@everfur/sdk 0.1.1 → 0.4.0

package/dist/depth-DvPwPuT_.d.ts

@@ -0,0 +1,533 @@
+import { c as EverfurResult, E as EverfurError } from './EverfurResult-DN9pL2Ab.js';
+import { P as PetRef } from './ids-B2GAAifq.js';
+import { R as RequestFunnel } from './requestFunnel-DFMGcluw.js';
+import { A as AuthContext } from './identity-CEi9GRFZ.js';
+import { E as ErrorPolicyPort } from './ErrorPolicyPort-CwbfmxzJ.js';
+import { d as RecordsRequestView, R as RecordDocumentMeta, a as RecordEntity } from './models-B-Uh2LTf.js';
+
+/** Directory contact details only. The server intentionally does not expose clinic email addresses. */
+interface RecordsClinic {
+    readonly id: string;
+    readonly name: string;
+    readonly address: string | null;
+    readonly phone: string | null;
+    readonly emailStatus: string;
+    readonly distanceKm: number | null;
+}
+interface RecordsClinicSearchInput {
+    readonly query?: string;
+    readonly location?: {
+        readonly latitude: number;
+        readonly longitude: number;
+    };
+    readonly limit?: number;
+    /** Use with the same query/location that produced it. Opaque; never decode it. */
+    readonly cursor?: string;
+}
+interface RecordsClinicSearchPage {
+    readonly clinics: readonly RecordsClinic[];
+    readonly nextCursor: string | null;
+}
+/** `GET /widget/v1/records/clinics/recent`: the directory clinics THIS member sent a request to before. */
+interface RecordsRecentClinicsInput {
+    /** 1 to 25 (the route's bound); the server default when omitted. */
+    readonly limit?: number;
+}
+/** Backend-authored templates. Present them before signing; never substitute SDK-authored legal copy. */
+interface RecordsAuthorizationCopy {
+    readonly authorizationVersion: string;
+    readonly scopeTemplate: string;
+    readonly authorizationTemplate: string;
+}
+type RecordsClinicTarget = {
+    readonly clinicId: string;
+    readonly clinicFreeText?: never;
+} | {
+    readonly clinicId?: never;
+    readonly clinicFreeText: string;
+};
+/** Exactly one explicit authorization signature; never inferred from the partner's virtual user. */
+type RecordsAuthorizationSignature = {
+    readonly signatureId: string;
+    readonly signaturePngBase64?: never;
+} | {
+    readonly signatureId?: never;
+    readonly signaturePngBase64: string;
+};
+type CreateClinicRequestInput = RecordsClinicTarget & RecordsAuthorizationSignature & {
+    readonly petRef: PetRef;
+    readonly ownerName: string;
+    readonly authorizationVersion: string;
+    /** Owner-supplied contact only; server anti-relay checks prevent redirecting an addressable clinic. */
+    readonly clinicEmail?: string;
+    /** Stable for retries of this authorization, distinct for a new authorization. */
+    readonly idempotencyKey: string;
+};
+/** Multipart signature upload policy. Do not log or persist this short-lived credential. */
+interface RecordsSignatureUploadPolicy {
+    readonly uploadId: string;
+    readonly uploadUrl: string;
+    readonly uploadFields: Readonly<Record<string, string>>;
+}
+
+interface HttpRecordsClinicRepositoryDeps {
+    readonly auth: AuthContext;
+    readonly funnel?: RequestFunnel;
+    readonly errorPolicy?: ErrorPolicyPort;
+}
+
+/** The most clinics one batch may name (the server's `_MAX_BATCH_CLINICS`). */
+declare const RECORDS_CLINIC_BATCH_MAX = 10;
+/** One clinic of a batch: exactly one clinic target, exactly one signature, and its own idempotency key. */
+type RecordsClinicBatchItem = RecordsClinicTarget & RecordsAuthorizationSignature & {
+    /** Owner-supplied contact only; server anti-relay checks prevent redirecting an addressable clinic. */
+    readonly clinicEmail?: string;
+    /** Stable for retries of this clinic's authorization, distinct for a new one. */
+    readonly idempotencyKey: string;
+};
+interface CreateClinicRequestBatchInput {
+    /** The registered pet the records are requested for. */
+    readonly petRef: PetRef;
+    /** The signer's name, confirmed by the owner before signing. */
+    readonly ownerName: string;
