@proveanything/smartlinks 2.1.1 → 2.1.3

package/dist/api/bookings.d.ts

@@ -1,4 +1,4 @@
-import type { Booking, BookingSlot, BookingAllocation, CreateBookingInput, UpdateBookingInput, MoveBookingInput, BookingListQueryParams, CreateSlotInput, UpdateSlotInput, SlotListQueryParams, CreateBlockInput, BlockListQueryParams, FreeBusyQuery, FreeBusyResponse, BookingAccessOptions } from '../types/bookings.js';
+import type { Booking, BookingSlot, BookingAllocation, CreateBookingInput, UpdateBookingInput, MoveBookingInput, BookingListQueryParams, CreateSlotInput, UpdateSlotInput, SlotListQueryParams, CreateBlockInput, BlockListQueryParams, FreeBusyQuery, FreeBusyResponse, BookingAccessOptions, MessageBookersInput, MessageBookersResult } from '../types/bookings.js';
 import type { PaginatedResponse } from '../types/appObjects.js';
 export declare namespace bookings {
     /**
@@ -55,6 +55,12 @@ export declare namespace bookings {
      * GET /bookings/freebusy
      */
     function freebusy(collectionId: string, appId: string, q: FreeBusyQuery, admin?: boolean): Promise<FreeBusyResponse>;
+    /**
+     * Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date
+     * range (optionally with one person / room), each send hydrated with their booking ({{ booking }}).
+     * No segment to make. POST /bookings/message
+     */
+    function message(collectionId: string, appId: string, input: MessageBookersInput): Promise<MessageBookersResult>;
     namespace slots {
         /** Create a slot (admin). POST /bookings/slots */
         function create(collectionId: string, appId: string, input: CreateSlotInput): Promise<BookingSlot>;

package/dist/api/bookings.js

@@ -122,6 +122,15 @@ export var bookings;
         return request(`${basePath(collectionId, appId, admin)}/freebusy${query(params)}`);
     }
     bookings.freebusy = freebusy;
+    /**
+     * Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date
+     * range (optionally with one person / room), each send hydrated with their booking ({{ booking }}).
+     * No segment to make. POST /bookings/message
+     */
+    async function message(collectionId, appId, input) {
+        return post(`${basePath(collectionId, appId, true)}/message`, input);
+    }
+    bookings.message = message;
     // ==================== SLOTS ====================
     let slots;
     (function (slots_1) {

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.1  |  Generated: 2026-10-25T08:26:22.390Z
+Version: 2.1.3  |  Generated: 2026-10-26T21:00:54.277Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2585,9 +2585,11 @@ interface AppContainerComponent {
 **DeepLinkEntry** (interface)
 ```typescript
 interface DeepLinkEntry {
+  id?: string;
   title: string;
   path?: string;
   params?: Record<string, string>;
+  accepts?: PublicViewParams;
   widget?: true;
 }
 ```
@@ -2816,6 +2818,7 @@ interface ServerFunctionBookings {
   complete(bookingId: string): Promise<Booking>;
   noShow(bookingId: string): Promise<Booking>;
   freebusy(q: FreeBusyQuery): Promise<FreeBusyResponse>;
+  message(input: MessageBookersInput): Promise<MessageBookersResult>;
   slots: {
   create(input: CreateSlotInput): Promise<BookingSlot>;
   createMany(inputs: CreateSlotInput[], opts?: { seriesId?: string }): Promise<BookingSlot[]>;
@@ -5366,6 +5369,32 @@ interface FreeBusyResponse {
 }
 ```
 
+**MessageBookersInput** (interface)
+```typescript
+interface MessageBookersInput {
+  templateId: string
+  channel?: 'email' | 'sms' | 'whatsapp' | 'push' | 'preferred'
+  props?: Record<string, any>
+  slotId?: string
+  from?: string | Date
+  to?: string | Date
+  resourceType?: string
+  resourceId?: string
+  statuses?: BookingStatus[]
+  ref?: string
+}
+```
+
+**MessageBookersResult** (interface)
+```typescript
+interface MessageBookersResult {
+  matched: number
+  sent: number
+  skipped: { noContact: number; duplicate: number; failed: number }
+  failures: Array<{ bookingId: string; error: string }>
+}
+```
+
 **BookingAccessOptions** (interface)
 ```typescript
 interface BookingAccessOptions {
@@ -7452,6 +7481,7 @@ interface IframeResponderOptions {
   version?: string;
   appUrl?: string;
   initialPath?: string;
+  params?: Record<string, string>;
   isAdmin?: boolean;
   cache?: CachedData;
   onAuthLogin?: (
@@ -11902,6 +11932,9 @@ confirmed → no_show (admin).
 **freebusy**(collectionId: string, appId: string, q: FreeBusyQuery, admin: boolean = false) → `Promise<FreeBusyResponse>`
 Busy intervals per resource (bookings, blocks, slots' own blocks) — never booking details. Public only when the app sets `publicRead.bookings.freebusy: true`. GET /bookings/freebusy
 
+**message**(collectionId: string, appId: string, input: MessageBookersInput) → `Promise<MessageBookersResult>`
+Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date range (optionally with one person / room), each send hydrated with their booking ({{ booking }}). No segment to make. POST /bookings/message
+
 ### bookings.blocks
 
 **create**(collectionId: string, appId: string, input: CreateBlockInput) → `Promise<BookingAllocation>`

package/dist/docs/app-manifest.md

@@ -326,11 +326,28 @@ Static deep-linkable states built into the app — fixed routes that exist regar
 
 See the [Deep Link Discovery guide](deep-link-discovery.md) for the full dual-source pattern (static manifest routes + dynamic `appConfig.linkable`).
 
+These are the app's **pages that a host opens**: portal menus and tabs, and websites that embed the app
+(websites.md → "Using another app's pages"). A host opens them with its own signed-in session, so one
+app can offer several pages that each know the visitor: book, upcoming bookings, past bookings, change a
+booking.
+
+```json
+"linkable": [
+  { "id": "book", "title": "Book an appointment", "path": "/",
+    "accepts": { "optional": ["service", "staff", "date"] } },
+  { "id": "upcoming", "title": "Your upcoming bookings", "path": "/my-bookings" },
+  { "id": "change", "title": "Change a booking", "path": "/booking",
+    "accepts": { "required": ["id"] } }
+]
+```
+
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
+| `id` | string | ❌ | Stable id, unique within the app: hosts and sites refer to the page by it |
 | `title` | string | ✅ | Human-readable label shown in menus and offered to AI agents |
 | `path` | string | ❌ | Hash route within the app (defaults to `"/"` if omitted) |
-| `params` | object | ❌ | App-specific query params appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
+| `params` | object | ❌ | Params this entry PINS, appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
+| `accepts` | `{ required?: string[]; optional?: string[] }` | ❌ | The params a host may supply when it opens the page (e.g. which service to start on) |
 
