@everfur/sdk 0.6.0 → 0.7.1

package/dist/{depth-NmWSbvfi.d.cts → depth-CAAwiStc.d.cts}

@@ -1,11 +1,117 @@
 import { E as EverfurResult } from './EverfurResult-ZtH-YV1h.cjs';
 import { P as PetRef } from './ids-B2GAAifq.cjs';
-import { R as RequestFunnel } from './requestFunnel-DAwb7haa.cjs';
-import { A as AuthContext } from './identity-D7PO5s9m.cjs';
+import { R as RequestFunnel } from './requestFunnel-DMR_1T3O.cjs';
+import { A as AuthContext } from './identity-DUlshgow.cjs';
 import { E as ErrorPolicyPort } from './ErrorPolicyPort-D6CybiqJ.cjs';
 import { d as RecordsRequestView, R as RecordDocumentMeta, a as RecordEntity } from './models-Bn2z0NNo.cjs';
 import { E as EverfurError } from './EverfurError-DmELDpXp.cjs';
 
+/** Who a share link is for, while the server's audience switch is on (V819), in the order it offers them. */
+type RecordShareAudience = 'vet' | 'groomer' | 'boarding';
+/** Every audience this package can name, in the design's order. */
+declare const RECORD_SHARE_AUDIENCES: readonly RecordShareAudience[];
+/** Who an emailed record goes to: an audience, or `other` (the neutral email wording and no audience). */
+type RecordShareRecipientKind = RecordShareAudience | 'other';
+/**
+ * What a link minted for one audience carries (`ShareAudienceScope` on the wire): the content `sections` of the
+ * shared record and, for a care handoff that is not a vet, the only `entityTypes` it keeps (null: every type).
+ */
+interface RecordShareAudienceScope {
+    readonly audience: RecordShareAudience;
+    readonly sections: readonly string[];
+    readonly entityTypes: readonly string[] | null;
+}
+/** A freshly minted share link. `shareUrl` is shown once; the list read never repeats it. */
+interface RecordShareLink {
+    readonly shareId: string;
+    readonly shareUrl: string;
+    readonly expiresAt: string | null;
+    /**
+     * The audience the link was stamped with; null for a link minted without one (or with the switch off). Always
+     * set by this package's mapper; optional only so a value a host builds itself (a test double) still type-checks.
+     */
+    readonly audience?: RecordShareAudience | null;
+}
+/** One live share link as the list read reports it (no URL: the token was shown once, at creation). */
+interface RecordShare {
+    readonly shareId: string;
+    readonly expiresAt: string | null;
+    readonly createdAt: string | null;
+    readonly viewCount: number;
+    readonly lastViewedAt: string | null;
+    /**
+     * The audience the link was stamped with; null for none, an unknown one, or with the switch off. Always set by
+     * this package's mapper; optional only so a value a host builds itself (a test double) still type-checks.
+     */
+    readonly audience?: RecordShareAudience | null;
+}
+/** Email the record: the recipient's address and who they are (which picks the email's wording). */
+interface RecordShareEmailInput {
+    readonly recipientEmail: string;
+    readonly recipientKind: RecordShareRecipientKind;
+}
+/**
+ * The emailed link's receipt: the id to turn it off by and the date it dies. NO URL, by design: the server never
+ * returns the link for an email send, and this shape has nowhere to put one.
+ */
+interface RecordShareEmailReceipt {
+    readonly shareId: string;
+    readonly expiresAt: string | null;
+    readonly audience: RecordShareAudience | null;
+}
+/** The presigned PDF download. */
+interface RecordPdfLink {
+    readonly downloadUrl: string;
+    readonly expiresAt: string | null;
+}
