@crvouga/mockingbird-service-fullscript 3.13.0 → 3.15.0

package/dist/chunk-CJAYCSOW.js

@@ -0,0 +1,940 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+
+// <define:__MOCKINGBIRD_ADMIN_BRAND__>
+var define_MOCKINGBIRD_ADMIN_BRAND_default = { vendor: "Fullscript", website: "https://fullscript.com", docs: "https://fullscript.dev", guide: "https://mockingbird.chrisvouga.dev/services/fullscript", logo: "data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjU2IiBoZWlnaHQ9IjI1NiIgdmlld0JveD0iMCAwIDI1NiAyNTYiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxtYXNrIGlkPSJtYXNrMF8yNV84IiBzdHlsZT0ibWFzay10eXBlOmx1bWluYW5jZSIgbWFza1VuaXRzPSJ1c2VyU3BhY2VPblVzZSIgeD0iMCIgeT0iMTYiIHdpZHRoPSIyNTYiIGhlaWdodD0iMjI1Ij4KPHBhdGggZD0iTTI1NiAxNkgwVjI0MC42NjJIMjU2VjE2WiIgZmlsbD0id2hpdGUiLz4KPC9tYXNrPgo8ZyBtYXNrPSJ1cmwoI21hc2swXzI1XzgpIj4KPHBhdGggZD0iTTIzMC4xNzQgMTAzLjU4OUMyMzAuMTc0IDEwMy41ODkgMjMwLjE3NCAxMDMuOTk4IDIzMC4xNzQgMTA0LjQwN0MyMzAuMTc0IDEwNy42NzcgMjI1LjI1OCAxNzYuMzM1IDE0MC40NTUgMjA3LjM5NVYxNjQuNDgzTDE5MS42NjQgMTA4LjkwMkMxOTYuMTcxIDEwMy45OTggMTk2LjE3MSA5Ni4yMzMzIDE5MC44NDUgOTEuMzI5MkMxODUuOTI5IDg2LjgzMzMgMTc4LjE0NSA4Ni44MzMzIDE3My4yMjkgOTIuMTQ2MUwxNDAuNDU1IDEyOC4xMTFWOTEuMzI5MkMxNDAuNDU1IDkxLjMyOTIgMTQwLjQ1NSA5MS4zMjkyIDE0MC40NTUgOTAuOTIwNEMxNDQuNTUyIDgxLjUyMDQgMTY0LjIxNiA0NC43Mzg5IDIxMi41NTcgNDQuNzM4OUMyMTIuOTY3IDQ0LjczODkgMjEzLjM3NyA0NC43Mzg5IDIxMy43ODcgNDQuNzM4OUMyMzMuMDQxIDY3LjYyNTMgMjMwLjE3NCAxMDMuMTgxIDIzMC4xNzQgMTAzLjU4OVpNMTE1Ljg3NSAxMjguMTExTDgyLjY5MDggOTIuMTQ2MUM3OC4xODQzIDg3LjI0MiA3MC40MDA2IDg2LjgzMzMgNjUuNDg0NSA5MS4zMjkyQzYwLjU2ODUgOTUuODI0NiA2MC4xNTg5IDEwMy45OTggNjQuNjY1MyAxMDguOTAyTDExNS44NzUgMTY0LjQ4M1YyMDYuOTg3QzMxLjA3MiAxNzUuOTI3IDI2LjU2NTYgMTA2Ljg1OSAyNi4xNTU5IDEwMy45OThDMjYuMTU1OSAxMDMuNTg5IDI2LjE1NTkgMTAzLjU4OSAyNi4xNTU5IDEwMy4xODFDMjYuMTU1OSAxMDIuNzcyIDIyLjg3ODUgNjcuMjE2NiA0Mi4xMzMyIDQ0LjMzMDJDNDIuNTQyOCA0NC4zMzAyIDQyLjk1MjUgNDQuMzMwMiA0My43NzE5IDQ0LjMzMDJDOTIuNTIzIDQ0LjMzMDIgMTExLjc3OCA4MS41MjA0IDExNS44NzUgOTAuNTExN0MxMTUuODc1IDkwLjUxMTcgMTE1Ljg3NSA5MC41MTE3IDExNS44NzUgOTAuOTIwNFYxMjguMTExWk0yMjguNTM1IDIzLjQ4NzNDMjI2LjQ4NiAyMS40NDM5IDIyMy42MTkgMjAuMjE3OCAyMjAuNzUxIDE5LjgwOTJDMTc0LjQ1OCAxNi45NDg0IDE0NC4xNDIgNDAuNjUyMSAxMjguMTY1IDYyLjcyMTJDMTEyLjE4NyA0MC42NTIxIDgyLjI4MTIgMTYuOTQ4NCAzNS41Nzg0IDE5LjgwOTJDMzIuNzEwNyAxOS44MDkyIDI5Ljg0MjkgMjEuNDQzOSAyNy43OTQ2IDIzLjQ4NzNDLTIuMTExNjMgNTMuMzIxMyAxLjE2NTc3IDEwMC43MjkgMS41NzU0NSAxMDUuMjI0QzEuNTc1NDUgMTA4LjQ5NCAzLjYyMzgxIDEzMS43ODkgMTguNzgxNyAxNTguNzYyQzMzLjEyMDQgMTg0LjUwOSA2My40MzYxIDIxOC40MyAxMjMuNjU4IDIzNS41OTRDMTI0LjA2OCAyMzUuNTk0IDEyNC40NzggMjM1LjU5NCAxMjQuNDc4IDIzNi4wMDNDMTI0Ljg4NyAyMzYuMDAzIDEyNC44ODcgMjM2LjAwMyAxMjUuMjk3IDIzNi4wMDNDMTI1LjcwNyAyMzYuMDAzIDEyNS43MDcgMjM2LjAwMyAxMjYuMTE2IDIzNi4wMDNDMTI2LjUyNiAyMzYuMDAzIDEyNy4zNDYgMjM2LjAwMyAxMjcuNzU1IDIzNi4wMDNDMTI4LjE2NSAyMzYuMDAzIDEyOC45ODQgMjM2LjAwMyAxMjkuMzk0IDIzNi4wMDNDMTI5LjgwMyAyMzYuMDAzIDEyOS44MDMgMjM2LjAwMyAxMzAuMjEzIDIzNi4wMDNDMTMwLjYyMyAyMzYuMDAzIDEzMC42MjMgMjM2LjAwMyAxMzEuMDMyIDIzNi4wMDNDMTMxLjQ0MiAyMzYuMDAzIDEzMS44NTIgMjM2LjAwMyAxMzIuMjYyIDIzNS41OTRDMjQ0LjEwMiAyMDQuMTI2IDI1My45MzUgMTE0LjIxNSAyNTQuMzQ1IDEwNS42MzNDMjU0Ljc1NCAxMDMuMTgxIDI1OC44NTEgNTQuMTM4NyAyMjguNTM1IDIzLjQ4NzNaIiBmaWxsPSIjODhCMDRCIi8+CjwvZz4KPC9zdmc+Cg==", color: null, description: "Empowering providers and patients with clinical insights. Use Fullscript to order lab tests, manage supplement plans, and track health progress together." };
+
+// mockingbird-service-runtime:@crvouga/mockingbird-runtime/service
+var service_exports = {};
+__export(service_exports, {
+  PACKAGE_VERSION: () => PACKAGE_VERSION,
+  createRuntime: () => createRuntime
+});
+__reExport(service_exports, service_star);
+import * as service_star from "@crvouga/mockingbird-runtime/service";
+import { PACKAGE_VERSION as SHARED_VERSION, createRuntime as sharedRuntime } from "@crvouga/mockingbird-runtime/service";
+var PACKAGE_VERSION = true ? "3.15.0" : SHARED_VERSION;
+var ADMIN_BRAND = typeof define_MOCKINGBIRD_ADMIN_BRAND_default === "object" ? define_MOCKINGBIRD_ADMIN_BRAND_default : void 0;
+var createRuntime = (options) => sharedRuntime({
+  ...options,
+  version: options.version ?? PACKAGE_VERSION,
+  adminBrand: options.adminBrand ?? ADMIN_BRAND
+});
+
+// src/generated/openapi.ts
+var document = JSON.parse(`{"openapi":"3.1.0","info":{"title":"Fullscript API (Mockingbird subset)","description":"Stateful emulator subset of the Fullscript API for lab ordering: per-practitioner OAuth (authorize, token with authorization_code and refresh_token grants, revoke), clinic, embeddable session grants, lab orders, lab-order events, expiring result PDFs, and signed webhooks. Hand-authored from the EMR consumer (fullscript-api-client.ts, fullscript-event-model.ts, fullscript-webhook-signature.ts).\\n","version":"1","x-mockingbird-upstream":{"note":"Wire shapes from the consumer app's EMR backend (its Fullscript services and routers); the vendor's API reference is behind a partner login."}},"servers":[{"url":"https://api-us-snd.fullscript.io"}],"security":[{"bearerAuth":[]}],"paths":{"/api/oauth/token":{"post":{"operationId":"OAuthToken","description":"Exchange an authorization code, or rotate a refresh token (the old refresh token stops working).","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthTokenResponse"}}}},"400":{"description":"invalid_grant / unsupported_grant_type / invalid_request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"401":{"description":"invalid_client","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenRequest"}}}}}},"/api/oauth/revoke":{"post":{"operationId":"OAuthRevoke","description":"Revoke an access or refresh token (RFC 7009: always 200).","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"responses":{"200":{"description":"Revoked","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"invalid_request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"401":{"description":"invalid_client","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeRequest"}}}}}},"/api/clinic":{"get":{"operationId":"GetClinic","description":"The token's clinic.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Clinic","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClinicResponse"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}}}},"/api/clinic/embeddable/session_grants":{"post":{"operationId":"CreateSessionGrant","description":"A short-lived secret for the embedded Fullscript widget.