@everfur/sdk 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -10,6 +10,332 @@ changes that has not been earned by any production integration yet.
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-02
+
+### Added
+
+- **`identitySignatureRequired` is a named error code.** The pets routes' 403 for a health field on a session your
+  backend did not sign (`registerPet` or `updatePet` with health fields, or `getPetProfile`, while anonymous)
+  settled as `unknown`. It is now `identitySignatureRequired` (category `authentication`, not retryable), shown to an
+  end user with the existing access-denied sentence. Documented in 11-ERRORS. (#155)
+- **`EverfurError.retryAfterSeconds`.** The wait a refusal named, in seconds: the body's `retry_after_seconds`, or a
+  `Retry-After` header the transport folds into it. (#155)
+- **`@everfur/sdk/web/records/upload`**: `createWebRecordsUploadTransport` on its own entry, for the `uploadTransport`
+  on a provider config at the app root (1_295 bytes minified, against 85_208 for the same import from
+  `@everfur/sdk/web/records`, and 388_582 before the tree-shaking change under Changed). `@everfur/sdk/web/records` still exports it. (#158)
+- **`TelevetBookingController.releaseHold(slotId)`** (optional on the interface, so a host's own controller
+  still type-checks): `DELETE /widget/v1/televet/slots/{slot_id}/hold`, served by EFBackend from #1865. The
+  server releases only this member's own hold and answers the same either way. A server without the route (a
+  dark 404) settles `ok`, and the hold lapses as before. (#144)
+- Colour tokens `highlight`, `onHighlight`, `mark`, `controlEdge`, `structureEdge` and `primaryEdge` on
+  `EverfurColorTokens`; `themeAdjustments` and `EverfurThemeAdjustment`; the `SlotSurrounds` type the slot guard now
+  takes; and `ThemeSeams.isDevelopment`. Additive: the appearance contract
+  (`contract/appearance/appearance_v1.json`) and the branding wire are unchanged. (#145)
+- **`consentText`: the records consent gate shows the partner's own consent text (owner decision 2026-10-02).**
+  Every records surface that takes `consentVersion` now takes `consentText` beside it (React Native:
+  `EverfurRecordsFlow`, `EverfurRecordsDashboard`, `EverfurRecordDetail`, `EverfurRecordDocument`; web: the same
+  plus `EverfurRecordsPage`; the iframe embed: the `consentText` init option and `data-consent-text`, an additive
+  `ef:init` field). The gate renders it as plain text, line breaks kept, above `Allow`, which stays its own button.
+  The visible `DRAFT COPY` line that held its place is gone: Everfur supplies no consent wording, so a surface
+  given `consentVersion` without `consentText` shows only `Consent required` and `Allow`, and a development build
+  logs one `[everfur]` console warning naming the missing prop. Optional in the types (a minor addition), because
+  `consentVersion` is optional too. Documented in 09-GUIDE-RECORDS-AND-CONSENT, 05-SDK-INTEGRATION,
+  13-WEB-INTEGRATION and the quickstart; the examples pass both. The Everfur CLI's docs mirror resyncs itself. (#168)
+
+### Changed
+
+- **A partner's bundler can now tree-shake the web entries.** Importing one thing from `@everfur/sdk/web` used to
+  cost the whole entry: a page importing only `petRef` carried 354_011 minified bytes, exactly what `EverfurChat`
+  costs, because the build kept function names with a call after every function and its minifier deleted every
+  `/* @__PURE__ */` annotation. The published files are now minified without renaming anything and keep their pure
+  annotations, so a page that imports `petRef` alone carries 29_035 bytes (esbuild, minified), and the partner demo's
+  app root went from 686_156 to 203_196. Function and component names are unchanged in stack traces and React
+  DevTools. `tests/supply-chain/consumerTreeShake.test.ts` keeps it that way. (#158)
+
+### Fixed
+
+#### Packaging and client
+
+- **Importing `@everfur/sdk/web` from a Next.js server component works.** It failed with the cryptic
+  `(0, c.createContext) is not a function`: the provider and hooks ran in the server graph. Every `web/*` entry and
+  `testing/web` now opens with `"use client"` (`scripts/add-use-client.mjs`, run by `build`), as React libraries
+  mark their client entries; `./server`, `./client`, `./core` and the React Native entries do not. Server rendering
+  of the client components is unchanged (pinned by rendering the built provider with `renderToString`). (#163)
+- **One session mint per page load, not three.** Every runtime's identity called your `getToken` for itself, so
+  React StrictMode's second runtime (and any second `EverfurProvider`) minted again in parallel: the production
+  integration test of 0.7.1 counted three `POST` session mints on every load. Concurrent mints for the same
+  tenant (publishable key and API base URL) and the same user now share one `getToken` call. Only the call in
+  flight is shared: the next mint after it settles calls `getToken` again, so the expiry your minter names and
+  a sign-out mean what they did. (#140)
+- **A pet is registered once per burst, not once per caller.** A sample app counted every pet registered twice per
+  navigation: React StrictMode runs the chat's `pet` registration twice, and a host registering on load sends the
+  same body beside it. Concurrent identical `registerPet` calls (same tenant, identity, pet and body, from one
+  runtime or several, and from the chat's `pet` prop) now share one `POST /widget/v1/pets/{pet_ref}` and its
+  result, as session mints do (#140). Only the request in flight is shared; the next call sends again. (#160)
+- **The birth date rule is documented.** The same report met `validationFailed` with no request id on
+  `birthDate: '2026-09-01'`. A recent date, today's included, is accepted (now pinned by a test); the refusal a
+  birth date meets before any request is the pair rule (a birth date always goes with `birthDatePrecision`), which
+  was documented nowhere. 09-GUIDE now states it and where the reason is (`error.wireMessage`). (#160)
+- **The anonymous-session budget's 429 is told apart.** A new anonymous identity per page load (the session id is
+  memory-only) meets the API's budget of 20 new anonymous identities per IP per 5 minutes, and the 429 read as a
+  send throttle. The API now sends `Retry-After` and `reason_code: anonymous_session_limit` on it; the SDK settles
+  it as `rateLimited` with that `reasonCode` and `retryAfterSeconds`, and (through the header fold) does not retry
+  into a wait longer than its retry budget. Documented in 10-TESTING and 11-ERRORS. (#155)
+
+#### Theme
+
+- **Everfur's colours no longer leak through a partner palette (web and React Native).** A production integration
+  test of 0.7.1 themed through `appearance` (teal primary, warm white background) still showed Everfur's mint pet
+  avatar, the pastel green `Good to know` banner, a pink picked day chip and `Now` pill, and a green current step on
+  the request timeline. Each now paints from the theme: the picked chips, the `Now` pill, the open history row and a
+  pet's initials disc from the new `highlight` / `onHighlight` tokens (a tint of the partner's accent, else its
+  primary), the avatar ring and the current step from `mark`, and the `Good to know` and `Monitor at home` banners
+  from the brand's wash, outline and ink (`Vet care suggested soon` from the palette's caution tokens). Everfur's
+  own light look is unchanged: every new token is the compiled value it stands in for, and the banners and the
+  initials disc keep the app's authored paint there. (#145)
+- **The dark palette is dark-aware everywhere (`night` preset).** The calm urgency banners were self-contained
+  pastel chips (THEME-01), a glaring mint or amber slab on the dark ground, and the picked chip and `Now` pill stayed
