domma-cms 0.105.2 → 0.106.0

package/plugins/booking/plugin.js

@@ -6,6 +6,8 @@
  *   GET  /count                   sidebar badge: bookings still to come today
  *   GET  /bookings?from=&to=      bookings starting in a range (ISO instants)
  *   GET  /bookings/:id · POST /bookings · PUT /bookings/:id · PUT /bookings/:id/move · DELETE /bookings/:id
+ *   GET  /bookings/:id/call-chat  an online booking's call chat, read-only (booking.read; 1.5) - saved per
+ *                                 session (a class's shared call has one) in data/call-chat.json
  *   GET  /slots?service=&from=&to=&with=&ignore=   free times (dates in the business zone)
  *   GET/POST /services · PUT/DELETE /services/:id
  *   GET/POST /bookables · PUT/DELETE /bookables/:id
@@ -24,6 +26,8 @@
  * The booking page itself is plugin.public.js.
  */
 
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
 import {getConfig} from '../../server/config.js';
 import {getPluginStates} from '../../server/services/plugins.js';
 import {getPermissionsFor} from '../../server/services/roles.js';
@@ -119,7 +123,9 @@ function registerShortcodes(hooks) {
     });
 }
 
-export const ASSET_V = '1.4.0';
+export const ASSET_V = '1.5.0';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
 
 export default async function booking(fastify, options) {
     const {authenticate, requirePermission} = options.auth;
@@ -135,6 +141,10 @@ export default async function booking(fastify, options) {
     // The online call's rooms (set once the engine is mounted, at the end). A booking cancelled or moved away
     // ends the call it was in, unless someone else is still booked into that session (a class).
     let calls = null;
+    // The call's chat (1.5), saved per session - set with the engine, at the end; null on an older core.
+    let chatStore = null;
+    let whoOf = null;
+    const dataDir = options.dataDir || path.join(HERE, 'data');
     async function endCall(old) {
         if (!calls || old?.online !== true) return;
         const room = sessionOf(old);
@@ -432,7 +442,24 @@ export default async function booking(fastify, options) {
 
     fastify.get('/bookings/:id', can('read'), async (request, reply) => {
         const b = await getBooking(request.params.id);
-        return b ? adminBooking(b) : fail(reply, 404, 'No such booking.');
+        if (!b) return fail(reply, 404, 'No such booking.');
+        // An online booking says how many messages its call's chat holds (the panel offers "Call chat").
+        const callChat = b.online === true && chatStore ? (await chatStore.load(sessionOf(b))).filter(i => i.kind === 'chat').length : undefined;
+        return reply.send({...adminBooking(b), ...(callChat !== undefined ? {callChat} : {})});
+    });
+
+    // The call's chat, read-only (1.5): the session's transcript - a class's shared call has one. Staff with
+    // booking read only; the customer saw it in the call. Staff (host) lines are marked `mine`.
+    fastify.get('/bookings/:id/call-chat', can('read'), async (request, reply) => {
+        const b = await getBooking(request.params.id);
+        if (!b || b.online !== true) return fail(reply, 404, 'No such online booking.');
+        const room = sessionOf(b);
+        const items = chatStore ? await chatStore.load(room) : [];
+        const hosts = new Set(whoOf ? (await allBookings()).filter(x => x.online === true && sessionOf(x) === room)
+            .map(x => whoOf(`${x.id}:host`, '')) : []);
+        reply.header('Cache-Control', 'no-store');
+        return reply.send({messages: items.filter(i => i.kind === 'chat').length,
+            items: items.map(({from, ...i}) => ({...i, mine: i.kind === 'chat' && hosts.has(i.who)}))});
     });
 
