@everfur/sdk 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -8,6 +8,226 @@ The line is deliberately pre-1.0: the API is stable enough to build against and
 is guarded by api-extractor golden reports across all eleven subpaths, but 1.0.0 is a promise about breaking
 changes that has not been earned by any production integration yet.
 
+## [Unreleased]
+
+## [0.5.1] - 2026-09-23
+
+Fixes from the partner end-to-end run of 2026-09-23 (a Vite React web app and an Expo app, built through the
+MCP planner, against staging). No public signature changes.
+
+### Fixed
+
+- **A partner member is told booking is paused, never that they need Pro.** On the partner plane the televet
+  entitlement read answers whether YOUR allowance is on, not whether the member has a plan. When it answered
+  `active: false` (allowance not set yet, suspended, set to 0 or used up) the booking flow opened, on both
+  platforms and from every vet entry, on "A Pro membership is needed to book a video visit.", with Close as the
+  only control. That state now renders what the unavailable branch renders: your `renderUnavailable` when you
+  pass one, else the paused card ("Booking is not available right now."). A 402 at Confirm joins the same state
+  instead of printing the membership sentence under Confirm. The test id `televet-booking-not-entitled` and the
+  optional "Check availability" escape are unchanged. The exported `TelevetEntitlementInterestState` draws the
+  paused card too. `confirmNotEntitled` stays in the copy deck and no screen renders it.
+- **Close on an untouched booking leaves without asking.** The auto-matched vet counted as an answer, so every
+  booking with a non-empty roster asked "Leave without booking? Your answers will not be saved." of a member who
+  had entered nothing. Typed text and a held slot still ask. Both platforms.
+- **A rate-limited televet read settles after one request.** The televet 429 names its wait as
+  `retry_after_seconds` in the body; the request funnel read only `resets_at`, so each such 429 was retried up to
+  the attempt ceiling against a window that could have minutes left. A numeric `retry_after_seconds` is now the
+  retry override, a wait past the retry budget settles on the first 429, and `televet_rate_limited` normalizes to
+  `rateLimited`. The visits list shows the server's own sentence for a rate limit instead of "Check your
+  connection and try again." (web), or under its title (React Native); no sentence is written by the SDK.
+- The upload progress line no longer reads "Uploading 2 of 1..." while the last file is being confirmed; the
+  counter is held to the total, on the card and in the queue's live region.
+- Web surfaces stop a host page's inherited `text-align` at their root. A stock Vite app's `#root` centers text,
+  which centered chat replies, the records timeline and the clinic request form. Chat, every records screen, the
+  clinic request composer, the booking flow, the visits list, the call and its lobby, the capability off-state
+  and the clinical disclaimer set `text-align: start` on their root; your `style` prop still wins.
+- The web full record's two header actions draw the consumer's icons (Feather `send` and `share-2`, as the
+  React Native SDK already does) instead of a rotated square and an empty circle. Their accessible names are
+  unchanged.
+- The web records entry's size line moves 90_300 -> 94_800 gzip bytes (measured 90_326, plus 5%): main held it
+  by 350 bytes and the icons (+290) with the text-align reset and the counter clamp (+86) crossed it by 26.
+  Every other entry holds its line on the same build.
+
+## [0.5.0] - 2026-09-23
+
+0.4.1 was tagged but never published to npm: its fixes (the five televet refusal screens and the rest
+listed under 0.4.1 below) ship in this release instead.
+
+### Changed: records keep the member inside your app, and the web records page is complete on its own
+
+**What an existing integration notices.** Nothing is removed and every signature still compiles, with the one
+exception in the first bullet. What changes is which edges a host navigator receives and where a URL goes when
+you pass no `onOpenUrl`.
+
+- `RecordsScreen` gains `requests` (the request list) and `RecordsUrlKind` gains `request_document` (web, one
+  uploaded request document). A `switch` over either that ends in an exhaustive `assertNever` stops compiling
+  until it handles the new member.
+- A host that routes the records screens itself (`onNavigate`) now receives edges it never received before:
+  `requests` from the React Native dashboard's new request-status card, and `clinicPicker` and `request` from
+  the web `EverfurRecordsPage` header and request rows. A router with no case for them leaves
+  those controls doing nothing, so add the cases (or pass no `onNavigate` on the web page, which then opens
+  every screen inside itself).
+- With no `onOpenUrl`, nothing opens a browser or a tab any more. React Native shares a share link through the
+  OS share sheet, and the record PDF's short-lived link the same way. The web shares a link with
+  `navigator.share`, else copies it, and saves the record PDF and an uploaded document in place. The web save
+  needs the API to sign those links as attachments (`response-content-disposition=attachment`); against an API
+  that does not yet, the save does not happen and the control shows its existing failure line, and it never
+  falls back to a tab.
+- The web `EverfurRecordsPage` is the default web records surface, and the hosted records frame serves it.
+  The React Native-shaped web `EverfurRecords` flow stays for existing embeds, and now moves focus to each new
+  screen's heading.
+- Frame mode: the loader's sandbox adds `allow-downloads` and it delegates `clipboard-write; web-share` (this
+  applies to the chat frame as well). The records frame document's policy adds the consent-signature bucket to
+  `connect-src` and `img-src` and the media bucket to `frame-src`. Your page's `frame-src` stays
+  `https://sdk.everfur.com`.
+
+### Changed: a vet visit opens INSIDE your app by default, on both platforms
+