 #### `publicViews`
 
@@ -371,7 +388,7 @@ An app can have any combination of three setup styles. Only public views are ext
 | Style | Declared by | Lives | Context |
 |-------|-------------|-------|---------|
 | **Portal components** — where the app renders inside portal (collection / product / batch / variant / proof) | module registry `components.*` (set at publish) | Inside portal | Physical twin (QR/NFC scan) |
-| **Portal deep links** — the entry points portal menus/tabs/side-menus link to (e.g. list view vs calendar view) | `linkable` / `DeepLinkEntry` | Inside portal | Portal (menu picks the entry) |
+| **App pages** — the entry points portal menus/tabs link to and websites embed (e.g. list vs calendar; book vs my bookings) | `linkable` / `DeepLinkEntry` | Inside a host: portal or a website | The host: its signed-in session, plus the page's `accepts` params |
 | **Public views** — standalone external screens | `publicViews` (this block) | Outside portal | URL params only |
 
 #### `records`

package/dist/docs/bookings.md

@@ -324,8 +324,80 @@ Recorded after each write commits, for flows and app functions (`trigger: { type
 `booking.no_show`, `booking.hold_expired`, `slot.full`, `slot.place_freed` (for waitlist promotion).
 Context: `{ appId, status, slotIds }` (bookings) / `{ appId, remaining }` (slots).
 
-Reminders before a booking (`booking.starts_in`) are coming; until then, use a cron function that lists
-upcoming bookings.
+Reminders before a booking (`booking.starts_in`) are coming; until then, send a reminder template to
+tomorrow's bookers with `bookings.message` (below) from a cron function.
+
+---
+
+## Confirmations and messages
+
+Nothing is emailed by default: your app decides what goes out, in **flows on booking events**, with
+**templates the business can reword in Studio** (Comms → Templates). The platform does the sending,
+the hydration and the consent.
+
+### Flows on booking events
+
+A site, or an app on behalf of a business, sets them up through the cloud blueprint
+(`cloud/flows.json` in a site; `POST /admin/collection/:cId/blueprint/apply` with
+`{ appId, blueprint: { templates, flows } }` from an app's admin screen). Additive: re-applying never
+removes what is there, and a template edited in Studio keeps its edits unless the blueprint sends new
+wording.
+
+```json
+{
+  "templates": {
+    "booking-confirmed": { "name": "You're booked", "email": { "subject": "{{ booking.serviceName }} on {{ booking.when.date }}", "body": "<p>Hi {{ contact.firstName }}, see you at {{ booking.when.time }}.</p>" }, "sms": { "body": "Booked: {{ booking.when.shortDate }} {{ booking.when.time }}" } },
+    "booking-requested": { "name": "Request received", "email": { "subject": "We got your request", "body": "<p>We'll confirm shortly.</p>" } },
+    "staff-new-booking": { "name": "You've been booked", "email": { "subject": "New appointment", "body": "<p>{{ booking.customer.name }}, {{ booking.when.dateTime }}</p>" } }
+  },
+  "flows": [
+    { "when": { "event": "booking.confirmed" }, "do": [{ "send": "booking-confirmed", "to": "contact" }, { "send": "staff-new-booking", "to": "resource" }, { "send": "team-new-booking", "to": "team" }] },
+    { "when": { "event": "booking.created", "status": "pending" }, "do": [{ "send": "booking-requested", "to": "contact" }] }
+  ]
+}
+```
+
+- `when.event`: `booking.created` / `confirmed` / `cancelled` / `moved` / `completed` / `no_show` /
+  `hold_expired`, `slot.full` / `slot.place_freed`; `when.status` narrows to the booking's status at the
+  time (`"pending"` for "request received").
+- `to`: `contact` — the booker, by their preferred channel (`channel` to force one; a template needs an
+  `sms` part to go by text); `team` — the collection's team addresses; `resource` — the booked
+  person or room: a resource that is a contact, or a record with `data.email` / `data.contactId`.
+  A **public** resource record (a staff profile the booking page lists) keeps its address on a
+  **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
+  resource) — the platform looks there too, and the address never ships with the public listing.
+- Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
+  `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
+  `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
+  recipient's timezone is known and differs, `whenFor` (the same in theirs); `editToken` only when the
+  recipient is the booker (a guest's manage link). `{{ contact }}` is the recipient; `{{ appConfig }}`
+  the app's public config (a booking page's address, the business name) for sends to the contact.
+
+### Who is reachable
+
+A **guest** who books with an email or phone gets a **contact** (found by that identity or made,
+filling only empty fields: a form's details never overwrite a known contact), and so does a customer
+**staff book in by hand** (`customer: { name, email, phone }` on the body or in `data`). Admin
+creates may pass `contactId` instead. A booking with no contact gets no messages: show the booker why
+an email is worth giving.
+
+### Messaging everyone booked — `bookings.message`
+
+No list to build, no segment to save: send a template to everyone on a slot, or everyone booked in a
+window (optionally with one resource), each hydrated with **their own** booking.
+
+```ts
+// Everyone on tomorrow's 10:00 class
+await SL.bookings.message(collectionId, appId, { templateId, slotId })
+// Everyone booked with Sam next week, by email even if they prefer texts
+await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
+```
+
+Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
+for more). One message per contact on a slot, one per booking in a window. Also
+`ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that
+messages tomorrow's bookers is a reminder system in five lines.
 
 ---
 
@@ -343,6 +415,7 @@ All take `(collectionId, appId, …)`; `admin` is the last parameter where both
 | `bookings.confirm / cancel / move(…, admin?, { editToken }?)` | ✓ | per `ownerActions.bookings` |
 | `bookings.extendHold / complete / noShow` | ✓ | — |
 | `bookings.freebusy(q, admin?)` | ✓ | if `publicRead.bookings.freebusy` |
+| `bookings.message(input)` | ✓ | — |
 | `bookings.slots.create / createMany / update / remove` | ✓ | — |
 | `bookings.slots.list / get(…, admin?)` | ✓ | open, public slots |
 | `bookings.blocks.create / list / remove` | ✓ | — |

