@protobase/server 0.62.4 → 0.63.0

package/dist/calls/calls-runtime.js

@@ -1,8 +1,10 @@
+import { guestMember } from "./guest-tokens.js";
 import { maxMembersOf } from "./calls-options.js";
 import { callHub } from "./call-hub.js";
 import { recordId } from "./call-reads.js";
 import { callWatch } from "./call-watch.js";
 import { sqlCallStore } from "./calls-store.js";
+import { sqlGuestStore } from "./guest-store.js";
 import { memberRelay } from "./member-relay.js";
 //#region src/calls/calls-runtime.ts
 /** How often the calls this process serves, and the records its pages follow, are read. */
@@ -18,11 +20,14 @@ const loadBackend = async (settings) => {
 * its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
 * as served and sweeps every call, whichever process served it; with neither, it runs no timer.
 */
-const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db, timeoutMs), rings, announce }) => {
+const callsRuntime = ({ db, timeoutMs, options, report, store: given, guests: givenGuests, organizationOf = async () => void 0, rings, announce }) => {
+	const store = given ?? sqlCallStore(db, timeoutMs);
+	const guests = given ? givenGuests : givenGuests ?? sqlGuestStore(db, timeoutMs, organizationOf);
 	const hub = callHub({
 		store,
 		manyProcesses: options.processes === "many",
-		report
+		report,
+		...guests && { lobbies: guests.lobbies }
 	});
 	const watch = callWatch(store);
 	const maxMembers = maxMembersOf(options.backend);
@@ -58,24 +63,59 @@ const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db,
 		}, readEveryMs);
 		timer.unref?.();
 	};
-	const door = { admit: async ({ user, ring, ...input }, link) => {
-		const admitted = await hub.admit(input, link);
-		schedule();
-		if ("refused" in admitted) return admitted;
-		changed([input.record]);
-		if (rings && user !== void 0) {
-			if (ring && admitted.started) await rings.start(admitted.call, input.record, user, ring).catch(report);
-			await rings.stop(admitted.call, user).catch(report);
-		}
-		return {
-			...admitted,
-			leave: async () => {
-				await admitted.leave();
-				changed([input.record]);
-				await rings?.settle();
+	const guestsChanged = async (call) => {
+		await hub.refresh([call]);
+		const record = await store.recordOf(call);
+		if (record) changed([record]);
+	};
+	const guestsOf = () => {
+		if (!guests) throw new Error("Not implemented: guests with a call store of a test");
+		return guests;
+	};
+	const door = {
+		admit: async ({ user, ring, ...input }, link) => {
+			const admitted = await hub.admit(input, link);
+			schedule();
+			if ("refused" in admitted) return admitted;
+			changed([input.record]);
+			if (rings && user !== void 0) {
+				if (ring && admitted.started) await rings.start(admitted.call, input.record, user, ring).catch(report);
+				await rings.stop(admitted.call, user).catch(report);
 			}
-		};
-	} };
+			return {
+				...admitted,
+				leave: async () => {
+					await admitted.leave();
+					changed([input.record]);
+					await rings?.settle();
+				}
+			};
+		},
+		...guests && { guests: {
+			link: async (input) => {
+				const made = await guests.createLink(input);
+				await hub.refresh([input.call]);
+				return made;
+			},
+			revoke: async (input) => {
+				const revoked = await guests.revokeLink(input);
+				await guestsChanged(input.call);
+				return revoked;
+			},
+			decide: async (input) => {
+				const decided = await guests.decide({
+					...input,
+					maxMembers
+				});
+				await hub.refresh([input.call]);
+				return decided;
+			},
+			remove: async (call, guest) => {
+				await store.remove(call, guestMember(guest));
+				await guestsChanged(call);
+			}
+		} }
+	};
 	return {
 		/** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
 		relay: async (record, member, rights, by = {}) => {
@@ -92,6 +132,31 @@ const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db,
 				...by
 			});
 		},
+		/** The guest's socket, relayed like a member's, as member `guest:<id>` in their link's call only, sending what it allows. */
+		relayGuest: async (guest) => {
+			backend ??= loadBackend(options.backend);
+			return memberRelay({
+				door,
+				backend: await backend,
+				record: guest.record,
+				member: guestMember(guest.id),
+				rights: { publish: guest.publish },
+				maxMembers,
+				maxMinutes,
+				report,
+				name: guest.name,
+				guest: {
+					id: guest.id,
+					call: guest.call
+				}
+			});
+		},
+		/** Guest links and the lobby, for the guests' routes. */
+		guests: guestsOf,
+		/** The organization's admin set whether its calls take guests: the calls this process serves hear of it at once. */
+		setOrganizationGuests: async (input) => {
+			for (const call of await guestsOf().setOrganization(input)) await guestsChanged(call);
+		},
 		/** Removes the member from the call, and only from it: whether they were in it. */
 		remove: async (call, member) => {
 			const record = await store.recordOf(call);

