@protobase/server 0.62.4 → 0.63.0

package/dist/better-auth/auth-settings.d.ts

@@ -1,5 +1,5 @@
 import { UserColumn } from "./user-table.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -10,6 +10,7 @@ import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole, StoredMember, StoredOrganization } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import "../index.js";
 import { CreateAuthOptions, UserCreatedHook } from "./create-auth.js";
@@ -8836,6 +8837,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
     id: string;
     name: string;
   }[];
+  personalMail: PersonalMailProvider[];
+  personalMailer: (userId: string) => Mailer;
   mcp: {
     resource: string;
     path: string;

package/dist/better-auth/create-auth.d.ts

@@ -1,5 +1,5 @@
 import { UserColumn, UserTableOptions } from "./user-table.js";
-import { Mailer } from "../mail/smtp-mailer.js";
+import { Mailer } from "../mail/mail-message.js";
 import { SignInPolicy } from "./sign-in-policy.js";
 import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
@@ -10,9 +10,11 @@ import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
+import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import { OperatorProvider } from "./operator-provider.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
+import { PersonalMailProviderId } from "../personal-mail/personal-mail-providers.js";
 import "../index.js";
 import "./auth-base-path.js";
 import { mcpAuthPlugins } from "./mcp/mcp-auth-plugins.js";
@@ -108,6 +110,12 @@ export type CreateAuthOptions = {
    * One with the id of `signInProvider` takes its place. Default none.
    */
   socialProviders?: BetterAuthOptions['socialProviders'];
+  /**
+   * The mail providers people may link their own mailbox with, from the account page, for the app's functions to send
+   * mail from it (`context.personalMail`), such as `['gmail']`. Each links through its sign-in provider, which
+   * `socialProviders` must have: Gmail through `google`. Default none.
+   */
+  personalMail?: PersonalMailProviderId[];
   /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
@@ -1794,7 +1802,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string | null | undefined;
+          image?: string | null | undefined;
         }) | import("better-auth/plugins").UserWithTwoFactor;
       }>;
       generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
@@ -8977,6 +8985,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
     id: string;
     name: string;
   }[];
+  /** The mail providers people link their own mailbox with (`personalMail`). */
+  personalMail: PersonalMailProvider[];
+  /** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
+  personalMailer: (userId: string) => Mailer;
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {
     resource: string;

package/dist/better-auth/create-auth.js

@@ -5,6 +5,9 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { betterAuthLinkedAccounts } from "../personal-mail/linked-accounts.js";
+import { resolvePersonalMail } from "../personal-mail/personal-mail-providers.js";
+import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
@@ -368,6 +371,7 @@ const createAuth = (options, plugins = {}) => {
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
+	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
@@ -458,6 +462,10 @@ const createAuth = (options, plugins = {}) => {
 			id,
 			name
 		})),
+		/** The mail providers people link their own mailbox with (`personalMail`). */
+		personalMail,
+		/** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
+		personalMailer: (userId) => personalMailer(betterAuthLinkedAccounts(auth), personalMail, userId),
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {
 			resource: mcp.resource,

package/dist/better-auth/organizations/organization-role.js

@@ -0,0 +1,13 @@
+import { findMember, organizationRoleOf } from "./store.js";
+//#region src/better-auth/organizations/organization-role.ts
+/** The user's role in the organization, `undefined` when they are no member of it. */
+const organizationRole = (auth) => async (organization, user) => {
+	const { adapter } = await auth.$context;
+	const member = await findMember(adapter, {
+		organizationId: organization,
+		userId: user
+	});
+	return member && organizationRoleOf(member);
+};
+//#endregion
+export { organizationRole };

