chore: release v0.11.0

Bump root/backend/frontend to 0.11.0 and record the 0.11.0 changelog:
relay-routed Patient Portal + wallet linking, phone-ready portal QR,
appointments/invoices synced to the wallet, clinic-location reverse geocoding,
and the Arabic RTL sidebar fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,220 @@ for how releases are cut and published.
 
 ## [Unreleased]
 
+## [0.11.0] — 2026-07-09
+
+### Added
+- **Patient Portal over the Temetro Network relay + wallet linking.** The wallet app now reaches a
+  clinic's Patient Portal through the relay instead of a direct HTTP API, so it works from a real
+  phone. New `services/portal.ts` (clinic info, doctors, availability, wallet linking, conflict-aware
+  booking, results, downloadable lab files) runs behind a `portal:request` hub handler
+  (`backend/src/services/relay-client.ts`). A new nullable `patients.wallet_number` column stores the
+  link, and `walletNumberForPatient` resolves through it so clinic→wallet pushes work after a portal
+  link (not only after a permanent share). `GET /api/portal/:clinic/link` returns the relay-based
+  pairing descriptor (clinic signing key + relay URL).
+- **Portal "Link my wallet" option.** The Patient Portal kiosk adds a third card that shows a QR the
+  wallet app scans to link over the relay (`components/portal/portal-kiosk.tsx`).
+- **Appointments & invoices reach the wallet.** Clinic→wallet pushes now include the patient's
+  appointments and invoices in the sealed bundle, so they show up in the wallet app.
+- **Clinic location reverse-geocoding.** "Use my current location" now fills address / city /
+  country (OpenStreetMap Nominatim), not just latitude / longitude (`lib/geocode.ts`).
+
+### Fixed
+- **Patient Portal QR was unreachable from a phone.** Settings → Signing now encodes a
+  `temetro-portal:` pairing URI (relay URL + clinic signing key) instead of a `localhost` API URL, so
+  the wallet app can actually connect (`components/settings/settings-portal.tsx`).
+- **Arabic (RTL) sidebar.** The collapse arrow and notification bell now stack **above** the nav
+  icons instead of being pinned to the opposite edge; the toggle glyph mirrors and the notifications
+  popover opens toward the content side (`components/sidebar-02/app-sidebar.tsx`,
+  `components/ui/sidebar.tsx`, `components/sidebar-02/nav-notifications.tsx`).
+
+## [0.10.0] — 2026-07-07
+
+### Added
+- **Patient Portal doctor picker & availability.** The portal now lists the clinic's doctors and
+  books against a chosen provider, showing only free slots. New public endpoints
+  `GET /api/portal/:clinic/doctors` and `GET /api/portal/:clinic/availability?provider=&date=`
+  (display-safe fields only), and `POST /api/portal/:clinic/appointments` accepts an optional
+  `provider` (`backend/src/routes/portal.ts`). The existing 409 conflict check stays authoritative.
+- **Patient Portal links in Settings.** Settings → Signing → Patient Portal adds **open**, **copy
+  link**, and **QR code** actions (`components/settings/settings-portal.tsx`); the QR carries the
+  backend base (`?api=`) so the patient wallet app can book natively when it scans it.
+- **Clinic location "Use my current location".** The location editor fills map coordinates from the
+  browser's geolocation (`components/settings/settings-location.tsx`).
+- **Wallet app native Patient Portal.** Scanning a clinic's portal QR opens a native booking screen
+  (doctor list → free-slot picker → confirm) in the patient wallet app.
+
+### Fixed
+- **Arabic (RTL) layout.** The sidebar now anchors to the **right** for RTL locales and the toggle
+  switch mirrors correctly, instead of leaving the shell misaligned
+  (`components/sidebar-02/app-sidebar.tsx`, `components/ui/switch.tsx`).
+- **Wallet app:** record-card **bottom sheet no longer freezes** the app (dropped the per-frame
+  animated blur overlay for HeroUI's built-in overlay); **Reset wallet** now confirms in a native
+  HeroUI dialog with Liquid Glass actions; fixed the **white edge flash** on screen transitions in
+  dark mode; the home/onboarding/register **logo** is now the Temetro mark.
+
+### Changed
+- New i18n keys (`settings.portal.*`, geolocation strings) are translated into **all** shipped
+  locales (en, de, fr, ar, so).
+
+## [0.9.0] — 2026-07-06
+
+### Added
+- **Patient blood type & phone number.** The patient record now carries a `bloodType` (e.g. `O+`)
+  and a `phone` number. Both are shown in the record sheet and chat summary card and are editable in
+  the add/edit patient form. `phone` is a demographic/contact field (visible to and editable by the
+  **reception** role); `bloodType` is treated as clinical PHI and is **redacted for reception** (like
+  allergies/vitals). New columns `patients.phone` / `patients.blood_type` (migration `0033`).
+- **Clinic location setting.** A new org-scoped `clinic_settings` table (migration `0034`) stores the
+  clinic's address (address / city / country) plus optional map coordinates (latitude / longitude),
+  set in **Settings → Signing → Clinic location** (owner/admin only). New endpoints
+  `GET /api/clinic/settings` (any clinician) and `PUT /api/clinic/location` (owner/admin). This will
+  be surfaced in the patient wallet app to show a clinic's location.
+
+### Changed
+- New i18n keys for the above are translated into **all** shipped locales (en, de, fr, ar, so), per
+  the coverage rule now documented in `frontend/CLAUDE.md`.
+
+## [0.8.2] — 2026-07-05
+
+### Fixed
+- **`RELAY_URL` now defaults to the hosted relay** (`https://network.temetro.com`) instead of
+  `http://localhost:8080`. The old default silently failed for anyone who joined the network without
+  explicitly setting `RELAY_URL` — the backend's hub connection could never reach the relay (inside
+  Docker `localhost` is the container itself), so it never authenticated and QR pairing generated a
+  QR pointing at an unreachable `localhost`. Self-hosters running their own relay still override
+  `RELAY_URL`. Updated `.env.example` accordingly.
+
+### Changed
+- Generating a pairing QR (`POST /api/patients/wallet/pair`) now ensures the clinic's relay hub is
+  connected before pre-registering the request, so the routing is set up even if the connection was
+  opened lazily.
+
+### Fixed
+- **QR "scan to connect" pairing** was broken by the multi-clinic relay routing (v0.8.0): pairing
+  has no wallet number, so the clinic never sent a `wallet:send` to register the request, and the
+  relay rejected the scanning device's response as "unknown or expired". The clinic now
+  **pre-registers** the pairing request with the relay (a new `hub:expect { requestId }` event on
+  `POST /api/patients/wallet/pair`), so the device's response routes back correctly. On hub
+  (re)connect the backend re-registers its still-pending requests, so routing also survives a relay
+  restart. `POST /pair` now also requires the clinic to have joined the network (clear 409 instead of
+  a dead QR), surfaced in the import dialog.
+
+### Added
+- **Multi-clinic Temetro Network.** The relay now serves many self-hosted clinics at once. Each
+  clinic authenticates to the `/hub` namespace by **signing a challenge with its own Ed25519 clinic
+  signing key** (`services/signing.ts`) — a per-clinic identity, not a shared password — and the
+  relay routes every device response back to only the clinic that originated the request (keyed by
+  `requestId`), so clinics never see each other's traffic. `wallet:online` is fanned out only to
+  clinics with pending work for that wallet.
+- **"Join Temetro Network" opt-in.** A per-clinic toggle in **Settings → Signing** (backed by
+  `clinic_signing_keys.network_enabled`, `GET`/`PUT /api/signing/network`, owner/admin only). Off by
+  default; enabling opens the clinic's relay connection, disabling tears it down. Wallet
+  import/push endpoints return **409** while a clinic hasn't joined. Localised in all five languages.
+
+### Changed
+- **The backend keeps one authenticated relay connection per network-enabled org**
+  (`services/relay-client.ts` — `connectOrg`/`disconnectOrg`, a `hubs` map keyed by `orgId`), instead
+  of a single shared-token connection. `emitToWallet`/`sendToWallet` now take an `orgId`, and the
+  offline-flush (`pendingUpdatesForWallet`) is org-scoped.
+- **`RELAY_TOKEN` is now optional/legacy.** Clinics authenticate with their signing key, so an open
+  relay needs no shared secret; `RELAY_TOKEN` only gates an optional *private* relay.
+
+## [0.7.0] — 2026-07-05
+
+### Added
+- **Temetro Network** — a standalone, high-performance **relay** (Rust + Axum + socketioxide) that
+  connects the backend to patient wallet apps, in its own repo
+  ([github.com/temetro/temetro-network](https://github.com/temetro/temetro-network)) and deployable
+  on Railway. It replaces the flaky Cloudflare quick-tunnel that used to expose the backend's
+  embedded `/wallet` Socket.io namespace to phones. The relay is a **dumb, stateless pipe**: a
+  `/wallet` namespace for devices (challenge/Ed25519-signature auth, room keyed by wallet number)
+  and a `RELAY_TOKEN`-authenticated `/hub` namespace for the backend. It forwards sealed ciphertext
+  verbatim, keeps no database, and its only crypto is verifying a device's auth signature (proven
+  byte-for-byte compatible with `wallet-crypto.ts`).
+
+### Changed
+- **The backend is now a client of the relay, not the wallet server.** The `/wallet` Socket.io
+  namespace was removed from `src/realtime.ts`; a new `src/services/relay-client.ts` connects to the
+  relay's `/hub` (`emitToWallet` delegates to its `sendToWallet`), handles device responses
+  (`wallet:share-response` / `wallet:update-response` / `wallet:revoke`) and flushes missed updates on
+  `wallet:online` — calling the same `wallet-share` / `wallet-updates` services as before. New
+  `RELAY_URL` + `RELAY_TOKEN` env vars; the wallet-import QR now points at `RELAY_URL`.
+
+## [0.6.0] — 2026-07-04
+
+### Added
+- **Read-only FHIR R4 server** — temetro can now be a FHIR **server**, not just a client.
+  A new endpoint tree at **`/fhir`** (mounted outside `/api`, bearer-only) exposes each
+  clinic's records as FHIR R4: **Patient**, **Observation** (labs + synthesized vital signs),
+  **AllergyIntolerance**, **Condition**, **MedicationRequest**, **Encounter** and
+  **Appointment**, plus an unauthenticated **`GET /fhir/metadata`** CapabilityStatement.
+  Searches return searchset `Bundle`s with `_count`/`_offset` pagination and self/next/prev
+  links. Because temetro stores free-text clinical values, every `CodeableConcept` is
+  **text-only** (no SNOMED/LOINC) and patients carry an **age** extension rather than a
+  `birthDate` — documented in the CapabilityStatement and API docs.
+- **Per-clinic FHIR API keys** — machine-to-machine auth via `Authorization: Bearer tmf_…`.
+  Keys are created/revoked under **Settings → Integrations → FHIR server** (owner/admin),
+  **SHA-256-hashed** at rest, and shown **once** at creation. Every FHIR request is
+  org-scoped (no cross-clinic reads) and written to the activity log with the key name and
+  result count. New `fhir_api_keys` table, `middleware/fhir-auth.ts`, the
+  `services/fhir-server/` mapping module (queries, resources, bundle, capability, keys), the
+  `/fhir` router, and `GET/POST/DELETE /api/integrations/fhir-server/keys`. New `fhirServer`
+  locale namespace across all five languages.
+
+## [0.5.0] — 2026-07-03
+
+### Added
+- **Clinic → wallet record-update push** — a clinician can push an updated record to a
+  **wallet-linked** patient (a permanent, approved share). The record snapshot is **signed**
+  with the clinic's Ed25519 key and **sealed** to the wallet's X25519 key (derived from its
+  Ed25519 wallet number via the birational map — verified byte-for-byte against the wallet's
+  own derivation), stored `pending`, and delivered over the `/wallet` relay live **and** on
+  the wallet's next authenticated connect (so an offline phone catches up). The patient
+  reviews it in a **pending-updates inbox** and approves/denies; the wallet signs its
+  decision, the backend verifies it, and the on-device record is replaced only on approval.
+  The wallet **pins** the clinic key (TOFU) and warns on a key change. New
+  `POST /api/patients/wallet/push`, `GET /api/patients/wallet/{link/:fileNumber,updates,updates/:id}`,
+  `walletRecordUpdates` table + service, `wallet:update-request` / `wallet:update-response`
+  relay events, a "Push to wallet" dialog with live status, and a "Sent updates" list under
+  Settings → Signing. New `walletPush` / `walletUpdatesList` locale namespaces across all five
+  languages. (The wallet app half ships in the sibling `temetro-app` repo.)
+
+## [0.4.0] — 2026-07-03
+
+### Added
+- **Ambient AI visit scribe** — a **Record visit** action on the patient sheet turns a
+  clinician↔patient conversation into a draft **SOAP** encounter note. Record with the
+  microphone (`MediaRecorder`, stored as an auditable patient attachment) or paste a
+  transcript; the backend transcribes via the user's **OpenAI (Whisper)** or **Gemini**
+  key, de-identifies the transcript + patient context through **Veil**, and the model
+  drafts a structured note that the clinician **reviews and edits before saving** — the
+  same write-approval gate as the chat agent. New `POST /api/scribe/{transcribe,draft,save}`
+  (`backend/src/routes/scribe.ts`, `services/ai/transcribe.ts`), a `veil.redactText()`
+  free-text redactor, and an `appendEncounter` service that adds one note without touching
+  the rest of the record. Gated by `patient:write` + the clinic AI policy (reception and
+  disabled-AI accounts don't see it). New `scribe` locale namespace across all five
+  languages. Drafting also works with local Ollama from a pasted transcript.
+
+## [0.3.0] — 2026-07-02
+
+### Added
+- **Three new interface languages** — Somali (`so`), Arabic (`ar`) and German
+  (`de`) join English and French, selectable in Settings → Profile → Language.
+  Each locale carries a full translation of the ~1,660 UI strings, with native
+  names shown in the selector (Soomaali, العربية, Deutsch).
+- **Right-to-left (RTL) support** — selecting Arabic sets `dir="rtl"` on the
+  document (applied before first paint via an inline script, so no flash), flips
+  physical spacing/alignment to logical CSS utilities, mirrors directional icons,
+  and loads an Arabic-capable typeface (IBM Plex Sans Arabic) appended to the
+  font stack for per-character fallback.
+- **Language roams across devices** — the chosen language is persisted to the
+  per-user `user_settings` preferences and re-applied on sign-in, with
+  localStorage remaining the offline source of truth.
+- **`frontend/scripts/check-locales.mjs`** (+ `npm run check-locales`) — a parity
+  check that fails on missing/extra keys or `{{placeholder}}` mismatches across
+  locales and warns when Arabic count-keys lack the full CLDR plural forms.
+
 ## [0.2.5] — 2026-07-01
 
 ### Fixed

CLAUDE.md

@@ -27,12 +27,13 @@ repository (published as `temetro`).
 > "Patient wallet app" below) and an end-to-end **encrypted share / patient-approval** flow:
 > clinics hold a real **Ed25519 signing key** (Settings → Signing, `backend/src/services/signing.ts`),
 > and "Import from a patient app" on the Patients page relays an encrypted request to the wallet over
-> a **`/wallet` Socket.io namespace**, the patient approves on their phone, and the sealed record is
-> imported (with optional **temporary share + auto-delete**). See `backend/src/routes/{signing,patients-wallet}.ts`.
+> the **Temetro Network** relay (see below), the patient approves on their phone, and the sealed record
+> is imported (with optional **temporary share + auto-delete**). Clinic→wallet **record-update push**
+> and **QR pairing** are built too. See `backend/src/routes/{signing,patients-wallet}.ts`.
 >
-> **Still vision, not built:** clinic→wallet push of signed record updates, in-app record editing,
-> QR pairing, and cryptographic time-boxing of temporary shares. The AI chat is still **mock replies**.
-> Email verification is wired but currently **not enforced** at sign-in (see `backend/CLAUDE.md`).
+> **Still vision, not built:** in-app record editing and cryptographic time-boxing of temporary
+> shares. The AI chat is still **mock replies**. Email verification is wired but currently **not
+> enforced** at sign-in (see `backend/CLAUDE.md`).
 
 ## Patient wallet app (sibling repo `~/Desktop/temetro-app`)
 
@@ -47,6 +48,28 @@ here means keys + data live on the patient's device and the relay only ever forw
 is **not** a literal blockchain (records are off-chain, which is also what lets a temporary share be
 deleted). Commit/push that app inside its own repo, separately from this one.
 
+## Temetro Network (sibling repo/folder `~/Desktop/Temetro-network`)
+
+The **relay** that connects this backend to patient wallet apps. It is its **own git repo** on the
+Desktop (folder `~/Desktop/Temetro-network`, pushed to `github.com/temetro/temetro-network`), **not**
+in this monorepo — a standalone **Rust + Axum + socketioxide** service meant to run always-on (e.g.
+on **Railway**). It replaces the old flaky Cloudflare quick-tunnel that used to expose the backend's
+embedded `/wallet` Socket.io namespace to phones.
+
+It is a **dumb, stateless pipe**: two Socket.io namespaces — `/wallet` for devices
+(challenge/Ed25519-signature auth, room keyed by wallet number) and `/hub` for this backend
+(`RELAY_TOKEN`-authenticated). Devices and the backend both connect to it; it **forwards sealed
+ciphertext verbatim** and never opens bundles or touches a database. Its only crypto is verifying a
+device's auth signature (mirrors `backend/src/lib/wallet-crypto.ts`). The backend connects to it as a
+`/hub` client via `backend/src/services/relay-client.ts` (its `sendToWallet` is what `emitToWallet`
+now calls); configure with `RELAY_URL` + `RELAY_TOKEN`. Commit/push that service inside its own repo,
+separately from this one.
+
+> **Note:** in this sandbox the `~/Desktop/Temetro-network` folder blocks directory enumeration
+> (`ls`/`getcwd`/git inside it return EPERM) though plain file writes work. Develop/build/commit it
+> in an accessible copy and mirror the tree in with `tar`; drive git there via
+> `GIT_DIR`/`GIT_WORK_TREE` from an accessible cwd.
+
 ## Layout
 
 `frontend/` and `backend/` were previously separate per-folder git repos; they have been **merged

backend/.env.example

@@ -32,13 +32,23 @@ POSTGRES_PORT=5432
 BACKEND_PORT=4000
 FRONTEND_PORT=3000
 
-# --- Patient wallet relay -------------------------------------------------
-# The URL baked into the QR a patient scans to import their record. Their phone
-# must be able to reach it — so localhost will NOT work from a real device. If
-# unset, the backend derives it from the request host (fine when you open the
-# web app over your LAN IP, e.g. http://192.168.1.20:3000). Otherwise set it
-# explicitly to a phone-reachable address: your machine's LAN IP or a public
-# tunnel URL.
+# --- Temetro Network relay ------------------------------------------------
+# The standalone relay (github.com/temetro/temetro-network) that connects this
+# backend to patient phones. Deploy it (e.g. on Railway) and point both this
+# backend and the wallet app at it. RELAY_URL is the relay's public URL (also
+# baked into the QR a patient scans). This clinic authenticates to the relay's
+# /hub with its own Ed25519 signing key, so no shared secret is needed.
+# RELAY_TOKEN is OPTIONAL/LEGACY — set it only for a private relay that also
+# gates on a shared token (then use the SAME value here and on the relay).
+# Defaults to the hosted relay (https://network.temetro.com) when unset, so
+# "Join Temetro Network" works out of the box; set RELAY_URL only to point at
+# your own relay. Do NOT use http://localhost — inside Docker that's the
+# container itself and the relay connection will silently fail.
+RELAY_URL=https://network.temetro.com
+RELAY_TOKEN=
+
+# (Legacy, pre-relay self-hosting.) A phone-reachable URL for the QR when NOT
+# using the Temetro Network relay. RELAY_URL takes precedence over this.
 # PUBLIC_RELAY_URL=http://192.168.1.20:4000
 
 # --- Email (optional) -----------------------------------------------------

backend/CLAUDE.md

@@ -60,6 +60,18 @@ No test runner is configured. Verify by running the stack (`docker compose up`)
 - **Real-time** lives in **`src/realtime.ts`** — a Socket.io server attached to the same HTTP server
   in `index.ts`; the handshake reuses Better Auth's `getSession`. Other modules push via
   `emitToUser` / `emitToConversation` (no direct socket import, so no circular deps).
+- **Patient-wallet relay** is **no longer hosted here.** Devices connect to the standalone **Temetro
+  Network** service (`~/Desktop/Temetro-network`, see root `CLAUDE.md`), which is **multi-clinic**.
+  This backend connects to it as a `/hub` client in **`src/services/relay-client.ts`**, keeping **one
+  authenticated connection per network-enabled org** (`hubs` map keyed by `orgId`). Each org
+  authenticates by signing the relay's `hub:challenge` with its clinic signing key
+  (`signWithClinicKey`) — no shared `RELAY_TOKEN` needed (it's now optional/legacy, only for a
+  private relay). `emitToWallet(orgId, …)` (realtime.ts) delegates to `sendToWallet(orgId, …)`, and
+  device responses (`wallet:share-response` / `wallet:update-response` / `wallet:revoke`) +
+  `wallet:online` replay are handled per-org there, calling the same `wallet-share` /
+  `wallet-updates` services the old `/wallet` namespace did. A clinic opts in via **"Join Temetro
+  Network"** (Settings → Signing → `PUT /api/signing/network`, `clinic_signing_keys.network_enabled`);
+  `connectOrg`/`disconnectOrg` open/close its connection, and wallet routes 409 when it's off.
 - **`src/lib/email.ts`** — `sendEmail` logs links to the console when SMTP is unset.
 
 ## Gotchas / conventions

backend/docker-compose.yml

@@ -68,6 +68,11 @@ services:
       BETTER_AUTH_URL: http://localhost:4000
       FRONTEND_URL: http://localhost:3000
       PORT: "4000"
+      # Temetro Network relay (github.com/temetro/temetro-network). Set RELAY_URL
+      # to your deployed relay's public URL and RELAY_TOKEN to the shared secret
+      # you configured on it — both are required for patient-wallet import.
+      RELAY_URL: ${RELAY_URL:-}
+      RELAY_TOKEN: ${RELAY_TOKEN:-}
       NODE_ENV: production
       # Uploaded patient/lab files live here, on the temetro_uploads volume.
       UPLOAD_DIR: /var/lib/temetro/uploads

backend/drizzle/0030_medical_blur.sql

@@ -0,0 +1,21 @@
+CREATE TABLE "wallet_record_updates" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" text NOT NULL,
+	"created_by" text NOT NULL,
+	"file_number" text NOT NULL,
+	"wallet_number" text NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"payload_sealed" text NOT NULL,
+	"clinic_signature" text NOT NULL,
+	"clinic_public_key" text NOT NULL,
+	"clinic_fingerprint" text NOT NULL,
+	"changes" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"delivered_at" timestamp,
+	"resolved_at" timestamp
+);
+--> statement-breakpoint
+ALTER TABLE "wallet_record_updates" ADD CONSTRAINT "wallet_record_updates_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "wallet_record_updates" ADD CONSTRAINT "wallet_record_updates_created_by_user_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "wallet_updates_org_idx" ON "wallet_record_updates" USING btree ("organization_id");--> statement-breakpoint
+CREATE INDEX "wallet_updates_wallet_idx" ON "wallet_record_updates" USING btree ("wallet_number");

backend/drizzle/0031_stiff_gateway.sql

@@ -0,0 +1,15 @@
+CREATE TABLE "fhir_api_keys" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" text NOT NULL,
+	"name" text NOT NULL,
+	"key_hash" text NOT NULL,
+	"created_by" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"last_used_at" timestamp,
+	"revoked_at" timestamp,
+	CONSTRAINT "fhir_api_keys_key_hash_unique" UNIQUE("key_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "fhir_api_keys" ADD CONSTRAINT "fhir_api_keys_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "fhir_api_keys" ADD CONSTRAINT "fhir_api_keys_created_by_user_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "fhir_api_keys_org_idx" ON "fhir_api_keys" USING btree ("organization_id");

backend/drizzle/0032_closed_dakota_north.sql

@@ -0,0 +1 @@
+ALTER TABLE "clinic_signing_keys" ADD COLUMN "network_enabled" boolean DEFAULT false NOT NULL;

backend/drizzle/0033_ambitious_reavers.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "patients" ADD COLUMN "phone" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "patients" ADD COLUMN "blood_type" text DEFAULT '' NOT NULL;

backend/drizzle/0034_chunky_blacklash.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "clinic_settings" (
+	"organization_id" text PRIMARY KEY NOT NULL,
+	"address" text DEFAULT '' NOT NULL,
+	"city" text DEFAULT '' NOT NULL,
+	"country" text DEFAULT '' NOT NULL,
+	"latitude" double precision,
+	"longitude" double precision,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "clinic_settings" ADD CONSTRAINT "clinic_settings_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;

backend/drizzle/0035_slippery_retro_girl.sql

@@ -0,0 +1 @@
+ALTER TABLE "patients" ADD COLUMN "wallet_number" text;

backend/drizzle/meta/_journal.json

@@ -211,6 +211,48 @@
       "when": 1782057030557,
       "tag": "0029_tiny_starhawk",
       "breakpoints": true
+    },
+    {
+      "idx": 30,
+      "version": "7",
+      "when": 1783093188246,
+      "tag": "0030_medical_blur",
+      "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "7",
+      "when": 1783117115021,
+      "tag": "0031_stiff_gateway",
+      "breakpoints": true
+    },
+    {
+      "idx": 32,
+      "version": "7",
+      "when": 1783263738631,
+      "tag": "0032_closed_dakota_north",
+      "breakpoints": true
+    },
+    {
+      "idx": 33,
+      "version": "7",
+      "when": 1783362745730,
+      "tag": "0033_ambitious_reavers",
+      "breakpoints": true
+    },
+    {
+      "idx": 34,
+      "version": "7",
+      "when": 1783363217049,
+      "tag": "0034_chunky_blacklash",
+      "breakpoints": true
+    },
+    {
+      "idx": 35,
+      "version": "7",
+      "when": 1783530491321,
+      "tag": "0035_slippery_retro_girl",
+      "breakpoints": true
     }
   ]
 }

