@protobase/server 0.62.5 → 0.63.1

package/dist/better-auth/create-auth.d.ts

@@ -113,10 +113,10 @@ export type CreateAuthOptions = {
   /**
    * The mail providers people may link their own mailbox with, from the account page, for the app's functions to send
    * mail from it (`context.personalMail`), such as `['gmail']`. Each links through its sign-in provider, which
-   * `socialProviders` must have: Gmail through `google`. Default none.
+   * `socialProviders` must have: Gmail through `google`. Needs `encryptOAuthTokens`. Default none.
    */
   personalMail?: PersonalMailProviderId[];
-  /** Encrypt the OAuth access, refresh and ID tokens Better Auth stores for social sign-ins, with `secret`. Default off. */
+  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` needs it. Default off. */
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;

package/dist/better-auth/create-auth.js

@@ -78,6 +78,7 @@ const tokenLifetime = "15m";
 /** The configured roles with `admin` first; `admin` is added when missing. */
 const normalizeRoles = (roles) => roleDefinitions(roles).names;
 const adminImpersonationPaths = ["/admin/impersonate-user", "/admin/stop-impersonating"];
+const providerTokenPaths = ["/get-access-token", "/refresh-token"];
 /** The optional plugins `options` turns on, imported: an app without SAML or MCP loads neither. */
 const loadAuthPlugins = async (options) => ({
 	...(options.sso?.saml.length ?? 0) > 0 && { samlPlugin: (await import("./saml-plugin.js")).samlPlugin },
@@ -268,6 +269,7 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...accountDeletion ? [] : [selfDeletionPath],
 			...unusedEmailCodePaths,
 			...adminImpersonationPaths,
+			...providerTokenPaths,
 			...organizations ? organizationPaths : [],
 			...saml.length > 0 ? samlDisabledPaths : [],
 			...mcp ? mcpUnusedPaths : []
@@ -371,7 +373,7 @@ const createAuth = (options, plugins = {}) => {
 	const socialProviders = Object.keys(options.socialProviders ?? {});
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
-	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders);
+	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions, options.baseURL);
@@ -477,4 +479,4 @@ const createAuth = (options, plugins = {}) => {
 /** `createAuth` with the optional plugins its options turn on loaded first (see `loadAuthPlugins`). */
 const buildAuth = async (options) => createAuth(options, await loadAuthPlugins(options));
 //#endregion
-export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles };
+export { authBasePath, betterAuthOptions, buildAuth, createAuth, loadAuthPlugins, normalizeRoles, providerTokenPaths };

package/dist/better-auth/organizations/organization-role.js

@@ -0,0 +1,13 @@
+import { findMember, organizationRoleOf } from "./store.js";
+//#region src/better-auth/organizations/organization-role.ts
+/** The user's role in the organization, `undefined` when they are no member of it. */
+const organizationRole = (auth) => async (organization, user) => {
+	const { adapter } = await auth.$context;
+	const member = await findMember(adapter, {
+		organizationId: organization,
+		userId: user
+	});
+	return member && organizationRoleOf(member);
+};
+//#endregion
+export { organizationRole };