package/dist/better-auth/status-route.js

@@ -14,7 +14,7 @@ import { Hono } from "hono";
 * operator provider's name, when staff can sign in as people; `passkeyDomains`, when people have passkeys for more than
 * one of the app's hosts, the RP IDs a passkey sign-in can ask for, the passkey domain first; with organizations, who may create them and the roles
 * with their labels, `membership` for those a member can hold, and the roles each one's holders may also give; and
-* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, with the `url` of its endpoint, so the account page shows that address and lists the connected clients; and
+* `anonymous` when the project's anonymous role reads a resource, so the admin app opens for visitors before anyone signs in; `mcp` when MCP clients can connect, with the `url` of its endpoint, so the account page shows that address and lists the connected clients; `personalMail`, the mail providers people may link their mailbox with, each with the sign-in provider it links through, the scopes and the authorization parameters of the link, so the account page offers "Link Gmail"; and
 * `plugins`, those the app loads before sign-in (see `PluginOption`); and `locale`, the language `options.locale` puts
 * the screens in, so the sign-in screens and public forms, which come before `/meta`, are in it too.
 */
@@ -48,6 +48,13 @@ const statusRoute = (auth, { anonymous = false, plugins = [], locale } = {}) =>
 			...passkeyDomains.length > 1 && { passkeyDomains },
 			...anonymous && { anonymous },
 			...auth.mcp && { mcp: { url: auth.mcp.resource } },
+			...auth.personalMail.length > 0 && { personalMail: auth.personalMail.map(({ id, name, signInProvider, scopes, linkParams }) => ({
+				id,
+				name,
+				provider: signInProvider,
+				scopes,
+				params: linkParams
+			})) },
 			...plugins.length > 0 && { plugins },
 			...locale && { locale },
 			...auth.organizations && { organizations: {

package/dist/calls/call-hub.js

@@ -5,9 +5,10 @@ import { randomUUID } from "node:crypto";
 const signalsPerSecond = 100;
 /** How often the signals for this process are read, with several processes. */
 const signalsEveryMs = 100;
-const rosterOf = (members) => members.map(({ member, joined_at }) => ({
+const rosterOf = (members) => members.map(({ member, joined_at, name }) => ({
 	member,
-	joined_at
+	joined_at,
+	...name !== null && { name }
 }));
 /**
 * The members this process serves, in their calls, whose records the `calls` schema keeps. A member is in only while
@@ -16,7 +17,7 @@ const rosterOf = (members) => members.map(({ member, joined_at }) => ({
 * member of the same call only, straight to their socket here, or through the `calls` schema to the process that
 * serves them.
 */
-const callHub = ({ store, manyProcesses, report }) => {
+const callHub = ({ store, manyProcesses, report, lobbies }) => {
 	const process = randomUUID();
 	const locals = /* @__PURE__ */ new Map();
 	const known = /* @__PURE__ */ new Map();
@@ -50,10 +51,29 @@ const callHub = ({ store, manyProcesses, report }) => {
 			local.listener?.(members);
 		}
 	};
-	/** Reads who is in these calls and tells their members here. */
+	const tellLobbies = async (calls) => {
+		const asked = calls.filter((call) => ofCall(call).some((local) => local.invites && local.listener));
+		if (!lobbies || asked.length === 0) return;
+		const found = await lobbies(asked);
+		for (const call of asked) {
+			const lobby = found.get(call);
+			if (!lobby) continue;
+			const body = JSON.stringify(lobby);
+			for (const local of ofCall(call)) {
+				if (!local.invites || !local.listener || local.lobby === body) continue;
+				local.lobby = body;
+				local.link.send({
+					type: "lobby",
+					...lobby
+				});
+			}
+		}
+	};
+	/** Reads who is in these calls, and their lobbies, and tells their members here. */
 	const refresh = async (calls) => {
 		const found = await store.rosters(calls);
 		for (const call of calls) apply(call, found.get(call));
+		await tellLobbies(calls);
 	};
 	const deliver = (call, to, from, body) => {
 		ofCall(call).find((local) => local.member === to)?.link.send({
@@ -113,9 +133,9 @@ const callHub = ({ store, manyProcesses, report }) => {
 		/**
 		* Lets the member in, or says why not. Once in, `listen` gets who is in the call; `leave` ends their time in it,
 		* `detach` only stops this process hearing of them, as when their socket was lost: they are out `graceSeconds`
-		* later unless their browser resumes.
+		* later unless their browser resumes. A member who `invites` is told of the call's lobby too.
 		*/
-		admit: async (input, link) => {
+		admit: async ({ invites = false, ...input }, link) => {
 			const admitted = await store.admit({
 				...input,
 				process
@@ -126,7 +146,8 @@ const callHub = ({ store, manyProcesses, report }) => {
 				member: input.member,
 				row: admitted.row,
 				link,
-				signals: fixedWindow(signalsPerSecond, 1e3)
+				signals: fixedWindow(signalsPerSecond, 1e3),
+				invites: invites && lobbies !== void 0
 			};
 			for (const before of ofCall(admitted.call)) if (before.member === input.member && before.row === admitted.row) drop(before, "removed");
 			locals.set(local.row, local);

