@everfur/sdk 0.1.1 → 0.4.0

package/dist/view-Bxwxp4xD.d.ts

@@ -0,0 +1,310 @@
+import { c as EverfurResult, E as EverfurError } from './EverfurResult-DN9pL2Ab.js';
+import { R as RecordsRequestId, P as PetRef } from './ids-B2GAAifq.js';
+import { F as FileHandle, U as UploadTransport } from './ports-BN6RHF9W.js';
+import { C as CreateUploadRequestInput, d as RecordsRequestView, U as UploadedDocument, g as RecordsView, h as ConsentState, G as GrantConsentInput, i as RecordsDenialReason, a as RecordEntity } from './models-B-Uh2LTf.js';
+import { K as RecordMarkersView, L as RecordPdfLink, N as RecordShareLink, Q as RecordsClinicBatchClient } from './depth-DvPwPuT_.js';
+import { c as RecordsDepthStatus, i as RecordsClinicController } from './useRecordsDepth-crhBllQK.js';
+
+interface UploadDocumentInput {
+    readonly requestId: RecordsRequestId;
+    readonly file: FileHandle;
+    readonly onProgress?: (fraction: number) => void;
+    readonly signal?: AbortSignal;
+}
+interface RecordsController {
+    /** Create the self-upload request. Idempotent on `idempotencyKey`. Lands `awaiting_upload`. */
+    createUploadRequest(input: CreateUploadRequestInput): Promise<EverfurResult<RecordsRequestView>>;
+    /** Two-phase presigned upload of ONE document (§3.2). Bytes go DIRECT to S3. Resolves at `received`. */
+    uploadDocument(input: UploadDocumentInput): Promise<EverfurResult<UploadedDocument>>;
+    /** Poll one request's parse lifecycle. */
+    getRequest(id: RecordsRequestId): Promise<EverfurResult<RecordsRequestView>>;
+    /** All of this user's requests, newest-first (server-ordered). */
+    listRequests(): Promise<EverfurResult<readonly RecordsRequestView[]>>;
+    /** The parsed, partner-redacted record. Consent-gated + redaction-fail-closed. */
+    getRecord(pet: PetRef): Promise<EverfurResult<RecordsView>>;
+    /** Consent read-back. Never a hard failure for an absent row -> `granted:false`. */
+    getConsent(pet: PetRef): Promise<EverfurResult<ConsentState>>;
+    /** Grant content-exposure consent. Fail-closed audited server-side. Idempotent. */
+    grantConsent(input: GrantConsentInput): Promise<EverfurResult<ConsentState>>;
+    /** Revoke consent (prospective). Drops any cached record for the pet from memory. Idempotent. */
+    revokeConsent(pet: PetRef): Promise<EverfurResult<ConsentState>>;
+    /** The last record read for a pet, held in memory only; cleared on revoke. Null when none. */
+    peekCachedRecord(pet: PetRef): RecordsView | null;
+    /** Emit `records.capability.denied` (the rn CapabilityGate disabled surface calls this once, R12). */
+    reportCapabilityDenied(pet: PetRef | null): void;
+}
+
+type RecordsStatus = 'loading' | 'empty' | 'error' | 'populated';
+/** Why a picked file was not uploaded (the consumer picker's `PickSkipReason`): decided BEFORE any request is made. */
+type UploadSkipReason = 'too_large' | 'unsupported';
+/** One file of an upload batch, with its own lifecycle and progress (the consumer `UploadItem`). */
+interface UploadQueueItem {
+    /** Stable row key within the batch. */
+    readonly key: string;
+    /** The host's file name when it gave one; rendered locally, never sent. */
+    readonly name: string | null;
+    readonly status: 'queued' | 'uploading' | 'done' | 'failed' | 'skipped';
+    /** 0..1, monotonic while uploading; 1 once done. */
+    readonly progress: number;
+    readonly skipReason: UploadSkipReason | null;
+    readonly error: EverfurError | null;
+}
+interface UseEverfurRecordsState {
+    readonly status: RecordsStatus;
+    readonly record: RecordsView | null;
+    readonly requests: readonly RecordsRequestView[];
+    /** the most-recent request, whose timeline the populated state renders. */
+    readonly activeRequest: RecordsRequestView | null;
+    readonly consent: ConsentState | null;
+    readonly error: EverfurError | null;
+    /** drives the recovery affordance: consent CTA / establish-session CTA / disabled. */
+    readonly denialReason: RecordsDenialReason | null;
+    /** §5.1 fail-closed suppression: render the withheld notice, never empty, never raw. */
+    readonly withheld: boolean;
+    readonly isUploading: boolean;
+    readonly uploadProgress: number | null;
+    /** The files of the last pick, one row each, with per-file status and progress. Empty until a pick. */
+    readonly uploadQueue: readonly UploadQueueItem[];
+    /** Create a self-upload request the user attaches documents to. */
+    createRequest(idempotencyKey: string): Promise<EverfurResult<RecordsRequestView>>;
+    /** Two-phase presigned upload of one document to the active request. */
+    uploadDocument(requestId: RecordsRequestView['id'], file: FileHandle): Promise<EverfurResult<UploadedDocument>>;
+    /**
+     * Several documents in one pick: uploaded ONE AT A TIME (kinder to slow links), a live row per file, one failed
+     * file never aborts the rest (continue-on-error), and a non-PDF or oversize file is skipped with a reason before
+     * any request is created, so no quota is charged for it. Resolves with the settled rows.