+  light pink. They now take the dark palette's tokens: a dark wash under light ink, and the pink's dusk twin
+  (`#605051`) as the dark `highlight`. (#145)
+- **Non-text contrast (WCAG 1.4.11).** The text guard is joined by a guard on the outlines that show a control or a
+  structural mark: the new `controlEdge` (outlined pills, such as the chat header's Vet entry), `structureEdge` (the
+  steps still to come on a request timeline and its rail, an informational banner's edge) and `mark` reach 3:1 on a
+  partner palette, and `primaryEdge` edges the send disc, the owner's bubble and a done step when a pale primary does
+  not stand out from its ground. A slot with an opaque fill that melts into the ground around it (a white
+  `userBubble` on a white chat) is given a `borderColor` that reads at 3:1 there, and a partner's own `borderColor`
+  on such a slot is pushed until it does. Everfur's compiled palettes keep their authored hairlines. (#145)
+- **The guard no longer changes a partner's colours in silence.** `themeAdjustments(input)` lists every partner
+  colour the contrast guard replaced (field, role, requested, painted), and the provider writes that list to the
+  console once in a development build (`__DEV__` on React Native, the bundler's `process.env.NODE_ENV` on the web). (#145)
+- **A partner brand that already reads keeps its outline's hue (teal `#0F766E`).** The non-text guard pushed an
+  outline that did not read (the brand's 20% hairline) toward black or white, so a teal partner's outlined pills
+  (the chat header's Vet entry among them) were painted grey and a development build reported
+  `primary_color (control outline): #0F766E -> #7C8683`, although the teal reads at 3:1 on its warm white and on
+  white. When the brand itself reads at 3:1 on every control ground the outline is now strengthened toward the brand
+  (`#49968E` on `#FFFBF5`) and nothing is reported; a brand that does not read is pushed and reported as before. (#170)
+
+#### Records
+
+- **A refused signature upload no longer fails the clinic request (web and React Native).** A production sandbox
+  test found the signature upload's direct S3 POST refused from a partner's page (the prod bucket's CORS listed only
+  Everfur origins), so every web clinic request failed at signing. When that POST itself fails (a network or CORS
+  refusal, or S3 answering non-2xx) the built-in pad now sends the same PNG inline as `signature_png_base64`, which
+  the create API has always accepted. A refused initiate, an untrusted policy host, a failed complete and a cancel
+  still fail as before. Web: the pad gains `capture(controller, signal)`, which the built-in forms use;
+  `register` is unchanged and still strict. React Native: the multi-clinic composer keeps the inline PNG when its
+  registration's S3 POST fails. (#162)
+- **The clinic-release consent screen no longer reads "I, , authorize ..." (web and React Native).** The served
+  authorization sentence is the owner's own signed scope, and with no name typed yet it rendered with a blank
+  where the name goes. It now waits for a name: nothing stands in for it while the field is empty, and it
+  appears as the name is typed. Found by the production integration test of 0.7.1. (#139)
+- **"Please add your signature before submitting." no longer greets the consent screen (web).** #127 moved the
+  line on the in-place clinic request forms; the consent screen the picker opens still showed it as soon as a
+  clinic was chosen. It now appears only when the signature is the one thing keeping `Send request` closed. (#139)
+- **The React Native multi-clinic composer scrolls, closes and sends (React Native).** On an iPhone 17 simulator
+  (Expo 57, 2026-10-01) `EverfurClinicRequestBatch` was about 1112 pt of unscrolled content on an 874 pt screen: once
+  a clinic was added, Send and Cancel were out of reach, there was no close control at the top, the Search control
+  looked like a second text field, and the keyboard could not be dismissed. It now has a header with the composer's
+  own `Cancel`, the form in a keyboard-avoiding ScrollView that dismisses the keyboard on a drag or a tap outside a
+  control, and `Send` pinned in a footer above the home indicator. The search is one field whose return key
+  searches; Search is an outline pill. No new strings. (#143)
+- **React Native records draw their icons (React Native).** The records pictograms rendered as empty tinted discs
+  (the empty states, the upload screen) and squares (the dashboard's action rows). They now draw the consumer app's
+  Feather icons with Views, as the chat glyphs do: `file-text`, `list`, `inbox` and `refresh-cw` on the action rows;
+  `search`, `inbox`, `activity`, `clock`, `tool` and `wifi-off` per empty state; `upload-cloud` on the upload screen.
+  They are drawn in the brand ink and hidden from assistive technology. (#149)
+- **The records footnote sentence shows once per screen (web and React Native).** On `Visits & records` inside
+  `EverfurRecordsPage` the production integration test of 0.7.1 saw "Everfur summarizes what your vet recorded.
+  It is informational, not diagnostic." three times: the server's disclaimer band (the same words), the record
+  screen's footnote and the page's footnote. A screen the page shows now draws no footnote of its own under the
+  page's, and a server disclaimer that says exactly what the footnote says is not drawn again. A server
+  disclaimer with any other words is still rendered verbatim. (#142)
+- **The records consent gate says what `Allow` agrees to, and its button is reachable on React Native.** Both
+  production integration tests of 0.7.1 saw only "Consent required" and `Allow`. The gate now shows a line for
+  what the member consents to between them. **That line is a visible `DRAFT COPY [[...]]` placeholder**: no
+  approved consent text exists and the server serves none, so the wording is the owner's decision (documented in
+  09-GUIDE-RECORDS-AND-CONSENT.md). On React Native the gate's container was `accessible`, which grouped it into
+  one element named "Consent required" and hid the `Allow` button from a screen reader; the ask is now visible
+  text announced on mount, and `Allow` is its own button. (#150)
+- **Web records forms and screens speak to assistive technology (accessibility).** A records flow opened on a given
+  screen (`initialScreen`) now moves focus to that screen's heading on mount, as every later screen change already
+  did; before, the host control that opened it unmounted and focus fell to the page's `<body>`. The clinic email
+  errors on the consent screen, a failed request's recovery and the clinic search's add-by-email form are bound to
+  their fields (`aria-invalid` + `aria-describedby`). The clinic search says how many clinics it found through a
+  polite status region (a DRAFT COPY slot until the owner approves a sentence). The upload card's heading is an
+  `h3` under the screen's `h2` instead of skipping to `h4`. (#161)
+- **The records share sheet's audience chips wrap (web).** At 390px the `Boarding` chip was clipped on the right. (#145)
+- **Every records control says what it shows (web and React Native, WCAG 2.5.3 Label in Name).** Owner decision
+  2026-10-02: a control's accessible name is its visible text, so a speech user can activate it by reading it. The
+  records screens and the chat history named about twenty controls in other words (`Choose a file` was spoken
+  "Choose records to upload", `I already have the records` "Upload records you already have", `Cancel request`
+  "Cancel this records request"); each now takes its visible text as its name, busy labels included. A control
+  repeated in a list keeps its visible name and gets its row as context: `Copy link` is described by its share row
+  (`aria-describedby` on the web, `accessibilityHint` on React Native) and each request row's `Ask about this
