queueDesktopSegmentsFinalization } from "@/lib/desktop-segments-finalization";
+import {
+	type MobileCapRow as CapRow,
+	toMobileCapSummary,
+} from "@/lib/mobile-cap-summary";
 import {
 	resolveMobileRequestOrigin,
 	resolveMobileWebResourceUrl,
@@ -71,39 +76,6 @@ import { importLoomVideoWorkflow } from "@/workflows/import-loom-video";
 
 export const dynamic = "force-dynamic";
 
-type CapRow = {
-	id: Video.VideoId;
-	ownerId: User.UserId;
-	ownerPreferences: unknown;
-	name: string;
-	createdAt: Date;
-	updatedAt: Date;
-	ownerName: string | null;
-	duration: number | null;
-	folderId: Folder.FolderId | null;
-	public: boolean;
-	hasPassword: boolean;
-	hasInheritedPassword: boolean;
-	commentCount: number;
-	reactionCount: number;
-	uploadVideoId: Video.VideoId | null;
-	uploadUploaded: number | null;
-	uploadTotal: number | null;
-	uploadPhase: Video.UploadPhase | null;
-	processingProgress: number | null;
-	processingMessage: string | null;
-	processingError: string | null;
-	metadata: unknown;
-	transcriptionStatus:
-		| "PROCESSING"
-		| "COMPLETE"
-		| "ERROR"
-		| "SKIPPED"
-		| "NO_AUDIO"
-		| null;
-};
-
-type MobileCapSummary = (typeof Mobile.MobileCapSummary)["Type"];
 type MobileFolder = (typeof Mobile.MobileFolder)["Type"];
 type MobileOrganization = (typeof Mobile.MobileOrganization)["Type"];
 type MobileSpace = (typeof Mobile.MobileSpace)["Type"];
@@ -319,53 +291,6 @@ const getUploadTitle = (fileName: string) => {
 	return title.length > 0 ? title : "Mobile Upload";
 };
 
-const toMobileCapSummary = (
-	row: CapRow,
-	viewCount: number,
-	publicOrigin: string,
-	currentUserId: User.UserId,
-): MobileCapSummary => {
-	const hasThumbnail =
-		(!row.uploadVideoId || row.uploadPhase === "complete") &&
-		(row.ownerId === currentUserId ||
-			(!row.hasPassword && !row.hasInheritedPassword));
-	const thumbnailVersion = row.updatedAt.getTime();
-	return {
-		id: row.id,
-		ownerId: row.ownerId,
-		shareUrl: `${publicOrigin}/s/${row.id}`,
-		title: row.name,
-		createdAt: toIsoString(row.createdAt),
-		updatedAt: toIsoString(row.updatedAt),
-		ownerName: row.ownerName ?? "",
-		durationSeconds: row.duration,
-		thumbnailUrl: hasThumbnail
-			? `${publicOrigin}/api/mobile/caps/${encodeURIComponent(row.id)}/thumbnail?v=${thumbnailVersion}`
-			: null,
-		thumbnailCacheKey: hasThumbnail
-			? `cap-thumbnail:${row.id}:${thumbnailVersion}`
-			: null,
-		folderId: row.folderId,
-		public: row.public,
-		protected: row.hasPassword || row.hasInheritedPassword,
-		viewCount,
-		commentCount: Number(row.commentCount),
-		reactionCount: Number(row.reactionCount),
-		upload:
-			row.uploadVideoId && row.uploadPhase !== "complete"
-				? {
-						uploaded: Number(row.uploadUploaded ?? 0),
-						total: Number(row.uploadTotal ?? 0),
-						phase: row.uploadPhase ?? "uploading",
-						processingProgress: Number(row.processingProgress ?? 0),
-						processingMessage: row.processingMessage,
-						processingError: row.processingError,
-					}
-				: null,
-		ownedByCurrentUser: row.ownerId === currentUserId,
-	};
-};
-
 const withMappedErrors = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
 	effect.pipe(
 		Effect.catchTags({
@@ -1383,6 +1308,7 @@ const getCapLocations = Effect.fn("Mobile.getCapLocations")(function* ({
 			? eq(Db.videos.folderId, folderId)
 			: isNull(Db.videos.folderId);
 		const collectionWhereClause = and(
+			organizationVideoAccessCondition(user.id),
 			eq(Db.videos.ownerId, user.id),
 			eq(Db.videos.orgId, user.activeOrganizationId),
 			isNull(Db.organizations.tombstoneAt),
@@ -1425,6 +1351,7 @@ const getCapLocations = Effect.fn("Mobile.getCapLocations")(function* ({
 			? eq(Db.sharedVideos.folderId, folderId)
 			: isNull(Db.sharedVideos.folderId);
 		const collectionWhereClause = and(
+			organizationVideoAccessCondition(user.id),
 			eq(Db.sharedVideos.organizationId, user.activeOrganizationId),
 			isNull(Db.organizations.tombstoneAt),
 		);
@@ -1473,6 +1400,7 @@ const getCapLocations = Effect.fn("Mobile.getCapLocations")(function* ({
 		? eq(Db.spaceVideos.folderId, folderId)
 		: isNull(Db.spaceVideos.folderId);
 	const collectionWhereClause = and(
+		organizationVideoAccessCondition(user.id),
 		eq(Db.spaceVideos.spaceId, space.id),
 		isNull(Db.organizations.tombstoneAt),
 	);
@@ -1526,6 +1454,7 @@ const getCapRows = Effect.fn("Mobile.getCapRows")(function* (
 	if (locations.length === 0) return [];
 
 	const database = yield* Database;
+	const user = yield* CurrentUser;
 	const folderIds = new Map(
 		locations.map((location) => [location.id, location.folderId]),
 	);
@@ -1552,6 +1481,8 @@ const getCapRows = Effect.fn("Mobile.getCapRows")(function* (
 				duration: Db.videos.duration,
 				folderId: Db.videos.folderId,
 				public: Db.videos.public,
+				videoSharingRestrictedToOrg:
+					Db.organizations.videoSharingRestrictedToOrg,
 				hasPassword: sql<boolean>`${Db.videos.password} IS NOT NULL`.mapWith(
 					Boolean,
 				),
@@ -1569,13 +1500,17 @@ const getCapRows = Effect.fn("Mobile.getCapRows")(function* (
 				transcriptionStatus: Db.videos.transcriptionStatus,
 			})
 			.from(Db.videos)
+			.innerJoin(Db.organizations, eq(Db.videos.orgId, Db.organizations.id))
 			.leftJoin(Db.comments, eq(Db.videos.id, Db.comments.videoId))
 			.leftJoin(Db.users, eq(Db.videos.ownerId, Db.users.id))
 			.leftJoin(Db.videoUploads, eq(Db.videos.id, Db.videoUploads.videoId))
 			.where(
-				inArray(
-					Db.videos.id,
-					locations.map((location) => location.id),
+				and(
+					inArray(
+						Db.videos.id,
+						locations.map((location) => location.id),
+					),
+					organizationVideoAccessCondition(user.id),
 				),
 			)
 			.groupBy(
@@ -1588,6 +1523,7 @@ const getCapRows = Effect.fn("Mobile.getCapRows")(function* (
 				Db.videos.duration,
 				Db.videos.folderId,
 				Db.videos.public,
+				Db.organizations.videoSharingRestrictedToOrg,
 				Db.videos.password,
 				Db.videoUploads.videoId,
 				Db.videoUploads.uploaded,
@@ -1819,6 +1755,8 @@ const assertMobileVideoAccess = Effect.fn("Mobile.assertVideoAccess")(
 			return db
 				.select({
 					ownerId: Db.videos.ownerId,
+					videoSharingRestrictedToOrg:
+						Db.organizations.videoSharingRestrictedToOrg,
 					ownerPreferences: Db.users.preferences,
 					hasPassword: sql<boolean>`${Db.videos.password} IS NOT NULL`.mapWith(
 						Boolean,
@@ -1832,8 +1770,14 @@ const assertMobileVideoAccess = Effect.fn("Mobile.assertVideoAccess")(
 					),
 				})
 				.from(Db.videos)
+				.innerJoin(Db.organizations, eq(Db.videos.orgId, Db.organizations.id))
 				.leftJoin(Db.users, eq(Db.videos.ownerId, Db.users.id))
-				.where(eq(Db.videos.id, videoId))
+				.where(
+					and(
+						eq(Db.videos.id, videoId),
+						organizationVideoAccessCondition(user.id),
+					),
+				)
 				.limit(1);
 		});
 
@@ -1844,6 +1788,8 @@ const assertMobileVideoAccess = Effect.fn("Mobile.assertVideoAccess")(
 		) {
 			return yield* Effect.fail(new HttpApiError.NotFound());
 		}
+		if (row.videoSharingRestrictedToOrg)
+			return { ...row, hasPassword: false, hasInheritedPassword: false };
 		if (row.ownerId === user.id) return row;
 		if (!row.sharedWithOrganization && !row.sharedWithAccessibleSpace) {
 			return yield* Effect.fail(new HttpApiError.NotFound());
@@ -1931,6 +1877,8 @@ const getCapById = Effect.fn("Mobile.getCapById")(function* (
 	if (!row) return yield* Effect.fail(new HttpApiError.NotFound());
 	const capRow: CapRow = {
 		...row,
+		videoSharingRestrictedToOrg: access.videoSharingRestrictedToOrg,
+		hasPassword: access.hasPassword,
 		hasInheritedPassword: access.hasInheritedPassword,
 		ownerPreferences: access.ownerPreferences,
 	};
diff --git a/apps/web/app/api/oembed/route.ts b/apps/web/app/api/oembed/route.ts
index 72a54bf5fb4..74ca2bff7df 100644
--- a/apps/web/app/api/oembed/route.ts
+++ b/apps/web/app/api/oembed/route.ts
@@ -31,10 +31,7 @@ const jsonResponse = (body: unknown, status = 200) =>
 		contentType: "application/json; charset=utf-8",
 		headers: {
 			"Access-Control-Allow-Origin": "*",
-			"Cache-Control":
-				status === 200
-					? "public, max-age=300, stale-while-revalidate=3600"
-					: "private, no-store",
+			"Cache-Control": "private, no-store",
 			"X-Content-Type-Options": "nosniff",
 		},
 	});
diff --git a/apps/web/app/api/v1/[...route]/route.ts b/apps/web/app/api/v1/[...route]/route.ts
index 5e889e3c47c..bd4cb7eaacd 100644
--- a/apps/web/app/api/v1/[...route]/route.ts
+++ b/apps/web/app/api/v1/[...route]/route.ts
@@ -10,6 +10,7 @@ import { sendEmail } from "@cap/database/emails/config";
 import { OrganizationInvite } from "@cap/database/emails/organization-invite";
 import { nanoId, nanoIdLong } from "@cap/database/helpers";
 import * as Db from "@cap/database/schema";
+import { organizationVideoAccessCondition } from "@cap/database/video-organization-access";
 import { getNewVideoPublic } from "@cap/database/video-sharing-default";
 import { buildEnv, serverEnv } from "@cap/env";
 import {
@@ -770,6 +771,7 @@ const listCaps = Effect.fn("Agent.listCaps")(function* (
 				)
 			: undefined;
 		const filters = [
+			organizationVideoAccessCondition(principal.id),
 			params.scope === "shared"
 				? ne(Db.videos.ownerId, principal.id)
 				: undefined,
diff --git a/apps/web/app/api/video/preview/route.ts b/apps/web/app/api/video/preview/route.ts
index efd6a96640f..54cabba1d7c 100644
--- a/apps/web/app/api/video/preview/route.ts
+++ b/apps/web/app/api/video/preview/route.ts
@@ -62,7 +62,7 @@ export async function GET(request: NextRequest) {
 	}
 
 	const response = NextResponse.redirect(previewUrl, 302);
-	response.headers.set("Cache-Control", "public, max-age=300");
+	response.headers.set("Cache-Control", "private, no-store, max-age=0");
 	return response;
 }
 
diff --git a/apps/web/app/s/[videoId]/_components/ShareHeader.tsx b/apps/web/app/s/[videoId]/_components/ShareHeader.tsx
index 60607606a55..160aa414918 100644
--- a/apps/web/app/s/[videoId]/_components/ShareHeader.tsx
+++ b/apps/web/app/s/[videoId]/_components/ShareHeader.tsx
@@ -148,6 +148,7 @@ export const ShareHeader = ({
 	customDomain,
 	domainVerified,
 	allowedEmailDomain,
+	videoSharingRestrictedToOrg = false,
 	sharedOrganizations = [],
 	sharedSpaces = [],
 	viewerCount = 0,
@@ -163,6 +164,7 @@ export const ShareHeader = ({
 	customDomain?: string | null;
 	domainVerified?: boolean;
 	allowedEmailDomain?: string | null;
+	videoSharingRestrictedToOrg?: boolean;
 	sharedOrganizations?: { id: string; name: string }[];
 	viewerCount?: number;
 	userOrganizations?: { id: string; name: string }[];
@@ -512,6 +514,7 @@ export const ShareHeader = ({
 	const audience = describeShareAudience({
 		isPublic: Boolean(data.public),
 		allowedEmailDomain,
+		videoSharingRestrictedToOrg,
 		passwordProtected: effectivePasswordProtected,
 		audienceNames: [
 			...(sharedOrganizations ?? []).map((org) => org.name),
@@ -842,6 +845,7 @@ export const ShareHeader = ({
 					onSharingUpdated={handleSharingUpdated}
 					isPublic={data.public}
 					allowedEmailDomain={allowedEmailDomain}
+					videoSharingRestrictedToOrg={videoSharingRestrictedToOrg}
 					spacesData={spacesData}
 					hasPassword={passwordProtected}
 					inheritedPasswordSources={data.inheritedPasswordSources}
diff --git a/apps/web/app/s/[videoId]/_components/share-audience.ts b/apps/web/app/s/[videoId]/_components/share-audience.ts
index 879e1260707..3d2267d2684 100644
--- a/apps/web/app/s/[videoId]/_components/share-audience.ts
+++ b/apps/web/app/s/[videoId]/_components/share-audience.ts
@@ -18,6 +18,7 @@ export interface ShareAudience {
 export interface ShareAudienceInput {
 	isPublic: boolean;
 	allowedEmailDomain?: string | null;
+	videoSharingRestrictedToOrg?: boolean;
 	/** Includes an inherited password from a space or organization. */
 	passwordProtected: boolean;
 	/**
@@ -43,10 +44,19 @@ const listNames = (names: string[], total: number): string => {
 export const describeShareAudience = ({
 	isPublic,
 	allowedEmailDomain,
+	videoSharingRestrictedToOrg = false,
 	passwordProtected,
 	audienceNames,
 	viewerCount = 0,
 }: ShareAudienceInput): ShareAudience => {
+	if (videoSharingRestrictedToOrg) {
+		return {
+			kind: "spaces",
+			label: "Organization only",
+			tooltip:
+				"Only signed-in members of this recording’s organization can view it. This organization setting overrides individual sharing settings.",
+		};
+	}
 	if (isPublic) {
 		if (allowedEmailDomain?.trim()) {
 			return {
diff --git a/apps/web/app/s/[videoId]/page.tsx b/apps/web/app/s/[videoId]/page.tsx
index 9805a60e6c2..cb4765346d1 100644
--- a/apps/web/app/s/[videoId]/page.tsx
+++ b/apps/web/app/s/[videoId]/page.tsx
@@ -198,7 +198,21 @@ function PolicyDeniedView({
 	let title = "This video is private";
 	let description: React.ReactNode = <PrivateAccessActions videoId={videoId} />;
 
-	if (reason === "email_restriction_login_required") {
+	if (
+		reason === "organization_only_login_required" ||
+		reason === "organization_only_denied"
+	) {
+		title = "This video is organization-only";
+		description = (
+			<>
+				Only members of this organization can view this recording.{" "}
+				<Link href={`/login?next=${encodeURIComponent(`/s/${videoId}`)}`}>
+					Sign in with your organization account
+				</Link>
+				.
+			</>
+		);
+	} else if (reason === "email_restriction_login_required") {
 		title = "This video requires sign-in";
 		description = (
 			<>
@@ -376,6 +390,8 @@ export default async function ShareVideoPage(props: PageProps<"/s/[videoId]">) {
 					},
 					orgSettings: organizations.settings,
 					allowedEmailDomain: organizations.allowedEmailDomain,
+					videoSharingRestrictedToOrg:
+						organizations.videoSharingRestrictedToOrg,
 					organizationName: organizations.name,
 					organizationIconUrl: organizations.iconUrl,
 					shareableLinkIconUrl: organizations.shareableLinkIconUrl,
@@ -449,6 +465,7 @@ async function AuthorizedContent({
 		activeUploadRawFileKey: string | null;
 		orgSettings?: OrganizationSettings | null;
 		allowedEmailDomain?: string | null;
+		videoSharingRestrictedToOrg?: boolean | null;
 		videoSettings?: OrganizationSettings | null;
 		organizationName?: string | null;
 		organizationIconUrl?: ImageUpload.ImageUrlOrKey | null;
@@ -952,6 +969,9 @@ async function AuthorizedContent({
 						customDomain={customDomain}
 						domainVerified={domainVerified}
 						allowedEmailDomain={video.allowedEmailDomain}
+						videoSharingRestrictedToOrg={
+							video.videoSharingRestrictedToOrg ?? false
+						}
 						sharedOrganizations={
 							videoWithOrganizationInfo.sharedOrganizations || []
 						}
diff --git a/apps/web/content/docs/sharing/share-a-cap.mdx b/apps/web/content/docs/sharing/share-a-cap.mdx
index 272c7eb10bf..80b7cfca1c0 100644
--- a/apps/web/content/docs/sharing/share-a-cap.mdx
+++ b/apps/web/content/docs/sharing/share-a-cap.mdx
@@ -63,3 +63,9 @@ The embed enforces the same effective access and viewer rules. Screenshots do no
 ## Revoke access or delete
 