     /** Service + the bookables that may take a booking of it (`with` narrows to one). */
@@ -536,6 +563,11 @@ export default async function booking(fastify, options) {
         const b = await getBooking(request.params.id);
         if (!b) return fail(reply, 404, 'No such booking.');
         await removeBooking(b.id);
+        // Its call's chat goes with it - unless someone else is still booked into that session (a class).
+        if (b.online === true && chatStore) {
+            const room = sessionOf(b);
+            if (!(await allBookings()).some(x => x.online === true && sessionOf(x) === room)) await chatStore.remove(room)?.catch?.(() => {});
+        }
         return {ok: true};
     });
 
@@ -788,7 +820,13 @@ export default async function booking(fastify, options) {
     // The engine is core's (_lib/call); an older core without it simply has no calls.
     try {
         const {mountCallRoutes} = await import('../_lib/call/routes.js');
-        calls = mountCallRoutes(fastify, {prefix: '/call', ns: 'booking', resolve: async (request, room, body) => {
+        // The chat is saved per session (1.5; a core with the chat store) so a call reopened later shows it.
+        try {
+            const {createChatStore} = await import('../_lib/call/chatStore.js');
+            chatStore = createChatStore(path.join(dataDir, 'call-chat.json'));
+            whoOf = (await import('../_lib/call/rooms.js')).whoOf || null;
+        } catch { chatStore = null; }
+        calls = mountCallRoutes(fastify, {prefix: '/call', ns: 'booking', ...(chatStore ? {chat: chatStore} : {}), resolve: async (request, room, body) => {
             const b = await getBooking(String(body?.b || '')).catch(() => null);
             // A class opened early ("Call now") is open for everyone in the session - someone who booked in
             // after the click too: take the session's latest opening when this booking has none of its own.

package/plugins/booking/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",

package/plugins/booking/tests/api.test.js

@@ -6,6 +6,7 @@
 import {after, before, test} from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import Fastify from 'fastify';
 import booking from '../plugin.js';
@@ -20,6 +21,7 @@ const DIRS = ['booking-bookables', 'booking-services', 'booking-bookings'].map(c
 const TZ = 'Europe/London';
 let savedPlugins;
 let app;
+let dataDir;
 const sent = [];
 const notices = [];
 const related = {};
@@ -30,11 +32,14 @@ before(async () => {
     for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
     setMailer(async (msg) => { sent.push(msg); });
     app = Fastify();
+    dataDir = await fs.mkdtemp(path.join(os.tmpdir(), 'booking-data-'));
     const authenticate = async (req) => { req.user = {id: 'u1', name: 'Sam', role: 'admin'}; };
     await app.register(booking, {
         prefix: '',
-        auth: {authenticate, requirePermission: () => async () => {}},
+        // `x-deny` stands for a role without the permission.
+        auth: {authenticate, requirePermission: () => async (req, reply) => { if (req.headers['x-deny']) return reply.code(403).send({error: 'Forbidden'}); }},
         settings: {},
+        dataDir,
         hooks: {
             notify: (n) => notices.push(n), registerShortcode() {},
             registerRelatedItems: (kind, p) => { related[kind] = p; return true; }
@@ -49,6 +54,7 @@ after(async () => {
     if (savedPlugins === null) await fs.rm(PLUGINS, {force: true});
     else await fs.writeFile(PLUGINS, savedPlugins);
     if (savedContacts !== null) await fs.writeFile(CONTACTS, savedContacts);
+    if (dataDir) await fs.rm(dataDir, {recursive: true, force: true});
 });
 
 const call = async (method, url, body) => {
@@ -355,6 +361,63 @@ test('online: a service an extension makes online gives a call - the customer an
     }
 });
 