+  request` has the row's source as its hint. The clinic picker's add-by-email toggle states open or closed through
+  `aria-expanded` and `accessibilityState.expanded` instead of a second name. No visible copy changed. (#169)
+- **The single-clinic consent form lets the keyboard go and keeps `Send request` above it (React Native).** Its
+  ScrollView and the clinic results dismiss the keyboard on a drag (interactive on iOS, on-drag on Android) and keep
+  taps on controls. The pinned `Send request` footer lifts by the keyboard measured from the avoiding view's own
+  top, as the multi-clinic composer's does (#143); before, it sat half under the keyboard. (#170)
+- **The search glyph has its handle (React Native).** The clinic empty state's and the chat history's search glyph
+  drew its handle detached from the ring, and the clinic picker's search bar drew a bare ring. Both now draw
+  Feather's `search`: a ring with the handle growing out of it, down and to the right. (#170)
+
+#### Chat
+
+- **Chat shows the pet a host registers on load, without waiting for a send (web and React Native).** The pet
+  list behind the chat header, the empty-state title and the starter chips was read once on mount, so a host
+  that calls `registerPet` as the page loads (the documented shape) raced it: the production integration test of
+  0.7.1 opened chat before the write landed and saw "What can we help your pet with today?", "Mixed Breed" and a
+  `?` avatar until the member sent a message. A successful `registerPet`, `updatePet` or `deletePet` now makes
+  `useEverfurPets` (and so chat) read the list again. (#141)
+- **Chat conversations are saved under the chat's pet again (web and React Native).** Since 0.7.0 the first
+  send creates the conversation (#129), and it created it with the turn's pet, which `useEverfurChat().send`
+  never names: every conversation was created unscoped and saved with `pet_ref` null, so the pet's history
+  drawer read "No chats yet" right after a chat (mobile integration test of 0.7.1). A send that names no pet now
+  uses the chat's own pet scope; a send that names one keeps it, and an unscoped chat is unchanged. (#148)
+- **React Native chat lets the keyboard go, and the urgency banner compacts while typing (React Native).** Once
+  open, the chat keyboard could not be dismissed, and the pinned urgency banner kept its full height while the
+  member typed (about 40% of what was left of the screen). The thread and the starter-prompt ScrollViews now
+  dismiss the keyboard on a drag (interactive on iOS, on-drag on Android). While the keyboard is open the banner is
+  compact: tighter padding and the reason held to two lines (a screen reader still reads it whole). The tier label,
+  the vet pill, poison control and the dismiss stay, so an emergency keeps its way to care. (#147)
+- **The web chat holds up in forced-colors mode (Windows High Contrast) (accessibility).** The header's New chat and
+  History glyphs vanished, the starter chips and the Send disc lost their edges, and the brand-ink upload and mic
+  glyphs fell below contrast. Every chat glyph now draws in `currentColor` with its ink as the SVG's CSS `color`
+  (and `forced-color-adjust: auto`, since browsers otherwise preserve an SVG's own colour there), so the mode
+  repaints it in the system colours; the starter chips, the header's icon buttons, the composer's glyph controls
+  and the Send disc carry a 1px transparent edge that only the mode draws. The normal look is unchanged. (#159)
+- **The starter chips follow a partner's palette and the dark palette (React Native).** Off Everfur's own light look
+  the four starter chips stayed Everfur's blue, green, amber and pink pastels, which glared on the night ground. They
+  now paint the theme's `highlight` under `onHighlight`. Everfur's own look keeps its pastels and black ink. (#170)
+- **The starter chips follow a partner's palette and the dark palette (web).** The web chat's starter chips kept
+  Everfur's blue, green, amber and pink pastels under every partner preset and glared on the night ground. Off
+  Everfur's own light look they now paint the theme's `highlight` under `onHighlight` (4.5:1), the rule the React
+  Native chips follow since #170. Everfur's own look keeps its pastels and black ink. (#172)
+
+#### Vet visits
+
+- **The default vet visit can offer the pet's own clinic and your emergency-vet locator (web and React Native).**
+  `primaryVet` and `onFindEmergencyVet` reached the emergency warning only through `EverfurTelevet`; the in-app
+  visit Everfur provides by default (`EverfurTelevetHost`) rendered it without them, so the warning offered ASPCA
+  Animal Poison Control and no way to the member's clinic. The web host now passes both through, as it does
+  `onPickMedia`. The React Native host took no props at all; it now takes the same four (`onAddToCalendar`,
+  `onPickMedia`, `primaryVet`, `onFindEmergencyVet`), and `@everfur/sdk/televet` exports their types. (#157)
+- **The vet booking asks each question once (web and React Native).** Every booking read kept its own state, so the
+  dialog asked its eight or nine questions again on every open, the state policy twice per open (the flow and its
+  `where` step), and ten open/close cycles ran a member into the partner plane's rate limit (2026-10-01 audit). The
+  read-only reads (the roster, the slots, the soonest opening, the state policy, the cancellation terms, the visits)
+  now share one answer per question per signed-in session: a question already in flight is joined, a settled answer
+  is reused for 30 seconds (the visits list a member comes back to is still read again), and a hold, booking,
+  move, cancel or released hold drops the answers it changed. The entitlement read is joined but never reused. A
+  rate-limited answer is kept for the server's own wait, so a reopened dialog shows the rate-limit state it already
+  has instead of spending another request. A 429 or 503 whose wait rides only in the `Retry-After` header is now
+  honoured like one whose body names it. (#166)
+- **A test tenant's vet entry no longer reads the real vet roster or slots.** The booking container prefetched the
+  real roster, bios, photos and bookable slots even when it then drew the visit simulator. On a test tenant those
+  reads now wait for the allowance answer and never start when the simulator applies. A live tenant reads them at
+  once, as before; a test tenant with an allowance still books real visits. (#162)
+- **A rate-limited booking read says so, and offers "Try again" when it can work (web and React Native).** After
+  about eight booking opens in eight minutes the production integration test of 0.7.1 got 429 on the vet roster
+  and the state policy, and the step showed only "Could not load" with a "Try again" that could not succeed.
+  The pet, vet and time steps now show the SDK's existing rate-limit state ("Slow down a moment" / "You’ve made
+  a lot of requests just now. You can try again shortly.", the records empty state's words) and offer "Try
+  again" once the server's `retry_after_seconds` has passed (60 seconds when it names none). Any other failure
+  shows the step's own card, as before. The steps take an optional `error` prop for this. (#146)
+- **An unbooked vet visit hold is given back (web and React Native).** Reaching the booking review takes a
+  ten-minute hold, and nothing released it: closing the dialog left the time off every grid until the hold ran
+  out, and the same member coming back for it read "That time was just taken." about their own hold (production
+  integration test of 0.7.1). The booking flow now releases its hold when it closes or unmounts without booking,
+  and when another time replaces it. Back from review still keeps the hold, so the same time picked again goes
+  straight back to review on it. A hold the flow booked, or is booking, is never released. (#144)
