@everfur/sdk 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -10,6 +10,381 @@ changes that has not been earned by any production integration yet.
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-09-25
+
+Fixes for the televet booking, web vet call and web dialog defects found on staging on 2026-09-23, for the
+React Native vet call, and for the records upload and chat defects the partner end-to-end runs found on
+2026-09-24, with the missing React Native pull to refresh on a records request. Public signature changes are
+additive only, each an optional prop, a new method, a new export or a promise from a method that returned
+nothing: `selectedSlot` on `TelevetSlotPicker` (both platforms); `consultMinutes` on the React Native
+`EverfurVetCall` and `EverfurVetCallLobby` (`@everfur/sdk/televet/call`, see the call lobby entry under Fixed);
+`ChatController.newConversation()` (see Added); a promise from `refresh()` on `useEverfurRecords` (both
+platforms, see Changed); and on web, `onAddToCalendar` on `EverfurTelevetHost` and `EverfurTelevetDialog`,
+`returnedTo` on `TelevetVisitsScreen`, `lengthMinutes` on `TelevetBookedScreen`, a ready `.ics` calendar writer
+exported from `@everfur/sdk/web/televet`, and a third result a web `TelevetCalendarWriter` may resolve,
+`'handed-off'` (a writer that resolves a boolean is unchanged).
+
+### Added
+
+- **`EverfurTelevetHost` takes `onAddToCalendar` (web).** The booked confirmation has had a calendar seam since
+  the web booking shipped, but the default in-page visit could not reach it: the host took no props and its
+  dialog rendered the flow without a writer, so a partner on the default path could not offer Add to Calendar
+  even with a calendar of its own. Pass a `TelevetCalendarWriter` to `EverfurTelevetHost` and the confirmation
+  offers the control and calls the writer with the visit's entry; without one it has no calendar control, as
+  before. The hosts `VetVisitButton` and `EverfurChat` mount take no props, and the first host mounted renders,
+  so mount yours above them. `EverfurTelevetHostProps`, `TelevetCalendarEvent` and `TelevetCalendarWriter` are
+  exported from `@everfur/sdk/web/televet` (types only; the entry's code does not grow by the booking screens).
+  `EverfurTelevetDialog` takes the same prop.
+- **`downloadTelevetCalendarFile`, a ready calendar writer (web).** The consumer web app's Add to Calendar hands
+  the member a one-shot `.ics` file, because a browser has no calendar a page may write to. The SDK now ships
+  that file's builder, ported from the consumer's: `<EverfurTelevetHost onAddToCalendar={downloadTelevetCalendarFile} />`
+  offers Add to Calendar with no calendar code of your own. The file is RFC 5545 in UTC with CRLF line ends and
+  75-octet folding, its `UID` is the entry's `key`, and it carries no alarm (a file cannot be withdrawn when a
+  visit moves). An entry that would be wrong (a blank title, an unreadable time, an end not after the start) is
+  not built, and the confirmation shows its existing did-not-save line. A started download is not an entry in a
+  calendar (the member still imports the file, and may cancel the save or have it blocked), so the writer resolves
+  `'handed-off'`, a result the web `TelevetCalendarWriter` now allows beside `true` and `false`, and on it the
+  confirmation keeps Add to Calendar enabled to press again, as the consumer web app's link does, rather than
+  saying the visit was added. Only a writer that resolves `true` gets "Added to your calendar".
+  `televetCalendarFile(event)` returns the same file as `{ href, filename }` for a page that renders its own link.
+  Both are exported from `@everfur/sdk/web/televet` with `TelevetCalendarFile`; no new copy.
+- **`TelevetSlotPicker` takes an optional `selectedSlot`.** The strip opens on that slot's day instead of
+  the first offered day when the day is offered. Omitted, the picker behaves as before. Both platforms.
+- **`ChatController.newConversation()`.** Leave the active thread for a fresh, empty one. It is what
+  `newConversation()` on `useEverfurChat` now calls. `adoptConversation(null)` is unchanged and still clears the
+  id alone. Both platforms.
+
+### Changed
+
+- **`refresh()` on `useEverfurRecords` returns a promise.** It settles once the reads it started have landed,
+  which is what the React Native request screen's pull-to-refresh spinner waits for. It was typed `void`; a
+  caller that ignores the result is unaffected. Both platforms.
+
+### Fixed
+
+- **The chat follows the member to the answer.** On the web, after a send the new question and its reply
+  rendered below the visible transcript. The transcript followed new content only while it believed the reader
+  was at the end, and three things broke that: it read its own scroll, a frame later, as the reader's, and on a
+  resumed thread the follow-up list had grown under the reply by then, so the reader looked 709 px short of the
+  end; nothing set it back on a send; and when it did follow, it went to the end of the follow-up list, which put
+  the question and its answer above the view. The transcript now settles on the latest turn, the top of the
+  newest reply with the question above it, as Everfur's own apps do (`resolveTurnScrollTarget`, ported). Every
+  turn the member starts (a typed send, a suggested prompt, Retry) takes them there even from further up, and the
+  surface no longer mistakes its own scroll for the reader's. A reader who scrolls up to re-read still keeps their
+  place when a message they did not ask for arrives. The React Native thread never scrolled itself at all, so a
+  resumed thread opened on its first message and every send landed below the fold; it now follows the same way,
+  measured with `onLayout` as the Everfur app measures its own thread. Both platforms.