package/dist/docs/deep-link-discovery.md

@@ -172,6 +172,9 @@ Both sources use the same entry shape:
 
 ```typescript
 interface DeepLinkEntry {
+  /** Stable id, unique within the app (optional): hosts and websites refer to the page by it */
+  id?: string;
+
   /** Human-readable label for this state (required) */
   title: string;
 
@@ -193,6 +196,13 @@ interface DeepLinkEntry {
    */
   params?: Record<string, string>;
 
+  /**
+   * The params a host may supply when it opens this page (optional), e.g. a booking page that can
+   * start on one service: `{ optional: ['service', 'staff', 'date'] }`. `params` are pinned by the
+   * entry; `accepts` are filled in by whoever opens it.
+   */
+  accepts?: { required?: string[]; optional?: string[] };
+
   /**
    * When `true`, this entry is also available as a dynamic data context for widgets.
    *
@@ -211,7 +221,9 @@ interface DeepLinkEntry {
 |-------|----------|-------|
 | `title` | ✅ | Displayed in menus and offered to AI agents. Should be concise and human-readable. |
 | `path` | ❌ | Hash route within the app. Defaults to `/` if omitted. |
+| `id` | ❌ | Stable id for hosts and websites to refer to the page by. |
 | `params` | ❌ | App-specific query params only. Platform params are injected automatically. |
+| `accepts` | ❌ | The params whoever opens the page may supply (`required` / `optional`). |
 | `widget` | ❌ | Set to `true` to make this entry selectable in the widget config picker as a dynamic data context. |
 
 > **Tip:** Different entries can share the same `path` if they differ by `params` — for example, two entries pointing at `/settings` with different `tab` params.

package/dist/docs/iframe-responder.md

@@ -103,6 +103,7 @@ interface IframeResponderOptions {
   version?: 'stable' | 'development'; // App version (default: 'stable')
   appUrl?: string;              // Override URL (for local dev)
   initialPath?: string;         // Initial hash path (e.g., '/settings')
+  params?: Record<string, string>; // The page's own params (e.g. { service: 'svc_123' }); context params win
   
   // Data
   cache?: CachedData;           // Pre-cached data

package/dist/docs/server-functions.md

@@ -517,7 +517,7 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Check a tapped tag is real | `ctx.sl.tags.resolve(proofId)` → `{ id, claimSetId, code }` or `null` | `sl:tags:read` |
 | Put a visitor's details on a contact | `ctx.sl.contacts.upsert({ email, firstName, … })` → `{ contactId, created }` (fills empty fields only) | `sl:contacts:write` |
 | Record "they did X" | `ctx.sl.interactions.record({ interactionId, contactId, outcome, metadata })` | `sl:interactions:write` |
-| Take a booking with your own checks (hours, queue token, payment) | `ctx.sl.bookings.create({ slotId \| resource + time, contactId, status, idempotencyKey })` — never oversold, never double-booked; also `confirm` / `cancel` / `move` / `mine` / `freebusy` / `slots.*` / `blocks.*` (see [bookings.md](bookings.md)) | `sl:bookings:write` (`sl:bookings:read` to read) |
+| Take a booking with your own checks (hours, queue token, payment) | `ctx.sl.bookings.create({ slotId \| resource + time, contactId, status, idempotencyKey })` — never oversold, never double-booked; also `confirm` / `cancel` / `move` / `mine` / `freebusy` / `message` (everyone booked, hydrated) / `slots.*` / `blocks.*` (see [bookings.md](bookings.md)) | `sl:bookings:write` (`sl:bookings:read` to read) |
 
 Notes:
 - **Talking to the SmartLinks core is `ctx.sl`, not HTTP.** The common pattern — *validate /
@@ -636,6 +636,18 @@ try {
 }
 ```
 
+`ctx.sl.bookings.message({ templateId, slotId | from, to, resourceType?, resourceId?, channel? })` sends a
+template to everyone booked (each hydrated with their own booking) — the five-line reminder cron:
+
+```ts
+// manifest: { name: 'remind', trigger: { type: 'cron', schedule: '0 17 * * *' }, capabilities: ['sl:bookings:write'] }
+export async function remind(ctx) {
+  const from = new Date(); from.setDate(from.getDate() + 1); from.setHours(0, 0, 0, 0)
+  const to = new Date(from); to.setDate(to.getDate() + 1)
+  return ctx.sl.bookings.message({ templateId: 'bp.' + ctx.collectionId + '.reminder', from, to })
+}
+```
+
 The local harness runs bookings in memory with the same rules (capacity, per-person limits, no
 overlaps, idempotency, holds): `ctx.memory.bookings`.
 

package/dist/docs/websites.md

@@ -66,6 +66,32 @@ bytes. `_server/` is never served to visitors.
   doing work that belongs in a server function or a scheduled job.
 - **No secrets** in the server bundle and no Node built-ins beyond `nodejs_compat`.
 
+## Using another app's pages
+
+Some apps do a job a site shouldn't rebuild: a booking journey holds the time rules, the clash
+handling and the confirmation; "my bookings" holds who may change what. Those apps declare their pages
+in `linkable` (app-manifest.md), each with a stable `id`, a `path` and the params it `accepts`. A site
+embeds one with **`IframeResponder`** (iframe-responder.md), from the browser:
+
+```typescript
+const site = SL.site.current()
+const responder = new SL.IframeResponder({
+  collectionId: site.collectionId,
+  appId: 'appointments',            // the app's id on this collection
+  initialPath: '/my-bookings',      // the page's `path`
+  params: { service: 'svc_123' },   // what the page `accepts`
+  onResize: (h) => { iframe.style.height = `${h}px` },
+})
+iframe.src = await responder.attach(iframe)
+```
+
+- **The visitor's session goes with it.** The page's API calls are proxied through the site, so it
+  acts as whoever is signed in to the site (or as a guest). Never pass a token in the URL.
+- **The app must be installed** on the site's collection; its address comes from there.
+- **Show the app's content natively where you can** (its `headless` data: services, staff, events)
+  for your own design and SEO, and embed the page only for the part that does the work.
+- Pages render on the client, after load: they aren't part of the server-rendered HTML.
+
 ## Caching
 
 The router keeps a rendered page at the edge when your response says it may:

package/dist/iframeResponder.d.ts

@@ -100,4 +100,6 @@ export declare function buildIframeSrc(options: {
         secondary?: string;
     };
     initialPath?: string;
+    /** The page's own params; the context params above always win. */
+    params?: Record<string, string>;
 }): string;

