domma-cms 0.106.0 → 0.107.1

package/public/js/celebrations/trait-data.mjs

@@ -0,0 +1 @@
+export const CELEBRATION_THEMES={christmas:{label:"Christmas",traits:{snowflake:{label:"Snowflakes",types:["snowflake"],kind:"particle"},tree:{label:"Christmas trees",types:["tree"],count:"trees"},wreath:{label:"Wreaths",types:["wreath"],count:"wreaths"},snowman:{label:"Snowmen",types:["snowman"],count:"snowmen"},northStar:{label:"North star",types:["north-star"],count:"northStars"},sleigh:{label:"Santa's sleigh",types:["sleigh"]},robin:{label:"Robins",types:["robin"]},train:{label:"Steam train",types:["train"]},elf:{label:"Elves",types:["elf"]},peeingElf:{label:"Peeing elf",types:["peeing-elf"],chance:"peeingElfChance",enabled:!1},thievingElf:{label:"Thieving elf",types:["thieving-elf"],chance:"thievingElfChance",enabled:!1},firework:{label:"Fireworks",types:["firework","spark"]}}},halloween:{label:"Halloween",traits:{pumpkin:{label:"Falling pumpkins",types:["pumpkin"],kind:"particle"},bat:{label:"Bats",types:["bat"],kind:"particle"},ghost:{label:"Ghosts",types:["ghost"],kind:"particle"},spider:{label:"Spiders",types:["spider","spider-small"],count:"spiders"},gravestone:{label:"Gravestones",types:["gravestone"],count:"gravestones"},jackOLantern:{label:"Jack-o-lanterns",types:["jack-o-lantern"],count:"jackOLanterns"},scarecrow:{label:"Scarecrows",types:["scarecrow"],count:"scarecrows"},twinklingStar:{label:"Twinkling stars",types:["twinkling-star"],count:"twinklingStars"},hauntedHouse:{label:"Haunted house",types:["haunted-house"]},moon:{label:"Moon",types:["moon"]},witch:{label:"Witches",types:["witch"]},cauldron:{label:"Cauldron",types:["cauldron"]},floatingPumpkin:{label:"Floating pumpkins",types:["floating-pumpkin"]},lightning:{label:"Lightning",global:!0}}},valentines:{label:"Valentine's Day",traits:{heart:{label:"Hearts",types:["heart"],kind:"particle"},rosePetal:{label:"Rose petals",types:["rose-petal"],kind:"particle"},sparkle:{label:"Sparkles",types:["sparkle"],kind:"particle"},lips:{label:"Kisses",types:["lips"],kind:"particle"},heartGarland:{label:"Heart garlands",types:["heart-garland"],count:"garlands"},butterfly:{label:"Butterflies",types:["butterfly"],count:"butterflies"},envelope:{label:"Envelopes",types:["envelope"],count:"envelopes"},heartMoon:{label:"Heart moon",types:["heart-moon"]},cupid:{label:"Cupid",types:["cupid"],chance:"cupidChance"},loveLetter:{label:"Love letters",types:["love-letter"]},neonSign:{label:"Neon sign",types:["neon-sign"]}}},"guy-fawkes":{label:"Guy Fawkes Night",traits:{ember:{label:"Embers",types:["ember"],kind:"particle"},spark:{label:"Sparks",types:["spark","trail"],kind:"particle"},bonfire:{label:"Bonfires",types:["bonfire"],count:"bonfires"},guyEffigy:{label:"Guy effigies",types:["guy-effigy"]},catherineWheel:{label:"Catherine wheels",types:["catherine-wheel"]},romanCandle:{label:"Roman candles",types:["roman-candle"]},sparklerBundle:{label:"Sparklers",types:["sparkler-bundle"]},firework:{label:"Fireworks",types:["firework"],chance:"fireworkChance"},rocket:{label:"Rockets",types:["rocket"],chance:"rocketChance"},burst:{label:"Bursts",types:["burst"],chance:"burstChance"},moon:{label:"Moon",types:["moon"]},lightning:{label:"Lightning",global:!0}}},"st-patricks":{label:"St Patrick's Day",traits:{cloverPetal:{label:"Clover petals",types:["clover-petal"],kind:"particle"},shamrock:{label:"Shamrocks",types:["shamrock"],kind:"particle"},goldCoin:{label:"Gold coins",types:["gold-coin"],kind:"particle"},sparkle:{label:"Sparkles",types:["sparkle"],kind:"particle"},potOfGold:{label:"Pots of gold",types:["pot-of-gold"],count:"pots"},twinklingStar:{label:"Twinkling stars",types:["twinkling-star"],count:"twinklingStars"},leprechaun:{label:"Leprechauns",types:["leprechaun","static-leprechaun"],chance:"leprechaunChance"},rainbow:{label:"Rainbow",types:["rainbow"]},banshee:{label:"Banshee",types:["banshee"]},moon:{label:"Moon",types:["moon"]}}},"st-davids":{label:"St David's Day",traits:{daffodilPetal:{label:"Daffodil petals",types:["daffodil-petal"],kind:"particle"},daffodil:{label:"Daffodils",types:["daffodil"],kind:"particle"},springSparkle:{label:"Spring sparkles",types:["spring-sparkle"],kind:"particle"},leek:{label:"Leeks",types:["leek"],kind:"particle"},daffodilField:{label:"Daffodil fields",types:["daffodil-field"],count:"daffodilFields"},twinklingStar:{label:"Twinkling stars",types:["twinkling-star"],count:"twinklingStars"},welshDragon:{label:"Welsh dragon",types:["welsh-dragon"],chance:"dragonChance"},flag:{label:"Welsh flag",types:["flag"]},harp:{label:"Harp",types:["harp"]},leekBundle:{label:"Leek bundles",types:["leek-bundle"]}}},"st-georges":{label:"St George's Day",traits:{rosePetal:{label:"Rose petals",types:["rose-petal"],kind:"particle"},tudorRose:{label:"Tudor roses",types:["tudor-rose"],kind:"particle"},oakLeaf:{label:"Oak leaves",types:["oak-leaf"],kind:"particle"},sparkle:{label:"Sparkles",types:["sparkle"],kind:"particle"},englishRose:{label:"English roses",types:["english-rose"],count:"roses"},twinklingStar:{label:"Twinkling stars",types:["twinkling-star"],count:"twinklingStars"},knight:{label:"Knight",types:["knight"],chance:"knightChance"},dragon:{label:"Dragon",types:["dragon"]},castle:{label:"Castle",types:["castle"]},shield:{label:"Shields",types:["shield"]},stGeorgesCross:{label:"St George's cross",types:["st-georges-cross"]}}},"st-andrews":{label:"St Andrew's Day",traits:{heatherPetal:{label:"Heather petals",types:["heather-petal"],kind:"particle"},heather:{label:"Heather",types:["heather"],kind:"particle"},saltireSparkle:{label:"Saltire sparkles",types:["saltire-sparkle"],kind:"particle"},thistle:{label:"Thistles",types:["thistle"],kind:"particle"},thistlePlant:{label:"Thistle plants",types:["thistle-plant"],count:"thistles"},twinklingStar:{label:"Twinkling stars",types:["twinkling-star"],count:"twinklingStars"},bagpiper:{label:"Bagpiper",types:["bagpiper"],chance:"bagpiperChance"},saltireFlag:{label:"Saltire flag",types:["saltire-flag"]},tartanPattern:{label:"Tartan",types:["tartan-pattern"]},highlandScene:{label:"Highland scene",types:["highland-scene"]}}}};const c=a=>String(a).toLowerCase().replace(/[^a-z0-9]/g,"");export const traitAttribute=a=>a.replace(/[A-Z]/g,s=>"-"+s.toLowerCase());export function resolveCelebrationTraits(a,s={}){const n=new Set,r=new Set,i={},o=Object.entries(s).map(([l,e])=>[c(l),String(e).trim().toLowerCase()]),b=o.some(([l,e])=>["fallingonly","snowonly"].includes(l)&&["true","1","yes","on"].includes(e));for(const[l,e]of Object.entries(CELEBRATION_THEMES[a]?.traits||{})){const p=o.find(([t])=>[l,e.count,e.chance].filter(Boolean).some(d=>c(d)===t))?.[1];if(["off","false","0","no"].includes(p)||e.enabled===!1&&!["true","1","yes","on"].includes(p)||b&&e.kind!=="particle"){for(const t of e.types||[])n.add(t);e.global&&r.add(l);for(const t of[e.count,e.chance].filter(Boolean))i[t]=0}}return{disabledTypes:n,disabledGlobals:r,config:i}}