+- **New chat clears the thread.** `newConversation()` on `useEverfurChat` (behind the new-chat controls in the
+  header and the history panel, and `Start a new chat` under a turn that cannot be retried) only cleared the
+  conversation id. The old thread stayed on screen, and the next message opened a new conversation on the wire
+  but rendered under the old one. It now leaves the thread: the transcript clears with its history cursor, a
+  failed or stopped turn and the reply's own follow-ups; a reply still streaming into it is dropped; and the next
+  message is the first turn of the new conversation. The suggested prompts the chat opened with stay, as does the
+  unread dot for the member's other threads. Both platforms.
+- **A chat photo uploads on an Expo app (React Native).** On a partner's Expo SDK 57 app every picked photo
+  failed: the initiate call answered 200 three times and no request reached S3, then the composer held "Some
+  attachments failed to upload. Remove or retry them before sending." Expo replaces the global `fetch` with
+  `expo/fetch`, whose multipart encoder throws on React Native's `{ uri, name, type }` file part before any
+  request exists, and the transport posted through the global `fetch`. `createRnChatAttachmentTransport` now
+  posts through React Native's own `XMLHttpRequest` (Expo leaves it in place), which streams the file from disk
+  as before: the policy fields in the server's order, the file last, no cookie, no header of its own, and the
+  same two bounded rejections. The `fetch` option is still honoured when given.
+- **A failed attachment draws its retry control (React Native).** The alert said "Remove or retry", but the red
+  overlay that retries (`Retry uploading {filename}`) was never drawn, and neither were the uploading wash or the
+  upload flash. Their box came from `StyleSheet.absoluteFillObject`, which React Native 0.86 no longer has; a
+  spread of it is `{}`, so each overlay fell into the flow at zero size. The same spread placed the chat header's
+  title layer and the feedback sheet's scrim. They now use a literal box that holds on every React Native version.
+- **The React Native vet call keeps its video and camera-off panels full-size.** `EverfurVetCall` took the box
+  for the clinician's video and its frame, the self-view video, the self-view's camera-off overlay and the
+  clinician's camera-off panel from the same `StyleSheet.absoluteFillObject` spread, so on React Native 0.86 each
+  fell into the flow at zero size during a call. They now use the same literal box. The scrims behind the chat
+  history drawer, the pet switcher and the records edit and share sheets used `StyleSheet.absoluteFill`, which
+  still works, and now use that box too, so no React Native surface takes an overlay box from `StyleSheet`.
+- **Photo attach works under React StrictMode (web, and any React Native host that uses it).** In development
+  under `<StrictMode>` (on by default in Vite and Next), every valid photo was refused with "You can attach up to
+  5 files per message." at 0 of 5, and nothing uploaded. StrictMode's remount ran the hook's cleanup, which
+  disposed the attachment queue the hook kept handing out. The remount now builds the scope a fresh queue.
+  Production builds were not affected.
+- **Booking a slot again after cancelling it books a new visit.** A member booked a slot, cancelled the visit
+  in-app, then booked the same slot again. The hold and the booking both succeeded, but the booking answer was
+  the first visit, now cancelled, and the flow confirmed it ("You're booked with {vet}" on the web, "You are
+  booked." on React Native). No new visit existed. The booking's `Idempotency-Key` was derived from the slot
+  alone (`televet.book.<slotId>`), so the platform read the second booking as a retry of the first and
+  answered with the first consult as it now stood.
+  `televetBookingKey` now mints a new key on every call, and both platforms call it once per awarded hold, so a
+  new hold is a new booking even on the same slot. Pressing Confirm again after a failure still reuses that
+  hold's key, so a lost answer cannot become a second visit. If you drive the booking reducer yourself, call
+  `televetBookingKey` once when a hold is awarded and keep the result in the draft; calling it at submit time
+  would give each retry its own key. Both platforms.
+- **A booking answered with a visit that is not live is never confirmed.** `TelevetBookingController.book`
+  used to settle any readable 2xx as a booking. It now settles a consult outside the platform's live statuses
+  (`scheduled`, `in_progress`, `awaiting_summary`) as a refusal: a cancelled, no-show, completed or abandoned
+  visit, or a status this build does not know. The booking flow shows it as the existing slot-taken refusal
+  ("That time was just taken. Pick another.") and returns to the time grid, where picking a time takes a new
+  hold, and so a new key. `onBooked` is not called. The flow checks the same thing before it draws the
+  confirmation, so a controller you inject through the `controller` prop is held to it too. Both platforms.
+- **A booking whose key the platform refuses goes back to the time grid, not round Confirm.** From EFBackend
+  #1480 the platform answers a booking whose `Idempotency-Key` names a visit that has ended, or a live visit on
+  another slot or for another pet, with 409 `IDEMPOTENCY_KEY_REUSED_DIFFERENT_REQUEST`, and records nothing.
