@protobase/server 0.62.5 → 0.63.0

package/dist/calls/calls-sql.js

@@ -5,6 +5,52 @@ import { migrationCommand } from "../changes/capture-schema.js";
 import { sql } from "kysely";
 //#region src/calls/calls-sql.ts
 /**
+* - `members.name`: the name a guest gave; NULL for the app's members, whom the app names.
+* - `guest_links`: a link that lets guests into one call, by the SHA-256 of its token: the member who made it, the
+*   organization of the call's record (NULL in an app without organizations), what a guest may send, until when it
+*   lets guests in (NULL: until the call ends) and when it was revoked.
+* - `guests`: someone who came in through a link, by the SHA-256 of their token, with the name they gave; `admitted`
+*   NULL while they wait, then whether a member let them in, who and when. They are member `guest:<id>` in the call.
+* - `organization_guests`: whether an organization's admin allows guest links to its calls; no row allows them.
+*/
+const guestsSchemaSql = `alter table "calls"."members" add column if not exists "name" text;
+
+create table if not exists "calls"."guest_links" (
+  "id" uuid primary key,
+  "call_id" uuid not null references "calls"."calls" ("id") on delete cascade,
+  "token_hash" bytea not null unique,
+  "created_by" text not null,
+  "organization_id" text,
+  "publish" jsonb not null,
+  "created_at" timestamptz not null,
+  "expires_at" timestamptz,
+  "revoked_at" timestamptz
+);
+create index if not exists "guest_links_call" on "calls"."guest_links" ("call_id");
+create index if not exists "guest_links_organization" on "calls"."guest_links" ("organization_id") where "revoked_at" is null;
+
+create table if not exists "calls"."guests" (
+  "id" uuid primary key,
+  "link_id" uuid not null references "calls"."guest_links" ("id") on delete cascade,
+  "call_id" uuid not null references "calls"."calls" ("id") on delete cascade,
+  "name" text not null,
+  "token_hash" bytea not null unique,
+  "entered_at" timestamptz not null,
+  "seen_at" timestamptz not null,
+  "admitted" boolean,
+  "decided_by" text,
+  "decided_at" timestamptz
+);
+create index if not exists "guests_waiting" on "calls"."guests" ("call_id") where "admitted" is null;
+create index if not exists "guests_link" on "calls"."guests" ("link_id");
+
+create table if not exists "calls"."organization_guests" (
+  "organization_id" text primary key,
+  "allowed" boolean not null,
+  "set_by" text not null,
+  "set_at" timestamptz not null
+);`;
+/**
 * - `calls`: a call on a record, by resource and encoded key: who started it, when, the latest it may end, and when it
 *   ended (NULL while it goes on). A record has at most one call going on. Its id is random, so it is unique beyond
 *   the app too, as the room of a media server other apps share.
@@ -14,6 +60,7 @@ import { sql } from "kysely";
 *   taken out by that process as it reads it, and deleted after a minute when no process did.
 * - `rings`: a user a call rang, by their id, with the ring's text, until when it rings, and when it stopped: they
 *   joined the call, declined, or the call ended.
+* - The guest tables, see `guestsSchemaSql`.
 */
 const callsSchemaSql = `create schema if not exists "calls";
 