+test('online: the call\'s chat is saved per session - counted on the booking, read by staff, seeds the reopened call', async () => {
+    const reg = bookingRegistry();
+    reg.register('test-online', {rules: (s) => (s?.slug === 'chat-call' ? {online: true} : {})});
+    try {
+        const all = Object.fromEntries(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun'].map(d => [d, [{from: '00:00', to: '24:00'}]]));
+        let r = await call('POST', '/bookables', {name: 'Cara', kind: 'person', hours: all});
+        const cara = r.body;
+        r = await call('POST', '/services', {name: 'Chat call', duration: 30, minNoticeMinutes: 0, bookables: [cara.id]});
+        const svc = r.body;
+        const start = new Date(Math.ceil((Date.now() + 5 * 60000) / 60000) * 60000).toISOString();
+        r = await call('POST', '/bookings', {serviceId: svc.id, startAt: start, customer: {name: 'Gus Guest', email: 'gus@example.com'}, force: true});
+        assert.equal(r.status, 201, JSON.stringify(r.body));
+        const b = r.body;
+        const raw = JSON.parse(await fs.readFile(path.resolve('content/collections/booking-bookings/data.json'), 'utf8'))
+            .map(e => e.data ? {id: e.id, ...e.data} : e).find(x => x.id === b.id);
+        const room = b.hostUrl.split('/call/')[1].split('?')[0];
+        const hostKey = new URL(`http://x${b.hostUrl}`).searchParams.get('h');
+        const as = (p) => ({'x-call-id': p.id, 'x-call-secret': p.secret});
+        const post = (u, payload, headers = {}) => app.inject({method: 'POST', url: u, payload, headers});
+
+        assert.equal((await call('GET', `/bookings/${b.id}`)).body.callChat, 0, 'no chat yet');
+        const host = (await post(`/call/${room}/join`, {b: b.id, h: hostKey})).json();
+        const guest = (await post(`/call/${room}/join`, {b: b.id, t: raw.token})).json();
+        assert.equal(guest.state, 'waiting');
+        await post(`/call/${room}/answer`, {who: guest.id, yes: true}, as(host));
+        assert.equal((await post(`/call/${room}/chat`, {text: 'Hello Gus'}, as(host))).statusCode, 200);
+        assert.equal((await post(`/call/${room}/chat`, {text: 'Hi <Cara>'}, as(guest))).statusCode, 200);
+        await post(`/call/${room}/leave`, {}, as(guest));
+        await post(`/call/${room}/leave`, {}, as(host));
+        await new Promise(res => setTimeout(res, 30));
+
+        // Saved in the plugin's data folder, keyed by the session.
+        const file = JSON.parse(await fs.readFile(path.join(dataDir, 'call-chat.json'), 'utf8'));
+        assert.equal(file.rooms[room].items.filter(i => i.kind === 'chat').length, 2);
+        assert.equal((await call('GET', `/bookings/${b.id}`)).body.callChat, 2);
+        r = await call('GET', `/bookings/${b.id}/call-chat`);
+        assert.equal(r.status, 200);
+        assert.equal(r.body.messages, 2);
+        assert.deepEqual(r.body.items.filter(i => i.kind === 'chat').map(i => [i.name, i.text, i.mine]), [['Cara', 'Hello Gus', true], ['Gus Guest', 'Hi <Cara>', false]]);
+        assert.ok(r.body.items.every(i => !('from' in i)));
+        assert.ok(r.body.items.some(i => i.kind === 'system' && i.text === 'Gus Guest left'));
+        // Staff without booking read: refused. Not online / missing: 404.
+        assert.equal((await app.inject({method: 'GET', url: `/bookings/${b.id}/call-chat`, headers: {'x-deny': '1'}})).statusCode, 403);
+        assert.equal((await call('GET', '/bookings/nope/call-chat')).status, 404);
+
+        // Everyone left, the room is gone: rejoining shows the earlier chat.
+        const again = (await post(`/call/${room}/join`, {b: b.id, h: hostKey})).json();
+        const polled = (await app.inject({method: 'GET', url: `/call/${room}/poll?since=0`, headers: as(again)})).json();
+        const admitted = polled.events.find(e => e.type === 'admitted');
+        assert.ok(admitted.chat.some(i => i.text === 'Hello Gus') && admitted.chat.some(i => i.text === 'Hi <Cara>'));
+        await post(`/call/${room}/leave`, {}, as(again));
+        await call('DELETE', `/bookings/${b.id}`);
+    } finally {
+        reg.unregister('test-online');
+    }
+});
+
 test('extensions: banner actions reach the bootstrap, only under their owner, one per id', async () => {
     const reg = bookingRegistry();
     assert.ok(reg.version >= 4);