+  The booking flow read that as a retryable failure and left Confirm live on the review step, and Confirm
+  resent the same key, so every press got the same 409. `TelevetBookingController.book` now gives that refusal
+  the reason code `televet_booking_key_reused`, and the flow shows it as the existing slot-taken refusal ("That
+  time was just taken. Pick another.") on the time grid, where picking a time takes a new hold, and so a new
+  key. `onBooked` is not called. The error code stays `idempotencyConflict` and is still not retryable, and no
+  other route's `idempotencyConflict` changes meaning. A controller you inject through the `controller` prop
+  gets the same remedy. Both platforms.
+- **Going Back from review and picking the same time no longer sends a second hold.** The time step took a
+  new hold on every pick, including the time the member already held. The platform claims a hold only on an
+  open slot, so it answered 409: the member read "That time was just taken. Pick another." about their own
+  hold, the chip stayed listed, and every press spent one of the member's hourly holds. A pick of the slot the
+  draft already holds, unexpired, now goes straight back to review with the same hold and booking key, as
+  consumer web does. After a real 409 on a hold the flow re-reads the times, so the one that went leaves the
+  grid. A booking refused as slot-taken (a taken slot, a lapsed hold, a visit that is not live, a reused key)
+  now also drops the draft's hold and key and re-reads the times, so the next pick, even of the same time, is
+  a fresh hold with a fresh key. Both platforms.
+- **A hold refused for any reason but a conflict no longer says the time was taken.** A rate limit (429), a
+  server fault or a dropped connection on the hold showed "That time was just taken. Pick another." The time
+  step now shows the existing line "That did not book. Try again." for all three. A 402 on a hold now opens
+  the paused state, as a 402 at Confirm does. The time stays on the grid. No new strings. Both platforms.
+- **A rate limit never shows the server's sentence: the booking steps and the visits list show their existing
+  lines.** A 429 at Confirm printed the platform's own sentence under Confirm, and since 0.5.1 a rate-limited
+  visits list printed it in its error card. That sentence carries an em-dash. By the owner's decision of
+  2026-09-24, one rule everywhere, as consumer web does: the time step and the review step show the existing
+  line "That did not book. Try again." for a 429, and the visits list shows the card it shows for any other
+  failed read, "Could not load your visits" with "Check your connection and try again." (web), or the title
+  alone (React Native), each with its Try again button. The visits list still settles after one request, as
+  0.5.1 made it. The review step's line keeps the test id `televet-review-rate-limited`.
+  `TelevetBookingFailure` still names the case `rate_limited`, and `televetBookingRefusal` still carries the
+  server's `message` for a host that reads it. No new strings. Both platforms.
+- **Back from review keeps the day of the held time.** The day strip reopened on the first offered day, with
+  the member's own time out of sight. It now opens on the held slot's day and scrolls that day into the middle
+  of the strip, once, when the strip first draws it. Only the strip scrolls, never the page around it. Both
+  platforms.
+- **A booking refused at Confirm keeps the member's day (web).** After a slot-taken refusal at Confirm (a taken
+  slot, a reused key, a visit that is not live) the time step reopened on the first offered day, because the
+  refusal clears the held slot the strip took its day from. It now reopens on the refused time's day while that
+  day still has times, and on the first offered day only when it has none, as consumer web does. The hold and
+  its booking key are still dropped, so the next pick is a fresh hold under a new key. No new strings.
+- **The review states the visit length the platform serves.** The review's length row printed the SDK's
+  `CONSULT_MINUTES` (10) whatever the held slot said. It now reads the held slot's own interval
+  (`ends_at - starts_at`), which is the length the platform runs the visit for (15 minutes on the platform's
+  default grid since 2026-09-18, and 20, 30 or 60 for a clinician on longer slots) and the one consumer web's
+  review shows. It is capped at 60 minutes, as the platform caps it, and falls back to `CONSULT_MINUTES` only
+  for a slot that does not say. It is the only length served before a booking exists: `call_limits` arrives
+  with the join. Both platforms.
+- **The calendar entry ends when the booked visit does (web).** The booked confirmation's calendar entry ended
+  `CONSULT_MINUTES` (10) after the start whatever the booked slot said, so on the platform's 15-minute default
+  grid every visit was written 5 minutes short, into the `.ics` file's `DTEND` and into the `endDate` a partner's
+  own `TelevetCalendarWriter` receives. It now ends after the booked slot's served length, the same one the
+  review states; consumer web ends its file at the booked slot's served end. `TelevetBookedScreen` takes the
+  length as an optional `lengthMinutes`, which the prebuilt flow passes; a screen mounted without it keeps
+  `CONSULT_MINUTES`. React Native's confirmation still uses the constant.