package/dist/calls/call-member.d.ts

@@ -19,12 +19,16 @@ export type CallMember = CallRights & {
   };
   /**
    * Who joins, unique in the call, such as the signed-in user's id: take it from the caller, never from the request,
-   * since the other members know them by it.
+   * since the other members know them by it. Never `guest:…`, which guests are.
    */
   member: string;
   /** The function's own checks, repeated every minute after the record's, such as whether the caller is still invited. */
   recheck?: () => unknown;
   /** Whom the call rings, on any page of the app they have open, when this join starts it. */
   ring?: CallRingInput;
+  /** Whether the member may share guest links to the call and let its guests in; `false` by default. */
+  invites?: boolean;
+  /** The name the others in the call see, such as the user's name; guests see no other. */
+  name?: string;
 };
 //#endregion

package/dist/calls/call-reads.d.ts

@@ -2,15 +2,19 @@ import "./call-store.js";
 import { CallRemoteTrack } from "@protobase/schema/internal";
 import { Db } from "@protobase/query";
 //#region src/calls/call-reads.d.ts
-/** Someone in a call now: their members row, the process that serves them and the tracks they send. */
+/** Someone in a call now: their members row, the process that serves them, the tracks they send and the name they show. */
 export type RosterMember = {
   row: string;
   member: string;
   process: string;
   joined_at: string;
   tracks: CallRemoteTrack[];
+  name: string | null;
 };
-/** A call as the record's readers see it: who started it, when, when it ended, who is in it and who was removed. */
+/**
+ * A call as the record's readers see it: who started it, when, when it ended, who is in it, with the name they show
+ * when they have one, and who was removed.
+ */
 export type CallItem = {
   id: string;
   started_by: string;
@@ -20,6 +24,7 @@ export type CallItem = {
   members: {
     member: string;
     joined_at: string;
+    name?: string;
   }[];
   removed: {
     member: string;

package/dist/calls/call-reads.js

@@ -7,7 +7,7 @@ const rosters = async (db, calls) => {
 	const found = /* @__PURE__ */ new Map();
 	if (calls.length === 0) return found;
 	const { rows } = await sql`
-    select c."id"::text as call, c."ended_at" is not null as ended, m."id"::text as row, m."member", m."process"::text as process, ${iso("m.\"joined_at\"")} as joined_at, m."tracks"
+    select c."id"::text as call, c."ended_at" is not null as ended, m."id"::text as row, m."member", m."process"::text as process, ${iso("m.\"joined_at\"")} as joined_at, m."tracks", m."name"
     from "calls"."calls" c left join "calls"."members" m on m."call_id" = c."id" and m."left_at" is null
     where c."id" = any(${ids(calls)}::uuid[]) order by c."id", m."joined_at", m."id"`.execute(db);
 	for (const row of rows) {
@@ -21,7 +21,8 @@ const rosters = async (db, calls) => {
 			member: row.member,
 			process: row.process,
 			joined_at: row.joined_at,
-			tracks: row.tracks
+			tracks: row.tracks,
+			name: row.name
 		});
 	}
 	return found;
@@ -41,7 +42,7 @@ const recordCalls = async (db, records) => {
     order by c."ended_at" is not null, c."started_at" desc, c."id"`.execute(db);
 	if (calls.rows.length === 0) return found;
 	const members = await sql`
-    select "call_id"::text as call, "member", ${iso("\"joined_at\"")} as joined_at, ${iso("\"removed_at\"")} as removed_at
+    select "call_id"::text as call, "member", ${iso("\"joined_at\"")} as joined_at, ${iso("\"removed_at\"")} as removed_at, "name"
     from "calls"."members" where "call_id" = any(${ids(calls.rows.map((call) => call.id))}::uuid[]) and ("left_at" is null or "removed_at" is not null)
     order by "joined_at", "id"`.execute(db);
 	const items = /* @__PURE__ */ new Map();
@@ -64,7 +65,8 @@ const recordCalls = async (db, records) => {
 		const item = items.get(row.call);
 		if (row.removed_at === null) item.members.push({
 			member: row.member,
-			joined_at: row.joined_at
+			joined_at: row.joined_at,
+			...row.name !== null && { name: row.name }
 		});
 		else item.removed.push({
 			member: row.member,