+- **No fee line on a partner's cancel receipt (web).** A partner member owes no cancellation fee (owner decision
+  2026-10-01: a late cancel is used from the partner's allowance, and the server reports `fee_recorded: false` on
+  every partner cancel), yet the visits screen showed "No late cancellation fee was recorded for this visit." on
+  every receipt. That line now renders only when the server reports a recorded fee, so a fee that was recorded is
+  still named. No copy changed. (#153)
+- **React Native booking follows the palette.** The progress bar (the booking chrome's done segments) and the
+  booked and joined rings now take `mark` instead of Everfur's green, the picked day `highlight` instead of the pink,
+  the primary button's edge `primaryEdge` (a pale partner primary, the disabled `Continue` included, keeps its
+  shape), and the full-screen booking modal sets the status bar to light content over a dark ground (the `night`
+  preset left the iOS clock dark on dark). (#145)
+- **The booking emergency panel is as tall as its content (web and React Native).** The early emergency step grew
+  to the dialog's height, a tall red box with nothing in its lower half. (#145)
+- **The vet visit dialog states `aria-modal` (web).** It is a `<dialog>` shown with `showModal()`, so the browser
+  already treats it as modal and the page behind it as inert; it now says so in the attribute too, as the records
+  dialogs (the share sheet's among them) do, for tools that read attributes and for a DOM without `showModal`. (#164)
+- **The web booking's choices and times are walked with the arrow keys (accessibility).** The option cards (pet,
+  where, the emergency check, a cancellation's reason) and the time grid made every choice its own tab stop. Each
+  radio group is now one tab stop whose arrows move the pick and wrap, as native radios do; the time grid is one tab
+  stop walked with Left, Right, Up, Down, Home and End, where focus never holds a slot (Enter or a click does), and
+  a chip stays focusable while its hold is in flight. The review summary is a valid description list again (its
+  "Change" sits inside the value it changes), and the visit dialog is named by the heading on screen rather than
+  by a title no screen shows. (#156)
+- **The web booking's emergency warning comes into view, and a busy button keeps the focus (accessibility).** At
+  200% zoom (640x450) "Yes, at least one" opened the emergency warning below the step's scroll area: it was
+  announced, but a sighted member saw only a Continue that had gone dark. The warning is now scrolled into view
+  (`block: 'nearest'`, instant under reduced motion), and the React Native step scrolls to it the same way. A booking
+  button that went busy or blocked used the native `disabled` attribute, which drops focus to the partner page's
+  `<body>` mid-booking; it is now `aria-disabled`, stays focusable, swallows the press, points `aria-describedby` at
+  the reason where the screen shows one, and speaks the deck's own busy words ("Booking…", "Moving…") through a
+  polite status region. The step's scroller now contains the review's visually hidden consent inputs, which had
+  stretched the visit dialog's own scroll height and scrolled the whole dialog when one took focus. (#154)
+
+### Documentation
+
+- **The docs say what the UI and the wire do (production sandbox and Next.js integration tests, 2026-10-01).**
+  The vet booking is eight steps with a pet chooser and seven for a member with one pet, not always eight. The chat
+  stream's `metadata` frame arrives BEFORE `done`, which repeats its title and follow-up questions; 10-TESTING
+  said a frame arrives after `done` and the quickstart said a later `metadata` frame can follow. The examples
+  script no longer says a sandbox uses an ordinary `pk_live_` key on staging, and the onboarding page no longer says
+  most sandboxes come from self-serve sign-up, which is not open to partners yet. (#165)
+- **Current facts in the README and the vet visit guide.** The README named `0.3.0` and called vet visits "not
+  yet enabled", and 16-TELEVET-VISITS.md opened with "draft ... not yet enabled for any partner"; vet visits run
+  in production for the partners Everfur enables them for. The README quickstart's `getToken` used a relative
+  URL, which does not resolve in a React Native bundle (00-QUICKSTART.md already said so). The camera note said
+  to add vision-camera's config plugin: `4.x` has one, `5.x` has none and needs `react-native-nitro-modules` and
+  `react-native-nitro-image`. The React Native call setup now names all of Daily's declared peers
+  (`@react-native-async-storage/async-storage`, `react-native-background-timer`, `react-native-get-random-values`
+  beside the WebRTC build) and the config plugin's one-Expo-SDK peer, with the `--legacy-peer-deps` install and
+  the `overrides` entry that keeps the next install and `npm ci` passing. `registerEverfurDaily`'s doc comment on
+  React Native now imports it from `@everfur/sdk/televet/call`, where it is exported. Found by the 2026-10-01
+  production integration tests of 0.7.1 (web and mobile). (#151)
+- **Test mode is a production sandbox with a `pk_test_` key.** 00-QUICKSTART, 10-TESTING, 12-CLI-AND-MCP and the
+  README describe test mode as a sandbox tenant with a `pk_test_` key on the production host (an older sandbox may
+  still carry `pk_live_`; staging is early access), the go-live pair, the console's live/test switch, the hosted MCP
+  reconnect and the test/staging/production plan environments; 02, 08, 11 and 14 no longer say that no deployment
+  accepts `pk_test_`. The operator guide (04-ONBOARDING-A-CUSTOMER) covers going live by pairing. Every heading and
+  anchor is unchanged. (#101)
+
+### Tests and tooling
+
+- **The records bundle budget is re-measured.** The 2026-10-01 records fixes (#139, #142, #143, #149) each passed
+  on their own head and together crossed the React Native records closure's line by 349 gzip bytes, all records
+  feature code; the closure still holds no chat, vet visit, video, photo or animations module. The line is the CI
+  measurement plus 5%, as every budget entry is. (#152)
+- **Chat's first reads are pinned beside the entitlement verdict.** A test holds the verdict unanswered over the
+  real transport and asserts the conversation head, the suggested prompts and the pets requests are already out, so
+  a later gate on the verdict cannot add that hop. (#167)
+- **The consent gate's `Allow` is pinned reachable on the dashboard, and the theme guard's development warning is
+  pinned to a runtime switch of appearance.** No ancestor of `Allow` on the React Native dashboard is `accessible`;
+  switching to another adjusted preset at runtime writes that preset's line once, and a look the guard leaves alone
+  writes nothing. (#170)
+
+## [0.7.1] - 2026-10-01
+
+### Fixed
+
+- **`RecordShareAudience` is now exported (type-only) from `@everfur/sdk/records/depth` and
+  `@everfur/sdk/web/records/depth`**, the audience `RecordsDepthClient.createShare(petRef, { audience })` takes.
+  Before, both depth API reports carried an api-extractor warning pinned to a hashed build file
+  (`dist/depth-<hash>.d.ts`), so `npm run api:check` failed on every version bump until the reports were
+  regenerated.
+- **`EverfurTelevetHost` takes `onPickMedia` (web).** The intake step has had a picker seam since booking photos
+  shipped (`onPickMedia` on `EverfurTelevet`), but the default in-page visit never reached it: the host and
+  `EverfurTelevetDialog` rendered the flow without a picker, so a partner on the button, chat or its own host
+  could not offer photos even with booking media served. The host now passes it through, as it does
+  `onAddToCalendar`. Absent, the intake step has no attachment row, as before.
+
 ## [0.7.0] - 2026-10-01
 