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "temetro-backend",
-  "version": "0.1.0",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "temetro-backend",
-      "version": "0.1.0",
+      "version": "0.6.0",
       "license": "MIT",
       "dependencies": {
         "@ai-sdk/anthropic": "^3.0.84",
@@ -28,6 +28,7 @@
         "nodemailer": "^8.0.10",
         "pg": "^8.21.0",
         "socket.io": "^4.8.3",
+        "socket.io-client": "^4.8.3",
         "zod": "^4.4.3"
       },
       "devDependencies": {
@@ -3339,6 +3340,40 @@
         "node": ">=10.2.0"
       }
     },
+    "node_modules/engine.io-client": {
+      "version": "6.6.6",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.6.tgz",
+      "integrity": "sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-parser": "~5.2.1",
+        "ws": "~8.21.0",
+        "xmlhttprequest-ssl": "~2.1.1"
+      }
+    },
+    "node_modules/engine.io-client/node_modules/ws": {
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/engine.io-parser": {
       "version": "5.2.3",
       "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz",
@@ -4947,6 +4982,21 @@
         "ws": "~8.20.1"
       }
     },
+    "node_modules/socket.io-client": {
+      "version": "4.8.3",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
+      "integrity": "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-client": "~6.6.1",
+        "socket.io-parser": "~4.2.4"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/socket.io-parser": {
       "version": "4.2.6",
       "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
@@ -5779,6 +5829,14 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/xmlhttprequest-ssl": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.1.2.tgz",
+      "integrity": "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/xtend": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "temetro-backend",
-  "version": "0.2.5",
+  "version": "0.11.0",
   "private": true,
   "type": "module",
   "description": "temetro backend — Express + Postgres API with Better Auth (email/password, organizations) and org-scoped patient records.",
@@ -41,6 +41,7 @@
     "nodemailer": "^8.0.10",
     "pg": "^8.21.0",
     "socket.io": "^4.8.3",
+    "socket.io-client": "^4.8.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {

backend/src/db/schema/clinic-settings.ts

@@ -0,0 +1,25 @@
+import { doublePrecision, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+import { organization } from "./auth.js";
+
+// Per-clinic (organization) settings. Currently holds the clinic's physical
+// location — a free-text address plus optional map coordinates — set in
+// Settings → Location by an owner/admin and surfaced to patients in the wallet
+// app later (e.g. a map pin for a clinic that shared a record). One row per org
+// (PK = organizationId), mirroring `clinic_signing_keys`.
+export const clinicSettings = pgTable("clinic_settings", {
+  organizationId: text("organization_id")
+    .primaryKey()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  address: text("address").notNull().default(""),
+  city: text("city").notNull().default(""),
+  country: text("country").notNull().default(""),
+  // Optional map coordinates (WGS84). Null until the clinic sets them.
+  latitude: doublePrecision("latitude"),
+  longitude: doublePrecision("longitude"),
+  createdAt: timestamp("created_at").defaultNow().notNull(),
+  updatedAt: timestamp("updated_at")
+    .defaultNow()
+    .$onUpdate(() => new Date())
+    .notNull(),
+});

backend/src/db/schema/fhir-keys.ts

@@ -0,0 +1,30 @@
+import { index, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+import { organization, user } from "./auth.js";
+
+// Per-organization API keys for the read-only FHIR R4 server (`/fhir`). These
+// are machine-to-machine credentials (no Better Auth session): a caller sends
+// `Authorization: Bearer tmf_<secret>` and every query is scoped to the owning
+// clinic. Only the SHA-256 *hash* of the secret is stored — the plaintext key is
+// shown once at creation and never again. Revoking sets `revokedAt` (kept for
+// audit rather than hard-deleted).
+export const fhirApiKeys = pgTable(
+  "fhir_api_keys",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    // Hex SHA-256 of the full `tmf_…` secret. Unique so a lookup is a single
+    // indexed probe and two keys can never collide.
+    keyHash: text("key_hash").notNull().unique(),
+    createdBy: text("created_by").references(() => user.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    lastUsedAt: timestamp("last_used_at"),
+    revokedAt: timestamp("revoked_at"),
+  },
+  (t) => [index("fhir_api_keys_org_idx").on(t.organizationId)],
+);

backend/src/db/schema/index.ts

@@ -20,4 +20,7 @@ export * from "./integrations.js";
 export * from "./staff-profile.js";
 export * from "./meetings.js";
 export * from "./signing.js";
+export * from "./clinic-settings.js";
 export * from "./wallet-share.js";
+export * from "./wallet-updates.js";
+export * from "./fhir-keys.js";

backend/src/db/schema/patients.ts

@@ -36,6 +36,11 @@ export const patients = pgTable(
     pcp: text("pcp").notNull(),
     status: text("status").$type<PatientStatus>().notNull(),
     initials: text("initials").notNull(),
+    // Contact + clinical demographics. `phone` is a contact/registration field
+    // (reception may read/write it); `bloodType` is clinical (redacted for the
+    // reception role, like allergies/vitals).
+    phone: text("phone").notNull().default(""),
+    bloodType: text("blood_type").notNull().default(""),
     alerts: jsonb("alerts").$type<string[]>().notNull(),
     vitalsBp: text("vitals_bp").notNull(),
     vitalsHr: text("vitals_hr").notNull(),
@@ -59,6 +64,10 @@ export const patients = pgTable(
     // and passes, a scheduled sweep hard-deletes the row (services/wallet-share).
     shareOrigin: text("share_origin").$type<"wallet">(),
     shareExpiresAt: timestamp("share_expires_at"),
+    // The patient's wallet number (tmw_…) once they link their wallet from the
+    // Patient Portal. Lets clinic→wallet pushes and portal actions resolve to
+    // this file directly (services/portal.ts, wallet-updates.ts). Nullable.
+    walletNumber: text("wallet_number"),
     createdBy: text("created_by").references(() => user.id, {
       onDelete: "set null",
     }),

backend/src/db/schema/signing.ts

@@ -1,4 +1,4 @@
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
 
 import { organization } from "./auth.js";
 
@@ -16,6 +16,11 @@ export const clinicSigningKeys = pgTable("clinic_signing_keys", {
   fingerprint: text("fingerprint").notNull(),
   // Encrypted (lib/crypto.ts) hex of the Ed25519 private key.
   privateKeyEnc: text("private_key_enc").notNull(),
+  // Whether this clinic has joined the Temetro Network relay ("Join Temetro
+  // Network" in Settings → Signing). Off by default: only when enabled does the
+  // backend open this clinic's relay hub connection and expose wallet features.
+  // The relay identity *is* this signing key, so the flag lives on the same row.
+  networkEnabled: boolean("network_enabled").notNull().default(false),
   createdAt: timestamp("created_at").defaultNow().notNull(),
   rotatedAt: timestamp("rotated_at"),
 });

backend/src/db/schema/wallet-updates.ts

@@ -0,0 +1,53 @@
+import { index, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+import { organization, user } from "./auth.js";
+
+export type WalletUpdateStatus =
+  | "pending"
+  | "delivered"
+  | "approved"
+  | "denied";
+
+// One row per clinic→wallet record-update push. When a clinician edits a
+// wallet-linked patient they can push the updated record to the patient's app;
+// it lands here as `pending`, is sealed to the wallet's (X25519-from-Ed25519)
+// key and signed with the clinic's Ed25519 key. The relay delivers it live if
+// the device is connected, and again on the wallet's next authenticated connect
+// (so an offline phone still receives it). The patient reviews the change,
+// verifies the clinic signature, and approves/denies in-app — only then is the
+// on-device record replaced. The clinic polls `status` for delivery/approval.
+export const walletRecordUpdates = pgTable(
+  "wallet_record_updates",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    createdBy: text("created_by")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    fileNumber: text("file_number").notNull(),
+    walletNumber: text("wallet_number").notNull(),
+    status: text("status")
+      .$type<WalletUpdateStatus>()
+      .notNull()
+      .default("pending"),
+    // base64 sealed box of the full updated patient snapshot (sealed to the
+    // wallet's derived X25519 key).
+    payloadSealed: text("payload_sealed").notNull(),
+    // The clinic's Ed25519 signature over the plaintext bundle bytes + its
+    // public key + fingerprint, so the wallet can verify provenance (TOFU pin).
+    clinicSignature: text("clinic_signature").notNull(),
+    clinicPublicKey: text("clinic_public_key").notNull(),
+    clinicFingerprint: text("clinic_fingerprint").notNull(),
+    // Human-readable summary of what changed (shown in the wallet inbox).
+    changes: jsonb("changes").$type<string[]>().notNull().default([]),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    deliveredAt: timestamp("delivered_at"),
+    resolvedAt: timestamp("resolved_at"),
+  },
+  (t) => [
+    index("wallet_updates_org_idx").on(t.organizationId),
+    index("wallet_updates_wallet_idx").on(t.walletNumber),
+  ],
+);

backend/src/env.ts

@@ -28,6 +28,19 @@ const schema = z.object({
   // Overrides the version reported by GET /api/version. Normally derived from
   // package.json; the release pipeline can pin it explicitly.
   APP_VERSION: z.string().optional(),
+  // Temetro Network relay (github.com/temetro/temetro-network). Both this
+  // backend and patient phones connect to it; it routes the encrypted wallet
+  // messages between them. RELAY_URL is the relay's public URL (also baked into
+  // the QR a patient scans). Each clinic authenticates to the relay's /hub with
+  // its own Ed25519 signing key, so no shared secret is needed. RELAY_TOKEN is
+  // now *optional/legacy* — set it only for a private relay that also gates on a
+  // shared token (must then match the relay's RELAY_TOKEN).
+  //
+  // Defaults to the hosted relay so "Join Temetro Network" works out of the box;
+  // override only when running your own relay. (A `localhost` default silently
+  // fails inside Docker, where localhost is the container itself.)
+  RELAY_URL: z.string().min(1).default("https://network.temetro.com"),
+  RELAY_TOKEN: z.string().default(""),
   // Public, device-reachable URL of this backend's wallet relay, baked into the
   // QR a patient scans. Optional — when unset we derive it from the request host
   // (so opening the web app over the LAN yields a reachable LAN URL).
@@ -80,6 +93,9 @@ if (env.NODE_ENV === "production") {
     );
     process.exit(1);
   }
+  // RELAY_TOKEN is optional now: clinics authenticate to the relay with their
+  // own Ed25519 signing key, so an unset token is the normal "open relay" case —
+  // no warning needed.
 }
 
 export const isProd = env.NODE_ENV === "production";

backend/src/index.ts

@@ -16,8 +16,10 @@ import { analyticsRouter } from "./routes/analytics.js";
 import { attachmentsRouter } from "./routes/attachments.js";
 import { appointmentsRouter } from "./routes/appointments.js";
 import { chatRouter } from "./routes/chat.js";
+import { clinicRouter } from "./routes/clinic.js";
 import { conversationsRouter } from "./routes/conversations.js";
 import { dispensesRouter } from "./routes/dispenses.js";
+import { fhirRouter } from "./routes/fhir.js";
 import { integrationsRouter } from "./routes/integrations.js";
 import { inventoryRouter } from "./routes/inventory.js";
 import { invoicesRouter } from "./routes/invoices.js";
@@ -28,12 +30,14 @@ import { patientsRouter } from "./routes/patients.js";
 import { patientsWalletRouter } from "./routes/patients-wallet.js";
 import { portalRouter } from "./routes/portal.js";
 import { prescriptionsRouter } from "./routes/prescriptions.js";
+import { scribeRouter } from "./routes/scribe.js";
 import { settingsRouter } from "./routes/settings.js";
 import { signingRouter } from "./routes/signing.js";
 import { staffRouter } from "./routes/staff.js";
 import { networkRouter } from "./routes/network.js";
 import { tasksRouter } from "./routes/tasks.js";
 import { versionRouter } from "./routes/version.js";
+import { initRelayClient } from "./services/relay-client.js";
 import { beginQuickTunnelDiscovery } from "./services/relay-url.js";
 import { sweepExpiredShares } from "./services/wallet-share.js";
 
@@ -87,6 +91,7 @@ app.use("/api/network", networkRouter);
 app.use("/api/patients/wallet", patientsWalletRouter);
 app.use("/api/patients", patientsRouter);
 app.use("/api/signing", signingRouter);
+app.use("/api/clinic", clinicRouter);
 app.use("/api/attachments", attachmentsRouter);
 app.use("/api/notes", notesRouter);
 app.use("/api/appointments", appointmentsRouter);
@@ -104,10 +109,16 @@ app.use("/api/notifications", notificationsRouter);
 app.use("/api/settings", settingsRouter);
 app.use("/api/ai", aiRouter);
 app.use("/api/chat", chatRouter);
+app.use("/api/scribe", scribeRouter);
 app.use("/api/integrations", integrationsRouter);
 app.use("/api/portal", portalRouter);
 app.use("/api/auth-helpers", authHelpersRouter);
 
+// Read-only FHIR R4 server, mounted OUTSIDE /api. Bearer-only (per-clinic API
+// keys), no Better Auth session/cookie coupling. Errors are FHIR
+// OperationOutcomes, not our standard error JSON.
+app.use("/fhir", fhirRouter);
+
 app.use(notFound);
 app.use(errorHandler);
 
@@ -115,6 +126,11 @@ app.use(errorHandler);
 const server = createServer(app);
 initRealtime(server);
 
+// Connect to the Temetro Network relay (the device-facing hub). Patient phones
+// no longer connect to this backend directly — they connect to the relay, and
+// we push to / receive from them over its /hub namespace.
+initRelayClient();
+
 // Sweep expired temporary patient-wallet shares (auto-delete) every 5 minutes.
 const SHARE_SWEEP_INTERVAL = 5 * 60 * 1000;
 setInterval(() => {
@@ -144,8 +160,9 @@ server.listen(env.PORT, () => {
   console.log(`  • chat:     /api/chat  (LLM agent)`);
   console.log(`  • integr.:  /api/integrations  (FHIR / e-Rx / claims)`);
   console.log(`  • portal:   /api/portal  (public clinic kiosk)`);
+  console.log(`  • fhir:     /fhir  (read-only FHIR R4 server, API-key auth)`);
   console.log(`  • signing:  /api/signing  (Ed25519 clinic key)`);
-  console.log(`  • wallet:   /api/patients/wallet  (+ /wallet socket relay)`);
+  console.log(`  • wallet:   /api/patients/wallet  (via Temetro Network relay: ${env.RELAY_URL})`);
 });
 
 // Dockerized off-network testing: learn our public Cloudflare quick-tunnel URL

backend/src/lib/patient-validation.ts

@@ -105,6 +105,10 @@ export const patientInputSchema = z
     ),
     status: z.enum(["active", "inpatient", "discharged"]).default("active"),
     initials: z.string().trim().max(4).default(""),
+    phone: z.string().trim().max(30).default(""),
+    bloodType: z
+      .enum(["A+", "A-", "B+", "B-", "AB+", "AB-", "O+", "O-", ""])
+      .default(""),
     allergies: z.array(allergySchema).default([]),
     alerts: z.array(z.string()).default([]),
     medications: z.array(medicationSchema).default([]),

backend/src/lib/wallet-x25519.ts

@@ -0,0 +1,49 @@
+import { bytesToHex } from "@noble/hashes/utils.js";
+
+// Convert an Ed25519 public key to the matching X25519 (Montgomery) public key,
+// so the clinic can `seal()` a record update to a wallet that only publishes an
+// Ed25519 identity (its wallet number). The patient wallet derives the matching
+// X25519 *private* key from its Ed25519 seed (SHA-512 clamp) to `open()` it —
+// this file MUST stay byte-for-byte compatible with the wallet app's
+// src/lib/crypto.ts. @noble/curves does not export edwardsToMontgomery in the
+// pinned version, so the birational map u = (1 + y) / (1 - y) mod p is done here
+// with BigInt. Verified: edPubToMontU(A) === x25519.getPublicKey(edClamp(seed)).
+
+const P = 2n ** 255n - 19n;
+
+function modpow(base: bigint, exp: bigint, mod: bigint): bigint {
+  let result = 1n;
+  let b = base % mod;
+  let e = exp;
+  while (e > 0n) {
+    if (e & 1n) result = (result * b) % mod;
+    b = (b * b) % mod;
+    e >>= 1n;
+  }
+  return result;
+}
+
+// Modular inverse via Fermat's little theorem (p is prime).
+function inv(a: bigint): bigint {
+  return modpow(((a % P) + P) % P, P - 2n, P);
+}
+
+// Ed25519 public key (compressed, little-endian y with the x-sign in the high
+// bit) → X25519 u-coordinate, returned as 32-byte little-endian hex.
+export function ed25519PubToX25519Hex(edPub: Uint8Array): string {
+  if (edPub.length !== 32) throw new Error("Ed25519 public key must be 32 bytes.");
+  const bytes = edPub.slice();
+  bytes[31] = (bytes[31] as number) & 0x7f; // clear the x sign bit
+  let y = 0n;
+  for (let i = 31; i >= 0; i--) y = (y << 8n) | BigInt(bytes[i] as number);
+  y %= P;
+  // u = (1 + y) / (1 - y)  (mod p)
+  const u = ((1n + y) * inv((1n - y + P) % P)) % P;
+  const out = new Uint8Array(32);
+  let v = u;
+  for (let i = 0; i < 32; i++) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return bytesToHex(out);
+}

backend/src/middleware/fhir-auth.ts

@@ -0,0 +1,49 @@
+import type { NextFunction, Request, Response } from "express";
+
+import { resolveKey } from "../services/fhir-server/keys.js";
+import {
+  FHIR_CONTENT_TYPE,
+  operationOutcome,
+} from "../services/fhir-server/outcome.js";
+
+// Bearer-token auth for the read-only FHIR server. Unlike the rest of the API
+// (Better Auth session cookies), the `/fhir` endpoints authenticate with a
+// per-clinic API key: `Authorization: Bearer tmf_<secret>`. On success the
+// caller's organization is attached to `req.organizationId` and every downstream
+// query is scoped to it. Failures return a FHIR OperationOutcome, not our
+// standard error JSON.
+export async function requireFhirKey(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> {
+  const header = req.headers.authorization ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  const secret = match?.[1]?.trim();
+
+  const unauthorized = (diagnostics: string) => {
+    res
+      .status(401)
+      .type(FHIR_CONTENT_TYPE)
+      .set("WWW-Authenticate", "Bearer")
+      .json(operationOutcome("error", "login", diagnostics));
+  };
+
+  if (!secret) {
+    unauthorized("Missing bearer token. Send Authorization: Bearer tmf_…");
+    return;
+  }
+
+  try {
+    const resolved = await resolveKey(secret);
+    if (!resolved) {
+      unauthorized("Invalid or revoked API key.");
+      return;
+    }
+    req.organizationId = resolved.orgId;
+    req.fhirKey = { id: resolved.keyId, name: resolved.keyName };
+    next();
+  } catch (err) {
+    next(err);
+  }
+}

backend/src/realtime.ts

@@ -1,16 +1,14 @@
 import type { Server as HttpServer } from "node:http";
 
 import { fromNodeHeaders } from "better-auth/node";
-import { bytesToHex, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 import { Server, type Socket } from "socket.io";
 
 import { auth } from "./auth.js";
 import { env } from "./env.js";
-import { decodeWalletNumber, verifySignature } from "./lib/wallet-crypto.js";
 import * as meetings from "./services/meetings.js";
 import * as messaging from "./services/messaging.js";
 import { createNotification } from "./services/notifications.js";
-import * as walletShare from "./services/wallet-share.js";
+import { sendToWallet } from "./services/relay-client.js";
 import type { MessageAttachment } from "./types/messaging.js";
 
 let io: Server | null = null;
@@ -19,7 +17,6 @@ const userRoom = (userId: string) => `user:${userId}`;
 const convRoom = (conversationId: string) => `conv:${conversationId}`;
 const callRoom = (roomId: string) => `call:${roomId}`;
 const orgRoom = (orgId: string) => `org:${orgId}`;
-const walletRoom = (walletNumber: string) => `wallet:${walletNumber}`;
 
 // Mesh WebRTC tops out around four peers (each sends its stream to every other);
 // past that the room is closed to new joiners.
@@ -43,15 +40,18 @@ export function emitToConversation(
   io?.to(convRoom(conversationId)).emit(event, data);
 }
 
-// Relay an end-to-end-encrypted message to a patient wallet device (the /wallet
-// namespace, room keyed by wallet number). The relay only ever forwards
-// ciphertext — it cannot read the record bundle.
+// Relay an end-to-end-encrypted message to a patient wallet device. Devices no
+// longer connect to this server directly — they connect to the standalone
+// Temetro Network relay, which forwards to the room keyed by wallet number. We
+// push over the relay's /hub namespace (see services/relay-client.ts). The
+// relay only ever forwards ciphertext — it cannot read the record bundle.
 export function emitToWallet(
+  orgId: string,
   walletNumber: string,
   event: string,
   data: unknown,
 ): void {
-  io?.of("/wallet").to(walletRoom(walletNumber)).emit(event, data);
+  sendToWallet(orgId, walletNumber, event, data);
 }
 
 type Ack = (response: { ok: boolean; [key: string]: unknown }) => void;
@@ -285,106 +285,5 @@ export function initRealtime(httpServer: HttpServer): Server {
     });
   });
 
-  // --- Patient wallet relay (/wallet namespace) ----------------------------
-  // Devices have no clinic session, so this namespace is NOT cookie-gated.
-  // Instead a device proves control of its wallet keypair: the server issues a
-  // random challenge, the device signs it with its Ed25519 key, and only then
-  // may it join its own wallet room. The relay forwards encrypted share
-  // requests/responses without ever reading the record bundle.
-  const walletNs = io.of("/wallet");
-  walletNs.on("connection", (socket: Socket) => {
-    const challenge = bytesToHex(randomBytes(32));
-    socket.data.challenge = challenge;
-    socket.data.walletNumber = null as string | null;
-    socket.emit("wallet:challenge", { challenge });
-
-    socket.on(
-      "wallet:auth",
-      (payload: { walletNumber?: string; signature?: string }, ack?: Ack) => {
-        try {
-          const walletNumber = String(payload?.walletNumber ?? "");
-          const signature = String(payload?.signature ?? "");
-          const publicKey = decodeWalletNumber(walletNumber);
-          const ok = verifySignature(
-            publicKey,
-            signature,
-            utf8ToBytes(socket.data.challenge as string),
-          );
-          if (!ok) {
-            ack?.({ ok: false });
-            return;
-          }
-          socket.data.walletNumber = walletNumber;
-          socket.join(walletRoom(walletNumber));
-          ack?.({ ok: true });
-        } catch {
-          ack?.({ ok: false });
-        }
-      },
-    );
-
-    // The patient approved/denied a share on their device; the sealed bundle (if
-    // approved) rides along and is decrypted + verified server-side.
-    socket.on(
-      "wallet:share-response",
-      async (
-        payload: {
-          requestId?: string;
-          walletNumber?: string;
-          decision?: "approved" | "denied";
-          sealed?: string;
-          signature?: string;
-        },
-        ack?: Ack,
-      ) => {
-        try {
-          if (
-            !socket.data.walletNumber ||
-            socket.data.walletNumber !== payload?.walletNumber
-          ) {
-            ack?.({ ok: false });
-            return;
-          }
-          const view = await walletShare.applyShareResponse(
-            String(payload?.requestId ?? ""),
-            String(payload?.walletNumber ?? ""),
-            payload?.decision === "approved" ? "approved" : "denied",
-            payload?.sealed,
-            payload?.signature,
-          );
-          ack?.({ ok: !!view });
-        } catch (err) {
-          ack?.({ ok: false, error: (err as Error).message });
-        }
-      },
-    );
-
-    // The patient revoked a previously shared record; delete it from the clinic.
-    socket.on(
-      "wallet:revoke",
-      async (
-        payload: { requestId?: string; walletNumber?: string },
-        ack?: Ack,
-      ) => {
-        try {
-          if (
-            !socket.data.walletNumber ||
-            socket.data.walletNumber !== payload?.walletNumber
-          ) {
-            ack?.({ ok: false });
-            return;
-          }
-          const result = await walletShare.revokeShare(
-            String(payload?.requestId ?? ""),
-            String(payload?.walletNumber ?? ""),
-          );
-          ack?.({ ok: !!result });
-        } catch {
-          ack?.({ ok: false });
-        }
-      },
-    );
-  });
-
   return io;
 }

backend/src/routes/attachments.ts

@@ -41,6 +41,14 @@ const ALLOWED_MIME = new Set([
   "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
   "application/vnd.ms-excel",
   "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // Ambient visit-scribe recordings (stored as a patient attachment so they're
+  // auditable). Voice Opus/AAC stays well under the 15 MB cap for a long visit.
+  "audio/webm",
+  "audio/ogg",
+  "audio/mp4",
+  "audio/mpeg",
+  "audio/wav",
+  "audio/x-m4a",
 ]);
 
 // Disk storage under UPLOAD_DIR/<orgId>/, keyed by a random id so original

backend/src/routes/clinic.ts

@@ -0,0 +1,61 @@
+import { Router } from "express";
+import { z } from "zod";
+
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import * as clinicSettings from "../services/clinic-settings.js";
+
+export const clinicRouter = Router();
+
+clinicRouter.use(requireAuth, requireOrg);
+
+// The clinic's settings (currently just its location). Readable by any
+// clinician so the app/UI can display the clinic address.
+clinicRouter.get(
+  "/settings",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await clinicSettings.getClinicSettings(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+// Set the clinic's location — owner/admin only (gated on the org-update
+// statement, same as signing-key rotation / network toggle).
+const locationSchema = z.object({
+  address: z.string().trim().max(200).default(""),
+  city: z.string().trim().max(120).default(""),
+  country: z.string().trim().max(120).default(""),
+  latitude: z.number().min(-90).max(90).nullable().default(null),
+  longitude: z.number().min(-180).max(180).nullable().default(null),
+});
+
+clinicRouter.put(
+  "/location",
+  requirePermission({ organization: ["update"] }),
+  async (req, res, next) => {
+    try {
+      const location = locationSchema.parse(req.body);
+      const view = await clinicSettings.setClinicLocation(
+        req.organizationId!,
+        location,
+      );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Updated the clinic location",
+        entityType: "settings",
+      });
+      res.json(view);
+    } catch (err) {
+      next(err);
+    }
+  },
+);

