@proveanything/smartlinks 2.1.5 → 2.1.7

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.5  |  Generated: 2026-10-30T13:51:55.292Z
+Version: 2.1.7  |  Generated: 2026-11-01T12:48:45.040Z
 
 This is a concise summary of all available API functions and types.
 
@@ -5402,6 +5402,7 @@ interface MessageBookersInput {
   resourceId?: string
   statuses?: BookingStatus[]
   ref?: string
+  attach?: import('./comms').EmailAttachmentSpec[]
 }
 ```
 
@@ -5512,6 +5513,7 @@ interface BroadcastRecord {
   priority?: number
   }>
   }
+  attach?: Array<{ asset: string }>
   [key: string]: unknown
   }
   createdAt: string
@@ -6242,6 +6244,7 @@ interface TransactionalSendRequest {
   }
   ref?: string
   appId?: string
+  attach?: EmailAttachmentSpec[]
 }
 ```
 
@@ -6251,6 +6254,7 @@ interface TransactionalSendResponse {
   ok: true
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   messageId?: string
+  attachmentsLeftOut?: string[]
 }
 ```
 
@@ -6270,6 +6274,8 @@ interface TransactionalSendError {
 
 **ConsentChannels** = `Partial<Record<BroadcastChannel, boolean>>`
 
+**EmailAttachmentSpec** = ``
+
 **TransactionalSendResult** = `// src/types/comms.ts
 // Communication and notification types for the Smartlinks API
 import type { IdField } from './common'
@@ -6595,14 +6601,36 @@ export interface TransactionalSendRequest {
   ref?: string
   /** App context stored on the comms-events row */
   appId?: string
+  /**
+   * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+   * `attachmentsLeftOut` — the email still goes.
+   */
+  attach?: EmailAttachmentSpec[]
 }
 
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec =
+  | 'calendar'
+  | { asset: string }
+  | { function: string }
+  | { filename: string; contentType: string; content: string }
+  | { filename: string; contentType?: string; file: string }
+
 export interface TransactionalSendResponse {
   ok: true
   /** The channel the message was actually sent on */
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
   messageId?: string
+  /** Attachments that couldn't be made, and why (the email went without them) */
+  attachmentsLeftOut?: string[]
 }
 
 export interface TransactionalSendError {

package/dist/docs/bookings.md

@@ -361,11 +361,24 @@ wording.
   `hold_expired`, `slot.full` / `slot.place_freed`; `when.status` narrows to the booking's status at the
   time (`"pending"` for "request received").
 - `to`: `contact` — the booker, by their preferred channel (`channel` to force one; a template needs an
-  `sms` part to go by text); `team` — the collection's team addresses; `resource` — the booked
+  `sms` part to go by text); `team` — the collection's team addresses; an **address** (`"hello@bloom.com"`,
+  or a list of up to 10) — a particular inbox, written out: never built from what someone sent
+  (`{{ … }}` is refused), at most 200 a day per template; `resource` — the booked
   person or room: a resource that is a contact, or a record with `data.email` / `data.contactId`.
   A **public** resource record (a staff profile the booking page lists) keeps its address on a
   **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
   resource) — the platform looks there too, and the address never ships with the public listing.
+- Any step can also take `replyTo` — an address, or `"contact"` (replies go to the person the event is
+  about: a team notification answered straight to the booker) — and `cc` / `bcc` (written-out addresses,
+  same rules as `to`, counted in the same daily cap; over it the person still gets their email, without the
+  copies). A site's `cloud/email.json` (`{ "fromName", "replyTo" }`) sets the name the business's emails come
+  from and their default reply-to; the From address is the business's verified domain.
+- `attach` on a step adds files (at most 5, 10 MB in all): `"calendar"` — the booking as an `.ics` invite
+  that drops straight into the person's calendar (a cancelled booking's invite cancels it there);
+  `{ "asset": "<assetId>" }` — a file in the collection's assets (terms, a price list);
+  `{ "function": "<name>" }` — your app's own function makes it (a receipt PDF: server-functions.md,
+  "Making an email attachment"). E.g. `{ "send": "booking-confirmed", "to": "contact", "attach": ["calendar"] }`.
+  One that can't be made is left out; the email still goes.
 - Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
   `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
   `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
@@ -391,9 +404,14 @@ window (optionally with one resource), each hydrated with **their own** booking.
 await SL.bookings.message(collectionId, appId, { templateId, slotId })
 // Everyone booked with Sam next week, by email even if they prefer texts
 await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// Everyone on the class, each with their own calendar invite
+await SL.bookings.message(collectionId, appId, { templateId, slotId, attach: ['calendar'] })
 // → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
 ```
 