+     */
+    uploadDocuments(requestId: RecordsRequestView['id'], files: readonly FileHandle[]): Promise<readonly UploadQueueItem[]>;
+    /** Grant content-exposure consent, then fetch the record. */
+    grantConsent(consentVersion: string, idempotencyKey: string): Promise<EverfurResult<ConsentState>>;
+    /** Revoke consent (prospective); drops the record from view. */
+    revokeConsent(): Promise<EverfurResult<ConsentState>>;
+    /** Re-run the surface fetch (error retry). */
+    refresh(): void;
+}
+declare function useEverfurRecords(opts: {
+    readonly petRef: PetRef;
+    /** Host/test seam: inject a controller directly instead of acquiring one from the runtime. */
+    readonly controller?: RecordsController;
+    /**
+     * The upload transport for this surface, overriding `EverfurConfig.uploadTransport`. The latest value is used
+     * at upload time, so a transport created inline on each render does not rebuild the controller.
+     */
+    readonly uploadTransport?: UploadTransport;
+}): UseEverfurRecordsState;
+
+interface UseRecordsMarkersState {
+    readonly status: RecordsDepthStatus;
+    readonly markers: RecordMarkersView | null;
+    /** False while the markers route is dark for the tenant: the markers surface is hidden, never an error. */
+    readonly available: boolean;
+    readonly error: EverfurError | null;
+    readonly refresh: () => void;
+}
+declare function useRecordsMarkers(petRef: PetRef): UseRecordsMarkersState;
+
+interface ShareRowView {
+    readonly shareId: string;
+    /** The link, when it was minted in this session (the list read never repeats a URL). */
+    readonly shareUrl: string | null;
+    readonly active: boolean;
+    /** `Active` or `Expired`: status as text, never colour alone. */
+    readonly statusLabel: string;
+    readonly expiryLabel: string;
+    readonly createdLabel: string | null;
+    readonly a11yLabel: string;
+    /** Disambiguating suffix for the row's spoken action labels. */
+    readonly actionContext: string;
+}
+
+type RecordSharesStatus = 'loading' | 'empty' | 'error' | 'populated';
+interface UseRecordSharesState {
+    readonly status: RecordSharesStatus;
+    readonly rows: readonly ShareRowView[];
+    /** True once a list read got an answer from behind the depth gate; false before that, after a read that never
+     * reached the server, and while the routes are dark. */
+    readonly available: boolean;
+    /**
+     * True once records consent for this pet is known to be withdrawn: a mint or an export answered the typed
+     * 409, or a withdrawal was made elsewhere in the app. The two consent-gated controls (create link, download
+     * PDF) go away while it holds; the LIST and the per-link revoke do not, because the server gates those on
+     * ownership alone so a member can still kill a link they no longer want live. `refresh()` clears it, which
+     * is the way back after the member allows records again.
+     */
+    readonly consentRequired: boolean;
+    readonly error: EverfurError | null;
+    readonly creating: boolean;
+    readonly revokingId: string | null;
+    readonly preparingPdf: boolean;
+    /** Mint a link; on success the list is re-read and the URL is remembered for its row. */
+    createLink(): Promise<EverfurResult<RecordShareLink>>;
+    revoke(shareId: string): Promise<EverfurResult<void>>;
+    /** The presigned PDF link the host opens itself. */
+    pdfLink(): Promise<EverfurResult<RecordPdfLink>>;
+    refresh(): void;
+}
+declare function useRecordShares(petRef: PetRef, opts?: {
+    readonly now?: () => number;
+}): UseRecordSharesState;
+interface UseRecordPdfLinkState {
+    readonly preparing: boolean;
+    /**
+     * True once the mount probe found the depth ROUTES lit; false before that, on the probe's dark 404, and when
+     * the probe never reached the server. It says nothing about whether the pet has a published record to export,
+     * which the same route's 404 also means: a surface that can see the record (the document screen does) must
+     * require that too before it draws a Download control.
+     */
+    readonly available: boolean;
+    readonly error: EverfurError | null;
+    pdfLink(): Promise<EverfurResult<RecordPdfLink>>;
+}
+/**
+ * The PDF link alone (the document screen's download control), without the share list read.
+ *
+ * `getPdfLink` answers ONE untyped 404 for two different states, and the guide says so
+ * (docs/partner-integration/09-GUIDE-RECORDS-AND-CONSENT.md): the tenant's depth switch is off, or the pet has
+ * no published record yet. The mount probe above already settled the first from a read behind the same
+ * router-level gate, so a 404 arriving HERE is the second, and folding it to `available:false` made the tap
+ * remove its own control and say nothing. It is a local, recoverable failure of one action: it sets `error`
+ * (every surface that draws the control has a line for it) and leaves `available` alone, so the control the
+ * member just pressed is still there. The honest answer to "is there a record to export" is the record read
+ * itself, which is why the document screen gates the control on the body it is already rendering.