package/dist/calls/calls-service.js

@@ -7,10 +7,11 @@ import { appPath } from "@protobase/schema";
 const callsService = (deps, options, wiring) => {
 	let runtime;
 	const load = async () => {
-		const [{ callsRuntime }, { ringer, ringMessage }, { sqlRingStore }] = await Promise.all([
+		const [{ callsRuntime }, { ringer, ringMessage }, { sqlRingStore }, { recordOrganization }] = await Promise.all([
 			import("./calls-runtime.js"),
 			import("./ringer.js"),
-			import("./ring-store.js")
+			import("./ring-store.js"),
+			import("./record-organization.js")
 		]);
 		const { db, statementTimeoutMs, report, registry } = deps();
 		const recordUrl = ({ resource, key }) => wiring.origin === void 0 ? void 0 : new URL(appPath({
@@ -32,6 +33,7 @@ const callsService = (deps, options, wiring) => {
 					inbox: true
 				}, ringMessage(notification)) }
 			}),
+			...wiring.organizations && { organizationOf: recordOrganization(registry) },
 			announce: (record, items) => wiring.channels().broadcast({
 				resource: record.resource,
 				key: record.key,

package/dist/calls/calls-sql.d.ts

@@ -2,7 +2,7 @@ import { EventsOptions } from "../changes/events-options.js";
 import { Db } from "@protobase/query";
 //#region src/calls/calls-sql.d.ts
 /**
- * The SQL that adds the `calls` schema and its tables, and the changes schema's notices table rings reach open pages
+ * The SQL that adds the `calls` schema and its tables, or the guest tables to a calls schema without them, and the changes schema's notices table rings reach open pages
  * through, `undefined` when they are there. They are never dropped.
  */
 export declare const callsMigration: (db: Db, events?: EventsOptions) => Promise<string | undefined>;