+`attach` takes the same files as `comms.sendTransactional` (comms.md, "Attachments"); `'calendar'` is
+each person's own booking.
+
 Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
 for more). One message per contact on a slot, one per booking in a window. Also
 `ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that

package/dist/docs/comms.md

@@ -56,6 +56,7 @@ if (result.ok) {
 | `include` | object | Hydration flags — see table below. |
 | `ref` | `string` | Arbitrary reference string stored with the event. |
 | `appId` | `string` | App identifier, used for context/logging. |
+| `attach` | `EmailAttachmentSpec[]` | Files on the email — see [Attachments](#attachments). |
 
 **`include` fields:**
 
@@ -73,12 +74,36 @@ if (result.ok) {
 
 ```typescript
 // Success
-{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string }
+{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string; attachmentsLeftOut?: string[] }
 
 // Failure
 { ok: false; error: string }
 ```
 
+### Attachments
+
+`attach` puts files on the email (email only — ignored when the send goes by text or push). At most 5
+files and 10 MB in all; PDF, Word / Excel / PowerPoint, images, text, CSV and calendar files.
+
+```typescript
+await comms.sendTransactional(collectionId, {
+  contactId, templateId: 'booking-confirmed', appId: 'appointment-booking',
+  include: { booking: bookingId },
+  attach: [
+    'calendar',                                   // the booking's .ics invite (needs include.booking + appId)
+    { asset: 'a1b2c3' },                          // a file uploaded to the collection's assets
+    { function: 'receiptPdf' },                   // the app's own server function makes it
+    { filename: 'Quote.pdf', contentType: 'application/pdf', content: base64 },  // a file you made
+    { filename: 'Report.pdf', file: signedUrl },  // a private file you made (pdf.create return: 'signedUrl')
+  ],
+})
+```
+
+A malformed list is refused (`transactional.attach_invalid`). A file that can't be made at send time
+(a missing asset, a function that fails) is left out and listed in `attachmentsLeftOut` — the email
+still goes. The request body is capped at 10 MB, so for big files make a private file and pass `file`.
+`bookings.message` takes the same `attach` (`'calendar'` is each person's own booking).
+
 ---
 
 ## Broadcasts
@@ -149,11 +174,12 @@ Consent resolution order (per recipient, per channel):
 3. `preferences._default.topics[topic]`
 4. Subject-specific preferences (when hydrating a subject context)
 