backend/src/routes/fhir.ts

@@ -0,0 +1,275 @@
+import { createRequire } from "node:module";
+
+import { Router } from "express";
+import type { Request, Response } from "express";
+import type { ParsedQs } from "qs";
+
+import { env } from "../env.js";
+import { requireFhirKey } from "../middleware/fhir-auth.js";
+import { recordActivity } from "../services/activity.js";
+import {
+  paginate,
+  parseCount,
+  parseOffset,
+  searchsetBundle,
+} from "../services/fhir-server/bundle.js";
+import { capabilityStatement } from "../services/fhir-server/capability.js";
+import {
+  FHIR_CONTENT_TYPE,
+  operationOutcome,
+  type IssueCode,
+  type IssueSeverity,
+} from "../services/fhir-server/outcome.js";
+import * as q from "../services/fhir-server/queries.js";
+import {
+  allergyResource,
+  appointmentResource,
+  conditionResource,
+  encounterResource,
+  labObservation,
+  medicationRequestResource,
+  patientResource,
+  vitalObservations,
+  type FhirResource,
+} from "../services/fhir-server/resources.js";
+
+const require = createRequire(import.meta.url);
+const pkg = require("../../package.json") as { version?: string };
+const VERSION = env.APP_VERSION ?? pkg.version ?? "0.0.0";
+
+export const fhirRouter = Router();
+
+// --- helpers ----------------------------------------------------------------
+
+function baseUrl(req: Request): string {
+  return `${req.protocol}://${req.get("host")}/fhir`;
+}
+
+function sendResource(res: Response, resource: unknown): void {
+  res.type(FHIR_CONTENT_TYPE).json(resource);
+}
+
+function sendOutcome(
+  res: Response,
+  status: number,
+  severity: IssueSeverity,
+  code: IssueCode,
+  diagnostics: string,
+): void {
+  res
+    .status(status)
+    .type(FHIR_CONTENT_TYPE)
+    .json(operationOutcome(severity, code, diagnostics));
+}
+
+function qstr(v: string | ParsedQs | (string | ParsedQs)[] | undefined): string | undefined {
+  if (typeof v === "string") return v.trim() || undefined;
+  if (Array.isArray(v) && typeof v[0] === "string") return v[0].trim() || undefined;
+  return undefined;
+}
+
+// Best-effort audit: every FHIR request is logged with the key name + result
+// count, scoped to the org. Access to PHI over the API must leave a trail.
+function audit(req: Request, resourceType: string, count: number): void {
+  void recordActivity({
+    orgId: req.organizationId!,
+    actor: { name: `FHIR API · ${req.fhirKey?.name ?? "key"}` },
+    action: `Read ${resourceType} via the FHIR API (${count} result${count === 1 ? "" : "s"})`,
+    entityType: "patient",
+  });
+}
+
+// Materialize a page from a full resource array + emit a searchset Bundle.
+function respondSearch(
+  req: Request,
+  res: Response,
+  resourceType: string,
+  all: FhirResource[],
+): void {
+  const count = parseCount(qstr(req.query._count as never));
+  const offset = parseOffset(qstr(req.query._offset as never));
+  const { page, total } = paginate(all, count, offset);
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(req.query)) {
+    if (k === "_count" || k === "_offset") continue;
+    const s = qstr(v as never);
+    if (s !== undefined) params.set(k, s);
+  }
+  audit(req, resourceType, total);
+  sendResource(
+    res,
+    searchsetBundle({ baseUrl: baseUrl(req), resourceType, page, total, count, offset, params }),
+  );
+}
+
+// Resolve the `patient` / `patient.identifier` search parameter to a patient row
+// (org-scoped). Returns undefined when the param is absent or matches nobody.
+async function patientFromQuery(req: Request) {
+  const patientId = qstr(req.query.patient as never);
+  const identifier = qstr(req.query["patient.identifier"] as never);
+  if (!patientId && !identifier) return undefined;
+  return q.resolvePatientRef(req.organizationId!, { patientId, identifier });
+}
+
+// --- CapabilityStatement (unauthenticated, per FHIR convention) -------------
+
+fhirRouter.get("/metadata", (req, res) => {
+  sendResource(res, capabilityStatement(baseUrl(req), VERSION));
+});
+
+// Everything below requires a valid per-clinic API key.
+fhirRouter.use(requireFhirKey);
+
+// --- Patient ----------------------------------------------------------------
+
+fhirRouter.get("/Patient", async (req, res, next) => {
+  try {
+    const count = parseCount(qstr(req.query._count as never));
+    const offset = parseOffset(qstr(req.query._offset as never));
+    const { rows, total } = await q.searchPatients(req.organizationId!, {
+      identifier: qstr(req.query.identifier as never),
+      name: qstr(req.query.name as never),
+      limit: count,
+      offset,
+    });
+    const params = new URLSearchParams();
+    if (qstr(req.query.identifier as never))
+      params.set("identifier", qstr(req.query.identifier as never)!);
+    if (qstr(req.query.name as never)) params.set("name", qstr(req.query.name as never)!);
+    audit(req, "Patient", total);
+    sendResource(
+      res,
+      searchsetBundle({
+        baseUrl: baseUrl(req),
+        resourceType: "Patient",
+        page: rows.map(patientResource),
+        total,
+        count,
+        offset,
+        params,
+      }),
+    );
+  } catch (err) {
+    next(err);
+  }
+});
+
+fhirRouter.get("/Patient/:id", async (req, res, next) => {
+  try {
+    const row = await q.patientById(req.organizationId!, String(req.params.id));
+    if (!row) {
+      sendOutcome(res, 404, "error", "not-found", "Patient not found.");
+      return;
+    }
+    audit(req, "Patient", 1);
+    sendResource(res, patientResource(row));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Observation (labs + vitals) --------------------------------------------
+
+fhirRouter.get("/Observation", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) {
+      respondSearch(req, res, "Observation", []);
+      return;
+    }
+    const category = qstr(req.query.category as never);
+    const all: FhirResource[] = [];
+    if (category !== "vital-signs") {
+      const rows = await q.labsForPatient(patient.id);
+      all.push(...rows.map((r) => labObservation(r, patient)));
+    }
+    if (category !== "laboratory") {
+      all.push(...vitalObservations(patient));
+    }
+    respondSearch(req, res, "Observation", all);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- AllergyIntolerance -----------------------------------------------------
+
+fhirRouter.get("/AllergyIntolerance", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "AllergyIntolerance", []);
+    const rows = await q.allergiesForPatient(patient.id);
+    respondSearch(req, res, "AllergyIntolerance", rows.map((r) => allergyResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Condition --------------------------------------------------------------
+
+fhirRouter.get("/Condition", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Condition", []);
+    const rows = await q.problemsForPatient(patient.id);
+    respondSearch(req, res, "Condition", rows.map((r) => conditionResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- MedicationRequest ------------------------------------------------------
+
+fhirRouter.get("/MedicationRequest", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "MedicationRequest", []);
+    const rows = await q.prescriptionsForFile(req.organizationId!, patient.fileNumber);
+    respondSearch(
+      req,
+      res,
+      "MedicationRequest",
+      rows.map((r) => medicationRequestResource(r, patient)),
+    );
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Encounter --------------------------------------------------------------
+
+fhirRouter.get("/Encounter", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Encounter", []);
+    const rows = await q.encountersForPatient(patient.id);
+    respondSearch(req, res, "Encounter", rows.map((r) => encounterResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Appointment ------------------------------------------------------------
+
+fhirRouter.get("/Appointment", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Appointment", []);
+    const rows = await q.appointmentsForFile(req.organizationId!, patient.fileNumber);
+    respondSearch(req, res, "Appointment", rows.map((r) => appointmentResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Unknown resource / path -> OperationOutcome ----------------------------
+
+fhirRouter.use((req, res) => {
+  sendOutcome(
+    res,
+    404,
+    "error",
+    "not-supported",
+    `Unsupported FHIR path or resource: ${req.method} ${req.path}.`,
+  );
+});

backend/src/routes/integrations.ts

@@ -18,6 +18,7 @@ import {
   listConfigs,
   saveConfig,
 } from "../services/integrations/config.js";
+import { createKey, listKeys, revokeKey } from "../services/fhir-server/keys.js";
 import * as eprescribe from "../services/integrations/eprescribe.js";
 import * as fhir from "../services/integrations/fhir.js";
 
@@ -119,6 +120,75 @@ integrationsRouter.post(
   },
 );
 
+// --- FHIR server API keys (owner/admin only) --------------------------------
+// These credential the read-only /fhir server. The plaintext secret is returned
+// exactly once (on creation) and only its hash is stored.
+
+integrationsRouter.get(
+  "/fhir-server/keys",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      res.json(await listKeys(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+const createKeySchema = z.object({ name: z.string().trim().min(1).max(120) });
+
+integrationsRouter.post(
+  "/fhir-server/keys",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      const { name } = createKeySchema.parse(req.body);
+      const { secret, key } = await createKey(
+        req.organizationId!,
+        name,
+        req.user!.id,
+      );
+      void recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created a FHIR API key ("${key.name}")`,
+        entityType: "settings",
+      });
+      // `secret` is present only in this response — the client must show it now.
+      res.status(201).json({ ...key, secret });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+integrationsRouter.delete(
+  "/fhir-server/keys/:id",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      const revoked = await revokeKey(req.organizationId!, String(req.params.id));
+      if (!revoked) throw new HttpError(404, "API key not found.");
+      void recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Revoked a FHIR API key",
+        entityType: "settings",
+      });
+      res.json({ revoked: true });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
 // --- Actions ----------------------------------------------------------------
 
 const syncSchema = z.object({ fileNumber: z.string().trim().min(1) });

backend/src/routes/patients-wallet.ts

@@ -17,18 +17,36 @@ import {
 } from "../middleware/auth.js";
 import { emitToWallet } from "../realtime.js";
 import { recordActivity } from "../services/activity.js";
+import { connectOrg, expectResponse } from "../services/relay-client.js";
 import * as patientService from "../services/patients.js";
 import { awaitQuickTunnelUrl } from "../services/relay-url.js";
+import { getNetworkEnabled } from "../services/signing.js";
 import * as walletShare from "../services/wallet-share.js";
+import * as walletUpdates from "../services/wallet-updates.js";
 
 export const patientsWalletRouter = Router();
 
 patientsWalletRouter.use(requireAuth, requireOrg);
 
+// Wallet sharing rides the Temetro Network relay, which a clinic must opt into
+// ("Join Temetro Network" in Settings → Signing). Guard the actions that need a
+// live relay connection so a disabled clinic gets a clear message, not silence.
+async function requireNetwork(orgId: string): Promise<void> {
+  if (!(await getNetworkEnabled(orgId))) {
+    throw new HttpError(
+      409,
+      "This clinic hasn't joined the Temetro Network. Enable it in Settings → Signing to share with patient wallets.",
+    );
+  }
+}
+
 // The device-reachable URL the patient's app should connect to (baked into the
-// QR). Prefer an explicit PUBLIC_RELAY_URL; otherwise derive it from the request
-// host so that opening the web app over the LAN yields a reachable LAN URL.
+// QR). Devices connect to the standalone Temetro Network relay — the same relay
+// this backend is hubbed to — so RELAY_URL is the canonical answer. The legacy
+// PUBLIC_RELAY_URL / cloudflared / request-host fallbacks remain for pre-relay
+// self-hosting.
 async function resolveRelayUrl(req: Request): Promise<string> {
+  if (env.RELAY_URL) return env.RELAY_URL;
   if (env.PUBLIC_RELAY_URL) return env.PUBLIC_RELAY_URL;
   // A cloudflared quick tunnel (`npm run docker:tunnel`). Wait briefly for it to
   // become reachable so the QR never carries a not-yet-live URL.
@@ -67,6 +85,7 @@ patientsWalletRouter.post(
   requirePermission({ patient: ["write"] }),
   async (req, res, next) => {
     try {
+      await requireNetwork(req.organizationId!);
       const input = pairSchema.parse(req.body);
       const { view, ephemeralPubKey } = await walletShare.createPairingRequest(
         req.organizationId!,
@@ -74,6 +93,12 @@ patientsWalletRouter.post(
         input.mode,
         input.durationHours,
       );
+      // No wallet number to `wallet:send` to yet, so pre-register the request id
+      // with the relay so the scanning device's response routes back to us.
+      // Ensure the hub is (re)connected first; if it's still mid-handshake the
+      // on-auth re-registration of pending requests will catch this one.
+      await connectOrg(req.organizationId!);
+      expectResponse(req.organizationId!, view.id);
       res.status(201).json({
         ...view,
         ephemeralPubKey,
@@ -93,6 +118,7 @@ patientsWalletRouter.post(
   requirePermission({ patient: ["write"] }),
   async (req, res, next) => {
     try {
+      await requireNetwork(req.organizationId!);
       const input = requestSchema.parse(req.body);
       const { view, ephemeralPubKey } = await walletShare.createShareRequest(
         req.organizationId!,
@@ -105,7 +131,7 @@ patientsWalletRouter.post(
         .select({ name: organization.name })
         .from(organization)
         .where(eq(organization.id, req.organizationId!));
-      emitToWallet(input.walletNumber, "wallet:share-request", {
+      emitToWallet(req.organizationId!, input.walletNumber, "wallet:share-request", {
         requestId: view.id,
         clinicName: org?.name ?? "A clinic",
         requestedBy: req.user!.name,
@@ -138,6 +164,95 @@ patientsWalletRouter.get(
   },
 );
 
+// --- Clinic → wallet record-update push ------------------------------------
+
+// Whether a patient is linked to a wallet (drives the "Push update" button).
+// Returns the wallet number when linked, 404 otherwise.
+patientsWalletRouter.get(
+  "/link/:fileNumber",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      const walletNumber = await walletUpdates.walletNumberForPatient(
+        req.organizationId!,
+        req.params.fileNumber as string,
+      );
+      if (!walletNumber) throw new HttpError(404, "Not wallet-linked.");
+      res.json({ walletNumber });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+const pushSchema = z.object({
+  fileNumber: z.string().trim().min(1),
+  changes: z.array(z.string().trim().min(1)).min(1).max(50),
+});
+
+// Push the current record snapshot to the linked wallet. Seals + signs it,
+// stores it pending, and delivers live if the device is connected (it is also
+// re-sent on the wallet's next connect). The patient must approve in-app.
+patientsWalletRouter.post(
+  "/push",
+  requirePermission({ patient: ["write"] }),
+  async (req, res, next) => {
+    try {
+      await requireNetwork(req.organizationId!);
+      const input = pushSchema.parse(req.body);
+      const row = await walletUpdates.createRecordUpdate(
+        req.organizationId!,
+        req.user!.id,
+        input.fileNumber,
+        input.changes,
+      );
+      const event = await walletUpdates.toEvent(row);
+      emitToWallet(req.organizationId!, row.walletNumber, "wallet:update-request", event);
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Pushed a record update to a patient wallet (#${row.fileNumber})`,
+        entityType: "patient",
+        entityId: row.fileNumber,
+        patientFileNumber: row.fileNumber,
+      });
+      res.status(201).json(walletUpdates.viewOf(row));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+// The clinic's recent update pushes (Signing panel + status polling).
+patientsWalletRouter.get(
+  "/updates",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await walletUpdates.listUpdates(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+patientsWalletRouter.get(
+  "/updates/:id",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      const view = await walletUpdates.getUpdate(
+        req.organizationId!,
+        req.params.id as string,
+      );
+      if (!view) throw new HttpError(404, "Update not found.");
+      res.json(view);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
 // Commit the (possibly clinician-edited) draft into a real patient record. The
 // temporary-share metadata (origin + auto-delete deadline) is taken from the
 // request server-side, so the clinic can't quietly keep a temporary record.

backend/src/routes/portal.ts

@@ -1,9 +1,11 @@
-import { eq } from "drizzle-orm";
+import { and, asc, eq, inArray } from "drizzle-orm";
 import { Router, type Request } from "express";
 import { z } from "zod";
 
 import { db } from "../db/index.js";
-import { organization } from "../db/schema/auth.js";
+import { member, organization, user } from "../db/schema/auth.js";
+import { staffProfile } from "../db/schema/staff-profile.js";
+import { env } from "../env.js";
 import { appointmentInputSchema } from "../lib/appointment-validation.js";
 import { HttpError } from "../lib/http-error.js";
 import { initialsFromName } from "../lib/initials.js";
@@ -11,6 +13,11 @@ import { patientInputSchema } from "../lib/patient-validation.js";
 import { recordActivity } from "../services/activity.js";
 import { createAppointment, listAppointments } from "../services/appointments.js";
 import { createPatient, getPatient } from "../services/patients.js";
+import { getOrCreateKey } from "../services/signing.js";
+
+// Clinical-capable roles that can be a patient's provider (mirrors
+// staff.ts PROVIDER_ROLES). Department roles (reception, pharmacy, lab) excluded.
+const PROVIDER_ROLES = ["owner", "admin", "doctor", "member"] as const;
 
 // Public, unauthenticated kiosk API for a clinic's Patient Portal (an iPad in the
 // waiting room). Scoped by the clinic slug in the URL — there is no session.
@@ -45,12 +52,97 @@ portalRouter.get("/:clinic", async (req, res, next) => {
   }
 });
 
+// GET /api/portal/:clinic/link — the relay-based pairing descriptor the wallet
+// app scans to talk to this clinic over the Temetro Network: the clinic's
+// signing public key (the relay's routing id) + the relay URL. Both values are
+// non-secret (the signing key is the clinic's public identity). This is what
+// makes the Patient Portal QR reachable from a real phone — it no longer bakes
+// in a localhost API URL.
+portalRouter.get("/:clinic/link", async (req, res, next) => {
+  try {
+    const clinic = await resolveClinic(req);
+    const key = await getOrCreateKey(clinic.id);
+    res.json({
+      clinicId: key.publicKey,
+      relay: env.RELAY_URL,
+      slug: String(req.params.clinic ?? "").trim(),
+      name: clinic.name,
+    });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// GET /api/portal/:clinic/doctors — public list of the clinic's providers so a
+// patient can pick who to see. Returns only display-safe fields (name +
+// specialty); no ids, emails, or usernames leave this unauthenticated surface.
+portalRouter.get("/:clinic/doctors", async (req, res, next) => {
+  try {
+    const clinic = await resolveClinic(req);
+    const rows = await db
+      .select({ name: user.name, specialty: staffProfile.specialty })
+      .from(member)
+      .innerJoin(user, eq(user.id, member.userId))
+      .leftJoin(
+        staffProfile,
+        and(
+          eq(staffProfile.userId, member.userId),
+          eq(staffProfile.organizationId, member.organizationId),
+        ),
+      )
+      .where(
+        and(
+          eq(member.organizationId, clinic.id),
+          inArray(member.role, PROVIDER_ROLES as unknown as string[]),
+        ),
+      )
+      .orderBy(asc(user.name));
+    res.json(rows.map((r) => ({ name: r.name, specialty: r.specialty ?? null })));
+  } catch (err) {
+    next(err);
+  }
+});
+
+const availabilitySchema = z.object({
+  provider: z.string().trim().max(200).optional(),
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD."),
+});
+
+// GET /api/portal/:clinic/availability?provider=&date= — the taken time slots
+// for a provider on a given day, so the kiosk can render only free slots. The
+// filter mirrors the booking conflict check (an empty-provider appointment
+// blocks the slot clinic-wide). Booking still re-checks server-side (409).
+portalRouter.get("/:clinic/availability", async (req, res, next) => {
+  try {
+    const clinic = await resolveClinic(req);
+    const q = availabilitySchema.parse({
+      provider: req.query.provider,
+      date: req.query.date,
+    });
+    const provider = q.provider ?? "";
+    const taken = (await listAppointments(clinic.id))
+      .filter(
+        (a) =>
+          a.status !== "cancelled" &&
+          a.date === q.date &&
+          (!provider || !a.provider || a.provider === provider),
+      )
+      .map((a) => a.time);
+    res.json({ date: q.date, provider, taken: [...new Set(taken)].sort() });
+  } catch (err) {
+    next(err);
+  }
+});
+
 const bookingSchema = z.object({
   fileNumber: z.string().trim().min(1, "A file number is required.").max(64),
   name: z.string().trim().min(1, "Your name is required.").max(200),
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD."),
   time: z.string().regex(/^\d{2}:\d{2}$/, "Time must be HH:mm."),
   type: z.string().trim().max(120).optional(),
+  // Chosen provider (doctor name) from the portal's doctor picker; falls back
+  // to the patient's PCP when omitted.
+  provider: z.string().trim().max(200).optional(),
 });
 
 const newPatientSchema = z.object({
@@ -114,7 +206,7 @@ portalRouter.post("/:clinic/appointments", async (req, res, next) => {
       date: body.date,
       time: body.time,
       type: body.type || "Self-service booking",
-      provider: patient.pcp || "",
+      provider: body.provider || patient.pcp || "",
       status: "confirmed",
       source: "manual",
     });

backend/src/routes/scribe.ts

@@ -0,0 +1,240 @@
+import { readFile } from "node:fs/promises";
+
+import { generateText } from "ai";
+import { Router } from "express";
+import { z } from "zod";
+
+import { HttpError } from "../lib/http-error.js";
+import { isReceptionOnly, providerScope } from "../lib/role-scope.js";
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import { getAiSettings } from "../services/ai/config.js";
+import { aiAllowedFor, getPolicy } from "../services/ai/policy.js";
+import { resolveModel } from "../services/ai/provider.js";
+import { transcribeAudio } from "../services/ai/transcribe.js";
+import { createVeil } from "../services/ai/veil.js";
+import { absolutePath, getAttachmentRow } from "../services/attachments.js";
+import { appendEncounter, getPatient } from "../services/patients.js";
+import type { Encounter } from "../types/patient.js";
+
+export const scribeRouter = Router();
+
+// The ambient scribe drafts and saves a clinical encounter note, so it needs
+// full clinical write access — never reception (demographics only).
+scribeRouter.use(
+  requireAuth,
+  requireOrg,
+  requirePermission({ patient: ["write"] }),
+);
+
+// Guard shared by every scribe route: the clinic AI kill-switch must allow this
+// member, and reception (demographics-only) can never draft clinical notes.
+async function ensureScribeAllowed(req: {
+  organizationId?: string;
+  memberRole?: string;
+}): Promise<void> {
+  if (isReceptionOnly(req.memberRole)) {
+    throw new HttpError(403, "The visit scribe is not available for your role.");
+  }
+  const policy = await getPolicy(req.organizationId!);
+  if (!aiAllowedFor(policy, req.memberRole)) {
+    throw new HttpError(403, "The AI assistant is disabled for your account.");
+  }
+}
+
+const transcribeSchema = z.object({
+  attachmentId: z.string().trim().min(1),
+});
+
+// POST /api/scribe/transcribe — turn a stored audio attachment into a raw
+// transcript via the user's speech provider (OpenAI/Gemini). The audio does NOT
+// pass through Veil or the chat loop.
+scribeRouter.post("/transcribe", async (req, res, next) => {
+  try {
+    await ensureScribeAllowed(req);
+    const { attachmentId } = transcribeSchema.parse(req.body);
+    const row = await getAttachmentRow(req.organizationId!, attachmentId);
+    if (!row) throw new HttpError(404, "Recording not found.");
+    if (!row.mimeType.startsWith("audio/")) {
+      throw new HttpError(400, "That attachment is not an audio recording.");
+    }
+
+    const settings = await getAiSettings(req.user!.id);
+    const buffer = await readFile(absolutePath(row.storagePath));
+    const { transcript, provider } = await transcribeAudio(settings, {
+      buffer,
+      mimeType: row.mimeType,
+      filename: row.filename,
+    });
+
+    void recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Transcribed a visit recording (${provider})`,
+      entityType: "patient",
+      patientFileNumber: row.fileNumber,
+    });
+
+    res.json({ transcript });
+  } catch (err) {
+    next(err);
+  }
+});
+
+const draftSchema = z.object({
+  fileNumber: z.string().trim().min(1),
+  transcript: z.string().trim().min(1).max(100_000),
+  visitType: z.string().trim().max(120).optional(),
+  date: z.string().trim().max(40).optional(),
+});
+
+// Strip ```json fences and parse; returns null if the text isn't JSON.
+function parseDraftJson(text: string): { type?: string; summary?: string } | null {
+  const cleaned = text
+    .replace(/^\s*```(?:json)?/i, "")
+    .replace(/```\s*$/i, "")
+    .trim();
+  try {
+    const parsed = JSON.parse(cleaned);
+    return typeof parsed === "object" && parsed ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+const DRAFT_SYSTEM = [
+  "You are a clinical scribe. From a visit transcript, write a concise, structured",
+  "encounter note in SOAP format (Subjective, Objective, Assessment, Plan).",
+  "Rules:",
+  "- Use ONLY what the transcript supports. Never invent vitals, doses, or findings.",
+  "- If a SOAP section has nothing to report, write \"Not discussed.\" under it.",
+  "- Identifiers may appear as tokens like [PATIENT_1] or [PROVIDER_1]; keep them",
+  "  verbatim — do not guess real names.",
+  "Respond with a JSON object ONLY (no prose, no code fences):",
+  '{ "type": "<short visit type, e.g. Follow-up / New patient / Telehealth>",',
+  '  "summary": "<the SOAP note as markdown with **Subjective** / **Objective** /',
+  '  **Assessment** / **Plan** headings>" }',
+].join("\n");
+
+// POST /api/scribe/draft — draft an encounter note from a transcript. The
+// transcript + patient context are Veil-redacted before any external call and
+// the output is rehydrated. Nothing is written — the clinician reviews and
+// approves via POST /save (the same write-approval gate as the chat agent).
+scribeRouter.post("/draft", async (req, res, next) => {
+  try {
+    await ensureScribeAllowed(req);
+    const { fileNumber, transcript, visitType, date } = draftSchema.parse(
+      req.body,
+    );
+
+    const patient = await getPatient(
+      req.organizationId!,
+      fileNumber,
+      false,
+      providerScope(req.memberRole, req.user!.id),
+    );
+    if (!patient) throw new HttpError(404, "Patient not found.");
+
+    const settings = await getAiSettings(req.user!.id);
+    const resolved = resolveModel(settings, settings.defaultModel);
+    const veil = createVeil(settings.veilLevel, resolved.isExternal);
+
+    // Seed Veil's token maps with this patient's identifiers, then redact the
+    // free-text transcript against them before it leaves the clinic.
+    const redactedPatient = veil.redactPatient(patient);
+    const redactedTranscript = veil.redactText(transcript);
+
+    const context = [
+      `Patient: ${redactedPatient.name} (MRN ${redactedPatient.fileNumber}), ${patient.age}y ${patient.sex}.`,
+      patient.problems.length
+        ? `Known problems: ${patient.problems.map((p) => p.label).join(", ")}.`
+        : "",
+      patient.medications.length
+        ? `Current medications: ${patient.medications
+            .map((m) => `${m.name} ${m.dose}`)
+            .join(", ")}.`
+        : "",
+      visitType ? `Visit type hint: ${visitType}.` : "",
+      "",
+      "Transcript:",
+      redactedTranscript,
+    ]
+      .filter(Boolean)
+      .join("\n");
+
+    const result = await generateText({
+      model: resolved.model,
+      system: DRAFT_SYSTEM,
+      prompt: context,
+    });
+
+    const parsed = parseDraftJson(result.text);
+    const summary = veil.rehydrate(
+      (parsed?.summary ?? result.text ?? "").trim(),
+    );
+    const type = (parsed?.type ?? visitType ?? "Visit").trim() || "Visit";
+
+    const draft: Encounter = {
+      date: date || new Date().toISOString().slice(0, 10),
+      type,
+      // The responsible clinician is the signed-in user, not the model's guess.
+      provider: req.user!.name ?? "",
+      summary,
+    };
+
+    res.json({
+      draft,
+      veil: {
+        active: veil.active,
+        level: veil.level,
+        classes: veil.usedClasses(),
+        provider: resolved.providerLabel,
+      },
+    });
+  } catch (err) {
+    next(err);
+  }
+});
+
+const saveSchema = z.object({
+  fileNumber: z.string().trim().min(1),
+  encounter: z.object({
+    date: z.string().trim().min(1),
+    type: z.string().trim().min(1),
+    provider: z.string().trim().default(""),
+    summary: z.string().trim().min(1),
+  }),
+});
+
+// POST /api/scribe/save — the approval step: append the reviewed encounter note
+// to the patient record. Re-validates server-side and audits like any add.
+scribeRouter.post("/save", async (req, res, next) => {
+  try {
+    await ensureScribeAllowed(req);
+    const { fileNumber, encounter } = saveSchema.parse(req.body);
+    const updated = await appendEncounter(
+      req.organizationId!,
+      fileNumber,
+      encounter,
+    );
+    if (!updated) throw new HttpError(404, "Patient not found.");
+
+    void recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Added a scribe visit note for ${updated.name}`,
+      entityType: "patient",
+      entityId: updated.fileNumber,
+      patientName: updated.name,
+      patientFileNumber: updated.fileNumber,
+    });
+
+    res.status(201).json(updated);
+  } catch (err) {
+    next(err);
+  }
+});

backend/src/routes/signing.ts

@@ -1,4 +1,5 @@
 import { Router } from "express";
+import { z } from "zod";
 
 import {
   requireAuth,
@@ -6,6 +7,7 @@ import {
   requirePermission,
 } from "../middleware/auth.js";
 import { recordActivity } from "../services/activity.js";
+import { connectOrg, disconnectOrg } from "../services/relay-client.js";
 import * as signing from "../services/signing.js";
 import * as walletShare from "../services/wallet-share.js";
 
@@ -48,6 +50,52 @@ signingRouter.post(
   },
 );
 