+- **Leaving the in-page vet call returns to the visits instead of a blank dialog (web).** In 0.5.1, pressing the
+  lobby's own Leave left the visit dialog open, modal and blank, with no close control, and Escape did nothing;
+  the partner page behind it stayed blocked. `EverfurVetCall` removed Daily's Prebuilt iframe from the page
+  before awaiting `leave()`, and Daily's `leave()` only settles when that iframe answers, so it never settled,
+  `destroy()` never ran and `onLeave` never fired. Every Leave the SDK draws now keeps the frame in the page until
+  Daily has let go, waits at most 5 seconds for it, reports the departure once however often it is pressed, and
+  releases the Daily instance, so the member can join again without a reload. That includes a Leave that hit the
+  5 second bound and a call the host unmounted mid-leave, which used to leave the instance registered (daily-js
+  then refused the next frame on the page), and a host that unmounts the call mid-leave is no longer called back
+  afterwards. After Daily's own Leave the instance is released at once as well, not only when the host unmounts
+  the call.
+- **The in-page join asks the recording notice BEFORE it calls `POST /consults/{id}/join` (web).** That request
+  mints the token and records the member's arrival for the clinician, and the join screen sent it on mount, before
+  the notice, so a member who pressed "Not now" had already been logged as arriving. The order is now the
+  consumer web app's: the notice first, the request only from "Continue to the call" (the notice stays up,
+  controls disabled, while it travels), and "Not now" sends nothing. A page without the Daily module registered
+  says the visit cannot be joined before any notice or request. The acceptance covers one consult and one visit
+  into the room: a join screen handed another consult, or reached again after leaving, asks again before it
+  sends anything. The call surface does not ask a second time behind the join screen; that is an internal
+  receipt, not a prop, and `EverfurVetCall` still has no prop that skips the notice.
+- **The web call is Daily's frame, with no SDK lobby (web).** `EverfurVetCall` no longer stacks the lobby panel
+  (and its second Leave and a hardcoded "10 MINUTE VISIT") under the frame, matching the consumer web app's owner
+  room: in the room, Daily's own tray carries Leave. Daily's rename control is off, as it is there. The frame's
+  height is capped at `calc(100dvh - 8rem)`, as the consumer web app caps its owner room, so in a wide container
+  Daily's tray (and its Leave) stays above the fold; before, a 16:9 frame at full width could be as tall as the
+  viewport. `clinicianName` and `petName` are still accepted and are not shown on the web.
+  `EverfurVetCallLobby` is still exported for a host that draws its own. The failure card and its Leave are
+  unchanged.
+- **A way out before the room (web).** While the call was joining (Daily's frame loading, Daily's own pre-join
+  screen, which has a Join and no Leave, or a frame the page never let load) the member's only control was Join:
+  the dialog has no close control and Escape was swallowed. `EverfurVetCall` now draws its Leave under the frame
+  until Daily reports the member in the room, and removes it there.
+- **Daily's pre-join fits the frame on a phone (web).** Daily's pre-join screen lays itself out by the frame's
+  shape, and the frame was 16:9 at every width, so at phone width Daily drew its side-by-side layout into 390 or
+  358 px: Join and the heading ran about 34 px past the right edge and the camera and microphone toggles went off
+  the left edge (iPhone 14 emulation, Chromium and WebKit). On a phone in landscape the height cap cut the toggle
+  row by 43 px. Until the member is in the room, `EverfurVetCall` now sizes the frame by its own width: narrower
+  than 480 px it is portrait (3:4) and at least 500 px tall, so Daily stacks its pre-join; from 480 px it stays
+  16:9 under the cap, with a floor of 45% of its width (at least 270 px) that only binds where the cap would cut
+  the toggle row, and the page scrolls there. In the room the frame is the 16:9 box under the cap, as before.
+  `scripts/measure-call-prejoin.mjs` measures it against Daily's real Prebuilt.
+- **Escape on the in-page join screen is Leave everywhere except in the room (web).** It was swallowed for as
+  long as the call module was loaded: at Daily's pre-join screen, on the failure card and after the member had
+  left. It is now swallowed only between Daily's `joined-meeting` and the departure, so it never hangs up a call,
+  and while the join request travels, as the consumer web app holds its decline then.
+- **Coming back to the visits puts focus on them (web).** Closing a booking started from the visits, declining
+  the recording notice, leaving the call or moving a visit popped the screen that held focus, and nothing on the
+  visits took it, so focus fell to `<body>` with the dialog still open: a screen reader said nothing. The
+  visits' first heading (Upcoming visits, else Past visits) now takes focus once the list has loaded, as the
+  booking steps' headings do, or the error notice when the list fails to load. It is `tabIndex={-1}`, so never a
+  tab stop. The flow's first screen still takes no focus from your page, and focus the member moved while the
+  list loaded stays where it is. `EverfurTelevet` tells the screen through its new `returnedTo` prop; a host
+  that mounts `TelevetVisitsScreen` in its own router can pass it the same way.
+- **The recording notice takes focus when it appears (web).** Pressing Join on a visit replaced the visits with
+  the recording notice, and pressing Continue replaced the notice with the busy one the join request waits
+  behind. Each time the pressed control went with its screen and focus fell to `<body>` with the dialog still
+  open (the partner web call run of 2026-09-24, SDK main 62998c4). The notice's `alertdialog` now takes that
+  focus when it mounts, so it is announced by its title and Tab reaches Continue next, and the busy notice takes
+  it again while the request travels, when both its buttons are disabled. It is `tabIndex={-1}`, so never a tab
+  stop, and it takes focus only from `<body>`, never from a control the member is on. The same run found focus on
+  `<body>` after Not now, the pre-join Leave and Daily's own Leave; those returns land on the visits heading
+  (the entry above), now pinned through the whole call path.
