feat: portal doctor booking, Arabic RTL fix, wallet portal QR (v0.10.0)

backend: public GET /api/portal/:clinic/doctors and /availability, and
thread a chosen provider into portal bookings (conflict check unchanged).

frontend: fix site-wide Arabic RTL — anchor the sidebar right for RTL and
mirror the Switch thumb. Add a Patient Portal section (open/copy/QR) to
Settings → Signing and a "Use my current location" GPS button to the clinic
location editor. New i18n keys across all five locales.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,140 @@ for how releases are cut and published.
 
 ## [Unreleased]
 
+## [0.10.0] — 2026-07-07
+
+### Added
+- **Patient Portal doctor picker & availability.** The portal now lists the clinic's doctors and
+  books against a chosen provider, showing only free slots. New public endpoints
+  `GET /api/portal/:clinic/doctors` and `GET /api/portal/:clinic/availability?provider=&date=`
+  (display-safe fields only), and `POST /api/portal/:clinic/appointments` accepts an optional
+  `provider` (`backend/src/routes/portal.ts`). The existing 409 conflict check stays authoritative.
+- **Patient Portal links in Settings.** Settings → Signing → Patient Portal adds **open**, **copy
+  link**, and **QR code** actions (`components/settings/settings-portal.tsx`); the QR carries the
+  backend base (`?api=`) so the patient wallet app can book natively when it scans it.
+- **Clinic location "Use my current location".** The location editor fills map coordinates from the
+  browser's geolocation (`components/settings/settings-location.tsx`).
+- **Wallet app native Patient Portal.** Scanning a clinic's portal QR opens a native booking screen
+  (doctor list → free-slot picker → confirm) in the patient wallet app.
+
+### Fixed
+- **Arabic (RTL) layout.** The sidebar now anchors to the **right** for RTL locales and the toggle
+  switch mirrors correctly, instead of leaving the shell misaligned
+  (`components/sidebar-02/app-sidebar.tsx`, `components/ui/switch.tsx`).
+- **Wallet app:** record-card **bottom sheet no longer freezes** the app (dropped the per-frame
+  animated blur overlay for HeroUI's built-in overlay); **Reset wallet** now confirms in a native
+  HeroUI dialog with Liquid Glass actions; fixed the **white edge flash** on screen transitions in
+  dark mode; the home/onboarding/register **logo** is now the Temetro mark.
+
+### Changed
+- New i18n keys (`settings.portal.*`, geolocation strings) are translated into **all** shipped
+  locales (en, de, fr, ar, so).
+
+## [0.9.0] — 2026-07-06
+
+### Added
+- **Patient blood type & phone number.** The patient record now carries a `bloodType` (e.g. `O+`)
+  and a `phone` number. Both are shown in the record sheet and chat summary card and are editable in
+  the add/edit patient form. `phone` is a demographic/contact field (visible to and editable by the
+  **reception** role); `bloodType` is treated as clinical PHI and is **redacted for reception** (like
+  allergies/vitals). New columns `patients.phone` / `patients.blood_type` (migration `0033`).
+- **Clinic location setting.** A new org-scoped `clinic_settings` table (migration `0034`) stores the
+  clinic's address (address / city / country) plus optional map coordinates (latitude / longitude),
+  set in **Settings → Signing → Clinic location** (owner/admin only). New endpoints
+  `GET /api/clinic/settings` (any clinician) and `PUT /api/clinic/location` (owner/admin). This will
+  be surfaced in the patient wallet app to show a clinic's location.
+
+### Changed
+- New i18n keys for the above are translated into **all** shipped locales (en, de, fr, ar, so), per
+  the coverage rule now documented in `frontend/CLAUDE.md`.
+
+## [0.8.2] — 2026-07-05
+
+### Fixed
+- **`RELAY_URL` now defaults to the hosted relay** (`https://network.temetro.com`) instead of
+  `http://localhost:8080`. The old default silently failed for anyone who joined the network without
+  explicitly setting `RELAY_URL` — the backend's hub connection could never reach the relay (inside
+  Docker `localhost` is the container itself), so it never authenticated and QR pairing generated a
+  QR pointing at an unreachable `localhost`. Self-hosters running their own relay still override
+  `RELAY_URL`. Updated `.env.example` accordingly.
+
+### Changed
+- Generating a pairing QR (`POST /api/patients/wallet/pair`) now ensures the clinic's relay hub is
+  connected before pre-registering the request, so the routing is set up even if the connection was
+  opened lazily.
+
+### Fixed
+- **QR "scan to connect" pairing** was broken by the multi-clinic relay routing (v0.8.0): pairing
+  has no wallet number, so the clinic never sent a `wallet:send` to register the request, and the
+  relay rejected the scanning device's response as "unknown or expired". The clinic now
+  **pre-registers** the pairing request with the relay (a new `hub:expect { requestId }` event on
+  `POST /api/patients/wallet/pair`), so the device's response routes back correctly. On hub
+  (re)connect the backend re-registers its still-pending requests, so routing also survives a relay
+  restart. `POST /pair` now also requires the clinic to have joined the network (clear 409 instead of
+  a dead QR), surfaced in the import dialog.
+
+### Added
+- **Multi-clinic Temetro Network.** The relay now serves many self-hosted clinics at once. Each
+  clinic authenticates to the `/hub` namespace by **signing a challenge with its own Ed25519 clinic
+  signing key** (`services/signing.ts`) — a per-clinic identity, not a shared password — and the
+  relay routes every device response back to only the clinic that originated the request (keyed by
+  `requestId`), so clinics never see each other's traffic. `wallet:online` is fanned out only to
+  clinics with pending work for that wallet.
+- **"Join Temetro Network" opt-in.** A per-clinic toggle in **Settings → Signing** (backed by
+  `clinic_signing_keys.network_enabled`, `GET`/`PUT /api/signing/network`, owner/admin only). Off by
+  default; enabling opens the clinic's relay connection, disabling tears it down. Wallet
+  import/push endpoints return **409** while a clinic hasn't joined. Localised in all five languages.
+
+### Changed
+- **The backend keeps one authenticated relay connection per network-enabled org**
+  (`services/relay-client.ts` — `connectOrg`/`disconnectOrg`, a `hubs` map keyed by `orgId`), instead
+  of a single shared-token connection. `emitToWallet`/`sendToWallet` now take an `orgId`, and the
+  offline-flush (`pendingUpdatesForWallet`) is org-scoped.
+- **`RELAY_TOKEN` is now optional/legacy.** Clinics authenticate with their signing key, so an open
+  relay needs no shared secret; `RELAY_TOKEN` only gates an optional *private* relay.
+
+## [0.7.0] — 2026-07-05
+
+### Added
+- **Temetro Network** — a standalone, high-performance **relay** (Rust + Axum + socketioxide) that
+  connects the backend to patient wallet apps, in its own repo
+  ([github.com/temetro/temetro-network](https://github.com/temetro/temetro-network)) and deployable
+  on Railway. It replaces the flaky Cloudflare quick-tunnel that used to expose the backend's
+  embedded `/wallet` Socket.io namespace to phones. The relay is a **dumb, stateless pipe**: a
+  `/wallet` namespace for devices (challenge/Ed25519-signature auth, room keyed by wallet number)
+  and a `RELAY_TOKEN`-authenticated `/hub` namespace for the backend. It forwards sealed ciphertext
+  verbatim, keeps no database, and its only crypto is verifying a device's auth signature (proven
+  byte-for-byte compatible with `wallet-crypto.ts`).
+
+### Changed
+- **The backend is now a client of the relay, not the wallet server.** The `/wallet` Socket.io
+  namespace was removed from `src/realtime.ts`; a new `src/services/relay-client.ts` connects to the
+  relay's `/hub` (`emitToWallet` delegates to its `sendToWallet`), handles device responses
+  (`wallet:share-response` / `wallet:update-response` / `wallet:revoke`) and flushes missed updates on
+  `wallet:online` — calling the same `wallet-share` / `wallet-updates` services as before. New
+  `RELAY_URL` + `RELAY_TOKEN` env vars; the wallet-import QR now points at `RELAY_URL`.
+
+## [0.6.0] — 2026-07-04
+
+### Added
+- **Read-only FHIR R4 server** — temetro can now be a FHIR **server**, not just a client.
+  A new endpoint tree at **`/fhir`** (mounted outside `/api`, bearer-only) exposes each
+  clinic's records as FHIR R4: **Patient**, **Observation** (labs + synthesized vital signs),
+  **AllergyIntolerance**, **Condition**, **MedicationRequest**, **Encounter** and
+  **Appointment**, plus an unauthenticated **`GET /fhir/metadata`** CapabilityStatement.
+  Searches return searchset `Bundle`s with `_count`/`_offset` pagination and self/next/prev
+  links. Because temetro stores free-text clinical values, every `CodeableConcept` is
+  **text-only** (no SNOMED/LOINC) and patients carry an **age** extension rather than a
+  `birthDate` — documented in the CapabilityStatement and API docs.
+- **Per-clinic FHIR API keys** — machine-to-machine auth via `Authorization: Bearer tmf_…`.
+  Keys are created/revoked under **Settings → Integrations → FHIR server** (owner/admin),
+  **SHA-256-hashed** at rest, and shown **once** at creation. Every FHIR request is
+  org-scoped (no cross-clinic reads) and written to the activity log with the key name and
+  result count. New `fhir_api_keys` table, `middleware/fhir-auth.ts`, the
+  `services/fhir-server/` mapping module (queries, resources, bundle, capability, keys), the
+  `/fhir` router, and `GET/POST/DELETE /api/integrations/fhir-server/keys`. New `fhirServer`
+  locale namespace across all five languages.
+
 ## [0.5.0] — 2026-07-03
 
 ### Added

CLAUDE.md

@@ -27,12 +27,13 @@ repository (published as `temetro`).
 > "Patient wallet app" below) and an end-to-end **encrypted share / patient-approval** flow:
 > clinics hold a real **Ed25519 signing key** (Settings → Signing, `backend/src/services/signing.ts`),
 > and "Import from a patient app" on the Patients page relays an encrypted request to the wallet over
-> a **`/wallet` Socket.io namespace**, the patient approves on their phone, and the sealed record is
-> imported (with optional **temporary share + auto-delete**). See `backend/src/routes/{signing,patients-wallet}.ts`.
+> the **Temetro Network** relay (see below), the patient approves on their phone, and the sealed record
+> is imported (with optional **temporary share + auto-delete**). Clinic→wallet **record-update push**
+> and **QR pairing** are built too. See `backend/src/routes/{signing,patients-wallet}.ts`.
 >
-> **Still vision, not built:** clinic→wallet push of signed record updates, in-app record editing,
-> QR pairing, and cryptographic time-boxing of temporary shares. The AI chat is still **mock replies**.
-> Email verification is wired but currently **not enforced** at sign-in (see `backend/CLAUDE.md`).
+> **Still vision, not built:** in-app record editing and cryptographic time-boxing of temporary
+> shares. The AI chat is still **mock replies**. Email verification is wired but currently **not
+> enforced** at sign-in (see `backend/CLAUDE.md`).
 
 ## Patient wallet app (sibling repo `~/Desktop/temetro-app`)
 
@@ -47,6 +48,28 @@ here means keys + data live on the patient's device and the relay only ever forw
 is **not** a literal blockchain (records are off-chain, which is also what lets a temporary share be
 deleted). Commit/push that app inside its own repo, separately from this one.
 
+## Temetro Network (sibling repo/folder `~/Desktop/Temetro-network`)
+
+The **relay** that connects this backend to patient wallet apps. It is its **own git repo** on the
+Desktop (folder `~/Desktop/Temetro-network`, pushed to `github.com/temetro/temetro-network`), **not**
+in this monorepo — a standalone **Rust + Axum + socketioxide** service meant to run always-on (e.g.
+on **Railway**). It replaces the old flaky Cloudflare quick-tunnel that used to expose the backend's
+embedded `/wallet` Socket.io namespace to phones.
+
+It is a **dumb, stateless pipe**: two Socket.io namespaces — `/wallet` for devices
+(challenge/Ed25519-signature auth, room keyed by wallet number) and `/hub` for this backend
+(`RELAY_TOKEN`-authenticated). Devices and the backend both connect to it; it **forwards sealed
+ciphertext verbatim** and never opens bundles or touches a database. Its only crypto is verifying a
+device's auth signature (mirrors `backend/src/lib/wallet-crypto.ts`). The backend connects to it as a
+`/hub` client via `backend/src/services/relay-client.ts` (its `sendToWallet` is what `emitToWallet`
+now calls); configure with `RELAY_URL` + `RELAY_TOKEN`. Commit/push that service inside its own repo,
+separately from this one.
+
+> **Note:** in this sandbox the `~/Desktop/Temetro-network` folder blocks directory enumeration
+> (`ls`/`getcwd`/git inside it return EPERM) though plain file writes work. Develop/build/commit it
+> in an accessible copy and mirror the tree in with `tar`; drive git there via
+> `GIT_DIR`/`GIT_WORK_TREE` from an accessible cwd.
+
 ## Layout
 
 `frontend/` and `backend/` were previously separate per-folder git repos; they have been **merged

backend/.env.example

@@ -32,13 +32,23 @@ POSTGRES_PORT=5432
 BACKEND_PORT=4000
 FRONTEND_PORT=3000
 
-# --- Patient wallet relay -------------------------------------------------
-# The URL baked into the QR a patient scans to import their record. Their phone
-# must be able to reach it — so localhost will NOT work from a real device. If
-# unset, the backend derives it from the request host (fine when you open the
-# web app over your LAN IP, e.g. http://192.168.1.20:3000). Otherwise set it
-# explicitly to a phone-reachable address: your machine's LAN IP or a public
-# tunnel URL.
+# --- Temetro Network relay ------------------------------------------------
+# The standalone relay (github.com/temetro/temetro-network) that connects this
+# backend to patient phones. Deploy it (e.g. on Railway) and point both this
+# backend and the wallet app at it. RELAY_URL is the relay's public URL (also
+# baked into the QR a patient scans). This clinic authenticates to the relay's
+# /hub with its own Ed25519 signing key, so no shared secret is needed.
+# RELAY_TOKEN is OPTIONAL/LEGACY — set it only for a private relay that also
+# gates on a shared token (then use the SAME value here and on the relay).
+# Defaults to the hosted relay (https://network.temetro.com) when unset, so
+# "Join Temetro Network" works out of the box; set RELAY_URL only to point at
+# your own relay. Do NOT use http://localhost — inside Docker that's the
+# container itself and the relay connection will silently fail.
+RELAY_URL=https://network.temetro.com
+RELAY_TOKEN=
+
+# (Legacy, pre-relay self-hosting.) A phone-reachable URL for the QR when NOT
+# using the Temetro Network relay. RELAY_URL takes precedence over this.
 # PUBLIC_RELAY_URL=http://192.168.1.20:4000
 
 # --- Email (optional) -----------------------------------------------------

backend/CLAUDE.md

@@ -60,6 +60,18 @@ No test runner is configured. Verify by running the stack (`docker compose up`)
 - **Real-time** lives in **`src/realtime.ts`** — a Socket.io server attached to the same HTTP server
   in `index.ts`; the handshake reuses Better Auth's `getSession`. Other modules push via
   `emitToUser` / `emitToConversation` (no direct socket import, so no circular deps).
+- **Patient-wallet relay** is **no longer hosted here.** Devices connect to the standalone **Temetro
+  Network** service (`~/Desktop/Temetro-network`, see root `CLAUDE.md`), which is **multi-clinic**.
+  This backend connects to it as a `/hub` client in **`src/services/relay-client.ts`**, keeping **one
+  authenticated connection per network-enabled org** (`hubs` map keyed by `orgId`). Each org
+  authenticates by signing the relay's `hub:challenge` with its clinic signing key
+  (`signWithClinicKey`) — no shared `RELAY_TOKEN` needed (it's now optional/legacy, only for a
+  private relay). `emitToWallet(orgId, …)` (realtime.ts) delegates to `sendToWallet(orgId, …)`, and
+  device responses (`wallet:share-response` / `wallet:update-response` / `wallet:revoke`) +
+  `wallet:online` replay are handled per-org there, calling the same `wallet-share` /
+  `wallet-updates` services the old `/wallet` namespace did. A clinic opts in via **"Join Temetro
+  Network"** (Settings → Signing → `PUT /api/signing/network`, `clinic_signing_keys.network_enabled`);
+  `connectOrg`/`disconnectOrg` open/close its connection, and wallet routes 409 when it's off.
 - **`src/lib/email.ts`** — `sendEmail` logs links to the console when SMTP is unset.
 
 ## Gotchas / conventions

backend/docker-compose.yml

@@ -68,6 +68,11 @@ services:
       BETTER_AUTH_URL: http://localhost:4000
       FRONTEND_URL: http://localhost:3000
       PORT: "4000"
+      # Temetro Network relay (github.com/temetro/temetro-network). Set RELAY_URL
+      # to your deployed relay's public URL and RELAY_TOKEN to the shared secret
+      # you configured on it — both are required for patient-wallet import.
+      RELAY_URL: ${RELAY_URL:-}
+      RELAY_TOKEN: ${RELAY_TOKEN:-}
       NODE_ENV: production
       # Uploaded patient/lab files live here, on the temetro_uploads volume.
       UPLOAD_DIR: /var/lib/temetro/uploads

backend/drizzle/0031_stiff_gateway.sql

@@ -0,0 +1,15 @@
+CREATE TABLE "fhir_api_keys" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" text NOT NULL,
+	"name" text NOT NULL,
+	"key_hash" text NOT NULL,
+	"created_by" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"last_used_at" timestamp,
+	"revoked_at" timestamp,
+	CONSTRAINT "fhir_api_keys_key_hash_unique" UNIQUE("key_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "fhir_api_keys" ADD CONSTRAINT "fhir_api_keys_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "fhir_api_keys" ADD CONSTRAINT "fhir_api_keys_created_by_user_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "fhir_api_keys_org_idx" ON "fhir_api_keys" USING btree ("organization_id");

backend/drizzle/0032_closed_dakota_north.sql

@@ -0,0 +1 @@
+ALTER TABLE "clinic_signing_keys" ADD COLUMN "network_enabled" boolean DEFAULT false NOT NULL;

backend/drizzle/0033_ambitious_reavers.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "patients" ADD COLUMN "phone" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "patients" ADD COLUMN "blood_type" text DEFAULT '' NOT NULL;

backend/drizzle/0034_chunky_blacklash.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "clinic_settings" (
+	"organization_id" text PRIMARY KEY NOT NULL,
+	"address" text DEFAULT '' NOT NULL,
+	"city" text DEFAULT '' NOT NULL,
+	"country" text DEFAULT '' NOT NULL,
+	"latitude" double precision,
+	"longitude" double precision,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "clinic_settings" ADD CONSTRAINT "clinic_settings_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;

backend/drizzle/meta/_journal.json

@@ -218,6 +218,34 @@
       "when": 1783093188246,
       "tag": "0030_medical_blur",
       "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "7",
+      "when": 1783117115021,
+      "tag": "0031_stiff_gateway",
+      "breakpoints": true
+    },
+    {
+      "idx": 32,
+      "version": "7",
+      "when": 1783263738631,
+      "tag": "0032_closed_dakota_north",
+      "breakpoints": true
+    },
+    {
+      "idx": 33,
+      "version": "7",
+      "when": 1783362745730,
+      "tag": "0033_ambitious_reavers",
+      "breakpoints": true
+    },
+    {
+      "idx": 34,
+      "version": "7",
+      "when": 1783363217049,
+      "tag": "0034_chunky_blacklash",
+      "breakpoints": true
     }
   ]
 }