package/dist/calls/call-hub.js

@@ -5,9 +5,10 @@ import { randomUUID } from "node:crypto";
 const signalsPerSecond = 100;
 /** How often the signals for this process are read, with several processes. */
 const signalsEveryMs = 100;
-const rosterOf = (members) => members.map(({ member, joined_at }) => ({
+const rosterOf = (members) => members.map(({ member, joined_at, name }) => ({
 	member,
-	joined_at
+	joined_at,
+	...name !== null && { name }
 }));
 /**
 * The members this process serves, in their calls, whose records the `calls` schema keeps. A member is in only while
@@ -16,7 +17,7 @@ const rosterOf = (members) => members.map(({ member, joined_at }) => ({
 * member of the same call only, straight to their socket here, or through the `calls` schema to the process that
 * serves them.
 */
-const callHub = ({ store, manyProcesses, report }) => {
+const callHub = ({ store, manyProcesses, report, lobbies }) => {
 	const process = randomUUID();
 	const locals = /* @__PURE__ */ new Map();
 	const known = /* @__PURE__ */ new Map();
@@ -50,10 +51,29 @@ const callHub = ({ store, manyProcesses, report }) => {
 			local.listener?.(members);
 		}
 	};
-	/** Reads who is in these calls and tells their members here. */
+	const tellLobbies = async (calls) => {
+		const asked = calls.filter((call) => ofCall(call).some((local) => local.invites && local.listener));
+		if (!lobbies || asked.length === 0) return;
+		const found = await lobbies(asked);
+		for (const call of asked) {
+			const lobby = found.get(call);
+			if (!lobby) continue;
+			const body = JSON.stringify(lobby);
+			for (const local of ofCall(call)) {
+				if (!local.invites || !local.listener || local.lobby === body) continue;
+				local.lobby = body;
+				local.link.send({
+					type: "lobby",
+					...lobby
+				});
+			}
+		}
+	};
+	/** Reads who is in these calls, and their lobbies, and tells their members here. */
 	const refresh = async (calls) => {
 		const found = await store.rosters(calls);
 		for (const call of calls) apply(call, found.get(call));
+		await tellLobbies(calls);
 	};
 	const deliver = (call, to, from, body) => {
 		ofCall(call).find((local) => local.member === to)?.link.send({
@@ -113,9 +133,9 @@ const callHub = ({ store, manyProcesses, report }) => {
 		/**
 		* Lets the member in, or says why not. Once in, `listen` gets who is in the call; `leave` ends their time in it,
 		* `detach` only stops this process hearing of them, as when their socket was lost: they are out `graceSeconds`
-		* later unless their browser resumes.
+		* later unless their browser resumes. A member who `invites` is told of the call's lobby too.
 		*/
-		admit: async (input, link) => {
+		admit: async ({ invites = false, ...input }, link) => {
 			const admitted = await store.admit({
 				...input,
 				process
@@ -126,7 +146,8 @@ const callHub = ({ store, manyProcesses, report }) => {
 				member: input.member,
 				row: admitted.row,
 				link,
-				signals: fixedWindow(signalsPerSecond, 1e3)
+				signals: fixedWindow(signalsPerSecond, 1e3),
+				invites: invites && lobbies !== void 0
 			};
 			for (const before of ofCall(admitted.call)) if (before.member === input.member && before.row === admitted.row) drop(before, "removed");
 			locals.set(local.row, local);

package/dist/calls/call-member.d.ts

@@ -19,12 +19,16 @@ export type CallMember = CallRights & {
   };
   /**
    * Who joins, unique in the call, such as the signed-in user's id: take it from the caller, never from the request,
-   * since the other members know them by it.
+   * since the other members know them by it. Never `guest:…`, which guests are.
    */
   member: string;
   /** The function's own checks, repeated every minute after the record's, such as whether the caller is still invited. */
   recheck?: () => unknown;
   /** Whom the call rings, on any page of the app they have open, when this join starts it. */
   ring?: CallRingInput;
+  /** Whether the member may share guest links to the call and let its guests in; `false` by default. */
+  invites?: boolean;
+  /** The name the others in the call see, such as the user's name; guests see no other. */
+  name?: string;
 };
 //#endregion

package/dist/calls/call-reads.d.ts

@@ -2,15 +2,19 @@ import "./call-store.js";
 import { CallRemoteTrack } from "@protobase/schema/internal";
 import { Db } from "@protobase/query";
 //#region src/calls/call-reads.d.ts
-/** Someone in a call now: their members row, the process that serves them and the tracks they send. */
+/** Someone in a call now: their members row, the process that serves them, the tracks they send and the name they show. */
 export type RosterMember = {
   row: string;
   member: string;
   process: string;
   joined_at: string;
   tracks: CallRemoteTrack[];
+  name: string | null;
 };
-/** A call as the record's readers see it: who started it, when, when it ended, who is in it and who was removed. */
+/**
+ * A call as the record's readers see it: who started it, when, when it ended, who is in it, with the name they show
+ * when they have one, and who was removed.
+ */
 export type CallItem = {
   id: string;
   started_by: string;
@@ -20,6 +24,7 @@ export type CallItem = {
   members: {
     member: string;
     joined_at: string;
+    name?: string;
   }[];
   removed: {
     member: string;