+// Whether this clinic has joined the Temetro Network relay. Readable by any
+// clinician (the panel shows the toggle state + connection status).
+signingRouter.get(
+  "/network",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json({ enabled: await signing.getNetworkEnabled(req.organizationId!) });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+// Join / leave the Temetro Network — owner/admin only (same gate as key
+// rotation). Enabling opens this clinic's relay hub connection; disabling tears
+// it down.
+const networkSchema = z.object({ enabled: z.boolean() });
+
+signingRouter.put(
+  "/network",
+  requirePermission({ organization: ["update"] }),
+  async (req, res, next) => {
+    try {
+      const { enabled } = networkSchema.parse(req.body);
+      await signing.setNetworkEnabled(req.organizationId!, enabled);
+      if (enabled) {
+        await connectOrg(req.organizationId!);
+      } else {
+        disconnectOrg(req.organizationId!);
+      }
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: enabled
+          ? "Joined the Temetro Network"
+          : "Left the Temetro Network",
+        entityType: "settings",
+      });
+      res.json({ enabled });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
 // Recent records shared from patient wallets — feeds the panel's shared-records
 // list.
 signingRouter.get(

backend/src/services/ai/transcribe.ts

@@ -0,0 +1,132 @@
+import { HttpError } from "../../lib/http-error.js";
+import type { userAiSettings } from "../../db/schema/ai.js";
+import { getApiKey } from "./config.js";
+
+type AiSettingsRow = typeof userAiSettings.$inferSelect;
+
+export type AudioInput = {
+  buffer: Buffer;
+  mimeType: string;
+  filename: string;
+};
+
+// Which transcription backend a user's AI settings can reach. Anthropic has no
+// speech-to-text API, so an Anthropic-only user must paste a transcript instead.
+export type TranscribeProvider = "openai" | "gemini";
+
+export function transcribeProviderFor(
+  settings: AiSettingsRow,
+): TranscribeProvider | null {
+  if (getApiKey(settings, "openai")) return "openai";
+  if (getApiKey(settings, "gemini")) return "gemini";
+  return null;
+}
+
+const OPENAI_MODEL = "whisper-1";
+const GEMINI_MODEL = "gemini-2.5-flash";
+
+const TRANSCRIBE_PROMPT =
+  "Transcribe this clinical visit recording verbatim. Return only the spoken words as plain text, with no commentary, headings, or timestamps.";
+
+async function transcribeWithOpenAI(
+  apiKey: string,
+  audio: AudioInput,
+): Promise<string> {
+  const form = new FormData();
+  form.append(
+    "file",
+    new Blob([new Uint8Array(audio.buffer)], { type: audio.mimeType }),
+    audio.filename,
+  );
+  form.append("model", OPENAI_MODEL);
+  form.append("response_format", "json");
+
+  const res = await fetch("https://api.openai.com/v1/audio/transcriptions", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    body: form,
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new HttpError(
+      502,
+      `Transcription failed (OpenAI ${res.status}). ${detail.slice(0, 300)}`,
+    );
+  }
+  const json = (await res.json()) as { text?: string };
+  return (json.text ?? "").trim();
+}
+
+async function transcribeWithGemini(
+  apiKey: string,
+  audio: AudioInput,
+): Promise<string> {
+  const url = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent?key=${encodeURIComponent(
+    apiKey,
+  )}`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      contents: [
+        {
+          parts: [
+            {
+              inline_data: {
+                mime_type: audio.mimeType,
+                data: audio.buffer.toString("base64"),
+              },
+            },
+            { text: TRANSCRIBE_PROMPT },
+          ],
+        },
+      ],
+    }),
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new HttpError(
+      502,
+      `Transcription failed (Gemini ${res.status}). ${detail.slice(0, 300)}`,
+    );
+  }
+  const json = (await res.json()) as {
+    candidates?: { content?: { parts?: { text?: string }[] } }[];
+  };
+  const text =
+    json.candidates?.[0]?.content?.parts
+      ?.map((p) => p.text ?? "")
+      .join("")
+      .trim() ?? "";
+  return text;
+}
+
+// Send an audio recording to the user's transcription provider and return the
+// raw transcript. The audio never passes through the chat loop or Veil — Veil
+// cannot redact speech, so the caller must warn the clinician that audio leaves
+// the clinic when an external provider is used (only the DRAFTING step is
+// Veil-protected). Throws a 400 when no speech-capable provider is configured.
+export async function transcribeAudio(
+  settings: AiSettingsRow,
+  audio: AudioInput,
+): Promise<{ transcript: string; provider: TranscribeProvider }> {
+  const provider = transcribeProviderFor(settings);
+  if (!provider) {
+    throw new HttpError(
+      400,
+      "Transcription needs an OpenAI or Gemini API key. Add one in Settings → AI, or paste the visit transcript instead.",
+    );
+  }
+  const apiKey = getApiKey(settings, provider)!;
+  const transcript =
+    provider === "openai"
+      ? await transcribeWithOpenAI(apiKey, audio)
+      : await transcribeWithGemini(apiKey, audio);
+  if (!transcript) {
+    throw new HttpError(
+      502,
+      "The transcription came back empty — try again or paste the transcript.",
+    );
+  }
+  return { transcript, provider };
+}

backend/src/services/ai/veil.ts

@@ -26,6 +26,15 @@ export type Veil = {
   redactPatient: (patient: Patient) => Patient;
   /** Map a possibly-tokenized file number from a tool call back to the real one. */
   resolveFileNumber: (input: string) => string;
+  /**
+   * De-identify free text (e.g. a visit transcript) by swapping any KNOWN
+   * identifiers — the patient name, MRN and provider names already seen via
+   * redactPatient — for their tokens. Seed the token maps by calling
+   * redactPatient(patient) first. Note: this only catches identifiers we know
+   * about; free-text PHI spoken aloud (addresses, relatives' names) is not
+   * covered — see the ambient-scribe consent notice.
+   */
+  redactText: (text: string) => string;
   /** Swap any tokens in model output back to real identifiers. */
   rehydrate: (text: string) => string;
   /** Token classes actually emitted — for the audit log. */
@@ -81,6 +90,21 @@ export function createVeil(level: VeilLevel, active: boolean): Veil {
     return mrnByToken.get(input.trim()) ?? input;
   }
 
+  function redactText(text: string): string {
+    if (!isActive || fromToken.size === 0) return text;
+    let out = text;
+    // Longest real values first so a provider name containing the patient name
+    // (or similar overlap) is replaced whole before its substrings.
+    const byLength = [...fromToken.entries()]
+      .filter(([, real]) => real.trim().length > 0)
+      .sort((a, b) => b[1].length - a[1].length);
+    for (const [token, real] of byLength) {
+      const escaped = real.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      out = out.replace(new RegExp(escaped, "gi"), token);
+    }
+    return out;
+  }
+
   function rehydrate(text: string): string {
     if (!isActive || fromToken.size === 0) return text;
     let out = text;
@@ -101,6 +125,7 @@ export function createVeil(level: VeilLevel, active: boolean): Veil {
     level,
     redactPatient,
     resolveFileNumber,
+    redactText,
     rehydrate,
     usedClasses,
   };

backend/src/services/clinic-settings.ts

@@ -0,0 +1,82 @@
+import { eq } from "drizzle-orm";
+
+import { db } from "../db/index.js";
+import { clinicSettings } from "../db/schema/clinic-settings.js";
+
+export type ClinicLocation = {
+  address: string;
+  city: string;
+  country: string;
+  latitude: number | null;
+  longitude: number | null;
+};
+
+export type ClinicSettingsView = {
+  location: ClinicLocation;
+};
+
+const EMPTY_LOCATION: ClinicLocation = {
+  address: "",
+  city: "",
+  country: "",
+  latitude: null,
+  longitude: null,
+};
+
+type ClinicSettingsRow = typeof clinicSettings.$inferSelect;
+
+function toView(row: ClinicSettingsRow | undefined): ClinicSettingsView {
+  if (!row) return { location: { ...EMPTY_LOCATION } };
+  return {
+    location: {
+      address: row.address,
+      city: row.city,
+      country: row.country,
+      latitude: row.latitude,
+      longitude: row.longitude,
+    },
+  };
+}
+
+// Read a clinic's settings. Returns empty defaults when no row exists yet, so
+// the panel always renders.
+export async function getClinicSettings(
+  orgId: string,
+): Promise<ClinicSettingsView> {
+  const [row] = await db
+    .select()
+    .from(clinicSettings)
+    .where(eq(clinicSettings.organizationId, orgId))
+    .limit(1);
+  return toView(row);
+}
+
+// Upsert the clinic's location (address + optional coordinates).
+export async function setClinicLocation(
+  orgId: string,
+  location: ClinicLocation,
+): Promise<ClinicSettingsView> {
+  const values = {
+    organizationId: orgId,
+    address: location.address,
+    city: location.city,
+    country: location.country,
+    latitude: location.latitude,
+    longitude: location.longitude,
+  };
+  const [row] = await db
+    .insert(clinicSettings)
+    .values(values)
+    .onConflictDoUpdate({
+      target: clinicSettings.organizationId,
+      set: {
+        address: values.address,
+        city: values.city,
+        country: values.country,
+        latitude: values.latitude,
+        longitude: values.longitude,
+      },
+    })
+    .returning();
+  return toView(row);
+}

backend/src/services/fhir-server/bundle.ts

@@ -0,0 +1,77 @@
+import type { FhirResource } from "./resources.js";
+
+// searchset Bundle assembly + offset/limit pagination for the FHIR server.
+
+export const DEFAULT_COUNT = 50;
+export const MAX_COUNT = 200;
+
+// Clamp a client-supplied `_count` into [1, MAX_COUNT], defaulting when absent.
+export function parseCount(raw: string | undefined): number {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_COUNT;
+  return Math.min(Math.floor(n), MAX_COUNT);
+}
+
+export function parseOffset(raw: string | undefined): number {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return 0;
+  return Math.floor(n);
+}
+
+// Slice an already-materialized resource array to the requested page.
+export function paginate<T>(
+  all: T[],
+  count: number,
+  offset: number,
+): { page: T[]; total: number } {
+  return { page: all.slice(offset, offset + count), total: all.length };
+}
+
+export type SearchsetBundle = {
+  resourceType: "Bundle";
+  type: "searchset";
+  total: number;
+  link: { relation: string; url: string }[];
+  entry: { fullUrl: string; resource: FhirResource; search: { mode: "match" } }[];
+};
+
+// Build a FHIR searchset Bundle. `page` is the current slice; `total` the full
+// match count; `params` the effective query (already carrying `_count`/`_offset`)
+// used to derive self/next/prev links.
+export function searchsetBundle(opts: {
+  baseUrl: string; // e.g. https://host/fhir
+  resourceType: string;
+  page: FhirResource[];
+  total: number;
+  count: number;
+  offset: number;
+  params: URLSearchParams;
+}): SearchsetBundle {
+  const { baseUrl, resourceType, page, total, count, offset, params } = opts;
+
+  const linkFor = (nextOffset: number): string => {
+    const q = new URLSearchParams(params);
+    q.set("_count", String(count));
+    q.set("_offset", String(nextOffset));
+    return `${baseUrl}/${resourceType}?${q.toString()}`;
+  };
+
+  const link: { relation: string; url: string }[] = [
+    { relation: "self", url: linkFor(offset) },
+  ];
+  if (offset + count < total) link.push({ relation: "next", url: linkFor(offset + count) });
+  if (offset > 0)
+    link.push({ relation: "previous", url: linkFor(Math.max(0, offset - count)) });
+
+  return {
+    resourceType: "Bundle",
+    type: "searchset",
+    total,
+    link,
+    entry: page.map((resource) => ({
+      fullUrl: `${baseUrl}/${resource.resourceType}/${resource.id}`,
+      resource,
+      search: { mode: "match" },
+    })),
+  };
+}

backend/src/services/fhir-server/capability.ts

@@ -0,0 +1,114 @@
+// A static CapabilityStatement describing exactly what this read-only FHIR R4
+// server supports. It is intentionally honest: only the resources and search
+// params implemented below are listed, everything is `read`/`search-type` only,
+// and clinical concepts are text-only (no SNOMED/LOINC coding).
+
+type ResourceCapability = {
+  type: string;
+  interaction: { code: "read" | "search-type" }[];
+  searchParam?: { name: string; type: "token" | "string" | "reference" }[];
+};
+
+const RESOURCES: ResourceCapability[] = [
+  {
+    type: "Patient",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "identifier", type: "token" },
+      { name: "name", type: "string" },
+    ],
+  },
+  {
+    type: "Observation",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+      { name: "category", type: "token" },
+    ],
+  },
+  {
+    type: "AllergyIntolerance",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Condition",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "MedicationRequest",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Encounter",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Appointment",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+];
+
+export function capabilityStatement(
+  baseUrl: string,
+  version: string,
+): Record<string, unknown> {
+  return {
+    resourceType: "CapabilityStatement",
+    status: "active",
+    date: new Date().toISOString(),
+    publisher: "temetro",
+    kind: "instance",
+    implementation: { description: "temetro FHIR server", url: baseUrl },
+    software: { name: "temetro", version },
+    fhirVersion: "4.0.1",
+    format: ["application/fhir+json", "json"],
+    rest: [
+      {
+        mode: "server",
+        documentation:
+          "Read-only FHIR R4 server. Authenticate with a per-clinic API key: " +
+          "Authorization: Bearer tmf_…. Clinical values are text-only " +
+          "CodeableConcepts (no SNOMED/LOINC). Patients expose age (extension), " +
+          "not birthDate. Pagination via _count (default 50, max 200) and _offset.",
+        security: {
+          description: "Bearer token (per-organization API key, tmf_ prefix).",
+          service: [
+            {
+              coding: [
+                {
+                  system:
+                    "http://terminology.hl7.org/CodeSystem/restful-security-service",
+                  code: "OAuth",
+                  display: "OAuth",
+                },
+              ],
+              text: "API key bearer token",
+            },
+          ],
+        },
+        resource: RESOURCES,
+      },
+    ],
+  };
+}

backend/src/services/fhir-server/keys.ts

@@ -0,0 +1,110 @@
+import { createHash, randomBytes } from "node:crypto";
+
+import { and, desc, eq, isNull } from "drizzle-orm";
+
+import { db } from "../../db/index.js";
+import { fhirApiKeys } from "../../db/schema/fhir-keys.js";
+
+// FHIR-server API keys. The secret is `tmf_` + 32 random bytes (base64url); we
+// persist only its SHA-256 hash, so a leaked database never yields usable keys
+// and the plaintext is returned exactly once (at creation).
+
+const PREFIX = "tmf_";
+
+export type FhirKeyView = {
+  id: string;
+  name: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+  revoked: boolean;
+};
+
+function hashKey(secret: string): string {
+  return createHash("sha256").update(secret).digest("hex");
+}
+
+function toView(row: typeof fhirApiKeys.$inferSelect): FhirKeyView {
+  return {
+    id: row.id,
+    name: row.name,
+    createdAt: row.createdAt.toISOString(),
+    lastUsedAt: row.lastUsedAt ? row.lastUsedAt.toISOString() : null,
+    revoked: row.revokedAt !== null,
+  };
+}
+
+// List a clinic's keys (active first, then revoked), newest first. Never
+// exposes the hash.
+export async function listKeys(orgId: string): Promise<FhirKeyView[]> {
+  const rows = await db
+    .select()
+    .from(fhirApiKeys)
+    .where(eq(fhirApiKeys.organizationId, orgId))
+    .orderBy(desc(fhirApiKeys.createdAt));
+  return rows.map(toView);
+}
+
+// Mint a new key. Returns the one-time plaintext secret alongside the stored
+// view — the caller must surface the secret to the user immediately; it is not
+// recoverable afterwards.
+export async function createKey(
+  orgId: string,
+  name: string,
+  createdBy: string,
+): Promise<{ secret: string; key: FhirKeyView }> {
+  const secret = PREFIX + randomBytes(32).toString("base64url");
+  const [row] = await db
+    .insert(fhirApiKeys)
+    .values({
+      organizationId: orgId,
+      name: name.trim() || "FHIR key",
+      keyHash: hashKey(secret),
+      createdBy,
+    })
+    .returning();
+  return { secret, key: toView(row!) };
+}
+
+// Revoke a key (idempotent). Scoped to the org so one clinic can't revoke
+// another's. Returns false if no such active key exists.
+export async function revokeKey(orgId: string, id: string): Promise<boolean> {
+  const result = await db
+    .update(fhirApiKeys)
+    .set({ revokedAt: new Date() })
+    .where(
+      and(
+        eq(fhirApiKeys.id, id),
+        eq(fhirApiKeys.organizationId, orgId),
+        isNull(fhirApiKeys.revokedAt),
+      ),
+    )
+    .returning({ id: fhirApiKeys.id });
+  return result.length > 0;
+}
+
+export type ResolvedKey = { orgId: string; keyId: string; keyName: string };
+
+// Resolve a presented bearer secret to its owning organization (plus the key's
+// identity, for the audit log), or null when it is unknown or revoked. Bumps
+// `lastUsedAt` (throttled to once a minute) so the key list can show recent
+// activity without a write on every request.
+export async function resolveKey(secret: string): Promise<ResolvedKey | null> {
+  if (!secret.startsWith(PREFIX)) return null;
+  const [row] = await db
+    .select()
+    .from(fhirApiKeys)
+    .where(eq(fhirApiKeys.keyHash, hashKey(secret)))
+    .limit(1);
+  if (!row || row.revokedAt) return null;
+
+  const now = Date.now();
+  const last = row.lastUsedAt?.getTime() ?? 0;
+  if (now - last > 60_000) {
+    void db
+      .update(fhirApiKeys)
+      .set({ lastUsedAt: new Date() })
+      .where(eq(fhirApiKeys.id, row.id))
+      .catch(() => {});
+  }
+  return { orgId: row.organizationId, keyId: row.id, keyName: row.name };
+}

backend/src/services/fhir-server/outcome.ts

@@ -0,0 +1,36 @@
+// FHIR OperationOutcome helpers. Errors on a FHIR endpoint are returned as an
+// OperationOutcome resource (not our usual `{ error }` JSON), with the
+// `application/fhir+json` content type, so conformant clients can parse them.
+
+export const FHIR_CONTENT_TYPE = "application/fhir+json";
+
+export type IssueSeverity = "fatal" | "error" | "warning" | "information";
+export type IssueCode =
+  | "not-found"
+  | "not-supported"
+  | "security"
+  | "login"
+  | "forbidden"
+  | "invalid"
+  | "processing"
+  | "exception";
+
+export type OperationOutcome = {
+  resourceType: "OperationOutcome";
+  issue: {
+    severity: IssueSeverity;
+    code: IssueCode;
+    diagnostics?: string;
+  }[];
+};
+
+export function operationOutcome(
+  severity: IssueSeverity,
+  code: IssueCode,
+  diagnostics: string,
+): OperationOutcome {
+  return {
+    resourceType: "OperationOutcome",
+    issue: [{ severity, code, diagnostics }],
+  };
+}

backend/src/services/fhir-server/queries.ts

@@ -0,0 +1,168 @@
+import { and, asc, count, eq, ilike, sql } from "drizzle-orm";
+import type { SQL } from "drizzle-orm";
+
+import { db } from "../../db/index.js";
+import { appointments } from "../../db/schema/appointments.js";
+import {
+  allergies,
+  encounters,
+  labs,
+  medications,
+  patients,
+  problems,
+} from "../../db/schema/patients.js";
+import { prescriptions } from "../../db/schema/prescriptions.js";
+
+// Narrow, org-scoped reads for the FHIR server. Deliberately separate from the
+// app's `services/patients.ts` (which returns the reshaped canonical Patient and
+// applies role redaction): the FHIR layer needs raw rows *with their UUIDs* to
+// mint stable resource ids, and offset/limit pagination the app service doesn't
+// expose. Every function is scoped to a single organization.
+
+export type PatientRow = typeof patients.$inferSelect;
+export type LabRow = typeof labs.$inferSelect;
+export type AllergyRow = typeof allergies.$inferSelect;
+export type ProblemRow = typeof problems.$inferSelect;
+export type EncounterRow = typeof encounters.$inferSelect;
+export type PrescriptionRow = typeof prescriptions.$inferSelect;
+export type AppointmentRow = typeof appointments.$inferSelect;
+
+// --- Patient ----------------------------------------------------------------
+
+// Paginated Patient search. `identifier` matches the MRN (file number) exactly;
+// `name` is a case-insensitive substring. Returns the page plus the full total
+// for the searchset Bundle.
+export async function searchPatients(
+  orgId: string,
+  opts: { identifier?: string; name?: string; limit: number; offset: number },
+): Promise<{ rows: PatientRow[]; total: number }> {
+  const filters: SQL[] = [eq(patients.organizationId, orgId)];
+  if (opts.identifier) filters.push(eq(patients.fileNumber, opts.identifier));
+  if (opts.name) filters.push(ilike(patients.name, `%${opts.name}%`));
+  const where = and(...filters);
+
+  const [rows, [totalRow]] = await Promise.all([
+    db
+      .select()
+      .from(patients)
+      .where(where)
+      .orderBy(asc(patients.fileNumber))
+      .limit(opts.limit)
+      .offset(opts.offset),
+    db.select({ value: count() }).from(patients).where(where),
+  ]);
+
+  return { rows, total: totalRow?.value ?? 0 };
+}
+
+// A single patient by FHIR logical id (the row UUID), scoped to the org.
+export async function patientById(
+  orgId: string,
+  id: string,
+): Promise<PatientRow | undefined> {
+  // Guard against a non-UUID id: Postgres would otherwise error on the cast.
+  if (!/^[0-9a-f-]{36}$/i.test(id)) return undefined;
+  const [row] = await db
+    .select()
+    .from(patients)
+    .where(and(eq(patients.organizationId, orgId), eq(patients.id, id)))
+    .limit(1);
+  return row;
+}
+
+// Resolve a `patient` search parameter to a patient row. Accepts either the FHIR
+// logical id (`patient=<uuid>`) or the MRN (`patient.identifier=<file#>`).
+export async function resolvePatientRef(
+  orgId: string,
+  ref: { patientId?: string; identifier?: string },
+): Promise<PatientRow | undefined> {
+  if (ref.patientId) {
+    // A reference may arrive as "Patient/<id>" or a bare id.
+    const id = ref.patientId.replace(/^Patient\//, "");
+    return patientById(orgId, id);
+  }
+  if (ref.identifier) {
+    const [row] = await db
+      .select()
+      .from(patients)
+      .where(
+        and(
+          eq(patients.organizationId, orgId),
+          eq(patients.fileNumber, ref.identifier),
+        ),
+      )
+      .limit(1);
+    return row;
+  }
+  return undefined;
+}
+
+// --- Clinical child rows (by patient UUID) ----------------------------------
+
+export function labsForPatient(patientId: string): Promise<LabRow[]> {
+  return db
+    .select()
+    .from(labs)
+    .where(eq(labs.patientId, patientId))
+    .orderBy(asc(labs.position));
+}
+
+export function allergiesForPatient(patientId: string): Promise<AllergyRow[]> {
+  return db
+    .select()
+    .from(allergies)
+    .where(eq(allergies.patientId, patientId))
+    .orderBy(asc(allergies.position));
+}
+
+export function problemsForPatient(patientId: string): Promise<ProblemRow[]> {
+  return db
+    .select()
+    .from(problems)
+    .where(eq(problems.patientId, patientId))
+    .orderBy(asc(problems.position));
+}
+
+export function encountersForPatient(
+  patientId: string,
+): Promise<EncounterRow[]> {
+  return db
+    .select()
+    .from(encounters)
+    .where(eq(encounters.patientId, patientId))
+    .orderBy(asc(encounters.position));
+}
+
+// --- Denormalized resources (linked to the patient by MRN / file number) ----
+
+export function prescriptionsForFile(
+  orgId: string,
+  fileNumber: string,
+): Promise<PrescriptionRow[]> {
+  return db
+    .select()
+    .from(prescriptions)
+    .where(
+      and(
+        eq(prescriptions.organizationId, orgId),
+        eq(prescriptions.patientFileNumber, fileNumber),
+      ),
+    )
+    .orderBy(sql`${prescriptions.prescribedAt} desc`);
+}
+
+export function appointmentsForFile(
+  orgId: string,
+  fileNumber: string,
+): Promise<AppointmentRow[]> {
+  return db
+    .select()
+    .from(appointments)
+    .where(
+      and(
+        eq(appointments.organizationId, orgId),
+        eq(appointments.patientFileNumber, fileNumber),
+      ),
+    )
+    .orderBy(sql`${appointments.date} desc, ${appointments.time} desc`);
+}