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "temetro-backend",
-  "version": "0.1.0",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "temetro-backend",
-      "version": "0.1.0",
+      "version": "0.6.0",
       "license": "MIT",
       "dependencies": {
         "@ai-sdk/anthropic": "^3.0.84",
@@ -28,6 +28,7 @@
         "nodemailer": "^8.0.10",
         "pg": "^8.21.0",
         "socket.io": "^4.8.3",
+        "socket.io-client": "^4.8.3",
         "zod": "^4.4.3"
       },
       "devDependencies": {
@@ -3339,6 +3340,40 @@
         "node": ">=10.2.0"
       }
     },
+    "node_modules/engine.io-client": {
+      "version": "6.6.6",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.6.tgz",
+      "integrity": "sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-parser": "~5.2.1",
+        "ws": "~8.21.0",
+        "xmlhttprequest-ssl": "~2.1.1"
+      }
+    },
+    "node_modules/engine.io-client/node_modules/ws": {
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/engine.io-parser": {
       "version": "5.2.3",
       "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz",
@@ -4947,6 +4982,21 @@
         "ws": "~8.20.1"
       }
     },
+    "node_modules/socket.io-client": {
+      "version": "4.8.3",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
+      "integrity": "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-client": "~6.6.1",
+        "socket.io-parser": "~4.2.4"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/socket.io-parser": {
       "version": "4.2.6",
       "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
@@ -5779,6 +5829,14 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/xmlhttprequest-ssl": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.1.2.tgz",
+      "integrity": "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/xtend": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "temetro-backend",
-  "version": "0.5.0",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "description": "temetro backend — Express + Postgres API with Better Auth (email/password, organizations) and org-scoped patient records.",
@@ -41,6 +41,7 @@
     "nodemailer": "^8.0.10",
     "pg": "^8.21.0",
     "socket.io": "^4.8.3",
+    "socket.io-client": "^4.8.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {

backend/src/db/schema/clinic-settings.ts

@@ -0,0 +1,25 @@
+import { doublePrecision, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+import { organization } from "./auth.js";
+
+// Per-clinic (organization) settings. Currently holds the clinic's physical
+// location — a free-text address plus optional map coordinates — set in
+// Settings → Location by an owner/admin and surfaced to patients in the wallet
+// app later (e.g. a map pin for a clinic that shared a record). One row per org
+// (PK = organizationId), mirroring `clinic_signing_keys`.
+export const clinicSettings = pgTable("clinic_settings", {
+  organizationId: text("organization_id")
+    .primaryKey()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  address: text("address").notNull().default(""),
+  city: text("city").notNull().default(""),
+  country: text("country").notNull().default(""),
+  // Optional map coordinates (WGS84). Null until the clinic sets them.
+  latitude: doublePrecision("latitude"),
+  longitude: doublePrecision("longitude"),
+  createdAt: timestamp("created_at").defaultNow().notNull(),
+  updatedAt: timestamp("updated_at")
+    .defaultNow()
+    .$onUpdate(() => new Date())
+    .notNull(),
+});

backend/src/db/schema/fhir-keys.ts

@@ -0,0 +1,30 @@
+import { index, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+import { organization, user } from "./auth.js";
+
+// Per-organization API keys for the read-only FHIR R4 server (`/fhir`). These
+// are machine-to-machine credentials (no Better Auth session): a caller sends
+// `Authorization: Bearer tmf_<secret>` and every query is scoped to the owning
+// clinic. Only the SHA-256 *hash* of the secret is stored — the plaintext key is
+// shown once at creation and never again. Revoking sets `revokedAt` (kept for
+// audit rather than hard-deleted).
+export const fhirApiKeys = pgTable(
+  "fhir_api_keys",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    // Hex SHA-256 of the full `tmf_…` secret. Unique so a lookup is a single
+    // indexed probe and two keys can never collide.
+    keyHash: text("key_hash").notNull().unique(),
+    createdBy: text("created_by").references(() => user.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    lastUsedAt: timestamp("last_used_at"),
+    revokedAt: timestamp("revoked_at"),
+  },
+  (t) => [index("fhir_api_keys_org_idx").on(t.organizationId)],
+);

backend/src/db/schema/index.ts

@@ -20,5 +20,7 @@ export * from "./integrations.js";
 export * from "./staff-profile.js";
 export * from "./meetings.js";
 export * from "./signing.js";
+export * from "./clinic-settings.js";
 export * from "./wallet-share.js";
 export * from "./wallet-updates.js";
+export * from "./fhir-keys.js";

backend/src/db/schema/patients.ts

@@ -36,6 +36,11 @@ export const patients = pgTable(
     pcp: text("pcp").notNull(),
     status: text("status").$type<PatientStatus>().notNull(),
     initials: text("initials").notNull(),
+    // Contact + clinical demographics. `phone` is a contact/registration field
+    // (reception may read/write it); `bloodType` is clinical (redacted for the
+    // reception role, like allergies/vitals).
+    phone: text("phone").notNull().default(""),
+    bloodType: text("blood_type").notNull().default(""),
     alerts: jsonb("alerts").$type<string[]>().notNull(),
     vitalsBp: text("vitals_bp").notNull(),
     vitalsHr: text("vitals_hr").notNull(),

backend/src/db/schema/signing.ts

@@ -1,4 +1,4 @@
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
 
 import { organization } from "./auth.js";
 
@@ -16,6 +16,11 @@ export const clinicSigningKeys = pgTable("clinic_signing_keys", {
   fingerprint: text("fingerprint").notNull(),
   // Encrypted (lib/crypto.ts) hex of the Ed25519 private key.
   privateKeyEnc: text("private_key_enc").notNull(),
+  // Whether this clinic has joined the Temetro Network relay ("Join Temetro
+  // Network" in Settings → Signing). Off by default: only when enabled does the
+  // backend open this clinic's relay hub connection and expose wallet features.
+  // The relay identity *is* this signing key, so the flag lives on the same row.
+  networkEnabled: boolean("network_enabled").notNull().default(false),
   createdAt: timestamp("created_at").defaultNow().notNull(),
   rotatedAt: timestamp("rotated_at"),
 });

backend/src/env.ts

@@ -28,6 +28,19 @@ const schema = z.object({
   // Overrides the version reported by GET /api/version. Normally derived from
   // package.json; the release pipeline can pin it explicitly.
   APP_VERSION: z.string().optional(),
+  // Temetro Network relay (github.com/temetro/temetro-network). Both this
+  // backend and patient phones connect to it; it routes the encrypted wallet
+  // messages between them. RELAY_URL is the relay's public URL (also baked into
+  // the QR a patient scans). Each clinic authenticates to the relay's /hub with
+  // its own Ed25519 signing key, so no shared secret is needed. RELAY_TOKEN is
+  // now *optional/legacy* — set it only for a private relay that also gates on a
+  // shared token (must then match the relay's RELAY_TOKEN).
+  //
+  // Defaults to the hosted relay so "Join Temetro Network" works out of the box;
+  // override only when running your own relay. (A `localhost` default silently
+  // fails inside Docker, where localhost is the container itself.)
+  RELAY_URL: z.string().min(1).default("https://network.temetro.com"),
+  RELAY_TOKEN: z.string().default(""),
   // Public, device-reachable URL of this backend's wallet relay, baked into the
   // QR a patient scans. Optional — when unset we derive it from the request host
   // (so opening the web app over the LAN yields a reachable LAN URL).
@@ -80,6 +93,9 @@ if (env.NODE_ENV === "production") {
     );
     process.exit(1);
   }
+  // RELAY_TOKEN is optional now: clinics authenticate to the relay with their
+  // own Ed25519 signing key, so an unset token is the normal "open relay" case —
+  // no warning needed.
 }
 
 export const isProd = env.NODE_ENV === "production";

backend/src/index.ts

@@ -16,8 +16,10 @@ import { analyticsRouter } from "./routes/analytics.js";
 import { attachmentsRouter } from "./routes/attachments.js";
 import { appointmentsRouter } from "./routes/appointments.js";
 import { chatRouter } from "./routes/chat.js";
+import { clinicRouter } from "./routes/clinic.js";
 import { conversationsRouter } from "./routes/conversations.js";
 import { dispensesRouter } from "./routes/dispenses.js";
+import { fhirRouter } from "./routes/fhir.js";
 import { integrationsRouter } from "./routes/integrations.js";
 import { inventoryRouter } from "./routes/inventory.js";
 import { invoicesRouter } from "./routes/invoices.js";
@@ -35,6 +37,7 @@ import { staffRouter } from "./routes/staff.js";
 import { networkRouter } from "./routes/network.js";
 import { tasksRouter } from "./routes/tasks.js";
 import { versionRouter } from "./routes/version.js";
+import { initRelayClient } from "./services/relay-client.js";
 import { beginQuickTunnelDiscovery } from "./services/relay-url.js";
 import { sweepExpiredShares } from "./services/wallet-share.js";
 
@@ -88,6 +91,7 @@ app.use("/api/network", networkRouter);
 app.use("/api/patients/wallet", patientsWalletRouter);
 app.use("/api/patients", patientsRouter);
 app.use("/api/signing", signingRouter);
+app.use("/api/clinic", clinicRouter);
 app.use("/api/attachments", attachmentsRouter);
 app.use("/api/notes", notesRouter);
 app.use("/api/appointments", appointmentsRouter);
@@ -110,6 +114,11 @@ app.use("/api/integrations", integrationsRouter);
 app.use("/api/portal", portalRouter);
 app.use("/api/auth-helpers", authHelpersRouter);
 
+// Read-only FHIR R4 server, mounted OUTSIDE /api. Bearer-only (per-clinic API
+// keys), no Better Auth session/cookie coupling. Errors are FHIR
+// OperationOutcomes, not our standard error JSON.
+app.use("/fhir", fhirRouter);
+
 app.use(notFound);
 app.use(errorHandler);
 
@@ -117,6 +126,11 @@ app.use(errorHandler);
 const server = createServer(app);
 initRealtime(server);
 
+// Connect to the Temetro Network relay (the device-facing hub). Patient phones
+// no longer connect to this backend directly — they connect to the relay, and
+// we push to / receive from them over its /hub namespace.
+initRelayClient();
+
 // Sweep expired temporary patient-wallet shares (auto-delete) every 5 minutes.
 const SHARE_SWEEP_INTERVAL = 5 * 60 * 1000;
 setInterval(() => {
@@ -146,8 +160,9 @@ server.listen(env.PORT, () => {
   console.log(`  • chat:     /api/chat  (LLM agent)`);
   console.log(`  • integr.:  /api/integrations  (FHIR / e-Rx / claims)`);
   console.log(`  • portal:   /api/portal  (public clinic kiosk)`);
+  console.log(`  • fhir:     /fhir  (read-only FHIR R4 server, API-key auth)`);
   console.log(`  • signing:  /api/signing  (Ed25519 clinic key)`);
-  console.log(`  • wallet:   /api/patients/wallet  (+ /wallet socket relay)`);
+  console.log(`  • wallet:   /api/patients/wallet  (via Temetro Network relay: ${env.RELAY_URL})`);
 });
 
 // Dockerized off-network testing: learn our public Cloudflare quick-tunnel URL

backend/src/lib/patient-validation.ts

@@ -105,6 +105,10 @@ export const patientInputSchema = z
     ),
     status: z.enum(["active", "inpatient", "discharged"]).default("active"),
     initials: z.string().trim().max(4).default(""),
+    phone: z.string().trim().max(30).default(""),
+    bloodType: z
+      .enum(["A+", "A-", "B+", "B-", "AB+", "AB-", "O+", "O-", ""])
+      .default(""),
     allergies: z.array(allergySchema).default([]),
     alerts: z.array(z.string()).default([]),
     medications: z.array(medicationSchema).default([]),

backend/src/middleware/fhir-auth.ts

@@ -0,0 +1,49 @@
+import type { NextFunction, Request, Response } from "express";
+
+import { resolveKey } from "../services/fhir-server/keys.js";
+import {
+  FHIR_CONTENT_TYPE,
+  operationOutcome,
+} from "../services/fhir-server/outcome.js";
+
+// Bearer-token auth for the read-only FHIR server. Unlike the rest of the API
+// (Better Auth session cookies), the `/fhir` endpoints authenticate with a
+// per-clinic API key: `Authorization: Bearer tmf_<secret>`. On success the
+// caller's organization is attached to `req.organizationId` and every downstream
+// query is scoped to it. Failures return a FHIR OperationOutcome, not our
+// standard error JSON.
+export async function requireFhirKey(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> {
+  const header = req.headers.authorization ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  const secret = match?.[1]?.trim();
+
+  const unauthorized = (diagnostics: string) => {
+    res
+      .status(401)
+      .type(FHIR_CONTENT_TYPE)
+      .set("WWW-Authenticate", "Bearer")
+      .json(operationOutcome("error", "login", diagnostics));
+  };
+
+  if (!secret) {
+    unauthorized("Missing bearer token. Send Authorization: Bearer tmf_…");
+    return;
+  }
+
+  try {
+    const resolved = await resolveKey(secret);
+    if (!resolved) {
+      unauthorized("Invalid or revoked API key.");
+      return;
+    }
+    req.organizationId = resolved.orgId;
+    req.fhirKey = { id: resolved.keyId, name: resolved.keyName };
+    next();
+  } catch (err) {
+    next(err);
+  }
+}

backend/src/realtime.ts

@@ -1,17 +1,14 @@
 import type { Server as HttpServer } from "node:http";
 
 import { fromNodeHeaders } from "better-auth/node";
-import { bytesToHex, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 import { Server, type Socket } from "socket.io";
 
 import { auth } from "./auth.js";
 import { env } from "./env.js";
-import { decodeWalletNumber, verifySignature } from "./lib/wallet-crypto.js";
 import * as meetings from "./services/meetings.js";
 import * as messaging from "./services/messaging.js";
 import { createNotification } from "./services/notifications.js";
-import * as walletShare from "./services/wallet-share.js";
-import * as walletUpdates from "./services/wallet-updates.js";
+import { sendToWallet } from "./services/relay-client.js";
 import type { MessageAttachment } from "./types/messaging.js";
 
 let io: Server | null = null;
@@ -20,7 +17,6 @@ const userRoom = (userId: string) => `user:${userId}`;
 const convRoom = (conversationId: string) => `conv:${conversationId}`;
 const callRoom = (roomId: string) => `call:${roomId}`;
 const orgRoom = (orgId: string) => `org:${orgId}`;
-const walletRoom = (walletNumber: string) => `wallet:${walletNumber}`;
 
 // Mesh WebRTC tops out around four peers (each sends its stream to every other);
 // past that the room is closed to new joiners.
@@ -44,15 +40,18 @@ export function emitToConversation(
   io?.to(convRoom(conversationId)).emit(event, data);
 }
 
-// Relay an end-to-end-encrypted message to a patient wallet device (the /wallet
-// namespace, room keyed by wallet number). The relay only ever forwards
-// ciphertext — it cannot read the record bundle.
+// Relay an end-to-end-encrypted message to a patient wallet device. Devices no
+// longer connect to this server directly — they connect to the standalone
+// Temetro Network relay, which forwards to the room keyed by wallet number. We
+// push over the relay's /hub namespace (see services/relay-client.ts). The
+// relay only ever forwards ciphertext — it cannot read the record bundle.
 export function emitToWallet(
+  orgId: string,
   walletNumber: string,
   event: string,
   data: unknown,
 ): void {
-  io?.of("/wallet").to(walletRoom(walletNumber)).emit(event, data);
+  sendToWallet(orgId, walletNumber, event, data);
 }
 
 type Ack = (response: { ok: boolean; [key: string]: unknown }) => void;
@@ -286,151 +285,5 @@ export function initRealtime(httpServer: HttpServer): Server {
     });
   });
 
-  // --- Patient wallet relay (/wallet namespace) ----------------------------
-  // Devices have no clinic session, so this namespace is NOT cookie-gated.
-  // Instead a device proves control of its wallet keypair: the server issues a
-  // random challenge, the device signs it with its Ed25519 key, and only then
-  // may it join its own wallet room. The relay forwards encrypted share
-  // requests/responses without ever reading the record bundle.
-  const walletNs = io.of("/wallet");
-  walletNs.on("connection", (socket: Socket) => {
-    const challenge = bytesToHex(randomBytes(32));
-    socket.data.challenge = challenge;
-    socket.data.walletNumber = null as string | null;
-    socket.emit("wallet:challenge", { challenge });
-
-    socket.on(
-      "wallet:auth",
-      (payload: { walletNumber?: string; signature?: string }, ack?: Ack) => {
-        try {
-          const walletNumber = String(payload?.walletNumber ?? "");
-          const signature = String(payload?.signature ?? "");
-          const publicKey = decodeWalletNumber(walletNumber);
-          const ok = verifySignature(
-            publicKey,
-            signature,
-            utf8ToBytes(socket.data.challenge as string),
-          );
-          if (!ok) {
-            ack?.({ ok: false });
-            return;
-          }
-          socket.data.walletNumber = walletNumber;
-          socket.join(walletRoom(walletNumber));
-          ack?.({ ok: true });
-          // Deliver any record updates the device missed while offline. Sent
-          // after the ack so the client is ready to receive them.
-          void walletUpdates
-            .pendingUpdatesForWallet(walletNumber)
-            .then(async (rows) => {
-              for (const row of rows) {
-                socket.emit("wallet:update-request", await walletUpdates.toEvent(row));
-                await walletUpdates.markDelivered(row.id);
-              }
-            })
-            .catch(() => {});
-        } catch {
-          ack?.({ ok: false });
-        }
-      },
-    );
-
-    // The patient approved/denied a clinic→wallet record update on their device.
-    // We verify the wallet's signature over the decision and resolve the row.
-    socket.on(
-      "wallet:update-response",
-      async (
-        payload: {
-          requestId?: string;
-          walletNumber?: string;
-          decision?: "approved" | "denied";
-          signature?: string;
-        },
-        ack?: Ack,
-      ) => {
-        try {
-          if (
-            !socket.data.walletNumber ||
-            socket.data.walletNumber !== payload?.walletNumber
-          ) {
-            ack?.({ ok: false });
-            return;
-          }
-          const view = await walletUpdates.applyUpdateResponse(
-            String(payload?.requestId ?? ""),
-            String(payload?.walletNumber ?? ""),
-            payload?.decision === "approved" ? "approved" : "denied",
-            payload?.signature,
-          );
-          ack?.({ ok: !!view });
-        } catch (err) {
-          ack?.({ ok: false, error: (err as Error).message });
-        }
-      },
-    );
-
-    // The patient approved/denied a share on their device; the sealed bundle (if
-    // approved) rides along and is decrypted + verified server-side.
-    socket.on(
-      "wallet:share-response",
-      async (
-        payload: {
-          requestId?: string;
-          walletNumber?: string;
-          decision?: "approved" | "denied";
-          sealed?: string;
-          signature?: string;
-        },
-        ack?: Ack,
-      ) => {
-        try {
-          if (
-            !socket.data.walletNumber ||
-            socket.data.walletNumber !== payload?.walletNumber
-          ) {
-            ack?.({ ok: false });
-            return;
-          }
-          const view = await walletShare.applyShareResponse(
-            String(payload?.requestId ?? ""),
-            String(payload?.walletNumber ?? ""),
-            payload?.decision === "approved" ? "approved" : "denied",
-            payload?.sealed,
-            payload?.signature,
-          );
-          ack?.({ ok: !!view });
-        } catch (err) {
-          ack?.({ ok: false, error: (err as Error).message });
-        }
-      },
-    );
-
-    // The patient revoked a previously shared record; delete it from the clinic.
-    socket.on(
-      "wallet:revoke",
-      async (
-        payload: { requestId?: string; walletNumber?: string },
-        ack?: Ack,
-      ) => {
-        try {
-          if (
-            !socket.data.walletNumber ||
-            socket.data.walletNumber !== payload?.walletNumber
-          ) {
-            ack?.({ ok: false });
-            return;
-          }
-          const result = await walletShare.revokeShare(
-            String(payload?.requestId ?? ""),
-            String(payload?.walletNumber ?? ""),
-          );
-          ack?.({ ok: !!result });
-        } catch {
-          ack?.({ ok: false });
-        }
-      },
-    );
-  });
-
   return io;
 }

backend/src/routes/clinic.ts

@@ -0,0 +1,61 @@
+import { Router } from "express";
+import { z } from "zod";
+
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import * as clinicSettings from "../services/clinic-settings.js";
+
+export const clinicRouter = Router();
+
+clinicRouter.use(requireAuth, requireOrg);
+
+// The clinic's settings (currently just its location). Readable by any
+// clinician so the app/UI can display the clinic address.
+clinicRouter.get(
+  "/settings",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await clinicSettings.getClinicSettings(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+// Set the clinic's location — owner/admin only (gated on the org-update
+// statement, same as signing-key rotation / network toggle).
+const locationSchema = z.object({
+  address: z.string().trim().max(200).default(""),
+  city: z.string().trim().max(120).default(""),
+  country: z.string().trim().max(120).default(""),
+  latitude: z.number().min(-90).max(90).nullable().default(null),
+  longitude: z.number().min(-180).max(180).nullable().default(null),
+});
+
+clinicRouter.put(
+  "/location",
+  requirePermission({ organization: ["update"] }),
+  async (req, res, next) => {
+    try {
+      const location = locationSchema.parse(req.body);
+      const view = await clinicSettings.setClinicLocation(
+        req.organizationId!,
+        location,
+      );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Updated the clinic location",
+        entityType: "settings",
+      });
+      res.json(view);
+    } catch (err) {
+      next(err);
+    }
+  },
+);