package/public/js/effects.js

@@ -1 +1 @@
-(function(){"use strict";fetch("/api/effects/settings").then(function(y){return y.json()}).then(function(y){var z=y.respectMotion!==!1,A=y.defaultDuration||600,S=y.defaultAnimation||"fade",E=y.defaultThreshold!=null?y.defaultThreshold:.1,p=z&&window.matchMedia&&window.matchMedia("(prefers-reduced-motion: reduce)").matches,d=document.querySelector(".page-body");if(!d)return;function r(t,e){return t.getAttribute("data-fx-"+e)}function i(t,e,n){var a=r(t,e);return a!==null?parseFloat(a):n}function v(t,e,n){var a=r(t,e);return a===null?n:a==="true"||a==="1"}function b(t,e,n){var a=new IntersectionObserver(function(o){o[0].isIntersecting&&(a.unobserve(t),n())},{threshold:e});a.observe(t)}d.querySelectorAll(".dm-fx-reveal").forEach(function(t){var e=r(t,"animation")||S,n=i(t,"duration",A),a=i(t,"delay",0),o=i(t,"threshold",E),f=v(t,"once",!0);p||(t.style.opacity="0",t.style.transition="none",e==="slide-up"?t.style.transform="translateY(30px)":e==="slide-down"?t.style.transform="translateY(-30px)":e==="zoom"?t.style.transform="scale(0.85)":e==="flip"&&(t.style.transform="rotateY(90deg)"),requestAnimationFrame(function(){requestAnimationFrame(function(){t.style.transition="opacity "+n+"ms ease "+a+"ms, transform "+n+"ms ease "+a+"ms";var s=new IntersectionObserver(function(u){u.forEach(function(h){h.isIntersecting?(t.style.opacity="1",t.style.transform="",f&&s.unobserve(t)):f||(t.style.opacity="0",e==="slide-up"?t.style.transform="translateY(30px)":e==="slide-down"?t.style.transform="translateY(-30px)":e==="zoom"?t.style.transform="scale(0.85)":e==="flip"?t.style.transform="rotateY(90deg)":t.style.transform="")})},{threshold:o});s.observe(t)})}))}),d.querySelectorAll(".dm-fx-counter").forEach(function(t){var e=i(t,"to",0),n=i(t,"from",0),a=i(t,"duration",2e3),o=r(t,"prefix")||"",f=r(t,"suffix")||"",s=i(t,"decimals",0),u=r(t,"separator")||"";function h(m){var l=m.toFixed(s);if(u){var x=l.split(".");x[0]=x[0].replace(/\B(?=(\d{3})+(?!\d))/g,u),l=x.join(".")}return o+l+f}if(p){t.textContent=h(e);return}b(t,.5,function(){var m=null;requestAnimationFrame(function l(x){m||(m=x);var w=Math.min((x-m)/a,1),q=1-Math.pow(1-w,3);t.textContent=h(n+(e-n)*q),w<1&&requestAnimationFrame(l)})})}),p||d.querySelectorAll(".dm-fx-scramble").forEach(function(t){var e=i(t,"speed",50),n=t.textContent,a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%&",o=0;b(t,.3,function(){var f=setInterval(function(){for(var s="",u=0;u<n.length;u++)u<o||n[u]===" "?s+=n[u]:s+=a[Math.floor(Math.random()*a.length)];t.textContent=s,o<n.length?o++:clearInterval(f)},e)})}),p||d.querySelectorAll(".dm-fx-shake").forEach(function(t){var e=i(t,"intensity",5),n=i(t,"duration",500),a=r(t,"direction")||"horizontal",o=a==="vertical"?"translateY":"translateX";t.animate([{transform:o+"(0)"},{transform:o+"(-"+e+"px)"},{transform:o+"("+e+"px)"},{transform:o+"(-"+e+"px)"},{transform:o+"("+e+"px)"},{transform:o+"(0)"}],{duration:n,easing:"ease-in-out"})}),d.querySelectorAll(".dm-fx-ripple").forEach(function(t){t.style.position="relative",t.style.overflow="hidden",t.addEventListener("click",function(e){var n=r(t,"colour")||"rgba(255,255,255,0.3)",a=i(t,"duration",600),o=t.getBoundingClientRect(),f=Math.max(o.width,o.height)*2,s=document.createElement("span");s.style.cssText="position:absolute;border-radius:50%;pointer-events:none;width:"+f+"px;height:"+f+"px;left:"+(e.clientX-o.left-f/2)+"px;top:"+(e.clientY-o.top-f/2)+"px;background:"+n+";transform:scale(0);opacity:1;transition:transform "+a+"ms ease,opacity "+a+"ms ease;",t.appendChild(s),requestAnimationFrame(function(){s.style.transform="scale(1)",s.style.opacity="0"}),setTimeout(function(){s.remove()},a)})});var c=window.Domma&&window.Domma.effects;c&&(d.querySelectorAll(".dm-fx-breathe").forEach(function(t){if(!p){var e={};r(t,"amplitude")&&(e.amplitude=i(t,"amplitude",6)),r(t,"duration")&&(e.duration=i(t,"duration",3e3)),r(t,"easing")&&(e.easing=r(t,"easing")),r(t,"stagger")&&(e.stagger=i(t,"stagger",0)),c.breathe(t,e)}}),d.querySelectorAll(".dm-fx-pulse").forEach(function(t){if(!p){var e={};r(t,"scale")&&(e.scale=i(t,"scale",1.05)),r(t,"duration")&&(e.duration=i(t,"duration",2e3)),r(t,"easing")&&(e.easing=r(t,"easing")),c.pulse(t,e)}}),d.querySelectorAll(".dm-fx-scribe").forEach(function(t){var e={};r(t,"speed")&&(e.speed=i(t,"speed",50)),r(t,"delete-speed")&&(e.deleteSpeed=i(t,"delete-speed",30)),r(t,"cursor")&&(e.cursor=v(t,"cursor",!0)),r(t,"cursor-char")&&(e.cursorChar=r(t,"cursor-char")),r(t,"cursor-type")&&(e.cursorType=r(t,"cursor-type")),r(t,"mode")&&(e.mode=r(t,"mode")),r(t,"loop")&&(e.loop=v(t,"loop",!1)),r(t,"loop-delay")&&(e.loopDelay=i(t,"loop-delay",1e3)),r(t,"pause-on-hover")&&(e.pauseOnHover=v(t,"pause-on-hover",!1));var n=r(t,"actions");if(n)try{e.actions=JSON.parse(n)}catch{return}else{var a=t.textContent.trim();if(!a)return;t.textContent="",e.actions=[{render:a}]}c.scribe(t,e)}),d.querySelectorAll(".dm-fx-twinkle").forEach(function(t){var e={};r(t,"count")&&(e.count=i(t,"count",100)),r(t,"shape")&&(e.shape=r(t,"shape")),r(t,"colour")&&(e.colour=r(t,"colour")),r(t,"min-size")&&(e.minSize=i(t,"min-size",1)),r(t,"max-size")&&(e.maxSize=i(t,"max-size",3)),c.twinkle(t,e)}),typeof c.tickerTape=="function"&&d.querySelectorAll(".dm-fx-ticker-tape").forEach(function(t){if(!p){var