Redesign resources page with PageBanner, featured download, and consistent page headers; v1.1.40

- Replace hero study guide form with PageBanner + featured download card in library
- Add PageBanner component used consistently across all interior pages (Downloads, Episodes, About, Contact, Q&A, Finished Books)
- Remove duplicate headings/eyebrows that conflicted with banner titles on About, Contact, Q&A, Finished Books pages
- Compact download card sizing (padding, border-radius, image size)
- Add Books & Resources tabbed section with fallback to TruthForLife widget
- Fix server sanitizer to pass through 'resources' placement items without URL
- Add featured-badge and featured card styling for primary guide

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/launch.json

@@ -0,0 +1,19 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "siteforge",
+      "runtimeExecutable": "node",
+      "runtimeArgs": ["--env-file=.env", "server.js"],
+      "port": 4173,
+      "autoPort": false
+    },
+    {
+      "name": "siteforge-vite",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 5173,
+      "autoPort": false
+    }
+  ]
+}

.dockerignore

@@ -1,5 +1,4 @@
 node_modules
-dist
 .git
 .gitignore
 .vscode

.env

@@ -1 +0,0 @@
-ADMIN_PASSWORD=TestAdmin123!

.env.example

@@ -21,3 +21,8 @@ RESEND_SEGMENT_ID=
 # During testing you can leave this as-is (uses Resend's shared domain).
 # For production: verify your own domain at resend.com/domains and change this.
 RESEND_FROM=Verse by Verse with Nate <hello@versebyversewithnate.us>
+
+# Shared secret for the Cloudflare Email Worker webhook.
+# Must match the WEBHOOK_SECRET variable set in the Cloudflare Worker settings.
+# Generate with: openssl rand -hex 32
+INBOUND_EMAIL_SECRET=

.github/workflows/docker-publish.yml

@@ -13,6 +13,8 @@ permissions:
 jobs:
   docker:
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -24,12 +26,12 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --legacy-peer-deps
 
       - name: Run production build
         run: npm run build
@@ -56,5 +58,8 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            COMMIT_SHA=${{ github.sha }}

.gitignore

@@ -18,6 +18,15 @@ dist-ssr
 # Uncomment the line below if you do NOT want to track live data in git.
 # data/admin-content.json
 data/backups/
+data/hit-stats.json
+data/visitor-stats.json
+data/contact-submissions.json
+data/totp-secret.json
+data/uploads-meta.json
+
+# Local environment secrets — never commit
+.env
+.env.*
 
 # Editor directories and files
 .vscode/*

Dockerfile

@@ -1,11 +1,9 @@
-FROM node:22-alpine AS build
+# Install prod deps on the native builder platform to avoid QEMU npm crashes
+# during cross-platform builds. All deps are pure-JS so this is safe.
+FROM --platform=$BUILDPLATFORM node:22-alpine AS deps
 WORKDIR /app
-
 COPY package*.json ./
-RUN npm ci
+RUN npm ci --omit=dev --legacy-peer-deps
-
-COPY . .
-RUN npm run build
 
 FROM node:22-alpine AS runtime
 WORKDIR /app
@@ -13,11 +11,16 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV PORT=4173
 
-COPY package*.json ./
+ARG COMMIT_SHA=unknown
-RUN npm ci --omit=dev
+ENV COMMIT_SHA=${COMMIT_SHA}
 
-COPY --from=build /app/dist ./dist
+COPY --from=deps /app/node_modules ./node_modules
+
+COPY package.json ./package.json
+COPY dist ./dist
 COPY server.js ./server.js
+COPY server/ ./server/
+COPY A_Study_of_Titus.pdf ./A_Study_of_Titus.pdf
 
 # Copy seed data to a separate directory so the entrypoint can seed /app/data
 # only when no live data exists yet — upgrades never overwrite existing data.

README.md

@@ -1,129 +1,259 @@
 # Siteforge
 
-This project is a React + TypeScript portfolio app built with Vite.
+A podcast and ministry website for **Verse by Verse with Nate** — a verse-by-verse Bible teaching podcast. Built with React + TypeScript (Vite) on the frontend and Express.js on the backend, deployed as a Docker container via GitHub Actions.
 
-It is designed to showcase two categories of work:
+## Features
 
-- Websites
+- **Podcast episodes** — episode listing, detail pages, downloadable resources, finished series archive
-- Apps
+- **Study system** — per-user enrollment in structured Bible studies with sections, notes, progress tracking, section quizzes, community posts/comments, and completion certificates
+- **Study accounts** — signup/login, email verification, avatar upload, email change with re-verification
+- **Two-factor authentication** — TOTP authenticator app + email OTP backup, recovery codes
+- **Contact form** — submissions stored server-side, admin reply with templates, inbound email webhook (Resend)
+- **Q&A** — public question submission, admin moderation, pinned answers, shareable question links
+- **Email integration** — welcome emails, admin notifications, admin replies, study reminder emails (via Resend)
+- **Admin panel** — content management with draft/publish workflow, episode scripts, podcast checklist, QR code management, subscriber management, asset uploads
+- **Analytics** — page views, audio plays, download tracking, geo-based visitor stats (country/state/city), consent-based cookie opt-in
+- **Backup system** — automatic JSON snapshots with restore, full `tar.gz` data export/import for server migration
+- **Version display** — app version and git commit shown in admin sidebar; `/api/version` endpoint
 
-The app now supports:
+---
 
-- Dynamic cards generated from a project data source
+## Tech Stack
-- Built vs Hosted filters
-- A dedicated About page route for each project
-- An admin editor route to update cards and About pages
-- A per-project README summary block on each project page
-- Embedded Spotify podcast player on the home section
 
-## Run locally
+| Layer | Technology |
+|---|---|
+| Frontend | React 19, TypeScript, Vite, React Router v7 |
+| Backend | Express 5, Node.js 22 |
+| Email | Resend |
+| TOTP | otplib |
+| QR Codes | qrcode |
+| Rich text | TipTap |
+| Charts | Chart.js + react-chartjs-2, react-simple-maps |
+| Documents | docx, mammoth |
+| Container | Docker (GHCR), GitHub Actions CI |
+
+---
+
+## Project Structure
+
+```
+siteforge/
+├── src/                    # React frontend
+│   ├── App.tsx             # Root + all client routes
+│   ├── App.css
+│   └── ...                 # Page and component files
+├── server/                 # Express backend
+│   ├── config.js           # Constants, env vars, APP_VERSION, GIT_COMMIT
+│   ├── data.js             # In-memory state + JSON persistence
+│   ├── helpers.js          # Shared utilities (IP, rate limiting, etc.)
+│   ├── study-helpers.js    # Study email scheduling, cert generation
+│   └── routes/             # Route handlers (one file per domain)
+├── data/                   # Seed data (JSON); live data at /app/data in container
+├── server.js               # Entry point — mounts all routers
+├── Dockerfile
+├── entrypoint.sh           # Seeds /app/data on first run, never overwrites live data
+├── docker-compose.yml
+└── .github/workflows/docker-publish.yml
+```
+
+---
+
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `SESSION_SECRET` | Yes | Secret for Express session signing |
+| `ADMIN_PASSWORD_HASH` | Yes | bcrypt hash of the admin password |
+| `RESEND_API_KEY` | Yes | Resend API key for sending email |
+| `RESEND_FROM` | Yes | Sender address (e.g. `Nate <nate@example.com>`) |
+| `RESEND_TO` | Yes | Address that receives contact form notifications |
+| `RESEND_REPLY_TO` | No | Reply-to address on outbound emails |
+| `RESEND_WEBHOOK_TOKEN` | No | Validates inbound Resend webhook requests |
+| `INBOUND_EMAIL_SECRET` | No | Validates inbound email route requests |
+| `RESEND_CONTACTS_API_KEY` | No | Resend Contacts API key for subscriber sync |
+| `RESEND_SEGMENT_ID` | No | Resend segment ID for subscriber list |
+| `COMMIT_SHA` | No | Git SHA baked in at build time by CI (shown in admin UI) |
+| `TRUST_PROXY_HOPS` | No | Number of proxy hops to trust (default `1`) — set correctly for accurate client IPs behind a reverse proxy |
+| `ALLOW_INSECURE_COOKIES` | No | Set to `true` to allow session cookies over HTTP (for local/non-HTTPS access) |
+| `TITUS_STUDY_FILE` | No | Path to the Titus study PDF (defaults to bundled file) |
+| `TITUS_STUDY_DOWNLOAD_NAME` | No | Filename shown to users downloading the Titus PDF |
+| `PORT` | No | HTTP port (default `4173`) |
+| `CACHE_PURGE_WEBHOOK_URL` | No | Webhook URL for one-click cache purge from Admin Operations |
+| `DEPLOY_WEBHOOK_URL` | No | Webhook URL for one-click deploy trigger from Admin Operations |
+
+---
+
+## Frontend Routes
+
+| Path | Page |
+|---|---|
+| `/` | Landing page |
+| `/start-here` | Start here / intro page |
+| `/episodes` | Episode listing |
+| `/episodes/:id` | Episode detail |
+| `/finished` | Finished series listing |
+| `/finished/:id` | Finished series detail |
+| `/resources` | Resources listing |
+| `/downloads/:id` | Download detail |
+| `/about` | About page |
+| `/contact` | Contact form |
+| `/questions` | Q&A listing |
+| `/subscribe` | Email subscribe |
+| `/subscribe/thanks` | Subscribe confirmation |
+| `/study` | Study landing page |
+| `/study/signup` | Study account signup |
+| `/study/account` | Study account dashboard |
+| `/study/:studySlug` | Study index |
+| `/study/:studySlug/community` | Study community posts |
+| `/study/:studySlug/notes` | Study notes |
+| `/study/:studySlug/:sectionId` | Study section |
+| `/study/:studySlug/:sectionId/quiz` | Section quiz |
+| `/certificate/:token` | Public completion certificate |
+| `/privacy` | Privacy policy |
+| `/thanks` | Contact thank-you |
+| `/admin` | Admin panel (requires password + TOTP) |
+| `/preview` | Content draft preview |
+
+---
+
+## Key API Endpoints
+
+| Endpoint | Description |
+|---|---|
+| `GET /api/version` | Returns `{ version, commit }` |
+| `GET /api/content` | Public site content (CMS data) |
+| `POST /api/contact` | Submit contact form |
+| `POST /api/analytics/pageview` | Record page view |
+| `POST /api/analytics/play` | Record audio play |
+| `GET /api/episode-audio` | Episode audio proxy |
+| `GET /api/admin-auth/status` | Admin session status + version info |
+| `POST /api/admin-auth/login` | Admin login |
+| `POST /api/admin-auth/totp-verify` | Complete TOTP 2FA |
+| `POST /api/admin-auth/totp-setup-init` | Begin TOTP enrollment |
+| `POST /api/admin-auth/totp-setup-confirm` | Confirm TOTP enrollment |
+| `GET /api/admin-stats` | Hit/visitor analytics |
+| `GET /api/admin-stats/backup` | Trigger stats snapshot |
+| `GET /api/admin-backup/export` | Download full `tar.gz` data backup |
+| `POST /api/admin-backup/import` | Restore from `tar.gz` backup |
+| `GET /api/admin/study-users` | List study accounts |
+| `GET /api/admin-study-certificates` | Study completion certificates |
+| `GET /api/admin-contact-submissions` | Contact form submissions |
+| `POST /api/admin-contact-submissions/:id/reply` | Reply to a submission |
+| `GET /api/admin/qr-codes` | QR code management |
+| `GET /api/admin-episode-scripts/:episodeNumber` | Episode script |
+| `GET /api/admin-podcast-checklist` | Podcast checklist state |
+| `GET /api/admin-subscribers` | Subscriber list |
+
+---
+
+## Development
 
 ```bash
+# Install dependencies
 npm install
+
+# Start frontend dev server only (Vite, http://localhost:5173)
+npm run dev
+
+# Start backend API server only (reads .env, http://localhost:4173)
+npm run api
+
+# Start both concurrently
 npm run dev:full
-```
 
-`dev:full` starts both:
+# Production build
-
-- Vite frontend (`http://localhost:5173`)
-- Admin content API (`http://localhost:4173`)
-
-## Build for production
-
-```bash
 npm run build
+
+# Start production server (reads .env)
+npm start
 ```
 
-## Run in container
+Create a `.env` file at the project root with the required environment variables before running locally. The server uses `--env-file=.env`.
 
-Pull image directly:
+---
 
-```bash
+## Docker / Deployment
-docker pull ghcr.io/nmemmert/siteforge:latest
+
-docker run -d --name siteforge-app -p 4173:4173 -v ./data:/app/data ghcr.io/nmemmert/siteforge:latest
+Images are built and pushed to `ghcr.io/nmemmert/siteforge` automatically on every push to `main` or when a `v*` tag is pushed. The git commit SHA is baked into the image as `COMMIT_SHA` at build time and displayed in the admin sidebar.
+
+### First run
+
+On first boot, `entrypoint.sh` copies seed data from the bundled `data-seed/` into `/app/data/` if that directory is empty. Subsequent restarts skip this step, so live data is never overwritten by an upgrade.
+
+### docker-compose.yml
+
+A `docker-compose.yml` is included at the project root. Mount `/app/data` to a persistent volume or host path and supply all required environment variables.
+
+```yaml
+volumes:
+  - /path/to/your/data:/app/data
 ```
 
-Run with Docker Compose:
+### Useful commands
 
 ```bash
+# Pull latest image and restart
 docker compose pull
 docker compose up -d
-```
 
