@everfur/sdk 0.4.0 → 0.5.1

package/dist/branding-Xb_wL8N1.d.cts

@@ -0,0 +1,212 @@
+import { c as EverfurThemeSlotName, b as EverfurFontFaceKey, d as EverfurThemeSlots } from './tokens-CIngRkvt.cjs';
+
+/**
+ * One slot's paint on the `theme` prop; colours in any form `parseColor` reads, the radius in dp/px. The console's
+ * snake_case wire keys are accepted beside the camelCase ones.
+ */
+interface EverfurThemeSlotInput {
+    readonly backgroundColor?: string | number;
+    readonly background_color?: string | number;
+    readonly borderColor?: string | number;
+    readonly border_color?: string | number;
+    readonly borderRadius?: number | string;
+    readonly border_radius?: number | string;
+    readonly textColor?: string | number;
+    readonly text_color?: string | number;
+}
+/** The `slots` map on the `theme` prop: any subset of the eight slot names. */
+type EverfurThemeSlotsInput = Readonly<Partial<Record<EverfurThemeSlotName, EverfurThemeSlotInput>>>;
+/**
+ * The faces a theme names: the three text weights and the three mono weights (`EverfurFontFaceKey` on the tokens).
+ * A missing weight falls back along its chain: bold -> medium -> regular, monoBold -> monoMedium -> mono.
+ */
+type EverfurThemeFontFaceKey = 'regular' | 'medium' | 'bold' | 'mono' | 'monoMedium' | 'monoBold';
+/** The `fonts` map on the `theme` prop: a registered family name per face, any subset. */
+type EverfurThemeFontsInput = Readonly<Partial<Record<EverfurThemeFontFaceKey, string>>>;
+/** The `font_urls` map on the `theme` prop (web only): a brand-font URL per face, any subset. */
+type EverfurThemeFontUrlsInput = Readonly<Partial<Record<EverfurThemeFontFaceKey, string>>>;
+/**
+ * The client `theme` prop. Any shape is tolerated (unknown keys are ignored, malformed values are dropped); the
+ * named keys are the ones the resolver reads, in the console's snake_case with camelCase twins.
+ */
+interface EverfurThemeInput {
+    readonly display_name?: string;
+    readonly displayName?: string;
+    readonly logo_url?: string;
+    readonly logoUrl?: string;
+    /** The logo shown on the dark palette; absent, `logo_url` is shown on both. */
+    readonly logo_url_dark?: string;
+    readonly logoUrlDark?: string;
+    readonly primary_color?: string | number;
+    readonly primaryColor?: string | number;
+    readonly accent_color?: string | number;
+    readonly accentColor?: string | number;
+    /** The primary fill on the dark palette; absent, it is derived from `primary_color` (`deriveDarkVariant`). */
+    readonly primary_color_dark?: string | number;
+    readonly primaryColorDark?: string | number;
+    readonly accent_color_dark?: string | number;
+    readonly accentColorDark?: string | number;
+    /**
+     * `light` or `dark` pins the palette; `auto` follows the device's scheme. Absent (here and in the console), the
+     * theme is LIGHT, as Everfur's own apps are: the device scheme is never read unless someone chose `auto`.
+     */
+    readonly brightness?: string;
+    /** The console's name for `brightness` (`light`, `dark` or `auto`); `brightness` wins when both are set. */
+    readonly color_scheme?: string;
+    readonly colorScheme?: string;
+    readonly font_family?: string;
+    readonly fontFamily?: string;
+    readonly font_url?: string;
+    readonly fontUrl?: string;
+    /**
+     * The family per face. Two conventions, the same rendering on React Native and the web:
+     *   - one registered face per weight, the way the Everfur app maps weight to family (`Azeret-Regular`,
+     *     `Azeret-Medium`, `Azeret-Bold`, `AzeretMono-Regular`): a name no other weight of its group uses is a NAMED
+     *     face, rendered with no weight of its own (React Native) or at the normal weight (the web);
+     *   - one family for every weight (`Azeret`): a name shared across the weights of a group is a BASE family, and
+     *     every face takes its numeric weight on both hosts.
+     * A missing weight falls back along its chain (regular -> medium -> bold, mono -> monoMedium -> monoBold). The host
+     * registers the faces itself (the native font files, or a web `@font-face`) and passes the NAMES only: the SDK
+     * bundles no font. Beats `font_family` for the weights it names. On React Native, when the app's font registry can
+     * tell (expo-font's), a named face that is not registered falls back to the platform font at its weight, with a
+     * development warning.
+     */
+    readonly fonts?: EverfurThemeFontsInput;
+    /**
+     * Web only: the woff2 URL per face, loaded through the SDK's brand-font allow-list (a woff2 under `/fonts/`
+     * on the Everfur SDK CDN). A URL on any other origin is refused, so a host that serves its own licensed
+     * faces loads them with its own `@font-face` and passes `fonts` names only.