+/** The longest address the email route accepts (`recipient_email: Field(max_length=254)`). */
+declare const SHARE_RECIPIENT_EMAIL_MAX = 254;
+/**
+ * The email route's own lenient address check (records_router.py `_EMAIL_RE`, which the widget route imports), so
+ * an address the server would refuse is refused here before a request is spent. Not an RFC 5322 parser.
+ */
+declare function isShareRecipientEmail(value: string): boolean;
+/**
+ * `share_audiences` off the features read, FAIL CLOSED: absent, not a list, or any entry off the documented shape
+ * is NO audiences, so a surface never claims a scope it cannot read. An audience this package cannot name (a
+ * newer server's) and a repeat are dropped; the rest keep the server's order.
+ */
+declare function mapShareAudiences(wire: unknown): readonly RecordShareAudienceScope[];
+/**
+ * The share link as an absolute https URL. The consumer route returns the RELATIVE form
+ * (`/api/v1/records/everfur_record/shared/<token>.pdf`), which is resolved against the API base URL the
+ * client was built for; an absolute value is kept as it is. A link that cannot be made absolute https (a
+ * relative path with no base URL, another scheme, a malformed value) is refused: it is never opened raw.
+ */
+declare function resolveShareUrl(shareUrl: string, apiBaseUrl: string | undefined): string | null;
+/** The mint response to a frozen link, or null when malformed (fail-closed: no link is better than a bad one). */
+declare function mapRecordShareLink(wire: unknown, apiBaseUrl?: string): RecordShareLink | null;
+/** The list response to frozen rows, or null when malformed. */
+declare function mapRecordShareList(wire: unknown): readonly RecordShare[] | null;
+/** The email send's answer to a frozen receipt, or null when malformed. Only the named keys survive: never a URL. */
+declare function mapRecordShareEmailReceipt(wire: unknown): RecordShareEmailReceipt | null;
+/** The PDF link response to a frozen link, or null when malformed or not https. */
+declare function mapRecordPdfLink(wire: unknown): RecordPdfLink | null;
+
+/** A photo type `uploads/initiate` accepts while photo upload is armed. */
+type RecordsPhotoContentType = 'image/jpeg' | 'image/png' | 'image/heic' | 'image/heif';
+/** A content type `uploads/initiate` can be asked for. */
+type RecordsUploadContentType = 'application/pdf' | RecordsPhotoContentType;
+/** The records features read, mapped. */
+interface RecordsFeatures {
+    /** Every feature the server named, by its wire name (`markers`, `sharing`, ...). Empty when the read failed. */
+    readonly features: Readonly<Record<string, boolean>>;
+    /** What an upload may declare. Always starts with `application/pdf`; photo types only while armed. */
+    readonly uploadContentTypes: readonly RecordsUploadContentType[];
+    /**
+     * Who a share link can be for, in the server's order, each with the scope its link carries. Served only while
+     * the audience switch is on; empty otherwise, and when the list is malformed.
+     */
+    readonly shareAudiences: readonly RecordShareAudienceScope[];
+}
+/** True when an upload may be a photo. An absent list (a host-built state) is PDF only. */
+declare function acceptsPhotos(types: readonly string[] | undefined): boolean;
+
 /** Directory contact details only. The server intentionally does not expose clinic email addresses. */
 interface RecordsClinic {
     readonly id: string;
@@ -276,39 +382,6 @@ interface RecordsRequestDocument {
     readonly expiresInSeconds: number;
 }
 