+**The owner's decision of 2026-09-21: in-app is the default and the hosted redirect is an explicit opt-in.**
+`VetVisitButton`, `useVetVisit().open()` and `openVisit()`, and every vet entry inside `EverfurChat` (the header,
+the urgency pill, the vet-prep chip, the check-in) now resolve one destination, in order: the button's own
+`onStartInApp`, a presenter registered with `registerEverfurTelevetFlow`, else the in-app visit Everfur provides,
+rendered by the new `EverfurTelevetHost` (a full-screen `Modal` on React Native, a modal `<dialog>` in the SDK's own
+DOM subtree on the web). `VetVisitButton` and `EverfurChat` mount that host themselves. Nothing opens the system
+browser or a new tab unless the host passes `prefer="redirect"` (`prefer: 'redirect'` on the hook,
+`vetPrefer="redirect"` on chat), which keeps the 0.4.x handoff byte for byte.
+
+**Who is affected: every integration that registered nothing.** In 0.4.x a press with nothing registered minted a
+handoff and opened the hosted page; it now opens the in-app visit. An existing visit (`visitRef`, a tapped push)
+used to skip the registry and always go hosted; it now travels in the request (`request.visitRef`,
+`request.intent`) to the same destinations. A presenter may return `false` to decline a request it does not handle.
+`onStartInApp` now receives the request.
+
+**The screens load on demand.** The booking flow is loaded through a dynamic import of
+`@everfur/sdk/televet/booking` (`@everfur/sdk/web/televet/booking`) on the first press, and the call through
+`@everfur/sdk/televet/call` (`@everfur/sdk/web/televet/call`) only when a visit is joined (ruling R11). On the web
+the partner's bundler splits both into their own chunks. On React Native, Metro bundles what is reachable, so the
+booking screens are now part of any app that renders `VetVisitButton` or `EverfurChat`.
+
+### Added
+
+- `TelevetBookingController.listConsults`, `getConsult`, `joinConsult` and `cancelConsult`, the clients for the
+  served partner routes the SDK had none for (`GET /widget/v1/televet/consults`, `GET .../consults/{id}`,
+  `POST .../consults/{id}/join`, `POST .../consults/{id}/cancel`). The join answers the room credential
+  (`VetCallCredential`: room, token, `recordingNotice`, `callLimits`) with one attempt and no idempotency key.
+- The `call` screen of `EverfurTelevet`, `TelevetJoinScreen`, `televetScreenForRequest`, `EverfurTelevetModal` /
+  `EverfurTelevetDialog`, `useTelevetJoin`.
+- **The member's visits, in the app.** `EverfurTelevet` now lands on `home`: the member's visits when one is still
+  ahead, otherwise the booking. React Native ports the consumer mobile app's history and visit screens
+  (`TelevetVisitsScreen`, `TelevetConsultScreen`: the time, the vet, a Join that arms on the join window,
+  Reschedule, Cancel with the served terms and the server's receipt). The web ports the consumer web app's list
+  (`TelevetVisitsScreen`, `TelevetCancelVisitForm`), with Join, Reschedule and Cancel on each row. A reminder's
+  `visitRef` opens the visits. `TelevetConsult.hasRoom`; `splitTelevetVisits`, `televetJoinReadiness`,
+  `televetJoinDecision`, `canManageTelevetVisit`.
+- **The emergency warning's ways out** (`TelevetEmergencyExits`), on both places the warning appears: the pet's
+  clinic (`primaryVet`) and the host's locator (`onFindEmergencyVet`, new). `primaryVet`, `onFindEmergencyVet`
+  and `onTriageReason` now pass through `EverfurTelevet`. The consumer web's ASPCA Animal Poison Control card is
+  built but not drawn until the owner approves its number and its "a fee may apply" line for partner pages; a
+  web warning with no card on screen reads the lede that points at no list.
+- **React Native call controls are glyphs**, with Switch camera (the module's `cycleCamera`; the self-view is
+  mirrored only for the front lens) and the speaker route (`setNativeInCallAudioMode`), each drawn only when the
+  native module has the method.
+- The recording notice (D8) in `EverfurVetCall` on both platforms, before the room, every mount, with no prop to
+  skip it: no call object or frame exists until the member continues.
+
+### Changed: the web booking is the consumer web app's funnel
+
+The web booking was a DOM port of the React Native flow in the mobile deck's words. It now draws the consumer web
+funnel: a text Back, a bar of eight segments and an x, a centred heading per step, a main-issues step before the
+description (the reason the vet reads is the chips and the words), and the web app's own strings through a web
+deck (`TELEVET_BOOKING_COPY_WEB`): "Type to the vet what you're seeing", "Which vet would you like to see?",
+"Pick a date and time", "Does this look right?", "You're booked with {vet}", "Add to Calendar". React Native is
+unchanged except that its describe heading takes the mobile app's current "Tell the vet what you are seeing".
+
+### Changed: chat citation sources stay in your app, and chat reads like Everfur's own apps
+
+- **Citation sources no longer leave the app by default, on either platform.** Without a host opener a source card
+  is the read-only card (title, meta line, excerpt; no link). `EverfurChat` takes `onOpenUrl(url, 'citation')`,
+  the same shape as records, called through the host-callback guard. **Who is affected:** an integration that relied
+  on sources opening a browser or a new tab must now pass an opener, for example `(url) => Linking.openURL(url)` or
+  `(url) => { window.open(url, '_blank', 'noopener'); }`. The CDN frame draws the read-only card, since its sandbox
+  has no `allow-popups`.
+- **The web chat lays out by its own box, not the viewport**, like the consumer web app: history is a brand rail at
+  800px and wider, the web app's drawer below that (scrim, focus trap, Escape, focus return); the thread and
+  composer keep a centred 768px column; at 1024px and wider the conversation type steps from 15/22 to 17/28. New
+  optional `headingLevel` (web, default 2) for the empty-state title.
+- **A keyboard focus ring the host page cannot remove:** drawn inline on keyboard focus in the theme's ink, so a
