@proveanything/smartlinks 2.1.6 → 2.1.8

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.6  |  Generated: 2026-10-31T10:38:17.995Z
+Version: 2.1.8  |  Generated: 2026-11-02T13:05:01.425Z
 
 This is a concise summary of all available API functions and types.
 
@@ -5402,6 +5402,7 @@ interface MessageBookersInput {
   resourceId?: string
   statuses?: BookingStatus[]
   ref?: string
+  attach?: import('./comms').EmailAttachmentSpec[]
 }
 ```
 
@@ -5512,6 +5513,7 @@ interface BroadcastRecord {
   priority?: number
   }>
   }
+  attach?: Array<{ asset: string }>
   [key: string]: unknown
   }
   createdAt: string
@@ -6242,6 +6244,7 @@ interface TransactionalSendRequest {
   }
   ref?: string
   appId?: string
+  attach?: EmailAttachmentSpec[]
 }
 ```
 
@@ -6251,6 +6254,7 @@ interface TransactionalSendResponse {
   ok: true
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   messageId?: string
+  attachmentsLeftOut?: string[]
 }
 ```
 
@@ -6270,6 +6274,8 @@ interface TransactionalSendError {
 
 **ConsentChannels** = `Partial<Record<BroadcastChannel, boolean>>`
 
+**EmailAttachmentSpec** = ``
+
 **TransactionalSendResult** = `// src/types/comms.ts
 // Communication and notification types for the Smartlinks API
 import type { IdField } from './common'
@@ -6595,14 +6601,36 @@ export interface TransactionalSendRequest {
   ref?: string
   /** App context stored on the comms-events row */
   appId?: string
+  /**
+   * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+   * `attachmentsLeftOut` — the email still goes.
+   */
+  attach?: EmailAttachmentSpec[]
 }
 
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec =
+  | 'calendar'
+  | { asset: string }
+  | { function: string }
+  | { filename: string; contentType: string; content: string }
+  | { filename: string; contentType?: string; file: string }
+
 export interface TransactionalSendResponse {
   ok: true
   /** The channel the message was actually sent on */
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
   messageId?: string
+  /** Attachments that couldn't be made, and why (the email went without them) */
+  attachmentsLeftOut?: string[]
 }
 
 export interface TransactionalSendError {
@@ -7511,6 +7539,7 @@ interface IframeResponderOptions {
   ) => Promise<void>;
   onAuthLogout?: () => Promise<void>;
   onRouteChange?: (path: string, state: Record<string, string>) => void;
+  autoHeight?: boolean | { minHeight?: number };
   onResize?: (height: number) => void;
   onError?: (error: Error) => void;
   onReady?: () => void;

package/dist/docs/bookings.md

@@ -368,6 +368,17 @@ wording.
   A **public** resource record (a staff profile the booking page lists) keeps its address on a
   **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
   resource) — the platform looks there too, and the address never ships with the public listing.
+- Any step can also take `replyTo` — an address, or `"contact"` (replies go to the person the event is
+  about: a team notification answered straight to the booker) — and `cc` / `bcc` (written-out addresses,
+  same rules as `to`, counted in the same daily cap; over it the person still gets their email, without the
+  copies). A site's `cloud/email.json` (`{ "fromName", "replyTo" }`) sets the name the business's emails come
+  from and their default reply-to; the From address is the business's verified domain.
+- `attach` on a step adds files (at most 5, 10 MB in all): `"calendar"` — the booking as an `.ics` invite
+  that drops straight into the person's calendar (a cancelled booking's invite cancels it there);
+  `{ "asset": "<assetId>" }` — a file in the collection's assets (terms, a price list);
+  `{ "function": "<name>" }` — your app's own function makes it (a receipt PDF: server-functions.md,
+  "Making an email attachment"). E.g. `{ "send": "booking-confirmed", "to": "contact", "attach": ["calendar"] }`.
+  One that can't be made is left out; the email still goes.
 - Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
   `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
   `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
@@ -393,9 +404,14 @@ window (optionally with one resource), each hydrated with **their own** booking.
 await SL.bookings.message(collectionId, appId, { templateId, slotId })
 // Everyone booked with Sam next week, by email even if they prefer texts
 await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// Everyone on the class, each with their own calendar invite
+await SL.bookings.message(collectionId, appId, { templateId, slotId, attach: ['calendar'] })
 // → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
 ```
 
+`attach` takes the same files as `comms.sendTransactional` (comms.md, "Attachments"); `'calendar'` is
+each person's own booking.
+
 Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
 for more). One message per contact on a slot, one per booking in a window. Also
 `ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that

package/dist/docs/comms.md

@@ -56,6 +56,7 @@ if (result.ok) {
 | `include` | object | Hydration flags — see table below. |
 | `ref` | `string` | Arbitrary reference string stored with the event. |
 | `appId` | `string` | App identifier, used for context/logging. |
+| `attach` | `EmailAttachmentSpec[]` | Files on the email — see [Attachments](#attachments). |
 
 **`include` fields:**
 
@@ -73,12 +74,36 @@ if (result.ok) {
 
 ```typescript
 // Success
-{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string }
+{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string; attachmentsLeftOut?: string[] }
 
 // Failure
 { ok: false; error: string }
 ```
 
+### Attachments
+
+`attach` puts files on the email (email only — ignored when the send goes by text or push). At most 5
+files and 10 MB in all; PDF, Word / Excel / PowerPoint, images, text, CSV and calendar files.
+
+```typescript
+await comms.sendTransactional(collectionId, {
+  contactId, templateId: 'booking-confirmed', appId: 'appointment-booking',
+  include: { booking: bookingId },
+  attach: [
+    'calendar',                                   // the booking's .ics invite (needs include.booking + appId)
+    { asset: 'a1b2c3' },                          // a file uploaded to the collection's assets
+    { function: 'receiptPdf' },                   // the app's own server function makes it
+    { filename: 'Quote.pdf', contentType: 'application/pdf', content: base64 },  // a file you made
+    { filename: 'Report.pdf', file: signedUrl },  // a private file you made (pdf.create return: 'signedUrl')
+  ],
+})
+```
+
+A malformed list is refused (`transactional.attach_invalid`). A file that can't be made at send time
+(a missing asset, a function that fails) is left out and listed in `attachmentsLeftOut` — the email
+still goes. The request body is capped at 10 MB, so for big files make a private file and pass `file`.
+`bookings.message` takes the same `attach` (`'calendar'` is each person's own booking).
+
 ---
 