package/dist/calls/calls-sql.js

@@ -5,6 +5,52 @@ import { migrationCommand } from "../changes/capture-schema.js";
 import { sql } from "kysely";
 //#region src/calls/calls-sql.ts
 /**
+* - `members.name`: the name a guest gave; NULL for the app's members, whom the app names.
+* - `guest_links`: a link that lets guests into one call, by the SHA-256 of its token: the member who made it, the
+*   organization of the call's record (NULL in an app without organizations), what a guest may send, until when it
+*   lets guests in (NULL: until the call ends) and when it was revoked.
+* - `guests`: someone who came in through a link, by the SHA-256 of their token, with the name they gave; `admitted`
+*   NULL while they wait, then whether a member let them in, who and when. They are member `guest:<id>` in the call.
+* - `organization_guests`: whether an organization's admin allows guest links to its calls; no row allows them.
+*/
+const guestsSchemaSql = `alter table "calls"."members" add column if not exists "name" text;
+
+create table if not exists "calls"."guest_links" (
+  "id" uuid primary key,
+  "call_id" uuid not null references "calls"."calls" ("id") on delete cascade,
+  "token_hash" bytea not null unique,
+  "created_by" text not null,
+  "organization_id" text,
+  "publish" jsonb not null,
+  "created_at" timestamptz not null,
+  "expires_at" timestamptz,
+  "revoked_at" timestamptz
+);
+create index if not exists "guest_links_call" on "calls"."guest_links" ("call_id");
+create index if not exists "guest_links_organization" on "calls"."guest_links" ("organization_id") where "revoked_at" is null;
+
+create table if not exists "calls"."guests" (
+  "id" uuid primary key,
+  "link_id" uuid not null references "calls"."guest_links" ("id") on delete cascade,
+  "call_id" uuid not null references "calls"."calls" ("id") on delete cascade,
+  "name" text not null,
+  "token_hash" bytea not null unique,
+  "entered_at" timestamptz not null,
+  "seen_at" timestamptz not null,
+  "admitted" boolean,
+  "decided_by" text,
+  "decided_at" timestamptz
+);
+create index if not exists "guests_waiting" on "calls"."guests" ("call_id") where "admitted" is null;
+create index if not exists "guests_link" on "calls"."guests" ("link_id");
+
+create table if not exists "calls"."organization_guests" (
+  "organization_id" text primary key,
+  "allowed" boolean not null,
+  "set_by" text not null,
+  "set_at" timestamptz not null
+);`;
+/**
 * - `calls`: a call on a record, by resource and encoded key: who started it, when, the latest it may end, and when it
 *   ended (NULL while it goes on). A record has at most one call going on. Its id is random, so it is unique beyond
 *   the app too, as the room of a media server other apps share.
@@ -14,6 +60,7 @@ import { sql } from "kysely";
 *   taken out by that process as it reads it, and deleted after a minute when no process did.
 * - `rings`: a user a call rang, by their id, with the ring's text, until when it rings, and when it stopped: they
 *   joined the call, declined, or the call ended.
+* - The guest tables, see `guestsSchemaSql`.
 */
 const callsSchemaSql = `create schema if not exists "calls";
 
@@ -67,23 +114,27 @@ create table if not exists "calls"."rings" (
   primary key ("call_id", "user_id")
 );
 create index if not exists "rings_user" on "calls"."rings" ("user_id", "until") where "stopped_at" is null;
-create index if not exists "rings_until" on "calls"."rings" ("until") where "stopped_at" is null;`;
+create index if not exists "rings_until" on "calls"."rings" ("until") where "stopped_at" is null;
+
+${guestsSchemaSql}`;
 const hasCallsTables = async (db) => (await sql`select to_regclass('calls.calls') is not null and to_regclass('calls.members') is not null and to_regclass('calls.signals') is not null and to_regclass('calls.rings') is not null as found`.execute(db)).rows[0].found;
+const hasGuestTables = async (db) => (await sql`select to_regclass('calls.guest_links') is not null and to_regclass('calls.guests') is not null and to_regclass('calls.organization_guests') is not null
+      and exists (select from information_schema.columns where table_schema = 'calls' and table_name = 'members' and column_name = 'name') as found`.execute(db)).rows[0].found;
 const noticesTable = (events) => `${quoteIdent(changesSchema(events))}."notices"`;
 const hasNotices = async (db, events) => (await sql`select to_regclass(${noticesTable(events)}) is not null as found`.execute(db)).rows[0].found;
 /**
-* The SQL that adds the `calls` schema and its tables, and the changes schema's notices table rings reach open pages
+* The SQL that adds the `calls` schema and its tables, or the guest tables to a calls schema without them, and the changes schema's notices table rings reach open pages
 * through, `undefined` when they are there. They are never dropped.
 */
 const callsMigration = async (db, events) => {
-	const statements = [...await hasCallsTables(db) ? [] : [callsSchemaSql], ...await hasNotices(db, events) ? [] : [`create schema if not exists ${quoteIdent(changesSchema(events))}`, noticesTableSql(changesSchema(events))]];
+	const statements = [...await hasCallsTables(db) ? await hasGuestTables(db) ? [] : [guestsSchemaSql] : [callsSchemaSql], ...await hasNotices(db, events) ? [] : [`create schema if not exists ${quoteIdent(changesSchema(events))}`, noticesTableSql(changesSchema(events))]];
 	return statements.length === 0 ? void 0 : `${statements.join(";\n\n")};`;
 };
 /** Refuses to go on while the app has `calls` and the database lacks their tables; the project's migrations add them. */
 const checkCalls = async (db, calls, events) => {
 	if (!calls) return;
-	if (await hasCallsTables(db) && await hasNotices(db, events)) return;
+	if (await hasCallsTables(db) && await hasGuestTables(db) && await hasNotices(db, events)) return;
 	throw new Error(`The calls schema or the notices table that rings go through is missing. Write them as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
-export { callsMigration, callsSchemaSql, checkCalls };
+export { callsMigration, callsSchemaSql, checkCalls, guestsSchemaSql };