backend/src/routes/fhir.ts

@@ -0,0 +1,275 @@
+import { createRequire } from "node:module";
+
+import { Router } from "express";
+import type { Request, Response } from "express";
+import type { ParsedQs } from "qs";
+
+import { env } from "../env.js";
+import { requireFhirKey } from "../middleware/fhir-auth.js";
+import { recordActivity } from "../services/activity.js";
+import {
+  paginate,
+  parseCount,
+  parseOffset,
+  searchsetBundle,
+} from "../services/fhir-server/bundle.js";
+import { capabilityStatement } from "../services/fhir-server/capability.js";
+import {
+  FHIR_CONTENT_TYPE,
+  operationOutcome,
+  type IssueCode,
+  type IssueSeverity,
+} from "../services/fhir-server/outcome.js";
+import * as q from "../services/fhir-server/queries.js";
+import {
+  allergyResource,
+  appointmentResource,
+  conditionResource,
+  encounterResource,
+  labObservation,
+  medicationRequestResource,
+  patientResource,
+  vitalObservations,
+  type FhirResource,
+} from "../services/fhir-server/resources.js";
+
+const require = createRequire(import.meta.url);
+const pkg = require("../../package.json") as { version?: string };
+const VERSION = env.APP_VERSION ?? pkg.version ?? "0.0.0";
+
+export const fhirRouter = Router();
+
+// --- helpers ----------------------------------------------------------------
+
+function baseUrl(req: Request): string {
+  return `${req.protocol}://${req.get("host")}/fhir`;
+}
+
+function sendResource(res: Response, resource: unknown): void {
+  res.type(FHIR_CONTENT_TYPE).json(resource);
+}
+
+function sendOutcome(
+  res: Response,
+  status: number,
+  severity: IssueSeverity,
+  code: IssueCode,
+  diagnostics: string,
+): void {
+  res
+    .status(status)
+    .type(FHIR_CONTENT_TYPE)
+    .json(operationOutcome(severity, code, diagnostics));
+}
+
+function qstr(v: string | ParsedQs | (string | ParsedQs)[] | undefined): string | undefined {
+  if (typeof v === "string") return v.trim() || undefined;
+  if (Array.isArray(v) && typeof v[0] === "string") return v[0].trim() || undefined;
+  return undefined;
+}
+
+// Best-effort audit: every FHIR request is logged with the key name + result
+// count, scoped to the org. Access to PHI over the API must leave a trail.
+function audit(req: Request, resourceType: string, count: number): void {
+  void recordActivity({
+    orgId: req.organizationId!,
+    actor: { name: `FHIR API · ${req.fhirKey?.name ?? "key"}` },
+    action: `Read ${resourceType} via the FHIR API (${count} result${count === 1 ? "" : "s"})`,
+    entityType: "patient",
+  });
+}
+
+// Materialize a page from a full resource array + emit a searchset Bundle.
+function respondSearch(
+  req: Request,
+  res: Response,
+  resourceType: string,
+  all: FhirResource[],
+): void {
+  const count = parseCount(qstr(req.query._count as never));
+  const offset = parseOffset(qstr(req.query._offset as never));
+  const { page, total } = paginate(all, count, offset);
+  const params = new URLSearchParams();
+  for (const [k, v] of Object.entries(req.query)) {
+    if (k === "_count" || k === "_offset") continue;
+    const s = qstr(v as never);
+    if (s !== undefined) params.set(k, s);
+  }
+  audit(req, resourceType, total);
+  sendResource(
+    res,
+    searchsetBundle({ baseUrl: baseUrl(req), resourceType, page, total, count, offset, params }),
+  );
+}
+
+// Resolve the `patient` / `patient.identifier` search parameter to a patient row
+// (org-scoped). Returns undefined when the param is absent or matches nobody.
+async function patientFromQuery(req: Request) {
+  const patientId = qstr(req.query.patient as never);
+  const identifier = qstr(req.query["patient.identifier"] as never);
+  if (!patientId && !identifier) return undefined;
+  return q.resolvePatientRef(req.organizationId!, { patientId, identifier });
+}
+
+// --- CapabilityStatement (unauthenticated, per FHIR convention) -------------
+
+fhirRouter.get("/metadata", (req, res) => {
+  sendResource(res, capabilityStatement(baseUrl(req), VERSION));
+});
+
+// Everything below requires a valid per-clinic API key.
+fhirRouter.use(requireFhirKey);
+
+// --- Patient ----------------------------------------------------------------
+
+fhirRouter.get("/Patient", async (req, res, next) => {
+  try {
+    const count = parseCount(qstr(req.query._count as never));
+    const offset = parseOffset(qstr(req.query._offset as never));
+    const { rows, total } = await q.searchPatients(req.organizationId!, {
+      identifier: qstr(req.query.identifier as never),
+      name: qstr(req.query.name as never),
+      limit: count,
+      offset,
+    });
+    const params = new URLSearchParams();
+    if (qstr(req.query.identifier as never))
+      params.set("identifier", qstr(req.query.identifier as never)!);
+    if (qstr(req.query.name as never)) params.set("name", qstr(req.query.name as never)!);
+    audit(req, "Patient", total);
+    sendResource(
+      res,
+      searchsetBundle({
+        baseUrl: baseUrl(req),
+        resourceType: "Patient",
+        page: rows.map(patientResource),
+        total,
+        count,
+        offset,
+        params,
+      }),
+    );
+  } catch (err) {
+    next(err);
+  }
+});
+
+fhirRouter.get("/Patient/:id", async (req, res, next) => {
+  try {
+    const row = await q.patientById(req.organizationId!, String(req.params.id));
+    if (!row) {
+      sendOutcome(res, 404, "error", "not-found", "Patient not found.");
+      return;
+    }
+    audit(req, "Patient", 1);
+    sendResource(res, patientResource(row));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Observation (labs + vitals) --------------------------------------------
+
+fhirRouter.get("/Observation", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) {
+      respondSearch(req, res, "Observation", []);
+      return;
+    }
+    const category = qstr(req.query.category as never);
+    const all: FhirResource[] = [];
+    if (category !== "vital-signs") {
+      const rows = await q.labsForPatient(patient.id);
+      all.push(...rows.map((r) => labObservation(r, patient)));
+    }
+    if (category !== "laboratory") {
+      all.push(...vitalObservations(patient));
+    }
+    respondSearch(req, res, "Observation", all);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- AllergyIntolerance -----------------------------------------------------
+
+fhirRouter.get("/AllergyIntolerance", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "AllergyIntolerance", []);
+    const rows = await q.allergiesForPatient(patient.id);
+    respondSearch(req, res, "AllergyIntolerance", rows.map((r) => allergyResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Condition --------------------------------------------------------------
+
+fhirRouter.get("/Condition", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Condition", []);
+    const rows = await q.problemsForPatient(patient.id);
+    respondSearch(req, res, "Condition", rows.map((r) => conditionResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- MedicationRequest ------------------------------------------------------
+
+fhirRouter.get("/MedicationRequest", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "MedicationRequest", []);
+    const rows = await q.prescriptionsForFile(req.organizationId!, patient.fileNumber);
+    respondSearch(
+      req,
+      res,
+      "MedicationRequest",
+      rows.map((r) => medicationRequestResource(r, patient)),
+    );
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Encounter --------------------------------------------------------------
+
+fhirRouter.get("/Encounter", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Encounter", []);
+    const rows = await q.encountersForPatient(patient.id);
+    respondSearch(req, res, "Encounter", rows.map((r) => encounterResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Appointment ------------------------------------------------------------
+
+fhirRouter.get("/Appointment", async (req, res, next) => {
+  try {
+    const patient = await patientFromQuery(req);
+    if (!patient) return respondSearch(req, res, "Appointment", []);
+    const rows = await q.appointmentsForFile(req.organizationId!, patient.fileNumber);
+    respondSearch(req, res, "Appointment", rows.map((r) => appointmentResource(r, patient)));
+  } catch (err) {
+    next(err);
+  }
+});
+
+// --- Unknown resource / path -> OperationOutcome ----------------------------
+
+fhirRouter.use((req, res) => {
+  sendOutcome(
+    res,
+    404,
+    "error",
+    "not-supported",
+    `Unsupported FHIR path or resource: ${req.method} ${req.path}.`,
+  );
+});

backend/src/routes/integrations.ts

@@ -18,6 +18,7 @@ import {
   listConfigs,
   saveConfig,
 } from "../services/integrations/config.js";
+import { createKey, listKeys, revokeKey } from "../services/fhir-server/keys.js";
 import * as eprescribe from "../services/integrations/eprescribe.js";
 import * as fhir from "../services/integrations/fhir.js";
 
@@ -119,6 +120,75 @@ integrationsRouter.post(
   },
 );
 
+// --- FHIR server API keys (owner/admin only) --------------------------------
+// These credential the read-only /fhir server. The plaintext secret is returned
+// exactly once (on creation) and only its hash is stored.
+
+integrationsRouter.get(
+  "/fhir-server/keys",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      res.json(await listKeys(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+const createKeySchema = z.object({ name: z.string().trim().min(1).max(120) });
+
+integrationsRouter.post(
+  "/fhir-server/keys",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      const { name } = createKeySchema.parse(req.body);
+      const { secret, key } = await createKey(
+        req.organizationId!,
+        name,
+        req.user!.id,
+      );
+      void recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created a FHIR API key ("${key.name}")`,
+        entityType: "settings",
+      });
+      // `secret` is present only in this response — the client must show it now.
+      res.status(201).json({ ...key, secret });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+integrationsRouter.delete(
+  "/fhir-server/keys/:id",
+  requireAuth,
+  requireOrg,
+  async (req, res, next) => {
+    try {
+      assertAdmin(req.memberRole);
+      const revoked = await revokeKey(req.organizationId!, String(req.params.id));
+      if (!revoked) throw new HttpError(404, "API key not found.");
+      void recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Revoked a FHIR API key",
+        entityType: "settings",
+      });
+      res.json({ revoked: true });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
 // --- Actions ----------------------------------------------------------------
 
 const syncSchema = z.object({ fileNumber: z.string().trim().min(1) });

backend/src/routes/patients-wallet.ts

@@ -17,8 +17,10 @@ import {
 } from "../middleware/auth.js";
 import { emitToWallet } from "../realtime.js";
 import { recordActivity } from "../services/activity.js";
+import { connectOrg, expectResponse } from "../services/relay-client.js";
 import * as patientService from "../services/patients.js";
 import { awaitQuickTunnelUrl } from "../services/relay-url.js";
+import { getNetworkEnabled } from "../services/signing.js";
 import * as walletShare from "../services/wallet-share.js";
 import * as walletUpdates from "../services/wallet-updates.js";
 
@@ -26,10 +28,25 @@ export const patientsWalletRouter = Router();
 
 patientsWalletRouter.use(requireAuth, requireOrg);
 
+// Wallet sharing rides the Temetro Network relay, which a clinic must opt into
+// ("Join Temetro Network" in Settings → Signing). Guard the actions that need a
+// live relay connection so a disabled clinic gets a clear message, not silence.
+async function requireNetwork(orgId: string): Promise<void> {
+  if (!(await getNetworkEnabled(orgId))) {
+    throw new HttpError(
+      409,
+      "This clinic hasn't joined the Temetro Network. Enable it in Settings → Signing to share with patient wallets.",
+    );
+  }
+}
+
 // The device-reachable URL the patient's app should connect to (baked into the
-// QR). Prefer an explicit PUBLIC_RELAY_URL; otherwise derive it from the request
-// host so that opening the web app over the LAN yields a reachable LAN URL.
+// QR). Devices connect to the standalone Temetro Network relay — the same relay
+// this backend is hubbed to — so RELAY_URL is the canonical answer. The legacy
+// PUBLIC_RELAY_URL / cloudflared / request-host fallbacks remain for pre-relay
+// self-hosting.
 async function resolveRelayUrl(req: Request): Promise<string> {
+  if (env.RELAY_URL) return env.RELAY_URL;
   if (env.PUBLIC_RELAY_URL) return env.PUBLIC_RELAY_URL;
   // A cloudflared quick tunnel (`npm run docker:tunnel`). Wait briefly for it to
   // become reachable so the QR never carries a not-yet-live URL.
@@ -68,6 +85,7 @@ patientsWalletRouter.post(
   requirePermission({ patient: ["write"] }),
   async (req, res, next) => {
     try {
+      await requireNetwork(req.organizationId!);
       const input = pairSchema.parse(req.body);
       const { view, ephemeralPubKey } = await walletShare.createPairingRequest(
         req.organizationId!,
@@ -75,6 +93,12 @@ patientsWalletRouter.post(
         input.mode,
         input.durationHours,
       );
+      // No wallet number to `wallet:send` to yet, so pre-register the request id
+      // with the relay so the scanning device's response routes back to us.
+      // Ensure the hub is (re)connected first; if it's still mid-handshake the
+      // on-auth re-registration of pending requests will catch this one.
+      await connectOrg(req.organizationId!);
+      expectResponse(req.organizationId!, view.id);
       res.status(201).json({
         ...view,
         ephemeralPubKey,
@@ -94,6 +118,7 @@ patientsWalletRouter.post(
   requirePermission({ patient: ["write"] }),
   async (req, res, next) => {
     try {
+      await requireNetwork(req.organizationId!);
       const input = requestSchema.parse(req.body);
       const { view, ephemeralPubKey } = await walletShare.createShareRequest(
         req.organizationId!,
@@ -106,7 +131,7 @@ patientsWalletRouter.post(
         .select({ name: organization.name })
         .from(organization)
         .where(eq(organization.id, req.organizationId!));
-      emitToWallet(input.walletNumber, "wallet:share-request", {
+      emitToWallet(req.organizationId!, input.walletNumber, "wallet:share-request", {
         requestId: view.id,
         clinicName: org?.name ?? "A clinic",
         requestedBy: req.user!.name,
@@ -173,6 +198,7 @@ patientsWalletRouter.post(
   requirePermission({ patient: ["write"] }),
   async (req, res, next) => {
     try {
+      await requireNetwork(req.organizationId!);
       const input = pushSchema.parse(req.body);
       const row = await walletUpdates.createRecordUpdate(
         req.organizationId!,
@@ -181,7 +207,7 @@ patientsWalletRouter.post(
         input.changes,
       );
       const event = await walletUpdates.toEvent(row);
-      emitToWallet(row.walletNumber, "wallet:update-request", event);
+      emitToWallet(req.organizationId!, row.walletNumber, "wallet:update-request", event);
       await recordActivity({
         orgId: req.organizationId!,
         actor: { id: req.user!.id, name: req.user!.name },

backend/src/routes/portal.ts

@@ -1,9 +1,10 @@
-import { eq } from "drizzle-orm";
+import { and, asc, eq, inArray } from "drizzle-orm";
 import { Router, type Request } from "express";
 import { z } from "zod";
 
 import { db } from "../db/index.js";
-import { organization } from "../db/schema/auth.js";
+import { member, organization, user } from "../db/schema/auth.js";
+import { staffProfile } from "../db/schema/staff-profile.js";
 import { appointmentInputSchema } from "../lib/appointment-validation.js";
 import { HttpError } from "../lib/http-error.js";
 import { initialsFromName } from "../lib/initials.js";
@@ -12,6 +13,10 @@ import { recordActivity } from "../services/activity.js";
 import { createAppointment, listAppointments } from "../services/appointments.js";
 import { createPatient, getPatient } from "../services/patients.js";
 
+// Clinical-capable roles that can be a patient's provider (mirrors
+// staff.ts PROVIDER_ROLES). Department roles (reception, pharmacy, lab) excluded.
+const PROVIDER_ROLES = ["owner", "admin", "doctor", "member"] as const;
+
 // Public, unauthenticated kiosk API for a clinic's Patient Portal (an iPad in the
 // waiting room). Scoped by the clinic slug in the URL — there is no session.
 //
@@ -45,12 +50,76 @@ portalRouter.get("/:clinic", async (req, res, next) => {
   }
 });
 
+// GET /api/portal/:clinic/doctors — public list of the clinic's providers so a
+// patient can pick who to see. Returns only display-safe fields (name +
+// specialty); no ids, emails, or usernames leave this unauthenticated surface.
+portalRouter.get("/:clinic/doctors", async (req, res, next) => {
+  try {
+    const clinic = await resolveClinic(req);
+    const rows = await db
+      .select({ name: user.name, specialty: staffProfile.specialty })
+      .from(member)
+      .innerJoin(user, eq(user.id, member.userId))
+      .leftJoin(
+        staffProfile,
+        and(
+          eq(staffProfile.userId, member.userId),
+          eq(staffProfile.organizationId, member.organizationId),
+        ),
+      )
+      .where(
+        and(
+          eq(member.organizationId, clinic.id),
+          inArray(member.role, PROVIDER_ROLES as unknown as string[]),
+        ),
+      )
+      .orderBy(asc(user.name));
+    res.json(rows.map((r) => ({ name: r.name, specialty: r.specialty ?? null })));
+  } catch (err) {
+    next(err);
+  }
+});
+
+const availabilitySchema = z.object({
+  provider: z.string().trim().max(200).optional(),
+  date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD."),
+});
+
+// GET /api/portal/:clinic/availability?provider=&date= — the taken time slots
+// for a provider on a given day, so the kiosk can render only free slots. The
+// filter mirrors the booking conflict check (an empty-provider appointment
+// blocks the slot clinic-wide). Booking still re-checks server-side (409).
+portalRouter.get("/:clinic/availability", async (req, res, next) => {
+  try {
+    const clinic = await resolveClinic(req);
+    const q = availabilitySchema.parse({
+      provider: req.query.provider,
+      date: req.query.date,
+    });
+    const provider = q.provider ?? "";
+    const taken = (await listAppointments(clinic.id))
+      .filter(
+        (a) =>
+          a.status !== "cancelled" &&
+          a.date === q.date &&
+          (!provider || !a.provider || a.provider === provider),
+      )
+      .map((a) => a.time);
+    res.json({ date: q.date, provider, taken: [...new Set(taken)].sort() });
+  } catch (err) {
+    next(err);
+  }
+});
+
 const bookingSchema = z.object({
   fileNumber: z.string().trim().min(1, "A file number is required.").max(64),
   name: z.string().trim().min(1, "Your name is required.").max(200),
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD."),
   time: z.string().regex(/^\d{2}:\d{2}$/, "Time must be HH:mm."),
   type: z.string().trim().max(120).optional(),
+  // Chosen provider (doctor name) from the portal's doctor picker; falls back
+  // to the patient's PCP when omitted.
+  provider: z.string().trim().max(200).optional(),
 });
 
 const newPatientSchema = z.object({
@@ -114,7 +183,7 @@ portalRouter.post("/:clinic/appointments", async (req, res, next) => {
       date: body.date,
       time: body.time,
       type: body.type || "Self-service booking",
-      provider: patient.pcp || "",
+      provider: body.provider || patient.pcp || "",
       status: "confirmed",
       source: "manual",
     });

backend/src/routes/signing.ts

@@ -1,4 +1,5 @@
 import { Router } from "express";
+import { z } from "zod";
 
 import {
   requireAuth,
@@ -6,6 +7,7 @@ import {
   requirePermission,
 } from "../middleware/auth.js";
 import { recordActivity } from "../services/activity.js";
+import { connectOrg, disconnectOrg } from "../services/relay-client.js";
 import * as signing from "../services/signing.js";
 import * as walletShare from "../services/wallet-share.js";
 
@@ -48,6 +50,52 @@ signingRouter.post(
   },
 );
 
+// Whether this clinic has joined the Temetro Network relay. Readable by any
+// clinician (the panel shows the toggle state + connection status).
+signingRouter.get(
+  "/network",
+  requirePermission({ patient: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json({ enabled: await signing.getNetworkEnabled(req.organizationId!) });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+// Join / leave the Temetro Network — owner/admin only (same gate as key
+// rotation). Enabling opens this clinic's relay hub connection; disabling tears
+// it down.
+const networkSchema = z.object({ enabled: z.boolean() });
+
+signingRouter.put(
+  "/network",
+  requirePermission({ organization: ["update"] }),
+  async (req, res, next) => {
+    try {
+      const { enabled } = networkSchema.parse(req.body);
+      await signing.setNetworkEnabled(req.organizationId!, enabled);
+      if (enabled) {
+        await connectOrg(req.organizationId!);
+      } else {
+        disconnectOrg(req.organizationId!);
+      }
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: enabled
+          ? "Joined the Temetro Network"
+          : "Left the Temetro Network",
+        entityType: "settings",
+      });
+      res.json({ enabled });
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
 // Recent records shared from patient wallets — feeds the panel's shared-records
 // list.
 signingRouter.get(

backend/src/services/clinic-settings.ts

@@ -0,0 +1,82 @@
+import { eq } from "drizzle-orm";
+
+import { db } from "../db/index.js";
+import { clinicSettings } from "../db/schema/clinic-settings.js";
+
+export type ClinicLocation = {
+  address: string;
+  city: string;
+  country: string;
+  latitude: number | null;
+  longitude: number | null;
+};
+
+export type ClinicSettingsView = {
+  location: ClinicLocation;
+};
+
+const EMPTY_LOCATION: ClinicLocation = {
+  address: "",
+  city: "",
+  country: "",
+  latitude: null,
+  longitude: null,
+};
+
+type ClinicSettingsRow = typeof clinicSettings.$inferSelect;
+
+function toView(row: ClinicSettingsRow | undefined): ClinicSettingsView {
+  if (!row) return { location: { ...EMPTY_LOCATION } };
+  return {
+    location: {
+      address: row.address,
+      city: row.city,
+      country: row.country,
+      latitude: row.latitude,
+      longitude: row.longitude,
+    },
+  };
+}
+
+// Read a clinic's settings. Returns empty defaults when no row exists yet, so
+// the panel always renders.
+export async function getClinicSettings(
+  orgId: string,
+): Promise<ClinicSettingsView> {
+  const [row] = await db
+    .select()
+    .from(clinicSettings)
+    .where(eq(clinicSettings.organizationId, orgId))
+    .limit(1);
+  return toView(row);
+}
+
+// Upsert the clinic's location (address + optional coordinates).
+export async function setClinicLocation(
+  orgId: string,
+  location: ClinicLocation,
+): Promise<ClinicSettingsView> {
+  const values = {
+    organizationId: orgId,
+    address: location.address,
+    city: location.city,
+    country: location.country,
+    latitude: location.latitude,
+    longitude: location.longitude,
+  };
+  const [row] = await db
+    .insert(clinicSettings)
+    .values(values)
+    .onConflictDoUpdate({
+      target: clinicSettings.organizationId,
+      set: {
+        address: values.address,
+        city: values.city,
+        country: values.country,
+        latitude: values.latitude,
+        longitude: values.longitude,
+      },
+    })
+    .returning();
+  return toView(row);
+}