e={};r(t,"palette")&&(e.palette=r(t,"palette")),r(t,"density")&&(e.density=i(t,"density",50)),r(t,"speed")&&(e.speed=i(t,"speed",1)),r(t,"sway")&&(e.sway=i(t,"sway",60)),r(t,"rotation-speed")&&(e.rotationSpeed=i(t,"rotation-speed",6)),r(t,"min-width")&&(e.minWidth=i(t,"min-width",5)),r(t,"max-width")&&(e.maxWidth=i(t,"max-width",9)),r(t,"min-height")&&(e.minHeight=i(t,"min-height",12)),r(t,"max-height")&&(e.maxHeight=i(t,"max-height",22)),r(t,"fade-start")&&(e.fadeStart=i(t,"fade-start",.55)),r(t,"burst")&&(e.burst=v(t,"burst",!1)),r(t,"burst-count")&&(e.burstCount=i(t,"burst-count",150)),r(t,"z-index")&&(e.zIndex=i(t,"z-index",1));var n=r(t,"mode");n==="page"?c.tickerTape(null,e):c.tickerTape(t,e)}}),typeof c.butterflies=="function"&&d.querySelectorAll(".dm-fx-butterflies").forEach(function(t){if(!p){var e={};r(t,"palette")&&(e.palette=r(t,"palette")),r(t,"density")&&(e.density=i(t,"density",18)),r(t,"speed")&&(e.speed=i(t,"speed",1)),r(t,"wander")&&(e.wander=i(t,"wander",1)),r(t,"rise-speed")&&(e.riseSpeed=i(t,"rise-speed",.4)),r(t,"flap-speed")&&(e.flapSpeed=i(t,"flap-speed",1)),r(t,"min-size")&&(e.minSize=i(t,"min-size",14)),r(t,"max-size")&&(e.maxSize=i(t,"max-size",26)),r(t,"two-tone")&&(e.twoTone=v(t,"two-tone",!0)),r(t,"burst")&&(e.burst=v(t,"burst",!1)),r(t,"burst-count")&&(e.burstCount=i(t,"burst-count",40)),r(t,"z-index")&&(e.zIndex=i(t,"z-index",1));var n=r(t,"mode");n==="page"?c.butterflies(null,e):c.butterflies(t,e)}}),typeof c.strobe=="function"&&d.querySelectorAll(".dm-fx-strobe").forEach(function(t){if(p)return;function e(s){var u=r(t,s);if(!u)return null;var h=u.split(",").map(function(m){return m.trim()}).filter(Boolean);return h.length?h:null}var n={};r(t,"preset")&&(n.preset=r(t,"preset")),r(t,"motion")&&(n.motion=r(t,"motion")),r(t,"speed")&&(n.speed=i(t,"speed",1)),r(t,"sweep-arc")&&(n.sweepArc=i(t,"sweep-arc",100)),r(t,"beam-width")&&(n.beamWidth=i(t,"beam-width",16)),r(t,"intensity")&&(n.intensity=i(t,"intensity",.7)),r(t,"flicker")&&(n.flicker=v(t,"flicker",!0)),r(t,"hz")&&(n.hz=i(t,"hz",10));var a=e("origins");a&&(n.origins=a);var o=e("colours");o&&(n.colours=o),r(t,"duration")&&(n.duration=i(t,"duration",null)),r(t,"z-index")&&(n.zIndex=i(t,"z-index",9999));var f=r(t,"mode");f==="page"?c.strobe(null,n):c.strobe(t,n)}));var g=d.querySelectorAll(".dm-fx-celebrate");g.length&&!p&&import("/public/js/celebrations/index.js?v=20260930-snowman").then(function(t){var e=t.CelebrationsEffect;g.forEach(function(n){var a=n.getAttribute("data-fx-theme")||"auto",o=n.getAttribute("data-fx-intensity")||"medium",f=n.getAttribute("data-fx-z-index")?parseInt(n.getAttribute("data-fx-z-index"),10):999;if(!(a==="auto"&&(a=e.getCurrentTheme(),!a))){var s={},u=["data-fx-theme","data-fx-intensity","data-fx-z-index"];Array.from(n.attributes).forEach(function(m){m.name.startsWith("data-fx-")&&!u.includes(m.name)&&(s[m.name.slice(8)]=m.value)});var h=new e({theme:a,intensity:o,enabled:!0,zIndex:f,overrides:s});h.init().then(function(){h.start()})}})}).catch(function(){})}).catch(function(){})})();
+(function(){"use strict";fetch("/api/effects/settings").then(function(y){return y.json()}).then(function(y){var z=y.respectMotion!==!1,A=y.defaultDuration||600,S=y.defaultAnimation||"fade",E=y.defaultThreshold!=null?y.defaultThreshold:.1,p=z&&window.matchMedia&&window.matchMedia("(prefers-reduced-motion: reduce)").matches,d=document.querySelector(".page-body");if(!d)return;function r(t,e){return t.getAttribute("data-fx-"+e)}function i(t,e,n){var a=r(t,e);return a!==null?parseFloat(a):n}function v(t,e,n){var a=r(t,e);return a===null?n:a==="true"||a==="1"}function b(t,e,n){var a=new IntersectionObserver(function(o){o[0].isIntersecting&&(a.unobserve(t),n())},{threshold:e});a.observe(t)}d.querySelectorAll(".dm-fx-reveal").forEach(function(t){var e=r(t,"animation")||S,n=i(t,"duration",A),a=i(t,"delay",0),o=i(t,"threshold",E),f=v(t,"once",!0);p||(t.style.opacity="0",t.style.transition="none",e==="slide-up"?t.style.transform="translateY(30px)":e==="slide-down"?t.style.transform="translateY(-30px)":e==="zoom"?t.style.transform="scale(0.85)":e==="flip"&&(t.style.transform="rotateY(90deg)"),requestAnimationFrame(function(){requestAnimationFrame(function(){t.style.transition="opacity "+n+"ms ease "+a+"ms, transform "+n+"ms ease "+a+"ms";var s=new IntersectionObserver(function(u){u.forEach(function(h){h.isIntersecting?(t.style.opacity="1",t.style.transform="",f&&s.unobserve(t)):f||(t.style.opacity="0",e==="slide-up"?t.style.transform="translateY(30px)":e==="slide-down"?t.style.transform="translateY(-30px)":e==="zoom"?t.style.transform="scale(0.85)":e==="flip"?t.style.transform="rotateY(90deg)":t.style.transform="")})},{threshold:o});s.observe(t)})}))}),d.querySelectorAll(".dm-fx-counter").forEach(function(t){var e=i(t,"to",0),n=i(t,"from",0),a=i(t,"duration",2e3),o=r(t,"prefix")||"",f=r(t,"suffix")||"",s=i(t,"decimals",0),u=r(t,"separator")||"";function h(m){var l=m.toFixed(s);if(u){var x=l.split(".");x[0]=x[0].replace(/\B(?=(\d{3})+(?!\d))/g,u),l=x.join(".")