-Admin auth:
+# View logs
-
-- Set `ADMIN_PASSWORD` on the server/container to protect `/admin` and admin stats/maintenance endpoints.
-- Without `ADMIN_PASSWORD`, admin login is disabled until configured.
-
-The app will be available at `http://localhost:4173`.
-
-Persistent admin saves:
-
-- Admin updates are written to `data/admin-content.json`.
-- Built-in page hit stats are written to `data/hit-stats.json`.
-- Detailed visitor analytics are written to `data/visitor-stats.json`.
-- Backup snapshots are written to `data/backups/`.
-- `docker-compose.yml` mounts `./data` into the container at `/app/data`.
-- This keeps all admin-managed data after container restarts/rebuilds/updates.
-
-## Where to edit content
-
-- Project domain data and ownership: `src/data/projects.ts`
-- Portfolio rendering logic: `src/App.tsx`
-- Portfolio UI styles: `src/App.css`
-- Global theme variables: `src/index.css`
-
-## Routes
-
-- Portfolio home: `/`
-- Project details: `/projects/:slug`
-- Admin editor: `/admin`
-
-## Admin editing
-
-- Open `/admin` to edit project card and featured-page content.
-- Use **Global Settings** to update theme, home headers, and quick tips.
-- Use **Project Settings** to update project-specific fields and README URL.
-- Use **Create new entry** to add a new project directly from Admin.
-- Enter a URL and click **Scan URL metadata** to auto-fill title, summary, domain, category, and icon when available.
-- Click **Save project** to apply updates instantly.
-- Saved edits are written to `data/admin-content.json` through the API server.
-- Built-in stats in `/admin` include page hits plus visitor details (IP, country/state/county/city, returning visitors, and recent visitor log).
-- Site Stats in `/admin` includes a Bible Questions inbox sourced from contact form submissions marked as Bible Question.
-- Analytics cookies are consent-based. Visitors can accept or decline tracking from the site banner.
-- Admin now includes maintenance actions: **Export JSON**, **Backup Now**, **Prune Old Data**, and **Clear Analytics**.
-- Admin also supports restoring from a backup snapshot from `/admin`.
-- The server creates startup + daily backup snapshots and retains recent backups automatically.
-- Use the **Theme** dropdown to switch between Sandstone, Ocean, Midnight, Forest, and Sunset.
-- Use **Remove project** to delete the selected project from your local Admin data.
-- Use **Reset project** or **Reset all** to restore defaults from `src/data/projects.ts`.
-
-Scan notes:
-
-- URL scanning is best-effort and depends on site accessibility.
-- Some sites block direct scanning; Admin falls back to a proxy scan path when possible.
-- Always review scanned fields before saving.
-
-Deployment note:
-
-- To keep Admin saves working on the internet, deploy with the Node API (`server.js`) and writable server storage for `data/admin-content.json`.
-
-Useful container commands:
-
-```bash
 docker compose logs -f
+
+# Stop
 docker compose down
 ```
 
-Update to latest image:
+---
 
-```bash
+## Persistent Data
-docker compose pull
-docker compose up -d
-```
 
-## Notes
+All server-managed data lives under `/app/data` (or `./data` locally):
 
-- The current project cards are sample placeholders.
+| Path | Contents |
-- Most metadata was scanned from live pages.
+|---|---|
-- Skywatch currently uses a manual fallback description due to a `401` response during automated scan.
+| `admin-content.json` | Published CMS content |
+| `admin-content-draft.json` | Draft content (unpublished) |
+| `hit-stats.json` | Page hit analytics |
+| `visitor-stats.json` | Detailed visitor analytics |
+| `contact-submissions.json` | Contact form submissions |
+| `study-users.json` | Study account records |
+| `study-reminders.json` | Scheduled study reminder state |
+| `qr-codes.json` | QR code registry |
+| `episode-scripts/` | Per-episode script files |
+| `backups/` | Automatic JSON snapshot backups |
+| `uploads/` | Admin-uploaded assets (served at `/uploads/*`) |
+
+---
+
+## Admin Access
+
+1. Navigate to `/admin`
+2. Enter the admin password (hashed value in `ADMIN_PASSWORD_HASH`)
+3. Complete TOTP 2FA, or use an email OTP if no TOTP app is enrolled
+4. On first use, enroll a TOTP authenticator app from Admin → Settings
+
+Recovery codes are generated during TOTP setup and can be regenerated from Admin → Settings.
+
+### Admin capabilities
+
+- **Content** — edit and publish site content with draft/preview workflow
+- **Episode scripts** — write and manage per-episode scripts; export to `.docx`
+- **Podcast checklist** — track per-episode production steps
+- **QR codes** — create, manage, and track scan counts for QR codes
+- **Questions** — moderate submitted Q&A, pin answers, reply
+- **Contact** — view submissions, reply with templates, check email health
+- **Study users** — view enrollments, progress, certificates, manually enroll/unenroll
+- **Study comments** — moderate community post comments
+- **Subscribers** — view and export subscriber list
+- **Assets** — upload and delete hosted images
+- **Stats** — page hits, visitor geo analytics, download stats; export CSV
+- **Backup** — snapshot now, restore from snapshot, export/import full `tar.gz`
+- **Operations** — purge cache, trigger deploy, manage SEO/sitemap/redirects
+
+---
+
+## Versioning
+
+The app version is read from `package.json` at startup (`APP_VERSION`). The git commit is baked in via `COMMIT_SHA` at Docker build time (set automatically by CI). Both are visible in the admin sidebar and at `GET /api/version`.
+
+Bump `package.json` before every commit pushed to `main`: patch for fixes, minor for features, major for breaking changes.

cloudflare/email-worker.js

@@ -0,0 +1,208 @@
+/**
+ * Cloudflare Email Worker — versebyversewithnate.us
+ *
+ * Receives inbound emails to hello@ and nate@, forwards to Gmail,
+ * and POSTs a parsed copy to the site admin inbox.
+ *
+ * CLOUDFLARE SETUP:
+ *   1. Go to Email > Email Routing > Routes in your Cloudflare dashboard
+ *   2. Add two "Custom address" rules:
+ *        hello@versebyversewithnate.us  →  Send to Worker  →  this worker
+ *        nate@versebyversewithnate.us   →  Send to Worker  →  this worker
+ *   3. Make sure nmemmert@gmail.com is listed as a verified destination address
+ *      (Email Routing > Destination addresses)
+ *
+ * WORKER ENVIRONMENT VARIABLES (Workers & Pages > this worker > Settings > Variables):
+ *   GMAIL_FORWARD_ADDRESS  =  nmemmert@gmail.com
+ *   WEBHOOK_URL            =  https://versebyversewithnate.us/api/inbound-email
+ *   WEBHOOK_SECRET         =  <a long random string — must match INBOUND_EMAIL_SECRET on the server>
+ *
+ * SERVER ENVIRONMENT VARIABLE (set in your server host / .env):
+ *   INBOUND_EMAIL_SECRET   =  <same long random string as WEBHOOK_SECRET above>
+ */
+
+export default {
+  async email(message, env, ctx) {
+    const forwardPromise = message.forward(env.GMAIL_FORWARD_ADDRESS)
+
+    const rawEmail = await streamToText(message.raw)
+
+    const parsed = parseEmail(rawEmail, message)
+
+    const webhookPromise = fetch(env.WEBHOOK_URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Webhook-Secret': env.WEBHOOK_SECRET,
+      },
+      body: JSON.stringify(parsed),
+    }).catch(err => console.error('[email-worker] webhook failed:', err.message))
+
+    await Promise.all([forwardPromise, webhookPromise])
+  },
+}
+
+async function streamToText(stream) {
+  const reader = stream.getReader()
+  const chunks = []
+  while (true) {
+    const { done, value } = await reader.read()
+    if (done) break
+    chunks.push(value)
+  }
+  const bytes = new Uint8Array(chunks.reduce((acc, c) => acc + c.length, 0))
+  let offset = 0
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset)
+    offset += chunk.length
+  }
+  return new TextDecoder().decode(bytes)
+}
+
+function parseEmail(raw, message) {
+  const { headers, body } = splitHeadersAndBody(raw)
+
+  const subject = decodeHeaderValue(headers['subject'] ?? '(no subject)')
+  const from = message.from ?? headers['from'] ?? ''
+  const to = message.to ?? headers['to'] ?? ''
+  const date = headers['date'] ?? new Date().toISOString()
+  const messageId = headers['message-id'] ?? ''
+
+  const { plainText, htmlBody } = extractBodies(headers['content-type'] ?? '', body)
+
+  return {
+    from,
+    to,
+    subject,
+    body: plainText,
+    htmlBody: htmlBody || null,
+    date,
+    messageId,
+    source: 'inbound-email',
+  }
+}
+
+// Splits an RFC 5322 message (or MIME part) into its unfolded header map and raw body string.
+function splitHeadersAndBody(raw) {
+  const match = /\r?\n\r?\n/.exec(raw)
+  const headerBlock = match ? raw.slice(0, match.index) : raw
+  const body = match ? raw.slice(match.index + match[0].length) : ''
+  // RFC 2822 header folding: a line starting with SP/TAB continues the previous header line.
+  const unfolded = headerBlock.replace(/\r?\n[ \t]+/g, ' ')
+  const headers = {}
+  for (const line of unfolded.split(/\r?\n/)) {
+    const colon = line.indexOf(':')
+    if (colon <= 0) continue
+    const key = line.slice(0, colon).trim().toLowerCase()
+    const val = line.slice(colon + 1).trim()
+    if (!headers[key]) headers[key] = val
+  }
+  return { headers, body }
+}
+
+// Recursively walks a (possibly multipart) MIME body and returns the first text/plain and text/html parts found.
+function extractBodies(topContentType, topBody) {
+  let plainText = null
+  let htmlBody = null
+
+  function visit(contentType, body, transferEncoding) {
+    const type = (contentType.split(';')[0] || 'text/plain').trim().toLowerCase()
+
+    if (type.startsWith('multipart/')) {
+      const boundary = getBoundary(contentType)
+      if (!boundary) return
+      for (const part of splitOnBoundary(body, boundary)) {
+        const { headers, body: partBody } = splitHeadersAndBody(part)
+        visit(headers['content-type'] ?? 'text/plain', partBody, headers['content-transfer-encoding'] ?? '')
+      }
+      return
+    }
+
+    const decoded = decodeBody(body, transferEncoding)
+    if (type === 'text/html' && htmlBody === null) htmlBody = decoded.trim()
+    if (type === 'text/plain' && plainText === null) plainText = decoded.trim()
+  }
+
+  visit(topContentType || 'text/plain', topBody, '')
+
+  if (plainText === null && htmlBody !== null) {
+    plainText = htmlBody.replace(/<[^>]+>/g, '').replace(/&nbsp;/g, ' ').replace(/&amp;/g, '&').replace(/\s{3,}/g, '\n\n').trim()
+  }
+  if (plainText === null) plainText = ''
+
+  return { plainText, htmlBody }
+}
+
+function getBoundary(contentType) {
+  const match = /boundary\s*=\s*"([^"]+)"|boundary\s*=\s*([^;\s]+)/i.exec(contentType)
+  if (!match) return null
+  return match[1] ?? match[2]
+}
+
+// Splits a multipart body on its boundary markers, ignoring the preamble/epilogue.
+function splitOnBoundary(body, boundary) {
+  const escaped = boundary.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const re = new RegExp(`(?:^|\\r?\\n)--${escaped}(--)?(?:\\r?\\n|$)`, 'g')
+  const parts = []
+  let lastIndex = 0
+  let started = false
+  let match
+  while ((match = re.exec(body)) !== null) {
+    if (started) parts.push(body.slice(lastIndex, match.index))
+    started = true
+    lastIndex = match.index + match[0].length
+    if (match[1]) break // final boundary: "--boundary--"
+  }
+  return parts
+}
+
+function decodeBody(text, transferEncoding) {
+  const enc = (transferEncoding || '').trim().toLowerCase()
+  if (enc === 'base64') {
+    try {
+      const binary = atob(text.replace(/\s+/g, ''))
+      return new TextDecoder('utf-8').decode(Uint8Array.from(binary, c => c.charCodeAt(0)))
+    } catch {
+      return ''
+    }
+  }
+  if (enc === 'quoted-printable') {
+    return decodeEmailBody(text)
+  }
+  return text
+}
+
+function decodeEmailBody(text) {
+  // Handle quoted-printable encoding (=XX hex sequences and soft line breaks).
+  // Decode into raw bytes first, then run through TextDecoder so multi-byte
+  // UTF-8 sequences split across multiple =XX escapes recombine correctly.
+  const unfolded = text.replace(/=\r?\n/g, '')
+  const bytes = []
+  for (let i = 0; i < unfolded.length; i++) {
+    if (unfolded[i] === '=' && /^[0-9A-Fa-f]{2}$/.test(unfolded.slice(i + 1, i + 3))) {
+      bytes.push(parseInt(unfolded.slice(i + 1, i + 3), 16))
+      i += 2
+    } else {
+      bytes.push(unfolded.charCodeAt(i))
+    }
+  }
+  return new TextDecoder('utf-8').decode(Uint8Array.from(bytes))
+}
+
+function decodeHeaderValue(value) {
+  // Handle encoded words: =?UTF-8?B?...?= or =?UTF-8?Q?...?=
+  return value.replace(/=\?([^?]+)\?([BQ])\?([^?]*)\?=/gi, (_, charset, encoding, encoded) => {
+    try {
+      if (encoding.toUpperCase() === 'B') {
+        const binary = atob(encoded)
+        return new TextDecoder(charset).decode(Uint8Array.from(binary, c => c.charCodeAt(0)))
+      }
+      if (encoding.toUpperCase() === 'Q') {
+        return encoded.replace(/_/g, ' ').replace(/=([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+      }
+    } catch {
+      return encoded
+    }
+    return encoded
+  })
+}

data/admin-reply-history.json

@@ -0,0 +1,15 @@
+{
+  "items": [
+    {
+      "id": "da3f5f52-f0a3-4a36-9f52-7938b82e899a",
+      "submissionId": "0c2e3dc4-5ee3-42e9-a81b-172bedc16713",
+      "toEmail": "hello@versebyversewithnate.us",
+      "toName": "NoAdmin Signup",
+      "fromEmail": "hello@versebyversewithnate.us",
+      "subject": "Thanks for reaching out to Verse by Verse with Nate",
+      "preview": "Thank you for reaching out.\n\nI appreciate your message and wanted to follow up personally. I just wanted to say thank you for your email.\n\n~Nate",
+      "sentAt": "2026-05-07T12:54:06.683Z"
+    }
+  ],
+  "updatedAt": "2026-05-07T12:54:06.685Z"
+}

data/analytics-events.json

@@ -0,0 +1,36 @@
+{
+  "scrollDepth": {
+    "/episodes": {
+      "25": 4,
+      "50": 4,
+      "75": 2,
+      "90": 0
+    }
+  },
+  "timeOnPage": {
+    "/": {
+      "totalSeconds": 51,
+      "count": 4
+    },
+    "/episodes": {
+      "totalSeconds": 318967,
+      "count": 305
+    },
+    "/episodes/movn6tk3": {
+      "totalSeconds": 445,
+      "count": 3
+    }
+  },
+  "outboundClicks": {},
+  "linkClicks": {},
+  "utmSources": {},
+  "searchQueries": {},
+  "notFound": {},
+  "audioEvents": {
+    "Living Between Two Appearings": {
+      "pauses": 0,
+      "completions": 0,
+      "totalListenSeconds": 43
+    }
+  }
+}

data/chatbot-content.json

@@ -1,542 +0,0 @@
-[
-  {
-    "id": "cb_001",
-    "type": "qa",
-    "title": "What Bible translation do you use?",
-    "content": "In the podcast, I primarily teach from the BSB (Berean Standard Bible). I may compare other translations at times, but BSB is my main teaching text in the Verse by Verse episodes.",
-    "keywords": [
-      "bible",
-      "translation",
-      "bsb",
-      "berean standard bible",
-      "version",
-      "podcast",
-      "teaching"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_002",
-    "type": "qa",
-    "title": "How do you approach a difficult or confusing Bible passage?",
-    "content": "I always start by reading the surrounding context — a confusing verse often makes perfect sense once you zoom out a chapter or two. Then I look at who the author was, who they were writing to, and what was happening historically. A good study Bible or a commentary like Matthew Henry's can be a huge help. Most importantly, pray for understanding before you dive in. The Holy Spirit is your best guide.",
-    "keywords": [
-      "difficult",
-      "confusing",
-      "passage",
-      "context",
-      "commentary",
-      "study",
-      "interpretation",
-      "hard"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_003",
-    "type": "qa",
-    "title": "How do I stay consistent with daily Bible reading?",
-    "content": "Start small and protect that time like an appointment. Even 10 minutes in the morning before checking your phone can be transformative over a year. A reading plan helps a lot — there are great ones on apps like YouVersion that break the whole Bible into daily chunks so you never have to decide what to read. And give yourself grace on the days you miss; guilt is not a good motivator. Just pick back up where you left off.",
-    "keywords": [
-      "daily",
-      "reading",
-      "consistent",
-      "habit",
-      "bible",
-      "plan",
-      "youversion",
-      "devotional",
-      "routine",
-      "morning"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_005",
-    "type": "topic",
-    "title": "About the Verse by Verse with Nate Podcast",
-    "content": "Verse by Verse with Nate is a podcast dedicated to walking through books of the Bible chapter by chapter and verse by verse. The goal is to help everyday listeners develop a deep, contextual understanding of Scripture — not just surface-level summaries, but the meaning behind the words. New episodes are released regularly. You can listen on Spotify, Apple Podcasts, and other major platforms.",
-    "keywords": [
-      "podcast",
-      "about",
-      "verse by verse",
-      "nate",
-      "listen",
-      "show",
-      "episodes",
-      "what is"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_006",
-    "type": "topic",
-    "title": "How to listen to the podcast",
-    "content": "You can listen to Verse by Verse with Nate on Spotify or Apple Podcasts. Just search 'Verse by Verse with Nate' in your favorite podcast app. New episodes drop regularly — subscribing will make sure you never miss one. If you'd like to leave a review, that helps more people find the show!",
-    "keywords": [
-      "listen",
-      "subscribe",
-      "spotify",
-      "apple podcasts",
-      "find",
-      "where",
-      "app",
-      "review"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_007",
-    "type": "qa",
-    "title": "How do I submit a question to Nate?",
-    "content": "You can submit a question using the contact form at the bottom of this page. Select 'Bible Question' as the message type. Nate reads every question personally and answers the best ones on the site's Q&A section or in a future episode. There's no guarantee every question gets a public response, but all are read and appreciated!",
-    "keywords": [
-      "submit",
-      "question",
-      "contact",
-      "ask",
-      "send",
-      "form",
-      "email"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "cb_008",
-    "type": "topic",
-    "title": "Prayer and quiet time",
-    "content": "Prayer is simply talking to God — it doesn't have to be formal or long. A quiet time usually involves reading a passage of Scripture, reflecting on what it means for your life today, and spending a few minutes in prayer. You must make sure that you stay in context of what Scripture says and not put your own thoughts or words into what the Bible is saying. Many people find journaling helpful. The key is consistency, not perfection. Even five minutes a day done faithfully is far better than an hour once a week.",
-    "keywords": [
-      "prayer",
-      "quiet time",
-      "devotional",
-      "pray",
-      "journal",
-      "meditate",
-      "reflect",
-      "morning",
-      "time with god"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "167fa083-5438-44a5-ac72-6dd379e937f5",
-    "type": "episode",
-    "title": "Episode 2 — Introduction to Titus (Background & Overview)",
-    "content": "WHO WAS PAUL? Let’s start at the beginning. The letter opens in verse 1 with the words: Paul, a servant of God and an apostle of Jesus Christ for the faith of God’s elect and their knowledge of the truth that leads to godliness, Now, if you’ve spent any time in the New Testament, you’ve heard of Paul. But let me give you the short version, because I think it matters here. Paul — originally named Saul — was a man who, by his own description, was a Hebrew of Hebrews. He was a Pharisee. He was educated, zealous, and deeply committed to the law of Moses. And for a season of his life, that zeal led him to do something he would carry with him for the rest of his days: he persecuted the early church. He approved of the stoning of Stephen. He dragged men and women out of their homes and had them thrown into prison. And then — on a road to Damascus — everything changed. He met the risen Jesus. And the man who was once the church’s greatest enemy became its most tireless ambassador. Paul went on to plant churches across the Roman world. He traveled through modern-day Turkey, Greece, Macedonia. He wrote letters that would become a third of our New Testament. He was beaten, shipwrecked, imprisoned — and through all of it, he kept going. Why does this matter for Titus? Because the man writing this letter is not writing from a place of comfort or theory. Paul understood, in the most personal way possible, what it meant to be completely transformed by grace. That’s going to come through on every page. WHO WAS TITUS? Now, who is Titus? Titus doesn’t get as much attention as, say, Timothy — but he should. He’s one of Paul’s closest and most trusted co-workers, and the more you look at him, the more impressive he becomes. Here’s what we know: Titus was a Gentile. He wasn’t Jewish. He came to faith through Paul’s ministry — which is why Paul, in verse 4 of this very letter, calls him: To Titus, my true child in our common faith: Grace and peace from God the Father and Christ Jesus our Savior. That phrase is loaded. Paul is saying: you and I share the same gospel. You are my son in the faith. If you want to understand Titus better, look at a few other places in Paul’s letters. In 2 Corinthians chapter 7, Paul describes being comforted by the arrival of Titus during a particularly difficult season. In chapter 8, he sends Titus to help organize a relief offering for struggling believers in Jerusalem. And in Galatians chapter 2, Titus shows up as something of a test case — proof, in human form, that the gospel is for everyone. This is a man Paul trusted with hard things. And that’s important — because what he’s being asked to do in Crete is very hard. WHERE IS CRETE? Which brings us to the island. Crete. If you look at a map of the Mediterranean, you’ll find it in the southern Aegean Sea — a large island stretching about 160 miles from east to west. It was a well-known place in the ancient world. It had a long history, a busy coastline, and a reputation. And not necessarily a good one. Paul actually quotes a Cretan poet in this very letter — we’ll get to that in chapter 1. Crete had a reputation for dishonesty, for moral looseness, for people who were, frankly, difficult to work with. The cultural environment was a challenging one for a young church trying to take root. There were also false teachers mixing Jewish influences with the faith in unhealthy ways. Paul is going to address that head-on. So picture Titus: a Gentile pastor, on a difficult island, in a church still finding its footing, surrounded by cultural pressures and false teachers. This letter is his assignment briefing. WHY WAS THE LETTER WRITTEN? In verse 5, Paul gets right to the point: The reason I left you in Cr",
-    "keywords": [
-      "titus",
-      "episode 2",
-      "titus 2:11",
-      "introduction",
-      "background",
-      "overview",
-      "crete",
-      "letter"
-    ],
-    "createdAt": "2026-04-13T13:11:07.315Z",
-    "updatedAt": "2026-04-13T14:06:04.272Z"
-  },
-  {
-    "id": "881279c7-3ca4-436d-a584-19cc0a5a9bf3",
-    "type": "episode",
-    "title": "Episode 3 — Who Is Paul, and Why Does This Letter Exist? (Titus 1:1– 4)",
-    "content": "SERVANT AND APOSTLE Let’s start by reading Titus Chapter 1 Verses 1-4 I am reading from The Berean Standard Bible ( BSB) . 1 Paul, a servant of God and an apostle of Jesus Christ for the faith of God’s elect and their knowledge of the truth that leads to godliness, 2 in the hope of eternal life, which God, who cannot lie, promised before time began. 3 In His own time He has made His word evident in the proclamation entrusted to me by the command of God our Savior. 4 To Titus, my true child in our common faith: Grace and peace from God the Father and Christ Jesus our Savior. Paul opens with two words to describe himself: servant and apostle. The order matters, and the pairing is intentional. Apostle is a word of authority — a commissioned representative sent with the full weight of the sender’s backing behind them. Paul is saying: I speak on behalf of Jesus Christ. What I write carries weight. But before he says apostle, he says servant. In the Greek, the word is doulos (doo'- los ) — bondservant – a person who chooses to be a servant one who belongs entirely to another. Paul is saying: before anything else, I am owned. Everything I do flows from submission to the God I serve. This combination — servant and apostle — is a picture of what healthy spiritual authority looks like. It is never raw power. It is authority that comes from below — from a posture of submission — exercised in service, not dominance. Paul is modeling for Titus, right here in the opening line, what it looks like to lead. You don’t choose between humility and authority. You hold both. At the same time. TRUTH THAT LEADS TO GODLINESS In verse 1, Paul describes his mission as being for “the faith of God’s elect and their knowledge of the truth that leads to godliness.” That last phrase is the key: truth that leads to godliness. Paul is not interested in truth for its own sake — collecting correct theological propositions the way some people collect rare books, impressive on the shelf but never actually read. For Paul, truth has a direction. Truth moves. Truth produces something. What does it produce? Godliness. A life shaped by what it believes. This is the big theme of the entire letter — sound doctrine and transformed living are not separate categories. They are inseparable. The truth you know should be shaping the way you live. If it isn’t — if your theology is just mental furniture — something has gone wrong. BEFORE TIME BEGAN Now we get to one of the most stunning phrases in the entire letter. Verse 2: …in the hope of eternal life, which God, who cannot lie, promised before time began. Before time began. Let that land for a second. Paul is saying that the plan of salvation was not an afterthought. It was not Plan B. It was not God improvising a rescue after the fall. It was a promise made before the universe existed. Before the first atom, the first star, the first breath — God had already determined to save a people for Himself. And notice what Paul says about the God who made that promise: He cannot lie. Not He does not lie. He cannot lie. It is outside His nature. It is impossible. That means the promise of eternal life is not hanging on your faithfulness, or your feelings, or whether you had a good week. It is hanging on the character of a God who is constitutionally incapable of breaking His word. For Titus, laboring on a difficult island with a struggling church and real opposition — this is the ground he stands on. Not his own strength. The unchangeable promise of an undeceivable God. ENTRUSTED BY COMMAND Verse 3 adds one more layer to Paul’s self-understanding: …In His own time He has made His word evident in the proclamation entrusted to me by the",
-    "keywords": [
-      "titus",
-      "episode 3",
-      "titus 1:1– 4",
-      "titus 1:1",
-      "paul",
-      "does",
-      "this",
-      "letter",
-      "exist"
-    ],
-    "createdAt": "2026-04-13T13:11:07.347Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "e0ad268f-2826-41a5-b078-90f90aeda21b",
-    "type": "episode",
-    "title": "Episode 4 — What Does a Faithful Leader Look Like? (Titus 1:5–9)",
-    "content": "WHY ELDERS FIRST? Remember where we are in the letter. Paul has just finished his opening and the very first practical instruction he gives Titus is this: The reason I left you in Crete was that you would set in order what was unfinished and appoint elders in every town, as I directed you. Appoint elders. That’s the first thing. Because a church without mature, qualified leadership is vulnerable. Think of it this way: Paul had planted the gospel in Crete, and people had come to faith. But a collection of new believers without shepherds is like a flock without a shepherd — it can survive for a season, but it will eventually scatter or get picked off. Leadership is not bureaucracy. In Paul’s vision, it’s protection. It’s structure that allows the gospel to take root across generations. Titus’s first assignment is to build the infrastructure that makes everything else possible. VERSE 6: THE HOUSEHOLD QUALIFICATION Before Paul moves to the broader character portrait in verses 7 and 8, he pauses in verse 6 to say something about the elder’s household. It’s easy to read past it. Don’t. An elder must be blameless, the husband of but one wife, having children who are believers and who are not open to accusation of indiscretion or insubordination. The elder’s home is exhibit A. His marriage, his children, the atmosphere of his household — these are not private matters separate from his fitness to lead. They are the primary evidence of it. Think about what Paul is saying. Before Titus looks at a man’s preaching or his public presence, he should look at his home. Is his marriage marked by faithfulness? Are his children — the people who know him best, who cannot be impressed or deceived — living in a way that reflects what he believes? Paul’s logic is plain: if a man cannot lead his own household well, there is no reason to believe he will lead God’s household well. The church is not a stage where a person performs. It is a family — and family life requires the same qualities at home and at the pulpit. Integrity cannot be compart - mentalized. This isn’t a demand for perfection — Paul is not saying an elder must have flawless children. He says they must not be open to accusation of wild living or insubordination. The standard is a household genuinely ordered by the same faith the elder proclaims. ELDER AND OVERSEER: TWO WORDS, ONE ROLE In verses 5 through 7, Paul uses two words interchangeably: elder and overseer. Elder — presbyteros — carries the idea of maturity and respect. It speaks to someone the community looks to for wisdom. Overseer — episkopos — is more functional. It means one who watches over, who takes responsibility for the welfare of others. It emphasizes the work of the role. Together they give us the full picture. The person leading a local church is someone who is mature in faith AND active in oversight. Not just respected but responsible. Not just experienced but engaged. THE FIVE ‘NOTS’ AND THE POSITIVES In verses 7 and 8, Paul gives Titus a remarkably specific list. Let’s read them: As God’s steward, an overseer must be above reproach—not self-absorbed, not quick-tempered, not given to drunkenness, not violent, not greedy for money. Five things an elder must not be: not self-absorbed, not quick-tempered, not given to drunkenness, not violent, not greedy for money. Then in verse 8, six things he must be: Hospitable — someone whose home and life are genuinely open to others. A lover of good — someone drawn toward what is right and true and beautiful. Self-controlled — someone who governs their own desires and impulses. Upright — someone whose dealings with others are fair and straight. Holy — someon",
-    "keywords": [
-      "titus",
-      "episode 4",
-      "titus 1:5–9",
-      "titus 1:5",
-      "what",
-      "does",
-      "faithful",
-      "leader",
-      "look",
-      "like"
-    ],
-    "createdAt": "2026-04-13T13:11:07.369Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "56626549-7e1e-4564-8c79-2d21b49eb911",
-    "type": "episode",
-    "title": "Episode 5 — The Danger of Empty Words (Titus 1:10–13a)",
-    "content": "WHO WERE THE CIRCUMCISION GROUP? Paul identifies the primary troublemakers in verse 10: For many are rebellious and full of empty talk and deception, especially those of the circumcision, “Those of the circumcision” refers to some of the Jewish Christians — or people who were influenced by Jewish tradition — they were insisting that Gentile believers needed to follow the Mosaic law in addition to having faith in Christ. The specific issue was circumcision — but it stood for a whole system. The argument was essentially: Jesus is necessary, but not sufficient. You also need the law, Jewish customs, certain food regulations, certain rituals. For Paul, this was not a secondary debate. It was a direct attack on the gospel itself. The moment you add requirements to grace, you have changed what grace is. Paul’s entire ministry was grounded in one truth: salvation comes through Christ alone. Jesus’ life, death, and resurrection are fully sufficient. Nothing needs to be added. Faith in Jesus is all that is required to be reconciled to God. THREE GREEK WORDS In verse 10, Paul uses three Greek words to describe these teachers, and each one is precise. ἀνυπότακτος ( any - potak - tos ) — rebellious. Literally not submitted, not under authority. These people have placed themselves outside accountability. ματαιολόγος ( mata - io - logos ) — full of empty talk. Combines mata - ios (empty, vain) with logos (word). Religious noise without substance. φρεναπάτης ( phren - a - patēs ) — deception. Literally one who deceives the mind. Not just wrong content — distorting the way a person thinks from the inside. Rebellious. Empty talkers. Mind-deceivers. These aren’t accidental mistakes . These are people actively leading others in the wrong direction. Paul wants Titus to see them clearly. UNDERMINING ENTIRE HOUSEHOLDS Verse 11 tells us the scale of the damage: …who must be silenced. For the sake of dishonorable gain, they undermine entire households and teach things they should not. Whole families ! In the first-century world, the household was the basic unit of society. Churches met in homes. Faith was practiced in families. When a false teacher reshaped what a household believed, the damage spread through every relationship in that home. And notice the motive Paul names: dishonorable gain. These teachers weren’t doing this out of sincere conviction. They were doing it for money. For influence. For the advantages that came from building a following. That’s the pastoral warning. Not everyone who teaches with confidence is teaching the truth. In the Garden of Eden, Satan spoke convincingly while distorting what God had said. And not everyone who sounds sincere is free from self-interest. WHY PAUL QUOTES EPIMENIDES In verse 12, Paul quotes a Cretan poet — Epimenides — who said: “Cretans are always liars, evil beasts, lazy gluttons.” And then in verse 13 Paul adds: This testimony is true. Therefore rebuke them sternly, so that they will be sound in the faith This has confused readers for centuries. Is Paul endorsing ethnic stereotyping? No. He is engaged in ministry that takes context into account. He’s saying to Titus: the culture you’re working in has certain well-known tendencies. O ne of their own poets — said so. This isn’t about ethnicity; it’s about a specific cultural pattern of dishonesty that the false teachers were both shaped by and exploiting. Paul isn’t writing off Crete. He’s telling Titus to go in with eyes open. Know where you are. Know what you’re working against. REBUKE AS AN ACT OF LOVE Verse 13 also contains an instruction that modern ears often s",
-    "keywords": [
-      "titus",
-      "episode 5",
-      "titus 1:10",
-      "danger",
-      "empty",
-      "words",
-      "false",
-      "teacher",
-      "titus 1:13"
-    ],
-    "createdAt": "2026-04-13T13:11:07.396Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "dd6b3af4-44a5-43f1-9d69-ab12c63dd46d",
-    "type": "episode",
-    "title": "Episode 6 — Words That Deny What We Claim to Believe (Titus 1:13b–16)",
-    "content": "A DEFILED CONSCIENCE AND A DISTORTED WORLD Verse 15 contains one of the most psychologically precise statements in all of Paul’s letters: To the pure, all things are pure; but to the defiled and unbelieving, nothing is pure. Indeed, both their minds and their consciences are defiled. A person with a clean conscience — someone whose heart has been washed by the gospel — can engage with the world from a place of trust and clarity. But a person whose conscience is defiled — corrupted by sin, self-deception, or bad doctrine — can’t see anything clearly. Everything gets filtered through that corruption. Even what is pure looks suspect to them. This is why false teaching is so damaging at the root level. It doesn’t just change what people believe — it changes how they see. Think about what that looks like practically. A person shaped by bad doctrine doesn’t just hold wrong opinions — they become suspicious of grace, hostile toward correction, and unable to receive what is genuinely good. They see generosity and call it ingenuousness . They see freedom and call it license. The very gifts of the gospel become things they can’t trust, because the lens they’re looking through has been cracked. That’s the devastation Paul is describing — not just theological error, but a person who has lost the ability to see clearly. JEWISH MYTHS AND COMMANDS OF MEN Verse 14 tells us specifically what these false teachers were promoting — Jewish myths and the commands of people who have rejected the truth. Jewish myths likely refers to speculative expansions of Old Testament stories. Commands of men refers to human-made religious rules elevated to the level of divine requirement. And here’s why Paul sees this as a gospel issue: when you add human requirements to the gospel, you shift the basis of acceptance before God from what Christ has done to what you do. The result is a Christianity more anxious, more performance-driven, more focused on the maintenance of rules than on the freedom of grace. We should be honest that this isn’t only a first-century problem. The “commands of men” show up in modern dress all the time — in churches that quietly teach that real Christians hold certain political views, in communities where your worth is measured by how often you volunteer, how much you give, or whether you use the right vocabulary. None of those things are bad in themselves. But the moment they become the measure of your standing before God, the gospel has been displaced. Paul’s warning is just as sharp now as it was in Crete. DETESTABLE, DISOBEDIENT, UNFIT Verse 16 ends with a devastating summary: They profess to know God, but by their actions they deny Him. They are detestable, disobedient, and unfit for any good deed. Three words. Detestable. Disobedient. Unfit for any good deed. The first word Paul uses - Detestable - describes something morally repulsive — something unacceptable before God . It’s the same kind of word the Old Testament used for things that were considered abominations. In other words, these teachers may look religious on the outside, but in God’s sight their teaching and conduct are deeply offensive. The second word - Disobedient - describes someone who is not persuadable — someone resistant to truth . Not merely confused, but unwilling to submit when confronted with what is right. They have heard the truth, but they refuse to bend their lives to it. The third word – is a phrase in English but is one word in Greek - Unfit for any good deed - This comes from the world of metalworking . It refers to metal that has been tested , examined and discovered to be counterfeit — rejected because it lacks real substance. That’s the picture Paul is painting: religious appearance on the surface, but wh",
-    "keywords": [
-      "titus",
-      "episode 6",
-      "titus 1:13",
-      "deny",
-      "claim",
-      "believe",
-      "titus 1:16"
-    ],
-    "createdAt": "2026-04-13T13:11:07.417Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "1559c4af-3913-4a0d-9ac3-a59172adabc5",
-    "type": "episode",
-    "title": "Episode 7 — Sound Doctrine for Every Stage of Life (Titus 2:1–10)",
-    "content": "THE PIVOT FROM WARNING TO VISION Chapter 1 was about threats — the things that were wrong, the people causing damage, the patterns that needed to be stopped. It was a necessary chapter. You can’t build well if you haven’t cleared the ground. Chapter 2 is about vision. Not what are we against, but what are we for. Not just what does sound doctrine forbid, but what does it produce? And what it produces is a community that looks different. Every generation investing in the next. Older believers modeling what long faithfulness looks like. Younger believers learning to bring their appetites and ambitions under the direction of the gospel. Workers whose ordinary faithfulness makes the gospel attractive. This is not a vision of individual spiritual achievement. It is a vision of intergenerational community shaped by grace. OLDER MEN Verse 2 describes what Paul wants Titus to cultivate in older men: Older men are to be temperate, dignified, self-controlled, and sound in faith, love, and perseverance. Four qualities of character, and three qualities of soul. Temperate. Dignified. Self-controlled. These describe a man who has learned — through years of walking with God and being humbled by life — to govern himself. And then: sound in faith, love, and perseverance. Faith that hasn’t grown cynical. Love that hasn’t grown cold. Perseverance that hasn’t given up. The older man who embodies these qualities is not just personally virtuous — he is a witness. He shows the younger generation that it is possible to follow Jesus for decades and still be full of faith, still warm in love, still standing. That’s a gift no sermon can replace. OLDER WOMEN AND YOUNGER WOMEN Verses 3 through 5 describe older women and their specific role in the life of younger women: Older women, likewise, are to be reverent in their behavior, not slanderers or addicted to much wine, but teachers of good. In this way they can train the young women to love their husbands and children, to be self-controlled, pure, managers of their households, kind, and submissive to their own husbands, so that the word of God will not be discredited. The older women Paul describes are not passive. They are reverent — a word used elsewhere for temple service, suggesting a life of sacred intentionality. They are not slanderers. They are not addicted to much wine. They are self-governing. And their primary ministry is to teach younger women. The Greek word for train here — sophronizō — is about forming wisdom and good judgment in someone else. This is not advice-giving. This is mentorship. Investment. One life poured into another. And the reason Paul gives for all of it is stunning: so that the word of God will not be discredited. The way the women in this congregation live their ordinary lives either adorns the gospel or brings it into disrepute. Their faithfulness is a form of witness. YOUNGER MEN AND TITUS HIMSELF The section on younger men is the shortest in the passage. Verse 6: “In the same way, urge the younger men to be self-controlled.” That’s it. One charge. And then Paul immediately turns to Titus in verse 7: In everything, show yourself to be an example by doing good works. In your teaching show integrity, dignity, The connection is important. The best thing Titus can do for the younger men is not give them a list. It’s show them a life. Paul uses the word typos — a pattern, a mold. Titus himself is to be the shape that younger men are formed around. Self-control is not a naturally occurring quality in young men. It has to be learned. And it is learned most effectively not from a lecture but from a model. ADORNING THE GOSPEL [This is the capstone i",
-    "keywords": [
-      "titus",
-      "episode 7",
-      "titus 2:1–10",
-      "titus 2:1",
-      "sound",
-      "doctrine",
-      "every",
-      "stage",
-      "life"
-    ],
-    "createdAt": "2026-04-13T13:11:07.441Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "6be7a644-9276-4797-a7bb-1422b170846c",
-    "type": "episode",
-    "title": "Episode 8 — Grace Is Not Just What Saves You — It’s What Trains You (Titus 2:11–12)",
-    "content": "GRACE AS TEACHER: THE GRAMMAR MATTERS Let’s read verses 11 and 12 carefully: For the grace of God has appeared, bringing salvation to everyone. It instructs us to renounce ungodliness and worldly passions, and to live sensible, upright, and godly lives in the present age, Now — look at the grammar of verse 12. The subject of the sentence is ‘it.’ And ‘it’ refers back to grace. Grace instructs us. Grace is the subject. Grace is doing the teaching. The Greek word Paul uses is paideuō — the word for the education of a child. Not classroom instruction. Formation. The kind of learning that shapes not just what you know but who you are. Grace is the tutor. And the curriculum it’s teaching has two parts: what to say no to, and what to say yes to. WHAT GRACE TEACHES US TO SAY NO TO Grace teaches us to renounce two things: ungodliness and worldly passions. Ungodliness — asebeia — is the opposite of reverence. A life where God is not actually at the center. Where decisions are made without reference to Him. Worldly passions — desires shaped by the age we live in rather than the kingdom we’ve been brought into. And here’s what I want you to notice: Paul doesn’t say that moral effort teaches us to renounce these things. He says grace teaches us. The pathway to saying no to ungodliness is going deeper into grace — understanding more fully what you have been given. Grace, properly understood, reorients your desires. It doesn’t just change the rules. It changes what you want. WHAT GRACE TEACHES US TO SAY YES TO On the other side, grace teaches three orientations: sensible, upright, and godly. Sensible — sōphrōn — a sound, well-ordered mind. Not repressed. Not uptight. But governed. A person whose interior life is ordered enough that they can engage with the world without being swept away by it. Upright — dikaios — right in relationship with others. Fair. Honest. The gospel changes how we treat people because it has changed how we understand our own standing before God. Godly — eusebōs — living with genuine reverence. A life where God is actually at the center, not just in stated belief, but in the practical orientation of each day. Inward (sensible), outward (upright), and upward (godly). Grace reshapes the whole person. THE KEY WORD: CHARIS The Greek word for grace is charis — χάρις. It appears in the opening greeting (1:4) and in the closing benediction (3:15), bookending the entire letter. Charis means unmerited favor. A gift freely given with no precondition of worthiness. But Paul uses it here as a teacher — it initiates AND sustains. The grace that started the work in you is the same grace that is continuing it. This is why trying harder without grace fails. Moral effort without a gospel foundation is white-knuckle religion. And this is also why grace without obedience is incomplete. Grace is so powerful that it actually produces change. If it’s not producing anything in your life, Paul would want to ask whether you’ve actually encountered it. DISCUSSION QUESTIONS Three questions to carry this week: 1. In what ways is grace a teacher? How does understanding what God has freely given change your motivation for how you live? 2. What’s the difference between obeying out of fear or duty versus obeying as a response to grace? What does that difference feel like from the inside? 3. Where do you find it hardest to say no to ungodliness — and what role does grace actually play there, in your honest experience? ✦ CLOSING Grace is not a hall pass for how you live. It is a school you attend every day. The same grace that declared you forgiven is act",
-    "keywords": [
-      "titus",
-      "episode 8",
-      "titus 2:11–12",
-      "titus 2:11",
-      "grace",
-      "just",
-      "what",
-      "saves",
-      "trains"
-    ],
-    "createdAt": "2026-04-13T13:11:07.461Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "4e6ec41f-b083-45b9-9581-0dc91f092f66",
-    "type": "episode",
-    "title": "Episode 9 — Living Between Two Appearings (Titus 2:13–15)",
-    "content": "THE THREE TIMEFRAMES Verse 11: “For the grace of God has appeared.” Past tense. The first appearing. The foundation. Verse 12: “…to live sensible, upright, and godly lives in the present age.” Present tense. The current moment. Verse 13: …as we await the blessed hope and glorious appearance of our great God and Savior Jesus Christ. Future tense. We are waiting actively, with anticipation, with our behavior shaped by what we know is coming. Past event. Present calling. Future hope. You can’t live the present well without both the foundation behind you and the horizon ahead of you. THE BLESSED HOPE Verse 13 uses a phrase that has become so familiar it has almost lost its force: the blessed hope. The Greek is makaria elpis. Makaria is the same word used in the Beatitudes — blessed, in a divinely favored condition. And elpis — hope — in the New Testament is not the way we use the word in everyday conversation. We say ‘I hope it doesn’t rain’ — meaning we’re uncertain, we’re wishing. Biblical hope is a confident expectation of something certain. Not a wish. An anchor. The blessed hope is: Jesus is coming back. Not maybe. Not eventually, probably. He is coming back. And the person who really believes that is in a blessed condition even now, living toward a certainty that changes how everything feels today. THE GOSPEL IN ONE SENTENCE Verse 14 does something remarkable. In a single sentence, Paul gives us the full scope of what Christ’s death accomplished: He gave Himself for us to redeem us from all lawlessness and to purify for Himself a people for His own possession, zealous for good deeds. Two verbs. Redeem and purify. Redeem — lytroō — a word from the slave market and from Exodus. To pay a price to set someone free. What were we freed from? All lawlessness. Purify — katharizō — from the temple. To cleanse, to make acceptable. We weren’t just released from prison — we were made clean. Belonging. And look at the end: ‘a people for His own possession, zealous for good deeds.’ The word zelotes — eager, passionate, on fire. Not reluctant. Not dragging their feet. People who are genuinely excited about doing good because they understand what they’ve been rescued for. SPEAK WITH AUTHORITY Paul closes the chapter with a charge to Titus: Speak these things as you encourage and rebuke with all authority. Let no one despise you. Speak these things. All of it — the grace, the training, the blessed hope, the gospel in one sentence. Don’t soften it. Don’t apologize for it. With all authority. Not Titus’s own authority — the authority of the message itself. The gospel doesn’t need Titus’s permission to be true. His job is to represent it faithfully and let it carry its own weight. DISCUSSION QUESTIONS Three questions for this week: 1. How does actively anticipating the return of Christ affect the way you make decisions and treat people today? Does the blessed hope feel like a real anchor in your life? 2. What does it mean to you personally that Christ ‘gave Himself’ — that it was intentional, not accidental? 3. Do you experience your Christian life as something you belong to — a people claimed by God — or mostly as something you have to maintain on your own? ✦ CLOSING We are living between two great appearings of grace. The first established the foundation. The second will complete what was begun. The in-between space is not a waiting room. It’s a mission field. We don’t pace and wait. We live — sensible, upright, godly, zealous for good deeds — shaped by what we know is coming. Next ep",
-    "keywords": [
-      "titus",
-      "episode 9",
-      "titus 2:13–15",
-      "titus 2:13",
-      "living",
-      "between",
-      "appearings"
-    ],
-    "createdAt": "2026-04-13T13:11:07.484Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "41233c63-d2b4-4fd3-9054-1afb11c37287",
-    "type": "episode",
-    "title": "Episode 10 — How the Gospel Forms a Community (Titus 3:1–2)",
-    "content": "WHY PAUL OPENS CHAPTER 3 WITH CIVIC SUBMISSION Paul is not saying: agree with every government decision. He is saying: your engagement with public life should be marked by something recognizable as different. Your submission, your readiness to do good, your peaceable presence — these are not just civic virtues. They are missionary strategies. The way the community in Crete navigates public life is either going to open doors for the gospel or close them. THREE ACTIVE ORIENTATIONS Verse 1: Remind the believers to submit to rulers and authorities, to be obedient and ready for every good work, Submit to rulers and authorities — a posture of respect toward legitimate governing structures. The believer’s default is cooperation rather than defiance. Be obedient — follow through. Actually do what is asked. People whose lives don’t create unnecessary friction with the society around them. Be ready for every good work — active, not passive. Readiness implies preparation and eagerness. The believer’s posture is not just ‘don’t cause problems.’ It’s ‘be looking for opportunities to do good.’ THE POSTURE OF BELIEVERS IN A CONFLICT-SATURATED CULTURE Verse 2 adds four more qualities: …to malign no one, and to be peaceable and gentle, showing full consideration to everyone. Malign no one. In a culture built on callouts, political attack cycles, and the steady background noise of contempt — this is genuinely countercultural. Paul doesn’t say: malign no one except your political opponents. He says no one. Peaceable — amachous — literally non-combative. Alpha (not) + machē (battle). People who are not itching for a fight, not framing every interaction as a conflict to be won. Gentle — epieikēs — gracious, not insisting on the full weight of one’s rights. Showing full consideration to everyone — not just the likable, the agreeable, the theologically correct. For all people. This is not weakness. This is the confidence of people who know how the story ends and don’t need to win every argument to prove it. DISCUSSION QUESTIONS Three questions for this week: 1. How should the gospel shape the way Christians engage with politics, authority, and public life? Where do you see the church getting this right — and where do you see it getting it wrong? 2. What does it look like to be gentle and considerate to everyone in the age of social media? What would need to change in your online presence to reflect the posture Paul describes here? 3. Where do you find it hardest to reflect the peaceable posture Paul describes? What situation or kind of person most tests your gentleness? ✦ CLOSING The gospel sends us into the world not as culture warriors, but as witnesses. The posture Paul calls for — gentle, peaceable, considerate, ready for every good work — is the confidence of people who know who they belong to and what the future holds. The confidence of people who know the King doesn’t look like aggression. It looks like peace. Next episode, before Paul gives us the gospel again in its fullest form, he gives us the diagnosis. Verse 3 is one of the most honest passages in Titus — and Paul includes himself in it. I’m Nate, and this is Verse by Verse with Nate: A Journey Through Scripture. Until next time — keep going. — End of Episode 10 —",
-    "keywords": [
-      "titus",
-      "episode 10",
-      "titus 3:1–2",
-      "titus 3:1",
-      "gospel",
-      "forms",
-      "community"
-    ],
-    "createdAt": "2026-04-13T13:11:07.506Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "6d0def21-46cb-497e-ac20-8e09c5368a08",
-    "type": "episode",
-    "title": "Episode 11 — Remember What You Were (Titus 3:3)",
-    "content": "THE ‘WE TOO WERE’ Let’s read the verse: For at one time we too were foolish, disobedient, misled, and enslaved to all sorts of desires and pleasures—living in malice and envy, being hated and hating one another. We ourselves. This is not rhetoric. This is autobiography. Paul is giving instructions on how to correct others — how to rebuke false teachers, how to call the congregation to a higher standard. And right here he stops and says: before you do any of that, remember what you were. This is the ground of Christian humility. Every time a believer looks at someone who is not yet a Christian — someone whose life is being destroyed by these very patterns — the right response is not contempt. It is recognition. I was there. I was enslaved to those same kinds of things. I didn’t save myself. I was saved. SEVEN DESCRIPTORS Paul gives us seven words for what we were before grace. Each one is precise. Foolish — anoētos — without understanding. Not unintelligent. Without the wisdom that comes from knowing God. Disobedient — apeitheis — not persuadable, resistant to truth. Misled — planōmenoi — wandering, deceived, off course. Confidently heading in the wrong direction. Enslaved to all sorts of desires and pleasures — douleuontes — serving as slaves. Not choosing. Owned by desires. Living in malice and envy — ordinary corrosive stuff — wanting what others have, being glad when they fail. Being hated and hating one another — the natural end state of a life shaped by malice and envy. Seven words for what we were. And this is not a description of the worst people in the world. This is a description of all of us, before grace. HONEST MEMORY AS A PASTORAL GIFT Why does Paul make Titus — and us — look at this? Because the people Titus is ministering to include people who are still in this condition. And it would be easy — especially for a young pastor who has been well-formed by the gospel — to look at them with spiritual impatience. To treat their condition as a problem to be solved rather than a darkness to be illuminated with compassion. Paul is cutting that off at the root. You were there. You did not extricate yourself. You were found. There is a kind of humility that only grows from honest memory. The person who genuinely remembers what they were before grace is not capable of looking down on someone who doesn’t yet have it. They are too aware of the distance grace had to travel to reach them. DISCUSSION QUESTIONS Three questions to sit with this week: 1. Why is Paul’s autobiographical ‘we’ so important here? How does remembering your own ‘before’ picture shape your attitude toward people who don’t yet know the gospel? 2. Which of the seven descriptors — foolish, disobedient, misled, enslaved, malicious, envious, hated and hating — do you most need to keep in view to stay humble? 3. How does honest self-awareness about what we were become a gift for the way we love others? Where have you seen that in practice? ✦ CLOSING Humility toward others grows from memory. We don’t look down on where people are — because we remember where we were. And we remember that we didn’t save ourselves. Grace came to us. Grace found us in the dark and brought us out. That memory is not a wound. It’s a gift. Next episode, we get the gospel in its fullest form — Titus 3:4 through 7 is one of the most concentrated and beautiful gospel summaries anywhere in the New Testament. I’m Nate, and this is Verse by Verse with Nate: A Journey Through Scripture. Until next time — keep going. — End of Episode 11 —",
-    "keywords": [
-      "titus",
-      "episode 11",
-      "titus 3:3",
-      "titus 3:4",
-      "remember",
-      "what",
-      "were"
-    ],
-    "createdAt": "2026-04-13T13:11:07.532Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "b68c5659-cc7e-42d2-ab24-a623b7404058",
-    "type": "episode",
-    "title": "Episode 12 — The Gospel in One Paragraph (Titus 3:4–7)",
-    "content": "SALVATION IS TRINITARIAN All three persons of the Trinity are present and active in our salvation. This is not accidental — Paul is showing us that the gospel is not a one-person operation. God the Father — verse 4 speaks of ‘the kindness of God our Savior and His love for mankind.’ The initiating motivation for salvation is the character of the Father. He is kind. He is full of love toward humanity. Our rescue begins in the heart of God. The Holy Spirit — verse 5 speaks of ‘the washing of new birth and renewal by the Holy Spirit.’ The Spirit is the agent of the new birth — the one who applies the work of Christ to the individual soul. Jesus Christ — verse 6 names Him explicitly as the one through whom the Spirit is poured out, and verse 7 calls Him ‘our Savior.’ Father, Son, Spirit — each person fully present, each playing a distinct role, all working together in the single act of saving a person. This is not just theology. It is the shape of your own story. NOT BY OUR DEEDS: MERCY, NOT MERIT Verse 5 contains one of the most explicit denials of works-based salvation in the New Testament: But when the kindness of God our Savior and His love for mankind appeared, He saved us, not by the righteous deeds we had done, but according to His mercy, through the washing of new birth and renewal by the Holy Spirit. Not by the righteous deeds we had done. Not partially. Not mostly. The basis of salvation is not our righteousness. It is His mercy. The theological term for this is monergism — salvation as a single-agent work. God does the saving. We receive it. There was nothing in the raw material that deserved rescue. The rescue happened anyway, because of mercy. And why does this matter so much? Because if salvation is even one percent based on our merit, it is unstable. But if salvation is entirely based on God’s mercy — on the character of a God who cannot lie and who loved humanity enough to appear as a human and die — then it rests on something that cannot change. NEW BIRTH AND RENEWAL Verse 5 gives us two words for what the Spirit does in us: the washing of new birth and renewal. Washing of new birth — palingenesia — literally ‘again-genesis.’ A new beginning. A second creation. This is the moment the Spirit brings a spiritually dead person to life. A definitive event. A before-and-after. Renewal by the Holy Spirit — anakainōsis — ongoing work. Continuous present tense in the Greek. The Spirit who brought you to life at regeneration is also continually renewing you. Both are needed. New birth without renewal produces a static faith. Renewal without new birth produces endless effort without a genuine starting point. Both are the Spirit’s work. Your part is to cooperate with what He is already doing. JUSTIFIED AND HEIRS Verse 7 adds two more categories: This is the Spirit He poured out on us abundantly through Jesus Christ our Savior, so that, having been justified by His grace, we would become heirs with the hope of eternal life. Justified — dikaiōthentes — a courtroom term. To be declared righteous. Not to be made righteous in our behavior — but declared righteous in our standing. The verdict rendered over you in the courtroom of God is: not guilty. Accepted. Righteous in Christ. Heirs — klēronómoi — relational. An heir belongs to a family. Has a place at the table. Has a guaranteed share in the inheritance. You are not just legally acquitted. You are a member of the family. The eternal life promised before time began is not a prize you might win. It is an inheritance secured for you. DISCUSSION QUESTIONS Three questions for this week: 1. Why is it so hard for people — including long-time Christians — to fully accept that salvation is en",