+     */
+    readonly font_urls?: EverfurThemeFontUrlsInput;
+    readonly fontUrls?: EverfurThemeFontUrlsInput;
+    readonly chat_placeholder?: string;
+    readonly chatPlaceholder?: string;
+    readonly placeholder?: string;
+    /** Typed for completeness; INERT on the client. The server decides the attribution from the plan. */
+    readonly hide_powered_by?: boolean;
+    readonly hidePoweredBy?: boolean;
+    /** `white`, `cream` or `subtle`. */
+    readonly surface_style?: string;
+    readonly surfaceStyle?: string;
+    /** `sharp`, `default` or `round`. */
+    readonly radius_scale?: string;
+    readonly radiusScale?: string;
+    /**
+     * The cap on the CHROME text tiers (headings, controls, chips, badges): 1 to 3.1, or 0 for none (the default,
+     * the tiers alone: headings 2, controls 1.8, chips 1.5, badges 1.3). Flowing content is never capped.
+     */
+    readonly accessibility_max_font_scale?: number | string;
+    readonly accessibilityMaxFontScale?: number | string;
+    /** Paint overrides at the named slots. */
+    readonly slots?: EverfurThemeSlotsInput;
+    /** Tolerated for any other key; ignored by the resolver. */
+    readonly [key: string]: unknown;
+}
+
+interface ClientBranding {
+    readonly displayName: string | null;
+    /** normalized (https-hardened downstream) logo URL */
+    readonly logoUrl: string | null;
+    /** normalized color string (#RRGGBB or rgba(...)) or null */
+    readonly primaryColor: string | null;
+    readonly accentColor: string | null;
+    /**
+     * `light` or `dark` pins the palette; `auto` follows the device's scheme (an explicit opt-in). null (absent)
+     * resolves to LIGHT, as Everfur's own apps render. Read from `brightness`, or its console alias `color_scheme`
+     * (`colorScheme`).
+     */
+    readonly brightness: 'light' | 'dark' | 'auto' | null;
+    readonly fontFamily: string | null;
+    readonly fontUrl: string | null;
+    /**
+     * fonts: one registered family per face (`regular` / `medium` / `bold` / `mono` / `monoMedium` / `monoBold`),
+     * any subset. A name used by one face of its group only is a named face, rendered without a synthetic
+     * `fontWeight`; a name repeated across the weights of a group is a base family and takes the numeric weights.
+     * Absent/null names none (the base families stand).
+     */
+    readonly fonts?: Readonly<Partial<Record<EverfurFontFaceKey, string>>> | null;
+    /** font_urls: the brand-font URL per face (web only), any subset; hardened https-only downstream. */
+    readonly fontUrls?: Readonly<Partial<Record<EverfurFontFaceKey, string>>> | null;
+    /** composer placeholder override (chat_placeholder/placeholder); null keeps the base. */
+    readonly placeholder: string | null;
+    /**
+     * white-label switch (hide_powered_by): hide the powered-by attribution. null = unset (keep the base). Honoured
+     * from SERVER branding only: `resolveTheme` ignores it on the client override (attribution is server-only).
+     */
+    readonly hidePoweredBy: boolean | null;
+    /** primary_color_dark: the primary fill used when the resolved palette is dark. Absent/null derives one. */
+    readonly primaryColorDark?: string | null;
+    /** accent_color_dark: the accent fill used when the resolved palette is dark. Absent/null derives one. */
+    readonly accentColorDark?: string | null;
+    /**
+     * surface_style: which compiled surface the chat ground (`chatGround`) uses. Absent/null keeps the palette's
+     * white ground (the Everfur app's shell). The composer and the record cards keep their cream either way.
+     */
+    readonly surfaceStyle?: SurfaceStyle | null;
+    /** radius_scale: scales the corner radii (the pill radius is never scaled). Absent/null keeps the palette radii. */
+    readonly radiusScale?: RadiusScale | null;
+    /** logo_url_dark: the logo shown on the dark palette. Absent/null keeps logoUrl on both palettes. */
+    readonly logoUrlDark?: string | null;
+    /** slots: paint overrides at the named slots (schema 2). Absent/null paints none. */
+    readonly slots?: EverfurThemeSlots | null;
+    /**
+     * accessibility_max_font_scale: the tenant's cap on the CHROME text tiers (headings, controls, chips, badges),
+     * 1..3.1, or 0 for none. Flowing content is never capped. Absent/null keeps the default (0, the tiers alone).
+     */
+    readonly accessibilityMaxFontScale?: number | null;
+    /**
+     * locked_fields: the wire names the tenant keeps server-wins (schema 2): a field, `slots` (every slot) or
+     * `slots.<name>` (one slot); the wire also lists `hide_powered_by`, which is locked whether listed or not.
+     * Meaningful on SERVER branding only; ignored on the client override. Absent/null locks nothing beyond the
+     * attribution.
+     */
+    readonly lockedFields?: readonly ThemeLockName[] | null;
+    /**
+     * schema_version: the wire version the branding was written for. null when absent (schema 1); 0 when present but
+     * not a positive integer. A version this SDK does not know (`THEME_SCHEMA_VERSIONS`) drops the server branding.
+     */
+    readonly schemaVersion?: number | null;
+}
+/** The compiled surface a branding may pick for the chat ground (`surface_style`). */
+type SurfaceStyle = 'white' | 'cream' | 'subtle';
+/** The corner-radius scale a branding may pick (`radius_scale`). */
+type RadiusScale = 'sharp' | 'default' | 'round';
+/**
+ * The wire names a tenant may list in `locked_fields` (every cosmetic field). `hide_powered_by` is not listed:
+ * it is server-wins unconditionally, so locking it is meaningless.