+ */
+declare function useRecordPdfLink(petRef: PetRef): UseRecordPdfLinkState;
+
+/** Corrections and removals keyed by the row's `canonicalKey`. */
+interface FactOverlay {
+    readonly edits: Readonly<Record<string, string>>;
+    readonly removed: readonly string[];
+}
+/** The rows as the owner now sees them: a corrected value shows, a removed row is gone. Pure. */
+declare function applyFactOverlay(entities: readonly RecordEntity[], overlay: FactOverlay): readonly RecordEntity[];
+/** True when the row can be corrected: the wire gave it a stable key. */
+declare function isFactEditable(entity: Pick<RecordEntity, 'canonicalKey'>): boolean;
+interface UseRecordFactEditState {
+    readonly overlay: FactOverlay;
+    readonly busy: boolean;
+    /** The curated user-facing line of the last failure; null once a new write starts. */
+    readonly error: string | null;
+    /**
+     * Whether to offer the editor. The fact routes are their own feature flag and it defaults ON, so this is true
+     * from the first render and turns false only once a write has answered the dark 404 for this scope. There is
+     * no cheap read on these POST-only routes to probe with, and reading another feature's route instead is what
+     * made a tenant's share-links setting silently disable its fact editor.
+     */
+    readonly available: boolean;
+    /**
+     * Correct the row's displayed value. The wire key is the original value's typed slot (`value_num` for a number,
+     * `value_date`, `value_bool`, else `value_text`). Resolves the settled result; the overlay is already patched
+     * or rolled back.
+     */
+    edit(entity: RecordEntity, value: string): Promise<EverfurResult<void>>;
+    remove(entity: RecordEntity): Promise<EverfurResult<void>>;
+    clearError(): void;
+}
+declare function useRecordFactEdit(petRef: PetRef, opts?: {
+    readonly newIdempotencyKey?: () => string;
+}): UseRecordFactEditState;
+
+type RecordsEmptyVariant = 'idle' | 'error' | 'rate_limited' | 'service_unavailable' | 'no_requests' | 'no_records';
+
+/**
+ *   - `published`: STATE C, parsed lab markers are published (the donut and the trend cards render);
+ *   - `in_progress`: STATE B, a real request is mid-flight, driven solely by an actual request row;
+ *   - `none`: STATE A, no published markers and no live request: the actionable chooser.
+ */
+type RecordsDashboardState = 'published' | 'in_progress' | 'none';
+/**
+ * The request that drives a pet's dashboard state: a `published` one first (the owner keeps their data), else
+ * the most recently updated in-flight one, else null (only off-rail terminal requests, or none).
+ */
+declare function pickPetRecordsRequest(requests: readonly RecordsRequestView[], petRef: PetRef | null): RecordsRequestView | null;
+/**
+ * Derive the dashboard state from whether published markers exist and the pet's requests. A `published`
+ * request whose markers have not landed yet (eventual consistency) reads as in-progress, never a bare empty;
+ * a prior terminal request (revoked / failed) lands on STATE A so the owner can act again.
+ */
+declare function deriveRecordsDashboardState(args: {
+    readonly hasMarkers: boolean;
+    readonly requests: readonly RecordsRequestView[];
+    readonly petRef: PetRef | null;
+}): RecordsDashboardState;
+/** The six surfaces the dashboard body picks between, in the app's own branch order. */
+type RecordsDashboardView = 'loading' | 'record' | 'error' | 'in_progress' | 'none' | 'labs_only';
+interface RecordsDashboardInput {
+    /** The base records read (consent, requests, record) is still loading. */
+    readonly recordLoading: boolean;
+    /** The pet has a published, non-empty record. */
+    readonly hasFullRecord: boolean;
+    /** The base records read failed (any member of the error family). */
+    readonly recordError: boolean;
+    readonly markersLoading: boolean;
+    /** The markers read failed with a real error (a dark 404 is NOT an error: it is "no markers surface"). */
+    readonly markersError: boolean;
+    readonly hasMarkers: boolean;
+    readonly requestsLoading: boolean;
+    readonly dashboardState: RecordsDashboardState;
+    readonly drivingRequest: RecordsRequestView | null;
+}
+/** The branch order of RecordsDashboardScreen.tsx:238-419, as data. */
+declare function selectDashboardView(input: RecordsDashboardInput): RecordsDashboardView;
+
+/**
+ * The signed user's clinic request API. No prefetch, signature, consent, or outbound
+ * contact occurs on mount. The host presents backend-authored authorization copy
+ * and obtains the owner's explicit signature before calling createClinicRequest.