-Minimal broadcast data shape:
+Minimal broadcast data shape (`attach` is optional — uploaded assets only, the same files on every email):
 ```json
 {
   "data": {
     "topic": "newsletter",
+    "attach": [{ "asset": "a1b2c3" }],
     "channelSettings": {
       "mode": "preferred",
       "channels": [

package/dist/docs/server-functions.md

@@ -703,6 +703,35 @@ export async function printLabel(ctx, event) {
 - **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
   confirm the digits before answering.
 
+### Making an email attachment
+
+A flow step can attach a file your function makes: `"attach": [{ "function": "receiptPdf" }]` in a
+site's `cloud/flows.json` (or an app's blueprint). When the email goes, the platform calls your function
+(your app's, in this collection, as the collection, like a connector step) with:
+
+```ts
+event.body = { purpose: 'attachment', eventType, interactionId, outcome, contactId, metadata, booking? } // booking: ready-formatted
+```
+
+and attaches what it returns:
+
+```ts
+// capabilities: ["tools:pdf.create"]
+export async function receiptPdf(ctx, event) {
+  const b = event.body.booking
+  const pdf = await ctx.sl.tools.run('pdf.create', { format: 'A4', html: `<h1>Receipt</h1><p>${b.serviceName}, ${b.when.dateTime}</p>`, return: 'signedUrl' })
+  return { filename: `receipt-${b.id}.pdf`, file: pdf.url }          // a private file you made
+  // or { filename, contentType: 'application/pdf', content: '<base64>' }, a list of those, or null for none
+}
+```
+
+- Files: PDF, calendar (`.ics`), images, text / CSV and Office documents; at most 5 per email and 10 MB
+  in all. A private file must be one this platform made (`return: 'signedUrl'`), never an outside URL.
+- If your function fails or returns something else, the email still goes without it (the reason is in
+  your function's runs).
+- Other sources need no code: `"calendar"` (a booking event's calendar invite) and
+  `{ "asset": "<assetId>" }` (a file in the collection's assets) — see bookings.md, "Flows on booking events".
+
 ---
 
 ## Worked example — a public competition entry

package/dist/openapi.yaml

@@ -24805,6 +24805,11 @@ components:
             $ref: "#/components/schemas/BookingStatus"
         ref:
           type: string
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
       required:
         - templateId
     MessageBookersResult:
@@ -24999,6 +25004,11 @@ components:
           type: boolean
         priority:
           type: number
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
         createdAt:
           type: string
       required:
@@ -26130,6 +26140,10 @@ components:
           type: string
         appId:
           type: string
+        attach:
+          type: array
+          items:
+            $ref: "#/components/schemas/EmailAttachmentSpec"
       required:
         - contactId
         - templateId
@@ -26149,6 +26163,10 @@ components:
             - wallet
         messageId:
           type: string
+        attachmentsLeftOut:
+          type: array
+          items:
+            type: string
       required:
         - ok
         - channel
@@ -26172,6 +26190,9 @@ components:
       $ref: "#/components/schemas/CommsSettings"
     ConsentChannels:
       $ref: "#/components/schemas/BroadcastChannel"
+    EmailAttachmentSpec:
+      type: object
+      additionalProperties: true
     TransactionalSendResult:
       anyOf:
         - $ref: "#/components/schemas/TransactionalSendResponse"

package/dist/types/bookings.d.ts

@@ -283,6 +283,8 @@ export interface MessageBookersInput {
     /** Default: held, pending, confirmed. */
     statuses?: BookingStatus[];
     ref?: string;
+    /** Files on each email, as comms.sendTransactional — `'calendar'` is each person's own booking. */
+    attach?: import('./comms.js').EmailAttachmentSpec[];
 }
 export interface MessageBookersResult {
     matched: number;

package/dist/types/broadcasts.d.ts

@@ -34,6 +34,10 @@ export interface BroadcastRecord {
                 priority?: number;
             }>;
         };
+        /** Files on every email of the broadcast (at most 5, 10 MB in all): uploaded assets only. */
+        attach?: Array<{
+            asset: string;
+        }>;
         [key: string]: unknown;
     };
     createdAt: string;

package/dist/types/comms.d.ts

@@ -355,13 +355,41 @@ export interface TransactionalSendRequest {
     ref?: string;
     /** App context stored on the comms-events row */
     appId?: string;
+    /**
+     * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+     * `attachmentsLeftOut` — the email still goes.
+     */
+    attach?: EmailAttachmentSpec[];
 }
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec = 'calendar' | {
+    asset: string;
+} | {
+    function: string;
+} | {
+    filename: string;
+    contentType: string;
+    content: string;
+} | {
+    filename: string;
+    contentType?: string;
+    file: string;
+};
 export interface TransactionalSendResponse {
     ok: true;
     /** The channel the message was actually sent on */
     channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet';
     /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
     messageId?: string;
+    /** Attachments that couldn't be made, and why (the email went without them) */
+    attachmentsLeftOut?: string[];
 }
 export interface TransactionalSendError {
     ok: false;

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.5  |  Generated: 2026-10-30T13:51:55.292Z
+Version: 2.1.7  |  Generated: 2026-11-01T12:48:45.040Z
 
 This is a concise summary of all available API functions and types.
 
@@ -5402,6 +5402,7 @@ interface MessageBookersInput {
   resourceId?: string
   statuses?: BookingStatus[]
   ref?: string
+  attach?: import('./comms').EmailAttachmentSpec[]
 }
 ```
 
@@ -5512,6 +5513,7 @@ interface BroadcastRecord {
   priority?: number
   }>
   }
+  attach?: Array<{ asset: string }>
   [key: string]: unknown
   }
   createdAt: string
@@ -6242,6 +6244,7 @@ interface TransactionalSendRequest {
   }
   ref?: string
   appId?: string
+  attach?: EmailAttachmentSpec[]
 }
 ```
 
@@ -6251,6 +6254,7 @@ interface TransactionalSendResponse {
   ok: true
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   messageId?: string
+  attachmentsLeftOut?: string[]
 }
 ```
 