 Change the Cap's access settings when you need to restrict future viewing while keeping the recording. Deleting the Cap removes it from the supported library surfaces and makes its share route unavailable after deletion is processed.
+
+### Organization-only access
+
+Owners and admins can enable **Only members of this organization** in **Dashboard → Settings → Organization → Preferences**. All existing and new recordings belonging to that organization then require a signed-in organization account. Every current member can view them, and outside viewers cannot. This overrides public links, viewer invitations, shares to other organizations or spaces, and video or space passwords. Owners cannot override it on an individual recording.
+
+Turning this off restores individual sharing settings. Recordings and their saved settings are not rewritten. Copies already downloaded and temporary media URLs already issued cannot be recalled.
diff --git a/apps/web/lib/folder.ts b/apps/web/lib/folder.ts
index 84fbc906a7b..464543a96b3 100644
--- a/apps/web/lib/folder.ts
+++ b/apps/web/lib/folder.ts
@@ -1,3 +1,4 @@
+import { organizationVideoAccessCondition } from "@cap/database/video-organization-access";
 import "server-only";
 
 import {
@@ -175,6 +176,7 @@ export const getVideosByFolderId = Effect.fn(function* (
 ) {
 	if (!folderId) throw new Error("Folder ID is required");
 	const db = yield* Database;
+	const user = yield* CurrentUser;
 	const imageUploads = yield* ImageUploads;
 
 	const videoData = yield* db.use((db) =>
@@ -231,17 +233,20 @@ export const getVideosByFolderId = Effect.fn(function* (
 			.leftJoin(users, eq(videos.ownerId, users.id))
 			.leftJoin(videoUploads, eq(videos.id, videoUploads.videoId))
 			.where(
-				root.variant === "space"
-					? and(
-							eq(spaceVideos.folderId, folderId),
-							isNull(organizations.tombstoneAt),
-						)
-					: root.variant === "org"
+				and(
+					organizationVideoAccessCondition(user.id),
+					root.variant === "space"
 						? and(
-								eq(sharedVideos.folderId, folderId),
+								eq(spaceVideos.folderId, folderId),
 								isNull(organizations.tombstoneAt),
 							)
-						: eq(videos.folderId, folderId),
+						: root.variant === "org"
+							? and(
+									eq(sharedVideos.folderId, folderId),
+									isNull(organizations.tombstoneAt),
+								)
+							: eq(videos.folderId, folderId),
+				),
 			)
 			.groupBy(
 				videos.id,
diff --git a/apps/web/lib/mobile-cap-summary.ts b/apps/web/lib/mobile-cap-summary.ts
new file mode 100644
index 00000000000..ca4b69987d8
--- /dev/null
+++ b/apps/web/lib/mobile-cap-summary.ts
@@ -0,0 +1,83 @@
+import type { Folder, Mobile, User, Video } from "@cap/web-domain";
+
+export type MobileCapRow = {
+	id: Video.VideoId;
+	ownerId: User.UserId;
+	ownerPreferences: unknown;
+	name: string;
+	createdAt: Date;
+	updatedAt: Date;
+	ownerName: string | null;
+	duration: number | null;
+	folderId: Folder.FolderId | null;
+	public: boolean;
+	videoSharingRestrictedToOrg: boolean;
+	hasPassword: boolean;
+	hasInheritedPassword: boolean;
+	commentCount: number;
+	reactionCount: number;
+	uploadVideoId: Video.VideoId | null;
+	uploadUploaded: number | null;
+	uploadTotal: number | null;
+	uploadPhase: Video.UploadPhase | null;
+	processingProgress: number | null;
+	processingMessage: string | null;
+	processingError: string | null;
+	metadata: unknown;
+	transcriptionStatus:
+		| "PROCESSING"
+		| "COMPLETE"
+		| "ERROR"
+		| "SKIPPED"
+		| "NO_AUDIO"
+		| null;
+};
+
+export const toMobileCapSummary = (
+	row: MobileCapRow,
+	viewCount: number,
+	publicOrigin: string,
+	currentUserId: User.UserId,
+): (typeof Mobile.MobileCapSummary)["Type"] => {
+	const passwordProtected =
+		!row.videoSharingRestrictedToOrg &&
+		(row.hasPassword || row.hasInheritedPassword);
+	const hasThumbnail =
+		(!row.uploadVideoId || row.uploadPhase === "complete") &&
+		(row.ownerId === currentUserId || !passwordProtected);
+	const thumbnailVersion = row.updatedAt.getTime();
+	return {
+		id: row.id,
+		ownerId: row.ownerId,
+		shareUrl: `${publicOrigin}/s/${row.id}`,
+		title: row.name,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString(),
+		ownerName: row.ownerName ?? "",
+		durationSeconds: row.duration,
+		thumbnailUrl: hasThumbnail
+			? `${publicOrigin}/api/mobile/caps/${encodeURIComponent(row.id)}/thumbnail?v=${thumbnailVersion}`
+			: null,
+		thumbnailCacheKey: hasThumbnail
+			? `cap-thumbnail:${row.id}:${thumbnailVersion}`
+			: null,
+		folderId: row.folderId,
+		public: !row.videoSharingRestrictedToOrg && row.public,
+		protected: passwordProtected,
+		viewCount,
+		commentCount: Number(row.commentCount),
+		reactionCount: Number(row.reactionCount),
+		upload:
+			row.uploadVideoId && row.uploadPhase !== "complete"
+				? {
+						uploaded: Number(row.uploadUploaded ?? 0),
+						total: Number(row.uploadTotal ?? 0),
+						phase: row.uploadPhase ?? "uploading",
+						processingProgress: Number(row.processingProgress ?? 0),
+						processingMessage: row.processingMessage,
+						processingError: row.processingError,
+					}
+				: null,
+		ownedByCurrentUser: row.ownerId === currentUserId,
+	};
+};
diff --git a/apps/web/lib/og/video-og.tsx b/apps/web/lib/og/video-og.tsx
index ce873937249..876656a3020 100644
--- a/apps/web/lib/og/video-og.tsx
+++ b/apps/web/lib/og/video-og.tsx
@@ -31,10 +31,7 @@ export type VideoOgVariant =
 	| { kind: "password" }
 	| { kind: "not-found" };
 
-// Thumbnails and titles can change, so cache briefly at the edge and let
-// stale-while-revalidate keep crawler/email fetches instant.
-const VIDEO_OG_CACHE_CONTROL =
-	"public, max-age=600, s-maxage=3600, stale-while-revalidate=86400";
+const VIDEO_OG_CACHE_CONTROL = "private, no-store, max-age=0";
 
 export const formatDuration = (seconds: number) => {
 	const total = Math.max(0, Math.round(seconds));
diff --git a/apps/web/lib/public-collections.ts b/apps/web/lib/public-collections.ts
index a7c126645a4..c820f2baba2 100644
--- a/apps/web/lib/public-collections.ts
+++ b/apps/web/lib/public-collections.ts
@@ -5,6 +5,7 @@ import { getCurrentUser } from "@cap/database/auth/session";
 import {
 	comments,
 	folders,
+	organizationMembers,
 	organizations,
 	sharedVideos,
 	spaces,
@@ -14,6 +15,10 @@ import {
 	videoUploads,
 } from "@cap/database/schema";
 import type { VideoMetadata } from "@cap/database/types";
+import {
+	organizationVideoAccessCondition,
+	videoEmailAccessCondition,
+} from "@cap/database/video-organization-access";
 import { userIsPro } from "@cap/utils";
 import { ImageUploads } from "@cap/web-backend";
 import {
@@ -22,9 +27,10 @@ import {
 	type Organisation,
 	PublicCollection as PublicCollectionDomain,
 	type Space,
+	type User,
 	Video,
 } from "@cap/web-domain";
-import { and, desc, eq, inArray, isNull, type SQL, sql } from "drizzle-orm";
+import { and, desc, eq, inArray, isNull, or, type SQL, sql } from "drizzle-orm";
 import { Effect } from "effect";
 import { cache } from "react";
 import { sortFolders } from "@/lib/folder-sort";
@@ -161,13 +167,42 @@ export async function getPublicCollectionPageData(
 
 	if (!collection) return null;
 
-	const access = resolvePublicCollectionAccess({
+	const savedAccess = resolvePublicCollectionAccess({
 		allowedEmailDomain: collection.allowedEmailDomain,
 		viewerEmail: user?.email,
 		passwordHash: collection.passwordHash,
 		verifiedPasswordHashes,
 	});
 
+	const [memberOrganization] =
+		savedAccess.state !== "allowed" && user
+			? await db()
+					.select({ id: organizations.id })
+					.from(organizations)
+					.leftJoin(
+						organizationMembers,
+						and(
+							eq(organizationMembers.organizationId, organizations.id),
+							eq(organizationMembers.userId, user.id),
+						),
+					)
+					.where(
+						and(
+							eq(organizations.id, collection.organizationId),
+							eq(organizations.videoSharingRestrictedToOrg, true),
+							isNull(organizations.tombstoneAt),
+							or(
+								eq(organizations.ownerId, user.id),
+								eq(organizationMembers.userId, user.id),
+							),
+						),
+					)
+					.limit(1)
+			: [];
+	const access: PublicCollectionAccess = memberOrganization
+		? { state: "allowed" }
+		: savedAccess;
+
 	if (access.state !== "allowed") {
 		return {
 			collection,
@@ -181,9 +216,13 @@ export async function getPublicCollectionPageData(
 		};
 	}
 
+	const videoAccess = collectionVideoAccess(
+		verifiedPasswordHashes,
+		user ?? undefined,
+	);
 	const [childFolders, videoPage] = await Promise.all([
-		getPublicChildFolders(collection, verifiedPasswordHashes),
-		getPublicCollectionVideos(collection, page, verifiedPasswordHashes),
+		getPublicChildFolders(collection, videoAccess),
+		getPublicCollectionVideos(collection, page, videoAccess),
 	]);
 
 	return {
@@ -394,24 +433,48 @@ function isOrgLevelFolder(collection: PublicCollection) {
 	);
 }
 
+function collectionVideoAccess(
+	verifiedPasswordHashes: readonly string[],
+	viewer?: { id: User.UserId; email: string },
+) {
+	return or(
+		and(
+			eq(organizations.videoSharingRestrictedToOrg, false),
+			eq(videos.public, true),
+			videoEmailAccessCondition(viewer),
+			videoPasswordPredicate(
+				sql`${videos.id}`,
+				sql`${videos.password}`,
+				verifiedPasswordHashes,
+			),
+		),
+		viewer
+			? and(
+					eq(organizations.videoSharingRestrictedToOrg, true),
+					organizationVideoAccessCondition(viewer.id),
+				)
+			: sql`FALSE`,
+	);
+}
+
 async function getPublicCollectionVideos(
 	collection: PublicCollection,
 	page: number,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	if (collection.kind === "space") {
-		return getPublicSpaceVideos(collection, page, verifiedPasswordHashes);
+		return getPublicSpaceVideos(collection, page, videoAccess);
 	}
 
 	if (isOrgLevelFolder(collection)) {
-		return getPublicOrgFolderVideos(collection, page, verifiedPasswordHashes);
+		return getPublicOrgFolderVideos(collection, page, videoAccess);
 	}
 
 	if (collection.spaceId) {
-		return getPublicSpaceFolderVideos(collection, page, verifiedPasswordHashes);
+		return getPublicSpaceFolderVideos(collection, page, videoAccess);
 	}
 
-	return getPublicUserFolderVideos(collection, page, verifiedPasswordHashes);
+	return getPublicUserFolderVideos(collection, page, videoAccess);
 }
 
 const videoSelect = {
@@ -471,19 +534,14 @@ function toPublicCollectionVideos(
 async function getPublicSpaceVideos(
 	collection: PublicCollection,
 	page: number,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	const offset = (page - 1) * PUBLIC_COLLECTION_PAGE_SIZE;
 	const where = and(
 		eq(spaceVideos.spaceId, collection.id as Space.SpaceIdOrOrganisationId),
 		isNull(spaceVideos.folderId),
-		eq(videos.public, true),
 		isNull(organizations.tombstoneAt),
-		videoPasswordPredicate(
-			sql`${videos.id}`,
-			sql`${videos.password}`,
-			verifiedPasswordHashes,
-		),
+		videoAccess,
 	);
 
 	const [videoRows, totalCountResult] = await Promise.all([
@@ -517,18 +575,13 @@ async function getPublicSpaceVideos(
 async function getPublicSpaceFolderVideos(
 	collection: PublicCollection,
 	page: number,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	const offset = (page - 1) * PUBLIC_COLLECTION_PAGE_SIZE;
 	const where = and(
 		eq(spaceVideos.folderId, collection.id as Folder.FolderId),
-		eq(videos.public, true),
 		isNull(organizations.tombstoneAt),
-		videoPasswordPredicate(
-			sql`${videos.id}`,
-			sql`${videos.password}`,
-			verifiedPasswordHashes,
-		),
+		videoAccess,
 	);
 
 	const [videoRows, totalCountResult] = await Promise.all([
@@ -562,18 +615,13 @@ async function getPublicSpaceFolderVideos(
 async function getPublicOrgFolderVideos(
 	collection: PublicCollection,
 	page: number,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	const offset = (page - 1) * PUBLIC_COLLECTION_PAGE_SIZE;
 	const where = and(
 		eq(sharedVideos.folderId, collection.id as Folder.FolderId),
-		eq(videos.public, true),
 		isNull(organizations.tombstoneAt),
-		videoPasswordPredicate(
-			sql`${videos.id}`,
-			sql`${videos.password}`,
-			verifiedPasswordHashes,
-		),
+		videoAccess,
 	);
 
 	const [videoRows, totalCountResult] = await Promise.all([
@@ -607,18 +655,13 @@ async function getPublicOrgFolderVideos(
 async function getPublicUserFolderVideos(
 	collection: PublicCollection,
 	page: number,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	const offset = (page - 1) * PUBLIC_COLLECTION_PAGE_SIZE;
 	const where = and(
 		eq(videos.folderId, collection.id as Folder.FolderId),
-		eq(videos.public, true),
 		isNull(organizations.tombstoneAt),
-		videoPasswordPredicate(
-			sql`${videos.id}`,
-			sql`${videos.password}`,
-			verifiedPasswordHashes,
-		),
+		videoAccess,
 	);
 
 	const [videoRows, totalCountResult] = await Promise.all([
@@ -649,7 +692,7 @@ async function getPublicUserFolderVideos(
 
 async function getPublicChildFolders(
 	collection: PublicCollection,
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ): Promise<PublicCollectionFolder[]> {
 	const where =
 		collection.kind === "space"
@@ -685,10 +728,10 @@ async function getPublicChildFolders(
 
 	const folderIds = childFolders.map((folder) => folder.id);
 	const counts = isOrgLevelFolder(collection)
-		? await getPublicOrgFolderVideoCounts(folderIds, verifiedPasswordHashes)
+		? await getPublicOrgFolderVideoCounts(folderIds, videoAccess)
 		: collection.kind === "space" || Boolean(collection.spaceId)
-			? await getPublicSpaceFolderVideoCounts(folderIds, verifiedPasswordHashes)
-			: await getPublicUserFolderVideoCounts(folderIds, verifiedPasswordHashes);
+			? await getPublicSpaceFolderVideoCounts(folderIds, videoAccess)
+			: await getPublicUserFolderVideoCounts(folderIds, videoAccess);
 	const countByFolderId = new Map(
 		counts.map((row) => [row.folderId, row.videoCount]),
 	);
@@ -701,7 +744,7 @@ async function getPublicChildFolders(
 
 async function getPublicSpaceFolderVideoCounts(
 	folderIds: Folder.FolderId[],
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	return db()
 		.select({
@@ -714,13 +757,8 @@ async function getPublicSpaceFolderVideoCounts(
 		.where(
 			and(
 				inArray(spaceVideos.folderId, folderIds),
-				eq(videos.public, true),
 				isNull(organizations.tombstoneAt),
-				videoPasswordPredicate(
-					sql`${videos.id}`,
-					sql`${videos.password}`,
-					verifiedPasswordHashes,
-				),
+				videoAccess,
 			),
 		)
 		.groupBy(spaceVideos.folderId);
@@ -728,7 +766,7 @@ async function getPublicSpaceFolderVideoCounts(
 
 async function getPublicOrgFolderVideoCounts(
 	folderIds: Folder.FolderId[],
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	return db()
 		.select({
@@ -741,13 +779,8 @@ async function getPublicOrgFolderVideoCounts(
 		.where(
 			and(
 				inArray(sharedVideos.folderId, folderIds),
-				eq(videos.public, true),
 				isNull(organizations.tombstoneAt),
-				videoPasswordPredicate(
-					sql`${videos.id}`,
-					sql`${videos.password}`,
-					verifiedPasswordHashes,
-				),
+				videoAccess,
 			),
 		)
 		.groupBy(sharedVideos.folderId);
@@ -755,7 +788,7 @@ async function getPublicOrgFolderVideoCounts(
 
 async function getPublicUserFolderVideoCounts(
 	folderIds: Folder.FolderId[],
-	verifiedPasswordHashes: readonly string[],
+	videoAccess: SQL | undefined,
 ) {
 	return db()
 		.select({
@@ -767,13 +800,8 @@ async function getPublicUserFolderVideoCounts(
 		.where(
 			and(
 				inArray(videos.folderId, folderIds),
-				eq(videos.public, true),
 				isNull(organizations.tombstoneAt),
-				videoPasswordPredicate(
-					sql`${videos.id}`,
-					sql`${videos.password}`,
-					verifiedPasswordHashes,
-				),
+				videoAccess,
 			),
 		)
 		.groupBy(videos.folderId);
diff --git a/apps/web/lib/public-share-video.ts b/apps/web/lib/public-share-video.ts
index da299be45c4..dd8429053f7 100644
--- a/apps/web/lib/public-share-video.ts
+++ b/apps/web/lib/public-share-video.ts
@@ -19,6 +19,7 @@ export type PublicShareVideoCandidate = {
 	hasPassword: boolean;
 	hasInheritedPassword: boolean;
 	allowedEmailDomain: string | null;
+	videoSharingRestrictedToOrg: boolean;
 	isScreenshot: boolean;
 	hasActiveUpload: boolean;
 	sourceType:
@@ -40,6 +41,7 @@ export type PublicShareVideo = Omit<
 	| "hasPassword"
 	| "hasInheritedPassword"
 	| "allowedEmailDomain"
+	| "videoSharingRestrictedToOrg"
 	| "isScreenshot"
 	| "hasActiveUpload"
 	| "jobStatus"
@@ -50,6 +52,7 @@ export const isPublicShareVideoCandidateEligible = (
 	video: PublicShareVideoCandidate,
 ) =>
 	video.public &&
+	!video.videoSharingRestrictedToOrg &&
 	!video.hasPassword &&
 	!video.hasInheritedPassword &&
 	(video.allowedEmailDomain?.trim().length ?? 0) === 0 &&
@@ -73,6 +76,7 @@ export async function getPublicShareVideo(
 				Boolean,
 			),
 			allowedEmailDomain: organizations.allowedEmailDomain,
+			videoSharingRestrictedToOrg: organizations.videoSharingRestrictedToOrg,
 			isScreenshot: videos.isScreenshot,
 			hasActiveUpload:
 				sql<boolean>`${videoUploads.videoId} IS NOT NULL AND ${videoUploads.phase} <> 'complete'`.mapWith(
diff --git a/apps/web/lib/video-download-permissions.ts b/apps/web/lib/video-download-permissions.ts
index d7d3e10ab7a..7a53217d555 100644
--- a/apps/web/lib/video-download-permissions.ts
+++ b/apps/web/lib/video-download-permissions.ts
@@ -5,6 +5,7 @@ import {
 	spaceMembers,
 	spaceVideos,
 } from "@cap/database/schema";
+import { getVideoOrganizationAccess } from "@cap/database/video-organization-access";
 import type { User, Video } from "@cap/web-domain";
 import { and, eq, inArray } from "drizzle-orm";
 