package/dist/calls/call-store.d.ts

@@ -19,6 +19,13 @@ export type AdmitInput = {
   };
   maxMembers: number;
   maxMinutes: number;
+  /** The name the member shows the others: a guest's own, or the one the app gave. */
+  name?: string;
+  /** A guest, who comes only into the call their link is for, by their id; never starts one. */
+  guest?: {
+    id: string;
+    call: string;
+  };
 };
 /** The member in the call `call`, as the members row `row`, with whether their join started it; or why not. */
 export type Admission = {

package/dist/calls/call-store.js

@@ -32,31 +32,39 @@ const liveCall = async (trx, record, member, maxMinutes) => {
 	}
 	throw new Error(`The call on ${record.resource} ${record.key} could not be started`);
 };
-const enter = async (trx, call, member, process, tracks) => {
+const enter = async (trx, call, member, process, tracks, name) => {
 	const body = JSON.stringify(tracks);
-	const { rows } = await sql`update "calls"."members" set "process" = ${process}::uuid, "seen_at" = now(), "tracks" = ${body}::jsonb
+	const { rows } = await sql`update "calls"."members" set "process" = ${process}::uuid, "seen_at" = now(), "tracks" = ${body}::jsonb, "name" = ${name}
     where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
 	if (rows[0]) return rows[0].id;
-	return (await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at")
-    values (${call}::uuid, ${member}, ${process}::uuid, ${body}::jsonb, now(), now()) returning "id"::text as id`.execute(trx)).rows[0].id;
+	return (await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "name")
+    values (${call}::uuid, ${member}, ${process}::uuid, ${body}::jsonb, now(), now(), ${name}) returning "id"::text as id`.execute(trx)).rows[0].id;
+};
+const resumed = async (trx, record, call) => {
+	const found = isCallId(call) ? await lockCall(trx, call) : void 0;
+	if (!found || found.ended || found.resource !== record.resource || found.record_key !== record.key) return;
+	if (!found.expired) return found.id;
+	await endCall(trx, found.id);
 };
 /**
 * Lets the member into the record's call, or the call they resume, when they may: one transaction, the call's row
 * locked. The members whose process stopped hearing of them are out first. A resume of a call that ended, or that is
-* on another record, is refused as ended; a fresh join to a record without a call going on starts one.
+* on another record, is refused as ended; a fresh join to a record without a call going on starts one. A guest comes
+* only into their link's call, while `guestAllowed` lets them, and never starts one.
 */
-const admit = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
-	const { record, member, resume } = input;
+const admit = (db, timeoutMs, input, guestAllowed) => writeTransaction(db, timeoutMs, async (trx) => {
+	const { record, member, resume, guest } = input;
 	let call;
 	let started = false;
-	if (resume) {
-		const resumed = isCallId(resume.call) ? await lockCall(trx, resume.call) : void 0;
-		if (!resumed || resumed.ended || resumed.resource !== record.resource || resumed.record_key !== record.key) return { refused: "ended" };
-		if (resumed.expired) {
-			await endCall(trx, resumed.id);
-			return { refused: "ended" };
-		}
-		call = resumed.id;
+	if (guest) {
+		if (resume && resume.call !== guest.call) return { refused: "ended" };
+		const going = await resumed(trx, record, guest.call);
+		if (!going || !guestAllowed || !await guestAllowed(trx, guest.id)) return { refused: "ended" };
+		call = going;
+	} else if (resume) {
+		const going = await resumed(trx, record, resume.call);
+		if (!going) return { refused: "ended" };
+		call = going;
 	} else {
 		const live = await liveCall(trx, record, member, input.maxMinutes);
 		call = live.id;
@@ -75,7 +83,7 @@ const admit = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (t
 	if (refused) return { refused };
 	return {
 		call,
-		row: await enter(trx, call, member, input.process, resume?.tracks ?? []),
+		row: await enter(trx, call, member, input.process, resume?.tracks ?? [], input.name ?? null),
 		started
 	};
 });
@@ -96,16 +104,19 @@ const leave = (db, timeoutMs, row, process) => writeTransaction(db, timeoutMs, a
 const remove = (db, timeoutMs, callId, member) => writeTransaction(db, timeoutMs, async (trx) => {
 	const call = isCallId(callId) ? await lockCall(trx, callId) : void 0;
 	if (!call || call.ended) return false;
-	const { rows } = await sql`update "calls"."members" set "left_at" = now(), "removed_at" = now()
-      where "call_id" = ${call.id}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
-	if (rows.length === 0) {
-		await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "left_at", "removed_at")
-        values (${call.id}::uuid, ${member}, ${nobody}::uuid, '[]'::jsonb, now(), now(), now(), now())`.execute(trx);
-		return false;
-	}
+	if (!await removeMember(trx, call.id, member)) return false;
 	await endIfEmpty(trx, call.id);
 	return true;
 });
+/** `remove`'s change, in a transaction that holds the call's row: whether the member was in the call. */
+const removeMember = async (trx, call, member) => {
+	const { rows } = await sql`update "calls"."members" set "left_at" = now(), "removed_at" = now()
+    where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
+	if (rows.length > 0) return true;
+	await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "left_at", "removed_at")
+    values (${call}::uuid, ${member}, ${nobody}::uuid, '[]'::jsonb, now(), now(), now(), now())`.execute(trx);
+	return false;
+};
 /** The tracks the member of row `row` sends now, while `process` serves them. */
 const setTracks = async (db, row, process, tracks) => {
 	await sql`update "calls"."members" set "tracks" = ${JSON.stringify(tracks)}::jsonb
@@ -124,4 +135,4 @@ const callRecord = async (db, call) => {
 	return rows[0];
 };
 //#endregion
-export { admit, callRecord, endCall, heartbeat, isCallId, leave, remove, setTracks };
+export { admit, callRecord, endCall, endIfEmpty, heartbeat, isCallId, leave, lockCall, remove, removeMember, setTracks };