package/dist/calls/call-reads.js

@@ -7,7 +7,7 @@ const rosters = async (db, calls) => {
 	const found = /* @__PURE__ */ new Map();
 	if (calls.length === 0) return found;
 	const { rows } = await sql`
-    select c."id"::text as call, c."ended_at" is not null as ended, m."id"::text as row, m."member", m."process"::text as process, ${iso("m.\"joined_at\"")} as joined_at, m."tracks"
+    select c."id"::text as call, c."ended_at" is not null as ended, m."id"::text as row, m."member", m."process"::text as process, ${iso("m.\"joined_at\"")} as joined_at, m."tracks", m."name"
     from "calls"."calls" c left join "calls"."members" m on m."call_id" = c."id" and m."left_at" is null
     where c."id" = any(${ids(calls)}::uuid[]) order by c."id", m."joined_at", m."id"`.execute(db);
 	for (const row of rows) {
@@ -21,7 +21,8 @@ const rosters = async (db, calls) => {
 			member: row.member,
 			process: row.process,
 			joined_at: row.joined_at,
-			tracks: row.tracks
+			tracks: row.tracks,
+			name: row.name
 		});
 	}
 	return found;
@@ -41,7 +42,7 @@ const recordCalls = async (db, records) => {
     order by c."ended_at" is not null, c."started_at" desc, c."id"`.execute(db);
 	if (calls.rows.length === 0) return found;
 	const members = await sql`
-    select "call_id"::text as call, "member", ${iso("\"joined_at\"")} as joined_at, ${iso("\"removed_at\"")} as removed_at
+    select "call_id"::text as call, "member", ${iso("\"joined_at\"")} as joined_at, ${iso("\"removed_at\"")} as removed_at, "name"
     from "calls"."members" where "call_id" = any(${ids(calls.rows.map((call) => call.id))}::uuid[]) and ("left_at" is null or "removed_at" is not null)
     order by "joined_at", "id"`.execute(db);
 	const items = /* @__PURE__ */ new Map();
@@ -64,7 +65,8 @@ const recordCalls = async (db, records) => {
 		const item = items.get(row.call);
 		if (row.removed_at === null) item.members.push({
 			member: row.member,
-			joined_at: row.joined_at
+			joined_at: row.joined_at,
+			...row.name !== null && { name: row.name }
 		});
 		else item.removed.push({
 			member: row.member,

package/dist/calls/call-store.d.ts

@@ -19,6 +19,13 @@ export type AdmitInput = {
   };
   maxMembers: number;
   maxMinutes: number;
+  /** The name the member shows the others: a guest's own, or the one the app gave. */
+  name?: string;
+  /** A guest, who comes only into the call their link is for, by their id; never starts one. */
+  guest?: {
+    id: string;
+    call: string;
+  };
 };
 /** The member in the call `call`, as the members row `row`, with whether their join started it; or why not. */
 export type Admission = {