+ */
+declare const LOCKABLE_THEME_FIELDS: readonly ["display_name", "logo_url", "logo_url_dark", "primary_color", "accent_color", "primary_color_dark", "accent_color_dark", "brightness", "color_scheme", "font_family", "font_url", "fonts", "font_urls", "chat_placeholder", "surface_style", "radius_scale", "accessibility_max_font_scale", "slots"];
+type LockableThemeField = (typeof LOCKABLE_THEME_FIELDS)[number];
+/** The `locked_fields` key that locks one slot (`slots.<name>`), as EFBackend branding_slots.py emits it. */
+declare const SLOT_LOCK_PREFIX = "slots.";
+type SlotLockName = `${typeof SLOT_LOCK_PREFIX}${EverfurThemeSlotName}`;
+/** Everything `locked_fields` may name: a cosmetic field, one slot, or the (always locked) attribution. */
+type ThemeLockName = LockableThemeField | SlotLockName | 'hide_powered_by';
+/** The branding wire versions this SDK reads: 1 (absent on the wire) and 2 (the 18 Sep 2026 fields). */
+declare const THEME_SCHEMA_VERSIONS: readonly number[];
+/**
+ * true when every field is null (no config) - treated by callers as "absent". The version stamp alone is not a
+ * value: a branding that carries only `schema_version` is empty.
+ */
+declare function isEmptyBranding(b: ClientBranding): boolean;
+/** true when the branding is absent or written for a wire version this SDK knows. */
+declare function isKnownBrandingSchema(b: ClientBranding | null): boolean;
+/** The names a server branding keeps server-wins: its `locked_fields`, plus the attribution always. */
+declare function lockedFieldsOf(b: ClientBranding | null): ReadonlySet<string>;
+/**
+ * Parse an untrusted branding blob (from the entitlements render_hints, or the client `theme` prop) into a
+ * normalized `ClientBranding`. Accepts BOTH snake_case and camelCase keys. Returns null when the input is not
+ * an object OR when the result is empty (all fields null) - callers read null as "no config" (fail-closed to
+ * the compiled default). Never throws.
+ */
+declare function parseClientBranding(json: unknown): ClientBranding | null;
+/** The largest cap a tenant may set on the chrome tiers: iOS's largest accessibility text size (AX5, 310%). */
+declare const MAX_FONT_SCALE_CEILING = 3.1;
+/**
+ * Return the URL only if it is an https URL with no embedded whitespace, else null (security invariant:
+ * https-only; rejects http:, javascript:, data:, etc.). Uses a protocol-locked regex rather than the URL
+ * constructor so it is portable + total on React Native (whose URL global is incomplete) and never throws.
+ */
+declare function hardenHttpsUrl(url: string | null): string | null;
+
+export { type ClientBranding as C, type EverfurThemeInput as E, LOCKABLE_THEME_FIELDS as L, MAX_FONT_SCALE_CEILING as M, type RadiusScale as R, type SurfaceStyle as S, THEME_SCHEMA_VERSIONS as T, type EverfurThemeFontFaceKey as a, type EverfurThemeFontUrlsInput as b, type EverfurThemeFontsInput as c, type EverfurThemeSlotInput as d, type EverfurThemeSlotsInput as e, type LockableThemeField as f, SLOT_LOCK_PREFIX as g, type SlotLockName as h, type ThemeLockName as i, hardenHttpsUrl as j, isEmptyBranding as k, isKnownBrandingSchema as l, lockedFieldsOf as m, parseClientBranding as p };

package/dist/branding-xpQ056sM.d.ts

@@ -0,0 +1,212 @@
+import { c as EverfurThemeSlotName, b as EverfurFontFaceKey, d as EverfurThemeSlots } from './tokens-CIngRkvt.js';
+
+/**
+ * One slot's paint on the `theme` prop; colours in any form `parseColor` reads, the radius in dp/px. The console's
+ * snake_case wire keys are accepted beside the camelCase ones.
+ */
+interface EverfurThemeSlotInput {
+    readonly backgroundColor?: string | number;
+    readonly background_color?: string | number;
+    readonly borderColor?: string | number;
+    readonly border_color?: string | number;
+    readonly borderRadius?: number | string;
+    readonly border_radius?: number | string;
+    readonly textColor?: string | number;
+    readonly text_color?: string | number;
+}
+/** The `slots` map on the `theme` prop: any subset of the eight slot names. */
+type EverfurThemeSlotsInput = Readonly<Partial<Record<EverfurThemeSlotName, EverfurThemeSlotInput>>>;
+/**
+ * The faces a theme names: the three text weights and the three mono weights (`EverfurFontFaceKey` on the tokens).
+ * A missing weight falls back along its chain: bold -> medium -> regular, monoBold -> monoMedium -> mono.