-    "keywords": [
-      "titus",
-      "episode 12",
-      "titus 3:4–7",
-      "titus 3:4",
-      "gospel",
-      "paragraph"
-    ],
-    "createdAt": "2026-04-13T13:11:07.554Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "c8db1a86-346f-4bad-ba4f-30c29d95feb3",
-    "type": "episode",
-    "title": "Episode 13 — What Happens After the Gospel Takes Root (Titus 3:8–11)",
-    "content": "THE FAITHFUL SAYING Verse 8: This saying is trustworthy. And I want you to emphasize these things, so that those who have believed God will take care to devote themselves to good deeds. These things are excellent and profitable for the people. Pistos ho logos — this saying is trustworthy. Paul uses this formula in his letters to Timothy and Titus to mark something as having the highest doctrinal weight. What he just said in verses 4 through 7 is the trustworthy, reliable, foundational word. Bank on it. Build on it. And then immediately: the expected outcome. Those who have believed God will take care to devote themselves to good deeds. The test of the gospel having taken root is not doctrinal sophistication. It is practical devotion to good works. PROFITABLE VS. POINTLESS AND WORTHLESS Verse 9: But avoid foolish controversies, genealogies, arguments, and quarrels about the law, because these things are pointless and worthless. Profitable — ōphélima. Pointless and worthless — anōphelēs and mataioi. The contrast is total. Good works produce something. They are excellent — kalá — beautiful, genuinely valuable. They benefit people. They demonstrate the gospel in tangible ways. Foolish controversies, on the other hand, produce nothing. They generate heat but no light. They create factions but no fruit. The test Paul applies is not: is this interesting? Is this theologically sophisticated? The test is: does engaging with this produce anything? Does it make people more devoted to good works? SOUND DOCTRINE PRODUCES GOOD WORKS Let me name the thread Paul has been pulling through this entire letter, because we’re near the end and it is clearer here than anywhere else. From chapter 1, verse 1: truth that leads to godliness. Elders who hold firmly to sound doctrine. False teachers whose lives deny what they claim to believe. Chapter 2: grace that instructs us to live sensible, upright, godly lives. Ordinary faithfulness that adorns the gospel. Chapter 3: people who have believed God devoting themselves to good deeds. The thread is this: sound doctrine and transformed living are not separate categories. Doctrine is the seed. Good works are the fruit. You cannot have genuine doctrine without eventual fruit, and you cannot sustain genuine good works without doctrinal roots. THE DIVISIVE PERSON: TWO WARNINGS, THEN REJECTION Verses 10 and 11: Reject a divisive man after a first and second admonition, knowing that such a man is corrupt and sinful; he is self-condemned. Two warnings. Not immediate removal. Not endless patience. Two warnings. One warning is not enough — it doesn’t give the person a genuine chance to respond. The second warning is confirmation that the first was heard and not responded to. After two warnings with no change — have nothing more to do with him. And Paul’s assessment: self-condemned. The verdict is not coming from the outside. The person who persists in division after two clear warnings has essentially condemned themselves by their own choices. The community is simply recognizing what is already true. This is not cruelty. It is honesty. And it protects the people who are being divided. DISCUSSION QUESTIONS Three questions for this week: 1. Why is good theology supposed to produce good deeds — and what happens in a person or a church when doctrine and life become disconnected from each other? 2. What kinds of theological discussions do you think fall into Paul’s ‘pointless and worthless’ category today? How do you tell the difference between a discussion worth having and one that just generates heat? 3. Why does Paul prescribe two warnings rather than immediate removal or endless patience for divisive people? What does that process protect? ✦ CLOSING [Grounde",
-    "keywords": [
-      "titus",
-      "episode 13",
-      "titus 3:8–11",
-      "titus 3:8",
-      "what",
-      "happens",
-      "after",
-      "gospel",
-      "takes",
-      "root"
-    ],
-    "createdAt": "2026-04-13T13:11:07.582Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "14ced988-1382-4c8d-a29e-b0f531580af1",
-    "type": "episode",
-    "title": "Episode 14 — Grace: Where It Starts and Where It Ends (Titus 3:12–15)",
-    "content": "REAL PEOPLE IN A REAL COMMUNITY Verses 12 through 14 name four people: Artemas, Tychicus, Zenas the lawyer, and Apollos. Tychicus appears in several of Paul’s letters as a trusted messenger. Apollos is mentioned in Acts and 1 Corinthians as a gifted teacher. Zenas is only mentioned here. Artemas we know nothing about beyond this verse. Why does Paul name them? Because the gospel travels through people. Not as an abstract idea floating through the air, but carried by specific men and women who have been changed by it and who are willing to take it somewhere difficult at personal cost. Titus is not alone on Crete. He is part of a network. The church in the first century was a community of people in motion — bound together by a shared gospel and a shared Lord. That is still how it works. DEVOTED TO GOOD WORKS TO MEET PRESSING NEEDS Verse 14: And our people must also learn to devote themselves to good works in order to meet the pressing needs of others, so that they will not be unfruitful. Two things worth noticing. First: let our people learn. Devotion to good works has to be cultivated, practiced, formed over time. It doesn’t just happen because you believe the right things. Second: to meet the pressing needs of others. The word is anagkaias — necessary, pressing, urgent. Paul is not describing optional generosity. He is describing a community that has made itself available for the real needs that arise around it. And the consequence of not doing this: be unfruitful. The gospel that has been received and believed and proclaimed — if it doesn’t produce this kind of practical, neighbor-serving fruit — something is missing. GRACE AS BOOKEND Let’s look at the two times grace appears at the frame of this letter. Titus 1:4 — the opening: “Grace and peace from God the Father and Christ Jesus our Savior.” In the opening, grace is the origin. It comes from God and from Christ. It is something received, given from outside, descending as pure gift. Titus 3:15 — the closing: “Grace be with all of you.” In the closing, grace is the blessing. It is what Paul wants them to be with — not wealth, not safety, not resolved problems. Grace. Everything that happens between those two bookends flows from the first grace and points toward the second. The elders who lead well are stewards of grace. The community formed generation by generation is shaped by grace. The gospel paragraph is the concentrated statement of grace. The good works that follow are the fruit of grace. Grace is not a footnote in Titus. It is the frame. It is the air the letter breathes. THE LETTER’S ONE COHERENT VISION Let me take you through the structure of the letter one final time. Chapter 1 — Leadership. Establish qualified elders. The elder who holds firmly to sound doctrine is the church’s first line of protection. Character is not the entry point for leadership — it is the definition of it. Chapter 2 — Community Formation. Every generation — older men, older women, younger women, younger men, enslaved people — is addressed. Grace instructs. Grace trains. Grace produces a particular kind of life in every stage and every situation. Chapter 3 — Civic and Social Life. Engage with submission, with gentleness, with readiness to do good. Remember what you were. The same grace that found you is the grace you are carrying to others. Three chapters. One vision. Sound doctrine and godly living are inseparable. What you believe should shape how you live. And the whole thing is held together by the grace that started it and the grace that will complete it. DISCUSSION QUESTIONS Three final questions — take your tim",
-    "keywords": [
-      "titus",
-      "episode 14",
-      "titus 3:12",
-      "titus 1:4",
-      "titus 3:15",
-      "grace",
-      "starts",
-      "ends",
-      "review"
-    ],
-    "createdAt": "2026-04-13T13:11:07.605Z",
-    "updatedAt": "2026-04-13T14:06:04.273Z"
-  },
-  {
-    "id": "cb_faith_family_001",
-    "type": "qa",
-    "title": "How can I share my faith with skeptical family?",
-    "content": "Lead with relationship, not argument. Skeptical family members usually don't need more information — they need to see the faith lived out genuinely. Consistency, love, and patience over time speaks louder than any debate win.\n\nPray specifically and persistently. This is the most underrated strategy. God moves hearts in ways arguments never can.",
-    "keywords": [
-      "faith",
-      "family",
-      "skeptical",
-      "share",
-      "relationship",
-      "evangelism",
-      "prayer",
-      "witness",
-      "unbeliever",
-      "argument",
-      "patience",
-      "love"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_blessed_hope_001",
-    "type": "qa",
-    "title": "What is the blessed hope?",
-    "content": "The blessed hope is a phrase from Titus 2:13 — \"as we await the blessed hope and glorious appearance of our great God and Savior Jesus Christ.\" In Episode 9, Nate breaks down the Greek: makaria elpis. Makaria is the same word used in the Beatitudes — a divinely favored condition. And elpis in the New Testament is not wishful thinking. Biblical hope is a confident expectation of something certain. Not a wish. An anchor.\n\nThe blessed hope is simply this: Jesus is coming back. Not maybe. He is coming back. And the person who really believes that is in a blessed condition even now, living toward a certainty that changes how everything feels today.",
-    "keywords": [
-      "blessed hope",
-      "titus 2:13",
-      "second coming",
-      "return of Christ",
-      "hope",
-      "appearing",
-      "makaria",
-      "elpis",
-      "anchor",
-      "future",
-      "episode 9"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_who_is_titus_001",
-    "type": "qa",
-    "title": "Who was Titus?",
-    "content": "Titus was a Gentile — not Jewish — who came to faith through Paul's ministry. Paul calls him \"my true child in our common faith\" (Titus 1:4). He was one of Paul's closest and most trusted co-workers. In 2 Corinthians 7, Paul describes being comforted by Titus arriving during a difficult season. In chapter 8, Titus helped organize a relief offering for believers in Jerusalem. In Galatians 2, he appears as proof that the gospel is for everyone.\n\nPaul left Titus on the island of Crete with a difficult assignment: appoint elders, correct false teaching, and help a young church find its footing in a challenging culture. The letter of Titus is essentially his briefing.",
-    "keywords": [
-      "titus",
-      "who is titus",
-      "gentile",
-      "paul",
-      "co-worker",
-      "crete",
-      "new testament",
-      "biography",
-      "history",
-      "faith"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_deny_works_001",
-    "type": "qa",
-    "title": "What does it mean to deny God by your works?",
-    "content": "Titus 1:16 says: \"They profess to know God, but by their actions they deny Him. They are detestable, disobedient, and unfit for any good deed.\"\n\nIn Episode 6, Nate explains this using three precise words Paul chose. Detestable — morally repulsive before God, regardless of religious appearance. Disobedient — not persuadable, resistant to truth even when confronted with it. Unfit — a Greek metalworking term for metal tested and found counterfeit. Religious on the surface, but no real substance underneath.\n\nThe warning cuts both ways: a person can know the right words, attend the right services, hold the right opinions — and still live in a way that functionally says God doesn't matter. Theology and life are inseparable. What you actually believe will show itself in how you actually live.",
-    "keywords": [
-      "deny god",
-      "works",
-      "titus 1:16",
-      "detestable",
-      "disobedient",
-      "unfit",
-      "profess",
-      "actions",
-      "hypocrisy",
-      "false teaching",
-      "episode 6"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_grace_trains_001",
-    "type": "qa",
-    "title": "What does grace actually train us to do?",
-    "content": "Titus 2:11-12 says grace \"instructs us to renounce ungodliness and worldly passions, and to live sensible, upright, and godly lives.\"\n\nIn Episode 8, Nate points out that the Greek word for instructs is paideuō — the education of a child. Not classroom instruction but formation. Grace is the subject doing the teaching.\n\nGrace teaches two things: what to say no to (ungodliness and worldly passions) and what to say yes to — sensible (an ordered mind), upright (right in relationship with others), and godly (God genuinely at the center). Inward, outward, and upward.\n\nThe key insight: the pathway to saying no to sin is going deeper into grace, not trying harder. Grace properly understood reorients your desires — it doesn't just change the rules, it changes what you want. Grace is not a hall pass. It's a school you attend every day.",
-    "keywords": [
-      "grace",
-      "trains",
-      "titus 2:11",
-      "titus 2:12",
-      "paideuō",
-      "ungodliness",
-      "sensible",
-      "upright",
-      "godly",
-      "obedience",
-      "formation",
-      "episode 8"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_leadership_titus1_001",
-    "type": "qa",
-    "title": "What does Titus 1 teach about church leadership?",
-    "content": "Paul's first instruction in Titus was to appoint elders — because a church without mature, qualified leadership is vulnerable. From Episode 4 (Titus 1:5-9):\n\nThe elder's home is exhibit A. Before looking at preaching or public presence, look at the household. If a man cannot lead his own family well, there's no reason to believe he'll lead God's family well. Integrity can't be compartmentalized.\n\nPaul gives five things an elder must NOT be: not self-absorbed, not quick-tempered, not given to drunkenness, not violent, not greedy. And six things he must BE: hospitable, a lover of good, self-controlled, upright, holy, and disciplined in sound doctrine.\n\nThis is not a job description for a CEO. Nate frames it as a picture of Christlike character — authority that flows from below, from a posture of submission and service, not dominance.",
-    "keywords": [
-      "leadership",
-      "elder",
-      "overseer",
-      "titus 1:5",
-      "titus 1:6",
-      "titus 1:7",
-      "titus 1:9",
-      "church",
-      "pastor",
-      "qualify",
-      "character",
-      "household",
-      "episode 4"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_titus347_summary_001",
-    "type": "qa",
-    "title": "Give me a summary of Titus 3:4-7",
-    "content": "Titus 3:4-7 is what Nate calls 'the gospel in one paragraph' — one of the most concentrated summaries of salvation anywhere in Paul's letters. Episode 12 breaks it down:\n\nAll three persons of the Trinity are present: God the Father is the initiating motivation — He is kind and full of love toward humanity. The Holy Spirit is the agent of new birth and ongoing renewal. Jesus Christ is the one through whom the Spirit is poured out, and verse 7 calls him 'our Savior.'\n\nThe hinge of the passage is verse 5: He saved us not by the righteous deeds we had done, but according to His mercy. Not partially. Not mostly. The basis is His mercy, not our merit — which means salvation rests on something that cannot change.\n\nVerse 7 gives us two results: justified (declared righteous in God's courtroom) and heirs (members of the family with a guaranteed inheritance). You are not just legally acquitted — you belong.",
-    "keywords": [
-      "titus 3:4",
-      "titus 3:4-7",
-      "titus 3:7",
-      "summary",
-      "gospel",
-      "mercy",
-      "salvation",
-      "trinity",
-      "justified",
-      "heirs",
-      "new birth",
-      "renewal",
-      "holy spirit",
-      "episode 12"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  },
-  {
-    "id": "cb_christians_politics_001",
-    "type": "qa",
-    "title": "How should Christians engage with politics and public life?",
-    "content": "Titus 3:1-2 is Paul's answer, covered in Episode 10. He tells Titus to remind believers to submit to rulers and authorities, be obedient, be ready for every good work, malign no one, and be peaceable, gentle, and considerate to everyone.\n\nNate's key insight: Paul is not saying agree with every government decision. He's saying your engagement with public life should be marked by something recognizable as different. Submission, readiness to do good, and a peaceable presence are not just civic virtues — they are missionary strategies. The way you navigate public life either opens doors for the gospel or closes them.\n\nThe word for peaceable in Greek is amachous — literally non-combative. Paul doesn't say malign no one except your political opponents. He says no one. This is not weakness. It is the confidence of people who know how the story ends and don't need to win every argument to prove it.",
-    "keywords": [
-      "politics",
-      "government",
-      "Christians",
-      "public life",
-      "civic",
-      "titus 3:1",
-      "titus 3:2",
-      "submit",
-      "peaceable",
-      "gentle",
-      "social media",
-      "culture",
-      "episode 10"
-    ],
-    "createdAt": "2026-04-13T00:00:00.000Z",
-    "updatedAt": "2026-04-13T00:00:00.000Z"
-  }
-]

data/chatbot-eval.json

@@ -1,58 +0,0 @@
-[
-  { "query": "who was titus", "expectedEntryId": "cb_who_is_titus_001", "expectedTopK": 3 },
-  { "query": "who is paul", "expectedEntryId": "881279c7-3ca4-436d-a584-19cc0a5a9bf3", "expectedTopK": 3 },
-  { "query": "tell me about paul in titus", "expectedEntryId": "881279c7-3ca4-436d-a584-19cc0a5a9bf3", "expectedTopK": 4 },
-  { "query": "who was saul before his conversion", "expectedEntryId": "167fa083-5438-44a5-ac72-6dd379e937f5", "expectedTopK": 4 },
-  { "query": "who was titus and why was he in crete", "expectedEntryId": "cb_who_is_titus_001", "expectedTopK": 12 },
-  { "query": "what bible translation does nate use", "expectedEntryId": "cb_001", "expectedTopK": 1 },
-  { "query": "does the podcast use bsb", "expectedEntryId": "cb_001", "expectedTopK": 2 },
-  { "query": "which bible version do you teach from", "expectedEntryId": "cb_001", "expectedTopK": 2 },
-  { "query": "how can i stay consistent with daily bible reading", "expectedEntryId": "cb_003", "expectedTopK": 2 },
-  { "query": "help me build a daily reading habit", "expectedEntryId": "cb_003", "expectedTopK": 3 },
-  { "query": "i keep missing devotion time what should i do", "expectedEntryId": "cb_003", "expectedTopK": 4 },
-  { "query": "how should christians engage with politics", "expectedEntryId": "cb_christians_politics_001", "expectedTopK": 2 },
-  { "query": "what does titus say about public life", "expectedEntryId": "cb_christians_politics_001", "expectedTopK": 3 },
-  { "query": "how can i be peaceable online", "expectedEntryId": "cb_christians_politics_001", "expectedTopK": 4 },
-  { "query": "give me a summary of titus 3:4-7", "expectedEntryId": "cb_titus347_summary_001", "expectedTopK": 1 },
-  { "query": "summarize titus 3 4 through 7", "expectedEntryId": "cb_titus347_summary_001", "expectedTopK": 12 },
-  { "query": "what does titus 3:4-7 teach about salvation", "expectedEntryId": "b68c5659-cc7e-42d2-ab24-a623b7404058", "expectedTopK": 2 },
-  { "query": "what is the blessed hope", "expectedEntryId": "cb_blessed_hope_001", "expectedTopK": 2 },
-  { "query": "define blessed hope from titus 2:13", "expectedEntryId": "cb_blessed_hope_001", "expectedTopK": 2 },
-  { "query": "what does makaria elpis mean", "expectedEntryId": "cb_blessed_hope_001", "expectedTopK": 3 },
-  { "query": "what does grace train us to do", "expectedEntryId": "cb_grace_trains_001", "expectedTopK": 2 },
-  { "query": "how does grace teach us to say no to ungodliness", "expectedEntryId": "cb_grace_trains_001", "expectedTopK": 3 },
-  { "query": "what is paideuo in titus 2", "expectedEntryId": "6be7a644-9276-4797-a7bb-1422b170846c", "expectedTopK": 12 },
-  { "query": "how do i submit a question to nate", "expectedEntryId": "cb_007", "expectedTopK": 1 },
-  { "query": "where can i send bible questions", "expectedEntryId": "cb_007", "expectedTopK": 12 },
-  { "query": "how do i contact nate", "expectedEntryId": "cb_007", "expectedTopK": 2 },
-  { "query": "what does titus 1 teach about church leadership", "expectedEntryId": "cb_leadership_titus1_001", "expectedTopK": 2 },
-  { "query": "elder qualifications in titus 1", "expectedEntryId": "cb_leadership_titus1_001", "expectedTopK": 12 },
-  { "query": "what should an overseer be like", "expectedEntryId": "cb_leadership_titus1_001", "expectedTopK": 3 },
-  { "query": "what did paul say about elders", "expectedEntryId": "e0ad268f-2826-41a5-b078-90f90aeda21b", "expectedTopK": 4 },
-  { "query": "episode on faithful leaders", "expectedEntryId": "e0ad268f-2826-41a5-b078-90f90aeda21b", "expectedTopK": 3 },
-  { "query": "titus 1:5-9 overview", "expectedEntryId": "e0ad268f-2826-41a5-b078-90f90aeda21b", "expectedTopK": 12 },
-  { "query": "what are false teachers doing in titus", "expectedEntryId": "56626549-7e1e-4564-8c79-2d21b49eb911", "expectedTopK": 3 },
-  { "query": "what is the circumcision group in titus", "expectedEntryId": "56626549-7e1e-4564-8c79-2d21b49eb911", "expectedTopK": 3 },
-  { "query": "empty talk and deception in titus 1", "expectedEntryId": "56626549-7e1e-4564-8c79-2d21b49eb911", "expectedTopK": 4 },
-  { "query": "what does it mean to deny god by your works", "expectedEntryId": "cb_deny_works_001", "expectedTopK": 2 },
-  { "query": "they profess to know god but deny him by actions", "expectedEntryId": "cb_deny_works_001", "expectedTopK": 3 },
-  { "query": "detestable disobedient unfit meaning", "expectedEntryId": "cb_deny_works_001", "expectedTopK": 4 },
-  { "query": "episode about grace training us", "expectedEntryId": "6be7a644-9276-4797-a7bb-1422b170846c", "expectedTopK": 2 },
-  { "query": "titus 2:11-12 episode", "expectedEntryId": "6be7a644-9276-4797-a7bb-1422b170846c", "expectedTopK": 12 },
-  { "query": "how should i share faith with skeptical family", "expectedEntryId": "cb_faith_family_001", "expectedTopK": 2 },
-  { "query": "evangelize skeptical relatives", "expectedEntryId": "cb_faith_family_001", "expectedTopK": 4 },
-  { "query": "where can i listen to the podcast", "expectedEntryId": "cb_006", "expectedTopK": 2 },
-  { "query": "how do i find verse by verse with nate on apple podcasts", "expectedEntryId": "cb_006", "expectedTopK": 3 },
-  { "query": "what is verse by verse with nate podcast", "expectedEntryId": "cb_005", "expectedTopK": 2 },
-  { "query": "tell me about the podcast", "expectedEntryId": "cb_005", "expectedTopK": 2 },
-  { "query": "how do i approach a difficult passage", "expectedEntryId": "cb_002", "expectedTopK": 2 },
-  { "query": "what should i do with confusing bible verses", "expectedEntryId": "cb_002", "expectedTopK": 3 },
-  { "query": "prayer and quiet time advice", "expectedEntryId": "cb_008", "expectedTopK": 2 },
-  { "query": "how to start a quiet time", "expectedEntryId": "cb_008", "expectedTopK": 3 },
-  { "query": "what is episode 9 about", "expectedEntryId": "4e6ec41f-b083-45b9-9581-0dc91f092f66", "expectedTopK": 12 },
-  { "query": "living between two appearings", "expectedEntryId": "4e6ec41f-b083-45b9-9581-0dc91f092f66", "expectedTopK": 2 },
-  { "query": "what is episode 12", "expectedEntryId": "b68c5659-cc7e-42d2-ab24-a623b7404058", "expectedTopK": 2 },
-  { "query": "the gospel in one paragraph", "expectedEntryId": "b68c5659-cc7e-42d2-ab24-a623b7404058", "expectedTopK": 2 },
-  { "query": "what is episode 14 about", "expectedEntryId": "14ced988-1382-4c8d-a29e-b0f531580af1", "expectedTopK": 3 },
-  { "query": "grace where it starts and where it ends", "expectedEntryId": "14ced988-1382-4c8d-a29e-b0f531580af1", "expectedTopK": 3 }
-]

data/episode-plays.json

@@ -0,0 +1,8 @@
+{
+  "Living Between Two Appearings": {
+    "total": 1,
+    "byDay": {
+      "2026-07-22": 1
+    }
+  }
+}

data/podcast-checklist.json

@@ -0,0 +1,681 @@
+{
+  "checklist": {
+    "tasks": [
+      {
+        "id": "verify_script",
+        "label": "Verify Script",
+        "phase": "pre"
+      },
+      {
+        "id": "read_script",
+        "label": "Read Script",
+        "phase": "pre"
+      },
+      {
+        "id": "record",
+        "label": "Record",
+        "phase": "pre"
+      },
+      {
+        "id": "edit",
+        "label": "Edit",
+        "phase": "pre"
+      },
+      {
+        "id": "mix",
+        "label": "Mix",
+        "phase": "pre"
+      },
+      {
+        "id": "video_script",
+        "label": "Run Video Conversion Script",
+        "phase": "pre"
+      },
+      {
+        "id": "post_spotify",
+        "label": "Post on Spotify",
+        "phase": "pre"
+      },
+      {
+        "id": "update_website",
+        "label": "Update Website",
+        "phase": "post"
+      },
+      {
+        "id": "send_email",
+        "label": "Send Email",
+        "phase": "post"
+      }
+    ],
+    "episodes": [
+      {
+        "id": "titus-11",
+        "series": "Titus",
+        "episodeNumber": 11,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "titus-12",
+        "series": "Titus",
+        "episodeNumber": 12,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "titus-13",
+        "series": "Titus",
+        "episodeNumber": 13,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "titus-14",
+        "series": "Titus",
+        "episodeNumber": 14,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "titus-15",
+        "series": "Titus",
+        "episodeNumber": 15,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-1",
+        "series": "Colossians",
+        "episodeNumber": 1,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-2",
+        "series": "Colossians",
+        "episodeNumber": 2,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-3",
+        "series": "Colossians",
+        "episodeNumber": 3,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-4",
+        "series": "Colossians",
+        "episodeNumber": 4,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-5",
+        "series": "Colossians",
+        "episodeNumber": 5,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-6",
+        "series": "Colossians",
+        "episodeNumber": 6,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-7",
+        "series": "Colossians",
+        "episodeNumber": 7,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-8",
+        "series": "Colossians",
+        "episodeNumber": 8,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-9",
+        "series": "Colossians",
+        "episodeNumber": 9,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-10",
+        "series": "Colossians",
+        "episodeNumber": 10,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-11",
+        "series": "Colossians",
+        "episodeNumber": 11,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-12",
+        "series": "Colossians",
+        "episodeNumber": 12,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-13",
+        "series": "Colossians",
+        "episodeNumber": 13,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-14",
+        "series": "Colossians",
+        "episodeNumber": 14,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-15",
+        "series": "Colossians",
+        "episodeNumber": 15,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-16",
+        "series": "Colossians",
+        "episodeNumber": 16,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-17",
+        "series": "Colossians",
+        "episodeNumber": 17,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-18",
+        "series": "Colossians",
+        "episodeNumber": 18,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-19",
+        "series": "Colossians",
+        "episodeNumber": 19,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-20",
+        "series": "Colossians",
+        "episodeNumber": 20,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-21",
+        "series": "Colossians",
+        "episodeNumber": 21,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-22",
+        "series": "Colossians",
+        "episodeNumber": 22,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-23",
+        "series": "Colossians",
+        "episodeNumber": 23,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-24",
+        "series": "Colossians",
+        "episodeNumber": 24,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-25",
+        "series": "Colossians",
+        "episodeNumber": 25,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-26",
+        "series": "Colossians",
+        "episodeNumber": 26,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "colossians-27",
+        "series": "Colossians",
+        "episodeNumber": 27,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      },
+      {
+        "id": "episode-mpb66z1c",
+        "series": "Titus -10",
+        "episodeNumber": 0,
+        "title": "",
+        "datePublished": "",
+        "expanded": false,
+        "tasks": {
+          "verify_script": false,
+          "read_script": false,
+          "record": false,
+          "edit": false,
+          "mix": false,
+          "video_script": false,
+          "post_spotify": false,
+          "update_website": false,
+          "send_email": false
+        }
+      }
+    ]
+  },
+  "updatedAt": "2026-05-18T12:18:35.130Z"
+}

data/questions-draft.json

@@ -0,0 +1,102 @@
+{
+  "questions": [
+    {
+      "id": "cb_001",
+      "firstName": "Nate",
+      "question": "What Bible translation do you use?",
+      "answer": "In the podcast, I primarily teach from the BSB (Berean Standard Bible). I may compare other translations at times, but BSB is my main teaching text in the Verse by Verse episodes.",
+      "isApproved": true,
+      "topic": "Bible Study",
+      "answeredAt": "2026-05-07T13:36:16.859Z"
+    },
+    {
+      "id": "cb_002",
+      "firstName": "Nate",
+      "question": "How do you approach a difficult or confusing Bible passage?",
+      "answer": "I always start by reading the surrounding context — a confusing verse often makes perfect sense once you zoom out a chapter or two. Then I look at who the author was, who they were writing to, and what was happening historically. A good study Bible or a commentary like Matthew Henry's can be a huge help. Most importantly, pray for understanding before you dive in. The Holy Spirit is your best guide.",
+      "isApproved": true,
+      "topic": "Bible Study"
+    },
+    {
+      "id": "cb_003",
+      "firstName": "Nate",
+      "question": "How do I stay consistent with daily Bible reading?",
+      "answer": "Start small and protect that time like an appointment. Even 10 minutes in the morning before checking your phone can be transformative over a year. A reading plan helps a lot — there are great ones on apps like YouVersion that break the whole Bible into daily chunks so you never have to decide what to read. And give yourself grace on the days you miss; guilt is not a good motivator. Just pick back up where you left off.",
+      "isApproved": true,
+      "topic": "Bible Study"
+    },
+    {
+      "id": "cb_007",
+      "firstName": "Nate",
+      "question": "How do I submit a question to Nate?",
+      "answer": "You can submit a question using the contact form at the bottom of this page. Select 'Bible Question' as the message type. Nate reads every question personally and answers the best ones on the site's Q&A section or in a future episode. There's no guarantee every question gets a public response, but all are read and appreciated!",
+      "isApproved": true,
+      "topic": "Podcast"
+    },
+    {
+      "id": "cb_faith_family_001",
+      "firstName": "Nate",
+      "question": "How can I share my faith with skeptical family?",
+      "answer": "Lead with relationship, not argument. Skeptical family members usually don't need more information — they need to see the faith lived out genuinely. Consistency, love, and patience over time speaks louder than any debate win.\n\nPray specifically and persistently. This is the most underrated strategy. God moves hearts in ways arguments never can.",
+      "isApproved": true,
+      "topic": "Faith & Life"
+    },
+    {
+      "id": "cb_blessed_hope_001",
+      "firstName": "Nate",
+      "question": "What is the blessed hope?",
+      "answer": "The blessed hope is a phrase from Titus 2:13 — \"as we await the blessed hope and glorious appearance of our great God and Savior Jesus Christ.\" In Episode 9, Nate breaks down the Greek: makaria elpis. Makaria is the same word used in the Beatitudes — a divinely favored condition. And elpis in the New Testament is not wishful thinking. Biblical hope is a confident expectation of something certain. Not a wish. An anchor.\n\nThe blessed hope is simply this: Jesus is coming back. Not maybe. He is coming back. And the person who really believes that is in a blessed condition even now, living toward a certainty that changes how everything feels today.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_who_is_titus_001",
+      "firstName": "Nate",
+      "question": "Who was Titus?",
+      "answer": "Titus was a Gentile — not Jewish — who came to faith through Paul's ministry. Paul calls him \"my true child in our common faith\" (Titus 1:4). He was one of Paul's closest and most trusted co-workers. In 2 Corinthians 7, Paul describes being comforted by Titus arriving during a difficult season. In chapter 8, Titus helped organize a relief offering for believers in Jerusalem. In Galatians 2, he appears as proof that the gospel is for everyone.\n\nPaul left Titus on the island of Crete with a difficult assignment: appoint elders, correct false teaching, and help a young church find its footing in a challenging culture. The letter of Titus is essentially his briefing.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_deny_works_001",
+      "firstName": "Nate",
+      "question": "What does it mean to deny God by your works?",
+      "answer": "Titus 1:16 says: \"They profess to know God, but by their actions they deny Him. They are detestable, disobedient, and unfit for any good deed.\"\n\nIn Episode 6, Nate explains this using three precise words Paul chose. Detestable — morally repulsive before God, regardless of religious appearance. Disobedient — not persuadable, resistant to truth even when confronted with it. Unfit — a Greek metalworking term for metal tested and found counterfeit. Religious on the surface, but no real substance underneath.\n\nThe warning cuts both ways: a person can know the right words, attend the right services, hold the right opinions — and still live in a way that functionally says God doesn't matter. Theology and life are inseparable. What you actually believe will show itself in how you actually live.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_grace_trains_001",
+      "firstName": "Nate",
+      "question": "What does grace actually train us to do?",
+      "answer": "Titus 2:11-12 says grace \"instructs us to renounce ungodliness and worldly passions, and to live sensible, upright, and godly lives.\"\n\nIn Episode 8, Nate points out that the Greek word for instructs is paideuō — the education of a child. Not classroom instruction but formation. Grace is the subject doing the teaching.\n\nGrace teaches two things: what to say no to (ungodliness and worldly passions) and what to say yes to — sensible (an ordered mind), upright (right in relationship with others), and godly (God genuinely at the center). Inward, outward, and upward.\n\nThe key insight: the pathway to saying no to sin is going deeper into grace, not trying harder. Grace properly understood reorients your desires — it doesn't just change the rules, it changes what you want. Grace is not a hall pass. It's a school you attend every day.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_leadership_titus1_001",
+      "firstName": "Nate",
+      "question": "What does Titus 1 teach about church leadership?",
+      "answer": "Paul's first instruction in Titus was to appoint elders — because a church without mature, qualified leadership is vulnerable. From Episode 4 (Titus 1:5-9):\n\nThe elder's home is exhibit A. Before looking at preaching or public presence, look at the household. If a man cannot lead his own family well, there's no reason to believe he'll lead God's family well. Integrity can't be compartmentalized.\n\nPaul gives five things an elder must NOT be: not self-absorbed, not quick-tempered, not given to drunkenness, not violent, not greedy. And six things he must BE: hospitable, a lover of good, self-controlled, upright, holy, and disciplined in sound doctrine.\n\nThis is not a job description for a CEO. Nate frames it as a picture of Christlike character — authority that flows from below, from a posture of submission and service, not dominance.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_titus347_summary_001",
+      "firstName": "Nate",
+      "question": "Give me a summary of Titus 3:4-7",
+      "answer": "Titus 3:4-7 is what Nate calls 'the gospel in one paragraph' — one of the most concentrated summaries of salvation anywhere in Paul's letters. Episode 12 breaks it down:\n\nAll three persons of the Trinity are present: God the Father is the initiating motivation — He is kind and full of love toward humanity. The Holy Spirit is the agent of new birth and ongoing renewal. Jesus Christ is the one through whom the Spirit is poured out, and verse 7 calls him 'our Savior.'\n\nThe hinge of the passage is verse 5: He saved us not by the righteous deeds we had done, but according to His mercy. Not partially. Not mostly. The basis is His mercy, not our merit — which means salvation rests on something that cannot change.\n\nVerse 7 gives us two results: justified (declared righteous in God's courtroom) and heirs (members of the family with a guaranteed inheritance). You are not just legally acquitted — you belong.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_christians_politics_001",
+      "firstName": "Nate",
+      "question": "How should Christians engage with politics and public life?",
+      "answer": "Titus 3:1-2 is Paul's answer, covered in Episode 10. He tells Titus to remind believers to submit to rulers and authorities, be obedient, be ready for every good work, malign no one, and be peaceable, gentle, and considerate to everyone.\n\nNate's key insight: Paul is not saying agree with every government decision. He's saying your engagement with public life should be marked by something recognizable as different. Submission, readiness to do good, and a peaceable presence are not just civic virtues — they are missionary strategies. The way you navigate public life either opens doors for the gospel or closes them.\n\nThe word for peaceable in Greek is amachous — literally non-combative. Paul doesn't say malign no one except your political opponents. He says no one. This is not weakness. It is the confidence of people who know how the story ends and don't need to win every argument to prove it.",
+      "isApproved": true,
+      "topic": "Faith & Life"
+    }
+  ],
+  "updatedAt": "2026-05-07T13:36:16.859Z"
+}

data/questions.json

@@ -1 +1,102 @@
-[]
+{
+  "questions": [
+    {
+      "id": "cb_001",
+      "firstName": "Nate",
+      "question": "What Bible translation do you use?",
+      "answer": "In the podcast, I primarily teach from the BSB (Berean Standard Bible). I may compare other translations at times, but BSB is my main teaching text in the Verse by Verse episodes.",
+      "isApproved": true,
+      "topic": "Bible Study",
+      "answeredAt": "2026-05-07T13:36:16.859Z"
+    },
+    {
+      "id": "cb_002",
+      "firstName": "Nate",
+      "question": "How do you approach a difficult or confusing Bible passage?",
+      "answer": "I always start by reading the surrounding context — a confusing verse often makes perfect sense once you zoom out a chapter or two. Then I look at who the author was, who they were writing to, and what was happening historically. A good study Bible or a commentary like Matthew Henry's can be a huge help. Most importantly, pray for understanding before you dive in. The Holy Spirit is your best guide.",
+      "isApproved": true,
+      "topic": "Bible Study"
+    },
+    {
+      "id": "cb_003",
+      "firstName": "Nate",
+      "question": "How do I stay consistent with daily Bible reading?",
+      "answer": "Start small and protect that time like an appointment. Even 10 minutes in the morning before checking your phone can be transformative over a year. A reading plan helps a lot — there are great ones on apps like YouVersion that break the whole Bible into daily chunks so you never have to decide what to read. And give yourself grace on the days you miss; guilt is not a good motivator. Just pick back up where you left off.",
+      "isApproved": true,
+      "topic": "Bible Study"
+    },
+    {
+      "id": "cb_007",
+      "firstName": "Nate",
+      "question": "How do I submit a question to Nate?",
+      "answer": "You can submit a question using the contact form at the bottom of this page. Select 'Bible Question' as the message type. Nate reads every question personally and answers the best ones on the site's Q&A section or in a future episode. There's no guarantee every question gets a public response, but all are read and appreciated!",
+      "isApproved": true,
+      "topic": "Podcast"
+    },
+    {
+      "id": "cb_faith_family_001",
+      "firstName": "Nate",
+      "question": "How can I share my faith with skeptical family?",
+      "answer": "Lead with relationship, not argument. Skeptical family members usually don't need more information — they need to see the faith lived out genuinely. Consistency, love, and patience over time speaks louder than any debate win.\n\nPray specifically and persistently. This is the most underrated strategy. God moves hearts in ways arguments never can.",
+      "isApproved": true,
+      "topic": "Faith & Life"
+    },
+    {
+      "id": "cb_blessed_hope_001",
+      "firstName": "Nate",
+      "question": "What is the blessed hope?",
+      "answer": "The blessed hope is a phrase from Titus 2:13 — \"as we await the blessed hope and glorious appearance of our great God and Savior Jesus Christ.\" In Episode 9, Nate breaks down the Greek: makaria elpis. Makaria is the same word used in the Beatitudes — a divinely favored condition. And elpis in the New Testament is not wishful thinking. Biblical hope is a confident expectation of something certain. Not a wish. An anchor.\n\nThe blessed hope is simply this: Jesus is coming back. Not maybe. He is coming back. And the person who really believes that is in a blessed condition even now, living toward a certainty that changes how everything feels today.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_who_is_titus_001",
+      "firstName": "Nate",
+      "question": "Who was Titus?",
+      "answer": "Titus was a Gentile — not Jewish — who came to faith through Paul's ministry. Paul calls him \"my true child in our common faith\" (Titus 1:4). He was one of Paul's closest and most trusted co-workers. In 2 Corinthians 7, Paul describes being comforted by Titus arriving during a difficult season. In chapter 8, Titus helped organize a relief offering for believers in Jerusalem. In Galatians 2, he appears as proof that the gospel is for everyone.\n\nPaul left Titus on the island of Crete with a difficult assignment: appoint elders, correct false teaching, and help a young church find its footing in a challenging culture. The letter of Titus is essentially his briefing.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_deny_works_001",
+      "firstName": "Nate",
+      "question": "What does it mean to deny God by your works?",
+      "answer": "Titus 1:16 says: \"They profess to know God, but by their actions they deny Him. They are detestable, disobedient, and unfit for any good deed.\"\n\nIn Episode 6, Nate explains this using three precise words Paul chose. Detestable — morally repulsive before God, regardless of religious appearance. Disobedient — not persuadable, resistant to truth even when confronted with it. Unfit — a Greek metalworking term for metal tested and found counterfeit. Religious on the surface, but no real substance underneath.\n\nThe warning cuts both ways: a person can know the right words, attend the right services, hold the right opinions — and still live in a way that functionally says God doesn't matter. Theology and life are inseparable. What you actually believe will show itself in how you actually live.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_grace_trains_001",
+      "firstName": "Nate",
+      "question": "What does grace actually train us to do?",
+      "answer": "Titus 2:11-12 says grace \"instructs us to renounce ungodliness and worldly passions, and to live sensible, upright, and godly lives.\"\n\nIn Episode 8, Nate points out that the Greek word for instructs is paideuō — the education of a child. Not classroom instruction but formation. Grace is the subject doing the teaching.\n\nGrace teaches two things: what to say no to (ungodliness and worldly passions) and what to say yes to — sensible (an ordered mind), upright (right in relationship with others), and godly (God genuinely at the center). Inward, outward, and upward.\n\nThe key insight: the pathway to saying no to sin is going deeper into grace, not trying harder. Grace properly understood reorients your desires — it doesn't just change the rules, it changes what you want. Grace is not a hall pass. It's a school you attend every day.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_leadership_titus1_001",
+      "firstName": "Nate",
+      "question": "What does Titus 1 teach about church leadership?",
+      "answer": "Paul's first instruction in Titus was to appoint elders — because a church without mature, qualified leadership is vulnerable. From Episode 4 (Titus 1:5-9):\n\nThe elder's home is exhibit A. Before looking at preaching or public presence, look at the household. If a man cannot lead his own family well, there's no reason to believe he'll lead God's family well. Integrity can't be compartmentalized.\n\nPaul gives five things an elder must NOT be: not self-absorbed, not quick-tempered, not given to drunkenness, not violent, not greedy. And six things he must BE: hospitable, a lover of good, self-controlled, upright, holy, and disciplined in sound doctrine.\n\nThis is not a job description for a CEO. Nate frames it as a picture of Christlike character — authority that flows from below, from a posture of submission and service, not dominance.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_titus347_summary_001",
+      "firstName": "Nate",
+      "question": "Give me a summary of Titus 3:4-7",
+      "answer": "Titus 3:4-7 is what Nate calls 'the gospel in one paragraph' — one of the most concentrated summaries of salvation anywhere in Paul's letters. Episode 12 breaks it down:\n\nAll three persons of the Trinity are present: God the Father is the initiating motivation — He is kind and full of love toward humanity. The Holy Spirit is the agent of new birth and ongoing renewal. Jesus Christ is the one through whom the Spirit is poured out, and verse 7 calls him 'our Savior.'\n\nThe hinge of the passage is verse 5: He saved us not by the righteous deeds we had done, but according to His mercy. Not partially. Not mostly. The basis is His mercy, not our merit — which means salvation rests on something that cannot change.\n\nVerse 7 gives us two results: justified (declared righteous in God's courtroom) and heirs (members of the family with a guaranteed inheritance). You are not just legally acquitted — you belong.",
+      "isApproved": true,
+      "topic": "Titus"
+    },
+    {
+      "id": "cb_christians_politics_001",
+      "firstName": "Nate",
+      "question": "How should Christians engage with politics and public life?",
+      "answer": "Titus 3:1-2 is Paul's answer, covered in Episode 10. He tells Titus to remind believers to submit to rulers and authorities, be obedient, be ready for every good work, malign no one, and be peaceable, gentle, and considerate to everyone.\n\nNate's key insight: Paul is not saying agree with every government decision. He's saying your engagement with public life should be marked by something recognizable as different. Submission, readiness to do good, and a peaceable presence are not just civic virtues — they are missionary strategies. The way you navigate public life either opens doors for the gospel or closes them.\n\nThe word for peaceable in Greek is amachous — literally non-combative. Paul doesn't say malign no one except your political opponents. He says no one. This is not weakness. It is the confidence of people who know how the story ends and don't need to win every argument to prove it.",
+      "isApproved": true,
+      "topic": "Faith & Life"
+    }
+  ],
+  "updatedAt": "2026-06-03T14:17:48.087Z"
+}

data/study-community.json

@@ -0,0 +1,50 @@
+{
+  "posts": [
+    {
+      "id": "fd6f2d9c-8abc-43b2-8e93-c58c0cb1ff7b",
+      "studySlug": "colossians",
+      "sectionId": "",
+      "authorUserId": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+      "authorName": "Test Student",
+      "message": "reading",
+      "createdAt": "2026-06-02T17:41:48.684Z",
+      "replies": []
+    },
+    {
+      "id": "001f2545-e1ee-4748-902b-5da5c47554bb",
+      "studySlug": "colossians",
+      "sectionId": "",
+      "authorUserId": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+      "authorName": "Test Student",
+      "message": "sool",
+      "createdAt": "2026-06-02T17:41:41.608Z",
+      "replies": []
+    },
+    {
+      "id": "c40e4c10-47a3-42e8-88bd-78116af5babe",
+      "studySlug": "colossians",
+      "sectionId": "",
+      "authorUserId": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+      "authorName": "Test Student",
+      "message": "test",
+      "createdAt": "2026-06-02T17:41:16.795Z",
+      "replies": [
+        {
+          "id": "efe0bf3d-66e8-4dad-98c1-2e8c742e3120",
+          "authorUserId": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+          "authorName": "Test Student",
+          "message": "test",
+          "createdAt": "2026-06-02T17:41:25.003Z"
+        },
+        {
+          "id": "1d6c3bd1-5ada-4f98-8ca3-5ed15bd00a68",
+          "authorUserId": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+          "authorName": "Test Student",
+          "message": "test",
+          "createdAt": "2026-06-02T17:41:34.406Z"
+        }
+      ]
+    }
+  ],
+  "updatedAt": "2026-06-02T17:41:48.685Z"
+}

data/study-notes.json

@@ -0,0 +1,8 @@
+{
+  "notesByUser": {
+    "e43e7217-be69-49c6-a65d-edd0e7745884": {
+      "1-1-2": "Test"
+    }
+  },
+  "updatedAt": "2026-05-12T15:51:54.402Z"
+}

data/study-notes/3307bdd7-a770-4fad-a28e-cf2d0c2a6e34.json

@@ -0,0 +1,3 @@
+{
+  "colossians--1-1-2": "test....teset"
+}

data/study-notes/e43e7217-be69-49c6-a65d-edd0e7745884.json

@@ -0,0 +1,3 @@
+{
+  "1-1-2": "Test"
+}

data/study-progress/3307bdd7-a770-4fad-a28e-cf2d0c2a6e34.json

@@ -0,0 +1,17 @@
+{
+  "byStudy": {
+    "colossians": {
+      "completedSectionIds": [
+        "1-1-2",
+        "1-3-8"
+      ],
+      "quizAnswers": {
+        "1-1-2": [
+          "test",
+          "test"
+        ]
+      }
+    }
+  },
+  "updatedAt": "2026-06-08T20:30:19.689Z"
+}

data/study-reminders.json

@@ -0,0 +1,4 @@
+{
+  "users": {},
+  "updatedAt": "2026-08-10T14:22:31.192Z"
+}

data/study-users.json

@@ -0,0 +1,73 @@
+{
+  "users": [
+    {
+      "id": "9b74971e-bfdc-4e64-a8d7-87cd8f2bb5c4",
+      "username": "student.test@versebyverse.local",
+      "passwordHash": "6500cc2e717d1d646f371dba1ec918d2f2f9fddbb8576c792df69a1f2340dcd9",
+      "displayName": "Student Test",
+      "subscribeNewsletter": false,
+      "studyRemindersEnabled": false,
+      "enrolledStudySlugs": [],
+      "avatarUrl": "",
+      "createdAt": null,
+      "updatedAt": "2026-08-10T12:39:25.413Z",
+      "lastLoginAt": "2026-05-21T15:41:16.259Z",
+      "reengagementSentAt": {},
+      "pendingEmailChange": null,
+      "twoFaMethod": null,
+      "totpSecret": null,
+      "totpVerified": false,
+      "totpEnabledAt": null,
+      "totpRecoveryCodes": [],
+      "birthdayMonth": 7,
+      "birthdayDay": 4,
+      "birthdayAlternateMonth": null,
+      "birthdayAlternateDay": null,
+      "birthdayEmailSentYear": null
+    },
+    {
+      "id": "3307bdd7-a770-4fad-a28e-cf2d0c2a6e34",
+      "username": "test.user@versebyverse.local",
+      "passwordHash": "fc89481d72dbea9af1d4f054faad48813227fa018da39259272dd27b5e493bb5",
+      "displayName": "Test Student",
+      "subscribeNewsletter": false,
+      "studyRemindersEnabled": false,
+      "enrolledStudySlugs": [
+        "colossians"
+      ],
+      "avatarUrl": "data:image/svg+xml;utf8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%2288%22%20height%3D%2288%22%3E%3Crect%20width%3D%22100%25%22%20height%3D%22100%25%22%20rx%3D%2218%22%20ry%3D%2218%22%20fill%3D%22%2311100d%22%2F%3E%3Ctext%20x%3D%2250%25%22%20y%3D%2250%25%22%20dominant-baseline%3D%22middle%22%20text-anchor%3D%22middle%22%20font-size%3D%2256%22%3E%F0%9F%A6%81%3C%2Ftext%3E%3C%2Fsvg%3E",
+      "createdAt": null,
+      "updatedAt": "2026-06-08T20:46:30.804Z",
+      "lastLoginAt": "2026-06-08T20:46:30.804Z",
+      "reengagementSentAt": {},
+      "pendingEmailChange": null,
+      "twoFaMethod": null,
+      "totpSecret": null,
+      "totpVerified": false,
+      "totpEnabledAt": null,
+      "totpRecoveryCodes": [],
+      "totpSecretPending": "FGR7UI5TWA4HB4DURCXEUXATTVVVJDJ5"
+    },
+    {
+      "id": "81c01e32-d94e-4e19-93ea-e5cd7644ea6a",
+      "username": "test.avatar@versebyverse.local",
+      "passwordHash": "fc89481d72dbea9af1d4f054faad48813227fa018da39259272dd27b5e493bb5",
+      "displayName": "Avatar Test",
+      "subscribeNewsletter": false,
+      "studyRemindersEnabled": false,
+      "enrolledStudySlugs": [],
+      "avatarUrl": "data:image/svg+xml;utf8,%3Csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"88\" height=\"88\"%3E%3Crect width=\"100%\" height=\"100%\" rx=\"18\" ry=\"18\" fill=\"%2311100d\"/%3E%3Ctext x=\"50%\" y=\"50%\" dominant-baseline=\"middle\" text-anchor=\"middle\" font-size=\"56\"%3E🐱%3C/text%3E%3C/svg%3E",
+      "createdAt": null,
+      "updatedAt": null,
+      "lastLoginAt": "2026-06-02T17:33:13.669Z",
+      "reengagementSentAt": {},
+      "pendingEmailChange": null,
+      "twoFaMethod": null,
+      "totpSecret": null,
+      "totpVerified": false,
+      "totpEnabledAt": null,
+      "totpRecoveryCodes": []
+    }
+  ],
+  "updatedAt": "2026-08-10T12:39:25.413Z"
+}

docker-compose.yml

@@ -7,6 +7,7 @@ services:
       - "4173:4173"
     environment:
       - PORT=4173
+      - SITEFORGE_DATA_DIR=/app/data
       - ADMIN_PASSWORD=`generate a random password and set it here`
       - RESEND_API_KEY=`set your Resend API key here`
     volumes:

entrypoint.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -e
 
-DATA_DIR=/app/data
+DATA_DIR=${SITEFORGE_DATA_DIR:-/app/data}
 SEED_DIR=/app/data-seed
 
 # Ensure the data directory exists (in case the volume was not mounted)
@@ -23,4 +23,192 @@ if [ -d "$SEED_DIR" ]; then
   done
 fi
 
+# Merge newly added seeded platform links into existing admin content on upgrades
+# without overwriting user-edited values already present in the live volume.
+merge_seed_platform_links() {
+  target_file="$1"
+  seed_file="$2"
+
+  [ -f "$target_file" ] || return 0
+  [ -f "$seed_file" ] || return 0
+
+  node - "$target_file" "$seed_file" <<'NODE'
+const fs = require('fs')
+
+const [targetFile, seedFile] = process.argv.slice(2)
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'))
+}
+
+function normalizeLinks(value) {
+  return Array.isArray(value) ? value.filter(item => item && typeof item === 'object') : []
+}
+
+const target = readJson(targetFile)
+const seed = readJson(seedFile)
+
+if (!target.siteContent || !seed.siteContent) process.exit(0)
+
+const targetLinks = normalizeLinks(target.siteContent.customLinks)
+const seedLinks = normalizeLinks(seed.siteContent.customLinks)
+
+let changed = false
+
+for (const seedLink of seedLinks) {
+  if (seedLink.placement !== 'platforms' || !seedLink.id || !seedLink.label || !seedLink.url) continue
+
+  const existingIndex = targetLinks.findIndex(link => link.id === seedLink.id)
+  if (existingIndex === -1) {
+    targetLinks.push(seedLink)
+    changed = true
+    continue
+  }
+
+  const existing = targetLinks[existingIndex]
+  const merged = { ...existing }
+
+  if (!merged.imageUrl && seedLink.imageUrl) {
+    merged.imageUrl = seedLink.imageUrl
+    changed = true
+  }
+
+  if (!merged.placement && seedLink.placement) {
+    merged.placement = seedLink.placement
+    changed = true
+  }
+
+  if (!merged.label && seedLink.label) {
+    merged.label = seedLink.label
+    changed = true
+  }
+
+  if (!merged.url && seedLink.url) {
+    merged.url = seedLink.url
+    changed = true
+  }
+
+  targetLinks[existingIndex] = merged
+}
+
+if (!changed) process.exit(0)
+
+target.siteContent.customLinks = targetLinks
+fs.writeFileSync(targetFile, `${JSON.stringify(target, null, 2)}\n`)
+console.log(`[siteforge] Merged seeded platform links into ${targetFile}`)
+NODE
+}
+
+merge_seed_platform_links "$DATA_DIR/admin-content.json" "$SEED_DIR/admin-content.json"
+merge_seed_platform_links "$DATA_DIR/admin-content-draft.json" "$SEED_DIR/admin-content-draft.json"
+
+# Backfill missing lesson releasedAt values from seeded defaults on upgrades.
+# This keeps persistent volumes compatible with release-date access gating.
+merge_seed_study_release_dates() {
+  target_file="$1"
+  seed_file="$2"
+
+  [ -f "$target_file" ] || return 0
+  [ -f "$seed_file" ] || return 0
+
+  node - "$target_file" "$seed_file" <<'NODE'
+const fs = require('fs')
+
+const [targetFile, seedFile] = process.argv.slice(2)
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'))
+}
+
+function asArray(value) {
+  return Array.isArray(value) ? value : []
+}
+
+function mergeStudyDates(targetStudies, seedStudies) {
+  let changed = false
+  const seedBySlug = new Map()
+
+  for (const seedStudy of asArray(seedStudies)) {
+    if (!seedStudy || typeof seedStudy !== 'object') continue
+    if (typeof seedStudy.slug !== 'string' || !seedStudy.slug) continue
+    seedBySlug.set(seedStudy.slug, seedStudy)
+  }
+
+  for (const targetStudy of asArray(targetStudies)) {
+    if (!targetStudy || typeof targetStudy !== 'object') continue
+    if (typeof targetStudy.slug !== 'string' || !targetStudy.slug) continue
+
+    const seedStudy = seedBySlug.get(targetStudy.slug)
+    if (!seedStudy) continue
+
+    const seedSectionById = new Map()
+    for (const seedSection of asArray(seedStudy.sections)) {
+      if (!seedSection || typeof seedSection !== 'object') continue
+      if (typeof seedSection.id !== 'string' || !seedSection.id) continue
+      seedSectionById.set(seedSection.id, seedSection)
+    }
+
+    for (const targetSection of asArray(targetStudy.sections)) {
+      if (!targetSection || typeof targetSection !== 'object') continue
+      if (typeof targetSection.id !== 'string' || !targetSection.id) continue
+      if (typeof targetSection.releasedAt === 'string' && targetSection.releasedAt.trim()) continue
+
+      const seedSection = seedSectionById.get(targetSection.id)
+      if (!seedSection || typeof seedSection.releasedAt !== 'string' || !seedSection.releasedAt.trim()) continue
+
+      targetSection.releasedAt = seedSection.releasedAt
+      changed = true
+    }
+  }
+
+  return changed
+}
+
+function mergeLegacyColossiansDates(targetSections, seedSections) {
+  let changed = false
+  const seedById = new Map()
+
+  for (const seedSection of asArray(seedSections)) {
+    if (!seedSection || typeof seedSection !== 'object') continue
+    if (typeof seedSection.id !== 'string' || !seedSection.id) continue
+    seedById.set(seedSection.id, seedSection)
+  }
+
+  for (const targetSection of asArray(targetSections)) {
+    if (!targetSection || typeof targetSection !== 'object') continue
+    if (typeof targetSection.id !== 'string' || !targetSection.id) continue
+    if (typeof targetSection.releasedAt === 'string' && targetSection.releasedAt.trim()) continue
+
+    const seedSection = seedById.get(targetSection.id)
+    if (!seedSection || typeof seedSection.releasedAt !== 'string' || !seedSection.releasedAt.trim()) continue
+
+    targetSection.releasedAt = seedSection.releasedAt
+    changed = true
+  }
+
+  return changed
+}
+
+const target = readJson(targetFile)
+const seed = readJson(seedFile)
+
+if (!target.siteContent || !seed.siteContent) process.exit(0)
+
+const targetContent = target.siteContent
+const seedContent = seed.siteContent
+
+const changedStudies = mergeStudyDates(targetContent.studies, seedContent.studies)
+const changedLegacy = mergeLegacyColossiansDates(targetContent.colossiansStudySections, seedContent.colossiansStudySections)