package/dist/iframeResponder.js

@@ -155,11 +155,16 @@ export class IframeResponder {
     // URL Building
     // ===========================================================================
     buildIframeSrc() {
-        var _a, _b;
+        var _a, _b, _c;
         if (!this.appUrl) {
             throw new Error('App URL not resolved');
         }
         const params = new URLSearchParams();
+        // The page's own params first: the platform's context below always wins.
+        for (const [key, value] of Object.entries((_a = this.options.params) !== null && _a !== void 0 ? _a : {})) {
+            if (value != null && value !== '')
+                params.set(key, String(value));
+        }
         // Required context
         params.set('collectionId', this.options.collectionId);
         params.set('appId', this.options.appId);
@@ -171,13 +176,13 @@ export class IframeResponder {
         if (this.options.isAdmin)
             params.set('isAdmin', 'true');
         // Dark mode from collection
-        const isDark = (_b = (_a = this.cache.collection) === null || _a === void 0 ? void 0 : _a.dark) !== null && _b !== void 0 ? _b : false;
+        const isDark = (_c = (_b = this.cache.collection) === null || _b === void 0 ? void 0 : _b.dark) !== null && _c !== void 0 ? _c : false;
         params.set('dark', isDark ? '1' : '0');
         // Parent URL for redirects
         try {
             params.set('parentUrl', window.location.href);
         }
-        catch (_c) {
+        catch (_d) {
             // Ignore if can't access location
         }
         // Encode theme from collection
@@ -192,7 +197,7 @@ export class IframeResponder {
                     params.set('theme', btoa(JSON.stringify(themeData)));
                 }
             }
-            catch (_d) {
+            catch (_e) {
                 // Ignore encoding errors
             }
         }
@@ -210,7 +215,8 @@ export class IframeResponder {
                 const path = this.options.initialPath.startsWith('/') ? this.options.initialPath : '/' + this.options.initialPath;
                 // Insert path before the ?
                 const [beforeHash, afterHash] = baseWithHash.split('#');
-                finalUrl = `${beforeHash}#${afterHash || ''}${path}?${existingParams.toString()}`;
+                // App addresses end in "#/": join without doubling the slash ("#//my-bookings" matches no route).
+                finalUrl = `${beforeHash}#${(afterHash || '').replace(/\/+$/, '')}${path}?${existingParams.toString()}`;
             }
             else {
                 finalUrl = `${baseWithHash}?${existingParams.toString()}`;
@@ -765,8 +771,12 @@ export function isAdminFromRoles(user, collection, proof) {
  * Standalone helper for cases where you don't need the full IframeResponder.
  */
 export function buildIframeSrc(options) {
-    var _a, _b;
+    var _a, _b, _c;
     const params = new URLSearchParams();
+    for (const [key, value] of Object.entries((_a = options.params) !== null && _a !== void 0 ? _a : {})) {
+        if (value != null && value !== '')
+            params.set(key, String(value));
+    }
     params.set('collectionId', options.collectionId);
     params.set('appId', options.appId);
     if (options.productId)
@@ -776,14 +786,14 @@ export function buildIframeSrc(options) {
     if (options.isAdmin)
         params.set('isAdmin', 'true');
     params.set('dark', options.dark ? '1' : '0');
-    if (((_a = options.theme) === null || _a === void 0 ? void 0 : _a.primary) || ((_b = options.theme) === null || _b === void 0 ? void 0 : _b.secondary)) {
+    if (((_b = options.theme) === null || _b === void 0 ? void 0 : _b.primary) || ((_c = options.theme) === null || _c === void 0 ? void 0 : _c.secondary)) {
         const themeData = { p: options.theme.primary, s: options.theme.secondary };
         params.set('theme', btoa(JSON.stringify(themeData)));
     }
     try {
         params.set('parentUrl', window.location.href);
     }
-    catch (_c) {
+    catch (_d) {
         // Ignore
     }
     let base = options.appUrl.replace(/#\/?$/, '').replace(/\/$/, '');

package/dist/openapi.yaml

@@ -10291,6 +10291,32 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /message:
+    post:
+      tags:
+        - bookings
+      summary: "Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date range (optionally with one person / room), each send hydrated with their booking ({{ booking }})."
+      operationId: bookings_message
+      security: []
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageBookersResult"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/MessageBookersInput"
   /platform/location:
     post:
       tags:
@@ -19883,6 +19909,8 @@ components:
     DeepLinkEntry:
       type: object
       properties:
+        id:
+          type: string
         title:
           type: string
         path:
@@ -19891,6 +19919,8 @@ components:
           type: object
           additionalProperties:
             type: string
+        accepts:
+          $ref: "#/components/schemas/PublicViewParams"
         widget:
           type: object
           additionalProperties: true
@@ -24706,6 +24736,62 @@ components:
         - from
         - to
         - resources
+    MessageBookersInput:
+      type: object
+      properties:
+        templateId:
+          type: string
+        channel:
+          type: string
+          enum:
+            - email
+            - sms
+            - whatsapp
+            - push
+            - preferred
+        props:
+          type: object
+          additionalProperties: true
+        slotId:
+          type: string
+        from:
+          type: object
+          additionalProperties: true
+        to:
+          type: object
+          additionalProperties: true
+        resourceType:
+          type: string
+        resourceId:
+          type: string
+        statuses:
+          type: array
+          items:
+            $ref: "#/components/schemas/BookingStatus"
+        ref:
+          type: string
+      required:
+        - templateId
+    MessageBookersResult:
+      type: object
+      properties:
+        matched:
+          type: number
+        sent:
+          type: number
+        skipped:
+          type: object
+          additionalProperties: true
+        failures:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - matched
+        - sent
+        - skipped
+        - failures
     BookingAccessOptions:
       type: object
       properties:
@@ -27570,6 +27656,10 @@ components:
           type: string
         initialPath:
           type: string
+        params:
+          type: object
+          additionalProperties:
+            type: string
         isAdmin:
           type: boolean
         cache:

package/dist/testing/bookingsMemory.d.ts

@@ -32,6 +32,17 @@ export declare function bookingsMemoryImpl(mem: BookingsMemory, caller?: {
     cancel(bookingId: string, opts?: any): Promise<any>;
     move(bookingId: string, input?: any): Promise<any>;
     extendHold(bookingId: string, holdMinutes: number): Promise<any>;
+    /** Counts who would be messaged (no sends in memory); inject `sl.bookings.message` to assert sends. */
+    message(input?: any): Promise<{
+        matched: number;
+        sent: number;
+        skipped: {
+            noContact: number;
+            duplicate: number;
+            failed: number;
+        };
+        failures: any[];
+    }>;
     complete(bookingId: string): Promise<any>;
     noShow(bookingId: string): Promise<any>;
     freebusy(q?: any): Promise<{