package/dist/calls/calls-store.js

@@ -2,10 +2,11 @@ import { admit, callRecord, heartbeat, leave, remove, setTracks } from "./call-s
 import { recordCalls, rosters } from "./call-reads.js";
 import { takeSignals, writeSignal } from "./call-signals-sql.js";
 import { sweepCalls } from "./call-sweep.js";
+import { guestAllowed } from "./guest-checks-sql.js";
 //#region src/calls/calls-store.ts
 /** The `calls` schema of the app's database; writes under the API's statement timeout. */
 const sqlCallStore = (db, timeoutMs) => ({
-	admit: (input) => admit(db, timeoutMs, input),
+	admit: (input) => admit(db, timeoutMs, input, guestAllowed),
 	leave: (row, process) => leave(db, timeoutMs, row, process),
 	remove: (call, member) => remove(db, timeoutMs, call, member),
 	setTracks: (row, process, tracks) => setTracks(db, row, process, tracks),

package/dist/calls/client-message.js

@@ -38,10 +38,17 @@ const description = z.strictObject({
 	type: z.enum(["offer", "answer"]),
 	sdp
 });
+const uuid = z.uuid();
+const guest = z.string().min(1).max(128).optional();
+const ahead = z.iso.datetime({ offset: true }).refine((value) => Date.parse(value) > Date.now(), "A link expires in the future");
 const message = z.discriminatedUnion("type", [
-	z.strictObject({ type: z.literal("join") }),
+	z.strictObject({
+		type: z.literal("join"),
+		guest
+	}),
 	z.strictObject({
 		type: z.literal("resume"),
+		guest,
 		call: id,
 		participant: id,
 		offer: sdp.optional(),
@@ -88,7 +95,25 @@ const message = z.discriminatedUnion("type", [
 		height: size,
 		hidden: z.boolean().optional()
 	}),
-	z.strictObject({ type: z.literal("leave") })
+	z.strictObject({ type: z.literal("leave") }),
+	z.strictObject({
+		type: z.literal("guest-link"),
+		publish: z.array(source).max(4),
+		expires_at: ahead.optional()
+	}),
+	z.strictObject({
+		type: z.literal("guest-link-revoke"),
+		link: uuid
+	}),
+	z.strictObject({
+		type: z.literal("guest-decide"),
+		guest: uuid,
+		admit: z.boolean()
+	}),
+	z.strictObject({
+		type: z.literal("guest-remove"),
+		guest: uuid
+	})
 ]);
 /** A browser's message, or `undefined` when it is no message of the call protocol. */
 const parseClientMessage = (data) => {

package/dist/calls/guest-checks-sql.d.ts

@@ -0,0 +1,14 @@
+import { CallRecord } from "./call-store.js";
+import { CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-checks-sql.d.ts
+/** A guest by their token's hash: their call, its record, their name, what they may send and whether they were let in. */
+export type GuestRow = {
+  id: string;
+  call: string;
+  record: CallRecord;
+  name: string;
+  publish: CallTrackSource[];
+  admitted: boolean | null;
+};
+//#endregion