}return o+l+f}if(p){t.textContent=h(e);return}b(t,.5,function(){var m=null;requestAnimationFrame(function l(x){m||(m=x);var w=Math.min((x-m)/a,1),q=1-Math.pow(1-w,3);t.textContent=h(n+(e-n)*q),w<1&&requestAnimationFrame(l)})})}),p||d.querySelectorAll(".dm-fx-scramble").forEach(function(t){var e=i(t,"speed",50),n=t.textContent,a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%&",o=0;b(t,.3,function(){var f=setInterval(function(){for(var s="",u=0;u<n.length;u++)u<o||n[u]===" "?s+=n[u]:s+=a[Math.floor(Math.random()*a.length)];t.textContent=s,o<n.length?o++:clearInterval(f)},e)})}),p||d.querySelectorAll(".dm-fx-shake").forEach(function(t){var e=i(t,"intensity",5),n=i(t,"duration",500),a=r(t,"direction")||"horizontal",o=a==="vertical"?"translateY":"translateX";t.animate([{transform:o+"(0)"},{transform:o+"(-"+e+"px)"},{transform:o+"("+e+"px)"},{transform:o+"(-"+e+"px)"},{transform:o+"("+e+"px)"},{transform:o+"(0)"}],{duration:n,easing:"ease-in-out"})}),d.querySelectorAll(".dm-fx-ripple").forEach(function(t){t.style.position="relative",t.style.overflow="hidden",t.addEventListener("click",function(e){var n=r(t,"colour")||"rgba(255,255,255,0.3)",a=i(t,"duration",600),o=t.getBoundingClientRect(),f=Math.max(o.width,o.height)*2,s=document.createElement("span");s.style.cssText="position:absolute;border-radius:50%;pointer-events:none;width:"+f+"px;height:"+f+"px;left:"+(e.clientX-o.left-f/2)+"px;top:"+(e.clientY-o.top-f/2)+"px;background:"+n+";transform:scale(0);opacity:1;transition:transform "+a+"ms ease,opacity "+a+"ms ease;",t.appendChild(s),requestAnimationFrame(function(){s.style.transform="scale(1)",s.style.opacity="0"}),setTimeout(function(){s.remove()},a)})});var c=window.Domma&&window.Domma.effects;c&&(d.querySelectorAll(".dm-fx-breathe").forEach(function(t){if(!p){var e={};r(t,"amplitude")&&(e.amplitude=i(t,"amplitude",6)),r(t,"duration")&&(e.duration=i(t,"duration",3e3)),r(t,"easing")&&(e.easing=r(t,"easing")),r(t,"stagger")&&(e.stagger=i(t,"stagger",0)),c.breathe(t,e)}}),d.querySelectorAll(".dm-fx-pulse").forEach(function(t){if(!p){var e={};r(t,"scale")&&(e.scale=i(t,"scale",1.05)),r(t,"duration")&&(e.duration=i(t,"duration",2e3)),r(t,"easing")&&(e.easing=r(t,"easing")),c.pulse(t,e)}}),d.querySelectorAll(".dm-fx-scribe").forEach(function(t){var e={};r(t,"speed")&&(e.speed=i(t,"speed",50)),r(t,"delete-speed")&&(e.deleteSpeed=i(t,"delete-speed",30)),r(t,"cursor")&&(e.cursor=v(t,"cursor",!0)),r(t,"cursor-char")&&(e.cursorChar=r(t,"cursor-char")),r(t,"cursor-type")&&(e.cursorType=r(t,"cursor-type")),r(t,"mode")&&(e.mode=r(t,"mode")),r(t,"loop")&&(e.loop=v(t,"loop",!1)),r(t,"loop-delay")&&(e.loopDelay=i(t,"loop-delay",1e3)),r(t,"pause-on-hover")&&(e.pauseOnHover=v(t,"pause-on-hover",!1));var n=r(t,"actions");if(n)try{e.actions=JSON.parse(n)}catch{return}else{var a=t.textContent.trim();if(!a)return;t.textContent="",e.actions=[{render:a}]}c.scribe(t,e)}),d.querySelectorAll(".dm-fx-twinkle").forEach(function(t){var e={};r(t,"count")&&(e.count=i(t,"count",100)),r(t,"shape")&&(e.shape=r(t,"shape")),r(t,"colour")&&(e.colour=r(t,"colour")),r(t,"min-size")&&(e.minSize=i(t,"min-size",1)),r(t,"max-size")&&(e.maxSize=i(t,"max-size",3)),c.twinkle(t,e)}),typeof c.tickerTape=="function"&&d.querySelectorAll(".dm-fx-ticker-tape").forEach(function(t){if(!p){var e={};r(t,"palette")&&(e.palette=r(t,"palette")),r(t,"density")&&(e.density=i(t,"density",50)),r(t,"speed")&&(e.speed=i(t,"speed",1)),r(t,"sway")&&(e.sway=i(t,"sway",60)),r(t,"rotation-speed")&&(e.rotationSpeed=i(t,"rotation-speed",6)),r(t,"min-width")&&(e.minWidth=i(t,"min-width",5)),r(t,"max-width")&&(e.maxWidth=i(t,"max-width",9)),r(t,"min-height")&&(e.minHeight=i(t,"min-height",12)),r(t,"max-height")&&(e.maxHeight=i(t,"max-height",22)),r(t,"fade-start")&&(e.fadeStart=i(t,"fade-start",.55)),r(t,"burst")&&(e.burst=v(t,"burst",!1)),r(t,"burst-count")&&(e.burstCount=i(t,"burst-count",150)),r(t,"z-index")&&(e.zIndex=i(t,"z-index",1));var n=r(t,"mode");n==="page"?c.tickerTape(null,e):c.tickerTape(t,e)}}),typeof c.butterflies=="function"&&d.querySelectorAll(".dm-fx-butterflies").forEach(function(t){if(!p){var e={};r(t,"palette")&&(e.palette=r(t,"palette")),r(t,"density")&&(e.density=i(t,"density",18)),r(t,"speed")&&(e.speed=i(t,"speed",1)),r(t,"wander")&&(e.wander=i(t,"wander",1)),r(t,"rise-speed")&&(e.riseSpeed=i(t,"rise-speed",.4)),r(t,"flap-speed")&&(e.flapSpeed=i(t,"flap-speed",1)),r(t,"min-size")&&(e.minSize=i(t,"min-size",14)),r(t,"max-size")&&(e.maxSize=i(t,"max-size",26)),r(t,"two-tone")&&(e.twoTone=v(t,"two-tone",!0)),r(t,"burst")&&(e.burst=v(t,"burst",!1)),r(t,"burst-count")&&(e.burstCount=i(t,"burst-count",40)),r(t,"z-index")&&(e.zIndex=i(t,"z-index",1));var n=r(t,"mode");n==="page"?c.butterflies(null,e):c.butterflies(t,e)}}),typeof c.strobe=="function"&&d.querySelectorAll(".dm-fx-strobe").forEach(function(t){if(p)return;function e(s){var u=r(t,s);if(!u)return null;var h=u.split(",").map(function(m){return m.trim()}).filter(Boolean);return h.length?h:null}var n={};r(t,"preset")&&(n.preset=r(t,"preset")),r(t,"motion")&&(n.motion=r(t,"motion")),r(t,"speed")&&(n.speed=i(t,"speed",1)),r(t,"sweep-arc")&&(n.sweepArc=i(t,"sweep-arc",100)),r(t,"beam-width")&&(n.beamWidth=i(t,"beam-width",16)),r(t,"intensity")&&(n.intensity=i(t,"intensity",.7)),r(t,"flicker")&&(n.flicker=v(t,"flicker",!0)),r(t,"hz")&&(n.hz=i(t,"hz",10));var a=e("origins");a&&(n.origins=a);var o=e("colours");o&&(n.colours=o),r(t,"duration")&&(n.duration=i(t,"duration",null)),r(t,"z-index")&&(n.zIndex=i(t,"z-index",9999));var f=r(t,"mode");f==="page"?c.strobe(null,n):c.strobe(t,n)}));var g=d.querySelectorAll(".dm-fx-celebrate");g.length&&!p&&import("/public/js/celebrations/index.js?v=20261001-options").then(function(t){var e=t.CelebrationsEffect;g.forEach(function(n){var a=n.getAttribute("data-fx-theme")||"auto",o=n.getAttribute("data-fx-intensity")||"medium",f=n.getAttribute("data-fx-z-index")?parseInt(n.getAttribute("data-fx-z-index"),10):999;if(!(a==="auto"&&(a=e.getCurrentTheme(),!a))){var s={},u=["data-fx-theme","data-fx-intensity","data-fx-z-index"];Array.from(n.attributes).forEach(function(m){m.name.startsWith("data-fx-")&&!u.includes(m.name)&&(s[m.name.slice(8)]=m.value)});var h=new e({theme:a,intensity:o,enabled:!0,zIndex:f,overrides:s});h.init().then(function(){h.start()})}})}).catch(function(){})}).catch(function(){})})();