package/dist/testing/bookingsMemory.js

@@ -280,6 +280,28 @@ export function bookingsMemoryImpl(mem, caller = {}) {
             b.holdExpiresAt = iso(Math.min(now() + (holdMinutes !== null && holdMinutes !== void 0 ? holdMinutes : 15) * 60000, ms(b.createdAt) + 24 * 3600000));
             return copy(withAllocations(b));
         },
+        /** Counts who would be messaged (no sends in memory); inject `sl.bookings.message` to assert sends. */
+        async message(input = {}) {
+            const list = input.slotId
+                ? (await this.query({ slotId: input.slotId, status: (input.statuses || ['held', 'pending', 'confirmed']).join(',') })).data
+                : (await this.query({ from: input.from, to: input.to, status: (input.statuses || ['held', 'pending', 'confirmed']).join(',') })).data;
+            const seen = new Set();
+            const out = { matched: list.length, sent: 0, skipped: { noContact: 0, duplicate: 0, failed: 0 }, failures: [] };
+            for (const b of list) {
+                if (!b.contactId) {
+                    out.skipped.noContact++;
+                    continue;
+                }
+                const key = input.slotId ? b.contactId : `${b.contactId}:${b.id}`;
+                if (seen.has(key)) {
+                    out.skipped.duplicate++;
+                    continue;
+                }
+                seen.add(key);
+                out.sent++;
+            }
+            return out;
+        },
         async complete(bookingId) { return outcome(find(bookingId), 'completed'); },
         async noShow(bookingId) { return outcome(find(bookingId), 'no_show'); },
         async freebusy(q = {}) {

package/dist/testing/index.js

@@ -274,7 +274,7 @@ export function createFunctionTestContext(opts) {
     const bkFn = (obj, name) => (obj && typeof obj[name] === 'function' ? obj[name].bind(obj) : undefined);
     const BOOKING_READS = new Set(['get', 'query', 'mine', 'freebusy']);
     sl.bookings = {};
-    for (const m of ['create', 'get', 'query', 'mine', 'update', 'confirm', 'cancel', 'move', 'extendHold', 'complete', 'noShow', 'freebusy']) {
+    for (const m of ['create', 'get', 'query', 'mine', 'update', 'confirm', 'cancel', 'move', 'extendHold', 'complete', 'noShow', 'freebusy', 'message']) {
         sl.bookings[m] = gated('bookings', BOOKING_READS.has(m) ? 'read' : 'write', bkFn(bk, m), `bookings.${m}`);
     }
     sl.bookings.slots = {};

package/dist/types/appManifest.d.ts

@@ -4,7 +4,7 @@ import type { AppDataDeclaration, AppHeadlessDeclaration } from './headless.js';
 import type { RealtimeChannelDeclaration } from './realtime.js';
 import type { AppManifestAdminCards } from './adminCards.js';
 import type { PaginatedResponse } from './appObjects.js';
-import type { Booking, BookingSlot, BookingAllocation, CreateBookingInput, UpdateBookingInput, MoveBookingInput, BookingListQueryParams, CreateSlotInput, UpdateSlotInput, SlotListQueryParams, CreateBlockInput, BlockListQueryParams, FreeBusyQuery, FreeBusyResponse } from './bookings.js';
+import type { Booking, BookingSlot, BookingAllocation, CreateBookingInput, UpdateBookingInput, MoveBookingInput, BookingListQueryParams, CreateSlotInput, UpdateSlotInput, SlotListQueryParams, CreateBlockInput, BlockListQueryParams, FreeBusyQuery, FreeBusyResponse, MessageBookersInput, MessageBookersResult } from './bookings.js';
 /**
  * A bundle (widget or container) as returned by the collection widgets endpoint.
  *
@@ -109,6 +109,12 @@ export interface AppContainerComponent {
  *   { "title": "About Us", "params": { "pageId": "about-us" } }
  */
 export interface DeepLinkEntry {
+    /**
+     * Stable id for this page, unique within the app (optional). Hosts and websites refer to the page
+     * by it (e.g. a site embeds `{ app: 'appointments', page: 'book' }`), so a renamed `title` or a moved
+     * `path` doesn't break them.
+     */
+    id?: string;
     /** Human-readable label shown in menus and offered to AI agents */
     title: string;
     /**
@@ -123,6 +129,12 @@ export interface DeepLinkEntry {
      * those are injected by the platform automatically.
      */
     params?: Record<string, string>;
+    /**
+     * The params a host may supply when it opens this page (in addition to the platform's own), e.g. a
+     * booking page that can start on one service: `{ optional: ['service', 'staff', 'date'] }`. `params`
+     * above are the values this entry PINS; `accepts` are the ones the caller fills in.
+     */
+    accepts?: PublicViewParams;
     /**
      * When `true`, this entry is also available as a dynamic data context for widgets
      * (in addition to being a navigable page / container route).
@@ -449,6 +461,8 @@ export interface ServerFunctionBookings {
     noShow(bookingId: string): Promise<Booking>;
     /** Busy intervals per resource — feed them to `utils.freeTimes` with your schedule. */
     freebusy(q: FreeBusyQuery): Promise<FreeBusyResponse>;
+    /** A template to everyone booked on a slot / in a range, each hydrated with their booking. */
+    message(input: MessageBookersInput): Promise<MessageBookersResult>;
     slots: {
         create(input: CreateSlotInput): Promise<BookingSlot>;
         createMany(inputs: CreateSlotInput[], opts?: {
@@ -854,10 +868,10 @@ export interface AppManifest {
         components: AppContainerComponent[];
     };
     /**
-     * PORTAL deep-linkable states built into this app — the entry points the portal's menu system
-     * (bottom menu, side menus, tabs) can link to. Use these when one app has several ways to enter/load
-     * its portal component (e.g. a list view and a calendar view, or a viewer and an editor) that
-     * different parts of portal should link to independently. These live INSIDE portal.
+     * The app's PAGES that a host opens — portal menus (bottom menu, side menus, tabs) and WEBSITES that
+     * embed the app (IframeResponder). Use these when one app has several ways in (a list view and a
+     * calendar view; book, upcoming bookings, change a booking). A host opens them with its own signed-in
+     * session: the page's API calls go through the host, so it acts as the person signed in there.
      * Fixed routes are declared here at build time; dynamic content entries (e.g. CMS pages) are stored
      * separately in `appConfig.linkable` — merge both for the full navigable set.
      * @see DeepLinkEntry

package/dist/types/bookings.d.ts

@@ -266,6 +266,37 @@ export interface FreeBusyResponse {
         busy: FreeBusyInterval[];
     }>;
 }
+/** `bookings.message`: a template to everyone booked on a slot, or in a date range. */
+export interface MessageBookersInput {
+    /** A comms template of the collection (edited in Studio). */
+    templateId: string;
+    channel?: 'email' | 'sms' | 'whatsapp' | 'push' | 'preferred';
+    /** Extra Liquid variables, on top of {{ booking }}, {{ contact }} and {{ appConfig }}. */
+    props?: Record<string, any>;
+    /** Everyone on this slot … */
+    slotId?: string;
+    /** … or everyone booked in [from, to), optionally with one resource. */
+    from?: string | Date;
+    to?: string | Date;
+    resourceType?: string;
+    resourceId?: string;
+    /** Default: held, pending, confirmed. */
+    statuses?: BookingStatus[];
+    ref?: string;
+}
+export interface MessageBookersResult {
+    matched: number;
+    sent: number;
+    skipped: {
+        noContact: number;
+        duplicate: number;
+        failed: number;
+    };
+    failures: Array<{
+        bookingId: string;
+        error: string;
+    }>;
+}
 /** Public calls on a booking made by an anonymous guest: pass the edit token returned at create. */
 export interface BookingAccessOptions {
     editToken?: string;