package/dist/calls/call-store.js

@@ -32,31 +32,39 @@ const liveCall = async (trx, record, member, maxMinutes) => {
 	}
 	throw new Error(`The call on ${record.resource} ${record.key} could not be started`);
 };
-const enter = async (trx, call, member, process, tracks) => {
+const enter = async (trx, call, member, process, tracks, name) => {
 	const body = JSON.stringify(tracks);
-	const { rows } = await sql`update "calls"."members" set "process" = ${process}::uuid, "seen_at" = now(), "tracks" = ${body}::jsonb
+	const { rows } = await sql`update "calls"."members" set "process" = ${process}::uuid, "seen_at" = now(), "tracks" = ${body}::jsonb, "name" = ${name}
     where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
 	if (rows[0]) return rows[0].id;
-	return (await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at")
-    values (${call}::uuid, ${member}, ${process}::uuid, ${body}::jsonb, now(), now()) returning "id"::text as id`.execute(trx)).rows[0].id;
+	return (await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "name")
+    values (${call}::uuid, ${member}, ${process}::uuid, ${body}::jsonb, now(), now(), ${name}) returning "id"::text as id`.execute(trx)).rows[0].id;
+};
+const resumed = async (trx, record, call) => {
+	const found = isCallId(call) ? await lockCall(trx, call) : void 0;
+	if (!found || found.ended || found.resource !== record.resource || found.record_key !== record.key) return;
+	if (!found.expired) return found.id;
+	await endCall(trx, found.id);
 };
 /**
 * Lets the member into the record's call, or the call they resume, when they may: one transaction, the call's row
 * locked. The members whose process stopped hearing of them are out first. A resume of a call that ended, or that is
-* on another record, is refused as ended; a fresh join to a record without a call going on starts one.
+* on another record, is refused as ended; a fresh join to a record without a call going on starts one. A guest comes
+* only into their link's call, while `guestAllowed` lets them, and never starts one.
 */
-const admit = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (trx) => {
-	const { record, member, resume } = input;
+const admit = (db, timeoutMs, input, guestAllowed) => writeTransaction(db, timeoutMs, async (trx) => {
+	const { record, member, resume, guest } = input;
 	let call;
 	let started = false;
-	if (resume) {
-		const resumed = isCallId(resume.call) ? await lockCall(trx, resume.call) : void 0;
-		if (!resumed || resumed.ended || resumed.resource !== record.resource || resumed.record_key !== record.key) return { refused: "ended" };
-		if (resumed.expired) {
-			await endCall(trx, resumed.id);
-			return { refused: "ended" };
-		}
-		call = resumed.id;
+	if (guest) {
+		if (resume && resume.call !== guest.call) return { refused: "ended" };
+		const going = await resumed(trx, record, guest.call);
+		if (!going || !guestAllowed || !await guestAllowed(trx, guest.id)) return { refused: "ended" };
+		call = going;
+	} else if (resume) {
+		const going = await resumed(trx, record, resume.call);
+		if (!going) return { refused: "ended" };
+		call = going;
 	} else {
 		const live = await liveCall(trx, record, member, input.maxMinutes);
 		call = live.id;
@@ -75,7 +83,7 @@ const admit = (db, timeoutMs, input) => writeTransaction(db, timeoutMs, async (t
 	if (refused) return { refused };
 	return {
 		call,
-		row: await enter(trx, call, member, input.process, resume?.tracks ?? []),
+		row: await enter(trx, call, member, input.process, resume?.tracks ?? [], input.name ?? null),
 		started
 	};
 });
@@ -96,16 +104,19 @@ const leave = (db, timeoutMs, row, process) => writeTransaction(db, timeoutMs, a
 const remove = (db, timeoutMs, callId, member) => writeTransaction(db, timeoutMs, async (trx) => {
 	const call = isCallId(callId) ? await lockCall(trx, callId) : void 0;
 	if (!call || call.ended) return false;
-	const { rows } = await sql`update "calls"."members" set "left_at" = now(), "removed_at" = now()
-      where "call_id" = ${call.id}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
-	if (rows.length === 0) {
-		await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "left_at", "removed_at")
-        values (${call.id}::uuid, ${member}, ${nobody}::uuid, '[]'::jsonb, now(), now(), now(), now())`.execute(trx);
-		return false;
-	}
+	if (!await removeMember(trx, call.id, member)) return false;
 	await endIfEmpty(trx, call.id);
 	return true;
 });
+/** `remove`'s change, in a transaction that holds the call's row: whether the member was in the call. */
+const removeMember = async (trx, call, member) => {
+	const { rows } = await sql`update "calls"."members" set "left_at" = now(), "removed_at" = now()
+    where "call_id" = ${call}::uuid and "member" = ${member} and "left_at" is null returning "id"::text as id`.execute(trx);
+	if (rows.length > 0) return true;
+	await sql`insert into "calls"."members" ("call_id", "member", "process", "tracks", "joined_at", "seen_at", "left_at", "removed_at")
+    values (${call}::uuid, ${member}, ${nobody}::uuid, '[]'::jsonb, now(), now(), now(), now())`.execute(trx);
+	return false;
+};
 /** The tracks the member of row `row` sends now, while `process` serves them. */
 const setTracks = async (db, row, process, tracks) => {
 	await sql`update "calls"."members" set "tracks" = ${JSON.stringify(tracks)}::jsonb
@@ -124,4 +135,4 @@ const callRecord = async (db, call) => {
 	return rows[0];
 };
 //#endregion
-export { admit, callRecord, endCall, heartbeat, isCallId, leave, remove, setTracks };
+export { admit, callRecord, endCall, endIfEmpty, heartbeat, isCallId, leave, lockCall, remove, removeMember, setTracks };