package/server/routes/api/calls.js

@@ -25,6 +25,9 @@
  * The call itself (no sign-in - the link is the credential):
  *   /api/calls/room/:id/{join,poll,signal,chat,answer,recording,leave}   (plugins/_lib/call/routes.js)
  *   join takes {t} (the guest) or {h} (the host); guests knock and the host lets them in.
+ *   "Add people" (the host, in the call): GET /api/calls/room/:id/people?q= - the host's readable contacts and the
+ *   team; POST /api/calls/room/:id/invite - each person gets their own Join link `?g=<pass>` (never the guest's
+ *   token), by email, notification and Messages as chosen (services/callInvites.js). They knock like any guest.
  */
 import {authenticate as defaultAuthenticate, requirePermission as defaultRequirePermission} from '../../middleware/auth.js';
 import {getEntry, listEntries} from '../../services/collections.js';
@@ -35,9 +38,10 @@ import {isToolEnabled} from '../../services/tools.js';
 import {mountCallRoutes} from '../../../plugins/_lib/call/routes.js';
 import {whoOf} from '../../../plugins/_lib/call/rooms.js';
 import {getBaseUrl} from '../public.js';
+import {deliverInvites, resolveInvitees, searchInvitees} from '../../services/callInvites.js';
 import {
     EMAIL_RE, callChat, callMailReady, callPaths, callsOfContact, chatCountOf, createCall, getCall, instantCallsEnabled, isOpen,
-    mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
+    invitePath, mayEmailAddress, mayStartCall, saveCallChat, sendCallEmail, whoIsCalling
 } from '../../services/instantCalls.js';
 
 const CONTACTS_SLUG = 'contacts-contacts';
@@ -147,8 +151,26 @@ export async function callsRoutes(fastify, opts = {}) {
     // The call engine: a room per call, guests knock, the host lets them in, open createdAt..expiresAt.
     mountCallRoutes(fastify, {
         prefix: '/room', ns: 'instant', ...(opts.rooms ? {rooms: opts.rooms} : {}),
-        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h}),
+        resolve: async (request, room, body) => whoIsCalling(await getCall(String(room)), {t: body?.t, h: body?.h, g: body?.g}),
         // The chat is saved against the call record, so a call reopened (or after a restart) shows it again.
-        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)}
+        chat: {load: (room) => callChat(String(room)), save: (room, item) => saveCallChat(String(room), item)},
+        // Add people (the host): the host user's contacts and the team; each invitee gets their own `?g=` link.
+        invite: {
+            search: async (room, q) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return [];
+                return searchInvitees({hostUserId: rec.hostId, q});
+            },
+            send: async (room, people, {via, request}) => {
+                const rec = await getCall(String(room));
+                if (!rec || !isOpen(rec)) return {error: 'This call has ended.'};
+                const base = getBaseUrl(request);
+                const newLink = async () => `${base}${await invitePath(rec.id)}`;
+                const targets = await resolveInvitees(people, {hostUserId: rec.hostId});
+                const results = await deliverInvites(targets, {linkFor: newLink, hostName: rec.hostName, hostUserId: rec.hostId,
+                    title: `Video call: ${rec.hostName} and ${rec.name || 'a guest'}`, via, key: `instant:${rec.id}`, expiresAt: rec.expiresAt, log: request.log});
+                return {link: await newLink(), results};
+            }
+        }
     });
 }

package/server/routes/call-public.js

@@ -3,6 +3,7 @@
  *
  *   /_call/<id>?t=<guest token>   the person called
  *   /_call/<id>?h=<host key>      the host
+ *   /_call/<id>?g=<invite pass>   someone the host added ("Add people") - names themselves, knocks
  *
  * Under `/_call`, like `/_preview`. Answered from an onRequest hook, and ONLY
  * while instant calls are on: with no Pro Tool with calls the request goes on
@@ -53,14 +54,14 @@ export const recoverScript = '<script>(function(){try{if(location.search)return;
 
 export function callPage(rec, who, cred, now = Date.now()) {
     if (!rec || !who) {
-        const bare = !cred?.t && !cred?.h;
+        const bare = !cred?.t && !cred?.h && !cred?.g;
         return {status: 404, title: 'Call', body: '<h1>This call link is not valid</h1><p>Ask the person who sent it for a new one.</p>'
             + (bare ? recoverScript : '')};
     }
     if (!(Date.parse(rec.expiresAt) > now)) {
         return {status: 410, title: 'Call', body: '<h1>This call has ended</h1><p>Ask the person who sent the link for a new one.</p>'};
     }
-    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && !rec.name, recordingAllowed: false, closesAt: rec.expiresAt};
+    const cfg = {api: ROOM_API, room: rec.id, cred, title: who.title, askName: !who.host && (!rec.name || who.invited === true), recordingAllowed: false, closesAt: rec.expiresAt};
     return {
         status: 200,
         title: who.title,
@@ -89,7 +90,7 @@ export async function callPublicRoutes(fastify, opts = {}) {
         reply.header('cache-control', 'no-store, private');
         reply.header('x-robots-tag', 'noindex, nofollow');
         const q = new URLSearchParams(search);
-        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
+        const cred = q.get('h') ? {h: q.get('h').slice(0, 128)} : q.get('g') ? {g: q.get('g').slice(0, 128)} : {t: String(q.get('t') || '').slice(0, 128)};
         const rec = await getCall(id);
         const page = callPage(rec, whoIsCalling(rec, cred), cred);
         const html = await renderBlogPage(TEMPLATE, {body: page.body}, {