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"201":{"description":"Grant","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SessionGrant"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}}}},"/api/clinic/labs/orders":{"get":{"operationId":"ListLabOrders","description":"The clinic's lab orders (optionally one patient's), paged.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Page","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LabOrdersPage"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"parameters":[{"name":"patient_id","in":"query","required":false,"schema":{"type":"string","enum":["pat_seed_1","pat_seed_2","pat_missing"]}},{"name":"page[number]","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":3}},{"name":"page[size]","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}}]}},"/api/clinic/labs/orders/{orderId}":{"get":{"operationId":"GetLabOrder","description":"One lab order with tests, per-test results and the aggregated result.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LabOrderResponse"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"404":{"description":"Unknown order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"parameters":[{"name":"orderId","in":"path","required":true,"schema":{"type":"string","enum":["lo_seed_1","lo_seed_2","lo_seed_3","lo_missing"]}}]}},"/api/events/lab_orders":{"get":{"operationId":"ListLabOrderEvents","description":"The clinic's lab_order.updated events, newest first by default.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Page","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventsPage"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"parameters":[{"name":"order_by","in":"query","required":false,"schema":{"type":"string","enum":["DESC","ASC"]}},{"name":"page[number]","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":3}},{"name":"page[size]","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":100}}]}},"/api/events/{eventId}":{"get":{"operationId":"GetEvent","description":"One event with its data.","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Event","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EventResponse"}}}},"401":{"description":"Missing, invalid, expired or revoked access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"404":{"description":"Unknown event","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}},"429":{"description":"Rate limited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrors"}}}}},"parameters":[{"name":"eventId","in":"path","required":true,"schema":{"type":"string","enum":["evt_1","evt_2","evt_3","evt_missing"]}}]}},"/oauth/authorize":{"get":{"operationId":"Authorize","description":"The consent page: auto-approves as the requested (or default) practitioner and redirects to redirect_uri with code and state.","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":false,"reason":"Browser redirect flow; covered by acceptance tests."}},"parameters":[{"name":"client_id","in":"query","required":true,"schema":{"type":"string"}},{"name":"redirect_uri","in":"query","required":true,"schema":{"type":"string"}},{"name":"response_type","in":"query","required":true,"schema":{"type":"string","enum":["code"]}},{"name":"state","in":"query","required":false,"schema":{"type":"string"}},{"name":"scope","in":"query","required":false,"schema":{"type":"string"}},{"name":"practitioner_id","in":"query","required":false,"schema":{"type":"string"}}],"responses":{"302":{"description":"Redirect back with ?code=&state="},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthError"}}}}}}},"/results/{artifactId}":{"get":{"operationId":"GetResultPdf","description":"An expiring result PDF URL (what pdf_url points at).","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":false,"reason":"Binary PDF behind an expiring signed URL; covered by acceptance tests."}},"parameters":[{"name":"artifactId","in":"path","required":true,"schema":{"type":"string"}},{"name":"expires","in":"query","required":true,"schema":{"type":"string"}},{"name":"signature","in":"query","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"The PDF","content":{"application/pdf":{"schema":{"type":"string","format":"binary"}}}},"403":{"description":"Expired or bad signature"},"404":{"description":"Unknown artifact"}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"TokenRequest":{"type":"object","required":["grant_type","client_id","client_secret"],"properties":{"grant_type":{"type":"string","enum":["authorization_code","refresh_token"]},"client_id":{"type":"string","minLength":1,"maxLength":64,"examples":["parity-client"]},"client_secret":{"type":"string","minLength":1,"maxLength":64,"examples":["parity-secret"]},"code":{"type":"string","maxLength":64},"refresh_token":{"type":"string","maxLength":200},"redirect_uri":{"type":"string","maxLength":200,"examples":["https://emr.example.com/v1/fullscript/oauth/callback"]}}},"RevokeRequest":{"type":"object","required":["client_id","client_secret","token"],"properties":{"client_id":{"type":"string","minLength":1,"maxLength":64},"client_secret":{"type":"string","minLength":1,"maxLength":64},"token":{"type":"string","minLength":1,"maxLength":200}}},"OAuthTokenResponse":{"type":"object","required":["oauth"],"properties":{"oauth":{"type":"object","required":["access_token","token_type","expires_in","refresh_token","scope","created_at","resource_owner"],"properties":{"access_token":{"type":"string","x-mockingbird-volatile":{"kind":"token"}},"token_type":{"type":"string","enum":["Bearer"]},"expires_in":{"type":"integer"},"refresh_token":{"type":"string","x-mockingbird-volatile":{"kind":"token"}},"scope":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"resource_owner":{"type":"object","required":["id","type"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["Practitioner","Staff"]},"clinic_id":{"type":"string"}}}}}}},"OAuthError":{"type":"object","required":["error"],"properties":{"error":{"type":"string"},"error_description":{"type":"string"}}},"ApiErrors":{"type":"object","required":["errors"],"properties":{"errors":{"type":"array","items":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"}}}}}},"ClinicResponse":{"type":"object","required":["clinic"],"properties":{"clinic":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}}}}}},"SessionGrant