+  host `button:focus { outline: none }` reset no longer leaves chat controls without one.
+- **React Native touch targets reach 44pt:** `PressScale` defaults to the consumer's 12pt hit slop; a caller's own
+  slop still wins.
+- **Check-ins follow the consumer rule:** only the newest ask per case is live, and a re-ask after a SAME answer is
+  no longer locked behind the case's previous answer. `ChatCheckin.openedAt`, `WatchCase.checkinAskCount` and
+  `WatchCase.checkinAnswerCount` are new, optional and additive.
+- **Theme:** the resolver guarantees `brandBorderStrong` reads 3:1 on every ground a control sits on, pushing a
+  partner brand that does not; the uploading wash and the starter chip edge now follow the partner's theme.
+- The composer placeholder is the consumer apps' own `Ask me anything!`.
+- Docs: brightness is light by default and `'auto'` opts in to the OS setting; the docs previously said the reverse.
+
+### Breaking
+
+- `TelevetConsult` gained a REQUIRED `hasRoom` (from `meeting_url`). A host that builds a `TelevetConsult` by hand,
+  for example for `EverfurTelevetReschedule`'s `consult`, must now set it.
+- The `TelevetScreen` and `TelevetBookingStep` unions widened (`home`, `visits`, `consult` on React Native, `call`,
+  `visit`; `issues` on the web booking). An exhaustive `switch` over either stops compiling until it handles them.
+- `EverfurTelevet`'s default root moved from the booking to `home`: every opening reads `GET /consults` once, and
+  lands on the visits instead of the booking when one is ahead. Pass `initialScreen={{ name: 'booking' }}` for the
+  old behaviour.
+
+### Fixed
+
+- The landing is held for the whole opening: Back from a visit the member cancelled, or out of a call that ended,
+  returns to the visits. It used to read the list again and drop the member into a new booking.
+- On React Native, Android's back press during a call no longer reaches a partner's own navigator (the
+  `registerEverfurTelevetFlow` path), which popped the screen and hung up on the vet. Before the call runs it is
+  Leave, as it is inside the SDK's modal.
+- A React Native visits list that fails to load still offers the booking beneath the retry, as the vet home does.
+- The React Native speaker toggle asks the native module once per press; it used to ask from inside a state
+  updater, which StrictMode runs twice in development.
+- Web a11y: a dark Join names its reason through `aria-describedby`, and the emergency primary-vet hint takes a
+  `useId` id, so two warnings on one page no longer share one.
+- The React Native location card no longer tells the member to "Turn on location for Everfur" when the host gave
+  the booking no way to resolve one; the developer is told which prop is missing.
+- The chat vet entries honour a registered flow in the PUBLISHED package: the registry lives on a `globalThis`
+  slot, so `@everfur/sdk/chat` and `@everfur/sdk/televet` (and their web twins) read one presenter instead of two
+  private copies.
+- A dark booking plane (the partner booking routes answering 404) shows the paused state inside the app. It used to
+  read the entitlement 404 as "not entitled" and show "A Pro membership is needed to book a video visit." to a
+  member whose tenant pays, and its unavailable fallback rendered `VetVisitButton`, which re-presented the same flow
+  when one was registered and left the app when none was.
+- The React Native lobby waits on the vet's PRESENCE, not their video track: a vet with the camera off no longer
+  leaves the member on "Your vet is joining", and turning the camera off mid-call no longer throws the member back
+  to the lobby. The self-view reads "Your camera is off" rather than the control's "Camera on".
+- The route table and `MockTransport` treat the served booking routes, the join route, the pet profile and the
+  embed config as served.
+
+## [0.4.1] - 2026-09-23
+
+### Fixed
+
+- Televet booking carries the five refusal screens the consumer mobile app has and this package did
+  not: the early-emergency interstitial, the empty clinician roster, the unentitled state, the
+  unserved-state action and the refused-attachment notice. The funnel matched already; the refusals
+  did not exist, so a partner's member who described something urgent, or whose state is not served,
+  saw something Everfur's own app does not show. Both platforms, with the triggers and the copy in
+  the shared react layer so the two cannot drift.
+- The two televet booking size gates are re-measured on a clean tree, which both of their notes had asked
+  for: the previous lines were taken from a tree holding other lanes' uncommitted work. The web booking entry
+  moves 37_300 -> 42_600 (measured 40_560) and the React Native booking closure 35_600 -> 39_600 (measured
+  37_694), each the measured size plus 5%. Only the booking lines moved: the visit-button entry, the call
+  entry, chat, records and every other closure hold their existing budgets on the same build, and the
+  structural checks still prove no foreign capability entered the closure.
+- A televet parity guard now derives the mobile component set from the real everfur-mobile checkout
+  and fails by name when a screen is missing. Chat, records and the theme tokens each had such a
+  guard; televet did not, which is how five screens stayed absent while parity read as verified.
+- `TelevetBookingFailure` is published as its real union again on both `televet/booking` and
+  `web/televet/booking`. It had degraded to an opaque alias (`TelevetBookingFailure_2`) with its seven
+  members and their per-member documentation stripped from the generated `.d.ts`, so a partner's editor
+  could not tell which failures exist or which of them a retry can fix. The containers now re-export the
+  declaration rather than aliasing it.
+- Imports the five-refusal-screen change left behind are removed from the two booking containers, the two
+  step files and the two review steps. Nothing rendered changed: every symbol was already used at the file
+  the code moved into, which is why the screens themselves were unaffected.
+
 ## [0.4.0] - 2026-09-21
 