package/server/services/callInvites.js

@@ -0,0 +1,238 @@
+/**
+ * "Add people" to a call - what core does for every Tool with calls (instant
+ * calls, Booking, Calendar, Messages). The pure parts (the request's shape, the
+ * invite pass, matching, limits) are `plugins/_lib/call/invite.js`; the routes
+ * are the engine's (`plugins/_lib/call/routes.js`). This file finds people and
+ * sends what the host chose:
+ *
+ *   searchInvitees({hostUserId, q, excludeUserIds, contacts, team})
+ *       the host's readable contacts (their own plus what a sharing Tool lets
+ *       them read - `readableContactIds`) and the team, matched to `q`
+ *   resolveInvitees(people, {hostUserId, contacts, team, emails})
+ *       the request's {kind, id} / {kind: 'email'} list as real people - a
+ *       contact the host may read, an active team member - else an error row
+ *   deliverInvites(targets, {linkFor, hostName, hostUserId, title, via, key})
+ *       per person: the Join email (via.email, any address), a notification
+ *       (via.notify, team members: bell + desktop, `core:call-invites`,
+ *       dedupeKey per call + person) and a direct message from the host
+ *       (via.message, team members, when a Tool registered a messenger -
+ *       Messages; hooks.sendDirectMessage). Never throws.
+ *
+ * "The team": active users whose most senior role is at the base `user` level
+ * or above - roles a plugin makes for people from outside (Job Board's
+ * candidates) are not the team.
+ *
+ * @module services/callInvites
+ */
+import {getConfig} from '../config.js';
+import {getEntry, listEntries} from './collections.js';
+import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {hasDirectMessenger, readableContactIds, sendDirectMessage} from './hooks.js';
+import {notify, registerNotificationSource} from './notify.js';
+import {getPermissionsFor, getRoleLevel} from './roles.js';
+import {isToolEnabled} from './tools.js';
+import {getUserById, listUsers} from './users.js';
+import {getEffectiveLevel, getEffectiveRoles} from './userRoles.js';
+import {cleanText, createLimiter, inviteMessage, inviteTitle, matchPeople} from '../../plugins/_lib/call/invite.js';
+
+export const SOURCE = 'core:call-invites';
+const CONTACTS_SLUG = 'contacts-contacts';
+/** Join emails one address may be sent in an hour, whoever sends them. */
+export const EMAILS_PER_ADDRESS_HOUR = 3;
+/** Join emails the whole site may send in an hour (every call, every Tool) - a leaked host link cannot spam. */
+export const EMAILS_PER_SITE_HOUR = 30;
+
+try {
+    registerNotificationSource({id: SOURCE, owner: 'core', label: 'Call invitations', severity: 'info', defaultOn: true,
+        description: 'Someone in a video call adds a team member to it ("Add people") - told to that person, with the Join link.'});
+} catch { /* never stops the calls */ }
+
+const isActive = (u) => Boolean(u) && u.disabled !== true && u.active !== false && u.isActive !== false;
+
+/** Is this user one of the team (active, at the base user level or more senior)? */
+export function isTeamMember(u) {
+    if (!isActive(u)) return false;
+    const base = getRoleLevel('user');
+    try { return getEffectiveLevel(u) <= (Number.isFinite(base) ? base : 2); } catch { return false; }
+}
+
+/** The team, by name. */
+export async function teamMembers() {
+    return (await listUsers().catch(() => [])).filter(isTeamMember);
+}
+
+/** May this user read contacts at all (Contacts on, a role with contacts.read)? */
+function mayReadContacts(user) {
+    try {
+        const roles = getEffectiveRoles(user || {});
+        return isToolEnabled('contacts') && roles.some(r => getPermissionsFor('contacts', 'read').includes(r));
+    } catch { return false; }
+}
+
+/** The contacts this user may read, as {id, name, email} (with an email only). */
+export async function contactsOf(hostUserId) {
+    const user = hostUserId ? await getUserById(String(hostUserId)).catch(() => null) : null;
+    if (!user || !mayReadContacts(user)) return [];
+    const {entries} = await listEntries(CONTACTS_SLUG, {limit: 100000}).catch(() => ({entries: []}));
+    const withEmail = (entries || []).filter(e => String(e?.data?.email || '').includes('@'));
+    const ok = await readableContactIds(withEmail, {id: user.id, roles: getEffectiveRoles(user)});
+    return withEmail.filter(e => ok.has(e.id)).map(e => ({id: e.id, name: String(e.data?.name || '').trim(), email: String(e.data.email).trim()}));
+}
+
+/**
+ * Search: the team (not `excludeUserIds`, not the host) and the host's contacts.
+ *
+ * @param {{hostUserId?: string, q?: string, excludeUserIds?: string[], contacts?: boolean, team?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function searchInvitees({hostUserId = '', q = '', excludeUserIds = [], contacts = true, team = true, teamFilter = null} = {}) {
+    const users = team ? (await teamMembers()).filter(u => !teamFilter || teamFilter(u)) : [];
+    const known = contacts && String(q || '').trim() ? await contactsOf(hostUserId) : [];
+    return matchPeople({q, users, contacts: known, excludeUserIds: [...excludeUserIds, hostUserId].filter(Boolean),
+        canMessage: Boolean(hostUserId) && hasDirectMessenger()});
+}
+
+/**
+ * The request's people as real people: `{kind, id?, name, email, userId?}`, or `{name, error}` for someone who
+ * cannot be invited (a contact the host may not read, not a team member, an email not allowed here).
+ *
+ * @param {object[]} people - cleanInviteRequest()'s list
+ * @param {{hostUserId?: string, contacts?: boolean, team?: boolean, emails?: boolean, teamFilter?: (u: object) => boolean}} opts
+ */
+export async function resolveInvitees(people = [], {hostUserId = '', contacts = true, team = true, emails = true, teamFilter = null} = {}) {
+    const out = [];
+    let readable = null;
+    for (const p of people) {
+        if (p.kind === 'email') {
+            out.push(emails ? {kind: 'email', name: p.name, email: p.email} : {name: p.name, error: 'Only team members can be added to this call.'});
+        } else if (p.kind === 'user') {
+            const u = team ? await getUserById(p.id).catch(() => null) : null;
+            if (!u || !isTeamMember(u) || (teamFilter && !teamFilter(u)) || u.id === hostUserId) out.push({name: 'Someone', error: 'That person cannot be added.'});
+            else out.push({kind: 'user', id: u.id, name: String(u.name || '').trim() || 'Team member', email: String(u.email || '').trim()});
+        } else if (p.kind === 'contact') {
+            readable ||= contacts ? await contactsOf(hostUserId) : [];
+            const c = readable.find(x => x.id === p.id);
+            out.push(c ? {kind: 'contact', id: c.id, name: c.name || c.email.split('@')[0], email: c.email.toLowerCase()} : {name: 'Someone', error: 'That contact could not be found.'});
+        }
+    }
+    return out;
+}
+
+// ---------------------------------------------------------------------------