+    /** The version of the backend-authored authorization copy the owner signed. */
+    readonly authorizationVersion: string;
+    /** 1..RECORDS_CLINIC_BATCH_MAX clinics. */
+    readonly clinics: readonly RecordsClinicBatchItem[];
+}
+/** One clinic's outcome: `request` when created, `failureCode` and `failureReason` when not. */
+interface RecordsClinicBatchResult {
+    /** The idempotency key this clinic was sent with. */
+    readonly idempotencyKey: string;
+    /** The directory clinic, when the clinic was chosen from the directory. */
+    readonly clinicId: string | null;
+    /** The owner-entered clinic, when it was not. */
+    readonly clinicFreeText: string | null;
+    /** True when this clinic has a request in the response; false with failureCode otherwise. */
+    readonly created: boolean;
+    /** The created request, mapped like every other records request. */
+    readonly request: RecordsRequestView | null;
+    /** Machine-readable reason this clinic was not created. */
+    readonly failureCode: string | null;
+    /** Server-authored; safe to log, but render your own copy from `failureCode`. */
+    readonly failureReason: string | null;
+}
+interface RecordsClinicBatch {
+    /** The group every request of this batch belongs to. */
+    readonly requestGroupId: string;
+    /** The pet the batch was for; always the input's petRef. */
+    readonly petRef: string;
+    /** One result per clinic, in the order sent. */
+    readonly results: readonly RecordsClinicBatchResult[];
+    /** How many clinics have a request. */
+    readonly createdCount: number;
+    /** How many clinics failed. */
+    readonly failedCount: number;
+}
+/** The multi-clinic records request client. */
+interface RecordsClinicBatchClient {
+    /** Run it only from the owner's own signed action: it gives consent and contacts clinics in the owner's name. */
+    createClinicRequestBatch(input: CreateClinicRequestBatchInput): Promise<EverfurResult<RecordsClinicBatch>>;
+}
+/** The batch client, over the same auth, funnel and error policy as the clinic repository. */
+declare function createRecordsClinicBatchClient(deps: HttpRecordsClinicRepositoryDeps): RecordsClinicBatchClient;
+
+/** A corrected field's wire value: text and dates as strings, numbers as numbers, flags as booleans. */
+type FactFieldValue = string | number | boolean;
+interface RecordFactEditInput {
+    /** The row's `category` (the wire `entity_type`). */
+    readonly entityType: string;
+    /** The row's `canonicalKey`; never an `entity_id`. */
+    readonly canonicalKey: string;
+    /**
+     * Field overrides under the fact's typed slot, e.g. `{ value_text: 'Chicken' }`, `{ value_num: 12.4 }`,
+     * `{ value_date: '2026-05-01' }` or `{ value_bool: true }`. Never empty.
+     */
+    readonly correctedFields: Readonly<Record<string, FactFieldValue>>;
+    /** Stable for a retry of the same correction. */
+    readonly idempotencyKey?: string;
+}
+interface RecordFactRemoveInput {
+    readonly entityType: string;
+    readonly canonicalKey: string;
+    readonly idempotencyKey?: string;
+}
+/** The display field every fact accepts as a correction target on this wire (the text slot). */
+declare const FACT_VALUE_FIELD = "value_text";
+/**
+ * True when the server refused the write because a staff reviewer already decided this fact.
+ *
+ * MEASURED, and the reason this is not written on the normalized code. The route raises the reviewer-wins
+ * refusal with a STRING detail (`_REVIEWER_LOCKED_DETAIL`), and `http_exception_handler` renders a string
+ * detail through `_HTTP_CODE_MAP`, so the body reaching the SDK is `{code: 'ConflictException', message,
+ * request_id}` and NOT the code-free body this guard used to assume. `ConflictException` folds to `conflict`,
+ * exactly like the typed `records_consent_required` the same two routes answer when consent was withdrawn
+ * between the read and the write, so the old `code !== 'conflict'` test was false for BOTH of them: the
+ * reviewer-wins copy below was unreachable, and a consent withdrawal read as a connection fault.