":{"type":"object","required":["secret_token","expires_at"],"properties":{"secret_token":{"type":"string","x-mockingbird-volatile":{"kind":"token"}},"expires_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}}}},"LabOrderSummary":{"type":"object","required":["id","state","treatment_plan_id","patient_id","created_at","updated_at"],"properties":{"id":{"type":"string"},"state":{"type":"string","enum":["not_purchased","purchased","schedule_appointment","upcoming_appointment","processing","partial_results","results_ready","interpretation_shared","results_amended"]},"treatment_plan_id":{"type":["string","null"]},"patient_id":{"type":"string"},"name":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"updated_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}}}},"LabOrdersPage":{"type":"object","required":["orders","meta"],"properties":{"orders":{"type":"array","items":{"$ref":"#/components/schemas/LabOrderSummary"}},"meta":{"type":"object","required":["current_page","next_page","prev_page","total_pages","total_count"],"properties":{"current_page":{"type":"integer"},"next_page":{"type":["integer","null"]},"prev_page":{"type":["integer","null"]},"total_pages":{"type":"integer"},"total_count":{"type":"integer"}}}}},"LabOrderResponse":{"type":"object","required":["order"],"properties":{"order":{"type":"object","required":["id","state","treatment_plan_id","tests","results","latest_aggregated_result"],"properties":{"id":{"type":"string"},"state":{"type":"string","enum":["not_purchased","purchased","schedule_appointment","upcoming_appointment","processing","partial_results","results_ready","interpretation_shared","results_amended"]},"treatment_plan_id":{"type":["string","null"]},"patient_id":{"type":"string"},"name":{"type":"string"},"collection_method":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"updated_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"tests":{"type":"array","items":{"type":"object","required":["id","name"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"lab_type":{"type":"string"}}}},"results":{"type":"array","items":{"type":"object","required":["id","name","state","pdf_url"],"properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"type":"string"},"pdf_url":{"type":"string","x-mockingbird-volatile":{"kind":"url"}}}}},"latest_aggregated_result":{"type":["object","null"],"properties":{"id":{"type":"string"},"artifact_id":{"type":"string"},"pdf_url":{"type":"string","x-mockingbird-volatile":{"kind":"url"}},"status":{"type":"string"}}}}}}},"EventSummary":{"type":"object","required":["id","type","clinic_id","created_at"],"properties":{"id":{"type":"string"},"type":{"type":"string","enum":["lab_order.updated"]},"clinic_id":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}}}},"EventsPage":{"type":"object","required":["events","meta"],"properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/EventSummary"}},"meta":{"type":"object","required":["current_page","next_page","prev_page","total_pages","total_count"],"properties":{"current_page":{"type":"integer"},"next_page":{"type":["integer","null"]},"prev_page":{"type":["integer","null"]},"total_pages":{"type":"integer"},"total_count":{"type":"integer"}}}}},"EventResponse":{"type":"object","required":["event"],"properties":{"event":{"type":"object","required":["id","type","clinic_id","created_at","data"],"properties":{"id":{"type":"string"},"type":{"type":"string"},"clinic_id":{"type":"string"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"data":{"type":"object"}}}}}}}}`);
+var operationIds = ["OAuthToken", "OAuthRevoke", "GetClinic", "CreateSessionGrant", "ListLabOrders", "GetLabOrder", "ListLabOrderEvents", "GetEvent", "Authorize", "GetResultPdf"];
+var supportedOperationIds = ["OAuthToken", "OAuthRevoke", "GetClinic", "CreateSessionGrant", "ListLabOrders", "GetLabOrder", "ListLabOrderEvents", "GetEvent", "Authorize", "GetResultPdf"];
+
+// src/pdf.ts
+var RESULT_PDF = new TextEncoder().encode(
+  "%PDF-1.4\n1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n3 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>\nendobj\n4 0 obj\n<< /Length 64 >>\nstream\nBT /F1 18 Tf 72 720 Td (Mockingbird Fullscript lab result) Tj ET\nendstream\nendobj\n5 0 obj\n<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>\nendobj\nxref\n0 6\n0000000000 65535 f \n0000000009 00000 n \n0000000058 00000 n \n0000000115 00000 n \n0000000241 00000 n \n0000000355 00000 n \ntrailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n425\n%%EOF\n"
+);
+
+// src/state.ts
+var LAB_ORDER_STATES = [
+  "not_purchased",
+  "purchased",
+  "schedule_appointment",
+  "upcoming_appointment",
+  "processing",
+  "partial_results",
+  "results_ready",
+  "interpretation_shared",
+  "results_amended"
+];
+var isLabOrderState = (value) => typeof value === "string" && LAB_ORDER_STATES.includes(value);
+var stateRank = (state) => LAB_ORDER_STATES.indexOf(state);
+var DEFAULT_SETTINGS = {
+  clients: [],
+  accessTokenTtlSeconds: 7200,
+  codeTtlSeconds: 600,
+  pdfUrlTtlSeconds: 900,
+  resultsBaseUrl: null
+};
+var DEFAULT_CLINIC = {
+  id: "clinic_mock_1",
+  name: "Acme Mock Clinic",
+  created_at: "2025-01-01T00:00:00.000Z"
+};
+var DEFAULT_PRACTITIONER = {
+  id: "prac_mock_1",
+  type: "Practitioner",
+  clinicId: DEFAULT_CLINIC.id
+};
+var FullscriptState = class {
+  constructor(sqlite, namespace, seed) {
+    this.seed = seed;
+    this.practitioners = new service_exports.Collection(sqlite, namespace, "practitioners");
+    this.clinics = new service_exports.Collection(sqlite, namespace, "clinics");
+    this.codes = new service_exports.Collection(sqlite, namespace, "codes");
+    this.refresh = new service_exports.Collection(sqlite, namespace, "refresh_tokens");
+    this.revoked = new service_exports.Collection(sqlite, namespace, "revoked_tokens");
+    this.orders = new service_exports.Collection(sqlite, namespace, "lab_orders");
+    this.events = new service_exports.Collection(sqlite, namespace, "events");
+    this.settings = new service_exports.Collection(sqlite, namespace, "settings");
+    this.counters = new service_exports.Collection(sqlite, namespace, "counters");
+    this.ensureSeeded();
+  }
+  seed;
+  practitioners;
+  clinics;
+  codes;
+  refresh;
+  revoked;
+  orders;
+  events;
+  settings;
+  counters;
+  ensureSeeded() {