-/** A freshly minted share link. `shareUrl` is shown once; the list read never repeats it. */
-interface RecordShareLink {
-    readonly shareId: string;
-    readonly shareUrl: string;
-    readonly expiresAt: string | null;
-}
-/** One live share link as the list read reports it (no URL: the token was shown once, at creation). */
-interface RecordShare {
-    readonly shareId: string;
-    readonly expiresAt: string | null;
-    readonly createdAt: string | null;
-    readonly viewCount: number;
-    readonly lastViewedAt: string | null;
-}
-/** The presigned PDF download. */
-interface RecordPdfLink {
-    readonly downloadUrl: string;
-    readonly expiresAt: string | null;
-}
-/**
- * The share link as an absolute https URL. The consumer route returns the RELATIVE form
- * (`/api/v1/records/everfur_record/shared/<token>.pdf`), which is resolved against the API base URL the
- * client was built for; an absolute value is kept as it is. A link that cannot be made absolute https (a
- * relative path with no base URL, another scheme, a malformed value) is refused: it is never opened raw.
- */
-declare function resolveShareUrl(shareUrl: string, apiBaseUrl: string | undefined): string | null;
-/** The mint response to a frozen link, or null when malformed (fail-closed: no link is better than a bad one). */
-declare function mapRecordShareLink(wire: unknown, apiBaseUrl?: string): RecordShareLink | null;
-/** The list response to frozen rows, or null when malformed. */
-declare function mapRecordShareList(wire: unknown): readonly RecordShare[] | null;
-/** The PDF link response to a frozen link, or null when malformed or not https. */
-declare function mapRecordPdfLink(wire: unknown): RecordPdfLink | null;
-
 interface RecordsSignatureSuggestion {
     readonly signatureId: string;
     /** A short-lived presigned https URL of the signature PNG. */
@@ -503,8 +576,29 @@ interface RecordsDepthClient {
     getDocumentContributions(petRef: PetRef, docId: string): Promise<EverfurResult<RecordDocumentContributionsView>>;
     /** The consumer dashboard's lab markers with the BE-computed donut summary (`markers.ts`). */
     getMarkers(petRef: PetRef): Promise<EverfurResult<RecordMarkersView>>;
-    /** Mint a public, expiring share link to the pet's record. The URL is returned ONCE. */
-    createShare(petRef: PetRef): Promise<EverfurResult<RecordShareLink>>;
+    /**
+     * Mint a public, expiring share link to the pet's record. The URL is returned ONCE. `audience` stamps who the
+     * link is for and is sent ONLY when given: pass it only while the features read serves `shareAudiences`, because
+     * with the server's audience switch off an `audience` key is refused (400).
+     */
+    createShare(petRef: PetRef, opts?: {
+        readonly audience?: RecordShareAudience;
+    }): Promise<EverfurResult<RecordShareLink>>;
+    /**
+     * Mint a link and EMAIL it to `recipientEmail` (`POST .../everfur_record/share/email`). The link is never
+     * returned: the receipt is the id to turn it off by and its expiry. Gated like the mint (the sharing feature, the
+     * `records.record.share` capability, the typed 409 without records consent, the tenant's daily quota) plus the
+     * member's hourly email budget (429); a mail that fails after the mint is a retryable 502, and that link stays
+     * listed and revocable. An address the server would refuse is `validationFailed` with no request spent.
+     */
+    emailShare(petRef: PetRef, input: RecordShareEmailInput): Promise<EverfurResult<RecordShareEmailReceipt>>;
+    /**
+     * `GET /widget/v1/records/features`, mapped (`mapRecordsFeatures`): which records features are live and, while
+     * the audience switch is on, the share audiences. NEVER rejects: a failed or malformed read is the fail-closed
+     * answer (no feature known, no audiences). OPTIONAL so a host-built client still satisfies this interface; a
+     * surface given one without it offers no audience.
+     */
+    readFeatures?(): Promise<RecordsFeatures>;
     /** The pet's live share links (never the URLs). */
     listShares(petRef: PetRef): Promise<EverfurResult<readonly RecordShare[]>>;
     /** Turn a link off. A link already off (404) settles as the ordinary not-found error. */
@@ -531,4 +625,4 @@ interface RecordsDepthClient {
 /** The depth client, over the same auth, funnel and error policy as the records repository. */
 declare function createRecordsDepthClient(deps: HttpRecordsRepositoryDeps): RecordsDepthClient;
 
