feat(calls): mint a LiveKit join token into the native VoIP call payload (inc 1)

Increment 1 server side. Move livekitToken() into server/livekit.js (shared by routes.js
and calls.js). calls.js now mints a per-callee LiveKit join token and calls.js/push.js
put {livekitUrl, livekitToken} in the VoIP invite payload, so the native plugin can
connect the LiveKit room immediately on answer — even from a killed state, before the
WebView loads. No behaviour change while CALLKIT_ENABLED=0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/calls.js

@@ -7,6 +7,7 @@ const R = require('./repos');
 const A = require('./auth');
 const CHAT = require('./chat');
 const PUSH = require('./push'); // native push (APNs/FCM/WebPush) so a CLOSED app is notified of calls
+const LK = require('./livekit'); // mint the callee's LiveKit join token for the native VoIP call payload
 const { TRANS_DIR } = require('./config');
 const { meetingRooms, groupCalls, roomToGroupCall, dmCalls, roomToDmCall, roomHost, transcriptBuffers, transcriptSubs } = require('./presence');
 const now = () => Date.now();
@@ -75,7 +76,7 @@ async function startGroupCall(group, teamId, user) {
   broadcast(group, { type: 'group-call', group, active: true, room, uuid: call.uuid, by: user.id, startedByName: call.startedByName, groupName: gName });
   // Notify the OTHER members so a closed app is alerted to the group call — VoIP/CallKit if available,
   // else a banner. broadcast() above only reaches connected sockets. Best-effort; never throws.
-  try { for (const mid of await R.conversations.members(group)) { if (mid !== user.id) PUSH.sendCallNotification(mid, { callUUID: call.uuid, room, kind: 'group', groupId: group, groupName: gName, callerId: user.id, callerName: call.startedByName, title: gName, body: '📞 ' + call.startedByName + ' started a group call', hasVideo: true }); } } catch (_) {}
+  try { for (const mid of await R.conversations.members(group)) { if (mid !== user.id) PUSH.sendCallNotification(mid, { callUUID: call.uuid, room, kind: 'group', groupId: group, groupName: gName, callerId: user.id, callerName: call.startedByName, title: gName, body: '📞 ' + call.startedByName + ' started a group call', hasVideo: true, livekitUrl: LK.LIVEKIT_URL, livekitToken: LK.livekitToken(mid, null, room) }); } } catch (_) {}
   return { room, uuid: call.uuid, active: true };
 }
 
@@ -125,7 +126,7 @@ async function startDmCall(me, otherId, teamId) {
   // Notify the callee so a CLOSED app still rings — VoIP/CallKit if the device registered a VoIP token,
   // else a banner (the CHAT.pushToUser events above only reach a connected socket). Best-effort. On
   // reconnect the callee's app also re-shows the invite (replayActiveCalls), so answering works either way.
-  try { PUSH.sendCallNotification(otherId, { callUUID: call.uuid, room, kind: 'dm', callerId: me.id, callerName: byName, title: byName, body: '📞 Incoming call', hasVideo: false }); } catch (_) {}
+  try { PUSH.sendCallNotification(otherId, { callUUID: call.uuid, room, kind: 'dm', callerId: me.id, callerName: byName, title: byName, body: '📞 Incoming call', hasVideo: false, livekitUrl: LK.LIVEKIT_URL, livekitToken: LK.livekitToken(otherId, null, room) }); } catch (_) {}
   return { room, uuid: call.uuid, active: true };
 }
 

server/livekit.js

@@ -0,0 +1,23 @@
+// LiveKit helpers shared by routes.js (browser meeting/call join) and calls.js (native VoIP call payload).
+// Mint an access token (HS256 JWT signed with the API secret) — hand-rolled, same approach as push.js's
+// JWTs, so there's no SDK dependency. Grants join+publish+subscribe on exactly one room, as one identity.
+// The secret stays server-side.
+const crypto = require('crypto');
+const { LIVEKIT_URL, LIVEKIT_API_KEY, LIVEKIT_API_SECRET, LIVEKIT_ENABLED } = require('./config');
+
+const _b64u = (buf) => Buffer.from(buf).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+
+function livekitToken(identity, name, room, metadata) {
+  const nowSec = Math.floor(Date.now() / 1000);
+  const header = _b64u(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const payload = _b64u(JSON.stringify({
+    iss: LIVEKIT_API_KEY, sub: identity, name: name || identity,
+    nbf: nowSec, exp: nowSec + 6 * 3600, // 6h — long enough for any meeting/call
+    metadata: metadata || '',
+    video: { room, roomJoin: true, canPublish: true, canSubscribe: true, canPublishData: true },
+  }));
+  const sig = _b64u(crypto.createHmac('sha256', LIVEKIT_API_SECRET).update(header + '.' + payload).digest());
+  return header + '.' + payload + '.' + sig;
+}
+
+module.exports = { livekitToken, LIVEKIT_URL, LIVEKIT_ENABLED };

server/push.js

@@ -144,6 +144,9 @@ async function sendCallNotification(userId, data) {
       callUUID: data.callUUID, room: data.room, kind: data.kind,
       callerId: data.callerId || '', callerName: data.callerName || 'Incoming call',
       groupId: data.groupId || '', groupName: data.groupName || '', hasVideo: !!data.hasVideo,
+      // LiveKit join credentials so the native plugin can connect the room immediately on answer — even
+      // from a killed state, before the WebView has loaded.
+      livekitUrl: data.livekitUrl || '', livekitToken: data.livekitToken || '',
     };
     for (const t of voip) {
       try { const r = await sendApnsVoip(t.token, payload); if (r && r.dead) { try { await R.deviceTokens.removeByToken(t.token); } catch (_) {} } } catch (_) {}

server/routes.js

@@ -137,22 +137,9 @@ const crypto = require('crypto');
 const MAX_UPLOAD_MB = parseInt(process.env.MAX_UPLOAD_MB, 10) || 1024; // default 1 GB per chat attachment
 const MAX_FILE_BYTES = MAX_UPLOAD_MB * 1024 * 1024; // NOTE: also raise Nginx Proxy Manager's client_max_body_size to match (default is 1 MB) or large uploads are rejected at the proxy before reaching here.
 
-// Mint a LiveKit access token (HS256 JWT signed with the API secret) — same hand-rolled JWT
-// approach as push.js's FCM/APNs tokens, so no extra dependency. Grants the holder join+publish+
-// subscribe on exactly one room, as one identity. Secret stays server-side.
-const _b64u = (buf) => Buffer.from(buf).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-function livekitToken(identity, name, room, metadata) {
-  const nowSec = Math.floor(Date.now() / 1000);
-  const header = _b64u(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
-  const payload = _b64u(JSON.stringify({
-    iss: LIVEKIT_API_KEY, sub: identity, name: name || identity,
-    nbf: nowSec, exp: nowSec + 6 * 3600, // 6h — long enough for any meeting
-    metadata: metadata || '',
-    video: { room, roomJoin: true, canPublish: true, canSubscribe: true, canPublishData: true },
-  }));
-  const sig = _b64u(crypto.createHmac('sha256', LIVEKIT_API_SECRET).update(header + '.' + payload).digest());
-  return header + '.' + payload + '.' + sig;
-}
+// LiveKit access-token minting lives in ./livekit (shared with calls.js, which mints a token for the native
+// VoIP call payload). Same hand-rolled HS256 JWT — grants join+publish+subscribe on one room, one identity.
+const { livekitToken } = require('./livekit');
 
 // Issue a refresh token (native clients), store only its hash, return the plaintext once.
 async function issueRefreshToken(userId) {