package/dist/types/iframeResponder.d.ts

@@ -24,6 +24,12 @@ export interface IframeResponderOptions {
     appUrl?: string;
     /** Initial hash path (e.g., '/settings') */
     initialPath?: string;
+    /**
+     * The page's own params (a `linkable` entry's pinned `params` plus what it `accepts`), e.g.
+     * `{ service: 'svc_123' }`. Added to the app's URL alongside the platform's context params, which
+     * always win (collectionId, appId, productId, proofId, isAdmin, dark, theme, parentUrl).
+     */
+    params?: Record<string, string>;
     /** Is user an admin of this collection */
     isAdmin?: boolean;
     cache?: CachedData;

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.1  |  Generated: 2026-10-25T08:26:22.390Z
+Version: 2.1.3  |  Generated: 2026-10-26T21:00:54.277Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2585,9 +2585,11 @@ interface AppContainerComponent {
 **DeepLinkEntry** (interface)
 ```typescript
 interface DeepLinkEntry {
+  id?: string;
   title: string;
   path?: string;
   params?: Record<string, string>;
+  accepts?: PublicViewParams;
   widget?: true;
 }
 ```
@@ -2816,6 +2818,7 @@ interface ServerFunctionBookings {
   complete(bookingId: string): Promise<Booking>;
   noShow(bookingId: string): Promise<Booking>;
   freebusy(q: FreeBusyQuery): Promise<FreeBusyResponse>;
+  message(input: MessageBookersInput): Promise<MessageBookersResult>;
   slots: {
   create(input: CreateSlotInput): Promise<BookingSlot>;
   createMany(inputs: CreateSlotInput[], opts?: { seriesId?: string }): Promise<BookingSlot[]>;
@@ -5366,6 +5369,32 @@ interface FreeBusyResponse {
 }
 ```
 
+**MessageBookersInput** (interface)
+```typescript
+interface MessageBookersInput {
+  templateId: string
+  channel?: 'email' | 'sms' | 'whatsapp' | 'push' | 'preferred'
+  props?: Record<string, any>
+  slotId?: string
+  from?: string | Date
+  to?: string | Date
+  resourceType?: string
+  resourceId?: string
+  statuses?: BookingStatus[]
+  ref?: string
+}
+```
+
+**MessageBookersResult** (interface)
+```typescript
+interface MessageBookersResult {
+  matched: number
+  sent: number
+  skipped: { noContact: number; duplicate: number; failed: number }
+  failures: Array<{ bookingId: string; error: string }>
+}
+```
+
 **BookingAccessOptions** (interface)
 ```typescript
 interface BookingAccessOptions {
@@ -7452,6 +7481,7 @@ interface IframeResponderOptions {
   version?: string;
   appUrl?: string;
   initialPath?: string;
+  params?: Record<string, string>;
   isAdmin?: boolean;
   cache?: CachedData;
   onAuthLogin?: (
@@ -11902,6 +11932,9 @@ confirmed → no_show (admin).
 **freebusy**(collectionId: string, appId: string, q: FreeBusyQuery, admin: boolean = false) → `Promise<FreeBusyResponse>`
 Busy intervals per resource (bookings, blocks, slots' own blocks) — never booking details. Public only when the app sets `publicRead.bookings.freebusy: true`. GET /bookings/freebusy
 
+**message**(collectionId: string, appId: string, input: MessageBookersInput) → `Promise<MessageBookersResult>`
+Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date range (optionally with one person / room), each send hydrated with their booking ({{ booking }}). No segment to make. POST /bookings/message
+
 ### bookings.blocks
 
 **create**(collectionId: string, appId: string, input: CreateBlockInput) → `Promise<BookingAllocation>`

package/docs/app-manifest.md

@@ -326,11 +326,28 @@ Static deep-linkable states built into the app — fixed routes that exist regar
 
 See the [Deep Link Discovery guide](deep-link-discovery.md) for the full dual-source pattern (static manifest routes + dynamic `appConfig.linkable`).
 
+These are the app's **pages that a host opens**: portal menus and tabs, and websites that embed the app
+(websites.md → "Using another app's pages"). A host opens them with its own signed-in session, so one
+app can offer several pages that each know the visitor: book, upcoming bookings, past bookings, change a
+booking.
+
+```json
+"linkable": [
+  { "id": "book", "title": "Book an appointment", "path": "/",
+    "accepts": { "optional": ["service", "staff", "date"] } },
+  { "id": "upcoming", "title": "Your upcoming bookings", "path": "/my-bookings" },
+  { "id": "change", "title": "Change a booking", "path": "/booking",
+    "accepts": { "required": ["id"] } }
+]
+```
+
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
+| `id` | string | ❌ | Stable id, unique within the app: hosts and sites refer to the page by it |
 | `title` | string | ✅ | Human-readable label shown in menus and offered to AI agents |
 | `path` | string | ❌ | Hash route within the app (defaults to `"/"` if omitted) |
-| `params` | object | ❌ | App-specific query params appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
+| `params` | object | ❌ | Params this entry PINS, appended to the URL — do **not** include platform params (`collectionId`, `productId`, etc.) |
+| `accepts` | `{ required?: string[]; optional?: string[] }` | ❌ | The params a host may supply when it opens the page (e.g. which service to start on) |
 
 #### `publicViews`
 
@@ -371,7 +388,7 @@ An app can have any combination of three setup styles. Only public views are ext
 | Style | Declared by | Lives | Context |
 |-------|-------------|-------|---------|
 | **Portal components** — where the app renders inside portal (collection / product / batch / variant / proof) | module registry `components.*` (set at publish) | Inside portal | Physical twin (QR/NFC scan) |
-| **Portal deep links** — the entry points portal menus/tabs/side-menus link to (e.g. list view vs calendar view) | `linkable` / `DeepLinkEntry` | Inside portal | Portal (menu picks the entry) |
+| **App pages** — the entry points portal menus/tabs link to and websites embed (e.g. list vs calendar; book vs my bookings) | `linkable` / `DeepLinkEntry` | Inside a host: portal or a website | The host: its signed-in session, plus the page's `accepts` params |
 | **Public views** — standalone external screens | `publicViews` (this block) | Outside portal | URL params only |
 
 #### `records`

package/docs/bookings.md

@@ -324,8 +324,80 @@ Recorded after each write commits, for flows and app functions (`trigger: { type
 `booking.no_show`, `booking.hold_expired`, `slot.full`, `slot.place_freed` (for waitlist promotion).
 Context: `{ appId, status, slotIds }` (bookings) / `{ appId, remaining }` (slots).
 