backend/src/services/fhir-server/resources.ts

@@ -0,0 +1,317 @@
+import type { LabFlag } from "../../types/patient.js";
+import type {
+  AllergyRow,
+  AppointmentRow,
+  EncounterRow,
+  LabRow,
+  PatientRow,
+  PrescriptionRow,
+  ProblemRow,
+} from "./queries.js";
+
+// Pure mappers from temetro rows to FHIR R4 JSON. temetro stores clinical values
+// as **free text** (no SNOMED/LOINC coding), so every CodeableConcept here is
+// `text`-only — valid FHIR, deliberately un-coded (documented in the
+// CapabilityStatement and API docs). Resource ids are the rows' own UUIDs so
+// they are stable; synthesized vital-sign Observations derive their id from the
+// patient UUID.
+
+export type FhirResource = {
+  resourceType: string;
+  id?: string;
+  [key: string]: unknown;
+};
+
+// System URIs.
+const MRN_SYSTEM = "urn:temetro:mrn";
+const INTERPRETATION_SYSTEM =
+  "http://terminology.hl7.org/CodeSystem/v3-ObservationInterpretation";
+const OBS_CATEGORY_SYSTEM =
+  "http://terminology.hl7.org/CodeSystem/observation-category";
+const AGE_EXTENSION =
+  "https://temetro.app/fhir/StructureDefinition/patient-age-years";
+
+// A FHIR dateTime from our stored strings. Passes date-only values (`YYYY-MM-DD`)
+// through unchanged (valid FHIR dateTime), otherwise parses display strings like
+// "Jun 28, 2025" to a full instant. Returns undefined when unparseable.
+function fhirDateTime(value: string | null | undefined): string | undefined {
+  if (!value) return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  if (/^\d{4}-\d{2}-\d{2}$/.test(trimmed)) return trimmed;
+  const parsed = new Date(trimmed);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed.toISOString();
+}
+
+function humanName(full: string): Record<string, unknown>[] {
+  const parts = full.trim().split(/\s+/).filter(Boolean);
+  if (parts.length < 2) return [{ text: full }];
+  return [{ text: full, family: parts.at(-1), given: parts.slice(0, -1) }];
+}
+
+function subjectRef(patient: PatientRow) {
+  return { reference: `Patient/${patient.id}`, display: patient.name };
+}
+
+// --- Patient ----------------------------------------------------------------
+
+export function patientResource(row: PatientRow): FhirResource {
+  return {
+    resourceType: "Patient",
+    id: row.id,
+    identifier: [{ system: MRN_SYSTEM, value: row.fileNumber }],
+    active: row.status !== "discharged",
+    name: humanName(row.name),
+    gender: row.sex === "M" ? "male" : "female",
+    // temetro records age, not date of birth; expose it as an extension rather
+    // than fabricate a birthDate.
+    extension: [{ url: AGE_EXTENSION, valueInteger: row.age }],
+  };
+}
+
+// --- Observation ------------------------------------------------------------
+
+function interpretation(flag: LabFlag) {
+  const map: Record<LabFlag, { code: string; display: string }> = {
+    normal: { code: "N", display: "Normal" },
+    high: { code: "H", display: "High" },
+    low: { code: "L", display: "Low" },
+    critical: { code: "HH", display: "Critical high" },
+  };
+  const { code, display } = map[flag];
+  return [{ coding: [{ system: INTERPRETATION_SYSTEM, code, display }] }];
+}
+
+export function labObservation(row: LabRow, patient: PatientRow): FhirResource {
+  const effective = fhirDateTime(row.takenAt);
+  return {
+    resourceType: "Observation",
+    id: row.id,
+    status: "final",
+    category: [
+      {
+        coding: [
+          {
+            system: OBS_CATEGORY_SYSTEM,
+            code: "laboratory",
+            display: "Laboratory",
+          },
+        ],
+      },
+    ],
+    code: { text: row.name },
+    subject: subjectRef(patient),
+    ...(effective ? { effectiveDateTime: effective } : {}),
+    valueString: row.value,
+    interpretation: interpretation(row.flag),
+  };
+}
+
+// Synthesize vital-sign Observations from the denormalized columns on the
+// patient row. Returns an empty array when vitals are blank (e.g. a
+// reception-registered patient with clinical fields stripped).
+export function vitalObservations(patient: PatientRow): FhirResource[] {
+  const effective = fhirDateTime(patient.vitalsTakenAt);
+  const base = (idSuffix: string, text: string) => ({
+    resourceType: "Observation" as const,
+    id: `${patient.id}-vital-${idSuffix}`,
+    status: "final",
+    category: [
+      {
+        coding: [
+          {
+            system: OBS_CATEGORY_SYSTEM,
+            code: "vital-signs",
+            display: "Vital Signs",
+          },
+        ],
+      },
+    ],
+    code: { text },
+    subject: subjectRef(patient),
+    ...(effective ? { effectiveDateTime: effective } : {}),
+  });
+
+  const out: FhirResource[] = [];
+
+  if (patient.vitalsBp) {
+    const bp = base("bp", "Blood pressure");
+    const m = /^(\d+)\s*\/\s*(\d+)/.exec(patient.vitalsBp.trim());
+    if (m) {
+      out.push({
+        ...bp,
+        component: [
+          {
+            code: { text: "Systolic blood pressure" },
+            valueQuantity: { value: Number(m[1]), unit: "mmHg" },
+          },
+          {
+            code: { text: "Diastolic blood pressure" },
+            valueQuantity: { value: Number(m[2]), unit: "mmHg" },
+          },
+        ],
+      });
+    } else {
+      out.push({ ...bp, valueString: patient.vitalsBp });
+    }
+  }
+  if (patient.vitalsHr)
+    out.push({ ...base("hr", "Heart rate"), valueString: patient.vitalsHr });
+  if (patient.vitalsTemp)
+    out.push({
+      ...base("temp", "Body temperature"),
+      valueString: patient.vitalsTemp,
+    });
+  if (patient.vitalsSpo2)
+    out.push({
+      ...base("spo2", "Oxygen saturation"),
+      valueString: patient.vitalsSpo2,
+    });
+
+  return out;
+}
+
+// --- AllergyIntolerance -----------------------------------------------------
+
+export function allergyResource(
+  row: AllergyRow,
+  patient: PatientRow,
+): FhirResource {
+  return {
+    resourceType: "AllergyIntolerance",
+    id: row.id,
+    clinicalStatus: {
+      coding: [
+        {
+          system:
+            "http://terminology.hl7.org/CodeSystem/allergyintolerance-clinical",
+          code: "active",
+        },
+      ],
+    },
+    code: { text: row.substance },
+    patient: subjectRef(patient),
+    criticality: row.severity === "severe" ? "high" : "low",
+    reaction: [
+      { manifestation: [{ text: row.reaction }], severity: row.severity },
+    ],
+  };
+}
+
+// --- Condition --------------------------------------------------------------
+
+export function conditionResource(
+  row: ProblemRow,
+  patient: PatientRow,
+): FhirResource {
+  return {
+    resourceType: "Condition",
+    id: row.id,
+    clinicalStatus: {
+      coding: [
+        {
+          system: "http://terminology.hl7.org/CodeSystem/condition-clinical",
+          code: "active",
+        },
+      ],
+    },
+    code: { text: row.label },
+    subject: subjectRef(patient),
+    ...(row.since ? { onsetString: row.since } : {}),
+  };
+}
+
+// --- MedicationRequest ------------------------------------------------------
+
+export function medicationRequestResource(
+  row: PrescriptionRow,
+  patient: PatientRow,
+): FhirResource {
+  const status =
+    row.status === "completed"
+      ? "completed"
+      : row.status === "expired"
+        ? "stopped"
+        : "active";
+  const dosageText = [row.dose, row.frequency].filter(Boolean).join(" ").trim();
+  return {
+    resourceType: "MedicationRequest",
+    id: row.id,
+    status,
+    intent: "order",
+    medicationCodeableConcept: { text: row.medication },
+    subject: subjectRef(patient),
+    ...(row.prescribedAt ? { authoredOn: row.prescribedAt } : {}),
+    requester: { display: row.prescriber },
+    ...(dosageText ? { dosageInstruction: [{ text: dosageText }] } : {}),
+  };
+}
+
+// --- Encounter --------------------------------------------------------------
+
+function narrative(text: string): Record<string, unknown> {
+  const escaped = text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+  return {
+    status: "generated",
+    div: `<div xmlns="http://www.w3.org/1999/xhtml">${escaped}</div>`,
+  };
+}
+
+export function encounterResource(
+  row: EncounterRow,
+  patient: PatientRow,
+): FhirResource {
+  const start = fhirDateTime(row.date);
+  return {
+    resourceType: "Encounter",
+    id: row.id,
+    ...(row.summary ? { text: narrative(row.summary) } : {}),
+    status: "finished",
+    class: {
+      system: "http://terminology.hl7.org/CodeSystem/v3-ActCode",
+      code: "AMB",
+      display: "ambulatory",
+    },
+    type: [{ text: row.type }],
+    subject: subjectRef(patient),
+    ...(start ? { period: { start } } : {}),
+    participant: [{ individual: { display: row.provider } }],
+  };
+}
+
+// --- Appointment ------------------------------------------------------------
+
+export function appointmentResource(
+  row: AppointmentRow,
+  patient: PatientRow,
+): FhirResource {
+  const statusMap: Record<string, string> = {
+    confirmed: "booked",
+    "checked-in": "arrived",
+    completed: "fulfilled",
+    cancelled: "cancelled",
+  };
+  // Combine local date + time into an instant; omit when unparseable.
+  const startDate =
+    row.date && row.time ? new Date(`${row.date}T${row.time}:00`) : null;
+  const start =
+    startDate && !Number.isNaN(startDate.getTime())
+      ? startDate.toISOString()
+      : undefined;
+  return {
+    resourceType: "Appointment",
+    id: row.id,
+    status: statusMap[row.status] ?? "booked",
+    description: row.type,
+    ...(start ? { start } : {}),
+    participant: [
+      { actor: subjectRef(patient), status: "accepted" },
+      ...(row.provider
+        ? [{ actor: { display: row.provider }, status: "accepted" }]
+        : []),
+    ],
+  };
+}

backend/src/services/patients.ts

@@ -53,6 +53,8 @@ function toPatient(row: PatientRow, children: Children): Patient {
     primaryProviderId: row.primaryProviderId,
     status: row.status,
     initials: row.initials,
+    phone: row.phone,
+    bloodType: row.bloodType,
     allergies: children.allergies,
     alerts: row.alerts,
     medications: children.medications,
@@ -82,6 +84,8 @@ const EMPTY_TREND: Trend = { label: "", unit: "", points: [] };
 function redactClinical(patient: Patient): Patient {
   return {
     ...patient,
+    // bloodType is clinical PHI; phone is a demographic/contact field and stays.
+    bloodType: "",
     allergies: [],
     alerts: [],
     medications: [],
@@ -116,6 +120,8 @@ function patientColumns(orgId: string, input: PatientInput, createdBy?: string)
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
+    bloodType: input.bloodType,
     alerts: input.alerts,
     vitalsBp: input.vitals.bp,
     vitalsHr: input.vitals.hr,
@@ -147,6 +153,8 @@ function demographicColumns(
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
+    bloodType: "",
     source: input.source,
     alerts: [] as string[],
     vitalsBp: "",
@@ -172,6 +180,7 @@ function demographicUpdateColumns(input: PatientInput) {
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
   };
 }
 
@@ -570,6 +579,46 @@ export async function appendLabs(
   return getPatient(orgId, fileNumber);
 }
 
+// Append a single encounter (visit note) without touching the rest of the
+// record — used by the ambient AI scribe, which drafts one note at a time and
+// must not go through updatePatient's wholesale child replacement. Position
+// continues after the current max so the new note sorts last.
+export async function appendEncounter(
+  orgId: string,
+  fileNumber: string,
+  entry: Encounter,
+): Promise<Patient | null> {
+  const inserted = await db.transaction(async (tx) => {
+    const [existing] = await tx
+      .select({ id: patients.id })
+      .from(patients)
+      .where(
+        and(
+          eq(patients.organizationId, orgId),
+          eq(patients.fileNumber, fileNumber),
+        ),
+      );
+    if (!existing) return false;
+
+    const [pos] = await tx
+      .select({ max: sql<number>`coalesce(max(${encounters.position}), -1)` })
+      .from(encounters)
+      .where(eq(encounters.patientId, existing.id));
+    await tx.insert(encounters).values({
+      patientId: existing.id,
+      position: (pos?.max ?? -1) + 1,
+      ...entry,
+    });
+    await tx
+      .update(patients)
+      .set({ updatedAt: new Date() })
+      .where(eq(patients.id, existing.id));
+    return true;
+  });
+  if (!inserted) return null;
+  return getPatient(orgId, fileNumber);
+}
+
 // Remove a single lab result from a patient, identified by its
 // name/value/takenAt (the frontend has no row id). Scoped to the org via the
 // owning patient. Returns the reloaded patient, or null when the chart is gone.

backend/src/services/portal.ts

@@ -0,0 +1,295 @@
+// Patient Portal actions, shared by the public REST kiosk (routes/portal.ts)
+// and the relay path used by the wallet app (relay-client.ts handles
+// `portal:request` and dispatches here). Both go through the same clinic-scoped
+// logic so a booking made in the phone shows up on the clinic's Appointments
+// page exactly like a kiosk booking.
+//
+// The relay path identifies the patient by their *verified* wallet number (the
+// relay only forwards a request after the device signed the relay challenge),
+// which is more trustworthy than the kiosk's name + file-number check.
+
+import { readFile } from "node:fs/promises";
+
+import { and, asc, eq, inArray } from "drizzle-orm";
+
+import { db } from "../db/index.js";
+import { member, organization, user } from "../db/schema/auth.js";
+import { patients } from "../db/schema/patients.js";
+import { staffProfile } from "../db/schema/staff-profile.js";
+import { appointmentInputSchema } from "../lib/appointment-validation.js";
+import { HttpError } from "../lib/http-error.js";
+import { initialsFromName } from "../lib/initials.js";
+import { recordActivity } from "./activity.js";
+import { createAppointment, listAppointments } from "./appointments.js";
+import {
+  absolutePath,
+  getAttachmentRow,
+  listAttachments,
+} from "./attachments.js";
+import { getPatient } from "./patients.js";
+
+// Clinical-capable roles that can be a patient's provider (mirrors portal.ts).
+const PROVIDER_ROLES = ["owner", "admin", "doctor", "member"] as const;
+const norm = (s: string) => s.trim().toLowerCase();
+
+export type PortalDoctor = { name: string; specialty: string | null };
+
+export async function getClinicInfo(orgId: string): Promise<{ name: string }> {
+  const [org] = await db
+    .select({ name: organization.name })
+    .from(organization)
+    .where(eq(organization.id, orgId))
+    .limit(1);
+  if (!org) throw new HttpError(404, "Clinic not found.");
+  return { name: org.name };
+}
+
+export async function listDoctors(orgId: string): Promise<PortalDoctor[]> {
+  const rows = await db
+    .select({ name: user.name, specialty: staffProfile.specialty })
+    .from(member)
+    .innerJoin(user, eq(user.id, member.userId))
+    .leftJoin(
+      staffProfile,
+      and(
+        eq(staffProfile.userId, member.userId),
+        eq(staffProfile.organizationId, member.organizationId),
+      ),
+    )
+    .where(
+      and(
+        eq(member.organizationId, orgId),
+        inArray(member.role, PROVIDER_ROLES as unknown as string[]),
+      ),
+    )
+    .orderBy(asc(user.name));
+  return rows.map((r) => ({ name: r.name, specialty: r.specialty ?? null }));
+}
+
+// Taken time slots for a provider on a day, so the client renders only free
+// ones. Mirrors routes/portal.ts (an empty-provider appointment blocks the slot
+// clinic-wide). Booking re-checks server-side.
+export async function getAvailability(
+  orgId: string,
+  provider: string,
+  date: string,
+): Promise<{ date: string; provider: string; taken: string[] }> {
+  const taken = (await listAppointments(orgId))
+    .filter(
+      (a) =>
+        a.status !== "cancelled" &&
+        a.date === date &&
+        (!provider || !a.provider || a.provider === provider),
+    )
+    .map((a) => a.time);
+  return { date, provider, taken: [...new Set(taken)].sort() };
+}
+
+// --- wallet linkage ---------------------------------------------------------
+
+// Save a wallet number onto a patient file after verifying the patient's
+// identity (name + file number, like the kiosk). Once linked, clinic→wallet
+// pushes and portal actions resolve to this file directly.
+export async function linkWallet(
+  orgId: string,
+  walletNumber: string,
+  fileNumber: string,
+  name: string,
+): Promise<{ fileNumber: string; name: string }> {
+  const patient = await getPatient(orgId, fileNumber);
+  if (!patient || norm(patient.name) !== norm(name)) {
+    throw new HttpError(
+      404,
+      "We couldn't find a record matching that name and file number.",
+    );
+  }
+  await db
+    .update(patients)
+    .set({ walletNumber })
+    .where(
+      and(
+        eq(patients.organizationId, orgId),
+        eq(patients.fileNumber, patient.fileNumber),
+      ),
+    );
+  await recordActivity({
+    orgId,
+    actor: { id: "", name: patient.name },
+    action: `Patient portal — ${patient.name} linked a wallet`,
+    entityType: "patient",
+    entityId: patient.fileNumber,
+  });
+  return { fileNumber: patient.fileNumber, name: patient.name };
+}
+
+// The file number a linked wallet maps to, or null.
+export async function fileNumberForWallet(
+  orgId: string,
+  walletNumber: string,
+): Promise<string | null> {
+  const [row] = await db
+    .select({ fileNumber: patients.fileNumber })
+    .from(patients)
+    .where(
+      and(
+        eq(patients.organizationId, orgId),
+        eq(patients.walletNumber, walletNumber),
+      ),
+    )
+    .limit(1);
+  return row?.fileNumber ?? null;
+}
+
+async function requireLinkedPatient(orgId: string, walletNumber: string) {
+  const fileNumber = await fileNumberForWallet(orgId, walletNumber);
+  if (!fileNumber) {
+    throw new HttpError(403, "This wallet isn't linked to a record at this clinic.");
+  }
+  const patient = await getPatient(orgId, fileNumber);
+  if (!patient) throw new HttpError(404, "Linked record not found.");
+  return patient;
+}
+
+// Book an appointment for the linked wallet (conflict-checked), attributed to
+// the patient's file so it appears on the clinic's Appointments page.
+export async function bookForWallet(
+  orgId: string,
+  walletNumber: string,
+  body: { date: string; time: string; type?: string; provider?: string },
+): Promise<{ date: string; time: string; type: string; provider: string }> {
+  const patient = await requireLinkedPatient(orgId, walletNumber);
+
+  const today = new Date().toISOString().slice(0, 10);
+  if (body.date < today) throw new HttpError(400, "Please pick a future date.");
+
+  const input = appointmentInputSchema.parse({
+    fileNumber: patient.fileNumber,
+    name: patient.name,
+    initials: patient.initials || initialsFromName(patient.name),
+    date: body.date,
+    time: body.time,
+    type: body.type || "Self-service booking",
+    provider: body.provider || patient.pcp || "",
+    status: "confirmed",
+    source: "manual",
+  });
+
+  const taken = (await listAppointments(orgId)).some(
+    (a) =>
+      a.status !== "cancelled" &&
+      a.date === input.date &&
+      a.time === input.time &&
+      (!input.provider || !a.provider || a.provider === input.provider),
+  );
+  if (taken) {
+    throw new HttpError(409, "That time slot is already taken. Please choose another time.");
+  }
+
+  const created = await createAppointment(orgId, "", input);
+  await recordActivity({
+    orgId,
+    actor: { id: "", name: patient.name },
+    action: `Patient portal booking — ${patient.name} on ${created.date} ${created.time}`,
+    entityType: "appointment",
+    entityId: created.id,
+  });
+  return {
+    date: created.date,
+    time: created.time,
+    type: created.type,
+    provider: created.provider,
+  };
+}
+
+// Results view for the linked wallet: upcoming appointments + downloadable lab
+// files (metadata only; bytes come from `getResultFile`).
+export async function resultsForWallet(
+  orgId: string,
+  walletNumber: string,
+): Promise<{
+  name: string;
+  upcoming: { date: string; time: string; type: string; provider: string; status: string }[];
+  files: { id: string; filename: string; mimeType: string; sizeBytes: number; labKey: string | null }[];
+}> {
+  const patient = await requireLinkedPatient(orgId, walletNumber);
+  const now = new Date();
+  const upcoming = (await listAppointments(orgId))
+    .filter(
+      (a) =>
+        a.fileNumber === patient.fileNumber &&
+        a.status !== "cancelled" &&
+        new Date(`${a.date}T${a.time}`) >= now,
+    )
+    .map((a) => ({
+      date: a.date,
+      time: a.time,
+      type: a.type,
+      provider: a.provider,
+      status: a.status,
+    }));
+  const files = (await listAttachments(orgId, patient.fileNumber)).map((f) => ({
+    id: f.id,
+    filename: f.filename,
+    mimeType: f.mimeType,
+    sizeBytes: f.sizeBytes,
+    labKey: f.labKey,
+  }));
+  return { name: patient.name, upcoming, files };
+}
+
+// A single lab/result file for the linked wallet, base64-encoded so it can ride
+// back over the relay. Verifies the file belongs to the patient's own record.
+export async function resultFileForWallet(
+  orgId: string,
+  walletNumber: string,
+  attachmentId: string,
+): Promise<{ filename: string; mimeType: string; base64: string }> {
+  const patient = await requireLinkedPatient(orgId, walletNumber);
+  const row = await getAttachmentRow(orgId, attachmentId);
+  if (!row || row.fileNumber !== patient.fileNumber) {
+    throw new HttpError(404, "File not found.");
+  }
+  const bytes = await readFile(absolutePath(row.storagePath));
+  return {
+    filename: row.filename,
+    mimeType: row.mimeType,
+    base64: bytes.toString("base64"),
+  };
+}
+
+// --- relay dispatch ---------------------------------------------------------
+
+type PortalPayload = Record<string, unknown>;
+
+// Dispatch a `portal:request` relayed from a wallet device. `walletNumber` is
+// the device's relay-verified wallet number (empty for the public reads).
+export async function handlePortalRequest(
+  orgId: string,
+  req: { action: string; payload: PortalPayload; walletNumber: string },
+): Promise<unknown> {
+  const { action, payload, walletNumber } = req;
+  const s = (k: string): string => String(payload[k] ?? "");
+  switch (action) {
+    case "clinic":
+      return getClinicInfo(orgId);
+    case "doctors":
+      return listDoctors(orgId);
+    case "availability":
+      return getAvailability(orgId, s("provider"), s("date"));
+    case "link":
+      return linkWallet(orgId, walletNumber, s("fileNumber"), s("name"));
+    case "book":
+      return bookForWallet(orgId, walletNumber, {
+        date: s("date"),
+        time: s("time"),
+        type: s("type") || undefined,
+        provider: s("provider") || undefined,
+      });
+    case "results":
+      return resultsForWallet(orgId, walletNumber);
+    case "result-file":
+      return resultFileForWallet(orgId, walletNumber, s("id"));
+    default:
+      throw new HttpError(400, `Unknown portal action: ${action}`);
+  }
+}

backend/src/services/relay-client.ts

@@ -0,0 +1,249 @@
+// Client connection to the Temetro Network relay
+// (github.com/temetro/temetro-network), a standalone Rust service that routes
+// encrypted wallet messages between this backend and patient phones.
+//
+// This backend was previously the device-facing Socket.io server itself (the
+// `/wallet` namespace in realtime.ts). Now it is a *client* of the relay's
+// `/hub` namespace: it pushes messages to devices via `sendToWallet` and handles
+// their responses here, calling the same wallet service functions the old socket
+// handlers did. Sealed bundles are decrypted here (we hold the ephemeral key);
+// the relay only ever forwards ciphertext.
+//
+// The relay is **multi-clinic**: each clinic (organization) authenticates to
+// `/hub` with its own Ed25519 signing key (a per-clinic identity, not a shared
+// password), and the relay routes each device response back only to the clinic
+// that originated the request. So this backend keeps **one hub connection per
+// network-enabled org**, opened when the org joins the network ("Join Temetro
+// Network" in Settings → Signing) and torn down when it leaves.
+
+import { io as connect, type Socket } from "socket.io-client";
+
+import { env } from "../env.js";
+import { HttpError } from "../lib/http-error.js";
+import { handlePortalRequest } from "./portal.js";
+import { networkEnabledOrgs, signWithClinicKey } from "./signing.js";
+import * as walletShare from "./wallet-share.js";
+import * as walletUpdates from "./wallet-updates.js";
+
+// One authenticated hub connection per network-enabled organization.
+const hubs = new Map<string, Socket>();
+
+type Ack = (response: { ok: boolean; [key: string]: unknown }) => void;
+
+// Push an end-to-end-encrypted message to a patient wallet device via the given
+// clinic's relay connection (the relay forwards it to the room keyed by wallet
+// number). A no-op if the clinic isn't on the network / not connected yet — the
+// device replays anything it missed on its next connect (see `wallet:online`).
+export function sendToWallet(
+  orgId: string,
+  walletNumber: string,
+  event: string,
+  data: unknown,
+): void {
+  hubs.get(orgId)?.emit("wallet:send", { walletNumber, event, data });
+}
+
+// Tell the relay to expect a device response for `requestId` and route it back
+// to this clinic — used by **QR pairing**, where there's no wallet number to
+// `wallet:send` to yet, so nothing would otherwise register the request.
+export function expectResponse(orgId: string, requestId: string): void {
+  hubs.get(orgId)?.emit("hub:expect", { requestId });
+}
+
+// Open (and authenticate) a hub connection for a clinic, if not already open.
+// Idempotent — safe to call on startup, when an org joins the network, and
+// before generating a pairing QR. The socket auto-reconnects on its own, so an
+// existing entry is left as-is.
+export async function connectOrg(orgId: string): Promise<void> {
+  if (hubs.has(orgId)) return;
+
+  const hub = connect(`${env.RELAY_URL}/hub`, {
+    transports: ["websocket"],
+    reconnection: true,
+    reconnectionDelayMax: 10_000,
+  });
+  hubs.set(orgId, hub);
+  registerHubHandlers(orgId, hub);
+}
+
+// Leave the network for a clinic: close and forget its hub connection.
+export function disconnectOrg(orgId: string): void {
+  const hub = hubs.get(orgId);
+  if (!hub) return;
+  hub.disconnect();
+  hubs.delete(orgId);
+}
+
+// Open a hub connection for every clinic already on the network. Called once at
+// startup; runtime joins/leaves go through connectOrg/disconnectOrg.
+export async function initRelayClient(): Promise<void> {
+  try {
+    const orgs = await networkEnabledOrgs();
+    await Promise.all(orgs.map((orgId) => connectOrg(orgId)));
+  } catch (err) {
+    console.warn(`Temetro Network: failed to open hub connections: ${(err as Error).message}`);
+  }
+}
+
+// Wire up auth + device-response handlers for one clinic's hub socket.
+function registerHubHandlers(orgId: string, hub: Socket): void {
+  // Authenticate by signing the relay's challenge with this clinic's signing
+  // key. `clinicId` is that key's public half (hex), which is how the relay
+  // identifies and routes to this clinic.
+  hub.on("hub:challenge", async (payload: { challenge?: string }) => {
+    const challenge = String(payload?.challenge ?? "");
+    if (!challenge) return;
+    try {
+      const { signature, publicKey } = await signWithClinicKey(
+        orgId,
+        new TextEncoder().encode(challenge),
+      );
+      hub.emit(
+        "hub:auth",
+        // `token` is only meaningful for a private relay (optional shared gate);
+        // an empty value is ignored by an open relay.
+        { clinicId: publicKey, signature, token: env.RELAY_TOKEN || undefined },
+        async (ack: { ok?: boolean } | undefined) => {
+          if (!ack?.ok) {
+            console.warn(`Temetro Network: relay rejected clinic ${orgId}`);
+            return;
+          }
+          console.log(`Temetro Network: clinic ${orgId} authenticated on the relay`);
+          // The relay keeps routing state in memory, so re-register this clinic's
+          // still-pending requests — restores QR-pairing / share routing after a
+          // relay restart or a reconnect.
+          try {
+            for (const requestId of await walletShare.pendingRequestIds(orgId)) {
+              expectResponse(orgId, requestId);
+            }
+          } catch {
+            /* best-effort */
+          }
+        },
+      );
+    } catch (err) {
+      console.warn(`Temetro Network: failed to sign relay challenge for ${orgId}: ${(err as Error).message}`);
+    }
+  });
+
+  hub.on("connect_error", (err) => {
+    console.warn(`Temetro Network relay unreachable (${env.RELAY_URL}) for ${orgId}: ${err.message}`);
+  });
+
+  // A device authenticated on the relay — flush any record updates it missed
+  // while offline (scoped to this clinic; the relay only delivers this to
+  // clinics with pending work for the wallet).
+  hub.on("wallet:online", async (payload: { walletNumber?: string }) => {
+    const walletNumber = String(payload?.walletNumber ?? "");
+    if (!walletNumber) return;
+    try {
+      const rows = await walletUpdates.pendingUpdatesForWallet(orgId, walletNumber);
+      for (const row of rows) {
+        sendToWallet(orgId, walletNumber, "wallet:update-request", await walletUpdates.toEvent(row));
+        await walletUpdates.markDelivered(row.id);
+      }
+    } catch {
+      /* best-effort */
+    }
+  });
+
+  // The patient approved/denied a clinic→wallet record update. Verify the
+  // wallet's signature over the decision and resolve the row.
+  hub.on(
+    "wallet:update-response",
+    async (
+      payload: {
+        requestId?: string;
+        walletNumber?: string;
+        decision?: "approved" | "denied";
+        signature?: string;
+      },
+      ack?: Ack,
+    ) => {
+      try {
+        const view = await walletUpdates.applyUpdateResponse(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+          payload?.decision === "approved" ? "approved" : "denied",
+          payload?.signature,
+        );
+        ack?.({ ok: !!view });
+      } catch (err) {
+        ack?.({ ok: false, error: (err as Error).message });
+      }
+    },
+  );
+
+  // The patient approved/denied a share; the sealed bundle (if approved) rides
+  // along and is decrypted + verified here.
+  hub.on(
+    "wallet:share-response",
+    async (
+      payload: {
+        requestId?: string;
+        walletNumber?: string;
+        decision?: "approved" | "denied";
+        sealed?: string;
+        signature?: string;
+      },
+      ack?: Ack,
+    ) => {
+      try {
+        const view = await walletShare.applyShareResponse(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+          payload?.decision === "approved" ? "approved" : "denied",
+          payload?.sealed,
+          payload?.signature,
+        );
+        ack?.({ ok: !!view });
+      } catch (err) {
+        ack?.({ ok: false, error: (err as Error).message });
+      }
+    },
+  );
+
+  // A wallet app made a Patient Portal request over the relay (book, view
+  // results, link, …). The relay forwards it here with the device's verified
+  // wallet number; we run the same portal logic the web kiosk uses and ack the
+  // result back down the relay to the device.
+  hub.on(
+    "portal:request",
+    async (
+      payload: {
+        action?: string;
+        payload?: Record<string, unknown>;
+        walletNumber?: string;
+      },
+      ack?: Ack,
+    ) => {
+      try {
+        const data = await handlePortalRequest(orgId, {
+          action: String(payload?.action ?? ""),
+          payload: payload?.payload ?? {},
+          walletNumber: String(payload?.walletNumber ?? ""),
+        });
+        ack?.({ ok: true, data });
+      } catch (err) {
+        const status = err instanceof HttpError ? err.status : 500;
+        ack?.({ ok: false, error: (err as Error).message, status });
+      }
+    },
+  );
+
+  // The patient revoked a previously shared record; delete it from the clinic.
+  hub.on(
+    "wallet:revoke",
+    async (payload: { requestId?: string; walletNumber?: string }, ack?: Ack) => {
+      try {
+        const result = await walletShare.revokeShare(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+        );
+        ack?.({ ok: !!result });
+      } catch {
+        ack?.({ ok: false });
+      }
+    },
+  );
+}

backend/src/services/signing.ts

@@ -74,6 +74,40 @@ export async function rotateKey(orgId: string): Promise<SigningKeyView> {
   return mintKey(orgId, true);
 }
 