+ */
+declare function useEverfurRecordsClinic(): RecordsClinicController;
+/** The signed user's multi-clinic batch client, over the same auth and scope rules as `useEverfurRecordsClinic`. */
+declare function useEverfurRecordsClinicBatch(): RecordsClinicBatchClient;
+
+type RequestTimelineEventKey = 'requested' | 'sent_to_clinic' | 'awaiting_clinic' | 'awaiting_upload' | 'records_received' | 'processing' | 'parsing_failed' | 'manual_review' | 'ready' | 'delivery_failed' | 'processing_failed' | 'clinic_declined' | 'clinic_no_records' | 'no_response' | 'revoked';
+type RequestTimelineEventState = 'done' | 'current' | 'upcoming' | 'failed';
+interface RequestTimelineEvent {
+    readonly key: RequestTimelineEventKey;
+    /** Structural step title (not clinical/legal copy). */
+    readonly title: string;
+    /** Structural sub-detail (counts, dispatch substate) or null. */
+    readonly detail: string | null;
+    /** ISO timestamp when the request genuinely carries it, else null. */
+    readonly at: string | null;
+    readonly state: RequestTimelineEventState;
+}
+/** The step titles, verbatim: everfur-mobile-2026-7 src/features/records/lib/requestTimeline.ts `STAGE_TITLES`. */
+declare const REQUEST_TIMELINE_TITLES: Readonly<Record<RequestTimelineEventKey, string>>;
+/**
+ * Build the ordered step-wise timeline for a request. Pure + deterministic: states derive from the status,
+ * timestamps from the request's own fields. The terminal event (if any) is always last and carries state `failed`.
+ */
+declare function buildRequestTimeline(request: RecordsRequestView): readonly RequestTimelineEvent[];
+
+/**
+ * The card title: the clinic the request went to, else the consumer's own fallback by source
+ * (everfur-mobile-2026-7 src/features/records/ui/RecordsRequestScreen.tsx:97-100).
+ */
+declare function selectRequestTitle(request: RecordsRequestView): string;
+/**
+ * ALL of the member's requests for the pet, newest first (updatedAt, then createdAt), so the surface shows one
+ * step rail per request rather than only the newest. Frozen; the input is never reordered in place.
+ */
+declare function selectRequestList(requests: readonly RecordsRequestView[]): readonly RecordsRequestView[];
+/**
+ * The one BE-authored line a request card leads with: the consumer action-first sentence when the request needs
+ * the member (`actionNeededLabel`), else the status label. Never the raw status; empty when the server sent
+ * neither (the caller then renders no line).
+ */
+declare function selectPrimaryLabel(request: RecordsRequestView): string;
+interface ClinicCall {
+    /** The verified clinic number, trimmed, for display. */
+    readonly phone: string;
+    /** The `tel:` target: digits and a leading `+` only (the consumer app's own normalisation). */
+    readonly dial: string;
+    readonly clinicName: string | null;
+}
+/**
+ * The tap-to-call affordance, ONLY when the server gates it (`showClinicPhone`) AND supplies a number: the
+ * consumer app's `callPhone` rule (everfur-mobile-2026-7 src/features/records/ui/RecordsRequestScreen.tsx:205).
+ */
+declare function selectClinicCall(request: RecordsRequestView): ClinicCall | null;
+
+export { useEverfurRecords as A, useEverfurRecordsClinic as B, type ClinicCall as C, useEverfurRecordsClinicBatch as D, useRecordFactEdit as E, type FactOverlay as F, useRecordPdfLink as G, useRecordShares as H, useRecordsMarkers as I, type RecordsController as R, type ShareRowView as S, type UploadDocumentInput as U, REQUEST_TIMELINE_TITLES as a, type RecordSharesStatus as b, type RecordsDashboardState as c, type RecordsDashboardView as d, type RecordsEmptyVariant as e, type RecordsStatus as f, type RequestTimelineEvent as g, type RequestTimelineEventKey as h, type RequestTimelineEventState as i, type UploadQueueItem as j, type UploadSkipReason as k, type UseEverfurRecordsState as l, type UseRecordFactEditState as m, type UseRecordPdfLinkState as n, type UseRecordSharesState as o, type UseRecordsMarkersState as p, applyFactOverlay as q, buildRequestTimeline as r, deriveRecordsDashboardState as s, isFactEditable as t, pickPetRecordsRequest as u, selectClinicCall as v, selectDashboardView as w, selectPrimaryLabel as x, selectRequestList as y, selectRequestTitle as z };

package/dist/view-DyitEO0m.d.cts

@@ -0,0 +1,310 @@
+import { c as EverfurResult, E as EverfurError } from './EverfurResult-DN9pL2Ab.cjs';
+import { R as RecordsRequestId, P as PetRef } from './ids-B2GAAifq.cjs';
+import { F as FileHandle, U as UploadTransport } from './ports-BN6RHF9W.cjs';
+import { C as CreateUploadRequestInput, d as RecordsRequestView, U as UploadedDocument, g as RecordsView, h as ConsentState, G as GrantConsentInput, i as RecordsDenialReason, a as RecordEntity } from './models-D2EUxPZY.cjs';