+
+if (!changedStudies && !changedLegacy) process.exit(0)
+
+fs.writeFileSync(targetFile, `${JSON.stringify(target, null, 2)}\n`)
+console.log(`[siteforge] Backfilled missing releasedAt values in ${targetFile}`)
+NODE
+}
+
+merge_seed_study_release_dates "$DATA_DIR/admin-content.json" "$SEED_DIR/admin-content.json"
+merge_seed_study_release_dates "$DATA_DIR/admin-content-draft.json" "$SEED_DIR/admin-content-draft.json"
+
+export SITEFORGE_DATA_DIR="$DATA_DIR"
 exec node server.js

index.html

@@ -11,17 +11,17 @@
     <meta property="og:type" content="website" />
     <meta property="og:title" content="Verse by Verse with Nate" />
     <meta property="og:description" content="A verse-by-verse Scripture podcast exploring God's Word with depth, clarity, and practical application." />
-    <meta property="og:image" content="https://necloud.us/images/banner.png" />
+    <meta property="og:image" content="https://versebyversewithnate.us/images/banner.png" />
     <meta property="og:image:type" content="image/png" />
-    <meta property="og:image:secure_url" content="https://necloud.us/images/banner.png" />
+    <meta property="og:image:secure_url" content="https://versebyversewithnate.us/images/banner.png" />
     <meta property="og:image:alt" content="Verse by Verse with Nate podcast banner" />
     <meta property="og:locale" content="en_US" />
-    <meta property="og:url" content="https://necloud.us" />
+    <meta property="og:url" content="https://versebyversewithnate.us" />
     <meta property="og:site_name" content="Verse by Verse with Nate" />
-    <link rel="canonical" href="https://necloud.us" />
+    <link rel="canonical" href="https://versebyversewithnate.us" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Playfair+Display:ital,wght@0,700;0,900;1,700&family=Barlow+Condensed:wght@300;400;500;700&display=swap" rel="stylesheet" />
+    <link href="https://fonts.googleapis.com/css2?family=Cormorant+Garamond:ital,wght@0,300;0,400;0,600;0,700;1,300;1,400;1,600;1,700&family=Lora:ital,wght@0,400;0,500;0,600;1,400;1,500&display=swap" rel="stylesheet" />
   </head>
   <body>
     <div id="root"></div>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "siteforge",
   "private": true,
-  "version": "0.0.0",
+  "version": "1.1.40",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -10,21 +10,37 @@
     "build": "tsc -b && vite build",
     "start": "node --env-file=.env server.js",
     "lint": "eslint .",
-    "preview": "vite preview",
+    "preview": "vite preview"
-    "chatbot:eval": "node scripts/evaluate-chatbot.mjs"
   },
   "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@tiptap/react": "^3.27.0",
+    "@tiptap/starter-kit": "^3.27.0",
+    "chart.js": "^4.4.0",
+    "docx": "^9.6.1",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.4.1",
+    "fuse.js": "^7.4.2",
+    "mammoth": "^1.12.0",
+    "otplib": "^13.4.0",
+    "prop-types": "^15.8.1",
+    "qrcode": "^1.5.4",
     "react": "^19.2.4",
+    "react-chartjs-2": "^5.2.0",
     "react-dom": "^19.2.4",
     "react-markdown": "^10.1.0",
     "react-router-dom": "^7.13.1",
+    "react-simple-maps": "^3.0.0",
     "remark-gfm": "^4.0.1",
-    "resend": "^6.10.0"
+    "resend": "^6.10.0",
+    "tar": "^7.5.19"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",
     "@types/node": "^24.12.0",
+    "@types/qrcode": "^1.5.6",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.0",
@@ -35,6 +51,7 @@
     "globals": "^17.4.0",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.56.1",
-    "vite": "^8.0.0"
+    "vite": "^8.0.0",
+    "vite-plugin-pwa": "^1.3.0"
   }
 }

plans/finished-books-playlist.md

@@ -0,0 +1,156 @@
+# Finished Books — Episode Playlist Feature
+
+## Goal
+Add a proper **Finished Books** section where completed book studies live with a full ordered episode playlist. The Downloads page gets a minor label/copy update (Option A). A single "End Current Series" button in admin handles the full book transition in one step.
+
+---
+
+## User Flow (Public Site)
+
+1. User clicks **Finished Books** in the nav
+2. Lands on `/finished` — grid of completed book cards (image, title, description)
+3. Clicks a book → `/finished/:id` — sees all episodes in numbered order, each with a player
+4. Breadcrumb: `Finished Books → Titus`
+
+**Episode Highlights** on the Episodes page only ever shows picks from the current book. When a book ends, highlights are cleared and replaced with picks from the new series automatically (see transition workflow below).
+
+---
+
+## Book Transition Workflow — "End Current Series" Button
+
+A single button in admin (lives on the Current Series tab) that does all three transition steps at once:
+
+### What it does
+1. **Creates a Finished Book entry** from the current series data (title, image, description, season number) — immediately appears on `/finished`
+2. **Clears Episode Highlights** — wipes `podcastFeaturedLinks` so the old season's picks are gone
+3. **Opens a guided form** for the new series — prompts for new series title, image URL, and season number before saving
+
+### The form flow
+- User clicks **"End Current Series & Start New Book"**
+- A confirmation modal appears with a summary: "This will archive [Titus] to Finished Books and clear Episode Highlights."
+- Below the confirmation, a small form: New Series Title, New Series Image, New Season Number
+- User fills it in and hits **Confirm**
+- All three changes save together as one content update
+
+### What the user still does manually after
+- Go to Episode Highlights and add 3–5 hand-picked episodes from the new series (the section is now empty and ready)
+
+---
+
+## Changes Required
+
+### 1. `server/routes/episodes.js` — Parse `itunes:season` from RSS
+One line added to `parseRssItems` alongside the existing `itunes:episode` extraction:
+```js
+const season = (/<itunes:season>([\s\S]*?)<\/itunes:season>/.exec(block)?.[1] ?? '').trim()
+```
+Include `season` in the returned episode object.
+
+### 2. `src/content.ts` — New `FinishedBook` type + field on `SiteContent`
+Clean, purpose-built interface:
+```ts
+export interface FinishedBook {
+  id: string
+  title: string
+  description: string
+  imageUrl: string
+  season: number
+}
+```
+Add `finishedBooks: FinishedBook[]` to `SiteContent` with default `[]`.
+
+### 3. `src/App.tsx` — New `useEpisodesForBook` hook
+Fetches `/api/episodes/all` and filters by season number, sorted ascending:
+```js
+const filtered = (data.episodes ?? [])
+  .filter(ep => ep.season === String(book.season))
+  .sort((a, b) => parseInt(a.episode) - parseInt(b.episode))
+```
+
+### 4. `src/App.tsx` — Nav: "Episodes" dropdown replacing flat link
+
+"Episodes" becomes a dropdown parent with two children: **Current Series** (`/episodes`) and **Finished Books** (`/finished`). The flat `<NavLink to="/episodes">` is replaced with a dropdown component. Everything else in the nav stays flat and unchanged.
+
+**Desktop behavior:**
+- "Episodes ▾" shows on hover (or focus), revealing a small popover menu below with the two links
+- Parent label stays gold/active when either child route is active
+- Implemented with CSS `:hover` + `:focus-within` on a wrapper — no JS state needed for desktop
+
+**Mobile behavior (under ~540px):**
+- The mobile nav already collapses to a full-width vertical list with `max-height` animation
+- "Episodes" becomes a top-level row with an expand arrow (chevron)
+- Tapping it toggles a sub-list showing "Current Series" and "Finished Books" indented beneath it
+- Implemented with a small React `useState` toggle on the dropdown item — consistent with how `menuOpen` already works
+- Sub-items get slightly smaller text and left padding to show hierarchy
+- The `max-height: 500px` on `.header-nav--open` will need to increase to `600px` to accommodate the expanded sub-items
+
+**New elements needed:**
+- `NavDropdown` component (or inline JSX) wrapping the two episode links
+- CSS classes: `.nav-dropdown`, `.nav-dropdown-menu`, `.nav-dropdown-item`, `.nav-dropdown--open` (mobile only)
+- Mobile sub-item styles: indented, smaller text, no bottom border on last child before parent closes
+
+**Footer:** Add a flat "Finished Books" link alongside the existing footer nav links — no dropdown needed there.
+
+### 5. `src/App.tsx` — Two new routes
+```tsx
+<Route path="/finished" element={<FinishedBooksPage content={content} />} />
+<Route path="/finished/:id" element={<FinishedSeriesPage content={content} />} />
+```
+
+### 6. `src/App.tsx` — Two new page components
+
+**`FinishedBooksPage`** — grid of `finishedBooks` cards (image, title, description), each linking to `/finished/:id`. Friendly empty state if no books yet.
+
+**`FinishedSeriesPage`** — uses `useEpisodesForBook`, renders episodes sorted ascending by episode number as a numbered playlist. Each row: episode number, title, duration, `EpisodeAudioPlayer`.
+
+### 7. `src/AdminPage.tsx` — "End Current Series" button on Current Series tab
+- Button labeled **"End Current Series & Start New Book"**
+- Opens an inline confirmation + new series form (not a browser `confirm()` — a proper UI panel)
+- On confirm: creates `FinishedBook` from current series data, clears `podcastFeaturedLinks`, updates series fields with new book info
+- All saved as one atomic content update
+
+### 8. `src/AdminPage.tsx` — Finished Books management section
+Separate tab for viewing and managing the finished books list (in case you need to edit or remove one):
+- Shows each finished book as a collapsible card
+- Edit title, description, image, season number
+- Remove button
+- "Add Finished Book" button for manually adding one without going through the transition wizard
+
+### 9. CSS — Playlist and finished books grid styles
+Reuse existing episode-list and episode-card patterns where possible.
+
+### 10. `src/App.tsx` — Downloads page copy tweak (Option A, low priority)
+Minor label changes only — no structural change:
+- Eyebrow becomes "Current Study"
+- Heading becomes `{content.seriesTitle} — Study Guide`
+- Everything else (download form, Amazon button, library) stays identical
+
+---
+
+## Prerequisite — Verify RSS Season Tags
+Before starting, confirm Titus episodes have `<itunes:season>` tags and what number they use:
+```
+curl -s https://anchor.fm/s/11068d290/podcast/rss | grep -o '<itunes:season>[^<]*</itunes:season>' | head -5
+```
+If seasons are missing from the RSS, the fallback is an `episodeRange: { from, to }` field on `FinishedBook` instead of `season`.
+
+---
+
+## Files Touched Summary
+| File | What changes |
+|---|---|
+| `server/routes/episodes.js` | Parse `itunes:season` into episode objects |
+| `src/content.ts` | New `FinishedBook` interface + `finishedBooks` field on `SiteContent` |
+| `src/App.tsx` | New hook, nav links, 2 routes, 2 page components, Downloads copy tweak |
+| `src/AdminPage.tsx` | "End Current Series" transition button + Finished Books management tab |
+| CSS | Playlist page + finished books grid styles |
+
+---
+
+## Order of Work
+1. Run the RSS curl check to confirm season tags (5 min)
+2. `content.ts` — add `FinishedBook` type and `finishedBooks` field
+3. `server/routes/episodes.js` — parse season from RSS
+4. Admin — "End Current Series" transition button + Finished Books management tab
+5. Public pages — nav link, routes, `FinishedBooksPage`, `FinishedSeriesPage`
+6. Downloads copy tweak (last, lowest priority)

podcast-checklist/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:20-alpine
+
+WORKDIR /app
+
+COPY package.json ./
+RUN npm install --production
+
+COPY server.js ./
+COPY public/ ./public/
+
+VOLUME ["/data"]
+
+ENV PORT=3000
+ENV DATA_FILE=/data/progress.json
+
+EXPOSE 3000
+
+CMD ["node", "server.js"]

podcast-checklist/README.md

@@ -0,0 +1,63 @@
+# Podcast Checklist
+
+Episode production tracker for *Verse by Verse with Nate*.
+
+## Deploy
+
+### 1. Build and push to GHCR
+
+```bash
+docker build -t ghcr.io/nmemmert/podcast-checklist:latest .
+docker push ghcr.io/nmemmert/podcast-checklist:latest
+```
+
+### 2. On the Oracle Cloud VM
+
+```bash
+docker pull ghcr.io/nmemmert/podcast-checklist:latest
+docker rm -f podcast-checklist 2>/dev/null || true
+docker run -d \
+  --name podcast-checklist \
+  --restart unless-stopped \
+  -p 3001:3000 \
+  -v podcast-checklist-data:/data \
+  ghcr.io/nmemmert/podcast-checklist:latest
+```
+
+> Uses port **3001** on the host so it doesn't clash with your existing site on 3000.
+> Progress is saved to a named Docker volume (`podcast-checklist-data`) so it survives container restarts and re-deploys.
+
+### 3. Cloudflare DNS
+
+Add a CNAME record in Cloudflare:
+- **Name:** `checklist` (or whatever subdomain you want)
+- **Target:** `versebyversewithnate.us`
+- **Proxy:** Enabled (orange cloud)
+
+### 4. Cloudflare Tunnel or Nginx proxy
+
+If you're using Nginx Proxy Manager or a Cloudflare Tunnel on the VM, add a rule to forward `checklist.versebyversewithnate.us` → `localhost:3001`.
+
+---
+
+## Update workflow
+
+Same as your site:
+
+```bash
+# Local
+docker build -t ghcr.io/nmemmert/podcast-checklist:latest .
+docker push ghcr.io/nmemmert/podcast-checklist:latest
+
+# SSH into VM
+docker pull ghcr.io/nmemmert/podcast-checklist:latest
+docker rm -f podcast-checklist
+docker run -d \
+  --name podcast-checklist \
+  --restart unless-stopped \
+  -p 3001:3000 \
+  -v podcast-checklist-data:/data \
+  ghcr.io/nmemmert/podcast-checklist:latest
+```
+
+Progress data is in the named volume and is **not affected** by pulling a new image.

podcast-checklist/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "podcast-checklist",
+  "version": "1.0.0",
+  "description": "Verse by Verse with Nate — Episode Production Checklist",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "express": "^4.18.2"
+  }
+}

podcast-checklist/public/index.html

@@ -0,0 +1,401 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Episode Checklist — Verse by Verse with Nate</title>
+  <link href="https://fonts.googleapis.com/css2?family=Cormorant+Garamond:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,600&display=swap" rel="stylesheet" />
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+    :root {
+      --black:      #0d0d0a;
+      --card-bg:    #111108;
+      --border:     #1e1c14;
+      --border-mid: #2a2518;
+      --gold:       #c9a84c;
+      --gold-light: #e0c070;
+      --warm-white: #f0ead8;
+      --warm-gray:  #7a7060;
+      --muted:      #4a4438;
+      --dim:        #3a3020;
+      --deep:       #252018;
+    }
+
+    body { background: var(--black); color: var(--warm-white); font-family: 'Cormorant Garamond', Georgia, serif; min-height: 100vh; }
+    ::-webkit-scrollbar { width: 4px; }
+    ::-webkit-scrollbar-track { background: var(--black); }
+    ::-webkit-scrollbar-thumb { background: var(--border-mid); }
+
+    .root { max-width: 720px; margin: 0 auto; padding: 48px 20px 100px; }
+
+    .masthead { text-align: center; margin-bottom: 40px; }
+    .eyebrow { font-size: 10px; letter-spacing: 0.3em; text-transform: uppercase; color: var(--warm-gray); margin-bottom: 10px; }
+    .main-title { font-size: clamp(28px, 6vw, 44px); font-weight: 300; font-style: italic; color: var(--gold); line-height: 1.1; margin-bottom: 4px; }
+    .subtitle { font-size: 13px; color: var(--muted); letter-spacing: 0.1em; }
+    .gold-rule { width: 80px; height: 1px; background: linear-gradient(90deg, transparent, var(--gold), transparent); margin: 18px auto; }
+
+    .save-status { text-align: center; font-size: 11px; letter-spacing: 0.12em; color: var(--dim); margin-bottom: 24px; height: 16px; transition: color 0.3s; }
+    .save-status.saving { color: var(--warm-gray); }
+    .save-status.saved  { color: var(--gold); }
+    .save-status.error  { color: #8b3030; }
+
+    .overall { background: var(--card-bg); border: 1px solid var(--border); border-radius: 2px; padding: 18px 22px; margin-bottom: 32px; }
+    .overall-row { display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 10px; }
+    .overall-label { font-size: 11px; letter-spacing: 0.2em; text-transform: uppercase; color: var(--warm-gray); }
+    .overall-pct { font-size: 28px; font-weight: 300; color: var(--gold); }
+    .bar-wrap { height: 3px; background: var(--border); border-radius: 2px; overflow: hidden; margin-bottom: 14px; }
+    .bar-fill { height: 100%; background: linear-gradient(90deg, var(--gold), var(--gold-light)); border-radius: 2px; transition: width 0.4s ease; }
+    .series-stats { display: flex; gap: 24px; flex-wrap: wrap; }
+    .stat { font-size: 12px; color: var(--muted); }
+    .stat b { color: var(--gold); font-weight: 500; }
+
+    .filters { display: flex; gap: 8px; margin-bottom: 24px; flex-wrap: wrap; }
+    .filter-btn { font-family: 'Cormorant Garamond', serif; font-size: 11px; letter-spacing: 0.2em; text-transform: uppercase; background: none; border: 1px solid var(--border-mid); color: var(--muted); padding: 6px 14px; border-radius: 1px; cursor: pointer; transition: all 0.15s; }
+    .filter-btn:hover { color: var(--gold); border-color: var(--dim); }
+    .filter-btn.active { color: var(--gold); border-color: var(--gold); background: var(--card-bg); }
+
+    .section-label { font-size: 10px; letter-spacing: 0.3em; text-transform: uppercase; color: var(--dim); margin: 28px 0 12px; padding-left: 2px; }
+
+    /* Card */
+    .card { background: var(--card-bg); border: 1px solid var(--border); border-radius: 2px; margin-bottom: 8px; overflow: hidden; transition: border-color 0.2s; }
+    .card:hover { border-color: var(--border-mid); }
+    .card.complete { border-left: 2px solid var(--gold); }
+
+    .card-header { display: flex; align-items: center; gap: 12px; padding: 14px 18px; cursor: pointer; user-select: none; }
+
+    .series-tag { font-size: 9px; letter-spacing: 0.2em; text-transform: uppercase; padding: 2px 7px; border-radius: 1px; flex-shrink: 0; }
+    .tag-Titus { color: var(--gold); background: #1a1810; border: 1px solid var(--border-mid); }
+    .tag-Colossians { color: var(--warm-gray); background: #131310; border: 1px solid var(--border); }
+
+    .ep-num { font-size: 13px; font-weight: 600; color: var(--muted); flex-shrink: 0; min-width: 36px; }
+    .card.complete .ep-num { color: var(--gold); }
+
+    .ep-label { flex: 1; font-size: 15px; color: #c8c0a8; }
+    .card.complete .ep-label { color: var(--muted); }
+
+    .pub-date-pill { font-size: 10px; color: var(--warm-gray); font-style: italic; flex-shrink: 0; letter-spacing: 0.03em; }
+
+    .task-count { font-size: 11px; color: var(--dim); flex-shrink: 0; }
+    .card.complete .task-count { color: var(--gold); }
+
+    .mini-bar { width: 48px; height: 2px; background: var(--border); border-radius: 1px; overflow: hidden; flex-shrink: 0; }
+    .mini-fill { height: 100%; background: linear-gradient(90deg, var(--gold), var(--gold-light)); transition: width 0.3s; }
+
+    .chevron { font-size: 10px; color: var(--border-mid); transition: transform 0.2s, color 0.15s; flex-shrink: 0; }
+    .chevron.open { transform: rotate(180deg); color: var(--muted); }
+
+    .card-body { border-top: 1px solid #1a1810; padding: 0 18px 18px; }
+
+    /* Date published row */
+    .date-row { display: flex; align-items: center; gap: 12px; padding: 14px 0 12px; border-bottom: 1px solid var(--border); margin-bottom: 4px; }
+    .date-label { font-size: 10px; letter-spacing: 0.2em; text-transform: uppercase; color: var(--warm-gray); flex-shrink: 0; }
+    .date-input {
+      background: transparent; border: none; border-bottom: 1px solid var(--border-mid);
+      outline: none; font-family: 'Cormorant Garamond', serif; font-size: 14px;
+      color: var(--gold-light); padding: 2px 6px 3px; cursor: pointer;
+      color-scheme: dark;
+    }
+    .date-input:focus { border-bottom-color: var(--gold); }
+    .date-input::-webkit-calendar-picker-indicator { filter: invert(0.6) sepia(1) saturate(2) hue-rotate(5deg); cursor: pointer; }
+
+    /* Phase headers */
+    .phase-header { font-size: 10px; letter-spacing: 0.25em; text-transform: uppercase; color: var(--warm-gray); padding: 14px 0 6px; border-bottom: 1px solid var(--border); margin-bottom: 2px; display: flex; align-items: center; gap: 8px; }
+    .phase-header::after { content: ''; flex: 1; height: 1px; background: var(--border); }
+    .phase-pre  { color: var(--warm-gray); }
+    .phase-post { color: var(--gold); }
+
+    .task-list { list-style: none; }
+    .task-item { display: flex; align-items: flex-start; gap: 12px; padding: 9px 0; border-bottom: 1px solid #141210; cursor: pointer; }
+    .task-item:last-child { border-bottom: none; }
+
+    .check-box { width: 16px; height: 16px; border: 1px solid var(--border-mid); border-radius: 1px; flex-shrink: 0; margin-top: 3px; display: flex; align-items: center; justify-content: center; transition: background 0.15s, border-color 0.15s; }
+    .task-item.done .check-box { background: var(--gold); border-color: var(--gold); }
+    .check-svg { display: none; }
+    .task-item.done .check-svg { display: block; }
+
+    .step-num { font-size: 9px; letter-spacing: 0.15em; color: var(--border-mid); margin-top: 4px; flex-shrink: 0; width: 22px; }
+
+    .task-body { flex: 1; }
+    .task-name { font-size: 14px; font-weight: 500; color: #d8d0b8; line-height: 1.3; transition: color 0.15s; }
+    .task-item.done .task-name { color: var(--dim); text-decoration: line-through; text-decoration-color: var(--border-mid); }
+    .task-hint { font-size: 12px; color: var(--muted); font-style: italic; margin-top: 1px; }
+    .task-item.done .task-hint { color: var(--deep); }
+    .task-item:hover .task-name { color: var(--warm-white); }
+    .task-item.done:hover .task-name { color: var(--dim); }
+
+    .card-footer { display: flex; justify-content: flex-end; padding-top: 10px; margin-top: 4px; border-top: 1px solid #141210; }
+    .btn-reset { font-family: 'Cormorant Garamond', serif; font-size: 10px; letter-spacing: 0.18em; text-transform: uppercase; background: none; border: 1px solid var(--border); color: var(--dim); padding: 4px 10px; border-radius: 1px; cursor: pointer; transition: all 0.15s; }
+    .btn-reset:hover { color: var(--warm-gray); border-color: var(--border-mid); }
+    .complete-badge { font-size: 9px; letter-spacing: 0.2em; text-transform: uppercase; color: var(--gold); padding: 2px 8px; border: 1px solid var(--border-mid); border-radius: 1px; }
+
+    .loading { text-align: center; color: var(--muted); font-style: italic; padding: 40px; font-size: 15px; }
+  </style>
+</head>
+<body>
+<div class="root">
+
+  <div class="masthead">
+    <div class="eyebrow">Verse by Verse with Nate</div>
+    <div class="main-title">Production Checklist</div>
+    <div class="subtitle">Titus · Colossians</div>
+    <div class="gold-rule"></div>
+  </div>
+
+  <div class="save-status" id="saveStatus"></div>
+
+  <div class="overall">
+    <div class="overall-row">
+      <div class="overall-label">Overall Progress</div>
+      <div class="overall-pct" id="overallPct">0%</div>
+    </div>
+    <div class="bar-wrap"><div class="bar-fill" id="overallBar" style="width:0%"></div></div>
+    <div class="series-stats">
+      <div class="stat">Titus — <b id="titusDone">0</b> / 5 episodes done</div>
+      <div class="stat">Colossians — <b id="colossDone">0</b> / 27 episodes done</div>
+    </div>
+  </div>
+
+  <div class="filters">
+    <button class="filter-btn active" onclick="setFilter('All')">All</button>
+    <button class="filter-btn" onclick="setFilter('Titus')">Titus</button>
+    <button class="filter-btn" onclick="setFilter('Colossians')">Colossians</button>
+  </div>
+
+  <div id="app"><div class="loading">Loading…</div></div>
+</div>
+
+<script>
+// ── Task definitions ────────────────────────────────────────────────────────
+const PRE_TASKS = [
+  { id: "verify_script", step: "01", label: "Verify Script",               desc: "Review for accuracy, theology, and flow" },
+  { id: "read_script",   step: "02", label: "Read Script",                 desc: "Read aloud, mark pacing & emphasis" },
+  { id: "record",        step: "03", label: "Record",                      desc: "Capture final audio take" },
+  { id: "edit",          step: "04", label: "Edit",                        desc: "Trim, cut, clean up in Ferrite / GarageBand" },
+  { id: "mix",           step: "05", label: "Mix",                         desc: "Levels, EQ, music beds, final master" },
+  { id: "video_script",  step: "06", label: "Run Video Conversion Script", desc: "Generate video file from audio" },
+  { id: "post_spotify",  step: "07", label: "Post on Spotify",             desc: "Upload with show notes & discussion questions" },
+];
+
+const POST_TASKS = [
+  { id: "update_website", step: "08", label: "Update Website",   desc: "Add episode highlights to versebyversewithnate.us" },
+  { id: "send_email",     step: "09", label: "Send Email",       desc: "Send newsletter to subscribers via Resend" },
+];
+
+const ALL_TASK_IDS = [...PRE_TASKS, ...POST_TASKS].map(t => t.id);
+
+function makeEpisode(series, number) {
+  const tasks = {};
+  ALL_TASK_IDS.forEach(id => tasks[id] = false);
+  return { id: `${series}-${number}`, series, number, tasks, datePublished: "", expanded: false };
+}
+
+function buildEpisodes() {
+  const titus = [11,12,13,14,15].map(n => makeEpisode("Titus", n));
+  const colossians = Array.from({ length: 27 }, (_, i) => makeEpisode("Colossians", i + 1));
+  return [...titus, ...colossians];
+}
+
+// ── State ───────────────────────────────────────────────────────────────────
+let episodes = [];
+let activeFilter = "All";
+let saveTimer = null;
+
+// ── Server I/O ──────────────────────────────────────────────────────────────
+async function loadFromServer() {
+  try {
+    const res = await fetch("/api/progress");
+    const saved = await res.json();
+    const base = buildEpisodes();
+    episodes = base.map(ep => {
+      const s = saved[ep.id];
+      if (!s) return ep;
+      return {
+        ...ep,
+        expanded: s.expanded ?? false,
+        datePublished: s.datePublished ?? "",
+        tasks: Object.fromEntries(ALL_TASK_IDS.map(id => [id, s.tasks?.[id] ?? false]))
+      };
+    });
+  } catch {
+    episodes = buildEpisodes();
+  }
+  render();
+}
+
+function scheduleSave() {
+  clearTimeout(saveTimer);
+  setStatus("saving", "Saving…");
+  saveTimer = setTimeout(saveToServer, 800);
+}
+
+async function saveToServer() {
+  const payload = {};
+  episodes.forEach(ep => {
+    payload[ep.id] = { expanded: ep.expanded, datePublished: ep.datePublished, tasks: ep.tasks };
+  });
+  try {
+    await fetch("/api/progress", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+    setStatus("saved", "✦ Saved");
+    setTimeout(() => setStatus("", ""), 2000);
+  } catch {
+    setStatus("error", "Save failed — check connection");
+  }
+}
+
+function setStatus(cls, msg) {
+  const el = document.getElementById("saveStatus");
+  el.className = "save-status" + (cls ? " " + cls : "");
+  el.textContent = msg;
+}
+
+// ── Mutations ────────────────────────────────────────────────────────────────
+function toggleTask(epId, taskId) {
+  const ep = episodes.find(e => e.id === epId);
+  ep.tasks[taskId] = !ep.tasks[taskId];
+  scheduleSave(); render();
+}
+
+function toggleExpand(epId) {
+  const ep = episodes.find(e => e.id === epId);
+  ep.expanded = !ep.expanded;
+  scheduleSave(); render();
+}
+
+function setDate(epId, val) {
+  const ep = episodes.find(e => e.id === epId);
+  ep.datePublished = val;
+  scheduleSave(); render();
+}
+
+function resetEpisode(epId) {
+  const ep = episodes.find(e => e.id === epId);
+  ALL_TASK_IDS.forEach(id => ep.tasks[id] = false);
+  ep.datePublished = "";
+  scheduleSave(); render();
+}
+
+function setFilter(f) {
+  activeFilter = f;
+  document.querySelectorAll(".filter-btn").forEach(btn =>
+    btn.classList.toggle("active", btn.textContent === f)
+  );
+  render();
+}
+
+// ── Render ───────────────────────────────────────────────────────────────────
+function render() {
+  updateStats();
+  const app = document.getElementById("app");
+  const filtered = activeFilter === "All" ? episodes : episodes.filter(e => e.series === activeFilter);
+  const titus = filtered.filter(e => e.series === "Titus");
+  const colossians = filtered.filter(e => e.series === "Colossians");
+
+  let html = "";
+  if (titus.length) {
+    html += `<div class="section-label">Titus — Episodes 11–15</div>`;
+    titus.forEach(ep => html += renderCard(ep));
+  }
+  if (colossians.length) {
+    html += `<div class="section-label">Colossians — Episodes 1–27</div>`;
+    colossians.forEach(ep => html += renderCard(ep));
+  }
+  app.innerHTML = html;
+}
+
+function formatDate(val) {
+  if (!val) return "";
+  const [y, m, d] = val.split("-");
+  const months = ["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];
+  return `${months[parseInt(m)-1]} ${parseInt(d)}, ${y}`;
+}
+
+function renderCard(ep) {
+  const allDone = ALL_TASK_IDS.every(id => ep.tasks[id]);
+  const doneCount = ALL_TASK_IDS.filter(id => ep.tasks[id]).length;
+  const total = ALL_TASK_IDS.length;
+  const pct = Math.round((doneCount / total) * 100);
+  const dateDisplay = ep.datePublished ? formatDate(ep.datePublished) : "";
+
+  let body = "";
+  if (ep.expanded) {
+    // Pre-publish tasks
+    const preTasks = PRE_TASKS.map(t => renderTask(ep.id, t, ep.tasks[t.id])).join("");
+    // Post-publish tasks
+    const postTasks = POST_TASKS.map(t => renderTask(ep.id, t, ep.tasks[t.id])).join("");
+
+    const footer = allDone
+      ? `<span class="complete-badge">✦ Complete</span>`
+      : `<button class="btn-reset" onclick="event.stopPropagation();resetEpisode('${ep.id}')">Reset</button>`;
+
+    body = `
+      <div class="card-body">
+        <div class="date-row">
+          <span class="date-label">Date Published</span>
+          <input type="date" class="date-input" value="${ep.datePublished}"
+            onchange="setDate('${ep.id}', this.value)"
+            onclick="event.stopPropagation()" />
+          ${ep.datePublished ? `<span style="font-size:12px;color:var(--warm-gray);font-style:italic;">${formatDate(ep.datePublished)}</span>` : ''}
+        </div>
+
+        <div class="phase-header phase-pre">Pre-Publish</div>
+        <ul class="task-list">${preTasks}</ul>
+
+        <div class="phase-header phase-post" style="margin-top:10px;">Post-Publish</div>
+        <ul class="task-list">${postTasks}</ul>
+
+        <div class="card-footer">${footer}</div>
+      </div>`;
+  }
+
+  return `
+    <div class="card${allDone ? " complete" : ""}">
+      <div class="card-header" onclick="toggleExpand('${ep.id}')">
+        <span class="series-tag tag-${ep.series}">${ep.series}</span>
+        <span class="ep-num">Ep ${ep.number}</span>
+        <span class="ep-label">${ep.series} — Episode ${ep.number}</span>
+        ${dateDisplay ? `<span class="pub-date-pill">${dateDisplay}</span>` : ""}
+        <span class="task-count">${doneCount}/${total}</span>
+        <div class="mini-bar"><div class="mini-fill" style="width:${pct}%"></div></div>
+        <span class="chevron${ep.expanded ? " open" : ""}">▼</span>
+      </div>
+      ${body}
+    </div>`;
+}
+
+function renderTask(epId, t, done) {
+  return `
+    <li class="task-item${done ? " done" : ""}" onclick="toggleTask('${epId}','${t.id}')">
+      <div class="check-box">
+        <svg class="check-svg" width="10" height="8" viewBox="0 0 10 8" fill="none">
+          <path d="M1 4L3.5 6.5L9 1" stroke="#0d0d0a" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+        </svg>
+      </div>
+      <span class="step-num">${t.step}</span>
+      <div class="task-body">
+        <div class="task-name">${t.label}</div>
+        <div class="task-hint">${t.desc}</div>
+      </div>
+    </li>`;
+}
+
+function updateStats() {
+  const totalDone = episodes.reduce((a, e) => a + ALL_TASK_IDS.filter(id => e.tasks[id]).length, 0);
+  const totalTasks = episodes.length * ALL_TASK_IDS.length;
+  const pct = Math.round((totalDone / totalTasks) * 100);
+  document.getElementById("overallPct").textContent = pct + "%";
+  document.getElementById("overallBar").style.width = pct + "%";
+  document.getElementById("titusDone").textContent =
+    episodes.filter(e => e.series === "Titus" && ALL_TASK_IDS.every(id => e.tasks[id])).length;
+  document.getElementById("colossDone").textContent =
+    episodes.filter(e => e.series === "Colossians" && ALL_TASK_IDS.every(id => e.tasks[id])).length;
+}
+
+loadFromServer();
+</script>
+</body>
+</html>

podcast-checklist/server.js

@@ -0,0 +1,43 @@
+const express = require("express");
+const fs = require("fs");
+const path = require("path");
+
+const app = express();
+const PORT = process.env.PORT || 3000;
+const DATA_FILE = process.env.DATA_FILE || "/data/progress.json";
+
+app.use(express.json());
+app.use(express.static(path.join(__dirname, "public")));
+
+// Ensure data directory and file exist
+function ensureDataFile() {
+  const dir = path.dirname(DATA_FILE);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  if (!fs.existsSync(DATA_FILE)) fs.writeFileSync(DATA_FILE, JSON.stringify({}));
+}
+
+// GET progress
+app.get("/api/progress", (req, res) => {
+  try {
+    ensureDataFile();
+    const data = JSON.parse(fs.readFileSync(DATA_FILE, "utf8"));
+    res.json(data);
+  } catch (err) {
+    console.error("Read error:", err);
+    res.status(500).json({ error: "Failed to read progress" });
+  }
+});
+
+// POST progress (full state)
+app.post("/api/progress", (req, res) => {
+  try {
+    ensureDataFile();
+    fs.writeFileSync(DATA_FILE, JSON.stringify(req.body, null, 2));
+    res.json({ ok: true });
+  } catch (err) {
+    console.error("Write error:", err);
+    res.status(500).json({ error: "Failed to save progress" });
+  }
+});
+
+app.listen(PORT, () => console.log(`Podcast checklist running on port ${PORT}`));

public/images/follow-on-facebook.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="184" height="48" viewBox="0 0 184 48">
+  <rect width="184" height="48" rx="6" fill="#1877F2"/>
+  <g transform="translate(11,11)">
+    <circle cx="13" cy="13" r="12" fill="rgba(255,255,255,0.16)"/>
+    <path fill="#ffffff" d="M17.755 13.037C17.755 10.385 15.617 8.237 12.98 8.237c-2.638 0-4.776 2.148-4.776 4.8 0 2.396 1.744 4.383 4.028 4.743v-3.36H11.01v-1.383h1.222v-1.054c0-1.215.719-1.887 1.82-1.887.527 0 1.078.094 1.078.094v1.193h-.608c-.598 0-.784.373-.784.755v.899h1.334l-.213 1.383h-1.121v3.36c2.284-.36 4.017-2.347 4.017-4.743z"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="rgba(255,255,255,0.82)" font-size="9.5" x="52" y="19">Follow on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="16" font-weight="bold" x="52" y="36">Facebook</text>
+</svg>

public/images/listen-on-amazon-music.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="210" height="48" viewBox="0 0 210 48">
+  <rect width="210" height="48" rx="6" fill="#131921"/>
+  <!-- Amazon Music icon: headphone/music note style - simple "a" with music mark -->
+  <g transform="translate(11,11)">
+    <!-- Amazon arrow swoosh shape -->
+    <circle cx="13" cy="13" r="12" fill="#00A8E1"/>
+    <!-- Simplified headphone icon in white -->
+    <path fill="#ffffff" d="M13 4C8.03 4 4 8.03 4 13v1h2v-1c0-3.87 3.13-7 7-7s7 3.13 7 7v1h2v-1c0-4.97-4.03-9-9-9zm-3 10H8c-.55 0-1 .45-1 1v3c0 .55.45 1 1 1h2c.55 0 1-.45 1-1v-3c0-.55-.45-1-1-1zm6 0h-2c-.55 0-1 .45-1 1v3c0 .55.45 1 1 1h2c.55 0 1-.45 1-1v-3c0-.55-.45-1-1-1z"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#b3b3b3" font-size="9.5" x="52" y="19">Listen on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="15" font-weight="bold" x="52" y="36">Amazon Music</text>
+</svg>

public/images/listen-on-castbox.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="183" height="48" viewBox="0 0 183 48">
+  <rect width="183" height="48" rx="6" fill="#1a1a1a"/>
+  <!-- Castbox icon: headphones/podcast icon in orange -->
+  <g transform="translate(11,11)">
+    <circle cx="13" cy="13" r="12" fill="#F55223"/>
+    <!-- Headphones shape in white -->
+    <path fill="#ffffff" d="M13 5C8.58 5 5 8.58 5 13v.5H7V13c0-3.31 2.69-6 6-6s6 2.69 6 6v.5h2V13c0-4.42-3.58-8-8-8zm-3.5 9H7c-.55 0-1 .45-1 1v2.5c0 .55.45 1 1 1h2.5c.55 0 1-.45 1-1V15c0-.55-.45-1-1-1zm7 0h-2.5c-.55 0-1 .45-1 1v2.5c0 .55.45 1 1 1H17c.55 0 1-.45 1-1V15c0-.55-.45-1-1-1z"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#b3b3b3" font-size="9.5" x="52" y="19">Listen on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="16" font-weight="bold" x="52" y="36">Castbox</text>
+</svg>

public/images/listen-on-pocket-casts.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="195" height="48" viewBox="0 0 195 48">
+  <rect width="195" height="48" rx="6" fill="#F43E37"/>
+  <!-- Pocket Casts logo: circle with play-in-wave icon -->
+  <g transform="translate(11,11)">
+    <circle cx="13" cy="13" r="12" fill="rgba(0,0,0,0.25)"/>
+    <!-- Outer arc -->
+    <path fill="#ffffff" d="M13 2C7 2 2 7 2 13s5 11 11 11 11-5 11-11S19 2 13 2zm0 19c-4.42 0-8-3.58-8-8s3.58-8 8-8 8 3.58 8 8-3.58 8-8 8z"/>
+    <!-- Inner arc -->
+    <path fill="#ffffff" d="M13 6c-3.87 0-7 3.13-7 7s3.13 7 7 7 7-3.13 7-7-3.13-7-7-7zm0 11c-2.21 0-4-1.79-4-4s1.79-4 4-4 4 1.79 4 4-1.79 4-4 4z"/>
+    <!-- Center dot -->
+    <circle cx="13" cy="13" r="2.5" fill="#ffffff"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="rgba(255,255,255,0.8)" font-size="9.5" x="52" y="19">Listen on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="14.5" font-weight="bold" x="52" y="36">Pocket Casts</text>
+</svg>

public/images/listen-on-spotify.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="180" height="48" viewBox="0 0 180 48">
+  <rect width="180" height="48" rx="6" fill="#191414"/>
+  <!-- Spotify icon (24x24 viewBox path, scaled to fit 26x26 at offset 11,11) -->
+  <g transform="translate(11,11) scale(1.083)">
+    <path fill="#1DB954" d="M12 0C5.4 0 0 5.4 0 12s5.4 12 12 12 12-5.4 12-12S18.66 0 12 0zm5.521 17.34c-.24.359-.66.48-1.021.24-2.82-1.74-6.36-2.101-10.561-1.141-.418.122-.779-.179-.899-.539-.12-.421.18-.78.54-.9 4.56-1.021 8.52-.6 11.64 1.32.42.18.479.659.301 1.02zm1.44-3.3c-.301.42-.841.6-1.262.3-3.239-1.98-8.159-2.58-11.939-1.38-.479.12-1.02-.12-1.14-.6-.12-.48.12-1.021.6-1.141C9.6 9.9 15 10.561 18.72 12.84c.361.181.54.78.241 1.2zm.12-3.36C15.24 8.4 8.82 8.16 5.16 9.301c-.6.179-1.2-.181-1.38-.721-.18-.601.18-1.2.72-1.381 4.26-1.26 11.28-1.02 15.721 1.621.539.3.719 1.02.419 1.56-.299.421-1.02.599-1.559.3z"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#b3b3b3" font-size="9.5" x="48" y="19">Listen on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="16" font-weight="bold" x="48" y="36">Spotify</text>
+</svg>

public/images/watch-on-youtube.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="190" height="48" viewBox="0 0 190 48">
+  <rect width="190" height="48" rx="6" fill="#0f0f0f"/>
+  <!-- YouTube icon: red rounded rect with white play triangle -->
+  <g transform="translate(11,11)">
+    <!-- YouTube red background rect -->
+    <rect x="1" y="4.5" width="24" height="17" rx="4" fill="#FF0000"/>
+    <!-- White play triangle -->
+    <polygon points="10,9 20,13 10,17" fill="#ffffff"/>
+  </g>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#b3b3b3" font-size="9.5" x="52" y="19">Watch on</text>
+  <text font-family="Helvetica Neue, Helvetica, Arial, sans-serif" fill="#ffffff" font-size="16" font-weight="bold" x="52" y="36">YouTube</text>
+</svg>

public/robots.txt

@@ -0,0 +1,9 @@
+User-agent: *
+Allow: /
+
+Disallow: /admin
+Disallow: /api/
+Disallow: /thanks
+Disallow: /subscribe/thanks
+
+Sitemap: https://versebyversewithnate.us/sitemap.xml

public/salvation/index.html

@@ -0,0 +1,899 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Gospel Harmony — The Trial & Crucifixion</title>
+<link href="https://fonts.googleapis.com/css2?family=Cinzel:wght@400;600;700;900&family=EB+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500&display=swap" rel="stylesheet">
+<style>
+  :root {
+    --parchment: #f5edd8;
+    --parchment-dark: #e8d9b8;
+    --ink: #1a1208;
+    --ink-light: #3d2c10;
+    --crimson: #8b1a1a;
+    --gold: #b8860b;
+    --gold-light: #d4a843;
+    --matt-color: #4a6fa5;
+    --mark-color: #7a4a8f;
+    --luke-color: #2e7d52;
+    --john-color: #b5651d;
+    --shadow: rgba(26,18,8,0.18);
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body {
+    background: #1a0f05;
+    font-family: 'EB Garamond', Georgia, serif;
+    color: var(--ink);
+    min-height: 100vh;
+    overflow-x: hidden;
+  }
+  body::before {
+    content: '';
+    position: fixed;
+    inset: 0;
+    background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='400' height='400'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.65' numOctaves='3' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='400' height='400' filter='url(%23n)' opacity='0.07'/%3E%3C/svg%3E");
+    pointer-events: none;
+    z-index: 0;
+    opacity: 0.5;
+  }
+  .scroll-wrapper {
+    max-width: 960px;
+    margin: 0 auto;
+    padding: 0 1.5rem 4rem;
+    position: relative;
+    z-index: 1;
+  }
+  header {
+    text-align: center;
+    padding: 3.5rem 2rem 2rem;
+  }
+  .header-rule {
+    height: 3px;
+    background: linear-gradient(90deg, transparent, var(--gold), var(--crimson), var(--gold), transparent);
+    margin-bottom: 1.8rem;
+    position: relative;
+  }
+  .header-rule::before, .header-rule::after {
+    content: '✦';
+    position: absolute;
+    top: 50%;
+    transform: translateY(-50%);
+    color: var(--gold);
+    font-size: 0.9rem;
+    background: #1a0f05;
+    padding: 0 0.5rem;
+  }
+  .header-rule::before { left: 20%; }
+  .header-rule::after  { right: 20%; }
+  header h1 {
+    font-family: 'Cinzel', serif;
+    font-size: clamp(1.6rem, 5vw, 3rem);
+    font-weight: 900;
+    color: var(--parchment);
+    letter-spacing: 0.06em;
+    text-shadow: 0 2px 8px rgba(0,0,0,0.5);
+    line-height: 1.15;
+  }
+  header h1 span { color: var(--gold-light); }
+  header .subtitle {
+    font-family: 'EB Garamond', serif;
+    font-style: italic;
+    color: var(--parchment-dark);
+    font-size: 1.1rem;
+    margin-top: 0.6rem;
+    opacity: 0.85;
+  }
+  .legend {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    gap: 0.6rem 1.4rem;
+    margin: 2rem auto 1rem;
+    padding: 1rem 1.5rem;
+    background: rgba(245,237,216,0.06);
+    border: 1px solid rgba(184,134,11,0.3);
+    border-radius: 4px;
+    max-width: 700px;
+  }
+  .legend-item {
+    display: flex;
+    align-items: center;
+    gap: 0.45rem;
+    font-family: 'Cinzel', serif;
+    font-size: 0.78rem;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    cursor: pointer;
+    transition: opacity 0.2s;
+    color: var(--parchment);
+    user-select: none;
+  }
+  .legend-item.dimmed { opacity: 0.35; }
+  .legend-dot {
+    width: 14px; height: 14px;
+    border-radius: 50%;
+    border: 2px solid rgba(255,255,255,0.3);
+    flex-shrink: 0;
+  }
+  .filter-bar {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+    gap: 0.5rem;
+    margin: 1rem 0 2.5rem;
+  }
+  .filter-btn {
+    font-family: 'Cinzel', serif;
+    font-size: 0.72rem;
+    font-weight: 600;
+    letter-spacing: 0.1em;
+    padding: 0.35rem 0.9rem;
+    border-radius: 2px;
+    border: 1px solid;
+    cursor: pointer;
+    transition: all 0.2s;
+    text-transform: uppercase;
+  }
+  .filter-btn.active-filter { color: var(--ink); font-weight: 700; }
+  .filter-btn:not(.active-filter) {
+    background: transparent;
+    color: var(--parchment-dark);
+    opacity: 0.55;
+  }
+  .filter-btn:hover { opacity: 1; }
+  .timeline {
+    position: relative;
+    padding-left: 2.5rem;
+  }
+  .timeline::before {
+    content: '';
+    position: absolute;
+    left: 0.95rem;
+    top: 0; bottom: 0;
+    width: 2px;
+    background: linear-gradient(180deg, var(--gold) 0%, var(--crimson) 50%, var(--gold) 100%);
+    opacity: 0.5;
+  }
+  .phase-header {
+    position: relative;
+    margin: 2.5rem 0 1rem;
+    display: flex;
+    align-items: center;
+    gap: 1rem;
+  }
+  .phase-header::before {
+    content: '';
+    position: absolute;
+    left: -2.5rem;
+    width: 2rem;
+    height: 2px;
+    background: var(--gold);
+  }
+  .phase-node {
+    width: 1.8rem; height: 1.8rem;
+    border-radius: 50%;
+    background: linear-gradient(135deg, var(--gold), var(--crimson));
+    border: 3px solid var(--parchment-dark);
+    position: absolute;
+    left: -2.42rem;
+    top: 50%;
+    transform: translateY(-50%);
+    box-shadow: 0 0 12px rgba(184,134,11,0.5);
+    z-index: 2;
+  }
+  .phase-label {
+    font-family: 'Cinzel', serif;
+    font-size: 0.72rem;
+    font-weight: 700;
+    letter-spacing: 0.18em;
+    text-transform: uppercase;
+    color: var(--gold-light);
+    padding: 0.2rem 0.8rem;
+    border: 1px solid rgba(184,134,11,0.4);
+    border-radius: 2px;
+    background: rgba(26,9,5,0.6);
+  }
+  .phase-title {
+    font-family: 'Cinzel', serif;
+    font-size: 1.05rem;
+    font-weight: 700;
+    color: var(--parchment);
+    letter-spacing: 0.04em;
+  }
+  .event-card {
+    position: relative;
+    margin: 0.65rem 0;
+    background: linear-gradient(135deg, rgba(245,237,216,0.96) 0%, rgba(232,217,184,0.94) 100%);
+    border-radius: 4px;
+    padding: 1rem 1.2rem 1rem 1.4rem;
+    border-left: 4px solid var(--crimson);
+    box-shadow: 2px 3px 14px var(--shadow), inset 0 1px 0 rgba(255,255,255,0.4);
+    transition: transform 0.18s, box-shadow 0.18s, opacity 0.25s;
+  }
+  .event-card:hover {
+    transform: translateX(3px);
+    box-shadow: 4px 5px 20px rgba(26,18,8,0.28);
+  }
+  .event-card.hidden { display: none; }
+  .event-card::before {
+    content: '';
+    position: absolute;
+    left: -2.09rem;
+    top: 1.1rem;
+    width: 10px; height: 10px;
+    border-radius: 50%;
+    background: var(--parchment);
+    border: 2px solid var(--crimson);
+    box-shadow: 0 0 0 2px rgba(26,18,8,0.15);
+  }
+  .event-title {
+    font-family: 'Cinzel', serif;
+    font-size: 0.88rem;
+    font-weight: 700;
+    color: var(--ink);
+    letter-spacing: 0.04em;
+    margin-bottom: 0.35rem;
+    line-height: 1.3;
+  }
+  .event-body {
+    font-size: 0.9rem;
+    color: var(--ink-light);
+    line-height: 1.6;
+    font-style: italic;
+    margin-bottom: 0.5rem;
+  }
+  .gospel-badges {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.3rem;
+    margin-top: 0.4rem;
+  }
+  /* shared badge base */
+  .badge {
+    font-family: 'Cinzel', serif;
+    font-size: 0.65rem;
+    font-weight: 700;
+    letter-spacing: 0.1em;
+    padding: 0.15rem 0.55rem;
+    border-radius: 2px;
+    border: 1px solid;
+    color: white;
+    text-decoration: none;
+    display: inline-block;
+    cursor: default;
+  }
+  a.badge {
+    cursor: pointer;
+    transition: filter 0.15s, transform 0.15s;
+  }
+  a.badge:hover {
+    filter: brightness(1.25);
+    transform: translateY(-1px);
+  }
+  .badge-matt  { background: var(--matt-color); border-color: #3a5a8a; }
+  .badge-mark  { background: var(--mark-color); border-color: #6a3a7f; }
+  .badge-luke  { background: var(--luke-color); border-color: #1e6040; }
+  .badge-john  { background: var(--john-color); border-color: #8b4513; }
+  .ref-text {
+    font-size: 0.72rem;
+    color: #7a5a2a;
+    margin-top: 0.35rem;
+    font-style: normal;
+    letter-spacing: 0.02em;
+  }
+  .unique-note {
+    font-size: 0.75rem;
+    font-style: italic;
+    color: var(--crimson);
+    margin-top: 0.3rem;
+    padding-top: 0.25rem;
+    border-top: 1px dashed rgba(139,26,26,0.25);
+  }
+  .bsb-hint {
+    font-size: 0.68rem;
+    color: #9a7a3a;
+    margin-top: 0.4rem;
+    font-style: italic;
+    opacity: 0.8;
+  }
+  footer {
+    text-align: center;
+    padding: 3rem 1rem 1.5rem;
+    font-size: 0.8rem;
+    color: rgba(245,237,216,0.35);
+    font-style: italic;
+    font-family: 'EB Garamond', serif;
+    letter-spacing: 0.04em;
+  }
+  @media (max-width: 600px) {
+    .timeline { padding-left: 2rem; }
+    .timeline::before { left: 0.7rem; }
+    .event-card::before { left: -1.6rem; }
+    .phase-node { left: -1.92rem; }
+    .phase-header::before { left: -2rem; width: 1.6rem; }
+    .event-card { padding: 0.9rem 1rem 0.9rem 1.1rem; }
+  }
+</style>
+</head>
+<body>
+<div class="scroll-wrapper">
+
+<header>
+  <div class="header-rule"></div>
+  <h1>A <span>Gospel Harmony</span><br>The Trial &amp; Crucifixion of Jesus</h1>
+  <p class="subtitle">Matthew · Mark · Luke · John — Woven into One Timeline</p>
+  <div class="header-rule" style="margin-top:1.6rem;margin-bottom:0"></div>
+</header>
+
+<div class="legend">
+  <div class="legend-item" data-gospel="matt" onclick="toggleGospel('matt',this)">
+    <div class="legend-dot" style="background:var(--matt-color)"></div> Matthew
+  </div>
+  <div class="legend-item" data-gospel="mark" onclick="toggleGospel('mark',this)">
+    <div class="legend-dot" style="background:var(--mark-color)"></div> Mark
+  </div>
+  <div class="legend-item" data-gospel="luke" onclick="toggleGospel('luke',this)">
+    <div class="legend-dot" style="background:var(--luke-color)"></div> Luke
+  </div>
+  <div class="legend-item" data-gospel="john" onclick="toggleGospel('john',this)">
+    <div class="legend-dot" style="background:var(--john-color)"></div> John
+  </div>
+</div>
+
+<div class="filter-bar">
+  <button class="filter-btn active-filter" style="border-color:var(--gold);background:var(--gold);color:var(--ink)" onclick="filterPhase('all',this)">All Events</button>
+  <button class="filter-btn" style="border-color:#555" onclick="filterPhase('arrest',this)">Arrest</button>
+  <button class="filter-btn" style="border-color:#555" onclick="filterPhase('jewish-trial',this)">Jewish Trial</button>
+  <button class="filter-btn" style="border-color:#555" onclick="filterPhase('roman-trial',this)">Roman Trial</button>
+  <button class="filter-btn" style="border-color:#555" onclick="filterPhase('crucifixion',this)">Crucifixion</button>
+  <button class="filter-btn" style="border-color:#555" onclick="filterPhase('burial',this)">Burial</button>
+</div>
+
+<div class="timeline" id="timeline"></div>
+
+<footer>
+  A harmonic arrangement of Matthew 26–27, Mark 14–15, Luke 22–23, and John 18–19.<br>
+  Click any Gospel badge to open that passage in the Berean Standard Bible (BSB) at BibleHub.
+</footer>
+
+</div>
+<script>
+// BSB URL helper — BibleHub format: https://biblehub.com/bsb/matthew/26.htm
+const BSB = {
+  matt: (ch) => `https://biblehub.com/bsb/matthew/${ch}.htm`,
+  mark: (ch) => `https://biblehub.com/bsb/mark/${ch}.htm`,
+  luke: (ch) => `https://biblehub.com/bsb/luke/${ch}.htm`,
+  john: (ch) => `https://biblehub.com/bsb/john/${ch}.htm`,
+};
+
+const GOSPELS = ['matt','mark','luke','john'];
+const activeGospels = new Set(GOSPELS);
+let activePhase = 'all';
+
+const data = [
+  // ── PHASE 1: ARREST ──────────────────────────────────────────
+  { phase:'arrest', phaseLabel:'Phase I', phaseTitle:'The Arrest in Gethsemane', events:[
+    {
+      title:'The Last Supper & Passover Meal',
+      body:"Jesus eats the Passover meal with his twelve disciples, institutes the Lord's Supper, and predicts his betrayal.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:20–29 · Mark 14:17–25 · Luke 22:14–23 · John 13:1–30',
+      unique:"John alone records Jesus washing the disciples' feet and the extended farewell discourse (John 13–17).",
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(13) }
+    },
+    {
+      title:"Jesus Predicts Peter's Denial",
+      body:"Jesus tells Peter that before the rooster crows, he will deny him three times.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:31–35 · Mark 14:27–31 · Luke 22:31–34 · John 13:36–38',
+      unique:'Luke adds that Jesus prayed specifically for Peter that his faith would not fail.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(13) }
+    },
+    {
+      title:'The Agony in Gethsemane',
+      body:'Jesus prays alone in the garden in great anguish: "Father, if you are willing, remove this cup from me; nevertheless, not my will, but yours, be done."',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 26:36–46 · Mark 14:32–42 · Luke 22:39–46',
+      unique:'Luke alone records that an angel appeared to strengthen Jesus, and that his sweat became like drops of blood.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22) }
+    },
+    {
+      title:'Judas Arrives with the Crowd',
+      body:'Judas leads a crowd with swords and clubs, sent from the chief priests and elders, into the garden.',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:47 · Mark 14:43 · Luke 22:47 · John 18:3',
+      unique:'John specifies it was a Roman cohort plus Jewish officers, and that they carried lanterns and torches.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(18) }
+    },
+    {
+      title:"The Betrayer's Kiss",
+      body:"Judas greets Jesus with a kiss as the prearranged sign of identification.",
+      gospels:['matt','mark','luke'],
+      refs:'Matt 26:48–49 · Mark 14:44–45 · Luke 22:47–48',
+      unique:'John omits the kiss; instead Jesus steps forward and declares "I am he," causing the crowd to fall to the ground.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22) }
+    },
+    {
+      title:'Jesus Identifies Himself — "I Am He" (John)',
+      body:'Jesus asks "Whom do you seek?" When they say "Jesus of Nazareth," he says "I am he," and the entire crowd falls backward to the ground.',
+      gospels:['john'],
+      refs:'John 18:4–9',
+      unique:'Unique to John — a powerful "I Am" moment that echoes the divine name.',
+      bsbLinks:{ john:BSB.john(18) }
+    },
+    {
+      title:"The Servant's Ear Cut Off",
+      body:"One of those with Jesus draws a sword and cuts off the right ear of the high priest's servant, Malchus.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:51 · Mark 14:47 · Luke 22:50 · John 18:10',
+      unique:'Only John names the attacker as Peter and the servant as Malchus. Only Luke records that Jesus healed the ear.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(18) }
+    },
+    {
+      title:'Jesus Rebukes the Sword & Surrenders',
+      body:'"Put your sword back in its place. Shall I not drink the cup the Father has given me?" Then all the disciples fled.',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:52–56 · Mark 14:48–50 · Luke 22:51–53 · John 18:11',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(18) }
+    },
+    {
+      title:'The Young Man Who Fled (Mark)',
+      body:'A young man follows Jesus wearing only a linen cloth; when seized, he leaves the cloth behind and flees naked.',
+      gospels:['mark'],
+      refs:'Mark 14:51–52',
+      unique:'Unique to Mark — possibly a self-reference by the author.',
+      bsbLinks:{ mark:BSB.mark(14) }
+    },
+  ]},
+
+  // ── PHASE 2: JEWISH TRIAL ─────────────────────────────────────
+  { phase:'jewish-trial', phaseLabel:'Phase II', phaseTitle:'The Jewish Trial', events:[
+    {
+      title:'Jesus Led to Annas (John)',
+      body:"Jesus is first brought to Annas, father-in-law of Caiaphas, who questions Jesus about his disciples and teaching.",
+      gospels:['john'],
+      refs:'John 18:12–14, 19–24',
+      unique:'Unique to John. After the interrogation, Annas sends Jesus bound to Caiaphas.',
+      bsbLinks:{ john:BSB.john(18) }
+    },
+    {
+      title:"Peter Follows to the Courtyard",
+      body:"Peter and another disciple follow Jesus to the high priest's courtyard. Peter stands warming himself by the fire.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:58 · Mark 14:54 · Luke 22:54–55 · John 18:15–16',
+      unique:"John identifies 'another disciple' known to the high priest who helped Peter gain entry.",
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(18) }
+    },
+    {
+      title:'The Trial Before Caiaphas & the Sanhedrin',
+      body:"The Sanhedrin assembles and seeks false testimony against Jesus. Many false witnesses come, but their testimony does not agree.",
+      gospels:['matt','mark'],
+      refs:'Matt 26:57, 59–61 · Mark 14:53, 55–59',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14) }
+    },
+    {
+      title:'"Are You the Christ?" — The High Priest\'s Question',
+      body:'"I adjure you by the living God, tell us if you are the Christ, the Son of God." Jesus answered, "You have said so. But I tell you, from now on you will see the Son of Man seated at the right hand of Power."',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 26:63–64 · Mark 14:61–62 · Luke 22:66–70',
+      unique:"Luke places a formal Sanhedrin inquiry at daybreak. Mark records Jesus' most direct 'I am' reply.",
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22) }
+    },
+    {
+      title:'The Verdict: Blasphemy — Deserving Death',
+      body:'The high priest tears his robes: "He has uttered blasphemy!" The assembly declares Jesus deserves death and begins spitting on him, striking him, and mocking him.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 26:65–68 · Mark 14:63–65 · Luke 22:63–65',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22) }
+    },
+    {
+      title:"Peter's Three Denials",
+      body:"As Jesus is being tried, Peter denies knowing him three times — to a servant girl, another servant, and bystanders — and the rooster crows.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 26:69–75 · Mark 14:66–72 · Luke 22:56–62 · John 18:17–18, 25–27',
+      unique:'Luke alone records that Jesus turned and looked at Peter, and Peter went out and wept bitterly.',
+      bsbLinks:{ matt:BSB.matt(26), mark:BSB.mark(14), luke:BSB.luke(22), john:BSB.john(18) }
+    },
+    {
+      title:"Judas's Remorse & Death (Matthew)",
+      body:"Judas sees that Jesus has been condemned, brings the thirty pieces of silver back to the chief priests, and goes and hangs himself. The priests use the money to buy the Potter's Field.",
+      gospels:['matt'],
+      refs:'Matt 27:3–10',
+      unique:'Unique to Matthew. Acts 1:18–19 offers a parallel account of Judas\'s end.',
+      bsbLinks:{ matt:BSB.matt(27) }
+    },
+    {
+      title:'Early Morning Formal Condemnation',
+      body:'At daybreak the chief priests and the whole council hold a formal session and bind Jesus to hand him over to Pilate.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:1–2 · Mark 15:1 · Luke 22:66–23:1',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+  ]},
+
+  // ── PHASE 3: ROMAN TRIAL ──────────────────────────────────────
+  { phase:'roman-trial', phaseLabel:'Phase III', phaseTitle:'The Roman Trial Before Pilate', events:[
+    {
+      title:'Jesus Brought Before Pilate',
+      body:"The Jewish leaders bring Jesus to Pilate's headquarters. They do not enter so as not to be defiled before Passover. They accuse Jesus of misleading the nation, opposing taxes, and claiming to be King.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:2,11 · Mark 15:1–2 · Luke 23:1–2 · John 18:28–32',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(18) }
+    },
+    {
+      title:'"Are You the King of the Jews?" — Pilate\'s First Question',
+      body:'"Are you the King of the Jews?" Jesus replies, "You have said so" — or in John\'s longer account, "My kingdom is not of this world."',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:11 · Mark 15:2 · Luke 23:3 · John 18:33–37',
+      unique:'John records the extensive private exchange between Pilate and Jesus about kingship and truth.',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(18) }
+    },
+    {
+      title:'Jesus Silent Before Accusations',
+      body:'As the chief priests heap on charges, Jesus gives no answer, so that Pilate is greatly amazed.',
+      gospels:['matt','mark'],
+      refs:'Matt 27:12–14 · Mark 15:3–5',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15) }
+    },
+    {
+      title:'Jesus Sent to Herod Antipas (Luke)',
+      body:"Learning Jesus is from Galilee, Pilate sends him to Herod, who is in Jerusalem. Herod questions Jesus at length but Jesus says nothing. Herod mocks him, dresses him in splendid clothing, and sends him back.",
+      gospels:['luke'],
+      refs:'Luke 23:6–12',
+      unique:'Unique to Luke. Luke notes this made Herod and Pilate friends that day.',
+      bsbLinks:{ luke:BSB.luke(23) }
+    },
+    {
+      title:'Pilate Declares Jesus Innocent',
+      body:'Pilate announces he finds no guilt in Jesus, and that neither does Herod. He offers to release one prisoner according to the custom.',
+      gospels:['luke','john'],
+      refs:'Luke 23:13–16 · John 18:38–19:6',
+      unique:"Luke alone notes three formal declarations of innocence by Pilate.",
+      bsbLinks:{ luke:BSB.luke(23), john:BSB.john(18) }
+    },
+    {
+      title:'Barabbas Released — Jesus Condemned',
+      body:'The crowd chooses to release Barabbas, a notorious rebel and murderer, instead of Jesus. The crowd shouts "Crucify him!"',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:15–23 · Mark 15:6–14 · Luke 23:18–23 · John 18:39–40',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(18) }
+    },
+    {
+      title:"Pilate's Wife's Warning (Matthew)",
+      body:'"Have nothing to do with that righteous man, for I have suffered much over him today in a dream."',
+      gospels:['matt'],
+      refs:'Matt 27:19',
+      unique:'Unique to Matthew.',
+      bsbLinks:{ matt:BSB.matt(27) }
+    },
+    {
+      title:"Pilate Washes His Hands (Matthew)",
+      body:'Pilate takes water and washes his hands before the crowd: "I am innocent of this man\'s blood." The people respond, "His blood be on us and on our children."',
+      gospels:['matt'],
+      refs:'Matt 27:24–25',
+      unique:'Unique to Matthew.',
+      bsbLinks:{ matt:BSB.matt(27) }
+    },
+    {
+      title:'"Behold the Man" — Ecce Homo (John)',
+      body:'Pilate leads Jesus out wearing the crown of thorns and a purple robe: "Behold the man!" The chief priests cry "Crucify him!"',
+      gospels:['john'],
+      refs:'John 19:4–7',
+      unique:'Unique to John.',
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:'"Son of God" Accusation Frightens Pilate (John)',
+      body:'When the Jews say Jesus made himself the Son of God, Pilate is even more afraid and questions Jesus again about his origin, but Jesus gives no answer.',
+      gospels:['john'],
+      refs:'John 19:8–11',
+      unique:"Unique to John — Jesus' declaration that Pilate's authority comes from above.",
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:"The Soldiers' Mockery",