+ */
+type EverfurThemeFontFaceKey = 'regular' | 'medium' | 'bold' | 'mono' | 'monoMedium' | 'monoBold';
+/** The `fonts` map on the `theme` prop: a registered family name per face, any subset. */
+type EverfurThemeFontsInput = Readonly<Partial<Record<EverfurThemeFontFaceKey, string>>>;
+/** The `font_urls` map on the `theme` prop (web only): a brand-font URL per face, any subset. */
+type EverfurThemeFontUrlsInput = Readonly<Partial<Record<EverfurThemeFontFaceKey, string>>>;
+/**
+ * The client `theme` prop. Any shape is tolerated (unknown keys are ignored, malformed values are dropped); the
+ * named keys are the ones the resolver reads, in the console's snake_case with camelCase twins.
+ */
+interface EverfurThemeInput {
+    readonly display_name?: string;
+    readonly displayName?: string;
+    readonly logo_url?: string;
+    readonly logoUrl?: string;
+    /** The logo shown on the dark palette; absent, `logo_url` is shown on both. */
+    readonly logo_url_dark?: string;
+    readonly logoUrlDark?: string;
+    readonly primary_color?: string | number;
+    readonly primaryColor?: string | number;
+    readonly accent_color?: string | number;
+    readonly accentColor?: string | number;
+    /** The primary fill on the dark palette; absent, it is derived from `primary_color` (`deriveDarkVariant`). */
+    readonly primary_color_dark?: string | number;
+    readonly primaryColorDark?: string | number;
+    readonly accent_color_dark?: string | number;
+    readonly accentColorDark?: string | number;
+    /**
+     * `light` or `dark` pins the palette; `auto` follows the device's scheme. Absent (here and in the console), the
+     * theme is LIGHT, as Everfur's own apps are: the device scheme is never read unless someone chose `auto`.
+     */
+    readonly brightness?: string;
+    /** The console's name for `brightness` (`light`, `dark` or `auto`); `brightness` wins when both are set. */
+    readonly color_scheme?: string;
+    readonly colorScheme?: string;
+    readonly font_family?: string;
+    readonly fontFamily?: string;
+    readonly font_url?: string;
+    readonly fontUrl?: string;
+    /**
+     * The family per face. Two conventions, the same rendering on React Native and the web:
+     *   - one registered face per weight, the way the Everfur app maps weight to family (`Azeret-Regular`,
+     *     `Azeret-Medium`, `Azeret-Bold`, `AzeretMono-Regular`): a name no other weight of its group uses is a NAMED
+     *     face, rendered with no weight of its own (React Native) or at the normal weight (the web);
+     *   - one family for every weight (`Azeret`): a name shared across the weights of a group is a BASE family, and
+     *     every face takes its numeric weight on both hosts.
+     * A missing weight falls back along its chain (regular -> medium -> bold, mono -> monoMedium -> monoBold). The host
+     * registers the faces itself (the native font files, or a web `@font-face`) and passes the NAMES only: the SDK
+     * bundles no font. Beats `font_family` for the weights it names. On React Native, when the app's font registry can
+     * tell (expo-font's), a named face that is not registered falls back to the platform font at its weight, with a
+     * development warning.
+     */
+    readonly fonts?: EverfurThemeFontsInput;
+    /**
+     * Web only: the woff2 URL per face, loaded through the SDK's brand-font allow-list (a woff2 under `/fonts/`
+     * on the Everfur SDK CDN). A URL on any other origin is refused, so a host that serves its own licensed
+     * faces loads them with its own `@font-face` and passes `fonts` names only.
+     */
+    readonly font_urls?: EverfurThemeFontUrlsInput;
+    readonly fontUrls?: EverfurThemeFontUrlsInput;
+    readonly chat_placeholder?: string;
+    readonly chatPlaceholder?: string;
+    readonly placeholder?: string;
+    /** Typed for completeness; INERT on the client. The server decides the attribution from the plan. */
+    readonly hide_powered_by?: boolean;
+    readonly hidePoweredBy?: boolean;
+    /** `white`, `cream` or `subtle`. */
+    readonly surface_style?: string;
+    readonly surfaceStyle?: string;
+    /** `sharp`, `default` or `round`. */
+    readonly radius_scale?: string;
+    readonly radiusScale?: string;
+    /**
+     * The cap on the CHROME text tiers (headings, controls, chips, badges): 1 to 3.1, or 0 for none (the default,
+     * the tiers alone: headings 2, controls 1.8, chips 1.5, badges 1.3). Flowing content is never capped.
+     */
+    readonly accessibility_max_font_scale?: number | string;
+    readonly accessibilityMaxFontScale?: number | string;
+    /** Paint overrides at the named slots. */
+    readonly slots?: EverfurThemeSlotsInput;
+    /** Tolerated for any other key; ignored by the resolver. */
+    readonly [key: string]: unknown;
+}
+
+interface ClientBranding {
+    readonly displayName: string | null;
+    /** normalized (https-hardened downstream) logo URL */
+    readonly logoUrl: string | null;
+    /** normalized color string (#RRGGBB or rgba(...)) or null */
+    readonly primaryColor: string | null;
+    readonly accentColor: string | null;
+    /**
+     * `light` or `dark` pins the palette; `auto` follows the device's scheme (an explicit opt-in). null (absent)
+     * resolves to LIGHT, as Everfur's own apps render. Read from `brightness`, or its console alias `color_scheme`
+     * (`colorScheme`).