+    if (this.clinics.count() === 0) this.clinics.insert(DEFAULT_CLINIC.id, DEFAULT_CLINIC);
+    if (this.practitioners.count() === 0) {
+      this.practitioners.insert(DEFAULT_PRACTITIONER.id, DEFAULT_PRACTITIONER);
+    }
+    if (!this.settings.has("settings")) {
+      this.settings.insert("settings", { ...DEFAULT_SETTINGS, ...this.seed });
+    }
+  }
+  current() {
+    return this.settings.get("settings") ?? DEFAULT_SETTINGS;
+  }
+  update(patch) {
+    const next = { ...this.current(), ...patch };
+    this.settings.insert("settings", next);
+    return next;
+  }
+  next(kind) {
+    const current = this.counters.get("counters") ?? {
+      code: 0,
+      refresh: 0,
+      order: 0,
+      event: 0,
+      artifact: 0
+    };
+    const next = { ...current, [kind]: current[kind] + 1 };
+    this.counters.insert("counters", next);
+    return next[kind];
+  }
+};
+
+// src/runtime.ts
+var SIGNATURE_HEADER = "Fullscript-Signature";
+var API = "/api/";
+var FULLSCRIPT_PRESETS = {
+  token_expired: {
+    description: "API calls answer 401 token_expired before the token's 2 h (our token service refreshes)",
+    rules: [
+      { pathPrefix: "/api/clinic", effect: "token_expired" },
+      { pathPrefix: "/api/events", effect: "token_expired" }
+    ]
+  },
+  invalid_grant: {
+    description: "The refresh_token grant answers 400 invalid_grant (the practitioner must reconnect)",
+    rules: [{ operationId: "OAuthToken", effect: "invalid_grant" }]
+  },
+  rate_limited: {
+    description: "API calls answer 429 rate_limited",
+    rules: [
+      {
+        pathPrefix: API,
+        status: 429,
+        body: { errors: [{ code: "rate_limited", message: "Too many requests" }] }
+      }
+    ]
+  },
+  server_error: {
+    description: "API calls answer 500",
+    rules: [
+      {
+        pathPrefix: API,
+        status: 500,
+        body: { errors: [{ code: "internal_server_error", message: "Something went wrong" }] }
+      }
+    ]
+  },
+  events_schema_drift: {
+    description: "The lab-order events list answers an unexpected event type (our zod literal rejects it)",
+    rules: [{ operationId: "ListLabOrderEvents", effect: "events_schema_drift" }]
+  },
+  pdf_not_pdf: {
+    description: "Result PDF URLs answer 200 text/html (our downloader rejects the content type)",
+    rules: [
+      {
+        operationId: "GetResultPdf",
+        status: 200,
+        body: "<html>Sign in</html>",
+        headers: { "content-type": "text/html" }
+      }
+    ]
+  },
+  pdf_redirect: {
+    description: "Result PDF URLs answer a 302 (our downloader refuses redirects)",
+    rules: [
+      {
+        operationId: "GetResultPdf",
+        status: 302,
+        body: "",
+        headers: { location: "https://login.fullscript.com/" }
+      }
+    ]
+  },
+  pdf_expired: {
+    description: "Result PDF URLs answer 403 as if expired",
+    rules: [
+      {
+        operationId: "GetResultPdf",
+        status: 403,
+        body: "Request has expired",
+        headers: { "content-type": "text/plain" }
+      }
+    ]
+  },
+  connection_drop: {
+    description: "The connection drops before any answer (fetch rejects)",
+    rules: [{ pathPrefix: API, drop: true }]
+  },
+  slow: {
+    description: "API calls answer after 12 s (past our client's 10 s timeout)",
+    rules: [{ pathPrefix: API, latencyMs: 12e3 }]
+  },
+  webhook_duplicate: {
+    description: "The next webhook is delivered twice",
+    webhook: { mode: "duplicate" }
+  },
+  webhook_reorder: {
+    description: "The next two webhooks arrive swapped",
+    webhook: { mode: "reorder" }
+  },
+  webhook_drop: { description: "The next webhook is never delivered", webhook: { mode: "drop" } }
+};
+var json = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+var adminError = (status, message) => json(status, { error: { type: "mockingbird_admin", message } });
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var echoes = async (response, challenge) => {
+  try {
+    const body = await response.clone().json();
+    return body.challenge === challenge;
+  } catch {
+    return false;
+  }
+};
+var adminRoutes = (send, challenge) => (runtime) => ({
+  "POST /oauth/codes": ({ body, namespace }) => {
+    const input = isRecord(body) ? body : {};
+    const api = runtime.instance(namespace);
+    const practitionerId = typeof input.practitionerId === "string" ? input.practitionerId : "prac_mock_1";
+    if (!api.state.practitioners.get(practitionerId))
+      return adminError(404, `no practitioner ${practitionerId}`);
+    const code = api.issueCode(
+      practitionerId,
+      typeof input.clientId === "string" ? input.clientId : "any",
+      typeof input.redirectUri === "string" ? input.redirectUri : null
+    );
+    return json(201, { code });
+  },
+  "POST /practitioners": ({ body, namespace }) => {
+    if (!isRecord(body) || typeof body.id !== "string" || typeof body.clinicId !== "string") {
+      return adminError(
+        400,
+        'expected {"id", "clinicId", "type"?: "Practitioner"|"Staff", "clinicName"?}'
+      );
+    }
+    const api = runtime.instance(namespace);
+    if (!api.state.clinics.get(body.clinicId)) {
+      api.state.clinics.insert(body.clinicId, {
+        id: body.clinicId,
+        name: typeof body.clinicName === "string" ? body.clinicName : body.clinicId,
+        created_at: new Date(runtime.namespaceClock(namespace).now()).toISOString()
+      });
+    }
+    const practitioner = {
+      id: body.id,
+      clinicId: body.clinicId,
+      type: body.type === "Staff" ? "Staff" : "Practitioner"
+    };
+    api.state.practitioners.insert(practitioner.id, practitioner);
+    return json(201, practitioner);
+  },
+  "GET /lab-orders": ({ namespace }) => json(200, { orders: runtime.instance(namespace).labOrders() }),
+  "POST /lab-orders": ({ body, namespace }) => {
+    if (!isRecord(body) || typeof body.patientId !== "string") {
+      return adminError(
+        400,
+        'expected {"patientId", "id"?, "clinicId"?, "treatmentPlanId"?, "name"?, "collectionMethod"?, "tests"?: [names]}'
+      );
+    }
+    const text = (key) => typeof body[key] === "string" ? { [key]: body[key] } : {};
+    const order = runtime.instance(namespace).createOrder({
+      patientId: body.patientId,
+      ...text("id"),
+      ...text("clinicId"),