 ## Broadcasts
@@ -149,11 +174,12 @@ Consent resolution order (per recipient, per channel):
 3. `preferences._default.topics[topic]`
 4. Subject-specific preferences (when hydrating a subject context)
 
-Minimal broadcast data shape:
+Minimal broadcast data shape (`attach` is optional — uploaded assets only, the same files on every email):
 ```json
 {
   "data": {
     "topic": "newsletter",
+    "attach": [{ "asset": "a1b2c3" }],
     "channelSettings": {
       "mode": "preferred",
       "channels": [

package/dist/docs/iframe-responder.md

@@ -35,10 +35,8 @@ const responder = new smartlinks.IframeResponder({
     smartlinks.setBearerToken(token);
     console.log('User logged in:', user);
   },
-  onResize: (height) => {
-    // Update iframe height
-    iframeElement.style.height = `${height}px`;
-  },
+  // An app in a page: the iframe is as tall as the app's content — the page scrolls, never the iframe.
+  autoHeight: { minHeight: 480 },
 });
 
 // Attach to iframe element
@@ -115,9 +113,24 @@ interface IframeResponderOptions {
   onResize?: (height: number) => void;
   onError?: (error: Error) => void;
   onReady?: () => void;
+
+  // Height
+  autoHeight?: boolean | { minHeight?: number }; // size the iframe to the app's content (an app in a page)
 }
 ```
 
+**Height: `autoHeight` or `onResize`.**
+
+- **`autoHeight`** — for an app placed in a page (a website, a section of a dashboard). The responder sets
+  the iframe's height from the height the app reports, adds the iframe's own border and padding (an
+  element with `box-sizing: border-box`, Tailwind's default, otherwise ends up short by its border — a
+  pointless scrollbar), and never uses the window-filling height. The iframe's own scrolling stays on as a
+  fallback for an app on an older SDK that under-reports its height. `minHeight`
+  is the least height it gives. `onResize` still hears each content height.
+- **`onResize`** without `autoHeight` — for a full-screen host that sizes the iframe itself. It receives
+  the app's content height whenever the app reports one, **and** on every window resize the window's
+  height below the iframe's container.
+
 ## Advanced Examples
 
 ### Deep Linking / Route Synchronization
@@ -175,6 +188,8 @@ const responder = new smartlinks.IframeResponder({
 
 ### Responsive Height Management
 
+An app in a page: `autoHeight` (above) does it all. A full-screen host that manages the height itself:
+
 ```typescript
 const responder = new smartlinks.IframeResponder({
   collectionId: 'acme-wines',
@@ -442,7 +457,7 @@ import type {
 3. **Clean up** responder with `destroy()` when unmounting
 4. **Use version control** to test against development versions
 5. **Validate tokens** server-side for security
-6. **Set height dynamically** based on content using `onResize`
+6. **Size the iframe to its content** with `autoHeight` (an app in a page) or `onResize` (a full-screen host)
 7. **Sync routes** with parent navigation for better UX
 8. **Set `parentPath`** for routes that have a meaningful parent screen in the app hierarchy
 
@@ -458,8 +473,9 @@ import type {
 - Verify token is being set with `setBearerToken()`
 - Check that auth messages are being received
 
-### Height not updating
-- Implement `onResize` callback
+### Height not updating, or a scrollbar inside the iframe
+- An app in a page: use `autoHeight` instead of setting the height yourself
+- A full-screen host: implement the `onResize` callback
 - Ensure iframe has CSS styling for height changes
 - Check that iframe is sending resize messages
 

package/dist/docs/server-functions.md

@@ -703,6 +703,35 @@ export async function printLabel(ctx, event) {
 - **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
   confirm the digits before answering.
 
+### Making an email attachment
+
+A flow step can attach a file your function makes: `"attach": [{ "function": "receiptPdf" }]` in a
+site's `cloud/flows.json` (or an app's blueprint). When the email goes, the platform calls your function
+(your app's, in this collection, as the collection, like a connector step) with:
+
+```ts
+event.body = { purpose: 'attachment', eventType, interactionId, outcome, contactId, metadata, booking? } // booking: ready-formatted
+```
+
+and attaches what it returns:
+
+```ts
+// capabilities: ["tools:pdf.create"]
+export async function receiptPdf(ctx, event) {
+  const b = event.body.booking
+  const pdf = await ctx.sl.tools.run('pdf.create', { format: 'A4', html: `<h1>Receipt</h1><p>${b.serviceName}, ${b.when.dateTime}</p>`, return: 'signedUrl' })
+  return { filename: `receipt-${b.id}.pdf`, file: pdf.url }          // a private file you made
+  // or { filename, contentType: 'application/pdf', content: '<base64>' }, a list of those, or null for none
+}
+```
+
+- Files: PDF, calendar (`.ics`), images, text / CSV and Office documents; at most 5 per email and 10 MB
+  in all. A private file must be one this platform made (`return: 'signedUrl'`), never an outside URL.
+- If your function fails or returns something else, the email still goes without it (the reason is in
+  your function's runs).
+- Other sources need no code: `"calendar"` (a booking event's calendar invite) and
+  `{ "asset": "<assetId>" }` (a file in the collection's assets) — see bookings.md, "Flows on booking events".
+
 ---
 
 ## Worked example — a public competition entry

package/dist/docs/websites.md

@@ -80,11 +80,17 @@ const responder = new SL.IframeResponder({
   appId: 'appointments',            // the app's id on this collection
   initialPath: '/my-bookings',      // the page's `path`
   params: { service: 'svc_123' },   // what the page `accepts`
-  onResize: (h) => { iframe.style.height = `${h}px` },
+  autoHeight: { minHeight: 480 },   // the iframe is as tall as the page: your page scrolls, never the iframe
 })
 iframe.src = await responder.attach(iframe)
 ```
 