+- **Closing a dialog under React StrictMode returns focus to the control that opened it (web).** In development
+  StrictMode runs a mount effect twice with a simulated unmount between. The shared dialog hook restored focus
+  in that simulated unmount, where the page behind the still-modal dialog refused it, forgot the opener, and on
+  the re-run recorded the dialog itself as the opener; when the dialog really closed, focus fell to `<body>`.
+  The opener is now the control captured before `showModal()`, kept until focus actually lands on it. Every web
+  dialog shares the hook: the in-page vet visit, the chat sheets and the records sheets. That includes the visit
+  opened from inside `EverfurChat` (the urgency banner's Find a vet and the header's Talk to a vet), where the
+  partner web chat run of 2026-09-24 saw focus land on the page after the close. Production builds were not
+  affected.
+- **`EverfurVetCallLobby` states the served visit length or none (web).** It defaulted to a hardcoded 10 minutes
+  (`VET_CALL_CONSULT_MINUTES`), which is wrong for any slot that is not 10 minutes long. Pass the join response's
+  `callLimits.consultMinutes`; without `consultMinutes` the duration line is not drawn.
+- **React Native: `onLeave` fires once when the member leaves the vet call.** daily-js emits `left-meeting`
+  before `leave()` settles, so `EverfurVetCall` reported the departure from that event and again from the Leave
+  control, and a host that navigates on `onLeave` navigated twice. Every departure path now reports through one
+  guard, the consumer app's fix of 2026-09-13. On the member's own Leave the report waits for `leave()` and
+  `destroy()` to settle, so the surface stays mounted while Daily releases the camera and microphone, and that
+  wait is bounded at 5 seconds, so a `leave()` that never settles can no longer strand the member. A second
+  press while leaving is the same departure, and the recording notice's Leave reports once too. Nothing is
+  reported once the host has taken the surface down, so a departure that settles late, or a room the host
+  replaced while it was still leaving, cannot send a stale `onLeave` after the member has moved on.
+- **React Native: the call lobby states the visit length the server sold.** The duration line always read
+  `VET_CALL_CONSULT_MINUTES` (10), while the join response's `call_limits.consult_minutes` was parsed and then
+  dropped. `TelevetJoinScreen` now passes the served value to the call, the lobby quotes it through the existing
+  `VET_CALL_COPY.lobbyDuration`, and the in-call clock turns to the danger colour at that same length, as the
+  consumer app does. With no served value, or one that is not a whole number of at least 1, both are unchanged.
+  One optional prop is added for this, and no existing signature changes: `EverfurVetCall` and
+  `EverfurVetCallLobby` (`@everfur/sdk/televet/call`) take `consultMinutes`, the length the join response served
+  (`VetCallCredential.callLimits?.consultMinutes`). A host that mounts the call itself can pass it; absent, the
+  lobby says what it said before.
+- **React Native: the recording notice comes before `POST /consults/{id}/join`, and Leave on it sends nothing.**
+  That POST mints the room token and records the member's arrival for the clinician, and `TelevetJoinScreen`
+  sent it on mount, before the call surface showed "This consultation is recorded.", so a member who pressed
+  Leave on the notice had already been logged as arriving (the web join had the same order, known issue k4).
+  The join screen now shows the notice first and sends the join only on "Continue to the call", once per press.
+  While the request travels the notice stays up with Continue busy, and Leave still leaves, because iOS has no
+  back button; an answer that arrives after Leave opens nothing. The call surface is told the member already
+  accepted through an internal receipt for the room just minted, so it does not ask twice. There is no prop for
+  this: `EverfurVetCall` mounted by a host still asks on every mount, whatever props it is given. An app without
+  the Daily modules registered is told it cannot join before any notice or request, and the setup instruction
+  still reaches the console. No public signature changes.
+- **React Native: an acceptance of the recording notice covers one consult and one visit into its room.**
+  `TelevetJoinScreen` handed another `consultId` while mounted now asks the notice again before that consult's
+  join is sent, and so does a consult it is handed back: an earlier Continue for a consult is spent once the
+  screen shows another, so returning to it never sends its join without a new press. When the call reports that the member left or the vet ended it, the join screen lets the room
+  go, so a host that keeps the screen mounted after `onLeave` shows the notice again, not a finished call that
+  still swallows the back press. `EverfurVetCall` handed another `roomUrl` while mounted is a fresh surface: it
+  asks the notice again before joining the new room, leaves and destroys the first, and carries no participant,
+  clock or reported departure across. No public signature changes.