package/dist/calls/call-sweep.js

@@ -4,22 +4,24 @@ import { sql } from "kysely";
 //#region src/calls/call-sweep.ts
 /** How long a signal between processes is kept: long after it was read. */
 const signalSeconds = 60;
+const toEnd = (seconds) => sql`("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null)
+  or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."member" not like 'guest:%' and (m."left_at" is null or m."left_at" > now() - make_interval(secs => ${seconds}))))`;
 /**
 * Ends what should have ended, over every call, whichever process served it: the members no process heard of within
 * `graceSeconds`, as after their socket was lost or their process stopped; the calls past their last minute; the
-* calls nobody is in any more. A call an admission holds is left to the next sweep. Old signals go too. The records
-* whose calls it changed.
+* calls nobody is in any more, and those with only guests in them `guestOnly` seconds after the last of the app's
+* members left. A call an admission holds is left to the next sweep. Old signals go too. The records whose calls it
+* changed.
 */
-const sweepCalls = (db, timeoutMs) => writeTransaction(db, timeoutMs, async (trx) => {
+const sweepCalls = (db, timeoutMs, guestOnly = 120) => writeTransaction(db, timeoutMs, async (trx) => {
 	const left = await sql`update "calls"."members" set "left_at" = now()
       where "left_at" is null and "seen_at" < now() - make_interval(secs => ${30}) returning "call_id"::text as id`.execute(trx);
 	const changed = new Set(left.rows.map((row) => row.id));
-	const { rows } = await sql`select "id"::text as id from "calls"."calls" c where "ended_at" is null
-      and ("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null))
+	const { rows } = await sql`select "id"::text as id from "calls"."calls" c where "ended_at" is null and ${toEnd(guestOnly)}
       for update skip locked`.execute(trx);
 	if (rows.length > 0) {
 		const ended = await sql`select "id"::text as id from "calls"."calls" c where "id" = any(${`{${rows.map((row) => row.id).join(",")}}`}::uuid[])
-        and ("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null))`.execute(trx);
+        and ${toEnd(guestOnly)}`.execute(trx);
 		for (const { id } of ended.rows) {
 			await endCall(trx, id);
 			changed.add(id);