+- **Size it with `autoHeight`, not by hand.** The responder sets the iframe's height from the page's own
+  height and counts the iframe's border and padding, so there's nothing left to scroll. Setting
+  `iframe.style.height` from `onResize` yourself goes wrong in a site: `onResize` also fires on every
+  window resize with "the window below the iframe" (for a full-screen host), and a bordered iframe
+  (Tailwind's border-box) ends up a few pixels short — a scrollbar inside the frame.
+
 - **The visitor's session goes with it.** The page's API calls are proxied through the site, so it
   acts as whoever is signed in to the site (or as a guest). Never pass a token in the URL.
 - **The app must be installed** on the site's collection; its address comes from there.

package/dist/iframe.js

@@ -36,16 +36,29 @@ export var iframe;
     function sendHeight(height, extra) {
         if (!inIframe())
             return;
-        const h = height !== null && height !== void 0 ? height : document.documentElement.scrollHeight;
+        const h = height !== null && height !== void 0 ? height : measureHeight();
         postParentMessage((resizeOptions === null || resizeOptions === void 0 ? void 0 : resizeOptions.messageType) || 'smartlinks:resize', Object.assign(Object.assign({ height: h }, resizeOptions === null || resizeOptions === void 0 ? void 0 : resizeOptions.extra), extra));
     }
     iframe.sendHeight = sendHeight;
+    /**
+     * The page's own height — not the frame's. scrollHeight and clientHeight are never less than the iframe's
+     * viewport, so a page that got shorter (a step done, a list emptied) was still reported at the frame's old
+     * height and the frame never shrank. When the page overflows the frame, its scrollHeight is the real
+     * height (absolutely positioned content included); when it fits, the document's own box is.
+     */
     function measureHeight() {
         if (!isBrowser())
             return 0;
         const doc = document.documentElement;
-        // Use max of several properties for robustness
-        return Math.max(doc.scrollHeight, doc.offsetHeight, doc.clientHeight, document.body ? document.body.scrollHeight : 0, document.body ? document.body.offsetHeight : 0);
+        if (doc.scrollHeight > doc.clientHeight + 1)
+            return doc.scrollHeight;
+        const body = document.body;
+        let bodyHeight = 0;
+        if (body) {
+            const cs = window.getComputedStyle(body);
+            bodyHeight = body.offsetHeight + (parseFloat(cs.marginTop) || 0) + (parseFloat(cs.marginBottom) || 0);
+        }
+        return Math.ceil(Math.max(doc.offsetHeight, bodyHeight));
     }
     function scheduleManualPolling() {
         var _a;
@@ -61,33 +74,63 @@ export var iframe;
             }
         }, interval);
     }
+    let measureQueued = false;
+    /**
+     * Measure once, a moment after a burst of changes, however many asked for it. A timer, not
+     * requestAnimationFrame: frames are paused in a hidden page and in an off-screen cross-origin iframe (an
+     * app below the fold), so the height wasn't reported until it was scrolled into view; timers only slow down.
+     */
+    function queueMeasure() {
+        if (measureQueued || !isBrowser())
+            return;
+        measureQueued = true;
+        const run = () => {
+            measureQueued = false;
+            if (!resizeOptions)
+                return;
+            const h = measureHeight();
+            if (resizeOptions.alwaysSend || h !== lastHeight) {
+                lastHeight = h;
+                sendHeight(h);
+            }
+        };
+        setTimeout(run, 30);
+    }
+    let lastWidth = 0;
+    /** The frame got wider or narrower: the page reflows. (Its height is ours to set — not a reason.) */
+    function onWindowResize() {
+        if (window.innerWidth === lastWidth)
+            return;
+        lastWidth = window.innerWidth;
+        queueMeasure();
+    }
+    const CONTENT_EVENTS = ['load', 'transitionend', 'animationend'];
+    /**
+     * Re-measure when something that changes the page's height happens: its content (any DOM change — a step
+     * rendered, times loaded), an image or font arriving, a transition or animation ending, the frame's width.
+     * Never the frame's own height: an app held at the frame's height (html/body/root at 100%, a 100vh
+     * wrapper — common in app templates) changes size whenever the host resizes the frame, so watching it
+     * re-measured after every resize and, with a few px beyond 100vh, grew the frame step by step. Content
+     * growing INSIDE such a pinned body never resized it either, so it was never reported (the booking app
+     * said "700" once while loading and nothing after).
+     */
     function setupObservers() {
         if (!isBrowser())
             return;
-        // Prefer ResizeObserver for layout changes
-        if (typeof ResizeObserver !== 'undefined') {
-            resizeObserver = new ResizeObserver(() => {
-                const h = measureHeight();
-                if ((resizeOptions === null || resizeOptions === void 0 ? void 0 : resizeOptions.alwaysSend) || h !== lastHeight) {
-                    lastHeight = h;
-                    sendHeight(h);
-                }
-            });
-            resizeObserver.observe(document.body);
+        if (typeof MutationObserver !== 'undefined') {
+            mutationObserver = new MutationObserver(queueMeasure);
+            mutationObserver.observe(document.documentElement, { childList: true, subtree: true, attributes: true, characterData: true });
         }
         else {
-            // Fallback: MutationObserver for DOM changes
-            mutationObserver = new MutationObserver(() => {
-                const h = measureHeight();
-                if ((resizeOptions === null || resizeOptions === void 0 ? void 0 : resizeOptions.alwaysSend) || h !== lastHeight) {
-                    lastHeight = h;
-                    sendHeight(h);
-                }
-            });
-            mutationObserver.observe(document.body, { childList: true, subtree: true, attributes: true });
-            // Manual polling as additional safeguard
             scheduleManualPolling();
         }
+        for (const e of CONTENT_EVENTS)
+            document.addEventListener(e, queueMeasure, true);
+        const fonts = document.fonts;
+        if (fonts && typeof fonts.addEventListener === 'function')
+            fonts.addEventListener('loadingdone', queueMeasure);
+        lastWidth = window.innerWidth;
+        window.addEventListener('resize', onWindowResize);
     }
     /** Enable automatic height reporting to parent iframe. */
     function enableAutoIframeResize(options) {
@@ -97,10 +140,6 @@ export var iframe;
         lastHeight = measureHeight();
         sendHeight(lastHeight);
         setupObservers();
-        if (!resizeObserver) {
-            // If no ResizeObserver, MutationObserver is active and we also poll
-            scheduleManualPolling();
-        }
     }
     iframe.enableAutoIframeResize = enableAutoIframeResize;
     /** Disable automatic height reporting. */
@@ -109,8 +148,15 @@ export var iframe;
             resizeObserver.disconnect();
         if (mutationObserver)
             mutationObserver.disconnect();
-        if (isBrowser())
+        if (isBrowser()) {
+            for (const e of CONTENT_EVENTS)
+                document.removeEventListener(e, queueMeasure, true);
+            const fonts = document.fonts;
+            if (fonts && typeof fonts.removeEventListener === 'function')
+                fonts.removeEventListener('loadingdone', queueMeasure);
+            window.removeEventListener('resize', onWindowResize);
             clearInterval(autoResizeTimer);
+        }
         resizeObserver = undefined;
         mutationObserver = undefined;
         autoResizeTimer = undefined;

