- Shipped
- November 13, 2026 at 8:20 AM UTC
- Author
- Kamo
- Commit
- b1b7cd8
- EmailSendRequest.docLinks (DocLinkSpec[]). Member and shared-mailbox sends run DocsService's Access Check on the final recipients: BLOCK => 403 DOC_ACCESS_BLOCKED, WARN without acknowledgeDisclosureWarning => 409 DOC_ACCESS_CHECK {matrix, disclosure}; a dry run carries docAccessCheck. DocsService away (404/503/unreachable/no secret) => 503 DOC_LINKS_UNAVAILABLE; mail without docLinks never calls it. - After the dry-run gate and before the send: the Message-ID is minted up front, /issue grants and links every doc against it (source MAIL, mailboxEmail), the email-safe "Shared docs" card block (thumbnail or type badge, name, type/pages, Shared by, role line, expiry, Open button in the org brand colour) fills the place prepare kept above signature and quote, plus a text twin. X-Kamo-Doc-Links carries the link ids; a failed send calls /revoke-source. Response gains docLinks. - Drafts keep docLinks in X-Kamo-Draft-Doc-Links (base64 JSON, folded), no grants. Message reads (IMAP and Graph) expose docLinkIds and draftDocLinks. - email.sent.<mbx> {messageId, docLinkIds, recipients} on every member/shared send (svc_email already publishes email.>).