 ### Changed: a press of `VetVisitButton` opens the visit IN YOUR APP, not the system browser

package/README.md

@@ -71,12 +71,13 @@ Two ways, one wire contract, documented in
 
 Chat and records are the web surfaces (records on its own subpath and its own frame document, available
 when Everfur enables records for your account); photo and video remain React Native for now. Vet visits (not yet enabled)
-have their own entry on both hosts, `@everfur/sdk/web/televet` and `@everfur/sdk/televet`, and the video call
-rendered inside your own app has an entry again beneath each, `@everfur/sdk/web/televet/call` and
-`@everfur/sdk/televet/call`, so a partner mounting only the visit button takes no WebRTC dependency. Booking
-the visit inside your own React Native app, rather than handing off to the hosted one, is a third entry,
-`@everfur/sdk/televet/booking`, split out for the same reason: a partner that mounts only the button never
-downloads a scheduler it does not render.
+have their own entry on both hosts, `@everfur/sdk/web/televet` and `@everfur/sdk/televet`, and a visit opens
+INSIDE your app by default: booking, the confirmation and the call run in an Everfur modal (React Native) or
+dialog (web) that `VetVisitButton` and `EverfurChat` mount themselves; the hosted page is an explicit opt-in,
+`prefer="redirect"`. The booking screens (`@everfur/sdk/televet/booking`, `@everfur/sdk/web/televet/booking`)
+and the call (`@everfur/sdk/televet/call`, `@everfur/sdk/web/televet/call`) are their own entries, loaded on
+demand, so a page where nobody opens a visit downloads neither and a page where nobody joins takes no WebRTC
+dependency.
 [docs/partner-integration/16-TELEVET-VISITS.md](docs/partner-integration/16-TELEVET-VISITS.md).
 
 ## Quickstart
@@ -177,13 +178,13 @@ off-state, never a blank region.
 | Import | Contents |
 | --- | --- |
 | `@everfur/sdk` | `EverfurProvider`, `CapabilityGate`, `EverfurChat`, `useEverfurChat`, `CapabilityName`, error/result types, branded id helpers (`petRef`, `userRef`, `conversationId`) |
-| `@everfur/sdk/records` | `EverfurRecords`, `EverfurClinicRequest`, `EverfurClinicRequestBatch`, `SignaturePad`, records hooks + types |
+| `@everfur/sdk/records` | `EverfurRecords` (the Everfur app's records flow), the named screens (`EverfurRecordsUpload`, `EverfurRecordsRequests`, `EverfurRecordsRequest`, `EverfurRecordDetail`, ...), `EverfurClinicRequest`, `EverfurClinicRequestBatch`, `SignaturePad`, records hooks + types |
 | `@everfur/sdk/records/depth`, `@everfur/sdk/web/records/depth` | record depth (the timeline, the withheld record sections, per-document contributions) on their own entries, dark until Everfur enables it per deployment; see [chapter 9](docs/partner-integration/09-GUIDE-RECORDS-AND-CONSENT.md#record-depth-behind-a-separate-switch) |
 | `@everfur/sdk/video` | gait / live-scan surface |
 | `@everfur/sdk/photo` | photo checkup surface |
 | `@everfur/sdk/animations` | server-driven pet-state media surface |
 | `@everfur/sdk/web` | the browser entry: `EverfurProvider`, `CapabilityGate`, `EverfurChat`, `useEverfurChat`, the theme hook, rendered with `react-dom`; withheld from React Native bundles the way `./server` is |
-| `@everfur/sdk/web/records` | records for a browser host: `EverfurRecords`, `useEverfurRecords`, `createWebRecordsUploadTransport`, `fileToHandle`; its own entry, withheld from React Native like `./web`; available when Everfur enables records for the account. Frame mode serves it with `surface: 'records'` (see [chapter 13](docs/partner-integration/13-WEB-INTEGRATION.md)) |
+| `@everfur/sdk/web/records` | records for a browser host: `EverfurRecordsPage` (the Everfur web app's records page, complete on its own: request from a clinic, upload, request status, the full record with vaccinations, all inside your page), the named screens, `EverfurRecords` (the React Native-shaped flow), `useEverfurRecords`, `createWebRecordsUploadTransport`, `fileToHandle`; its own entry, withheld from React Native like `./web`; available when Everfur enables records for the account. Frame mode serves it with `surface: 'records'` (see [chapter 13](docs/partner-integration/13-WEB-INTEGRATION.md)) |
 | `@everfur/sdk/server` | **server-only** `mintPartnerSession` (no React Native resolution; never bundled on-device) |
 | `@everfur/sdk/server/events` | **server-only, Node only** partner events (preview): `constructEvent` to verify webhooks, `sendPartnerEvent`; see [chapter 15](docs/partner-integration/15-EVENTS-AND-WEBHOOKS.md) |
 | `@everfur/sdk/testing`, `@everfur/sdk/testing/rn`, `@everfur/sdk/testing/web` | test seams (`MockTransport`, `useEverfurTestEntitlements`, ...) for your own tests |