 ### Added

package/README.md

@@ -10,12 +10,15 @@ features without shipping an app update.
   a blank screen, and cannot be force-enabled client-side.
 - The app never holds a secret. See [The security model](#the-security-model).
 
-> `0.3.0`, MIT licensed, public on npm. Requires React Native `>=0.74` (or React `>=18` with `react-dom`
+> `0.8.0`, MIT licensed, public on npm. Requires React Native `>=0.74` (or React `>=18` with `react-dom`
 > for the web entry), and Node `>=18` on the backend that mints sessions.
 
-**Getting keys:** Everfur keys are provisioned by the Everfur team during partner onboarding; there is
-no self-serve signup yet. Contact [support@everfur.com](mailto:support@everfur.com) to get set up. The
-publishable key is designed to ship inside your app; the secret key is not.
+<!-- DRAFT COPY slot PD1-2 (owner): the README's invitation to get started (self-serve sandbox sign-up), in the owner's words. The factual paragraph below stands without it. -->
+**Getting keys:** a sandbox (test-mode) tenant can be created from the partner console's sandbox page
+(`https://everfur.com/partners/console/sandbox`) where Everfur has opened sandbox sign-up; otherwise the
+Everfur team creates it. Live tenants and their keys are provisioned by the Everfur team. Contact
+[support@everfur.com](mailto:support@everfur.com) to get set up. The publishable key is designed to ship
+inside your app; the secret key is not.
 