package/dist/iframeResponder.d.ts

@@ -61,6 +61,12 @@ export declare class IframeResponder {
     private resolveAppUrl;
     private getVersionUrl;
     private buildIframeSrc;
+    /**
+     * autoHeight: the iframe exactly as tall as the app's content. The height set on an element with
+     * box-sizing: border-box (Tailwind's default) includes its border and padding, so those are added — a
+     * 1px border otherwise left the page 2px short and the iframe showed a pointless scrollbar.
+     */
+    private applyContentHeight;
     private calculateViewportHeight;
     private handleMessage;
     private handleRouteChange;

package/dist/iframeResponder.js

@@ -77,10 +77,15 @@ export class IframeResponder {
         // Set up message listener
         this.messageHandler = this.handleMessage.bind(this);
         window.addEventListener('message', this.messageHandler);
-        // Set up resize listener for viewport-based calculations
-        this.resizeHandler = this.calculateViewportHeight.bind(this);
-        window.addEventListener('resize', this.resizeHandler);
-        window.addEventListener('orientationchange', this.resizeHandler);
+        // autoHeight: sized to the app's content, so the iframe has nothing to scroll. Its own scrolling is
+        // left on: an app on an older SDK may still under-report its height, and a scrollbar beats content
+        // cut off.
+        if (!this.options.autoHeight) {
+            // Set up resize listener for viewport-based calculations (a full-screen host)
+            this.resizeHandler = this.calculateViewportHeight.bind(this);
+            window.addEventListener('resize', this.resizeHandler);
+            window.addEventListener('orientationchange', this.resizeHandler);
+        }
         const src = this.buildIframeSrc();
         return src;
     }
@@ -239,6 +244,30 @@ export class IframeResponder {
     // ===========================================================================
     // Viewport Resize Calculation
     // ===========================================================================
+    /**
+     * autoHeight: the iframe exactly as tall as the app's content. The height set on an element with
+     * box-sizing: border-box (Tailwind's default) includes its border and padding, so those are added — a
+     * 1px border otherwise left the page 2px short and the iframe showed a pointless scrollbar.
+     */
+    applyContentHeight(contentHeight) {
+        var _a;
+        const iframe = this.iframe;
+        if (!iframe)
+            return;
+        const min = typeof this.options.autoHeight === 'object' ? (_a = this.options.autoHeight.minHeight) !== null && _a !== void 0 ? _a : 0 : 0;
+        let extra = 0;
+        try {
+            const cs = window.getComputedStyle(iframe);
+            if (cs.boxSizing === 'border-box') {
+                extra = ['borderTopWidth', 'borderBottomWidth', 'paddingTop', 'paddingBottom']
+                    .reduce((n, k) => n + (parseFloat(cs[k]) || 0), 0);
+            }
+        }
+        catch (_b) {
+            /* no computed style (not in a document): the content height as it is */
+        }
+        iframe.style.height = `${Math.ceil(Math.max(min, contentHeight + extra))}px`;
+    }
     calculateViewportHeight() {
         var _a, _b;
         if (!this.iframe)
@@ -332,6 +361,8 @@ export class IframeResponder {
             case 'smartlinks:resize': {
                 const contentHeight = (_a = data.payload) === null || _a === void 0 ? void 0 : _a.height;
                 if (typeof contentHeight === 'number' && contentHeight > 0) {
+                    if (this.options.autoHeight)
+                        this.applyContentHeight(contentHeight);
                     (_c = (_b = this.options).onResize) === null || _c === void 0 ? void 0 : _c.call(_b, contentHeight);
                 }
                 break;