@@ -67,23 +114,27 @@ create table if not exists "calls"."rings" (
   primary key ("call_id", "user_id")
 );
 create index if not exists "rings_user" on "calls"."rings" ("user_id", "until") where "stopped_at" is null;
-create index if not exists "rings_until" on "calls"."rings" ("until") where "stopped_at" is null;`;
+create index if not exists "rings_until" on "calls"."rings" ("until") where "stopped_at" is null;
+
+${guestsSchemaSql}`;
 const hasCallsTables = async (db) => (await sql`select to_regclass('calls.calls') is not null and to_regclass('calls.members') is not null and to_regclass('calls.signals') is not null and to_regclass('calls.rings') is not null as found`.execute(db)).rows[0].found;
+const hasGuestTables = async (db) => (await sql`select to_regclass('calls.guest_links') is not null and to_regclass('calls.guests') is not null and to_regclass('calls.organization_guests') is not null
+      and exists (select from information_schema.columns where table_schema = 'calls' and table_name = 'members' and column_name = 'name') as found`.execute(db)).rows[0].found;
 const noticesTable = (events) => `${quoteIdent(changesSchema(events))}."notices"`;
 const hasNotices = async (db, events) => (await sql`select to_regclass(${noticesTable(events)}) is not null as found`.execute(db)).rows[0].found;
 /**
-* The SQL that adds the `calls` schema and its tables, and the changes schema's notices table rings reach open pages
+* The SQL that adds the `calls` schema and its tables, or the guest tables to a calls schema without them, and the changes schema's notices table rings reach open pages
 * through, `undefined` when they are there. They are never dropped.
 */
 const callsMigration = async (db, events) => {
-	const statements = [...await hasCallsTables(db) ? [] : [callsSchemaSql], ...await hasNotices(db, events) ? [] : [`create schema if not exists ${quoteIdent(changesSchema(events))}`, noticesTableSql(changesSchema(events))]];
+	const statements = [...await hasCallsTables(db) ? await hasGuestTables(db) ? [] : [guestsSchemaSql] : [callsSchemaSql], ...await hasNotices(db, events) ? [] : [`create schema if not exists ${quoteIdent(changesSchema(events))}`, noticesTableSql(changesSchema(events))]];
 	return statements.length === 0 ? void 0 : `${statements.join(";\n\n")};`;
 };
 /** Refuses to go on while the app has `calls` and the database lacks their tables; the project's migrations add them. */
 const checkCalls = async (db, calls, events) => {
 	if (!calls) return;
-	if (await hasCallsTables(db) && await hasNotices(db, events)) return;
+	if (await hasCallsTables(db) && await hasGuestTables(db) && await hasNotices(db, events)) return;
 	throw new Error(`The calls schema or the notices table that rings go through is missing. Write them as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
 };
 //#endregion
-export { callsMigration, callsSchemaSql, checkCalls };
+export { callsMigration, callsSchemaSql, checkCalls, guestsSchemaSql };

package/dist/calls/calls-store.js

@@ -2,10 +2,11 @@ import { admit, callRecord, heartbeat, leave, remove, setTracks } from "./call-s
 import { recordCalls, rosters } from "./call-reads.js";
 import { takeSignals, writeSignal } from "./call-signals-sql.js";
 import { sweepCalls } from "./call-sweep.js";
+import { guestAllowed } from "./guest-checks-sql.js";
 //#region src/calls/calls-store.ts
 /** The `calls` schema of the app's database; writes under the API's statement timeout. */
 const sqlCallStore = (db, timeoutMs) => ({
-	admit: (input) => admit(db, timeoutMs, input),
+	admit: (input) => admit(db, timeoutMs, input, guestAllowed),
 	leave: (row, process) => leave(db, timeoutMs, row, process),
 	remove: (call, member) => remove(db, timeoutMs, call, member),
 	setTracks: (row, process, tracks) => setTracks(db, row, process, tracks),

package/dist/calls/client-message.js

@@ -38,10 +38,17 @@ const description = z.strictObject({
 	type: z.enum(["offer", "answer"]),
 	sdp
 });
+const uuid = z.uuid();
+const guest = z.string().min(1).max(128).optional();
+const ahead = z.iso.datetime({ offset: true }).refine((value) => Date.parse(value) > Date.now(), "A link expires in the future");
 const message = z.discriminatedUnion("type", [
-	z.strictObject({ type: z.literal("join") }),
+	z.strictObject({
+		type: z.literal("join"),
+		guest
+	}),
 	z.strictObject({
 		type: z.literal("resume"),
+		guest,
 		call: id,
 		participant: id,
 		offer: sdp.optional(),
@@ -88,7 +95,25 @@ const message = z.discriminatedUnion("type", [
 		height: size,
 		hidden: z.boolean().optional()
 	}),
-	z.strictObject({ type: z.literal("leave") })
+	z.strictObject({ type: z.literal("leave") }),
+	z.strictObject({
+		type: z.literal("guest-link"),
+		publish: z.array(source).max(4),
+		expires_at: ahead.optional()
+	}),
+	z.strictObject({
+		type: z.literal("guest-link-revoke"),
+		link: uuid
+	}),
+	z.strictObject({
+		type: z.literal("guest-decide"),
+		guest: uuid,
+		admit: z.boolean()
+	}),
+	z.strictObject({
+		type: z.literal("guest-remove"),
+		guest: uuid
+	})
 ]);
 /** A browser's message, or `undefined` when it is no message of the call protocol. */
 const parseClientMessage = (data) => {