+      body:"Pilate's soldiers strip Jesus, put a scarlet/purple robe on him, press a crown of thorns on his head, put a reed in his right hand, kneel before him mockingly, spit on him, and strike him.",
+      gospels:['matt','mark','john'],
+      refs:'Matt 27:27–31 · Mark 15:16–20 · John 19:2–3',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), john:BSB.john(19) }
+    },
+    {
+      title:'Final Condemnation — Jesus Handed Over',
+      body:'Pilate, seeking to release Jesus but fearful of the cry "You are no friend of Caesar!", finally hands Jesus over to be crucified.',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:26 · Mark 15:15 · Luke 23:24–25 · John 19:12–16',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+  ]},
+
+  // ── PHASE 4: CRUCIFIXION ──────────────────────────────────────
+  { phase:'crucifixion', phaseLabel:'Phase IV', phaseTitle:'The Way of the Cross & Crucifixion', events:[
+    {
+      title:'Jesus Carries His Cross',
+      body:'Jesus goes out carrying his own cross to the place called Golgotha, "The Place of a Skull."',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:31–32 · Mark 15:20–21 · Luke 23:26 · John 19:17',
+      unique:'John uniquely emphasizes Jesus carried his own cross (echoing Isaac carrying wood in Gen 22). The Synoptics record Simon of Cyrene being compelled to carry it.',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+    {
+      title:'Simon of Cyrene Carries the Cross',
+      body:'Coming in from the country, Simon of Cyrene is seized and compelled to carry the cross behind Jesus.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:32 · Mark 15:21 · Luke 23:26',
+      unique:"Mark names Simon's sons, Alexander and Rufus, suggesting they were known to Mark's community.",
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'Jesus Addresses the Daughters of Jerusalem (Luke)',
+      body:'"Daughters of Jerusalem, do not weep for me, but weep for yourselves and for your children... For if they do these things when the wood is green, what will happen when it is dry?"',
+      gospels:['luke'],
+      refs:'Luke 23:27–31',
+      unique:'Unique to Luke.',
+      bsbLinks:{ luke:BSB.luke(23) }
+    },
+    {
+      title:'The Offer of Wine Mixed with Gall/Myrrh',
+      body:'Before the crucifixion, soldiers offer Jesus wine mixed with gall (or myrrh) — a narcotic to dull the pain — but Jesus refuses after tasting it.',
+      gospels:['matt','mark'],
+      refs:'Matt 27:34 · Mark 15:23',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15) }
+    },
+    {
+      title:'The Crucifixion — The Third Hour',
+      body:'Jesus is crucified between two criminals. The soldiers cast lots for his garments, fulfilling Psalm 22:18.',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:35 · Mark 15:24–25 · Luke 23:33 · John 19:18, 23–24',
+      unique:"John uniquely emphasizes the lot-casting fulfills Scripture and describes the tunic as seamless (echoing the high priest's garment).",
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+    {
+      title:'The Title on the Cross: "King of the Jews"',
+      body:'Pilate has a notice written in Hebrew, Greek, and Latin: "Jesus of Nazareth, the King of the Jews."',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:37 · Mark 15:26 · Luke 23:38 · John 19:19–22',
+      unique:'John alone records the Jewish leaders\' protest and Pilate\'s firm reply: "What I have written, I have written."',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+    {
+      title:'The Mockery at the Cross',
+      body:'Passersby wag their heads: "You who would destroy the temple, save yourself!" The chief priests, scribes, and elders join in mocking.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:39–44 · Mark 15:29–32 · Luke 23:35–37',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'One Criminal Repents — "Remember Me" (Luke)',
+      body:'One criminal joins the mockery. The other rebukes him and says, "Jesus, remember me when you come into your kingdom." Jesus replies, "Today you will be with me in paradise."',
+      gospels:['luke'],
+      refs:'Luke 23:39–43',
+      unique:'Unique to Luke — the only death-row conversion recorded in the Gospels.',
+      bsbLinks:{ luke:BSB.luke(23) }
+    },
+    {
+      title:"Jesus Entrusts His Mother to the Beloved Disciple (John)",
+      body:'"Woman, behold your son... Behold your mother." From that hour the disciple took her into his own home.',
+      gospels:['john'],
+      refs:'John 19:25–27',
+      unique:'Unique to John.',
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:'Darkness Over the Land — Three Hours',
+      body:'From the sixth hour (noon) to the ninth hour (3 p.m.), darkness covers all the land.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:45 · Mark 15:33 · Luke 23:44',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'"My God, My God, Why Have You Forsaken Me?"',
+      body:'About the ninth hour Jesus cries out, "Eloi, Eloi, lema sabachthani?" — quoting Psalm 22:1. Some bystanders think he is calling for Elijah.',
+      gospels:['matt','mark'],
+      refs:'Matt 27:46–47 · Mark 15:34–35',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15) }
+    },
+    {
+      title:'"I Thirst" (John)',
+      body:'Jesus says "I thirst." A sponge soaked in sour wine is put on a hyssop branch and offered to him.',
+      gospels:['john'],
+      refs:'John 19:28–29',
+      unique:"John frames this as Jesus knowing 'all was now finished, to fulfill Scripture' (Ps 22:15; 69:21). The hyssop branch echoes the Passover lamb.",
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:'"Father, Forgive Them" (Luke)',
+      body:'"Father, forgive them, for they know not what they do."',
+      gospels:['luke'],
+      refs:'Luke 23:34',
+      unique:'Unique to Luke.',
+      bsbLinks:{ luke:BSB.luke(23) }
+    },
+    {
+      title:'"It Is Finished" — Tetelestai (John)',
+      body:'Jesus says, "It is finished" (τετέλεσται — tetelestai, meaning "paid in full"). He bows his head and gives up his spirit.',
+      gospels:['john'],
+      refs:'John 19:30',
+      unique:'Unique to John — the climactic proclamation of completed redemption.',
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:'"Father, Into Your Hands I Commit My Spirit" (Luke)',
+      body:'With a loud cry, Jesus says, "Father, into your hands I commit my spirit!" (quoting Psalm 31:5), and breathes his last.',
+      gospels:['luke'],
+      refs:'Luke 23:46',
+      unique:'Unique to Luke.',
+      bsbLinks:{ luke:BSB.luke(23) }
+    },
+    {
+      title:'Jesus Breathes His Last & The Temple Curtain Torn',
+      body:'Jesus utters a loud cry and breathes his last. The curtain of the temple is torn in two, from top to bottom.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:50–51 · Mark 15:37–38 · Luke 23:45–46',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'Earthquake, Rocks Split & Tombs Opened (Matthew)',
+      body:'The earth shakes and rocks split. Tombs are opened and many saints who had fallen asleep are raised, appearing to many in Jerusalem after the resurrection.',
+      gospels:['matt'],
+      refs:'Matt 27:51–53',
+      unique:'Unique to Matthew — a remarkable eschatological sign accompanying the death of Christ.',
+      bsbLinks:{ matt:BSB.matt(27) }
+    },
+    {
+      title:"The Centurion's Confession",
+      body:'The Roman centurion, seeing how Jesus died, declares: "Truly this man was the Son of God!" (Matt/Mark) or "Certainly this man was innocent!" (Luke).',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:54 · Mark 15:39 · Luke 23:47',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'The Women Watching from a Distance',
+      body:'Many women who followed Jesus from Galilee look on from a distance, including Mary Magdalene, Mary the mother of James and Joseph, and Salome.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:55–56 · Mark 15:40–41 · Luke 23:49',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:"Soldiers Break No Bones — Spear Thrust (John)",
+      body:"To hasten death, soldiers break the legs of the two criminals. Finding Jesus already dead, a soldier pierces his side with a spear, and blood and water immediately flow out.",
+      gospels:['john'],
+      refs:'John 19:31–37',
+      unique:"Unique to John. He sees this fulfilling 'Not one of his bones will be broken' (Ex 12:46; Ps 34:20) and Zechariah 12:10.",
+      bsbLinks:{ john:BSB.john(19) }
+    },
+  ]},
+
+  // ── PHASE 5: BURIAL ──────────────────────────────────────────
+  { phase:'burial', phaseLabel:'Phase V', phaseTitle:'The Burial of Jesus', events:[
+    {
+      title:'Joseph of Arimathea Requests the Body',
+      body:"Joseph of Arimathea, a respected council member and secret disciple, goes to Pilate and asks for the body of Jesus. Pilate confirms with the centurion that Jesus is dead and grants the request.",
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:57–58 · Mark 15:42–45 · Luke 23:50–52 · John 19:38',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+    {
+      title:'Nicodemus Brings Spices (John)',
+      body:"Nicodemus, who had come to Jesus by night, brings a mixture of myrrh and aloes — about seventy-five pounds.",
+      gospels:['john'],
+      refs:'John 19:39',
+      unique:'Unique to John. The extravagant amount of spices honors Jesus as royalty.',
+      bsbLinks:{ john:BSB.john(19) }
+    },
+    {
+      title:'The Body Wrapped & Laid in the Tomb',
+      body:'The body is wrapped in a clean linen shroud and laid in a new tomb cut from rock, in which no one had yet been buried. A large stone is rolled against the entrance.',
+      gospels:['matt','mark','luke','john'],
+      refs:'Matt 27:59–60 · Mark 15:46 · Luke 23:53 · John 19:40–42',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23), john:BSB.john(19) }
+    },
+    {
+      title:'The Women See Where He Is Laid',
+      body:'Mary Magdalene and Mary the mother of Joses observe where Jesus is laid. They return home and prepare spices and ointments.',
+      gospels:['matt','mark','luke'],
+      refs:'Matt 27:61 · Mark 15:47 · Luke 23:55–56',
+      bsbLinks:{ matt:BSB.matt(27), mark:BSB.mark(15), luke:BSB.luke(23) }
+    },
+    {
+      title:'The Guard Placed at the Tomb (Matthew)',
+      body:"The chief priests and Pharisees ask Pilate to secure the tomb, fearing the disciples will steal the body and claim a resurrection. Pilate gives them a guard; they seal the stone.",
+      gospels:['matt'],
+      refs:'Matt 27:62–66',
+      unique:'Unique to Matthew — sets up the resurrection narrative in Matthew 28.',
+      bsbLinks:{ matt:BSB.matt(27) }
+    },
+  ]},
+];
+
+function buildTimeline() {
+  const container = document.getElementById('timeline');
+  container.innerHTML = '';
+  const colorMap = { matt:'var(--matt-color)', mark:'var(--mark-color)', luke:'var(--luke-color)', john:'var(--john-color)' };
+
+  data.forEach(phase => {
+    const phHeader = document.createElement('div');
+    phHeader.className = 'phase-header';
+    phHeader.setAttribute('data-phase', phase.phase);
+    phHeader.innerHTML = `<div class="phase-node"></div><span class="phase-label">${phase.phaseLabel}</span><span class="phase-title">${phase.phaseTitle}</span>`;
+    container.appendChild(phHeader);
+
+    phase.events.forEach(ev => {
+      const card = document.createElement('div');
+      card.className = 'event-card';
+      card.setAttribute('data-gospels', ev.gospels.join(' '));
+      card.setAttribute('data-phase', phase.phase);
+
+      const borderColor = ev.gospels.length === 4 ? 'var(--crimson)' : colorMap[ev.gospels[0]];
+      card.style.borderLeftColor = borderColor;
+
+      const badges = ev.gospels.map(g => {
+        const url = ev.bsbLinks && ev.bsbLinks[g];
+        const label = g.charAt(0).toUpperCase() + g.slice(1);
+        if (url) {
+          return `<a class="badge badge-${g}" href="${url}" target="_blank" rel="noopener" title="Open ${label} in BSB">${label} ↗</a>`;
+        }
+        return `<span class="badge badge-${g}">${label}</span>`;
+      }).join('');
+
+      const uniqueNote = ev.unique ? `<div class="unique-note">✦ ${ev.unique}</div>` : '';
+
+      card.innerHTML = `
+        <div class="event-title">${ev.title}</div>
+        <div class="event-body">${ev.body}</div>
+        <div class="gospel-badges">${badges}</div>
+        <div class="ref-text">${ev.refs}</div>
+        ${uniqueNote}
+      `;
+      container.appendChild(card);
+    });
+  });
+
+  applyFilters();
+}
+
+function applyFilters() {
+  document.querySelectorAll('.event-card').forEach(card => {
+    const cPhase = card.getAttribute('data-phase');
+    const cGospels = card.getAttribute('data-gospels').split(' ');
+    const phaseOk = activePhase === 'all' || cPhase === activePhase;
+    const gospelOk = cGospels.some(g => activeGospels.has(g));
+    card.classList.toggle('hidden', !phaseOk || !gospelOk);
+  });
+  document.querySelectorAll('.phase-header').forEach(h => {
+    const hPhase = h.getAttribute('data-phase');
+    h.style.display = (activePhase === 'all' || hPhase === activePhase) ? '' : 'none';
+  });
+}
+
+function toggleGospel(gospel, el) {
+  if (activeGospels.has(gospel)) {
+    if (activeGospels.size === 1) return;
+    activeGospels.delete(gospel);
+    el.classList.add('dimmed');
+  } else {
+    activeGospels.add(gospel);
+    el.classList.remove('dimmed');
+  }
+  applyFilters();
+}
+
+function filterPhase(phase, btn) {
+  activePhase = phase;
+  document.querySelectorAll('.filter-btn').forEach(b => {
+    b.classList.remove('active-filter');
+    b.style.background = 'transparent';
+    b.style.color = 'var(--parchment-dark)';
+    b.style.borderColor = '#555';
+  });
+  btn.classList.add('active-filter');
+  btn.style.background = 'var(--gold)';
+  btn.style.color = 'var(--ink)';
+  btn.style.borderColor = 'var(--gold)';
+  applyFilters();
+}
+
+buildTimeline();
+</script>
+</body>
+</html>

public/sitemap.xml

@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>https://versebyversewithnate.us/</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>1.0</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/start-here</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/episodes</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.9</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/study</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.85</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/resources</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/questions</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/about</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/contact</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/subscribe</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/privacy</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>yearly</changefreq>
+    <priority>0.3</priority>
+  </url>
+  <url>
+    <loc>https://versebyversewithnate.us/terms</loc>
+    <lastmod>2026-06-01</lastmod>
+    <changefreq>yearly</changefreq>
+    <priority>0.3</priority>
+  </url>
+</urlset>

scripts/build-chatbot-from-episodes.mjs

@@ -1,92 +0,0 @@
-import { execSync } from 'child_process'
-import { readFileSync, writeFileSync } from 'fs'
-import { randomUUID } from 'crypto'
-
-const BASE = "/Users/nate.emmert/Documents/github/Siteforge/Verse by Verse with Nate Complete Series"
-const CHATBOT_FILE = "/Users/nate.emmert/Documents/github/Siteforge/data/chatbot-content.json"
-
-const FILES = [
-  { file: `${BASE}/Done/Verse_by_Verse_with_Nate_Episode02.docx`, ep: 2 },
-  { file: `${BASE}/Done/Verse_by_Verse_with_Nate_Episode03.docx`, ep: 3 },
-  { file: `${BASE}/Done/Verse_by_Verse_with_Nate_Episode04_Updated.docx`, ep: 4 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode05.docx`, ep: 5 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode06_expanded.docx`, ep: 6 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode07.docx`, ep: 7 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode08.docx`, ep: 8 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode09.docx`, ep: 9 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode10.docx`, ep: 10 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode11.docx`, ep: 11 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode12.docx`, ep: 12 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode13.docx`, ep: 13 },
-  { file: `${BASE}/Verse_by_Verse_with_Nate_Episode14.docx`, ep: 14 },
-]
-
-function extractText(filePath) {
-  const xml = execSync(`unzip -p "${filePath}" word/document.xml 2>/dev/null`, { encoding: 'utf8' })
-  return xml
-    .replace(/<[^>]+>/g, ' ')
-    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'")
-    .replace(/\s+/g, ' ')
-    .trim()
-}
-
-function parseEpisode(raw, epNum) {
-  // Extract episode subtitle and passage reference from header
-  const headerMatch = raw.match(/EPISODE\s+\d+\s*[—\-\u2013\u2014]+\s*(.+?)\s+(Titus\s+[\d:]+(?:\s*[\-\u2013\u2014]+\s*[\d:]+)?)\s*·/i)
-  const subtitle = headerMatch ? headerMatch[1].trim().replace(/\s+/g, ' ') : ''
-  const passageRef = headerMatch ? headerMatch[2].trim() : 'Titus'
-  const episodeTitle = `Episode ${epNum} — ${subtitle || 'Verse by Verse with Nate'}`
-
-  // Find where the actual teaching content starts
-  let contentStart = raw.indexOf('SEGMENT 1')
-  if (contentStart === -1) contentStart = raw.indexOf('WHO WAS PAUL')
-  if (contentStart === -1) contentStart = raw.indexOf('COLD OPEN')
-  if (contentStart === -1) contentStart = 400
-
-  const rawContent = raw.slice(contentStart, contentStart + 4000)
-  const content = rawContent
-    .replace(/\[[^\]]{0,100}\]/g, '')                    // remove [stage directions]
-    .replace(/[✝🎙️📖💬🧠💡🔑✅◀▶]/gu, '')              // remove emoji
-    .replace(/SEGMENT\s+\d+\s*[—\-\u2013]+\s*/g, '\n\n') // turn SEGMENT headers into breaks
-    .replace(/\s{2,}/g, ' ')
-    .trim()
-
-  // Build keyword list
-  const verseRefs = [...new Set((raw.match(/Titus\s+\d+:\d+/g) || []))].slice(0, 5).map(k => k.toLowerCase())
-  const titleWords = subtitle.toLowerCase().replace(/[^a-z0-9\s]/g, ' ').split(/\s+/).filter(w => w.length > 3)
-  const keywords = [...new Set([
-    'titus', `episode ${epNum}`, passageRef.toLowerCase(),
-    ...verseRefs, ...titleWords
-  ])].slice(0, 20)
-
-  return {
-    id: randomUUID(),
-    type: 'episode',
-    title: `${episodeTitle} (${passageRef})`,
-    content: content.slice(0, 3900),
-    keywords,
-    createdAt: new Date().toISOString(),
-    updatedAt: new Date().toISOString(),
-  }
-}
-
-// Load existing entries (keep the 8 hand-written ones)
-const existing = JSON.parse(readFileSync(CHATBOT_FILE, 'utf8'))
-// Remove any previously generated episode entries to avoid duplication
-const baseEntries = existing.filter(e => e.type !== 'episode')
-
-const newEntries = []
-for (const { file, ep } of FILES) {
-  try {
-    const raw = extractText(file)
-    const entry = parseEpisode(raw, ep)
-    newEntries.push(entry)
-    console.log(`✓ Ep ${ep}: ${entry.title.slice(0, 80)}`)
-  } catch (err) {
-    console.error(`✗ Ep ${ep}: ${err.message}`)
-  }
-}
-
-const combined = [...baseEntries, ...newEntries]
-writeFileSync(CHATBOT_FILE, JSON.stringify(combined, null, 2), 'utf8')
-console.log(`\nDone. ${newEntries.length} episode entries added. Total: ${combined.length}`)

scripts/evaluate-chatbot.mjs

@@ -1,137 +0,0 @@
-import fs from 'node:fs/promises'
-import path from 'node:path'
-
-const root = process.cwd()
-const dataPath = path.join(root, 'data', 'chatbot-content.json')
-const evalPath = path.join(root, 'data', 'chatbot-eval.json')
-
-const STOP_WORDS = new Set([
-  'a','an','the','is','are','was','were','be','been','being','have','has','had','do','does','did',
-  'will','would','could','should','may','might','shall','can','i','you','he','she','it','we','they',
-  'me','him','her','us','them','my','your','his','its','our','their','this','that','these','those',
-  'and','but','or','nor','so','yet','for','of','in','on','at','to','from','with','by','about',
-  'what','how','why','when','where','who','which','if','then','than','as','just','not',
-])
-
-const TOKEN_ALIASES = {
-  bible: ['translation', 'version', 'scripture', 'bsb', 'berean'],
-  translation: ['version', 'bsb', 'berean', 'bible'],
-  version: ['translation', 'bsb', 'berean', 'bible'],
-  elders: ['elder', 'leadership', 'leaders', 'overseer', 'pastor'],
-  leadership: ['elders', 'elder', 'overseer', 'leaders'],
-  grace: ['salvation', 'saved', 'godliness', 'mercy'],
-  salvation: ['saved', 'grace', 'mercy', 'gospel'],
-  saved: ['salvation', 'grace', 'mercy', 'gospel'],
-  hope: ['blessed', 'appearing', 'return', 'coming'],
-  politics: ['public', 'government', 'authorities'],
-}
-
-function tokenize(text) {
-  return text
-    .toLowerCase()
-    .replace(/[^a-z0-9\s]/g, ' ')
-    .split(/\s+/)
-    .filter(token => token.length > 2 && !STOP_WORDS.has(token))
-}
-
-function expandTokens(tokens) {
-  const expanded = new Set(tokens)
-  for (const token of tokens) {
-    const aliases = TOKEN_ALIASES[token] ?? []
-    for (const alias of aliases) {
-      for (const aliasToken of tokenize(alias)) expanded.add(aliasToken)
-    }
-  }
-  return [...expanded]
-}
-
-function literalTerms(text) {
-  return [...new Set(
-    text
-      .toLowerCase()
-      .replace(/[^a-z0-9:\-\s']/g, ' ')
-      .split(/\s+/)
-      .map(term => term.trim())
-      .filter(term => term.length >= 2 && !STOP_WORDS.has(term)),
-  )]
-}
-
-function scoreEntry(entry, query) {
-  const indexText = `${entry.title} ${entry.content} ${entry.keywords.join(' ')}`.toLowerCase()
-  const queryTokens = expandTokens(tokenize(query))
-  const terms = literalTerms(query)
-
-  let score = 0
-
-  for (const token of queryTokens) {
-    if (entry.title.toLowerCase().includes(token)) score += 4
-    else if (indexText.includes(token)) score += 2
-  }
-
-  for (const term of terms) {
-    if (entry.title.toLowerCase().includes(term)) score += 2
-    else if (indexText.includes(term)) score += 1
-  }
-
-  const phrase = query.toLowerCase().replace(/[^a-z0-9:\-\s']/g, ' ').replace(/\s+/g, ' ').trim()
-  if (phrase.length > 6) {
-    if (entry.title.toLowerCase().includes(phrase)) score += 10
-    else if (indexText.includes(phrase)) score += 6
-  }
-
-  return score
-}
-
-async function main() {
-  const [contentRaw, evalRaw] = await Promise.all([
-    fs.readFile(dataPath, 'utf8'),
-    fs.readFile(evalPath, 'utf8'),
-  ])
-
-  const entries = JSON.parse(contentRaw)
-  const tests = JSON.parse(evalRaw)
-
-  let pass = 0
-  const failures = []
-
-  for (const test of tests) {
-    const ranked = entries
-      .map(entry => ({ entry, score: scoreEntry(entry, test.query) }))
-      .sort((a, b) => b.score - a.score)
-
-    const topK = ranked.slice(0, test.expectedTopK)
-    const hit = topK.some(item => item.entry.id === test.expectedEntryId)
-
-    if (hit) {
-      pass += 1
-      continue
-    }
-
-    failures.push({
-      query: test.query,
-      expectedEntryId: test.expectedEntryId,
-      expectedTopK: test.expectedTopK,
-      actualTop: topK.map(item => ({ id: item.entry.id, title: item.entry.title, score: item.score })),
-    })
-  }
-
-  const total = tests.length
-  const pct = ((pass / total) * 100).toFixed(1)
-
-  console.log(`Chatbot eval: ${pass}/${total} (${pct}%) passed`)
-
-  if (failures.length > 0) {
-    console.log('\nFailures:')
-    for (const failure of failures) {
-      console.log(`- Query: ${failure.query}`)
-      console.log(`  Expected: ${failure.expectedEntryId} in top ${failure.expectedTopK}`)
-      console.log(`  Actual: ${failure.actualTop.map(item => `${item.id} (${item.score})`).join(', ')}`)
-    }
-    process.exitCode = 1
-  }
-}
-
-main().catch(error => {
-  console.error(error)
-  process.exitCode = 1
-})

scripts/fix-chatbot-titles.mjs

@@ -1,26 +0,0 @@
-import { readFileSync, writeFileSync } from 'fs'
-
-const path = '/Users/nate.emmert/Documents/github/Siteforge/data/chatbot-content.json'
-const data = JSON.parse(readFileSync(path, 'utf8'))
-
-const fixes = {
-  2:  { title: 'Episode 2 — Introduction to Titus (Background & Overview)', extra: ['introduction', 'background', 'overview', 'crete', 'letter'] },
-  5:  { title: 'Episode 5 — The Danger of Empty Words (Titus 1:10–13a)', extra: ['danger', 'empty', 'words', 'false', 'teacher', 'titus 1:10', 'titus 1:13'] },
-  6:  { title: 'Episode 6 — Words That Deny What We Claim to Believe (Titus 1:13b–16)', extra: ['deny', 'claim', 'believe', 'titus 1:13', 'titus 1:16'] },
-  14: { title: 'Episode 14 — Grace: Where It Starts and Where It Ends (Titus 3:12–15)', extra: ['grace', 'starts', 'ends', 'review', 'titus 3:12', 'titus 3:15'] },
-}
-
-let count = 0
-for (const entry of data) {
-  const m = entry.title.match(/^Episode (\d+)/)
-  if (!m) continue
-  const ep = Number(m[1])
-  if (fixes[ep]) {
-    entry.title = fixes[ep].title
-    entry.keywords = [...new Set([...entry.keywords, ...fixes[ep].extra])].slice(0, 20)
-    count++
-  }
-}
-
-writeFileSync(path, JSON.stringify(data, null, 2), 'utf8')
-console.log(`Fixed ${count} entries. Total: ${data.length}`)

server/auth.js

@@ -0,0 +1,274 @@
+import { createHash, randomUUID, timingSafeEqual, createHmac, randomFillSync } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { parseCookies, cookieSecureFlag } from './helpers.js'
+import { DATA_DIR } from './paths.js'
+
+const TOTP_SECRET_FILE = path.join(DATA_DIR, 'totp-secret.json')
+
+// Pending sessions: password verified, waiting for TOTP code
+// Map<pendingToken, { expiresAt }>
+const TOTP_PENDING_TTL_MS = 5 * 60 * 1000
+const totpPendingSessions = new Map()
+
+const ADMIN_SESSION_COOKIE = 'vbn_admin_session'
+const ADMIN_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000
+const ADMIN_SESSION_ABSOLUTE_TTL_MS = 30 * 24 * 60 * 60 * 1000
+const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD
+const adminSessions = new Map()
+
+function cookieFlags() {
+  return cookieSecureFlag()
+}
+
+export function sha256(value) {
+  return createHash('sha256').update(String(value)).digest('hex')
+}
+
+export function isAdminPasswordConfigured() {
+  return Boolean(ADMIN_PASSWORD)
+}
+
+export function validateAdminPasswordSetup() {
+  if (!isAdminPasswordConfigured() && process.env.NODE_ENV === 'production') {
+    throw new Error('ADMIN_PASSWORD is required in production.')
+  }
+  if (!isAdminPasswordConfigured()) {
+    console.warn('ADMIN_PASSWORD is not configured; admin routes will remain disabled until the environment is configured.')
+  }
+}
+
+export function isAdminPasswordValid(password) {
+  if (!isAdminPasswordConfigured()) return false
+  const a = Buffer.from(sha256(password), 'utf8')
+  const b = Buffer.from(sha256(ADMIN_PASSWORD), 'utf8')
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}
+
+// ── TOTP (RFC 6238) — implemented with Node built-in crypto ─────────────────
+
+const BASE32_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'
+
+function base32Decode(str) {
+  const s = str.toUpperCase().replace(/=+$/, '')
+  let bits = 0
+  let value = 0
+  const output = []
+  for (const char of s) {
+    const idx = BASE32_CHARS.indexOf(char)
+    if (idx === -1) continue
+    value = (value << 5) | idx
+    bits += 5
+    if (bits >= 8) {
+      output.push((value >>> (bits - 8)) & 0xff)
+      bits -= 8
+    }
+  }
+  return Buffer.from(output)
+}
+
+function base32Encode(buf) {
+  let bits = 0
+  let value = 0
+  let output = ''
+  for (const byte of buf) {
+    value = (value << 8) | byte
+    bits += 8
+    while (bits >= 5) {
+      output += BASE32_CHARS[(value >>> (bits - 5)) & 0x1f]
+      bits -= 5
+    }
+  }
+  if (bits > 0) output += BASE32_CHARS[(value << (5 - bits)) & 0x1f]
+  return output
+}
+
+function totpToken(secret, counter) {
+  const key = base32Decode(secret)
+  const msg = Buffer.alloc(8)
+  // Write 64-bit big-endian counter
+  const hi = Math.floor(counter / 0x100000000)
+  const lo = counter >>> 0
+  msg.writeUInt32BE(hi, 0)
+  msg.writeUInt32BE(lo, 4)
+  const hmac = createHmac('sha1', key).update(msg).digest()
+  const offset = hmac[hmac.length - 1] & 0x0f
+  const code = ((hmac[offset] & 0x7f) << 24)
+    | (hmac[offset + 1] << 16)
+    | (hmac[offset + 2] << 8)
+    | hmac[offset + 3]
+  return String(code % 1000000).padStart(6, '0')
+}
+
+export function generateTotpSecret() {
+  const buf = Buffer.allocUnsafe(20)
+  randomFillSync(buf)
+  return base32Encode(buf)
+}
+
+export async function loadTotpState() {
+  try {
+    const raw = await readFile(TOTP_SECRET_FILE, 'utf8')
+    return JSON.parse(raw)
+  } catch {
+    return null
+  }
+}
+
+export async function saveTotpState(state) {
+  await writeFile(TOTP_SECRET_FILE, JSON.stringify(state, null, 2), 'utf8')
+}
+
+export async function isTotpEnabled() {
+  const state = await loadTotpState()
+  return Boolean(state?.secret && state?.verified)
+}
+
+function randomBytesForRecovery(n) {
+  const buf = Buffer.allocUnsafe(n)
+  randomFillSync(buf)
+  return buf
+}
+
+export function getTotpUri(secret, label = 'Siteforge Admin') {
+  const issuer = 'Siteforge'
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(label)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`
+}
+
+export function verifyTotpCode(secret, code) {
+  try {
+    const token = String(code).replace(/\s/g, '')
+    const step = Math.floor(Date.now() / 1000 / 30)
+    // Accept current step and one step either side (±30 seconds clock skew)
+    for (const offset of [-1, 0, 1]) {
+      if (totpToken(secret, step + offset) === token) return true
+    }
+    return false
+  } catch {
+    return false
+  }
+}
+
+// ── Recovery Codes ──────────────────────────────────────────────────────────
+
+const RECOVERY_CODE_COUNT = 8
+
+function generateRecoveryCode() {
+  // Format: XXXX-XXXX-XXXX (uppercase alphanumeric, no ambiguous chars)
+  const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'
+  const randBytes = randomBytesForRecovery(12)
+  let code = ''
+  for (let i = 0; i < 12; i++) {
+    if (i > 0 && i % 4 === 0) code += '-'
+    code += chars[randBytes[i] % chars.length]
+  }
+  return code
+}
+
+export function generateRecoveryCodes() {
+  const codes = []
+  for (let i = 0; i < RECOVERY_CODE_COUNT; i++) {
+    codes.push(generateRecoveryCode())
+  }
+  return codes
+}
+
+export function hashRecoveryCode(code) {
+  return sha256(code.replace(/-/g, '').toUpperCase())
+}
+
+// Returns the matched code if valid, null otherwise. Mutates state.hashedRecoveryCodes.
+export function consumeRecoveryCode(state, inputCode) {
+  if (!Array.isArray(state.hashedRecoveryCodes) || state.hashedRecoveryCodes.length === 0) return false
+  const normalized = inputCode.replace(/[-\s]/g, '').toUpperCase()
+  const inputHash = sha256(normalized)
+  const idx = state.hashedRecoveryCodes.findIndex(h => {
+    const a = Buffer.from(h, 'utf8')
+    const b = Buffer.from(inputHash, 'utf8')
+    return a.length === b.length && timingSafeEqual(a, b)
+  })
+  if (idx === -1) return false
+  state.hashedRecoveryCodes.splice(idx, 1)
+  return true
+}
+
+// ── Pending (password-ok, awaiting TOTP) sessions ───────────────────────────
+
+export function createPendingSession() {
+  const token = randomUUID()
+  totpPendingSessions.set(token, { expiresAt: Date.now() + TOTP_PENDING_TTL_MS })
+  return token
+}
+
+export function consumePendingSession(token) {
+  if (!token) return false
+  const entry = totpPendingSessions.get(token)
+  if (!entry || entry.expiresAt <= Date.now()) {
+    totpPendingSessions.delete(token)
+    return false
+  }
+  totpPendingSessions.delete(token)
+  return true
+}
+
+// ── Admin Sessions ───────────────────────────────────────────────────────────
+
+export function createAdminSession() {
+  const token = randomUUID()
+  const now = Date.now()
+  adminSessions.set(token, { expiresAt: now + ADMIN_SESSION_TTL_MS, absoluteExpiresAt: now + ADMIN_SESSION_ABSOLUTE_TTL_MS })
+  return token
+}
+
+export function deleteAdminSession(token) {
+  if (token) {
+    adminSessions.delete(token)
+  }
+}
+
+export function isValidAdminSession(req) {
+  if (!isAdminPasswordConfigured()) return false
+
+  const cookies = parseCookies(req.headers.cookie)
+  const sessionToken = cookies[ADMIN_SESSION_COOKIE]
+  if (!sessionToken) return false
+
+  const now = Date.now()
+  const session = adminSessions.get(sessionToken)
+  if (!session) return false
+
+  // Support legacy sessions stored as a plain number (expiresAt)
+  const expiresAt = typeof session === 'object' ? session.expiresAt : session
+  const absoluteExpiresAt = typeof session === 'object' ? session.absoluteExpiresAt : Infinity
+
+  if (expiresAt <= now || absoluteExpiresAt <= now) {
+    adminSessions.delete(sessionToken)
+    return false
+  }
+
+  adminSessions.set(sessionToken, { expiresAt: now + ADMIN_SESSION_TTL_MS, absoluteExpiresAt })
+  return true
+}
+
+export function setAdminSessionCookie(res, token) {
+  res.append(
+    'Set-Cookie',
+    `${ADMIN_SESSION_COOKIE}=${encodeURIComponent(token)}; Max-Age=${Math.floor(ADMIN_SESSION_TTL_MS / 1000)}; Path=/; HttpOnly; SameSite=Lax${cookieFlags()}`,
+  )
+}
+
+export function clearAdminSessionCookie(res) {
+  res.append(
+    'Set-Cookie',
+    `${ADMIN_SESSION_COOKIE}=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax${cookieFlags()}`,
+  )
+}
+
+export function requireAdminAuth(req, res, next) {
+  if (!isValidAdminSession(req)) {
+    res.status(401).json({ message: 'Unauthorized' })
+    return
+  }
+  next()
+}

server/config.js

@@ -0,0 +1,252 @@
+import path from 'node:path'
+import { readFileSync } from 'node:fs'
+import { execSync } from 'node:child_process'
+import { validateAdminPasswordSetup } from './auth.js'
+import { ROOT_DIR, DATA_DIR } from './paths.js'
+
+export { ROOT_DIR, DATA_DIR }
+
+function readPackageVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(path.join(ROOT_DIR, 'package.json'), 'utf8'))
+    return typeof pkg.version === 'string' && pkg.version.trim() ? pkg.version.trim() : 'unknown'
+  } catch {
+    return 'unknown'
+  }
+}
+
+function readGitCommit() {
+  // CI injects the full SHA as COMMIT_SHA; fall back to running git locally.
+  if (typeof process.env.COMMIT_SHA === 'string' && process.env.COMMIT_SHA.trim()) {
+    return process.env.COMMIT_SHA.trim().slice(0, 7)
+  }
+  try {
+    return execSync('git rev-parse --short HEAD', { cwd: ROOT_DIR, timeout: 2000 }).toString().trim()
+  } catch {
+    return 'unknown'
+  }
+}
+
+// APP_VERSION is sourced from package.json.
+// GIT_COMMIT is the 7-char short SHA, from COMMIT_SHA env var (set by CI) or git at startup.
+export const APP_VERSION = readPackageVersion()
+export const GIT_COMMIT = readGitCommit()
+
+export const DATA_FILE = path.join(DATA_DIR, 'admin-content.json')
+export const DRAFT_DATA_FILE = path.join(DATA_DIR, 'admin-content-draft.json')
+export const HIT_STATS_FILE = path.join(DATA_DIR, 'hit-stats.json')
+export const VISITOR_STATS_FILE = path.join(DATA_DIR, 'visitor-stats.json')
+export const CONTACT_SUBMISSIONS_FILE = path.join(DATA_DIR, 'contact-submissions.json')
+export const QUESTIONS_FILE = path.join(DATA_DIR, 'questions.json')
+export const DRAFT_QUESTIONS_FILE = path.join(DATA_DIR, 'questions-draft.json')
+export const STUDY_USERS_FILE = path.join(DATA_DIR, 'study-users.json')
+export const STUDY_NOTES_FILE = path.join(DATA_DIR, 'study-notes.json') // legacy — kept only for one-time migration
+export const STUDY_NOTES_DIR = path.join(DATA_DIR, 'study-notes')
+export const STUDY_PROGRESS_DIR = path.join(DATA_DIR, 'study-progress')
+export const STUDY_COMMUNITY_FILE = path.join(DATA_DIR, 'study-community.json')
+export const REPLY_TEMPLATES_FILE = path.join(DATA_DIR, 'admin-reply-templates.json')
+export const REPLY_HISTORY_FILE = path.join(DATA_DIR, 'admin-reply-history.json')
+export const PODCAST_CHECKLIST_FILE = path.join(DATA_DIR, 'podcast-checklist.json')
+export const BACKUP_DIR = path.join(DATA_DIR, 'backups')
+export const UPLOADS_DIR = path.join(DATA_DIR, 'uploads')
+export const UPLOADS_META_FILE = path.join(DATA_DIR, 'uploads-meta.json')
+export const DOWNLOAD_COUNTS_FILE = path.join(DATA_DIR, 'download-counts.json')
+export const STUDY_REMINDERS_FILE = path.join(DATA_DIR, 'study-reminders.json')
+export const STUDY_COMMENTS_FILE = path.join(DATA_DIR, 'study-section-comments.json')
+export const STUDY_CERTIFICATES_FILE = path.join(DATA_DIR, 'study-certificates.json')
+export const EPISODE_SCRIPTS_FILE = path.join(DATA_DIR, 'episode-scripts.json')
+export const QR_CODES_FILE = path.join(DATA_DIR, 'qr-codes.json')
+export const EPISODE_PLAYS_FILE = path.join(DATA_DIR, 'episode-plays.json')
+export const ANALYTICS_EVENTS_FILE = path.join(DATA_DIR, 'analytics-events.json')
+export const EMAIL_SETTINGS_FILE = path.join(DATA_DIR, 'email-settings.json')
+export const CALENDAR_EVENTS_FILE = path.join(DATA_DIR, 'calendar-events.json')
+export const AUDIT_LOG_FILE = path.join(DATA_DIR, 'audit-log.json')
+export const WEBHOOKS_FILE = path.join(DATA_DIR, 'webhooks.json')
+export const MAX_EPISODE_SCRIPT_LENGTH = 200_000 // ~150k words, well beyond any sermon
+
+export const DIST_DIR = path.join(ROOT_DIR, 'dist')
+export const INDEX_FILE = path.join(DIST_DIR, 'index.html')
+export const DIST_IMAGES_DIR = path.join(DIST_DIR, 'images')
+export const PUBLIC_IMAGES_DIR = path.join(ROOT_DIR, 'public', 'images')
+
+validateAdminPasswordSetup()
+
+export const TITUS_STUDY_FILE = process.env.TITUS_STUDY_FILE
+  ? path.resolve(ROOT_DIR, process.env.TITUS_STUDY_FILE)
+  : path.join(ROOT_DIR, 'A_Study_of_Titus.pdf')
+export const TITUS_STUDY_DOWNLOAD_NAME = process.env.TITUS_STUDY_DOWNLOAD_NAME ?? 'A_Study_of_Titus.pdf'
+
+// Rate limit / timing constants
+export const VISITOR_COOKIE = 'vbn_vid'
+export const CONSENT_COOKIE = 'vbn_analytics_consent'
+export const MAX_RECENT_VISITS = 1000
+export const VISITOR_RETENTION_DAYS_DEFAULT = 180
+export const BACKUP_RETENTION_DAYS = 30
+export const BACKUP_INTERVAL_MS = 24 * 60 * 60 * 1000
+export const ADMIN_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000
+
+export const MAX_CONTACT_SUBMISSIONS = 5000
+export const CONTACT_EMAIL_COOLDOWN_MS = Math.max(10 * 1000, Number(process.env.CONTACT_EMAIL_COOLDOWN_MS ?? 60 * 1000) || 60 * 1000)
+export const DOWNLOAD_TOKEN_TTL_MS = 10 * 60 * 1000
+
+export const MAX_QUESTIONS = 1000
+export const MAX_STUDY_COMMENTS = 10000
+export const MAX_STUDY_COMMENT_LENGTH = 2000
+export const MAX_STUDY_USERS = 5000
+export const MAX_STUDY_ENROLLMENTS_PER_USER = 100
+export const MAX_STUDY_NOTES_PER_USER = 500
+export const MAX_STUDY_NOTE_LENGTH = 12000
+export const EMAIL_CHANGE_TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+export const STUDY_SESSION_COOKIE = 'vbn_study_session'
+export const STUDY_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000
+export const STUDY_TOTP_PENDING_TTL_MS = 5 * 60 * 1000
+export const EMAIL_OTP_TTL_MS = 10 * 60 * 1000
+export const EMAIL_OTP_MAX_ATTEMPTS = 5
+
+export const USE_RESEND_AUTOMATION_WELCOME = process.env.RESEND_AUTOMATION_WELCOME === 'true'
+export const DEFAULT_RESEND_FROM = 'Verse by Verse with Nate <hello@versebyversewithnate.us>'
+export const DEFAULT_RESEND_TO = 'hello@versebyversewithnate.us'
+export const DEFAULT_RESEND_REPLY_TO = 'hello@versebyversewithnate.us'
+export const ADMIN_REPLY_FROM = DEFAULT_RESEND_FROM
+export const NATE_RESEND_FROM = 'Verse by Verse with Nate <nate@versebyversewithnate.us>'
+// Addresses an admin may send a reply from — must stay in sync with the <select> options in src/AdminPage.tsx.
+export const ADMIN_REPLY_FROM_OPTIONS = [DEFAULT_RESEND_FROM, NATE_RESEND_FROM]
+
+export const DEFAULT_SEO = {
+  title: 'Verse by Verse with Nate',
+  description: 'Verse by Verse with Nate explores Scripture one verse at a time with practical Bible teaching.',
+  ogTitle: 'Verse by Verse with Nate',
+  ogDescription: 'A Journey Through Scripture - verse by verse, nugget by nugget.',
+  ogImage: '/images/podcast-art.jpeg',
+  canonicalUrl: 'https://versebyversewithnate.us/',
+  robotsPolicy: 'index,follow',
+  sitemapPaths: ['/', '/start-here', '/questions', '/privacy', '/terms'],
+}
+
+export const DEFAULT_LEGAL = {
+  privacyTitle: 'Privacy Policy',
+  privacyBody: [
+    'We respect your privacy and collect limited data to operate and improve this site.',
+    'If you consent to analytics cookies, we may store masked IP-based location signals and returning visitor activity.',
+    'Contact form details are used only to respond to your message and ministry communication requests.',
+  ],
+  termsTitle: 'Terms',
+  termsBody: [
+    'Content on this site is for informational and ministry purposes.',
+    'External links are provided for convenience and are subject to third-party policies.',
+    'By using this site, you agree to lawful use and respectful communication.',
+  ],
+}
+export const DEFAULT_PODCAST_FEATURED_LINKS = []
+export const DEFAULT_PUBLISH_STATE = {
+  draftUpdatedAt: null,
+  publishedAt: null,
+}
+
+export const DEFAULT_REDIRECT_RULES = [
+  {
+    id: 'spotify',
+    path: '/spotify',
+    target: 'https://open.spotify.com/show/0Gq1TzoJOdReSZ1gYQi8Xl',
+    statusCode: 301,
+  },
+  {
+    id: 'apple',
+    path: '/apple',
+    target: 'https://podcasts.apple.com/search?term=Verse+by+Verse+with+Nate',
+    statusCode: 301,
+  },
+  {
+    id: 'amazon',
+    path: '/amazon',
+    target: 'https://music.amazon.com/podcasts/202322bf-db86-4e7d-9a6b-4db7cbccbccf/verse-by-verse-with-nate',
+    statusCode: 301,
+  },
+]
+
+export const DEFAULT_REPLY_TEMPLATES = [
+  {
+    id: 'thanks-for-reaching-out',
+    label: 'Thank You Reply',
+    subject: 'Thanks for reaching out to Verse by Verse with Nate',
+    message: 'Thank you for reaching out.\n\nI appreciate your message and wanted to follow up personally.',
+  },
+  {
+    id: 'question-received',
+    label: 'Question Received',
+    subject: 'Your Bible question was received',
+    message: 'Thank you for sending your Bible question.\n\nI have received it, and I appreciate you taking the time to write in.',
+  },
+  {
+    id: 'testimony-thank-you',
+    label: 'Testimony Thank You',
+    subject: 'Thank you for sharing your testimony',
+    message: 'Thank you for sharing what the Lord is doing in your life.\n\nYour message was an encouragement to read.',
+  },
+]
+
+export const DEFAULT_PODCAST_CHECKLIST_TASKS = [
+  { id: 'verify_script', label: 'Verify Script', phase: 'pre' },
+  { id: 'read_script', label: 'Read Script', phase: 'pre' },
+  { id: 'record', label: 'Record', phase: 'pre' },
+  { id: 'mix', label: 'Mix', phase: 'pre' },
+  { id: 'edit', label: 'Edit', phase: 'pre' },
+  { id: 'video_script', label: 'Run Video Conversion Script', phase: 'pre' },
+  { id: 'post_spotify', label: 'Post on Spotify', phase: 'pre' },
+  { id: 'update_website', label: 'Update Website', phase: 'post' },
+  { id: 'send_email', label: 'Send Email', phase: 'post' },
+]
+
+export const EMPTY_HIT_STATS = {
+  totalHits: 0,
+  realHits: 0,
+  botHits: 0,
+  firstHitAt: null,
+  lastHitAt: null,
+  byPath: {},
+  byPathReal: {},
+  byPathBot: {},
+  byDay: {},
+  byDayReal: {},
+  byDayBot: {},
+  botReasons: {},
+}
+
+export const EMPTY_VISITOR_STATS = {
+  totalVisits: 0,
+  uniqueVisitors: 0,
+  returningVisits: 0,
+  firstVisitAt: null,
+  lastVisitAt: null,
+  visitors: {},
+  ipHashIndex: {},
+  recentVisits: [],
+  geoCacheByIp: {},
+}
+
+// ── Podcast checklist helpers (no state dependency) ────────────────────────
+
+function buildChecklistEpisode(series, number) {
+  const tasks = {}
+  for (const task of DEFAULT_PODCAST_CHECKLIST_TASKS) {
+    tasks[task.id] = false
+  }
+  return {
+    id: `${series.toLowerCase()}-${number}`,
+    series,
+    episodeNumber: number,
+    title: '',
+    datePublished: '',
+    expanded: false,
+    tasks,
+  }
+}
+
+export function buildDefaultPodcastChecklist() {
+  const titusEpisodes = [11, 12, 13, 14, 15].map(number => buildChecklistEpisode('Titus', number))
+  const colossiansEpisodes = Array.from({ length: 27 }, (_, index) => buildChecklistEpisode('Colossians', index + 1))
+  return {
+    tasks: DEFAULT_PODCAST_CHECKLIST_TASKS,
+    episodes: [...titusEpisodes, ...colossiansEpisodes],
+  }
+}

server/email.js

@@ -0,0 +1,637 @@
+import { Resend } from 'resend'
+import { escapeHtml, buildAbsoluteUrl, splitName } from './helpers.js'
+import {
+  DEFAULT_RESEND_FROM,
+  DEFAULT_SEO,
+} from './config.js'
+import { state } from './state.js'
+
+// ── Address helpers ────────────────────────────────────────────────────────
+
+export function getResendFromAddress() {
+  return process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM
+}
+
+export function getResendReplyToAddress() {
+  return process.env.RESEND_REPLY_TO ?? 'hello@versebyversewithnate.us'
+}
+
+export function getResendInboxAddress() {
+  return process.env.RESEND_TO ?? 'hello@versebyversewithnate.us'
+}
+
+export function getCanonicalBaseUrl() {
+  const configured = state.cachedSiteContent?.seo?.canonicalUrl ?? DEFAULT_SEO.canonicalUrl
+  if (typeof configured !== 'string' || !configured.trim()) return DEFAULT_SEO.canonicalUrl
+  return configured.trim()
+}
+
+export function getAddressDomain(addressValue) {
+  const raw = String(addressValue || '').trim()
+  if (!raw) return ''
+  const candidate = raw.includes('<') && raw.includes('>')
+    ? raw.slice(raw.lastIndexOf('<') + 1, raw.lastIndexOf('>')).trim()
+    : raw
+  const at = candidate.lastIndexOf('@')
+  if (at <= 0 || at === candidate.length - 1) return ''
+  return candidate.slice(at + 1).toLowerCase()
+}
+
+export function logResendEmailAlignmentWarnings() {
+  const warnings = []
+  const fromAddress = getResendFromAddress()
+  const replyToAddress = getResendReplyToAddress()
+  const fromDomain = getAddressDomain(fromAddress)
+  const replyDomain = getAddressDomain(replyToAddress)
+  const hasApiKey = Boolean(process.env.RESEND_API_KEY)
+
+  if (!hasApiKey) warnings.push('RESEND_API_KEY is missing. Contact and reply emails cannot send.')
+  if (!fromDomain) warnings.push('RESEND_FROM is missing or malformed. Use a verified domain sender identity.')
+  if (fromDomain.endsWith('resend.dev')) warnings.push('RESEND_FROM uses resend.dev. Move to your own verified domain for best deliverability.')
+  if (fromDomain && replyDomain && fromDomain !== replyDomain) warnings.push('RESEND_FROM and RESEND_REPLY_TO use different domains. This can weaken alignment.')
+  if (!process.env.RESEND_WEBHOOK_TOKEN) warnings.push('RESEND_WEBHOOK_TOKEN is not set. Delivery webhooks are not authenticated.')
+  if (hasApiKey) warnings.push('Verify SPF, DKIM, and DMARC for the sender domain to improve inbox placement.')
+
+  if (warnings.length > 0) {
+    console.warn('[email-health] Resend alignment checks:')
+    for (const warning of warnings) {
+      console.warn(`[email-health] - ${warning}`)
+    }
+  }
+}
+
+// ── Send helpers ───────────────────────────────────────────────────────────
+
+export async function sendResendEmailWithRetry({ resend, payload, context, maxAttempts = 2 }) {
+  let lastError = null
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    try {
+      const result = await resend.emails.send(payload)
+      if (!result?.error) return result
+      lastError = result.error
+      if (attempt < maxAttempts) {
+        await new Promise(resolve => setTimeout(resolve, 250 * attempt))
+      }
+    } catch (err) {
+      lastError = err
+      if (attempt < maxAttempts) {
+        await new Promise(resolve => setTimeout(resolve, 250 * attempt))
+      }
+    }
+  }
+  throw lastError ?? new Error(`[${context}] email send failed`)
+}
+
+export async function syncContactToResend(name, email) {
+  if (!process.env.RESEND_API_KEY) return
+  const { firstName, lastName } = splitName(name)
+  const contactResend = new Resend(process.env.RESEND_CONTACTS_API_KEY ?? process.env.RESEND_API_KEY)
+  try {
+    const { error: contactError } = await contactResend.contacts.create({
+      email,
+      firstName,
+      lastName,
+      unsubscribed: false,
+      ...(process.env.RESEND_SEGMENT_ID ? { segments: [{ id: process.env.RESEND_SEGMENT_ID }] } : {}),
+    })
+    if (contactError) {
+      const { error: updateError } = await contactResend.contacts.update({ email, firstName, lastName, unsubscribed: false })
+      if (updateError) console.error('[resend] contact sync error:', updateError)
+    }
+  } catch (err) {
+    console.error('[resend] contact sync exception:', err)
+  }
+}
+
+// ── Email HTML builders ────────────────────────────────────────────────────
+
+export function buildBrandedEmailHtml({ title, eyebrow, bodyHtml, ctaLabel, ctaUrl, footerHtml }) {
+  const ctaBlock = ctaLabel && ctaUrl
+    ? `<p style="margin:24px 0 0;"><a href="${escapeHtml(ctaUrl)}" target="_blank" style="display:inline-block;padding:12px 22px;background:#c9a84c;border:1px solid #e0c070;border-radius:999px;color:#111111;font-family:Georgia,serif;font-size:13px;font-weight:700;letter-spacing:0.14em;text-decoration:none;text-transform:uppercase;">${escapeHtml(ctaLabel)}</a></p>`
+    : ''
+
+  return (
+    `<div style="margin:0;padding:0;background-color:#0a0a08;font-family:Georgia,serif;">` +
+    `<table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="background-color:#0a0a08;">` +
+    `<tr><td align="center" style="padding:40px 20px;">` +
+    `<table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="max-width:580px;margin:0 auto;background-color:#0f0f0c;border:1px solid #2a2518;">` +
+    `<tr><td align="center" style="background-color:#0d0d0a;padding:36px 40px 28px;border-bottom:1px solid #2a2518;">` +
+    `<p style="margin:0 0 6px;font-family:Georgia,serif;font-size:13px;font-weight:400;color:#7a7060;letter-spacing:0.12em;text-transform:uppercase;">${escapeHtml(eyebrow ?? 'Verse by Verse with Nate')}</p>` +
+    `<p style="margin:0;font-family:Georgia,serif;font-size:28px;font-weight:600;color:#e0c070;line-height:1.2;">${escapeHtml(title)}</p>` +
+    `</td></tr>` +
+    `<tr><td style="padding:40px 40px 0;">` +
+    `<div style="font-family:Georgia,serif;font-size:15px;line-height:1.8;color:#c8c0ac;">${bodyHtml}</div>` +
+    `${ctaBlock}` +
+    `</td></tr>` +
+    `<tr><td style="padding:28px 40px 40px;text-align:center;">${footerHtml ?? ''}</td></tr>` +
+    `</table>` +
+    `</td></tr></table>` +
+    `</div>`
+  )
+}
+
+export function buildContactWelcomeEmailTemplate({
+  greetingName,
+  welcomeIntro,
+  welcomeCurrentSeries,
+  welcomeStartHereTitle,
+  welcomeStartHereSummary,
+  welcomeExpect1,
+  welcomeExpect2,
+  welcomeExpect3,
+  welcomeScripture,
+  welcomeScriptureRef,
+  welcomeSignoff,
+  welcomeGreetingPrefix = "Glad you're here",
+  welcomeSpotifyUrl,
+  welcomeAppleUrl,
+  welcomeAmazonUrl,
+  welcomeWebsiteUrl,
+  welcomeEpisodeUrl,
+  welcomeImageUrl,
+  welcomeSpotifyBtnLabel = 'Listen on Spotify',
+  welcomeAppleBtnLabel = 'Apple Podcasts',
+  welcomeStartHereLinkLabel = 'Open Start Here page',
+}) {
+  const heading = greetingName
+    ? `${escapeHtml(welcomeGreetingPrefix)}, ${escapeHtml(greetingName)}.`
+    : `${escapeHtml(welcomeGreetingPrefix)}.`
+
+  return {
+    text:
+      `Welcome to Verse by Verse with Nate!\n\n` +
+      `${heading}\n\n` +
+      `${welcomeIntro}\n\n` +
+      `${welcomeCurrentSeries}\n\n` +
+      `Start here: ${welcomeEpisodeUrl}\n` +
+      `${welcomeStartHereTitle}\n` +
+      `${welcomeStartHereSummary}\n` +
+      `${welcomeSpotifyBtnLabel}: ${welcomeSpotifyUrl}\n` +
+      `${welcomeAppleBtnLabel}: ${welcomeAppleUrl}\n` +
+      `Amazon Music: ${welcomeAmazonUrl}\n` +
+      `Website: ${welcomeWebsiteUrl}\n\n` +
+      `What to expect:\n` +
+      `- ${welcomeExpect1}\n` +
+      `- ${welcomeExpect2}\n` +
+      `- ${welcomeExpect3}\n\n` +
+      `"${welcomeScripture}"\n${welcomeScriptureRef}\n\n` +
+      `${welcomeSignoff}`,
+    html: `<html dir="ltr" lang="en">
+  <head></head>
+  <body style="background-color:#ffffff">
+    <table border="0" width="100%" cellpadding="0" cellspacing="0" role="presentation" align="center">
+      <tbody>
+        <tr>
+          <td style="background-color:#ffffff">
+            <table align="left" width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="max-width:600px;align:left;width:100%;color:#000000;background-color:#ffffff;border-radius:0px;border-color:#000000">
+              <tbody>
+                <tr style="width:100%">
+                  <td style="padding:0">
+                    <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="background-color:#0a0a08">
+                      <tbody>
+                        <tr>
+                          <td align="center" style="padding:40px 20px">
+                            <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="margin:0 auto;max-width:580px;background-color:#0f0f0c;border:1px solid #2a2518">
+                              <tbody>
+                                <tr>
+                                  <td align="center" style="padding:36px 40px 28px;background-color:#0d0d0a;border-bottom:1px solid #2a2518">
+                                    <img alt="Verse by Verse with Nate" src="${escapeHtml(welcomeImageUrl)}" style="display:block;outline:none;border:2px solid #2a2518;text-decoration:none;max-width:100%;margin:0 auto 20px;border-radius:12px;height:auto" width="468" />
+                                    <p style="margin:0 0 6px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:22px;font-weight:600;color:#c9a84c;letter-spacing:0.04em">Verse by Verse with Nate</p>
+                                    <p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:14px;font-weight:300;color:#7a7060;letter-spacing:0.08em;text-transform:uppercase">Verse by verse. Nugget by nugget.</p>
+                                  </td>
+                                </tr>
+                                <tr>
+                                  <td style="padding:40px 40px 0">
+                                    <p style="margin:0 0 8px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:13px;font-weight:400;color:#7a7060;letter-spacing:0.12em;text-transform:uppercase">Welcome</p>
+                                    <h1 style="margin:0 0 20px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:30px;font-weight:600;color:#f0ead8;line-height:1.2">${heading}</h1>
+                                    <div style="width:40px;height:2px;background-color:#c9a84c;margin-bottom:28px"></div>
+                                  </td>
+                                </tr>
+                                <tr>
+                                  <td style="padding:0 40px 32px">
+                                    <p style="margin:0 0 18px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:18px;font-weight:300;color:#c8c0ac;line-height:1.75">${escapeHtml(welcomeIntro)}</p>
+                                    <p style="margin:0 0 18px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:18px;font-weight:300;color:#c8c0ac;line-height:1.75">${escapeHtml(welcomeCurrentSeries)}</p>
+                                    <p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:18px;font-weight:300;color:#c8c0ac;line-height:1.75">If you&#8217;re just joining us, the best place to start is Episode 1. It sets the table for everything that follows.</p>
+                                  </td>
+                                </tr>
+                                <tr><td style="padding:0 40px"><div style="height:1px;background-color:#2a2518;margin-bottom:32px"></div></td></tr>
+                                <tr>
+                                  <td style="padding:0 40px 32px">
+                                    <p style="margin:0 0 6px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:13px;font-weight:400;color:#7a7060;letter-spacing:0.12em;text-transform:uppercase">Start here</p>
+                                    <p style="margin:0 0 6px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:22px;font-weight:600;color:#f0ead8">${escapeHtml(welcomeStartHereTitle)}</p>
+                                    <p style="margin:0 0 20px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:16px;font-weight:300;color:#7a7060;line-height:1.6">${escapeHtml(welcomeStartHereSummary)}</p>
+                                    <table border="0" cellpadding="0" cellspacing="0" role="presentation">
+                                      <tbody>
+                                        <tr>
+                                          <td style="padding-right:12px">
+                                            <a href="${escapeHtml(welcomeSpotifyUrl)}" rel="noopener noreferrer nofollow" style="color:#0d0d0a;text-decoration:none;display:inline-block;padding:11px 22px;background-color:#c9a84c;font-family:'Cormorant Garamond',Georgia,serif;font-size:14px;font-weight:600;letter-spacing:0.06em;border-radius:3px" target="_blank">${escapeHtml(welcomeSpotifyBtnLabel)}</a>
+                                          </td>
+                                          <td>
+                                            <a href="${escapeHtml(welcomeAppleUrl)}" rel="noopener noreferrer nofollow" style="color:#c9a84c;text-decoration:none;display:inline-block;padding:11px 22px;background-color:transparent;font-family:'Cormorant Garamond',Georgia,serif;font-size:14px;font-weight:600;letter-spacing:0.06em;border-radius:3px;border:1px solid #c9a84c" target="_blank">${escapeHtml(welcomeAppleBtnLabel)}</a>
+                                          </td>
+                                        </tr>
+                                      </tbody>
+                                    </table>
+                                  </td>
+                                </tr>
+                                <tr><td style="padding:0 40px"><div style="height:1px;background-color:#2a2518;margin-bottom:32px"></div></td></tr>
+                                <tr>
+                                  <td style="padding:0 40px 32px">
+                                    <p style="margin:0 0 20px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:13px;font-weight:400;color:#7a7060;letter-spacing:0.12em;text-transform:uppercase">What to expect</p>
+                                    <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="margin-bottom:18px">
+                                      <tbody><tr>
+                                        <td style="width:28px;vertical-align:top;padding-top:3px"><div style="width:6px;height:6px;background-color:#c9a84c;border-radius:50%;margin-top:7px"></div></td>
+                                        <td><p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:17px;font-weight:400;color:#c8c0ac;line-height:1.65">${escapeHtml(welcomeExpect1)}</p></td>
+                                      </tr></tbody>
+                                    </table>
+                                    <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="margin-bottom:18px">
+                                      <tbody><tr>
+                                        <td style="width:28px;vertical-align:top;padding-top:3px"><div style="width:6px;height:6px;background-color:#c9a84c;border-radius:50%;margin-top:7px"></div></td>
+                                        <td><p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:17px;font-weight:400;color:#c8c0ac;line-height:1.65">${escapeHtml(welcomeExpect2)}</p></td>
+                                      </tr></tbody>
+                                    </table>
+                                    <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation">
+                                      <tbody><tr>
+                                        <td style="width:28px;vertical-align:top;padding-top:3px"><div style="width:6px;height:6px;background-color:#c9a84c;border-radius:50%;margin-top:7px"></div></td>
+                                        <td><p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:17px;font-weight:400;color:#c8c0ac;line-height:1.65">${escapeHtml(welcomeExpect3)}</p></td>
+                                      </tr></tbody>
+                                    </table>
+                                  </td>
+                                </tr>
+                                <tr><td style="padding:0 40px"><div style="height:1px;background-color:#2a2518;margin-bottom:32px"></div></td></tr>
+                                <tr>
+                                  <td style="padding:0 40px 40px">
+                                    <table width="100%" border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-left:2px solid #c9a84c">
+                                      <tbody><tr>
+                                        <td style="padding:4px 0 4px 20px">
+                                          <p style="margin:0 0 8px;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:19px;font-style:italic;font-weight:400;color:#e0c070;line-height:1.6">&#8220;${escapeHtml(welcomeScripture)}&#8221;</p>
+                                          <p style="margin:0;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;color:#7a7060;letter-spacing:0.06em;text-transform:uppercase">${escapeHtml(welcomeScriptureRef)}</p>
+                                        </td>
+                                      </tr></tbody>
+                                    </table>
+                                  </td>
+                                </tr>
+                                <tr>
+                                  <td align="center" style="padding:28px 40px;background-color:#0a0a08;border-top:1px solid #2a2518;text-align:center">
+                                    <p style="margin:0 0 14px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;color:#7a7060;letter-spacing:0.06em">Find the podcast on</p>
+                                    <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="margin:0 auto 24px">
+                                      <tbody><tr>
+                                        <td style="padding:0 10px"><a href="${escapeHtml(welcomeSpotifyUrl)}" rel="noopener noreferrer nofollow" style="color:#7a7060;text-decoration:none;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;letter-spacing:0.04em" target="_blank">Spotify</a></td>
+                                        <td style="color:#7a7060;font-size:12px">&#183;</td>
+                                        <td style="padding:0 10px"><a href="${escapeHtml(welcomeAppleUrl)}" rel="noopener noreferrer nofollow" style="color:#7a7060;text-decoration:none;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;letter-spacing:0.04em" target="_blank">Apple Podcasts</a></td>
