Let a shared playlist be sent to another user by name

server/db.js

@@ -66,6 +66,21 @@ export async function initDb() {
       data       TEXT    NOT NULL DEFAULT '{}',
       created_at INTEGER NOT NULL DEFAULT (unixepoch())
     );
+
+    -- Playlists sent from one profile to another. Holds only a pointer to the
+    -- shared_playlists row, never a copy of the videos, so a delivery costs a
+    -- few bytes and the recipient decides whether to keep it.
+    CREATE TABLE IF NOT EXISTS playlist_inbox (
+      id         TEXT    PRIMARY KEY,
+      to_name    TEXT    NOT NULL,
+      from_name  TEXT,
+      code       TEXT    NOT NULL,
+      title      TEXT    NOT NULL,
+      created_at INTEGER NOT NULL DEFAULT (unixepoch())
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_inbox_to
+      ON playlist_inbox (to_name, created_at DESC);
   `);
 }
 
@@ -136,6 +151,58 @@ export async function getSharedPlaylist(code) {
   return { data: row.data, createdAt: Number(row.created_at) };
 }
 
+// ---- Playlist inbox (profile-to-profile sends) ------------------------------
+
+// Queue a shared playlist for a recipient profile. Caller must have verified
+// the recipient exists; `code` must already be a row in shared_playlists.
+export async function queueInboxPlaylist({ id, toName, fromName, code, title }) {
+  await db.execute({
+    sql: `INSERT INTO playlist_inbox (id, to_name, from_name, code, title, created_at)
+          VALUES (?, ?, ?, ?, ?, unixepoch())`,
+    args: [id, toName, fromName || null, code, title],
+  });
+}
+
+// Pending deliveries for a profile, oldest first so they are offered in the
+// order they were sent. Capped so a flooded inbox can't blow up the response.
+export async function listInbox(toName, limit = 20) {
+  const r = await db.execute({
+    sql: `SELECT id, from_name, code, title, created_at
+            FROM playlist_inbox
+           WHERE to_name = ?
+        ORDER BY created_at ASC
+           LIMIT ?`,
+    args: [toName, limit],
+  });
+  return r.rows.map((row) => ({
+    id: row.id,
+    from: row.from_name || null,
+    code: row.code,
+    title: row.title,
+    createdAt: Number(row.created_at),
+  }));
+}
+
+// Remove one delivery once the recipient has kept or dismissed it. Scoped by
+// to_name so knowing an id alone cannot clear someone else's inbox.
+export async function deleteInboxItem(toName, id) {
+  const r = await db.execute({
+    sql: 'DELETE FROM playlist_inbox WHERE to_name = ? AND id = ?',
+    args: [toName, id],
+  });
+  return (r.rowsAffected || 0) > 0;
+}
+
+// How many deliveries this recipient already has waiting — used to refuse a
+// send that would flood an inbox.
+export async function countInbox(toName) {
+  const r = await db.execute({
+    sql: 'SELECT COUNT(*) AS n FROM playlist_inbox WHERE to_name = ?',
+    args: [toName],
+  });
+  return Number(r.rows[0] ? r.rows[0].n : 0);
+}
+
 // ---- Helpers ---------------------------------------------------------------
 
 // Upsert the users row and optionally update playlists.