-export { isFactReviewerLocked as $, RECORDS_CLINIC_BATCH_MAX as A, type RecordFactEditInput as B, type CreateClinicRequestBatchInput as C, type RecordFactRemoveInput as D, type RecordMarker as E, FACT_FIELD_BY_KIND as F, type RecordMarkerLatest as G, type HttpRecordsClinicRepositoryDeps as H, type RecordMarkerPoint as I, type RecordMarkerSummary as J, type RecordMarkersView as K, type RecordPdfLink as L, type RecordShare as M, type RecordShareLink as N, type RecordsAuthorizationSignature as O, type RecordsClinicBatch as P, type RecordsClinicBatchClient as Q, type RecordClinicianNote as R, type RecordsClinicBatchItem as S, type RecordsClinicBatchResult as T, type RecordsClinicTarget as U, type RecordsSignatureSuggestion as V, createRecordsClinicBatchClient as W, createRecordsDepthClient as X, factCorrectionFor as Y, factValueCorrection as Z, inferFactValueKind as _, type RecordClinicianNoteSection as a, mapRecordMarkers as a0, mapRecordPdfLink as a1, mapRecordShareLink as a2, mapRecordShareList as a3, mapSignatureSuggestions as a4, resolveShareUrl as a5, type RecordsClinicSearchInput as a6, type RecordsClinicSearchPage as a7, type RecordsRecentClinicsInput as a8, type RecordsAuthorizationCopy as a9, type CreateClinicRequestInput as aa, type RecordsSignatureUploadPolicy as ab, type RecordCompleteness as b, type RecordConflict as c, type RecordConflictCandidate as d, type RecordDepthView as e, type RecordDocumentContributionsView as f, type RecordEncounter as g, type RecordExamSystem as h, type RecordLabMarker as i, type RecordLabPoint as j, type RecordPhysicalExam as k, type RecordsClinic as l, type RecordsDepthClient as m, type RecordsRequestDocument as n, type RecordsTimelineMedication as o, type RecordsTimelineVaccine as p, type RecordsTimelineView as q, type RecordsTimelineVisit as r, type RecordsTimelineWeight as s, mapDocumentContributions as t, mapRecordDepth as u, mapRecordsTimeline as v, FACT_VALUE_FIELD as w, type FactFieldValue as x, type FactValueKind as y, type HttpRecordsRepositoryDeps as z };
+export { type RecordsSignatureSuggestion as $, type HttpRecordsRepositoryDeps as A, RECORDS_CLINIC_BATCH_MAX as B, type CreateClinicRequestBatchInput as C, RECORD_SHARE_AUDIENCES as D, type RecordFactEditInput as E, FACT_FIELD_BY_KIND as F, type RecordFactRemoveInput as G, type HttpRecordsClinicRepositoryDeps as H, type RecordMarker as I, type RecordMarkerLatest as J, type RecordMarkerPoint as K, type RecordMarkerSummary as L, type RecordMarkersView as M, type RecordPdfLink as N, type RecordShare as O, type RecordShareAudienceScope as P, type RecordShareEmailInput as Q, type RecordClinicianNote as R, type RecordShareEmailReceipt as S, type RecordShareLink as T, type RecordShareRecipientKind as U, type RecordsAuthorizationSignature as V, type RecordsClinicBatch as W, type RecordsClinicBatchClient as X, type RecordsClinicBatchItem as Y, type RecordsClinicBatchResult as Z, type RecordsClinicTarget as _, type RecordClinicianNoteSection as a, SHARE_RECIPIENT_EMAIL_MAX as a0, createRecordsClinicBatchClient as a1, createRecordsDepthClient as a2, factCorrectionFor as a3, factValueCorrection as a4, inferFactValueKind as a5, isFactReviewerLocked as a6, isShareRecipientEmail as a7, mapRecordMarkers as a8, mapRecordPdfLink as a9, mapRecordShareEmailReceipt as aa, mapRecordShareLink as ab, mapRecordShareList as ac, mapShareAudiences as ad, mapSignatureSuggestions as ae, resolveShareUrl as af, type RecordsClinicSearchInput as ag, type RecordsClinicSearchPage as ah, type RecordsRecentClinicsInput as ai, type RecordsAuthorizationCopy as aj, type CreateClinicRequestInput as ak, type RecordsSignatureUploadPolicy as al, type RecordsFeatures as am, type RecordsUploadContentType as an, type RecordsPhotoContentType as ao, acceptsPhotos as ap, type RecordCompleteness as b, type RecordConflict as c, type RecordConflictCandidate as d, type RecordDepthView as e, type RecordDocumentContributionsView as f, type RecordEncounter as g, type RecordExamSystem as h, type RecordLabMarker as i, type RecordLabPoint as j, type RecordPhysicalExam as k, type RecordShareAudience as l, type RecordsClinic as m, type RecordsDepthClient as n, type RecordsRequestDocument as o, type RecordsTimelineMedication as p, type RecordsTimelineVaccine as q, type RecordsTimelineView as r, type RecordsTimelineVisit as s, type RecordsTimelineWeight as t, mapDocumentContributions as u, mapRecordDepth as v, mapRecordsTimeline as w, FACT_VALUE_FIELD as x, type FactFieldValue as y, type FactValueKind as z };