+ *
+ * The split that does hold is on the wire code (`isRecordsConsentRequired`): every other 409 on these routes
+ * is the reviewer lock, including a 409 that carries no wire code at all, which is the coarser of the two
+ * "your write did not apply" messages and therefore the safe default.
+ */
+declare function isFactReviewerLocked(error: EverfurError | null): boolean;
+/** The text-slot correction (`value_text`). Prefer `factCorrectionFor`, which picks the ORIGINAL row's slot. */
+declare function factValueCorrection(value: string): Readonly<Record<string, string>>;
+type FactValueKind = 'num' | 'date' | 'bool' | 'text';
+/** The four typed slots of a fact envelope, keyed by kind. */
+declare const FACT_FIELD_BY_KIND: Readonly<Record<FactValueKind, string>>;
+/** The slot a fact lives in, read off its display value. `null` (no value on the wire) is text. */
+declare function inferFactValueKind(value: string | null | undefined): FactValueKind;
+/**
+ * The one-field `corrected_fields` for a correction of `original` (the row's display value) to `corrected`
+ * (what the owner typed). The key is the original's slot; the value is coerced into it, or sent as text when
+ * it does not fit. The corrected value is trimmed; the caller has already refused an empty one.
+ */
+declare function factCorrectionFor(original: string | null | undefined, corrected: string): Readonly<Record<string, string | number | boolean>>;
+
+/** One reading on a marker's trend line, with its provenance (the clinic, the document, the review flag). */
+interface RecordMarkerPoint {
+    readonly at: string | null;
+    readonly value: number | null;
+    readonly unit: string | null;
+    readonly qualitativeResult: string | null;
+    readonly refLow: number | null;
+    readonly refHigh: number | null;
+    /** The BE-computed range status (`in_range`, `above`, `below`); null when no band is on file. */
+    readonly status: string | null;
+    readonly sourceClinic: string | null;
+    /** The base wire's document key for the source document; null when the wire named none. */
+    readonly docId: string | null;
+    /** True once Everfur's team verified the reading against the original document. */
+    readonly reviewed: boolean;
+}
+interface RecordMarkerLatest {
+    readonly at: string | null;
+    readonly value: number | null;
+    readonly unit: string | null;
+    readonly qualitativeResult: string | null;
+    readonly status: string | null;
+}
+/** One swipeable trend card: a canonical marker with its point series, latest reading and trajectory. */
+interface RecordMarker {
+    readonly markerId: string;
+    readonly name: string;
+    readonly loincCode: string | null;
+    readonly unit: string | null;
+    readonly panel: string | null;
+    /** BE-authored meaning text, rendered verbatim. */
+    readonly meaning: string | null;
+    readonly latest: RecordMarkerLatest | null;
+    /** `up`, `down` or `flat`, BE-decided; null when the wire sent none. */
+    readonly trajectory: string | null;
+    readonly points: readonly RecordMarkerPoint[];
+}
+/** The BE-computed donut aggregate: the FE renders these counts verbatim and never tallies statuses itself. */
+interface RecordMarkerSummary {
+    readonly totalMarkers: number;
+    readonly inRangeCount: number;
+    readonly outOfRangeCount: number;
+    readonly unknownCount: number;
+}
+interface RecordMarkersView {
+    readonly petRef: PetRef;
+    /** The consent-not-granted or fail-closed shape: render nothing. */
+    readonly withheld: boolean;
+    readonly markers: readonly RecordMarker[];
+    readonly summary: RecordMarkerSummary | null;
+    /** BE-authored, rendered verbatim. */
+    readonly disclaimer: string;
+    readonly featuredMarkerId: string | null;
+}
+/** The markers wire to a frozen view; withheld or malformed folds to withheld (never partial). */
+declare function mapRecordMarkers(petRef: string, wire: unknown): RecordMarkersView;
+
+interface HttpRecordsRepositoryDeps {
+    /** The partner's `EverfurConfig.errorPolicy`, so its retry knobs reach the funnel. Narrowing only. */
+    readonly errorPolicy?: ErrorPolicyPort;
+    readonly auth: AuthContext;
+    /** The ONE request funnel. Built from `auth` when absent; injected in tests for a deterministic clock. */
+    readonly funnel?: RequestFunnel;
+    /**
+     * The API base URL the transport was built for. The depth client resolves a RELATIVE link the server
+     * returns (the consumer share link is a path) against this origin; absent, such a link is refused.