+- **React Native: the vet call is destroyed even when `leave()` never settles.** The teardown awaited `leave()`
+  before calling `destroy()`, so a `leave()` that hung meant `destroy()` was never called: the 5 second bound
+  reported the departure while the Daily call object stayed alive, possibly with the microphone and camera, and
+  a rejoin in the same session could throw "Duplicate DailyIframe instances are not allowed". `EverfurVetCall`
+  now waits for `leave()` for at most those 5 seconds, then, whether it settled, failed or timed out, turns the
+  microphone and camera off (`setLocalAudio(false)`, `setLocalVideo(false)`) and calls `destroy()`. `onLeave`
+  still fires once, after `destroy()` has been called. One limit remains in daily-js itself: its `destroy()`
+  begins with a `leave()` of its own, so a call object that never answers at all can still hold `destroy()`
+  open and ignore the device calls. No public signature changes.
+- **React Native: the in-app vet call opens with the real `@daily-co/react-native-daily-js`.** In 0.5.0 and
+  0.5.1 it never opened: every install registered as the docs say failed the SDK's shape check ("optional peer
+  '@daily-co/react-native-daily-js' is present but failed its shape check"). On the real package `default` is
+  the Daily class and `createCallObject` a static of it, and the check read `default` only when it was a plain
+  object, which is what its tests had stood in for it. It now reads a class default as well, calls
+  `createCallObject` on the class, and a contract suite holds it to the real package's own dist entry. No
+  public signature changes.
+- **React Native: an app whose Daily module does not load is told so before the recording notice.** The join
+  screen asked only whether a module was registered, so a registered module that then failed to load showed the
+  notice, sent `POST /consults/{id}/join` (which stamps the member's arrival for the clinician) and only then
+  refused. It now asks the call's own guarded load first, and refuses with Leave before any notice or request.
+- **React Native: the join screen's refusals stay inside the safe area and the screen gutter.** The SDK's modal
+  dropped its safe-area padding as soon as the call module loaded, so a call that then could not open drew its
+  refusal under the status bar. The padding now goes only when the room itself renders. The recording notice,
+  the refusals on the join screen and the reschedule screen now sit in the same side gutter as the visits and
+  the visit screens.
+- **A records upload works on an Expo app (React Native).** On a partner's Expo SDK 57 app every records upload
+  failed and the member saw "Retry 1 that didn’t upload". It is the chat photo defect above:
+  `createRnRecordsUploadTransport` posted React Native's `{ uri, name, type }` FormData part through the global
+  `fetch`, which Expo replaces with `expo/fetch`, and its multipart encoder throws "Unsupported FormDataPart
+  implementation" on that part before any request exists. The records transport now posts through React Native's
+  own `XMLHttpRequest` too, and both transports share one request module, so records and chat make the same
+  request. The file still streams from disk, the policy fields still go first and the file last, no
+  cookie rides the request, and every failure still rejects with the same bounded message. `onProgress` still
+  reports completion only. The `fetch` option is unchanged and still wins when given.
+- **A failed records upload row shows the file, "Failed" and why (React Native).** The row drew blank, with only
+  "Retry 1 that didn’t upload" under it. The file name, the status label and the reason shared one flex row, and
+  the reason, which could not shrink, kept the whole line and left the name and "Failed" 0 pt wide. The reason
+  now sits under the name and the label. The uploading row's progress bar, which sat in the same row the same
+  way, is under them too.
+- **A refused records file is named with why, and never opens an empty request.** On the web upload card,
+  picking ONE file that is not a PDF, or ONE PDF over 25 MB, showed the connection line ("We couldn’t upload
+  that record. Check your connection and try again.") although nothing was sent, while the same files picked
+  together showed the skipped-files message. The card now shows the skipped-files message for whatever it
+  refused, however many files were picked. On both platforms the card created the owner request before it
+  looked at the pick, so a pick where every file was refused left an empty request on the member's page. The
+  card now classifies the pick first, by the same PDF and 25 MB rule the upload applies, creates the request
+  only when at least one file will upload, and hands only those files to `uploadDocuments`. A React Native
+  picker handle without `sizeBytes` is refused before any request exists, as the `RecordsDocumentPicker`
+  contract already said. Both platforms.
+- **React Native: pull to refresh on the records request screen.** The consumer app re-reads a request when the
+  member pulls its request screen down; the SDK request screen had no way to re-read a status such as "Checked
+  by our team" short of leaving and coming back. `EverfurRecordsRequest` now carries a `RefreshControl` that
+  re-reads what the screen loaded. As in the app, the spinner shows for the member's pull only, until the re-read
+  settles, never for the status poll, and the screen keeps the request on screen while it re-reads instead of
+  going back to its skeleton. The request list (`EverfurRecordsRequests`) has no pull to refresh, as the
+  consumer app's request list has none. No new copy.
+
+## [0.5.1] - 2026-09-23
+
+Fixes from the partner end-to-end run of 2026-09-23 (a Vite React web app and an Expo app, built through the
+MCP planner, against staging). No public signature changes.