package/dist/calls/guest-checks-sql.js

@@ -0,0 +1,43 @@
+import { guestMember } from "./guest-tokens.js";
+import { sql } from "kysely";
+//#region src/calls/guest-checks-sql.ts
+/** A link that still lets guests in: not revoked, not expired, and its organization's admin did not turn guests off. */
+const liveLink = (link) => sql.raw(`${link}."revoked_at" is null and (${link}."expires_at" is null or ${link}."expires_at" > now())
+    and not exists (select from "calls"."organization_guests" o where o."organization_id" = ${link}."organization_id" and not o."allowed")`);
+/**
+* Whether the guest may be in their call now: let in by a member, through a link that is still live, and not removed
+* from the call. The call's own end the caller checks under its row lock.
+*/
+const guestAllowed = async (trx, guest) => {
+	const { rows } = await sql`select g."id"::text as id from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+    where g."id" = ${guest}::uuid and g."admitted" and ${liveLink("l")}
+    and not exists (select from "calls"."members" m where m."call_id" = g."call_id" and m."member" = ${guestMember(guest)} and m."removed_at" is not null)`.execute(trx);
+	return rows.length > 0;
+};
+/** Whether the guest may still be in their call, the call going on: the minute's check of a guest's socket. */
+const guestStillAllowed = async (db, guest) => {
+	const { rows } = await sql`select c."ended_at" is null and c."ends_at" > now() as live
+    from "calls"."guests" g join "calls"."calls" c on c."id" = g."call_id" where g."id" = ${guest}::uuid`.execute(db);
+	return Boolean(rows[0]?.live) && await guestAllowed(db, guest);
+};
+const guestByToken = async (db, hash) => {
+	const { rows } = await sql`
+    select g."id"::text as id, g."call_id"::text as call, c."resource", c."record_key" as key, g."name", l."publish", g."admitted"
+    from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id" join "calls"."calls" c on c."id" = g."call_id"
+    where g."token_hash" = ${hash}`.execute(db);
+	const row = rows[0];
+	if (!row) return;
+	return {
+		id: row.id,
+		call: row.call,
+		record: {
+			resource: row.resource,
+			key: row.key
+		},
+		name: row.name,
+		publish: row.publish,
+		admitted: row.admitted
+	};
+};
+//#endregion
+export { guestAllowed, guestByToken, guestStillAllowed, liveLink };

package/dist/calls/guest-limits.js

@@ -0,0 +1,49 @@
+//#region src/calls/guest-limits.ts
+/**
+* Counts per key in a fixed window of `windowMs`, which all keys share: every count starts over when it turns, so
+* memory follows the keys of the current window.
+*/
+const windowCounts = (windowMs, now = () => Date.now()) => {
+	let start = -Infinity;
+	let counts = /* @__PURE__ */ new Map();
+	const turn = () => {
+		if (now() - start < windowMs) return;
+		start = now();
+		counts = /* @__PURE__ */ new Map();
+	};
+	return {
+		count: (key) => {
+			turn();
+			return counts.get(key) ?? 0;
+		},
+		add: (key) => {
+			turn();
+			counts.set(key, (counts.get(key) ?? 0) + 1);
+		}
+	};
+};
+/** The lobby's limits, per process: by address, and by guest. */
+const guestLimits = (now = () => Date.now()) => {
+	const entries = windowCounts(6e4, now);
+	const refusals = windowCounts(6e4, now);
+	const polls = windowCounts(6e4, now);
+	return {
+		/** Whether the address sent too many refused tokens this minute. */
+		blocked: (address) => refusals.count(address) >= 10,
+		refused: (address) => refusals.add(address),
+		/** Takes one entry of the address: whether it fits. */
+		enter: (address) => {
+			if (entries.count(address) >= 5) return false;
+			entries.add(address);
+			return true;
+		},
+		/** Takes one ask of the guest: whether it fits. */
+		poll: (guest) => {
+			if (polls.count(guest) >= 120) return false;
+			polls.add(guest);
+			return true;
+		}
+	};
+};
+//#endregion
+export { guestLimits, windowCounts };