+      ...text("treatmentPlanId"),
+      ...text("name"),
+      ...text("collectionMethod"),
+      ...Array.isArray(body.tests) ? { tests: body.tests.map(String) } : {}
+    });
+    return json(201, order);
+  },
+  "POST /lab-orders/:id/transition": ({ params, body, namespace }) => {
+    if (!isRecord(body) || !isLabOrderState(body.to)) {
+      return adminError(
+        400,
+        'expected {"to": "<purchased|schedule_appointment|upcoming_appointment|processing|partial_results|results_ready|interpretation_shared|results_amended>"}'
+      );
+    }
+    try {
+      return json(200, runtime.instance(namespace).transition(params.id, body.to));
+    } catch (error) {
+      if (error instanceof service_exports.HttpError) return error.toResponse();
+      throw error;
+    }
+  },
+  "GET /events": ({ namespace }) => json(200, { events: runtime.instance(namespace).eventsList() }),
+  "POST /webhooks/verify": async ({ namespace }) => {
+    const endpoints = runtime.webhooks?.endpoints(namespace) ?? [];
+    const results = await Promise.all(
+      endpoints.map(async (endpoint) => {
+        try {
+          const response = await send(
+            new Request(endpoint.url, {
+              method: "POST",
+              headers: { "content-type": "application/json" }
+            })
+          );
+          return {
+            url: endpoint.url,
+            status: response.status,
+            challengeEchoed: challenge ? await echoes(response, challenge) : null
+          };
+        } catch (error) {
+          return {
+            url: endpoint.url,
+            status: null,
+            error: error instanceof Error ? error.message : String(error)
+          };
+        }
+      })
+    );
+    return json(200, { endpoints: results });
+  },
+  "GET /settings": ({ namespace }) => json(200, runtime.instance(namespace).state.current()),
+  "PUT /settings": ({ body, namespace }) => {
+    if (!isRecord(body)) return adminError(400, "expected a JSON object");
+    const patch = {};
+    for (const key of ["accessTokenTtlSeconds", "codeTtlSeconds", "pdfUrlTtlSeconds"]) {
+      if (body[key] !== void 0) {
+        if (typeof body[key] !== "number") return adminError(400, `${key}: number`);
+        patch[key] = body[key];
+      }
+    }
+    if (body.resultsBaseUrl !== void 0) {
+      if (body.resultsBaseUrl !== null && typeof body.resultsBaseUrl !== "string")
+        return adminError(400, "resultsBaseUrl: string | null");
+      patch.resultsBaseUrl = body.resultsBaseUrl;
+    }
+    if (body.clients !== void 0) {
+      if (!Array.isArray(body.clients))
+        return adminError(400, "clients: [{clientId, clientSecret}]");
+      patch.clients = body.clients.filter(isRecord).map((c) => ({ clientId: String(c.clientId), clientSecret: String(c.clientSecret) }));
+    }
+    return json(200, runtime.instance(namespace).state.update(patch));
+  }
+});
+var createRuntime2 = (options = {}) => {
+  const { retryDelaysMs, fetch: rawSend, challenge, ...endpoint } = options.webhooks ?? { url: "" };
+  const send = rawSend ?? ((request) => fetch(request));
+  const hub = (0, service_exports.createWebhookHub)({
+    signer: service_exports.signers.timestamped(SIGNATURE_HEADER),
+    ...retryDelaysMs ? { retryDelaysMs } : {},
+    // Fullscript counts a delivery as acknowledged only when the receiver echoes the
+    // challenge key; anything else is retried (recorded as a 502).
+    fetch: async (request) => {
+      const response = await send(request);
+      if (!challenge || !response.ok || await echoes(response, challenge)) return response;
+      return new Response(null, { status: 502, statusText: "challenge not echoed" });
+    },
+    endpoints: options.webhooks ? [endpoint] : []
+  });
+  const runtime = createRuntime({
+    name: FULLSCRIPT_NAMESPACE,
+    document,
+    ...options.sqlite ? { sqlite: options.sqlite } : {},
+    ...options.clock ? { clock: options.clock } : {},
+    ...options.seed !== void 0 ? { seed: options.seed } : {},
+    ...options.adminPrefix !== void 0 ? { adminPrefix: options.adminPrefix } : {},
+    ...options.adminKey !== void 0 ? { adminKey: options.adminKey } : {},
+    ...options.adminControls !== void 0 ? { adminControls: options.adminControls } : {},
+    ...options.onLog ? { onLog: options.onLog } : {},
+    credential: tokenCredential,
+    presets: FULLSCRIPT_PRESETS,
+    webhooks: hub,
+    create: ({ sqlite, namespace, publicNamespace, adminPrefix, clock }) => new FullscriptAPI({
+      sqlite,
+      namespace,
+      publicNamespace,
+      adminPrefix,
+      now: clock.now,
+      ...options.settings ? { settings: options.settings } : {},
+      ...options.orders ? { orders: options.orders } : {},
+      onEvent: (event) => hub.publish({
+        namespace: publicNamespace,
+        type: event.type,
+        id: event.id,
+        body: envelope(event)
+      })
+    }),
+    describe: () => ({ webhooks: hub.endpoints("default").length > 0 ? "on" : "off" }),
+    admin: adminRoutes(send, challenge)
+  });
+  return Object.assign(runtime, { webhooks: hub });
+};
+
+// src/index.ts
+var FULLSCRIPT_NAMESPACE = "fullscript";
+var SCOPE = "clinic:read labs:read labs:write patients:read";
+var TOKEN_PREFIX = "fsat_";
+var apiErrors = (status, code, message) => (0, service_exports.jsonRes)(status, { errors: [{ code, message }] });
+var oauthError = (status, error, description) => (0, service_exports.jsonRes)(status, { error, error_description: description });
+var INVALID_GRANT = "The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.";
+var INVALID_CLIENT = "Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method.";
+var base64url = (value) => (0, service_exports.toBase64)(new TextEncoder().encode(value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var fromBase64url = (value) => {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      (0, service_exports.fromBase64)(value.replace(/-/g, "+").replace(/_/g, "/"))
+    );
+  } catch {
+    return void 0;
+  }
+};
+var sign = (payload, issuedAt) => (0, service_exports.opaqueToken)(`fullscript:${payload}:${issuedAt}`, 32);
+var issueAccessToken = (claims, issuedAtSeconds) => {
+  const payload = base64url(
+    JSON.stringify([claims.clientId, claims.practitionerId, claims.clinicId, claims.type])
+  );