+
+### Fixed
+
+- **A partner member is told booking is paused, never that they need Pro.** On the partner plane the televet
+  entitlement read answers whether YOUR allowance is on, not whether the member has a plan. When it answered
+  `active: false` (allowance not set yet, suspended, set to 0 or used up) the booking flow opened, on both
+  platforms and from every vet entry, on "A Pro membership is needed to book a video visit.", with Close as the
+  only control. That state now renders what the unavailable branch renders: your `renderUnavailable` when you
+  pass one, else the paused card ("Booking is not available right now."). A 402 at Confirm joins the same state
+  instead of printing the membership sentence under Confirm. The test id `televet-booking-not-entitled` and the
+  optional "Check availability" escape are unchanged. The exported `TelevetEntitlementInterestState` draws the
+  paused card too. `confirmNotEntitled` stays in the copy deck and no screen renders it.
+- **Close on an untouched booking leaves without asking.** The auto-matched vet counted as an answer, so every
+  booking with a non-empty roster asked "Leave without booking? Your answers will not be saved." of a member who
+  had entered nothing. Typed text and a held slot still ask. Both platforms.
+- **A rate-limited televet read settles after one request.** The televet 429 names its wait as
+  `retry_after_seconds` in the body; the request funnel read only `resets_at`, so each such 429 was retried up to
+  the attempt ceiling against a window that could have minutes left. A numeric `retry_after_seconds` is now the
+  retry override, a wait past the retry budget settles on the first 429, and `televet_rate_limited` normalizes to
+  `rateLimited`. The visits list shows the server's own sentence for a rate limit instead of "Check your
+  connection and try again." (web), or under its title (React Native); no sentence is written by the SDK.
+- The upload progress line no longer reads "Uploading 2 of 1..." while the last file is being confirmed; the
+  counter is held to the total, on the card and in the queue's live region.
+- Web surfaces stop a host page's inherited `text-align` at their root. A stock Vite app's `#root` centers text,
+  which centered chat replies, the records timeline and the clinic request form. Chat, every records screen, the
+  clinic request composer, the booking flow, the visits list, the call and its lobby, the capability off-state
+  and the clinical disclaimer set `text-align: start` on their root; your `style` prop still wins.
+- The web full record's two header actions draw the consumer's icons (Feather `send` and `share-2`, as the
+  React Native SDK already does) instead of a rotated square and an empty circle. Their accessible names are
+  unchanged.
+- The web records entry's size line moves 90_300 -> 94_800 gzip bytes (measured 90_326, plus 5%): main held it
+  by 350 bytes and the icons (+290) with the text-align reset and the counter clamp (+86) crossed it by 26.
+  Every other entry holds its line on the same build.
+
 ## [0.5.0] - 2026-09-23
 
 0.4.1 was tagged but never published to npm: its fixes (the five televet refusal screens and the rest

package/dist/BookedScreen-BJPbXLCG.d.ts

@@ -0,0 +1,54 @@
+import { ReactNode } from 'react';
+import { T as TelevetConsult } from './bookingTypes-DCs8mmBb.js';
+
+/** The calendar entry a booked visit asks the host to write. */
+interface TelevetCalendarEvent {
+    /**
+     * A stable key for THIS consult's entry.
+     *
+     * Keyed on the CONSULT so a re-press updates the same entry rather than writing a second event for one
+     * visit, and so a later cancel or reschedule can address the SAME row. A host that ignores the key writes
+     * duplicates the owner has to clean up by hand.
+     */
+    readonly key: string;
+    readonly title: string;
+    readonly startDate: Date;
+    readonly endDate: Date;
+    /** The reminder offset in minutes, negative for "before". The platform queues its own at the same offset. */
+    readonly alarmOffsetMinutes: number;
+}
+/**
+ * Writes the entry. Resolves true when it landed in a calendar; false when the host has no calendar to write to
+ * or the entry could not be written; `'handed-off'` when the entry was handed to the member to add themselves (a
+ * file download, as `downloadTelevetCalendarFile` does), which puts nothing in a calendar yet. On true the
+ * confirmation says the visit was added; on `'handed-off'` it keeps Add to Calendar, enabled, so the member can
+ * press it again, as the consumer web app's link can be.
+ */
+type TelevetCalendarWriter = (event: TelevetCalendarEvent) => Promise<boolean | 'handed-off'>;
+/** The calendar key for a consult. One definition, so a cancel and a reschedule address the booked row. */
+declare function televetConsultCalendarKey(consultId: string): string;
+interface TelevetBookedScreenProps {
+    readonly consult: TelevetConsult;
+    readonly petName: string | null;
+    readonly onDone: () => void;
+    /** Absent, there is no Add to calendar control. */
+    readonly onAddToCalendar?: TelevetCalendarWriter | undefined;
+    /**
+     * Has the host PROVEN it can host the call in place? Defaults to false.
+     *
+     * Fail closed: a host that has not said so is assumed not to have mounted the call surface, and the in-place
+     * join promise is withheld rather than printed on a hope.
+     */
+    readonly canJoinInApp?: boolean;
+    /**
+     * How long the visit is, in minutes: the booked slot's served length (`televetSlotMinutes`), which is the
+     * length the platform runs the visit for. The calendar entry ends this long after the start.
+     *
+     * Absent, or not a positive number, the entry falls back to `CONSULT_MINUTES`, the same fallback the review's
+     * length row uses for a slot that does not say. The prebuilt flow always passes the slot's length.