 ## Install
 
@@ -36,8 +39,9 @@ Peer dependencies by capability (install only what you use):
 
 The camera peer is optional: if you never mount `./video` or `./photo`, you do not need it.
 `EverfurRecords` accepts the host's picker and upload transport, so use the native modules that fit your
-app (including Expo SDK 57) without an SDK peer-dependency constraint. `react-native-vision-camera` also
-needs its config plugin in `app.json` and a camera usage description.
+app (including Expo SDK 57) without an SDK peer-dependency constraint. `react-native-vision-camera` needs a
+camera usage description; `4.x` also ships an Expo config plugin (add it to `app.json` plugins), while `5.x`
+ships none and instead needs its own peers `react-native-nitro-modules` and `react-native-nitro-image`.
 
 ### Bundler resolution
 
@@ -70,8 +74,8 @@ Two ways, one wire contract, documented in
   is [`examples/frame-embed.html`](https://sdk.everfur.com/v1/docs/index.html#web--the-snippet).
 
 Chat and records are the web surfaces (records on its own subpath and its own frame document, available
-when Everfur enables records for your account); photo and video remain React Native for now. Vet visits (not yet enabled)
-have their own entry on both hosts, `@everfur/sdk/web/televet` and `@everfur/sdk/televet`, and a visit opens
+when Everfur enables records for your account); photo and video remain React Native for now. Vet visits (available when Everfur enables them for your
+account) have their own entry on both hosts, `@everfur/sdk/web/televet` and `@everfur/sdk/televet`, and a visit opens
 INSIDE your app by default: booking, the confirmation and the call run in an Everfur modal (React Native) or
 dialog (web) that `VetVisitButton` and `EverfurChat` mount themselves; the hosted page is an explicit opt-in,
 `prefer="redirect"`. The booking screens (`@everfur/sdk/televet/booking`, `@everfur/sdk/web/televet/booking`)
@@ -93,13 +97,14 @@ export default function App() {
   return (
     <EverfurProvider
       config={{
-        publishableKey: process.env.EXPO_PUBLIC_EVERFUR_PUBLISHABLE_KEY!, // pk_live_...  safe to ship
+        publishableKey: process.env.EXPO_PUBLIC_EVERFUR_PUBLISHABLE_KEY!, // pk_test_... or pk_live_...  safe to ship
         apiBaseUrl: 'https://api.everfur.com/api/v1',
       }}
       // Omit `user` entirely for anonymous mode (publishable key alone, general answers).
       user={{
           userRef: userRef('your-stable-user-id'),
-          getToken: () => fetch('/everfur-session').then((r) => r.text()),
+          // An absolute URL: a relative path does not resolve in a React Native bundle.
+          getToken: () => fetch('https://your-backend.example.com/everfur/session', { method: 'POST' }).then((r) => r.text()),
         }}
       activePet={petRef('pet-ref-123')}
     >
@@ -140,23 +145,25 @@ import { petRef } from '@everfur/sdk';
 ## The security model
 
 The one rule: **the app never holds a secret.** Two provisioning credentials, kept apart, plus a read-only
-docs key for tooling. Test mode is a sandbox tenant on the staging API with an ordinary `pk_live_` key
-(`livemode: false` in its entitlements); no deployed environment accepts a `pk_test_` key.
+docs key for tooling. Test mode is a sandbox tenant with a `pk_test_` key on the production API
+(`livemode: false` in its entitlements); the API accepts a `pk_test_` key only for a sandbox tenant, so a test
+key never reaches live data. An older sandbox may still carry a `pk_live_` key, which keeps working, so read
+`livemode`, not the prefix. Staging (`https://api-staging.everfur.com/api/v1`) is for early access.
 
 | Credential | Where it lives | What it does |
 | --- | --- | --- |
-| Publishable key `pk_live_...` | In the app (`EXPO_PUBLIC_...`). Safe to ship. | Names your tenant. Cannot mint a session or grant a feature by itself. |
+| Publishable key `pk_test_...` (sandbox) or `pk_live_...` (live) | In the app (`EXPO_PUBLIC_...`). Safe to ship. | Names your tenant. Cannot mint a session or grant a feature by itself. |
 | Partner secret key `sk_partner_...` | **Only** on your server. Never in the app, its bundle, env, git, or logs. | Mints session tokens. Revocable and rotatable without an app release. |
 | Session token (bearer) | App memory, short-lived. | Authenticates one end user; re-minted via your backend on a 401. Signed, holds no secret, 15 minutes by default (1 minute to 1 hour). |
 | Docs key `dk_partner_...` | Only in the MCP server or CLI configuration on a developer machine. | Read-only: fetches the Everfur contract from `GET /partners/contract` and opens no other route. |
 
 Your backend exchanges the two provisioning credentials for a short-lived session by calling
-`POST /widget/v1/sessions` with `x-everfur-partner-key: pk_live_...` + `x-everfur-partner-secret-key:
-sk_partner_...`. The SDK ships a **server-only** helper (`mintPartnerSession`, imported from
+`POST /widget/v1/sessions` with `x-everfur-partner-key: pk_...` + `x-everfur-partner-secret-key:
+sk_partner_...`, both from the same tenant. The SDK ships a **server-only** helper (`mintPartnerSession`, imported from
 `@everfur/sdk/server`) so you do not hand-roll that request. That helper is deliberately absent from every
 React-Native-resolvable bundle: a device can never import it, so the secret has no path onto the phone.
 