+     */
+    readonly brightness: 'light' | 'dark' | 'auto' | null;
+    readonly fontFamily: string | null;
+    readonly fontUrl: string | null;
+    /**
+     * fonts: one registered family per face (`regular` / `medium` / `bold` / `mono` / `monoMedium` / `monoBold`),
+     * any subset. A name used by one face of its group only is a named face, rendered without a synthetic
+     * `fontWeight`; a name repeated across the weights of a group is a base family and takes the numeric weights.
+     * Absent/null names none (the base families stand).
+     */
+    readonly fonts?: Readonly<Partial<Record<EverfurFontFaceKey, string>>> | null;
+    /** font_urls: the brand-font URL per face (web only), any subset; hardened https-only downstream. */
+    readonly fontUrls?: Readonly<Partial<Record<EverfurFontFaceKey, string>>> | null;
+    /** composer placeholder override (chat_placeholder/placeholder); null keeps the base. */
+    readonly placeholder: string | null;
+    /**
+     * white-label switch (hide_powered_by): hide the powered-by attribution. null = unset (keep the base). Honoured
+     * from SERVER branding only: `resolveTheme` ignores it on the client override (attribution is server-only).
+     */
+    readonly hidePoweredBy: boolean | null;
+    /** primary_color_dark: the primary fill used when the resolved palette is dark. Absent/null derives one. */
+    readonly primaryColorDark?: string | null;
+    /** accent_color_dark: the accent fill used when the resolved palette is dark. Absent/null derives one. */
+    readonly accentColorDark?: string | null;
+    /**
+     * surface_style: which compiled surface the chat ground (`chatGround`) uses. Absent/null keeps the palette's
+     * white ground (the Everfur app's shell). The composer and the record cards keep their cream either way.
+     */
+    readonly surfaceStyle?: SurfaceStyle | null;
+    /** radius_scale: scales the corner radii (the pill radius is never scaled). Absent/null keeps the palette radii. */
+    readonly radiusScale?: RadiusScale | null;
+    /** logo_url_dark: the logo shown on the dark palette. Absent/null keeps logoUrl on both palettes. */
+    readonly logoUrlDark?: string | null;
+    /** slots: paint overrides at the named slots (schema 2). Absent/null paints none. */
+    readonly slots?: EverfurThemeSlots | null;
+    /**
+     * accessibility_max_font_scale: the tenant's cap on the CHROME text tiers (headings, controls, chips, badges),
+     * 1..3.1, or 0 for none. Flowing content is never capped. Absent/null keeps the default (0, the tiers alone).
+     */
+    readonly accessibilityMaxFontScale?: number | null;
+    /**
+     * locked_fields: the wire names the tenant keeps server-wins (schema 2): a field, `slots` (every slot) or
+     * `slots.<name>` (one slot); the wire also lists `hide_powered_by`, which is locked whether listed or not.
+     * Meaningful on SERVER branding only; ignored on the client override. Absent/null locks nothing beyond the
+     * attribution.
+     */
+    readonly lockedFields?: readonly ThemeLockName[] | null;
+    /**
+     * schema_version: the wire version the branding was written for. null when absent (schema 1); 0 when present but
+     * not a positive integer. A version this SDK does not know (`THEME_SCHEMA_VERSIONS`) drops the server branding.
+     */
+    readonly schemaVersion?: number | null;
+}
+/** The compiled surface a branding may pick for the chat ground (`surface_style`). */
+type SurfaceStyle = 'white' | 'cream' | 'subtle';
+/** The corner-radius scale a branding may pick (`radius_scale`). */
+type RadiusScale = 'sharp' | 'default' | 'round';
+/**
+ * The wire names a tenant may list in `locked_fields` (every cosmetic field). `hide_powered_by` is not listed:
+ * it is server-wins unconditionally, so locking it is meaningless.
+ */
+declare const LOCKABLE_THEME_FIELDS: readonly ["display_name", "logo_url", "logo_url_dark", "primary_color", "accent_color", "primary_color_dark", "accent_color_dark", "brightness", "color_scheme", "font_family", "font_url", "fonts", "font_urls", "chat_placeholder", "surface_style", "radius_scale", "accessibility_max_font_scale", "slots"];
+type LockableThemeField = (typeof LOCKABLE_THEME_FIELDS)[number];
+/** The `locked_fields` key that locks one slot (`slots.<name>`), as EFBackend branding_slots.py emits it. */
+declare const SLOT_LOCK_PREFIX = "slots.";
+type SlotLockName = `${typeof SLOT_LOCK_PREFIX}${EverfurThemeSlotName}`;
+/** Everything `locked_fields` may name: a cosmetic field, one slot, or the (always locked) attribution. */
+type ThemeLockName = LockableThemeField | SlotLockName | 'hide_powered_by';
+/** The branding wire versions this SDK reads: 1 (absent on the wire) and 2 (the 18 Sep 2026 fields). */
+declare const THEME_SCHEMA_VERSIONS: readonly number[];
+/**
+ * true when every field is null (no config) - treated by callers as "absent". The version stamp alone is not a
+ * value: a branding that carries only `schema_version` is empty.