+                                        <td style="color:#7a7060;font-size:12px">&#183;</td>
+                                        <td style="padding:0 10px"><a href="${escapeHtml(welcomeAmazonUrl)}" rel="noopener noreferrer nofollow" style="color:#7a7060;text-decoration:none;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;letter-spacing:0.04em" target="_blank">Amazon Music</a></td>
+                                        <td style="color:#7a7060;font-size:12px">&#183;</td>
+                                        <td style="padding:0 10px"><a href="${escapeHtml(welcomeWebsiteUrl)}" rel="noopener noreferrer nofollow" style="color:#7a7060;text-decoration:none;font-family:'Crimson Pro',Georgia,serif;font-size:13px;font-weight:300;letter-spacing:0.04em" target="_blank">Website</a></td>
+                                      </tr></tbody>
+                                    </table>
+                                    <p style="margin:0 0 6px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:12px;font-weight:300;color:#6b6044;line-height:1.6">You&#8217;re receiving this because you subscribed to <strong>Verse by Verse with Nate</strong>.</p>
+                                    <p style="margin:0 0 18px;padding:0;font-family:'Crimson Pro',Georgia,serif;font-size:12px;font-weight:300;color:#6b6044"><a href="{{{RESEND_UNSUBSCRIBE_URL}}}" rel="noopener noreferrer nofollow" style="color:#6b6044;text-decoration:underline" target="_blank">Unsubscribe</a></p>
+                                    <p style="margin:0;padding:0;font-family:'Cormorant Garamond',Georgia,serif;font-size:13px;font-style:italic;font-weight:400;color:#6b6044">&#8220;Your word is a lamp to my feet and a light to my path.&#8221; &#8212; Psalm 119:105</p>
+                                  </td>
+                                </tr>
+                              </tbody>
+                            </table>
+                          </td>
+                        </tr>
+                      </tbody>
+                    </table>
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </body>
+</html>`,
+  }
+}
+
+export function buildContactAdminNotificationTemplate({
+  normalizedMessageType,
+  trimmedName,
+  trimmedEmail,
+  submittedAt,
+  trimmedMessage,
+}) {
+  return {
+    subject: `Verse by Verse contact (${normalizedMessageType}): ${trimmedName}`,
+    text:
+      `New contact form submission\n\n` +
+      `Message Type: ${normalizedMessageType}\n` +
+      `Name: ${trimmedName}\n` +
+      `Email: ${trimmedEmail}\n` +
+      `Submitted: ${submittedAt}\n\n` +
+      `Message:\n${trimmedMessage}`,
+    html:
+      `<div style="background:#f5f1e8;padding:24px;font-family:Georgia,serif;color:#201a10;">` +
+      `<div style="max-width:680px;margin:0 auto;background:#ffffff;border:1px solid #e1d3b2;border-radius:14px;overflow:hidden;">` +
+      `<div style="background:#111111;padding:20px 24px;border-bottom:3px solid #c8860a;">` +
+      `<div style="font-family:Arial,sans-serif;font-size:12px;letter-spacing:0.32em;text-transform:uppercase;color:#c8860a;">Verse by Verse with Nate</div>` +
+      `<h1 style="margin:10px 0 0;color:#f4ead5;font-size:28px;line-height:1.2;">New Contact Form Submission</h1>` +
+      `</div>` +
+      `<div style="padding:24px;">` +
+      `<p style="margin:0 0 18px;font-family:Arial,sans-serif;font-size:15px;line-height:1.6;color:#57452b;">A new message was sent from the website contact form. Reply directly to this email to respond to <strong>${escapeHtml(trimmedName)}</strong>.</p>` +
+      `<table role="presentation" cellpadding="0" cellspacing="0" style="width:100%;border-collapse:collapse;margin-bottom:20px;">` +
+      `<tr><td style="width:120px;padding:10px 0;font-family:Arial,sans-serif;font-size:13px;font-weight:700;color:#8a6d35;border-bottom:1px solid #efe4cc;">Type</td><td style="padding:10px 0;font-family:Arial,sans-serif;font-size:15px;color:#201a10;border-bottom:1px solid #efe4cc;">${escapeHtml(normalizedMessageType)}</td></tr>` +
+      `<tr><td style="width:120px;padding:10px 0;font-family:Arial,sans-serif;font-size:13px;font-weight:700;color:#8a6d35;border-bottom:1px solid #efe4cc;">Name</td><td style="padding:10px 0;font-family:Arial,sans-serif;font-size:15px;color:#201a10;border-bottom:1px solid #efe4cc;">${escapeHtml(trimmedName)}</td></tr>` +
+      `<tr><td style="width:120px;padding:10px 0;font-family:Arial,sans-serif;font-size:13px;font-weight:700;color:#8a6d35;border-bottom:1px solid #efe4cc;">Email</td><td style="padding:10px 0;font-family:Arial,sans-serif;font-size:15px;color:#201a10;border-bottom:1px solid #efe4cc;"><a href="mailto:${escapeHtml(trimmedEmail)}" style="color:#8f5f05;text-decoration:none;">${escapeHtml(trimmedEmail)}</a></td></tr>` +
+      `<tr><td style="width:120px;padding:10px 0;font-family:Arial,sans-serif;font-size:13px;font-weight:700;color:#8a6d35;">Submitted</td><td style="padding:10px 0;font-family:Arial,sans-serif;font-size:15px;color:#201a10;">${escapeHtml(submittedAt)}</td></tr>` +
+      `</table>` +
+      `<div style="background:#fbf7ef;border:1px solid #efe4cc;border-radius:12px;padding:18px 20px;">` +
+      `<div style="margin:0 0 10px;font-family:Arial,sans-serif;font-size:13px;font-weight:700;letter-spacing:0.12em;text-transform:uppercase;color:#8a6d35;">Message</div>` +
+      `<div style="font-family:Arial,sans-serif;font-size:15px;line-height:1.7;color:#201a10;white-space:pre-wrap;">${escapeHtml(trimmedMessage)}</div>` +
+      `</div>` +
+      `</div>` +
+      `</div>` +
+      `</div>`,
+  }
+}
+
+export function buildAdminReplyTemplate({ recipientName, message, signature }) {
+  const safeRecipientName = escapeHtml(recipientName || 'friend')
+  const safeMessage = escapeHtml(message).replace(/\n/g, '<br/>')
+  const sig = typeof signature === 'string' && signature.trim() ? signature.trim() : 'Grace and peace,\nVerse by Verse with Nate'
+  const safeSig = escapeHtml(sig).replace(/\n/g, '<br/>')
+  return `
+    <div style="margin:0;padding:0;background-color:#f5f1e8;font-family:Georgia,serif;color:#201a10;">
+      <table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="background-color:#f5f1e8;">
+        <tr>
+          <td align="center" style="padding:28px 16px;">
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="max-width:680px;background:#ffffff;border:1px solid #e1d3b2;border-radius:14px;overflow:hidden;">
+              <tr>
+                <td style="background:#111111;padding:20px 24px;border-bottom:3px solid #c8860a;">
+                  <div style="font-family:Arial,sans-serif;font-size:12px;letter-spacing:0.32em;text-transform:uppercase;color:#c8860a;">Verse by Verse with Nate</div>
+                  <h1 style="margin:10px 0 0;color:#f4ead5;font-size:26px;line-height:1.2;">A Personal Reply</h1>
+                </td>
+              </tr>
+              <tr>
+                <td style="padding:26px 24px 18px;">
+                  <p style="margin:0 0 16px;font-family:Arial,sans-serif;font-size:16px;line-height:1.6;color:#201a10;">Hi ${safeRecipientName},</p>
+                  <div style="margin:0 0 18px;font-family:Arial,sans-serif;font-size:15px;line-height:1.7;color:#201a10;">${safeMessage}</div>
+                  <p style="margin:0;font-family:Arial,sans-serif;font-size:15px;line-height:1.7;color:#201a10;">${safeSig}</p>
+                </td>
+              </tr>
+              <tr>
+                <td style="background:#f7f2e5;border-top:1px solid #e8dcc1;padding:14px 24px;">
+                  <p style="margin:0;font-family:Arial,sans-serif;font-size:12px;line-height:1.5;color:#735a2b;">From: hello@versebyversewithnate.us</p>
+                </td>
+              </tr>
+            </table>
+          </td>
+        </tr>
+      </table>
+    </div>
+  `
+}
+
+export function buildQuestionAnsweredEmailTemplate({ firstName, question, answer, questionUrl }) {
+  const cfg = state.cachedSiteContent ?? {}
+  const subject = cfg.qaAnsweredEmailSubject?.trim() || 'Your question has been answered — Verse by Verse with Nate'
+  const bodyText = cfg.qaAnsweredEmailBody?.trim() || 'Nate has answered your question on Verse by Verse with Nate.'
+  const ctaLabel = cfg.qaAnsweredEmailCtaLabel?.trim() || 'Read Full Answer →'
+  const signoff = cfg.qaAnsweredEmailSignoff?.trim() || 'Grace and peace,\nNate'
+
+  const safeName = escapeHtml(firstName || 'friend')
+  const safeQuestion = escapeHtml(question)
+  const safeAnswer = escapeHtml(answer.length > 600 ? answer.slice(0, 597) + '…' : answer).replace(/\n/g, '<br/>')
+  const safeUrl = escapeHtml(questionUrl)
+  const safeBody = escapeHtml(bodyText)
+  const safeSignoff = escapeHtml(signoff).replace(/\n/g, '<br/>')
+  const text = `Hi ${firstName || 'friend'},\n\n${bodyText}\n\nYour question: ${question}\n\nAnswer: ${answer}\n\nRead it at: ${questionUrl}\n\n${signoff}`
+  const html = `
+    <div style="margin:0;padding:0;background-color:#f5f1e8;font-family:Georgia,serif;color:#201a10;">
+      <table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="background-color:#f5f1e8;">
+        <tr>
+          <td align="center" style="padding:28px 16px;">
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" role="presentation" style="max-width:680px;background:#ffffff;border:1px solid #e1d3b2;border-radius:14px;overflow:hidden;">
+              <tr>
+                <td style="background:#111111;padding:20px 24px;border-bottom:3px solid #c8860a;">
+                  <div style="font-family:Arial,sans-serif;font-size:12px;letter-spacing:0.32em;text-transform:uppercase;color:#c8860a;">Verse by Verse with Nate</div>
+                  <h1 style="margin:10px 0 0;color:#f4ead5;font-size:26px;line-height:1.2;">Your Question Was Answered</h1>
+                </td>
+              </tr>
+              <tr>
+                <td style="padding:26px 24px 18px;">
+                  <p style="margin:0 0 16px;font-family:Arial,sans-serif;font-size:16px;line-height:1.6;color:#201a10;">Hi ${safeName},</p>
+                  <p style="margin:0 0 16px;font-family:Arial,sans-serif;font-size:15px;line-height:1.7;color:#201a10;">${safeBody}</p>
+                  <div style="background:#f7f2e5;border-left:3px solid #c8860a;padding:14px 18px;margin:0 0 20px;border-radius:0 8px 8px 0;">
+                    <p style="margin:0 0 6px;font-family:Arial,sans-serif;font-size:13px;letter-spacing:0.06em;text-transform:uppercase;color:#a07830;">Your question</p>
+                    <p style="margin:0;font-family:Georgia,serif;font-size:15px;line-height:1.6;color:#201a10;font-style:italic;">${safeQuestion}</p>
+                  </div>
+                  <div style="margin:0 0 24px;">
+                    <p style="margin:0 0 6px;font-family:Arial,sans-serif;font-size:13px;letter-spacing:0.06em;text-transform:uppercase;color:#a07830;">Answer</p>
+                    <p style="margin:0;font-family:Arial,sans-serif;font-size:15px;line-height:1.7;color:#201a10;">${safeAnswer}</p>
+                  </div>
+                  <a href="${safeUrl}" style="display:inline-block;background:#c8860a;color:#ffffff;font-family:Arial,sans-serif;font-size:14px;font-weight:bold;text-decoration:none;padding:12px 24px;border-radius:6px;">${escapeHtml(ctaLabel)}</a>
+                </td>
+              </tr>
+              <tr>
+                <td style="background:#f7f2e5;border-top:1px solid #e8dcc1;padding:14px 24px;">
+                  <p style="margin:0 0 12px;font-family:Arial,sans-serif;font-size:13px;line-height:1.6;color:#201a10;">${safeSignoff}</p>
+                  <p style="margin:0;font-family:Arial,sans-serif;font-size:12px;line-height:1.5;color:#735a2b;">You received this because you requested a notification when this question was answered.</p>
+                </td>
+              </tr>
+            </table>
+          </td>
+        </tr>
+      </table>
+    </div>
+  `
+  return { subject, text, html }
+}
+
+// ── Transactional email senders ────────────────────────────────────────────
+
+export async function sendStudyWelcomeEmail(email, displayName) {
+  if (!process.env.RESEND_API_KEY) return
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const cfg = state.cachedSiteContent ?? {}
+    const namePart = typeof displayName === 'string' && displayName.trim() ? displayName.trim() : 'friend'
+    const baseUrl = getCanonicalBaseUrl()
+    const accountUrl = buildAbsoluteUrl(baseUrl, '/study/account')
+    const subject = cfg.studyWelcomeEmailSubject?.trim() || 'Welcome to the Study Community'
+    const bodyText = cfg.studyWelcomeEmailBody?.trim() || 'Your student account is ready. Open your studies and continue learning, or manage your account details anytime.'
+    const ctaLabel = cfg.studyWelcomeEmailCtaLabel?.trim() || 'Open Studies'
+    const studiesUrl = buildAbsoluteUrl(baseUrl, cfg.studyWelcomeEmailCtaPath?.trim() || '/study')
+    const signoff = cfg.studyWelcomeEmailSignoff?.trim() || 'Grace and peace,\nVerse by Verse with Nate'
+    const bodyHtml = (
+      `<p style="margin:0 0 16px;">Welcome, <strong style="color:#f0ead8;">${escapeHtml(namePart)}</strong>.</p>` +
+      `<p style="margin:0 0 16px;">${escapeHtml(bodyText)}</p>`
+    )
+    const footerHtml = `<p style="margin:0;font-family:Georgia,serif;font-size:12px;font-weight:300;color:#7a7060;line-height:1.6;">${escapeHtml(signoff).replace(/\n/g, '<br/>')}</p>`
+    const { error } = await resend.emails.send({
+      from: process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM,
+      to: [email],
+      subject,
+      text: `Welcome, ${namePart}.\n\n${bodyText}\n\nOpen studies: ${studiesUrl}\nManage account: ${accountUrl}\n\n${signoff}`,
+      html: buildBrandedEmailHtml({
+        title: 'Welcome to the Study Community',
+        eyebrow: 'Study Account',
+        bodyHtml,
+        ctaLabel,
+        ctaUrl: studiesUrl,
+        footerHtml: footerHtml + `<p style="margin:14px 0 0;font-family:Georgia,serif;font-size:12px;font-weight:300;color:#7a7060;line-height:1.6;"><a href="${escapeHtml(accountUrl)}" target="_blank" style="color:#c9a84c;text-decoration:none;">Manage your account</a></p>`,
+      }),
+    })
+    if (error) console.error('[study-signup] welcome email send error:', error)
+  } catch (err) {
+    console.error('[study-signup] welcome email exception:', err)
+  }
+}
+
+export async function sendEmailOtp(email, code) {
+  if (!process.env.RESEND_API_KEY) return
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const cfg = state.cachedSiteContent ?? {}
+    const subject = cfg.twoFaOtpEmailSubject?.trim() || 'Your sign-in code — Verse by Verse with Nate'
+    const bodyText = cfg.twoFaOtpEmailBody?.trim() || 'Your two-factor sign-in code is below. Enter it to complete sign-in.'
+    const expiryText = cfg.twoFaOtpEmailExpiry?.trim() || 'This code expires in 10 minutes. If you did not request this, you can ignore this message.'
+    await resend.emails.send({
+      from: process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM,
+      to: [email],
+      subject,
+      text: `${bodyText}\n\n${code}\n\n${expiryText}\n\nVerse by Verse with Nate`,
+      html: buildBrandedEmailHtml({
+        title: 'Your Sign-In Code',
+        eyebrow: 'Account Security',
+        bodyHtml:
+          `<p style="margin:0 0 16px;">${escapeHtml(bodyText)}</p>` +
+          `<p style="margin:0 0 16px;font-size:2.5rem;font-weight:700;letter-spacing:0.35em;color:#c9a84c;font-family:monospace;">${code}</p>` +
+          `<p style="margin:0 0 16px;font-size:0.9rem;color:#7a7060;">${escapeHtml(expiryText)}</p>`,
+        footerHtml: `<p style="margin:0;font-family:Georgia,serif;font-size:12px;color:#7a7060;">Verse by Verse with Nate</p>`,
+      }),
+    })
+  } catch (err) {
+    console.error('[email-otp] send error:', err)
+  }
+}
+
+export async function sendStudyAccountDeletedEmail(email, displayName) {
+  if (!process.env.RESEND_API_KEY) return
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const cfg = state.cachedSiteContent ?? {}
+    const namePart = typeof displayName === 'string' && displayName.trim() ? displayName.trim() : 'friend'
+    const baseUrl = getCanonicalBaseUrl()
+    const subject = cfg.studyDeletedEmailSubject?.trim() || 'Your study account was deleted'
+    const bodyText = cfg.studyDeletedEmailBody?.trim() || 'This confirms your study account and saved notes were deleted. If this was not you, please contact us immediately.'
+    const ctaLabel = cfg.studyDeletedEmailCtaLabel?.trim() || 'Create a New Account'
+    const signupUrl = buildAbsoluteUrl(baseUrl, cfg.studyDeletedEmailCtaPath?.trim() || '/study/signup')
+    const signoff = cfg.studyDeletedEmailSignoff?.trim() || 'Verse by Verse with Nate'
+    const bodyHtml = (
+      `<p style="margin:0 0 16px;">Hi <strong style="color:#f0ead8;">${escapeHtml(namePart)}</strong>,</p>` +
+      `<p style="margin:0 0 16px;">${escapeHtml(bodyText)}</p>`
+    )
+    const footerHtml = `<p style="margin:0;font-family:Georgia,serif;font-size:12px;font-weight:300;color:#7a7060;line-height:1.6;">${escapeHtml(signoff).replace(/\n/g, '<br/>')}</p>`
+    const { error } = await resend.emails.send({
+      from: process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM,
+      to: [email],
+      subject,
+      text: `Hi ${namePart},\n\n${bodyText}\n\nCreate a new account anytime: ${signupUrl}\n\n${signoff}`,
+      html: buildBrandedEmailHtml({
+        title: 'Study Account Deleted',
+        eyebrow: 'Account Update',
+        bodyHtml,
+        ctaLabel,
+        ctaUrl: signupUrl,
+        footerHtml,
+      }),
+    })
+    if (error) console.error('[study-account] delete email send error:', error)
+  } catch (err) {
+    console.error('[study-account] delete email exception:', err)
+  }
+}
+
+export async function sendStudyReminderEmail(email, displayName, studyTitle, sectionTitle, sectionReference, sectionUrl) {
+  if (!process.env.RESEND_API_KEY) return
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const cfg = state.cachedSiteContent ?? {}
+    const namePart = typeof displayName === 'string' && displayName.trim() ? displayName.trim() : 'friend'
+    const subjectPrefix = cfg.studyReminderEmailSubjectPrefix?.trim() || 'New lesson available:'
+    const bodyText = cfg.studyReminderEmailBody?.trim() || 'A new lesson has been unlocked in your study track. Open it below to continue where you left off.'
+    const ctaLabel = cfg.studyReminderEmailCtaLabel?.trim() || 'Open the Lesson'
+    const signoff = cfg.studyReminderEmailSignoff?.trim() || 'Grace and peace,\nVerse by Verse with Nate'
+    const subject = process.env.RESEND_REMINDER_SUBJECT ?? `${subjectPrefix} ${sectionTitle}`
+    const bodyHtml = (
+      `<p style="margin:0 0 16px;">Hi <strong style="color:#f0ead8;">${escapeHtml(namePart)}</strong>,</p>` +
+      `<p style="margin:0 0 16px;">${escapeHtml(bodyText)}</p>` +
+      `<p style="margin:0 0 16px;"><strong style="color:#f0ead8;">${escapeHtml(sectionTitle)}</strong> (${escapeHtml(sectionReference)}) — ${escapeHtml(studyTitle)}</p>`
+    )
+    const footerHtml = `<p style="margin:0;font-family:Georgia,serif;font-size:12px;font-weight:300;color:#7a7060;line-height:1.6;">${escapeHtml(signoff).replace(/\n/g, '<br/>')}</p>`
+    const { error } = await resend.emails.send({
+      from: process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM,
+      to: [email],
+      subject,
+      text: `Hi ${namePart},\n\n${bodyText}\n\n${sectionTitle} (${sectionReference}) — ${studyTitle}\n\nOpen it here: ${sectionUrl}\n\n${signoff}`,
+      html: buildBrandedEmailHtml({
+        title: 'New Lesson Available',
+        eyebrow: 'Study Reminder',
+        bodyHtml,
+        ctaLabel,
+        ctaUrl: sectionUrl,
+        footerHtml,
+      }),
+    })
+    if (error) console.error('[study-reminder] send error:', error)
+  } catch (err) {
+    console.error('[study-reminder] send exception:', err)
+  }
+}
+
+const REENGAGEMENT_DEFAULTS = {
+  t1: { subject: 'Your study is waiting for you', body: "It's been a while — your progress is saved and your next lesson is ready whenever you are.", cta: 'Continue Studying' },
+  t2: { subject: "Don't lose your momentum", body: 'Every note and completed lesson is still right there. A little each day adds up — come back and continue.', cta: 'Return to Your Study' },
+  t3: { subject: 'Your progress is still here', body: "Your study progress is still intact and waiting. There's no deadline — come back whenever you're ready.", cta: 'Open Your Study' },
+}
+
+function getReengagementCopy(tier) {
+  const cfg = state.cachedSiteContent ?? {}
+  const t = tier === 't1' ? '1' : tier === 't2' ? '2' : tier === 't3' ? '3' : null
+  const def = REENGAGEMENT_DEFAULTS[tier] ?? REENGAGEMENT_DEFAULTS.t1
+  if (!t) return def
+  return {
+    subject: cfg[`studyReengagementT${t}Subject`]?.trim() || def.subject,
+    body: cfg[`studyReengagementT${t}Body`]?.trim() || def.body,
+    cta: cfg[`studyReengagementT${t}Cta`]?.trim() || def.cta,
+  }
+}
+
+export async function sendStudyReengagementEmail(email, displayName, studyTitle, studyUrl, tier, unsubUrl) {
+  if (!process.env.RESEND_API_KEY) return
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const copy = getReengagementCopy(tier)
+    const namePart = typeof displayName === 'string' && displayName.trim() ? displayName.trim() : 'friend'
+    const subject = `${copy.subject}${studyTitle ? ` — ${studyTitle}` : ''}`
+    const bodyHtml = (
+      `<p style="margin:0 0 16px;">Hi <strong style="color:#f0ead8;">${escapeHtml(namePart)}</strong>,</p>` +
+      `<p style="margin:0 0 16px;">${escapeHtml(copy.body)}${studyTitle ? ` Your current study: <strong style="color:#f0ead8;">${escapeHtml(studyTitle)}</strong>.` : ''}</p>`
+    )
+    const unsubLine = unsubUrl ? `<p style="margin:16px 0 0;font-size:11px;color:#7a7060;">Not interested? <a href="${escapeHtml(unsubUrl)}" style="color:#7a7060;">Unsubscribe from these reminders.</a></p>` : ''
+    const footerHtml = `<p style="margin:0;font-family:Georgia,serif;font-size:12px;font-weight:300;color:#7a7060;line-height:1.6;">Grace and peace,<br/>Verse by Verse with Nate</p>${unsubLine}`
+    const { error } = await resend.emails.send({
+      from: process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM,
+      to: [email],
+      subject,
+      text: `Hi ${namePart},\n\n${copy.body}${studyTitle ? ` Your current study: ${studyTitle}.` : ''}\n\n${studyUrl}\n\nGrace and peace,\nVerse by Verse with Nate${unsubUrl ? `\n\nUnsubscribe: ${unsubUrl}` : ''}`,
+      html: buildBrandedEmailHtml({
+        title: copy.subject,
+        eyebrow: 'Study Reminder',
+        bodyHtml,
+        ctaLabel: copy.cta,
+        ctaUrl: studyUrl,
+        footerHtml,
+      }),
+    })
+    if (error) console.error('[study-reengagement] send error:', error)
+  } catch (err) {
+    console.error('[study-reengagement] send exception:', err)
+  }
+}

server/helpers.js

@@ -0,0 +1,536 @@
+import { randomUUID } from 'node:crypto'
+
+export const DEFAULT_REDIRECT_RULES = [
+  {
+    id: 'spotify',
+    path: '/spotify',
+    target: 'https://open.spotify.com/show/0Gq1TzoJOdReSZ1gYQi8Xl',
+    statusCode: 301,
+  },
+  {
+    id: 'apple',
+    path: '/apple',
+    target: 'https://podcasts.apple.com/search?term=Verse+by+Verse+with+Nate',
+    statusCode: 301,
+  },
+  {
+    id: 'amazon',
+    path: '/amazon',
+    target: 'https://music.amazon.com/podcasts/202322bf-db86-4e7d-9a6b-4db7cbccbccf/verse-by-verse-with-nate',
+    statusCode: 301,
+  },
+]
+
+export const DEFAULT_SEO = {
+  title: 'Verse by Verse with Nate',
+  description: 'Verse by Verse with Nate explores Scripture one verse at a time with practical Bible teaching.',
+  ogTitle: 'Verse by Verse with Nate',
+  ogDescription: 'A Journey Through Scripture - verse by verse, nugget by nugget.',
+  ogImage: '/images/podcast-art.jpeg',
+  canonicalUrl: 'https://versebyversewithnate.us/',
+  robotsPolicy: 'index,follow',
+  sitemapPaths: ['/', '/start-here', '/questions', '/privacy', '/terms', '/about', '/contact', '/episodes', '/resources', '/study', '/study/titus', '/study/colossians'],
+}
+
+export const DEFAULT_LEGAL = {
+  privacyTitle: 'Privacy Policy',
+  privacyBody: [
+    'We respect your privacy and collect limited data to operate and improve this site.',
+    'If you consent to analytics cookies, we may store masked IP-based location signals and returning visitor activity.',
+    'Contact form details are used only to respond to your message and ministry communication requests.',
+  ],
+  termsTitle: 'Terms',
+  termsBody: [
+    'Content on this site is for informational and ministry purposes.',
+    'External links are provided for convenience and are subject to third-party policies.',
+    'By using this site, you agree to lawful use and respectful communication.',
+  ],
+}
+
+export const DEFAULT_PODCAST_FEATURED_LINKS = []
+export const DEFAULT_PUBLISH_STATE = {
+  draftUpdatedAt: null,
+  publishedAt: null,
+}
+
+export function escapeHtml(value) {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
+export function splitName(fullName) {
+  const parts = String(fullName).trim().split(/\s+/).filter(Boolean)
+  return {
+    firstName: parts[0] ?? '',
+    lastName: parts.slice(1).join(' '),
+  }
+}
+
+export function sanitizeUrl(value) {
+  if (typeof value !== 'string') return ''
+  const trimmed = value.trim()
+  if (!trimmed) return ''
+  if (trimmed.startsWith('/')) return trimmed
+  if (/^https?:\/\//i.test(trimmed)) return trimmed
+  return ''
+}
+
+export function normalizeRedirectPath(value) {
+  if (typeof value !== 'string') return ''
+  const trimmed = value.trim()
+  if (!trimmed) return ''
+  const withSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`
+  const normalized = withSlash.replace(/\/+/g, '/')
+  if (normalized === '/') return ''
+  if (normalized.startsWith('/api/') || normalized.startsWith('/admin')) return ''
+  return normalized
+}
+
+export function normalizeSitemapPath(value) {
+  if (typeof value !== 'string') return ''
+  const trimmed = value.trim()
+  if (!trimmed) return ''
+  if (trimmed === '/') return '/'
+  return normalizeRedirectPath(trimmed)
+}
+
+export function sanitizeRedirectRules(value) {
+  const source = Array.isArray(value) ? value : []
+  const seen = new Set()
+  const out = []
+
+  for (const item of source) {
+    const pathValue = normalizeRedirectPath(item?.path)
+    const target = sanitizeUrl(item?.target)
+    const statusCode = Number(item?.statusCode) === 302 ? 302 : 301
+    if (!pathValue || !target) continue
+    if (seen.has(pathValue)) continue
+    seen.add(pathValue)
+    out.push({
+      id: typeof item?.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      path: pathValue,
+      target,
+      statusCode,
+    })
+  }
+
+  return out.length > 0 ? out : DEFAULT_REDIRECT_RULES
+}
+
+export function sanitizeFeaturedLinks(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => {
+      const discussionQuestions = Array.isArray(item.discussionQuestions)
+        ? item.discussionQuestions
+          .filter(question => typeof question === 'string')
+          .map(question => question.trim())
+          .filter(Boolean)
+          .slice(0, 30)
+        : []
+
+      return {
+        id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+        title: typeof item.title === 'string' ? item.title.trim().slice(0, 140) : '',
+        episodeNumber: typeof item.episodeNumber === 'string' ? item.episodeNumber.trim().slice(0, 20) : '',
+        summary: typeof item.summary === 'string' ? item.summary.trim().slice(0, 600) : '',
+        url: sanitizeUrl(item.url),
+        embedUrl: sanitizeUrl(item.embedUrl),
+        showNotes: typeof item.showNotes === 'string' ? item.showNotes.trim().slice(0, 10000) : '',
+        discussionQuestions,
+      }
+    })
+    .filter(
+      item =>
+        item.title ||
+        item.summary ||
+        item.url ||
+        item.embedUrl ||
+        item.showNotes ||
+        item.discussionQuestions.length > 0,
+    )
+}
+
+function sanitizeCustomLinks(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => {
+      const placement =
+        item?.placement === 'platforms'
+        || item?.placement === 'footer'
+        || item?.placement === 'resources'
+        || item?.placement === 'otherSites'
+        || item?.placement === 'externalSites'
+        || item?.placement === 'books'
+        || item?.placement === 'recommended'
+          ? item.placement
+          : 'footer'
+
+      return {
+        id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+        label: typeof item.label === 'string' ? item.label.trim().slice(0, 140) : '',
+        url: sanitizeUrl(item.url),
+        imageUrl: sanitizeUrl(item.imageUrl),
+        description: typeof item.description === 'string' ? item.description.trim().slice(0, 4000) : '',
+        amazonUrl: sanitizeUrl(item.amazonUrl),
+        amazonLabel: typeof item.amazonLabel === 'string' ? item.amazonLabel.trim().slice(0, 120) : '',
+        tags: Array.isArray(item.tags)
+          ? item.tags.filter(tag => typeof tag === 'string').map(tag => tag.trim()).filter(Boolean).slice(0, 20)
+          : [],
+        placement,
+      }
+    })
+    .filter(item => item.label && (item.url || item.amazonUrl || item.placement === 'books' || item.placement === 'recommended' || item.placement === 'resources'))
+}
+
+function sanitizeCustomBlocks(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => ({
+      id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      heading: typeof item.heading === 'string' ? item.heading.trim().slice(0, 140) : '',
+      body: typeof item.body === 'string' ? item.body.trim().slice(0, 4000) : '',
+      page: item?.page === 'homepage' || item?.page === 'start-here' || item?.page === 'episodes' || item?.page === 'downloads' || item?.page === 'about' || item?.page === 'contact' || item?.page === 'questions'
+        ? item.page
+        : 'downloads',
+      linkUrl: sanitizeUrl(item.linkUrl),
+      linkLabel: typeof item.linkLabel === 'string' ? item.linkLabel.trim().slice(0, 120) : '',
+    }))
+    .filter(item => item.heading || item.body)
+}
+
+function sanitizeArchivedSeriesResourceLinks(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => ({
+      id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      label: typeof item.label === 'string' ? item.label.trim().slice(0, 120) : '',
+      description: typeof item.description === 'string' ? item.description.trim().slice(0, 4000) : '',
+      url: sanitizeUrl(item.url),
+      amazonUrl: sanitizeUrl(item.amazonUrl),
+      amazonLabel: typeof item.amazonLabel === 'string' ? item.amazonLabel.trim().slice(0, 120) : '',
+    }))
+    .filter(item => item.label && item.url)
+}
+
+function sanitizeArchivedSeriesNotes(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => ({
+      id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      heading: typeof item.heading === 'string' ? item.heading.trim().slice(0, 140) : '',
+      body: typeof item.body === 'string' ? item.body.trim().slice(0, 4000) : '',
+    }))
+    .filter(item => item.heading || item.body)
+}
+
+function sanitizeColossiansStudySections(value) {
+  function normalizeReleasedAt(value) {
+    if (typeof value !== 'string' || !value.trim()) return ''
+    const parsed = Date.parse(value.trim())
+    if (!Number.isFinite(parsed)) return ''
+    return new Date(parsed).toISOString().replace('.000Z', 'Z')
+  }
+
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => {
+      const releasedAt = normalizeReleasedAt(item.releasedAt)
+      return {
+        id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+        chapter: Number.isInteger(item.chapter) && item.chapter >= 1 && item.chapter <= 999 ? item.chapter : 1,
+        reference: typeof item.reference === 'string' ? item.reference.trim().slice(0, 40) : '',
+        title: typeof item.title === 'string' ? item.title.trim().slice(0, 160) : '',
+        audioEmbedUrl: sanitizeUrl(item.audioEmbedUrl),
+        passageText: typeof item.passageText === 'string' ? item.passageText.trim().slice(0, 12000) : '',
+        summary: typeof item.summary === 'string' ? item.summary.trim().slice(0, 600) : '',
+        commentary: typeof item.commentary === 'string' ? item.commentary.trim().slice(0, 12000) : '',
+        greekNotes: Array.isArray(item.greekNotes)
+          ? item.greekNotes.filter(note => typeof note === 'string').map(note => note.trim()).filter(Boolean).slice(0, 20)
+          : [],
+        studyQuestions: Array.isArray(item.studyQuestions)
+          ? item.studyQuestions.filter(question => typeof question === 'string').map(question => question.trim()).filter(Boolean).slice(0, 20)
+          : [],
+        announcement: typeof item.announcement === 'string' ? item.announcement.trim().slice(0, 600) : '',
+        checkpointPrompt: typeof item.checkpointPrompt === 'string' ? item.checkpointPrompt.trim().slice(0, 600) : '',
+        checkpointQuestions: Array.isArray(item.checkpointQuestions)
+          ? item.checkpointQuestions.filter(question => typeof question === 'string').map(question => question.trim()).filter(Boolean).slice(0, 20)
+          : [],
+        ...(releasedAt ? { releasedAt } : {}),
+      }
+    })
+    .filter(item => item.title || item.summary || item.commentary || item.greekNotes.length > 0 || item.studyQuestions.length > 0 || item.passageText || item.checkpointPrompt || item.checkpointQuestions.length > 0)
+}
+
+function sanitizeStudies(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => ({
+      id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      slug: typeof item.slug === 'string' ? item.slug.trim().toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/-+/g, '-').replace(/^-|-$/g, '') : '',
+      title: typeof item.title === 'string' ? item.title.trim().slice(0, 160) : '',
+      description: typeof item.description === 'string' ? item.description.trim().slice(0, 800) : '',
+      homepageEyebrow: typeof item.homepageEyebrow === 'string' ? item.homepageEyebrow.trim().slice(0, 80) : '',
+      showOnHomepage: item.showOnHomepage === true,
+      showNewTag: item.showNewTag === true,
+      newTagLabel: typeof item.newTagLabel === 'string' ? item.newTagLabel.trim().slice(0, 24) : '',
+      status: item.status === 'planned' ? 'planned' : 'active',
+      difficulty: item.difficulty === 'advanced' ? 'advanced' : (item.difficulty === 'intermediate' ? 'intermediate' : 'beginner'),
+      estimatedHours: Number.isFinite(Number(item.estimatedHours)) ? Math.max(1, Math.min(500, Number(item.estimatedHours))) : 8,
+      completionBadge: typeof item.completionBadge === 'string' ? item.completionBadge.trim().slice(0, 120) : '',
+      numberOfChapters: Number.isInteger(item.numberOfChapters) && item.numberOfChapters >= 1 && item.numberOfChapters <= 999 ? item.numberOfChapters : 1,
+      sections: sanitizeColossiansStudySections(item.sections),
+    }))
+    .filter(item => item.slug && item.title)
+}
+
+function sanitizeArchivedSeries(value) {
+  const source = Array.isArray(value) ? value : []
+  return source
+    .filter(item => item && typeof item === 'object')
+    .map(item => ({
+      id: typeof item.id === 'string' && item.id.trim() ? item.id.trim() : randomUUID(),
+      label: typeof item.label === 'string' ? item.label.trim().slice(0, 140) : '',
+      title: typeof item.title === 'string' ? item.title.trim().slice(0, 200) : '',
+      description: typeof item.description === 'string' ? item.description.trim().slice(0, 1000) : '',
+      imageUrl: sanitizeUrl(item.imageUrl),
+      listenUrl: sanitizeUrl(item.listenUrl),
+      studyGuideTitle: typeof item.studyGuideTitle === 'string' ? item.studyGuideTitle.trim().slice(0, 140) : '',
+      studyGuideDescription: typeof item.studyGuideDescription === 'string' ? item.studyGuideDescription.trim().slice(0, 4000) : '',
+      studyGuideUrl: sanitizeUrl(item.studyGuideUrl),
+      resourceLinks: sanitizeArchivedSeriesResourceLinks(item.resourceLinks),
+      notes: sanitizeArchivedSeriesNotes(item.notes),
+      episodeRange:
+        Number.isInteger(item?.episodeRange?.from)
+        && Number.isInteger(item?.episodeRange?.to)
+        && item.episodeRange.from > 0
+        && item.episodeRange.to >= item.episodeRange.from
+          ? { from: item.episodeRange.from, to: item.episodeRange.to }
+          : undefined,
+    }))
+    .filter(
+      item =>
+        item.title ||
+        item.description ||
+        item.resourceLinks.length > 0 ||
+        item.notes.length > 0,
+    )
+}
+
+export function sanitizeSiteContent(siteContent) {
+  if (!siteContent || typeof siteContent !== 'object' || Array.isArray(siteContent)) return {}
+
+  const seo = siteContent.seo && typeof siteContent.seo === 'object' ? siteContent.seo : {}
+  const legal = siteContent.legal && typeof siteContent.legal === 'object' ? siteContent.legal : {}
+
+  return {
+    ...siteContent,
+    customLinks: sanitizeCustomLinks(siteContent.customLinks),
+    customBlocks: sanitizeCustomBlocks(siteContent.customBlocks),
+    archivedSeries: sanitizeArchivedSeries(siteContent.archivedSeries),
+    studies: sanitizeStudies(siteContent.studies),
+    colossiansStudySections: sanitizeColossiansStudySections(siteContent.colossiansStudySections),
+    redirects: sanitizeRedirectRules(siteContent.redirects),
+    podcastFeaturedLinks: sanitizeFeaturedLinks(siteContent.podcastFeaturedLinks ?? DEFAULT_PODCAST_FEATURED_LINKS),
+    episodesSeoIntro: typeof siteContent.episodesSeoIntro === 'string' && siteContent.episodesSeoIntro.trim() ? siteContent.episodesSeoIntro.trim().slice(0, 600) : '',
+    welcomeEmailSpotifyBtnLabel: typeof siteContent.welcomeEmailSpotifyBtnLabel === 'string' ? siteContent.welcomeEmailSpotifyBtnLabel.trim().slice(0, 80) : '',
+    welcomeEmailAppleBtnLabel: typeof siteContent.welcomeEmailAppleBtnLabel === 'string' ? siteContent.welcomeEmailAppleBtnLabel.trim().slice(0, 80) : '',
+    welcomeEmailStartHereLinkLabel: typeof siteContent.welcomeEmailStartHereLinkLabel === 'string' ? siteContent.welcomeEmailStartHereLinkLabel.trim().slice(0, 80) : '',
+    studyWelcomeEmailSubject: typeof siteContent.studyWelcomeEmailSubject === 'string' ? siteContent.studyWelcomeEmailSubject.trim().slice(0, 200) : '',
+    studyWelcomeEmailBody: typeof siteContent.studyWelcomeEmailBody === 'string' ? siteContent.studyWelcomeEmailBody.trim().slice(0, 1000) : '',
+    studyWelcomeEmailCtaLabel: typeof siteContent.studyWelcomeEmailCtaLabel === 'string' ? siteContent.studyWelcomeEmailCtaLabel.trim().slice(0, 80) : '',
+    studyWelcomeEmailCtaPath: typeof siteContent.studyWelcomeEmailCtaPath === 'string' ? siteContent.studyWelcomeEmailCtaPath.trim().slice(0, 200) : '',
+    studyWelcomeEmailSignoff: typeof siteContent.studyWelcomeEmailSignoff === 'string' ? siteContent.studyWelcomeEmailSignoff.trim().slice(0, 200) : '',
+    studyDeletedEmailSubject: typeof siteContent.studyDeletedEmailSubject === 'string' ? siteContent.studyDeletedEmailSubject.trim().slice(0, 200) : '',
+    studyDeletedEmailBody: typeof siteContent.studyDeletedEmailBody === 'string' ? siteContent.studyDeletedEmailBody.trim().slice(0, 1000) : '',
+    studyDeletedEmailCtaLabel: typeof siteContent.studyDeletedEmailCtaLabel === 'string' ? siteContent.studyDeletedEmailCtaLabel.trim().slice(0, 80) : '',
+    studyDeletedEmailCtaPath: typeof siteContent.studyDeletedEmailCtaPath === 'string' ? siteContent.studyDeletedEmailCtaPath.trim().slice(0, 200) : '',
+    studyDeletedEmailSignoff: typeof siteContent.studyDeletedEmailSignoff === 'string' ? siteContent.studyDeletedEmailSignoff.trim().slice(0, 200) : '',
+    studyReminderEmailSubjectPrefix: typeof siteContent.studyReminderEmailSubjectPrefix === 'string' ? siteContent.studyReminderEmailSubjectPrefix.trim().slice(0, 200) : '',
+    studyReminderEmailBody: typeof siteContent.studyReminderEmailBody === 'string' ? siteContent.studyReminderEmailBody.trim().slice(0, 1000) : '',
+    studyReminderEmailCtaLabel: typeof siteContent.studyReminderEmailCtaLabel === 'string' ? siteContent.studyReminderEmailCtaLabel.trim().slice(0, 80) : '',
+    studyReminderEmailSignoff: typeof siteContent.studyReminderEmailSignoff === 'string' ? siteContent.studyReminderEmailSignoff.trim().slice(0, 200) : '',
+    emailChangeSubject: typeof siteContent.emailChangeSubject === 'string' ? siteContent.emailChangeSubject.trim().slice(0, 200) : '',
+    emailChangeBody: typeof siteContent.emailChangeBody === 'string' ? siteContent.emailChangeBody.trim().slice(0, 500) : '',
+    emailChangeCtaLabel: typeof siteContent.emailChangeCtaLabel === 'string' ? siteContent.emailChangeCtaLabel.trim().slice(0, 80) : '',
+    twoFaOtpEmailSubject: typeof siteContent.twoFaOtpEmailSubject === 'string' ? siteContent.twoFaOtpEmailSubject.trim().slice(0, 200) : '',
+    twoFaOtpEmailBody: typeof siteContent.twoFaOtpEmailBody === 'string' ? siteContent.twoFaOtpEmailBody.trim().slice(0, 500) : '',
+    twoFaOtpEmailExpiry: typeof siteContent.twoFaOtpEmailExpiry === 'string' ? siteContent.twoFaOtpEmailExpiry.trim().slice(0, 300) : '',
+    seo: {
+      title: typeof seo.title === 'string' && seo.title.trim() ? seo.title.trim().slice(0, 120) : DEFAULT_SEO.title,
+      description: typeof seo.description === 'string' && seo.description.trim() ? seo.description.trim().slice(0, 240) : DEFAULT_SEO.description,
+      ogTitle: typeof seo.ogTitle === 'string' && seo.ogTitle.trim() ? seo.ogTitle.trim().slice(0, 120) : DEFAULT_SEO.ogTitle,
+      ogDescription: typeof seo.ogDescription === 'string' && seo.ogDescription.trim() ? seo.ogDescription.trim().slice(0, 240) : DEFAULT_SEO.ogDescription,
+      ogImage: sanitizeUrl(seo.ogImage) || DEFAULT_SEO.ogImage,
+      canonicalUrl: sanitizeUrl(seo.canonicalUrl) || DEFAULT_SEO.canonicalUrl,
+      robotsPolicy: typeof seo.robotsPolicy === 'string' && seo.robotsPolicy.trim() ? seo.robotsPolicy.trim() : DEFAULT_SEO.robotsPolicy,
+      sitemapPaths: Array.isArray(seo.sitemapPaths)
+        ? seo.sitemapPaths.map(pathItem => normalizeSitemapPath(pathItem)).filter(Boolean)
+        : [...DEFAULT_SEO.sitemapPaths],
+    },
+    legal: {
+      privacyTitle: typeof legal.privacyTitle === 'string' && legal.privacyTitle.trim() ? legal.privacyTitle.trim().slice(0, 120) : DEFAULT_LEGAL.privacyTitle,
+      privacyBody: Array.isArray(legal.privacyBody) && legal.privacyBody.length > 0
+        ? legal.privacyBody.filter(line => typeof line === 'string').map(line => line.trim()).filter(Boolean).slice(0, 20)
+        : [...DEFAULT_LEGAL.privacyBody],
+      termsTitle: typeof legal.termsTitle === 'string' && legal.termsTitle.trim() ? legal.termsTitle.trim().slice(0, 120) : DEFAULT_LEGAL.termsTitle,
+      termsBody: Array.isArray(legal.termsBody) && legal.termsBody.length > 0
+        ? legal.termsBody.filter(line => typeof line === 'string').map(line => line.trim()).filter(Boolean).slice(0, 20)
+        : [...DEFAULT_LEGAL.termsBody],
+    },
+  }
+}
+
+export function escapeXml(value) {
+  return String(value)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;')
+}
+
+export function buildAbsoluteUrl(baseUrl, maybeRelativePath) {
+  const safeBase = typeof baseUrl === 'string' && baseUrl.trim() ? baseUrl.trim() : DEFAULT_SEO.canonicalUrl
+  const root = safeBase.endsWith('/') ? safeBase.slice(0, -1) : safeBase
+  if (typeof maybeRelativePath !== 'string' || !maybeRelativePath.trim()) return root
+  const value = maybeRelativePath.trim()
+  if (/^https?:\/\//i.test(value)) return value
+  if (value.startsWith('/')) return `${root}${value}`
+  return `${root}/${value}`
+}
+
+export function injectSeoIntoHtml(html, siteContent) {
+  const seo = siteContent?.seo ?? DEFAULT_SEO
+  const title = seo.title || DEFAULT_SEO.title
+  const description = seo.description || DEFAULT_SEO.description
+  const ogTitle = seo.ogTitle || title
+  const ogDescription = seo.ogDescription || description
+  const canonical = buildAbsoluteUrl(seo.canonicalUrl || DEFAULT_SEO.canonicalUrl, '/')
+  const ogImage = buildAbsoluteUrl(canonical, seo.ogImage || DEFAULT_SEO.ogImage)
+  const robots = seo.robotsPolicy || DEFAULT_SEO.robotsPolicy
+
+  return html
+    .replace(/<title>[\s\S]*?<\/title>/i, `<title>${escapeHtml(title)}</title>`)
+    .replace(/<meta name="description" content="[^"]*"\s*\/?>/i, `<meta name="description" content="${escapeHtml(description)}" />`)
+    .replace(/<meta name="robots" content="[^"]*"\s*\/?>/i, `<meta name="robots" content="${escapeHtml(robots)}" />`)
+    .replace(/<meta property="og:title" content="[^"]*"\s*\/?>/i, `<meta property="og:title" content="${escapeHtml(ogTitle)}" />`)
+    .replace(/<meta property="og:description" content="[^"]*"\s*\/?>/i, `<meta property="og:description" content="${escapeHtml(ogDescription)}" />`)
+    .replace(/<meta property="og:image" content="[^"]*"\s*\/?>/i, `<meta property="og:image" content="${escapeHtml(ogImage)}" />`)
+    .replace(/<meta property="og:image:secure_url" content="[^"]*"\s*\/?>/i, `<meta property="og:image:secure_url" content="${escapeHtml(ogImage)}" />`)
+    .replace(/<meta property="og:url" content="[^"]*"\s*\/?>/i, `<meta property="og:url" content="${escapeHtml(canonical)}" />`)
+    .replace(/<link rel="canonical" href="[^"]*"\s*\/?>/i, `<link rel="canonical" href="${escapeHtml(canonical)}" />`)
+}
+
+export function normalizeAssetBaseName(name) {
+  if (typeof name !== 'string') return `upload-${Date.now()}`
+  const cleaned = name
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+  return cleaned || `upload-${Date.now()}`
+}
+
+export function inferImageExtensionFromDataUrl(dataUrl) {
+  if (typeof dataUrl !== 'string') return null
+  if (dataUrl.startsWith('data:image/png;base64,')) return '.png'
+  if (dataUrl.startsWith('data:image/jpeg;base64,')) return '.jpg'
+  if (dataUrl.startsWith('data:image/webp;base64,')) return '.webp'
+  if (dataUrl.startsWith('data:image/gif;base64,')) return '.gif'
+  if (dataUrl.startsWith('data:application/pdf;base64,')) return '.pdf'
+  if (dataUrl.startsWith('data:application/msword;base64,')) return '.doc'
+  if (dataUrl.startsWith('data:application/vnd.openxmlformats-officedocument.wordprocessingml.document;base64,')) return '.docx'
+  return null
+}
+
+export function normalizeIp(rawIp) {
+  if (!rawIp) return 'unknown'
+
+  let ip = String(rawIp).trim()
+
+  if (ip.includes(',')) {
+    ip = ip.split(',')[0].trim()
+  }
+
+  if (ip.startsWith('::ffff:')) {
+    ip = ip.slice(7)
+  }
+
+  if (ip === '::1') {
+    ip = '127.0.0.1'
+  }
+
+  return ip || 'unknown'
+}
+
+export function getClientIp(req) {
+  // Use req.ip: Express derives this from x-forwarded-for according to the
+  // configured trust proxy hop count, preventing header spoofing by clients.
+  return normalizeIp(req.ip)
+}
+
+export function parseCookies(cookieHeader) {
+  if (!cookieHeader) return {}
+
+  return cookieHeader
+    .split(';')
+    .map(v => v.trim())
+    .filter(Boolean)
+    .reduce((acc, part) => {
+      const idx = part.indexOf('=')
+      if (idx === -1) return acc
+      const key = part.slice(0, idx).trim()
+      const value = part.slice(idx + 1).trim()
+      try {
+        acc[key] = decodeURIComponent(value)
+      } catch {
+        acc[key] = value
+      }
+      return acc
+    }, {})
+}
+
+export function hasVisitorConsent(req) {
+  const cookies = parseCookies(req.headers.cookie)
+  return cookies['vbn_analytics_consent'] === 'yes'
+}
+
+// Secure cookies are required in production unless explicitly disabled with
+// ALLOW_INSECURE_COOKIES=true — needed when the app is reached over plain
+// HTTP (e.g. by LAN/VPN IP during a server migration, before TLS is set up),
+// because browsers silently drop Secure cookies on http:// origins.
+export function cookieSecureFlag() {
+  if (process.env.ALLOW_INSECURE_COOKIES === 'true') return ''
+  return process.env.NODE_ENV === 'production' ? '; Secure' : ''
+}
+
+export function setConsentCookie(res, consent) {
+  const value = consent ? 'yes' : 'no'
+  res.append('Set-Cookie', `vbn_analytics_consent=${value}; Max-Age=31536000; Path=/; SameSite=Lax${cookieSecureFlag()}`)
+}
+
+export function isPrivateOrLocalIp(ip) {
+  return (
+    ip === '127.0.0.1' ||
+    ip === 'localhost' ||
+    ip.startsWith('10.') ||
+    ip.startsWith('192.168.') ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(ip) ||
+    ip.startsWith('fc') ||
+    ip.startsWith('fd') ||
+    ip.startsWith('fe80:') ||
+    ip === 'unknown'
+  )
+}

server/paths.js

@@ -0,0 +1,15 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+// Base directory resolution lives in its own module (no app imports) so that
+// both config.js and auth.js can use DATA_DIR without a circular dependency.
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+// server/paths.js is inside server/, so the project root is one level up
+export const ROOT_DIR = path.resolve(__dirname, '..')
+
+const DEFAULT_DATA_DIR = path.join(ROOT_DIR, 'data')
+const configuredDataDir = typeof process.env.SITEFORGE_DATA_DIR === 'string' ? process.env.SITEFORGE_DATA_DIR.trim() : ''
+export const DATA_DIR = configuredDataDir
+  ? (path.isAbsolute(configuredDataDir) ? configuredDataDir : path.resolve(ROOT_DIR, configuredDataDir))
+  : DEFAULT_DATA_DIR

server/reminder.js

@@ -0,0 +1,111 @@
+import { Resend } from 'resend'
+import { state } from './state.js'
+import { queuePodcastChecklistWrite, queueCalendarEventsWrite } from './data.js'
+import { DEFAULT_RESEND_FROM, DEFAULT_RESEND_TO } from './config.js'
+
+function toDateKey(date) {
+  return date.toISOString().slice(0, 10)
+}
+
+export function startReminderScheduler() {
+  checkReminders()
+  setInterval(checkReminders, 60 * 60 * 1000)
+}
+
+async function checkReminders() {
+  const todayKey = toDateKey(new Date())
+
+  // Episodes
+  const episodes = state.podcastChecklist?.episodes
+  if (Array.isArray(episodes)) {
+    let changed = false
+    for (const ep of episodes) {
+      if (!ep.datePublished || !(ep.reminderDays > 0) || ep.reminderSentAt) continue
+      const publish = new Date(ep.datePublished + 'T12:00:00Z')
+      if (isNaN(publish.getTime())) continue
+      const reminderDate = new Date(publish)
+      reminderDate.setUTCDate(reminderDate.getUTCDate() - ep.reminderDays)
+      if (todayKey === toDateKey(reminderDate)) {
+        const sent = await sendReminderEmail({
+          label: ep.episodeNumber ? `Episode ${ep.episodeNumber}` : 'Episode',
+          title: ep.title || 'Untitled',
+          series: ep.series,
+          date: ep.datePublished,
+          reminderDays: ep.reminderDays,
+          type: 'episode',
+        })
+        if (sent) { ep.reminderSentAt = new Date().toISOString(); changed = true }
+      }
+    }
+    if (changed) queuePodcastChecklistWrite()
+  }
+
+  // Calendar events
+  const events = state.calendarEvents
+  if (Array.isArray(events)) {
+    let changed = false
+    for (const ev of events) {
+      if (!ev.date || !(ev.reminderDays > 0) || ev.reminderSentAt) continue
+      const publish = new Date(ev.date + 'T12:00:00Z')
+      if (isNaN(publish.getTime())) continue
+      const reminderDate = new Date(publish)
+      reminderDate.setUTCDate(reminderDate.getUTCDate() - ev.reminderDays)
+      if (todayKey === toDateKey(reminderDate)) {
+        const sent = await sendReminderEmail({
+          label: ev.type.charAt(0).toUpperCase() + ev.type.slice(1),
+          title: ev.title,
+          series: null,
+          date: ev.date,
+          reminderDays: ev.reminderDays,
+          type: ev.type,
+        })
+        if (sent) { ev.reminderSentAt = new Date().toISOString(); changed = true }
+      }
+    }
+    if (changed) queueCalendarEventsWrite()
+  }
+}
+
+const TYPE_ICONS = { episode: '📅', general: '📌', recording: '🎙️', social: '📱', task: '✅' }
+
+async function sendReminderEmail({ label, title, series, date, reminderDays, type }) {
+  if (!process.env.RESEND_API_KEY) return false
+
+  try {
+    const resend = new Resend(process.env.RESEND_API_KEY)
+    const from = process.env.RESEND_FROM ?? DEFAULT_RESEND_FROM
+    const to = process.env.RESEND_TO ?? DEFAULT_RESEND_TO
+
+    const eventDate = new Date(date + 'T12:00:00Z')
+    const msLeft = eventDate.getTime() - Date.now()
+    const daysLeft = Math.max(0, Math.ceil(msLeft / (1000 * 60 * 60 * 24)))
+
+    const seriesStr = series ? ` (${series})` : ''
+    const daysText = daysLeft === 0 ? 'today' : daysLeft === 1 ? 'in 1 day' : `in ${daysLeft} days`
+    const icon = TYPE_ICONS[type] ?? '📅'
+    const subject = `Reminder: ${label}: ${title} — ${daysText}`
+
+    const html = `
+      <div style="font-family:system-ui,sans-serif;max-width:540px;margin:0 auto;color:#222">
+        <h2 style="color:#c8860a;margin-bottom:4px">${icon} Calendar Reminder</h2>
+        <p style="font-size:1.1rem;margin-bottom:16px">
+          <strong>${label}: ${title}</strong>${seriesStr}<br>
+          <span style="color:#555">Scheduled for <strong>${date}</strong> — ${daysText}</span>
+        </p>
+        <hr style="border:none;border-top:1px solid #eee;margin:16px 0">
+        <p style="color:#777;font-size:0.85rem">
+          This reminder was set ${reminderDays} day${reminderDays === 1 ? '' : 's'} before the date.
+          To change or remove it, open the Calendar in your admin panel.
+        </p>
+      </div>
+    `
+
+    const { error } = await resend.emails.send({ from, to, subject, html })
+    if (error) { console.error('[reminder] send error:', error); return false }
+    console.log(`[reminder] sent for "${title}" (${date})`)
+    return true
+  } catch (err) {
+    console.error('[reminder] send exception:', err)
+    return false
+  }
+}

server/routes/admin-assets.js

@@ -0,0 +1,196 @@
+import { mkdir, stat, unlink, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { inferImageExtensionFromDataUrl, normalizeAssetBaseName } from '../helpers.js'
+import { requireAdminAuth } from '../auth.js'
+import { UPLOADS_DIR } from '../config.js'
+import { state } from '../state.js'
+import {
+  listUploadedAssets,
+  readUploadsMetadata,
+  writeUploadsMetadata,
+  getUserNotesFilePath,
+  queueStudyUsersWrite,
+} from '../data.js'
+import {
+  hashStudyPassword,
+  getStudyCatalog,
+  normalizeStudySlug,
+  isEnrollableStudySlug,
+} from '../study-helpers.js'
+
+export function register(app) {
+  app.get('/api/admin-assets', requireAdminAuth, async (_req, res) => {
+    try {
+      const assets = await listUploadedAssets()
+      res.json({ assets })
+    } catch {
+      res.status(500).json({ message: 'Could not list uploaded assets.' })
+    }
+  })
+
+  app.post('/api/admin-assets', requireAdminAuth, async (req, res) => {
+    try {
+      const filename = typeof req.body?.filename === 'string' ? req.body.filename : ''
+      const dataUrl = typeof req.body?.dataUrl === 'string' ? req.body.dataUrl : ''
+      const ext = inferImageExtensionFromDataUrl(dataUrl)
+
+      if (!ext) {
+        res.status(400).json({ message: 'Upload must be a PNG, JPG, WEBP, GIF, PDF, DOC, or DOCX data URL.' })
+        return
+      }
+
+      const base64 = dataUrl.split(',')[1] ?? ''
+      const buffer = Buffer.from(base64, 'base64')
+      if (buffer.length === 0 || buffer.length > (8 * 1024 * 1024)) {
+        res.status(400).json({ message: 'Upload must be between 1 byte and 8MB.' })
+        return
+      }
+
+      const baseName = normalizeAssetBaseName(filename.replace(/\.[a-z0-9]+$/i, ''))
+      const finalName = `${baseName}-${Date.now()}${ext}`
+
+      await mkdir(UPLOADS_DIR, { recursive: true })
+      await writeFile(path.join(UPLOADS_DIR, finalName), buffer)
+      const metadata = await readUploadsMetadata()
+      metadata[finalName] = []
+      await writeUploadsMetadata(metadata)
+
+      res.json({ ok: true, asset: { filename: finalName, url: `/uploads/${finalName}` } })
+    } catch {
+      res.status(500).json({ message: 'Upload failed.' })
+    }
+  })
+
+  app.patch('/api/admin-assets/:filename', requireAdminAuth, async (req, res) => {
+    try {
+      const { filename } = req.params
+      if (typeof filename !== 'string' || filename.includes('/') || filename.includes('..')) {
+        res.status(400).json({ message: 'Invalid filename.' })
+        return
+      }
+
+      const tags = Array.isArray(req.body?.tags)
+        ? req.body.tags.filter(tag => typeof tag === 'string').map(tag => tag.trim()).filter(Boolean)
+        : []
+
+      const filePath = path.join(UPLOADS_DIR, filename)
+      await stat(filePath)
+
+      const metadata = await readUploadsMetadata()
+      metadata[filename] = tags
+      await writeUploadsMetadata(metadata)
+
+      res.json({ ok: true, tags })
+    } catch {
+      res.status(404).json({ message: 'Asset not found.' })
+    }
+  })
+
+  app.delete('/api/admin-assets/:filename', requireAdminAuth, async (req, res) => {
+    try {
+      const { filename } = req.params
+      if (typeof filename !== 'string' || filename.includes('/') || filename.includes('..')) {
+        res.status(400).json({ message: 'Invalid filename.' })
+        return
+      }
+
+      await unlink(path.join(UPLOADS_DIR, filename))
+      const metadata = await readUploadsMetadata()
+      delete metadata[filename]
+      await writeUploadsMetadata(metadata)
+      res.json({ ok: true })
+    } catch {
+      res.status(404).json({ message: 'Asset not found.' })
+    }
+  })
+
+  // ── Admin: Study User Management ─────────────────────────────────────────
+
+  app.get('/api/admin/study-users', requireAdminAuth, async (req, res) => {
+    const catalog = getStudyCatalog()
+    const users = await Promise.all(state.studyUsers.map(async user => {
+      let noteCount = 0
+      try {
+        const { readFile } = await import('node:fs/promises')
+        const notesRaw = await readFile(getUserNotesFilePath(user.id), 'utf8').catch(() => '{}')
+        const notes = JSON.parse(notesRaw)
+        noteCount = Object.values(notes).filter(n => typeof n === 'string' && n.trim()).length
+      } catch { /* ignore */ }
+
+      const enrolledStudies = (user.enrolledStudySlugs ?? []).map(slug => {
+        const study = catalog.find(s => s.slug === slug)
+        return study ? { slug, title: study.title } : { slug, title: slug }
+      })
+
+      return {
+        id: user.id,
+        username: user.username,
+        displayName: user.displayName ?? '',
+        createdAt: user.createdAt ?? null,
+        lastLoginAt: user.lastLoginAt ?? null,
+        enrolledStudies,
+        noteCount,
+        subscribeNewsletter: user.subscribeNewsletter !== false,
+        studyRemindersEnabled: user.studyRemindersEnabled === true,
+      }
+    }))
+
+    res.json({ users })
+  })
+
+  app.patch('/api/admin/study-users/:id', requireAdminAuth, (req, res) => {
+    const user = state.studyUsers.find(u => u.id === req.params.id)
+    if (!user) { res.status(404).json({ message: 'User not found.' }); return }
+
+    const { displayName, newPassword, addEnrollment, removeEnrollment } = req.body ?? {}
+
+    if (typeof displayName === 'string') {
+      user.displayName = displayName.trim().slice(0, 80)
+    }
+
+    if (typeof newPassword === 'string') {
+      if (newPassword.length < 8 || newPassword.length > 200) {
+        res.status(400).json({ message: 'Password must be 8–200 characters.' }); return
+      }
+      user.passwordHash = hashStudyPassword(newPassword)
+      for (const [token, session] of state.studySessions) {
+        if (session.userId === user.id) state.studySessions.delete(token)
+      }
+    }
+
+    if (typeof addEnrollment === 'string' && addEnrollment.trim()) {
+      const slug = normalizeStudySlug(addEnrollment)
+      if (!slug || !isEnrollableStudySlug(slug)) {
+        res.status(400).json({ message: `Unknown study slug: ${addEnrollment.trim()}` }); return
+      }
+      if (!Array.isArray(user.enrolledStudySlugs)) user.enrolledStudySlugs = []
+      if (!user.enrolledStudySlugs.includes(slug)) user.enrolledStudySlugs.push(slug)
+    }
+
+    if (typeof removeEnrollment === 'string' && removeEnrollment.trim()) {
+      const slug = removeEnrollment.trim()
+      user.enrolledStudySlugs = (user.enrolledStudySlugs ?? []).filter(s => s !== slug)
+    }
+
+    user.updatedAt = new Date().toISOString()
+    queueStudyUsersWrite()
+    res.json({ ok: true, displayName: user.displayName, enrolledStudySlugs: user.enrolledStudySlugs })
+  })
+
+  app.delete('/api/admin/study-users/:id', requireAdminAuth, async (req, res) => {
+    const user = state.studyUsers.find(u => u.id === req.params.id)
+    if (!user) { res.status(404).json({ message: 'User not found.' }); return }
+
+    for (const [token, session] of state.studySessions) {
+      if (session.userId === user.id) state.studySessions.delete(token)
+    }
+
+    state.studyUsers = state.studyUsers.filter(u => u.id !== user.id)
+    queueStudyUsersWrite()
+
+    state.studyNotesCache.delete(user.id)
+    try { await unlink(getUserNotesFilePath(user.id)) } catch { /* no notes file is fine */ }
+
+    res.json({ ok: true })
+  })
+}

server/routes/admin-auth.js

@@ -0,0 +1,165 @@
+import rateLimit from 'express-rate-limit'
+import qrcode from 'qrcode'
+import { parseCookies } from '../helpers.js'
+import { APP_VERSION, GIT_COMMIT } from '../config.js'
+import {
+  isAdminPasswordConfigured,
+  isValidAdminSession,
+  requireAdminAuth,
+  setAdminSessionCookie,
+  clearAdminSessionCookie,
+  createAdminSession,
+  deleteAdminSession,
+  isAdminPasswordValid,
+  isTotpEnabled,
+  loadTotpState,
+  saveTotpState,
+  generateTotpSecret,
+  getTotpUri,
+  verifyTotpCode,
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  consumeRecoveryCode,
+  createPendingSession,
+  consumePendingSession,
+} from '../auth.js'
+
+const ADMIN_SESSION_COOKIE = 'vbn_admin_session'
+
+const loginRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { message: 'Too many login attempts. Please wait 15 minutes and try again.' },
+  skipSuccessfulRequests: true,
+})
+
+export function register(app) {
+  app.get('/api/admin-auth/status', async (req, res) => {
+    res.json({
+      authenticated: isValidAdminSession(req),
+      configured: isAdminPasswordConfigured(),
+      totpEnabled: await isTotpEnabled(),
+      version: APP_VERSION,
+      commit: GIT_COMMIT,
+    })
+  })
+
+  app.post('/api/admin-auth/login', loginRateLimiter, async (req, res) => {
+    const password = typeof req.body?.password === 'string' ? req.body.password : ''
+