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@25153e0",
+  "source": "dcms-marketplace@ba58fcb",
   "plugins": {
     "blog": {
       "version": "1.9.4",
@@ -73,19 +73,19 @@
       }
     },
     "booking": {
-      "version": "1.4.1",
+      "version": "1.5.0",
       "files": {
-        "CLAUDE.md": "c4401810011ed98fe488e89e03d32ee601025818d1f354ec07fcd9f9add1115a",
+        "CLAUDE.md": "258f342c1acdd1d7562a3409bc7c8622828308c243549255d2ac75832be6d84e",
         "admin/css/index.css": "4f7731921c0c5038cb1566a6ab2d43ffc35bf9b161e58f87a0cff423e81b47fa",
         "admin/lib/details.js": "8b37536bfa9ccfcc5265cc957ba8266d3f5f777133e7c0946ae49540f1c80e3c",
         "admin/lib/diary-layout.js": "d818c79001fb9a9ecc15c96239ba961b0a1d98b9e8fce903eefb57d85adf2a73",
         "admin/lib/extension-sections.js": "0588ad47660e511b0dd8077bb9c3999c775d97597333a75e87ee12d915bbf00b",
-        "admin/lib/kit.js": "661e9c407bf398694dfa08105590065a6352594d526f3c09c31b180c840045bf",
+        "admin/lib/kit.js": "b69b02172d76ef80879da3f003cc1e687c6149626c9e58af51729c2e4a3ff959",
         "admin/templates/booking.html": "20b9a3bfe3e5d5bbee613f29be99551b12790fb38f80d119585360cc38e9ec57",
         "admin/views/booking.js": "4eddf6c0b60dbbba4c6e35352df247a3d34b66ee1d43c51fe2d53f894707348f",
         "admin/views/bookings.js": "bf17db82ed4d2f5c29ac924dd60dc0b84c8bd9c8ce32da6cbb011527699a56a6",
         "admin/views/diary.js": "9e8976e67c2232d353b3d9a1ef0d0503cc4d06b710d54d0cba84fb5b796fdfe9",
-        "admin/views/panels.js": "9d1c45e56d2a7a8caa12e9af29545c808ffb88da3ea48397d55aae19e802ec69",
+        "admin/views/panels.js": "1d269d90553a5482fd6ebd18180cb736011770f0204d5c1306948abcb4b676b2",
         "admin/views/people.js": "58cb9cc550b48c959a5572a4d25650ea2b32b658c9d0bf4c244e4abe0277c211",
         "admin/views/services.js": "122326d222ed16dc8ec903fef6f62f6a7638c31d73c4612b7a8c2ced38358068",
         "admin/views/settings.js": "299297b47a6509986276a859807a33ea225681d28e0e9cd06cdf36b0f6ec0c11",
@@ -93,14 +93,14 @@
         "collections/booking-bookings.json": "fa0b15cc81b4a2114734a0bc8adc4b4d25049d16cf62549b83634cdbeb543b52",
         "collections/booking-services.json": "cecb500a9215a0eba894e6b4c9ae78f5fbeb209830d07d47050c56c75143f66a",
         "config.js": "5565fd627481cf809322257cc300a7cbb7ccbf6cae076b4cf8a7453fcf554bd3",
-        "docs/guide.md": "545b050500a09ffdf7bc620e01f0b63bf59e92dfe855ba3201419b0bcc92a1fc",
+        "docs/guide.md": "dd6a8250ac25914dc8ac6922167c92e815f69f464d61b424dfab42770af59626",
         "inject/body.html": "ab55ce945eec2302eb0c836a4626cffa5e091d050c6a59c6f2af332b05570777",
         "lib/call.js": "7dfa0ae60be87d8f7f26b4360d5c1144322abe66eb61b233ed812e35bb8e59bd",
         "lib/extensions.js": "8cec28ff8685daad8083b23f034f1c3bf82fd2322943dd19d46570ccdc311105",
         "lib/mail.js": "cad8f409df62d6e42f0f4024ec364bbe018a62b842fa3f7c38786fd4e7f92408",
         "lib/store.js": "270161f907c68de39d32758931e86c290582524af4650e722c2c3be209acc875",
-        "plugin.js": "963e8190dbcaec71915d73402648899bb38135b25ec869a659d0938d03868682",
-        "plugin.json": "704402863b0aec563046b347d4341680e2dc9739db967bec0a933c2bf0e4e5c9",
+        "plugin.js": "afe2c3dd15c69515828f513478bb40f2ea3788a8b67ace571c01198acd79dc3b",
+        "plugin.json": "be0576b42a5fa60c04da8131a5d20113c020eb8088db228892f0715e9b1808f8",
         "plugin.public.js": "5f2dc4f01202b16ae804364a33c547509d1fa4026eadebac440730234aa266b5",
         "public/booking.css": "8b88989fdd04e50efc1688a2f32fe2e422299d7d13b81bb8fce0cc162fa99df6",
         "public/booking.js": "7dfc3d205696967013886567f67a867443c2e370bac29019d69911d695fdbade",
@@ -110,7 +110,7 @@
         "public/lib/time.js": "48e13a23e3d7a4916e2097e8f87c03a87d37b71c4ef037a5a16143c6a4185c41",
         "templates/booking.html": "a4995de46dfdab7e692b56f21347f29c76320cf3b0477889dc3c5d14e0b6dcd7",
         "tests/admin-diary.test.js": "4e34b447d62b41272ceec49bad9d491ae00dd04f4760d8a7a3046be1912f4abe",
-        "tests/api.test.js": "57ce73f48776e15454794405bae5b9674baeda46a96e4a11d0e253c6a977a764",
+        "tests/api.test.js": "937a79e5af9af6b3f12b7ae15dabc470a91c7fe8ca03e3f7f261e4e641dfe3dc",
         "tests/public.test.js": "0b7b626d60df5a3d73d7c0077b73f59b62a9fded98ce84a8d93cd32cd0333159",
         "tests/pure.test.js": "8ba0c8f76b4c9efcc422f39ff29509612544d81f760025a4b9a5594af14e7bcf"
       }