+import { K as RecordMarkersView, L as RecordPdfLink, N as RecordShareLink, Q as RecordsClinicBatchClient } from './depth-D5HwcvKC.cjs';
+import { c as RecordsDepthStatus, i as RecordsClinicController } from './useRecordsDepth-C6rjEaLn.cjs';
+
+interface UploadDocumentInput {
+    readonly requestId: RecordsRequestId;
+    readonly file: FileHandle;
+    readonly onProgress?: (fraction: number) => void;
+    readonly signal?: AbortSignal;
+}
+interface RecordsController {
+    /** Create the self-upload request. Idempotent on `idempotencyKey`. Lands `awaiting_upload`. */
+    createUploadRequest(input: CreateUploadRequestInput): Promise<EverfurResult<RecordsRequestView>>;
+    /** Two-phase presigned upload of ONE document (§3.2). Bytes go DIRECT to S3. Resolves at `received`. */
+    uploadDocument(input: UploadDocumentInput): Promise<EverfurResult<UploadedDocument>>;
+    /** Poll one request's parse lifecycle. */
+    getRequest(id: RecordsRequestId): Promise<EverfurResult<RecordsRequestView>>;
+    /** All of this user's requests, newest-first (server-ordered). */
+    listRequests(): Promise<EverfurResult<readonly RecordsRequestView[]>>;
+    /** The parsed, partner-redacted record. Consent-gated + redaction-fail-closed. */
+    getRecord(pet: PetRef): Promise<EverfurResult<RecordsView>>;
+    /** Consent read-back. Never a hard failure for an absent row -> `granted:false`. */
+    getConsent(pet: PetRef): Promise<EverfurResult<ConsentState>>;
+    /** Grant content-exposure consent. Fail-closed audited server-side. Idempotent. */
+    grantConsent(input: GrantConsentInput): Promise<EverfurResult<ConsentState>>;
+    /** Revoke consent (prospective). Drops any cached record for the pet from memory. Idempotent. */
+    revokeConsent(pet: PetRef): Promise<EverfurResult<ConsentState>>;
+    /** The last record read for a pet, held in memory only; cleared on revoke. Null when none. */
+    peekCachedRecord(pet: PetRef): RecordsView | null;
+    /** Emit `records.capability.denied` (the rn CapabilityGate disabled surface calls this once, R12). */
+    reportCapabilityDenied(pet: PetRef | null): void;
+}
+
+type RecordsStatus = 'loading' | 'empty' | 'error' | 'populated';
+/** Why a picked file was not uploaded (the consumer picker's `PickSkipReason`): decided BEFORE any request is made. */
+type UploadSkipReason = 'too_large' | 'unsupported';
+/** One file of an upload batch, with its own lifecycle and progress (the consumer `UploadItem`). */
+interface UploadQueueItem {
+    /** Stable row key within the batch. */
+    readonly key: string;
+    /** The host's file name when it gave one; rendered locally, never sent. */
+    readonly name: string | null;
+    readonly status: 'queued' | 'uploading' | 'done' | 'failed' | 'skipped';
+    /** 0..1, monotonic while uploading; 1 once done. */
+    readonly progress: number;
+    readonly skipReason: UploadSkipReason | null;
+    readonly error: EverfurError | null;
+}
+interface UseEverfurRecordsState {
+    readonly status: RecordsStatus;
+    readonly record: RecordsView | null;
+    readonly requests: readonly RecordsRequestView[];
+    /** the most-recent request, whose timeline the populated state renders. */
+    readonly activeRequest: RecordsRequestView | null;
+    readonly consent: ConsentState | null;
+    readonly error: EverfurError | null;
+    /** drives the recovery affordance: consent CTA / establish-session CTA / disabled. */
+    readonly denialReason: RecordsDenialReason | null;
+    /** §5.1 fail-closed suppression: render the withheld notice, never empty, never raw. */
+    readonly withheld: boolean;
+    readonly isUploading: boolean;
+    readonly uploadProgress: number | null;
+    /** The files of the last pick, one row each, with per-file status and progress. Empty until a pick. */
+    readonly uploadQueue: readonly UploadQueueItem[];
+    /** Create a self-upload request the user attaches documents to. */
+    createRequest(idempotencyKey: string): Promise<EverfurResult<RecordsRequestView>>;
+    /** Two-phase presigned upload of one document to the active request. */
+    uploadDocument(requestId: RecordsRequestView['id'], file: FileHandle): Promise<EverfurResult<UploadedDocument>>;
+    /**
+     * Several documents in one pick: uploaded ONE AT A TIME (kinder to slow links), a live row per file, one failed
+     * file never aborts the rest (continue-on-error), and a non-PDF or oversize file is skipped with a reason before
+     * any request is created, so no quota is charged for it. Resolves with the settled rows.