+     */
+    readonly lengthMinutes?: number | undefined;
+}
+declare function TelevetBookedScreen({ consult, petName, onDone, onAddToCalendar, canJoinInApp, lengthMinutes, }: TelevetBookedScreenProps): ReactNode;
+
+export { type TelevetCalendarWriter as T, type TelevetCalendarEvent as a, TelevetBookedScreen as b, type TelevetBookedScreenProps as c, televetConsultCalendarKey as t };

package/dist/BookedScreen-Cnld-jB_.d.cts

@@ -0,0 +1,54 @@
+import { ReactNode } from 'react';
+import { T as TelevetConsult } from './bookingTypes-DCs8mmBb.cjs';
+
+/** The calendar entry a booked visit asks the host to write. */
+interface TelevetCalendarEvent {
+    /**
+     * A stable key for THIS consult's entry.
+     *
+     * Keyed on the CONSULT so a re-press updates the same entry rather than writing a second event for one
+     * visit, and so a later cancel or reschedule can address the SAME row. A host that ignores the key writes
+     * duplicates the owner has to clean up by hand.
+     */
+    readonly key: string;
+    readonly title: string;
+    readonly startDate: Date;
+    readonly endDate: Date;
+    /** The reminder offset in minutes, negative for "before". The platform queues its own at the same offset. */
+    readonly alarmOffsetMinutes: number;
+}
+/**
+ * Writes the entry. Resolves true when it landed in a calendar; false when the host has no calendar to write to
+ * or the entry could not be written; `'handed-off'` when the entry was handed to the member to add themselves (a
+ * file download, as `downloadTelevetCalendarFile` does), which puts nothing in a calendar yet. On true the
+ * confirmation says the visit was added; on `'handed-off'` it keeps Add to Calendar, enabled, so the member can
+ * press it again, as the consumer web app's link can be.
+ */
+type TelevetCalendarWriter = (event: TelevetCalendarEvent) => Promise<boolean | 'handed-off'>;
+/** The calendar key for a consult. One definition, so a cancel and a reschedule address the booked row. */
+declare function televetConsultCalendarKey(consultId: string): string;
+interface TelevetBookedScreenProps {
+    readonly consult: TelevetConsult;
+    readonly petName: string | null;
+    readonly onDone: () => void;
+    /** Absent, there is no Add to calendar control. */
+    readonly onAddToCalendar?: TelevetCalendarWriter | undefined;
+    /**
+     * Has the host PROVEN it can host the call in place? Defaults to false.
+     *
+     * Fail closed: a host that has not said so is assumed not to have mounted the call surface, and the in-place
+     * join promise is withheld rather than printed on a hope.
+     */
+    readonly canJoinInApp?: boolean;
+    /**
+     * How long the visit is, in minutes: the booked slot's served length (`televetSlotMinutes`), which is the
+     * length the platform runs the visit for. The calendar entry ends this long after the start.
+     *
+     * Absent, or not a positive number, the entry falls back to `CONSULT_MINUTES`, the same fallback the review's
+     * length row uses for a slot that does not say. The prebuilt flow always passes the slot's length.
+     */
+    readonly lengthMinutes?: number | undefined;
+}
+declare function TelevetBookedScreen({ consult, petName, onDone, onAddToCalendar, canJoinInApp, lengthMinutes, }: TelevetBookedScreenProps): ReactNode;
+
+export { type TelevetCalendarWriter as T, type TelevetCalendarEvent as a, TelevetBookedScreen as b, type TelevetBookedScreenProps as c, televetConsultCalendarKey as t };

package/dist/{Chat-TA-aTcVF.d.cts → Chat-B43wIXCv.d.cts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.cjs';
 import { F as FileHandle } from './ports-BN6RHF9W.cjs';
-import { a as ChatCheckinTarget } from './ports-C2EVK416.cjs';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-DZZoEG3r.cjs';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-DHvnITuE.cjs';
+import { a as ChatCheckinTarget } from './ports-BSm48zIC.cjs';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-B3vr628I.cjs';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-CEmT52IA.cjs';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';

package/dist/{Chat-BOX-03ho.d.ts → Chat-my5aJLz5.d.ts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.js';
 import { F as FileHandle } from './ports-BN6RHF9W.js';
-import { a as ChatCheckinTarget } from './ports-BO3bzTJg.js';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-BjKJ8UsN.js';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-C_vtFu2f.js';
+import { a as ChatCheckinTarget } from './ports-DHhxhn95.js';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-DdzgINfF.js';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-DU1djTNd.js';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';

package/dist/{DepthViews-DSFyaSeL.d.cts → DepthViews-BBTv9VAs.d.cts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-Bnw36jPr.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DRNry1r9.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{DepthViews-Cviea-ri.d.cts → DepthViews-BLK0kgza.d.cts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-Bnw36jPr.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DRNry1r9.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;

package/dist/{DepthViews-CgjX2AJ5.d.ts → DepthViews-CNqAyjne.d.ts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-DFF7Faxx.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DnDhTaUL.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{DepthViews-D2dRqWRq.d.ts → DepthViews-G-7YRtOX.d.ts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-DFF7Faxx.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DnDhTaUL.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;