package/dist/calls/guest-links-sql.d.ts

@@ -0,0 +1,16 @@
+import { CallRecord } from "./call-store.js";
+import { CallGuestLink, CallGuestRefusal, CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-links-sql.d.ts
+/**
+ * The organization a record is in, as the app keeps it: `undefined` in an app without organizations, `null` for a
+ * record of a resource without a tenant in an app with them, which no admin's switch could cover.
+ */
+export type OrganizationOf = (trx: Db, record: CallRecord) => Promise<string | null | undefined>;
+export type CreateLinkInput = {
+  call: string;
+  member: string;
+  publish: CallTrackSource[];
+  expiresAt?: Date;
+};
+//#endregion

package/dist/calls/guest-links-sql.js

@@ -0,0 +1,78 @@
+import { writeTransaction } from "../transactions.js";
+import { endIfEmpty, lockCall, removeMember } from "./call-store.js";
+import { guestMember, isGuestMember, linkTokenPrefix, newToken, tokenHash } from "./guest-tokens.js";
+import { sql } from "kysely";
+//#region src/calls/guest-links-sql.ts
+const iso = (column) => sql.raw(`to_char(${column} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`);
+/** Whether `member` is in the call now, as one of the app's members, never a guest. */
+const presentMember = async (trx, call, member) => !isGuestMember(member) && (await sql`select "id"::text as id from "calls"."members" where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null`.execute(trx)).rows.length > 0;
+const allowedIn = async (trx, organization) => (await sql`select "allowed" from "calls"."organization_guests" where "organization_id" = ${organization}`.execute(trx)).rows[0]?.allowed !== false;
+/**
+* A new link to the call, made by a member in it, for the organization of the call's own record, read in the
+* transaction that holds the call's row; refused when the call is over, the member is not in it, or the organization
+* turned guests off. Its token is returned once, and only its hash kept.
+*/
+const createLink = (db, timeoutMs, organizationOf, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || call.expired || !await presentMember(trx, call.id, input.member)) return { refused: "gone" };
+	const organization = await organizationOf(trx, {
+		resource: call.resource,
+		key: call.record_key
+	});
+	if (organization === null) return { refused: "no-organization" };
+	if (organization !== void 0 && !await allowedIn(trx, organization)) return { refused: "off" };
+	const token = newToken(linkTokenPrefix);
+	const { rows } = await sql`insert into "calls"."guest_links" ("id", "call_id", "token_hash", "created_by", "organization_id", "publish", "created_at", "expires_at")
+      values (gen_random_uuid(), ${call.id}::uuid, ${tokenHash(linkTokenPrefix, token)}, ${input.member}, ${organization ?? null}, ${JSON.stringify(input.publish)}::jsonb, now(), ${input.expiresAt ?? null})
+      returning "id"::text as id, ${iso("\"expires_at\"")} as expires_at`.execute(trx);
+	const row = rows[0];
+	return {
+		link: {
+			id: row.id,
+			created_by: input.member,
+			publish: input.publish,
+			expires_at: row.expires_at
+		},
+		token
+	};
+});
+const revokeIn = async (trx, call, link, by) => {
+	await sql`update "calls"."guest_links" set "revoked_at" = now() where "id" = ${link}::uuid and "revoked_at" is null`.execute(trx);
+	await sql`update "calls"."guests" set "admitted" = false, "decided_by" = ${by}, "decided_at" = now() where "link_id" = ${link}::uuid and "admitted" is null`.execute(trx);
+	const { rows } = await sql`select "id"::text as id from "calls"."guests" where "link_id" = ${link}::uuid and "admitted"`.execute(trx);
+	for (const guest of rows) await removeMember(trx, call, guestMember(guest.id));
+	await endIfEmpty(trx, call);
+};
+/** A member in the call revokes one of its links: its guests are out. Whether it was the call's and still live. */
+const revokeLink = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || !await presentMember(trx, call.id, input.member)) return false;
+	const { rows } = await sql`select "id"::text as id from "calls"."guest_links" where "id" = ${input.link}::uuid and "call_id" = ${call.id}::uuid and "revoked_at" is null`.execute(trx);
+	if (rows.length === 0) return false;
+	await revokeIn(trx, call.id, input.link, input.member);
+	return true;
+});
+/**
+* Whether the organization's admin allows guest links to its calls. Turning them off revokes every live link of the
+* organization at once, each under its call's row lock in the order of the calls, and takes their guests out: the
+* calls it changed.
+*/
+const setOrganizationGuests = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	await sql`insert into "calls"."organization_guests" ("organization_id", "allowed", "set_by", "set_at") values (${input.organization}, ${input.allowed}, ${input.by}, now())
+      on conflict ("organization_id") do update set "allowed" = excluded."allowed", "set_by" = excluded."set_by", "set_at" = excluded."set_at"`.execute(trx);
+	if (input.allowed) return [];
+	const { rows } = await sql`select "id"::text as id, "call_id"::text as call from "calls"."guest_links"
+      where "organization_id" = ${input.organization} and "revoked_at" is null order by "call_id", "id"`.execute(trx);
+	const calls = /* @__PURE__ */ new Set();
+	for (const link of rows) {
+		const call = await lockCall(trx, link.call);
+		if (!call || call.ended) continue;
+		await revokeIn(trx, call.id, link.id, input.by);
+		calls.add(call.id);
+	}
+	return [...calls];
+});
+/** Whether the organization allows guest links: yes until its admin turned them off. */
+const organizationGuests = (db, organization) => allowedIn(db, organization);
+//#endregion
+export { createLink, organizationGuests, presentMember, revokeLink, setOrganizationGuests };