backend/src/services/fhir-server/bundle.ts

@@ -0,0 +1,77 @@
+import type { FhirResource } from "./resources.js";
+
+// searchset Bundle assembly + offset/limit pagination for the FHIR server.
+
+export const DEFAULT_COUNT = 50;
+export const MAX_COUNT = 200;
+
+// Clamp a client-supplied `_count` into [1, MAX_COUNT], defaulting when absent.
+export function parseCount(raw: string | undefined): number {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_COUNT;
+  return Math.min(Math.floor(n), MAX_COUNT);
+}
+
+export function parseOffset(raw: string | undefined): number {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return 0;
+  return Math.floor(n);
+}
+
+// Slice an already-materialized resource array to the requested page.
+export function paginate<T>(
+  all: T[],
+  count: number,
+  offset: number,
+): { page: T[]; total: number } {
+  return { page: all.slice(offset, offset + count), total: all.length };
+}
+
+export type SearchsetBundle = {
+  resourceType: "Bundle";
+  type: "searchset";
+  total: number;
+  link: { relation: string; url: string }[];
+  entry: { fullUrl: string; resource: FhirResource; search: { mode: "match" } }[];
+};
+
+// Build a FHIR searchset Bundle. `page` is the current slice; `total` the full
+// match count; `params` the effective query (already carrying `_count`/`_offset`)
+// used to derive self/next/prev links.
+export function searchsetBundle(opts: {
+  baseUrl: string; // e.g. https://host/fhir
+  resourceType: string;
+  page: FhirResource[];
+  total: number;
+  count: number;
+  offset: number;
+  params: URLSearchParams;
+}): SearchsetBundle {
+  const { baseUrl, resourceType, page, total, count, offset, params } = opts;
+
+  const linkFor = (nextOffset: number): string => {
+    const q = new URLSearchParams(params);
+    q.set("_count", String(count));
+    q.set("_offset", String(nextOffset));
+    return `${baseUrl}/${resourceType}?${q.toString()}`;
+  };
+
+  const link: { relation: string; url: string }[] = [
+    { relation: "self", url: linkFor(offset) },
+  ];
+  if (offset + count < total) link.push({ relation: "next", url: linkFor(offset + count) });
+  if (offset > 0)
+    link.push({ relation: "previous", url: linkFor(Math.max(0, offset - count)) });
+
+  return {
+    resourceType: "Bundle",
+    type: "searchset",
+    total,
+    link,
+    entry: page.map((resource) => ({
+      fullUrl: `${baseUrl}/${resource.resourceType}/${resource.id}`,
+      resource,
+      search: { mode: "match" },
+    })),
+  };
+}

backend/src/services/fhir-server/capability.ts

@@ -0,0 +1,114 @@
+// A static CapabilityStatement describing exactly what this read-only FHIR R4
+// server supports. It is intentionally honest: only the resources and search
+// params implemented below are listed, everything is `read`/`search-type` only,
+// and clinical concepts are text-only (no SNOMED/LOINC coding).
+
+type ResourceCapability = {
+  type: string;
+  interaction: { code: "read" | "search-type" }[];
+  searchParam?: { name: string; type: "token" | "string" | "reference" }[];
+};
+
+const RESOURCES: ResourceCapability[] = [
+  {
+    type: "Patient",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "identifier", type: "token" },
+      { name: "name", type: "string" },
+    ],
+  },
+  {
+    type: "Observation",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+      { name: "category", type: "token" },
+    ],
+  },
+  {
+    type: "AllergyIntolerance",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Condition",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "MedicationRequest",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Encounter",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+  {
+    type: "Appointment",
+    interaction: [{ code: "read" }, { code: "search-type" }],
+    searchParam: [
+      { name: "patient", type: "reference" },
+      { name: "patient.identifier", type: "token" },
+    ],
+  },
+];
+
+export function capabilityStatement(
+  baseUrl: string,
+  version: string,
+): Record<string, unknown> {
+  return {
+    resourceType: "CapabilityStatement",
+    status: "active",
+    date: new Date().toISOString(),
+    publisher: "temetro",
+    kind: "instance",
+    implementation: { description: "temetro FHIR server", url: baseUrl },
+    software: { name: "temetro", version },
+    fhirVersion: "4.0.1",
+    format: ["application/fhir+json", "json"],
+    rest: [
+      {
+        mode: "server",
+        documentation:
+          "Read-only FHIR R4 server. Authenticate with a per-clinic API key: " +
+          "Authorization: Bearer tmf_…. Clinical values are text-only " +
+          "CodeableConcepts (no SNOMED/LOINC). Patients expose age (extension), " +
+          "not birthDate. Pagination via _count (default 50, max 200) and _offset.",
+        security: {
+          description: "Bearer token (per-organization API key, tmf_ prefix).",
+          service: [
+            {
+              coding: [
+                {
+                  system:
+                    "http://terminology.hl7.org/CodeSystem/restful-security-service",
+                  code: "OAuth",
+                  display: "OAuth",
+                },
+              ],
+              text: "API key bearer token",
+            },
+          ],
+        },
+        resource: RESOURCES,
+      },
+    ],
+  };
+}

backend/src/services/fhir-server/keys.ts

@@ -0,0 +1,110 @@
+import { createHash, randomBytes } from "node:crypto";
+
+import { and, desc, eq, isNull } from "drizzle-orm";
+
+import { db } from "../../db/index.js";
+import { fhirApiKeys } from "../../db/schema/fhir-keys.js";
+
+// FHIR-server API keys. The secret is `tmf_` + 32 random bytes (base64url); we
+// persist only its SHA-256 hash, so a leaked database never yields usable keys
+// and the plaintext is returned exactly once (at creation).
+
+const PREFIX = "tmf_";
+
+export type FhirKeyView = {
+  id: string;
+  name: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+  revoked: boolean;
+};
+
+function hashKey(secret: string): string {
+  return createHash("sha256").update(secret).digest("hex");
+}
+
+function toView(row: typeof fhirApiKeys.$inferSelect): FhirKeyView {
+  return {
+    id: row.id,
+    name: row.name,
+    createdAt: row.createdAt.toISOString(),
+    lastUsedAt: row.lastUsedAt ? row.lastUsedAt.toISOString() : null,
+    revoked: row.revokedAt !== null,
+  };
+}
+
+// List a clinic's keys (active first, then revoked), newest first. Never
+// exposes the hash.
+export async function listKeys(orgId: string): Promise<FhirKeyView[]> {
+  const rows = await db
+    .select()
+    .from(fhirApiKeys)
+    .where(eq(fhirApiKeys.organizationId, orgId))
+    .orderBy(desc(fhirApiKeys.createdAt));
+  return rows.map(toView);
+}
+
+// Mint a new key. Returns the one-time plaintext secret alongside the stored
+// view — the caller must surface the secret to the user immediately; it is not
+// recoverable afterwards.
+export async function createKey(
+  orgId: string,
+  name: string,
+  createdBy: string,
+): Promise<{ secret: string; key: FhirKeyView }> {
+  const secret = PREFIX + randomBytes(32).toString("base64url");
+  const [row] = await db
+    .insert(fhirApiKeys)
+    .values({
+      organizationId: orgId,
+      name: name.trim() || "FHIR key",
+      keyHash: hashKey(secret),
+      createdBy,
+    })
+    .returning();
+  return { secret, key: toView(row!) };
+}
+
+// Revoke a key (idempotent). Scoped to the org so one clinic can't revoke
+// another's. Returns false if no such active key exists.
+export async function revokeKey(orgId: string, id: string): Promise<boolean> {
+  const result = await db
+    .update(fhirApiKeys)
+    .set({ revokedAt: new Date() })
+    .where(
+      and(
+        eq(fhirApiKeys.id, id),
+        eq(fhirApiKeys.organizationId, orgId),
+        isNull(fhirApiKeys.revokedAt),
+      ),
+    )
+    .returning({ id: fhirApiKeys.id });
+  return result.length > 0;
+}
+
+export type ResolvedKey = { orgId: string; keyId: string; keyName: string };
+
+// Resolve a presented bearer secret to its owning organization (plus the key's
+// identity, for the audit log), or null when it is unknown or revoked. Bumps
+// `lastUsedAt` (throttled to once a minute) so the key list can show recent
+// activity without a write on every request.
+export async function resolveKey(secret: string): Promise<ResolvedKey | null> {
+  if (!secret.startsWith(PREFIX)) return null;
+  const [row] = await db
+    .select()
+    .from(fhirApiKeys)
+    .where(eq(fhirApiKeys.keyHash, hashKey(secret)))
+    .limit(1);
+  if (!row || row.revokedAt) return null;
+
+  const now = Date.now();
+  const last = row.lastUsedAt?.getTime() ?? 0;
+  if (now - last > 60_000) {
+    void db
+      .update(fhirApiKeys)
+      .set({ lastUsedAt: new Date() })
+      .where(eq(fhirApiKeys.id, row.id))
+      .catch(() => {});
+  }
+  return { orgId: row.organizationId, keyId: row.id, keyName: row.name };
+}

backend/src/services/fhir-server/outcome.ts

@@ -0,0 +1,36 @@
+// FHIR OperationOutcome helpers. Errors on a FHIR endpoint are returned as an
+// OperationOutcome resource (not our usual `{ error }` JSON), with the
+// `application/fhir+json` content type, so conformant clients can parse them.
+
+export const FHIR_CONTENT_TYPE = "application/fhir+json";
+
+export type IssueSeverity = "fatal" | "error" | "warning" | "information";
+export type IssueCode =
+  | "not-found"
+  | "not-supported"
+  | "security"
+  | "login"
+  | "forbidden"
+  | "invalid"
+  | "processing"
+  | "exception";
+
+export type OperationOutcome = {
+  resourceType: "OperationOutcome";
+  issue: {
+    severity: IssueSeverity;
+    code: IssueCode;
+    diagnostics?: string;
+  }[];
+};
+
+export function operationOutcome(
+  severity: IssueSeverity,
+  code: IssueCode,
+  diagnostics: string,
+): OperationOutcome {
+  return {
+    resourceType: "OperationOutcome",
+    issue: [{ severity, code, diagnostics }],
+  };
+}

backend/src/services/fhir-server/queries.ts

@@ -0,0 +1,168 @@
+import { and, asc, count, eq, ilike, sql } from "drizzle-orm";
+import type { SQL } from "drizzle-orm";
+
+import { db } from "../../db/index.js";
+import { appointments } from "../../db/schema/appointments.js";
+import {
+  allergies,
+  encounters,
+  labs,
+  medications,
+  patients,
+  problems,
+} from "../../db/schema/patients.js";
+import { prescriptions } from "../../db/schema/prescriptions.js";
+
+// Narrow, org-scoped reads for the FHIR server. Deliberately separate from the
+// app's `services/patients.ts` (which returns the reshaped canonical Patient and
+// applies role redaction): the FHIR layer needs raw rows *with their UUIDs* to
+// mint stable resource ids, and offset/limit pagination the app service doesn't
+// expose. Every function is scoped to a single organization.
+
+export type PatientRow = typeof patients.$inferSelect;
+export type LabRow = typeof labs.$inferSelect;
+export type AllergyRow = typeof allergies.$inferSelect;
+export type ProblemRow = typeof problems.$inferSelect;
+export type EncounterRow = typeof encounters.$inferSelect;
+export type PrescriptionRow = typeof prescriptions.$inferSelect;
+export type AppointmentRow = typeof appointments.$inferSelect;
+
+// --- Patient ----------------------------------------------------------------
+
+// Paginated Patient search. `identifier` matches the MRN (file number) exactly;
+// `name` is a case-insensitive substring. Returns the page plus the full total
+// for the searchset Bundle.
+export async function searchPatients(
+  orgId: string,
+  opts: { identifier?: string; name?: string; limit: number; offset: number },
+): Promise<{ rows: PatientRow[]; total: number }> {
+  const filters: SQL[] = [eq(patients.organizationId, orgId)];
+  if (opts.identifier) filters.push(eq(patients.fileNumber, opts.identifier));
+  if (opts.name) filters.push(ilike(patients.name, `%${opts.name}%`));
+  const where = and(...filters);
+
+  const [rows, [totalRow]] = await Promise.all([
+    db
+      .select()
+      .from(patients)
+      .where(where)
+      .orderBy(asc(patients.fileNumber))
+      .limit(opts.limit)
+      .offset(opts.offset),
+    db.select({ value: count() }).from(patients).where(where),
+  ]);
+
+  return { rows, total: totalRow?.value ?? 0 };
+}
+
+// A single patient by FHIR logical id (the row UUID), scoped to the org.
+export async function patientById(
+  orgId: string,
+  id: string,
+): Promise<PatientRow | undefined> {
+  // Guard against a non-UUID id: Postgres would otherwise error on the cast.
+  if (!/^[0-9a-f-]{36}$/i.test(id)) return undefined;
+  const [row] = await db
+    .select()
+    .from(patients)
+    .where(and(eq(patients.organizationId, orgId), eq(patients.id, id)))
+    .limit(1);
+  return row;
+}
+
+// Resolve a `patient` search parameter to a patient row. Accepts either the FHIR
+// logical id (`patient=<uuid>`) or the MRN (`patient.identifier=<file#>`).
+export async function resolvePatientRef(
+  orgId: string,
+  ref: { patientId?: string; identifier?: string },
+): Promise<PatientRow | undefined> {
+  if (ref.patientId) {
+    // A reference may arrive as "Patient/<id>" or a bare id.
+    const id = ref.patientId.replace(/^Patient\//, "");
+    return patientById(orgId, id);
+  }
+  if (ref.identifier) {
+    const [row] = await db
+      .select()
+      .from(patients)
+      .where(
+        and(
+          eq(patients.organizationId, orgId),
+          eq(patients.fileNumber, ref.identifier),
+        ),
+      )
+      .limit(1);
+    return row;
+  }
+  return undefined;
+}
+
+// --- Clinical child rows (by patient UUID) ----------------------------------
+
+export function labsForPatient(patientId: string): Promise<LabRow[]> {
+  return db
+    .select()
+    .from(labs)
+    .where(eq(labs.patientId, patientId))
+    .orderBy(asc(labs.position));
+}
+
+export function allergiesForPatient(patientId: string): Promise<AllergyRow[]> {
+  return db
+    .select()
+    .from(allergies)
+    .where(eq(allergies.patientId, patientId))
+    .orderBy(asc(allergies.position));
+}
+
+export function problemsForPatient(patientId: string): Promise<ProblemRow[]> {
+  return db
+    .select()
+    .from(problems)
+    .where(eq(problems.patientId, patientId))
+    .orderBy(asc(problems.position));
+}
+
+export function encountersForPatient(
+  patientId: string,
+): Promise<EncounterRow[]> {
+  return db
+    .select()
+    .from(encounters)
+    .where(eq(encounters.patientId, patientId))
+    .orderBy(asc(encounters.position));
+}
+
+// --- Denormalized resources (linked to the patient by MRN / file number) ----
+
+export function prescriptionsForFile(
+  orgId: string,
+  fileNumber: string,
+): Promise<PrescriptionRow[]> {
+  return db
+    .select()
+    .from(prescriptions)
+    .where(
+      and(
+        eq(prescriptions.organizationId, orgId),
+        eq(prescriptions.patientFileNumber, fileNumber),
+      ),
+    )
+    .orderBy(sql`${prescriptions.prescribedAt} desc`);
+}
+
+export function appointmentsForFile(
+  orgId: string,
+  fileNumber: string,
+): Promise<AppointmentRow[]> {
+  return db
+    .select()
+    .from(appointments)
+    .where(
+      and(
+        eq(appointments.organizationId, orgId),
+        eq(appointments.patientFileNumber, fileNumber),
+      ),
+    )
+    .orderBy(sql`${appointments.date} desc, ${appointments.time} desc`);
+}

backend/src/services/fhir-server/resources.ts

@@ -0,0 +1,317 @@
+import type { LabFlag } from "../../types/patient.js";
+import type {
+  AllergyRow,
+  AppointmentRow,
+  EncounterRow,
+  LabRow,
+  PatientRow,
+  PrescriptionRow,
+  ProblemRow,
+} from "./queries.js";
+
+// Pure mappers from temetro rows to FHIR R4 JSON. temetro stores clinical values
+// as **free text** (no SNOMED/LOINC coding), so every CodeableConcept here is
+// `text`-only — valid FHIR, deliberately un-coded (documented in the
+// CapabilityStatement and API docs). Resource ids are the rows' own UUIDs so
+// they are stable; synthesized vital-sign Observations derive their id from the
+// patient UUID.
+
+export type FhirResource = {
+  resourceType: string;
+  id?: string;
+  [key: string]: unknown;
+};
+
+// System URIs.
+const MRN_SYSTEM = "urn:temetro:mrn";
+const INTERPRETATION_SYSTEM =
+  "http://terminology.hl7.org/CodeSystem/v3-ObservationInterpretation";
+const OBS_CATEGORY_SYSTEM =
+  "http://terminology.hl7.org/CodeSystem/observation-category";
+const AGE_EXTENSION =
+  "https://temetro.app/fhir/StructureDefinition/patient-age-years";
+
+// A FHIR dateTime from our stored strings. Passes date-only values (`YYYY-MM-DD`)
+// through unchanged (valid FHIR dateTime), otherwise parses display strings like
+// "Jun 28, 2025" to a full instant. Returns undefined when unparseable.
+function fhirDateTime(value: string | null | undefined): string | undefined {
+  if (!value) return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  if (/^\d{4}-\d{2}-\d{2}$/.test(trimmed)) return trimmed;
+  const parsed = new Date(trimmed);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed.toISOString();
+}
+
+function humanName(full: string): Record<string, unknown>[] {
+  const parts = full.trim().split(/\s+/).filter(Boolean);
+  if (parts.length < 2) return [{ text: full }];
+  return [{ text: full, family: parts.at(-1), given: parts.slice(0, -1) }];
+}
+
+function subjectRef(patient: PatientRow) {
+  return { reference: `Patient/${patient.id}`, display: patient.name };
+}
+
+// --- Patient ----------------------------------------------------------------
+
+export function patientResource(row: PatientRow): FhirResource {
+  return {
+    resourceType: "Patient",
+    id: row.id,
+    identifier: [{ system: MRN_SYSTEM, value: row.fileNumber }],
+    active: row.status !== "discharged",
+    name: humanName(row.name),
+    gender: row.sex === "M" ? "male" : "female",
+    // temetro records age, not date of birth; expose it as an extension rather
+    // than fabricate a birthDate.
+    extension: [{ url: AGE_EXTENSION, valueInteger: row.age }],
+  };
+}
+
+// --- Observation ------------------------------------------------------------
+
+function interpretation(flag: LabFlag) {
+  const map: Record<LabFlag, { code: string; display: string }> = {
+    normal: { code: "N", display: "Normal" },
+    high: { code: "H", display: "High" },
+    low: { code: "L", display: "Low" },
+    critical: { code: "HH", display: "Critical high" },
+  };
+  const { code, display } = map[flag];
+  return [{ coding: [{ system: INTERPRETATION_SYSTEM, code, display }] }];
+}
+
+export function labObservation(row: LabRow, patient: PatientRow): FhirResource {
+  const effective = fhirDateTime(row.takenAt);
+  return {
+    resourceType: "Observation",
+    id: row.id,
+    status: "final",
+    category: [
+      {
+        coding: [
+          {
+            system: OBS_CATEGORY_SYSTEM,
+            code: "laboratory",
+            display: "Laboratory",
+          },
+        ],
+      },
+    ],
+    code: { text: row.name },
+    subject: subjectRef(patient),
+    ...(effective ? { effectiveDateTime: effective } : {}),
+    valueString: row.value,
+    interpretation: interpretation(row.flag),
+  };
+}
+
+// Synthesize vital-sign Observations from the denormalized columns on the
+// patient row. Returns an empty array when vitals are blank (e.g. a
+// reception-registered patient with clinical fields stripped).
+export function vitalObservations(patient: PatientRow): FhirResource[] {
+  const effective = fhirDateTime(patient.vitalsTakenAt);
+  const base = (idSuffix: string, text: string) => ({
+    resourceType: "Observation" as const,
+    id: `${patient.id}-vital-${idSuffix}`,
+    status: "final",
+    category: [
+      {
+        coding: [
+          {
+            system: OBS_CATEGORY_SYSTEM,
+            code: "vital-signs",
+            display: "Vital Signs",
+          },
+        ],
+      },
+    ],
+    code: { text },
+    subject: subjectRef(patient),
+    ...(effective ? { effectiveDateTime: effective } : {}),
+  });
+
+  const out: FhirResource[] = [];
+
+  if (patient.vitalsBp) {
+    const bp = base("bp", "Blood pressure");
+    const m = /^(\d+)\s*\/\s*(\d+)/.exec(patient.vitalsBp.trim());
+    if (m) {
+      out.push({
+        ...bp,
+        component: [
+          {
+            code: { text: "Systolic blood pressure" },
+            valueQuantity: { value: Number(m[1]), unit: "mmHg" },
+          },
+          {
+            code: { text: "Diastolic blood pressure" },
+            valueQuantity: { value: Number(m[2]), unit: "mmHg" },
+          },
+        ],
+      });
+    } else {
+      out.push({ ...bp, valueString: patient.vitalsBp });
+    }
+  }
+  if (patient.vitalsHr)
+    out.push({ ...base("hr", "Heart rate"), valueString: patient.vitalsHr });
+  if (patient.vitalsTemp)
+    out.push({
+      ...base("temp", "Body temperature"),
+      valueString: patient.vitalsTemp,
+    });
+  if (patient.vitalsSpo2)
+    out.push({
+      ...base("spo2", "Oxygen saturation"),
+      valueString: patient.vitalsSpo2,
+    });
+
+  return out;
+}
+
+// --- AllergyIntolerance -----------------------------------------------------
+
+export function allergyResource(
+  row: AllergyRow,
+  patient: PatientRow,
+): FhirResource {
+  return {
+    resourceType: "AllergyIntolerance",
+    id: row.id,
+    clinicalStatus: {
+      coding: [
+        {
+          system:
+            "http://terminology.hl7.org/CodeSystem/allergyintolerance-clinical",
+          code: "active",
+        },
+      ],
+    },
+    code: { text: row.substance },
+    patient: subjectRef(patient),
+    criticality: row.severity === "severe" ? "high" : "low",
+    reaction: [
+      { manifestation: [{ text: row.reaction }], severity: row.severity },
+    ],
+  };
+}
+
+// --- Condition --------------------------------------------------------------
+
+export function conditionResource(
+  row: ProblemRow,
+  patient: PatientRow,
+): FhirResource {
+  return {
+    resourceType: "Condition",
+    id: row.id,
+    clinicalStatus: {
+      coding: [
+        {
+          system: "http://terminology.hl7.org/CodeSystem/condition-clinical",
+          code: "active",
+        },
+      ],
+    },
+    code: { text: row.label },
+    subject: subjectRef(patient),
+    ...(row.since ? { onsetString: row.since } : {}),
+  };
+}
+
+// --- MedicationRequest ------------------------------------------------------
+
+export function medicationRequestResource(
+  row: PrescriptionRow,
+  patient: PatientRow,
+): FhirResource {
+  const status =
+    row.status === "completed"
+      ? "completed"
+      : row.status === "expired"
+        ? "stopped"
+        : "active";
+  const dosageText = [row.dose, row.frequency].filter(Boolean).join(" ").trim();
+  return {
+    resourceType: "MedicationRequest",
+    id: row.id,
+    status,
+    intent: "order",
+    medicationCodeableConcept: { text: row.medication },
+    subject: subjectRef(patient),
+    ...(row.prescribedAt ? { authoredOn: row.prescribedAt } : {}),
+    requester: { display: row.prescriber },
+    ...(dosageText ? { dosageInstruction: [{ text: dosageText }] } : {}),
+  };
+}
+
+// --- Encounter --------------------------------------------------------------
+
+function narrative(text: string): Record<string, unknown> {
+  const escaped = text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+  return {
+    status: "generated",
+    div: `<div xmlns="http://www.w3.org/1999/xhtml">${escaped}</div>`,
+  };
+}
+
+export function encounterResource(
+  row: EncounterRow,
+  patient: PatientRow,
+): FhirResource {
+  const start = fhirDateTime(row.date);
+  return {
+    resourceType: "Encounter",
+    id: row.id,
+    ...(row.summary ? { text: narrative(row.summary) } : {}),
+    status: "finished",
+    class: {
+      system: "http://terminology.hl7.org/CodeSystem/v3-ActCode",
+      code: "AMB",
+      display: "ambulatory",
+    },
+    type: [{ text: row.type }],
+    subject: subjectRef(patient),
+    ...(start ? { period: { start } } : {}),
+    participant: [{ individual: { display: row.provider } }],
+  };
+}
+
+// --- Appointment ------------------------------------------------------------
+
+export function appointmentResource(
+  row: AppointmentRow,
+  patient: PatientRow,
+): FhirResource {
+  const statusMap: Record<string, string> = {
+    confirmed: "booked",
+    "checked-in": "arrived",
+    completed: "fulfilled",
+    cancelled: "cancelled",
+  };
+  // Combine local date + time into an instant; omit when unparseable.
+  const startDate =
+    row.date && row.time ? new Date(`${row.date}T${row.time}:00`) : null;
+  const start =
+    startDate && !Number.isNaN(startDate.getTime())
+      ? startDate.toISOString()
+      : undefined;
+  return {
+    resourceType: "Appointment",
+    id: row.id,
+    status: statusMap[row.status] ?? "booked",
+    description: row.type,
+    ...(start ? { start } : {}),
+    participant: [
+      { actor: subjectRef(patient), status: "accepted" },
+      ...(row.provider
+        ? [{ actor: { display: row.provider }, status: "accepted" }]
+        : []),
+    ],
+  };
+}