package/dist/openapi.yaml

@@ -24805,6 +24805,11 @@ components:
             $ref: "#/components/schemas/BookingStatus"
         ref:
           type: string
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
       required:
         - templateId
     MessageBookersResult:
@@ -24999,6 +25004,11 @@ components:
           type: boolean
         priority:
           type: number
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
         createdAt:
           type: string
       required:
@@ -26130,6 +26140,10 @@ components:
           type: string
         appId:
           type: string
+        attach:
+          type: array
+          items:
+            $ref: "#/components/schemas/EmailAttachmentSpec"
       required:
         - contactId
         - templateId
@@ -26149,6 +26163,10 @@ components:
             - wallet
         messageId:
           type: string
+        attachmentsLeftOut:
+          type: array
+          items:
+            type: string
       required:
         - ok
         - channel
@@ -26172,6 +26190,9 @@ components:
       $ref: "#/components/schemas/CommsSettings"
     ConsentChannels:
       $ref: "#/components/schemas/BroadcastChannel"
+    EmailAttachmentSpec:
+      type: object
+      additionalProperties: true
     TransactionalSendResult:
       anyOf:
         - $ref: "#/components/schemas/TransactionalSendResponse"
@@ -27708,6 +27729,9 @@ components:
         accountData:
           type: object
           additionalProperties: true
+        autoHeight:
+          type: object
+          additionalProperties: true
       required:
         - collectionId
         - appId

package/dist/types/bookings.d.ts

@@ -283,6 +283,8 @@ export interface MessageBookersInput {
     /** Default: held, pending, confirmed. */
     statuses?: BookingStatus[];
     ref?: string;
+    /** Files on each email, as comms.sendTransactional — `'calendar'` is each person's own booking. */
+    attach?: import('./comms.js').EmailAttachmentSpec[];
 }
 export interface MessageBookersResult {
     matched: number;

package/dist/types/broadcasts.d.ts

@@ -34,6 +34,10 @@ export interface BroadcastRecord {
                 priority?: number;
             }>;
         };
+        /** Files on every email of the broadcast (at most 5, 10 MB in all): uploaded assets only. */
+        attach?: Array<{
+            asset: string;
+        }>;
         [key: string]: unknown;
     };
     createdAt: string;

package/dist/types/comms.d.ts

@@ -355,13 +355,41 @@ export interface TransactionalSendRequest {
     ref?: string;
     /** App context stored on the comms-events row */
     appId?: string;
+    /**
+     * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+     * `attachmentsLeftOut` — the email still goes.
+     */
+    attach?: EmailAttachmentSpec[];
 }
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec = 'calendar' | {
+    asset: string;
+} | {
+    function: string;
+} | {
+    filename: string;
+    contentType: string;
+    content: string;
+} | {
+    filename: string;
+    contentType?: string;
+    file: string;
+};
 export interface TransactionalSendResponse {
     ok: true;
     /** The channel the message was actually sent on */
     channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet';
     /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
     messageId?: string;
+    /** Attachments that couldn't be made, and why (the email went without them) */
+    attachmentsLeftOut?: string[];
 }
 export interface TransactionalSendError {
     ok: false;

package/dist/types/iframeResponder.d.ts

@@ -36,6 +36,21 @@ export interface IframeResponderOptions {
     onAuthLogin?: (token: string, user: any, accountData?: Record<string, any>) => Promise<void>;
     onAuthLogout?: () => Promise<void>;
     onRouteChange?: (path: string, state: Record<string, string>) => void;
+    /**
+     * Size the iframe to the app's content, for an app placed in a page (a booking form in a website, a
+     * widget in a section): the page scrolls, never the iframe. The responder sets the iframe's height from
+     * the height the app reports, adding the iframe's own border and padding, and never uses the
+     * window-filling height. `minHeight`: the least height (px) it's given.
+     * Leave off for a full-screen host, which sizes the iframe itself from `onResize`.
+     */
+    autoHeight?: boolean | {
+        minHeight?: number;
+    };
+    /**
+     * A height for the iframe: the app's content height whenever the app reports one, and — unless
+     * `autoHeight` is on — the window's height below the iframe's container on every window resize (for a
+     * full-screen host). A page that embeds an app should use `autoHeight` instead.
+     */
     onResize?: (height: number) => void;
     onError?: (error: Error) => void;
     onReady?: () => void;

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.1.6  |  Generated: 2026-10-31T10:38:17.995Z
+Version: 2.1.8  |  Generated: 2026-11-02T13:05:01.425Z
 
 This is a concise summary of all available API functions and types.
 
@@ -5402,6 +5402,7 @@ interface MessageBookersInput {
   resourceId?: string
   statuses?: BookingStatus[]
   ref?: string
+  attach?: import('./comms').EmailAttachmentSpec[]
 }
 ```
 
@@ -5512,6 +5513,7 @@ interface BroadcastRecord {
   priority?: number
   }>
   }
+  attach?: Array<{ asset: string }>
   [key: string]: unknown
   }
   createdAt: string
@@ -6242,6 +6244,7 @@ interface TransactionalSendRequest {
   }
   ref?: string
   appId?: string
+  attach?: EmailAttachmentSpec[]
 }
 ```
 