@@ -22,6 +23,9 @@ export async function canUserDownloadVideo({
 	ownerId: User.UserId;
 	videoId: Video.VideoId;
 }): Promise<boolean> {
+	const organizationAccess = await getVideoOrganizationAccess(videoId, userId);
+	if (!organizationAccess?.allowed) return false;
+	if (organizationAccess.restricted) return true;
 	if (userId === ownerId) return true;
 
 	const sharedOrgs = await db()
diff --git a/packages/database/migrations/0050_equal_mentallo.sql b/packages/database/migrations/0050_equal_mentallo.sql
new file mode 100644
index 00000000000..a0e6ebeeb2e
--- /dev/null
+++ b/packages/database/migrations/0050_equal_mentallo.sql
@@ -0,0 +1 @@
+ALTER TABLE `organizations` ADD `videoSharingRestrictedToOrg` boolean DEFAULT false NOT NULL;
\ No newline at end of file
diff --git a/packages/database/migrations/meta/0050_snapshot.json b/packages/database/migrations/meta/0050_snapshot.json
new file mode 100644
index 00000000000..f6519d1f4b8
--- /dev/null
+++ b/packages/database/migrations/meta/0050_snapshot.json
@@ -0,0 +1,4997 @@
+{
+	"version": "5",
+	"dialect": "mysql",
+	"id": "798fd340-98c0-40bc-93cf-7893b6a43fa0",
+	"prevId": "7db9e8b2-ba9e-416d-a243-4b79b5d4ec5d",
+	"tables": {
+		"accounts": {
+			"name": "accounts",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"type": {
+					"name": "type",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"provider": {
+					"name": "provider",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"providerAccountId": {
+					"name": "providerAccountId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"access_token": {
+					"name": "access_token",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"expires_in": {
+					"name": "expires_in",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"id_token": {
+					"name": "id_token",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"refresh_token": {
+					"name": "refresh_token",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"refresh_token_expires_in": {
+					"name": "refresh_token_expires_in",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"scope": {
+					"name": "scope",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"token_type": {
+					"name": "token_type",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"tempColumn": {
+					"name": "tempColumn",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"user_id_idx": {
+					"name": "user_id_idx",
+					"columns": ["userId"],
+					"isUnique": false
+				},
+				"provider_account_id_idx": {
+					"name": "provider_account_id_idx",
+					"columns": ["providerAccountId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"accounts_id": {
+					"name": "accounts_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"agent_api_authorization_codes": {
+			"name": "agent_api_authorization_codes",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"codeHash": {
+					"name": "codeHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"codeChallenge": {
+					"name": "codeChallenge",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"redirectUri": {
+					"name": "redirectUri",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"scopes": {
+					"name": "scopes",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"consumedAt": {
+					"name": "consumedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"code_hash_idx": {
+					"name": "code_hash_idx",
+					"columns": ["codeHash"],
+					"isUnique": true
+				},
+				"expires_at_idx": {
+					"name": "expires_at_idx",
+					"columns": ["expiresAt"],
+					"isUnique": false
+				},
+				"user_created_at_idx": {
+					"name": "user_created_at_idx",
+					"columns": ["userId", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"agent_api_authorization_codes_id": {
+					"name": "agent_api_authorization_codes_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"agent_api_idempotency": {
+			"name": "agent_api_idempotency",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"operation": {
+					"name": "operation",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"keyHash": {
+					"name": "keyHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"requestHash": {
+					"name": "requestHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"state": {
+					"name": "state",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'pending'"
+				},
+				"statusCode": {
+					"name": "statusCode",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"response": {
+					"name": "response",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"user_operation_key_idx": {
+					"name": "user_operation_key_idx",
+					"columns": ["userId", "operation", "keyHash"],
+					"isUnique": true
+				},
+				"expires_at_idx": {
+					"name": "expires_at_idx",
+					"columns": ["expiresAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"agent_api_idempotency_id": {
+					"name": "agent_api_idempotency_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"agent_api_keys": {
+			"name": "agent_api_keys",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"tokenHash": {
+					"name": "tokenHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(100)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'Cap CLI'"
+				},
+				"scopes": {
+					"name": "scopes",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"revokedAt": {
+					"name": "revokedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"lastUsedAt": {
+					"name": "lastUsedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"token_hash_idx": {
+					"name": "token_hash_idx",
+					"columns": ["tokenHash"],
+					"isUnique": true
+				},
+				"user_created_at_idx": {
+					"name": "user_created_at_idx",
+					"columns": ["userId", "createdAt"],
+					"isUnique": false
+				},
+				"expires_at_idx": {
+					"name": "expires_at_idx",
+					"columns": ["expiresAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"agent_api_keys_id": {
+					"name": "agent_api_keys_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"agent_api_operations": {
+			"name": "agent_api_operations",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"kind": {
+					"name": "kind",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"resourceId": {
+					"name": "resourceId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"resultResourceId": {
+					"name": "resultResourceId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"state": {
+					"name": "state",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'queued'"
+				},
+				"payload": {
+					"name": "payload",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"result": {
+					"name": "result",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"errorCode": {
+					"name": "errorCode",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"errorMessage": {
+					"name": "errorMessage",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"completedAt": {
+					"name": "completedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"user_created_at_idx": {
+					"name": "user_created_at_idx",
+					"columns": ["userId", "createdAt"],
+					"isUnique": false
+				},
+				"state_updated_at_idx": {
+					"name": "state_updated_at_idx",
+					"columns": ["state", "updatedAt"],
+					"isUnique": false
+				},
+				"resource_id_idx": {
+					"name": "resource_id_idx",
+					"columns": ["resourceId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"agent_api_operations_id": {
+					"name": "agent_api_operations_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"auth_api_keys": {
+			"name": "auth_api_keys",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(36)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"source": {
+					"name": "source",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'unknown'"
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"user_id_created_at_idx": {
+					"name": "user_id_created_at_idx",
+					"columns": ["userId", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"auth_api_keys_id": {
+					"name": "auth_api_keys_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"comments": {
+			"name": "comments",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"type": {
+					"name": "type",
+					"type": "varchar(6)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"content": {
+					"name": "content",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"timestamp": {
+					"name": "timestamp",
+					"type": "float",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"authorId": {
+					"name": "authorId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"parentCommentId": {
+					"name": "parentCommentId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"mediaKey": {
+					"name": "mediaKey",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"mediaDuration": {
+					"name": "mediaDuration",
+					"type": "float",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"mediaMeta": {
+					"name": "mediaMeta",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"video_type_created_idx": {
+					"name": "video_type_created_idx",
+					"columns": ["videoId", "type", "createdAt", "id"],
+					"isUnique": false
+				},
+				"author_id_idx": {
+					"name": "author_id_idx",
+					"columns": ["authorId"],
+					"isUnique": false
+				},
+				"parent_comment_id_idx": {
+					"name": "parent_comment_id_idx",
+					"columns": ["parentCommentId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"comments_id": {
+					"name": "comments_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"developer_api_keys": {
+			"name": "developer_api_keys",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"appId": {
+					"name": "appId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"keyType": {
+					"name": "keyType",
+					"type": "varchar(8)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"keyPrefix": {
+					"name": "keyPrefix",
+					"type": "varchar(12)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"keyHash": {
+					"name": "keyHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"encryptedKey": {
+					"name": "encryptedKey",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"lastUsedAt": {
+					"name": "lastUsedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"revokedAt": {
+					"name": "revokedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"key_hash_idx": {
+					"name": "key_hash_idx",
+					"columns": ["keyHash"],
+					"isUnique": true
+				},
+				"app_key_type_idx": {
+					"name": "app_key_type_idx",
+					"columns": ["appId", "keyType"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"developer_api_keys_appId_developer_apps_id_fk": {
+					"name": "developer_api_keys_appId_developer_apps_id_fk",
+					"tableFrom": "developer_api_keys",
+					"tableTo": "developer_apps",
+					"columnsFrom": ["appId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_api_keys_id": {
+					"name": "developer_api_keys_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"developer_app_domains": {
+			"name": "developer_app_domains",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"appId": {
+					"name": "appId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"domain": {
+					"name": "domain",
+					"type": "varchar(253)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {},
+			"foreignKeys": {
+				"developer_app_domains_appId_developer_apps_id_fk": {
+					"name": "developer_app_domains_appId_developer_apps_id_fk",
+					"tableFrom": "developer_app_domains",
+					"tableTo": "developer_apps",
+					"columnsFrom": ["appId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_app_domains_id": {
+					"name": "developer_app_domains_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {
+				"app_domain_unique": {
+					"name": "app_domain_unique",
+					"columns": ["appId", "domain"]
+				}
+			},
+			"checkConstraint": {}
+		},
+		"developer_apps": {
+			"name": "developer_apps",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"environment": {
+					"name": "environment",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"logoUrl": {
+					"name": "logoUrl",
+					"type": "varchar(1024)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"deletedAt": {
+					"name": "deletedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"owner_deleted_idx": {
+					"name": "owner_deleted_idx",
+					"columns": ["ownerId", "deletedAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"developer_apps_id": {
+					"name": "developer_apps_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"developer_credit_accounts": {
+			"name": "developer_credit_accounts",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"appId": {
+					"name": "appId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"balanceMicroCredits": {
+					"name": "balanceMicroCredits",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"stripeCustomerId": {
+					"name": "stripeCustomerId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripePaymentMethodId": {
+					"name": "stripePaymentMethodId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"autoTopUpEnabled": {
+					"name": "autoTopUpEnabled",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"autoTopUpThresholdMicroCredits": {
+					"name": "autoTopUpThresholdMicroCredits",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"autoTopUpAmountCents": {
+					"name": "autoTopUpAmountCents",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"app_id_unique": {
+					"name": "app_id_unique",
+					"columns": ["appId"],
+					"isUnique": true
+				}
+			},
+			"foreignKeys": {
+				"developer_credit_accounts_appId_developer_apps_id_fk": {
+					"name": "developer_credit_accounts_appId_developer_apps_id_fk",
+					"tableFrom": "developer_credit_accounts",
+					"tableTo": "developer_apps",
+					"columnsFrom": ["appId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_credit_accounts_id": {
+					"name": "developer_credit_accounts_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"developer_credit_transactions": {
+			"name": "developer_credit_transactions",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"accountId": {
+					"name": "accountId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"type": {
+					"name": "type",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"amountMicroCredits": {
+					"name": "amountMicroCredits",
+					"type": "bigint",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"balanceAfterMicroCredits": {
+					"name": "balanceAfterMicroCredits",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"referenceId": {
+					"name": "referenceId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"referenceType": {
+					"name": "referenceType",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"account_type_created_idx": {
+					"name": "account_type_created_idx",
+					"columns": ["accountId", "type", "createdAt"],
+					"isUnique": false
+				},
+				"account_ref_dedup_idx": {
+					"name": "account_ref_dedup_idx",
+					"columns": ["accountId", "referenceId", "referenceType"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"dev_credit_txn_account_fk": {
+					"name": "dev_credit_txn_account_fk",
+					"tableFrom": "developer_credit_transactions",
+					"tableTo": "developer_credit_accounts",
+					"columnsFrom": ["accountId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_credit_transactions_id": {
+					"name": "developer_credit_transactions_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"developer_daily_storage_snapshots": {
+			"name": "developer_daily_storage_snapshots",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"appId": {
+					"name": "appId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"snapshotDate": {
+					"name": "snapshotDate",
+					"type": "varchar(10)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"totalDurationMinutes": {
+					"name": "totalDurationMinutes",
+					"type": "float",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"videoCount": {
+					"name": "videoCount",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"microCreditsCharged": {
+					"name": "microCreditsCharged",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"processedAt": {
+					"name": "processedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {},
+			"foreignKeys": {
+				"developer_daily_storage_snapshots_appId_developer_apps_id_fk": {
+					"name": "developer_daily_storage_snapshots_appId_developer_apps_id_fk",
+					"tableFrom": "developer_daily_storage_snapshots",
+					"tableTo": "developer_apps",
+					"columnsFrom": ["appId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_daily_storage_snapshots_id": {
+					"name": "developer_daily_storage_snapshots_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {
+				"app_date_unique": {
+					"name": "app_date_unique",
+					"columns": ["appId", "snapshotDate"]
+				}
+			},
+			"checkConstraint": {}
+		},
+		"developer_videos": {
+			"name": "developer_videos",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"appId": {
+					"name": "appId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"externalUserId": {
+					"name": "externalUserId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'Untitled'"
+				},
+				"duration": {
+					"name": "duration",
+					"type": "float",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"width": {
+					"name": "width",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"height": {
+					"name": "height",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"fps": {
+					"name": "fps",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"s3Key": {
+					"name": "s3Key",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"transcriptionStatus": {
+					"name": "transcriptionStatus",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"deletedAt": {
+					"name": "deletedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"app_created_idx": {
+					"name": "app_created_idx",
+					"columns": ["appId", "createdAt"],
+					"isUnique": false
+				},
+				"app_user_idx": {
+					"name": "app_user_idx",
+					"columns": ["appId", "externalUserId"],
+					"isUnique": false
+				},
+				"app_deleted_idx": {
+					"name": "app_deleted_idx",
+					"columns": ["appId", "deletedAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"developer_videos_appId_developer_apps_id_fk": {
+					"name": "developer_videos_appId_developer_apps_id_fk",
+					"tableFrom": "developer_videos",
+					"tableTo": "developer_apps",
+					"columnsFrom": ["appId"],
+					"columnsTo": ["id"],
+					"onDelete": "no action",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"developer_videos_id": {
+					"name": "developer_videos_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"folders": {
+			"name": "folders",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"color": {
+					"name": "color",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'normal'"
+				},
+				"public": {
+					"name": "public",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"settings": {
+					"name": "settings",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdById": {
+					"name": "createdById",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"parentId": {
+					"name": "parentId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"spaceId": {
+					"name": "spaceId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"created_by_id_idx": {
+					"name": "created_by_id_idx",
+					"columns": ["createdById"],
+					"isUnique": false
+				},
+				"parent_id_idx": {
+					"name": "parent_id_idx",
+					"columns": ["parentId"],
+					"isUnique": false
+				},
+				"space_id_idx": {
+					"name": "space_id_idx",
+					"columns": ["spaceId"],
+					"isUnique": false
+				},
+				"public_parent_id_idx": {
+					"name": "public_parent_id_idx",
+					"columns": ["public", "parentId"],
+					"isUnique": false
+				},
+				"public_space_parent_id_idx": {
+					"name": "public_space_parent_id_idx",
+					"columns": ["public", "spaceId", "parentId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"folders_id": {
+					"name": "folders_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"imported_videos": {
+			"name": "imported_videos",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"orgId": {
+					"name": "orgId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"source": {
+					"name": "source",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"source_id": {
+					"name": "source_id",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"id_idx": {
+					"name": "id_idx",
+					"columns": ["id"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"imported_videos_orgId_source_source_id_pk": {
+					"name": "imported_videos_orgId_source_source_id_pk",
+					"columns": ["orgId", "source", "source_id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"integration_installations": {
+			"name": "integration_installations",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"provider": {
+					"name": "provider",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"externalId": {
+					"name": "externalId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"displayName": {
+					"name": "displayName",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"installedByUserId": {
+					"name": "installedByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"encryptedCredentials": {
+					"name": "encryptedCredentials",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"provider_external_id_idx": {
+					"name": "provider_external_id_idx",
+					"columns": ["provider", "externalId"],
+					"isUnique": true
+				},
+				"organization_provider_display_name_idx": {
+					"name": "organization_provider_display_name_idx",
+					"columns": ["organizationId", "provider", "displayName"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"integration_installations_id": {
+					"name": "integration_installations_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"loops_sync_jobs": {
+			"name": "loops_sync_jobs",
+			"columns": {
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"revision": {
+					"name": "revision",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 1
+				},
+				"nextAttemptAt": {
+					"name": "nextAttemptAt",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"leaseToken": {
+					"name": "leaseToken",
+					"type": "varchar(36)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"leaseUntil": {
+					"name": "leaseUntil",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"failures": {
+					"name": "failures",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"lastError": {
+					"name": "lastError",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"profileHash": {
+					"name": "profileHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"teammateJoinedAt": {
+					"name": "teammateJoinedAt",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"syncedEmail": {
+					"name": "syncedEmail",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"lastSyncedAt": {
+					"name": "lastSyncedAt",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"loops_sync_due_idx": {
+					"name": "loops_sync_due_idx",
+					"columns": ["nextAttemptAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"loops_sync_jobs_userId": {
+					"name": "loops_sync_jobs_userId",
+					"columns": ["userId"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"mcp_oauth_clients": {
+			"name": "mcp_oauth_clients",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"clientId": {
+					"name": "clientId",
+					"type": "varchar(128)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"clientName": {
+					"name": "clientName",
+					"type": "varchar(100)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"redirectUris": {
+					"name": "redirectUris",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"activatedAt": {
+					"name": "activatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"client_id_idx": {
+					"name": "client_id_idx",
+					"columns": ["clientId"],
+					"isUnique": true
+				},
+				"inactive_created_at_idx": {
+					"name": "inactive_created_at_idx",
+					"columns": ["activatedAt", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"mcp_oauth_clients_id": {
+					"name": "mcp_oauth_clients_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"mcp_oauth_codes": {
+			"name": "mcp_oauth_codes",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"clientId": {
+					"name": "clientId",
+					"type": "varchar(128)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"codeHash": {
+					"name": "codeHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"codeChallenge": {
+					"name": "codeChallenge",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"redirectUri": {
+					"name": "redirectUri",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"resource": {
+					"name": "resource",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"consumedAt": {
+					"name": "consumedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"code_hash_idx": {
+					"name": "code_hash_idx",
+					"columns": ["codeHash"],
+					"isUnique": true
+				},
+				"expires_at_idx": {
+					"name": "expires_at_idx",
+					"columns": ["expiresAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"mcp_oauth_codes_id": {
+					"name": "mcp_oauth_codes_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"mcp_oauth_registration_quotas": {
+			"name": "mcp_oauth_registration_quotas",