backend/src/services/patients.ts

@@ -53,6 +53,8 @@ function toPatient(row: PatientRow, children: Children): Patient {
     primaryProviderId: row.primaryProviderId,
     status: row.status,
     initials: row.initials,
+    phone: row.phone,
+    bloodType: row.bloodType,
     allergies: children.allergies,
     alerts: row.alerts,
     medications: children.medications,
@@ -82,6 +84,8 @@ const EMPTY_TREND: Trend = { label: "", unit: "", points: [] };
 function redactClinical(patient: Patient): Patient {
   return {
     ...patient,
+    // bloodType is clinical PHI; phone is a demographic/contact field and stays.
+    bloodType: "",
     allergies: [],
     alerts: [],
     medications: [],
@@ -116,6 +120,8 @@ function patientColumns(orgId: string, input: PatientInput, createdBy?: string)
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
+    bloodType: input.bloodType,
     alerts: input.alerts,
     vitalsBp: input.vitals.bp,
     vitalsHr: input.vitals.hr,
@@ -147,6 +153,8 @@ function demographicColumns(
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
+    bloodType: "",
     source: input.source,
     alerts: [] as string[],
     vitalsBp: "",
@@ -172,6 +180,7 @@ function demographicUpdateColumns(input: PatientInput) {
     primaryProviderId: input.primaryProviderId ?? null,
     status: input.status,
     initials: input.initials,
+    phone: input.phone,
   };
 }
 

backend/src/services/relay-client.ts

@@ -0,0 +1,219 @@
+// Client connection to the Temetro Network relay
+// (github.com/temetro/temetro-network), a standalone Rust service that routes
+// encrypted wallet messages between this backend and patient phones.
+//
+// This backend was previously the device-facing Socket.io server itself (the
+// `/wallet` namespace in realtime.ts). Now it is a *client* of the relay's
+// `/hub` namespace: it pushes messages to devices via `sendToWallet` and handles
+// their responses here, calling the same wallet service functions the old socket
+// handlers did. Sealed bundles are decrypted here (we hold the ephemeral key);
+// the relay only ever forwards ciphertext.
+//
+// The relay is **multi-clinic**: each clinic (organization) authenticates to
+// `/hub` with its own Ed25519 signing key (a per-clinic identity, not a shared
+// password), and the relay routes each device response back only to the clinic
+// that originated the request. So this backend keeps **one hub connection per
+// network-enabled org**, opened when the org joins the network ("Join Temetro
+// Network" in Settings → Signing) and torn down when it leaves.
+
+import { io as connect, type Socket } from "socket.io-client";
+
+import { env } from "../env.js";
+import { networkEnabledOrgs, signWithClinicKey } from "./signing.js";
+import * as walletShare from "./wallet-share.js";
+import * as walletUpdates from "./wallet-updates.js";
+
+// One authenticated hub connection per network-enabled organization.
+const hubs = new Map<string, Socket>();
+
+type Ack = (response: { ok: boolean; [key: string]: unknown }) => void;
+
+// Push an end-to-end-encrypted message to a patient wallet device via the given
+// clinic's relay connection (the relay forwards it to the room keyed by wallet
+// number). A no-op if the clinic isn't on the network / not connected yet — the
+// device replays anything it missed on its next connect (see `wallet:online`).
+export function sendToWallet(
+  orgId: string,
+  walletNumber: string,
+  event: string,
+  data: unknown,
+): void {
+  hubs.get(orgId)?.emit("wallet:send", { walletNumber, event, data });
+}
+
+// Tell the relay to expect a device response for `requestId` and route it back
+// to this clinic — used by **QR pairing**, where there's no wallet number to
+// `wallet:send` to yet, so nothing would otherwise register the request.
+export function expectResponse(orgId: string, requestId: string): void {
+  hubs.get(orgId)?.emit("hub:expect", { requestId });
+}
+
+// Open (and authenticate) a hub connection for a clinic, if not already open.
+// Idempotent — safe to call on startup, when an org joins the network, and
+// before generating a pairing QR. The socket auto-reconnects on its own, so an
+// existing entry is left as-is.
+export async function connectOrg(orgId: string): Promise<void> {
+  if (hubs.has(orgId)) return;
+
+  const hub = connect(`${env.RELAY_URL}/hub`, {
+    transports: ["websocket"],
+    reconnection: true,
+    reconnectionDelayMax: 10_000,
+  });
+  hubs.set(orgId, hub);
+  registerHubHandlers(orgId, hub);
+}
+
+// Leave the network for a clinic: close and forget its hub connection.
+export function disconnectOrg(orgId: string): void {
+  const hub = hubs.get(orgId);
+  if (!hub) return;
+  hub.disconnect();
+  hubs.delete(orgId);
+}
+
+// Open a hub connection for every clinic already on the network. Called once at
+// startup; runtime joins/leaves go through connectOrg/disconnectOrg.
+export async function initRelayClient(): Promise<void> {
+  try {
+    const orgs = await networkEnabledOrgs();
+    await Promise.all(orgs.map((orgId) => connectOrg(orgId)));
+  } catch (err) {
+    console.warn(`Temetro Network: failed to open hub connections: ${(err as Error).message}`);
+  }
+}
+
+// Wire up auth + device-response handlers for one clinic's hub socket.
+function registerHubHandlers(orgId: string, hub: Socket): void {
+  // Authenticate by signing the relay's challenge with this clinic's signing
+  // key. `clinicId` is that key's public half (hex), which is how the relay
+  // identifies and routes to this clinic.
+  hub.on("hub:challenge", async (payload: { challenge?: string }) => {
+    const challenge = String(payload?.challenge ?? "");
+    if (!challenge) return;
+    try {
+      const { signature, publicKey } = await signWithClinicKey(
+        orgId,
+        new TextEncoder().encode(challenge),
+      );
+      hub.emit(
+        "hub:auth",
+        // `token` is only meaningful for a private relay (optional shared gate);
+        // an empty value is ignored by an open relay.
+        { clinicId: publicKey, signature, token: env.RELAY_TOKEN || undefined },
+        async (ack: { ok?: boolean } | undefined) => {
+          if (!ack?.ok) {
+            console.warn(`Temetro Network: relay rejected clinic ${orgId}`);
+            return;
+          }
+          console.log(`Temetro Network: clinic ${orgId} authenticated on the relay`);
+          // The relay keeps routing state in memory, so re-register this clinic's
+          // still-pending requests — restores QR-pairing / share routing after a
+          // relay restart or a reconnect.
+          try {
+            for (const requestId of await walletShare.pendingRequestIds(orgId)) {
+              expectResponse(orgId, requestId);
+            }
+          } catch {
+            /* best-effort */
+          }
+        },
+      );
+    } catch (err) {
+      console.warn(`Temetro Network: failed to sign relay challenge for ${orgId}: ${(err as Error).message}`);
+    }
+  });
+
+  hub.on("connect_error", (err) => {
+    console.warn(`Temetro Network relay unreachable (${env.RELAY_URL}) for ${orgId}: ${err.message}`);
+  });
+
+  // A device authenticated on the relay — flush any record updates it missed
+  // while offline (scoped to this clinic; the relay only delivers this to
+  // clinics with pending work for the wallet).
+  hub.on("wallet:online", async (payload: { walletNumber?: string }) => {
+    const walletNumber = String(payload?.walletNumber ?? "");
+    if (!walletNumber) return;
+    try {
+      const rows = await walletUpdates.pendingUpdatesForWallet(orgId, walletNumber);
+      for (const row of rows) {
+        sendToWallet(orgId, walletNumber, "wallet:update-request", await walletUpdates.toEvent(row));
+        await walletUpdates.markDelivered(row.id);
+      }
+    } catch {
+      /* best-effort */
+    }
+  });
+
+  // The patient approved/denied a clinic→wallet record update. Verify the
+  // wallet's signature over the decision and resolve the row.
+  hub.on(
+    "wallet:update-response",
+    async (
+      payload: {
+        requestId?: string;
+        walletNumber?: string;
+        decision?: "approved" | "denied";
+        signature?: string;
+      },
+      ack?: Ack,
+    ) => {
+      try {
+        const view = await walletUpdates.applyUpdateResponse(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+          payload?.decision === "approved" ? "approved" : "denied",
+          payload?.signature,
+        );
+        ack?.({ ok: !!view });
+      } catch (err) {
+        ack?.({ ok: false, error: (err as Error).message });
+      }
+    },
+  );
+
+  // The patient approved/denied a share; the sealed bundle (if approved) rides
+  // along and is decrypted + verified here.
+  hub.on(
+    "wallet:share-response",
+    async (
+      payload: {
+        requestId?: string;
+        walletNumber?: string;
+        decision?: "approved" | "denied";
+        sealed?: string;
+        signature?: string;
+      },
+      ack?: Ack,
+    ) => {
+      try {
+        const view = await walletShare.applyShareResponse(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+          payload?.decision === "approved" ? "approved" : "denied",
+          payload?.sealed,
+          payload?.signature,
+        );
+        ack?.({ ok: !!view });
+      } catch (err) {
+        ack?.({ ok: false, error: (err as Error).message });
+      }
+    },
+  );
+
+  // The patient revoked a previously shared record; delete it from the clinic.
+  hub.on(
+    "wallet:revoke",
+    async (payload: { requestId?: string; walletNumber?: string }, ack?: Ack) => {
+      try {
+        const result = await walletShare.revokeShare(
+          String(payload?.requestId ?? ""),
+          String(payload?.walletNumber ?? ""),
+        );
+        ack?.({ ok: !!result });
+      } catch {
+        ack?.({ ok: false });
+      }
+    },
+  );
+}

backend/src/services/signing.ts

@@ -74,6 +74,40 @@ export async function rotateKey(orgId: string): Promise<SigningKeyView> {
   return mintKey(orgId, true);
 }
 
+// Whether this clinic has joined the Temetro Network relay. Defaults to `false`
+// when the clinic has no signing key yet (it hasn't opted in).
+export async function getNetworkEnabled(orgId: string): Promise<boolean> {
+  const [row] = await db
+    .select({ networkEnabled: clinicSigningKeys.networkEnabled })
+    .from(clinicSigningKeys)
+    .where(eq(clinicSigningKeys.organizationId, orgId));
+  return row?.networkEnabled ?? false;
+}
+
+// Org ids of every clinic currently on the network — used at startup to open a
+// relay hub connection for each.
+export async function networkEnabledOrgs(): Promise<string[]> {
+  const rows = await db
+    .select({ organizationId: clinicSigningKeys.organizationId })
+    .from(clinicSigningKeys)
+    .where(eq(clinicSigningKeys.networkEnabled, true));
+  return rows.map((r) => r.organizationId);
+}
+
+// Join or leave the Temetro Network. Ensures the clinic has a signing key first
+// (the relay authenticates with it), then flips the flag. Returns the new state.
+export async function setNetworkEnabled(
+  orgId: string,
+  enabled: boolean,
+): Promise<boolean> {
+  await getOrCreateKey(orgId);
+  await db
+    .update(clinicSigningKeys)
+    .set({ networkEnabled: enabled })
+    .where(eq(clinicSigningKeys.organizationId, orgId));
+  return enabled;
+}
+
 // Sign a message with the clinic's signing key (creating one if needed). Returns
 // the signature + public key so a verifier can check provenance.
 export async function signWithClinicKey(

backend/src/services/wallet-share.ts

@@ -137,6 +137,22 @@ export async function listShareRequests(
   return rows.map(toView);
 }
 
+// Ids of this clinic's still-pending share/pairing requests. Used to re-register
+// them with the relay when the clinic's hub (re)connects (the relay keeps
+// routing state in memory, so it's lost on a relay restart / redeploy).
+export async function pendingRequestIds(orgId: string): Promise<string[]> {
+  const rows = await db
+    .select({ id: walletShareRequests.id })
+    .from(walletShareRequests)
+    .where(
+      and(
+        eq(walletShareRequests.organizationId, orgId),
+        eq(walletShareRequests.status, "pending"),
+      ),
+    );
+  return rows.map((r) => r.id);
+}
+
 // Apply a response relayed back from the patient's device. On approval we
 // decrypt the sealed bundle with the request's ephemeral private key and verify
 // the wallet's Ed25519 signature over it (provenance: it really came from that

backend/src/services/wallet-updates.ts

@@ -144,7 +144,11 @@ export async function toEvent(row: UpdateRow): Promise<WalletUpdateEvent> {
 
 // Every unresolved update for a wallet — re-sent on each authenticated connect
 // so an offline device eventually receives what it missed.
+// Pending updates a wallet missed, scoped to one clinic — the relay delivers a
+// `wallet:online` over that clinic's own hub connection, so a clinic only ever
+// re-sends its *own* updates (never another clinic's).
 export async function pendingUpdatesForWallet(
+  orgId: string,
   walletNumber: string,
 ): Promise<UpdateRow[]> {
   return db
@@ -152,6 +156,7 @@ export async function pendingUpdatesForWallet(
     .from(walletRecordUpdates)
     .where(
       and(
+        eq(walletRecordUpdates.organizationId, orgId),
         eq(walletRecordUpdates.walletNumber, walletNumber),
         isNull(walletRecordUpdates.resolvedAt),
       ),

backend/src/types/express.d.ts

@@ -15,6 +15,9 @@ declare global {
       };
       organizationId?: string;
       memberRole?: string;
+      // Set by the FHIR bearer-auth middleware (machine-to-machine API key)
+      // instead of a Better Auth session; used for org scoping + audit.
+      fhirKey?: { id: string; name: string };
     }
   }
 }

backend/src/types/patient.ts

@@ -61,6 +61,8 @@ export type Patient = {
   primaryProviderId?: string | null; // user id of the responsible clinician
   status: PatientStatus;
   initials: string; // for AvatarFallback
+  phone?: string; // contact number (demographic; visible to reception)
+  bloodType?: string; // e.g. "O+"; clinical — redacted for reception
   allergies: Allergy[];
   alerts: string[];
   medications: Medication[];

frontend/CLAUDE.md

@@ -104,12 +104,18 @@ white/6%), so layered surfaces stay close in lightness.
 
 ## i18n
 
-`i18next` + `react-i18next` (config in `lib/i18n/config.ts`, English resources in
-`lib/i18n/locales/en/translation.json`). `components/i18n-provider.tsx` wraps the app in
+`i18next` + `react-i18next` (config in `lib/i18n/config.ts`, resources in
+`lib/i18n/locales/<lng>/translation.json`). `components/i18n-provider.tsx` wraps the app in
 `app/layout.tsx`. Use `const { t } = useTranslation()` + nested keys (e.g. `t("auth.login.title")`)
 in **client** components. To add a language, drop a `locales/<lng>/translation.json` and register it
 in `resources`/`supportedLngs` in `config.ts`.
 
+> **Translate into EVERY locale, not just English.** The app ships multiple languages
+> (`lib/i18n/locales/`: currently `en`, `de`, `fr`, `ar`, `so`). Whenever you add or rename a
+> translation key, add it to **all** `locales/*/translation.json` files with a real translation for
+> each language (not the English string copied over) — leaving a key in only `en/` ships a broken UI
+> in the others. Keep the nested structure identical across every locale file.
+
 **Coverage:** essentially all user-facing strings are now keyed (every app page + its dialogs/sheets,
 auth pages, settings panels, the sidebar/user menu, chat input, patient cards/detail/form, messages,
 notifications, notes). Keys are grouped by feature (`appointments.*`, `patientCard.*`, `messages.*`,

frontend/components/chat/patient-cards.tsx

@@ -243,6 +243,11 @@ function SummaryCard({
               label={t("patientCard.summary.allergies")}
               value={patient.allergies.length || t("patientCard.summary.none")}
             />
+            <Stat
+              label={t("patientCard.summary.bloodType")}
+              value={patient.bloodType || "—"}
+            />
+            <Stat label={t("patientCard.summary.phone")} value={patient.phone || "—"} />
           </div>
           <AlertBadges alerts={patient.alerts} />
           {onEdit ? (

frontend/components/chat/patient-form-dialog.tsx

@@ -243,6 +243,8 @@ export function PatientFormDialog({
   // per-doctor visibility), not free text. `providerId` is the selected user id.
   const [providers, setProviders] = useState<Provider[]>([]);
   const [providerId, setProviderId] = useState(patient?.primaryProviderId ?? "");
+  const [phone, setPhone] = useState(patient?.phone ?? "");
+  const [bloodType, setBloodType] = useState(patient?.bloodType ?? "");
   const [bp, setBp] = useState(patient?.vitals.bp ?? "");
   const [hr, setHr] = useState(patient?.vitals.hr ?? "");
   const [temp, setTemp] = useState(patient?.vitals.temp ?? "");
@@ -310,6 +312,8 @@ export function PatientFormDialog({
       primaryProviderId: providerId || null,
       status,
       initials: initialsFromName(name),
+      phone: phone.trim(),
+      bloodType,
       allergies: allergies.filter((a) => a.substance.trim()),
       alerts: patient?.alerts ?? [],
       medications: medications.filter((m) => m.name.trim()),
@@ -515,6 +519,31 @@ export function PatientFormDialog({
               </select>
             </Field>
 