+// Whether this clinic has joined the Temetro Network relay. Defaults to `false`
+// when the clinic has no signing key yet (it hasn't opted in).
+export async function getNetworkEnabled(orgId: string): Promise<boolean> {
+  const [row] = await db
+    .select({ networkEnabled: clinicSigningKeys.networkEnabled })
+    .from(clinicSigningKeys)
+    .where(eq(clinicSigningKeys.organizationId, orgId));
+  return row?.networkEnabled ?? false;
+}
+
+// Org ids of every clinic currently on the network — used at startup to open a
+// relay hub connection for each.
+export async function networkEnabledOrgs(): Promise<string[]> {
+  const rows = await db
+    .select({ organizationId: clinicSigningKeys.organizationId })
+    .from(clinicSigningKeys)
+    .where(eq(clinicSigningKeys.networkEnabled, true));
+  return rows.map((r) => r.organizationId);
+}
+
+// Join or leave the Temetro Network. Ensures the clinic has a signing key first
+// (the relay authenticates with it), then flips the flag. Returns the new state.
+export async function setNetworkEnabled(
+  orgId: string,
+  enabled: boolean,
+): Promise<boolean> {
+  await getOrCreateKey(orgId);
+  await db
+    .update(clinicSigningKeys)
+    .set({ networkEnabled: enabled })
+    .where(eq(clinicSigningKeys.organizationId, orgId));
+  return enabled;
+}
+
 // Sign a message with the clinic's signing key (creating one if needed). Returns
 // the signature + public key so a verifier can check provenance.
 export async function signWithClinicKey(

backend/src/services/wallet-share.ts

@@ -137,6 +137,22 @@ export async function listShareRequests(
   return rows.map(toView);
 }
 
+// Ids of this clinic's still-pending share/pairing requests. Used to re-register
+// them with the relay when the clinic's hub (re)connects (the relay keeps
+// routing state in memory, so it's lost on a relay restart / redeploy).
+export async function pendingRequestIds(orgId: string): Promise<string[]> {
+  const rows = await db
+    .select({ id: walletShareRequests.id })
+    .from(walletShareRequests)
+    .where(
+      and(
+        eq(walletShareRequests.organizationId, orgId),
+        eq(walletShareRequests.status, "pending"),
+      ),
+    );
+  return rows.map((r) => r.id);
+}
+
 // Apply a response relayed back from the patient's device. On approval we
 // decrypt the sealed bundle with the request's ephemeral private key and verify
 // the wallet's Ed25519 signature over it (provenance: it really came from that

backend/src/services/wallet-updates.ts

@@ -0,0 +1,272 @@
+import { hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
+import { and, desc, eq, isNotNull, isNull } from "drizzle-orm";
+
+import { db } from "../db/index.js";
+import { organization } from "../db/schema/auth.js";
+import { patients } from "../db/schema/patients.js";
+import { walletRecordUpdates } from "../db/schema/wallet-updates.js";
+import { walletShareRequests } from "../db/schema/wallet-share.js";
+import { HttpError } from "../lib/http-error.js";
+import {
+  decodeWalletNumber,
+  fingerprint,
+  seal,
+  verifySignature,
+} from "../lib/wallet-crypto.js";
+import { ed25519PubToX25519Hex } from "../lib/wallet-x25519.js";
+import { listAppointments } from "./appointments.js";
+import { listInvoices } from "./invoices.js";
+import { getPatient } from "./patients.js";
+import { signWithClinicKey } from "./signing.js";
+
+type UpdateRow = typeof walletRecordUpdates.$inferSelect;
+
+// The payload the relay pushes to a wallet. `sealed` is the encrypted patient
+// snapshot; `signature`/`clinicPublicKey`/`fingerprint` let the wallet verify
+// provenance (TOFU pin) before applying.
+export type WalletUpdateEvent = {
+  requestId: string;
+  clinicName: string;
+  sealed: string;
+  signature: string;
+  clinicPublicKey: string;
+  fingerprint: string;
+  changes: string[];
+  createdAt: string;
+};
+
+// The clinic-facing view (no ciphertext) for the "Sent updates" list + polling.
+export type WalletUpdateView = {
+  id: string;
+  fileNumber: string;
+  walletNumber: string;
+  status: UpdateRow["status"];
+  changes: string[];
+  createdAt: string;
+  deliveredAt: string | null;
+  resolvedAt: string | null;
+};
+
+export function viewOf(row: UpdateRow): WalletUpdateView {
+  return toView(row);
+}
+
+function toView(row: UpdateRow): WalletUpdateView {
+  return {
+    id: row.id,
+    fileNumber: row.fileNumber,
+    walletNumber: row.walletNumber,
+    status: row.status,
+    changes: row.changes,
+    createdAt: row.createdAt.toISOString(),
+    deliveredAt: row.deliveredAt ? row.deliveredAt.toISOString() : null,
+    resolvedAt: row.resolvedAt ? row.resolvedAt.toISOString() : null,
+  };
+}
+
+// The wallet number a patient's record is linked to, or null when it isn't
+// wallet-backed. Only *permanent, approved, committed* shares qualify —
+// temporary shares auto-delete, so pushing an update to them is meaningless.
+export async function walletNumberForPatient(
+  orgId: string,
+  fileNumber: string,
+): Promise<string | null> {
+  // Preferred: the wallet number the patient linked from the Patient Portal
+  // (stored directly on the file). Falls back to a permanent, approved,
+  // committed share for records imported the older way.
+  const [linked] = await db
+    .select({ walletNumber: patients.walletNumber })
+    .from(patients)
+    .where(
+      and(
+        eq(patients.organizationId, orgId),
+        eq(patients.fileNumber, fileNumber),
+        isNotNull(patients.walletNumber),
+      ),
+    )
+    .limit(1);
+  if (linked?.walletNumber) return linked.walletNumber;
+
+  const [row] = await db
+    .select({ walletNumber: walletShareRequests.walletNumber })
+    .from(walletShareRequests)
+    .where(
+      and(
+        eq(walletShareRequests.organizationId, orgId),
+        eq(walletShareRequests.committedFileNumber, fileNumber),
+        eq(walletShareRequests.status, "approved"),
+        eq(walletShareRequests.shareMode, "permanent"),
+        isNotNull(walletShareRequests.walletNumber),
+      ),
+    )
+    .limit(1);
+  return row?.walletNumber ?? null;
+}
+
+// Compose, seal and sign a record-update push, and store it as pending. Loads
+// the current patient snapshot, seals it to the wallet's derived X25519 key, and
+// signs the plaintext bundle with the clinic's Ed25519 key. Returns the row.
+export async function createRecordUpdate(
+  orgId: string,
+  userId: string,
+  fileNumber: string,
+  changes: string[],
+): Promise<UpdateRow> {
+  const walletNumber = await walletNumberForPatient(orgId, fileNumber);
+  if (!walletNumber) {
+    throw new HttpError(409, "This patient is not linked to a wallet.");
+  }
+  const patient = await getPatient(orgId, fileNumber);
+  if (!patient) throw new HttpError(404, "Patient not found.");
+
+  // Appointments and invoices live in their own tables (not on the Patient
+  // snapshot), so pull the ones for this patient and ship them alongside — the
+  // wallet has no other way to see them and they'd otherwise silently vanish.
+  const [orgAppointments, orgInvoices] = await Promise.all([
+    listAppointments(orgId),
+    listInvoices(orgId),
+  ]);
+  const appointments = orgAppointments.filter(
+    (a) => a.fileNumber === fileNumber,
+  );
+  const invoices = orgInvoices.filter((i) => i.fileNumber === fileNumber);
+
+  // The wallet opens this, verifies the signature over the same bytes, then
+  // replaces its on-device record with `patient` (+ appointments/invoices).
+  const bundle = utf8ToBytes(
+    JSON.stringify({ patient, appointments, invoices, changes }),
+  );
+  const { signature, publicKey } = await signWithClinicKey(orgId, bundle);
+  const x25519Hex = ed25519PubToX25519Hex(decodeWalletNumber(walletNumber));
+  const sealed = seal(x25519Hex, bundle);
+
+  const [row] = await db
+    .insert(walletRecordUpdates)
+    .values({
+      organizationId: orgId,
+      createdBy: userId,
+      fileNumber,
+      walletNumber,
+      payloadSealed: sealed,
+      clinicSignature: signature,
+      clinicPublicKey: publicKey,
+      clinicFingerprint: fingerprint(hexToBytes(publicKey)),
+      changes,
+    })
+    .returning();
+  return row!;
+}
+
+// Build the wire event for a stored update row (joins the clinic name).
+export async function toEvent(row: UpdateRow): Promise<WalletUpdateEvent> {
+  const [org] = await db
+    .select({ name: organization.name })
+    .from(organization)
+    .where(eq(organization.id, row.organizationId));
+  return {
+    requestId: row.id,
+    clinicName: org?.name ?? "A clinic",
+    sealed: row.payloadSealed,
+    signature: row.clinicSignature,
+    clinicPublicKey: row.clinicPublicKey,
+    fingerprint: row.clinicFingerprint,
+    changes: row.changes,
+    createdAt: row.createdAt.toISOString(),
+  };
+}
+
+// Every unresolved update for a wallet — re-sent on each authenticated connect
+// so an offline device eventually receives what it missed.
+// Pending updates a wallet missed, scoped to one clinic — the relay delivers a
+// `wallet:online` over that clinic's own hub connection, so a clinic only ever
+// re-sends its *own* updates (never another clinic's).
+export async function pendingUpdatesForWallet(
+  orgId: string,
+  walletNumber: string,
+): Promise<UpdateRow[]> {
+  return db
+    .select()
+    .from(walletRecordUpdates)
+    .where(
+      and(
+        eq(walletRecordUpdates.organizationId, orgId),
+        eq(walletRecordUpdates.walletNumber, walletNumber),
+        isNull(walletRecordUpdates.resolvedAt),
+      ),
+    )
+    .orderBy(walletRecordUpdates.createdAt);
+}
+
+// Mark a pending update delivered (best-effort; only advances from pending).
+export async function markDelivered(id: string): Promise<void> {
+  await db
+    .update(walletRecordUpdates)
+    .set({ status: "delivered", deliveredAt: new Date() })
+    .where(
+      and(
+        eq(walletRecordUpdates.id, id),
+        eq(walletRecordUpdates.status, "pending"),
+      ),
+    );
+}
+
+// Apply the patient's decision relayed back from the wallet. Verifies the
+// wallet's Ed25519 signature over `${decision}:${requestId}` (provenance) before
+// resolving. Returns the resolved view, or null when unknown/already resolved.
+export async function applyUpdateResponse(
+  requestId: string,
+  walletNumber: string,
+  decision: "approved" | "denied",
+  signatureHex?: string,
+): Promise<WalletUpdateView | null> {
+  const [row] = await db
+    .select()
+    .from(walletRecordUpdates)
+    .where(eq(walletRecordUpdates.id, requestId));
+  if (!row || row.resolvedAt) return null;
+  if (row.walletNumber !== walletNumber.trim()) return null;
+  if (!signatureHex) return null;
+
+  const publicKey = decodeWalletNumber(walletNumber);
+  const message = utf8ToBytes(`${decision}:${requestId}`);
+  if (!verifySignature(publicKey, signatureHex, message)) {
+    throw new HttpError(400, "Response signature did not match the wallet.");
+  }
+
+  const [updated] = await db
+    .update(walletRecordUpdates)
+    .set({ status: decision, resolvedAt: new Date() })
+    .where(eq(walletRecordUpdates.id, requestId))
+    .returning();
+  return updated ? toView(updated) : null;
+}
+
+// Recent update pushes for the clinic (Signing panel "Sent updates" list).
+export async function listUpdates(
+  orgId: string,
+  limit = 30,
+): Promise<WalletUpdateView[]> {
+  const rows = await db
+    .select()
+    .from(walletRecordUpdates)
+    .where(eq(walletRecordUpdates.organizationId, orgId))
+    .orderBy(desc(walletRecordUpdates.createdAt))
+    .limit(limit);
+  return rows.map(toView);
+}
+
+export async function getUpdate(
+  orgId: string,
+  id: string,
+): Promise<WalletUpdateView | null> {
+  const [row] = await db
+    .select()
+    .from(walletRecordUpdates)
+    .where(
+      and(
+        eq(walletRecordUpdates.id, id),
+        eq(walletRecordUpdates.organizationId, orgId),
+      ),
+    );
+  return row ? toView(row) : null;
+}

backend/src/types/express.d.ts

@@ -15,6 +15,9 @@ declare global {
       };
       organizationId?: string;
       memberRole?: string;
+      // Set by the FHIR bearer-auth middleware (machine-to-machine API key)
+      // instead of a Better Auth session; used for org scoping + audit.
+      fhirKey?: { id: string; name: string };
     }
   }
 }

backend/src/types/patient.ts

@@ -61,6 +61,8 @@ export type Patient = {
   primaryProviderId?: string | null; // user id of the responsible clinician
   status: PatientStatus;
   initials: string; // for AvatarFallback
+  phone?: string; // contact number (demographic; visible to reception)
+  bloodType?: string; // e.g. "O+"; clinical — redacted for reception
   allergies: Allergy[];
   alerts: string[];
   medications: Medication[];

frontend/CLAUDE.md

@@ -104,12 +104,18 @@ white/6%), so layered surfaces stay close in lightness.
 
 ## i18n
 
-`i18next` + `react-i18next` (config in `lib/i18n/config.ts`, English resources in
-`lib/i18n/locales/en/translation.json`). `components/i18n-provider.tsx` wraps the app in
+`i18next` + `react-i18next` (config in `lib/i18n/config.ts`, resources in
+`lib/i18n/locales/<lng>/translation.json`). `components/i18n-provider.tsx` wraps the app in
 `app/layout.tsx`. Use `const { t } = useTranslation()` + nested keys (e.g. `t("auth.login.title")`)
 in **client** components. To add a language, drop a `locales/<lng>/translation.json` and register it
 in `resources`/`supportedLngs` in `config.ts`.
 
+> **Translate into EVERY locale, not just English.** The app ships multiple languages
+> (`lib/i18n/locales/`: currently `en`, `de`, `fr`, `ar`, `so`). Whenever you add or rename a
+> translation key, add it to **all** `locales/*/translation.json` files with a real translation for
+> each language (not the English string copied over) — leaving a key in only `en/` ships a broken UI
+> in the others. Keep the nested structure identical across every locale file.
+
 **Coverage:** essentially all user-facing strings are now keyed (every app page + its dialogs/sheets,
 auth pages, settings panels, the sidebar/user menu, chat input, patient cards/detail/form, messages,
 notifications, notes). Keys are grouped by feature (`appointments.*`, `patientCard.*`, `messages.*`,

frontend/app/globals.css

@@ -7,9 +7,11 @@
 @theme inline {
   --color-background: var(--background);
   --color-foreground: var(--foreground);
-  --font-sans: var(--font-sans);
+  /* Append the Arabic face so Arabic codepoints fall through per-character even
+     in LTR locales; Latin text still renders in Inter. See app/layout.tsx. */
+  --font-sans: var(--font-sans), var(--font-arabic);
   --font-mono: var(--font-mono);
-  --font-heading: var(--font-heading);
+  --font-heading: var(--font-heading), var(--font-arabic);
   --color-sidebar-ring: var(--sidebar-ring);
   --color-sidebar-border: var(--sidebar-border);
   --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);

frontend/app/layout.tsx

@@ -1,5 +1,5 @@
 import type { Metadata } from "next";
-import { Geist_Mono, Inter } from "next/font/google";
+import { Geist_Mono, IBM_Plex_Sans_Arabic, Inter } from "next/font/google";
 import "./globals.css";
 import { cn } from "@/lib/utils";
 import { ThemeProvider } from "@/components/theme-provider";
@@ -10,6 +10,27 @@ import { ToastProvider } from "@/components/ui/toast";
 const inter = Inter({ subsets: ["latin"], variable: "--font-sans" });
 const interHeading = Inter({ subsets: ["latin"], variable: "--font-heading" });
 const geistMono = Geist_Mono({ subsets: ["latin"], variable: "--font-mono" });
+// Arabic-capable fallback: Inter has no Arabic glyphs, so we append this to the
+// sans/heading stacks (see globals.css) for per-character fallback in every
+// locale, and rely on it fully when dir="rtl". Not a variable font — pin weights.
+const plexArabic = IBM_Plex_Sans_Arabic({
+  subsets: ["arabic"],
+  weight: ["400", "500", "600", "700"],
+  variable: "--font-arabic",
+});
+
+// Runs before first paint: mirror lib/i18n/config.ts `dirFor` so an Arabic user
+// gets dir="rtl" immediately instead of a flash of LTR. Detection order matches
+// i18next-browser-languagedetector (localStorage key "i18nextLng", then the
+// browser language). suppressHydrationWarning on <html> ignores the attr diff.
+const setInitialDir = `
+(function(){try{
+  var l=localStorage.getItem("i18nextLng")||navigator.language||"en";
+  var e=document.documentElement;
+  e.lang=l;
+  e.dir=l.indexOf("ar")===0?"rtl":"ltr";
+}catch(_){}})();
+`;
 
 export const metadata: Metadata = {
   title: "temetro — AI assistant for clinicians",
@@ -33,17 +54,22 @@ export default function RootLayout({
         inter.variable,
         interHeading.variable,
         geistMono.variable,
+        plexArabic.variable,
         "font-sans"
       )}
     >
       {/* suppressHydrationWarning: next-themes sets the theme class on <html>
-          before hydration, and browser extensions (e.g. ColorZilla's
-          cz-shortcut-listen) mutate <body>. Only ignores attribute diffs on
-          those elements, not their children. */}
+          before hydration, the dir script below sets lang/dir, and browser
+          extensions (e.g. ColorZilla's cz-shortcut-listen) mutate <body>. Only
+          ignores attribute diffs on those elements, not their children. */}
       <body
         className="h-dvh overflow-hidden flex flex-col"
         suppressHydrationWarning
       >
+        <script
+          // Sets <html dir/lang> before paint; see setInitialDir above.
+          dangerouslySetInnerHTML={{ __html: setInitialDir }}
+        />
         <ThemeProvider
           attribute="class"
           defaultTheme="dark"

frontend/components/activity/activity-view.tsx

@@ -104,7 +104,7 @@ function DetailRow({ label, value }: { label: string; value: string }) {
   return (
     <div className="flex items-baseline justify-between gap-3">
       <span className="shrink-0 text-muted-foreground text-xs">{label}</span>
-      <span className="text-right text-foreground text-sm">{value}</span>
+      <span className="text-end text-foreground text-sm">{value}</span>
     </div>
   );
 }
@@ -212,7 +212,7 @@ export function ActivityView() {
 
                 <button
                   className={cn(
-                    "-mx-2 flex-1 rounded-lg px-2 py-1 text-left transition-colors hover:bg-accent/40",
+                    "-mx-2 flex-1 rounded-lg px-2 py-1 text-start transition-colors hover:bg-accent/40",
                     isLast ? "pb-1" : "mb-5",
                   )}
                   onClick={() => setSelected(entry)}

frontend/components/analysis/trend-card.tsx

@@ -37,7 +37,7 @@ export function TrendCard({
   return (
     <>
       <button
-        className="w-full text-left"
+        className="w-full text-start"
         disabled={!hasData}
         onClick={() => setOpen(true)}
         type="button"

frontend/components/appointments/appointments-view.tsx

@@ -314,9 +314,9 @@ export function AppointmentsView() {
         </div>
         <div className="flex items-center gap-2">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
-              className="w-full pl-9 sm:w-64"
+              className="w-full ps-9 sm:w-64"
               onChange={(event) => setQuery(event.target.value)}
               placeholder={t("appointments.searchPlaceholder")}
               value={query}

frontend/components/appointments/calendar-dialog.tsx

@@ -145,7 +145,7 @@ export function CalendarDialog({
                 type="button"
                 variant="ghost"
               >
-                <ChevronLeft />
+                <ChevronLeft className="rtl:rotate-180" />
               </Button>
               <Button
                 aria-label="Next month"
@@ -154,7 +154,7 @@ export function CalendarDialog({
                 type="button"
                 variant="ghost"
               >
-                <ChevronRight />
+                <ChevronRight className="rtl:rotate-180" />
               </Button>
             </div>
           </div>
@@ -182,7 +182,7 @@ export function CalendarDialog({
                 return (
                   <button
                     className={cn(
-                      "flex min-h-22 flex-col gap-1 rounded-lg border p-1.5 text-left align-top transition-colors hover:bg-accent/50",
+                      "flex min-h-22 flex-col gap-1 rounded-lg border p-1.5 text-start align-top transition-colors hover:bg-accent/50",
                       inMonth
                         ? "bg-card/30"
                         : "bg-transparent text-muted-foreground/40",

frontend/components/auth/app-auth-guard.tsx

@@ -5,6 +5,7 @@ import { type ReactNode, useEffect, useRef } from "react";
 
 import { useAiAccess } from "@/lib/ai-policy";
 import { authClient } from "@/lib/auth-client";
+import { applyStoredLanguage } from "@/lib/language";
 import { canAccessRoute, defaultLandingFor, useActiveRole } from "@/lib/roles";
 
 // Authoritative client-side gate for the app shell. Requires a session and an
@@ -24,6 +25,16 @@ export function AppAuthGuard({ children }: { children: ReactNode }) {
   const hasUser = Boolean(session?.user);
   const activeOrgId = session?.session?.activeOrganizationId ?? null;
 
+  // Adopt the language saved on the backend once signed in, so the UI language
+  // roams across devices. Best-effort and one-shot; localStorage stays the
+  // offline source of truth.
+  const languageSynced = useRef(false);
+  useEffect(() => {
+    if (!hasUser || languageSynced.current) return;
+    languageSynced.current = true;
+    void applyStoredLanguage();
+  }, [hasUser]);
+
   useEffect(() => {
     if (isPending) return;
     if (!hasUser) {

frontend/components/chat/action-preview-card.tsx

@@ -269,7 +269,7 @@ export function ActionPreviewCard({
         </span>
         {editable ? (
           <Button
-            className="ml-auto"
+            className="ms-auto"
             onClick={() => setEditOpen(true)}
             size="sm"
             variant="ghost"

frontend/components/chat/ai-setup-notice.tsx

@@ -60,7 +60,7 @@ export function AiSetupNotice() {
       </div>
       <button
         aria-label={t("chat.setupNotice.dismiss")}
-        className="-mr-1 shrink-0 rounded-md p-1 text-muted-foreground transition-colors hover:bg-accent hover:text-foreground"
+        className="-me-1 shrink-0 rounded-md p-1 text-muted-foreground transition-colors hover:bg-accent hover:text-foreground"
         onClick={() => setDismissed(true)}
         type="button"
       >

frontend/components/chat/batch-action-preview-card.tsx

@@ -115,7 +115,7 @@ export function BatchActionPreviewCard({
         <span className="font-medium text-sm">
           {t("chat.actionCard.batch.title", { count: items.length })}
         </span>
-        <Badge className="ml-auto gap-1" variant="secondary">
+        <Badge className="ms-auto gap-1" variant="secondary">
           <Sparkles className="size-3" />
           AI
         </Badge>

frontend/components/chat/chat-history-panel.tsx

@@ -104,9 +104,9 @@ export function ChatHistoryPanel() {
               {t("chat.history.startNew")}
             </Button>
             <div className="relative">
-              <Search className="-translate-y-1/2 absolute top-1/2 left-2.5 size-4 text-muted-foreground" />
+              <Search className="-translate-y-1/2 absolute top-1/2 start-2.5 size-4 text-muted-foreground" />
               <Input
-                className="pl-8"
+                className="ps-8"
                 onChange={(e) => setQuery(e.target.value)}
                 placeholder={t("chat.history.search")}
                 value={query}
@@ -123,7 +123,7 @@ export function ChatHistoryPanel() {
                   return (
                     <button
                       className={cn(
-                        "group flex items-center gap-2 rounded-md px-2 py-2 text-left text-sm transition-colors hover:bg-accent",
+                        "group flex items-center gap-2 rounded-md px-2 py-2 text-start text-sm transition-colors hover:bg-accent",
                         active
                           ? "bg-accent text-foreground"
                           : "text-muted-foreground",

frontend/components/chat/chat-input.tsx

@@ -242,7 +242,7 @@ export function ChatInput({
               />
             </label>
             <button
-              className={cn(contextPill, "ml-0.5")}
+              className={cn(contextPill, "ms-0.5")}
               onClick={() => {
                 setAddKey((k) => k + 1);
                 setAddOpen(true);
@@ -258,7 +258,7 @@ export function ChatInput({
             <ModePicker
               mode={mode}
               onModeChange={onModeChange}
-              triggerClassName={cn(pillButton, "mr-1")}
+              triggerClassName={cn(pillButton, "me-1")}
             />
             <button
               aria-label={

frontend/components/chat/chat-panel.tsx

@@ -421,7 +421,7 @@ export function ChatPanel() {
         </div>
         <button
           aria-label={t("chat.error.dismiss")}
-          className="-mr-1 shrink-0 rounded-md p-1 text-destructive-foreground/70 transition-colors hover:bg-destructive/10 hover:text-destructive-foreground"
+          className="-me-1 shrink-0 rounded-md p-1 text-destructive-foreground/70 transition-colors hover:bg-destructive/10 hover:text-destructive-foreground"
           onClick={() => setErrorDismissed(true)}
           type="button"
         >

frontend/components/chat/import-preview-card.tsx

@@ -196,7 +196,7 @@ export function ImportPreviewCard({
         <span className="text-sm font-medium">{t("chat.importCard.title")}</span>
         {status === "pending" && records.length > 0 ? (
           <Button
-            className="ml-auto"
+            className="ms-auto"
             onClick={() => setReviewOpen(true)}
             size="sm"
             variant="ghost"
@@ -289,7 +289,7 @@ export function ImportPreviewCard({
                 t("chat.importCard.unnamed");
               return (
                 <button
-                  className="flex items-start gap-2 rounded-xl border bg-card/30 p-3 text-left transition-colors hover:bg-accent"
+                  className="flex items-start gap-2 rounded-xl border bg-card/30 p-3 text-start transition-colors hover:bg-accent"
                   key={index}
                   onClick={() => setEditingIndex(index)}
                   type="button"

frontend/components/chat/inventory-list-card.tsx

@@ -16,7 +16,7 @@ export function InventoryListCard({ items }: { items: InventoryItem[] }) {
       <div className="flex items-center gap-2 border-b px-4 py-3">
         <Boxes className="size-4 text-muted-foreground" />
         <span className="font-medium text-sm">{t("chat.lists.inventory")}</span>
-        <Badge className="ml-auto" variant="secondary">
+        <Badge className="ms-auto" variant="secondary">
           {items.length}
         </Badge>
       </div>

frontend/components/chat/patient-cards.tsx

@@ -71,11 +71,11 @@ const statusVariant: Record<Patient["status"], BadgeVariant> = {
 // plus a subtle clickable affordance (they open a detail dialog). Compact cards
 // size to their own (short) content — see `items-start` in PatientResult.
 const rowCard =
-  "w-72 shrink-0 cursor-pointer gap-0 text-left outline-none transition hover:bg-accent/30 hover:ring-foreground/20 focus-visible:ring-2 focus-visible:ring-ring";
+  "w-72 shrink-0 cursor-pointer gap-0 text-start outline-none transition hover:bg-accent/30 hover:ring-foreground/20 focus-visible:ring-2 focus-visible:ring-ring";
 