package/dist/calls/guest-checks-sql.d.ts

@@ -0,0 +1,14 @@
+import { CallRecord } from "./call-store.js";
+import { CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-checks-sql.d.ts
+/** A guest by their token's hash: their call, its record, their name, what they may send and whether they were let in. */
+export type GuestRow = {
+  id: string;
+  call: string;
+  record: CallRecord;
+  name: string;
+  publish: CallTrackSource[];
+  admitted: boolean | null;
+};
+//#endregion

package/dist/calls/guest-checks-sql.js

@@ -0,0 +1,43 @@
+import { guestMember } from "./guest-tokens.js";
+import { sql } from "kysely";
+//#region src/calls/guest-checks-sql.ts
+/** A link that still lets guests in: not revoked, not expired, and its organization's admin did not turn guests off. */
+const liveLink = (link) => sql.raw(`${link}."revoked_at" is null and (${link}."expires_at" is null or ${link}."expires_at" > now())
+    and not exists (select from "calls"."organization_guests" o where o."organization_id" = ${link}."organization_id" and not o."allowed")`);
+/**
+* Whether the guest may be in their call now: let in by a member, through a link that is still live, and not removed
+* from the call. The call's own end the caller checks under its row lock.
+*/
+const guestAllowed = async (trx, guest) => {
+	const { rows } = await sql`select g."id"::text as id from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+    where g."id" = ${guest}::uuid and g."admitted" and ${liveLink("l")}
+    and not exists (select from "calls"."members" m where m."call_id" = g."call_id" and m."member" = ${guestMember(guest)} and m."removed_at" is not null)`.execute(trx);
+	return rows.length > 0;
+};
+/** Whether the guest may still be in their call, the call going on: the minute's check of a guest's socket. */
+const guestStillAllowed = async (db, guest) => {
+	const { rows } = await sql`select c."ended_at" is null and c."ends_at" > now() as live
+    from "calls"."guests" g join "calls"."calls" c on c."id" = g."call_id" where g."id" = ${guest}::uuid`.execute(db);
+	return Boolean(rows[0]?.live) && await guestAllowed(db, guest);
+};
+const guestByToken = async (db, hash) => {
+	const { rows } = await sql`
+    select g."id"::text as id, g."call_id"::text as call, c."resource", c."record_key" as key, g."name", l."publish", g."admitted"
+    from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id" join "calls"."calls" c on c."id" = g."call_id"
+    where g."token_hash" = ${hash}`.execute(db);
+	const row = rows[0];
+	if (!row) return;
+	return {
+		id: row.id,
+		call: row.call,
+		record: {
+			resource: row.resource,
+			key: row.key
+		},
+		name: row.name,
+		publish: row.publish,
+		admitted: row.admitted
+	};
+};
+//#endregion
+export { guestAllowed, guestByToken, guestStillAllowed, liveLink };