package/dist/{depth-CrpRjWGB.d.ts → depth-DfNRVtrV.d.ts}

@@ -1,11 +1,117 @@
 import { E as EverfurResult } from './EverfurResult-SGvHKsCB.js';
 import { P as PetRef } from './ids-B2GAAifq.js';
-import { R as RequestFunnel } from './requestFunnel-CQzz2DIW.js';
-import { A as AuthContext } from './identity-B8rp0L9G.js';
+import { R as RequestFunnel } from './requestFunnel-CiSX2pun.js';
+import { A as AuthContext } from './identity-BhT7oJDS.js';
 import { E as ErrorPolicyPort } from './ErrorPolicyPort-D22LUVrK.js';
 import { d as RecordsRequestView, R as RecordDocumentMeta, a as RecordEntity } from './models-DSqA5Ahs.js';
 import { E as EverfurError } from './EverfurError-DmELDpXp.js';
 
+/** Who a share link is for, while the server's audience switch is on (V819), in the order it offers them. */
+type RecordShareAudience = 'vet' | 'groomer' | 'boarding';
+/** Every audience this package can name, in the design's order. */
+declare const RECORD_SHARE_AUDIENCES: readonly RecordShareAudience[];
+/** Who an emailed record goes to: an audience, or `other` (the neutral email wording and no audience). */
+type RecordShareRecipientKind = RecordShareAudience | 'other';
+/**
+ * What a link minted for one audience carries (`ShareAudienceScope` on the wire): the content `sections` of the
+ * shared record and, for a care handoff that is not a vet, the only `entityTypes` it keeps (null: every type).
+ */
+interface RecordShareAudienceScope {
+    readonly audience: RecordShareAudience;
+    readonly sections: readonly string[];
+    readonly entityTypes: readonly string[] | null;
+}
+/** A freshly minted share link. `shareUrl` is shown once; the list read never repeats it. */
+interface RecordShareLink {
+    readonly shareId: string;
+    readonly shareUrl: string;
+    readonly expiresAt: string | null;
+    /**
+     * The audience the link was stamped with; null for a link minted without one (or with the switch off). Always
+     * set by this package's mapper; optional only so a value a host builds itself (a test double) still type-checks.
+     */
+    readonly audience?: RecordShareAudience | null;
+}
+/** One live share link as the list read reports it (no URL: the token was shown once, at creation). */
+interface RecordShare {
+    readonly shareId: string;
+    readonly expiresAt: string | null;
+    readonly createdAt: string | null;
+    readonly viewCount: number;
+    readonly lastViewedAt: string | null;
+    /**
+     * The audience the link was stamped with; null for none, an unknown one, or with the switch off. Always set by
+     * this package's mapper; optional only so a value a host builds itself (a test double) still type-checks.
+     */
+    readonly audience?: RecordShareAudience | null;
+}
+/** Email the record: the recipient's address and who they are (which picks the email's wording). */
+interface RecordShareEmailInput {
+    readonly recipientEmail: string;
+    readonly recipientKind: RecordShareRecipientKind;
+}
+/**
+ * The emailed link's receipt: the id to turn it off by and the date it dies. NO URL, by design: the server never
+ * returns the link for an email send, and this shape has nowhere to put one.
+ */
+interface RecordShareEmailReceipt {
+    readonly shareId: string;
+    readonly expiresAt: string | null;
+    readonly audience: RecordShareAudience | null;
+}
+/** The presigned PDF download. */
+interface RecordPdfLink {
+    readonly downloadUrl: string;
+    readonly expiresAt: string | null;
+}
+/** The longest address the email route accepts (`recipient_email: Field(max_length=254)`). */
+declare const SHARE_RECIPIENT_EMAIL_MAX = 254;
+/**
+ * The email route's own lenient address check (records_router.py `_EMAIL_RE`, which the widget route imports), so
+ * an address the server would refuse is refused here before a request is spent. Not an RFC 5322 parser.
+ */
+declare function isShareRecipientEmail(value: string): boolean;
+/**
+ * `share_audiences` off the features read, FAIL CLOSED: absent, not a list, or any entry off the documented shape
+ * is NO audiences, so a surface never claims a scope it cannot read. An audience this package cannot name (a
+ * newer server's) and a repeat are dropped; the rest keep the server's order.
+ */
+declare function mapShareAudiences(wire: unknown): readonly RecordShareAudienceScope[];
+/**
+ * The share link as an absolute https URL. The consumer route returns the RELATIVE form
+ * (`/api/v1/records/everfur_record/shared/<token>.pdf`), which is resolved against the API base URL the
+ * client was built for; an absolute value is kept as it is. A link that cannot be made absolute https (a
+ * relative path with no base URL, another scheme, a malformed value) is refused: it is never opened raw.
+ */
+declare function resolveShareUrl(shareUrl: string, apiBaseUrl: string | undefined): string | null;
+/** The mint response to a frozen link, or null when malformed (fail-closed: no link is better than a bad one). */
+declare function mapRecordShareLink(wire: unknown, apiBaseUrl?: string): RecordShareLink | null;
+/** The list response to frozen rows, or null when malformed. */
+declare function mapRecordShareList(wire: unknown): readonly RecordShare[] | null;
+/** The email send's answer to a frozen receipt, or null when malformed. Only the named keys survive: never a URL. */
+declare function mapRecordShareEmailReceipt(wire: unknown): RecordShareEmailReceipt | null;
+/** The PDF link response to a frozen link, or null when malformed or not https. */
+declare function mapRecordPdfLink(wire: unknown): RecordPdfLink | null;
+
+/** A photo type `uploads/initiate` accepts while photo upload is armed. */
+type RecordsPhotoContentType = 'image/jpeg' | 'image/png' | 'image/heic' | 'image/heif';
+/** A content type `uploads/initiate` can be asked for. */
+type RecordsUploadContentType = 'application/pdf' | RecordsPhotoContentType;
+/** The records features read, mapped. */
+interface RecordsFeatures {
+    /** Every feature the server named, by its wire name (`markers`, `sharing`, ...). Empty when the read failed. */
+    readonly features: Readonly<Record<string, boolean>>;
+    /** What an upload may declare. Always starts with `application/pdf`; photo types only while armed. */
+    readonly uploadContentTypes: readonly RecordsUploadContentType[];
+    /**
+     * Who a share link can be for, in the server's order, each with the scope its link carries. Served only while
+     * the audience switch is on; empty otherwise, and when the list is malformed.
+     */
+    readonly shareAudiences: readonly RecordShareAudienceScope[];
+}
+/** True when an upload may be a photo. An absent list (a host-built state) is PDF only. */
+declare function acceptsPhotos(types: readonly string[] | undefined): boolean;
+
 /** Directory contact details only. The server intentionally does not expose clinic email addresses. */
 interface RecordsClinic {
     readonly id: string;
@@ -276,39 +382,6 @@ interface RecordsRequestDocument {
     readonly expiresInSeconds: number;
 }
 
