MINTER_ROLE     = keccak256("MINTER_ROLE")   // SLUD oracle only
REDEEMER_ROLE   = keccak256("REDEEMER_ROLE") // Service contracts
transferWhitelist mapping                     // CVS, Aetna, Medicare only

// triggerType: 0=MinuteClinic, 1=Rx_refill, 2=Wellness,
//              3=Medicare_AWV, 4=Vaccine, 5=Screening
event HealthActionRewarded(address user, uint8 triggerType, uint256 amount);

function earnReward(address user, uint8 triggerType, uint256 amount, bytes proof)
  external onlyRole(MINTER_ROLE)

function redeem(uint256 amount, address serviceContract) external
  // Requires whitelist, burns SLUD, calls creditBeneficiary()

// _update override: blocks all non-whitelist, non-mint/burn transfers

struct CredentialRecord {
  bytes32 medicareIdHash;   // keccak256(MBI) — NOT the MBI
  bytes32 medicaidIdHash;   // keccak256(Medicaid ID) if dual-eligible
  bytes32 aetnaMemberHash;  // keccak256(Aetna member ID)
  bytes32 rxBenefitHash;    // keccak256(Part D plan ID)
  string  vcCid;            // IPFS CID of AES-256 encrypted W3C VC bundle
  uint64  expiresAt;        // Plan expiry (0 = none)
  bool    medicareVerified; // Set by ID.me/CMS oracle
  bool    medicaidVerified; // Set by state Medicaid oracle
}

function locked(uint256) external pure returns (bool) { return true; }
function transferFrom(address,address,uint256) public pure override {
  revert("SaludID: identity is not transferable");
}
// verifyMedicareEligibility(tokenId, zkProof): ZK proof verification
// Proves eligibility without revealing MBI or any credential data

enum PlanType {
  SALUD_STARTER,          // $15/mo Salud Vault base
  SALUD_FAMILIA,          // $45/mo family tier
  SALUD_PREMIUM,          // $55/mo all three pillars
  MEDICARE_ADVANTAGE,     // Aetna/CVS MA plan
  MEDICAID_MANAGED_CARE,  // State MCO enrollment
  DUAL_ELIGIBLE_SPECIAL,  // D-SNP: Medicare + Medicaid (highest value)
  CVS_AETNA_EMPLOYEE      // CVS employee benefit plan
}

struct PlanMetadata {
  PlanType planType; uint64 effectiveDate; uint64 expiryDate;
  uint16 copayMinuteClinic;  // USDC cents (500 = $5.00)
  uint16 copayPrimary; uint16 copaySpecialist;
  uint32 rxDeductibleRemaining;
  bytes32 planContractHash;   // Hash of full plan document
  string  ipfsContractCid;    // IPFS link to plan PDF
  bool active;
}

// getCopayForService(tokenId, serviceType) → uint256 USDC
// serviceType: 0=MinuteClinic, 1=primary, 2=specialist
// isActivePlan(tokenId): checks active + effectiveDate + expiryDate
// familyTransfer(tokenId, newHolder, issuerSig): Salud + Aetna co-sign

// txType: 0=CVS_front_store, 1=non_CVS_retail, 2=financial, 3=opt_in
// NEVER: 4+ (reserved for health categories — will revert)
function mintReach(address wallet, uint256 campaignId, uint8 txType, bytes calldata proof)
  external onlyRole(REACH_ORACLE_ROLE) {
  require(txType <= 3, "Health-coded txType rejected");  // HIPAA guard
  Campaign storage c = campaigns[campaignId];
  require(c.active && block.timestamp <= c.expiresAt, "Campaign inactive");
  require(c.budgetSpent + c.earnRate <= c.budgetUsdc, "Budget exhausted");
  c.budgetSpent += c.earnRate;
  _mint(wallet, BASE_REACH, c.earnRate, "");  // Fungible pool
  _mint(wallet, campaignId, c.earnRate, "");  // Campaign semi-fungible
  emit CommercialActionRewarded(wallet, campaignId, txType, c.earnRate);
}