package/dist/calls/guest-limits.js

@@ -0,0 +1,49 @@
+//#region src/calls/guest-limits.ts
+/**
+* Counts per key in a fixed window of `windowMs`, which all keys share: every count starts over when it turns, so
+* memory follows the keys of the current window.
+*/
+const windowCounts = (windowMs, now = () => Date.now()) => {
+	let start = -Infinity;
+	let counts = /* @__PURE__ */ new Map();
+	const turn = () => {
+		if (now() - start < windowMs) return;
+		start = now();
+		counts = /* @__PURE__ */ new Map();
+	};
+	return {
+		count: (key) => {
+			turn();
+			return counts.get(key) ?? 0;
+		},
+		add: (key) => {
+			turn();
+			counts.set(key, (counts.get(key) ?? 0) + 1);
+		}
+	};
+};
+/** The lobby's limits, per process: by address, and by guest. */
+const guestLimits = (now = () => Date.now()) => {
+	const entries = windowCounts(6e4, now);
+	const refusals = windowCounts(6e4, now);
+	const polls = windowCounts(6e4, now);
+	return {
+		/** Whether the address sent too many refused tokens this minute. */
+		blocked: (address) => refusals.count(address) >= 10,
+		refused: (address) => refusals.add(address),
+		/** Takes one entry of the address: whether it fits. */
+		enter: (address) => {
+			if (entries.count(address) >= 5) return false;
+			entries.add(address);
+			return true;
+		},
+		/** Takes one ask of the guest: whether it fits. */
+		poll: (guest) => {
+			if (polls.count(guest) >= 120) return false;
+			polls.add(guest);
+			return true;
+		}
+	};
+};
+//#endregion
+export { guestLimits, windowCounts };

package/dist/calls/guest-links-sql.d.ts

@@ -0,0 +1,16 @@
+import { CallRecord } from "./call-store.js";
+import { CallGuestLink, CallGuestRefusal, CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-links-sql.d.ts
+/**
+ * The organization a record is in, as the app keeps it: `undefined` in an app without organizations, `null` for a
+ * record of a resource without a tenant in an app with them, which no admin's switch could cover.
+ */
+export type OrganizationOf = (trx: Db, record: CallRecord) => Promise<string | null | undefined>;
+export type CreateLinkInput = {
+  call: string;
+  member: string;
+  publish: CallTrackSource[];
+  expiresAt?: Date;
+};
+//#endregion