+     */
+    uploadDocuments(requestId: RecordsRequestView['id'], files: readonly FileHandle[]): Promise<readonly UploadQueueItem[]>;
+    /** Grant content-exposure consent, then fetch the record. */
+    grantConsent(consentVersion: string, idempotencyKey: string): Promise<EverfurResult<ConsentState>>;
+    /** Revoke consent (prospective); drops the record from view. */
+    revokeConsent(): Promise<EverfurResult<ConsentState>>;
+    /** Re-run the surface fetch (error retry). */
+    refresh(): void;
+}
+declare function useEverfurRecords(opts: {
+    readonly petRef: PetRef;
+    /** Host/test seam: inject a controller directly instead of acquiring one from the runtime. */
+    readonly controller?: RecordsController;
+    /**
+     * The upload transport for this surface, overriding `EverfurConfig.uploadTransport`. The latest value is used
+     * at upload time, so a transport created inline on each render does not rebuild the controller.
+     */
+    readonly uploadTransport?: UploadTransport;
+}): UseEverfurRecordsState;
+
+interface UseRecordsMarkersState {
+    readonly status: RecordsDepthStatus;
+    readonly markers: RecordMarkersView | null;
+    /** False while the markers route is dark for the tenant: the markers surface is hidden, never an error. */
+    readonly available: boolean;
+    readonly error: EverfurError | null;
+    readonly refresh: () => void;
+}
+declare function useRecordsMarkers(petRef: PetRef): UseRecordsMarkersState;
+
+interface ShareRowView {
+    readonly shareId: string;
+    /** The link, when it was minted in this session (the list read never repeats a URL). */
+    readonly shareUrl: string | null;
+    readonly active: boolean;
+    /** `Active` or `Expired`: status as text, never colour alone. */
+    readonly statusLabel: string;
+    readonly expiryLabel: string;
+    readonly createdLabel: string | null;
+    readonly a11yLabel: string;
+    /** Disambiguating suffix for the row's spoken action labels. */
+    readonly actionContext: string;
+}
+
+type RecordSharesStatus = 'loading' | 'empty' | 'error' | 'populated';
+interface UseRecordSharesState {
+    readonly status: RecordSharesStatus;
+    readonly rows: readonly ShareRowView[];
+    /** True once a list read got an answer from behind the depth gate; false before that, after a read that never
+     * reached the server, and while the routes are dark. */
+    readonly available: boolean;
+    /**
+     * True once records consent for this pet is known to be withdrawn: a mint or an export answered the typed
+     * 409, or a withdrawal was made elsewhere in the app. The two consent-gated controls (create link, download
+     * PDF) go away while it holds; the LIST and the per-link revoke do not, because the server gates those on
+     * ownership alone so a member can still kill a link they no longer want live. `refresh()` clears it, which
+     * is the way back after the member allows records again.
+     */
+    readonly consentRequired: boolean;
+    readonly error: EverfurError | null;
+    readonly creating: boolean;
+    readonly revokingId: string | null;
+    readonly preparingPdf: boolean;
+    /** Mint a link; on success the list is re-read and the URL is remembered for its row. */
+    createLink(): Promise<EverfurResult<RecordShareLink>>;
+    revoke(shareId: string): Promise<EverfurResult<void>>;
+    /** The presigned PDF link the host opens itself. */
+    pdfLink(): Promise<EverfurResult<RecordPdfLink>>;
+    refresh(): void;
+}
+declare function useRecordShares(petRef: PetRef, opts?: {
+    readonly now?: () => number;
+}): UseRecordSharesState;
+interface UseRecordPdfLinkState {
+    readonly preparing: boolean;
+    /**
+     * True once the mount probe found the depth ROUTES lit; false before that, on the probe's dark 404, and when
+     * the probe never reached the server. It says nothing about whether the pet has a published record to export,
+     * which the same route's 404 also means: a surface that can see the record (the document screen does) must
+     * require that too before it draws a Download control.
+     */
+    readonly available: boolean;
+    readonly error: EverfurError | null;
+    pdfLink(): Promise<EverfurResult<RecordPdfLink>>;
+}
+/**
+ * The PDF link alone (the document screen's download control), without the share list read.
+ *
+ * `getPdfLink` answers ONE untyped 404 for two different states, and the guide says so
+ * (docs/partner-integration/09-GUIDE-RECORDS-AND-CONSENT.md): the tenant's depth switch is off, or the pet has
+ * no published record yet. The mount probe above already settled the first from a read behind the same
+ * router-level gate, so a 404 arriving HERE is the second, and folding it to `available:false` made the tap
+ * remove its own control and say nothing. It is a local, recoverable failure of one action: it sets `error`
+ * (every surface that draws the control has a line for it) and leaves `available` alone, so the control the
+ * member just pressed is still there. The honest answer to "is there a record to export" is the record read
+ * itself, which is why the document screen gates the control on the body it is already rendering.