+ */
+declare function isEmptyBranding(b: ClientBranding): boolean;
+/** true when the branding is absent or written for a wire version this SDK knows. */
+declare function isKnownBrandingSchema(b: ClientBranding | null): boolean;
+/** The names a server branding keeps server-wins: its `locked_fields`, plus the attribution always. */
+declare function lockedFieldsOf(b: ClientBranding | null): ReadonlySet<string>;
+/**
+ * Parse an untrusted branding blob (from the entitlements render_hints, or the client `theme` prop) into a
+ * normalized `ClientBranding`. Accepts BOTH snake_case and camelCase keys. Returns null when the input is not
+ * an object OR when the result is empty (all fields null) - callers read null as "no config" (fail-closed to
+ * the compiled default). Never throws.
+ */
+declare function parseClientBranding(json: unknown): ClientBranding | null;
+/** The largest cap a tenant may set on the chrome tiers: iOS's largest accessibility text size (AX5, 310%). */
+declare const MAX_FONT_SCALE_CEILING = 3.1;
+/**
+ * Return the URL only if it is an https URL with no embedded whitespace, else null (security invariant:
+ * https-only; rejects http:, javascript:, data:, etc.). Uses a protocol-locked regex rather than the URL
+ * constructor so it is portable + total on React Native (whose URL global is incomplete) and never throws.
+ */
+declare function hardenHttpsUrl(url: string | null): string | null;
+
+export { type ClientBranding as C, type EverfurThemeInput as E, LOCKABLE_THEME_FIELDS as L, MAX_FONT_SCALE_CEILING as M, type RadiusScale as R, type SurfaceStyle as S, THEME_SCHEMA_VERSIONS as T, type EverfurThemeFontFaceKey as a, type EverfurThemeFontUrlsInput as b, type EverfurThemeFontsInput as c, type EverfurThemeSlotInput as d, type EverfurThemeSlotsInput as e, type LockableThemeField as f, SLOT_LOCK_PREFIX as g, type SlotLockName as h, type ThemeLockName as i, hardenHttpsUrl as j, isEmptyBranding as k, isKnownBrandingSchema as l, lockedFieldsOf as m, parseClientBranding as p };

package/dist/callCopy-rDH9JTFo.d.cts

@@ -0,0 +1,45 @@
+/** The consult length the lobby quotes, in minutes. everfur-mobile-2026-7 televetTime.ts:85 `CONSULT_MINUTES`. */
+declare const VET_CALL_CONSULT_MINUTES = 10;
+declare const VET_CALL_COPY: Readonly<{
+    /** Controls, shared by the lobby and the live call. */
+    muteCta: "Mute";
+    unmuteCta: "Unmute";
+    cameraOffCta: "Camera off";
+    cameraOnCta: "Camera on";
+    leaveCta: "Leave";
+    /**
+     * ADDED FOR RNUI-10, from the same deck (everfur-mobile copy.ts at 9856f5199): switchCameraCta :1029,
+     * speakerOffCta :1038, speakerOnCta :1039. Labelled by the ACTION, like the camera controls: "Front camera" as
+     * a label is ambiguous about whether it names the state or the result.
+     */
+    switchCameraCta: "Switch camera";
+    speakerOffCta: "Speaker off";
+    speakerOnCta: "Speaker on";
+    /** The lobby: the member is in the room and the clinician is not. */
+    lobbyTitleNoName: "Your vet is joining";
+    lobbySubtitle: "Usually under a minute";
+    lobbyPrepLabel: "WHILE YOU WAIT";
+    lobbyPrepNoPet: "Have your pet nearby and somewhere well lit.";
+    /** `{name}` is DATA from the consult, never a key. Absent, `lobbyTitleNoName` is used instead. */
+    lobbyTitle: (clinicianName: string | null | undefined) => string;
+    /** `{pet}` is DATA from the roster. Absent, the pet-free form is used instead. */
+    lobbyPrep: (petName: string | null | undefined) => string;
+    /** `{n}` is `VET_CALL_CONSULT_MINUTES`, never a hardcoded number. */
+    lobbyDuration: (minutes: number) => string;
+    /** The consumer app's `visit.joinFailedReason` (:735), shown when the call object errors. */
+    joinFailedReason: "That did not open. Try again.";
+    /** D8, shown BEFORE the room: acknowledging it is the only way in. Both consumer apps, verbatim. */
+    recordingNoticeTitle: "This consultation is recorded.";
+    /** The acknowledgement that actually opens the room. Mobile `recordingNoticeCta`, web `recordingNoticeAck`. */
+    recordingNoticeCta: "Continue to the call";
+    /** WEB ONLY: declining the notice. everfur-frontend ownerCopy.ts:229. */
+    recordingNoticeDecline: "Not now";
+    /**
+     * The member's own tile while their camera is off. NOT `cameraOnCta`: the tile used to be captioned with the
+     * control's imperative, so at the moment the camera was off it read "Camera on" (mobile copy.ts:1065 and
+     * the fix at TelevetCallScreen.tsx:1128-1133).