-/** A freshly minted share link. `shareUrl` is shown once; the list read never repeats it. */
-interface RecordShareLink {
-    readonly shareId: string;
-    readonly shareUrl: string;
-    readonly expiresAt: string | null;
-}
-/** One live share link as the list read reports it (no URL: the token was shown once, at creation). */
-interface RecordShare {
-    readonly shareId: string;
-    readonly expiresAt: string | null;
-    readonly createdAt: string | null;
-    readonly viewCount: number;
-    readonly lastViewedAt: string | null;
-}
-/** The presigned PDF download. */
-interface RecordPdfLink {
-    readonly downloadUrl: string;
-    readonly expiresAt: string | null;
-}
-/**
- * The share link as an absolute https URL. The consumer route returns the RELATIVE form
- * (`/api/v1/records/everfur_record/shared/<token>.pdf`), which is resolved against the API base URL the
- * client was built for; an absolute value is kept as it is. A link that cannot be made absolute https (a
- * relative path with no base URL, another scheme, a malformed value) is refused: it is never opened raw.
- */
-declare function resolveShareUrl(shareUrl: string, apiBaseUrl: string | undefined): string | null;
-/** The mint response to a frozen link, or null when malformed (fail-closed: no link is better than a bad one). */
-declare function mapRecordShareLink(wire: unknown, apiBaseUrl?: string): RecordShareLink | null;
-/** The list response to frozen rows, or null when malformed. */
-declare function mapRecordShareList(wire: unknown): readonly RecordShare[] | null;
-/** The PDF link response to a frozen link, or null when malformed or not https. */
-declare function mapRecordPdfLink(wire: unknown): RecordPdfLink | null;
-
 interface RecordsSignatureSuggestion {
     readonly signatureId: string;
     /** A short-lived presigned https URL of the signature PNG. */
@@ -503,8 +576,29 @@ interface RecordsDepthClient {
     getDocumentContributions(petRef: PetRef, docId: string): Promise<EverfurResult<RecordDocumentContributionsView>>;
     /** The consumer dashboard's lab markers with the BE-computed donut summary (`markers.ts`). */
     getMarkers(petRef: PetRef): Promise<EverfurResult<RecordMarkersView>>;
-    /** Mint a public, expiring share link to the pet's record. The URL is returned ONCE. */
-    createShare(petRef: PetRef): Promise<EverfurResult<RecordShareLink>>;
+    /**
+     * Mint a public, expiring share link to the pet's record. The URL is returned ONCE. `audience` stamps who the
+     * link is for and is sent ONLY when given: pass it only while the features read serves `shareAudiences`, because
+     * with the server's audience switch off an `audience` key is refused (400).
+     */
+    createShare(petRef: PetRef, opts?: {
+        readonly audience?: RecordShareAudience;
+    }): Promise<EverfurResult<RecordShareLink>>;
+    /**
+     * Mint a link and EMAIL it to `recipientEmail` (`POST .../everfur_record/share/email`). The link is never
+     * returned: the receipt is the id to turn it off by and its expiry. Gated like the mint (the sharing feature, the
+     * `records.record.share` capability, the typed 409 without records consent, the tenant's daily quota) plus the
+     * member's hourly email budget (429); a mail that fails after the mint is a retryable 502, and that link stays
+     * listed and revocable. An address the server would refuse is `validationFailed` with no request spent.
+     */
+    emailShare(petRef: PetRef, input: RecordShareEmailInput): Promise<EverfurResult<RecordShareEmailReceipt>>;
+    /**
+     * `GET /widget/v1/records/features`, mapped (`mapRecordsFeatures`): which records features are live and, while
+     * the audience switch is on, the share audiences. NEVER rejects: a failed or malformed read is the fail-closed
+     * answer (no feature known, no audiences). OPTIONAL so a host-built client still satisfies this interface; a
+     * surface given one without it offers no audience.
+     */
+    readFeatures?(): Promise<RecordsFeatures>;
     /** The pet's live share links (never the URLs). */
     listShares(petRef: PetRef): Promise<EverfurResult<readonly RecordShare[]>>;
     /** Turn a link off. A link already off (404) settles as the ordinary not-found error. */
@@ -531,4 +625,4 @@ interface RecordsDepthClient {
 /** The depth client, over the same auth, funnel and error policy as the records repository. */
 declare function createRecordsDepthClient(deps: HttpRecordsRepositoryDeps): RecordsDepthClient;
 