+            <div className="grid grid-cols-2 gap-3">
+              <Field label={t("patientForm.phone")}>
+                <Input
+                  inputMode="tel"
+                  onChange={(event) => setPhone(event.target.value)}
+                  placeholder={t("patientForm.phonePlaceholder")}
+                  value={phone}
+                />
+              </Field>
+              <Field label={t("patientForm.bloodType")}>
+                <select
+                  className={controlClass}
+                  onChange={(event) => setBloodType(event.target.value)}
+                  value={bloodType}
+                >
+                  <option value="">{t("patientForm.bloodTypeUnknown")}</option>
+                  {["A+", "A-", "B+", "B-", "AB+", "AB-", "O+", "O-"].map((bt) => (
+                    <option key={bt} value={bt}>
+                      {bt}
+                    </option>
+                  ))}
+                </select>
+              </Field>
+            </div>
+
             {showClinical && (
               <>
             <div className="flex flex-col gap-1.5">

frontend/components/patients/import-from-wallet-dialog.tsx

@@ -141,6 +141,8 @@ export function ImportFromWalletDialog({
     } catch (err) {
       if (err instanceof ApiError && err.status === 400) {
         setError(t("patients.importApp.invalidWallet"));
+      } else if (err instanceof ApiError && err.status === 409) {
+        setError(t("patients.importApp.networkOff"));
       } else {
         setError(t("patients.importApp.error"));
       }
@@ -171,8 +173,12 @@ export function ImportFromWalletDialog({
       setPairUri(`temetro-pair:?${params.toString()}`);
       setRequest(pairing);
       setPhase("waiting");
-    } catch {
-      setError(t("patients.importApp.error"));
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 409) {
+        setError(t("patients.importApp.networkOff"));
+      } else {
+        setError(t("patients.importApp.error"));
+      }
       setPhase("error");
     }
   };

frontend/components/patients/patient-detail.tsx

@@ -359,6 +359,14 @@ export function PatientDetail({
             label={t("patientCard.summary.openProblems")}
             value={patient.problems.length}
           />
+          <Stat
+            label={t("patientCard.summary.bloodType")}
+            value={patient.bloodType || "—"}
+          />
+          <Stat
+            label={t("patientCard.summary.phone")}
+            value={patient.phone || "—"}
+          />
         </div>
       </Section>
 

frontend/components/settings/settings-billing.tsx

@@ -6,16 +6,21 @@ import { useTranslation } from "react-i18next";
 import { cn } from "@/lib/utils";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { Switch } from "@/components/ui/switch";
 import {
   CopyField,
   SettingsCard,
   SettingsSection,
   whiteButton,
 } from "@/components/settings/settings-parts";
+import { ClinicLocationSection } from "@/components/settings/settings-location";
+import { PatientPortalSection } from "@/components/settings/settings-portal";
 import {
+  getNetworkEnabled,
   getSigningKey,
   listSignedRecords,
   rotateSigningKey,
+  setNetworkEnabled,
   type SharedRecord,
   type SigningKey,
 } from "@/lib/signing";
@@ -38,6 +43,8 @@ export function SigningPanel() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [rotating, setRotating] = useState(false);
+  const [networkOn, setNetworkOn] = useState(false);
+  const [networkSaving, setNetworkSaving] = useState(false);
 
   useEffect(() => {
     let active = true;
@@ -45,12 +52,14 @@ export function SigningPanel() {
       getSigningKey(),
       listSignedRecords().catch(() => []),
       listWalletUpdates().catch(() => []),
+      getNetworkEnabled().catch(() => false),
     ])
-      .then(([k, r, u]) => {
+      .then(([k, r, u, n]) => {
         if (!active) return;
         setKey(k);
         setRecords(r);
         setUpdates(u);
+        setNetworkOn(n);
         setError(null);
       })
       .catch(() => {
@@ -83,6 +92,32 @@ export function SigningPanel() {
     }
   };
 
+  const toggleNetwork = async (next: boolean) => {
+    setNetworkSaving(true);
+    // Optimistic — revert on failure.
+    setNetworkOn(next);
+    try {
+      const saved = await setNetworkEnabled(next);
+      setNetworkOn(saved);
+      notify.success(
+        next
+          ? t("settings.network.joinedTitle")
+          : t("settings.network.leftTitle"),
+        next
+          ? t("settings.network.joinedBody")
+          : t("settings.network.leftBody"),
+      );
+    } catch {
+      setNetworkOn(!next);
+      notify.error(
+        t("settings.network.errorTitle"),
+        t("settings.network.error"),
+      );
+    } finally {
+      setNetworkSaving(false);
+    }
+  };
+
   const recordStatusLabel = (status: SharedRecord["status"]): string =>
     t(
       `settings.signing.records.status${
@@ -137,6 +172,45 @@ export function SigningPanel() {
         </div>
       </SettingsCard>
 
+      <SettingsSection
+        description={t("settings.network.description")}
+        title={t("settings.network.title")}
+      >
+        <SettingsCard className="flex items-center justify-between gap-4 p-5">
+          <div className="min-w-0 space-y-0.5">
+            <div className="flex items-center gap-2">
+              <p className="text-sm font-medium">
+                {t("settings.network.toggleLabel")}
+              </p>
+              <Badge
+                className={cn(
+                  networkOn
+                    ? "bg-emerald-500/15 text-emerald-400"
+                    : "bg-muted text-muted-foreground",
+                )}
+              >
+                {networkOn
+                  ? t("settings.network.statusConnected")
+                  : t("settings.network.statusOff")}
+              </Badge>
+            </div>
+            <p className="text-sm text-muted-foreground">
+              {t("settings.network.toggleDesc")}
+            </p>
+          </div>
+          <Switch
+            aria-label={t("settings.network.toggleLabel")}
+            checked={networkOn}
+            disabled={loading || networkSaving}
+            onCheckedChange={toggleNetwork}
+          />
+        </SettingsCard>
+      </SettingsSection>
+
+      <PatientPortalSection />
+
+      <ClinicLocationSection />
+
       <SettingsSection
         description={t("settings.signing.identityDescription")}
         title={t("settings.signing.identityTitle")}

frontend/components/settings/settings-integrations.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { CheckCircle2, CircleDashed, XCircle } from "lucide-react";
+import { CheckCircle2, CircleDashed, Copy, KeyRound, Trash2, XCircle } from "lucide-react";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -13,10 +13,15 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
+import { API_BASE_URL } from "@/lib/api-client";
 import {
+  createFhirKey,
+  type FhirApiKey,
   type IntegrationConfig,
   type IntegrationType,
+  listFhirKeys,
   listIntegrations,
+  revokeFhirKey,
   saveIntegration,
   testIntegration,
 } from "@/lib/integrations";
@@ -191,6 +196,216 @@ function IntegrationCard({
   );
 }
 
+// The read-only FHIR R4 server. Unlike the integration cards above (which make
+// temetro a FHIR *client*), this exposes temetro's own records over `/fhir` to
+// external systems, authenticated with per-clinic API keys. Owner/admin only:
+// the component self-gates by hiding when the keys fetch is forbidden.
+function FhirServerCard() {
+  const { t } = useTranslation();
+  const [keys, setKeys] = useState<FhirApiKey[] | null>(null);
+  const [allowed, setAllowed] = useState(true);
+  const [name, setName] = useState("");
+  const [creating, setCreating] = useState(false);
+  const [freshSecret, setFreshSecret] = useState<string | null>(null);
+  const [confirmRevoke, setConfirmRevoke] = useState<string | null>(null);
+
+  const baseUrl = `${API_BASE_URL}/fhir`;
+
+  useEffect(() => {
+    let active = true;
+    listFhirKeys()
+      .then((rows) => active && setKeys(rows))
+      .catch(() => {
+        if (active) {
+          setAllowed(false);
+          setKeys([]);
+        }
+      });
+    return () => {
+      active = false;
+    };
+  }, []);
+
+  const create = async () => {
+    if (!name.trim() || creating) return;
+    setCreating(true);
+    try {
+      const created = await createFhirKey(name.trim());
+      setFreshSecret(created.secret);
+      setKeys((prev) => [created, ...(prev ?? [])]);
+      setName("");
+    } catch {
+      notify.error(
+        t("settings.integrations.fhirServer.createFailed"),
+        t("settings.integrations.fhirServer.createFailedBody"),
+      );
+    } finally {
+      setCreating(false);
+    }
+  };
+
+  const revoke = async (id: string) => {
+    try {
+      await revokeFhirKey(id);
+      setKeys((prev) =>
+        (prev ?? []).map((k) => (k.id === id ? { ...k, revoked: true } : k)),
+      );
+    } catch {
+      notify.error(
+        t("settings.integrations.fhirServer.revokeFailed"),
+        t("settings.integrations.fhirServer.revokeFailedBody"),
+      );
+    } finally {
+      setConfirmRevoke(null);
+    }
+  };
+
+  const copy = async (text: string, label: string) => {
+    try {
+      await navigator.clipboard.writeText(text);
+      notify.success(label, "");
+    } catch {
+      // Clipboard blocked — no-op; the value is visible for manual copy.
+    }
+  };
+
+  if (!allowed) return null;
+
+  return (
+    <SettingsSection
+      description={t("settings.integrations.fhirServer.description")}
+      title={t("settings.integrations.fhirServer.title")}
+    >
+      <SettingsCard className="space-y-5 p-5">
+        <div className="space-y-1.5">
+          <FieldLabel>{t("settings.integrations.fhirServer.baseUrl")}</FieldLabel>
+          <div className="flex items-center gap-2">
+            <Input readOnly value={baseUrl} />
+            <Button
+              onClick={() =>
+                copy(baseUrl, t("settings.integrations.fhirServer.copiedUrl"))
+              }
+              size="icon"
+              variant="outline"
+            >
+              <Copy className="size-4" />
+            </Button>
+          </div>
+          <p className="text-xs text-muted-foreground">
+            {t("settings.integrations.fhirServer.baseUrlHint")}
+          </p>
+        </div>
+
+        {freshSecret ? (
+          <div className="space-y-2 rounded-2xl border border-primary/40 bg-primary/5 p-4">
+            <p className="text-sm font-medium">
+              {t("settings.integrations.fhirServer.secretTitle")}
+            </p>
+            <p className="text-xs text-muted-foreground">
+              {t("settings.integrations.fhirServer.secretHint")}
+            </p>
+            <div className="flex items-center gap-2">
+              <code className="min-w-0 flex-1 truncate rounded-lg bg-muted px-3 py-2 font-mono text-xs">
+                {freshSecret}
+              </code>
+              <Button
+                onClick={() =>
+                  copy(
+                    freshSecret,
+                    t("settings.integrations.fhirServer.copiedSecret"),
+                  )
+                }
+                size="icon"
+                variant="outline"
+              >
+                <Copy className="size-4" />
+              </Button>
+            </div>
+            <Button onClick={() => setFreshSecret(null)} size="sm" variant="ghost">
+              {t("settings.integrations.fhirServer.dismissSecret")}
+            </Button>
+          </div>
+        ) : null}
+
+        <div className="space-y-1.5">
+          <FieldLabel>{t("settings.integrations.fhirServer.newKey")}</FieldLabel>
+          <div className="flex items-center gap-2">
+            <Input
+              onChange={(e) => setName(e.target.value)}
+              onKeyDown={(e) => e.key === "Enter" && create()}
+              placeholder={t("settings.integrations.fhirServer.newKeyPlaceholder")}
+              value={name}
+            />
+            <Button disabled={creating || !name.trim()} onClick={create} size="sm">
+              <KeyRound className="size-4" />
+              {creating
+                ? t("settings.integrations.fhirServer.creating")
+                : t("settings.integrations.fhirServer.create")}
+            </Button>
+          </div>
+        </div>
+
+        {keys && keys.length > 0 ? (
+          <ul className="divide-y rounded-2xl border">
+            {keys.map((k) => (
+              <li
+                key={k.id}
+                className="flex items-center justify-between gap-3 px-4 py-3"
+              >
+                <div className="min-w-0">
+                  <p className="truncate text-sm font-medium">{k.name}</p>
+                  <p className="text-xs text-muted-foreground">
+                    {k.lastUsedAt
+                      ? t("settings.integrations.fhirServer.lastUsed", {
+                          when: new Date(k.lastUsedAt).toLocaleString(),
+                        })
+                      : t("settings.integrations.fhirServer.neverUsed")}
+                  </p>
+                </div>
+                {k.revoked ? (
+                  <Badge variant="outline">
+                    {t("settings.integrations.fhirServer.revoked")}
+                  </Badge>
+                ) : confirmRevoke === k.id ? (
+                  <div className="flex items-center gap-2">
+                    <Button
+                      onClick={() => revoke(k.id)}
+                      size="sm"
+                      variant="destructive"
+                    >
+                      {t("settings.integrations.fhirServer.confirmRevoke")}
+                    </Button>
+                    <Button
+                      onClick={() => setConfirmRevoke(null)}
+                      size="sm"
+                      variant="ghost"
+                    >
+                      {t("settings.integrations.fhirServer.cancel")}
+                    </Button>
+                  </div>
+                ) : (
+                  <Button
+                    onClick={() => setConfirmRevoke(k.id)}
+                    size="sm"
+                    variant="outline"
+                  >
+                    <Trash2 className="size-4" />
+                    {t("settings.integrations.fhirServer.revoke")}
+                  </Button>
+                )}
+              </li>
+            ))}
+          </ul>
+        ) : (
+          <p className="text-xs text-muted-foreground">
+            {t("settings.integrations.fhirServer.noKeys")}
+          </p>
+        )}
+      </SettingsCard>
+    </SettingsSection>
+  );
+}
+
 export function IntegrationsPanel() {
   const { t } = useTranslation();
   const [configs, setConfigs] = useState<IntegrationConfig[] | null>(null);
@@ -231,6 +446,7 @@ export function IntegrationsPanel() {
           } satisfies IntegrationConfig);
         return <IntegrationCard initial={initial} key={type} type={type} />;
       })}
+      <FhirServerCard />
     </div>
   );
 }

frontend/components/settings/settings-location.tsx

@@ -0,0 +1,211 @@
+"use client";
+
+import { LocateFixed } from "lucide-react";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import {
+  FieldLabel,
+  SettingsCard,
+  SettingsSection,
+  whiteButton,
+} from "@/components/settings/settings-parts";
+import { cn } from "@/lib/utils";
+import { getClinicSettings, saveClinicLocation } from "@/lib/clinic";
+import { notify } from "@/lib/toast";
+
+// Parse a coordinate input into a number or null (empty ⇒ null). Returns
+// `false` when the string is present but not a finite number, so we can flag it.
+function parseCoord(value: string): number | null | false {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  const n = Number(trimmed);
+  return Number.isFinite(n) ? n : false;
+}
+
+// Clinic location editor (owner/admin only — mounted inside the Signing panel).
+// Persists the clinic's address + optional map coordinates so the wallet app can
+// display the clinic location later.
+export function ClinicLocationSection() {
+  const { t } = useTranslation();
+  const [address, setAddress] = useState("");
+  const [city, setCity] = useState("");
+  const [country, setCountry] = useState("");
+  const [latitude, setLatitude] = useState("");
+  const [longitude, setLongitude] = useState("");
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [locating, setLocating] = useState(false);
+
+  useEffect(() => {
+    let active = true;
+    getClinicSettings()
+      .then((settings) => {
+        if (!active) return;
+        const loc = settings.location;
+        setAddress(loc.address);
+        setCity(loc.city);
+        setCountry(loc.country);
+        setLatitude(loc.latitude === null ? "" : String(loc.latitude));
+        setLongitude(loc.longitude === null ? "" : String(loc.longitude));
+      })
+      .catch(() => {
+        /* keep empty defaults */
+      })
+      .finally(() => {
+        if (active) setLoading(false);
+      });
+    return () => {
+      active = false;
+    };
+  }, []);
+
+  // Fill the coordinates from the browser's geolocation (the clinician runs this
+  // on a device at the clinic). Client-only — no backend or map service.
+  const useMyLocation = () => {
+    if (typeof navigator === "undefined" || !("geolocation" in navigator)) {
+      notify.error(
+        t("settings.location.errorTitle"),
+        t("settings.location.geoUnsupported"),
+      );
+      return;
+    }
+    setLocating(true);
+    navigator.geolocation.getCurrentPosition(
+      (pos) => {
+        setLatitude(pos.coords.latitude.toFixed(6));
+        setLongitude(pos.coords.longitude.toFixed(6));
+        setLocating(false);
+      },
+      () => {
+        setLocating(false);
+        notify.error(
+          t("settings.location.errorTitle"),
+          t("settings.location.geoError"),
+        );
+      },
+      { enableHighAccuracy: true, timeout: 10000 },
+    );
+  };
+
+  const save = async () => {
+    const lat = parseCoord(latitude);
+    const lng = parseCoord(longitude);
+    if (lat === false || lng === false) {
+      notify.error(
+        t("settings.location.errorTitle"),
+        t("settings.location.invalidCoords"),
+      );
+      return;
+    }
+    setSaving(true);
+    try {
+      await saveClinicLocation({
+        address: address.trim(),
+        city: city.trim(),
+        country: country.trim(),
+        latitude: lat,
+        longitude: lng,
+      });
+      notify.success(
+        t("settings.location.savedTitle"),
+        t("settings.location.savedBody"),
+      );
+    } catch {
+      notify.error(
+        t("settings.location.errorTitle"),
+        t("settings.location.error"),
+      );
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <SettingsSection
+      description={t("settings.location.description")}
+      title={t("settings.location.title")}
+    >
+      <SettingsCard className="flex flex-col gap-4 p-5">
+        <label className="flex flex-col gap-1.5">
+          <FieldLabel>{t("settings.location.address")}</FieldLabel>
+          <Input
+            disabled={loading}
+            onChange={(e) => setAddress(e.target.value)}
+            placeholder={t("settings.location.addressPlaceholder")}
+            value={address}
+          />
+        </label>
+        <div className="grid gap-4 sm:grid-cols-2">
+          <label className="flex flex-col gap-1.5">
+            <FieldLabel>{t("settings.location.city")}</FieldLabel>
+            <Input
+              disabled={loading}
+              onChange={(e) => setCity(e.target.value)}
+              value={city}
+            />
+          </label>
+          <label className="flex flex-col gap-1.5">
+            <FieldLabel>{t("settings.location.country")}</FieldLabel>
+            <Input
+              disabled={loading}
+              onChange={(e) => setCountry(e.target.value)}
+              value={country}
+            />
+          </label>
+        </div>
+        <div className="grid gap-4 sm:grid-cols-2">
+          <label className="flex flex-col gap-1.5">
+            <FieldLabel>{t("settings.location.latitude")}</FieldLabel>
+            <Input
+              disabled={loading}
+              inputMode="decimal"
+              onChange={(e) => setLatitude(e.target.value)}
+              placeholder="e.g. 2.0469"
+              value={latitude}
+            />
+          </label>
+          <label className="flex flex-col gap-1.5">
+            <FieldLabel>{t("settings.location.longitude")}</FieldLabel>
+            <Input
+              disabled={loading}
+              inputMode="decimal"
+              onChange={(e) => setLongitude(e.target.value)}
+              placeholder="e.g. 45.3182"
+              value={longitude}
+            />
+          </label>
+        </div>
+        <p className="text-xs text-muted-foreground">
+          {t("settings.location.coordinatesHint")}
+        </p>
+        <div className="flex flex-wrap gap-2">
+          <Button
+            className={cn("rounded-lg", whiteButton)}
+            disabled={loading || saving}
+            onClick={save}
+            type="button"
+          >
+            {saving
+              ? t("settings.location.saving")
+              : t("settings.location.save")}
+          </Button>
+          <Button
+            className="rounded-lg"
+            disabled={loading || locating}
+            onClick={useMyLocation}
+            type="button"
+            variant="outline"
+          >
+            <LocateFixed className="size-4" />
+            {locating
+              ? t("settings.location.locating")
+              : t("settings.location.useMyLocation")}
+          </Button>
+        </div>
+      </SettingsCard>
+    </SettingsSection>
+  );
+}

frontend/components/settings/settings-portal.tsx

@@ -0,0 +1,99 @@
+"use client";
+
+import { ExternalLink, QrCode } from "lucide-react";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import QRCodeSvg from "react-qr-code";
+
+import {
+  CopyField,
+  SettingsCard,
+  SettingsSection,
+  whiteButton,
+} from "@/components/settings/settings-parts";
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogDescription,
+  DialogHeader,
+  DialogPanel,
+  DialogPopup,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { authClient } from "@/lib/auth-client";
+import { resolveBackendUrl } from "@/lib/backend-url";
+import { cn } from "@/lib/utils";
+
+// Patient Portal section (Settings → Signing): surfaces the clinic's public
+// portal link so patients can open it, copy it, or scan a QR. The portal lives
+// at /portal/<org-slug>; the QR also carries the backend base (`?api=`) so the
+// patient wallet app can reach the JSON API when it scans the same code.
+export function PatientPortalSection() {
+  const { t } = useTranslation();
+  const { data: activeOrg } = authClient.useActiveOrganization();
+  const [qrOpen, setQrOpen] = useState(false);
+
+  const slug = activeOrg?.slug;
+  const origin = typeof window !== "undefined" ? window.location.origin : "";
+  const portalUrl = slug ? `${origin}/portal/${slug}` : "";
+  const qrUrl = slug
+    ? `${portalUrl}?api=${encodeURIComponent(resolveBackendUrl())}`
+    : "";
+
+  return (
+    <SettingsSection
+      description={t("settings.portal.description")}
+      title={t("settings.portal.title")}
+    >
+      <SettingsCard className="flex flex-col gap-4 p-5">
+        <CopyField
+          description={t("settings.portal.linkDescription")}
+          label={t("settings.portal.linkLabel")}
+          value={portalUrl || "—"}
+        />
+        <div className="flex flex-wrap gap-2">
+          <Button
+            className={cn("rounded-lg", whiteButton)}
+            disabled={!portalUrl}
+            onClick={() => window.open(portalUrl, "_blank", "noopener")}
+            type="button"
+          >
+            <ExternalLink className="size-4" />
+            {t("settings.portal.open")}
+          </Button>
+          <Button
+            className="rounded-lg"
+            disabled={!qrUrl}
+            onClick={() => setQrOpen(true)}
+            type="button"
+            variant="outline"
+          >
+            <QrCode className="size-4" />
+            {t("settings.portal.showQr")}
+          </Button>
+        </div>
+      </SettingsCard>
+
+      <Dialog onOpenChange={setQrOpen} open={qrOpen}>
+        <DialogPopup className="sm:max-w-sm">
+          <DialogHeader>
+            <DialogTitle>{t("settings.portal.qrTitle")}</DialogTitle>
+            <DialogDescription>
+              {t("settings.portal.qrDescription")}
+            </DialogDescription>
+          </DialogHeader>
+          <DialogPanel className="flex flex-col items-center gap-3 pb-2">
+            {qrUrl ? (
+              <div className="rounded-2xl bg-white p-4">
+                <QRCodeSvg value={qrUrl} size={220} />
+              </div>
+            ) : null}
+            <p className="break-all text-center text-sm text-muted-foreground">
+              {portalUrl}
+            </p>
+          </DialogPanel>
+        </DialogPopup>
+      </Dialog>
+    </SettingsSection>
+  );
+}