+ */
+declare function useRecordPdfLink(petRef: PetRef): UseRecordPdfLinkState;
+
+/** Corrections and removals keyed by the row's `canonicalKey`. */
+interface FactOverlay {
+    readonly edits: Readonly<Record<string, string>>;
+    readonly removed: readonly string[];
+}
+/** The rows as the owner now sees them: a corrected value shows, a removed row is gone. Pure. */
+declare function applyFactOverlay(entities: readonly RecordEntity[], overlay: FactOverlay): readonly RecordEntity[];
+/** True when the row can be corrected: the wire gave it a stable key. */
+declare function isFactEditable(entity: Pick<RecordEntity, 'canonicalKey'>): boolean;
+interface UseRecordFactEditState {
+    readonly overlay: FactOverlay;
+    readonly busy: boolean;
+    /** The curated user-facing line of the last failure; null once a new write starts. */
+    readonly error: string | null;
+    /**
+     * Whether to offer the editor. The fact routes are their own feature flag and it defaults ON, so this is true
+     * from the first render and turns false only once a write has answered the dark 404 for this scope. There is
+     * no cheap read on these POST-only routes to probe with, and reading another feature's route instead is what
+     * made a tenant's share-links setting silently disable its fact editor.
+     */
+    readonly available: boolean;
+    /**
+     * Correct the row's displayed value. The wire key is the original value's typed slot (`value_num` for a number,
+     * `value_date`, `value_bool`, else `value_text`). Resolves the settled result; the overlay is already patched
+     * or rolled back.
+     */
+    edit(entity: RecordEntity, value: string): Promise<EverfurResult<void>>;
+    remove(entity: RecordEntity): Promise<EverfurResult<void>>;
+    clearError(): void;
+}
+declare function useRecordFactEdit(petRef: PetRef, opts?: {
+    readonly newIdempotencyKey?: () => string;
+}): UseRecordFactEditState;
+
+type RecordsEmptyVariant = 'idle' | 'error' | 'rate_limited' | 'service_unavailable' | 'no_requests' | 'no_records';
+
+/**
+ *   - `published`: STATE C, parsed lab markers are published (the donut and the trend cards render);
+ *   - `in_progress`: STATE B, a real request is mid-flight, driven solely by an actual request row;
+ *   - `none`: STATE A, no published markers and no live request: the actionable chooser.
+ */
+type RecordsDashboardState = 'published' | 'in_progress' | 'none';
+/**
+ * The request that drives a pet's dashboard state: a `published` one first (the owner keeps their data), else
+ * the most recently updated in-flight one, else null (only off-rail terminal requests, or none).
+ */
+declare function pickPetRecordsRequest(requests: readonly RecordsRequestView[], petRef: PetRef | null): RecordsRequestView | null;
+/**
+ * Derive the dashboard state from whether published markers exist and the pet's requests. A `published`
+ * request whose markers have not landed yet (eventual consistency) reads as in-progress, never a bare empty;
+ * a prior terminal request (revoked / failed) lands on STATE A so the owner can act again.
+ */
+declare function deriveRecordsDashboardState(args: {
+    readonly hasMarkers: boolean;
+    readonly requests: readonly RecordsRequestView[];
+    readonly petRef: PetRef | null;
+}): RecordsDashboardState;
+/** The six surfaces the dashboard body picks between, in the app's own branch order. */
+type RecordsDashboardView = 'loading' | 'record' | 'error' | 'in_progress' | 'none' | 'labs_only';
+interface RecordsDashboardInput {
+    /** The base records read (consent, requests, record) is still loading. */
+    readonly recordLoading: boolean;
+    /** The pet has a published, non-empty record. */
+    readonly hasFullRecord: boolean;
+    /** The base records read failed (any member of the error family). */
+    readonly recordError: boolean;
+    readonly markersLoading: boolean;
+    /** The markers read failed with a real error (a dark 404 is NOT an error: it is "no markers surface"). */
+    readonly markersError: boolean;
+    readonly hasMarkers: boolean;
+    readonly requestsLoading: boolean;
+    readonly dashboardState: RecordsDashboardState;
+    readonly drivingRequest: RecordsRequestView | null;
+}
+/** The branch order of RecordsDashboardScreen.tsx:238-419, as data. */
+declare function selectDashboardView(input: RecordsDashboardInput): RecordsDashboardView;
+
+/**
+ * The signed user's clinic request API. No prefetch, signature, consent, or outbound
+ * contact occurs on mount. The host presents backend-authored authorization copy
+ * and obtains the owner's explicit signature before calling createClinicRequest.
+ */
+declare function useEverfurRecordsClinic(): RecordsClinicController;
+/** The signed user's multi-clinic batch client, over the same auth and scope rules as `useEverfurRecordsClinic`. */
+declare function useEverfurRecordsClinicBatch(): RecordsClinicBatchClient;
+
+type RequestTimelineEventKey = 'requested' | 'sent_to_clinic' | 'awaiting_clinic' | 'awaiting_upload' | 'records_received' | 'processing' | 'parsing_failed' | 'manual_review' | 'ready' | 'delivery_failed' | 'processing_failed' | 'clinic_declined' | 'clinic_no_records' | 'no_response' | 'revoked';
+type RequestTimelineEventState = 'done' | 'current' | 'upcoming' | 'failed';
+interface RequestTimelineEvent {
+    readonly key: RequestTimelineEventKey;
+    /** Structural step title (not clinical/legal copy). */
+    readonly title: string;
+    /** Structural sub-detail (counts, dispatch substate) or null. */
+    readonly detail: string | null;
+    /** ISO timestamp when the request genuinely carries it, else null. */
+    readonly at: string | null;
+    readonly state: RequestTimelineEventState;
+}
+/** The step titles, verbatim: everfur-mobile-2026-7 src/features/records/lib/requestTimeline.ts `STAGE_TITLES`. */
+declare const REQUEST_TIMELINE_TITLES: Readonly<Record<RequestTimelineEventKey, string>>;
+/**
+ * Build the ordered step-wise timeline for a request. Pure + deterministic: states derive from the status,
+ * timestamps from the request's own fields. The terminal event (if any) is always last and carries state `failed`.