+     */
+    readonly apiBaseUrl?: string;
+}
+
+/**
+ * One file the member uploaded onto their own request.
+ *
+ * `fileName` is null for an upload made before the server kept the name (the schema says so), and a
+ * surface must then show the format, size and time on their own rather than inventing a title.
+ * `byteSize` and `receivedAt` are nullable for the same historical reason.
+ */
+interface RecordsRequestDocument {
+    /** The document's own id on the wire. Stable, and the list key. */
+    readonly sourceDocId: string;
+    readonly fileName: string | null;
+    readonly docFormat: string | null;
+    readonly byteSize: number | null;
+    /** ISO 8601, or null when the row carries no time. */
+    readonly receivedAt: string | null;
+    /** A presigned https GET the host opens itself. Never fetched with the bearer. */
+    readonly downloadUrl: string;
+    /** Seconds the signed URL stays good for, as the server minted it. */
+    readonly expiresInSeconds: number;
+}
+
+/** A freshly minted share link. `shareUrl` is shown once; the list read never repeats it. */
+interface RecordShareLink {
+    readonly shareId: string;
+    readonly shareUrl: string;
+    readonly expiresAt: string | null;
+}
+/** One live share link as the list read reports it (no URL: the token was shown once, at creation). */
+interface RecordShare {
+    readonly shareId: string;
+    readonly expiresAt: string | null;
+    readonly createdAt: string | null;
+    readonly viewCount: number;
+    readonly lastViewedAt: string | null;
+}
+/** The presigned PDF download. */
+interface RecordPdfLink {
+    readonly downloadUrl: string;
+    readonly expiresAt: string | null;
+}
+/**
+ * The share link as an absolute https URL. The consumer route returns the RELATIVE form
+ * (`/api/v1/records/everfur_record/shared/<token>.pdf`), which is resolved against the API base URL the
+ * client was built for; an absolute value is kept as it is. A link that cannot be made absolute https (a
+ * relative path with no base URL, another scheme, a malformed value) is refused: it is never opened raw.
+ */
+declare function resolveShareUrl(shareUrl: string, apiBaseUrl: string | undefined): string | null;
+/** The mint response to a frozen link, or null when malformed (fail-closed: no link is better than a bad one). */
+declare function mapRecordShareLink(wire: unknown, apiBaseUrl?: string): RecordShareLink | null;
+/** The list response to frozen rows, or null when malformed. */
+declare function mapRecordShareList(wire: unknown): readonly RecordShare[] | null;
+/** The PDF link response to a frozen link, or null when malformed or not https. */
+declare function mapRecordPdfLink(wire: unknown): RecordPdfLink | null;
+
+interface RecordsSignatureSuggestion {
+    readonly signatureId: string;
+    /** A short-lived presigned https URL of the signature PNG. */
+    readonly previewUrl: string;
+    readonly createdAt: string | null;
+}
+/** The gallery wire to frozen suggestions, or null when malformed. A row whose preview is not https is refused. */
+declare function mapSignatureSuggestions(wire: unknown): readonly RecordsSignatureSuggestion[] | null;
+
+/** One reading of a lab marker. Provenance absent; `docId` is the base wire's document key. */
+interface RecordLabPoint {
+    readonly at: string | null;
+    readonly value: number | null;
+    readonly unit: string | null;
+    readonly qualitativeResult: string | null;
+    readonly refLow: number | null;
+    readonly refHigh: number | null;
+    /** The BE-computed range status (`in_range`, `high`, `low`, ...); never derived here. */
+    readonly status: string | null;
+    readonly docId: string | null;
+}
+/** One lab marker series, the consumer "Blood & lab work" row. */
+interface RecordLabMarker {
+    readonly markerId: string;
+    readonly name: string;
+    readonly loincCode: string | null;
+    readonly unit: string | null;
+    readonly panel: string | null;
+    /** BE-authored meaning text, rendered verbatim. */
+    readonly meaning: string | null;
+    readonly latest: Omit<RecordLabPoint, 'refLow' | 'refHigh' | 'docId'>;
+    readonly trajectory: string | null;
+    readonly points: readonly RecordLabPoint[];