@@ -6251,6 +6254,7 @@ interface TransactionalSendResponse {
   ok: true
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   messageId?: string
+  attachmentsLeftOut?: string[]
 }
 ```
 
@@ -6270,6 +6274,8 @@ interface TransactionalSendError {
 
 **ConsentChannels** = `Partial<Record<BroadcastChannel, boolean>>`
 
+**EmailAttachmentSpec** = ``
+
 **TransactionalSendResult** = `// src/types/comms.ts
 // Communication and notification types for the Smartlinks API
 import type { IdField } from './common'
@@ -6595,14 +6601,36 @@ export interface TransactionalSendRequest {
   ref?: string
   /** App context stored on the comms-events row */
   appId?: string
+  /**
+   * Files to attach (email only; at most 5, 10 MB in all). What can't be made is left out and listed in
+   * `attachmentsLeftOut` — the email still goes.
+   */
+  attach?: EmailAttachmentSpec[]
 }
 
+/**
+ * One file for an email:
+ * - `'calendar'` — the booking's `.ics` calendar invite (needs `include.booking` and `appId`)
+ * - `{ asset }` — a file uploaded to this collection's assets
+ * - `{ function }` — the app's (`appId`) own server function makes it (see server-functions.md, "Making an email attachment")
+ * - `{ filename, contentType, content }` — a file you made, base64 (PDF, Office documents, images, text, CSV, calendar)
+ * - `{ filename, file }` — a private file you made (e.g. `pdf.create` with `return: 'signedUrl'`)
+ */
+export type EmailAttachmentSpec =
+  | 'calendar'
+  | { asset: string }
+  | { function: string }
+  | { filename: string; contentType: string; content: string }
+  | { filename: string; contentType?: string; file: string }
+
 export interface TransactionalSendResponse {
   ok: true
   /** The channel the message was actually sent on */
   channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'
   /** Provider message ID (email/SMS/WhatsApp); absent for push/wallet */
   messageId?: string
+  /** Attachments that couldn't be made, and why (the email went without them) */
+  attachmentsLeftOut?: string[]
 }
 
 export interface TransactionalSendError {
@@ -7511,6 +7539,7 @@ interface IframeResponderOptions {
   ) => Promise<void>;
   onAuthLogout?: () => Promise<void>;
   onRouteChange?: (path: string, state: Record<string, string>) => void;
+  autoHeight?: boolean | { minHeight?: number };
   onResize?: (height: number) => void;
   onError?: (error: Error) => void;
   onReady?: () => void;

package/docs/bookings.md

@@ -368,6 +368,17 @@ wording.
   A **public** resource record (a staff profile the booking page lists) keeps its address on a
   **private child record** instead (`visibility: 'admin'`, `parentType: 'record'`, `parentId` = the
   resource) — the platform looks there too, and the address never ships with the public listing.
+- Any step can also take `replyTo` — an address, or `"contact"` (replies go to the person the event is
+  about: a team notification answered straight to the booker) — and `cc` / `bcc` (written-out addresses,
+  same rules as `to`, counted in the same daily cap; over it the person still gets their email, without the
+  copies). A site's `cloud/email.json` (`{ "fromName", "replyTo" }`) sets the name the business's emails come
+  from and their default reply-to; the From address is the business's verified domain.
+- `attach` on a step adds files (at most 5, 10 MB in all): `"calendar"` — the booking as an `.ics` invite
+  that drops straight into the person's calendar (a cancelled booking's invite cancels it there);
+  `{ "asset": "<assetId>" }` — a file in the collection's assets (terms, a price list);
+  `{ "function": "<name>" }` — your app's own function makes it (a receipt PDF: server-functions.md,
+  "Making an email attachment"). E.g. `{ "send": "booking-confirmed", "to": "contact", "attach": ["calendar"] }`.
+  One that can't be made is left out; the email still goes.
 - Who gets what, in templates: `{{ booking }}` is the booking **ready-formatted**: its fields and
   `data`, plus `serviceName`, `staffName`, `customer`, `durationMinutes`, `when` (`date`,
   `shortDate`, `time`, `endTime`, `dateTime`, `timezone` — in the business's timezone) and, when the
@@ -393,9 +404,14 @@ window (optionally with one resource), each hydrated with **their own** booking.
 await SL.bookings.message(collectionId, appId, { templateId, slotId })
 // Everyone booked with Sam next week, by email even if they prefer texts
 await SL.bookings.message(collectionId, appId, { templateId, channel: 'email', from, to, resourceType: 'record', resourceId: samId })
+// Everyone on the class, each with their own calendar invite
+await SL.bookings.message(collectionId, appId, { templateId, slotId, attach: ['calendar'] })
 // → { matched, sent, skipped: { noContact, duplicate, failed }, failures: [{ bookingId, reason }] }
 ```
 
+`attach` takes the same files as `comms.sendTransactional` (comms.md, "Attachments"); `'calendar'` is
+each person's own booking.
+
 Statuses default to held, pending and confirmed; at most 500 recipients per call (narrow the window
 for more). One message per contact on a slot, one per booking in a window. Also
 `ctx.sl.bookings.message(input)` in a server function (`sl:bookings:write`) — a cron function that

package/docs/comms.md

@@ -56,6 +56,7 @@ if (result.ok) {
 | `include` | object | Hydration flags — see table below. |
 | `ref` | `string` | Arbitrary reference string stored with the event. |
 | `appId` | `string` | App identifier, used for context/logging. |
+| `attach` | `EmailAttachmentSpec[]` | Files on the email — see [Attachments](#attachments). |
 
 **`include` fields:**
 
@@ -73,12 +74,36 @@ if (result.ok) {
 
 ```typescript
 // Success
-{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string }
+{ ok: true; channel: 'email' | 'sms' | 'whatsapp' | 'push' | 'wallet'; messageId?: string; attachmentsLeftOut?: string[] }
 
 // Failure
 { ok: false; error: string }
 ```
 
+### Attachments
+
+`attach` puts files on the email (email only — ignored when the send goes by text or push). At most 5
+files and 10 MB in all; PDF, Word / Excel / PowerPoint, images, text, CSV and calendar files.
+
+```typescript
+await comms.sendTransactional(collectionId, {
+  contactId, templateId: 'booking-confirmed', appId: 'appointment-booking',
+  include: { booking: bookingId },
+  attach: [
+    'calendar',                                   // the booking's .ics invite (needs include.booking + appId)
+    { asset: 'a1b2c3' },                          // a file uploaded to the collection's assets
+    { function: 'receiptPdf' },                   // the app's own server function makes it
+    { filename: 'Quote.pdf', contentType: 'application/pdf', content: base64 },  // a file you made
+    { filename: 'Report.pdf', file: signedUrl },  // a private file you made (pdf.create return: 'signedUrl')
+  ],
+})
+```
+
+A malformed list is refused (`transactional.attach_invalid`). A file that can't be made at send time
+(a missing asset, a function that fails) is left out and listed in `attachmentsLeftOut` — the email
+still goes. The request body is capped at 10 MB, so for big files make a private file and pass `file`.
+`bookings.message` takes the same `attach` (`'calendar'` is each person's own booking).
+
 ---
 