+			"columns": {
+				"windowId": {
+					"name": "windowId",
+					"type": "varchar(10)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"registrations": {
+					"name": "registrations",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"expires_at_idx": {
+					"name": "expires_at_idx",
+					"columns": ["expiresAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"mcp_oauth_registration_quotas_windowId": {
+					"name": "mcp_oauth_registration_quotas_windowId",
+					"columns": ["windowId"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"mcp_oauth_tokens": {
+			"name": "mcp_oauth_tokens",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"clientId": {
+					"name": "clientId",
+					"type": "varchar(128)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"familyId": {
+					"name": "familyId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"resource": {
+					"name": "resource",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"accessHash": {
+					"name": "accessHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"refreshHash": {
+					"name": "refreshHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"accessExpiresAt": {
+					"name": "accessExpiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"refreshExpiresAt": {
+					"name": "refreshExpiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"revokedAt": {
+					"name": "revokedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"access_hash_idx": {
+					"name": "access_hash_idx",
+					"columns": ["accessHash"],
+					"isUnique": true
+				},
+				"refresh_hash_idx": {
+					"name": "refresh_hash_idx",
+					"columns": ["refreshHash"],
+					"isUnique": true
+				},
+				"family_id_idx": {
+					"name": "family_id_idx",
+					"columns": ["familyId"],
+					"isUnique": false
+				},
+				"client_active_idx": {
+					"name": "client_active_idx",
+					"columns": ["clientId", "revokedAt", "refreshExpiresAt"],
+					"isUnique": false
+				},
+				"refresh_expires_at_idx": {
+					"name": "refresh_expires_at_idx",
+					"columns": ["refreshExpiresAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"mcp_oauth_tokens_id": {
+					"name": "mcp_oauth_tokens_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"media_processing_budgets": {
+			"name": "media_processing_budgets",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"reserved_bytes": {
+					"name": "reserved_bytes",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"limit_bytes": {
+					"name": "limit_bytes",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expires_at": {
+					"name": "expires_at",
+					"type": "datetime(3)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"media_budget_expiry_idx": {
+					"name": "media_budget_expiry_idx",
+					"columns": ["expires_at"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"media_processing_budgets_id": {
+					"name": "media_processing_budgets_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"messenger_conversations": {
+			"name": "messenger_conversations",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"agent": {
+					"name": "agent",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"mode": {
+					"name": "mode",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'agent'"
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"anonymousId": {
+					"name": "anonymousId",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"takeoverByUserId": {
+					"name": "takeoverByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"takeoverAt": {
+					"name": "takeoverAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"lastMessageAt": {
+					"name": "lastMessageAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"user_last_message_idx": {
+					"name": "user_last_message_idx",
+					"columns": ["userId", "lastMessageAt"],
+					"isUnique": false
+				},
+				"anonymous_last_message_idx": {
+					"name": "anonymous_last_message_idx",
+					"columns": ["anonymousId", "lastMessageAt"],
+					"isUnique": false
+				},
+				"mode_last_message_idx": {
+					"name": "mode_last_message_idx",
+					"columns": ["mode", "lastMessageAt"],
+					"isUnique": false
+				},
+				"updated_at_idx": {
+					"name": "updated_at_idx",
+					"columns": ["updatedAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"messenger_conversations_id": {
+					"name": "messenger_conversations_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"messenger_messages": {
+			"name": "messenger_messages",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"conversationId": {
+					"name": "conversationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"role": {
+					"name": "role",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"content": {
+					"name": "content",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"anonymousId": {
+					"name": "anonymousId",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"conversation_created_at_idx": {
+					"name": "conversation_created_at_idx",
+					"columns": ["conversationId", "createdAt"],
+					"isUnique": false
+				},
+				"role_created_at_idx": {
+					"name": "role_created_at_idx",
+					"columns": ["role", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"messenger_messages_conversationId_messenger_conversations_id_fk": {
+					"name": "messenger_messages_conversationId_messenger_conversations_id_fk",
+					"tableFrom": "messenger_messages",
+					"tableTo": "messenger_conversations",
+					"columnsFrom": ["conversationId"],
+					"columnsTo": ["id"],
+					"onDelete": "cascade",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"messenger_messages_id": {
+					"name": "messenger_messages_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"messenger_support_emails": {
+			"name": "messenger_support_emails",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"conversationId": {
+					"name": "conversationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userEmail": {
+					"name": "userEmail",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"subject": {
+					"name": "subject",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"message": {
+					"name": "message",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"support_email_user_created_at_idx": {
+					"name": "support_email_user_created_at_idx",
+					"columns": ["userId", "createdAt"],
+					"isUnique": false
+				},
+				"support_email_conversation_created_at_idx": {
+					"name": "support_email_conversation_created_at_idx",
+					"columns": ["conversationId", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"support_email_conversation_fk": {
+					"name": "support_email_conversation_fk",
+					"tableFrom": "messenger_support_emails",
+					"tableTo": "messenger_conversations",
+					"columnsFrom": ["conversationId"],
+					"columnsTo": ["id"],
+					"onDelete": "cascade",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"messenger_support_emails_id": {
+					"name": "messenger_support_emails_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"notifications": {
+			"name": "notifications",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"orgId": {
+					"name": "orgId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"recipientId": {
+					"name": "recipientId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"type": {
+					"name": "type",
+					"type": "varchar(16)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"data": {
+					"name": "data",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(50)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"dedupKey": {
+					"name": "dedupKey",
+					"type": "varchar(128)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"readAt": {
+					"name": "readAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"org_id_idx": {
+					"name": "org_id_idx",
+					"columns": ["orgId"],
+					"isUnique": false
+				},
+				"type_idx": {
+					"name": "type_idx",
+					"columns": ["type"],
+					"isUnique": false
+				},
+				"read_at_idx": {
+					"name": "read_at_idx",
+					"columns": ["readAt"],
+					"isUnique": false
+				},
+				"created_at_idx": {
+					"name": "created_at_idx",
+					"columns": ["createdAt"],
+					"isUnique": false
+				},
+				"recipient_read_idx": {
+					"name": "recipient_read_idx",
+					"columns": ["recipientId", "readAt"],
+					"isUnique": false
+				},
+				"recipient_created_idx": {
+					"name": "recipient_created_idx",
+					"columns": ["recipientId", "createdAt"],
+					"isUnique": false
+				},
+				"dedup_key_idx": {
+					"name": "dedup_key_idx",
+					"columns": ["dedupKey"],
+					"isUnique": true
+				},
+				"type_recipient_created_idx": {
+					"name": "type_recipient_created_idx",
+					"columns": ["type", "recipientId", "createdAt"],
+					"isUnique": false
+				},
+				"type_recipient_video_created_idx": {
+					"name": "type_recipient_video_created_idx",
+					"columns": ["type", "recipientId", "videoId", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"notifications_id": {
+					"name": "notifications_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"organization_invites": {
+			"name": "organization_invites",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"invitedEmail": {
+					"name": "invitedEmail",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"invitedByUserId": {
+					"name": "invitedByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"role": {
+					"name": "role",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"status": {
+					"name": "status",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'pending'"
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"expiresAt": {
+					"name": "expiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"invited_email_idx": {
+					"name": "invited_email_idx",
+					"columns": ["invitedEmail"],
+					"isUnique": false
+				},
+				"invited_by_user_id_idx": {
+					"name": "invited_by_user_id_idx",
+					"columns": ["invitedByUserId"],
+					"isUnique": false
+				},
+				"status_idx": {
+					"name": "status_idx",
+					"columns": ["status"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"organization_invites_id": {
+					"name": "organization_invites_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"organization_members": {
+			"name": "organization_members",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"role": {
+					"name": "role",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"hasProSeat": {
+					"name": "hasProSeat",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"user_id_organization_id_idx": {
+					"name": "user_id_organization_id_idx",
+					"columns": ["userId", "organizationId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"organization_members_id": {
+					"name": "organization_members_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"organization_sso": {
+			"name": "organization_sso",
+			"columns": {
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"purchasedByUserId": {
+					"name": "purchasedByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"stripeCustomerId": {
+					"name": "stripeCustomerId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripeSubscriptionId": {
+					"name": "stripeSubscriptionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripePriceId": {
+					"name": "stripePriceId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"status": {
+					"name": "status",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'unpaid'"
+				},
+				"paidThrough": {
+					"name": "paidThrough",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"currentPeriodEnd": {
+					"name": "currentPeriodEnd",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"cancelAtPeriodEnd": {
+					"name": "cancelAtPeriodEnd",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"checkoutAttemptId": {
+					"name": "checkoutAttemptId",
+					"type": "varchar(36)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"checkoutCurrency": {
+					"name": "checkoutCurrency",
+					"type": "varchar(3)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"checkoutPriceId": {
+					"name": "checkoutPriceId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"checkoutSessionId": {
+					"name": "checkoutSessionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"checkoutStartedAt": {
+					"name": "checkoutStartedAt",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"sso_stripe_subscription_id_idx": {
+					"name": "sso_stripe_subscription_id_idx",
+					"columns": ["stripeSubscriptionId"],
+					"isUnique": true
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"organization_sso_organizationId": {
+					"name": "organization_sso_organizationId",
+					"columns": ["organizationId"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"organizations": {
+			"name": "organizations",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"tombstoneAt": {
+					"name": "tombstoneAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"allowedEmailDomain": {
+					"name": "allowedEmailDomain",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"defaultVideoVisibility": {
+					"name": "defaultVideoVisibility",
+					"type": "varchar(7)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"videoSharingRestrictedToOrg": {
+					"name": "videoSharingRestrictedToOrg",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"customDomain": {
+					"name": "customDomain",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"domainVerified": {
+					"name": "domainVerified",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"settings": {
+					"name": "settings",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"iconUrl": {
+					"name": "iconUrl",
+					"type": "varchar(1024)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"shareableLinkIconUrl": {
+					"name": "shareableLinkIconUrl",
+					"type": "varchar(1024)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"workosOrganizationId": {
+					"name": "workosOrganizationId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"workosConnectionId": {
+					"name": "workosConnectionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"owner_id_tombstone_idx": {
+					"name": "owner_id_tombstone_idx",
+					"columns": ["ownerId", "tombstoneAt"],
+					"isUnique": false
+				},
+				"custom_domain_idx": {
+					"name": "custom_domain_idx",
+					"columns": ["customDomain"],
+					"isUnique": false
+				},
+				"workos_organization_id_idx": {
+					"name": "workos_organization_id_idx",
+					"columns": ["workosOrganizationId"],
+					"isUnique": true
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"organizations_id": {
+					"name": "organizations_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"s3_buckets": {
+			"name": "s3_buckets",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"region": {
+					"name": "region",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"endpoint": {
+					"name": "endpoint",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"bucketName": {
+					"name": "bucketName",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"accessKeyId": {
+					"name": "accessKeyId",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"secretAccessKey": {
+					"name": "secretAccessKey",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"provider": {
+					"name": "provider",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "('aws')"
+				},
+				"active": {
+					"name": "active",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": true
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"owner_organization_idx": {
+					"name": "owner_organization_idx",
+					"columns": ["ownerId", "organizationId"],
+					"isUnique": false
+				},
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"organization_active_idx": {
+					"name": "organization_active_idx",
+					"columns": ["organizationId", "active", "updatedAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"s3_buckets_id": {
+					"name": "s3_buckets_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"sessions": {
+			"name": "sessions",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"sessionToken": {
+					"name": "sessionToken",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expires": {
+					"name": "expires",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"created_at": {
+					"name": "created_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updated_at": {
+					"name": "updated_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"session_token_idx": {
+					"name": "session_token_idx",
+					"columns": ["sessionToken"],
+					"isUnique": true
+				},
+				"user_id_idx": {
+					"name": "user_id_idx",
+					"columns": ["userId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"sessions_id": {
+					"name": "sessions_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"shared_videos": {
+			"name": "shared_videos",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"folderId": {
+					"name": "folderId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"sharedByUserId": {
+					"name": "sharedByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"sharedAt": {
+					"name": "sharedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"folder_id_idx": {
+					"name": "folder_id_idx",
+					"columns": ["folderId"],
+					"isUnique": false
+				},
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"shared_by_user_id_idx": {
+					"name": "shared_by_user_id_idx",
+					"columns": ["sharedByUserId"],
+					"isUnique": false
+				},
+				"video_id_organization_id_idx": {
+					"name": "video_id_organization_id_idx",
+					"columns": ["videoId", "organizationId"],
+					"isUnique": false
+				},
+				"video_id_folder_id_idx": {
+					"name": "video_id_folder_id_idx",
+					"columns": ["videoId", "folderId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"shared_videos_id": {
+					"name": "shared_videos_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"signed_baas": {
+			"name": "signed_baas",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"status": {
+					"name": "status",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'pending'"
+				},
+				"stripeSubscriptionId": {
+					"name": "stripeSubscriptionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"entityName": {
+					"name": "entityName",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"entityType": {
+					"name": "entityType",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"entityAddress": {
+					"name": "entityAddress",
+					"type": "varchar(500)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"signerName": {
+					"name": "signerName",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"signerTitle": {
+					"name": "signerTitle",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"noticesEmail": {
+					"name": "noticesEmail",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"signatureData": {
+					"name": "signatureData",
+					"type": "longtext",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"signedAt": {
+					"name": "signedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"emailSentAt": {
+					"name": "emailSentAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"signed_baa_organization_id_idx": {
+					"name": "signed_baa_organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": true
+				},
+				"signed_baa_stripe_subscription_idx": {
+					"name": "signed_baa_stripe_subscription_idx",
+					"columns": ["stripeSubscriptionId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"signed_baas_id": {
+					"name": "signed_baas_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"space_members": {
+			"name": "space_members",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"spaceId": {
+					"name": "spaceId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"userId": {
+					"name": "userId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"role": {
+					"name": "role",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'member'"
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"user_id_idx": {
+					"name": "user_id_idx",
+					"columns": ["userId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"space_members_id": {
+					"name": "space_members_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {
+				"space_id_user_id_unique": {
+					"name": "space_id_user_id_unique",
+					"columns": ["spaceId", "userId"]
+				}
+			},
+			"checkConstraint": {}
+		},
+		"space_videos": {
+			"name": "space_videos",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"spaceId": {
+					"name": "spaceId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"folderId": {
+					"name": "folderId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"addedById": {
+					"name": "addedById",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"addedAt": {
+					"name": "addedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"folder_id_idx": {
+					"name": "folder_id_idx",
+					"columns": ["folderId"],
+					"isUnique": false
+				},
+				"video_id_idx": {
+					"name": "video_id_idx",
+					"columns": ["videoId"],
+					"isUnique": false
+				},
+				"added_by_id_idx": {
+					"name": "added_by_id_idx",
+					"columns": ["addedById"],
+					"isUnique": false
+				},
+				"space_id_video_id_idx": {
+					"name": "space_id_video_id_idx",
+					"columns": ["spaceId", "videoId"],
+					"isUnique": false
+				},
+				"space_id_folder_id_idx": {
+					"name": "space_id_folder_id_idx",
+					"columns": ["spaceId", "folderId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"space_videos_id": {
+					"name": "space_videos_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"spaces": {
+			"name": "spaces",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"primary": {
+					"name": "primary",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdById": {
+					"name": "createdById",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"iconUrl": {
+					"name": "iconUrl",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"description": {
+					"name": "description",
+					"type": "varchar(1000)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"settings": {
+					"name": "settings",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"password": {
+					"name": "password",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"privacy": {
+					"name": "privacy",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'Private'"
+				},
+				"public": {
+					"name": "public",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				}
+			},
+			"indexes": {
+				"organization_id_idx": {
+					"name": "organization_id_idx",
+					"columns": ["organizationId"],
+					"isUnique": false
+				},
+				"created_by_id_idx": {
+					"name": "created_by_id_idx",
+					"columns": ["createdById"],
+					"isUnique": false
+				},
+				"public_organization_id_idx": {
+					"name": "public_organization_id_idx",
+					"columns": ["public", "organizationId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"spaces_id": {
+					"name": "spaces_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"storage_integrations": {
+			"name": "storage_integrations",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"organizationId": {
+					"name": "organizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"provider": {
+					"name": "provider",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"displayName": {
+					"name": "displayName",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"status": {
+					"name": "status",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'active'"
+				},
+				"active": {
+					"name": "active",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"encryptedConfig": {
+					"name": "encryptedConfig",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"googleDriveAccessToken": {
+					"name": "googleDriveAccessToken",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"googleDriveAccessTokenExpiresAt": {
+					"name": "googleDriveAccessTokenExpiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"googleDriveTokenRefreshLeaseId": {
+					"name": "googleDriveTokenRefreshLeaseId",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"googleDriveTokenRefreshLeaseExpiresAt": {
+					"name": "googleDriveTokenRefreshLeaseExpiresAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"googleDriveStorageQuotaCache": {
+					"name": "googleDriveStorageQuotaCache",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"owner_provider_idx": {
+					"name": "owner_provider_idx",
+					"columns": ["ownerId", "provider"],
+					"isUnique": false
+				},
+				"owner_active_idx": {
+					"name": "owner_active_idx",
+					"columns": ["ownerId", "active"],
+					"isUnique": false
+				},
+				"organization_provider_idx": {
+					"name": "organization_provider_idx",
+					"columns": ["organizationId", "provider"],
+					"isUnique": false
+				},
+				"organization_active_idx": {
+					"name": "organization_active_idx",
+					"columns": ["organizationId", "active", "status"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"storage_integrations_id": {
+					"name": "storage_integrations_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"storage_objects": {
+			"name": "storage_objects",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"integrationId": {
+					"name": "integrationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"objectKey": {