package/dist/calls/call-sweep.js

@@ -4,22 +4,24 @@ import { sql } from "kysely";
 //#region src/calls/call-sweep.ts
 /** How long a signal between processes is kept: long after it was read. */
 const signalSeconds = 60;
+const toEnd = (seconds) => sql`("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null)
+  or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."member" not like 'guest:%' and (m."left_at" is null or m."left_at" > now() - make_interval(secs => ${seconds}))))`;
 /**
 * Ends what should have ended, over every call, whichever process served it: the members no process heard of within
 * `graceSeconds`, as after their socket was lost or their process stopped; the calls past their last minute; the
-* calls nobody is in any more. A call an admission holds is left to the next sweep. Old signals go too. The records
-* whose calls it changed.
+* calls nobody is in any more, and those with only guests in them `guestOnly` seconds after the last of the app's
+* members left. A call an admission holds is left to the next sweep. Old signals go too. The records whose calls it
+* changed.
 */
-const sweepCalls = (db, timeoutMs) => writeTransaction(db, timeoutMs, async (trx) => {
+const sweepCalls = (db, timeoutMs, guestOnly = 120) => writeTransaction(db, timeoutMs, async (trx) => {
 	const left = await sql`update "calls"."members" set "left_at" = now()
       where "left_at" is null and "seen_at" < now() - make_interval(secs => ${30}) returning "call_id"::text as id`.execute(trx);
 	const changed = new Set(left.rows.map((row) => row.id));
-	const { rows } = await sql`select "id"::text as id from "calls"."calls" c where "ended_at" is null
-      and ("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null))
+	const { rows } = await sql`select "id"::text as id from "calls"."calls" c where "ended_at" is null and ${toEnd(guestOnly)}
       for update skip locked`.execute(trx);
 	if (rows.length > 0) {
 		const ended = await sql`select "id"::text as id from "calls"."calls" c where "id" = any(${`{${rows.map((row) => row.id).join(",")}}`}::uuid[])
-        and ("ends_at" <= now() or not exists (select from "calls"."members" m where m."call_id" = c."id" and m."left_at" is null))`.execute(trx);
+        and ${toEnd(guestOnly)}`.execute(trx);
 		for (const { id } of ended.rows) {
 			await endCall(trx, id);
 			changed.add(id);

package/dist/calls/calls-access.js

@@ -1,11 +1,14 @@
 import { forbidden } from "../problem.js";
+import { isGuestMember } from "./guest-tokens.js";
 import { checkRing } from "./call-ring.js";
 //#region src/calls/calls-access.ts
 /** The largest message of a member's socket: a description, with room to spare. */
 const maxMessageBytes = 307200;
-const checkMember = ({ record, member }) => {
+const checkMember = ({ record, member, name }) => {
 	if (typeof record?.resource !== "string" || record.resource.length === 0) throw new TypeError("calls.join needs the record, { resource, key }");
 	if (typeof member !== "string" || member.length === 0) throw new TypeError("calls.join needs the member, a non-empty string");
+	if (isGuestMember(member)) throw new TypeError("calls.join takes no member that starts with guest:, which only guests are");
+	if (name !== void 0 && (typeof name !== "string" || name.length > 200)) throw new TypeError("calls.join takes a name of at most 200 characters");
 };
 const withoutCalls = () => Promise.reject(/* @__PURE__ */ new Error("This app has no calls: configure calls: { backend } in protobase.config.ts"));
 /**
@@ -30,7 +33,9 @@ const callsAccess = (service, caller) => {
 			const ring = member.ring && checkRing(member.ring);
 			const by = {
 				user: String(session.user.id),
-				...ring && { ring }
+				...ring && { ring },
+				...member.invites === true && { invites: true },
+				...member.name !== void 0 && { name: member.name }
 			};
 			return {
 				...await (await service.runtime()).relay(record, member.member, {