-Reminders before a booking (`booking.starts_in`) are coming; until then, use a cron function that lists
-upcoming bookings.
+Reminders before a booking (`booking.starts_in`) are coming; until then, send a reminder template to
+tomorrow's bookers with `bookings.message` (below) from a cron function.
+
+---
+
+## Confirmations and messages
+
+Nothing is emailed by default: your app decides what goes out, in **flows on booking events**, with
+**templates the business can reword in Studio** (Comms → Templates). The platform does the sending,
+the hydration and the consent.
+
+### Flows on booking events
+
+A site, or an app on behalf of a business, sets them up through the cloud blueprint
+(`cloud/flows.json` in a site; `POST /admin/collection/:cId/blueprint/apply` with
+`{ appId, blueprint: { templates, flows } }` from an app's admin screen). Additive: re-applying never
+removes what is there, and a template edited in Studio keeps its edits unless the blueprint sends new
+wording.
+
+```json
+{
+  "templates": {
+    "booking-confirmed": { "name": "You're booked", "email": { "subject": "{{ booking.serviceName }} on {{ booking.when.date }}", "body": "<p>Hi {{ contact.firstName }}, see you at {{ booking.when.time }}.</p>" }, "sms": { "body": "Booked: {{ booking.when.shortDate }} {{ booking.when.time }}" } },
+    "booking-requested": { "name": "Request received", "email": { "subject": "We got your request", "body": "<p>We'll confirm shortly.</p>" } },
+    "staff-new-booking": { "name": "You've been booked", "email": { "subject": "New appointment", "body": "<p>{{ booking.customer.name }}, {{ booking.when.dateTime }}</p>" } }
+  },
+  "flows": [
+    { "when": { "event": "booking.confirmed" }, "do": [{ "send": "booking-confirmed", "to": "contact" }, { "send": "staff-new-booking", "to": "resource" }, { "send": "team-new-booking", "to": "team" }] },
+    { "when": { "event": "booking.created", "status": "pending" }, "do": [{ "send": "booking-requested", "to": "contact" }] }
+  ]
+}
+```
+
+- `when.event`: `booking.created` / `confirmed` / `cancelled` / `moved` / `completed` / `no_show` /
+  `hold_expired`, `slot.full` / `slot.place_freed`; `when.status` narrows to the booking's status at the
+  time (`"pending"` for "request received").
+- `to`: `contact` — the booker, by their preferred channel (`channel` to force one; a template needs an
+  `sms` part to go by text); `team` — the collection's team addresses; `resource` — the booked
+  person or room: a resource that is a contact, or a record with `data.email` / `data.contactId`.
+  A **public** resource record (a staff profile the booking page lists) keeps its address on a
+  **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
+  resource) — the platform looks there too, and the address never ships with the public listing.
+- Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
+  `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
+  `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
+  recipient's timezone is known and differs, `whenFor` (the same in theirs); `editToken` only when the
+  recipient is the booker (a guest's manage link). `{{ contact }}` is the recipient; `{{ appConfig }}`
+  the app's public config (a booking page's address, the business name) for sends to the contact.
+
+### Who is reachable
+
+A **guest** who books with an email or phone gets a **contact** (found by that identity or made,
+filling only empty fields: a form's details never overwrite a known contact), and so does a customer
+**staff book in by hand** (`customer: { name, email, phone }` on the body or in `data`). Admin
+creates may pass `contactId` instead. A booking with no contact gets no messages: show the booker why
+an email is worth giving.
+
+### Messaging everyone booked — `bookings.message`
+
+No list to build, no segment to save: send a template to everyone on a slot, or everyone booked in a
+window (optionally with one resource), each hydrated with **their own** booking.
+
+```ts
+// Everyone on tomorrow's 10:00 class
+await SL.bookings.message(collectionId, appId, { templateId, slotId })
+// Everyone booked with Sam next week, by email even if they prefer texts
+await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
+```
+
+Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
+for more). One message per contact on a slot, one per booking in a window. Also
+`ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that
+messages tomorrow's bookers is a reminder system in five lines.
 
 ---
 
@@ -343,6 +415,7 @@ All take `(collectionId, appId, …)`; `admin` is the last parameter where both
 | `bookings.confirm / cancel / move(…, admin?, { editToken }?)` | ✓ | per `ownerActions.bookings` |
 | `bookings.extendHold / complete / noShow` | ✓ | — |
 | `bookings.freebusy(q, admin?)` | ✓ | if `publicRead.bookings.freebusy` |
+| `bookings.message(input)` | ✓ | — |
 | `bookings.slots.create / createMany / update / remove` | ✓ | — |
 | `bookings.slots.list / get(…, admin?)` | ✓ | open, public slots |
 | `bookings.blocks.create / list / remove` | ✓ | — |