+					"name": "objectKey",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"objectKeyHash": {
+					"name": "objectKeyHash",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"providerObjectId": {
+					"name": "providerObjectId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"uploadSessionUrl": {
+					"name": "uploadSessionUrl",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"uploadStatus": {
+					"name": "uploadStatus",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'pending'"
+				},
+				"contentType": {
+					"name": "contentType",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"contentLength": {
+					"name": "contentLength",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {
+				"integration_key_hash_idx": {
+					"name": "integration_key_hash_idx",
+					"columns": ["integrationId", "objectKeyHash"],
+					"isUnique": true
+				},
+				"integration_status_idx": {
+					"name": "integration_status_idx",
+					"columns": ["integrationId", "uploadStatus"],
+					"isUnique": false
+				},
+				"integration_object_key_prefix_idx": {
+					"name": "integration_object_key_prefix_idx",
+					"columns": ["integrationId", "`objectKey`(191)"],
+					"isUnique": false
+				},
+				"video_id_idx": {
+					"name": "video_id_idx",
+					"columns": ["videoId"],
+					"isUnique": false
+				},
+				"owner_id_idx": {
+					"name": "owner_id_idx",
+					"columns": ["ownerId"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"storage_objects_integrationId_storage_integrations_id_fk": {
+					"name": "storage_objects_integrationId_storage_integrations_id_fk",
+					"tableFrom": "storage_objects",
+					"tableTo": "storage_integrations",
+					"columnsFrom": ["integrationId"],
+					"columnsTo": ["id"],
+					"onDelete": "restrict",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"storage_objects_id": {
+					"name": "storage_objects_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"users": {
+			"name": "users",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"lastName": {
+					"name": "lastName",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"email": {
+					"name": "email",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"emailVerified": {
+					"name": "emailVerified",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"image": {
+					"name": "image",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripeCustomerId": {
+					"name": "stripeCustomerId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripeSubscriptionId": {
+					"name": "stripeSubscriptionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"thirdPartyStripeSubscriptionId": {
+					"name": "thirdPartyStripeSubscriptionId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripeSubscriptionStatus": {
+					"name": "stripeSubscriptionStatus",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"stripeSubscriptionPriceId": {
+					"name": "stripeSubscriptionPriceId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"preferences": {
+					"name": "preferences",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false,
+					"default": "('null')"
+				},
+				"activeOrganizationId": {
+					"name": "activeOrganizationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"created_at": {
+					"name": "created_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updated_at": {
+					"name": "updated_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"onboardingSteps": {
+					"name": "onboardingSteps",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"onboarding_completed_at": {
+					"name": "onboarding_completed_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"customBucket": {
+					"name": "customBucket",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"inviteQuota": {
+					"name": "inviteQuota",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 1
+				},
+				"defaultOrgId": {
+					"name": "defaultOrgId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"authSessionVersion": {
+					"name": "authSessionVersion",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"marketingOrigin": {
+					"name": "marketingOrigin",
+					"type": "varchar(20)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'unknown'"
+				}
+			},
+			"indexes": {
+				"email_idx": {
+					"name": "email_idx",
+					"columns": ["email"],
+					"isUnique": true
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"users_id": {
+					"name": "users_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"verification_tokens": {
+			"name": "verification_tokens",
+			"columns": {
+				"identifier": {
+					"name": "identifier",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"token": {
+					"name": "token",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"expires": {
+					"name": "expires",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"created_at": {
+					"name": "created_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updated_at": {
+					"name": "updated_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"verification_tokens_identifier": {
+					"name": "verification_tokens_identifier",
+					"columns": ["identifier"]
+				}
+			},
+			"uniqueConstraints": {
+				"verification_tokens_token_unique": {
+					"name": "verification_tokens_token_unique",
+					"columns": ["token"]
+				}
+			},
+			"checkConstraint": {}
+		},
+		"video_edits": {
+			"name": "video_edits",
+			"columns": {
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"sourceKey": {
+					"name": "sourceKey",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"editSpec": {
+					"name": "editSpec",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				}
+			},
+			"indexes": {},
+			"foreignKeys": {
+				"video_edits_videoId_videos_id_fk": {
+					"name": "video_edits_videoId_videos_id_fk",
+					"tableFrom": "video_edits",
+					"tableTo": "videos",
+					"columnsFrom": ["videoId"],
+					"columnsTo": ["id"],
+					"onDelete": "cascade",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"video_edits_videoId": {
+					"name": "video_edits_videoId",
+					"columns": ["videoId"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"video_processing_jobs": {
+			"name": "video_processing_jobs",
+			"columns": {
+				"video_id": {
+					"name": "video_id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"owner_id": {
+					"name": "owner_id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"generation": {
+					"name": "generation",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"manifest_sha256": {
+					"name": "manifest_sha256",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"state": {
+					"name": "state",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'committing'"
+				},
+				"attempt_id": {
+					"name": "attempt_id",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"attempt_count": {
+					"name": "attempt_count",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"lease_expires_at": {
+					"name": "lease_expires_at",
+					"type": "datetime(3)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"next_retry_at": {
+					"name": "next_retry_at",
+					"type": "datetime(3)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"workflow_run_id": {
+					"name": "workflow_run_id",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"remote_job_id": {
+					"name": "remote_job_id",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"source": {
+					"name": "source",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"verification": {
+					"name": "verification",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"output": {
+					"name": "output",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"error_code": {
+					"name": "error_code",
+					"type": "varchar(64)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"error_message": {
+					"name": "error_message",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"created_at": {
+					"name": "created_at",
+					"type": "datetime(3)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"updated_at": {
+					"name": "updated_at",
+					"type": "datetime(3)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"processing_state_retry_video_idx": {
+					"name": "processing_state_retry_video_idx",
+					"columns": ["state", "next_retry_at", "video_id"],
+					"isUnique": false
+				},
+				"processing_state_lease_video_idx": {
+					"name": "processing_state_lease_video_idx",
+					"columns": ["state", "lease_expires_at", "video_id"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"video_processing_jobs_video_id": {
+					"name": "video_processing_jobs_video_id",
+					"columns": ["video_id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"video_uploads": {
+			"name": "video_uploads",
+			"columns": {
+				"video_id": {
+					"name": "video_id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"uploaded": {
+					"name": "uploaded",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"total": {
+					"name": "total",
+					"type": "bigint unsigned",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"started_at": {
+					"name": "started_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"updated_at": {
+					"name": "updated_at",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"mode": {
+					"name": "mode",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"phase": {
+					"name": "phase",
+					"type": "varchar(32)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'uploading'"
+				},
+				"processing_progress": {
+					"name": "processing_progress",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": 0
+				},
+				"processing_message": {
+					"name": "processing_message",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"processing_error": {
+					"name": "processing_error",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"raw_file_key": {
+					"name": "raw_file_key",
+					"type": "varchar(512)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"phase_updated_at_video_id_idx": {
+					"name": "phase_updated_at_video_id_idx",
+					"columns": ["phase", "updated_at", "video_id"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {},
+			"compositePrimaryKeys": {
+				"video_uploads_video_id": {
+					"name": "video_uploads_video_id",
+					"columns": ["video_id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"video_viewer_grants": {
+			"name": "video_viewer_grants",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"videoId": {
+					"name": "videoId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"email": {
+					"name": "email",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"invitedByUserId": {
+					"name": "invitedByUserId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"revokedAt": {
+					"name": "revokedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				}
+			},
+			"indexes": {
+				"video_email_idx": {
+					"name": "video_email_idx",
+					"columns": ["videoId", "email"],
+					"isUnique": true
+				}
+			},
+			"foreignKeys": {
+				"video_viewer_grants_videoId_videos_id_fk": {
+					"name": "video_viewer_grants_videoId_videos_id_fk",
+					"tableFrom": "video_viewer_grants",
+					"tableTo": "videos",
+					"columnsFrom": ["videoId"],
+					"columnsTo": ["id"],
+					"onDelete": "cascade",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"video_viewer_grants_id": {
+					"name": "video_viewer_grants_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		},
+		"videos": {
+			"name": "videos",
+			"columns": {
+				"id": {
+					"name": "id",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"ownerId": {
+					"name": "ownerId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"orgId": {
+					"name": "orgId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false
+				},
+				"name": {
+					"name": "name",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "'My Video'"
+				},
+				"bucket": {
+					"name": "bucket",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"storageIntegrationId": {
+					"name": "storageIntegrationId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"duration": {
+					"name": "duration",
+					"type": "float",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"width": {
+					"name": "width",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"height": {
+					"name": "height",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"fps": {
+					"name": "fps",
+					"type": "int",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"metadata": {
+					"name": "metadata",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"public": {
+					"name": "public",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": true
+				},
+				"settings": {
+					"name": "settings",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"transcriptionStatus": {
+					"name": "transcriptionStatus",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"source": {
+					"name": "source",
+					"type": "json",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "('{\"type\":\"MediaConvert\"}')"
+				},
+				"folderId": {
+					"name": "folderId",
+					"type": "varchar(15)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"createdAt": {
+					"name": "createdAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": "(now())"
+				},
+				"effectiveCreatedAt": {
+					"name": "effectiveCreatedAt",
+					"type": "datetime",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false,
+					"generated": {
+						"as": "COALESCE(\n          STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(`metadata`, '$.customCreatedAt')), '%Y-%m-%dT%H:%i:%s.%fZ'),\n          STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(`metadata`, '$.customCreatedAt')), '%Y-%m-%dT%H:%i:%sZ'),\n          `createdAt`\n        )",
+						"type": "stored"
+					}
+				},
+				"updatedAt": {
+					"name": "updatedAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"onUpdate": true,
+					"default": "(now())"
+				},
+				"password": {
+					"name": "password",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"xStreamInfo": {
+					"name": "xStreamInfo",
+					"type": "text",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"firstViewEmailSentAt": {
+					"name": "firstViewEmailSentAt",
+					"type": "timestamp",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"isScreenshot": {
+					"name": "isScreenshot",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				},
+				"awsRegion": {
+					"name": "awsRegion",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"awsBucket": {
+					"name": "awsBucket",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"videoStartTime": {
+					"name": "videoStartTime",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"audioStartTime": {
+					"name": "audioStartTime",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"jobId": {
+					"name": "jobId",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"jobStatus": {
+					"name": "jobStatus",
+					"type": "varchar(255)",
+					"primaryKey": false,
+					"notNull": false,
+					"autoincrement": false
+				},
+				"skipProcessing": {
+					"name": "skipProcessing",
+					"type": "boolean",
+					"primaryKey": false,
+					"notNull": true,
+					"autoincrement": false,
+					"default": false
+				}
+			},
+			"indexes": {
+				"owner_id_idx": {
+					"name": "owner_id_idx",
+					"columns": ["ownerId"],
+					"isUnique": false
+				},
+				"owner_updated_id_idx": {
+					"name": "owner_updated_id_idx",
+					"columns": ["ownerId", "updatedAt", "id"],
+					"isUnique": false
+				},
+				"is_public_idx": {
+					"name": "is_public_idx",
+					"columns": ["public"],
+					"isUnique": false
+				},
+				"folder_id_idx": {
+					"name": "folder_id_idx",
+					"columns": ["folderId"],
+					"isUnique": false
+				},
+				"storage_integration_id_idx": {
+					"name": "storage_integration_id_idx",
+					"columns": ["storageIntegrationId"],
+					"isUnique": false
+				},
+				"org_owner_folder_idx": {
+					"name": "org_owner_folder_idx",
+					"columns": ["orgId", "ownerId", "folderId"],
+					"isUnique": false
+				},
+				"org_effective_created_idx": {
+					"name": "org_effective_created_idx",
+					"columns": ["orgId", "effectiveCreatedAt"],
+					"isUnique": false
+				},
+				"screenshot_transcription_created_idx": {
+					"name": "screenshot_transcription_created_idx",
+					"columns": ["isScreenshot", "transcriptionStatus", "createdAt"],
+					"isUnique": false
+				}
+			},
+			"foreignKeys": {
+				"videos_storageIntegrationId_storage_integrations_id_fk": {
+					"name": "videos_storageIntegrationId_storage_integrations_id_fk",
+					"tableFrom": "videos",
+					"tableTo": "storage_integrations",
+					"columnsFrom": ["storageIntegrationId"],
+					"columnsTo": ["id"],
+					"onDelete": "restrict",
+					"onUpdate": "no action"
+				}
+			},
+			"compositePrimaryKeys": {
+				"videos_id": {
+					"name": "videos_id",
+					"columns": ["id"]
+				}
+			},
+			"uniqueConstraints": {},
+			"checkConstraint": {}
+		}
+	},
+	"views": {},
+	"_meta": {
+		"schemas": {},
+		"tables": {},
+		"columns": {}
+	},
+	"internal": {
+		"tables": {},
+		"indexes": {
+			"integration_object_key_prefix_idx": {
+				"columns": {
+					"`objectKey`(191)": {
+						"isExpression": true
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/packages/database/migrations/meta/_journal.json b/packages/database/migrations/meta/_journal.json
index d09298a78fb..49f18a82daa 100644
--- a/packages/database/migrations/meta/_journal.json
+++ b/packages/database/migrations/meta/_journal.json
@@ -351,6 +351,13 @@
 			"when": 1790203121737,
 			"tag": "0049_jittery_professor_monster",
 			"breakpoints": true
+		},
+		{
+			"idx": 50,
+			"version": "5",
+			"when": 1790359561932,
+			"tag": "0050_equal_mentallo",
+			"breakpoints": true
 		}
 	]
 }
diff --git a/packages/database/package.json b/packages/database/package.json
index ae6d39b6cd2..b066370af42 100644
--- a/packages/database/package.json
+++ b/packages/database/package.json
@@ -65,6 +65,7 @@
 		"./auth/sso-state": "./auth/sso-state.ts",
 		"./schema": "./schema.ts",
 		"./video-sharing-default": "./video-sharing-default.ts",
+		"./video-organization-access": "./video-organization-access.ts",
 		"./loops/*": "./loops/*.ts",
 		"./crypto": "./crypto.ts",
 		"./helpers": "./helpers.ts",
diff --git a/packages/database/schema.ts b/packages/database/schema.ts
index 8c19b1fd20f..71263cb56cf 100644
--- a/packages/database/schema.ts
+++ b/packages/database/schema.ts
@@ -228,6 +228,9 @@ export const organizations = mysqlTable(
 		defaultVideoVisibility: varchar("defaultVideoVisibility", {
 			length: 7,
 		}).$type<"private">(),
+		videoSharingRestrictedToOrg: boolean("videoSharingRestrictedToOrg")
+			.notNull()
+			.default(false),
 		customDomain: varchar("customDomain", { length: 255 }),
 		domainVerified: timestamp("domainVerified"),
 		settings: json("settings").$type<{
diff --git a/packages/database/video-organization-access.ts b/packages/database/video-organization-access.ts
new file mode 100644
index 00000000000..278f5da6b0d
--- /dev/null
+++ b/packages/database/video-organization-access.ts
@@ -0,0 +1,93 @@
+import type { User, Video } from "@cap/web-domain";
+import { eq, or, sql } from "drizzle-orm";
+import { db } from "./index.ts";
+import {
+	organizationMembers,
+	organizations,
+	sharedVideos,
+	spaceMembers,
+	spaceVideos,
+	videos,
+	videoViewerGrants,
+} from "./schema.ts";
+
+export const organizationVideoAccessCondition = (userId: User.UserId) =>
+	sql<boolean>`NOT EXISTS (
+		SELECT 1 FROM ${organizations}
+		WHERE ${organizations.id} = ${videos.orgId}
+		AND ${organizations.videoSharingRestrictedToOrg} = TRUE
+		AND (
+			${organizations.tombstoneAt} IS NOT NULL
+			OR (
+				${organizations.ownerId} <> ${userId}
+				AND NOT EXISTS (
+					SELECT 1 FROM ${organizationMembers}
+					WHERE ${organizationMembers.organizationId} = ${organizations.id}
+					AND ${organizationMembers.userId} = ${userId}
+				)
+			)
+		)
+	)`;
+
+export async function getVideoOrganizationAccess(
+	videoId: Video.VideoId,
+	userId: User.UserId,
+) {
+	const [video] = await db()
+		.select({
+			restricted: organizations.videoSharingRestrictedToOrg,
+			allowed: organizationVideoAccessCondition(userId).mapWith(Boolean),
+		})
+		.from(videos)
+		.innerJoin(organizations, eq(videos.orgId, organizations.id))
+		.where(eq(videos.id, videoId))
+		.limit(1);
+	return video;
+}
+
+export const videoEmailAccessCondition = (user?: {
+	id: User.UserId;
+	email: string;
+}) => {
+	const unrestricted = sql<boolean>`REGEXP_LIKE(COALESCE(${organizations.allowedEmailDomain}, ''), '^[[:space:]]*$')`;
+	if (!user) return unrestricted;
+
+	const email = user.email.toLowerCase();
+	const domain = email.slice(email.lastIndexOf("@") + 1);
+	const escape = (value: string) =>
+		value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const alternatives = [email, domain]
+		.filter(
+			(entry) =>
+				entry.length > 0 && entry === entry.trim() && !entry.includes(","),
+		)
+		.map(escape)
+		.join("|");
+	const pattern = `(^|,)[[:space:]]*(${alternatives})[[:space:]]*(,|$)`;
+
+	return or(
+		unrestricted,
+		sql`REGEXP_LIKE(COALESCE(${organizations.allowedEmailDomain}, ''), '^[[:space:],]*$')`,
+		email.includes("@") && alternatives.length > 0
+			? sql`REGEXP_LIKE(LOWER(${organizations.allowedEmailDomain}), ${pattern}, 'c')`
+			: sql`FALSE`,
+		eq(videos.ownerId, user.id),
+		sql`EXISTS (
+			SELECT 1 FROM ${sharedVideos} email_shared
+			INNER JOIN ${organizationMembers} email_members
+				ON email_shared.organizationId = email_members.organizationId
+			WHERE email_shared.videoId = ${videos.id} AND email_members.userId = ${user.id}
+		)`,
+		sql`EXISTS (
+			SELECT 1 FROM ${spaceVideos} email_space
+			INNER JOIN ${spaceMembers} email_space_members
+				ON email_space.spaceId = email_space_members.spaceId
+			WHERE email_space.videoId = ${videos.id} AND email_space_members.userId = ${user.id}
+		)`,
+		sql`EXISTS (
+			SELECT 1 FROM ${videoViewerGrants} email_grants
+			WHERE email_grants.videoId = ${videos.id}
+				AND email_grants.email = ${email.trim()} AND email_grants.revokedAt IS NULL
+		)`,
+	);
+};
diff --git a/packages/web-backend/src/Organisations/OrganisationsRepo.ts b/packages/web-backend/src/Organisations/OrganisationsRepo.ts
index 19db188436f..96fefc96bec 100644
--- a/packages/web-backend/src/Organisations/OrganisationsRepo.ts
+++ b/packages/web-backend/src/Organisations/OrganisationsRepo.ts
@@ -75,25 +75,21 @@ export class OrganisationsRepo extends Effect.Service<OrganisationsRepo>()(
 								})),
 							),
 						),
-				allowedEmailDomain: (orgId: Organisation.OrganisationId) =>
+				videoSharingSettings: (orgId: Organisation.OrganisationId) =>
 					db
 						.use((db) =>
 							db
 								.select({
 									allowedEmailDomain: Db.organizations.allowedEmailDomain,
+									videoSharingRestrictedToOrg:
+										Db.organizations.videoSharingRestrictedToOrg,
+									tombstoneAt: Db.organizations.tombstoneAt,
 								})
 								.from(Db.organizations)
 								.where(Dz.eq(Db.organizations.id, orgId))
 								.limit(1),
 						)
-						.pipe(
-							Effect.map(Array.get(0)),
-							Effect.map(
-								Option.flatMap((row) =>
-									Option.fromNullable(row.allowedEmailDomain?.trim() || null),
-								),
-							),
-						),
+						.pipe(Effect.map(Array.get(0))),
 			};
 		}),
 		dependencies: [Database.Default],
diff --git a/packages/web-backend/src/Videos/VideosPolicy.ts b/packages/web-backend/src/Videos/VideosPolicy.ts
index 95df93ec27b..e73f43d709e 100644
--- a/packages/web-backend/src/Videos/VideosPolicy.ts
+++ b/packages/web-backend/src/Videos/VideosPolicy.ts
@@ -37,9 +37,21 @@ export type VideosPolicyDeps = {
 			userId: User.UserId,
 			videoId: Video.VideoId,
 		) => Effect.Effect<readonly { membershipId: string }[], DatabaseError>;
-		allowedEmailDomain: (
+		videoSharingSettings: (orgId: Organisation.OrganisationId) => Effect.Effect<
+			Option.Option<{
+				allowedEmailDomain: string | null;
+				videoSharingRestrictedToOrg: boolean;
+				tombstoneAt: Date | null;
+			}>,
+			DatabaseError
+		>;
+		membership: (
+			userId: User.UserId,
 			orgId: Organisation.OrganisationId,
-		) => Effect.Effect<Option.Option<string>, DatabaseError>;
+		) => Effect.Effect<
+			Option.Option<{ membershipId: string | null }>,
+			DatabaseError
+		>;
 	};
 	spacesRepo: {
 		membershipForVideo: (
@@ -64,6 +76,28 @@ const decideCanView = (
 	password: Option.Option<string>,
 ) =>
 	Effect.gen(function* () {
+		const organization = yield* orgsRepo.videoSharingSettings(video.orgId);
+		if (Option.isSome(organization)) {
+			if (organization.value.tombstoneAt) return false;
+			if (organization.value.videoSharingRestrictedToOrg) {
+				if (Option.isNone(user)) {
+					return yield* new Policy.PolicyDeniedError({
+						reason: "organization_only_login_required",
+					});
+				}
+				const membership = yield* orgsRepo.membership(
+					user.value.id,
+					video.orgId,
+				);
+				if (Option.isNone(membership)) {
+					return yield* new Policy.PolicyDeniedError({
+						reason: "organization_only_denied",
+					});
+				}
+				return true;
+			}
+		}
+
 		if (Option.isSome(user)) {
 			const userId = user.value.id;
 			if (userId === video.ownerId) return true;
@@ -114,9 +148,8 @@ const decideCanView = (
 			return true;
 		}
 