-**Do:** ship `pk_live_` in the app; keep `sk_partner_` in a server secret manager; mint sessions on your
+**Do:** ship the publishable key (`pk_test_` or `pk_live_`) in the app; keep `sk_partner_` in a server secret manager; mint sessions on your
 backend; serve everything over HTTPS.
 **Never:** put `sk_partner_` in the app; mint sessions on the device; try to force-enable a feature
 client-side (the server re-checks and returns `403`).
@@ -185,6 +192,7 @@ off-state, never a blank region.
 | `@everfur/sdk/animations` | server-driven pet-state media surface |
 | `@everfur/sdk/web` | the browser entry: `EverfurProvider`, `CapabilityGate`, `EverfurChat`, `useEverfurChat`, the theme hook, rendered with `react-dom`; withheld from React Native bundles the way `./server` is |
 | `@everfur/sdk/web/records` | records for a browser host: `EverfurRecordsPage` (the Everfur web app's records page, complete on its own: request from a clinic, upload, request status, the full record with vaccinations, all inside your page), the named screens, `EverfurRecords` (the React Native-shaped flow), `useEverfurRecords`, `createWebRecordsUploadTransport`, `fileToHandle`; its own entry, withheld from React Native like `./web`; available when Everfur enables records for the account. Frame mode serves it with `surface: 'records'` (see [chapter 13](https://sdk.everfur.com/v1/docs/index.html#web--2-frame-mode-the-loader-and-the-frame)) |
+| `@everfur/sdk/web/records/upload` | `createWebRecordsUploadTransport` alone, for the `uploadTransport` on the provider config at your app root; the same function `@everfur/sdk/web/records` exports, without the records entry |
 | `@everfur/sdk/server` | **server-only** `mintPartnerSession` (no React Native resolution; never bundled on-device) |
 | `@everfur/sdk/server/events` | **server-only, Node only** partner events (preview): `constructEvent` to verify webhooks, `sendPartnerEvent`; see [chapter 15](https://sdk.everfur.com/v1/docs/index.html#sec-events) |
 | `@everfur/sdk/testing`, `@everfur/sdk/testing/rn`, `@everfur/sdk/testing/web` | test seams (`MockTransport`, `useEverfurTestEntitlements`, ...) for your own tests |

package/dist/{Chat-DZpYH8Uh.d.ts → Chat-Cv9EYMYA.d.ts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.js';
 import { F as FileHandle } from './ports-BN6RHF9W.js';
-import { a as ChatCheckinTarget } from './ports-nXHf50_X.js';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-CuYZZaI5.js';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-CXAnZcEg.js';
+import { a as ChatCheckinTarget } from './ports-BUXF0Rp3.js';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-B2lO1sKS.js';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-y_aO4hlk.js';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';

package/dist/{Chat-bATY4atj.d.cts → Chat-s2vcPbw3.d.cts}

@@ -2,9 +2,9 @@ import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
 import { P as PetRef, C as ConversationId } from './ids-B2GAAifq.cjs';
 import { F as FileHandle } from './ports-BN6RHF9W.cjs';
-import { a as ChatCheckinTarget } from './ports-ZmJYgd5I.cjs';
-import { W as WidgetPet, P as PetProfileInput } from './petsRepository-BJsJ4cju.cjs';
-import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-CUOGILir.cjs';
+import { a as ChatCheckinTarget } from './ports-C40S2V14.cjs';
+import { W as WidgetPet, P as PetProfileInput } from './petsRepository-BP9nhM1R.cjs';
+import { U as UrgencyDisplayLevel, L as LifecyclePort, E as EverfurChatDraftStore } from './attachments-DbFwz4iq.cjs';
 
 /** Where a picked image comes from: the host's photo library, or its camera. */
 type AttachmentSource = 'photo' | 'camera';

package/dist/{DepthViews-qBIoA48w.d.ts → DepthViews-CVxUHOJ-.d.ts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-fPSv-GXU.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DuPUJFDQ.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;

package/dist/{DepthViews-C4DC4Kom.d.cts → DepthViews-Cz7mSW7p.d.cts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-CARTuHKh.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-D6a6-_u_.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{DepthViews-dLTizxjr.d.ts → DepthViews-DNRY0Ugm.d.ts}

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { StyleProp, ViewStyle } from 'react-native';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-fPSv-GXU.js';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-DuPUJFDQ.js';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: StyleProp<ViewStyle>;

package/dist/{DepthViews-BpHUbjSY.d.cts → DepthViews-DvNixbxg.d.cts}

@@ -1,5 +1,5 @@
 import { CSSProperties, ReactNode } from 'react';
-import { f as RecordsScreenBaseProps } from './useRecordsDepth-CARTuHKh.cjs';
+import { f as RecordsScreenBaseProps } from './useRecordsDepth-D6a6-_u_.cjs';
 
 interface EverfurRecordsDepthProps extends Pick<RecordsScreenBaseProps, 'petRef' | 'petName' | 'onNavigate' | 'onBack'> {
     readonly style?: CSSProperties;

package/dist/{ErrorPolicyPort-D22LUVrK.d.ts → ErrorPolicyPort-DwSnmGcX.d.ts}

@@ -1,4 +1,4 @@
-import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-DmELDpXp.js';
+import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-pEXDbUJ1.js';
 
 /**
  * Recovery policy. A host may narrow retry ceilings (e.g. a metered plan) but can never widen the SDK's

package/dist/{ErrorPolicyPort-D6CybiqJ.d.cts → ErrorPolicyPort-NFDPe-5w.d.cts}

@@ -1,4 +1,4 @@
-import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-DmELDpXp.cjs';
+import { b as EverfurErrorCode, E as EverfurError } from './EverfurError-pEXDbUJ1.cjs';
 
 /**
  * Recovery policy. A host may narrow retry ceilings (e.g. a metered plan) but can never widen the SDK's