package/dist/calls/guest-lobby-sql.d.ts

@@ -0,0 +1,17 @@
+import { CallGuestLink, CallGuestRefusal, CallGuestState, CallLobbyGuest, CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-lobby-sql.d.ts
+/** What a guest's page learns of its wait: only its state, and once let in the call's id and what it may send. */
+export type LobbyState = {
+  state: CallGuestState;
+  call?: string;
+  publish?: CallTrackSource[];
+};
+export type DecideInput = {
+  call: string;
+  guest: string;
+  member: string;
+  admit: boolean;
+  maxMembers: number;
+};
+//#endregion

package/dist/calls/guest-lobby-sql.js

@@ -0,0 +1,81 @@
+import { writeTransaction } from "../transactions.js";
+import { lockCall } from "./call-store.js";
+import { liveLink } from "./guest-checks-sql.js";
+import { presentMember } from "./guest-links-sql.js";
+import { sql } from "kysely";
+//#region src/calls/guest-lobby-sql.ts
+const iso = (column) => sql.raw(`to_char(${column} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`);
+/**
+* A guest waits in the lobby of the link's call, by the name they gave and the hash of the token they were given;
+* refused, the same way for each cause, when the link is unknown or no longer live, its call is over, it turned away
+* `maxDenials` guests, or `maxWaiting` already wait on it. The call's row is locked.
+*/
+const enterLobby = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const link = (await sql`select l."id"::text as id, l."call_id"::text as call from "calls"."guest_links" l where l."token_hash" = ${input.link} and ${liveLink("l")}`.execute(trx)).rows[0];
+	const call = link && await lockCall(trx, link.call);
+	if (!link || !call || call.ended || call.expired) return { refused: "gone" };
+	const { rows } = await sql`select count(*) filter (where "admitted" is null and "seen_at" > now() - make_interval(secs => ${10}))::int as waiting,
+      count(*) filter (where "admitted" = false)::int as denied from "calls"."guests" where "link_id" = ${link.id}::uuid`.execute(trx);
+	if (rows[0].waiting >= 10 || rows[0].denied >= 3) return { refused: "gone" };
+	return { guest: (await sql`insert into "calls"."guests" ("id", "link_id", "call_id", "name", "token_hash", "entered_at", "seen_at")
+      values (gen_random_uuid(), ${link.id}::uuid, ${call.id}::uuid, ${input.name}, ${input.token}, now(), now()) returning "id"::text as id`.execute(trx)).rows[0].id };
+});
+/** The guest's wait, by their token's hash, which tells the lobby they are still there; `undefined` for an unknown token. */
+const lobbyState = async (db, token) => {
+	const { rows } = await sql`
+    update "calls"."guests" g set "seen_at" = now() from "calls"."guest_links" l, "calls"."calls" c
+    where g."token_hash" = ${token} and l."id" = g."link_id" and c."id" = g."call_id"
+    returning g."call_id"::text as call, g."admitted", (${liveLink("l")} and c."ended_at" is null and c."ends_at" > now()) as live, l."publish"`.execute(db);
+	const row = rows[0];
+	if (!row) return;
+	if (row.admitted === false) return { state: "denied" };
+	if (!row.live) return { state: "ended" };
+	if (row.admitted === null) return { state: "waiting" };
+	return {
+		state: "admitted",
+		call: row.call,
+		publish: row.publish
+	};
+};