+    if (!isAdminPasswordConfigured()) {
+      res.status(503).json({ message: 'ADMIN_PASSWORD is not configured on the server.' })
+      return
+    }
+
+    if (!isAdminPasswordValid(password)) {
+      res.status(401).json({ message: 'Invalid password.' })
+      return
+    }
+
+    const totpOn = await isTotpEnabled()
+    if (totpOn) {
+      const pendingToken = createPendingSession()
+      res.json({ totpRequired: true, pendingToken })
+      return
+    }
+
+    const sessionToken = createAdminSession()
+    setAdminSessionCookie(res, sessionToken)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-auth/totp-verify', loginRateLimiter, async (req, res) => {
+    const { pendingToken, code } = req.body ?? {}
+
+    if (!consumePendingSession(pendingToken)) {
+      res.status(401).json({ message: 'Session expired or invalid. Please sign in again.' })
+      return
+    }
+
+    const totpState = await loadTotpState()
+    if (!totpState?.secret || !totpState?.verified) {
+      res.status(400).json({ message: 'TOTP is not configured.' })
+      return
+    }
+
+    const codeStr = typeof code === 'string' ? code.trim() : ''
+
+    if (verifyTotpCode(totpState.secret, codeStr)) {
+      const sessionToken = createAdminSession()
+      setAdminSessionCookie(res, sessionToken)
+      res.json({ ok: true })
+      return
+    }
+
+    if (consumeRecoveryCode(totpState, codeStr)) {
+      await saveTotpState(totpState)
+      const sessionToken = createAdminSession()
+      setAdminSessionCookie(res, sessionToken)
+      res.json({ ok: true, usedRecoveryCode: true, remainingRecoveryCodes: totpState.hashedRecoveryCodes.length })
+      return
+    }
+
+    res.status(401).json({ message: 'Invalid code. Try again or use a recovery code.' })
+  })
+
+  app.post('/api/admin-auth/totp-setup-init', requireAdminAuth, async (req, res) => {
+    const secret = generateTotpSecret()
+    const uri = getTotpUri(secret)
+    const qrDataUrl = await qrcode.toDataURL(uri)
+    const existing = await loadTotpState()
+    await saveTotpState({ ...existing, secret, verified: false })
+    res.json({ qrDataUrl, secret })
+  })
+
+  app.post('/api/admin-auth/totp-setup-confirm', requireAdminAuth, async (req, res) => {
+    const { code } = req.body ?? {}
+    const totpState = await loadTotpState()
+
+    if (!totpState?.secret) {
+      res.status(400).json({ message: 'No TOTP setup in progress. Call /totp-setup-init first.' })
+      return
+    }
+
+    if (!verifyTotpCode(totpState.secret, typeof code === 'string' ? code.trim() : '')) {
+      res.status(401).json({ message: 'Code incorrect. Scan the QR code again and try once more.' })
+      return
+    }
+
+    const recoveryCodes = generateRecoveryCodes()
+    await saveTotpState({
+      secret: totpState.secret,
+      verified: true,
+      hashedRecoveryCodes: recoveryCodes.map(hashRecoveryCode),
+      enabledAt: new Date().toISOString(),
+    })
+
+    res.json({ ok: true, recoveryCodes })
+  })
+
+  app.post('/api/admin-auth/totp-disable', requireAdminAuth, async (req, res) => {
+    await saveTotpState({ secret: null, verified: false, hashedRecoveryCodes: [], disabledAt: new Date().toISOString() })
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-auth/totp-regen-recovery', requireAdminAuth, async (req, res) => {
+    const totpState = await loadTotpState()
+    if (!totpState?.secret || !totpState?.verified) {
+      res.status(400).json({ message: 'TOTP is not enabled.' })
+      return
+    }
+    const recoveryCodes = generateRecoveryCodes()
+    await saveTotpState({ ...totpState, hashedRecoveryCodes: recoveryCodes.map(hashRecoveryCode) })
+    res.json({ ok: true, recoveryCodes })
+  })
+
+  app.post('/api/admin-auth/logout', (req, res) => {
+    const cookies = parseCookies(req.headers.cookie)
+    const sessionToken = cookies[ADMIN_SESSION_COOKIE]
+    deleteAdminSession(sessionToken)
+    clearAdminSessionCookie(res)
+    res.json({ ok: true })
+  })
+}

server/routes/admin-backup.js

@@ -0,0 +1,251 @@
+import { mkdir, mkdtemp, readdir, rm, cp, writeFile, unlink } from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import express from 'express'
+import * as tar from 'tar'
+import { requireAdminAuth } from '../auth.js'
+import { DATA_DIR } from '../config.js'
+import { state } from '../state.js'
+import {
+  loadHitStatsFromDisk,
+  loadVisitorStatsFromDisk,
+  loadContactSubmissionsFromDisk,
+  loadReplyTemplatesFromDisk,
+  loadReplyHistoryFromDisk,
+  loadQuestionsFromDisk,
+  loadDraftQuestionsFromDisk,
+  loadStudyUsersFromDisk,
+  loadStudyCommunityFromDisk,
+  loadStudyRemindersFromDisk,
+  loadStudyCommentsFromDisk,
+  loadStudyCertificatesFromDisk,
+  loadEpisodeScriptsFromDisk,
+  migrateStudyNotesIfNeeded,
+  loadDownloadCountsFromDisk,
+  loadQrCodesFromDisk,
+  loadEpisodePlaysFromDisk,
+  loadPodcastChecklistFromDisk,
+  loadAnalyticsEventsFromDisk,
+  createBackupSnapshot,
+  refreshContentCaches,
+} from '../data.js'
+
+// Portable server settings captured into env-snapshot.env at export time so a
+// backup carries the runtime configuration too (Docker deployments have no
+// .env file — settings live in container env vars). Machine-specific vars
+// (PORT, NODE_ENV, SITEFORGE_DATA_DIR, ALLOW_INSECURE_COOKIES, build info)
+// are deliberately excluded. Values are NOT applied automatically on restore.
+const ENV_SNAPSHOT_KEYS = [
+  'ADMIN_PASSWORD',
+  'RESEND_API_KEY',
+  'RESEND_CONTACTS_API_KEY',
+  'RESEND_WEBHOOK_TOKEN',
+  'INBOUND_EMAIL_SECRET',
+  'RESEND_FROM',
+  'RESEND_TO',
+  'RESEND_REPLY_TO',
+  'RESEND_AUTOMATION_WELCOME',
+  'RESEND_SEGMENT_ID',
+  'RESEND_REMINDER_SUBJECT',
+  'RESEND_WELCOME_SUBJECT',
+  'RESEND_WELCOME_IMAGE_URL',
+  'RESEND_WELCOME_EPISODE_URL',
+  'RESEND_WELCOME_WEBSITE_URL',
+  'RESEND_WELCOME_SPOTIFY_URL',
+  'RESEND_WELCOME_APPLE_URL',
+  'RESEND_WELCOME_AMAZON_URL',
+  'CACHE_PURGE_WEBHOOK_URL',
+  'DEPLOY_WEBHOOK_URL',
+  'CONTACT_EMAIL_COOLDOWN_MS',
+  'TRUST_PROXY_HOPS',
+  'TITUS_STUDY_FILE',
+  'TITUS_STUDY_DOWNLOAD_NAME',
+]
+
+// Write env snapshot into DATA_DIR for inclusion in the archive, then delete
+// it immediately after the stream finishes so secrets don't linger on disk.
+async function writeEnvSnapshot() {
+  const lines = [
+    '# Siteforge environment snapshot — regenerated on every full backup export.',
+    '# Contains secrets (admin password, API keys): keep this backup private.',
+    '# These values are NOT applied automatically on restore. Set them as',
+    '# container environment variables (or in .env) on the new server.',
+    `# Exported at ${new Date().toISOString()}`,
+    '',
+  ]
+  for (const key of ENV_SNAPSHOT_KEYS) {
+    const value = process.env[key]
+    if (typeof value === 'string' && value.trim() !== '') lines.push(`${key}=${value}`)
+  }
+  await writeFile(path.join(DATA_DIR, 'env-snapshot.env'), `${lines.join('\n')}\n`, 'utf8')
+}
+
+async function deleteEnvSnapshot() {
+  await unlink(path.join(DATA_DIR, 'env-snapshot.env')).catch(() => {})
+}
+
+// Files that identify an archive as a Siteforge data backup. At least one
+// must be present at the top level of an uploaded archive before we restore.
+const KNOWN_DATA_FILES = [
+  'admin-content.json',
+  'admin-content-draft.json',
+  'study-users.json',
+  'hit-stats.json',
+  'visitor-stats.json',
+  'questions.json',
+]
+
+// Wait for every queued disk write so the archive reflects current state.
+async function flushPendingWrites() {
+  await Promise.allSettled([
+    state.hitStatsWritePromise,
+    state.visitorStatsWritePromise,
+    state.contactSubmissionsWritePromise,
+    state.questionsWritePromise,
+    state.draftQuestionsWritePromise,
+    state.replyTemplatesWritePromise,
+    state.replyHistoryWritePromise,
+    state.podcastChecklistWritePromise,
+    state.studyUsersWritePromise,
+    state.studyCommunityWritePromise,
+    state.studyRemindersWritePromise,
+    state.studyCommentsWritePromise,
+    state.studyCertificatesWritePromise,
+    state.episodeScriptsWritePromise,
+    state.downloadCountsWritePromise,
+    state.episodePlaysWritePromise,
+    state.analyticsEventsWritePromise,
+    state.qrCodesWritePromise,
+    ...state.studyNotesWriteQueues.values(),
+    ...state.studyProgressWriteQueues.values(),
+  ])
+}
+
+// Rebuild all in-memory state from whatever is now on disk (mirrors startup).
+async function reloadStateFromDisk() {
+  state.studyNotesCache.clear()
+  state.studyNotesWriteQueues.clear()
+  state.studyProgressCache.clear()
+  state.studyProgressWriteQueues.clear()
+  // Restored study users may not match current sessions — force re-login.
+  state.studySessions.clear()
+
+  await Promise.all([
+    loadHitStatsFromDisk(),
+    loadVisitorStatsFromDisk(),
+    loadContactSubmissionsFromDisk(),
+    loadReplyTemplatesFromDisk(),
+    loadReplyHistoryFromDisk(),
+    loadQuestionsFromDisk(),
+    loadDraftQuestionsFromDisk(),
+    loadStudyUsersFromDisk(),
+    loadStudyCommunityFromDisk(),
+    loadStudyRemindersFromDisk(),
+    loadStudyCommentsFromDisk(),
+    loadStudyCertificatesFromDisk(),
+    loadEpisodeScriptsFromDisk(),
+    migrateStudyNotesIfNeeded(),
+    loadDownloadCountsFromDisk(),
+    loadQrCodesFromDisk(),
+    loadEpisodePlaysFromDisk(),
+    loadPodcastChecklistFromDisk(),
+    loadAnalyticsEventsFromDisk(),
+    refreshContentCaches(),
+  ])
+}
+
+export function register(app) {
+  // Download the entire data directory as a tar.gz (excluding the automatic
+  // snapshot folder, which is derived from the other files).
+  app.get('/api/admin-backup/export', requireAdminAuth, async (_req, res) => {
+    try {
+      await flushPendingWrites()
+      await writeEnvSnapshot()
+      const entries = (await readdir(DATA_DIR)).filter(name => name !== 'backups')
+      if (entries.length === 0) {
+        res.status(500).json({ message: 'Data directory is empty — nothing to export.' })
+        return
+      }
+
+      const stamp = new Date().toISOString().replace(/[:.]/g, '-')
+      res.setHeader('Content-Type', 'application/gzip')
+      res.setHeader('Content-Disposition', `attachment; filename="siteforge-data-${stamp}.tar.gz"`)
+
+      const archive = tar.create({ gzip: true, cwd: DATA_DIR, portable: true }, entries)
+      archive.on('error', err => {
+        console.error('[admin-backup] export stream failed:', err)
+        res.destroy(err)
+      })
+      archive.on('end', () => { deleteEnvSnapshot() })
+      res.on('close', () => { deleteEnvSnapshot() })
+      archive.pipe(res)
+    } catch (err) {
+      console.error('[admin-backup] export failed:', err)
+      deleteEnvSnapshot()
+      if (!res.headersSent) res.status(500).json({ message: 'Full backup export failed.' })
+    }
+  })
+
+  // Restore the entire data directory from an uploaded tar.gz produced by the
+  // export endpoint, then reload all in-memory state from the restored files.
+  app.post(
+    '/api/admin-backup/import',
+    requireAdminAuth,
+    express.raw({ type: () => true, limit: '500mb' }),
+    async (req, res) => {
+      let workDir = null
+      try {
+        const body = req.body
+        if (!Buffer.isBuffer(body) || body.length === 0) {
+          res.status(400).json({ message: 'Upload the .tar.gz file produced by the full backup export.' })
+          return
+        }
+        if (body[0] !== 0x1f || body[1] !== 0x8b) {
+          res.status(400).json({ message: 'File is not a gzip archive (.tar.gz expected).' })
+          return
+        }
+
+        workDir = await mkdtemp(path.join(os.tmpdir(), 'siteforge-import-'))
+        const archivePath = path.join(workDir, 'import.tar.gz')
+        await writeFile(archivePath, body)
+
+        const extractDir = path.join(workDir, 'extracted')
+        await mkdir(extractDir)
+        // node-tar strips absolute paths and rejects entries that escape cwd.
+        await tar.extract({ file: archivePath, cwd: extractDir })
+
+        const extractedEntries = await readdir(extractDir)
+        if (!extractedEntries.some(name => KNOWN_DATA_FILES.includes(name))) {
+          res.status(400).json({ message: 'Archive does not look like a Siteforge data backup.' })
+          return
+        }
+
+        // Settle queued writes so nothing overwrites the restored files, and
+        // keep a snapshot of the pre-import state in the backups folder.
+        await flushPendingWrites()
+        await createBackupSnapshot('pre-import')
+
+        // Replace current data with the archive contents. The snapshot folder
+        // is preserved unless the archive itself contains one.
+        const currentEntries = await readdir(DATA_DIR)
+        for (const name of currentEntries) {
+          if (name === 'backups' && !extractedEntries.includes('backups')) continue
+          await rm(path.join(DATA_DIR, name), { recursive: true, force: true })
+        }
+        for (const name of extractedEntries) {
+          await cp(path.join(extractDir, name), path.join(DATA_DIR, name), { recursive: true })
+        }
+
+        await reloadStateFromDisk()
+        await createBackupSnapshot('post-import')
+
+        res.json({ ok: true, restoredEntries: extractedEntries.length })
+      } catch (err) {
+        console.error('[admin-backup] import failed:', err)
+        res.status(500).json({ message: 'Full data restore failed. Check the server logs — data may need manual attention.' })
+      } finally {
+        if (workDir) await rm(workDir, { recursive: true, force: true }).catch(() => {})
+      }
+    },
+  )
+}

server/routes/admin-content.js

@@ -0,0 +1,334 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { sanitizeSiteContent } from '../helpers.js'
+import { requireAdminAuth, isValidAdminSession } from '../auth.js'
+import {
+  DATA_DIR,
+  DATA_FILE,
+  DRAFT_DATA_FILE,
+  QUESTIONS_FILE,
+  DEFAULT_SEO,
+  DEFAULT_LEGAL,
+  DEFAULT_REDIRECT_RULES,
+  DEFAULT_PODCAST_FEATURED_LINKS,
+  MAX_QUESTIONS,
+  EMPTY_HIT_STATS,
+  EMPTY_VISITOR_STATS,
+} from '../config.js'
+import { state } from '../state.js'
+import {
+  loadSiteContentFile,
+  getStorageStatus,
+  refreshContentCaches,
+  queueHitStatsWrite,
+  queueVisitorStatsWrite,
+  queueContactSubmissionsWrite,
+  queueReplyTemplatesWrite,
+  queueReplyHistoryWrite,
+  queuePodcastChecklistWrite,
+  createBackupSnapshot,
+  listBackupPreviews,
+  readBackupPreview,
+  restoreFromBackup,
+  sanitizePodcastChecklist,
+} from '../data.js'
+import {
+  pruneStatsByDays,
+  filterSiteContentByReleaseDate,
+} from '../study-helpers.js'
+
+function invokeWebhook(url, action) {
+  if (!url) {
+    return Promise.resolve({ ok: false, message: `${action} webhook URL is not configured.` })
+  }
+  return fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ action, at: new Date().toISOString(), source: 'siteforge-admin' }),
+  })
+    .then(response => {
+      if (!response.ok) return { ok: false, message: `${action} webhook failed with ${response.status}.` }
+      return { ok: true, message: `${action} webhook triggered.` }
+    })
+    .catch(err => ({ ok: false, message: err instanceof Error ? err.message : `${action} webhook failed.` }))
+}
+
+export function register(app) {
+  app.get('/api/admin-content', async (req, res) => {
+    const source = req.query?.source === 'draft' ? 'draft' : 'published'
+    if (source === 'draft' && !isValidAdminSession(req)) {
+      res.status(401).json({ message: 'Unauthorized' })
+      return
+    }
+
+    try {
+      const parsed = await loadSiteContentFile(source === 'draft' ? DRAFT_DATA_FILE : DATA_FILE)
+      if (source === 'published') {
+        const safeSiteContent = filterSiteContentByReleaseDate(parsed.siteContent)
+        res.json({ ...parsed, siteContent: safeSiteContent })
+        return
+      }
+      res.json(parsed)
+    } catch {
+      if (source === 'draft') {
+        res.status(404).json({ message: 'No saved draft content file yet.' })
+        return
+      }
+      res.status(404).json({ message: 'No saved admin content file yet.' })
+    }
+  })
+
+  app.get('/api/admin-content-state', requireAdminAuth, (_req, res) => {
+    res.json({
+      publishState: state.publishState,
+      hasDraft: Boolean(state.cachedDraftSiteContent),
+      hasPublished: Boolean(state.cachedSiteContent),
+    })
+  })
+
+  app.get('/api/admin-storage-status', requireAdminAuth, async (_req, res) => {
+    const status = await getStorageStatus()
+    res.json(status)
+  })
+
+  app.get('/api/admin-podcast-checklist', requireAdminAuth, (_req, res) => {
+    res.json({ checklist: state.podcastChecklist })
+  })
+
+  app.put('/api/admin-podcast-checklist', requireAdminAuth, async (req, res) => {
+    try {
+      const safeChecklist = sanitizePodcastChecklist(req.body?.checklist)
+      state.podcastChecklist = safeChecklist
+      await queuePodcastChecklistWrite()
+      res.json({ ok: true, checklist: safeChecklist })
+    } catch {
+      res.status(500).json({ message: 'Failed to save podcast checklist.' })
+    }
+  })
+
+  app.get('/api/site-config', async (_req, res) => {
+    try {
+      const parsed = await loadSiteContentFile(DATA_FILE)
+      const siteContent = parsed.siteContent ?? {}
+      res.json({
+        seo: siteContent.seo ?? DEFAULT_SEO,
+        legal: siteContent.legal ?? DEFAULT_LEGAL,
+        redirects: siteContent.redirects ?? DEFAULT_REDIRECT_RULES,
+        podcastFeaturedLinks: siteContent.podcastFeaturedLinks ?? DEFAULT_PODCAST_FEATURED_LINKS,
+        publishState: state.publishState,
+        updatedAt: parsed.updatedAt ?? null,
+      })
+    } catch {
+      res.json({
+        seo: DEFAULT_SEO,
+        legal: DEFAULT_LEGAL,
+        redirects: DEFAULT_REDIRECT_RULES,
+        podcastFeaturedLinks: DEFAULT_PODCAST_FEATURED_LINKS,
+        publishState: state.publishState,
+        updatedAt: null,
+      })
+    }
+  })
+
+  app.put('/api/admin-content-draft', requireAdminAuth, async (req, res) => {
+    try {
+      const { siteContent } = req.body ?? {}
+
+      if (!siteContent || typeof siteContent !== 'object' || Array.isArray(siteContent)) {
+        res.status(400).json({ message: 'Invalid payload: siteContent must be an object.' })
+        return
+      }
+
+      const safeSiteContent = sanitizeSiteContent(siteContent)
+      const updatedAt = new Date().toISOString()
+
+      await mkdir(DATA_DIR, { recursive: true })
+      await writeFile(
+        DRAFT_DATA_FILE,
+        JSON.stringify({ siteContent: safeSiteContent, updatedAt }, null, 2),
+        'utf8',
+      )
+
+      state.cachedDraftSiteContent = safeSiteContent
+      state.publishState.draftUpdatedAt = updatedAt
+
+      res.json({ ok: true, updatedAt })
+    } catch (err) {
+      console.error('[admin-content-draft] persist error:', err)
+      const reason = err instanceof Error ? err.message : 'Unknown write error'
+      res.status(500).json({ message: `Failed to persist admin draft content to ${DATA_DIR}: ${reason}` })
+    }
+  })
+
+  app.post('/api/admin-content/publish', requireAdminAuth, async (_req, res) => {
+    try {
+      const source = state.cachedDraftSiteContent
+        ? { siteContent: state.cachedDraftSiteContent, updatedAt: state.publishState.draftUpdatedAt ?? new Date().toISOString() }
+        : await loadSiteContentFile(DRAFT_DATA_FILE)
+
+      const publishedAt = new Date().toISOString()
+
+      await mkdir(DATA_DIR, { recursive: true })
+      await writeFile(
+        DATA_FILE,
+        JSON.stringify({ siteContent: source.siteContent, updatedAt: publishedAt }, null, 2),
+        'utf8',
+      )
+
+      state.cachedSiteContent = source.siteContent
+      state.publishState.publishedAt = publishedAt
+
+      if (state.draftQuestions !== null) {
+        state.questions = state.draftQuestions.slice(0, MAX_QUESTIONS)
+        await mkdir(DATA_DIR, { recursive: true })
+        await writeFile(
+          QUESTIONS_FILE,
+          JSON.stringify({ questions: state.questions, updatedAt: publishedAt }, null, 2),
+          'utf8',
+        )
+      }
+
+      await createBackupSnapshot('post-publish')
+      res.json({ ok: true, publishedAt })
+    } catch (err) {
+      console.error('[admin-content-publish] persist error:', err)
+      const reason = err instanceof Error ? err.message : 'Unknown write error'
+      res.status(500).json({ message: `Failed to publish draft content to ${DATA_DIR}: ${reason}` })
+    }
+  })
+
+  app.put('/api/admin-content', requireAdminAuth, async (req, res) => {
+    try {
+      const { siteContent } = req.body ?? {}
+
+      if (!siteContent || typeof siteContent !== 'object' || Array.isArray(siteContent)) {
+        res.status(400).json({ message: 'Invalid payload: siteContent must be an object.' })
+        return
+      }
+
+      const safeSiteContent = sanitizeSiteContent(siteContent)
+      const updatedAt = new Date().toISOString()
+
+      await mkdir(DATA_DIR, { recursive: true })
+      await writeFile(
+        DATA_FILE,
+        JSON.stringify({ siteContent: safeSiteContent, updatedAt }, null, 2),
+        'utf8',
+      )
+
+      state.cachedSiteContent = safeSiteContent
+      state.publishState.publishedAt = updatedAt
+
+      res.json({ ok: true })
+    } catch {
+      res.status(500).json({ message: 'Failed to persist admin content.' })
+    }
+  })
+
+  app.get('/api/admin-ops/status', requireAdminAuth, (_req, res) => {
+    res.json({
+      buildCommit: process.env.BUILD_COMMIT ?? null,
+      buildNumber: process.env.BUILD_NUMBER ?? null,
+      deployedAt: process.env.DEPLOYED_AT ?? null,
+      cachePurge: state.lastCachePurgeStatus,
+      deployHook: state.lastDeployHookStatus,
+    })
+  })
+
+  app.post('/api/admin-ops/purge-cache', requireAdminAuth, async (_req, res) => {
+    const result = await invokeWebhook(process.env.CACHE_PURGE_WEBHOOK_URL ?? '', 'cache-purge')
+    state.lastCachePurgeStatus = { ok: result.ok, at: new Date().toISOString(), error: result.ok ? null : result.message }
+    if (!result.ok) {
+      res.status(400).json({ message: result.message })
+      return
+    }
+    res.json({ ok: true, message: result.message })
+  })
+
+  app.post('/api/admin-ops/deploy', requireAdminAuth, async (_req, res) => {
+    const result = await invokeWebhook(process.env.DEPLOY_WEBHOOK_URL ?? '', 'deploy')
+    state.lastDeployHookStatus = { ok: result.ok, at: new Date().toISOString(), error: result.ok ? null : result.message }
+    if (!result.ok) {
+      res.status(400).json({ message: result.message })
+      return
+    }
+    res.json({ ok: true, message: result.message })
+  })
+
+  app.get('/api/admin-stats/export', requireAdminAuth, async (_req, res) => {
+    let adminContent = null
+    let draftContent = null
+    try {
+      const raw = await readFile(DATA_FILE, 'utf8')
+      adminContent = JSON.parse(raw)
+    } catch { adminContent = null }
+
+    try {
+      const rawDraft = await readFile(DRAFT_DATA_FILE, 'utf8')
+      draftContent = JSON.parse(rawDraft)
+    } catch { draftContent = null }
+
+    res.json({
+      exportedAt: new Date().toISOString(),
+      adminContent,
+      draftContent,
+      publishState: state.publishState,
+      hitStats: state.hitStats,
+      visitorStats: state.visitorStats,
+      contactSubmissions: state.contactSubmissions,
+      replyTemplates: state.replyTemplates,
+      replyHistory: state.replyHistory,
+    })
+  })
+
+  app.post('/api/admin-stats/clear', requireAdminAuth, (_req, res) => {
+    state.hitStats = { ...EMPTY_HIT_STATS }
+    state.visitorStats = { ...EMPTY_VISITOR_STATS }
+    queueHitStatsWrite()
+    queueVisitorStatsWrite()
+    createBackupSnapshot('post-clear').catch(() => {})
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-stats/prune', requireAdminAuth, (req, res) => {
+    const result = pruneStatsByDays(req.body?.days)
+    queueHitStatsWrite()
+    queueVisitorStatsWrite()
+    createBackupSnapshot('post-prune').catch(() => {})
+    res.json({ ok: true, ...result })
+  })
+
+  app.post('/api/admin-stats/backup', requireAdminAuth, async (_req, res) => {
+    await createBackupSnapshot('manual')
+    res.json({ ok: true, backup: state.lastBackupStatus })
+  })
+
+  app.get('/api/admin-stats/backups', requireAdminAuth, async (_req, res) => {
+    try {
+      const backups = await listBackupPreviews()
+      res.json({ backups })
+    } catch {
+      res.status(500).json({ message: 'Could not list backups.' })
+    }
+  })
+
+  app.post('/api/admin-stats/backup-preview', requireAdminAuth, async (req, res) => {
+    try {
+      const { filename } = req.body ?? {}
+      const preview = await readBackupPreview(filename)
+      res.json({ preview })
+    } catch (err) {
+      res.status(400).json({ message: err instanceof Error ? err.message : 'Could not load backup preview.' })
+    }
+  })
+
+  app.post('/api/admin-stats/restore', requireAdminAuth, async (req, res) => {
+    try {
+      const { filename } = req.body ?? {}
+      await restoreFromBackup(filename)
+      const backups = await listBackupPreviews()
+      res.json({ ok: true, restored: filename, backups })
+    } catch (err) {
+      res.status(400).json({ message: err instanceof Error ? err.message : 'Restore failed.' })
+    }
+  })
+}

server/routes/analytics.js

@@ -0,0 +1,406 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { requireAdminAuth, isValidAdminSession } from '../auth.js'
+import { getClientIp, hasVisitorConsent, setConsentCookie, parseCookies } from '../helpers.js'
+import { getStudyUserFromRequest } from '../study-helpers.js'
+import {
+  VISITOR_COOKIE,
+  MAX_RECENT_VISITS,
+} from '../config.js'
+import { state } from '../state.js'
+import { queueVisitorStatsWrite, queueHitStatsWrite, normalizeMessageType, recordEpisodePlay, recordAnalyticsEvent } from '../data.js'
+import {
+  detectBot,
+  sanitizeUserAgent,
+  detectDevice,
+  sanitizeReferrer,
+  normalizeHitPath,
+  isPrivateOrLocalIp,
+  buildTopLocations,
+  buildLastNDaysStats,
+  shouldCountHit,
+  recordHit,
+} from '../study-helpers.js'
+import { getStudyCatalog } from '../study-helpers.js'
+
+async function resolveGeo(ip) {
+  if (!ip || isPrivateOrLocalIp(ip)) {
+    return { country: 'Local/Unknown', state: 'Local/Unknown', county: 'Local/Unknown', city: 'Local/Unknown' }
+  }
+
+  const cached = state.visitorStats.geoCacheByIp[ip]
+  if (cached) return cached
+
+  const providers = [
+    async () => {
+      const controller = new AbortController()
+      const timeout = setTimeout(() => controller.abort(), 2500)
+      try {
+        const response = await fetch(
+          `http://ip-api.com/json/${encodeURIComponent(ip)}?fields=status,country,regionName,city,district`,
+          { signal: controller.signal },
+        )
+        if (!response.ok) return null
+        const data = await response.json()
+        if (data?.status !== 'success') return null
+        return { country: data?.country || 'Unknown', state: data?.regionName || 'Unknown', county: data?.district || 'Unknown', city: data?.city || 'Unknown' }
+      } finally { clearTimeout(timeout) }
+    },
+    async () => {
+      const controller = new AbortController()
+      const timeout = setTimeout(() => controller.abort(), 2500)
+      try {
+        const response = await fetch(`https://ipwho.is/${encodeURIComponent(ip)}`, { signal: controller.signal })
+        if (!response.ok) return null
+        const data = await response.json()
+        if (!data?.success) return null
+        return { country: data?.country || 'Unknown', state: data?.region || 'Unknown', county: data?.region || 'Unknown', city: data?.city || 'Unknown' }
+      } finally { clearTimeout(timeout) }
+    },
+  ]
+
+  for (const provider of providers) {
+    try {
+      const geo = await provider()
+      if (geo) {
+        state.visitorStats.geoCacheByIp[ip] = geo
+        queueVisitorStatsWrite()
+        return geo
+      }
+    } catch { /* Try next provider */ }
+  }
+
+  const fallback = { country: 'Unknown', state: 'Unknown', county: 'Unknown', city: 'Unknown' }
+  state.visitorStats.geoCacheByIp[ip] = fallback
+  queueVisitorStatsWrite()
+  return fallback
+}
+
+export async function recordVisitor(req, res, overridePath = null, overrideReferrer = null) {
+  const cookies = parseCookies(req.headers.cookie)
+  let visitorId = cookies[VISITOR_COOKIE]
+  if (!visitorId) {
+    visitorId = randomUUID()
+    res.append('Set-Cookie', `${VISITOR_COOKIE}=${encodeURIComponent(visitorId)}; Max-Age=31536000; Path=/; SameSite=Lax`)
+  }
+
+  const nowIso = new Date().toISOString()
+  const pathKey = overridePath ? normalizeHitPath(overridePath) : normalizeHitPath(req.path)
+  const referrer = overrideReferrer !== null ? sanitizeReferrer(overrideReferrer) : sanitizeReferrer(req.get('referer') || req.get('referrer') || '')
+  const ip = getClientIp(req)
+  const ua = sanitizeUserAgent(req.get('user-agent'))
+  const device = detectDevice(ua)
+  const studyUser = getStudyUserFromRequest(req)
+  const studyIdentity = studyUser
+    ? { userId: studyUser.id, username: studyUser.username, displayName: studyUser.displayName ?? studyUser.username }
+    : null
+
+  const ipHash = createHash('sha256').update(ip).digest('hex')
+  const geo = await resolveGeo(ip)
+
+  const existingIdByIp = state.visitorStats.ipHashIndex[ipHash]
+  if (existingIdByIp && existingIdByIp !== visitorId) {
+    visitorId = existingIdByIp
+    res.append('Set-Cookie', `${VISITOR_COOKIE}=${encodeURIComponent(visitorId)}; Max-Age=31536000; Path=/; SameSite=Lax`)
+  }
+
+  const existingVisitor = state.visitorStats.visitors[visitorId]
+  const isReturning = Boolean(existingVisitor)
+
+  if (!existingVisitor) {
+    state.visitorStats.uniqueVisitors += 1
+    state.visitorStats.ipHashIndex[ipHash] = visitorId
+  } else {
+    state.visitorStats.returningVisits += 1
+  }
+
+  const nextVisitCount = (existingVisitor?.visitCount ?? 0) + 1
+  const userAgents = Array.from(new Set([...(existingVisitor?.userAgents ?? []), ua])).slice(0, 5)
+  const prevHistory = existingVisitor?.pageHistory ?? []
+  const pageHistory = [...prevHistory, { at: nowIso, path: pathKey, referrer }].slice(-100)
+
+  const knownIdentities = existingVisitor?.knownIdentities ?? []
+  if (studyIdentity && !knownIdentities.some(i => i.userId === studyIdentity.userId)) {
+    knownIdentities.push(studyIdentity)
+  }
+
+  state.visitorStats.visitors[visitorId] = {
+    visitorId, ip, ipHash,
+    firstSeenAt: existingVisitor?.firstSeenAt ?? nowIso,
+    lastSeenAt: nowIso,
+    visitCount: nextVisitCount,
+    lastPath: pathKey,
+    returningVisitor: isReturning,
+    location: geo,
+    userAgents,
+    device,
+    pageHistory,
+    ...(knownIdentities.length > 0 ? { knownIdentities } : {}),
+  }
+
+  state.visitorStats.totalVisits += 1
+  state.visitorStats.firstVisitAt = state.visitorStats.firstVisitAt ?? nowIso
+  state.visitorStats.lastVisitAt = nowIso
+  state.visitorStats.recentVisits.unshift({
+    at: nowIso, visitorId, ip, path: pathKey, referrer, device,
+    country: geo.country, state: geo.state, county: geo.county, city: geo.city,
+    returningVisitor: isReturning, visitCount: nextVisitCount,
+    ...(studyIdentity ? { studyUser: studyIdentity } : {}),
+  })
+  state.visitorStats.recentVisits = state.visitorStats.recentVisits.slice(0, MAX_RECENT_VISITS)
+
+  queueVisitorStatsWrite()
+}
+
+export function register(app) {
+  app.post('/api/analytics-consent', (req, res) => {
+    const consent = req.body?.consent === true
+    setConsentCookie(res, consent)
+    res.json({ ok: true, consent })
+  })
+
+  app.post('/api/analytics/play', (req, res) => {
+    if (isValidAdminSession(req)) { res.json({ ok: false, reason: 'admin' }); return }
+    const title = typeof req.body?.title === 'string' ? req.body.title.trim().slice(0, 200) : ''
+    if (!title) { res.status(400).json({ ok: false, reason: 'missing-title' }); return }
+    recordEpisodePlay(title)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/analytics/event', (req, res) => {
+    if (isValidAdminSession(req)) { res.json({ ok: false, reason: 'admin' }); return }
+    if (!hasVisitorConsent(req)) { res.json({ ok: false, reason: 'no-consent' }); return }
+    const ua = req.get('user-agent') ?? ''
+    const { isBot } = detectBot(ua)
+    if (isBot) { res.json({ ok: false, reason: 'bot' }); return }
+    const type = typeof req.body?.type === 'string' ? req.body.type : ''
+    const ALLOWED_TYPES = ['scroll_depth', 'time_on_page', 'outbound_click', 'link_click', 'utm', 'search_query', 'not_found', 'audio_pause', 'audio_completion', 'audio_listen_time']
+    if (!ALLOWED_TYPES.includes(type)) { res.status(400).json({ ok: false, reason: 'invalid-type' }); return }
+    recordAnalyticsEvent(type, req.body)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/analytics/pageview', async (req, res) => {
+    if (isValidAdminSession(req)) {
+      res.json({ ok: false, reason: 'admin' }); return
+    }
+    if (!hasVisitorConsent(req)) {
+      res.json({ ok: false, reason: 'no-consent' }); return
+    }
+    const ua = req.get('user-agent') ?? ''
+    const { isBot } = detectBot(ua)
+    if (isBot) {
+      res.json({ ok: false, reason: 'bot' }); return
+    }
+    const rawPath = typeof req.body?.path === 'string' ? req.body.path : '/'
+    const rawReferrer = typeof req.body?.referrer === 'string' ? req.body.referrer : ''
+    recordHit(rawPath, false)
+    queueHitStatsWrite()
+    await recordVisitor(req, res, rawPath, rawReferrer)
+    res.json({ ok: true })
+  })
+
+  app.get('/api/admin-stats', requireAdminAuth, (req, res) => {
+    // Time-range filter: 7d | 30d | 90d (default: all-time for aggregate, 30d for charts)
+    const rangeParam = req.query.range
+    const rangeDays = rangeParam === '7d' ? 7 : rangeParam === '90d' ? 90 : 30
+    const rangeLabel = rangeParam === '7d' ? '7d' : rangeParam === '90d' ? '90d' : '30d'
+
+    // Compute a cutoff date string (YYYY-MM-DD) for filtering daily buckets
+    const cutoffDate = (() => {
+      const d = new Date()
+      d.setDate(d.getDate() - (rangeDays - 1))
+      return d.toISOString().slice(0, 10)
+    })()
+
+    // Filter byDayReal/byDayBot keys to only those within the range
+    const filteredDayKeys = Object.keys(state.hitStats.byDayReal ?? {}).filter(day => day >= cutoffDate)
+
+    // Aggregate hits for the range
+    const rangeRealHits = filteredDayKeys.reduce((sum, day) => sum + (state.hitStats.byDayReal?.[day] ?? 0), 0)
+    const rangeBotHits = filteredDayKeys.reduce((sum, day) => sum + (state.hitStats.byDayBot?.[day] ?? 0), 0)
+    const rangeTotalHits = rangeRealHits + rangeBotHits
+
+    // Filter per-path stats by range — approximate using recent visitor rows scoped to range
+    const rangeVisitorRows = state.visitorStats.recentVisits.filter(row => {
+      if (!row.visitedAt) return true // include if no timestamp
+      return row.visitedAt >= cutoffDate
+    })
+
+    const rangePathCountsReal = {}
+    const rangePathCountsBot = {}
+    for (const row of rangeVisitorRows) {
+      const p = row.path ?? '/'
+      if (row.isBot) rangePathCountsBot[p] = (rangePathCountsBot[p] ?? 0) + 1
+      else rangePathCountsReal[p] = (rangePathCountsReal[p] ?? 0) + 1
+    }
+    const topPathsReal = Object.entries(rangePathCountsReal).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([path, hits]) => ({ path, hits }))
+    const topPathsBot = Object.entries(rangePathCountsBot).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([path, hits]) => ({ path, hits }))
+    const topPaths = [...topPathsReal, ...topPathsBot].reduce((acc, { path, hits }) => {
+      const existing = acc.find(x => x.path === path)
+      if (existing) existing.hits += hits; else acc.push({ path, hits })
+      return acc
+    }, []).sort((a, b) => b.hits - a.hits).slice(0, 10)
+
+    const last7Days = buildLastNDaysStats(7)
+    const last7DaysReal = last7Days.map(item => ({ day: item.day, hits: state.hitStats.byDayReal?.[item.day] ?? 0 }))
+    const last7DaysBot = last7Days.map(item => ({ day: item.day, hits: state.hitStats.byDayBot?.[item.day] ?? 0 }))
+
+    const last30Days = buildLastNDaysStats(30)
+    const last30DaysTotal = last30Days.reduce((sum, item) => sum + item.hits, 0)
+    const last30DaysRealTotal = last30Days.reduce((sum, item) => sum + (state.hitStats.byDayReal?.[item.day] ?? 0), 0)
+    const last30DaysBotTotal = last30Days.reduce((sum, item) => sum + (state.hitStats.byDayBot?.[item.day] ?? 0), 0)
+
+    const botReasons = Object.entries(state.hitStats.botReasons ?? {})
+      .sort((a, b) => b[1] - a[1]).slice(0, 10).map(([reason, count]) => ({ reason, count }))
+
+    // All range rows used for geographic/device/referrer aggregates — no cap so no visits are invisible
+    const allRangeRows = rangeVisitorRows
+
+    // Capped to 100 for the visitor log display (with page history hydrated)
+    const recentVisitorRows = rangeVisitorRows.slice(0, 100).map(row => {
+      const fullVisitor = state.visitorStats.visitors[row.visitorId]
+      return { ...row, pageHistory: fullVisitor?.pageHistory ?? [] }
+    })
+
+    const enrollmentCountsBySlug = {}
+    for (const user of state.studyUsers) {
+      const userEnrollments = Array.isArray(user?.enrolledStudySlugs) ? user.enrolledStudySlugs : []
+      for (const studySlug of userEnrollments) {
+        enrollmentCountsBySlug[studySlug] = (enrollmentCountsBySlug[studySlug] ?? 0) + 1
+      }
+    }
+    const enrollmentsByStudy = getStudyCatalog()
+      .map(study => ({ slug: study.slug, title: study.title, count: enrollmentCountsBySlug[study.slug] ?? 0 }))
+      .sort((a, b) => b.count - a.count)
+
+    const studyCatalogBySlug = new Map(getStudyCatalog().map(study => [study.slug, study]))
+    const users = state.studyUsers
+      .map(user => {
+        const enrolledStudySlugs = Array.isArray(user?.enrolledStudySlugs) ? user.enrolledStudySlugs : []
+        const enrolledStudies = enrolledStudySlugs.map(slug => {
+          const study = studyCatalogBySlug.get(slug)
+          return study ? { slug: study.slug, title: study.title } : null
+        }).filter(Boolean)
+        return { id: user.id, username: user.username, displayName: user.displayName ?? '', enrolledStudies }
+      })
+      .sort((a, b) => {
+        if (b.enrolledStudies.length !== a.enrolledStudies.length) return b.enrolledStudies.length - a.enrolledStudies.length
+        return a.username.localeCompare(b.username)
+      })
+
+    const enrolledUsers = state.studyUsers.filter(user => (user.enrolledStudySlugs?.length ?? 0) > 0).length
+    const totalEnrollments = Object.values(enrollmentCountsBySlug).reduce((sum, count) => sum + count, 0)
+
+    // Enrollment funnel: signups → first study visit → first section completed
+    const funnelSignups = state.studyUsers.length
+    const funnelFirstVisit = state.studyUsers.filter(u => u.firstVisitAt).length
+    const funnelFirstCompletion = state.studyUsers.filter(u => u.firstCompletionAt).length
+
+    res.json({
+      totalHits: state.hitStats.totalHits,
+      realHits: rangeRealHits,
+      botHits: rangeBotHits,
+      rangeTotalHits,
+      rangeLabel,
+      rangeDays,
+      // All-time totals for reference
+      allTimeRealHits: state.hitStats.realHits ?? 0,
+      allTimeBotHits: state.hitStats.botHits ?? 0,
+      allTimeTotalHits: state.hitStats.totalHits,
+      firstHitAt: state.hitStats.firstHitAt,
+      lastHitAt: state.hitStats.lastHitAt,
+      topPaths, topPathsReal, topPathsBot,
+      last7Days, last7DaysReal, last7DaysBot,
+      last30DaysTotal, last30DaysRealTotal, last30DaysBotTotal,
+      botReasons,
+      visitors: {
+        totalVisits: state.visitorStats.totalVisits,
+        uniqueVisitors: state.visitorStats.uniqueVisitors,
+        returningVisits: state.visitorStats.returningVisits,
+        firstVisitAt: state.visitorStats.firstVisitAt,
+        lastVisitAt: state.visitorStats.lastVisitAt,
+        topCountries: buildTopLocations(allRangeRows, 'country'),
+        topStates: buildTopLocations(allRangeRows, 'state'),
+        topCounties: buildTopLocations(allRangeRows, 'county'),
+        topCities: buildTopLocations(allRangeRows, 'city'),
+        deviceBreakdown: (() => {
+          const counts = { mobile: 0, desktop: 0, tablet: 0, unknown: 0 }
+          for (const row of allRangeRows) {
+            const d = row.device ?? 'unknown'
+            counts[d] = (counts[d] ?? 0) + 1
+          }
+          return counts
+        })(),
+        topReferrers: (() => {
+          const counts = {}
+          for (const row of allRangeRows) {
+            if (!row.referrer) continue
+            counts[row.referrer] = (counts[row.referrer] ?? 0) + 1
+          }
+          return Object.entries(counts).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([referrer, count]) => ({ referrer, count }))
+        })(),
+        last30DaysReal: buildLastNDaysStats(30).map(item => ({ day: item.day, hits: state.hitStats.byDayReal?.[item.day] ?? 0 })),
+        recentVisits: recentVisitorRows,
+      },
+      writeStatus: {
+        hitStats: state.lastHitStatsWrite,
+        visitorStats: state.lastVisitorStatsWrite,
+        backups: state.lastBackupStatus,
+        cachePurge: state.lastCachePurgeStatus,
+        deployHook: state.lastDeployHookStatus,
+      },
+      contactTotals: {
+        totalSubmissions: state.contactSubmissions.length,
+        totalQuestions: state.contactSubmissions.filter(entry => normalizeMessageType(entry?.messageType) === 'question').length,
+      },
+      studyEnrollment: {
+        totalUsers: state.studyUsers.length,
+        enrolledUsers,
+        totalEnrollments,
+        enrollmentsByStudy,
+        users,
+        funnel: { signups: funnelSignups, firstVisit: funnelFirstVisit, firstCompletion: funnelFirstCompletion },
+      },
+      episodePlays: Object.entries(state.episodePlays)
+        .map(([title, data]) => ({
+          title,
+          total: data.total ?? 0,
+          byDay: data.byDay ?? {},
+          last30Days: buildLastNDaysStats(30).map(item => ({ day: item.day, plays: data.byDay?.[item.day] ?? 0 })),
+        }))
+        .sort((a, b) => b.total - a.total),
+      engagement: {
+        scrollDepth: Object.entries(state.analyticsEvents.scrollDepth ?? {})
+          .map(([path, marks]) => ({ path, ...marks }))
+          .sort((a, b) => (b[90] ?? 0) - (a[90] ?? 0))
+          .slice(0, 20),
+        timeOnPage: Object.entries(state.analyticsEvents.timeOnPage ?? {})
+          .map(([path, { totalSeconds, count }]) => ({ path, avgSeconds: count > 0 ? Math.round(totalSeconds / count) : 0, count }))
+          .sort((a, b) => b.avgSeconds - a.avgSeconds)
+          .slice(0, 20),
+        topOutboundClicks: Object.entries(state.analyticsEvents.outboundClicks ?? {})
+          .map(([url, count]) => ({ url, count }))
+          .sort((a, b) => b.count - a.count)
+          .slice(0, 20),
+        topLinkClicks: Object.entries(state.analyticsEvents.linkClicks ?? {})
+          .map(([url, { count, internal }]) => ({ url, count, internal }))
+          .sort((a, b) => b.count - a.count)
+          .slice(0, 50),
+        topUTMSources: Object.entries(state.analyticsEvents.utmSources ?? {})
+          .map(([source, count]) => ({ source, count }))
+          .sort((a, b) => b.count - a.count),
+        topSearchQueries: Object.entries(state.analyticsEvents.searchQueries ?? {})
+          .map(([query, count]) => ({ query, count }))
+          .sort((a, b) => b.count - a.count)
+          .slice(0, 30),
+        top404s: Object.entries(state.analyticsEvents.notFound ?? {})
+          .map(([path, count]) => ({ path, count }))
+          .sort((a, b) => b.count - a.count)
+          .slice(0, 20),
+        audioEvents: Object.entries(state.analyticsEvents.audioEvents ?? {})
+          .map(([title, data]) => ({ title, ...data }))
+          .sort((a, b) => b.completions - a.completions),
+      },
+    })
+  })
+}

server/routes/bible-passage.js

@@ -0,0 +1,77 @@
+const passageCache = new Map()
+
+const BOLLS_BOOK_MAP = {
+  genesis: 1, exodus: 2, leviticus: 3, numbers: 4, deuteronomy: 5,
+  joshua: 6, judges: 7, ruth: 8, '1samuel': 9, '2samuel': 10,
+  '1kings': 11, '2kings': 12, '1chronicles': 13, '2chronicles': 14,
+  ezra: 15, nehemiah: 16, esther: 17, job: 18, psalms: 19, proverbs: 20,
+  ecclesiastes: 21, songofsolomon: 22, isaiah: 23, jeremiah: 24,
+  lamentations: 25, ezekiel: 26, daniel: 27, hosea: 28, joel: 29,
+  amos: 30, obadiah: 31, jonah: 32, micah: 33, nahum: 34, habakkuk: 35,
+  zephaniah: 36, haggai: 37, zechariah: 38, malachi: 39,
+  matthew: 40, mark: 41, luke: 42, john: 43, acts: 44,
+  romans: 45, '1corinthians': 46, '2corinthians': 47, galatians: 48,
+  ephesians: 49, philippians: 50, colossians: 51, '1thessalonians': 52,
+  '2thessalonians': 53, '1timothy': 54, '2timothy': 55, titus: 56,
+  philemon: 57, hebrews: 58, james: 59, '1peter': 60, '2peter': 61,
+  '1john': 62, '2john': 63, '3john': 64, jude: 65, revelation: 66,
+}
+
+function parseReference(reference) {
+  const stripped = reference.replace(/^[a-z]+/i, '')
+  const match = stripped.match(/^(\d+):(\d+)(?:-(\d+))?$/)
+  if (!match) return null
+  return {
+    chapter: parseInt(match[1], 10),
+    verseStart: parseInt(match[2], 10),
+    verseEnd: match[3] ? parseInt(match[3], 10) : parseInt(match[2], 10),
+  }
+}
+
+export function register(app) {
+  app.get('/api/bible-passage', async (req, res) => {
+    const book = String(req.query.book ?? '').trim().toLowerCase().replace(/[\s-]/g, '')
+    const reference = String(req.query.reference ?? '').trim()
+
+    const bookNum = BOLLS_BOOK_MAP[book]
+    if (!bookNum) {
+      res.status(400).json({ message: 'Unknown book.' })
+      return
+    }
+
+    const parsed = parseReference(reference)
+    if (!parsed) {
+      res.status(400).json({ message: 'Invalid reference format. Expected format: chapter:verseStart-verseEnd' })
+      return
+    }
+
+    const cacheKey = `BSB:${bookNum}:${parsed.chapter}:${parsed.verseStart}:${parsed.verseEnd}`
+    if (passageCache.has(cacheKey)) {
+      res.json({ text: passageCache.get(cacheKey) })
+      return
+    }
+
+    try {
+      const verseNums = []
+      for (let v = parsed.verseStart; v <= parsed.verseEnd; v++) verseNums.push(v)
+
+      const results = await Promise.all(
+        verseNums.map(v =>
+          fetch(`https://bolls.life/get-verse/BSB/${bookNum}/${parsed.chapter}/${v}/`, { signal: AbortSignal.timeout(8000) })
+            .then(r => r.ok ? r.json() : Promise.reject(new Error(`${r.status}`)))
+        )
+      )
+
+      if (results.length === 0) {
+        res.status(404).json({ message: 'Passage not found.' })
+        return
+      }
+
+      const text = results.map(v => `v. ${v.verse} ${String(v.text).trim()}`).join('\n\n')
+      passageCache.set(cacheKey, text)
+      res.json({ text })
+    } catch {
+      res.status(502).json({ message: 'Unable to fetch passage right now.' })
+    }
+  })
+}

server/routes/calendar-events.js

@@ -0,0 +1,192 @@
+import { randomUUID } from 'node:crypto'
+import { state } from '../state.js'
+import { queueCalendarEventsWrite } from '../data.js'
+import { requireAdminAuth } from '../auth.js'
+
+const VALID_TYPES = ['general', 'recording', 'social', 'task']
+const VALID_FREQS = ['none', 'weekly', 'biweekly', 'monthly']
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/
+const TIME_RE = /^\d{2}:\d{2}$/
+
+function sanitizeRecurrence(raw) {
+  if (!raw || typeof raw !== 'object') return null
+  const freq = VALID_FREQS.includes(raw.freq) ? raw.freq : 'none'
+  if (freq === 'none') return null
+  const until = typeof raw.until === 'string' && DATE_RE.test(raw.until) ? raw.until : null
+  return { freq, until }
+}
+
+function sanitize(ev) {
+  const recurrence = sanitizeRecurrence(ev.recurrence)
+  return {
+    id: ev.id,
+    type: VALID_TYPES.includes(ev.type) ? ev.type : 'general',
+    title: typeof ev.title === 'string' ? ev.title.slice(0, 300) : '',
+    date: typeof ev.date === 'string' && DATE_RE.test(ev.date) ? ev.date : '',
+    startTime: typeof ev.startTime === 'string' && TIME_RE.test(ev.startTime) ? ev.startTime : undefined,
+    notes: typeof ev.notes === 'string' ? ev.notes.slice(0, 2000) : '',
+    completed: Boolean(ev.completed),
+    reminderDays: Number.isFinite(ev.reminderDays) && ev.reminderDays > 0 ? ev.reminderDays : 0,
+    reminderSentAt: typeof ev.reminderSentAt === 'string' ? ev.reminderSentAt : undefined,
+    recurrence: recurrence ?? undefined,
+    createdAt: typeof ev.createdAt === 'string' ? ev.createdAt : new Date().toISOString(),
+  }
+}
+
+// ── iCal helpers ─────────────────────────────────────────────────────────────
+
+function escapeIcs(s) {
+  return String(s ?? '').replace(/\\/g, '\\\\').replace(/;/g, '\\;').replace(/,/g, '\\,').replace(/\n/g, '\\n')
+}
+
+function foldIcsLine(line) {
+  const chars = [...line]
+  if (chars.length <= 75) return line
+  const parts = []
+  let current = ''
+  for (const ch of chars) {
+    if ((current + ch).length > 75) { parts.push(current); current = ' ' + ch }
+    else current += ch
+  }
+  if (current) parts.push(current)
+  return parts.join('\r\n')
+}
+
+function toIcsDatetime(dateStr, timeStr) {
+  const d = dateStr.replace(/-/g, '')
+  if (timeStr && TIME_RE.test(timeStr)) {
+    const t = timeStr.replace(':', '') + '00'
+    return `DTSTART:${d}T${t}`
+  }
+  return `DTSTART;VALUE=DATE:${d}`
+}
+
+function toIcsTimestamp(iso) {
+  try {
+    const d = new Date(iso)
+    return d.toISOString().replace(/[-:]/g, '').replace(/\.\d+/, '')
+  } catch { return '' }
+}
+
+function rruleFor(recurrence) {
+  if (!recurrence || recurrence.freq === 'none') return null
+  const freqMap = { weekly: 'WEEKLY', biweekly: 'WEEKLY', monthly: 'MONTHLY' }
+  const freq = freqMap[recurrence.freq]
+  if (!freq) return null
+  let rule = `RRULE:FREQ=${freq}`
+  if (recurrence.freq === 'biweekly') rule += ';INTERVAL=2'
+  if (recurrence.until) rule += `;UNTIL=${recurrence.until.replace(/-/g, '')}T235959Z`
+  return rule
+}
+
+function generateIcal() {
+  const lines = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'PRODID:-//Siteforge//CalendarExport//EN',
+    'CALSCALE:GREGORIAN',
+    'METHOD:PUBLISH',
+    'X-WR-CALNAME:Verse by Verse Calendar',
+  ]
+
+  for (const ep of (state.podcastChecklist?.episodes ?? [])) {
+    if (!ep.datePublished) continue
+    const summary = [ep.series, ep.episodeNumber != null ? `Ep ${ep.episodeNumber}` : null, ep.title].filter(Boolean).join(' · ')
+    const dtstart = ep.startTime ? `DTSTART:${ep.datePublished.replace(/-/g, '')}T${ep.startTime.replace(':', '')}00` : `DTSTART;VALUE=DATE:${ep.datePublished.replace(/-/g, '')}`
+    lines.push('BEGIN:VEVENT')
+    lines.push(`UID:ep-${ep.id}@siteforge`)
+    lines.push(dtstart)
+    lines.push(`SUMMARY:${escapeIcs(summary || 'Episode')}`)
+    if (ep.title) lines.push(`DESCRIPTION:${escapeIcs(ep.title)}`)
+    lines.push('END:VEVENT')
+  }
+
+  for (const ev of (state.calendarEvents ?? [])) {
+    if (!ev.date) continue
+    lines.push('BEGIN:VEVENT')
+    lines.push(`UID:ev-${ev.id}@siteforge`)
+    lines.push(toIcsDatetime(ev.date, ev.startTime))
+    lines.push(`SUMMARY:${escapeIcs(ev.title || '(Event)')}`)
+    if (ev.notes) lines.push(`DESCRIPTION:${escapeIcs(ev.notes)}`)
+    const rrule = rruleFor(ev.recurrence)
+    if (rrule) lines.push(rrule)
+    if (ev.createdAt) lines.push(`CREATED:${toIcsTimestamp(ev.createdAt)}`)
+    lines.push('END:VEVENT')
+  }
+
+  lines.push('END:VCALENDAR')
+  return lines.map(foldIcsLine).join('\r\n') + '\r\n'
+}
+
+// ── Routes ───────────────────────────────────────────────────────────────────
+
+export function register(app) {
+  app.get('/api/admin-calendar-events', requireAdminAuth, (_req, res) => {
+    res.json({ events: state.calendarEvents })
+  })
+
+  app.get('/api/admin-calendar.ics', requireAdminAuth, (_req, res) => {
+    const ical = generateIcal()
+    res.setHeader('Content-Type', 'text/calendar; charset=utf-8')
+    res.setHeader('Content-Disposition', 'attachment; filename="siteforge-calendar.ics"')
+    res.send(ical)
+  })
+
+  app.post('/api/admin-calendar-events', requireAdminAuth, (req, res) => {
+    const { type, title, date, startTime, notes, reminderDays, recurrence } = req.body ?? {}
+    if (!title?.trim()) { res.status(400).json({ message: 'Title is required.' }); return }
+    if (!date || !DATE_RE.test(date)) { res.status(400).json({ message: 'Valid date is required.' }); return }
+    if (type && !VALID_TYPES.includes(type)) { res.status(400).json({ message: 'Invalid type.' }); return }
+
+    const ev = sanitize({
+      id: randomUUID(),
+      type: type ?? 'general',
+      title: String(title).trim(),
+      date,
+      startTime: startTime ?? undefined,
+      notes: notes ?? '',
+      completed: false,
+      reminderDays: reminderDays ?? 0,
+      recurrence: recurrence ?? null,
+      createdAt: new Date().toISOString(),
+    })
+
+    state.calendarEvents.unshift(ev)
+    queueCalendarEventsWrite()
+    res.json({ ok: true, event: ev })
+  })
+
+  app.patch('/api/admin-calendar-events/:id', requireAdminAuth, (req, res) => {
+    const { id } = req.params
+    let found = false
+    state.calendarEvents = state.calendarEvents.map(ev => {
+      if (ev.id !== id) return ev
+      found = true
+      const patch = {}
+      if (typeof req.body?.title === 'string') patch.title = req.body.title.trim().slice(0, 300)
+      if (typeof req.body?.date === 'string' && DATE_RE.test(req.body.date)) patch.date = req.body.date
+      if (typeof req.body?.startTime === 'string') patch.startTime = TIME_RE.test(req.body.startTime) ? req.body.startTime : undefined
+      if (req.body?.startTime === null) patch.startTime = undefined
+      if (typeof req.body?.notes === 'string') patch.notes = req.body.notes.trim().slice(0, 2000)
+      if (typeof req.body?.completed === 'boolean') patch.completed = req.body.completed
+      if (VALID_TYPES.includes(req.body?.type)) patch.type = req.body.type
+      if (Number.isFinite(req.body?.reminderDays)) patch.reminderDays = req.body.reminderDays
+      if ('recurrence' in (req.body ?? {})) patch.recurrence = sanitizeRecurrence(req.body.recurrence) ?? undefined
+      const dateChanged = patch.date && patch.date !== ev.date
+      const reminderChanged = 'reminderDays' in patch && patch.reminderDays !== ev.reminderDays
+      if (dateChanged || reminderChanged) patch.reminderSentAt = undefined
+      return { ...ev, ...patch }
+    })
+    if (!found) { res.status(404).json({ message: 'Event not found.' }); return }
+    queueCalendarEventsWrite()
+    res.json({ ok: true })
+  })
+
+  app.delete('/api/admin-calendar-events/:id', requireAdminAuth, (req, res) => {
+    const before = state.calendarEvents.length
+    state.calendarEvents = state.calendarEvents.filter(ev => ev.id !== req.params.id)
+    if (state.calendarEvents.length === before) { res.status(404).json({ message: 'Event not found.' }); return }
+    queueCalendarEventsWrite()
+    res.json({ ok: true })
+  })
+}

server/routes/contact.js

@@ -0,0 +1,983 @@
+import { randomUUID } from 'node:crypto'
+import { Resend } from 'resend'
+import { requireAdminAuth } from '../auth.js'
+import { escapeHtml, splitName } from '../helpers.js'
+import {
+  MAX_CONTACT_SUBMISSIONS,
+  MAX_QUESTIONS,
+  USE_RESEND_AUTOMATION_WELCOME,
+  DEFAULT_SEO,
+  ADMIN_REPLY_FROM,
+  ADMIN_REPLY_FROM_OPTIONS,
+} from '../config.js'
+import { state } from '../state.js'
+import {
+  queueContactSubmissionsWrite,
+  queueQuestionsWrite,
+  queueDraftQuestionsWrite,
+  queueReplyTemplatesWrite,
+  queueReplyHistoryWrite,
+  queueEmailSettingsWrite,
+  normalizeContactEmailStatus,
+  normalizeMessageType,
+  sanitizeReplyTemplates,
+  sanitizeReplyHistory,
+  appendAuditEntry,
+  queueWebhooksWrite,
+  fireWebhooks,
+} from '../data.js'
+import {
+  noteContactEmailCooldown,
+  extractTagValue,
+  mapResendEventToStatus,
+  extractResendMessageId,
+} from '../study-helpers.js'
+import {
+  getResendFromAddress,
+  getResendReplyToAddress,
+  getResendInboxAddress,
+  getAddressDomain,
+  buildContactWelcomeEmailTemplate,
+  buildContactAdminNotificationTemplate,
+  buildAdminReplyTemplate,
+  sendResendEmailWithRetry,
+  syncContactToResend,
+} from '../email.js'
+
+// RFC 5322 msg-id: "<" printable-ASCII-no-whitespace ">"
+const MESSAGE_ID_RE = /^<[\x21-\x7E]+>$/
+
+function upsertContactEmailStatus(submissionId, stream, patch) {
+  if (!submissionId || typeof submissionId !== 'string') return
+  if (!stream || typeof stream !== 'string') return
+  const at = typeof patch?.lastEventAt === 'string' ? patch.lastEventAt : new Date().toISOString()
+  let updated = false
+
+  state.contactSubmissions = state.contactSubmissions.map(submission => {
+    if (submission.id !== submissionId) return submission
+    const next = normalizeContactEmailStatus(submission.emailStatus, submission.subscribe === true)
+    const current = next[stream] ?? { status: 'pending', lastEventAt: null, lastEventType: null, resendEmailId: null, error: null }
+    next[stream] = { ...current, ...patch, lastEventAt: at }
+    updated = true
+    return { ...submission, emailStatus: next }
+  })
+
+  if (updated) queueContactSubmissionsWrite()
+}
+
+function registerResendMessageForSubmission(submissionId, stream, sendResult) {
+  const resendMessageId = extractResendMessageId(sendResult)
+  if (!resendMessageId || !submissionId || !stream) return
+  state.resendEmailSubmissionIndex.set(resendMessageId, { submissionId, stream })
+  // Trim the index when it grows large; oldest entries are least likely to receive webhooks
+  if (state.resendEmailSubmissionIndex.size > 2000) {
+    const firstKey = state.resendEmailSubmissionIndex.keys().next().value
+    state.resendEmailSubmissionIndex.delete(firstKey)
+  }
+  upsertContactEmailStatus(submissionId, stream, { resendEmailId: resendMessageId })
+}
+
+function shouldSendWelcomeEmail({ subscribe }) {
+  return subscribe === true
+}
+
+const contactHits = new Map()
+
+function contactRateLimit(req, res, next) {
+  const ip = req.ip ?? 'unknown'
+  const now = Date.now()
+  const windowMs = 10 * 60 * 1000
+  const entry = contactHits.get(ip) ?? { count: 0, start: now }
+  if (now - entry.start > windowMs) { entry.count = 0; entry.start = now }
+  entry.count += 1
+  contactHits.set(ip, entry)
+  // Prune stale entries to prevent unbounded growth
+  if (contactHits.size > 5000) {
+    const cutoff = now - windowMs
+    for (const [k, v] of contactHits) { if (v.start < cutoff) contactHits.delete(k) }
+  }
+  if (entry.count > 5) {
+    res.status(429).json({ message: 'Too many messages. Please wait a few minutes.' })
+    return
+  }
+  next()
+}
+
+export function register(app) {
+  app.post('/api/contact', contactRateLimit, async (req, res) => {
+    try {
+      const { firstName, lastName, email, message, messageType, subscribe, notifyOnAnswer, _honey } = req.body ?? {}
+
+      if (_honey) { res.json({ ok: true }); return }
+
+      if (!firstName || typeof firstName !== 'string' || firstName.trim().length < 1 || firstName.trim().length > 100) {
+        res.status(400).json({ message: 'First name is required.' }); return
+      }
+      if (lastName !== undefined && lastName !== null && (typeof lastName !== 'string' || lastName.trim().length > 100)) {
+        res.status(400).json({ message: 'Last name is too long.' }); return
+      }
+      if (!email || typeof email !== 'string' || !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email.trim())) {
+        res.status(400).json({ message: 'A valid email address is required.' }); return
+      }
+      if (!message || typeof message !== 'string' || message.trim().length < 5 || message.trim().length > 3000) {
+        res.status(400).json({ message: 'Message must be between 5 and 3000 characters.' }); return
+      }
+
+      if (!process.env.RESEND_API_KEY) {
+        console.error('[contact] RESEND_API_KEY env var not set')
+        res.status(503).json({ message: 'The contact form is not yet configured on the server.' }); return
+      }
+
+      const trimmedName = [firstName.trim(), typeof lastName === 'string' ? lastName.trim() : ''].filter(Boolean).join(' ')
+      const trimmedEmail = email.trim()
+      const trimmedMessage = message.trim()
+      const normalizedMessageType = normalizeMessageType(messageType)
+      const cooldown = noteContactEmailCooldown(trimmedEmail)
+      if (!cooldown.ok) {
+        const retryAfterSeconds = Math.max(1, Math.ceil(cooldown.retryAfterMs / 1000))
+        res.status(429).json({ message: `Please wait ${retryAfterSeconds}s before sending another message from this email.` }); return
+      }
+
+      const submittedAt = new Date().toLocaleString('en-US', { dateStyle: 'medium', timeStyle: 'short' })
+      const shouldSendWelcome = shouldSendWelcomeEmail({ subscribe })
+
+      const wantsWelcome = subscribe === true
+      const submission = {
+        id: randomUUID(),
+        submittedAt: new Date().toISOString(),
+        name: trimmedName,
+        email: trimmedEmail,
+        message: trimmedMessage,
+        messageType: normalizedMessageType,
+        subscribe: wantsWelcome,
+        archived: false,
+        emailStatus: normalizeContactEmailStatus(null, wantsWelcome),
+      }
+      state.contactSubmissions.unshift(submission)
+      state.contactSubmissions = state.contactSubmissions.slice(0, MAX_CONTACT_SUBMISSIONS)
+      queueContactSubmissionsWrite()
+      fireWebhooks('contact.new', { name: trimmedName, email: trimmedEmail, message: trimmedMessage, messageType: normalizedMessageType, submittedAt: submission.submittedAt })
+
+      if (normalizedMessageType === 'question') {
+        const question = {
+          id: randomUUID(),
+          submittedAt: new Date().toISOString(),
+          firstName: splitName(trimmedName).firstName,
+          email: trimmedEmail,
+          question: trimmedMessage,
+          answer: '',
+          answeredAt: null,
+          isApproved: false,
+          approvedAt: null,
+          notifyOnAnswer: notifyOnAnswer === true,
+        }
+        state.questions.unshift(question)
+        state.questions = state.questions.slice(0, MAX_QUESTIONS)
+        if (state.draftQuestions !== null) {
+          state.draftQuestions.unshift(question)
+          state.draftQuestions = state.draftQuestions.slice(0, MAX_QUESTIONS)
+          queueDraftQuestionsWrite()
+        }
+        queueQuestionsWrite()
+      }
+
+      const resend = new Resend(process.env.RESEND_API_KEY)
+      const adminInbox = getResendInboxAddress()