-export { isFactReviewerLocked as $, RECORDS_CLINIC_BATCH_MAX as A, type RecordFactEditInput as B, type CreateClinicRequestBatchInput as C, type RecordFactRemoveInput as D, type RecordMarker as E, FACT_FIELD_BY_KIND as F, type RecordMarkerLatest as G, type HttpRecordsClinicRepositoryDeps as H, type RecordMarkerPoint as I, type RecordMarkerSummary as J, type RecordMarkersView as K, type RecordPdfLink as L, type RecordShare as M, type RecordShareLink as N, type RecordsAuthorizationSignature as O, type RecordsClinicBatch as P, type RecordsClinicBatchClient as Q, type RecordClinicianNote as R, type RecordsClinicBatchItem as S, type RecordsClinicBatchResult as T, type RecordsClinicTarget as U, type RecordsSignatureSuggestion as V, createRecordsClinicBatchClient as W, createRecordsDepthClient as X, factCorrectionFor as Y, factValueCorrection as Z, inferFactValueKind as _, type RecordClinicianNoteSection as a, mapRecordMarkers as a0, mapRecordPdfLink as a1, mapRecordShareLink as a2, mapRecordShareList as a3, mapSignatureSuggestions as a4, resolveShareUrl as a5, type RecordsClinicSearchInput as a6, type RecordsClinicSearchPage as a7, type RecordsRecentClinicsInput as a8, type RecordsAuthorizationCopy as a9, type CreateClinicRequestInput as aa, type RecordsSignatureUploadPolicy as ab, type RecordCompleteness as b, type RecordConflict as c, type RecordConflictCandidate as d, type RecordDepthView as e, type RecordDocumentContributionsView as f, type RecordEncounter as g, type RecordExamSystem as h, type RecordLabMarker as i, type RecordLabPoint as j, type RecordPhysicalExam as k, type RecordsClinic as l, type RecordsDepthClient as m, type RecordsRequestDocument as n, type RecordsTimelineMedication as o, type RecordsTimelineVaccine as p, type RecordsTimelineView as q, type RecordsTimelineVisit as r, type RecordsTimelineWeight as s, mapDocumentContributions as t, mapRecordDepth as u, mapRecordsTimeline as v, FACT_VALUE_FIELD as w, type FactFieldValue as x, type FactValueKind as y, type HttpRecordsRepositoryDeps as z };
+export { type RecordsSignatureSuggestion as $, type HttpRecordsRepositoryDeps as A, RECORDS_CLINIC_BATCH_MAX as B, type CreateClinicRequestBatchInput as C, RECORD_SHARE_AUDIENCES as D, type RecordFactEditInput as E, FACT_FIELD_BY_KIND as F, type RecordFactRemoveInput as G, type HttpRecordsClinicRepositoryDeps as H, type RecordMarker as I, type RecordMarkerLatest as J, type RecordMarkerPoint as K, type RecordMarkerSummary as L, type RecordMarkersView as M, type RecordPdfLink as N, type RecordShare as O, type RecordShareAudienceScope as P, type RecordShareEmailInput as Q, type RecordClinicianNote as R, type RecordShareEmailReceipt as S, type RecordShareLink as T, type RecordShareRecipientKind as U, type RecordsAuthorizationSignature as V, type RecordsClinicBatch as W, type RecordsClinicBatchClient as X, type RecordsClinicBatchItem as Y, type RecordsClinicBatchResult as Z, type RecordsClinicTarget as _, type RecordClinicianNoteSection as a, SHARE_RECIPIENT_EMAIL_MAX as a0, createRecordsClinicBatchClient as a1, createRecordsDepthClient as a2, factCorrectionFor as a3, factValueCorrection as a4, inferFactValueKind as a5, isFactReviewerLocked as a6, isShareRecipientEmail as a7, mapRecordMarkers as a8, mapRecordPdfLink as a9, mapRecordShareEmailReceipt as aa, mapRecordShareLink as ab, mapRecordShareList as ac, mapShareAudiences as ad, mapSignatureSuggestions as ae, resolveShareUrl as af, type RecordsClinicSearchInput as ag, type RecordsClinicSearchPage as ah, type RecordsRecentClinicsInput as ai, type RecordsAuthorizationCopy as aj, type CreateClinicRequestInput as ak, type RecordsSignatureUploadPolicy as al, type RecordsFeatures as am, type RecordsUploadContentType as an, type RecordsPhotoContentType as ao, acceptsPhotos as ap, type RecordCompleteness as b, type RecordConflict as c, type RecordConflictCandidate as d, type RecordDepthView as e, type RecordDocumentContributionsView as f, type RecordEncounter as g, type RecordExamSystem as h, type RecordLabMarker as i, type RecordLabPoint as j, type RecordPhysicalExam as k, type RecordShareAudience as l, type RecordsClinic as m, type RecordsDepthClient as n, type RecordsRequestDocument as o, type RecordsTimelineMedication as p, type RecordsTimelineVaccine as q, type RecordsTimelineView as r, type RecordsTimelineVisit as s, type RecordsTimelineWeight as t, mapDocumentContributions as u, mapRecordDepth as v, mapRecordsTimeline as w, FACT_VALUE_FIELD as x, type FactFieldValue as y, type FactValueKind as z };