+  return `${TOKEN_PREFIX}${payload}.${issuedAtSeconds}.${sign(payload, issuedAtSeconds)}`;
+};
+var readAccessToken = (token) => {
+  if (!token.startsWith(TOKEN_PREFIX)) return void 0;
+  const [payload, issued, signature] = token.slice(TOKEN_PREFIX.length).split(".");
+  const issuedAt = Number(issued);
+  if (!payload || !Number.isInteger(issuedAt) || signature !== sign(payload, issuedAt))
+    return void 0;
+  const decoded = fromBase64url(payload);
+  try {
+    const [clientId, practitionerId, clinicId, type] = JSON.parse(decoded ?? "");
+    if (!clientId || !practitionerId || !clinicId) return void 0;
+    return {
+      clientId,
+      practitionerId,
+      clinicId,
+      type: type === "Staff" ? "Staff" : "Practitioner",
+      issuedAt
+    };
+  } catch {
+    return void 0;
+  }
+};
+var tokenCredential = (request) => {
+  const token = (0, service_exports.bearerToken)(request);
+  return token ? readAccessToken(token)?.clientId ?? token : void 0;
+};
+var publicEvent = (event) => ({
+  id: event.id,
+  type: event.type,
+  clinic_id: event.clinic_id,
+  created_at: event.created_at,
+  data: event.data
+});
+var envelope = (event) => ({ event_payload: { event: publicEvent(event) } });
+var page = (context) => {
+  const q = context.query;
+  const block = q.page ?? {};
+  const number = service_exports.coerce.integer(block.number ?? "1");
+  const size = service_exports.coerce.integer(block.size ?? "20");
+  return {
+    number: number.ok && number.value > 0 ? number.value : 1,
+    size: size.ok && size.value > 0 ? Math.min(size.value, 100) : 20
+  };
+};
+var meta = (current, size, total) => {
+  const totalPages = Math.max(1, Math.ceil(total / size));
+  return {
+    current_page: current,
+    next_page: current < totalPages ? current + 1 : null,
+    prev_page: current > 1 ? current - 1 : null,
+    total_pages: totalPages,
+    total_count: total
+  };
+};
+var FullscriptAPI = class {
+  app;
+  sqlite;
+  state;
+  service;
+  now;
+  prefix;
+  onEvent;
+  constructor(options = {}) {
+    const sqlite = (0, service_exports.bootSqlite)(options.sqlite);
+    const namespace = options.namespace ?? FULLSCRIPT_NAMESPACE;
+    this.now = options.now ?? (() => Date.now());
+    this.onEvent = options.onEvent;
+    this.prefix = options.publicNamespace && options.publicNamespace !== "default" ? `${options.adminPrefix ?? "/__admin"}/ns/${encodeURIComponent(options.publicNamespace)}` : "";
+    this.state = new FullscriptState(sqlite, namespace, options.settings ?? {});
+    const handlers = (0, service_exports.defineOperations)({
+      OAuthToken: (context) => this.token(context),
+      OAuthRevoke: (context) => this.revoke(context),
+      GetClinic: (context) => {
+        const claims = this.claims(context);
+        const clinic = this.state.clinics.get(claims.clinicId);
+        if (!clinic) return apiErrors(404, "not_found", "Clinic not found");
+        return (0, service_exports.jsonRes)(200, { clinic });
+      },
+      CreateSessionGrant: (context) => {
+        const claims = this.claims(context);
+        const expires = this.now() + 5 * 6e4;
+        return (0, service_exports.jsonRes)(201, {
+          secret_token: `sg_${(0, service_exports.opaqueToken)(`${claims.practitionerId}:${this.now()}`, 40)}`,
+          expires_at: new Date(expires).toISOString()
+        });
+      },
+      ListLabOrders: (context) => {
+        const claims = this.claims(context);
+        const patient = typeof context.query.patient_id === "string" ? context.query.patient_id : void 0;
+        const rows = this.state.orders.list({
+          order: "oldest",
+          where: (o) => o.clinicId === claims.clinicId && (!patient || o.patientId === patient)
+        }).map((r) => r.value);
+        const p = page(context);
+        return (0, service_exports.jsonRes)(200, {
+          orders: rows.slice((p.number - 1) * p.size, p.number * p.size).map((o) => this.summary(o)),
+          meta: meta(p.number, p.size, rows.length)
+        });
+      },
+      GetLabOrder: (context) => {
+        const claims = this.claims(context);
+        const order = this.state.orders.get(context.params.orderId ?? "");
+        if (!order || order.clinicId !== claims.clinicId)
+          return apiErrors(404, "not_found", "Lab order not found");
+        return (0, service_exports.annotateResponse)((0, service_exports.jsonRes)(200, { order: this.detail(order, context) }), {
+          ids: { orderId: order.id }
+        });
+      },
+      ListLabOrderEvents: (context) => {
+        const claims = this.claims(context);
+        const ascending = context.query.order_by === "ASC";
+        const rows = this.state.events.list({
+          order: ascending ? "oldest" : "newest",
+          where: (e) => e.clinic_id === claims.clinicId && e.type === "lab_order.updated"
+        }).map((r) => r.value);
+        const p = page(context);
+        const drift = (0, service_exports.faultEffect)(context.request, "events_schema_drift") !== void 0;
+        return (0, service_exports.jsonRes)(200, {
+          events: rows.slice((p.number - 1) * p.size, p.number * p.size).map((e) => ({
+            id: e.id,
+            type: drift ? "lab_order.changed" : e.type,
+            clinic_id: e.clinic_id,
+            created_at: e.created_at
+          })),
+          meta: meta(p.number, p.size, rows.length)
+        });
+      },
+      GetEvent: (context) => {
+        const claims = this.claims(context);
+        const event = this.state.events.get(context.params.eventId ?? "");
+        if (!event || event.clinic_id !== claims.clinicId)
+          return apiErrors(404, "not_found", "Event not found");
+        return (0, service_exports.jsonRes)(200, { event: this.publicEvent(event) });
+      },
+      Authorize: (context) => this.authorize(context),
+      GetResultPdf: (context) => this.pdf(context)
+    });
+    this.service = (0, service_exports.createService)({
+      document,
+      handlers,
+      sqlite,
+      namespace,
+      now: this.now,
+      notFound: () => apiErrors(404, "not_found", "Not Found"),
+      onError: (error) => {
+        if (error instanceof service_exports.HttpError) return error.toResponse();
+        throw error;
+      },
+      before: (context) => {
+        const id = context.operation.operationId;