+     */
+    selfCameraOffLabel: "Your camera is off";
+}>;
+
+export { VET_CALL_CONSULT_MINUTES as V, VET_CALL_COPY as a };

package/dist/callCopy-rDH9JTFo.d.ts

@@ -0,0 +1,45 @@
+/** The consult length the lobby quotes, in minutes. everfur-mobile-2026-7 televetTime.ts:85 `CONSULT_MINUTES`. */
+declare const VET_CALL_CONSULT_MINUTES = 10;
+declare const VET_CALL_COPY: Readonly<{
+    /** Controls, shared by the lobby and the live call. */
+    muteCta: "Mute";
+    unmuteCta: "Unmute";
+    cameraOffCta: "Camera off";
+    cameraOnCta: "Camera on";
+    leaveCta: "Leave";
+    /**
+     * ADDED FOR RNUI-10, from the same deck (everfur-mobile copy.ts at 9856f5199): switchCameraCta :1029,
+     * speakerOffCta :1038, speakerOnCta :1039. Labelled by the ACTION, like the camera controls: "Front camera" as
+     * a label is ambiguous about whether it names the state or the result.
+     */
+    switchCameraCta: "Switch camera";
+    speakerOffCta: "Speaker off";
+    speakerOnCta: "Speaker on";
+    /** The lobby: the member is in the room and the clinician is not. */
+    lobbyTitleNoName: "Your vet is joining";
+    lobbySubtitle: "Usually under a minute";
+    lobbyPrepLabel: "WHILE YOU WAIT";
+    lobbyPrepNoPet: "Have your pet nearby and somewhere well lit.";
+    /** `{name}` is DATA from the consult, never a key. Absent, `lobbyTitleNoName` is used instead. */
+    lobbyTitle: (clinicianName: string | null | undefined) => string;
+    /** `{pet}` is DATA from the roster. Absent, the pet-free form is used instead. */
+    lobbyPrep: (petName: string | null | undefined) => string;
+    /** `{n}` is `VET_CALL_CONSULT_MINUTES`, never a hardcoded number. */
+    lobbyDuration: (minutes: number) => string;
+    /** The consumer app's `visit.joinFailedReason` (:735), shown when the call object errors. */
+    joinFailedReason: "That did not open. Try again.";
+    /** D8, shown BEFORE the room: acknowledging it is the only way in. Both consumer apps, verbatim. */
+    recordingNoticeTitle: "This consultation is recorded.";
+    /** The acknowledgement that actually opens the room. Mobile `recordingNoticeCta`, web `recordingNoticeAck`. */
+    recordingNoticeCta: "Continue to the call";
+    /** WEB ONLY: declining the notice. everfur-frontend ownerCopy.ts:229. */
+    recordingNoticeDecline: "Not now";
+    /**
+     * The member's own tile while their camera is off. NOT `cameraOnCta`: the tile used to be captioned with the
+     * control's imperative, so at the moment the camera was off it read "Camera on" (mobile copy.ts:1065 and
+     * the fix at TelevetCallScreen.tsx:1128-1133).
+     */
+    selfCameraOffLabel: "Your camera is off";
+}>;
+
+export { VET_CALL_CONSULT_MINUTES as V, VET_CALL_COPY as a };

package/dist/callRoom-7wrE3RP2.d.ts

@@ -0,0 +1,62 @@
+import { E as EverfurError } from './EverfurError-DmELDpXp.js';
+
+/** The phases the in-app call surface moves through. The consumer app's `CallPhase`, verbatim. */
+type VetCallPhase = 'joining' | 'joined' | 'left' | 'error';
+/**
+ * Refuses anything that is not an https room.
+ *
+ * NEVER THROWS and never echoes the input: an unparseable value returns false rather than raising, because
+ * the caller is already on a failure path when it asks.
+ */
+declare function isSafeRoomUrl(url: string): boolean;
+/**
+ * The whole credential floor: an https room AND a non-empty join token. The call surface renders nothing and
+ * creates no call object unless this is true.
+ */
+declare function isUsableRoomCredential(roomUrl: string, token: string): boolean;
+/** The call's clock as the join response served it (`CallLimitsResponse`). */
+interface VetCallLimits {
+    /** The sold visit length, in minutes. */
+    readonly consultMinutes: number;
+    /** When the app leaves the call on its own, in minutes; 0 means never. */
+    readonly autoEndMinutes: number;
+    /** How long before either limit a warning is due, in seconds. */
+    readonly warnBeforeSeconds: number;
+}
+/** One participant's admission to the consult's room. The token is a credential: never log or store it. */
+interface VetCallCredential {
+    readonly roomUrl: string;
+    readonly token: string;
+    /** D8: the room is recorded, so the notice comes before the room. True unless the server said false. */
+    readonly recordingNotice: boolean;
+    /** Null when the server sent none, or sent a block with an unusable number in it. */
+    readonly callLimits: VetCallLimits | null;
+}
+/**
+ * Read a join response. Null when it carries no usable room or no token: a credential with half of itself
+ * missing cannot open anything, and the caller settles that as a failed join rather than a call that hangs.
+ */
+declare function parseVetCallCredential(wire: unknown): VetCallCredential | null;
+/**
+ * Why a join was refused. The consumer app's `televetJoinRefusal` (everfur-mobile
+ * src/features/liveVet/join/televetJoin.ts), plus `unavailable`, which the port adds for the same reason
+ * `televetBookingRefusal` adds it: a partner plane can be dark (404) where the consumer plane cannot.