+// The Join email
+// ---------------------------------------------------------------------------
+
+let mailer = null;
+let transport = null;
+let transportFor = '';
+const emailsTo = createLimiter({max: EMAILS_PER_ADDRESS_HOUR, windowMs: 3600000});
+const emailsFromSite = createLimiter({max: EMAILS_PER_SITE_HOUR, windowMs: 3600000});
+
+/** Tests only: `fn(msg)` receives every message instead of SMTP. null restores. */
+export function setInviteMailer(fn) { mailer = fn; }
+/** Tests only. */
+export function resetInviteLimits() { emailsTo.reset(); emailsFromSite.reset(); }
+
+const site = () => { try { return getConfig('site') || {}; } catch { return {}; } };
+
+/** Can mail really leave this site? */
+export const inviteMailReady = () => Boolean(mailer) || isSmtpConfigured(site().smtp || {});
+
+/** The message, escaped. */
+export function composeInviteEmail({name = '', hostName = '', title = '', link = ''}) {
+    const host = cleanText(hostName, 80) || 'Someone';
+    name = cleanText(name, 120);
+    title = cleanText(title, 120);
+    const subject = `${host} is inviting you to a video call now`;
+    const lines = [`Hello${name ? ` ${name}` : ''}, ${host} is in a video call${title ? ` (${title})` : ''} and would like you to join now.`,
+        'Use the button below. You will wait a moment until you are let in. You need a camera and microphone, or you can join with just one.'];
+    const html = [...lines.map(l => `<p>${escapeHtml(l)}</p>`),
+        `<p><a href="${escapeHtml(link)}" style="display:inline-block;padding:10px 18px;background:#2563eb;color:#fff;border-radius:6px;text-decoration:none">Join the call</a></p>`,
+        `<p style="color:#666;font-size:13px">Or paste this into your browser: ${escapeHtml(link)}</p>`].join('\n');
+    return {subject, html, text: [...lines, `Join the call: ${link}`].join('\n\n')};
+}
+
+/** Send it. Never throws; true only when it left. */
+export async function sendInviteEmail({to, name, hostName, title, link}, {log} = {}) {
+    try {
+        if (!to || !link) return false;
+        const msg = {to, ...composeInviteEmail({name, hostName, title, link})};
+        if (mailer) { await mailer(msg); return true; }
+        const s = site();
+        const smtp = s.smtp || {};
+        if (!isSmtpConfigured(smtp)) return false;
+        const k = JSON.stringify([smtp.host, smtp.port, smtp.user, smtp.secure]);
+        if (!transport || transportFor !== k) { transport = await createTransport(smtp); transportFor = k; }
+        await sendEmail(transport, {from: smtp.fromAddress || 'noreply@example.com', fromName: smtp.fromName || s.title || 'Calls', ...msg});
+        return true;
+    } catch (err) {
+        try { (log?.error || console.error).call(log || console, `[calls] Invitation to ${to} not sent: ${err?.message || err}`); } catch { /* never */ }
+        return false;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Sending
+// ---------------------------------------------------------------------------
+
+/**
+ * Tell each person. `linkFor(target)` is their Join link (absolute). Resolves to one result per target:
+ * `{name, emailed, notified, messaged, error?}` - `error` says why nothing reached them.
+ *
+ * @param {object[]} targets - resolveInvitees()'s list
+ * @param {{linkFor: (t: object) => string|Promise<string>, hostName?: string, hostUserId?: string, title?: string,
+ *   via?: {email?: boolean, notify?: boolean, message?: boolean}, key?: string, expiresAt?: string, log?: object,
+ *   deps?: {notify?: Function, sendDirectMessage?: Function}}} opts - `key`: the call, for the notification's dedupeKey
+ */
+export async function deliverInvites(targets = [], {linkFor, hostName = '', hostUserId = '', title = '', via = {}, key = '', expiresAt, log, deps = {}} = {}) {
+    const raise = deps.notify || notify;
+    const dm = deps.sendDirectMessage || sendDirectMessage;
+    const results = [];
+    for (const t of targets) {
+        if (t.error) { results.push({name: t.name, emailed: false, notified: false, messaged: false, error: t.error}); continue; }
+        const r = {name: t.name, emailed: false, notified: false, messaged: false};
+        let link = '';
+        try { link = await linkFor(t); } catch { link = ''; }
+        if (!link) { results.push({...r, error: 'No link could be made for them.'}); continue; }
+        const why = [];
+        if (via.email && t.email) {
+            if (!inviteMailReady()) why.push('email is not set up on this site');
+            else if (!emailsTo.take(t.email)) why.push('they have been emailed several times this hour');
+            else if (!emailsFromSite.take('site')) why.push('this site has sent a lot of call invitations this hour');
+            else if (!(r.emailed = await sendInviteEmail({to: t.email, name: t.name, hostName, title, link}, {log}))) why.push('the email could not be sent');
+        }
+        if (t.kind === 'user') {
+            if (via.notify) {
+                try {
+                    r.notified = Boolean(await raise({title: inviteTitle(hostName), body: title ? `Video call: ${title}` : 'A video call, now.', severity: 'info', link,
+                        source: SOURCE, dedupeKey: `call-invite:${key}:${t.id}`.slice(0, 200), audience: {userIds: [t.id]},
+                        expiresAt: expiresAt || new Date(Date.now() + 3 * 3600e3).toISOString()}));
+                } catch { r.notified = false; }
+                if (!r.notified) why.push('the notification was not raised');
+            }
+            if (via.message) {
+                if (!hostUserId) why.push('a message needs a host who is a team member');
+                else if (!hasDirectMessenger() && !deps.sendDirectMessage) why.push('Messages is not on');
+                else {
+                    let out = null;
+                    try { out = await dm({fromUserId: hostUserId, toUserId: t.id, text: inviteMessage(hostName, title, link)}); } catch { out = null; }
+                    r.messaged = out === true || out?.sent === true;
+                    if (!r.messaged) why.push(`no message: ${out?.reason || 'it could not be sent'}`);
+                }
+            }
+        }
+        if (!r.emailed && !r.notified && !r.messaged) r.error = why.length ? `Not reached: ${why.join('; ')}.` : 'Nothing was sent - copy the link and pass it on.';
+        results.push(r);
+    }
+    return results;
+}
+
+/**
+ * The origin Join links are built on: the site's configured `baseUrl` whenever there is one (links in emails
+ * and notices must never follow a Host header), else the request's own origin.
+ */
+export function inviteOrigin(request) {
+    const base = String(site().baseUrl || '').trim();
+    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
+    if (!request) return '';
+    return `${request.protocol}://${request.host || request.headers?.host || request.hostname}`;
+}