package/dist/{EverfurError-DmELDpXp.d.cts → EverfurError-pEXDbUJ1.d.cts}

@@ -1,5 +1,5 @@
 /** The frozen error taxonomy. Additive-only under the dated-contract policy. */
-type EverfurErrorCode = 'authExpired' | 'authRejected' | 'sessionRequired' | 'accessDenied' | 'paymentRequired' | 'quotaExceeded' | 'rateLimited' | 'validationFailed' | 'sdkUpdateRequired' | 'conflict' | 'idempotencyConflict' | 'idempotencyInFlight' | 'conversationNotFound' | 'petNotFound' | 'resourceNotFound' | 'streamTimeout' | 'mediaUploadFailed' | 'moderationBlocked' | 'upstreamLlmTimeout' | 'internalError' | 'notImplemented' | 'serviceUnavailable' | 'streamIncomplete' | 'unknown';
+type EverfurErrorCode = 'authExpired' | 'authRejected' | 'sessionRequired' | 'accessDenied' | 'paymentRequired' | 'quotaExceeded' | 'rateLimited' | 'validationFailed' | 'sdkUpdateRequired' | 'conflict' | 'idempotencyConflict' | 'idempotencyInFlight' | 'conversationNotFound' | 'petNotFound' | 'resourceNotFound' | 'streamTimeout' | 'mediaUploadFailed' | 'moderationBlocked' | 'upstreamLlmTimeout' | 'internalError' | 'notImplemented' | 'serviceUnavailable' | 'streamIncomplete' | 'identitySignatureRequired' | 'unknown';
 /** Every code, frozen, for iteration in conformance / property tests. */
 declare const EVERFUR_ERROR_CODES: readonly EverfurErrorCode[];
 /**
@@ -137,6 +137,12 @@ interface EverfurError {
      * snake_case token is kept; anything else is dropped rather than carried.
      */
     readonly reasonCode?: string;
+    /**
+     * The wait the server named, in seconds, when it named one: the body's `retry_after_seconds`, or a `Retry-After`
+     * header on a 429 or 503. The anonymous-session budget's 429 (`reasonCode` `anonymous_session_limit`) carries
+     * it; the SDK does not retry past it.
+     */
+    readonly retryAfterSeconds?: number;
     /** raw wire text; telemetry / logs only, NEVER rendered. NON-ENUMERABLE. */
     readonly wireMessage?: string;
     /** Opaque parsed wire payload for debugging (untrusted, unvalidated). NON-ENUMERABLE. */
@@ -169,6 +175,8 @@ interface MakeEverfurErrorOptions {
     readonly reasonCode?: string | null;
     /** Opaque parsed wire payload. Carried NON-ENUMERABLY for debugging; never rendered. */
     readonly raw?: unknown;
+    /** The wait the response named, in seconds. Kept only when finite and not negative. */
+    readonly retryAfterSeconds?: number | null;
 }
 declare function makeEverfurError(code: EverfurErrorCode, opts?: MakeEverfurErrorOptions): EverfurError;
 

package/dist/{EverfurError-DmELDpXp.d.ts → EverfurError-pEXDbUJ1.d.ts}

@@ -1,5 +1,5 @@
 /** The frozen error taxonomy. Additive-only under the dated-contract policy. */
-type EverfurErrorCode = 'authExpired' | 'authRejected' | 'sessionRequired' | 'accessDenied' | 'paymentRequired' | 'quotaExceeded' | 'rateLimited' | 'validationFailed' | 'sdkUpdateRequired' | 'conflict' | 'idempotencyConflict' | 'idempotencyInFlight' | 'conversationNotFound' | 'petNotFound' | 'resourceNotFound' | 'streamTimeout' | 'mediaUploadFailed' | 'moderationBlocked' | 'upstreamLlmTimeout' | 'internalError' | 'notImplemented' | 'serviceUnavailable' | 'streamIncomplete' | 'unknown';
+type EverfurErrorCode = 'authExpired' | 'authRejected' | 'sessionRequired' | 'accessDenied' | 'paymentRequired' | 'quotaExceeded' | 'rateLimited' | 'validationFailed' | 'sdkUpdateRequired' | 'conflict' | 'idempotencyConflict' | 'idempotencyInFlight' | 'conversationNotFound' | 'petNotFound' | 'resourceNotFound' | 'streamTimeout' | 'mediaUploadFailed' | 'moderationBlocked' | 'upstreamLlmTimeout' | 'internalError' | 'notImplemented' | 'serviceUnavailable' | 'streamIncomplete' | 'identitySignatureRequired' | 'unknown';
 /** Every code, frozen, for iteration in conformance / property tests. */
 declare const EVERFUR_ERROR_CODES: readonly EverfurErrorCode[];
 /**
@@ -137,6 +137,12 @@ interface EverfurError {
      * snake_case token is kept; anything else is dropped rather than carried.
      */
     readonly reasonCode?: string;
+    /**
+     * The wait the server named, in seconds, when it named one: the body's `retry_after_seconds`, or a `Retry-After`
+     * header on a 429 or 503. The anonymous-session budget's 429 (`reasonCode` `anonymous_session_limit`) carries
+     * it; the SDK does not retry past it.
+     */
+    readonly retryAfterSeconds?: number;
     /** raw wire text; telemetry / logs only, NEVER rendered. NON-ENUMERABLE. */
     readonly wireMessage?: string;
     /** Opaque parsed wire payload for debugging (untrusted, unvalidated). NON-ENUMERABLE. */
@@ -169,6 +175,8 @@ interface MakeEverfurErrorOptions {
     readonly reasonCode?: string | null;
     /** Opaque parsed wire payload. Carried NON-ENUMERABLY for debugging; never rendered. */
     readonly raw?: unknown;
+    /** The wait the response named, in seconds. Kept only when finite and not negative. */
+    readonly retryAfterSeconds?: number | null;
 }
 declare function makeEverfurError(code: EverfurErrorCode, opts?: MakeEverfurErrorOptions): EverfurError;
 

package/dist/{EverfurResult-ZtH-YV1h.d.cts → EverfurResult-dtl8ERAw.d.cts}

@@ -1,4 +1,4 @@
-import { E as EverfurError } from './EverfurError-DmELDpXp.cjs';
+import { E as EverfurError } from './EverfurError-pEXDbUJ1.cjs';
 
 /**
  * The settle type. An async public operation returns this instead of throwing for an EXPECTED failure.

package/dist/{EverfurResult-SGvHKsCB.d.ts → EverfurResult-sKkoXew0.d.ts}

@@ -1,4 +1,4 @@
-import { E as EverfurError } from './EverfurError-DmELDpXp.js';
+import { E as EverfurError } from './EverfurError-pEXDbUJ1.js';
 
 /**
  * The settle type. An async public operation returns this instead of throwing for an EXPECTED failure.