+/** A waiting guest leaves the lobby: their wait is gone. */
+const leaveLobby = async (db, token) => {
+	await sql`delete from "calls"."guests" where "token_hash" = ${token} and "admitted" is null`.execute(db);
+};
+/**
+* A member in the call lets a guest waiting on one of its live links in, or turns them away; refused when the guest no
+* longer waits there, or, to let them in, when the call has no room now. The call's row is locked, so racing decisions
+* come one after the other; the guest's own join is checked against the room again.
+*/
+const decideGuest = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || call.expired || !await presentMember(trx, call.id, input.member)) return { refused: "gone" };
+	const { rows } = await sql`select g."id"::text as id from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+      where g."id" = ${input.guest}::uuid and g."call_id" = ${call.id}::uuid and g."admitted" is null and ${liveLink("l")}`.execute(trx);
+	if (rows.length === 0) return { refused: "gone" };
+	if (input.admit) {
+		const { rows: present } = await sql`select count(*)::int as n from "calls"."members" where "call_id" = ${call.id}::uuid and "left_at" is null`.execute(trx);
+		if (present[0].n >= input.maxMembers) return { refused: "full" };
+	}
+	await sql`update "calls"."guests" set "admitted" = ${input.admit}, "decided_by" = ${input.member}, "decided_at" = now() where "id" = ${input.guest}::uuid`.execute(trx);
+	return {};
+});
+/** Each call's lobby, as its members who may invite see it: the guests waiting now, and its live links. */
+const lobbies = async (db, calls) => {
+	const found = new Map(calls.map((call) => [call, {
+		guests: [],
+		links: []
+	}]));
+	if (calls.length === 0) return found;
+	const ids = `{${calls.join(",")}}`;
+	const links = await sql`select l."call_id"::text as call, l."id"::text as id, l."created_by", l."publish", ${iso("l.\"expires_at\"")} as expires_at
+    from "calls"."guest_links" l where l."call_id" = any(${ids}::uuid[]) and ${liveLink("l")} order by l."created_at", l."id"`.execute(db);
+	for (const { call, ...link } of links.rows) found.get(call).links.push(link);
+	const guests = await sql`select g."call_id"::text as call, g."id"::text as guest, g."name", ${iso("g.\"entered_at\"")} as since
+    from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+    where g."call_id" = any(${ids}::uuid[]) and g."admitted" is null and g."seen_at" > now() - make_interval(secs => ${10}) and ${liveLink("l")}
+    order by g."entered_at", g."id"`.execute(db);
+	for (const { call, ...guest } of guests.rows) found.get(call).guests.push(guest);
+	return found;
+};
+//#endregion
+export { decideGuest, enterLobby, leaveLobby, lobbies, lobbyState };

package/dist/calls/guest-name.js

@@ -0,0 +1,10 @@
+import { badRequest } from "../problem.js";
+/** The name a guest gives, trimmed: 1 to 60 characters, none of them a control or format character. */
+const guestName = (value) => {
+	const name = typeof value === "string" ? value.trim() : "";
+	if (name.length === 0 || [...name].length > 60) throw badRequest("guest-name", `Give a name of 1 to 60 characters`);
+	if (/\p{C}/u.test(name)) throw badRequest("guest-name", "A name cannot hold control characters");
+	return name;
+};
+//#endregion
+export { guestName };