-		const allowedEmails = yield* orgsRepo.allowedEmailDomain(video.orgId);
-		const restriction = Option.isSome(allowedEmails)
-			? allowedEmails.value.trim()
+		const restriction = Option.isSome(organization)
+			? (organization.value.allowedEmailDomain?.trim() ?? "")
 			: "";
 
 		if (restriction.length > 0) {
diff --git a/scripts/org-video-lock-demo/README.md b/scripts/org-video-lock-demo/README.md
new file mode 100644
index 00000000000..20dd50a8a8b
--- /dev/null
+++ b/scripts/org-video-lock-demo/README.md
@@ -0,0 +1,20 @@
+# Organization-only sharing walkthrough
+
+The recipe uses an isolated development database, synthetic accounts, and a local read-only media fixture. The fixture server serves generated demonstration media only. No production storage, email, billing, or processing services are configured.
+
+Acceptance criteria:
+
+- Owners and admins can enable organization-only access from organization preferences; members cannot change it.
+- An existing public recording becomes inaccessible to signed-out viewers.
+- An existing private recording becomes inaccessible to an invited outsider.
+- Organization members can view and play existing private recordings.
+- Recordings created through the recording API while the lock is enabled are also organization-only.
+- Playback, thumbnails, animated previews, public collections, and rich-link metadata do not expose locked recordings to outsiders.
+- Public and private settings are preserved and restored when the lock is disabled.
+- Individual sharing controls explain the enforced organization policy.
+
+The browser walkthrough asserts the main flow and playback. Focused policy tests also cover passwords, external organization and space memberships, former owners, role restrictions, and invalid action inputs. The seed verifies the SQL access predicate against the isolated database.
+
+If the prepared Linux environment cannot start, `native-recipe.json` describes a macOS capture using the installed Cap CLI. Run its setup and readiness steps through the session wrapper and its server through `serve`. Run `native-capture.mjs` with the session's private artifact directory through the native wrapper. It records only a new Chrome window containing synthetic accounts, saves a Cap project and MP4, and retains an assertion receipt. It does not capture the desktop, microphone, or other windows. Review and bind the native recipe, source commit, environment, and recorder before capture, then verify the export and uploaded playback before accepting the result.
+
+Apply the generated additive organization column before deploying application code. Existing organizations default to unrestricted sharing. Downloaded copies and already-issued temporary media URLs cannot be recalled.
diff --git a/scripts/org-video-lock-demo/native-capture.mjs b/scripts/org-video-lock-demo/native-capture.mjs
new file mode 100644
index 00000000000..13a34e48222
--- /dev/null
+++ b/scripts/org-video-lock-demo/native-capture.mjs
@@ -0,0 +1,284 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import { promisify } from "node:util";
+import { expect } from "@playwright/test";
+import { chromium } from "playwright";
+import { directory, ids, origin } from "./paths.mjs";
+
+const execFile = promisify(execFileCallback);
+const outputDirectory = process.argv[2];
+if (
+	process.platform !== "darwin" ||
+	!outputDirectory ||
+	!isAbsolute(outputDirectory)
+) {
+	throw new Error("Supply an absolute artifact directory on macOS");
+}
+await mkdir(outputDirectory, { recursive: true });
+const captureDirectory = join(outputDirectory, `native-${Date.now()}`);
+await mkdir(captureDirectory);
+const project = join(captureDirectory, "organization-access.cap");
+const file = join(captureDirectory, "organization-access.mp4");
+const cap = async (args, timeout = 60_000) =>
+	execFile("cap", [...args, "--json"], {
+		timeout,
+		maxBuffer: 16 * 1024 * 1024,
+	});
+const capJson = async (args) => JSON.parse((await cap(args)).stdout);
+const states = JSON.parse(
+	await readFile(join(directory, "browser-states.json"), "utf8"),
+);
+const sha = (await execFile("git", ["rev-parse", "HEAD"])).stdout.trim();
+const recorder = await capJson(["version"]);
+const browser = await chromium.launch({
+	headless: false,
+	channel: "chrome",
+	args: ["--window-size=1440,810", "--window-position=36,70"],
+});
+const context = await browser.newContext({ viewport: null });
+const page = await context.newPage();
+page.setDefaultTimeout(20_000);
+const visit = async (role, path) => {
+	await context.clearCookies();
+	if (role !== "anonymous") await context.addCookies(states[role].cookies);
+	await page.goto(`${origin}${path}`, { waitUntil: "domcontentloaded" });
+	await page.bringToFront();
+};
+const pause = () => page.waitForTimeout(3_000);
+const lock = page.getByRole("switch", {
+	name: "Only members of this organization",
+});
+const receipt = { sha, recorder, project, file, passed: false, steps: [] };
+const saveReceipt = () =>
+	writeFile(
+		join(captureDirectory, "capture.json"),
+		JSON.stringify(receipt, null, "\t"),
+	);
+let recordingId;
+let stopped = false;
+
+try {
+	await visit("anonymous", `/s/${ids.publicVideo}`);
+	await expect(
+		page.getByRole("heading", {
+			name: "Existing project walkthrough",
+			exact: true,
+		}),
+	).toBeVisible();
+	const marker = `Organization access demo ${Date.now()}`;
+	await page.evaluate((title) => {
+		document.title = title;
+	}, marker);
+	let target;
+	await expect
+		.poll(async () => {
+			const windows = await capJson(["targets", "windows"]);
+			const matches = windows.filter(
+				(window) =>
+					window.ownerName === "Google Chrome" && window.name.includes(marker),
+			);
+			target = matches.length === 1 ? matches[0] : undefined;
+			return Boolean(target);
+		})
+		.toBe(true);
+	if (!target) throw new Error("Dedicated browser window was not found");
+	receipt.windowId = target.id;
+	receipt.windowBounds = target.bounds;
+	const started = await capJson([
+		"record",
+		"start",
+		"--window",
+		target.id,
+		"--detach",
+		"--fps",
+		"30",
+		"--path",
+		project,
+	]);
+	if (!started.recordingId)
+		throw new Error("Cap did not return a recording ID");
+	recordingId = started.recordingId;
+	receipt.recordingId = recordingId;
+	await saveReceipt();
+	console.log("Recording the dedicated synthetic browser window");
+	await pause();
+	receipt.steps.push("existing public recording visible");
+	await visit("owner", "/dashboard/settings/organization/preferences");
+	await expect(lock).not.toBeChecked();
+	await lock.scrollIntoViewIfNeeded();
+	await pause();
+	await lock.click();
+	await expect(
+		page.getByText("All recordings are now organization-only", { exact: true }),
+	).toBeVisible();
+	await expect(lock).toBeChecked();
+	await pause();
+	receipt.steps.push("owner enables organization-only access");
+	await visit("anonymous", `/s/${ids.publicVideo}`);
+	await expect(
+		page.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await expect(page.locator("video")).toHaveCount(0);
+	await pause();
+	receipt.steps.push("existing public link denied to signed-out viewer");
+	await visit("outsider", `/s/${ids.privateVideo}`);
+	await expect(
+		page.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await pause();
+	receipt.steps.push("previously invited guest denied");
+	await visit("member", `/s/${ids.privateVideo}`);
+	await expect(
+		page.getByRole("heading", { name: "Private team update", exact: true }),
+	).toBeVisible();
+	const video = page.locator("video").first();
+	await expect(video).toBeVisible();
+	await video.evaluate(async (element) => {
+		element.muted = true;
+		await element.play();
+	});
+	await expect
+		.poll(() => video.evaluate((element) => element.currentTime))
+		.toBeGreaterThan(1);
+	await pause();
+	receipt.steps.push("organization member plays an existing private recording");
+	await visit("owner", `/s/${ids.publicVideo}`);
+	await expect(async () => {
+		await page
+			.getByRole("button", {
+				name: "Sharing: Organization only. Click to manage access.",
+			})
+			.click();
+		await expect(
+			page.getByRole("button", { name: "Copy link for organization members" }),
+		).toBeVisible({ timeout: 2_000 });
+	}).toPass({ timeout: 20_000 });
+	await expect(page.getByRole("switch")).toHaveCount(0);
+	await pause();
+	receipt.steps.push(
+		"per-recording sharing controls explain the enforced policy",
+	);
+	const response = await context.request.get(
+		`${origin}/api/desktop/video/create?recordingMode=desktopMP4&name=New%20organization%20recording&durationInSecs=12&width=1280&height=720`,
+		{
+			headers: { Authorization: `Bearer ${states.desktopToken}` },
+		},
+	);
+	expect(response.status()).toBe(200);
+	const created = await response.json();
+	await visit("anonymous", `/s/${created.id}`);
+	await expect(
+		page.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await pause();
+	await visit("member", `/s/${created.id}`);
+	await expect(
+		page.getByRole("heading", {
+			name: "New organization recording",
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause();
+	receipt.steps.push(
+		"new recording denies outsiders and allows organization members",
+	);
+	await visit("owner", "/dashboard/settings/organization/preferences");
+	await lock.scrollIntoViewIfNeeded();
+	await lock.click();
+	await expect(
+		page.getByText("Individual sharing settings restored", { exact: true }),
+	).toBeVisible();
+	await pause();
+	await visit("anonymous", `/s/${ids.publicVideo}`);
+	await expect(
+		page.getByRole("heading", {
+			name: "Existing project walkthrough",
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause();
+	receipt.steps.push("disabling the rule restores the saved public setting");
+	await visit("owner", "/dashboard/settings/organization/preferences");
+	await lock.scrollIntoViewIfNeeded();
+	await lock.click();
+	await expect(
+		page.getByText("All recordings are now organization-only", { exact: true }),
+	).toBeVisible();
+	await pause();
+	await page.screenshot({ path: join(captureDirectory, "settings.png") });
+	const result = await capJson(["record", "stop", "--id", recordingId]);
+	stopped = true;
+	if (result.recordingMetaExists !== true)
+		throw new Error("Cap recording did not finalize");
+	receipt.recordingMetaExists = true;
+	const validation = await capJson(["project", "validate", project]);
+	if (validation.valid === false)
+		throw new Error("Cap project validation failed");
+	receipt.validation = validation;
+	console.log("Walkthrough assertions passed; exporting with Cap");
+	const exported = await cap(
+		[
+			"export",
+			project,
+			"--output",
+			file,
+			"--resolution",
+			"1920x1080",
+			"--fps",
+			"30",
+			"--quality",
+			"web",
+		],
+		600_000,
+	);
+	await writeFile(join(captureDirectory, "export.log"), exported.stdout);
+	const probe = JSON.parse(
+		(
+			await execFile("ffprobe", [
+				"-v",
+				"error",
+				"-show_streams",
+				"-show_format",
+				"-of",
+				"json",
+				file,
+			])
+		).stdout,
+	);
+	const stream = probe.streams.find((item) => item.codec_type === "video");
+	if (!stream || Number(probe.format.duration) <= 0)
+		throw new Error("Export has no playable video");
+	receipt.width = stream.width;
+	receipt.height = stream.height;
+	receipt.duration = Number(probe.format.duration);
+	receipt.fileHash = createHash("sha256")
+		.update(await readFile(file))
+		.digest("hex");
+	receipt.passed = true;
+	receipt.observedAt = new Date().toISOString();
+	await saveReceipt();
+	console.log(
+		JSON.stringify({
+			passed: true,
+			sha,
+			file,
+			width: receipt.width,
+			height: receipt.height,
+			duration: receipt.duration,
+		}),
+	);
+} catch (error) {
+	receipt.error = String(error.message);
+	await page
+		.screenshot({ path: join(captureDirectory, "failed.png") })
+		.catch(() => {});
+	await saveReceipt();
+	throw error;
+} finally {
+	if (recordingId && !stopped) {
+		await capJson(["record", "stop", "--id", recordingId]).catch(() => {});
+	}
+	await browser.close();
+}
diff --git a/scripts/org-video-lock-demo/native-recipe.json b/scripts/org-video-lock-demo/native-recipe.json
new file mode 100644
index 00000000000..633567db4ce
--- /dev/null
+++ b/scripts/org-video-lock-demo/native-recipe.json
@@ -0,0 +1,13 @@
+{
+	"version": 1,
+	"platform": "macos",
+	"recorder": "installed Cap CLI",
+	"captureTarget": "dedicated synthetic Chrome window",
+	"setup": [
+		"node scripts/org-video-lock-demo/prepare.mjs",
+		"bun scripts/org-video-lock-demo/seed.ts"
+	],
+	"start": "node scripts/org-video-lock-demo/start.mjs",
+	"ready": "node scripts/org-video-lock-demo/ready.mjs",
+	"capture": "node scripts/org-video-lock-demo/native-capture.mjs <absolute-artifact-directory>"
+}
diff --git a/scripts/org-video-lock-demo/paths.mjs b/scripts/org-video-lock-demo/paths.mjs
new file mode 100644
index 00000000000..a8f3b20662c
--- /dev/null
+++ b/scripts/org-video-lock-demo/paths.mjs
@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const session = process.env.CAP_BUILDING_SESSION;
+if (!session?.startsWith("org-video-lock-")) {
+	throw new Error("This walkthrough requires its isolated building session");
+}
+
+const id = (name) =>
+	createHash("sha256").update(`${session}:${name}`).digest("hex").slice(0, 15);
+
+export const ids = {
+	owner: id("user"),
+	organization: id("organization"),
+	member: id("demo-member"),
+	outsider: id("demo-outsider"),
+	outsideOrganization: id("demo-outside-org"),
+	publicVideo: id("demo-public-video"),
+	privateVideo: id("demo-private-video"),
+	publicSpace: id("demo-public-space"),
+	protectedSpace: id("demo-protected-space"),
+	domainOrganization: id("demo-domain-organization"),
+	domainMembership: id("demo-domain-membership"),
+	domainSpace: id("demo-domain-space"),
+	externalVideo: id("demo-external-video"),
+	externalPrivateVideo: id("demo-external-private-video"),
+	externalPasswordVideo: id("demo-external-password-video"),
+	emailOrganization: id("demo-email-organization"),
+	emailRestrictedVideo: id("demo-email-restricted-video"),
+	emailGrantedVideo: id("demo-email-granted-video"),