+ *
+ *   too_early       the window has not opened. It will work closer to the time.
+ *   too_late        the window closed. It will never work for this consult.
+ *   room_not_ready  the room is still being provisioned; fine in seconds.
+ *   not_joinable    the consult is cancelled or finished (`status_*`).
+ *   unavailable     404: the surface is dark, or the consult is not this member's. No retry can fix it.
+ *   unknown         anything else, including a transport failure. A retry is reasonable.
+ */
+type VetCallJoinRefusal = 'too_early' | 'too_late' | 'room_not_ready' | 'not_joinable' | 'unavailable' | 'unknown';
+/**
+ * The server's own reason for a refused join (`too_early`, `status_cancelled_owner`, ...), or null when the
+ * envelope carried none. The web surface words each `status_*` separately, as the consumer web app does, so it
+ * reads the reason itself; everything else reads the classification below.
+ */
+declare function vetCallJoinReason(error: EverfurError): string | null;
+/** Classify a failed join by the server's own reason, never by its message. */
+declare function vetCallJoinRefusal(error: EverfurError): VetCallJoinRefusal;
+
+export { type VetCallPhase as V, isUsableRoomCredential as a, type VetCallCredential as b, type VetCallJoinRefusal as c, type VetCallLimits as d, vetCallJoinRefusal as e, isSafeRoomUrl as i, parseVetCallCredential as p, vetCallJoinReason as v };

package/dist/callRoom-B_EqaUzx.d.cts

@@ -0,0 +1,62 @@
+import { E as EverfurError } from './EverfurError-DmELDpXp.cjs';
+
+/** The phases the in-app call surface moves through. The consumer app's `CallPhase`, verbatim. */
+type VetCallPhase = 'joining' | 'joined' | 'left' | 'error';
+/**
+ * Refuses anything that is not an https room.
+ *
+ * NEVER THROWS and never echoes the input: an unparseable value returns false rather than raising, because
+ * the caller is already on a failure path when it asks.
+ */
+declare function isSafeRoomUrl(url: string): boolean;
+/**
+ * The whole credential floor: an https room AND a non-empty join token. The call surface renders nothing and
+ * creates no call object unless this is true.
+ */
+declare function isUsableRoomCredential(roomUrl: string, token: string): boolean;
+/** The call's clock as the join response served it (`CallLimitsResponse`). */
+interface VetCallLimits {
+    /** The sold visit length, in minutes. */
+    readonly consultMinutes: number;
+    /** When the app leaves the call on its own, in minutes; 0 means never. */
+    readonly autoEndMinutes: number;
+    /** How long before either limit a warning is due, in seconds. */
+    readonly warnBeforeSeconds: number;
+}
+/** One participant's admission to the consult's room. The token is a credential: never log or store it. */
+interface VetCallCredential {
+    readonly roomUrl: string;
+    readonly token: string;
+    /** D8: the room is recorded, so the notice comes before the room. True unless the server said false. */
+    readonly recordingNotice: boolean;
+    /** Null when the server sent none, or sent a block with an unusable number in it. */
+    readonly callLimits: VetCallLimits | null;
+}
+/**
+ * Read a join response. Null when it carries no usable room or no token: a credential with half of itself
+ * missing cannot open anything, and the caller settles that as a failed join rather than a call that hangs.
+ */
+declare function parseVetCallCredential(wire: unknown): VetCallCredential | null;
+/**
+ * Why a join was refused. The consumer app's `televetJoinRefusal` (everfur-mobile
+ * src/features/liveVet/join/televetJoin.ts), plus `unavailable`, which the port adds for the same reason
+ * `televetBookingRefusal` adds it: a partner plane can be dark (404) where the consumer plane cannot.
+ *
+ *   too_early       the window has not opened. It will work closer to the time.
+ *   too_late        the window closed. It will never work for this consult.
+ *   room_not_ready  the room is still being provisioned; fine in seconds.
+ *   not_joinable    the consult is cancelled or finished (`status_*`).
+ *   unavailable     404: the surface is dark, or the consult is not this member's. No retry can fix it.
+ *   unknown         anything else, including a transport failure. A retry is reasonable.
+ */
+type VetCallJoinRefusal = 'too_early' | 'too_late' | 'room_not_ready' | 'not_joinable' | 'unavailable' | 'unknown';
+/**
+ * The server's own reason for a refused join (`too_early`, `status_cancelled_owner`, ...), or null when the
+ * envelope carried none. The web surface words each `status_*` separately, as the consumer web app does, so it
+ * reads the reason itself; everything else reads the classification below.
+ */
+declare function vetCallJoinReason(error: EverfurError): string | null;
+/** Classify a failed join by the server's own reason, never by its message. */
+declare function vetCallJoinRefusal(error: EverfurError): VetCallJoinRefusal;
+
+export { type VetCallPhase as V, isUsableRoomCredential as a, type VetCallCredential as b, type VetCallJoinRefusal as c, type VetCallLimits as d, vetCallJoinRefusal as e, isSafeRoomUrl as i, parseVetCallCredential as p, vetCallJoinReason as v };