 // Same footprint as `rowCard` but with no clickable affordance — used when a
 // card has nothing extra to reveal, so it shouldn't promise "Click for more".
-const rowCardStatic = "w-72 shrink-0 gap-0 text-left";
+const rowCardStatic = "w-72 shrink-0 gap-0 text-start";
 
 // COSS Card has no `size` variant; recreate the old compact ("sm") density by
 // tightening the inner section padding from p-6 → p-4 via data-slot selectors.
@@ -196,7 +196,7 @@ function ExpandableCard({
         {children}
         <div className="flex items-center gap-1 px-4 pt-2 pb-3 text-muted-foreground text-xs">
           {t("patientCard.clickForMore")}
-          <ArrowRight className="size-3" />
+          <ArrowRight className="size-3 rtl:rotate-180" />
         </div>
       </DialogTrigger>
       <DialogPopup className="max-h-[80dvh] sm:max-w-lg">
@@ -243,6 +243,11 @@ function SummaryCard({
               label={t("patientCard.summary.allergies")}
               value={patient.allergies.length || t("patientCard.summary.none")}
             />
+            <Stat
+              label={t("patientCard.summary.bloodType")}
+              value={patient.bloodType || "—"}
+            />
+            <Stat label={t("patientCard.summary.phone")} value={patient.phone || "—"} />
           </div>
           <AlertBadges alerts={patient.alerts} />
           {onEdit ? (

frontend/components/chat/patient-form-dialog.tsx

@@ -243,6 +243,8 @@ export function PatientFormDialog({
   // per-doctor visibility), not free text. `providerId` is the selected user id.
   const [providers, setProviders] = useState<Provider[]>([]);
   const [providerId, setProviderId] = useState(patient?.primaryProviderId ?? "");
+  const [phone, setPhone] = useState(patient?.phone ?? "");
+  const [bloodType, setBloodType] = useState(patient?.bloodType ?? "");
   const [bp, setBp] = useState(patient?.vitals.bp ?? "");
   const [hr, setHr] = useState(patient?.vitals.hr ?? "");
   const [temp, setTemp] = useState(patient?.vitals.temp ?? "");
@@ -310,6 +312,8 @@ export function PatientFormDialog({
       primaryProviderId: providerId || null,
       status,
       initials: initialsFromName(name),
+      phone: phone.trim(),
+      bloodType,
       allergies: allergies.filter((a) => a.substance.trim()),
       alerts: patient?.alerts ?? [],
       medications: medications.filter((m) => m.name.trim()),
@@ -515,6 +519,31 @@ export function PatientFormDialog({
               </select>
             </Field>
 
+            <div className="grid grid-cols-2 gap-3">
+              <Field label={t("patientForm.phone")}>
+                <Input
+                  inputMode="tel"
+                  onChange={(event) => setPhone(event.target.value)}
+                  placeholder={t("patientForm.phonePlaceholder")}
+                  value={phone}
+                />
+              </Field>
+              <Field label={t("patientForm.bloodType")}>
+                <select
+                  className={controlClass}
+                  onChange={(event) => setBloodType(event.target.value)}
+                  value={bloodType}
+                >
+                  <option value="">{t("patientForm.bloodTypeUnknown")}</option>
+                  {["A+", "A-", "B+", "B-", "AB+", "AB-", "O+", "O-"].map((bt) => (
+                    <option key={bt} value={bt}>
+                      {bt}
+                    </option>
+                  ))}
+                </select>
+              </Field>
+            </div>
+
             {showClinical && (
               <>
             <div className="flex flex-col gap-1.5">
@@ -724,7 +753,7 @@ export function PatientFormDialog({
 
           <DialogFooter className="flex-col items-stretch gap-2 sm:flex-row sm:items-center">
             {error && (
-              <p className="text-sm text-destructive sm:mr-auto">{error}</p>
+              <p className="text-sm text-destructive sm:me-auto">{error}</p>
             )}
             <DialogClose render={<Button type="button" variant="outline" />}>
               {t("patientForm.cancel")}

frontend/components/chat/record-list-card.tsx

@@ -31,7 +31,7 @@ function Shell({
       <div className="flex items-center gap-2 border-b px-4 py-3">
         <Icon className="size-4 text-muted-foreground" />
         <span className="font-medium text-sm">{title}</span>
-        <Badge className="ml-auto" variant="secondary">
+        <Badge className="ms-auto" variant="secondary">
           {rows.length}
         </Badge>
       </div>
@@ -123,7 +123,7 @@ export function AppointmentListCard({
         {range ? (
           <span className="text-muted-foreground text-xs">{range}</span>
         ) : null}
-        <Badge className="ml-auto" variant="secondary">
+        <Badge className="ms-auto" variant="secondary">
           {appointments.length}
         </Badge>
       </div>
@@ -157,7 +157,7 @@ export function AppointmentListCard({
         </span>
         <Button render={<Link href={href} />} size="sm" variant="ghost">
           {t("chat.lists.viewInCalendar")}
-          <ChevronRight className="size-4" />
+          <ChevronRight className="size-4 rtl:rotate-180" />
         </Button>
       </div>
     </Card>

frontend/components/i18n-provider.tsx

@@ -1,10 +1,27 @@
 "use client";
 
+import { useEffect } from "react";
 import type * as React from "react";
 import { I18nextProvider } from "react-i18next";
 
-import i18n from "@/lib/i18n/config";
+import i18n, { dirFor } from "@/lib/i18n/config";
 
 export function I18nProvider({ children }: { children: React.ReactNode }) {
+  // Keep <html lang/dir> in sync with the active language. The inline script in
+  // app/layout.tsx sets these before first paint (avoiding an RTL flash); this
+  // effect keeps them correct after hydration and on every language switch.
+  useEffect(() => {
+    const apply = (lng: string) => {
+      const root = document.documentElement;
+      root.lang = lng;
+      root.dir = dirFor(lng);
+    };
+    apply(i18n.resolvedLanguage ?? i18n.language);
+    i18n.on("languageChanged", apply);
+    return () => {
+      i18n.off("languageChanged", apply);
+    };
+  }, []);
+
   return <I18nextProvider i18n={i18n}>{children}</I18nextProvider>;
 }

frontend/components/invoices/invoice-detail-sheet.tsx

@@ -171,7 +171,7 @@ export function InvoiceDetailSheet({
           <SheetTitle className="flex items-center gap-2">
             {invoice.number}
             <AiBadge source={invoice.source} />
-            <Badge className="ml-auto" variant={statusVariant[invoice.status]}>
+            <Badge className="ms-auto" variant={statusVariant[invoice.status]}>
               {t(`invoices.status.${invoice.status}`)}
             </Badge>
           </SheetTitle>
@@ -222,7 +222,7 @@ export function InvoiceDetailSheet({
                     <span className="shrink-0 text-muted-foreground text-xs tabular-nums">
                       {li.quantity} × {formatMoney(li.unitPrice)}
                     </span>
-                    <span className="w-20 shrink-0 text-right font-medium text-foreground tabular-nums">
+                    <span className="w-20 shrink-0 text-end font-medium text-foreground tabular-nums">
                       {formatMoney(li.quantity * li.unitPrice)}
                     </span>
                   </div>

frontend/components/invoices/invoices-view.tsx

@@ -135,9 +135,9 @@ export function InvoicesView() {
         </div>
         <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
-              className="w-full pl-9 sm:w-64"
+              className="w-full ps-9 sm:w-64"
               onChange={(event) => {
                 setQuery(event.target.value);
                 setPage(1);
@@ -180,7 +180,7 @@ export function InvoicesView() {
       <div className="divide-y divide-border overflow-hidden rounded-2xl border bg-card/30">
         {pageRows.map((inv) => (
           <button
-            className="flex w-full items-center gap-3 px-4 py-3 text-left transition-colors hover:bg-accent/50"
+            className="flex w-full items-center gap-3 px-4 py-3 text-start transition-colors hover:bg-accent/50"
             key={inv.id}
             onClick={() => openInvoice(inv)}
             type="button"

frontend/components/lab/lab-integration-card.tsx

@@ -92,7 +92,7 @@ export function LabIntegrationCard({
           {t("integrations.fhir.cardTitle")}
         </h2>
         <Badge
-          className="ml-auto"
+          className="ms-auto"
           variant={
             config.status === "connected"
               ? "secondary"
@@ -141,9 +141,9 @@ export function LabIntegrationCard({
       ) : (
         <div className="flex flex-col gap-1.5">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
-              className="pl-9"
+              className="ps-9"
               onChange={(e) => setQuery(e.target.value)}
               placeholder={t("integrations.fhir.searchPlaceholder")}
               value={query}
@@ -153,7 +153,7 @@ export function LabIntegrationCard({
             <div className="flex flex-col gap-1">
               {matches.map((p) => (
                 <button
-                  className="flex items-center gap-3 rounded-lg px-2 py-2 text-left transition-colors hover:bg-accent"
+                  className="flex items-center gap-3 rounded-lg px-2 py-2 text-start transition-colors hover:bg-accent"
                   key={p.fileNumber}
                   onClick={() => setSelected(p)}
                   type="button"

frontend/components/lab/lab-view.tsx

@@ -336,7 +336,7 @@ function AddResultDialog({
                   {t("lab.addResult.patient")}
                 </span>
                 <div className="relative">
-                  <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+                  <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
                   <Input
                     aria-activedescendant={
                       matches[activeIndex]
@@ -344,7 +344,7 @@ function AddResultDialog({
                         : undefined
                     }
                     autoFocus
-                    className="pl-9"
+                    className="ps-9"
                     onChange={(event) => {
                       setPatientQuery(event.target.value);
                       setActiveIndex(0);
@@ -359,7 +359,7 @@ function AddResultDialog({
                     {matches.map((p, index) => (
                       <button
                         className={cn(
-                          "flex items-center gap-3 rounded-lg px-2 py-2 text-left transition-colors",
+                          "flex items-center gap-3 rounded-lg px-2 py-2 text-start transition-colors",
                           index === activeIndex
                             ? "bg-accent"
                             : "hover:bg-accent",
@@ -650,7 +650,7 @@ export function LabView() {
                     }
                     onClick={() => toggle(task.id)}
                   />
-                  <CollapsibleTrigger className="group flex min-w-0 flex-1 items-center gap-3 text-left">
+                  <CollapsibleTrigger className="group flex min-w-0 flex-1 items-center gap-3 text-start">
                     <div className="flex min-w-0 flex-1 flex-col">
                       <span
                         className={cn(
@@ -679,7 +679,7 @@ export function LabView() {
                   </CollapsibleTrigger>
                 </div>
                 <CollapsibleContent>
-                  <div className="space-y-3 px-4 pb-4 pl-12 text-sm">
+                  <div className="space-y-3 px-4 pb-4 ps-12 text-sm">
                     <p
                       className={cn(
                         "whitespace-pre-wrap",

frontend/components/login-form.tsx

@@ -124,7 +124,7 @@ export function LoginForm({
                     {t("auth.login.passwordLabel")}
                   </FieldLabel>
                   <Link
-                    className="ml-auto inline-block text-sm underline-offset-4 hover:underline"
+                    className="ms-auto inline-block text-sm underline-offset-4 hover:underline"
                     href="/forgot-password"
                   >
                     {t("auth.login.forgotPassword")}

frontend/components/meetings/meeting-room.tsx

@@ -285,10 +285,10 @@ export function MeetingRoom({
           </DialogHeader>
           <DialogPanel className="flex flex-col gap-2">
             <div className="relative">
-              <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+              <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
               <Input
                 aria-label={t("meetings.invite.search")}
-                className="pl-9"
+                className="ps-9"
                 onChange={(e) => setMemberQuery(e.target.value)}
                 placeholder={t("meetings.invite.search")}
                 size="sm"

frontend/components/meetings/meetings-view.tsx

@@ -246,13 +246,13 @@ export function MeetingsView() {
                   return (
                     <div
                       className={cn(
-                        "group flex w-full items-center gap-1 rounded-lg pr-1 transition-colors hover:bg-accent/50",
+                        "group flex w-full items-center gap-1 rounded-lg pe-1 transition-colors hover:bg-accent/50",
                         activeRoom?.id === room.id && "bg-accent hover:bg-accent",
                       )}
                       key={room.id}
                     >
                       <button
-                        className="flex min-w-0 flex-1 items-center gap-2.5 rounded-lg px-2 py-2 text-left"
+                        className="flex min-w-0 flex-1 items-center gap-2.5 rounded-lg px-2 py-2 text-start"
                         onClick={() => setActiveRoom(room)}
                         type="button"
                       >
@@ -352,7 +352,7 @@ export function MeetingsView() {
                 <div className="flex flex-col gap-1">
                   {upcoming.map((e) => (
                     <button
-                      className="flex flex-col gap-0.5 rounded-xl border bg-card px-2.5 py-2 text-left transition-colors hover:bg-accent/50"
+                      className="flex flex-col gap-0.5 rounded-xl border bg-card px-2.5 py-2 text-start transition-colors hover:bg-accent/50"
                       key={e.id}
                       onClick={() => setSelectedDay(new Date(`${e.date}T00:00:00`))}
                       type="button"

frontend/components/meetings/schedule-meeting-dialog.tsx

@@ -159,7 +159,7 @@ export function ScheduleMeetingDialog({
                       return (
                         <button
                           className={cn(
-                            "flex items-center gap-3 rounded-lg px-2 py-1.5 text-left transition-colors hover:bg-accent/50",
+                            "flex items-center gap-3 rounded-lg px-2 py-1.5 text-start transition-colors hover:bg-accent/50",
                             on && "bg-accent",
                           )}
                           key={m.id}

frontend/components/messages/appointment-detail-dialog.tsx

@@ -28,7 +28,7 @@ function Row({ label, value }: { label: string; value: ReactNode }) {
   return (
     <div className="flex items-baseline justify-between gap-3">
       <dt className="text-muted-foreground text-sm">{label}</dt>
-      <dd className="text-right text-foreground text-sm">{value}</dd>
+      <dd className="text-end text-foreground text-sm">{value}</dd>
     </div>
   );
 }

frontend/components/messages/messages-view.tsx

@@ -152,7 +152,7 @@ function SentAttachment({ att }: { att: MessageAttachment }) {
         <AttachmentContent>
           <AttachmentTitle>{att.fileName}</AttachmentTitle>
         </AttachmentContent>
-        <AttachmentActions className="pr-1.5">
+        <AttachmentActions className="pe-1.5">
           <AttachmentAction
             aria-label={t("messages.attach.download")}
             onClick={() => {
@@ -491,10 +491,10 @@ export function MessagesView() {
         </div>
         <div className="border-border border-b px-3 py-2">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
               aria-label={t("messages.searchPlaceholder")}
-              className="pl-9"
+              className="ps-9"
               onChange={(e) => setInboxQuery(e.target.value)}
               placeholder={t("messages.searchPlaceholder")}
               size="sm"
@@ -520,7 +520,7 @@ export function MessagesView() {
               return (
                 <div
                   className={cn(
-                    "flex w-full items-center gap-1 rounded-lg pr-2 transition-colors hover:bg-accent/50",
+                    "flex w-full items-center gap-1 rounded-lg pe-2 transition-colors hover:bg-accent/50",
                     selected?.id === c.id && "bg-accent hover:bg-accent",
                   )}
                   key={c.id}
@@ -544,7 +544,7 @@ export function MessagesView() {
                     </button>
                   )}
                   <button
-                    className="flex min-w-0 flex-1 items-center gap-3 rounded-lg py-2 pr-1 text-left"
+                    className="flex min-w-0 flex-1 items-center gap-3 rounded-lg py-2 pe-1 text-start"
                     onClick={() => open(c.id)}
                     type="button"
                   >
@@ -880,10 +880,10 @@ export function MessagesView() {
           </DialogHeader>
           <DialogPanel className="flex flex-col gap-2">
             <div className="relative">
-              <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+              <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
               <Input
                 aria-label={t("messages.compose.searchPlaceholder")}
-                className="pl-9"
+                className="ps-9"
                 onChange={(e) => setMemberQuery(e.target.value)}
                 placeholder={t("messages.compose.searchPlaceholder")}
                 size="sm"
@@ -902,7 +902,7 @@ export function MessagesView() {
               ) : (
                 visibleMembers.map((m) => (
                   <button
-                    className="flex w-full items-center gap-3 rounded-lg px-2 py-2 text-left transition-colors hover:bg-accent"
+                    className="flex w-full items-center gap-3 rounded-lg px-2 py-2 text-start transition-colors hover:bg-accent"
                     key={m.id}
                     onClick={() => startConversation(m.id)}
                     type="button"
@@ -932,10 +932,10 @@ export function MessagesView() {
           </DialogHeader>
           <DialogPanel className="flex flex-col gap-2">
             <div className="relative">
-              <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+              <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
               <Input
                 aria-label={t("messages.attach.apptSearchPlaceholder")}
-                className="pl-9"
+                className="ps-9"
                 onChange={(e) => setApptQuery(e.target.value)}
                 placeholder={t("messages.attach.apptSearchPlaceholder")}
                 size="sm"
@@ -954,7 +954,7 @@ export function MessagesView() {
               ) : (
                 visibleAppts.map((a) => (
                   <button
-                    className="flex w-full flex-col gap-0.5 rounded-lg px-2 py-2 text-left transition-colors hover:bg-accent"
+                    className="flex w-full flex-col gap-0.5 rounded-lg px-2 py-2 text-start transition-colors hover:bg-accent"
                     key={a.id}
                     onClick={() => attachAppointment(a)}
                     type="button"

frontend/components/notes/notes-view.tsx

@@ -153,7 +153,7 @@ export function NotesView() {
         <div className="divide-y divide-border overflow-hidden rounded-2xl border bg-card/30">
           {notes.map((n) => (
             <button
-              className="flex w-full flex-col items-start gap-0.5 px-4 py-3 text-left transition-colors hover:bg-accent/50"
+              className="flex w-full flex-col items-start gap-0.5 px-4 py-3 text-start transition-colors hover:bg-accent/50"
               key={n.id}
               onClick={() => openNote(n)}
               type="button"

frontend/components/patients/import-from-wallet-dialog.tsx

@@ -141,6 +141,8 @@ export function ImportFromWalletDialog({
     } catch (err) {
       if (err instanceof ApiError && err.status === 400) {
         setError(t("patients.importApp.invalidWallet"));
+      } else if (err instanceof ApiError && err.status === 409) {
+        setError(t("patients.importApp.networkOff"));
       } else {
         setError(t("patients.importApp.error"));
       }
@@ -171,8 +173,12 @@ export function ImportFromWalletDialog({
       setPairUri(`temetro-pair:?${params.toString()}`);
       setRequest(pairing);
       setPhase("waiting");
-    } catch {
-      setError(t("patients.importApp.error"));
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 409) {
+        setError(t("patients.importApp.networkOff"));
+      } else {
+        setError(t("patients.importApp.error"));
+      }
       setPhase("error");
     }
   };

frontend/components/patients/patient-detail-sheet.tsx

@@ -7,7 +7,9 @@ import { AiBadge } from "@/components/ai-badge";
 import { PatientFormDialog } from "@/components/chat/patient-form-dialog";
 import { RecordGraph } from "@/components/graph/record-graph";
 import { PatientDetail } from "@/components/patients/patient-detail";
+import { ScribeDialog } from "@/components/patients/scribe-dialog";
 import { TransferPatientDialog } from "@/components/patients/transfer-patient-dialog";
+import { WalletPushDialog } from "@/components/patients/wallet-push-dialog";
 import { ConfirmDialog } from "@/components/ui/confirm-dialog";
 import {
   Dialog,
@@ -28,8 +30,10 @@ import { type Appointment, listAppointments } from "@/lib/appointments";
 import { type Invoice, listInvoices } from "@/lib/invoices";
 import { deletePatient, getPatient, type Patient } from "@/lib/patients";
 import { listPrescriptions, type Prescription } from "@/lib/prescriptions";
+import { useAiAccess } from "@/lib/ai-policy";
 import { hasClinicalAccess, useActiveRole } from "@/lib/roles";
 import { notify } from "@/lib/toast";
+import { getWalletLink } from "@/lib/wallet-updates";
 
 type Status = "loading" | "ready" | "not-found";
 
@@ -76,9 +80,17 @@ export function PatientDetailSheet({
   // Deleting a chart is destructive — only offer it once we know the role is
   // a full clinician (patient:delete), never optimistically.
   const canDelete = role != null && hasClinicalAccess(role);
+  // The ambient scribe writes a clinical note, so it needs full clinical write
+  // access AND the clinic's AI must be enabled for this member.
+  const { allowed: aiAllowed } = useAiAccess();
+  const canScribe = role != null && hasClinicalAccess(role) && aiAllowed;
   const [patient, setPatient] = useState<Patient | null>(null);
   const [status, setStatus] = useState<Status>("loading");
   const [editOpen, setEditOpen] = useState(false);
+  const [scribeOpen, setScribeOpen] = useState(false);
+  const [walletPushOpen, setWalletPushOpen] = useState(false);
+  // Set once we confirm this patient is linked to a wallet (permanent share).
+  const [walletLinked, setWalletLinked] = useState(false);
   const [transferOpen, setTransferOpen] = useState(false);
   const [confirmOpen, setConfirmOpen] = useState(false);
   // Graph popped out of the sheet into its own dialog (the sheet closes first).
@@ -124,6 +136,21 @@ export function PatientDetailSheet({
     };
   }, [open, fileNumber]);
 
+  // Whether this patient is wallet-linked (drives the "Push update" button).
+  // Separate from the main load so it re-checks once the role resolves without
+  // refetching the record. Only clinicians can push.
+  useEffect(() => {
+    setWalletLinked(false);
+    if (!open || !fileNumber || !hasClinicalAccess(role)) return;
+    let active = true;
+    getWalletLink(fileNumber)
+      .then(() => active && setWalletLinked(true))
+      .catch(() => {});
+    return () => {
+      active = false;
+    };
+  }, [open, fileNumber, role]);
+
   const remove = async () => {
     if (!patient) return;
     try {
@@ -171,6 +198,10 @@ export function PatientDetailSheet({
                   setEditKey((k) => k + 1);
                   setEditOpen(true);
                 }}
+                onScribe={canScribe ? () => setScribeOpen(true) : undefined}
+                onWalletPush={
+                  walletLinked ? () => setWalletPushOpen(true) : undefined
+                }
                 onOpenGraph={() => {
                   onOpenChange(false);
                   setGraphOpen(true);
@@ -197,6 +228,23 @@ export function PatientDetailSheet({
         />
       )}
 
+      {patient && (
+        <ScribeDialog
+          onOpenChange={setScribeOpen}
+          onSaved={(updated) => setPatient(updated)}
+          open={scribeOpen}
+          patient={patient}
+        />
+      )}
+
+      {patient && (
+        <WalletPushDialog
+          onOpenChange={setWalletPushOpen}
+          open={walletPushOpen}
+          patient={patient}
+        />
+      )}
+
       {patient && (
         <TransferPatientDialog
           onOpenChange={setTransferOpen}

frontend/components/patients/patient-detail.tsx

@@ -1,6 +1,14 @@
 "use client";
 
-import { ArrowLeftRight, FileDown, Network, Pencil, Trash2 } from "lucide-react";
+import {
+  ArrowLeftRight,
+  FileDown,
+  Mic,
+  Network,
+  Pencil,
+  Send,
+  Trash2,
+} from "lucide-react";
 import { type ReactNode, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -173,6 +181,8 @@ function RecordHistory({ fileNumber }: { fileNumber: string }) {
 export function PatientDetail({
   patient,
   onEdit,
+  onScribe,
+  onWalletPush,
   onTransfer,
   onDelete,
   onOpenGraph,
@@ -182,6 +192,10 @@ export function PatientDetail({
 }: {
   patient: Patient;
   onEdit?: () => void;
+  // Opens the ambient AI visit scribe (record/transcribe → draft note).
+  onScribe?: () => void;
+  // Pushes the record to the patient's wallet (only when wallet-linked).
+  onWalletPush?: () => void;
   onTransfer?: () => void;
   onDelete?: () => void;
   // Pops the record graph out into its own dialog (closing this sheet).
@@ -287,16 +301,33 @@ export function PatientDetail({
               {t("patients.transfer.action")}
             </Button>
           )}
+          {onScribe && (
+            <Button onClick={onScribe} size="sm" type="button" variant="outline">
+              <Mic className="size-4" />
+              {t("scribe.recordVisit")}
+            </Button>
+          )}
           {onEdit && (
             <Button onClick={onEdit} size="sm" type="button" variant="outline">
               <Pencil className="size-4" />
               {t("patientCard.edit")}
             </Button>
           )}
+          {onWalletPush && (
+            <Button
+              onClick={onWalletPush}
+              size="sm"
+              type="button"
+              variant="outline"
+            >
+              <Send className="size-4" />
+              {t("walletPush.action")}
+            </Button>
+          )}
           {onDelete && (
             <Button
               aria-label={t("patients.delete.action")}
-              className="ml-auto"
+              className="ms-auto"
               onClick={onDelete}
               size="sm"
               type="button"
@@ -328,6 +359,14 @@ export function PatientDetail({
             label={t("patientCard.summary.openProblems")}
             value={patient.problems.length}
           />
+          <Stat
+            label={t("patientCard.summary.bloodType")}
+            value={patient.bloodType || "—"}
+          />
+          <Stat
+            label={t("patientCard.summary.phone")}
+            value={patient.phone || "—"}
+          />
         </div>
       </Section>
 