package/docs/deep-link-discovery.md

@@ -172,6 +172,9 @@ Both sources use the same entry shape:
 
 ```typescript
 interface DeepLinkEntry {
+  /** Stable id, unique within the app (optional): hosts and websites refer to the page by it */
+  id?: string;
+
   /** Human-readable label for this state (required) */
   title: string;
 
@@ -193,6 +196,13 @@ interface DeepLinkEntry {
    */
   params?: Record<string, string>;
 
+  /**
+   * The params a host may supply when it opens this page (optional), e.g. a booking page that can
+   * start on one service: `{ optional: ['service', 'staff', 'date'] }`. `params` are pinned by the
+   * entry; `accepts` are filled in by whoever opens it.
+   */
+  accepts?: { required?: string[]; optional?: string[] };
+
   /**
    * When `true`, this entry is also available as a dynamic data context for widgets.
    *
@@ -211,7 +221,9 @@ interface DeepLinkEntry {
 |-------|----------|-------|
 | `title` | ✅ | Displayed in menus and offered to AI agents. Should be concise and human-readable. |
 | `path` | ❌ | Hash route within the app. Defaults to `/` if omitted. |
+| `id` | ❌ | Stable id for hosts and websites to refer to the page by. |
 | `params` | ❌ | App-specific query params only. Platform params are injected automatically. |
+| `accepts` | ❌ | The params whoever opens the page may supply (`required` / `optional`). |
 | `widget` | ❌ | Set to `true` to make this entry selectable in the widget config picker as a dynamic data context. |
 
 > **Tip:** Different entries can share the same `path` if they differ by `params` — for example, two entries pointing at `/settings` with different `tab` params.

package/docs/iframe-responder.md

@@ -103,6 +103,7 @@ interface IframeResponderOptions {
   version?: 'stable' | 'development'; // App version (default: 'stable')
   appUrl?: string;              // Override URL (for local dev)
   initialPath?: string;         // Initial hash path (e.g., '/settings')
+  params?: Record<string, string>; // The page's own params (e.g. { service: 'svc_123' }); context params win
   
   // Data
   cache?: CachedData;           // Pre-cached data

package/docs/server-functions.md

@@ -517,7 +517,7 @@ Prefer the platform primitives above over a dependency; when you do need one, pi
 | Check a tapped tag is real | `ctx.sl.tags.resolve(proofId)` → `{ id, claimSetId, code }` or `null` | `sl:tags:read` |
 | Put a visitor's details on a contact | `ctx.sl.contacts.upsert({ email, firstName, … })` → `{ contactId, created }` (fills empty fields only) | `sl:contacts:write` |
 | Record "they did X" | `ctx.sl.interactions.record({ interactionId, contactId, outcome, metadata })` | `sl:interactions:write` |
-| Take a booking with your own checks (hours, queue token, payment) | `ctx.sl.bookings.create({ slotId \| resource + time, contactId, status, idempotencyKey })` — never oversold, never double-booked; also `confirm` / `cancel` / `move` / `mine` / `freebusy` / `slots.*` / `blocks.*` (see [bookings.md](bookings.md)) | `sl:bookings:write` (`sl:bookings:read` to read) |
+| Take a booking with your own checks (hours, queue token, payment) | `ctx.sl.bookings.create({ slotId \| resource + time, contactId, status, idempotencyKey })` — never oversold, never double-booked; also `confirm` / `cancel` / `move` / `mine` / `freebusy` / `message` (everyone booked, hydrated) / `slots.*` / `blocks.*` (see [bookings.md](bookings.md)) | `sl:bookings:write` (`sl:bookings:read` to read) |
 
 Notes:
 - **Talking to the SmartLinks core is `ctx.sl`, not HTTP.** The common pattern — *validate /
@@ -636,6 +636,18 @@ try {
 }
 ```
 
+`ctx.sl.bookings.message({ templateId, slotId | from, to, resourceType?, resourceId?, channel? })` sends a
+template to everyone booked (each hydrated with their own booking) — the five-line reminder cron:
+
+```ts
+// manifest: { name: 'remind', trigger: { type: 'cron', schedule: '0 17 * * *' }, capabilities: ['sl:bookings:write'] }
+export async function remind(ctx) {
+  const from = new Date(); from.setDate(from.getDate() + 1); from.setHours(0, 0, 0, 0)
+  const to = new Date(from); to.setDate(to.getDate() + 1)
+  return ctx.sl.bookings.message({ templateId: 'bp.' + ctx.collectionId + '.reminder', from, to })
+}
+```
+
 The local harness runs bookings in memory with the same rules (capacity, per-person limits, no
 overlaps, idempotency, holds): `ctx.memory.bookings`.
 

package/docs/websites.md

@@ -66,6 +66,32 @@ bytes. `_server/` is never served to visitors.
   doing work that belongs in a server function or a scheduled job.
 - **No secrets** in the server bundle and no Node built-ins beyond `nodejs_compat`.
 
+## Using another app's pages
+
+Some apps do a job a site shouldn't rebuild: a booking journey holds the time rules, the clash
+handling and the confirmation; "my bookings" holds who may change what. Those apps declare their pages
+in `linkable` (app-manifest.md), each with a stable `id`, a `path` and the params it `accepts`. A site
+embeds one with **`IframeResponder`** (iframe-responder.md), from the browser:
+
+```typescript
+const site = SL.site.current()
+const responder = new SL.IframeResponder({
+  collectionId: site.collectionId,
+  appId: 'appointments',            // the app's id on this collection
+  initialPath: '/my-bookings',      // the page's `path`
+  params: { service: 'svc_123' },   // what the page `accepts`
+  onResize: (h) => { iframe.style.height = `${h}px` },
+})
+iframe.src = await responder.attach(iframe)
+```
+
+- **The visitor's session goes with it.** The page's API calls are proxied through the site, so it
+  acts as whoever is signed in to the site (or as a guest). Never pass a token in the URL.
+- **The app must be installed** on the site's collection; its address comes from there.
+- **Show the app's content natively where you can** (its `headless` data: services, staff, events)
+  for your own design and SEO, and embed the page only for the part that does the work.
+- Pages render on the client, after load: they aren't part of the server-rendered HTML.
+
 ## Caching
 
 The router keeps a rendered page at the edge when your response says it may:

package/openapi.yaml

@@ -10291,6 +10291,32 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /message:
+    post:
+      tags:
+        - bookings
+      summary: "Message the people booked (admin): a template to everyone on a slot, or everyone booked in a date range (optionally with one person / room), each send hydrated with their booking ({{ booking }})."
+      operationId: bookings_message
+      security: []
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MessageBookersResult"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/MessageBookersInput"
   /platform/location:
     post:
       tags:
@@ -19883,6 +19909,8 @@ components:
     DeepLinkEntry:
       type: object
       properties:
+        id:
+          type: string
         title:
           type: string
         path:
@@ -19891,6 +19919,8 @@ components:
           type: object
           additionalProperties:
             type: string
+        accepts:
+          $ref: "#/components/schemas/PublicViewParams"
         widget:
           type: object
           additionalProperties: true
@@ -24706,6 +24736,62 @@ components:
         - from
         - to
         - resources
+    MessageBookersInput:
+      type: object
+      properties:
+        templateId:
+          type: string
+        channel:
+          type: string
+          enum:
+            - email
+            - sms
+            - whatsapp
+            - push
+            - preferred
+        props:
+          type: object
+          additionalProperties: true
+        slotId:
+          type: string
+        from:
+          type: object
+          additionalProperties: true
+        to:
+          type: object
+          additionalProperties: true
+        resourceType:
+          type: string
+        resourceId:
+          type: string
+        statuses:
+          type: array
+          items:
+            $ref: "#/components/schemas/BookingStatus"
+        ref:
+          type: string
+      required:
+        - templateId
+    MessageBookersResult:
+      type: object
+      properties:
+        matched:
+          type: number
+        sent:
+          type: number
+        skipped:
+          type: object
+          additionalProperties: true
+        failures:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+      required:
+        - matched
+        - sent
+        - skipped
+        - failures
     BookingAccessOptions:
       type: object
       properties:
@@ -27570,6 +27656,10 @@ components:
           type: string
         initialPath:
           type: string
+        params:
+          type: object
+          additionalProperties:
+            type: string
         isAdmin:
           type: boolean
         cache:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",