package/dist/{Chat-BZZ-Py5l.d.ts → Chat-Rzplrf5M.d.ts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.js';
 import { F as FileHandle } from './ports-BN6RHF9W.js';
-import { a as ChatCheckinTarget } from './ports-D7YW8qz9.js';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-Bk6GDwLs.js';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-BrUWQYNK.js';
+import { a as ChatCheckinTarget } from './ports-C0m1G1fS.js';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-DhsX3GLw.js';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-CzZ7in24.js';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';
@@ -118,6 +118,20 @@ interface EverfurChatProps {
      * is available there, so it is never offered to someone who could not book.
      */
     readonly vetUsState?: string;
+    /**
+     * Where every vet entry inside chat takes the member. Defaults to `'in-app'`: your registered presenter
+     * (`registerEverfurTelevetFlow`), else the in-app visit Everfur provides, which this surface mounts itself.
+     * `'redirect'` is the explicit opt-in to the hosted Everfur visit in the browser.
+     */
+    readonly vetPrefer?: 'in-app' | 'redirect';
+    /**
+     * Your opener for a web page chat links to: today, the source page behind a card in an answer's sources
+     * deck (`kind` `'citation'`, always an https URL). Absent (the default), a source card is read-only: its
+     * title, meta line and excerpt show, and nothing takes the member out of your app. Given, the card is a link
+     * and a tap goes here, so you can show the page in your own in-app browser; pass
+     * `(url) => Linking.openURL(url)` for the Everfur app's system browser. A throw or a rejection is contained.
+     */
+    readonly onOpenUrl?: (url: string, kind: 'citation') => void | Promise<void>;
 }
 /**
  * Entitlement-gated, four-state chat surface. Entitlement-OFF renders the CapabilityGate OffState;

package/dist/{Chat-Dq4fffIO.d.cts → Chat-ypo6miKm.d.cts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.cjs';
 import { F as FileHandle } from './ports-BN6RHF9W.cjs';
-import { a as ChatCheckinTarget } from './ports-BY2ph0_y.cjs';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-B_gKbAzJ.cjs';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-D_SECjr1.cjs';
+import { a as ChatCheckinTarget } from './ports-DNXyyzZF.cjs';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-D1bnxDZg.cjs';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-CwsR-bPN.cjs';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';
@@ -118,6 +118,20 @@ interface EverfurChatProps {
      * is available there, so it is never offered to someone who could not book.
      */
     readonly vetUsState?: string;
+    /**
+     * Where every vet entry inside chat takes the member. Defaults to `'in-app'`: your registered presenter
+     * (`registerEverfurTelevetFlow`), else the in-app visit Everfur provides, which this surface mounts itself.
+     * `'redirect'` is the explicit opt-in to the hosted Everfur visit in the browser.
+     */
+    readonly vetPrefer?: 'in-app' | 'redirect';
+    /**
+     * Your opener for a web page chat links to: today, the source page behind a card in an answer's sources
+     * deck (`kind` `'citation'`, always an https URL). Absent (the default), a source card is read-only: its
+     * title, meta line and excerpt show, and nothing takes the member out of your app. Given, the card is a link
+     * and a tap goes here, so you can show the page in your own in-app browser; pass
+     * `(url) => Linking.openURL(url)` for the Everfur app's system browser. A throw or a rejection is contained.
+     */
+    readonly onOpenUrl?: (url: string, kind: 'citation') => void | Promise<void>;
 }
 /**
  * Entitlement-gated, four-state chat surface. Entitlement-OFF renders the CapabilityGate OffState;

package/dist/{DepthViews-BG3E25MD.d.ts → DepthViews-CeTfPUBX.d.ts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-crhBllQK.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth--ObtMyjH.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;

package/dist/{DepthViews-B_hIypI6.d.cts → DepthViews-ClykXOJj.d.cts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-C6rjEaLn.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-B35y8bV-.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{DepthViews-CL75jyRA.d.cts → DepthViews-Cui3oonj.d.cts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-C6rjEaLn.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-B35y8bV-.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;

package/dist/{DepthViews-CkYri51q.d.ts → DepthViews-baYLMNQ-.d.ts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-crhBllQK.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth--ObtMyjH.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{ErrorPolicyPort-CwbfmxzJ.d.ts → ErrorPolicyPort-D22LUVrK.d.ts}