+}
+interface RecordEncounter {
+    readonly encounterId: string;
+    readonly date: string | null;
+    readonly type: string | null;
+    readonly clinicName: string | null;
+    readonly veterinarian: string | null;
+    readonly docId: string | null;
+}
+interface RecordClinicianNoteSection {
+    readonly section: string;
+    /** The vet's own words, verbatim. */
+    readonly text: string;
+}
+interface RecordClinicianNote {
+    readonly noteId: string;
+    readonly encounterId: string | null;
+    readonly observedOn: string | null;
+    readonly sections: readonly RecordClinicianNoteSection[];
+}
+interface RecordExamSystem {
+    readonly system: string;
+    /** `normal`, `abnormal` or `not_examined` (BE-graded). */
+    readonly findingStatus: string | null;
+    /** The BE-graded finding text for an abnormal system, verbatim; null otherwise. */
+    readonly finding: string | null;
+}
+interface RecordPhysicalExam {
+    readonly examId: string;
+    readonly encounterId: string | null;
+    readonly observedOn: string | null;
+    readonly docId: string | null;
+    /** In the server's order. */
+    readonly systems: readonly RecordExamSystem[];
+}
+/**
+ * The consumer "What's on file" card (records_epdf_schemas.py `Completeness`): coverage flags and counts only,
+ * never a review payload. Additive on the depth wire; an older backend omits it and the card does not render.
+ */
+interface RecordCompleteness {
+    readonly hasLabHistory: boolean;
+    readonly hasVaccinationHistory: boolean;
+    readonly hasWeightHistory: boolean;
+    readonly hasVitalsHistory: boolean;
+    readonly hasPhysicalExamHistory: boolean;
+    readonly hasProcedureHistory: boolean;
+    readonly hasGeneticHistory: boolean;
+    readonly hasReproductiveHistory: boolean;
+    readonly hasParasitePreventionHistory: boolean;
+    readonly earliestRecordAt: string | null;
+    readonly latestRecordAt: string | null;
+    readonly documentsIngested: number;
+    readonly documentsInReview: number;
+    /** Held facts still awaiting review, by entity type. */
+    readonly entitiesPendingReview: Readonly<Record<string, number>>;
+    readonly heldTotal: number;
+}
+interface RecordConflictCandidate {
+    readonly value: string;
+    readonly docId: string | null;
+    readonly collectedAt: string | null;
+}
+/** A disagreement between documents for one field or entity (records_epdf_schemas.py `Conflict`). */
+interface RecordConflict {
+    readonly conflictId: string;
+    readonly entityType: string;
+    readonly field: string | null;
+    /** `benign`, `needs_review` or `identity_risk` (BE-graded). */
+    readonly severity: string;
+    readonly candidates: readonly RecordConflictCandidate[];
+}
+/** The withheld sections of the record read (plus the completeness card and the conflicts, when the wire carries them). */
+interface RecordDepthView {
+    readonly petRef: PetRef;
+    /** True when the depth keys were on the wire (the flag is on for the tenant). False means: render nothing. */
+    readonly available: boolean;
+    /** The consent-not-granted or fail-closed shape: render nothing. */
+    readonly withheld: boolean;
+    readonly labResults: readonly RecordLabMarker[];
+    readonly encounters: readonly RecordEncounter[];
+    readonly clinicianNotes: readonly RecordClinicianNote[];
+    readonly physicalExams: readonly RecordPhysicalExam[];
+    /** Null when the wire carried no `completeness` (an older backend). */
+    readonly completeness: RecordCompleteness | null;
+    readonly conflicts: readonly RecordConflict[];
+}
+interface RecordsTimelineVisit {
+    readonly visitId: string;
+    readonly visitDate: string | null;
+    readonly veterinarian: string | null;
+    readonly summary: string | null;
+    readonly docId: string | null;
+}
+interface RecordsTimelineVaccine {
+    readonly vaccineId: string;
+    readonly product: string | null;
+    readonly lot: string | null;
+    readonly administeredOn: string | null;
+    readonly expiresOn: string | null;
+    readonly docId: string | null;
+}
+interface RecordsTimelineWeight {
+    readonly weightId: string;
+    readonly observedOn: string | null;