@@ -6270,6 +6274,8 @@ interface TransactionalSendError {
 
 **ConsentChannels** = `Partial<Record<BroadcastChannel, boolean>>`
 
+**EmailAttachmentSpec** = ``
+
 **TransactionalSendResult** = `// src/types/comms.ts
 // Communication and notification types for the Smartlinks API
 import type { IdField } from './common'
@@ -6595,14 +6601,36 @@ export interface TransactionalSendRequest {
   ref?: string
   /** App context stored on the comms-events row */
   appId?: string
+  /**
+   * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+   * `attachmentsLeftOut` — the email still goes.
+   */
+  attach?: EmailAttachmentSpec[]
 }
 
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec =
+  | 'calendar'
+  | { asset: string }
+  | { function: string }
+  | { filename: string; contentType: string; content: string }
+  | { filename: string; contentType?: string; file: string }
+
 export interface TransactionalSendResponse {
   ok: true
   /** The channel the message was actually sent on */
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
   messageId?: string
+  /** Attachments that couldn't be made, and why (the email went without them) */
+  attachmentsLeftOut?: string[]
 }
 
 export interface TransactionalSendError {

package/docs/bookings.md

@@ -361,11 +361,24 @@ wording.
   `hold_expired`, `slot.full` / `slot.place_freed`; `when.status` narrows to the booking's status at the
   time (`"pending"` for "request received").
 - `to`: `contact` — the booker, by their preferred channel (`channel` to force one; a template needs an
-  `sms` part to go by text); `team` — the collection's team addresses; `resource` — the booked
+  `sms` part to go by text); `team` — the collection's team addresses; an **address** (`"hello@bloom.com"`,
+  or a list of up to 10) — a particular inbox, written out: never built from what someone sent
+  (`{{ … }}` is refused), at most 200 a day per template; `resource` — the booked
   person or room: a resource that is a contact, or a record with `data.email` / `data.contactId`.
   A **public** resource record (a staff profile the booking page lists) keeps its address on a
   **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
   resource) — the platform looks there too, and the address never ships with the public listing.
+- Any step can also take `replyTo` — an address, or `"contact"` (replies go to the person the event is
+  about: a team notification answered straight to the booker) — and `cc` / `bcc` (written-out addresses,
+  same rules as `to`, counted in the same daily cap; over it the person still gets their email, without the
+  copies). A site's `cloud/email.json` (`{ "fromName", "replyTo" }`) sets the name the business's emails come
+  from and their default reply-to; the From address is the business's verified domain.
+- `attach` on a step adds files (at most 5, 10 MB in all): `"calendar"` — the booking as an `.ics` invite
+  that drops straight into the person's calendar (a cancelled booking's invite cancels it there);
+  `{ "asset": "<assetId>" }` — a file in the collection's assets (terms, a price list);
+  `{ "function": "<name>" }` — your app's own function makes it (a receipt PDF: server-functions.md,
+  "Making an email attachment"). E.g. `{ "send": "booking-confirmed", "to": "contact", "attach": ["calendar"] }`.
+  One that can't be made is left out; the email still goes.
 - Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
   `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
   `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
@@ -391,9 +404,14 @@ window (optionally with one resource), each hydrated with **their own** booking.
 await SL.bookings.message(collectionId, appId, { templateId, slotId })
 // Everyone booked with Sam next week, by email even if they prefer texts
 await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// Everyone on the class, each with their own calendar invite
+await SL.bookings.message(collectionId, appId, { templateId, slotId, attach: ['calendar'] })
 // → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
 ```
 
+`attach` takes the same files as `comms.sendTransactional` (comms.md, "Attachments"); `'calendar'` is
+each person's own booking.
+
 Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
 for more). One message per contact on a slot, one per booking in a window. Also
 `ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that

package/docs/comms.md

@@ -56,6 +56,7 @@ if (result.ok) {
 | `include` | object | Hydration flags — see table below. |
 | `ref` | `string` | Arbitrary reference string stored with the event. |
 | `appId` | `string` | App identifier, used for context/logging. |
+| `attach` | `EmailAttachmentSpec[]` | Files on the email — see [Attachments](#attachments). |
 
 **`include` fields:**
 
@@ -73,12 +74,36 @@ if (result.ok) {
 
 ```typescript
 // Success
-{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string }
+{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string; attachmentsLeftOut?: string[] }
 