package/dist/calls/guest-links-sql.js

@@ -0,0 +1,78 @@
+import { writeTransaction } from "../transactions.js";
+import { endIfEmpty, lockCall, removeMember } from "./call-store.js";
+import { guestMember, isGuestMember, linkTokenPrefix, newToken, tokenHash } from "./guest-tokens.js";
+import { sql } from "kysely";
+//#region src/calls/guest-links-sql.ts
+const iso = (column) => sql.raw(`to_char(${column} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`);
+/** Whether `member` is in the call now, as one of the app's members, never a guest. */
+const presentMember = async (trx, call, member) => !isGuestMember(member) && (await sql`select "id"::text as id from "calls"."members" where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null`.execute(trx)).rows.length > 0;
+const allowedIn = async (trx, organization) => (await sql`select "allowed" from "calls"."organization_guests" where "organization_id" = ${organization}`.execute(trx)).rows[0]?.allowed !== false;
+/**
+* A new link to the call, made by a member in it, for the organization of the call's own record, read in the
+* transaction that holds the call's row; refused when the call is over, the member is not in it, or the organization
+* turned guests off. Its token is returned once, and only its hash kept.
+*/
+const createLink = (db, timeoutMs, organizationOf, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || call.expired || !await presentMember(trx, call.id, input.member)) return { refused: "gone" };
+	const organization = await organizationOf(trx, {
+		resource: call.resource,
+		key: call.record_key
+	});
+	if (organization === null) return { refused: "no-organization" };
+	if (organization !== void 0 && !await allowedIn(trx, organization)) return { refused: "off" };
+	const token = newToken(linkTokenPrefix);
+	const { rows } = await sql`insert into "calls"."guest_links" ("id", "call_id", "token_hash", "created_by", "organization_id", "publish", "created_at", "expires_at")
+      values (gen_random_uuid(), ${call.id}::uuid, ${tokenHash(linkTokenPrefix, token)}, ${input.member}, ${organization ?? null}, ${JSON.stringify(input.publish)}::jsonb, now(), ${input.expiresAt ?? null})
+      returning "id"::text as id, ${iso("\"expires_at\"")} as expires_at`.execute(trx);
+	const row = rows[0];
+	return {
+		link: {
+			id: row.id,
+			created_by: input.member,
+			publish: input.publish,
+			expires_at: row.expires_at
+		},
+		token
+	};
+});
+const revokeIn = async (trx, call, link, by) => {
+	await sql`update "calls"."guest_links" set "revoked_at" = now() where "id" = ${link}::uuid and "revoked_at" is null`.execute(trx);
+	await sql`update "calls"."guests" set "admitted" = false, "decided_by" = ${by}, "decided_at" = now() where "link_id" = ${link}::uuid and "admitted" is null`.execute(trx);
+	const { rows } = await sql`select "id"::text as id from "calls"."guests" where "link_id" = ${link}::uuid and "admitted"`.execute(trx);
+	for (const guest of rows) await removeMember(trx, call, guestMember(guest.id));
+	await endIfEmpty(trx, call);
+};
+/** A member in the call revokes one of its links: its guests are out. Whether it was the call's and still live. */
+const revokeLink = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || !await presentMember(trx, call.id, input.member)) return false;
+	const { rows } = await sql`select "id"::text as id from "calls"."guest_links" where "id" = ${input.link}::uuid and "call_id" = ${call.id}::uuid and "revoked_at" is null`.execute(trx);
+	if (rows.length === 0) return false;
+	await revokeIn(trx, call.id, input.link, input.member);
+	return true;
+});
+/**
+* Whether the organization's admin allows guest links to its calls. Turning them off revokes every live link of the
+* organization at once, each under its call's row lock in the order of the calls, and takes their guests out: the
+* calls it changed.
+*/
+const setOrganizationGuests = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	await sql`insert into "calls"."organization_guests" ("organization_id", "allowed", "set_by", "set_at") values (${input.organization}, ${input.allowed}, ${input.by}, now())
+      on conflict ("organization_id") do update set "allowed" = excluded."allowed", "set_by" = excluded."set_by", "set_at" = excluded."set_at"`.execute(trx);
+	if (input.allowed) return [];
+	const { rows } = await sql`select "id"::text as id, "call_id"::text as call from "calls"."guest_links"
+      where "organization_id" = ${input.organization} and "revoked_at" is null order by "call_id", "id"`.execute(trx);
+	const calls = /* @__PURE__ */ new Set();
+	for (const link of rows) {
+		const call = await lockCall(trx, link.call);
+		if (!call || call.ended) continue;
+		await revokeIn(trx, call.id, link.id, input.by);
+		calls.add(call.id);
+	}
+	return [...calls];
+});
+/** Whether the organization allows guest links: yes until its admin turned them off. */
+const organizationGuests = (db, organization) => allowedIn(db, organization);
+//#endregion
+export { createLink, organizationGuests, presentMember, revokeLink, setOrganizationGuests };

package/dist/calls/guest-lobby-sql.d.ts

@@ -0,0 +1,17 @@
+import { CallGuestLink, CallGuestRefusal, CallGuestState, CallLobbyGuest, CallTrackSource } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/guest-lobby-sql.d.ts
+/** What a guest's page learns of its wait: only its state, and once let in the call's id and what it may send. */
+export type LobbyState = {
+  state: CallGuestState;
+  call?: string;
+  publish?: CallTrackSource[];
+};
+export type DecideInput = {
+  call: string;
+  guest: string;
+  member: string;
+  admit: boolean;
+  maxMembers: number;
+};
+//#endregion