+    readonly weightKg: number | null;
+    readonly docId: string | null;
+}
+interface RecordsTimelineMedication {
+    readonly medicationId: string;
+    readonly drugName: string | null;
+    readonly dose: string | null;
+    readonly route: string | null;
+    readonly frequency: string | null;
+    readonly sig: string | null;
+    readonly rxNumber: string | null;
+    readonly startedOn: string | null;
+    readonly stoppedOn: string | null;
+    readonly docId: string | null;
+}
+/** The consumer timeline for a pet: four rails, every clinical field verbatim. */
+interface RecordsTimelineView {
+    readonly petRef: PetRef;
+    readonly withheld: boolean;
+    /** No entry on any rail (a granted pet with nothing published yet). */
+    readonly isEmpty: boolean;
+    readonly visits: readonly RecordsTimelineVisit[];
+    readonly vaccines: readonly RecordsTimelineVaccine[];
+    readonly weights: readonly RecordsTimelineWeight[];
+    readonly medications: readonly RecordsTimelineMedication[];
+    /** BE-authored, rendered verbatim. */
+    readonly disclaimer: string;
+}
+/** What one published document contributed to the pet's record. */
+interface RecordDocumentContributionsView {
+    readonly petRef: PetRef;
+    readonly withheld: boolean;
+    readonly document: RecordDocumentMeta | null;
+    readonly contributions: readonly RecordEntity[];
+    readonly contributionCount: number;
+}
+/**
+ * The four depth sections off a record wire. Absent keys (the flag is off) read as `available:false`;
+ * `withheld:true` or a section that fails the allowlist parse reads as withheld, never partial.
+ */
+declare function mapRecordDepth(petRef: string, wire: unknown): RecordDepthView;
+/** The consumer timeline wire to a frozen view; withheld or malformed folds to withheld. */
+declare function mapRecordsTimeline(petRef: string, wire: unknown): RecordsTimelineView;
+/** The per-document contributions wire to a frozen view; withheld or malformed folds to withheld. */
+declare function mapDocumentContributions(petRef: string, wire: unknown): RecordDocumentContributionsView;
+/**
+ * The depth reads and the owner's record writes for a signed member, all behind the same strict flag. Every
+ * method settles; a dark flag is the ordinary not-found error (httpStatus 404), which every surface over this
+ * client folds to "hidden, no error" exactly as it folds `available:false` on the record read.
+ */
+interface RecordsDepthClient {
+    /** The withheld sections off the record read. `available:false` when the tenant's flag is off. */
+    getRecordDepth(petRef: PetRef): Promise<EverfurResult<RecordDepthView>>;
+    getTimeline(petRef: PetRef): Promise<EverfurResult<RecordsTimelineView>>;
+    getDocumentContributions(petRef: PetRef, docId: string): Promise<EverfurResult<RecordDocumentContributionsView>>;
+    /** The consumer dashboard's lab markers with the BE-computed donut summary (`markers.ts`). */
+    getMarkers(petRef: PetRef): Promise<EverfurResult<RecordMarkersView>>;
+    /** Mint a public, expiring share link to the pet's record. The URL is returned ONCE. */
+    createShare(petRef: PetRef): Promise<EverfurResult<RecordShareLink>>;
+    /** The pet's live share links (never the URLs). */
+    listShares(petRef: PetRef): Promise<EverfurResult<readonly RecordShare[]>>;
+    /** Turn a link off. A link already off (404) settles as the ordinary not-found error. */
+    revokeShare(petRef: PetRef, shareId: string): Promise<EverfurResult<void>>;
+    /** A presigned link to the record PDF the host opens itself. */
+    getPdfLink(petRef: PetRef): Promise<EverfurResult<RecordPdfLink>>;
+    /** Correct one fact's display value (append-only overlay; 409 when a reviewer already decided it). */
+    editFact(petRef: PetRef, input: RecordFactEditInput): Promise<EverfurResult<void>>;
+    /** Remove one fact from the owner-facing record (append-only reject; 409 when reviewer-decided). */
+    removeFact(petRef: PetRef, input: RecordFactRemoveInput): Promise<EverfurResult<void>>;
+    /**
+     * The files the member uploaded onto one of their own records requests, oldest first, each with a
+     * short-lived signed download.