+        if (id === "OAuthToken" || id === "OAuthRevoke" || id === "Authorize" || id === "GetResultPdf") {
+          return void 0;
+        }
+        const token = (0, service_exports.bearerToken)(context.request);
+        if (!token)
+          return apiErrors(401, "unauthorized", "You need to sign in or authenticate first");
+        if ((0, service_exports.faultEffect)(context.request, "token_expired") !== void 0) {
+          return apiErrors(401, "token_expired", "The access token expired");
+        }
+        const claims = readAccessToken(token);
+        if (!claims || this.state.revoked.has(token)) {
+          return apiErrors(401, "invalid_token", "The access token is invalid");
+        }
+        if (this.now() / 1e3 >= claims.issuedAt + this.state.current().accessTokenTtlSeconds) {
+          return apiErrors(401, "token_expired", "The access token expired");
+        }
+        return void 0;
+      }
+    });
+    this.app = this.service.app;
+    this.sqlite = this.service.sqlite;
+    for (const seed of options.orders ?? []) this.seedOrder(seed);
+  }
+  fetch(request) {
+    return this.service.fetch(request);
+  }
+  async reset() {
+    await this.service.reset();
+    this.state.ensureSeeded();
+  }
+  iso() {
+    return new Date(this.now()).toISOString();
+  }
+  claims(context) {
+    return readAccessToken((0, service_exports.bearerToken)(context.request) ?? "");
+  }
+  clientOk(clientId, secret) {
+    const clients = this.state.current().clients;
+    if (typeof clientId !== "string" || typeof secret !== "string" || !clientId || !secret)
+      return false;
+    return clients.length === 0 || clients.some((c) => c.clientId === clientId && c.clientSecret === secret);
+  }
+  body(context) {
+    const issues = (0, service_exports.bodyIssues)(context);
+    if (issues.length > 0) {
+      throw new service_exports.HttpError(400, {
+        error: "invalid_request",
+        error_description: `The request is missing a required parameter or is otherwise malformed: ${issues.map((i) => `${i.path || "body"} ${i.message}`).join("; ")}`
+      });
+    }
+    return context.body.kind === "json" ? context.body.value : {};
+  }
+  /** Mint an authorization code for a practitioner (what the consent page does). */
+  issueCode(practitionerId, clientId, redirectUri) {
+    const code = `code_${(0, service_exports.opaqueToken)(`${practitionerId}:${this.state.next("code")}`, 32)}`;
+    this.state.codes.insert(code, {
+      code,
+      practitionerId,
+      clientId,
+      redirectUri,
+      expiresAtMs: this.now() + this.state.current().codeTtlSeconds * 1e3,
+      used: false
+    });
+    return code;
+  }
+  tokenPair(practitioner, clientId) {
+    const refresh = `fsrt_${(0, service_exports.opaqueToken)(`${practitioner.id}:${this.state.next("refresh")}`, 40)}`;
+    this.state.refresh.insert(refresh, {
+      token: refresh,
+      practitionerId: practitioner.id,
+      clientId,
+      revoked: false
+    });
+    const issuedAt = Math.floor(this.now() / 1e3);
+    return (0, service_exports.jsonRes)(200, {
+      oauth: {
+        access_token: issueAccessToken(
+          {
+            clientId,
+            practitionerId: practitioner.id,
+            clinicId: practitioner.clinicId,
+            type: practitioner.type
+          },
+          issuedAt
+        ),
+        token_type: "Bearer",
+        expires_in: this.state.current().accessTokenTtlSeconds,
+        refresh_token: refresh,
+        scope: SCOPE,
+        created_at: new Date(issuedAt * 1e3).toISOString(),
+        resource_owner: {
+          id: practitioner.id,
+          type: practitioner.type,
+          clinic_id: practitioner.clinicId
+        }
+      }
+    });
+  }
+  token(context) {
+    const body = this.body(context);
+    const clientId = String(body.client_id);
+    if (!this.clientOk(body.client_id, body.client_secret))
+      return oauthError(401, "invalid_client", INVALID_CLIENT);
+    if (body.grant_type === "authorization_code") {
+      if (typeof body.code !== "string" || !body.code) {
+        return oauthError(400, "invalid_request", "Missing required parameter: code.");
+      }
+      const code = this.state.codes.get(body.code);
+      if (!code || code.used || code.clientId !== clientId || this.now() > code.expiresAtMs || code.redirectUri !== null && body.redirect_uri !== code.redirectUri) {
+        return oauthError(400, "invalid_grant", INVALID_GRANT);
+      }
+      this.state.codes.update(code.code, { ...code, used: true });
+      const practitioner2 = this.state.practitioners.get(code.practitionerId) ?? DEFAULT_PRACTITIONER;
+      return this.tokenPair(practitioner2, clientId);
+    }
+    if (typeof body.refresh_token !== "string" || !body.refresh_token) {
+      return oauthError(400, "invalid_request", "Missing required parameter: refresh_token.");
+    }
+    if ((0, service_exports.faultEffect)(context.request, "invalid_grant") !== void 0) {
+      return oauthError(400, "invalid_grant", INVALID_GRANT);
+    }
+    const refresh = this.state.refresh.get(body.refresh_token);
+    if (!refresh || refresh.revoked || refresh.clientId !== clientId) {
+      return oauthError(400, "invalid_grant", INVALID_GRANT);
+    }
+    this.state.refresh.update(refresh.token, { ...refresh, revoked: true });
+    const practitioner = this.state.practitioners.get(refresh.practitionerId) ?? DEFAULT_PRACTITIONER;
+    return this.tokenPair(practitioner, clientId);
+  }
+  revoke(context) {
+    const body = this.body(context);
+    if (!this.clientOk(body.client_id, body.client_secret))
+      return oauthError(401, "invalid_client", INVALID_CLIENT);
+    const token = String(body.token);
+    const refresh = this.state.refresh.get(token);
+    if (refresh) this.state.refresh.update(token, { ...refresh, revoked: true });
+    else if (readAccessToken(token)) this.state.revoked.insert(token, { token });
+    return (0, service_exports.jsonRes)(200, {});
+  }
+  authorize(context) {
+    const url = context.url;
+    const redirect = url.searchParams.get("redirect_uri");
+    const clientId = url.searchParams.get("client_id");
+    if (!redirect || !clientId || url.searchParams.get("response_type") !== "code") {
+      return oauthError(
+        400,
+        "invalid_request",
+        "client_id, redirect_uri and response_type=code are required."