 // Failure
 { ok: false; error: string }
 ```
 
+### Attachments
+
+`attach` puts files on the email (email only — ignored when the send goes by text or push). At most 5
+files and 10 MB in all; PDF, Word / Excel / PowerPoint, images, text, CSV and calendar files.
+
+```typescript
+await comms.sendTransactional(collectionId, {
+  contactId, templateId: 'booking-confirmed', appId: 'appointment-booking',
+  include: { booking: bookingId },
+  attach: [
+    'calendar',                                   // the booking's .ics invite (needs include.booking + appId)
+    { asset: 'a1b2c3' },                          // a file uploaded to the collection's assets
+    { function: 'receiptPdf' },                   // the app's own server function makes it
+    { filename: 'Quote.pdf', contentType: 'application/pdf', content: base64 },  // a file you made
+    { filename: 'Report.pdf', file: signedUrl },  // a private file you made (pdf.create return: 'signedUrl')
+  ],
+})
+```
+
+A malformed list is refused (`transactional.attach_invalid`). A file that can't be made at send time
+(a missing asset, a function that fails) is left out and listed in `attachmentsLeftOut` — the email
+still goes. The request body is capped at 10 MB, so for big files make a private file and pass `file`.
+`bookings.message` takes the same `attach` (`'calendar'` is each person's own booking).
+
 ---
 
 ## Broadcasts
@@ -149,11 +174,12 @@ Consent resolution order (per recipient, per channel):
 3. `preferences._default.topics[topic]`
 4. Subject-specific preferences (when hydrating a subject context)
 
-Minimal broadcast data shape:
+Minimal broadcast data shape (`attach` is optional — uploaded assets only, the same files on every email):
 ```json
 {
   "data": {
     "topic": "newsletter",
+    "attach": [{ "asset": "a1b2c3" }],
     "channelSettings": {
       "mode": "preferred",
       "channels": [

package/docs/server-functions.md

@@ -703,6 +703,35 @@ export async function printLabel(ctx, event) {
 - **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
   confirm the digits before answering.
 
+### Making an email attachment
+
+A flow step can attach a file your function makes: `"attach": [{ "function": "receiptPdf" }]` in a
+site's `cloud/flows.json` (or an app's blueprint). When the email goes, the platform calls your function
+(your app's, in this collection, as the collection, like a connector step) with:
+
+```ts
+event.body = { purpose: 'attachment', eventType, interactionId, outcome, contactId, metadata, booking? } // booking: ready-formatted
+```
+
+and attaches what it returns:
+
+```ts
+// capabilities: ["tools:pdf.create"]
+export async function receiptPdf(ctx, event) {
+  const b = event.body.booking
+  const pdf = await ctx.sl.tools.run('pdf.create', { format: 'A4', html: `<h1>Receipt</h1><p>${b.serviceName}, ${b.when.dateTime}</p>`, return: 'signedUrl' })
+  return { filename: `receipt-${b.id}.pdf`, file: pdf.url }          // a private file you made
+  // or { filename, contentType: 'application/pdf', content: '<base64>' }, a list of those, or null for none
+}
+```
+
+- Files: PDF, calendar (`.ics`), images, text / CSV and Office documents; at most 5 per email and 10 MB
+  in all. A private file must be one this platform made (`return: 'signedUrl'`), never an outside URL.
+- If your function fails or returns something else, the email still goes without it (the reason is in
+  your function's runs).
+- Other sources need no code: `"calendar"` (a booking event's calendar invite) and
+  `{ "asset": "<assetId>" }` (a file in the collection's assets) — see bookings.md, "Flows on booking events".
+
 ---
 
 ## Worked example — a public competition entry

package/openapi.yaml

@@ -24805,6 +24805,11 @@ components:
             $ref: "#/components/schemas/BookingStatus"
         ref:
           type: string
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
       required:
         - templateId
     MessageBookersResult:
@@ -24999,6 +25004,11 @@ components:
           type: boolean
         priority:
           type: number
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
         createdAt:
           type: string
       required:
@@ -26130,6 +26140,10 @@ components:
           type: string
         appId:
           type: string
+        attach:
+          type: array
+          items:
+            $ref: "#/components/schemas/EmailAttachmentSpec"
       required:
         - contactId
         - templateId
@@ -26149,6 +26163,10 @@ components:
             - wallet
         messageId:
           type: string
+        attachmentsLeftOut:
+          type: array
+          items:
+            type: string
       required:
         - ok
         - channel
@@ -26172,6 +26190,9 @@ components:
       $ref: "#/components/schemas/CommsSettings"
     ConsentChannels:
       $ref: "#/components/schemas/BroadcastChannel"
+    EmailAttachmentSpec:
+      type: object
+      additionalProperties: true
     TransactionalSendResult:
       anyOf:
         - $ref: "#/components/schemas/TransactionalSendResponse"