@@ -358,7 +397,7 @@ export function PatientDetail({
             <div className="divide-y divide-border overflow-hidden rounded-xl border bg-card/30">
               {files.map((file) => (
                 <button
-                  className="flex w-full items-center gap-2.5 px-3 py-2 text-left transition-colors hover:bg-accent"
+                  className="flex w-full items-center gap-2.5 px-3 py-2 text-start transition-colors hover:bg-accent"
                   key={file.id}
                   onClick={() => setOpenFile(file)}
                   type="button"

frontend/components/patients/patient-files.tsx

@@ -210,7 +210,7 @@ export function AttachmentsSection({
               key={attachment.id}
             >
               <button
-                className="flex min-w-0 flex-1 items-center gap-2.5 text-left"
+                className="flex min-w-0 flex-1 items-center gap-2.5 text-start"
                 onClick={() => setPreview(attachment)}
                 type="button"
               >

frontend/components/patients/patients-view.tsx

@@ -115,9 +115,9 @@ export function PatientsView() {
         </h1>
         <div className="flex items-center gap-2">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
-              className="w-full pl-9 sm:w-64"
+              className="w-full ps-9 sm:w-64"
               onChange={(event) => {
                 setQuery(event.target.value);
                 setPage(1);
@@ -159,7 +159,7 @@ export function PatientsView() {
       <div className="mt-8 overflow-hidden rounded-2xl border border-border bg-card/30">
         <table className="w-full text-sm">
           <thead>
-            <tr className="border-border border-b text-left text-xs text-muted-foreground uppercase">
+            <tr className="border-border border-b text-start text-xs text-muted-foreground uppercase">
               <th className="px-4 py-3 font-medium">{t("patients.columns.name")}</th>
               <th className="px-4 py-3 font-medium">{t("patients.columns.mrn")}</th>
               <th className="px-4 py-3 font-medium">

frontend/components/patients/scribe-dialog.tsx

@@ -0,0 +1,436 @@
+"use client";
+
+import { Mic, Square, Sparkles, Trash2 } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogPanel,
+  DialogPopup,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Spinner } from "@/components/ui/spinner";
+import {
+  Tabs,
+  TabsList,
+  TabsPanel,
+  TabsTab,
+} from "@/components/ui/tabs";
+import { Textarea } from "@/components/ui/textarea";
+import { uploadAttachment } from "@/lib/attachments";
+import type { Encounter, Patient } from "@/lib/patients";
+import { draftNote, saveNote, transcribeRecording } from "@/lib/scribe";
+import { notify } from "@/lib/toast";
+import { ApiError } from "@/lib/api-client";
+
+type Phase = "input" | "processing" | "review";
+type InputTab = "record" | "paste";
+type RecState = "idle" | "recording" | "recorded";
+
+// Pick a supported audio mime for MediaRecorder (Opus in WebM/OGG is tiny for
+// speech; Safari falls back to mp4). Returns "" to let the browser choose.
+function pickAudioMime(): string {
+  if (typeof MediaRecorder === "undefined") return "";
+  const candidates = [
+    "audio/webm;codecs=opus",
+    "audio/webm",
+    "audio/ogg;codecs=opus",
+    "audio/mp4",
+  ];
+  return candidates.find((m) => MediaRecorder.isTypeSupported(m)) ?? "";
+}
+
+function fmtElapsed(sec: number): string {
+  const m = Math.floor(sec / 60);
+  const s = sec % 60;
+  return `${m}:${String(s).padStart(2, "0")}`;
+}
+
+// The ambient AI scribe: record or paste a visit conversation, draft a SOAP
+// encounter note, review it, and append it to the patient record.
+export function ScribeDialog({
+  patient,
+  open,
+  onOpenChange,
+  onSaved,
+}: {
+  patient: Patient;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onSaved: (updated: Patient) => void;
+}) {
+  const { t } = useTranslation();
+  const [phase, setPhase] = useState<Phase>("input");
+  const [tab, setTab] = useState<InputTab>("record");
+  const [recState, setRecState] = useState<RecState>("idle");
+  const [elapsed, setElapsed] = useState(0);
+  const [transcript, setTranscript] = useState("");
+  const [visitType, setVisitType] = useState("");
+  const [draft, setDraft] = useState<Encounter | null>(null);
+  const [veilNote, setVeilNote] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const mediaRef = useRef<MediaRecorder | null>(null);
+  const chunksRef = useRef<Blob[]>([]);
+  const blobRef = useRef<Blob | null>(null);
+  const timerRef = useRef<ReturnType<typeof setInterval> | null>(null);
+
+  // Tear down any live recording + object state when the dialog closes.
+  const stopTracks = () => {
+    mediaRef.current?.stream.getTracks().forEach((track) => track.stop());
+    mediaRef.current = null;
+    if (timerRef.current) clearInterval(timerRef.current);
+    timerRef.current = null;
+  };
+
+  // Stop tracks on unmount.
+  useEffect(() => () => stopTracks(), []);
+
+  // Reset all state for the next open. Called on every close (the parent only
+  // ever closes this dialog through our onOpenChange), so no reset-in-effect.
+  const reset = () => {
+    setPhase("input");
+    setTab("record");
+    setRecState("idle");
+    setElapsed(0);
+    setTranscript("");
+    setVisitType("");
+    setDraft(null);
+    setVeilNote(null);
+    setError(null);
+    chunksRef.current = [];
+    blobRef.current = null;
+  };
+
+  const handleOpenChange = (next: boolean) => {
+    if (!next) {
+      stopTracks();
+      reset();
+    }
+    onOpenChange(next);
+  };
+
+  const startRecording = async () => {
+    setError(null);
+    try {
+      const stream = await navigator.mediaDevices.getUserMedia({ audio: true });
+      const mime = pickAudioMime();
+      const recorder = new MediaRecorder(
+        stream,
+        mime ? { mimeType: mime } : undefined,
+      );
+      chunksRef.current = [];
+      recorder.ondataavailable = (e) => {
+        if (e.data.size > 0) chunksRef.current.push(e.data);
+      };
+      recorder.onstop = () => {
+        blobRef.current = new Blob(chunksRef.current, {
+          type: recorder.mimeType || "audio/webm",
+        });
+        setRecState("recorded");
+      };
+      recorder.start();
+      mediaRef.current = recorder;
+      setRecState("recording");
+      setElapsed(0);
+      timerRef.current = setInterval(() => setElapsed((s) => s + 1), 1000);
+    } catch {
+      setError(t("scribe.errors.mic"));
+    }
+  };
+
+  const stopRecording = () => {
+    mediaRef.current?.stop();
+    mediaRef.current?.stream.getTracks().forEach((track) => track.stop());
+    if (timerRef.current) clearInterval(timerRef.current);
+    timerRef.current = null;
+  };
+
+  const discardRecording = () => {
+    blobRef.current = null;
+    chunksRef.current = [];
+    setRecState("idle");
+    setElapsed(0);
+  };
+
+  const filenameFor = (blob: Blob): string => {
+    const ext = blob.type.includes("mp4")
+      ? "m4a"
+      : blob.type.includes("ogg")
+        ? "ogg"
+        : "webm";
+    return `visit-${patient.fileNumber}-${Date.now()}.${ext}`;
+  };
+
+  const generate = async () => {
+    setError(null);
+    setPhase("processing");
+    try {
+      let text = transcript.trim();
+      if (tab === "record") {
+        const blob = blobRef.current;
+        if (!blob) {
+          setError(t("scribe.errors.noRecording"));
+          setPhase("input");
+          return;
+        }
+        // Store the recording as a patient attachment (auditable), then
+        // transcribe it server-side.
+        const file = new File([blob], filenameFor(blob), { type: blob.type });
+        const attachment = await uploadAttachment({
+          file,
+          fileNumber: patient.fileNumber,
+          labKey: "scribe",
+        });
+        const res = await transcribeRecording(attachment.id);
+        text = res.transcript.trim();
+        setTranscript(text);
+      }
+      if (!text) {
+        setError(t("scribe.errors.empty"));
+        setPhase("input");
+        return;
+      }
+      const { draft: note, veil } = await draftNote({
+        fileNumber: patient.fileNumber,
+        transcript: text,
+        visitType: visitType.trim() || undefined,
+      });
+      setDraft(note);
+      setVeilNote(
+        veil.active ? t("scribe.review.veil", { provider: veil.provider }) : null,
+      );
+      setPhase("review");
+    } catch (err) {
+      setError(
+        err instanceof ApiError ? err.message : t("scribe.errors.generic"),
+      );
+      setPhase("input");
+    }
+  };
+
+  const save = async () => {
+    if (!draft) return;
+    setPhase("processing");
+    try {
+      const updated = await saveNote(patient.fileNumber, draft);
+      notify.success(t("scribe.saved.title"), patient.name);
+      onSaved(updated);
+      handleOpenChange(false);
+    } catch (err) {
+      setError(
+        err instanceof ApiError ? err.message : t("scribe.errors.generic"),
+      );
+      setPhase("review");
+    }
+  };
+
+  const busy = phase === "processing";
+
+  return (
+    <Dialog onOpenChange={handleOpenChange} open={open}>
+      <DialogPopup className="flex max-h-[85dvh] flex-col sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Sparkles className="size-4 text-primary" />
+            {t("scribe.title")}
+          </DialogTitle>
+          <DialogDescription>
+            {t("scribe.subtitle", { name: patient.name })}
+          </DialogDescription>
+        </DialogHeader>
+
+        <DialogPanel className="min-h-0 flex-1 overflow-y-auto">
+          {phase === "review" && draft ? (
+            <div className="flex flex-col gap-4">
+              <div className="grid grid-cols-2 gap-3">
+                <div className="flex flex-col gap-1.5">
+                  <Label htmlFor="scribe-type">{t("scribe.review.type")}</Label>
+                  <Input
+                    id="scribe-type"
+                    onChange={(e) =>
+                      setDraft({ ...draft, type: e.target.value })
+                    }
+                    value={draft.type}
+                  />
+                </div>
+                <div className="flex flex-col gap-1.5">
+                  <Label htmlFor="scribe-date">{t("scribe.review.date")}</Label>
+                  <Input
+                    id="scribe-date"
+                    onChange={(e) =>
+                      setDraft({ ...draft, date: e.target.value })
+                    }
+                    type="date"
+                    value={draft.date}
+                  />
+                </div>
+              </div>
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="scribe-summary">
+                  {t("scribe.review.summary")}
+                </Label>
+                <Textarea
+                  className="min-h-56"
+                  id="scribe-summary"
+                  onChange={(e) =>
+                    setDraft({ ...draft, summary: e.target.value })
+                  }
+                  value={draft.summary}
+                />
+              </div>
+              <p className="text-muted-foreground text-xs">
+                {t("scribe.review.provider", { provider: draft.provider })}
+              </p>
+              {veilNote && (
+                <p className="rounded-lg bg-muted px-3 py-2 text-muted-foreground text-xs">
+                  {veilNote}
+                </p>
+              )}
+            </div>
+          ) : (
+            <Tabs
+              onValueChange={(v) => setTab(v as InputTab)}
+              value={tab}
+            >
+              <TabsList className="w-full">
+                <TabsTab value="record">
+                  <Mic className="size-4" />
+                  {t("scribe.tabs.record")}
+                </TabsTab>
+                <TabsTab value="paste">{t("scribe.tabs.paste")}</TabsTab>
+              </TabsList>
+
+              <TabsPanel className="pt-3" value="record">
+                <div className="flex flex-col items-center gap-4 py-4">
+                  {recState === "recording" ? (
+                    <>
+                      <div className="flex items-center gap-2 text-destructive">
+                        <span className="size-2.5 animate-pulse rounded-full bg-destructive" />
+                        <span className="font-mono text-lg tabular-nums">
+                          {fmtElapsed(elapsed)}
+                        </span>
+                      </div>
+                      <Button
+                        onClick={stopRecording}
+                        type="button"
+                        variant="destructive"
+                      >
+                        <Square className="size-4" />
+                        {t("scribe.record.stop")}
+                      </Button>
+                    </>
+                  ) : recState === "recorded" ? (
+                    <>
+                      <p className="text-foreground text-sm">
+                        {t("scribe.record.ready", {
+                          duration: fmtElapsed(elapsed),
+                        })}
+                      </p>
+                      <Button
+                        onClick={discardRecording}
+                        size="sm"
+                        type="button"
+                        variant="outline"
+                      >
+                        <Trash2 className="size-4" />
+                        {t("scribe.record.discard")}
+                      </Button>
+                    </>
+                  ) : (
+                    <Button onClick={startRecording} type="button">
+                      <Mic className="size-4" />
+                      {t("scribe.record.start")}
+                    </Button>
+                  )}
+                </div>
+              </TabsPanel>
+
+              <TabsPanel className="pt-3" value="paste">
+                <Textarea
+                  className="min-h-40"
+                  onChange={(e) => setTranscript(e.target.value)}
+                  placeholder={t("scribe.paste.placeholder")}
+                  value={transcript}
+                />
+              </TabsPanel>
+
+              <div className="mt-4 flex flex-col gap-3">
+                <div className="flex flex-col gap-1.5">
+                  <Label htmlFor="scribe-visit-type">
+                    {t("scribe.visitType.label")}
+                  </Label>
+                  <Input
+                    id="scribe-visit-type"
+                    onChange={(e) => setVisitType(e.target.value)}
+                    placeholder={t("scribe.visitType.placeholder")}
+                    value={visitType}
+                  />
+                </div>
+                <p className="rounded-lg bg-muted px-3 py-2 text-muted-foreground text-xs">
+                  {t("scribe.consent")}
+                </p>
+              </div>
+            </Tabs>
+          )}
+
+          {error && (
+            <p className="mt-3 text-destructive text-sm" role="alert">
+              {error}
+            </p>
+          )}
+        </DialogPanel>
+
+        <DialogFooter>
+          {phase === "review" ? (
+            <>
+              <Button
+                disabled={busy}
+                onClick={() => setPhase("input")}
+                type="button"
+                variant="outline"
+              >
+                {t("scribe.review.back")}
+              </Button>
+              <Button disabled={busy} onClick={save} type="button">
+                {busy && <Spinner className="size-4" />}
+                {t("scribe.review.save")}
+              </Button>
+            </>
+          ) : (
+            <>
+              <Button
+                disabled={busy}
+                onClick={() => handleOpenChange(false)}
+                type="button"
+                variant="outline"
+              >
+                {t("scribe.cancel")}
+              </Button>
+              <Button
+                disabled={
+                  busy ||
+                  (tab === "record"
+                    ? recState !== "recorded"
+                    : transcript.trim().length === 0)
+                }
+                onClick={generate}
+                type="button"
+              >
+                {busy && <Spinner className="size-4" />}
+                {busy ? t("scribe.processing") : t("scribe.generate")}
+              </Button>
+            </>
+          )}
+        </DialogFooter>
+      </DialogPopup>
+    </Dialog>
+  );
+}

frontend/components/patients/wallet-push-dialog.tsx

@@ -0,0 +1,242 @@
+"use client";
+
+import { Check, Loader2, Send, X } from "lucide-react";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogPanel,
+  DialogPopup,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Label } from "@/components/ui/label";
+import { Spinner } from "@/components/ui/spinner";
+import { Textarea } from "@/components/ui/textarea";
+import { ApiError } from "@/lib/api-client";
+import type { Patient } from "@/lib/patients";
+import { cn } from "@/lib/utils";
+import {
+  getWalletUpdate,
+  pushWalletUpdate,
+  type WalletUpdate,
+} from "@/lib/wallet-updates";
+
+// The record sections a clinician can flag as changed. The labels double as the
+// human-readable change summary the patient sees when approving.
+const SECTION_KEYS = [
+  "demographics",
+  "problems",
+  "medications",
+  "allergies",
+  "labs",
+  "vitals",
+  "visits",
+] as const;
+
+type Phase = "compose" | "sent";
+
+// Push the current record to a wallet-linked patient's app. The patient must
+// approve it on their phone before their on-device record is replaced.
+export function WalletPushDialog({
+  patient,
+  open,
+  onOpenChange,
+}: {
+  patient: Patient;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const { t } = useTranslation();
+  const [phase, setPhase] = useState<Phase>("compose");
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [note, setNote] = useState("");
+  const [update, setUpdate] = useState<WalletUpdate | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const reset = () => {
+    setPhase("compose");
+    setSelected(new Set());
+    setNote("");
+    setUpdate(null);
+    setBusy(false);
+    setError(null);
+  };
+
+  const handleOpenChange = (next: boolean) => {
+    if (!next) reset();
+    onOpenChange(next);
+  };
+
+  // Poll the update's status until the patient approves/denies (or the dialog
+  // closes). Live pushes usually resolve within seconds.
+  useEffect(() => {
+    if (phase !== "sent" || !update || update.resolvedAt) return;
+    let active = true;
+    const timer = setInterval(async () => {
+      try {
+        const fresh = await getWalletUpdate(update.id);
+        if (!active) return;
+        setUpdate(fresh);
+        if (fresh.resolvedAt) clearInterval(timer);
+      } catch {
+        /* keep polling */
+      }
+    }, 3000);
+    return () => {
+      active = false;
+      clearInterval(timer);
+    };
+  }, [phase, update]);
+
+  const toggle = (key: string) => {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(key)) next.delete(key);
+      else next.add(key);
+      return next;
+    });
+  };
+
+  const push = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      const changes = [
+        ...[...selected].map((k) => t(`walletPush.sections.${k}`)),
+        ...(note.trim() ? [note.trim()] : []),
+      ];
+      const created = await pushWalletUpdate({
+        fileNumber: patient.fileNumber,
+        changes,
+      });
+      setUpdate(created);
+      setPhase("sent");
+    } catch (err) {
+      setError(
+        err instanceof ApiError ? err.message : t("walletPush.errors.generic"),
+      );
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const canPush = selected.size > 0 || note.trim().length > 0;
+  const status = update?.status ?? "pending";
+
+  return (
+    <Dialog onOpenChange={handleOpenChange} open={open}>
+      <DialogPopup className="flex max-h-[85dvh] flex-col sm:max-w-md">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Send className="size-4 text-primary" />
+            {t("walletPush.title")}
+          </DialogTitle>
+          <DialogDescription>
+            {t("walletPush.subtitle", { name: patient.name })}
+          </DialogDescription>
+        </DialogHeader>
+
+        <DialogPanel className="min-h-0 flex-1 overflow-y-auto">
+          {phase === "compose" ? (
+            <div className="flex flex-col gap-4">
+              <div className="flex flex-col gap-2">
+                <Label>{t("walletPush.sectionsLabel")}</Label>
+                <div className="flex flex-wrap gap-2">
+                  {SECTION_KEYS.map((key) => {
+                    const on = selected.has(key);
+                    return (
+                      <button
+                        className={cn(
+                          "rounded-full border px-3 py-1 text-sm transition-colors",
+                          on
+                            ? "border-primary bg-primary/10 text-foreground"
+                            : "border-border text-muted-foreground hover:bg-accent",
+                        )}
+                        key={key}
+                        onClick={() => toggle(key)}
+                        type="button"
+                      >
+                        {t(`walletPush.sections.${key}`)}
+                      </button>
+                    );
+                  })}
+                </div>
+              </div>
+              <div className="flex flex-col gap-1.5">
+                <Label htmlFor="wallet-push-note">
+                  {t("walletPush.noteLabel")}
+                </Label>
+                <Textarea
+                  className="min-h-20"
+                  id="wallet-push-note"
+                  onChange={(e) => setNote(e.target.value)}
+                  placeholder={t("walletPush.notePlaceholder")}
+                  value={note}
+                />
+              </div>
+              <p className="rounded-lg bg-muted px-3 py-2 text-muted-foreground text-xs">
+                {t("walletPush.notice")}
+              </p>
+            </div>
+          ) : (
+            <div className="flex flex-col items-center gap-4 py-6 text-center">
+              {status === "approved" ? (
+                <div className="flex size-12 items-center justify-center rounded-full bg-success/15 text-success">
+                  <Check className="size-6" />
+                </div>
+              ) : status === "denied" ? (
+                <div className="flex size-12 items-center justify-center rounded-full bg-destructive/15 text-destructive">
+                  <X className="size-6" />
+                </div>
+              ) : (
+                <Loader2 className="size-8 animate-spin text-muted-foreground" />
+              )}
+              <div className="flex flex-col gap-1">
+                <p className="font-medium text-foreground text-sm">
+                  {t(`walletPush.status.${status}.title`)}
+                </p>
+                <p className="text-muted-foreground text-sm">
+                  {t(`walletPush.status.${status}.body`)}
+                </p>
+              </div>
+            </div>
+          )}
+
+          {error && (
+            <p className="mt-3 text-destructive text-sm" role="alert">
+              {error}
+            </p>
+          )}
+        </DialogPanel>
+
+        <DialogFooter>
+          {phase === "compose" ? (
+            <>
+              <Button
+                onClick={() => handleOpenChange(false)}
+                type="button"
+                variant="outline"
+              >
+                {t("walletPush.cancel")}
+              </Button>
+              <Button disabled={busy || !canPush} onClick={push} type="button">
+                {busy && <Spinner className="size-4" />}
+                {t("walletPush.send")}
+              </Button>
+            </>
+          ) : (
+            <Button onClick={() => handleOpenChange(false)} type="button">
+              {t("walletPush.done")}
+            </Button>
+          )}
+        </DialogFooter>
+      </DialogPopup>
+    </Dialog>
+  );
+}

frontend/components/pharmacy/inventory-detail-dialog.tsx

@@ -35,7 +35,7 @@ function Row({ label, value }: { label: string; value: ReactNode }) {
   return (
     <div className="flex items-center justify-between gap-4 py-2">
       <span className="text-muted-foreground text-sm">{label}</span>
-      <span className="text-right text-foreground text-sm">{value}</span>
+      <span className="text-end text-foreground text-sm">{value}</span>
     </div>
   );
 }
@@ -68,7 +68,7 @@ export function InventoryDetailDialog({
             </span>
             <span className="min-w-0 truncate">{item.name}</span>
             <Badge
-              className="ml-auto shrink-0"
+              className="ms-auto shrink-0"
               variant={availabilityVariant[availability]}
             >
               {t(`inventory.availability.${availability}`)}

frontend/components/pharmacy/inventory-view.tsx

@@ -67,7 +67,7 @@ function ItemRow({
   const descriptor = [item.strength, item.form].filter(Boolean).join(" · ");
   return (
     <div
-      className="flex w-full cursor-pointer items-center gap-3 px-4 py-3 text-left transition-colors hover:bg-accent/50"
+      className="flex w-full cursor-pointer items-center gap-3 px-4 py-3 text-start transition-colors hover:bg-accent/50"
       onClick={onOpen}
       onKeyDown={(event) => {
         if (event.key === "Enter" || event.key === " ") {
@@ -205,9 +205,9 @@ export function InventoryView() {
         </div>
         <div className="flex items-center gap-2">
           <div className="relative">
-            <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+            <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
             <Input
-              className="w-full pl-9 sm:w-64"
+              className="w-full ps-9 sm:w-64"
               onChange={(event) => setQuery(event.target.value)}
               placeholder={t("inventory.searchPlaceholder")}
               value={query}

frontend/components/pharmacy/pharmacy-view.tsx

@@ -330,9 +330,9 @@ export function PharmacyView() {
           <p className="text-muted-foreground text-sm">{t("pharmacy.subtitle")}</p>
         </div>
         <div className="relative">
-          <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+          <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
           <Input
-            className="w-full pl-9 sm:w-64"
+            className="w-full ps-9 sm:w-64"
             onChange={(event) => setQuery(event.target.value)}
             placeholder={t("pharmacy.searchPlaceholder")}
             value={query}

frontend/components/portal/portal-kiosk.tsx

@@ -8,9 +8,11 @@ import {
   ChevronRight,
   FlaskConical,
   Loader2,
+  Smartphone,
 } from "lucide-react";
 import { type FormEvent, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
+import QRCodeSvg from "react-qr-code";
 
 import { Button } from "@/components/ui/button";
 import {
@@ -25,13 +27,15 @@ import {
   bookPortalAppointment,
   createPortalPatient,
   getPortalClinic,
+  getPortalLink,
   lookupPortalResults,
+  portalPairingUri,
   type PortalBookingResult,
   type PortalResults,
 } from "@/lib/portal";
 import { cn } from "@/lib/utils";
 
-type Step = "choose" | "book" | "results";
+type Step = "choose" | "book" | "results" | "wallet";
 
 const todayKey = () => new Date().toISOString().slice(0, 10);
 
@@ -43,7 +47,7 @@ function Field({
   children: React.ReactNode;
 }) {
   return (
-    <label className="flex flex-col gap-1.5 text-left">
+    <label className="flex flex-col gap-1.5 text-start">
       <span className="font-medium text-foreground text-sm">{label}</span>
       {children}
     </label>
@@ -93,6 +97,8 @@ export function PortalKiosk({ clinic }: { clinic: string }) {
         <ChooseStep onPick={setStep} />
       ) : step === "book" ? (
         <BookStep clinic={clinic} onBack={() => setStep("choose")} />
+      ) : step === "wallet" ? (
+        <WalletStep clinic={clinic} onBack={() => setStep("choose")} />
       ) : (
         <ResultsStep clinic={clinic} onBack={() => setStep("choose")} />
       )}
@@ -117,12 +123,18 @@ function ChooseStep({ onPick }: { onPick: (step: Step) => void }) {
         title: t("portal.choose.resultsTitle"),
         desc: t("portal.choose.resultsDesc"),
       },
+      {
+        step: "wallet",
+        icon: <Smartphone className="size-7" />,
+        title: t("portal.choose.walletTitle"),
+        desc: t("portal.choose.walletDesc"),
+      },
     ];
   return (
     <div className="grid w-full gap-4 sm:grid-cols-2">
       {cards.map((c) => (
         <button
-          className="group flex flex-col items-start gap-4 rounded-3xl border bg-card/40 p-6 text-left transition-colors hover:border-primary/50 hover:bg-accent/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          className="group flex flex-col items-start gap-4 rounded-3xl border bg-card/40 p-6 text-start transition-colors hover:border-primary/50 hover:bg-accent/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
           key={c.step}
           onClick={() => onPick(c.step)}
           type="button"
@@ -133,7 +145,7 @@ function ChooseStep({ onPick }: { onPick: (step: Step) => void }) {
           <span className="flex flex-col gap-1">
             <span className="flex items-center gap-1 font-semibold text-lg text-foreground">
               {c.title}
-              <ChevronRight className="size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5" />
+              <ChevronRight className="size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5 rtl:rotate-180" />
             </span>
             <span className="text-muted-foreground text-sm">{c.desc}</span>
           </span>
@@ -151,12 +163,53 @@ function BackButton({ onBack }: { onBack: () => void }) {
       onClick={onBack}
       type="button"
     >
-      <ArrowLeft className="size-4" />
+      <ArrowLeft className="size-4 rtl:rotate-180" />
       {t("portal.back")}
     </button>
   );
 }
 
+// Show a QR the patient scans with the temetro wallet app to link it to this
+// clinic over the Temetro Network relay. After linking, the app can book
+// appointments and view/download results itself, syncing back to the clinic.
+function WalletStep({ clinic, onBack }: { clinic: string; onBack: () => void }) {
+  const { t } = useTranslation();
+  const [uri, setUri] = useState<string | null>(null);
+  const [error, setError] = useState(false);
+
+  useEffect(() => {
+    let active = true;
+    getPortalLink(clinic)
+      .then((link) => active && setUri(portalPairingUri(link)))
+      .catch(() => active && setError(true));
+    return () => {
+      active = false;
+    };
+  }, [clinic]);
+
+  return (
+    <div className="flex w-full flex-col items-center gap-5">
+      <BackButton onBack={onBack} />
+      <h2 className="font-semibold text-xl">{t("portal.wallet.title")}</h2>
+      <p className="max-w-md text-center text-muted-foreground text-sm">
+        {t("portal.wallet.subtitle")}
+      </p>
+      {uri ? (
+        <div className="rounded-2xl bg-white p-4">
+          <QRCodeSvg value={uri} size={232} />
+        </div>
+      ) : error ? (
+        <p className="text-destructive text-sm">{t("portal.wallet.error")}</p>
+      ) : (
+        <Loader2 className="size-6 animate-spin text-muted-foreground" />
+      )}
+      <p className="max-w-md text-center text-muted-foreground text-xs">
+        {t("portal.wallet.hint")}
+      </p>
+    </div>
+  );
+}
+
 function BookStep({ clinic, onBack }: { clinic: string; onBack: () => void }) {
   const { t } = useTranslation();
   // "returning" = has a file number; "new" = register first, then book.

frontend/components/prescriptions/add-prescription-dialog.tsx

@@ -378,11 +378,11 @@ export function AddPrescriptionDialog({
               ) : (
                 <div className="flex flex-col gap-1.5">
                   <div className="relative">
-                    <Search className="-translate-y-1/2 absolute top-1/2 left-3 size-4 text-muted-foreground" />
+                    <Search className="-translate-y-1/2 absolute top-1/2 start-3 size-4 text-muted-foreground" />
                     <Input
                       aria-autocomplete="list"
                       autoFocus
-                      className="pl-9"
+                      className="ps-9"
                       onChange={(event) => setQuery(event.target.value)}
                       onKeyDown={onPatientKeyDown}
                       placeholder={t("prescriptions.dialog.searchPlaceholder")}
@@ -399,7 +399,7 @@ export function AddPrescriptionDialog({
                         matches.map((p, i) => (
                           <button
                             className={cn(
-                              "flex w-full items-center justify-between gap-2 rounded-lg px-2 py-1.5 text-left transition-colors",
+                              "flex w-full items-center justify-between gap-2 rounded-lg px-2 py-1.5 text-start transition-colors",
                               i === activeIndex
                                 ? "bg-accent"
                                 : "hover:bg-accent",
@@ -442,7 +442,7 @@ export function AddPrescriptionDialog({
                       return (
                         <button
                           className={cn(
-                            "flex w-full items-center justify-between gap-2 rounded-lg px-2 py-1.5 text-left transition-colors",
+                            "flex w-full items-center justify-between gap-2 rounded-lg px-2 py-1.5 text-start transition-colors",
                             i === medIndex ? "bg-accent" : "hover:bg-accent",
                           )}
                           // Use onMouseDown so the pick fires before the input's