 ## Broadcasts
@@ -149,11 +174,12 @@ Consent resolution order (per recipient, per channel):
 3. `preferences._default.topics[topic]`
 4. Subject-specific preferences (when hydrating a subject context)
 
-Minimal broadcast data shape:
+Minimal broadcast data shape (`attach` is optional — uploaded assets only, the same files on every email):
 ```json
 {
   "data": {
     "topic": "newsletter",
+    "attach": [{ "asset": "a1b2c3" }],
     "channelSettings": {
       "mode": "preferred",
       "channels": [

package/docs/iframe-responder.md

@@ -35,10 +35,8 @@ const responder = new smartlinks.IframeResponder({
     smartlinks.setBearerToken(token);
     console.log('User logged in:', user);
   },
-  onResize: (height) => {
-    // Update iframe height
-    iframeElement.style.height = `${height}px`;
-  },
+  // An app in a page: the iframe is as tall as the app's content — the page scrolls, never the iframe.
+  autoHeight: { minHeight: 480 },
 });
 
 // Attach to iframe element
@@ -115,9 +113,24 @@ interface IframeResponderOptions {
   onResize?: (height: number) => void;
   onError?: (error: Error) => void;
   onReady?: () => void;
+
+  // Height
+  autoHeight?: boolean | { minHeight?: number }; // size the iframe to the app's content (an app in a page)
 }
 ```
 
+**Height: `autoHeight` or `onResize`.**
+
+- **`autoHeight`** — for an app placed in a page (a website, a section of a dashboard). The responder sets
+  the iframe's height from the height the app reports, adds the iframe's own border and padding (an
+  element with `box-sizing: border-box`, Tailwind's default, otherwise ends up short by its border — a
+  pointless scrollbar), and never uses the window-filling height. The iframe's own scrolling stays on as a
+  fallback for an app on an older SDK that under-reports its height. `minHeight`
+  is the least height it gives. `onResize` still hears each content height.
+- **`onResize`** without `autoHeight` — for a full-screen host that sizes the iframe itself. It receives
+  the app's content height whenever the app reports one, **and** on every window resize the window's
+  height below the iframe's container.
+
 ## Advanced Examples
 
 ### Deep Linking / Route Synchronization
@@ -175,6 +188,8 @@ const responder = new smartlinks.IframeResponder({
 
 ### Responsive Height Management
 
+An app in a page: `autoHeight` (above) does it all. A full-screen host that manages the height itself:
+
 ```typescript
 const responder = new smartlinks.IframeResponder({
   collectionId: 'acme-wines',
@@ -442,7 +457,7 @@ import type {
 3. **Clean up** responder with `destroy()` when unmounting
 4. **Use version control** to test against development versions
 5. **Validate tokens** server-side for security
-6. **Set height dynamically** based on content using `onResize`
+6. **Size the iframe to its content** with `autoHeight` (an app in a page) or `onResize` (a full-screen host)
 7. **Sync routes** with parent navigation for better UX
 8. **Set `parentPath`** for routes that have a meaningful parent screen in the app hierarchy
 
@@ -458,8 +473,9 @@ import type {
 - Verify token is being set with `setBearerToken()`
 - Check that auth messages are being received
 
-### Height not updating
-- Implement `onResize` callback
+### Height not updating, or a scrollbar inside the iframe
+- An app in a page: use `autoHeight` instead of setting the height yourself
+- A full-screen host: implement the `onResize` callback
 - Ensure iframe has CSS styling for height changes
 - Check that iframe is sending resize messages
 

package/docs/server-functions.md

@@ -703,6 +703,35 @@ export async function printLabel(ctx, event) {
 - **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
   confirm the digits before answering.
 
+### Making an email attachment
+
+A flow step can attach a file your function makes: `"attach": [{ "function": "receiptPdf" }]` in a
+site's `cloud/flows.json` (or an app's blueprint). When the email goes, the platform calls your function
+(your app's, in this collection, as the collection, like a connector step) with:
+
+```ts
+event.body = { purpose: 'attachment', eventType, interactionId, outcome, contactId, metadata, booking? } // booking: ready-formatted
+```
+
+and attaches what it returns:
+
+```ts
+// capabilities: ["tools:pdf.create"]
+export async function receiptPdf(ctx, event) {
+  const b = event.body.booking
+  const pdf = await ctx.sl.tools.run('pdf.create', { format: 'A4', html: `<h1>Receipt</h1><p>${b.serviceName}, ${b.when.dateTime}</p>`, return: 'signedUrl' })
+  return { filename: `receipt-${b.id}.pdf`, file: pdf.url }          // a private file you made
+  // or { filename, contentType: 'application/pdf', content: '<base64>' }, a list of those, or null for none
+}
+```
+
+- Files: PDF, calendar (`.ics`), images, text / CSV and Office documents; at most 5 per email and 10 MB
+  in all. A private file must be one this platform made (`return: 'signedUrl'`), never an outside URL.
+- If your function fails or returns something else, the email still goes without it (the reason is in
+  your function's runs).
+- Other sources need no code: `"calendar"` (a booking event's calendar invite) and
+  `{ "asset": "<assetId>" }` (a file in the collection's assets) — see bookings.md, "Flows on booking events".
+
 ---
 
 ## Worked example — a public competition entry

package/docs/websites.md

@@ -80,11 +80,17 @@ const responder = new SL.IframeResponder({
   appId: 'appointments',            // the app's id on this collection
   initialPath: '/my-bookings',      // the page's `path`
   params: { service: 'svc_123' },   // what the page `accepts`
-  onResize: (h) => { iframe.style.height = `${h}px` },
+  autoHeight: { minHeight: 480 },   // the iframe is as tall as the page: your page scrolls, never the iframe
 })
 iframe.src = await responder.attach(iframe)
 ```
 