package/dist/{entitlementRepository-tVNazi8R.d.ts → entitlementRepository-CVWvND1P.d.ts}

@@ -1,7 +1,7 @@
 import { E as EverfurError } from './EverfurError-DmELDpXp.js';
-import { R as RequestFunnel } from './requestFunnel-CQzz2DIW.js';
-import { A as AuthContext } from './identity-B8rp0L9G.js';
-import { C as ClientBranding } from './branding-DYWma2il.js';
+import { R as RequestFunnel } from './requestFunnel-CiSX2pun.js';
+import { A as AuthContext } from './identity-BhT7oJDS.js';
+import { C as ClientBranding } from './branding-ytH4jJq1.js';
 import { E as EntitlementDecision } from './resolve-D4Ywz5OS.js';
 
 /** The conditional-GET endpoint (SPEC-00 §5.3). Relative; the transport prefixes the resolved base URL. */

package/dist/{entitlementRepository-iL-9vS1i.d.cts → entitlementRepository-DPvWjV-N.d.cts}

@@ -1,7 +1,7 @@
 import { E as EverfurError } from './EverfurError-DmELDpXp.cjs';
-import { R as RequestFunnel } from './requestFunnel-DAwb7haa.cjs';
-import { A as AuthContext } from './identity-D7PO5s9m.cjs';
-import { C as ClientBranding } from './branding-ChXm8gxI.cjs';
+import { R as RequestFunnel } from './requestFunnel-DMR_1T3O.cjs';
+import { A as AuthContext } from './identity-DUlshgow.cjs';
+import { C as ClientBranding } from './branding-Bio5MM6g.cjs';
 import { E as EntitlementDecision } from './resolve-D4Ywz5OS.cjs';
 
 /** The conditional-GET endpoint (SPEC-00 §5.3). Relative; the transport prefixes the resolved base URL. */

package/dist/{identity-B8rp0L9G.d.ts → identity-BhT7oJDS.d.ts}

@@ -1,6 +1,6 @@
 import { E as EverfurResult } from './EverfurResult-SGvHKsCB.js';
 import { U as UserRef } from './ids-B2GAAifq.js';
-import { T as TransportPort, d as EverfurRequest } from './config-Dfbj5mlx.js';
+import { T as TransportPort, d as EverfurRequest } from './config-BM0sv5jx.js';
 
 /**
  * A minted session token with the expiry the minter knows. `expiresAt` is what `mintPartnerSession` returns

package/dist/{identity-D7PO5s9m.d.cts → identity-DUlshgow.d.cts}

@@ -1,6 +1,6 @@
 import { E as EverfurResult } from './EverfurResult-ZtH-YV1h.cjs';
 import { U as UserRef } from './ids-B2GAAifq.cjs';
-import { T as TransportPort, d as EverfurRequest } from './config-BZX97FmW.cjs';
+import { T as TransportPort, d as EverfurRequest } from './config-Daa1plhQ.cjs';
 
 /**
  * A minted session token with the expiry the minter knows. `expiresAt` is what `mintPartnerSession` returns