+     *
+     * NOT GATED BY THE DEPTH SWITCH, unlike every other method on this client: the route bounds these
+     * on `records.record.read` and the pet's records consent only, because they are the member's OWN
+     * uploads rather than clinical depth. So a caller must NOT fold a 404 here to `available:false`
+     * and hide the member's files; a 404 means the request is not theirs.
+     */
+    listRequestDocuments(requestId: string): Promise<EverfurResult<readonly RecordsRequestDocument[]>>;
+    /** The member's reusable signature gallery for the consent screen, newest first. */
+    listAuthorizationSignatures(): Promise<EverfurResult<readonly RecordsSignatureSuggestion[]>>;
+}
+/** The depth client, over the same auth, funnel and error policy as the records repository. */
+declare function createRecordsDepthClient(deps: HttpRecordsRepositoryDeps): RecordsDepthClient;
+
+export { isFactReviewerLocked as $, RECORDS_CLINIC_BATCH_MAX as A, type RecordFactEditInput as B, type CreateClinicRequestBatchInput as C, type RecordFactRemoveInput as D, type RecordMarker as E, FACT_FIELD_BY_KIND as F, type RecordMarkerLatest as G, type HttpRecordsClinicRepositoryDeps as H, type RecordMarkerPoint as I, type RecordMarkerSummary as J, type RecordMarkersView as K, type RecordPdfLink as L, type RecordShare as M, type RecordShareLink as N, type RecordsAuthorizationSignature as O, type RecordsClinicBatch as P, type RecordsClinicBatchClient as Q, type RecordClinicianNote as R, type RecordsClinicBatchItem as S, type RecordsClinicBatchResult as T, type RecordsClinicTarget as U, type RecordsSignatureSuggestion as V, createRecordsClinicBatchClient as W, createRecordsDepthClient as X, factCorrectionFor as Y, factValueCorrection as Z, inferFactValueKind as _, type RecordClinicianNoteSection as a, mapRecordMarkers as a0, mapRecordPdfLink as a1, mapRecordShareLink as a2, mapRecordShareList as a3, mapSignatureSuggestions as a4, resolveShareUrl as a5, type RecordsClinicSearchInput as a6, type RecordsClinicSearchPage as a7, type RecordsRecentClinicsInput as a8, type RecordsAuthorizationCopy as a9, type CreateClinicRequestInput as aa, type RecordsSignatureUploadPolicy as ab, type RecordCompleteness as b, type RecordConflict as c, type RecordConflictCandidate as d, type RecordDepthView as e, type RecordDocumentContributionsView as f, type RecordEncounter as g, type RecordExamSystem as h, type RecordLabMarker as i, type RecordLabPoint as j, type RecordPhysicalExam as k, type RecordsClinic as l, type RecordsDepthClient as m, type RecordsRequestDocument as n, type RecordsTimelineMedication as o, type RecordsTimelineVaccine as p, type RecordsTimelineView as q, type RecordsTimelineVisit as r, type RecordsTimelineWeight as s, mapDocumentContributions as t, mapRecordDepth as u, mapRecordsTimeline as v, FACT_VALUE_FIELD as w, type FactFieldValue as x, type FactValueKind as y, type HttpRecordsRepositoryDeps as z };

package/dist/entitlementRepository-B7egEdW6.d.ts

@@ -0,0 +1,43 @@
+import { E as EverfurError } from './EverfurResult-DN9pL2Ab.js';
+import { R as RequestFunnel } from './requestFunnel-DFMGcluw.js';
+import { A as AuthContext } from './identity-CEi9GRFZ.js';
+import { C as ClientBranding } from './branding-CsRdeNwK.js';
+import { E as EntitlementDecision } from './resolve-D4Ywz5OS.js';
+
+/** The conditional-GET endpoint (SPEC-00 §5.3). Relative; the transport prefixes the resolved base URL. */
+declare const ENTITLEMENTS_PATH = "/widget/v1/entitlements";
+/**
+ * The settled outcome of one entitlement fetch. `updated` carries a fresh verdict + the cadence to re-poll on;
+ * `notModified` means the cached verdict still holds; `failed` carries a normalized error and means keep-last.