+- **Size it with `autoHeight`, not by hand.** The responder sets the iframe's height from the page's own
+  height and counts the iframe's border and padding, so there's nothing left to scroll. Setting
+  `iframe.style.height` from `onResize` yourself goes wrong in a site: `onResize` also fires on every
+  window resize with "the window below the iframe" (for a full-screen host), and a bordered iframe
+  (Tailwind's border-box) ends up a few pixels short — a scrollbar inside the frame.
+
 - **The visitor's session goes with it.** The page's API calls are proxied through the site, so it
   acts as whoever is signed in to the site (or as a guest). Never pass a token in the URL.
 - **The app must be installed** on the site's collection; its address comes from there.

package/openapi.yaml

@@ -24805,6 +24805,11 @@ components:
             $ref: "#/components/schemas/BookingStatus"
         ref:
           type: string
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
       required:
         - templateId
     MessageBookersResult:
@@ -24999,6 +25004,11 @@ components:
           type: boolean
         priority:
           type: number
+        attach:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
         createdAt:
           type: string
       required:
@@ -26130,6 +26140,10 @@ components:
           type: string
         appId:
           type: string
+        attach:
+          type: array
+          items:
+            $ref: "#/components/schemas/EmailAttachmentSpec"
       required:
         - contactId
         - templateId
@@ -26149,6 +26163,10 @@ components:
             - wallet
         messageId:
           type: string
+        attachmentsLeftOut:
+          type: array
+          items:
+            type: string
       required:
         - ok
         - channel
@@ -26172,6 +26190,9 @@ components:
       $ref: "#/components/schemas/CommsSettings"
     ConsentChannels:
       $ref: "#/components/schemas/BroadcastChannel"
+    EmailAttachmentSpec:
+      type: object
+      additionalProperties: true
     TransactionalSendResult:
       anyOf:
         - $ref: "#/components/schemas/TransactionalSendResponse"
@@ -27708,6 +27729,9 @@ components:
         accountData:
           type: object
           additionalProperties: true
+        autoHeight:
+          type: object
+          additionalProperties: true
       required:
         - collectionId
         - appId

package/package.json

@@ -1,87 +1,87 @@
-{
-  "name": "@proveanything/smartlinks",
-  "version": "2.1.6",
-  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    },
-    "./testing": {
-      "types": "./dist/testing/index.d.ts",
-      "import": "./dist/testing/index.js",
-      "default": "./dist/testing/index.js"
-    },
-    "./*": {
-      "types": "./dist/*.d.ts",
-      "import": "./dist/*.js",
-      "default": "./dist/*.js"
-    },
-    "./baseline.css": "./dist/baseline.css",
-    "./baseline.classes.json": "./dist/baseline.classes.json",
-    "./theme.css": "./dist/theme.css",
-    "./theme-boot.js": "./dist/theme-boot.js",
-    "./package.json": "./package.json"
-  },
-  "bin": {
-    "smartlinks-register-release": "scripts/register-release.mjs",
-    "smartlinks-publish": "scripts/publish.mjs",
-    "smartlinks-doctor": "scripts/doctor.mjs",
-    "smartlinks-headless": "scripts/headless-check.mjs"
-  },
-  "files": [
-    "dist/",
-    "docs/",
-    "scripts/register-release.mjs",
-    "scripts/publish.mjs",
-    "scripts/doctor.mjs",
-    "scripts/headless-check.mjs",
-    "scripts/lib/",
-    "openapi.yaml",
-    "README.md"
-  ],
-  "scripts": {
-    "test": "node test/run.cjs",
-    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
-    "docs": "typedoc",
-    "docs:summary": "node generate-api-summary.cjs",
-    "docs:openapi": "node generate-openapi.cjs",
-    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
-    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
-    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "smartlinks",
-    "api",
-    "authentication",
-    "traceability",
-    "blockchain",
-    "typescript",
-    "sdk"
-  ],
-  "author": "Glenn Shoosmith",
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "cross-fetch": "^3.1.5",
-    "es-module-lexer": "^1.7.0"
-  },
-  "devDependencies": {
-    "ts-node": "^10.9.1",
-    "typedoc": "^0.25.13",
-    "typedoc-plugin-markdown": "^3.17.1",
-    "typescript": "^4.9.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/Prove-Anything/smartlinks.git"
-  },
-  "homepage": "https://smartlinks.app"
-}
+{
+  "name": "@proveanything/smartlinks",
+  "version": "2.1.8",
+  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js",
+      "default": "./dist/testing/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
+    },
+    "./baseline.css": "./dist/baseline.css",
+    "./baseline.classes.json": "./dist/baseline.classes.json",
+    "./theme.css": "./dist/theme.css",
+    "./theme-boot.js": "./dist/theme-boot.js",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "smartlinks-register-release": "scripts/register-release.mjs",
+    "smartlinks-publish": "scripts/publish.mjs",
+    "smartlinks-doctor": "scripts/doctor.mjs",
+    "smartlinks-headless": "scripts/headless-check.mjs"
+  },
+  "files": [
+    "dist/",
+    "docs/",
+    "scripts/register-release.mjs",
+    "scripts/publish.mjs",
+    "scripts/doctor.mjs",
+    "scripts/headless-check.mjs",
+    "scripts/lib/",
+    "openapi.yaml",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node test/run.cjs",
+    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
+    "docs": "typedoc",
+    "docs:summary": "node generate-api-summary.cjs",
+    "docs:openapi": "node generate-openapi.cjs",
+    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
+    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
+    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "smartlinks",
+    "api",
+    "authentication",
+    "traceability",
+    "blockchain",
+    "typescript",
+    "sdk"
+  ],
+  "author": "Glenn Shoosmith",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "cross-fetch": "^3.1.5",
+    "es-module-lexer": "^1.7.0"
+  },
+  "devDependencies": {
+    "ts-node": "^10.9.1",
+    "typedoc": "^0.25.13",
+    "typedoc-plugin-markdown": "^3.17.1",
+    "typescript": "^4.9.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Prove-Anything/smartlinks.git"
+  },
+  "homepage": "https://smartlinks.app"
+}