frontend/components/sidebar-02/app-sidebar.tsx

@@ -15,6 +15,7 @@ import {
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
 import { useAiAccess } from "@/lib/ai-policy";
+import { dirFor } from "@/lib/i18n/config";
 import { useActiveRole, visibleNavItems } from "@/lib/roles";
 import { motion } from "framer-motion";
 import Image from "next/image";
@@ -27,7 +28,10 @@ import { useCallInvites } from "@/components/meetings/use-call-invites";
 
 export function DashboardSidebar() {
   const { state } = useSidebar();
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
+  // Anchor the sidebar to the right for RTL locales (Arabic) so the whole shell
+  // mirrors instead of leaving the fixed sidebar pinned physically left.
+  const side = dirFor(i18n.language) === "rtl" ? "right" : "left";
   const role = useActiveRole();
   const { allowed: aiAllowed } = useAiAccess();
   const isCollapsed = state === "collapsed";
@@ -54,7 +58,7 @@ export function DashboardSidebar() {
   }));
 
   return (
-    <Sidebar variant="inset" collapsible="icon">
+    <Sidebar variant="inset" collapsible="icon" side={side}>
       <SidebarHeader
         className={cn(
           "flex md:pt-3.5",

frontend/components/ui/switch.tsx

@@ -19,7 +19,7 @@ export function Switch({
     >
       <SwitchPrimitive.Thumb
         className={cn(
-          "pointer-events-none block aspect-square h-full origin-left in-[[role=switch]:active,[data-slot=label]:active,[data-slot=field-label]:active]:not-data-disabled:scale-x-110 in-[[role=switch]:active,[data-slot=label]:active,[data-slot=field-label]:active]:rounded-[var(--thumb-size)/calc(var(--thumb-size)*1.1)] rounded-(--thumb-size) bg-background shadow-sm/5 will-change-transform [transition:translate_.15s,border-radius_.15s,scale_.1s_.1s,transform-origin_.15s] data-checked:origin-[var(--thumb-size)_50%] data-checked:translate-x-[calc(var(--thumb-size)-4px)]",
+          "pointer-events-none block aspect-square h-full ltr:origin-left rtl:origin-right in-[[role=switch]:active,[data-slot=label]:active,[data-slot=field-label]:active]:not-data-disabled:scale-x-110 in-[[role=switch]:active,[data-slot=label]:active,[data-slot=field-label]:active]:rounded-[var(--thumb-size)/calc(var(--thumb-size)*1.1)] rounded-(--thumb-size) bg-background shadow-sm/5 will-change-transform [transition:translate_.15s,border-radius_.15s,scale_.1s_.1s,transform-origin_.15s] data-checked:origin-[var(--thumb-size)_50%] ltr:data-checked:translate-x-[calc(var(--thumb-size)-4px)] rtl:data-checked:-translate-x-[calc(var(--thumb-size)-4px)]",
         )}
         data-slot="switch-thumb"
       />

frontend/lib/clinic.ts

@@ -0,0 +1,33 @@
+// Client for clinic-level (organization) settings — currently the clinic's
+// location (Settings → Signing → Location). Calls the backend over the shared
+// fetch wrapper (session cookie sent automatically).
+
+import { apiFetch } from "@/lib/api-client";
+
+export type ClinicLocation = {
+  address: string;
+  city: string;
+  country: string;
+  latitude: number | null;
+  longitude: number | null;
+};
+
+export type ClinicSettings = {
+  location: ClinicLocation;
+};
+
+// The clinic's settings. Readable by any clinician; returns empty defaults when
+// nothing has been set yet.
+export async function getClinicSettings(): Promise<ClinicSettings> {
+  return apiFetch<ClinicSettings>("/api/clinic/settings");
+}
+
+// Save the clinic's location (owner/admin only). Returns the updated settings.
+export async function saveClinicLocation(
+  location: ClinicLocation,
+): Promise<ClinicSettings> {
+  return apiFetch<ClinicSettings>("/api/clinic/location", {
+    method: "PUT",
+    body: JSON.stringify(location),
+  });
+}

frontend/lib/i18n/locales/ar/translation.json

@@ -322,6 +322,7 @@
       "expiredTitle": "انتهت صلاحية الطلب",
       "expiredBody": "انتهت مهلة الطلب قبل أن يستجيب المريض.",
       "invalidWallet": "لا يبدو هذا رقم محفظة صالحًا.",
+      "networkOff": "انضم أولاً إلى شبكة Temetro (الإعدادات ← التوقيع) للمشاركة مع تطبيقات المرضى.",
       "errorTitle": "تعذّر الوصول إلى المحفظة",
       "error": "يرجى التحقّق من رقم المحفظة والمحاولة مرة أخرى.",
       "savedTitle": "تم استيراد المريض",
@@ -1462,6 +1463,8 @@
       "allergies": "الحساسيات",
       "activeMeds": "الأدوية النشطة",
       "openProblems": "المشكلات المفتوحة",
+      "bloodType": "فصيلة الدم",
+      "phone": "الهاتف",
       "none": "لا شيء",
       "editRecord": "تعديل السجل"
     },
@@ -1564,6 +1567,10 @@
     "primaryCare": "الرعاية الأساسية",
     "primaryCarePlaceholder": "مثال: د. لينا أورتيز",
     "primaryCareUnassigned": "غير مُعيّن",
+    "phone": "الهاتف",
+    "phonePlaceholder": "مثال: +1 555 010 2938",
+    "bloodType": "فصيلة الدم",
+    "bloodTypeUnknown": "غير معروف",
     "currentVitals": "العلامات الحيوية الحالية",
     "bp": "ضغط الدم",
     "hr": "معدل ضربات القلب",
@@ -1692,6 +1699,32 @@
         "endpointPlaceholder": "https://your-clearinghouse.example/claims",
         "credentialsPlaceholder": "JSON: {\"token\":\"…\",\"submitterId\":\"…\",\"receiverId\":\"…\"}",
         "credentialsHint": "JSON مع رمز مركز المقاصة ومعرّفات المرسل/المستقبل."
+      },
+      "fhirServer": {
+        "title": "خادم FHIR (مشاركة سجلاتك)",
+        "description": "اعرض سجلات هذه العيادة للأنظمة الخارجية كخادم FHIR R4 للقراءة فقط، مع المصادقة عبر مفاتيح API خاصة بكل عيادة.",
+        "baseUrl": "عنوان URL الأساسي",
+        "baseUrlHint": "وجّه عميل FHIR إلى هذا العنوان. يقدّم Patient وObservation وCondition وAllergyIntolerance وMedicationRequest وEncounter وAppointment.",
+        "copiedUrl": "تم نسخ العنوان الأساسي",
+        "newKey": "إنشاء مفتاح API",
+        "newKeyPlaceholder": "اسم المفتاح (مثل مستودع الأبحاث)",
+        "create": "إنشاء",
+        "creating": "جارٍ الإنشاء…",
+        "createFailed": "تعذّر إنشاء المفتاح",
+        "createFailedBody": "يرجى المحاولة مرة أخرى.",
+        "secretTitle": "انسخ مفتاح API الآن",
+        "secretHint": "هذه هي المرة الوحيدة التي يظهر فيها السر. احفظه في مكان آمن — لا يمكن استرجاعه لاحقًا.",
+        "copiedSecret": "تم نسخ مفتاح API",
+        "dismissSecret": "تم",
+        "noKeys": "لا توجد مفاتيح API بعد. أنشئ واحدًا للسماح لعميل FHIR بالاتصال.",
+        "lastUsed": "آخر استخدام {{when}}",
+        "neverUsed": "لم يُستخدم قط",
+        "revoke": "إبطال",
+        "confirmRevoke": "إبطال المفتاح",
+        "revoked": "تم الإبطال",
+        "revokeFailed": "تعذّر إبطال المفتاح",
+        "revokeFailedBody": "يرجى المحاولة مرة أخرى.",
+        "cancel": "إلغاء"
       }
     },
     "empty": "لا شيء هنا بعد.",
@@ -1970,6 +2003,42 @@
         "errorTitle": "تعذّر إضافة العضو"
       }
     },
+    "network": {
+      "title": "شبكة Temetro",
+      "description": "يتيح مُرحّل شبكة Temetro لتطبيقات محفظة المرضى الاتصال بعيادتك لمشاركة السجلات والموافقة عليها — مشفّرة من طرف إلى طرف، مع تعريف عيادتك بمفتاح التوقيع الخاص بها.",
+      "toggleLabel": "الانضمام إلى شبكة Temetro",
+      "toggleDesc": "عند التفعيل، تتصل هذه العيادة بالمُرحّل لاستيراد السجلات من تطبيقات المرضى وإرسال التحديثات إلى محافظهم.",
+      "statusConnected": "متصل",
+      "statusOff": "معطّل",
+      "joinedTitle": "تم الانضمام إلى شبكة Temetro",
+      "joinedBody": "يمكن الآن لتطبيقات محفظة المرضى الاتصال بهذه العيادة.",
+      "leftTitle": "تم مغادرة شبكة Temetro",
+      "leftBody": "لم تعد هذه العيادة متصلة بالمُرحّل.",
+      "errorTitle": "تعذّر تحديث الوصول إلى الشبكة",
+      "error": "يرجى المحاولة مرة أخرى."
+    },
+    "location": {
+      "title": "موقع العيادة",
+      "description": "عنوان عيادتك وإحداثيات الخريطة. تظهر للمرضى في تطبيق المحفظة.",
+      "address": "العنوان",
+      "addressPlaceholder": "عنوان الشارع",
+      "city": "المدينة",
+      "country": "الدولة",
+      "latitude": "خط العرض",
+      "longitude": "خط الطول",
+      "coordinatesHint": "الإحداثيات اختيارية — تُستخدم لعرض عيادتك على الخريطة.",
+      "save": "حفظ الموقع",
+      "saving": "جارٍ الحفظ…",
+      "savedTitle": "تم حفظ الموقع",
+      "savedBody": "تم تحديث موقع عيادتك.",
+      "invalidCoords": "يجب أن يكون خطا العرض والطول أرقامًا.",
+      "errorTitle": "تعذّر حفظ الموقع",
+      "error": "يرجى المحاولة مرة أخرى.",
+      "useMyLocation": "استخدام موقعي الحالي",
+      "locating": "جارٍ تحديد الموقع…",
+      "geoUnsupported": "الموقع غير متاح على هذا الجهاز.",
+      "geoError": "تعذّر الحصول على موقعك. تحقّق من الأذونات وحاول مرة أخرى."
+    },
     "signing": {
       "keyTitle": "مفتاح التوقيع",
       "active": "نشط",
@@ -2080,6 +2149,16 @@
       "savedBody": "تم تحديث تهيئة الذكاء الاصطناعي الخاصة بك.",
       "saveFailedTitle": "تعذّر الحفظ",
       "saveFailedBody": "فشل حفظ إعدادات الذكاء الاصطناعي. يرجى المحاولة مرة أخرى."
+    },
+    "portal": {
+      "title": "بوابة المريض",
+      "description": "شارك بوابة الحجز العامة لعيادتك مع المرضى — يمكنهم رؤية أطبائك وحجز المواعيد.",
+      "linkLabel": "رابط البوابة",
+      "linkDescription": "الصفحة العامة التي يفتحها المرضى للحجز في عيادتك.",
+      "open": "فتح البوابة",
+      "showQr": "عرض رمز QR",
+      "qrTitle": "رمز QR لبوابة المريض",
+      "qrDescription": "يمسح المرضى هذا لفتح بوابة عيادتك — أو يمسحونه في تطبيق محفظة Temetro للحجز."
     }
   },
   "portal": {

frontend/lib/i18n/locales/de/translation.json

@@ -310,6 +310,7 @@
       "expiredTitle": "Anfrage abgelaufen",
       "expiredBody": "Die Anfrage ist abgelaufen, bevor der Patient geantwortet hat.",
       "invalidWallet": "Das sieht nicht nach einer gültigen Wallet-Nummer aus.",
+      "networkOff": "Treten Sie zuerst dem Temetro-Netzwerk bei (Einstellungen → Signierung), um mit Patienten-Apps zu teilen.",
       "errorTitle": "Wallet nicht erreichbar",
       "error": "Bitte prüfen Sie die Wallet-Nummer und versuchen Sie es erneut.",
       "savedTitle": "Patient importiert",
@@ -1442,6 +1443,8 @@
       "allergies": "Allergien",
       "activeMeds": "Aktive Medikamente",
       "openProblems": "Offene Probleme",
+      "bloodType": "Blutgruppe",
+      "phone": "Telefon",
       "none": "Keine",
       "editRecord": "Datensatz bearbeiten"
     },
@@ -1544,6 +1547,10 @@
     "primaryCare": "Primärversorgung",
     "primaryCarePlaceholder": "z. B. Dr. Lena Ortiz",
     "primaryCareUnassigned": "Nicht zugewiesen",
+    "phone": "Telefon",
+    "phonePlaceholder": "z. B. +1 555 010 2938",
+    "bloodType": "Blutgruppe",
+    "bloodTypeUnknown": "Unbekannt",
     "currentVitals": "Aktuelle Vitalwerte",
     "bp": "Blutdruck",
     "hr": "Herzfrequenz",
@@ -1672,6 +1679,32 @@
         "endpointPlaceholder": "https://ihre-verrechnungsstelle.example/claims",
         "credentialsPlaceholder": "JSON: {\"token\":\"…\",\"submitterId\":\"…\",\"receiverId\":\"…\"}",
         "credentialsHint": "JSON mit Ihrem Token und Absender-/Empfänger-IDs der Verrechnungsstelle."
+      },
+      "fhirServer": {
+        "title": "FHIR-Server (Datensätze teilen)",
+        "description": "Stellen Sie die Datensätze dieser Praxis externen Systemen als schreibgeschützten FHIR-R4-Server bereit, authentifiziert über praxiseigene API-Schlüssel.",
+        "baseUrl": "Basis-URL",
+        "baseUrlHint": "Richten Sie einen FHIR-Client auf diese URL. Sie liefert Patient, Observation, Condition, AllergyIntolerance, MedicationRequest, Encounter und Appointment.",
+        "copiedUrl": "Basis-URL kopiert",
+        "newKey": "API-Schlüssel erstellen",
+        "newKeyPlaceholder": "Schlüsselname (z. B. Forschungslager)",
+        "create": "Erstellen",
+        "creating": "Wird erstellt…",
+        "createFailed": "Schlüssel konnte nicht erstellt werden",
+        "createFailedBody": "Bitte erneut versuchen.",
+        "secretTitle": "Kopieren Sie Ihren API-Schlüssel jetzt",
+        "secretHint": "Das Geheimnis wird nur dieses eine Mal angezeigt. Bewahren Sie es sicher auf — es kann später nicht abgerufen werden.",
+        "copiedSecret": "API-Schlüssel kopiert",
+        "dismissSecret": "Fertig",
+        "noKeys": "Noch keine API-Schlüssel. Erstellen Sie einen, damit sich ein FHIR-Client verbinden kann.",
+        "lastUsed": "Zuletzt verwendet {{when}}",
+        "neverUsed": "Nie verwendet",
+        "revoke": "Widerrufen",
+        "confirmRevoke": "Schlüssel widerrufen",
+        "revoked": "Widerrufen",
+        "revokeFailed": "Schlüssel konnte nicht widerrufen werden",
+        "revokeFailedBody": "Bitte erneut versuchen.",
+        "cancel": "Abbrechen"
       }
     },
     "empty": "Hier gibt es noch nichts.",
@@ -1950,6 +1983,42 @@
         "errorTitle": "Mitglied konnte nicht hinzugefügt werden"
       }
     },
+    "network": {
+      "title": "Temetro-Netzwerk",
+      "description": "Das Temetro-Netzwerk-Relay ermöglicht es den Wallet-Apps der Patienten, sich mit Ihrer Praxis zu verbinden, um Akten zu teilen und zu genehmigen — Ende-zu-Ende-verschlüsselt, wobei Ihre Praxis über ihren Signierschlüssel identifiziert wird.",
+      "toggleLabel": "Temetro-Netzwerk beitreten",
+      "toggleDesc": "Wenn aktiviert, verbindet sich diese Praxis mit dem Relay, sodass Sie Akten aus Patienten-Apps importieren und Aktualisierungen an deren Wallets senden können.",
+      "statusConnected": "Verbunden",
+      "statusOff": "Aus",
+      "joinedTitle": "Temetro-Netzwerk beigetreten",
+      "joinedBody": "Wallet-Apps der Patienten können sich jetzt mit dieser Praxis verbinden.",
+      "leftTitle": "Temetro-Netzwerk verlassen",
+      "leftBody": "Diese Praxis ist nicht mehr mit dem Relay verbunden.",
+      "errorTitle": "Netzwerkzugriff konnte nicht aktualisiert werden",
+      "error": "Bitte versuchen Sie es erneut."
+    },
+    "location": {
+      "title": "Standort der Klinik",
+      "description": "Adresse und Kartenkoordinaten Ihrer Klinik. Wird Patienten in der Wallet-App angezeigt.",
+      "address": "Adresse",
+      "addressPlaceholder": "Straße und Hausnummer",
+      "city": "Stadt",
+      "country": "Land",
+      "latitude": "Breitengrad",
+      "longitude": "Längengrad",
+      "coordinatesHint": "Koordinaten sind optional – um Ihre Klinik auf einer Karte anzuzeigen.",
+      "save": "Standort speichern",
+      "saving": "Wird gespeichert …",
+      "savedTitle": "Standort gespeichert",
+      "savedBody": "Der Standort Ihrer Klinik wurde aktualisiert.",
+      "invalidCoords": "Breiten- und Längengrad müssen Zahlen sein.",
+      "errorTitle": "Standort konnte nicht gespeichert werden",
+      "error": "Bitte versuchen Sie es erneut.",
+      "useMyLocation": "Aktuellen Standort verwenden",
+      "locating": "Standort wird ermittelt …",
+      "geoUnsupported": "Standort ist auf diesem Gerät nicht verfügbar.",
+      "geoError": "Standort konnte nicht ermittelt werden. Bitte Berechtigungen prüfen und erneut versuchen."
+    },
     "signing": {
       "keyTitle": "Signierschlüssel",
       "active": "Aktiv",
@@ -2060,6 +2129,16 @@
       "savedBody": "Ihre KI-Konfiguration wurde aktualisiert.",
       "saveFailedTitle": "Speichern fehlgeschlagen",
       "saveFailedBody": "Das Speichern Ihrer KI-Einstellungen ist fehlgeschlagen. Bitte versuchen Sie es erneut."
+    },
+    "portal": {
+      "title": "Patientenportal",
+      "description": "Teilen Sie das öffentliche Buchungsportal Ihrer Klinik mit Patienten – sie können Ihre Ärzte sehen und Termine buchen.",
+      "linkLabel": "Portal-Link",
+      "linkDescription": "Die öffentliche Seite, die Patienten zum Buchen bei Ihrer Klinik öffnen.",
+      "open": "Portal öffnen",
+      "showQr": "QR-Code anzeigen",
+      "qrTitle": "Patientenportal-QR",
+      "qrDescription": "Patienten scannen dies, um das Portal Ihrer Klinik zu öffnen – oder scannen es in der Temetro-Wallet-App, um zu buchen."
     }
   },
   "portal": {