+ */
+declare function buildRequestTimeline(request: RecordsRequestView): readonly RequestTimelineEvent[];
+
+/**
+ * The card title: the clinic the request went to, else the consumer's own fallback by source
+ * (everfur-mobile-2026-7 src/features/records/ui/RecordsRequestScreen.tsx:97-100).
+ */
+declare function selectRequestTitle(request: RecordsRequestView): string;
+/**
+ * ALL of the member's requests for the pet, newest first (updatedAt, then createdAt), so the surface shows one
+ * step rail per request rather than only the newest. Frozen; the input is never reordered in place.
+ */
+declare function selectRequestList(requests: readonly RecordsRequestView[]): readonly RecordsRequestView[];
+/**
+ * The one BE-authored line a request card leads with: the consumer action-first sentence when the request needs
+ * the member (`actionNeededLabel`), else the status label. Never the raw status; empty when the server sent
+ * neither (the caller then renders no line).
+ */
+declare function selectPrimaryLabel(request: RecordsRequestView): string;
+interface ClinicCall {
+    /** The verified clinic number, trimmed, for display. */
+    readonly phone: string;
+    /** The `tel:` target: digits and a leading `+` only (the consumer app's own normalisation). */
+    readonly dial: string;
+    readonly clinicName: string | null;
+}
+/**
+ * The tap-to-call affordance, ONLY when the server gates it (`showClinicPhone`) AND supplies a number: the
+ * consumer app's `callPhone` rule (everfur-mobile-2026-7 src/features/records/ui/RecordsRequestScreen.tsx:205).
+ */
+declare function selectClinicCall(request: RecordsRequestView): ClinicCall | null;
+
+export { useEverfurRecords as A, useEverfurRecordsClinic as B, type ClinicCall as C, useEverfurRecordsClinicBatch as D, useRecordFactEdit as E, type FactOverlay as F, useRecordPdfLink as G, useRecordShares as H, useRecordsMarkers as I, type RecordsController as R, type ShareRowView as S, type UploadDocumentInput as U, REQUEST_TIMELINE_TITLES as a, type RecordSharesStatus as b, type RecordsDashboardState as c, type RecordsDashboardView as d, type RecordsEmptyVariant as e, type RecordsStatus as f, type RequestTimelineEvent as g, type RequestTimelineEventKey as h, type RequestTimelineEventState as i, type UploadQueueItem as j, type UploadSkipReason as k, type UseEverfurRecordsState as l, type UseRecordFactEditState as m, type UseRecordPdfLinkState as n, type UseRecordSharesState as o, type UseRecordsMarkersState as p, applyFactOverlay as q, buildRequestTimeline as r, deriveRecordsDashboardState as s, isFactEditable as t, pickPetRecordsRequest as u, selectClinicCall as v, selectDashboardView as w, selectPrimaryLabel as x, selectRequestList as y, selectRequestTitle as z };

package/dist/visitIntent-D7_yVp1I.d.cts

@@ -0,0 +1,8 @@
+/** What the hosted page opens for an existing visit, in EFBackend's order. `visit` is the default. */
+declare const VET_VISIT_INTENTS: readonly ["visit", "join", "summary", "messages"];
+/** One intent: the visit itself, its call, its summary, or its messages. */
+type VetVisitIntent = (typeof VET_VISIT_INTENTS)[number];
+/** True when `value` is one of the four intents. */
+declare function isVetVisitIntent(value: unknown): value is VetVisitIntent;
+
+export { type VetVisitIntent as V, VET_VISIT_INTENTS as a, isVetVisitIntent as i };

package/dist/visitIntent-D7_yVp1I.d.ts

@@ -0,0 +1,8 @@
+/** What the hosted page opens for an existing visit, in EFBackend's order. `visit` is the default. */
+declare const VET_VISIT_INTENTS: readonly ["visit", "join", "summary", "messages"];
+/** One intent: the visit itself, its call, its summary, or its messages. */
+type VetVisitIntent = (typeof VET_VISIT_INTENTS)[number];
+/** True when `value` is one of the four intents. */
+declare function isVetVisitIntent(value: unknown): value is VetVisitIntent;
+
+export { type VetVisitIntent as V, VET_VISIT_INTENTS as a, isVetVisitIntent as i };