package/dist/calls/calls-runtime.d.ts

@@ -4,10 +4,20 @@ import { CallRingInput } from "./call-ring.js";
 import { CallRights } from "./call-member.js";
 import { CallRecord } from "./call-store.js";
 import { CallItem } from "./call-reads.js";
+import { GuestRow } from "./guest-checks-sql.js";
 import { CallStore } from "./calls-store.js";
+import { OrganizationOf } from "./guest-links-sql.js";
+import { GuestStore } from "./guest-store.js";
 import { Ringer } from "./ringer.js";
 import { Db } from "@protobase/query";
 //#region src/calls/calls-runtime.d.ts
+/** Who a member is beyond their id: the signed-in user, whom the call rings, whether they invite guests, and their name. */
+export type RelayBy = {
+  user?: string;
+  ring?: CallRingInput;
+  invites?: boolean;
+  name?: string;
+};
 export type CallsRuntimeInput = {
   db: Db;
   timeoutMs: number;
@@ -15,6 +25,10 @@ export type CallsRuntimeInput = {
   report: (error: unknown) => void;
   /** Memory in tests; the `calls` schema otherwise. */
   store?: CallStore;
+  /** Guest links and the lobby: the `calls` schema, without `store`; none with a `store` of a test's unless given. */
+  guests?: GuestStore;
+  /** The organization of a call's record, which its guest links are for; none by default. */
+  organizationOf?: OrganizationOf;
   /** The rings of calls, which joins with a `ring` start. */
   rings?: Ringer;
   /** Tells the record's readers its calls changed, such as on the record's channel. */
@@ -25,12 +39,19 @@ export type CallsRuntimeInput = {
  * its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
  * as served and sweeps every call, whichever process served it; with neither, it runs no timer.
  */
-export declare const callsRuntime: ({ db, timeoutMs, options, report, store, rings, announce }: CallsRuntimeInput) => {
+export declare const callsRuntime: ({ db, timeoutMs, options, report, store: given, guests: givenGuests, organizationOf, rings, announce }: CallsRuntimeInput) => {
   /** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
-  relay: (record: CallRecord, member: string, rights: CallRights, by?: {
-    user?: string;
-    ring?: CallRingInput;
-  }) => Promise<SocketEvents>;
+  relay: (record: CallRecord, member: string, rights: CallRights, by?: RelayBy) => Promise<SocketEvents>;
+  /** The guest's socket, relayed like a member's, as member `guest:<id>` in their link's call only, sending what it allows. */
+  relayGuest: (guest: GuestRow) => Promise<SocketEvents>;
+  /** Guest links and the lobby, for the guests' routes. */
+  guests: () => GuestStore;
+  /** The organization's admin set whether its calls take guests: the calls this process serves hear of it at once. */
+  setOrganizationGuests: (input: {
+    organization: string;
+    allowed: boolean;
+    by: string;
+  }) => Promise<void>;
   /** Removes the member from the call, and only from it: whether they were in it. */
   remove: (call: string, member: string) => Promise<boolean>;
   /** The calls that ring the user now, and declining one. */