@@ -1,4 +1,4 @@
-import { b as EverfurErrorCode, E as EverfurError } from './EverfurResult-DN9pL2Ab.js';
+import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-DmELDpXp.js';
 
 /**
  * Recovery policy. A host may narrow retry ceilings (e.g. a metered plan) but can never widen the SDK's

package/dist/{ErrorPolicyPort-CNf4uQZP.d.cts → ErrorPolicyPort-D6CybiqJ.d.cts}

@@ -1,4 +1,4 @@
-import { b as EverfurErrorCode, E as EverfurError } from './EverfurResult-DN9pL2Ab.cjs';
+import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-DmELDpXp.cjs';
 
 /**
  * Recovery policy. A host may narrow retry ceilings (e.g. a metered plan) but can never widen the SDK's

package/dist/{EverfurResult-DN9pL2Ab.d.cts → EverfurError-DmELDpXp.d.cts}

@@ -172,70 +172,4 @@ interface MakeEverfurErrorOptions {
 }
 declare function makeEverfurError(code: EverfurErrorCode, opts?: MakeEverfurErrorOptions): EverfurError;
 
-/**
- * The settle type. An async public operation returns this instead of throwing for an EXPECTED failure.
- * A successful result may carry a non-fatal `warning` (e.g. served-stale, degraded path).
- */
-type EverfurResult<T> = {
-    readonly ok: true;
-    readonly value: T;
-    readonly warning?: EverfurError;
-} | {
-    readonly ok: false;
-    readonly error: EverfurError;
-};
-/** Construct a success result. Frozen, public state is immutable end to end. */
-declare function ok<T>(value: T, warning?: EverfurError): EverfurResult<T>;
-/** Construct a failure result. Frozen. */
-declare function err<T = never>(error: EverfurError): EverfurResult<T>;
-/** Narrowing guard: true iff the result is a success. */
-declare function isOk<T>(r: EverfurResult<T>): r is {
-    readonly ok: true;
-    readonly value: T;
-    readonly warning?: EverfurError;
-};
-/** Narrowing guard: true iff the result is a failure. */
-declare function isErr<T>(r: EverfurResult<T>): r is {
-    readonly ok: false;
-    readonly error: EverfurError;
-};
-/**
- * The real `Error` subclass `unwrap` throws, so an imperative call site that lets the throw escape
- * produces a proper Error rather than a bare object (which a crash reporter files as
- * "Non-Error exception captured", with no stack and no grouping).
- *
- * `message` is built from the normalized `code` and the frozen, product-owned `displayMessage` ONLY.
- * The untrusted `wireMessage` is deliberately NOT in it: `message` is the one field every telemetry
- * vendor captures and indexes by default, so putting wire text there would make an untrusted,
- * healthcare-adjacent string flow automatically into a partner's third-party tooling. The full
- * `EverfurError` hangs off `.error`, where `wireMessage` and `raw` remain non-enumerable.
- */
-declare class EverfurThrownError extends Error {
-    /** The settled error this was thrown from. Its `wireMessage` / `raw` stay non-enumerable. */
-    readonly error: EverfurError;
-    /** Mirror of `error.code`, so a catch block can branch without reaching through `.error`. */
-    readonly code: EverfurError['code'];
-    /** Mirror of `error.category`, the coarse branching axis. */
-    readonly category: EverfurError['category'];
-    constructor(error: EverfurError);
-}
-/**
- * Escape hatch for imperative callers: return the value or throw. The throw is an `EverfurThrownError`
- * (a real `Error`, safe message); the settled `EverfurError` is on its `.error`.
- * Prefer pattern-matching on `ok`; `unwrap` exists for call sites that want the throw.
- */
-declare function unwrap<T>(r: EverfurResult<T>): T;
-/**
- * Thrown SYNCHRONOUSLY for programmer error ONLY, never for a network or domain failure.
- * Mirrors Flutter `_requireInitialized` (a real guard, not an assert).
- *
- *  - `not-initialized`    , a capability used before EverfurProvider mounted / init ran.
- *  - `invalid-argument`   , a malformed id or option shape (e.g. a non-UUID conversation id).
- *  - `missing-peer-dependency`, a capability subpath used without its required native peer dep.
- */
-declare class EverfurConfigError extends Error {
-    readonly kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency';
-    constructor(kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency', message: string);
-}
-
-export { AUTO_RETRYABLE_CODES as A, BACKOFF_BASE_MS as B, type EverfurError as E, MAX_RETRY_ATTEMPTS as M, RETRYABLE_CONTRACT_CODES as R, type EverfurErrorCategory as a, type EverfurErrorCode as b, type EverfurResult as c, EverfurConfigError as d, EverfurThrownError as e, categoryFor as f, isOk as g, isRetryableCode as h, isErr as i, userFacingError as j, BACKOFF_CAP_MS as k, EVERFUR_ERROR_CATEGORIES as l, EVERFUR_ERROR_CODES as m, type MakeEverfurErrorOptions as n, backoffDelayMs as o, canRecreateOnNotFound as p, err as q, fromHttpStatus as r, fromWire as s, isAutoRetryable as t, unwrap as u, makeEverfurError as v, ok as w, shouldRetry as x };
+export { AUTO_RETRYABLE_CODES as A, BACKOFF_BASE_MS as B, type EverfurError as E, MAX_RETRY_ATTEMPTS as M, RETRYABLE_CONTRACT_CODES as R, type EverfurErrorCategory as a, type EverfurErrorCode as b, categoryFor as c, BACKOFF_CAP_MS as d, EVERFUR_ERROR_CATEGORIES as e, EVERFUR_ERROR_CODES as f, type MakeEverfurErrorOptions as g, backoffDelayMs as h, isRetryableCode as i, canRecreateOnNotFound as j, fromHttpStatus as k, fromWire as l, isAutoRetryable as m, makeEverfurError as n, shouldRetry as s, userFacingError as u };