package/server/services/hooks.js

@@ -404,6 +404,61 @@ export async function readableContactIds(entries, viewer) {
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// 7c. Direct messages - one team member writing to another (Messages)
+// ---------------------------------------------------------------------------
+//
+// Core has no messaging of its own. A Tool that has it (Messages) registers a
+// messenger, and core code - a call's "Add people" (services/callInvites.js) -
+// sends a direct message from one user to another through it, without knowing
+// the Tool. No messenger (Messages off or absent): sendDirectMessage answers
+// false and the caller carries on without it.
+
+const _messengers = new Map(); // owner -> fn({fromUserId, toUserId, text}) => Promise<boolean | {sent, reason}>
+
+/**
+ * @param {string} owner - the plugin
+ * @param {(msg: {fromUserId: string, toUserId: string, text: string}) => Promise<boolean|{sent: boolean, reason?: string}>} fn
+ *   post `text` from `fromUserId` to `toUserId` in their direct conversation (made when there is none), by the
+ *   Tool's OWN rules (who may message whom): true / {sent: true} when posted, else false or {sent: false, reason}
+ */
+export function registerDirectMessenger(owner, fn) {
+  if (typeof owner !== 'string' || !owner || typeof fn !== 'function') return false;
+  _messengers.set(owner, fn);
+  return true;
+}
+
+/** @param {string} owner */
+export function unregisterDirectMessenger(owner) {
+  _messengers.delete(owner);
+}
+
+/** Is there a Tool that can send a direct message? */
+export const hasDirectMessenger = () => _messengers.size > 0;
+
+/**
+ * Send a direct message through the registered messenger. Never throws.
+ *
+ * @param {{fromUserId: string, toUserId: string, text: string}} msg
+ * @returns {Promise<{sent: boolean, reason?: string}>} sent when a messenger posted it; else why not
+ */
+export async function sendDirectMessage({fromUserId, toUserId, text} = {}) {
+  const from = String(fromUserId || '');
+  const to = String(toUserId || '');
+  const body = String(text || '').trim().slice(0, 4000);
+  if (!from || !to || from === to || !body) return {sent: false, reason: 'nobody to send it to'};
+  if (!_messengers.size) return {sent: false, reason: 'Messages is not on'};
+  let reason = 'the message could not be sent';
+  for (const fn of _messengers.values()) {
+    try {
+      const out = await fn({fromUserId: from, toUserId: to, text: body});
+      if (out === true || out?.sent === true) return {sent: true};
+      if (out?.reason) reason = String(out.reason).slice(0, 200);
+    } catch { /* a failing messenger sends nothing */ }
+  }
+  return {sent: false, reason};
+}
+
 // ---------------------------------------------------------------------------
 // 8. Sitemap sources (0.89) - URLs a plugin serves, in /sitemap.xml
 // ---------------------------------------------------------------------------

package/server/services/instantCalls.js

@@ -19,7 +19,10 @@
  * actions and list stand aside (checked per request), so nobody sees two.
  *
  * A record: {id, name, email, contactId, hostId, hostName, token, hostKey,
- * createdAt, expiresAt, chat?}. `chat` is the call's chat, saved against the
+ * createdAt, expiresAt, chat?, inviteKey?}. `inviteKey` (made on the first "Add
+ * people", `inviteKeyOf`) signs the passes of people added to the call
+ * (`?g=<pass>`, _lib/call/invite.js) - never the guest's token, which carries
+ * the guest's name and place. `chat` is the call's chat, saved against the
  * call (the engine's items - typed messages plus joined/left lines - the last
  * CHAT_MAX); the engine seeds a reopened room from it, and the host (or an
  * admin) reads it afterwards through GET /api/calls/:id/chat. Kept in memory and in one JSON file with the sign-in
@@ -43,6 +46,7 @@ import {hasRelatedProvider, registerRelatedItems, unregisterRelatedItems} from '
 import {getPermissionsFor} from './roles.js';
 import {getEffectiveRoles} from './userRoles.js';
 import {createTransport, escapeHtml, isSmtpConfigured, sendEmail} from './email.js';
+import {checkInvitePass, invitePass, newInviteKey} from '../../plugins/_lib/call/invite.js';
 
 export const INSTANT_HOURS = 3;
 export const KEEP_DAYS = 30;
@@ -244,6 +248,25 @@ export async function getCall(id) {
     return (await load()).get(id) || null;
 }
 
+/** The call's invite key, made (and stored) the first time someone is added to it. Null for no such call. */
+export async function inviteKeyOf(id) {
+    if (typeof id !== 'string' || !ID_RE.test(id)) return null;
+    const all = await load();
+    const rec = all.get(id);
+    if (!rec) return null;
+    if (!rec.inviteKey) {
+        rec.inviteKey = newInviteKey();
+        await save(all);
+    }
+    return rec.inviteKey;
+}
+
+/** A new Join link (relative) for someone added to the call: `?g=<pass>`. */
+export async function invitePath(id) {
+    const k = await inviteKeyOf(id);
+    return k ? `${CALL_PATH}/${encodeURIComponent(id)}?g=${encodeURIComponent(invitePass(k, id))}` : '';
+}
+
 /** The chat item as it is kept on a record; null for junk. System lines other than joined/left are not kept. */
 function chatItem(raw) {
     if (!raw || typeof raw !== 'object' || typeof raw.text !== 'string' || !raw.id) return null;
@@ -299,8 +322,10 @@ const same = (a, b) => {
 
 /**
  * Who the caller is in an instant call, or null (the engine answers 404).
- * `cred` is what the link carried: {t} for the guest, {h} for the host. The
- * engine answers 410 once `closesAt` has passed.
+ * `cred` is what the link carried: {t} for the guest, {h} for the host, {g}
+ * for someone added to the call (a pass under `inviteKey`: they give their own
+ * name and knock; each pass is its own identity). The engine answers 410 once
+ * `closesAt` has passed.
  */
 export function whoIsCalling(rec, cred = {}) {
     if (!rec) return null;
@@ -314,6 +339,8 @@ export function whoIsCalling(rec, cred = {}) {
     if (cred.t && same(cred.t, rec.token)) {
         return {...base, host: false, name: rec.name || '', identity: `${rec.id}:guest`};
     }
+    const nonce = cred.g && rec.inviteKey ? checkInvitePass(rec.inviteKey, rec.id, cred.g) : null;
+    if (nonce) return {...base, host: false, name: '', identity: `${rec.id}:inv:${nonce}`, invited: true};
     return null;
 }
 

package/server/services/plugins.js

@@ -28,6 +28,8 @@ import {
     registerComponent,
     registerContactAccess,
     unregisterContactAccess,
+    registerDirectMessenger,
+    unregisterDirectMessenger,
     registerSidebarItem,
     registerTransform
 } from './hooks.js';
@@ -559,7 +561,9 @@ export async function registerPlugins(fastify) {
                   // loads under a licence may.
                   enableInstantCalls: () => enableInstantCalls({owner: manifest.name, tier: manifest.tier || 'free', closedSource: manifest.closedSource === true}),
                   // Who may read a contact that is not their own (Contacts Pro's sharing) - hooks.js 7b.
-                  registerContactAccess: (fn) => registerContactAccess(manifest.name, fn)},
+                  registerContactAccess: (fn) => registerContactAccess(manifest.name, fn),
+                  // Direct messages between team members (Messages) - hooks.js 7c; a call's "Add people" uses it.
+                  registerDirectMessenger: (fn) => registerDirectMessenger(manifest.name, fn)},
               settings,
               config: {}
           });
@@ -1120,6 +1124,7 @@ export async function runLifecycleHook(name, hook, fastify) {
     if (hook === 'onDisable') {
         disableInstantCalls(name);
         unregisterContactAccess(name);
+        unregisterDirectMessenger(name);
     }
 
     const pluginJsPath = path.join(PLUGINS_DIR, name, 'plugin.js');

package/server/templates/page.html

@@ -154,7 +154,7 @@
     <script src="/public/js/forms.js?v=20260927-submit-btn" type="module"></script>
 
     <!-- Core effects runtime -->
-    <script src="/public/js/effects.js?v=20260930-snowman"></script>
+    <script src="/public/js/effects.js?v=20261001-options"></script>
 
     <!-- Plugin body-end injection -->
     {{bodyEndInject}}