package/dist/calls/calls-runtime.js

@@ -1,8 +1,10 @@
+import { guestMember } from "./guest-tokens.js";
 import { maxMembersOf } from "./calls-options.js";
 import { callHub } from "./call-hub.js";
 import { recordId } from "./call-reads.js";
 import { callWatch } from "./call-watch.js";
 import { sqlCallStore } from "./calls-store.js";
+import { sqlGuestStore } from "./guest-store.js";
 import { memberRelay } from "./member-relay.js";
 //#region src/calls/calls-runtime.ts
 /** How often the calls this process serves, and the records its pages follow, are read. */
@@ -18,11 +20,14 @@ const loadBackend = async (settings) => {
 * its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
 * as served and sweeps every call, whichever process served it; with neither, it runs no timer.
 */
-const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db, timeoutMs), rings, announce }) => {
+const callsRuntime = ({ db, timeoutMs, options, report, store: given, guests: givenGuests, organizationOf = async () => void 0, rings, announce }) => {
+	const store = given ?? sqlCallStore(db, timeoutMs);
+	const guests = given ? givenGuests : givenGuests ?? sqlGuestStore(db, timeoutMs, organizationOf);
 	const hub = callHub({
 		store,
 		manyProcesses: options.processes === "many",
-		report
+		report,
+		...guests && { lobbies: guests.lobbies }
 	});
 	const watch = callWatch(store);
 	const maxMembers = maxMembersOf(options.backend);
@@ -58,24 +63,59 @@ const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db,
 		}, readEveryMs);
 		timer.unref?.();
 	};
-	const door = { admit: async ({ user, ring, ...input }, link) => {
-		const admitted = await hub.admit(input, link);
-		schedule();
-		if ("refused" in admitted) return admitted;
-		changed([input.record]);
-		if (rings && user !== void 0) {
-			if (ring && admitted.started) await rings.start(admitted.call, input.record, user, ring).catch(report);
-			await rings.stop(admitted.call, user).catch(report);
-		}
-		return {
-			...admitted,
-			leave: async () => {
-				await admitted.leave();
-				changed([input.record]);
-				await rings?.settle();
+	const guestsChanged = async (call) => {
+		await hub.refresh([call]);
+		const record = await store.recordOf(call);
+		if (record) changed([record]);
+	};
+	const guestsOf = () => {
+		if (!guests) throw new Error("Not implemented: guests with a call store of a test");
+		return guests;
+	};
+	const door = {
+		admit: async ({ user, ring, ...input }, link) => {
+			const admitted = await hub.admit(input, link);
+			schedule();
+			if ("refused" in admitted) return admitted;
+			changed([input.record]);
+			if (rings && user !== void 0) {
+				if (ring && admitted.started) await rings.start(admitted.call, input.record, user, ring).catch(report);
+				await rings.stop(admitted.call, user).catch(report);
 			}
-		};
-	} };
+			return {
+				...admitted,
+				leave: async () => {
+					await admitted.leave();
+					changed([input.record]);
+					await rings?.settle();
+				}
+			};
+		},
+		...guests && { guests: {
+			link: async (input) => {
+				const made = await guests.createLink(input);
+				await hub.refresh([input.call]);
+				return made;
+			},
+			revoke: async (input) => {
+				const revoked = await guests.revokeLink(input);
+				await guestsChanged(input.call);
+				return revoked;
+			},
+			decide: async (input) => {
+				const decided = await guests.decide({
+					...input,
+					maxMembers
+				});
+				await hub.refresh([input.call]);
+				return decided;
+			},
+			remove: async (call, guest) => {
+				await store.remove(call, guestMember(guest));
+				await guestsChanged(call);
+			}
+		} }
+	};
 	return {
 		/** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
 		relay: async (record, member, rights, by = {}) => {
@@ -92,6 +132,31 @@ const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db,
 				...by
 			});
 		},
+		/** The guest's socket, relayed like a member's, as member `guest:<id>` in their link's call only, sending what it allows. */
+		relayGuest: async (guest) => {
+			backend ??= loadBackend(options.backend);
+			return memberRelay({
+				door,
+				backend: await backend,
+				record: guest.record,
+				member: guestMember(guest.id),
+				rights: { publish: guest.publish },
+				maxMembers,
+				maxMinutes,
+				report,
+				name: guest.name,
+				guest: {
+					id: guest.id,
+					call: guest.call
+				}
+			});
+		},
+		/** Guest links and the lobby, for the guests' routes. */
+		guests: guestsOf,
+		/** The organization's admin set whether its calls take guests: the calls this process serves hear of it at once. */
+		setOrganizationGuests: async (input) => {
+			for (const call of await guestsOf().setOrganization(input)) await guestsChanged(call);
+		},
 		/** Removes the member from the call, and only from it: whether they were in it. */
 		remove: async (call, member) => {
 			const record = await store.recordOf(call);

package/dist/calls/calls-service.js

@@ -7,10 +7,11 @@ import { appPath } from "@protobase/schema";
 const callsService = (deps, options, wiring) => {
 	let runtime;
 	const load = async () => {
-		const [{ callsRuntime }, { ringer, ringMessage }, { sqlRingStore }] = await Promise.all([
+		const [{ callsRuntime }, { ringer, ringMessage }, { sqlRingStore }, { recordOrganization }] = await Promise.all([
 			import("./calls-runtime.js"),
 			import("./ringer.js"),
-			import("./ring-store.js")
+			import("./ring-store.js"),
+			import("./record-organization.js")
 		]);
 		const { db, statementTimeoutMs, report, registry } = deps();
 		const recordUrl = ({ resource, key }) => wiring.origin === void 0 ? void 0 : new URL(appPath({
@@ -32,6 +33,7 @@ const callsService = (deps, options, wiring) => {
 					inbox: true
 				}, ringMessage(notification)) }
 			}),
+			...wiring.organizations && { organizationOf: recordOrganization(registry) },
 			announce: (record, items) => wiring.channels().broadcast({
 				resource: record.resource,
 				key: record.key,

package/dist/calls/calls-sql.d.ts

@@ -2,7 +2,7 @@ import { EventsOptions } from "../changes/events-options.js";
 import { Db } from "@protobase/query";
 //#region src/calls/calls-sql.d.ts
 /**
- * The SQL that adds the `calls` schema and its tables, and the changes schema's notices table rings reach open pages
+ * The SQL that adds the `calls` schema and its tables, or the guest tables to a calls schema without them, and the changes schema's notices table rings reach open pages
  * through, `undefined` when they are there. They are never dropped.
  */
 export declare const callsMigration: (db: Db, events?: EventsOptions) => Promise<string | undefined>;