package/dist/{EverfurResult-DN9pL2Ab.d.ts → EverfurError-DmELDpXp.d.ts}

@@ -172,70 +172,4 @@ interface MakeEverfurErrorOptions {
 }
 declare function makeEverfurError(code: EverfurErrorCode, opts?: MakeEverfurErrorOptions): EverfurError;
 
-/**
- * The settle type. An async public operation returns this instead of throwing for an EXPECTED failure.
- * A successful result may carry a non-fatal `warning` (e.g. served-stale, degraded path).
- */
-type EverfurResult<T> = {
-    readonly ok: true;
-    readonly value: T;
-    readonly warning?: EverfurError;
-} | {
-    readonly ok: false;
-    readonly error: EverfurError;
-};
-/** Construct a success result. Frozen, public state is immutable end to end. */
-declare function ok<T>(value: T, warning?: EverfurError): EverfurResult<T>;
-/** Construct a failure result. Frozen. */
-declare function err<T = never>(error: EverfurError): EverfurResult<T>;
-/** Narrowing guard: true iff the result is a success. */
-declare function isOk<T>(r: EverfurResult<T>): r is {
-    readonly ok: true;
-    readonly value: T;
-    readonly warning?: EverfurError;
-};
-/** Narrowing guard: true iff the result is a failure. */
-declare function isErr<T>(r: EverfurResult<T>): r is {
-    readonly ok: false;
-    readonly error: EverfurError;
-};
-/**
- * The real `Error` subclass `unwrap` throws, so an imperative call site that lets the throw escape
- * produces a proper Error rather than a bare object (which a crash reporter files as
- * "Non-Error exception captured", with no stack and no grouping).
- *
- * `message` is built from the normalized `code` and the frozen, product-owned `displayMessage` ONLY.
- * The untrusted `wireMessage` is deliberately NOT in it: `message` is the one field every telemetry
- * vendor captures and indexes by default, so putting wire text there would make an untrusted,
- * healthcare-adjacent string flow automatically into a partner's third-party tooling. The full
- * `EverfurError` hangs off `.error`, where `wireMessage` and `raw` remain non-enumerable.
- */
-declare class EverfurThrownError extends Error {
-    /** The settled error this was thrown from. Its `wireMessage` / `raw` stay non-enumerable. */
-    readonly error: EverfurError;
-    /** Mirror of `error.code`, so a catch block can branch without reaching through `.error`. */
-    readonly code: EverfurError['code'];
-    /** Mirror of `error.category`, the coarse branching axis. */
-    readonly category: EverfurError['category'];
-    constructor(error: EverfurError);
-}
-/**
- * Escape hatch for imperative callers: return the value or throw. The throw is an `EverfurThrownError`
- * (a real `Error`, safe message); the settled `EverfurError` is on its `.error`.
- * Prefer pattern-matching on `ok`; `unwrap` exists for call sites that want the throw.
- */
-declare function unwrap<T>(r: EverfurResult<T>): T;
-/**
- * Thrown SYNCHRONOUSLY for programmer error ONLY, never for a network or domain failure.
- * Mirrors Flutter `_requireInitialized` (a real guard, not an assert).
- *
- *  - `not-initialized`    , a capability used before EverfurProvider mounted / init ran.
- *  - `invalid-argument`   , a malformed id or option shape (e.g. a non-UUID conversation id).
- *  - `missing-peer-dependency`, a capability subpath used without its required native peer dep.
- */
-declare class EverfurConfigError extends Error {
-    readonly kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency';
-    constructor(kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency', message: string);
-}
-
-export { AUTO_RETRYABLE_CODES as A, BACKOFF_BASE_MS as B, type EverfurError as E, MAX_RETRY_ATTEMPTS as M, RETRYABLE_CONTRACT_CODES as R, type EverfurErrorCategory as a, type EverfurErrorCode as b, type EverfurResult as c, EverfurConfigError as d, EverfurThrownError as e, categoryFor as f, isOk as g, isRetryableCode as h, isErr as i, userFacingError as j, BACKOFF_CAP_MS as k, EVERFUR_ERROR_CATEGORIES as l, EVERFUR_ERROR_CODES as m, type MakeEverfurErrorOptions as n, backoffDelayMs as o, canRecreateOnNotFound as p, err as q, fromHttpStatus as r, fromWire as s, isAutoRetryable as t, unwrap as u, makeEverfurError as v, ok as w, shouldRetry as x };
+export { AUTO_RETRYABLE_CODES as A, BACKOFF_BASE_MS as B, type EverfurError as E, MAX_RETRY_ATTEMPTS as M, RETRYABLE_CONTRACT_CODES as R, type EverfurErrorCategory as a, type EverfurErrorCode as b, categoryFor as c, BACKOFF_CAP_MS as d, EVERFUR_ERROR_CATEGORIES as e, EVERFUR_ERROR_CODES as f, type MakeEverfurErrorOptions as g, backoffDelayMs as h, isRetryableCode as i, canRecreateOnNotFound as j, fromHttpStatus as k, fromWire as l, isAutoRetryable as m, makeEverfurError as n, shouldRetry as s, userFacingError as u };