package/dist/calls/guest-lobby-sql.js

@@ -0,0 +1,81 @@
+import { writeTransaction } from "../transactions.js";
+import { lockCall } from "./call-store.js";
+import { liveLink } from "./guest-checks-sql.js";
+import { presentMember } from "./guest-links-sql.js";
+import { sql } from "kysely";
+//#region src/calls/guest-lobby-sql.ts
+const iso = (column) => sql.raw(`to_char(${column} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`);
+/**
+* A guest waits in the lobby of the link's call, by the name they gave and the hash of the token they were given;
+* refused, the same way for each cause, when the link is unknown or no longer live, its call is over, it turned away
+* `maxDenials` guests, or `maxWaiting` already wait on it. The call's row is locked.
+*/
+const enterLobby = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const link = (await sql`select l."id"::text as id, l."call_id"::text as call from "calls"."guest_links" l where l."token_hash" = ${input.link} and ${liveLink("l")}`.execute(trx)).rows[0];
+	const call = link && await lockCall(trx, link.call);
+	if (!link || !call || call.ended || call.expired) return { refused: "gone" };
+	const { rows } = await sql`select count(*) filter (where "admitted" is null and "seen_at" > now() - make_interval(secs => ${10}))::int as waiting,
+      count(*) filter (where "admitted" = false)::int as denied from "calls"."guests" where "link_id" = ${link.id}::uuid`.execute(trx);
+	if (rows[0].waiting >= 10 || rows[0].denied >= 3) return { refused: "gone" };
+	return { guest: (await sql`insert into "calls"."guests" ("id", "link_id", "call_id", "name", "token_hash", "entered_at", "seen_at")
+      values (gen_random_uuid(), ${link.id}::uuid, ${call.id}::uuid, ${input.name}, ${input.token}, now(), now()) returning "id"::text as id`.execute(trx)).rows[0].id };
+});
+/** The guest's wait, by their token's hash, which tells the lobby they are still there; `undefined` for an unknown token. */
+const lobbyState = async (db, token) => {
+	const { rows } = await sql`
+    update "calls"."guests" g set "seen_at" = now() from "calls"."guest_links" l, "calls"."calls" c
+    where g."token_hash" = ${token} and l."id" = g."link_id" and c."id" = g."call_id"
+    returning g."call_id"::text as call, g."admitted", (${liveLink("l")} and c."ended_at" is null and c."ends_at" > now()) as live, l."publish"`.execute(db);
+	const row = rows[0];
+	if (!row) return;
+	if (row.admitted === false) return { state: "denied" };
+	if (!row.live) return { state: "ended" };
+	if (row.admitted === null) return { state: "waiting" };
+	return {
+		state: "admitted",
+		call: row.call,
+		publish: row.publish
+	};
+};
+/** A waiting guest leaves the lobby: their wait is gone. */
+const leaveLobby = async (db, token) => {
+	await sql`delete from "calls"."guests" where "token_hash" = ${token} and "admitted" is null`.execute(db);
+};
+/**
+* A member in the call lets a guest waiting on one of its live links in, or turns them away; refused when the guest no
+* longer waits there, or, to let them in, when the call has no room now. The call's row is locked, so racing decisions
+* come one after the other; the guest's own join is checked against the room again.
+*/
+const decideGuest = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
+	const call = await lockCall(trx, input.call);
+	if (!call || call.ended || call.expired || !await presentMember(trx, call.id, input.member)) return { refused: "gone" };
+	const { rows } = await sql`select g."id"::text as id from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+      where g."id" = ${input.guest}::uuid and g."call_id" = ${call.id}::uuid and g."admitted" is null and ${liveLink("l")}`.execute(trx);
+	if (rows.length === 0) return { refused: "gone" };
+	if (input.admit) {
+		const { rows: present } = await sql`select count(*)::int as n from "calls"."members" where "call_id" = ${call.id}::uuid and "left_at" is null`.execute(trx);
+		if (present[0].n >= input.maxMembers) return { refused: "full" };
+	}
+	await sql`update "calls"."guests" set "admitted" = ${input.admit}, "decided_by" = ${input.member}, "decided_at" = now() where "id" = ${input.guest}::uuid`.execute(trx);
+	return {};
+});
+/** Each call's lobby, as its members who may invite see it: the guests waiting now, and its live links. */
+const lobbies = async (db, calls) => {
+	const found = new Map(calls.map((call) => [call, {
+		guests: [],
+		links: []
+	}]));
+	if (calls.length === 0) return found;
+	const ids = `{${calls.join(",")}}`;
+	const links = await sql`select l."call_id"::text as call, l."id"::text as id, l."created_by", l."publish", ${iso("l.\"expires_at\"")} as expires_at
+    from "calls"."guest_links" l where l."call_id" = any(${ids}::uuid[]) and ${liveLink("l")} order by l."created_at", l."id"`.execute(db);
+	for (const { call, ...link } of links.rows) found.get(call).links.push(link);
+	const guests = await sql`select g."call_id"::text as call, g."id"::text as guest, g."name", ${iso("g.\"entered_at\"")} as since
+    from "calls"."guests" g join "calls"."guest_links" l on l."id" = g."link_id"
+    where g."call_id" = any(${ids}::uuid[]) and g."admitted" is null and g."seen_at" > now() - make_interval(secs => ${10}) and ${liveLink("l")}
+    order by g."entered_at", g."id"`.execute(db);
+	for (const { call, ...guest } of guests.rows) found.get(call).guests.push(guest);
+	return found;
+};
+//#endregion
+export { decideGuest, enterLobby, leaveLobby, lobbies, lobbyState };