+};
+export const directory = join(tmpdir(), `cap-${session}`);
+export const origin = `http://127.0.0.1:${process.env.PORT}`;
diff --git a/scripts/org-video-lock-demo/prepare.mjs b/scripts/org-video-lock-demo/prepare.mjs
new file mode 100644
index 00000000000..02a0c116b84
--- /dev/null
+++ b/scripts/org-video-lock-demo/prepare.mjs
@@ -0,0 +1,39 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import sharp from "sharp";
+import { directory } from "./paths.mjs";
+
+mkdirSync(directory, { recursive: true, mode: 0o700 });
+await sharp(
+	Buffer.from(
+		'<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="720"><rect width="1280" height="720" fill="#1e3a8a"/><rect x="100" y="180" width="1080" height="360" rx="32" fill="#2563eb"/><text x="640" y="345" text-anchor="middle" font-family="sans-serif" font-size="52" fill="white">Team project walkthrough</text><text x="640" y="410" text-anchor="middle" font-family="sans-serif" font-size="28" fill="#bfdbfe">Example Studio - Synthetic demonstration</text></svg>',
+	),
+)
+	.jpeg()
+	.toFile(join(directory, "screenshot.jpg"));
+const result = spawnSync(
+	"ffmpeg",
+	[
+		"-loglevel",
+		"error",
+		"-y",
+		"-loop",
+		"1",
+		"-i",
+		join(directory, "screenshot.jpg"),
+		"-t",
+		"12",
+		"-r",
+		"24",
+		"-c:v",
+		"libx264",
+		"-pix_fmt",
+		"yuv420p",
+		"-movflags",
+		"+faststart",
+		join(directory, "demo.mp4"),
+	],
+	{ stdio: "inherit" },
+);
+if (result.status !== 0) throw new Error("Could not prepare synthetic media");
diff --git a/scripts/org-video-lock-demo/ready.mjs b/scripts/org-video-lock-demo/ready.mjs
new file mode 100644
index 00000000000..a45b6dcd1bb
--- /dev/null
+++ b/scripts/org-video-lock-demo/ready.mjs
@@ -0,0 +1,54 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { setTimeout } from "node:timers/promises";
+import { chromium } from "playwright";
+import { directory, ids, origin } from "./paths.mjs";
+
+const deadline = Date.now() + 150_000;
+while (true) {
+	try {
+		await readFile(join(directory, "browser-states.json"));
+		const response = await fetch(`${origin}/login`, {
+			signal: AbortSignal.timeout(5_000),
+		});
+		if (response.ok) break;
+	} catch {}
+	if (Date.now() > deadline)
+		throw new Error("Demo server did not become ready");
+	await setTimeout(1_000);
+}
+const states = JSON.parse(
+	await readFile(join(directory, "browser-states.json"), "utf8"),
+);
+const browser = await chromium.launch({
+	headless: true,
+	...(process.platform === "darwin" ? { channel: "chrome" } : {}),
+});
+try {
+	const context = await browser.newContext({ storageState: states.owner });
+	const page = await context.newPage();
+	for (const path of [
+		"/dashboard/settings/organization/preferences",
+		`/c/${ids.publicSpace}`,
+		`/s/${ids.publicVideo}`,
+		`/s/${ids.privateVideo}`,
+		`/embed/${ids.publicVideo}`,
+	]) {
+		await page.goto(`${origin}${path}`, {
+			waitUntil: "domcontentloaded",
+			timeout: 120_000,
+		});
+	}
+	for (const path of [
+		"/api/desktop/video/new-id",
+		`/api/playlist?videoId=${ids.publicVideo}&videoType=mp4`,
+		`/api/thumbnail?videoId=${ids.publicVideo}`,
+		`/api/video/preview?videoId=${ids.publicVideo}`,
+		`/api/oembed?url=${encodeURIComponent(`https://cap.so/s/${ids.publicVideo}`)}`,
+	]) {
+		await context.request.get(`${origin}${path}`, { maxRedirects: 0 });
+	}
+} finally {
+	await browser.close();
+}
+console.log("Demo routes warmed");
diff --git a/scripts/org-video-lock-demo/recipe.json b/scripts/org-video-lock-demo/recipe.json
new file mode 100644
index 00000000000..8e43550ab15
--- /dev/null
+++ b/scripts/org-video-lock-demo/recipe.json
@@ -0,0 +1,14 @@
+{
+	"version": 1,
+	"platform": "linux",
+	"snapshot": "cap-building-linux-v1",
+	"setup": [
+		"cap doctor --json",
+		"bun install --frozen-lockfile",
+		"bun x playwright install chromium",
+		"node scripts/org-video-lock-demo/prepare.mjs"
+	],
+	"start": "bun scripts/org-video-lock-demo/seed.ts && node scripts/org-video-lock-demo/start.mjs",
+	"ready": "node scripts/org-video-lock-demo/ready.mjs",
+	"walkthrough": "node scripts/org-video-lock-demo/walkthrough.mjs"
+}
diff --git a/scripts/org-video-lock-demo/seed.ts b/scripts/org-video-lock-demo/seed.ts
new file mode 100644
index 00000000000..69b5cbb8f7e
--- /dev/null
+++ b/scripts/org-video-lock-demo/seed.ts
@@ -0,0 +1,390 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { db } from "@cap/database";
+import {
+	authApiKeys,
+	organizationMembers,
+	organizations,
+	sharedVideos,
+	spaces,
+	spaceVideos,
+	users,
+	videos,
+	videoViewerGrants,
+} from "@cap/database/schema";
+import {
+	getVideoOrganizationAccess,
+	videoEmailAccessCondition,
+} from "@cap/database/video-organization-access";
+import { isEmailAllowedByRestriction } from "@cap/utils";
+import { Organisation, Space, User, Video } from "@cap/web-domain";
+import { eq } from "drizzle-orm";
+import { encode } from "next-auth/jwt";
+import { directory, ids } from "./paths.mjs";
+
+const organizationId = Organisation.OrganisationId.make(ids.organization);
+const ownerId = User.UserId.make(ids.owner);
+const memberId = User.UserId.make(ids.member);
+const outsiderId = User.UserId.make(ids.outsider);
+const outsideOrganizationId = Organisation.OrganisationId.make(
+	ids.outsideOrganization,
+);
+const database = db();
+
+await database
+	.update(organizations)
+	.set({ name: "Example Studio", videoSharingRestrictedToOrg: false })
+	.where(eq(organizations.id, organizationId));
+await database
+	.update(users)
+	.set({ name: "Example Owner" })
+	.where(eq(users.id, ownerId));
+for (const [id, name, email, activeOrganizationId] of [
+	[memberId, "Example Member", "member@example.invalid", organizationId],
+	[outsiderId, "Example Guest", "guest@example.invalid", outsideOrganizationId],
+] as const) {
+	await database
+		.insert(users)
+		.values({
+			id,
+			name,
+			email,
+			emailVerified: new Date(),
+			activeOrganizationId,
+			defaultOrgId: activeOrganizationId,
+			onboarding_completed_at: new Date(),
+			stripeSubscriptionStatus: "active",
+		})
+		.onDuplicateKeyUpdate({ set: { activeOrganizationId } });
+}
+await database
+	.insert(organizations)
+	.values({
+		id: outsideOrganizationId,
+		name: "Guest Organization",
+		ownerId: outsiderId,
+	})
+	.onDuplicateKeyUpdate({ set: { name: "Guest Organization" } });
+await database
+	.insert(organizationMembers)
+	.values({ id: ids.member, userId: memberId, organizationId, role: "member" })
+	.onDuplicateKeyUpdate({ set: { role: "member" } });
+for (const [id, name, isPublic] of [
+	[ids.publicVideo, "Existing project walkthrough", true],
+	[ids.privateVideo, "Private team update", false],
+] as const) {
+	const videoId = Video.VideoId.make(id);
+	await database
+		.insert(videos)
+		.values({
+			id: videoId,
+			ownerId,
+			orgId: organizationId,
+			name,
+			public: isPublic,
+			source: { type: "desktopMP4" },
+			duration: 12,
+			width: 1280,
+			height: 720,
+			createdAt: new Date("2024-01-01T00:00:00Z"),
+			transcriptionStatus: "COMPLETE",
+			settings: {
+				disableSummary: true,
+				disableChapters: true,
+				disableTranscript: true,
+				disableCaptions: true,
+			},
+		})
+		.onDuplicateKeyUpdate({ set: { name, public: isPublic } });
+}
+await database
+	.insert(videoViewerGrants)
+	.values({
+		id: ids.privateVideo,
+		videoId: Video.VideoId.make(ids.privateVideo),
+		email: "guest@example.invalid",
+		invitedByUserId: ownerId,
+	})
+	.onDuplicateKeyUpdate({ set: { revokedAt: null } });
+await database
+	.insert(sharedVideos)
+	.values({
+		id: ids.publicVideo,
+		videoId: Video.VideoId.make(ids.publicVideo),
+		organizationId: outsideOrganizationId,
+		sharedByUserId: ownerId,
+	})
+	.onDuplicateKeyUpdate({ set: { organizationId: outsideOrganizationId } });
+const spaceId = Space.SpaceId.make(ids.publicSpace);
+await database
+	.insert(spaces)
+	.values({
+		id: spaceId,
+		organizationId: outsideOrganizationId,
+		createdById: outsiderId,
+		name: "Public project library",
+		public: true,
+	})
+	.onDuplicateKeyUpdate({ set: { public: true } });
+await database
+	.insert(spaceVideos)
+	.values({
+		id: ids.publicSpace,
+		spaceId,
+		videoId: Video.VideoId.make(ids.publicVideo),
+		addedById: ownerId,
+	})
+	.onDuplicateKeyUpdate({ set: { spaceId } });
+
+const protectedSpaceId = Space.SpaceId.make(ids.protectedSpace);
+await database
+	.insert(spaces)
+	.values({
+		id: protectedSpaceId,
+		organizationId,
+		createdById: ownerId,
+		name: "Protected team library",
+		public: true,
+		privacy: "Public",
+		password: "synthetic-unverified-space-password",
+	})
+	.onDuplicateKeyUpdate({ set: { public: true, privacy: "Public" } });
+await database
+	.insert(spaceVideos)
+	.values({
+		id: ids.protectedSpace,
+		spaceId: protectedSpaceId,
+		videoId: Video.VideoId.make(ids.privateVideo),
+		addedById: ownerId,
+	})
+	.onDuplicateKeyUpdate({ set: { spaceId: protectedSpaceId } });
+
+const domainOrganizationId = Organisation.OrganisationId.make(
+	ids.domainOrganization,
+);
+const domainSpaceId = Space.SpaceId.make(ids.domainSpace);
+await database
+	.insert(organizations)
+	.values({
+		id: domainOrganizationId,
+		name: "Restricted project library",
+		ownerId,
+		allowedEmailDomain: "different.example.invalid",
+		videoSharingRestrictedToOrg: true,
+	})
+	.onDuplicateKeyUpdate({ set: { videoSharingRestrictedToOrg: true } });
+await database
+	.insert(organizationMembers)
+	.values({
+		id: ids.domainMembership,
+		organizationId: domainOrganizationId,
+		userId: memberId,
+		role: "member",
+	})
+	.onDuplicateKeyUpdate({ set: { role: "member" } });
+await database
+	.insert(spaces)
+	.values({
+		id: domainSpaceId,
+		organizationId: domainOrganizationId,
+		createdById: ownerId,
+		name: "Shared project library",
+		public: true,
+		privacy: "Public",
+	})
+	.onDuplicateKeyUpdate({ set: { public: true } });
+for (const [id, name, isPublic, password] of [
+	[ids.externalVideo, "Shared public project update", true, null],
+	[ids.externalPrivateVideo, "Private external project update", false, null],
+	[
+		ids.externalPasswordVideo,
+		"Password-protected external update",
+		true,
+		"synthetic-external-password",
+	],
+] as const) {
+	await database
+		.insert(videos)
+		.values({
+			id: Video.VideoId.make(id),
+			ownerId: outsiderId,
+			orgId: outsideOrganizationId,
+			name,
+			public: isPublic,
+			password,
+			source: { type: "desktopMP4" },
+			duration: 12,
+		})
+		.onDuplicateKeyUpdate({ set: { public: isPublic, password } });
+	await database
+		.insert(spaceVideos)
+		.values({
+			id,
+			spaceId: domainSpaceId,
+			videoId: Video.VideoId.make(id),
+			addedById: ownerId,
+		})
+		.onDuplicateKeyUpdate({ set: { spaceId: domainSpaceId } });
+}
+
+for (const [email, restriction] of [
+	["member@example.invalid", "example.invalid"],
+	["member@example.invalid", "different.example.invalid"],
+	[
+		"MEMBER@EXAMPLE.INVALID",
+		"  other.example.invalid , Member@Example.Invalid  ",
+	],
+	["member+tag@example.invalid", "member+tag@example.invalid"],
+	["memberXtag@example.invalid", "member+tag@example.invalid"],
+	["member@exampleXinvalid", "example.invalid"],
+	["member@éxample.invalid", "example.invalid"],
+	["member@straße.invalid", "strasse.invalid"],
+	["member,team@example.invalid", "member,team@example.invalid"],
+	["member,team@example.invalid", "example.invalid"],
+	["member@", ",example.invalid"],
+	[" member@example.invalid", " member@example.invalid"],
+	["member@example.invalid", " ,  , "],
+	["member@example.invalid", ""],
+] as const) {
+	await database
+		.update(organizations)
+		.set({ allowedEmailDomain: restriction })
+		.where(eq(organizations.id, outsideOrganizationId));
+	const [result] = await database
+		.select({
+			allowed: videoEmailAccessCondition({ id: memberId, email })?.mapWith(
+				Boolean,
+			),
+		})
+		.from(videos)
+		.innerJoin(organizations, eq(videos.orgId, organizations.id))
+		.where(eq(videos.id, Video.VideoId.make(ids.externalVideo)));
+	if (result?.allowed !== isEmailAllowedByRestriction(email, restriction))
+		throw new Error("Email restriction SQL parity assertion failed");
+}
+await database
+	.update(organizations)
+	.set({ allowedEmailDomain: null })
+	.where(eq(organizations.id, outsideOrganizationId));
+const emailOrganizationId = Organisation.OrganisationId.make(
+	ids.emailOrganization,
+);
+await database
+	.insert(organizations)
+	.values({
+		id: emailOrganizationId,
+		name: "External restricted studio",
+		ownerId: outsiderId,
+		allowedEmailDomain: "trusted.example.invalid",
+	})
+	.onDuplicateKeyUpdate({
+		set: { allowedEmailDomain: "trusted.example.invalid" },
+	});
+for (const [id, name] of [
+	[ids.emailRestrictedVideo, "Email-restricted external update"],
+	[ids.emailGrantedVideo, "Invited external update"],
+] as const) {
+	await database
+		.insert(videos)
+		.values({
+			id: Video.VideoId.make(id),
+			ownerId: outsiderId,
+			orgId: emailOrganizationId,
+			name,
+			public: true,
+			source: { type: "desktopMP4" },
+			duration: 12,
+		})
+		.onDuplicateKeyUpdate({ set: { public: true } });
+	await database
+		.insert(spaceVideos)
+		.values({
+			id,
+			spaceId: domainSpaceId,
+			videoId: Video.VideoId.make(id),
+			addedById: ownerId,
+		})
+		.onDuplicateKeyUpdate({ set: { spaceId: domainSpaceId } });
+}
+await database
+	.insert(videoViewerGrants)
+	.values({
+		id: ids.emailGrantedVideo,
+		videoId: Video.VideoId.make(ids.emailGrantedVideo),
+		email: "member@example.invalid",
+		invitedByUserId: outsiderId,
+	})
+	.onDuplicateKeyUpdate({ set: { revokedAt: null } });
+
+await database
+	.update(organizations)
+	.set({ videoSharingRestrictedToOrg: true })
+	.where(eq(organizations.id, organizationId));
+try {
+	for (const [userId, allowed] of [
+		[ownerId, true],
+		[memberId, true],
+		[outsiderId, false],
+	] as const) {
+		const access = await getVideoOrganizationAccess(
+			Video.VideoId.make(ids.publicVideo),
+			userId,
+		);
+		if (access?.allowed !== allowed || !access.restricted)
+			throw new Error("Organization access SQL assertion failed");
+	}
+} finally {
+	await database