+ */
+type EntitlementResolution = {
+    readonly kind: 'updated';
+    readonly revision: number;
+    readonly region: string;
+    readonly ttlSeconds: number;
+    readonly decisions: readonly EntitlementDecision[];
+    /**
+     * Server-driven branding parsed from the SAME 200 body's render_hints (orthogonal to capabilities).
+     * null when absent or unparseable (fail-closed -> the compiled Everfur default theme). OPTIONAL so a
+     * hand-built resolution (tests / injected resolve) need not supply it.
+     */
+    readonly branding?: ClientBranding | null;
+} | {
+    readonly kind: 'notModified';
+} | {
+    readonly kind: 'failed';
+    readonly error: EverfurError;
+};
+interface FetchEntitlementsArgs {
+    /** The revision we last stored; echoed as If-None-Match so an unchanged verdict returns 304. */
+    readonly cachedRevision?: number | null;
+    /** Optional region hint; forwarded as ?region. */
+    readonly region?: string;
+}
+/**
+ * Fetch the server-resolved entitlement verdict once. Never throws: a 304, a domain error, a network reject,
+ * and a malformed body all SETTLE to an EntitlementResolution. Fail-closed on every non-`updated` path.
+ */
+declare function fetchEntitlements(auth: AuthContext, args?: FetchEntitlementsArgs, funnel?: RequestFunnel): Promise<EntitlementResolution>;
+
+export { ENTITLEMENTS_PATH as E, type FetchEntitlementsArgs as F, type EntitlementResolution as a, fetchEntitlements as f };

package/dist/entitlementRepository-BpJ7tiwl.d.cts

@@ -0,0 +1,43 @@
+import { E as EverfurError } from './EverfurResult-DN9pL2Ab.cjs';
+import { R as RequestFunnel } from './requestFunnel-BjDpqqvm.cjs';
+import { A as AuthContext } from './identity-C2-08BZW.cjs';
+import { C as ClientBranding } from './branding-CsRdeNwK.cjs';
+import { E as EntitlementDecision } from './resolve-D4Ywz5OS.cjs';
+
+/** The conditional-GET endpoint (SPEC-00 §5.3). Relative; the transport prefixes the resolved base URL. */
+declare const ENTITLEMENTS_PATH = "/widget/v1/entitlements";
+/**
+ * The settled outcome of one entitlement fetch. `updated` carries a fresh verdict + the cadence to re-poll on;
+ * `notModified` means the cached verdict still holds; `failed` carries a normalized error and means keep-last.
+ */
+type EntitlementResolution = {
+    readonly kind: 'updated';
+    readonly revision: number;
+    readonly region: string;
+    readonly ttlSeconds: number;
+    readonly decisions: readonly EntitlementDecision[];
+    /**
+     * Server-driven branding parsed from the SAME 200 body's render_hints (orthogonal to capabilities).
+     * null when absent or unparseable (fail-closed -> the compiled Everfur default theme). OPTIONAL so a
+     * hand-built resolution (tests / injected resolve) need not supply it.
+     */
+    readonly branding?: ClientBranding | null;
+} | {
+    readonly kind: 'notModified';
+} | {
+    readonly kind: 'failed';
+    readonly error: EverfurError;
+};
+interface FetchEntitlementsArgs {
+    /** The revision we last stored; echoed as If-None-Match so an unchanged verdict returns 304. */
+    readonly cachedRevision?: number | null;
+    /** Optional region hint; forwarded as ?region. */
+    readonly region?: string;
+}
+/**
+ * Fetch the server-resolved entitlement verdict once. Never throws: a 304, a domain error, a network reject,
+ * and a malformed body all SETTLE to an EntitlementResolution. Fail-closed on every non-`updated` path.
+ */
+declare function fetchEntitlements(auth: AuthContext, args?: FetchEntitlementsArgs, funnel?: RequestFunnel): Promise<EntitlementResolution>;
+
+export { ENTITLEMENTS_PATH as E, type FetchEntitlementsArgs as F, type EntitlementResolution as a, fetchEntitlements as f };