package/dist/calls/guest-name.js

@@ -0,0 +1,10 @@
+import { badRequest } from "../problem.js";
+/** The name a guest gives, trimmed: 1 to 60 characters, none of them a control or format character. */
+const guestName = (value) => {
+	const name = typeof value === "string" ? value.trim() : "";
+	if (name.length === 0 || [...name].length > 60) throw badRequest("guest-name", `Give a name of 1 to 60 characters`);
+	if (/\p{C}/u.test(name)) throw badRequest("guest-name", "A name cannot hold control characters");
+	return name;
+};
+//#endregion
+export { guestName };

package/dist/calls/guest-routes.js

@@ -0,0 +1,97 @@
+import { HttpProblem, forbidden, notFound, unauthorized } from "../problem.js";
+import { socketAcceptor } from "../functions/accept-socket.js";
+import { allowedOrigin } from "../functions/upgrade-caller.js";
+import { guestLimits } from "./guest-limits.js";
+import { guestName } from "./guest-name.js";
+import { guestTokenPrefix, linkTokenPrefix, newToken, tokenHash } from "./guest-tokens.js";
+import { guestSocket } from "./guest-socket.js";
+import { Hono } from "hono";
+//#region src/calls/guest-routes.ts
+const noStore = { "Cache-Control": "no-store" };
+const tooMany = () => new HttpProblem(429, "too-many-requests", "Too Many Requests", "Too many tries: wait a minute", {}, { "retry-after": "60" });
+const noLobby = () => notFound("This link lets nobody into a call");
+const bearer = (c) => c.req.header("authorization")?.match(/^Bearer (.+)$/)?.[1];
+/**
+* The guests' routes, mounted at `guestCallsPath` before the API's authenticator, which takes none of their tokens,
+* as no route but these takes them:
+* - `POST /lobby` with `{ link, name }`: the guest waits in the lobby of the link's call; `201 { guest, token }`.
+* - `GET /lobby` with `Authorization: Bearer <token>`: `{ state }`, with `call` and `publish` once let in.
+* - `DELETE /lobby`: the waiting guest leaves.
+* - `GET /socket`: the guest's call socket (see `guestSocket`).
+* Each address may enter `entriesPerMinute` times a minute, and is answered 429 for the rest of the minute after
+* `refusalsPerMinute` unknown or refused tokens; each guest asks after their wait `pollsPerMinute` times at most.
+*/
+const guestRoutes = ({ calls, addressOf, origins, upgradeWebSocket, onError, report }) => {
+	const app = new Hono();
+	app.onError(onError);
+	const limits = guestLimits();
+	const address = (c) => addressOf(c.req.raw) ?? "no-trusted-address";
+	const open = (c) => {
+		const at = address(c);
+		if (limits.blocked(at)) throw tooMany();
+		return at;
+	};
+	const guestToken = (c, at) => {
+		const hash = tokenHash(guestTokenPrefix, bearer(c));
+		if (!hash) {
+			limits.refused(at);
+			throw unauthorized("Send the token the lobby gave you");
+		}
+		if (!limits.poll(hash.toString("hex"))) throw tooMany();
+		return hash;
+	};
+	app.post("/lobby", async (c) => {
+		const at = open(c);
+		const body = await c.req.json().catch(() => void 0);
+		if (!limits.enter(at)) throw tooMany();
+		const name = guestName(body?.name);
+		const link = tokenHash(linkTokenPrefix, body?.link);
+		if (!link) {
+			limits.refused(at);
+			throw noLobby();
+		}
+		const token = newToken(guestTokenPrefix);
+		const entered = await (await calls.runtime()).guests().enter({
+			link,
+			name,
+			token: tokenHash(guestTokenPrefix, token)
+		});
+		if ("refused" in entered) {
+			limits.refused(at);
+			throw noLobby();
+		}
+		return c.json({
+			guest: entered.guest,
+			token
+		}, 201, noStore);
+	});
+	app.get("/lobby", async (c) => {
+		const at = open(c);
+		const hash = guestToken(c, at);
+		const state = await (await calls.runtime()).guests().state(hash);
+		if (!state) {
+			limits.refused(at);
+			throw unauthorized("This token lets nobody into a call");
+		}
+		return c.json(state, 200, noStore);
+	});
+	app.delete("/lobby", async (c) => {
+		const at = open(c);
+		await (await calls.runtime()).guests().leave(guestToken(c, at));
+		return c.body(null, 204);
+	});
+	app.get("/socket", async (c) => {
+		const at = open(c);
+		if (!allowedOrigin(c.req.raw, origins)) throw forbidden("foreign-origin", "This page’s origin may not open a socket to this app");
+		const runtime = await calls.runtime();
+		const acceptor = socketAcceptor({
+			c,
+			upgradeWebSocket,
+			report
+		});
+		return acceptor.answer("guest call", acceptor.accept(guestSocket(runtime, () => limits.refused(at))));
+	});
+	return app;
+};
+//#endregion
+export { guestRoutes };