+		.update(organizations)
+		.set({ videoSharingRestrictedToOrg: false })
+		.where(eq(organizations.id, organizationId));
+}
+
+const secret = process.env.NEXTAUTH_SECRET;
+if (!secret) throw new Error("Missing isolated auth configuration");
+const states: Record<string, unknown> = {};
+const desktopToken = randomUUID();
+await database
+	.insert(authApiKeys)
+	.values({ id: desktopToken, userId: ownerId, source: "unknown" });
+states.desktopToken = desktopToken;
+for (const [key, id, email] of [
+	["owner", ownerId, `${process.env.CAP_BUILDING_SESSION}@example.invalid`],
+	["member", memberId, "member@example.invalid"],
+	["outsider", outsiderId, "guest@example.invalid"],
+] as const) {
+	const apiToken = randomUUID();
+	await database
+		.insert(authApiKeys)
+		.values({ id: apiToken, userId: id, source: "unknown" });
+	states[`${key}Token`] = apiToken;
+	const value = await encode({
+		secret,
+		maxAge: 3600,
+		token: { id, email, name: `Example ${key}`, sessionVersion: 0 },
+	});
+	states[key] = {
+		cookies: [
+			{
+				name: "next-auth.session-token",
+				value,
+				domain: "127.0.0.1",
+				path: "/",
+				httpOnly: true,
+				secure: false,
+				sameSite: "Lax",
+				expires: Math.floor(Date.now() / 1000) + 3600,
+			},
+		],
+		origins: [],
+	};
+}
+await mkdir(directory, { recursive: true, mode: 0o700 });
+await writeFile(
+	join(directory, "browser-states.json"),
+	JSON.stringify(states),
+	{ mode: 0o600 },
+);
+console.log("Synthetic access fixtures and database assertions passed");
+process.exit(0);
diff --git a/scripts/org-video-lock-demo/start.mjs b/scripts/org-video-lock-demo/start.mjs
new file mode 100644
index 00000000000..2b51516da2f
--- /dev/null
+++ b/scripts/org-video-lock-demo/start.mjs
@@ -0,0 +1,89 @@
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { directory, origin } from "./paths.mjs";
+
+const endpoint = new URL(process.env.CAP_AWS_ENDPOINT);
+if (endpoint.hostname !== "127.0.0.1")
+	throw new Error("Synthetic storage must be local");
+const video = readFileSync(join(directory, "demo.mp4"));
+const poster = readFileSync(join(directory, "screenshot.jpg"));
+const storage = createServer((request, response) => {
+	const url = new URL(request.url, endpoint);
+	response.setHeader("Access-Control-Allow-Origin", origin);
+	response.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
+	response.setHeader("Access-Control-Allow-Headers", "Range");
+	if (request.method === "OPTIONS") {
+		response.end();
+		return;
+	}
+	if (url.searchParams.has("list-type")) {
+		const prefix = url.searchParams.get("prefix") ?? "";
+		if (!/^[0-9abcdefghjkmnpqrstvwxyz/]*$/.test(prefix)) {
+			response.writeHead(400).end();
+			return;
+		}
+		response.setHeader("Content-Type", "application/xml");
+		response.end(
+			`<ListBucketResult><Name>organization-sharing-demo</Name><IsTruncated>false</IsTruncated><Contents><Key>${prefix}screenshot.jpg</Key><Size>${poster.length}</Size></Contents></ListBucketResult>`,
+		);
+		return;
+	}
+	const bytes = url.pathname.endsWith("/result.mp4")
+		? video
+		: url.pathname.endsWith("/screenshot.jpg")
+			? poster
+			: null;
+	if (!bytes) {
+		response.writeHead(404).end();
+		return;
+	}
+	response.setHeader(
+		"Content-Type",
+		bytes === video ? "video/mp4" : "image/jpeg",
+	);
+	response.setHeader("Accept-Ranges", "bytes");
+	const range = request.headers.range?.match(/^bytes=(\d+)-(\d*)$/);
+	const start = Number(range?.[1] ?? 0);
+	const end = Math.min(
+		Number(range?.[2] || bytes.length - 1),
+		bytes.length - 1,
+	);
+	if (range) {
+		response.statusCode = 206;
+		response.setHeader(
+			"Content-Range",
+			`bytes ${start}-${end}/${bytes.length}`,
+		);
+	}
+	response.setHeader("Content-Length", end - start + 1);
+	response.end(
+		request.method === "HEAD" ? undefined : bytes.subarray(start, end + 1),
+	);
+});
+storage.listen(Number(endpoint.port), "127.0.0.1");
+const web = spawn(
+	"bun",
+	[
+		"run",
+		"--cwd",
+		"apps/web",
+		"dev",
+		"--port",
+		process.env.PORT,
+		"--hostname",
+		"127.0.0.1",
+	],
+	{ stdio: "inherit" },
+);
+for (const signal of ["SIGINT", "SIGTERM"]) {
+	process.on(signal, () => {
+		web.kill(signal);
+		storage.close();
+	});
+}
+web.on("exit", (code) => {
+	storage.close();
+	process.exit(code ?? 1);
+});
diff --git a/scripts/org-video-lock-demo/walkthrough.mjs b/scripts/org-video-lock-demo/walkthrough.mjs
new file mode 100644
index 00000000000..618f12894d7
--- /dev/null
+++ b/scripts/org-video-lock-demo/walkthrough.mjs
@@ -0,0 +1,277 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { expect } from "@playwright/test";
+import { chromium } from "playwright";
+import { directory, ids, origin } from "./paths.mjs";
+
+const states = JSON.parse(
+	await readFile(join(directory, "browser-states.json"), "utf8"),
+);
+const browser = await chromium.launch({
+	headless: false,
+	args: ["--window-size=1920,1080"],
+	...(process.platform === "darwin" ? { channel: "chrome" } : {}),
+});
+const contextOptions = { viewport: { width: 1880, height: 980 } };
+const owner = await browser.newContext({
+	...contextOptions,
+	storageState: states.owner,
+});
+const member = await browser.newContext({
+	...contextOptions,
+	storageState: states.member,
+});
+const outsider = await browser.newContext({
+	...contextOptions,
+	storageState: states.outsider,
+});
+const anonymous = await browser.newContext(contextOptions);
+const settings = await owner.newPage();
+const viewer = await anonymous.newPage();
+const memberPage = await member.newPage();
+const guestPage = await outsider.newPage();
+const visit = async (page, path) => {
+	await page.bringToFront();
+	await page.goto(`${origin}${path}`, { waitUntil: "domcontentloaded" });
+};
+for (const context of [owner, member, outsider, anonymous])
+	context.setDefaultTimeout(15_000);
+const pause = (page) => page.waitForTimeout(2_500);
+
+try {
+	await visit(viewer, `/c/${ids.publicSpace}`);
+	await expect(
+		viewer.getByText("Existing project walkthrough", { exact: true }),
+	).toBeVisible();
+	await visit(viewer, `/s/${ids.publicVideo}`);
+	await expect(
+		viewer.getByRole("heading", {
+			name: "Existing project walkthrough",
+			exact: true,
+		}),
+	).toBeVisible();
+	await expect(viewer.locator("video").first()).toBeVisible();
+	await pause(viewer);
+	await visit(settings, "/dashboard/settings/organization/preferences");
+	const lock = settings.getByRole("switch", {
+		name: "Only members of this organization",
+	});
+	await expect(lock).not.toBeChecked();
+	await lock.scrollIntoViewIfNeeded();
+	await pause(settings);
+	await lock.click();
+	await expect(lock).toBeChecked();
+	await expect(
+		settings.getByText("All recordings are now organization-only", {
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause(settings);
+	await visit(viewer, `/s/${ids.publicVideo}`);
+	await expect(
+		viewer.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await expect(viewer.locator("video")).toHaveCount(0);
+	await pause(viewer);
+	await visit(viewer, `/embed/${ids.publicVideo}`);
+	await expect(
+		viewer.getByRole("heading", { name: "This video is private" }),
+	).toBeVisible();
+	await expect(viewer.locator("video")).toHaveCount(0);
+	await visit(guestPage, `/s/${ids.privateVideo}`);
+	await expect(
+		guestPage.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await pause(guestPage);
+	await visit(viewer, `/c/${ids.publicSpace}`);
+	await expect(
+		viewer.getByText("Existing project walkthrough", { exact: true }),
+	).toHaveCount(0);
+	await expect(
+		viewer.getByText("Public project library", { exact: true }).first(),
+	).toBeVisible();
+	for (const [path, status] of [
+		[`/api/playlist?videoId=${ids.publicVideo}&videoType=mp4`, 401],
+		[`/api/thumbnail?videoId=${ids.publicVideo}`, 404],
+		[`/api/video/preview?videoId=${ids.publicVideo}`, 404],
+		[
+			`/api/oembed?url=${encodeURIComponent(`https://cap.so/s/${ids.publicVideo}`)}`,
+			404,
+		],
+	]) {
+		const response = await anonymous.request.get(`${origin}${path}`, {
+			maxRedirects: 0,
+		});
+		expect(response.status()).toBe(status);
+	}
+	await visit(memberPage, `/c/${ids.publicSpace}`);
+	await expect(
+		memberPage.getByText("Existing project walkthrough", { exact: true }),
+	).toBeVisible();
+	await visit(memberPage, `/c/${ids.protectedSpace}`);
+	await expect(
+		memberPage.getByText("Private team update", { exact: true }),
+	).toBeVisible();
+	await pause(memberPage);
+	await visit(memberPage, `/c/${ids.domainSpace}`);
+	await expect(
+		memberPage.getByText("Shared public project update", { exact: true }),
+	).toBeVisible();
+	for (const title of [
+		"Private external project update",
+		"Password-protected external update",
+		"Email-restricted external update",
+	]) {
+		await expect(memberPage.getByText(title, { exact: true })).toHaveCount(0);
+	}
+	await expect(
+		memberPage.getByText("Invited external update", { exact: true }),
+	).toBeVisible();
+	const mobileDetail = await member.request.get(
+		`${origin}/api/mobile/caps/${ids.privateVideo}`,
+		{ headers: { Authorization: `Bearer ${states.memberToken}` } },
+	);
+	expect(mobileDetail.status()).toBe(200);
+	const { cap: mobileCap } = await mobileDetail.json();
+	expect(mobileCap.public).toBe(false);
+	expect(mobileCap.protected).toBe(false);
+	expect(mobileCap.thumbnailUrl).toBeTruthy();
+	const mobileList = await member.request.get(
+		`${origin}/api/mobile/caps?spaceId=${ids.protectedSpace}`,
+		{ headers: { Authorization: `Bearer ${states.memberToken}` } },
+	);
+	expect(mobileList.status()).toBe(200);
+	const { caps: mobileCaps } = await mobileList.json();
+	expect(mobileCaps).toEqual(
+		expect.arrayContaining([
+			expect.objectContaining({
+				id: ids.privateVideo,
+				public: false,
+				protected: false,
+				thumbnailUrl: expect.any(String),
+			}),
+		]),
+	);
+	const mobileDenied = await outsider.request.get(
+		`${origin}/api/mobile/caps/${ids.publicVideo}`,
+		{ headers: { Authorization: `Bearer ${states.outsiderToken}` } },
+	);
+	expect(mobileDenied.status()).toBe(404);
+	const created = await owner.request.get(
+		`${origin}/api/desktop/video/create?recordingMode=desktopMP4&name=New%20organization%20recording&durationInSecs=12&width=1280&height=720`,
+		{ headers: { Authorization: `Bearer ${states.desktopToken}` } },
+	);
+	expect(created.status()).toBe(200);
+	const newVideo = await created.json();
+	expect(typeof newVideo.id).toBe("string");
+	await visit(viewer, `/s/${newVideo.id}`);
+	await expect(
+		viewer.getByRole("heading", { name: "This video is organization-only" }),
+	).toBeVisible();
+	await pause(viewer);
+	await visit(memberPage, `/s/${newVideo.id}`);
+	await expect(
+		memberPage.getByRole("heading", {
+			name: "New organization recording",
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause(memberPage);
+	await visit(memberPage, `/s/${ids.privateVideo}`);
+	await expect(
+		memberPage.getByRole("heading", {
+			name: "Private team update",
+			exact: true,
+		}),
+	).toBeVisible();
+	const video = memberPage.locator("video").first();
+	await expect(video).toBeVisible();
+	await video.evaluate(async (element) => {
+		element.muted = true;
+		await element.play();
+	});
+	await expect
+		.poll(() => video.evaluate((element) => element.currentTime))
+		.toBeGreaterThan(0.5);
+	await pause(memberPage);
+	await visit(settings, `/s/${ids.publicVideo}`);
+	await expect(
+		settings.getByText("Organization only", { exact: true }).first(),
+	).toBeVisible();
+	await expect(async () => {
+		await settings
+			.getByRole("button", {
+				name: "Sharing: Organization only. Click to manage access.",
+			})
+			.click();
+		await expect(
+			settings.getByRole("button", {
+				name: "Copy link for organization members",
+			}),
+		).toBeVisible({ timeout: 2_000 });
+	}).toPass({ timeout: 20_000 });
+	await expect(settings.getByRole("switch")).toHaveCount(0);
+	await pause(settings);
+	await visit(settings, "/dashboard/settings/organization/preferences");
+	await lock.scrollIntoViewIfNeeded();
+	await lock.click();
+	await expect(
+		settings.getByText("Individual sharing settings restored", { exact: true }),
+	).toBeVisible();
+	await visit(viewer, `/s/${ids.publicVideo}`);
+	await expect(
+		viewer.getByRole("heading", {
+			name: "Existing project walkthrough",
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause(viewer);
+	await visit(memberPage, `/s/${ids.privateVideo}`);
+	await expect(
+		memberPage.getByRole("heading", { name: "This video is private" }),
+	).toBeVisible();
+	await visit(viewer, `/c/${ids.publicSpace}`);
+	await expect(
+		viewer.getByText("Existing project walkthrough", { exact: true }),
+	).toBeVisible();
+	await visit(settings, "/dashboard/settings/organization/preferences");
+	await lock.scrollIntoViewIfNeeded();
+	await lock.click();
+	await expect(
+		settings.getByText("All recordings are now organization-only", {
+			exact: true,
+		}),
+	).toBeVisible();
+	await pause(settings);
+	await settings.screenshot({ path: join(directory, "settings.png") });
+	await writeFile(
+		join(directory, "walkthrough-result.json"),
+		JSON.stringify({
+			passed: true,
+			observedAt: new Date().toISOString(),
+			verified: [
+				"existing public link blocked",
+				"invited guest blocked",
+				"anonymous embed blocked",
+				"public collection hides outsider metadata and allows owning members",
+				"saved collection passwords do not block organization members",
+				"eligible recordings from other organizations remain in collections",
+				"external email restrictions and explicit viewer grants are respected",
+				"sharing controls explain the organization policy",
+				"media and metadata endpoints blocked",
+				"organization member playback",
+				"mobile details and listings reflect the organization policy",
+				"new recording access enforced",
+				"original settings restored",
+			],
+		}),
+	);
+	console.log("Organization sharing walkthrough passed");
+} catch (error) {
+	await settings
+		.screenshot({ path: join(directory, "failed-settings.png") })
+		.catch(() => {});
+	throw error;
+} finally {
+	await browser.close();
+}