package/dist/calls/calls-access.js

@@ -1,11 +1,14 @@
 import { forbidden } from "../problem.js";
+import { isGuestMember } from "./guest-tokens.js";
 import { checkRing } from "./call-ring.js";
 //#region src/calls/calls-access.ts
 /** The largest message of a member's socket: a description, with room to spare. */
 const maxMessageBytes = 307200;
-const checkMember = ({ record, member }) => {
+const checkMember = ({ record, member, name }) => {
 	if (typeof record?.resource !== "string" || record.resource.length === 0) throw new TypeError("calls.join needs the record, { resource, key }");
 	if (typeof member !== "string" || member.length === 0) throw new TypeError("calls.join needs the member, a non-empty string");
+	if (isGuestMember(member)) throw new TypeError("calls.join takes no member that starts with guest:, which only guests are");
+	if (name !== void 0 && (typeof name !== "string" || name.length > 200)) throw new TypeError("calls.join takes a name of at most 200 characters");
 };
 const withoutCalls = () => Promise.reject(/* @__PURE__ */ new Error("This app has no calls: configure calls: { backend } in protobase.config.ts"));
 /**
@@ -30,7 +33,9 @@ const callsAccess = (service, caller) => {
 			const ring = member.ring && checkRing(member.ring);
 			const by = {
 				user: String(session.user.id),
-				...ring && { ring }
+				...ring && { ring },
+				...member.invites === true && { invites: true },
+				...member.name !== void 0 && { name: member.name }
 			};
 			return {
 				...await (await service.runtime()).relay(record, member.member, {

package/dist/calls/calls-runtime.d.ts

@@ -4,10 +4,20 @@ import { CallRingInput } from "./call-ring.js";
 import { CallRights } from "./call-member.js";
 import { CallRecord } from "./call-store.js";
 import { CallItem } from "./call-reads.js";
+import { GuestRow } from "./guest-checks-sql.js";
 import { CallStore } from "./calls-store.js";
+import { OrganizationOf } from "./guest-links-sql.js";
+import { GuestStore } from "./guest-store.js";
 import { Ringer } from "./ringer.js";
 import { Db } from "@protobase/query";
 //#region src/calls/calls-runtime.d.ts
+/** Who a member is beyond their id: the signed-in user, whom the call rings, whether they invite guests, and their name. */
+export type RelayBy = {
+  user?: string;
+  ring?: CallRingInput;
+  invites?: boolean;
+  name?: string;
+};
 export type CallsRuntimeInput = {
   db: Db;
   timeoutMs: number;
@@ -15,6 +25,10 @@ export type CallsRuntimeInput = {
   report: (error: unknown) => void;
   /** Memory in tests; the `calls` schema otherwise. */
   store?: CallStore;
+  /** Guest links and the lobby: the `calls` schema, without `store`; none with a `store` of a test's unless given. */
+  guests?: GuestStore;
+  /** The organization of a call's record, which its guest links are for; none by default. */
+  organizationOf?: OrganizationOf;
   /** The rings of calls, which joins with a `ring` start. */
   rings?: Ringer;
   /** Tells the record's readers its calls changed, such as on the record's channel. */
@@ -25,12 +39,19 @@ export type CallsRuntimeInput = {
  * its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
  * as served and sweeps every call, whichever process served it; with neither, it runs no timer.
  */
-export declare const callsRuntime: ({ db, timeoutMs, options, report, store, rings, announce }: CallsRuntimeInput) => {
+export declare const callsRuntime: ({ db, timeoutMs, options, report, store: given, guests: givenGuests, organizationOf, rings, announce }: CallsRuntimeInput) => {
   /** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
-  relay: (record: CallRecord, member: string, rights: CallRights, by?: {
-    user?: string;
-    ring?: CallRingInput;
-  }) => Promise<SocketEvents>;
+  relay: (record: CallRecord, member: string, rights: CallRights, by?: RelayBy) => Promise<SocketEvents>;
+  /** The guest's socket, relayed like a member's, as member `guest:<id>` in their link's call only, sending what it allows. */
+  relayGuest: (guest: GuestRow) => Promise<SocketEvents>;
+  /** Guest links and the lobby, for the guests' routes. */
+  guests: () => GuestStore;
+  /** The organization's admin set whether its calls take guests: the calls this process serves hear of it at once. */
+  setOrganizationGuests: (input: {
+    organization: string;
+    allowed: boolean;
+    by: string;
+  }) => Promise<void>;
   /** Removes the member from the call, and only from it: whether they were in it. */
   remove: (call: string, member: string) => Promise<boolean>;
   /** The calls that ring the user now, and declining one. */