package/dist/calls/guest-socket.js

@@ -0,0 +1,58 @@
+import { forbidden } from "../problem.js";
+import { parseClientMessage } from "./client-message.js";
+import { guestTokenPrefix, tokenHash } from "./guest-tokens.js";
+//#region src/calls/guest-socket.ts
+/** How long a guest's socket may stay open before its first message names the guest, in milliseconds. */
+const guestFirstMessageMs = 1e4;
+const refusedCloseCode = 1008;
+const maxMessageBytes = 307200;
+/**
+* A guest's call socket: open to anyone, it lets in only a guest whose first message, their `join` or `resume`, carries
+* the token of a guest a member let in who may still be in the call. From then on it is a member's socket, as `guest:<id>` in their link's call,
+* checked every minute: removed, their link revoked or expired, guests turned off or the call ended closes it. A
+* socket that names no such guest, or none in time, closes with 1008 and `refused` (the address is counted).
+*/
+const guestSocket = (runtime, refused) => {
+	let socket;
+	let relay;
+	let guest;
+	let timer;
+	const refuse = () => {
+		refused();
+		socket.send(JSON.stringify({
+			type: "left",
+			reason: "refused"
+		}));
+		socket.close(refusedCloseCode, "Not let into this call");
+	};
+	const first = async (data) => {
+		clearTimeout(timer);
+		const message = parseClientMessage(data);
+		const hash = message && (message.type === "join" || message.type === "resume") ? tokenHash(guestTokenPrefix, message.guest) : void 0;
+		const row = hash && await runtime.guests().byToken(hash);
+		if (!row || row.admitted !== true || !await runtime.guests().stillAllowed(row.id)) return refuse();
+		guest = row.id;
+		relay = await runtime.relayGuest(row);
+		await relay.onOpen?.(socket);
+		await relay.onMessage?.(data, socket);
+	};
+	return {
+		maxMessageBytes,
+		onOpen: (opened) => {
+			socket = opened;
+			timer = setTimeout(refuse, guestFirstMessageMs);
+			timer.unref?.();
+		},
+		onMessage: (data) => relay ? relay.onMessage?.(data, socket) : first(data),
+		onClose: (code, reason) => {
+			clearTimeout(timer);
+			return relay?.onClose?.(code, reason);
+		},
+		recheck: async () => {
+			if (guest === void 0) return;
+			if (!await runtime.guests().stillAllowed(guest)) throw forbidden("guest-not-allowed", "This guest may no longer be in the call");
+		}
+	};
+};
+//#endregion
+export { guestFirstMessageMs, guestSocket };