package/server/routes/api/calls.js

@@ -10,7 +10,8 @@
  *   GET  /api/calls/contacts?q=         contacts the caller may READ (own + shared), to pick     (calls.create)
  *   GET  /api/calls/contact/:id         one contact the caller may read, to fill in             (calls.create)
  *   POST /api/calls                     {name, email?, contactId?, notify} -> 201 {id, hostUrl, joinUrl, emailed, emailLimited?, expiresAt}
- *   GET  /api/calls?contact=<id>        the caller's recent calls with that contact             (calls.read)
+ *   GET  /api/calls?contact=<id>        the caller's recent calls with that contact, with `messages` (calls.read)
+ *   GET  /api/calls/:id/chat            the call's saved chat (read-only transcript) - its HOST or an admin (calls.read)
  *
  * Contacts are read through `readableContactIds` (services/hooks.js): the
  * caller's own, plus whatever a sharing plugin (Contacts Pro) lets them read -
@@ -29,13 +30,14 @@ import {authenticate as defaultAuthenticate, requirePermission as defaultRequire
 import {getEntry, listEntries} from '../../services/collections.js';
 import {readableContactIds} from '../../services/hooks.js';
 import {getPermissionsFor} from '../../services/roles.js';
-import {getEffectiveRoles} from '../../services/userRoles.js';
+import {getEffectiveLevel, getEffectiveRoles} from '../../services/userRoles.js';
 import {isToolEnabled} from '../../services/tools.js';
 import {mountCallRoutes} from '../../../plugins/_lib/call/routes.js';
+import {whoOf} from '../../../plugins/_lib/call/rooms.js';
 import {getBaseUrl} from '../public.js';
 import {
-    EMAIL_RE, callMailReady, callPaths, callsOfContact, createCall, getCall, instantCallsEnabled, isOpen,
-    mayEmailAddress, mayStartCall, sendCallEmail, whoIsCalling
+    EMAIL_RE, callChat, callMailReady, callPaths, callsOfContact, chatCountOf, createCall, getCall, instantCallsEnabled, isOpen,
+    mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
 } from '../../services/instantCalls.js';
 