package/dist/EverfurResult-SGvHKsCB.d.ts

@@ -0,0 +1,69 @@
+import { E as EverfurError } from './EverfurError-DmELDpXp.js';
+
+/**
+ * The settle type. An async public operation returns this instead of throwing for an EXPECTED failure.
+ * A successful result may carry a non-fatal `warning` (e.g. served-stale, degraded path).
+ */
+type EverfurResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+    readonly warning?: EverfurError;
+} | {
+    readonly ok: false;
+    readonly error: EverfurError;
+};
+/** Construct a success result. Frozen, public state is immutable end to end. */
+declare function ok<T>(value: T, warning?: EverfurError): EverfurResult<T>;
+/** Construct a failure result. Frozen. */
+declare function err<T = never>(error: EverfurError): EverfurResult<T>;
+/** Narrowing guard: true iff the result is a success. */
+declare function isOk<T>(r: EverfurResult<T>): r is {
+    readonly ok: true;
+    readonly value: T;
+    readonly warning?: EverfurError;
+};
+/** Narrowing guard: true iff the result is a failure. */
+declare function isErr<T>(r: EverfurResult<T>): r is {
+    readonly ok: false;
+    readonly error: EverfurError;
+};
+/**
+ * The real `Error` subclass `unwrap` throws, so an imperative call site that lets the throw escape
+ * produces a proper Error rather than a bare object (which a crash reporter files as
+ * "Non-Error exception captured", with no stack and no grouping).
+ *
+ * `message` is built from the normalized `code` and the frozen, product-owned `displayMessage` ONLY.
+ * The untrusted `wireMessage` is deliberately NOT in it: `message` is the one field every telemetry
+ * vendor captures and indexes by default, so putting wire text there would make an untrusted,
+ * healthcare-adjacent string flow automatically into a partner's third-party tooling. The full
+ * `EverfurError` hangs off `.error`, where `wireMessage` and `raw` remain non-enumerable.
+ */
+declare class EverfurThrownError extends Error {
+    /** The settled error this was thrown from. Its `wireMessage` / `raw` stay non-enumerable. */
+    readonly error: EverfurError;
+    /** Mirror of `error.code`, so a catch block can branch without reaching through `.error`. */
+    readonly code: EverfurError['code'];
+    /** Mirror of `error.category`, the coarse branching axis. */
+    readonly category: EverfurError['category'];
+    constructor(error: EverfurError);
+}
+/**
+ * Escape hatch for imperative callers: return the value or throw. The throw is an `EverfurThrownError`
+ * (a real `Error`, safe message); the settled `EverfurError` is on its `.error`.
+ * Prefer pattern-matching on `ok`; `unwrap` exists for call sites that want the throw.
+ */
+declare function unwrap<T>(r: EverfurResult<T>): T;
+/**
+ * Thrown SYNCHRONOUSLY for programmer error ONLY, never for a network or domain failure.
+ * Mirrors Flutter `_requireInitialized` (a real guard, not an assert).
+ *
+ *  - `not-initialized`    , a capability used before EverfurProvider mounted / init ran.
+ *  - `invalid-argument`   , a malformed id or option shape (e.g. a non-UUID conversation id).
+ *  - `missing-peer-dependency`, a capability subpath used without its required native peer dep.
+ */
+declare class EverfurConfigError extends Error {
+    readonly kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency';
+    constructor(kind: 'not-initialized' | 'invalid-argument' | 'missing-peer-dependency', message: string);
+}
+
+export { type EverfurResult as E, EverfurConfigError as a, EverfurThrownError as b, isOk as c, err as e, isErr as i, ok as o, unwrap as u };