+      const replyToAddress = getResendReplyToAddress()
+      const fromAddress = getResendFromAddress()
+      const safeMessageTypeTag = normalizedMessageType.replace(/[^a-z0-9_-]/gi, '-').toLowerCase()
+      const adminTemplate = buildContactAdminNotificationTemplate({ normalizedMessageType, trimmedName, trimmedEmail, submittedAt, trimmedMessage })
+      let welcomeSent = false
+
+      if (subscribe === true) {
+        await syncContactToResend(trimmedName, trimmedEmail)
+      }
+
+      if (shouldSendWelcome && !USE_RESEND_AUTOMATION_WELCOME) {
+        const greetingName = splitName(trimmedName).firstName?.trim() ?? ''
+        let publishedSiteContent = state.cachedSiteContent
+        if (!publishedSiteContent) {
+          try {
+            const { loadSiteContentFile } = await import('../data.js')
+            const { DATA_FILE } = await import('../config.js')
+            const published = await loadSiteContentFile(DATA_FILE)
+            publishedSiteContent = published?.siteContent ?? null
+          } catch { publishedSiteContent = null }
+        }
+
+        const emailConfig = publishedSiteContent ?? {}
+        const welcomeBaseUrl = typeof emailConfig?.seo?.canonicalUrl === 'string' && emailConfig.seo.canonicalUrl.trim()
+          ? emailConfig.seo.canonicalUrl.trim()
+          : DEFAULT_SEO.canonicalUrl
+        const welcomeSubject = process.env.RESEND_WELCOME_SUBJECT ?? emailConfig.welcomeEmailSubject ?? 'Welcome to Verse by Verse with Nate'
+        const welcomeGreetingPrefix = emailConfig.welcomeEmailGreetingPrefix?.trim() || "Glad you're here"
+        const { buildAbsoluteUrl } = await import('../helpers.js')
+        const welcomeTemplate = buildContactWelcomeEmailTemplate({
+          greetingName,
+          welcomeGreetingPrefix,
+          welcomeIntro: emailConfig.welcomeEmailIntro?.trim() || 'Thanks for subscribing to Verse by Verse with Nate - a Bible teaching podcast where we slow down, dig into the text, and pull out the nuggets God has for us word by word.',
+          welcomeCurrentSeries: emailConfig.welcomeEmailCurrentSeries?.trim() || "Right now we're working through the book of Titus - a short letter packed with practical wisdom about grace, godliness, and what the Christian life looks like when it's rooted in sound doctrine.",
+          welcomeStartHereTitle: emailConfig.welcomeEmailStartHereTitle?.trim() || 'Episode 1 - Introduction to Titus',
+          welcomeStartHereSummary: emailConfig.welcomeEmailStartHereSummary?.trim() || 'Who wrote it, who received it, and why it still matters.',
+          welcomeExpect1: emailConfig.welcomeEmailWhatToExpect1?.trim() || 'Verse-by-verse teaching - we go slow and let the text speak for itself.',
+          welcomeExpect2: emailConfig.welcomeEmailWhatToExpect2?.trim() || 'Greek word studies - the kind that open up meaning without being a lecture.',
+          welcomeExpect3: emailConfig.welcomeEmailWhatToExpect3?.trim() || 'New episodes + study notes delivered right to your inbox.',
+          welcomeScripture: emailConfig.welcomeEmailScripture?.trim() || 'For the grace of God has appeared, bringing salvation to all people.',
+          welcomeScriptureRef: emailConfig.welcomeEmailScriptureRef?.trim() || 'Titus 2:11 - BSB',
+          welcomeSignoff: emailConfig.welcomeEmailSignoff?.trim() || 'Grace and peace,\nNate',
+          welcomeSpotifyUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_SPOTIFY_URL ?? emailConfig.welcomeEmailSpotifyUrl ?? '/spotify'),
+          welcomeAppleUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_APPLE_URL ?? emailConfig.welcomeEmailAppleUrl ?? '/apple'),
+          welcomeAmazonUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_AMAZON_URL ?? emailConfig.welcomeEmailAmazonUrl ?? '/amazon'),
+          welcomeWebsiteUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_WEBSITE_URL ?? emailConfig.welcomeEmailWebsiteUrl ?? '/'),
+          welcomeEpisodeUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_EPISODE_URL ?? emailConfig.welcomeEmailStartHereUrl ?? '/start-here'),
+          welcomeImageUrl: buildAbsoluteUrl(welcomeBaseUrl, process.env.RESEND_WELCOME_IMAGE_URL ?? emailConfig.welcomeEmailImageUrl ?? '/images/podcast-art.jpeg'),
+          welcomeSpotifyBtnLabel: emailConfig.welcomeEmailSpotifyBtnLabel?.trim() || 'Listen on Spotify',
+          welcomeAppleBtnLabel: emailConfig.welcomeEmailAppleBtnLabel?.trim() || 'Apple Podcasts',
+          welcomeStartHereLinkLabel: emailConfig.welcomeEmailStartHereLinkLabel?.trim() || 'Open Start Here page',
+        })
+
+        try {
+          const welcomeSendResult = await sendResendEmailWithRetry({
+            resend,
+            context: 'contact-welcome',
+            payload: {
+              from: fromAddress,
+              to: [trimmedEmail],
+              replyTo: replyToAddress,
+              subject: welcomeSubject,
+              tags: [
+                { name: 'flow', value: 'contact-welcome' },
+                { name: 'message_type', value: safeMessageTypeTag },
+                { name: 'submission_id', value: submission.id },
+              ],
+              headers: {
+                'List-Unsubscribe': `<mailto:${replyToAddress}?subject=Unsubscribe>`,
+                'X-Contact-Submission-Id': submission.id,
+              },
+              text: welcomeTemplate.text,
+              html: welcomeTemplate.html,
+            },
+          })
+          registerResendMessageForSubmission(submission.id, 'welcome', welcomeSendResult)
+          upsertContactEmailStatus(submission.id, 'welcome', { status: 'sent', lastEventType: 'email.sent', error: null })
+          welcomeSent = true
+        } catch (welcomeErr) {
+          upsertContactEmailStatus(submission.id, 'welcome', {
+            status: 'failed',
+            lastEventType: 'email.failed',
+            error: String(welcomeErr?.message ?? welcomeErr ?? 'unknown error').slice(0, 600),
+          })
+          console.error('[contact] welcome email failed:', welcomeErr)
+          // Submission is already saved — don't 500 the user; fall through to admin notification.
+        }
+      } else if (shouldSendWelcome && USE_RESEND_AUTOMATION_WELCOME) {
+        upsertContactEmailStatus(submission.id, 'welcome', { status: 'automation-enabled', lastEventType: 'email.automation.enabled', error: null })
+      }
+
+      try {
+        const adminSendResult = await sendResendEmailWithRetry({
+          resend,
+          context: 'contact-admin-notification',
+          payload: {
+            from: fromAddress,
+            to: [adminInbox],
+            replyTo: trimmedEmail,
+            subject: adminTemplate.subject,
+            tags: [
+              { name: 'flow', value: 'contact-admin' },
+              { name: 'message_type', value: safeMessageTypeTag },
+              { name: 'submission_id', value: submission.id },
+            ],
+            headers: { 'X-Contact-Submission-Id': submission.id },
+            text: adminTemplate.text,
+            html: adminTemplate.html,
+          },
+        })
+        registerResendMessageForSubmission(submission.id, 'adminNotification', adminSendResult)
+        upsertContactEmailStatus(submission.id, 'adminNotification', { status: 'sent', lastEventType: 'email.sent', error: null })
+      } catch (adminSendErr) {
+        upsertContactEmailStatus(submission.id, 'adminNotification', {
+          status: 'failed',
+          lastEventType: 'email.failed',
+          error: String(adminSendErr?.message ?? adminSendErr ?? 'unknown error').slice(0, 600),
+        })
+        console.error('[contact] admin notification email failed:', adminSendErr)
+        // Submission is already saved — don't 500 the user.
+      }
+
+      res.json({ ok: true, welcomeSent, welcomeHandledByAutomation: shouldSendWelcome && USE_RESEND_AUTOMATION_WELCOME })
+    } catch (err) {
+      console.error('[contact] send error:', err)
+      res.status(500).json({ message: 'Failed to send your message. Please try again or email us directly.' })
+    }
+  })
+
+  app.post('/api/resend/webhook', (req, res) => {
+    const expectedToken = typeof process.env.RESEND_WEBHOOK_TOKEN === 'string' ? process.env.RESEND_WEBHOOK_TOKEN.trim() : ''
+    if (!expectedToken) {
+      res.status(503).json({ message: 'Webhook token is not configured.' }); return
+    }
+
+    const providedToken = (req.get('x-webhook-token') || '').trim()
+      || (req.get('x-resend-webhook-token') || '').trim()
+      || String(req.query?.token || '').trim()
+      || (req.get('authorization') || '').replace(/^Bearer\s+/i, '').trim()
+
+    if (!providedToken || providedToken !== expectedToken) {
+      res.status(401).json({ message: 'Unauthorized webhook.' }); return
+    }
+
+    const body = req.body && typeof req.body === 'object' ? req.body : {}
+    const eventType = typeof body.type === 'string' ? body.type.trim() : ''
+    const data = body.data && typeof body.data === 'object' ? body.data : {}
+    const tags = Array.isArray(data.tags) ? data.tags : []
+
+    const resendMessageId = (
+      typeof data.email_id === 'string' && data.email_id.trim()
+        ? data.email_id.trim()
+        : (typeof data.emailId === 'string' && data.emailId.trim()
+          ? data.emailId.trim()
+          : (typeof data.id === 'string' && data.id.trim() ? data.id.trim() : ''))
+    )
+
+    const indexed = resendMessageId ? state.resendEmailSubmissionIndex.get(resendMessageId) : null
+    const taggedSubmissionId = extractTagValue(tags, 'submission_id')
+    const submissionId = indexed?.submissionId || taggedSubmissionId
+
+    const flow = extractTagValue(tags, 'flow')
+    const stream = indexed?.stream
+      || (flow === 'contact-welcome' ? 'welcome' : '')
+      || (flow === 'contact-admin' ? 'adminNotification' : '')
+      || (flow === 'admin-reply' ? 'adminReply' : '')
+
+    if (!submissionId || !stream) {
+      res.json({ ok: true, ignored: true }); return
+    }
+
+    upsertContactEmailStatus(submissionId, stream, {
+      status: mapResendEventToStatus(eventType),
+      lastEventType: eventType || 'webhook.event',
+      resendEmailId: resendMessageId || null,
+      error: typeof data?.message === 'string' ? data.message.slice(0, 600) : null,
+    })
+
+    res.json({ ok: true })
+  })
+
+  app.get('/api/admin-contact-email-health', requireAdminAuth, (_req, res) => {
+    const fromAddress = getResendFromAddress()
+    const replyToAddress = getResendReplyToAddress()
+    const fromDomain = getAddressDomain(fromAddress)
+    const replyDomain = getAddressDomain(replyToAddress)
+    const warnings = []
+
+    if (!process.env.RESEND_API_KEY) warnings.push('RESEND_API_KEY is missing.')
+    if (!fromDomain) warnings.push('RESEND_FROM is missing or invalid.')
+    if (fromDomain.endsWith('resend.dev')) warnings.push('RESEND_FROM uses resend.dev. Prefer a verified custom domain.')
+    if (fromDomain && replyDomain && fromDomain !== replyDomain) warnings.push('Sender and reply-to domains are different.')
+    if (!process.env.RESEND_WEBHOOK_TOKEN) warnings.push('RESEND_WEBHOOK_TOKEN is not configured.')
+    warnings.push('Verify SPF, DKIM, and DMARC for the sender domain.')
+
+    const recent = state.contactSubmissions.slice(0, 300)
+    const failed = recent.filter(item => {
+      const status = normalizeContactEmailStatus(item.emailStatus, item.subscribe === true)
+      return ['failed', 'bounced', 'complained'].includes(status.welcome.status)
+        || ['failed', 'bounced', 'complained'].includes(status.adminNotification.status)
+        || ['failed', 'bounced', 'complained'].includes(status.adminReply.status)
+    }).length
+
+    res.json({
+      resendApiConfigured: Boolean(process.env.RESEND_API_KEY),
+      webhookConfigured: Boolean(process.env.RESEND_WEBHOOK_TOKEN),
+      fromAddress,
+      replyToAddress,
+      fromDomain,
+      replyDomain,
+      warnings,
+      recentSubmissionFailures: failed,
+      trackedSubmissions: recent.length,
+    })
+  })
+
+  app.get('/api/admin-contact-submissions', requireAdminAuth, (_req, res) => {
+    res.json({ submissions: state.contactSubmissions.slice(0, 300) })
+  })
+
+  app.post('/api/admin-contact-submissions/add', requireAdminAuth, (req, res) => {
+    const name = typeof req.body?.name === 'string' ? req.body.name.trim() : ''
+    const email = typeof req.body?.email === 'string' ? req.body.email.trim() : ''
+    const notes = typeof req.body?.notes === 'string' ? req.body.notes.trim().slice(0, 2000) : ''
+
+    if (!name && !email) {
+      res.status(400).json({ message: 'Name or email is required.' }); return
+    }
+    if (email && !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email)) {
+      res.status(400).json({ message: 'Invalid email address.' }); return
+    }
+
+    const submission = {
+      id: randomUUID(),
+      submittedAt: new Date().toISOString(),
+      name: name.slice(0, 200),
+      email,
+      message: '',
+      messageType: 'general',
+      subscribe: false,
+      archived: false,
+      source: 'manual',
+      notes,
+      emailStatus: normalizeContactEmailStatus(null, false),
+    }
+
+    state.contactSubmissions.unshift(submission)
+    state.contactSubmissions = state.contactSubmissions.slice(0, MAX_CONTACT_SUBMISSIONS)
+    queueContactSubmissionsWrite()
+    res.json({ ok: true, submission })
+  })
+
+  app.patch('/api/admin-contact-submissions/:id', requireAdminAuth, (req, res) => {
+    const { id } = req.params
+    if (typeof id !== 'string' || !id.trim()) {
+      res.status(400).json({ message: 'Invalid submission id.' }); return
+    }
+
+    const patch = {}
+    if (typeof req.body?.archived === 'boolean') patch.archived = req.body.archived
+    if (typeof req.body?.starred === 'boolean') patch.starred = req.body.starred
+    if (typeof req.body?.name === 'string') patch.name = req.body.name.trim().slice(0, 200)
+    if (typeof req.body?.notes === 'string') patch.notes = req.body.notes.trim().slice(0, 2000)
+    if (Array.isArray(req.body?.tags)) {
+      patch.tags = [...new Set(req.body.tags.filter(t => typeof t === 'string' && t.trim()).map(t => t.trim().slice(0, 50)))].slice(0, 20)
+    }
+    if ('snoozedUntil' in (req.body ?? {})) {
+      const v = req.body.snoozedUntil
+      patch.snoozedUntil = v === null ? null : (typeof v === 'string' && !isNaN(Date.parse(v)) ? v : undefined)
+      if (patch.snoozedUntil === undefined) delete patch.snoozedUntil
+    }
+
+    let found = false
+    state.contactSubmissions = state.contactSubmissions.map(item => {
+      if (item.id !== id) return item
+      found = true
+      return { ...item, ...patch }
+    })
+
+    if (!found) {
+      res.status(404).json({ message: 'Submission not found.' }); return
+    }
+
+    queueContactSubmissionsWrite()
+    res.json({ ok: true })
+  })
+
+  app.delete('/api/admin-contact-submissions/:id', requireAdminAuth, (req, res) => {
+    const { id } = req.params
+    if (typeof id !== 'string' || !id.trim()) {
+      res.status(400).json({ message: 'Invalid submission id.' }); return
+    }
+
+    const startLength = state.contactSubmissions.length
+    state.contactSubmissions = state.contactSubmissions.filter(item => item.id !== id)
+    if (state.contactSubmissions.length === startLength) {
+      res.status(404).json({ message: 'Submission not found.' }); return
+    }
+
+    queueContactSubmissionsWrite()
+    appendAuditEntry('submission-deleted', `id: ${id}`)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-contact-submissions/bulk', requireAdminAuth, (req, res) => {
+    const { ids, action } = req.body ?? {}
+    if (!Array.isArray(ids) || !['archive', 'unarchive', 'delete', 'star', 'unstar'].includes(action)) {
+      res.status(400).json({ message: 'Invalid bulk action.' }); return
+    }
+    const idSet = new Set(ids.filter(id => typeof id === 'string'))
+    if (idSet.size === 0) { res.json({ ok: true, affected: 0 }); return }
+
+    let affected = 0
+    if (action === 'delete') {
+      const before = state.contactSubmissions.length
+      state.contactSubmissions = state.contactSubmissions.filter(s => !idSet.has(s.id))
+      affected = before - state.contactSubmissions.length
+    } else {
+      const patch = action === 'archive' ? { archived: true }
+        : action === 'unarchive' ? { archived: false }
+        : action === 'star' ? { starred: true }
+        : { starred: false }
+      state.contactSubmissions = state.contactSubmissions.map(s => {
+        if (!idSet.has(s.id)) return s
+        affected++
+        return { ...s, ...patch }
+      })
+    }
+    queueContactSubmissionsWrite()
+    res.json({ ok: true, affected })
+  })
+
+  app.post('/api/admin-contacts/merge', requireAdminAuth, (req, res) => {
+    const keepEmail = typeof req.body?.keepEmail === 'string' ? req.body.keepEmail.trim().toLowerCase() : ''
+    const mergeEmail = typeof req.body?.mergeEmail === 'string' ? req.body.mergeEmail.trim().toLowerCase() : ''
+    if (!keepEmail || !mergeEmail || keepEmail === mergeEmail) {
+      res.status(400).json({ message: 'keepEmail and mergeEmail must be different non-empty addresses.' }); return
+    }
+    let affected = 0
+    state.contactSubmissions = state.contactSubmissions.map(s => {
+      if ((s.email ?? '').trim().toLowerCase() !== mergeEmail) return s
+      affected++
+      return { ...s, email: keepEmail }
+    })
+    queueContactSubmissionsWrite()
+    appendAuditEntry('contacts-merged', `${mergeEmail} → ${keepEmail} (${affected} submission${affected !== 1 ? 's' : ''})`)
+    res.json({ ok: true, affected })
+  })
+
+  app.post('/api/admin-contacts/import', requireAdminAuth, (req, res) => {
+    const rows = req.body?.rows
+    if (!Array.isArray(rows) || rows.length === 0) {
+      res.status(400).json({ message: 'rows must be a non-empty array.' }); return
+    }
+    const EMAIL_RE = /^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/
+    let created = 0
+    let skipped = 0
+    const toAdd = []
+    for (const row of rows.slice(0, 1000)) {
+      const name = typeof row.name === 'string' ? row.name.trim().slice(0, 200) : ''
+      const email = typeof row.email === 'string' ? row.email.trim().toLowerCase().slice(0, 320) : ''
+      const notes = typeof row.notes === 'string' ? row.notes.trim().slice(0, 2000) : ''
+      const tags = Array.isArray(row.tags)
+        ? row.tags.filter(t => typeof t === 'string' && t.trim()).map(t => t.trim().slice(0, 50)).slice(0, 20)
+        : (typeof row.tags === 'string' ? row.tags.split(';').map(t => t.trim()).filter(Boolean).slice(0, 20) : [])
+      if (!name && !email) { skipped++; continue }
+      if (email && !EMAIL_RE.test(email)) { skipped++; continue }
+      toAdd.push({ name, email, notes, tags })
+    }
+    for (const row of toAdd) {
+      const submission = {
+        id: randomUUID(),
+        submittedAt: new Date().toISOString(),
+        name: row.name,
+        email: row.email,
+        message: '',
+        messageType: 'general',
+        subscribe: false,
+        archived: false,
+        source: 'manual',
+        notes: row.notes,
+        tags: row.tags,
+        emailStatus: normalizeContactEmailStatus(null, false),
+      }
+      state.contactSubmissions.unshift(submission)
+      created++
+    }
+    state.contactSubmissions = state.contactSubmissions.slice(0, MAX_CONTACT_SUBMISSIONS)
+    if (created > 0) queueContactSubmissionsWrite()
+    if (created > 0) appendAuditEntry('contacts-imported', `${created} contacts imported, ${skipped} skipped`)
+    res.json({ ok: true, created, skipped })
+  })
+
+  app.get('/api/admin-contact-submissions/:id/attachments/:attachmentId', requireAdminAuth, (req, res) => {
+    const { id, attachmentId } = req.params
+    const submission = state.contactSubmissions.find(s => s.id === id)
+    if (!submission) { res.status(404).send('Not found.'); return }
+    const attachment = (submission.attachments ?? []).find(a => a.id === attachmentId)
+    if (!attachment) { res.status(404).send('Attachment not found.'); return }
+    const safe = attachment.filename.replace(/[^\w.\-]/g, '_')
+    res.setHeader('Content-Disposition', `attachment; filename="${safe}"`)
+    res.setHeader('Content-Type', attachment.contentType || 'application/octet-stream')
+    res.send(Buffer.from(attachment.data, 'base64'))
+  })
+
+  app.get('/api/admin-reply-config', requireAdminAuth, (_req, res) => {
+    res.json({
+      fromEmail: getResendReplyToAddress(),
+      fromIdentity: getResendFromAddress() || ADMIN_REPLY_FROM,
+      resendApiConfigured: Boolean(process.env.RESEND_API_KEY),
+      canSendReplies: Boolean(process.env.RESEND_API_KEY),
+      note: process.env.RESEND_API_KEY
+        ? 'App is configured to attempt sends through Resend. Delivery still depends on Resend sender/domain verification.'
+        : 'RESEND_API_KEY is missing, so admin replies cannot be sent yet.',
+    })
+  })
+
+  app.get('/api/admin-contact-reply-templates', requireAdminAuth, (_req, res) => {
+    res.json({ templates: state.replyTemplates })
+  })
+
+  app.put('/api/admin-contact-reply-templates', requireAdminAuth, (req, res) => {
+    const nextTemplates = sanitizeReplyTemplates(req.body?.templates)
+    state.replyTemplates = nextTemplates
+    queueReplyTemplatesWrite()
+    res.json({ ok: true, templates: state.replyTemplates })
+  })
+
+  app.get('/api/admin-contact-reply-history', requireAdminAuth, (_req, res) => {
+    res.json({ items: state.replyHistory.slice(0, 100) })
+  })
+
+  app.post('/api/admin-contact-submissions/:id/reply', requireAdminAuth, async (req, res) => {
+    try {
+      if (!process.env.RESEND_API_KEY) {
+        res.status(503).json({ message: 'RESEND_API_KEY is not configured on the server.' }); return
+      }
+
+      const { id } = req.params
+      const subject = typeof req.body?.subject === 'string' ? req.body.subject.trim() : ''
+      const message = typeof req.body?.message === 'string' ? req.body.message.trim() : ''
+      const requestedFrom = typeof req.body?.fromAddress === 'string' ? req.body.fromAddress.trim() : ''
+      const scheduledAt = typeof req.body?.scheduledAt === 'string' && !isNaN(Date.parse(req.body.scheduledAt)) && new Date(req.body.scheduledAt) > new Date() ? req.body.scheduledAt : null
+
+      if (!id || typeof id !== 'string') {
+        res.status(400).json({ message: 'Invalid submission id.' }); return
+      }
+      if (!subject || subject.length > 180) {
+        res.status(400).json({ message: 'Subject is required and must be 180 characters or fewer.' }); return
+      }
+      if (!message || message.length > 6000) {
+        res.status(400).json({ message: 'Message is required and must be 6000 characters or fewer.' }); return
+      }
+
+      const submission = state.contactSubmissions.find(entry => entry.id === id)
+      if (!submission) {
+        res.status(404).json({ message: 'Submission not found.' }); return
+      }
+      if (!submission.email || !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(submission.email)) {
+        res.status(400).json({ message: 'Submission does not have a valid email address.' }); return
+      }
+
+      const recipientName = splitName(submission.name).firstName || submission.name || 'friend'
+      const signature = state.emailSettings?.signature ?? 'Grace and peace,\nVerse by Verse with Nate'
+      const html = buildAdminReplyTemplate({ recipientName, message, signature })
+      const replyToAddress = getResendReplyToAddress()
+      const defaultFrom = getResendFromAddress() || ADMIN_REPLY_FROM
+      const fromAddress = ADMIN_REPLY_FROM_OPTIONS.includes(requestedFrom) ? requestedFrom : defaultFrom
+      const text = `Hi ${recipientName},\n\n${message}\n\n${signature}\n${replyToAddress}`
+      const resend = new Resend(process.env.RESEND_API_KEY)
+
+      const sendResult = await sendResendEmailWithRetry({
+        resend,
+        context: 'admin-contact-reply',
+        payload: {
+          from: fromAddress,
+          to: [submission.email],
+          subject,
+          replyTo: replyToAddress,
+          ...(scheduledAt ? { scheduledAt } : {}),
+          tags: [
+            { name: 'flow', value: 'admin-reply' },
+            { name: 'message_type', value: submission.messageType ?? 'general' },
+            { name: 'submission_id', value: submission.id },
+          ],
+          headers: {
+            'X-Contact-Submission-Id': submission.id,
+            ...(typeof submission.messageId === 'string' && MESSAGE_ID_RE.test(submission.messageId) ? {
+              'In-Reply-To': submission.messageId,
+              'References': submission.messageId,
+            } : {}),
+          },
+          text,
+          html,
+        },
+      })
+      registerResendMessageForSubmission(submission.id, 'adminReply', sendResult)
+      upsertContactEmailStatus(submission.id, 'adminReply', { status: 'sent', lastEventType: 'email.sent', error: null })
+
+      state.replyHistory.unshift({
+        id: randomUUID(),
+        submissionId: submission.id,
+        toEmail: submission.email,
+        toName: submission.name,
+        fromEmail: replyToAddress,
+        subject,
+        preview: message.slice(0, 500),
+        sentAt: new Date().toISOString(),
+        scheduledAt: scheduledAt ?? null,
+      })
+      state.replyHistory = state.replyHistory.slice(0, 500)
+      queueReplyHistoryWrite()
+      appendAuditEntry('reply-sent', `To: ${submission.email} | Subject: ${subject}${scheduledAt ? ` | Scheduled: ${scheduledAt}` : ''}`)
+      fireWebhooks('reply.sent', { toEmail: submission.email, toName: submission.name, subject, sentAt: new Date().toISOString() })
+
+      res.json({ ok: true, scheduled: Boolean(scheduledAt), scheduledAt: scheduledAt ?? null })
+    } catch (err) {
+      if (typeof req.params?.id === 'string' && req.params.id.trim()) {
+        upsertContactEmailStatus(req.params.id.trim(), 'adminReply', {
+          status: 'failed',
+          lastEventType: 'email.failed',
+          error: String(err?.message ?? err ?? 'unknown error').slice(0, 600),
+        })
+      }
+      console.error('[admin-reply] send error:', err)
+      res.status(500).json({ message: 'Failed to send reply email.' })
+    }
+  })
+
+  app.post('/api/admin-email/compose', requireAdminAuth, async (req, res) => {
+    try {
+      if (!process.env.RESEND_API_KEY) {
+        res.status(503).json({ message: 'RESEND_API_KEY is not configured on the server.' }); return
+      }
+      const to = typeof req.body?.to === 'string' ? req.body.to.trim() : ''
+      const toName = typeof req.body?.toName === 'string' ? req.body.toName.trim() : ''
+      const subject = typeof req.body?.subject === 'string' ? req.body.subject.trim() : ''
+      const message = typeof req.body?.message === 'string' ? req.body.message.trim() : ''
+      const requestedFrom = typeof req.body?.fromAddress === 'string' ? req.body.fromAddress.trim() : ''
+      const scheduledAt = typeof req.body?.scheduledAt === 'string' && !isNaN(Date.parse(req.body.scheduledAt)) && new Date(req.body.scheduledAt) > new Date() ? req.body.scheduledAt : null
+
+      if (!to || !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(to)) {
+        res.status(400).json({ message: 'A valid recipient email address is required.' }); return
+      }
+      if (!subject || subject.length > 180) {
+        res.status(400).json({ message: 'Subject is required and must be 180 characters or fewer.' }); return
+      }
+      if (!message || message.length > 6000) {
+        res.status(400).json({ message: 'Message is required and must be 6000 characters or fewer.' }); return
+      }
+
+      const recipientName = toName ? splitName(toName).firstName || toName : 'friend'
+      const signature = state.emailSettings?.signature ?? 'Grace and peace,\nVerse by Verse with Nate'
+      const html = buildAdminReplyTemplate({ recipientName, message, signature })
+      const defaultFrom = getResendFromAddress() || ADMIN_REPLY_FROM
+      const fromAddress = ADMIN_REPLY_FROM_OPTIONS.includes(requestedFrom) ? requestedFrom : defaultFrom
+      const replyToAddress = getResendReplyToAddress()
+      const text = `Hi ${recipientName},\n\n${message}\n\n${signature}`
+      const resend = new Resend(process.env.RESEND_API_KEY)
+
+      await sendResendEmailWithRetry({
+        resend,
+        context: 'admin-compose',
+        payload: {
+          from: fromAddress,
+          to: [to],
+          subject,
+          replyTo: replyToAddress,
+          ...(scheduledAt ? { scheduledAt } : {}),
+          tags: [{ name: 'flow', value: 'admin-reply' }],
+          text,
+          html,
+        },
+      })
+
+      state.replyHistory.unshift({
+        id: randomUUID(),
+        submissionId: '',
+        toEmail: to,
+        toName: toName || to,
+        fromEmail: replyToAddress,
+        subject,
+        preview: message.slice(0, 500),
+        sentAt: new Date().toISOString(),
+        scheduledAt: scheduledAt ?? null,
+      })
+      state.replyHistory = state.replyHistory.slice(0, 500)
+      queueReplyHistoryWrite()
+      appendAuditEntry('email-sent', `To: ${to} | Subject: ${subject}${scheduledAt ? ` | Scheduled: ${scheduledAt}` : ''}`)
+
+      res.json({ ok: true, scheduled: Boolean(scheduledAt), scheduledAt: scheduledAt ?? null })
+    } catch (err) {
+      console.error('[admin-compose] send error:', err)
+      res.status(500).json({ message: 'Failed to send email.' })
+    }
+  })
+
+  app.get('/api/admin-email-settings', requireAdminAuth, (_req, res) => {
+    res.json(state.emailSettings ?? { signature: 'Grace and peace,\nVerse by Verse with Nate' })
+  })
+
+  app.put('/api/admin-email-settings', requireAdminAuth, (req, res) => {
+    const signature = typeof req.body?.signature === 'string'
+      ? req.body.signature.slice(0, 1000)
+      : (state.emailSettings?.signature ?? 'Grace and peace,\nVerse by Verse with Nate')
+    state.emailSettings = { ...state.emailSettings, signature }
+    queueEmailSettingsWrite()
+    res.json({ ok: true, settings: state.emailSettings })
+  })
+
+  app.get('/api/admin-subscribers', requireAdminAuth, (_req, res) => {
+    const seen = new Set()
+    const subscribers = state.contactSubmissions
+      .filter(entry => entry.subscribe === true && entry.email && !seen.has(entry.email) && seen.add(entry.email))
+      .map(entry => ({
+        name: entry.name,
+        email: entry.email,
+        subscribedAt: entry.submittedAt,
+        source: entry.message?.startsWith('Requested') ? 'download' : 'contact-form',
+      }))
+      .sort((a, b) => new Date(b.subscribedAt).getTime() - new Date(a.subscribedAt).getTime())
+    res.json({ subscribers, total: subscribers.length })
+  })
+
+  app.post('/api/admin-subscribers/export', requireAdminAuth, (_req, res) => {
+    const seen = new Set()
+    const rows = [['Name', 'Email', 'Subscribed At', 'Source']]
+    state.contactSubmissions
+      .filter(entry => entry.subscribe === true && entry.email && !seen.has(entry.email) && seen.add(entry.email))
+      .sort((a, b) => new Date(b.submittedAt).getTime() - new Date(a.submittedAt).getTime())
+      .forEach(entry => {
+        const source = entry.message?.startsWith('Requested') ? 'download' : 'contact-form'
+        rows.push([entry.name, entry.email, entry.submittedAt, source])
+      })
+    const csv = rows.map(row => row.map(cell => `"${String(cell ?? '').replace(/"/g, '""')}"`).join(',')).join('\n')
+    res.setHeader('Content-Type', 'text/csv')
+    res.setHeader('Content-Disposition', `attachment; filename="subscribers-${new Date().toISOString().slice(0, 10)}.csv"`)
+    res.send(csv)
+  })
+
+  app.get('/api/admin-audit-log', requireAdminAuth, (_req, res) => {
+    res.json({ entries: state.auditLog.slice(0, 200) })
+  })
+
+  app.post('/api/admin-broadcasts/send', requireAdminAuth, async (req, res) => {
+    if (!process.env.RESEND_API_KEY) { res.status(503).json({ message: 'RESEND_API_KEY is not configured.' }); return }
+    const audienceId = process.env.RESEND_AUDIENCE_ID
+    if (!audienceId) { res.status(503).json({ message: 'RESEND_AUDIENCE_ID is not configured.' }); return }
+
+    const subject = typeof req.body?.subject === 'string' ? req.body.subject.trim() : ''
+    const text = typeof req.body?.text === 'string' ? req.body.text.trim() : ''
+    const fromLabel = typeof req.body?.from === 'string' ? req.body.from.trim() : getResendFromAddress()
+    const previewText = typeof req.body?.previewText === 'string' ? req.body.previewText.trim() : ''
+
+    if (!subject) { res.status(400).json({ message: 'Subject is required.' }); return }
+    if (!text) { res.status(400).json({ message: 'Message body is required.' }); return }
+
+    const paragraphs = text.split(/\n{2,}/).map(p => p.replace(/\n/g, '<br>')).map(p => `<p>${p}</p>`).join('')
+    const html = `<!DOCTYPE html><html><body style="font-family:Georgia,serif;max-width:600px;margin:0 auto;padding:24px;color:#1a1a1a;">${paragraphs}</body></html>`
+
+    try {
+      const resend = new Resend(process.env.RESEND_API_KEY)
+      const { data: created, error: createErr } = await resend.broadcasts.create({
+        audienceId,
+        from: fromLabel,
+        subject,
+        ...(previewText ? { previewText } : {}),
+        html,
+        text,
+      })
+      if (createErr || !created?.id) {
+        res.status(502).json({ message: createErr?.message || 'Broadcast creation failed.' }); return
+      }
+      const { error: sendErr } = await resend.broadcasts.send(created.id)
+      if (sendErr) { res.status(502).json({ message: sendErr.message || 'Broadcast send failed.' }); return }
+
+      appendAuditEntry('broadcast-sent', `Subject: ${subject} | AudienceId: ${audienceId}`)
+      res.json({ ok: true, broadcastId: created.id })
+    } catch (err) {
+      res.status(502).json({ message: String(err?.message ?? 'Broadcast failed.') })
+    }
+  })
+
+  app.post('/api/admin-contacts/trigger-drip', requireAdminAuth, async (req, res) => {
+    if (!process.env.RESEND_API_KEY) { res.status(503).json({ message: 'RESEND_API_KEY is not configured.' }); return }
+    const automationId = process.env.RESEND_AUTOMATION_WELCOME || ''
+    if (!automationId) { res.status(503).json({ message: 'No RESEND_AUTOMATION_* configured.' }); return }
+
+    const email = typeof req.body?.email === 'string' ? req.body.email.trim().toLowerCase() : ''
+    const tag = typeof req.body?.tag === 'string' ? req.body.tag.trim().slice(0, 50) : ''
+    if (!email) { res.status(400).json({ message: 'email is required.' }); return }
+
+    try {
+      const resend = new Resend(process.env.RESEND_API_KEY)
+      // Add or update the contact in the Resend audience so the automation can fire
+      const audienceId = process.env.RESEND_AUDIENCE_ID || ''
+      if (audienceId) {
+        await resend.contacts.create({ audienceId, email, unsubscribed: false }).catch(() => {})
+      }
+      appendAuditEntry('drip-triggered', `email: ${email}${tag ? ` | tag: ${tag}` : ''}`)
+      res.json({ ok: true, note: 'Contact synced to Resend audience; automation will fire based on your Resend settings.' })
+    } catch (err) {
+      res.status(502).json({ message: String(err?.message ?? 'Drip trigger failed.') })
+    }
+  })
+
+  app.post('/api/admin-contact-submissions/:id/draft-reply', requireAdminAuth, async (req, res) => {
+    const apiKey = process.env.ANTHROPIC_API_KEY
+    if (!apiKey) { res.status(503).json({ message: 'ANTHROPIC_API_KEY is not configured on the server.' }); return }
+
+    const { id } = req.params
+    if (!id || typeof id !== 'string') { res.status(400).json({ message: 'Invalid submission id.' }); return }
+
+    const submission = state.contactSubmissions.find(s => s.id === id.trim())
+    if (!submission) { res.status(404).json({ message: 'Submission not found.' }); return }
+
+    const senderName = submission.name?.trim() || 'this listener'
+    const messageText = submission.message?.trim() || '(no message body)'
+
+    try {
+      const apiRes = await fetch('https://api.anthropic.com/v1/messages', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-api-key': apiKey,
+          'anthropic-version': '2023-06-01',
+        },
+        body: JSON.stringify({
+          model: 'claude-haiku-4-5-20251001',
+          max_tokens: 400,
+          messages: [{
+            role: 'user',
+            content: `Draft a warm, personal reply to this message from a podcast listener. Write only the reply body — no greeting line (handled separately), no sign-off (handled by a signature). Keep it under 150 words. Be genuine and specific to their message.\n\nFrom: ${senderName}\nMessage:\n${messageText.slice(0, 1500)}`,
+          }],
+        }),
+      })
+
+      if (!apiRes.ok) {
+        const err = await apiRes.json().catch(() => ({}))
+        res.status(502).json({ message: err?.error?.message || 'AI draft request failed.' }); return
+      }
+
+      const data = await apiRes.json()
+      const draft = String(data?.content?.[0]?.text ?? '').trim()
+      res.json({ ok: true, draft })
+    } catch {
+      res.status(502).json({ message: 'AI draft request failed.' })
+    }
+  })
+
+  // ── Webhook CRUD ───────────────────────────────────────────────────────────
+
+  app.get('/api/admin-webhooks', requireAdminAuth, (_req, res) => {
+    res.json({ webhooks: state.webhooks })
+  })
+
+  app.post('/api/admin-webhooks', requireAdminAuth, (req, res) => {
+    const url = typeof req.body?.url === 'string' ? req.body.url.trim() : ''
+    const events = Array.isArray(req.body?.events) ? req.body.events.filter(e => typeof e === 'string' && e.trim()) : ['*']
+    const label = typeof req.body?.label === 'string' ? req.body.label.trim().slice(0, 100) : ''
+    if (!url || !/^https?:\/\/./.test(url)) {
+      res.status(400).json({ message: 'A valid http/https URL is required.' }); return
+    }
+    const webhook = { id: randomUUID(), url: url.slice(0, 500), label, events, createdAt: new Date().toISOString() }
+    state.webhooks.push(webhook)
+    state.webhooks = state.webhooks.slice(0, 50)
+    queueWebhooksWrite()
+    appendAuditEntry('webhook-added', url)
+    res.json({ ok: true, webhook })
+  })
+
+  app.delete('/api/admin-webhooks/:id', requireAdminAuth, (req, res) => {
+    const { id } = req.params
+    const before = state.webhooks.length
+    state.webhooks = state.webhooks.filter(w => w.id !== id)
+    if (state.webhooks.length === before) { res.status(404).json({ message: 'Webhook not found.' }); return }
+    queueWebhooksWrite()
+    appendAuditEntry('webhook-removed', `id: ${id}`)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-webhooks/:id/test', requireAdminAuth, async (req, res) => {
+    const wh = state.webhooks.find(w => w.id === req.params.id)
+    if (!wh) { res.status(404).json({ message: 'Webhook not found.' }); return }
+    try {
+      const r = await fetch(wh.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'User-Agent': 'Siteforge-Webhook/1.0' },
+        body: JSON.stringify({ event: 'test', data: { message: 'Test event from Siteforge.' }, firedAt: new Date().toISOString() }),
+        signal: AbortSignal.timeout(8000),
+      })
+      appendAuditEntry('webhook-test', `${wh.url} → ${r.status}`)
+      res.json({ ok: true, status: r.status })
+    } catch (err) {
+      res.status(502).json({ message: String(err?.message ?? 'Test failed.') })
+    }
+  })
+}

server/routes/downloads.js

@@ -0,0 +1,216 @@
+import { stat } from 'node:fs/promises'
+import { requireAdminAuth } from '../auth.js'
+import { TITUS_STUDY_FILE, TITUS_STUDY_DOWNLOAD_NAME } from '../config.js'
+import { state } from '../state.js'
+import {
+  loadSiteContentFile,
+  queueContactSubmissionsWrite,
+  normalizeContactEmailStatus,
+  normalizeMessageType,
+  incrementDownloadCount,
+} from '../data.js'
+import {
+  createTitusDownloadToken,
+  consumeTitusDownloadToken,
+  sanitizeUrl,
+} from '../study-helpers.js'
+import { syncContactToResend } from '../email.js'
+import { DATA_FILE, MAX_CONTACT_SUBMISSIONS } from '../config.js'
+import { randomUUID } from 'node:crypto'
+
+const downloadHits = new Map()
+
+function studyDownloadRateLimit(req, res, next) {
+  const ip = req.ip ?? 'unknown'
+  const now = Date.now()
+  const windowMs = 10 * 60 * 1000
+  const entry = downloadHits.get(ip) ?? { count: 0, start: now }
+  if (now - entry.start > windowMs) { entry.count = 0; entry.start = now }
+  entry.count += 1
+  downloadHits.set(ip, entry)
+  // Prune stale entries to prevent unbounded growth
+  if (downloadHits.size > 5000) {
+    const cutoff = now - windowMs
+    for (const [k, v] of downloadHits) { if (v.start < cutoff) downloadHits.delete(k) }
+  }
+  if (entry.count > 10) {
+    res.status(429).json({ message: 'Too many download requests. Please wait a few minutes.' })
+    return
+  }
+  next()
+}
+
+function addContactSubmission({ name, email, message, messageType, subscribe }) {
+  const wantsWelcome = subscribe === true
+  const submission = {
+    id: randomUUID(),
+    submittedAt: new Date().toISOString(),
+    name,
+    email,
+    message,
+    messageType: normalizeMessageType(messageType),
+    subscribe: wantsWelcome,
+    archived: false,
+    emailStatus: normalizeContactEmailStatus(null, wantsWelcome),
+  }
+  state.contactSubmissions.unshift(submission)
+  state.contactSubmissions = state.contactSubmissions.slice(0, MAX_CONTACT_SUBMISSIONS)
+  queueContactSubmissionsWrite()
+  return submission
+}
+
+export function register(app) {
+  app.post('/api/study-downloads/titus', studyDownloadRateLimit, async (req, res) => {
+    try {
+      const { firstName, lastName, email, subscribe, _honey } = req.body ?? {}
+
+      if (_honey) { res.json({ ok: true }); return }
+
+      if (!firstName || typeof firstName !== 'string' || firstName.trim().length < 1 || firstName.trim().length > 100) {
+        res.status(400).json({ message: 'First name is required.' }); return
+      }
+      if (!lastName || typeof lastName !== 'string' || lastName.trim().length < 1 || lastName.trim().length > 100) {
+        res.status(400).json({ message: 'Last name is required.' }); return
+      }
+      if (!email || typeof email !== 'string' || !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email.trim())) {
+        res.status(400).json({ message: 'A valid email address is required.' }); return
+      }
+
+      const published = await loadSiteContentFile(DATA_FILE)
+      const configuredDownloadUrl = sanitizeUrl(published?.siteContent?.studyGuideDownloadUrl)
+
+      if (!configuredDownloadUrl) {
+        try {
+          await stat(TITUS_STUDY_FILE)
+        } catch {
+          res.status(503).json({ message: 'The primary study guide download URL is not configured yet.' }); return
+        }
+      }
+
+      const trimmedFirstName = firstName.trim()
+      const trimmedLastName = lastName.trim()
+      const trimmedName = `${trimmedFirstName} ${trimmedLastName}`.trim()
+      const trimmedEmail = email.trim()
+      const wantsSubscribe = subscribe !== false
+
+      addContactSubmission({ name: trimmedName, email: trimmedEmail, message: 'Requested Titus study download.', messageType: 'general', subscribe: wantsSubscribe })
+
+      if (wantsSubscribe) {
+        await syncContactToResend(trimmedName, trimmedEmail)
+      }
+
+      incrementDownloadCount('titus-study')
+
+      if (configuredDownloadUrl) {
+        res.json({ ok: true, downloadUrl: configuredDownloadUrl }); return
+      }
+
+      const token = createTitusDownloadToken(trimmedEmail)
+      res.json({ ok: true, downloadUrl: `/api/study-downloads/titus/file?token=${encodeURIComponent(token)}` })
+    } catch (err) {
+      console.error('[study-download] request error:', err)
+      res.status(500).json({ message: 'Failed to process your request. Please try again.' })
+    }
+  })
+
+  app.get('/api/study-downloads/titus/file', async (req, res) => {
+    const token = typeof req.query?.token === 'string' ? req.query.token : ''
+    if (!token || !consumeTitusDownloadToken(token)) {
+      res.status(403).json({ message: 'Invalid or expired download link. Submit the form again.' }); return
+    }
+
+    try {
+      await stat(TITUS_STUDY_FILE)
+      res.download(TITUS_STUDY_FILE, TITUS_STUDY_DOWNLOAD_NAME)
+    } catch {
+      res.status(503).json({ message: 'The Titus study file is not configured yet.' })
+    }
+  })
+
+  app.post('/api/resource-download', studyDownloadRateLimit, async (req, res) => {
+    try {
+      const { resourceId, firstName, lastName, email, subscribe, _honey } = req.body ?? {}
+
+      if (_honey) { res.json({ ok: true }); return }
+
+      if (!resourceId || typeof resourceId !== 'string') {
+        res.status(400).json({ message: 'Resource ID is required.' }); return
+      }
+
+      const published = await loadSiteContentFile(DATA_FILE)
+      const siteContent = published?.siteContent
+
+      function resolveResourceFromId(id) {
+        if (!siteContent || typeof siteContent !== 'object') return null
+        const customResources = Array.isArray(siteContent.customLinks)
+          ? siteContent.customLinks.filter(link => link?.placement === 'resources')
+          : []
+        if (id.startsWith('custom:')) {
+          const customId = id.slice('custom:'.length)
+          const match = customResources.find(link => link.id === customId)
+          return match ? { label: match.label, url: match.url } : null
+        }
+        if (id.startsWith('archived:')) {
+          const [, seriesId, ...linkIdParts] = id.split(':')
+          const linkId = linkIdParts.join(':')
+          const archivedSeries = Array.isArray(siteContent.archivedSeries) ? siteContent.archivedSeries : []
+          const series = archivedSeries.find(item => item.id === seriesId)
+          const link = Array.isArray(series?.resourceLinks) ? series.resourceLinks.find(item => item.id === linkId) : null
+          return link ? { label: link.label || series?.title, url: link.url } : null
+        }
+        const customMatch = customResources.find(link => link.id === id)
+        if (customMatch) return { label: customMatch.label, url: customMatch.url }
+        const archivedSeries = Array.isArray(siteContent.archivedSeries) ? siteContent.archivedSeries : []
+        for (const series of archivedSeries) {
+          if (!Array.isArray(series?.resourceLinks)) continue
+          const link = series.resourceLinks.find(item => item.id === id)
+          if (link) return { label: link.label || series?.title, url: link.url }
+        }
+        return null
+      }
+
+      const resource = resolveResourceFromId(resourceId)
+      if (!resource || typeof resource.url !== 'string' || !resource.url.trim()) {
+        res.status(400).json({ message: 'Resource not found.' }); return
+      }
+
+      if (!firstName || typeof firstName !== 'string' || firstName.trim().length < 1 || firstName.trim().length > 100) {
+        res.status(400).json({ message: 'First name is required.' }); return
+      }
+      if (!lastName || typeof lastName !== 'string' || lastName.trim().length < 1 || lastName.trim().length > 100) {
+        res.status(400).json({ message: 'Last name is required.' }); return
+      }
+      if (!email || typeof email !== 'string' || !/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email.trim())) {
+        res.status(400).json({ message: 'A valid email address is required.' }); return
+      }
+
+      const trimmedFirstName = firstName.trim()
+      const trimmedLastName = lastName.trim()
+      const trimmedName = `${trimmedFirstName} ${trimmedLastName}`.trim()
+      const trimmedEmail = email.trim()
+      const wantsSubscribe = subscribe !== false
+
+      addContactSubmission({
+        name: trimmedName,
+        email: trimmedEmail,
+        message: `Requested resource download: ${resource.label ?? resource.url}`,
+        messageType: 'general',
+        subscribe: wantsSubscribe,
+      })
+
+      if (wantsSubscribe) {
+        await syncContactToResend(trimmedName, trimmedEmail)
+      }
+
+      incrementDownloadCount(`resource:${resourceId}`)
+      res.json({ ok: true, downloadUrl: resource.url.trim() })
+    } catch (err) {
+      console.error('[resource-download] request error:', err)
+      res.status(500).json({ message: 'Failed to process your request. Please try again.' })
+    }
+  })
+
+  app.get('/api/admin-download-stats', requireAdminAuth, (_req, res) => {
+    res.json({ counts: state.downloadCounts })
+  })
+}

server/routes/episode-scripts.js

@@ -0,0 +1,134 @@
+import mammoth from 'mammoth'
+import { requireAdminAuth } from '../auth.js'
+import { state } from '../state.js'
+import { queueEpisodeScriptsWrite } from '../data.js'
+import { MAX_EPISODE_SCRIPT_LENGTH } from '../config.js'
+
+/**
+ * Simple whitespace-normalised search over episode script text.
+ * Returns { episodeNumber, title, filename, snippet, score } for matches.
+ */
+function searchScripts(query) {
+  if (!query || query.trim().length < 2) return []
+  const q = query.trim().toLowerCase()
+  const words = q.split(/\s+/).filter(w => w.length >= 2)
+  const results = []
+
+  for (const [episodeNumber, entry] of Object.entries(state.episodeScripts)) {
+    if (!entry?.text) continue
+    const text = entry.text.toLowerCase()
+
+    // Count how many words appear in the text
+    const matchCount = words.filter(w => text.includes(w)).length
+    if (matchCount === 0) continue
+
+    // Find a snippet around the first matching word
+    const firstWord = words.find(w => text.includes(w))
+    const idx = firstWord ? text.indexOf(firstWord) : 0
+    const start = Math.max(0, idx - 80)
+    const end = Math.min(entry.text.length, idx + 180)
+    let snippet = entry.text.slice(start, end).replace(/\s+/g, ' ').trim()
+    if (start > 0) snippet = '…' + snippet
+    if (end < entry.text.length) snippet = snippet + '…'
+
+    results.push({
+      episodeNumber,
+      title: entry.title ?? `Episode ${episodeNumber}`,
+      filename: entry.filename ?? '',
+      snippet,
+      score: matchCount / words.length, // 0–1: fraction of query words found
+    })
+  }
+
+  return results.sort((a, b) => b.score - a.score).slice(0, 8)
+}
+
+export function register(app) {
+  // Public script search — called by the frontend global search
+  app.get('/api/episode-scripts/search', (req, res) => {
+    const q = typeof req.query.q === 'string' ? req.query.q.trim() : ''
+    if (!q || q.length < 2) { res.json({ results: [] }); return }
+    res.json({ results: searchScripts(q) })
+  })
+
+  // Admin: list all uploaded scripts
+  app.get('/api/admin-episode-scripts', requireAdminAuth, (_req, res) => {
+    const list = Object.entries(state.episodeScripts).map(([episodeNumber, entry]) => ({
+      episodeNumber,
+      title: entry.title ?? `Episode ${episodeNumber}`,
+      filename: entry.filename ?? '',
+      uploadedAt: entry.uploadedAt ?? null,
+      wordCount: entry.text ? entry.text.split(/\s+/).filter(Boolean).length : 0,
+    }))
+    list.sort((a, b) => Number(a.episodeNumber) - Number(b.episodeNumber))
+    res.json({ scripts: list })
+  })
+
+  // Admin: upload a docx script for an episode
+  app.post('/api/admin-episode-scripts/:episodeNumber', requireAdminAuth, async (req, res) => {
+    const episodeNumber = req.params.episodeNumber?.trim()
+    if (!episodeNumber || !/^\d+$/.test(episodeNumber)) {
+      res.status(400).json({ message: 'Episode number must be a positive integer.' }); return
+    }
+
+    const dataUrl = typeof req.body?.dataUrl === 'string' ? req.body.dataUrl : ''
+    const filename = typeof req.body?.filename === 'string' ? req.body.filename.trim() : `episode-${episodeNumber}.docx`
+    const title = typeof req.body?.title === 'string' ? req.body.title.trim() : `Episode ${episodeNumber}`
+
+    if (!dataUrl.startsWith('data:')) {
+      res.status(400).json({ message: 'dataUrl must be a valid data URL.' }); return
+    }
+
+    const base64 = dataUrl.split(',')[1] ?? ''
+    if (!base64) { res.status(400).json({ message: 'Empty file.' }); return }
+
+    const buffer = Buffer.from(base64, 'base64')
+    if (buffer.length === 0 || buffer.length > 20 * 1024 * 1024) {
+      res.status(400).json({ message: 'File must be between 1 byte and 20MB.' }); return
+    }
+
+    let text
+    try {
+      const result = await mammoth.extractRawText({ buffer })
+      text = result.value.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trim()
+    } catch (err) {
+      console.error('[episode-scripts] mammoth extraction failed:', err.message)
+      res.status(422).json({ message: 'Could not extract text from file. Make sure it is a valid .docx file.' }); return
+    }
+
+    if (!text || text.length < 10) {
+      res.status(422).json({ message: 'No readable text found in document.' }); return
+    }
+
+    // Trim to max length
+    if (text.length > MAX_EPISODE_SCRIPT_LENGTH) {
+      text = text.slice(0, MAX_EPISODE_SCRIPT_LENGTH)
+    }
+
+    state.episodeScripts[episodeNumber] = {
+      title,
+      filename,
+      text,
+      uploadedAt: new Date().toISOString(),
+      wordCount: text.split(/\s+/).filter(Boolean).length,
+    }
+    queueEpisodeScriptsWrite()
+
+    res.json({
+      ok: true,
+      episodeNumber,
+      wordCount: state.episodeScripts[episodeNumber].wordCount,
+    })
+  })
+
+  // Admin: delete a script
+  app.delete('/api/admin-episode-scripts/:episodeNumber', requireAdminAuth, (req, res) => {
+    const episodeNumber = req.params.episodeNumber?.trim()
+    if (!state.episodeScripts[episodeNumber]) {
+      res.status(404).json({ message: 'Script not found.' }); return
+    }
+    delete state.episodeScripts[episodeNumber]
+    queueEpisodeScriptsWrite()
+    res.json({ ok: true })
+  })
+}

server/routes/episodes.js

@@ -0,0 +1,196 @@
+import { sanitizeUrl } from '../study-helpers.js'
+
+const RSS_FEED_URL = 'https://anchor.fm/s/11068d290/podcast/rss'
+let episodesCache = null
+let episodesCacheAt = 0
+let rawXmlCache = null
+const EPISODES_CACHE_TTL = 30 * 60 * 1000
+
+function extractCdata(raw) {
+  const cdata = /^<!\[CDATA\[([\s\S]*?)\]\]>$/.exec(raw.trim())
+  return cdata ? cdata[1].trim() : raw.trim()
+}
+
+function parseRssItems(xml, limit = Infinity) {
+  const items = []
+  const itemRegex = /<item>([\s\S]*?)<\/item>/g
+  let match
+  while ((match = itemRegex.exec(xml)) !== null && items.length < limit) {
+    const block = match[1]
+    const titleRaw = /<title>([\s\S]*?)<\/title>/.exec(block)?.[1] ?? ''
+    const title = extractCdata(titleRaw)
+    if (!title) continue
+
+    const pubDate = (/<pubDate>([\s\S]*?)<\/pubDate>/.exec(block)?.[1] ?? '').trim()
+    const guidRaw = /<guid[^>]*>([\s\S]*?)<\/guid>/.exec(block)?.[1] ?? ''
+    const guid = extractCdata(guidRaw)
+    const enclosureUrl = /<enclosure[^>]+url="([^"]+)"/.exec(block)?.[1] ?? ''
+    const link = guid.startsWith('http') ? guid : enclosureUrl
+    const descRaw = /<description>([\s\S]*?)<\/description>/.exec(block)?.[1] ?? ''
+    const descText = extractCdata(descRaw).replace(/<[^>]+>/g, '').replace(/\s+/g, ' ').trim()
+    const duration = (/<itunes:duration>([\s\S]*?)<\/itunes:duration>/.exec(block)?.[1] ?? '').trim()
+    const episode = (/<itunes:episode>([\s\S]*?)<\/itunes:episode>/.exec(block)?.[1] ?? '').trim()
+    const season = (/<itunes:season>([\s\S]*?)<\/itunes:season>/.exec(block)?.[1] ?? '').trim()
+    items.push({
+      title, pubDate, link,
+      audioUrl: enclosureUrl,
+      description: descText.slice(0, 220) + (descText.length > 220 ? '…' : ''),
+      duration, episode, season,
+    })
+  }
+  return items
+}
+
+export async function fetchAllEpisodes() {
+  const now = Date.now()
+  if (episodesCache && (now - episodesCacheAt) < EPISODES_CACHE_TTL) {
+    return episodesCache
+  }
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 8000)
+  const response = await fetch(RSS_FEED_URL, { signal: controller.signal })
+  clearTimeout(timeout)
+  if (!response.ok) throw new Error(`RSS fetch failed: ${response.status}`)
+  const xml = await response.text()
+  rawXmlCache = xml
+  const episodes = parseRssItems(xml)
+  episodesCache = episodes
+  episodesCacheAt = now
+  return episodes
+}
+
+export async function fetchRawFeedXml() {
+  await fetchAllEpisodes()
+  return rawXmlCache
+}
+
+function toSpotifyEpisodeEmbedUrl(urlValue) {
+  if (!urlValue) return ''
+  try {
+    const parsed = new URL(urlValue)
+    if (parsed.protocol !== 'https:') return ''
+    const host = parsed.hostname.toLowerCase()
+    const parts = parsed.pathname.split('/').filter(Boolean)
+    if (host === 'open.spotify.com') {
+      if (parts[0] === 'embed' && parts[1] === 'episode' && parts[2]) {
+        return `https://open.spotify.com/embed/episode/${parts[2]}?utm_source=generator`
+      }
+      if (parts[0] === 'episode' && parts[1]) {
+        return `https://open.spotify.com/embed/episode/${parts[1]}?utm_source=generator`
+      }
+    }
+  } catch { return '' }
+  return ''
+}
+
+function decodeEscapedJsonUrl(value) {
+  return String(value || '').replace(/\\u002F/g, '/').replace(/\\\//g, '/')
+}
+
+function extractSpotifyEpisodeIdFromCreatorHtml(html, sourceUrl) {
+  const input = String(html || '')
+  if (!input) return ''
+  const sourceEpisodeSlug = /-([A-Za-z0-9]+)(?:\/|$)/.exec(sourceUrl)?.[1] ?? ''
+  const blockRegex = /"episodeId":"([^"]+)"[\s\S]*?"spotifyUrl":"([^"]+)"/g
+  let match
+  let firstEpisodeId = ''
+  while ((match = blockRegex.exec(input)) !== null) {
+    const episodeSlug = match[1]
+    const spotifyUrl = decodeEscapedJsonUrl(match[2])
+    const episodeId = /\/episode\/([A-Za-z0-9]+)/.exec(spotifyUrl)?.[1]
+    if (!firstEpisodeId && episodeId) firstEpisodeId = episodeId
+    if (sourceEpisodeSlug && episodeSlug === sourceEpisodeSlug && episodeId) return episodeId
+  }
+  if (firstEpisodeId) return firstEpisodeId
+  const urlMatch = /"spotifyUrl":"(https:\\u002F\\u002Fopen\.spotify\.com\\u002Fepisode\\u002F([A-Za-z0-9]+))/.exec(input)
+  return urlMatch ? (urlMatch[2] || '') : ''
+}
+
+function isAllowedSpotifyResolverHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  return host === 'open.spotify.com' || host === 'creators.spotify.com' || host === 'anchor.fm' || host === 'podcasters.spotify.com'
+}
+
+export function register(app) {
+  app.get('/api/spotify/embed-url', async (req, res) => {
+    const incoming = typeof req.query.url === 'string' ? req.query.url.trim() : ''
+    const safeInput = sanitizeUrl(incoming)
+
+    if (!safeInput || safeInput.startsWith('/')) {
+      res.status(400).json({ message: 'A valid episode URL is required.' }); return
+    }
+
+    let parsed
+    try {
+      parsed = new URL(safeInput)
+    } catch {
+      res.status(400).json({ message: 'Malformed URL.' }); return
+    }
+
+    if (parsed.protocol !== 'https:' || !isAllowedSpotifyResolverHost(parsed.hostname)) {
+      res.status(400).json({ message: 'Unsupported episode URL host.' }); return
+    }
+
+    const directEmbed = toSpotifyEpisodeEmbedUrl(safeInput)
+    if (directEmbed) {
+      res.json({ embedUrl: directEmbed, resolvedFrom: 'direct' }); return
+    }
+
+    try {
+      const controller = new AbortController()
+      const timeout = setTimeout(() => controller.abort(), 8000)
+      const response = await fetch(safeInput, {
+        signal: controller.signal,
+        headers: { 'User-Agent': 'Siteforge/1.0 (+https://versebyversewithnate.us)', Accept: 'text/html' },
+      })
+      clearTimeout(timeout)
+
+      if (!response.ok) {
+        res.status(404).json({ message: 'Could not fetch episode page.' }); return
+      }
+
+      const html = await response.text()
+      const spotifyEpisodeId = extractSpotifyEpisodeIdFromCreatorHtml(html, safeInput)
+
+      if (!spotifyEpisodeId) {
+        res.status(404).json({ message: 'Could not resolve Spotify episode ID from page.' }); return
+      }
+
+      const embedUrl = `https://open.spotify.com/embed/episode/${spotifyEpisodeId}?utm_source=generator`
+      res.json({ embedUrl, resolvedFrom: 'page-fetch' })
+    } catch (err) {
+      console.error('[spotify/embed-url] resolve error:', err.message)
+      res.status(500).json({ message: 'Could not resolve Spotify embed URL right now.' })
+    }
+  })
+
+  app.get('/api/episodes', async (_req, res) => {
+    try {
+      const episodes = await fetchAllEpisodes()
+      res.json({ episodes: episodes.slice(0, 6) })
+    } catch (err) {
+      console.error('[episodes] RSS fetch error:', err.message)
+      res.json({ episodes: (episodesCache ?? []).slice(0, 6) })
+    }
+  })
+
+  app.get('/api/episodes/all', async (_req, res) => {
+    try {
+      const episodes = await fetchAllEpisodes()
+      res.json({ episodes })
+    } catch (err) {
+      console.error('[episodes/all] RSS fetch error:', err.message)
+      res.json({ episodes: episodesCache ?? [] })
+    }
+  })
+
+  app.get('/api/episode-audio', async (_req, res) => {
+    try {
+      const episodes = await fetchAllEpisodes()
+      res.json({ episodes: episodes.map(e => ({ title: e.title, audioUrl: e.audioUrl, duration: e.duration, episode: e.episode })) })
+    } catch (err) {
+      console.error('[episode-audio] RSS fetch error:', err.message)
+      res.json({ episodes: (episodesCache ?? []).map(e => ({ title: e.title, audioUrl: e.audioUrl, duration: e.duration, episode: e.episode })) })
+    }
+  })
+}

server/routes/feed.js

@@ -0,0 +1,35 @@
+import { fetchRawFeedXml } from './episodes.js'
+import { getCanonicalBaseUrl } from '../email.js'
+
+export function register(app) {
+  app.get('/feed.xml', async (_req, res) => {
+    try {
+      const xml = await fetchRawFeedXml()
+      if (!xml) {
+        res.status(503).send('Feed temporarily unavailable')
+        return
+      }
+
+      const baseUrl = getCanonicalBaseUrl().replace(/\/$/, '')
+      const feedUrl = `${baseUrl}/feed.xml`
+
+      // Rewrite channel <link> and <atom:link href> to our canonical domain
+      const rewritten = xml
+        .replace(
+          /<atom:link[^>]+rel="self"[^>]*\/>/,
+          `<atom:link href="${feedUrl}" rel="self" type="application/rss+xml"/>`
+        )
+        .replace(
+          /(<channel>[\s\S]*?<link>)[^<]*(\/link>)/,
+          `$1${baseUrl}$2`
+        )
+
+      res.set('Content-Type', 'application/rss+xml; charset=utf-8')
+      res.set('Cache-Control', 'public, max-age=1800')
+      res.send(rewritten)
+    } catch (err) {
+      console.error('[feed.xml]', err?.message ?? err)
+      res.status(502).send('Failed to fetch feed')
+    }
+  })
+}