 const CONTACTS_SLUG = 'contacts-contacts';
@@ -122,13 +124,31 @@ export async function callsRoutes(fastify, opts = {}) {
         if (!contact) return fail(reply, 400, 'contact is required');
         const now = Date.now();
         const list = (await callsOfContact(contact, uidOf(request))).slice(0, 20)
-            .map(c => ({id: c.id, name: c.name, createdAt: c.createdAt, expiresAt: c.expiresAt, open: isOpen(c, now)}));
+            .map(c => ({id: c.id, name: c.name, createdAt: c.createdAt, expiresAt: c.expiresAt, open: isOpen(c, now), messages: chatCountOf(c)}));
         return reply.send(list);
     });
 
+    // The call's chat, saved against it: for the host who made the call, or an admin. Anyone else: 404 (not 403 -
+    // whether a call exists is the host's business). `mine` marks the host's own lines for the bubbles.
+    fastify.get('/:id/chat', can('read'), async (request, reply) => {
+        const rec = await getCall(String(request.params.id));
+        const uid = uidOf(request);
+        let admin = false;
+        try { admin = getEffectiveLevel(request.user || {}) <= 1; } catch { admin = false; }
+        if (!rec || !uid || (rec.hostId !== uid && !admin)) return fail(reply, 404, 'That call could not be found.');
+        const hostWho = whoOf(`${rec.id}:host`, '');
+        const mineToo = rec.hostId === uid;
+        const items = (await callChat(rec.id)).map(({from, ...i}) => ({...i, mine: mineToo && i.kind === 'chat' && i.who === hostWho}));
+        reply.header('Cache-Control', 'no-store');
+        return reply.send({id: rec.id, name: rec.name, hostName: rec.hostName, createdAt: rec.createdAt, expiresAt: rec.expiresAt,
+            messages: chatCountOf(rec), items});
+    });
+
     // The call engine: a room per call, guests knock, the host lets them in, open createdAt..expiresAt.
     mountCallRoutes(fastify, {
         prefix: '/room', ns: 'instant', ...(opts.rooms ? {rooms: opts.rooms} : {}),
-        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h})
+        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h}),
+        // The chat is saved against the call record, so a call reopened (or after a restart) shows it again.
+        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)}
     });
 }