package/package.json

@@ -1,87 +1,87 @@
-{
-  "name": "@proveanything/smartlinks",
-  "version": "2.1.5",
-  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    },
-    "./testing": {
-      "types": "./dist/testing/index.d.ts",
-      "import": "./dist/testing/index.js",
-      "default": "./dist/testing/index.js"
-    },
-    "./*": {
-      "types": "./dist/*.d.ts",
-      "import": "./dist/*.js",
-      "default": "./dist/*.js"
-    },
-    "./baseline.css": "./dist/baseline.css",
-    "./baseline.classes.json": "./dist/baseline.classes.json",
-    "./theme.css": "./dist/theme.css",
-    "./theme-boot.js": "./dist/theme-boot.js",
-    "./package.json": "./package.json"
-  },
-  "bin": {
-    "smartlinks-register-release": "scripts/register-release.mjs",
-    "smartlinks-publish": "scripts/publish.mjs",
-    "smartlinks-doctor": "scripts/doctor.mjs",
-    "smartlinks-headless": "scripts/headless-check.mjs"
-  },
-  "files": [
-    "dist/",
-    "docs/",
-    "scripts/register-release.mjs",
-    "scripts/publish.mjs",
-    "scripts/doctor.mjs",
-    "scripts/headless-check.mjs",
-    "scripts/lib/",
-    "openapi.yaml",
-    "README.md"
-  ],
-  "scripts": {
-    "test": "node test/run.cjs",
-    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
-    "docs": "typedoc",
-    "docs:summary": "node generate-api-summary.cjs",
-    "docs:openapi": "node generate-openapi.cjs",
-    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
-    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
-    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "smartlinks",
-    "api",
-    "authentication",
-    "traceability",
-    "blockchain",
-    "typescript",
-    "sdk"
-  ],
-  "author": "Glenn Shoosmith",
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "cross-fetch": "^3.1.5",
-    "es-module-lexer": "^1.7.0"
-  },
-  "devDependencies": {
-    "ts-node": "^10.9.1",
-    "typedoc": "^0.25.13",
-    "typedoc-plugin-markdown": "^3.17.1",
-    "typescript": "^4.9.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/Prove-Anything/smartlinks.git"
-  },
-  "homepage": "https://smartlinks.app"
-}
+{
+  "name": "@proveanything/smartlinks",
+  "version": "2.1.7",
+  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js",
+      "default": "./dist/testing/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
+    },
+    "./baseline.css": "./dist/baseline.css",
+    "./baseline.classes.json": "./dist/baseline.classes.json",
+    "./theme.css": "./dist/theme.css",
+    "./theme-boot.js": "./dist/theme-boot.js",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "smartlinks-register-release": "scripts/register-release.mjs",
+    "smartlinks-publish": "scripts/publish.mjs",
+    "smartlinks-doctor": "scripts/doctor.mjs",
+    "smartlinks-headless": "scripts/headless-check.mjs"
+  },
+  "files": [
+    "dist/",
+    "docs/",
+    "scripts/register-release.mjs",
+    "scripts/publish.mjs",
+    "scripts/doctor.mjs",
+    "scripts/headless-check.mjs",
+    "scripts/lib/",
+    "openapi.yaml",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node test/run.cjs",
+    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
+    "docs": "typedoc",
+    "docs:summary": "node generate-api-summary.cjs",
+    "docs:openapi": "node generate-openapi.cjs",
+    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
+    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
+    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "smartlinks",
+    "api",
+    "authentication",
+    "traceability",
+    "blockchain",
+    "typescript",
+    "sdk"
+  ],
+  "author": "Glenn Shoosmith",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "cross-fetch": "^3.1.5",
+    "es-module-lexer": "^1.7.0"
+  },
+  "devDependencies": {
+    "ts-node": "^10.9.1",
+    "typedoc": "^0.25.13",
+    "typedoc-plugin-markdown": "^3.17.1",
+    "typescript": "^4.9.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Prove-Anything/smartlinks.git"
+  },
+  "homepage": "https://smartlinks.app"
+}