frontend/lib/i18n/locales/en/translation.json

@@ -310,6 +310,7 @@
       "expiredTitle": "Request expired",
       "expiredBody": "The request timed out before the patient responded.",
       "invalidWallet": "That doesn't look like a valid wallet number.",
+      "networkOff": "Join the Temetro Network first (Settings → Signing) to share with patient apps.",
       "errorTitle": "Couldn't reach the wallet",
       "error": "Please check the wallet number and try again.",
       "savedTitle": "Patient imported",
@@ -1442,6 +1443,8 @@
       "allergies": "Allergies",
       "activeMeds": "Active meds",
       "openProblems": "Open problems",
+      "bloodType": "Blood type",
+      "phone": "Phone",
       "none": "None",
       "editRecord": "Edit record"
     },
@@ -1544,6 +1547,10 @@
     "primaryCare": "Primary care",
     "primaryCarePlaceholder": "e.g. Dr. Lena Ortiz",
     "primaryCareUnassigned": "Unassigned",
+    "phone": "Phone",
+    "phonePlaceholder": "e.g. +1 555 010 2938",
+    "bloodType": "Blood type",
+    "bloodTypeUnknown": "Unknown",
     "currentVitals": "Current vitals",
     "bp": "Blood pressure",
     "hr": "Heart rate",
@@ -1672,6 +1679,32 @@
         "endpointPlaceholder": "https://your-clearinghouse.example/claims",
         "credentialsPlaceholder": "JSON: {\"token\":\"…\",\"submitterId\":\"…\",\"receiverId\":\"…\"}",
         "credentialsHint": "JSON with your clearinghouse token and submitter/receiver ids."
+      },
+      "fhirServer": {
+        "title": "FHIR server (share your records)",
+        "description": "Expose this clinic's records to external systems as a read-only FHIR R4 server, authenticated with per-clinic API keys.",
+        "baseUrl": "Base URL",
+        "baseUrlHint": "Point a FHIR client at this URL. It serves Patient, Observation, Condition, AllergyIntolerance, MedicationRequest, Encounter and Appointment.",
+        "copiedUrl": "Base URL copied",
+        "newKey": "Create an API key",
+        "newKeyPlaceholder": "Key name (e.g. Research warehouse)",
+        "create": "Create",
+        "creating": "Creating…",
+        "createFailed": "Couldn't create the key",
+        "createFailedBody": "Please try again.",
+        "secretTitle": "Copy your API key now",
+        "secretHint": "This is the only time the secret is shown. Store it somewhere safe — it can't be retrieved later.",
+        "copiedSecret": "API key copied",
+        "dismissSecret": "Done",
+        "noKeys": "No API keys yet. Create one to let a FHIR client connect.",
+        "lastUsed": "Last used {{when}}",
+        "neverUsed": "Never used",
+        "revoke": "Revoke",
+        "confirmRevoke": "Revoke key",
+        "revoked": "Revoked",
+        "revokeFailed": "Couldn't revoke the key",
+        "revokeFailedBody": "Please try again.",
+        "cancel": "Cancel"
       }
     },
     "empty": "Nothing here yet.",
@@ -1950,6 +1983,42 @@
         "errorTitle": "Could not add member"
       }
     },
+    "network": {
+      "title": "Temetro Network",
+      "description": "The Temetro Network relay lets patients' wallet apps connect to your clinic to share and approve records — end-to-end encrypted, with your clinic identified by its signing key.",
+      "toggleLabel": "Join Temetro Network",
+      "toggleDesc": "When on, this clinic connects to the relay so you can import records from patient apps and push updates to their wallets.",
+      "statusConnected": "Connected",
+      "statusOff": "Off",
+      "joinedTitle": "Joined the Temetro Network",
+      "joinedBody": "Patient wallet apps can now connect to this clinic.",
+      "leftTitle": "Left the Temetro Network",
+      "leftBody": "This clinic is no longer connected to the relay.",
+      "errorTitle": "Couldn't update network access",
+      "error": "Please try again."
+    },
+    "location": {
+      "title": "Clinic location",
+      "description": "Your clinic's address and map coordinates. Shown to patients in the wallet app.",
+      "address": "Address",
+      "addressPlaceholder": "Street address",
+      "city": "City",
+      "country": "Country",
+      "latitude": "Latitude",
+      "longitude": "Longitude",
+      "coordinatesHint": "Coordinates are optional — used to show your clinic on a map.",
+      "save": "Save location",
+      "saving": "Saving…",
+      "savedTitle": "Location saved",
+      "savedBody": "Your clinic location has been updated.",
+      "invalidCoords": "Latitude and longitude must be numbers.",
+      "errorTitle": "Couldn't save location",
+      "error": "Please try again.",
+      "useMyLocation": "Use my current location",
+      "locating": "Locating…",
+      "geoUnsupported": "Location isn't available on this device.",
+      "geoError": "Couldn't get your location. Check permissions and try again."
+    },
     "signing": {
       "keyTitle": "Signing key",
       "active": "Active",
@@ -2060,6 +2129,16 @@
       "savedBody": "Your AI configuration has been updated.",
       "saveFailedTitle": "Could not save",
       "saveFailedBody": "Saving your AI settings failed. Please try again."
+    },
+    "portal": {
+      "title": "Patient Portal",
+      "description": "Share your clinic's public booking portal with patients — they can view your doctors and book appointments.",
+      "linkLabel": "Portal link",
+      "linkDescription": "The public page patients open to book with your clinic.",
+      "open": "Open portal",
+      "showQr": "Show QR code",
+      "qrTitle": "Patient Portal QR",
+      "qrDescription": "Patients scan this to open your clinic's portal — or scan it in the Temetro wallet app to book."
     }
   },
   "portal": {

frontend/lib/i18n/locales/fr/translation.json

@@ -310,6 +310,7 @@
       "expiredTitle": "Demande expirée",
       "expiredBody": "La demande a expiré avant que le patient ne réponde.",
       "invalidWallet": "Cela ne ressemble pas à un numéro de portefeuille valide.",
+      "networkOff": "Rejoignez d'abord le Réseau Temetro (Paramètres → Signature) pour partager avec les applications des patients.",
       "errorTitle": "Impossible de joindre le portefeuille",
       "error": "Veuillez vérifier le numéro de portefeuille et réessayer.",
       "savedTitle": "Patient importé",
@@ -1442,6 +1443,8 @@
       "allergies": "Allergies",
       "activeMeds": "Médicaments actifs",
       "openProblems": "Problèmes ouverts",
+      "bloodType": "Groupe sanguin",
+      "phone": "Téléphone",
       "none": "Aucun",
       "editRecord": "Modifier le dossier"
     },
@@ -1544,6 +1547,10 @@
     "primaryCare": "Praticien référent",
     "primaryCarePlaceholder": "ex. Dr Lena Ortiz",
     "primaryCareUnassigned": "Non attribué",
+    "phone": "Téléphone",
+    "phonePlaceholder": "p. ex. +1 555 010 2938",
+    "bloodType": "Groupe sanguin",
+    "bloodTypeUnknown": "Inconnu",
     "currentVitals": "Signes vitaux actuels",
     "bp": "Tension artérielle",
     "hr": "Fréquence cardiaque",
@@ -1672,6 +1679,32 @@
         "endpointPlaceholder": "https://votre-chambre-compensation.example/claims",
         "credentialsPlaceholder": "JSON : {\"token\":\"…\",\"submitterId\":\"…\",\"receiverId\":\"…\"}",
         "credentialsHint": "JSON avec le jeton de votre chambre de compensation et les identifiants d'expéditeur/destinataire."
+      },
+      "fhirServer": {
+        "title": "Serveur FHIR (partager vos dossiers)",
+        "description": "Exposez les dossiers de cette clinique à des systèmes externes via un serveur FHIR R4 en lecture seule, authentifié par des clés d'API propres à la clinique.",
+        "baseUrl": "URL de base",
+        "baseUrlHint": "Pointez un client FHIR vers cette URL. Elle expose Patient, Observation, Condition, AllergyIntolerance, MedicationRequest, Encounter et Appointment.",
+        "copiedUrl": "URL de base copiée",
+        "newKey": "Créer une clé d'API",
+        "newKeyPlaceholder": "Nom de la clé (ex. Entrepôt de recherche)",
+        "create": "Créer",
+        "creating": "Création…",
+        "createFailed": "Impossible de créer la clé",
+        "createFailedBody": "Veuillez réessayer.",
+        "secretTitle": "Copiez votre clé d'API maintenant",
+        "secretHint": "Le secret n'est affiché qu'une seule fois. Conservez-le en lieu sûr — il ne pourra pas être récupéré ensuite.",
+        "copiedSecret": "Clé d'API copiée",
+        "dismissSecret": "Terminé",
+        "noKeys": "Aucune clé d'API pour l'instant. Créez-en une pour qu'un client FHIR puisse se connecter.",
+        "lastUsed": "Dernière utilisation {{when}}",
+        "neverUsed": "Jamais utilisée",
+        "revoke": "Révoquer",
+        "confirmRevoke": "Révoquer la clé",
+        "revoked": "Révoquée",
+        "revokeFailed": "Impossible de révoquer la clé",
+        "revokeFailedBody": "Veuillez réessayer.",
+        "cancel": "Annuler"
       }
     },
     "empty": "Rien ici pour le moment.",
@@ -1950,6 +1983,42 @@
         "errorTitle": "Impossible d'ajouter le membre"
       }
     },
+    "network": {
+      "title": "Réseau Temetro",
+      "description": "Le relais Réseau Temetro permet aux applications portefeuille des patients de se connecter à votre clinique pour partager et approuver des dossiers — chiffrés de bout en bout, votre clinique étant identifiée par sa clé de signature.",
+      "toggleLabel": "Rejoindre le Réseau Temetro",
+      "toggleDesc": "Une fois activé, cette clinique se connecte au relais pour importer des dossiers depuis les applications des patients et envoyer des mises à jour vers leurs portefeuilles.",
+      "statusConnected": "Connecté",
+      "statusOff": "Désactivé",
+      "joinedTitle": "Réseau Temetro rejoint",
+      "joinedBody": "Les applications portefeuille des patients peuvent désormais se connecter à cette clinique.",
+      "leftTitle": "Réseau Temetro quitté",
+      "leftBody": "Cette clinique n'est plus connectée au relais.",
+      "errorTitle": "Impossible de mettre à jour l'accès au réseau",
+      "error": "Veuillez réessayer."
+    },
+    "location": {
+      "title": "Emplacement de la clinique",
+      "description": "L'adresse et les coordonnées cartographiques de votre clinique. Affichées aux patients dans l'application wallet.",
+      "address": "Adresse",
+      "addressPlaceholder": "Adresse postale",
+      "city": "Ville",
+      "country": "Pays",
+      "latitude": "Latitude",
+      "longitude": "Longitude",
+      "coordinatesHint": "Les coordonnées sont facultatives — utilisées pour afficher votre clinique sur une carte.",
+      "save": "Enregistrer l'emplacement",
+      "saving": "Enregistrement…",
+      "savedTitle": "Emplacement enregistré",
+      "savedBody": "L'emplacement de votre clinique a été mis à jour.",
+      "invalidCoords": "La latitude et la longitude doivent être des nombres.",
+      "errorTitle": "Impossible d'enregistrer l'emplacement",
+      "error": "Veuillez réessayer.",
+      "useMyLocation": "Utiliser ma position actuelle",
+      "locating": "Localisation…",
+      "geoUnsupported": "La localisation n'est pas disponible sur cet appareil.",
+      "geoError": "Impossible d'obtenir votre position. Vérifiez les autorisations et réessayez."
+    },
     "signing": {
       "keyTitle": "Clé de signature",
       "active": "Active",
@@ -2060,6 +2129,16 @@
       "savedBody": "Votre configuration d'IA a été mise à jour.",
       "saveFailedTitle": "Impossible d'enregistrer",
       "saveFailedBody": "L'enregistrement de vos paramètres d'IA a échoué. Veuillez réessayer."
+    },
+    "portal": {
+      "title": "Portail patient",
+      "description": "Partagez le portail de réservation public de votre clinique avec les patients — ils peuvent voir vos médecins et prendre rendez-vous.",
+      "linkLabel": "Lien du portail",
+      "linkDescription": "La page publique que les patients ouvrent pour réserver avec votre clinique.",
+      "open": "Ouvrir le portail",
+      "showQr": "Afficher le QR code",
+      "qrTitle": "QR du portail patient",
+      "qrDescription": "Les patients le scannent pour ouvrir le portail de votre clinique — ou le scannent dans l'application Temetro pour réserver."
     }
   },
   "portal": {

frontend/lib/i18n/locales/so/translation.json

@@ -310,6 +310,7 @@
       "expiredTitle": "Codsiga waa dhacay",
       "expiredBody": "Codsiga wuu dhacay ka hor inta uusan bukaanku ka jawaabin.",
       "invalidWallet": "Taasi uma muuqato lambar wallet oo sax ah.",
+      "networkOff": "Marka hore ku biir Shabakadda Temetro (Dejinta → Saxiixa) si aad ula wadaagto abaabulka bukaannada.",
       "errorTitle": "Wallet-ka lama gaari karin",
       "error": "Fadlan hubi lambarka wallet-ka oo isku day mar kale.",
       "savedTitle": "Bukaanka waa la soo dejiyay",
@@ -1442,6 +1443,8 @@
       "allergies": "Xasaasiyadaha",
       "activeMeds": "Daawooyin firfircoon",
       "openProblems": "Dhibaatooyin furan",
+      "bloodType": "Nooca dhiigga",
+      "phone": "Taleefanka",
       "none": "Midna",
       "editRecord": "Wax ka beddel diiwaanka"
     },
@@ -1544,6 +1547,10 @@
     "primaryCare": "Daryeelka aasaasiga ah",
     "primaryCarePlaceholder": "tusaale Dr. Lena Ortiz",
     "primaryCareUnassigned": "Aan la qoondayn",
+    "phone": "Taleefanka",
+    "phonePlaceholder": "tusaale: +1 555 010 2938",
+    "bloodType": "Nooca dhiigga",
+    "bloodTypeUnknown": "Aan la garanayn",
     "currentVitals": "Calaamadaha muhiimka ah ee hadda",
     "bp": "Cadaadiska dhiigga",
     "hr": "Garaaca wadnaha",
@@ -1672,6 +1679,32 @@
         "endpointPlaceholder": "https://xarunta-xisaabintaada.example/claims",
         "credentialsPlaceholder": "JSON: {\"token\":\"…\",\"submitterId\":\"…\",\"receiverId\":\"…\"}",
         "credentialsHint": "JSON leh token-ka xarunta xisaabinta iyo aqoonsiyada diraha/qaataha."
+      },
+      "fhirServer": {
+        "title": "Serfarka FHIR (la wadaag diiwaannadaada)",
+        "description": "U soo bandhig diiwaannada rugtan nidaamyada dibadda ah sida serfar FHIR R4 akhris-oo-keliya, oo lagu ansixiyo furayaal API oo rug walba gaar u ah.",
+        "baseUrl": "URL-ka aasaasiga ah",
+        "baseUrlHint": "U tilmaam macmiil FHIR URL-kan. Wuxuu adeegaa Patient, Observation, Condition, AllergyIntolerance, MedicationRequest, Encounter iyo Appointment.",
+        "copiedUrl": "URL-ka aasaasiga waa la koobiyeeyay",
+        "newKey": "Samee fure API",
+        "newKeyPlaceholder": "Magaca furaha (tusaale, Bakhaarka cilmi-baarista)",
+        "create": "Samee",
+        "creating": "Waa la samaynayaa…",
+        "createFailed": "Furaha lama abuuri karin",
+        "createFailedBody": "Fadlan mar kale isku day.",
+        "secretTitle": "Hadda koobiyee furahaaga API",
+        "secretHint": "Tanu waa markii kaliya ee sirta la muujiyo. Meel ammaan ah ku kaydi — lama soo ceshan karo dabadeed.",
+        "copiedSecret": "Furaha API waa la koobiyeeyay",
+        "dismissSecret": "Diyaar",
+        "noKeys": "Weli ma jiraan furayaal API ah. Mid samee si macmiil FHIR u xidho.",
+        "lastUsed": "Markii ugu dambeysay la isticmaalay {{when}}",
+        "neverUsed": "Weligeed lama isticmaalin",
+        "revoke": "Baabbi'i",
+        "confirmRevoke": "Baabbi'i furaha",
+        "revoked": "La baabbi'iyay",
+        "revokeFailed": "Furaha lama baabbi'in karin",
+        "revokeFailedBody": "Fadlan mar kale isku day.",
+        "cancel": "Jooji"
       }
     },
     "empty": "Weli halkan waxba ma jiraan.",
@@ -1950,6 +1983,42 @@
         "errorTitle": "Xubinta lama ku dari karin"
       }
     },
+    "network": {
+      "title": "Shabakadda Temetro",
+      "description": "Gudbiyaha Shabakadda Temetro wuxuu u oggolaanayaa abaabulka boorsada bukaannada inay ku xidhaan rugtaada si ay u wadaagaan oo u ansixiyaan diiwaannada — sir gaba-gabo ah, iyadoo rugtaada lagu aqoonsado furaheeda saxiixa.",
+      "toggleLabel": "Ku biir Shabakadda Temetro",
+      "toggleDesc": "Marka la shido, rugtan waxay ku xidhmaysaa gudbiyaha si aad u soo dejiso diiwaannada abaabulka bukaannada oo aad cusboonaysiin ugu dirto boorsadooda.",
+      "statusConnected": "La xidhiidhay",
+      "statusOff": "Daminaan",
+      "joinedTitle": "Waxaad ku biirtay Shabakadda Temetro",
+      "joinedBody": "Abaabulka boorsada bukaannada hadda way ku xidhmi karaan rugtan.",
+      "leftTitle": "Waxaad ka baxday Shabakadda Temetro",
+      "leftBody": "Rugtan hadda kuma xidhna gudbiyaha.",
+      "errorTitle": "Lama cusboonaysiin karin gelitaanka shabakadda",
+      "error": "Fadlan isku day mar kale."
+    },
+    "location": {
+      "title": "Goobta rugta caafimaadka",
+      "description": "Cinwaanka iyo isutagga khariidadda rugtaada. Waxaa loo tusayaa bukaannada app-ka wallet-ka.",
+      "address": "Cinwaanka",
+      "addressPlaceholder": "Cinwaanka waddada",
+      "city": "Magaalada",
+      "country": "Dalka",
+      "latitude": "Latitude",
+      "longitude": "Longitude",
+      "coordinatesHint": "Isutaggu waa ikhtiyaari — waxaa loo isticmaalaa in rugtaada lagu tuso khariidad.",
+      "save": "Kaydi goobta",
+      "saving": "Waa la kaydinayaa…",
+      "savedTitle": "Goobta waa la kaydiyay",
+      "savedBody": "Goobta rugtaada waa la cusboonaysiiyay.",
+      "invalidCoords": "Latitude iyo longitude waa inay noqdaan tirooyin.",
+      "errorTitle": "Lama kaydin karin goobta",
+      "error": "Fadlan mar kale isku day.",
+      "useMyLocation": "Isticmaal goobtayda hadda",
+      "locating": "Waa la helayaa goobta…",
+      "geoUnsupported": "Goobta laguma heli karo qalabkan.",
+      "geoError": "Lama heli karin goobtaada. Hubi oggolaanshaha oo isku day mar kale."
+    },
     "signing": {
       "keyTitle": "Furaha saxiixa",
       "active": "Firfircoon",
@@ -2060,6 +2129,16 @@
       "savedBody": "Qaabaynta AI-gaaga waa la cusbooneysiiyay.",
       "saveFailedTitle": "Lama kaydin karin",
       "saveFailedBody": "Kaydinta dejinta AI waa fashilantay. Fadlan isku day mar kale."
+    },
+    "portal": {
+      "title": "Boggaga Bukaanka",
+      "description": "La wadaag bukaannada boggaga ballanqaadka guud ee rugtaada — waxay arki karaan dhakhtarradaada oo ballan qaadan karaan.",
+      "linkLabel": "Linkiga boggaga",
+      "linkDescription": "Bogga guud ee bukaannadu furaan si ay ballan ugu qaataan rugtaada.",
+      "open": "Fur boggaga",
+      "showQr": "Muuji koodhka QR",
+      "qrTitle": "Koodhka QR ee Boggaga Bukaanka",
+      "qrDescription": "Bukaannadu waxay tan sawiraan si ay u furaan boggaga rugtaada — ama ku sawir abka Temetro wallet si aad ballan u qaadato."
     }
   },
   "portal": {

frontend/lib/integrations.ts

@@ -64,6 +64,37 @@ export function submitInsuranceClaim(
   });
 }
 
+// --- FHIR server API keys (owner/admin only) --------------------------------
+
+export type FhirApiKey = {
+  id: string;
+  name: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+  revoked: boolean;
+};
+
+// A freshly created key includes the one-time plaintext secret; it is never
+// returned again.
+export type CreatedFhirApiKey = FhirApiKey & { secret: string };
+
+export function listFhirKeys(): Promise<FhirApiKey[]> {
+  return apiFetch<FhirApiKey[]>("/api/integrations/fhir-server/keys");
+}
+
+export function createFhirKey(name: string): Promise<CreatedFhirApiKey> {
+  return apiFetch<CreatedFhirApiKey>("/api/integrations/fhir-server/keys", {
+    method: "POST",
+    body: JSON.stringify({ name }),
+  });
+}
+
+export function revokeFhirKey(id: string): Promise<{ revoked: boolean }> {
+  return apiFetch(`/api/integrations/fhir-server/keys/${id}`, {
+    method: "DELETE",
+  });
+}
+
 // Convenience hook-style fetch reused by the on-page sections: returns the
 // config for one type (or null while loading/absent).
 export async function getIntegration(

frontend/lib/patients.ts

@@ -66,6 +66,8 @@ export type Patient = {
   primaryProviderId?: string | null; // user id of the responsible clinician
   status: "active" | "inpatient" | "discharged";
   initials: string; // for AvatarFallback
+  phone?: string; // contact number (demographic; visible to reception)
+  bloodType?: string; // e.g. "O+"; clinical — redacted for reception
   allergies: Allergy[];
   alerts: string[];
   medications: Medication[];

frontend/lib/signing.ts

@@ -38,3 +38,21 @@ export async function rotateSigningKey(): Promise<SigningKey> {
 export async function listSignedRecords(): Promise<SharedRecord[]> {
   return apiFetch<SharedRecord[]>("/api/signing/records");
 }
+
+// Whether this clinic has joined the Temetro Network relay (patient-wallet
+// sharing rides it). Readable by any clinician.
+export async function getNetworkEnabled(): Promise<boolean> {
+  const { enabled } = await apiFetch<{ enabled: boolean }>(
+    "/api/signing/network",
+  );
+  return enabled;
+}
+
+// Join or leave the Temetro Network (owner/admin only). Returns the new state.
+export async function setNetworkEnabled(enabled: boolean): Promise<boolean> {
+  const res = await apiFetch<{ enabled: boolean }>("/api/signing/network", {
+    method: "PUT",
+    body: JSON.stringify({ enabled }),
+  });
+  return res.enabled;
+}

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontend",
-  "version": "0.5.0",
+  "version": "0.10.0",
   "private": true,
   "scripts": {
     "dev": "next dev",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "temetro",
-  "version": "0.5.0",
+  "version": "0.10.0",
   "private": true,
   "devDependencies": {
     "shadcn": "^4.11.0"