package/server/services/instantCalls.js

@@ -19,7 +19,10 @@
  * actions and list stand aside (checked per request), so nobody sees two.
  *
  * A record: {id, name, email, contactId, hostId, hostName, token, hostKey,
- * createdAt, expiresAt}. Kept in memory and in one JSON file with the sign-in
+ * createdAt, expiresAt, chat?}. `chat` is the call's chat, saved against the
+ * call (the engine's items - typed messages plus joined/left lines - the last
+ * CHAT_MAX); the engine seeds a reopened room from it, and the host (or an
+ * admin) reads it afterwards through GET /api/calls/:id/chat. Kept in memory and in one JSON file with the sign-in
  * sessions (content/sessions/ - runtime state, never committed; see
  * siteGitignore.js), so a restart keeps the links working. The call itself (who
  * is in it) is the call engine's, in memory. Records are forgotten KEEP_DAYS
@@ -44,6 +47,8 @@ import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.
 export const INSTANT_HOURS = 3;
 export const KEEP_DAYS = 30;
 export const MAX_KEPT = 2000;
+/** Chat items kept on one call record (the engine's HISTORY_MAX). */
+export const CHAT_MAX = 500;
 export const CALL_PATH = '/_call';
 export const ROOM_API = '/api/calls/room';
 export const ID_RE = /^[\w-]{16,40}$/;
@@ -141,9 +146,14 @@ function registerActions() {
         async list({id, user}) {
             if (!user?.id || !mayCall(user, 'read')) return [];
             const now = Date.now();
-            return (await callsOfContact(id, String(user.id))).slice(0, 5).map(c => ({
-                id: c.id, title: 'Video call', startAt: c.createdAt, past: !isOpen(c, now), meta: isOpen(c, now) ? 'open now' : ''
-            }));
+            return (await callsOfContact(id, String(user.id))).slice(0, 5).map((c) => {
+                const n = chatCountOf(c);
+                return {
+                    id: c.id, title: 'Video call', startAt: c.createdAt, past: !isOpen(c, now), meta: isOpen(c, now) ? 'open now' : '',
+                    // The admin's Calls list offers "N messages" - a read-only transcript (GET /api/calls/:id/chat).
+                    ...(n ? {transcript: {url: `/calls/${encodeURIComponent(c.id)}/chat`, count: n, title: `Video call with ${c.name || 'a guest'}`}} : {})
+                };
+            });
         }
     });
     // An email in the mail reader: "Call Sam now…" with the sender filled in.
@@ -234,6 +244,46 @@ export async function getCall(id) {
     return (await load()).get(id) || null;
 }
 
+/** The chat item as it is kept on a record; null for junk. System lines other than joined/left are not kept. */
+function chatItem(raw) {
+    if (!raw || typeof raw !== 'object' || typeof raw.text !== 'string' || !raw.id) return null;
+    const kind = raw.kind === 'system' ? 'system' : 'chat';
+    if (kind === 'system' && raw.event !== 'joined' && raw.event !== 'left') return null;
+    const item = {id: String(raw.id).slice(0, 64), seq: Number(raw.seq) || 0, at: String(raw.at || ''), kind,
+        from: String(raw.from || '').slice(0, 64), who: String(raw.who || '').slice(0, 64),
+        name: String(raw.name || '').slice(0, 60), text: raw.text.slice(0, 1000)};
+    if (kind === 'system') item.event = raw.event;
+    return item;
+}
+
+/**
+ * Save one chat item against its call (the engine's `chat.save`). Queued with
+ * every other write to the file; the last CHAT_MAX are kept. A call that is no
+ * longer on record (forgotten, or never) keeps nothing.
+ */
+export async function saveCallChat(id, raw) {
+    const item = chatItem(raw);
+    if (!item || typeof id !== 'string' || !ID_RE.test(id)) return;
+    const all = await load();
+    const rec = all.get(id);
+    if (!rec) return;
+    const chat = Array.isArray(rec.chat) ? rec.chat : [];
+    if (chat.some(c => c?.id === item.id)) return;
+    chat.push(item);
+    if (chat.length > CHAT_MAX) chat.splice(0, chat.length - CHAT_MAX);
+    rec.chat = chat;
+    await save(all);
+}
+
+/** A call's saved chat, oldest first ([] for none). */
+export async function callChat(id) {
+    const rec = await getCall(id);
+    return Array.isArray(rec?.chat) ? rec.chat.map(c => ({...c})) : [];
+}
+
+/** How many typed messages a call's chat holds (not the joined/left lines). */
+export const chatCountOf = (rec) => (Array.isArray(rec?.chat) ? rec.chat.filter(c => c?.kind === 'chat').length : 0);
+
 /** One host's calls with one contact, newest first. */
 export async function callsOfContact(contactId, hostId) {
     if (!contactId || !hostId) return [];