+      );
+    }
+    const practitionerId = url.searchParams.get("practitioner_id") ?? DEFAULT_PRACTITIONER.id;
+    if (!this.state.practitioners.get(practitionerId)) {
+      return oauthError(400, "invalid_request", `Unknown practitioner ${practitionerId}.`);
+    }
+    const code = this.issueCode(practitionerId, clientId, redirect);
+    const location = new URL(redirect);
+    location.searchParams.set("code", code);
+    const state = url.searchParams.get("state");
+    if (state !== null) location.searchParams.set("state", state);
+    return new Response(null, { status: 302, headers: { location: location.toString() } });
+  }
+  summary(order) {
+    return {
+      id: order.id,
+      state: order.state,
+      treatment_plan_id: order.treatmentPlanId,
+      patient_id: order.patientId,
+      name: order.name,
+      created_at: order.created_at,
+      updated_at: order.updated_at
+    };
+  }
+  /** A signed, expiring URL for a result artifact, on the mock itself (or `resultsBaseUrl`). */
+  pdfUrl(artifactId, context) {
+    const base = this.state.current().resultsBaseUrl ?? `${context.url.origin}${this.prefix}`;
+    const expires = this.now() + this.state.current().pdfUrlTtlSeconds * 1e3;
+    return `${base.replace(/\/$/, "")}/results/${artifactId}?expires=${expires}&signature=${(0, service_exports.opaqueToken)(`${artifactId}:${expires}`, 24)}`;
+  }
+  detail(order, context) {
+    return {
+      ...this.summary(order),
+      collection_method: order.collectionMethod,
+      tests: order.tests,
+      results: order.results.map((r) => ({
+        id: r.id,
+        name: r.name,
+        state: r.state,
+        pdf_url: this.pdfUrl(r.artifactId, context)
+      })),
+      latest_aggregated_result: order.aggregated ? {
+        id: order.aggregated.id,
+        artifact_id: order.aggregated.artifactId,
+        pdf_url: this.pdfUrl(order.aggregated.artifactId, context),
+        status: order.aggregated.status
+      } : null
+    };
+  }
+  pdf(context) {
+    const artifactId = context.params.artifactId ?? "";
+    const expires = Number(context.url.searchParams.get("expires"));
+    const signature = context.url.searchParams.get("signature");
+    if (signature !== (0, service_exports.opaqueToken)(`${artifactId}:${expires}`, 24)) {
+      return new Response("Forbidden", { status: 403, headers: { "content-type": "text/plain" } });
+    }
+    if (this.now() > expires)
+      return new Response("Expired", { status: 403, headers: { "content-type": "text/plain" } });
+    const known = this.state.orders.list().some(
+      ({ value: o }) => o.aggregated?.artifactId === artifactId || o.results.some((r) => r.artifactId === artifactId)
+    );
+    if (!known) return new Response(null, { status: 404 });
+    return new Response(new Blob([RESULT_PDF]), {
+      status: 200,
+      headers: {
+        "content-type": "application/pdf",
+        "content-length": String(RESULT_PDF.byteLength)
+      }
+    });
+  }
+  publicEvent(event) {
+    return {
+      id: event.id,
+      type: event.type,
+      clinic_id: event.clinic_id,
+      created_at: event.created_at,
+      data: event.data
+    };
+  }
+  emit(type, order, data) {
+    const seq = this.state.next("event");
+    const event = {
+      id: `evt_${seq}`,
+      type,
+      clinic_id: order.clinicId,
+      created_at: this.iso(),
+      data,
+      seq
+    };
+    this.state.events.insert(event.id, event);
+    this.onEvent?.(event);
+    return event;
+  }
+  /** Create a lab order in `not_purchased` (a practitioner recommended labs in a treatment plan). */
+  createOrder(input) {
+    const id = input.id ?? `lo_${this.state.next("order")}`;
+    const now = this.iso();
+    const order = {
+      id,
+      clinicId: input.clinicId ?? DEFAULT_PRACTITIONER.clinicId,
+      patientId: input.patientId,
+      treatmentPlanId: input.treatmentPlanId === void 0 ? `tp_${id}` : input.treatmentPlanId,
+      name: input.name ?? "Comprehensive Wellness Panel",
+      collectionMethod: input.collectionMethod ?? "at_home_phlebotomy",
+      state: "not_purchased",
+      tests: (input.tests ?? ["Lipid Panel", "Comprehensive Metabolic Panel"]).map((name, i) => ({
+        id: `lt_${id}_${i + 1}`,
+        name,
+        lab_type: "labs"
+      })),
+      results: [],
+      aggregated: null,
+      created_at: now,
+      updated_at: now
+    };
+    this.state.orders.insert(id, order);
+    return order;
+  }
+  /**
+   * Move an order forward (never back) and emit its events: `order.placed` on purchase and
+   * `lab_order.updated` for every move. Results-bearing states attach result artifacts.
+   */
+  transition(orderId, to) {
+    const order = this.state.orders.get(orderId);
+    if (!order)
+      throw new service_exports.HttpError(404, {
+        error: { type: "mockingbird_admin", message: `no lab order ${orderId}` }
+      });
+    if (stateRank(to) <= stateRank(order.state)) {
+      throw new service_exports.HttpError(409, {
+        error: {
+          type: "mockingbird_admin",
+          message: `lab orders only move forward: ${order.state} \u2192 ${to} is not allowed`
+        }
+      });
+    }
+    const artifact = () => `art_${(0, service_exports.opaqueToken)(`${order.id}:${this.state.next("artifact")}`, 16)}`;
+    const next = { ...order, state: to, updated_at: this.iso() };
+    const rank = stateRank(to);
+    if (rank >= stateRank("partial_results")) {
+      const wanted = rank >= stateRank("results_ready") ? next.tests.length : 1;
+      const results = [...next.results];
+      for (const test of next.tests.slice(results.length, wanted)) {
+        results.push({
+          id: `res_${test.id}`,
+          name: test.name,
+          state: "final",
+          artifactId: artifact()
+        });
+      }
+      next.results = results;
+    }
+    if (rank >= stateRank("results_ready") && (!next.aggregated || to === "results_amended")) {
+      next.aggregated = {
+        id: `agg_${order.id}${to === "results_amended" ? "_amended" : ""}`,
+        artifactId: artifact(),
+        status: to === "results_amended" ? "amended" : "final"
+      };
+    }
+    this.state.orders.update(order.id, next);
+    if (to === "purchased" || order.state === "not_purchased" && rank > stateRank("purchased")) {
+      this.emit("order.placed", next, {
+        id: next.id,
+        treatment_plan_ids: next.treatmentPlanId ? [next.treatmentPlanId] : [],
+        patient_id: next.patientId,
+        line_items: [{ type: "labs", lab_type: "labs", name: next.name }]
+      });
+    }
+    this.emit("lab_order.updated", next, {
+      lab_order: {
+        id: next.id,
+        state: next.state,
+        treatment_plan_id: next.treatmentPlanId,
+        patient_id: next.patientId
+      }
+    });
+    return next;
+  }
+  seedOrder(seed) {
+    const order = this.state.orders.get(seed.id) ?? this.createOrder(seed);
+    return seed.state === order.state ? order : this.transition(order.id, seed.state);
+  }
+  labOrders() {
+    return this.state.orders.list({ order: "oldest" }).map((r) => r.value);
+  }
+  eventsList() {
+    return this.state.events.list({ order: "oldest" }).map((r) => r.value);
+  }
+};
+
+export {
+  document,
+  operationIds,
+  supportedOperationIds,
+  RESULT_PDF,
+  LAB_ORDER_STATES,
+  isLabOrderState,
+  DEFAULT_CLINIC,
+  DEFAULT_PRACTITIONER,
+  SIGNATURE_HEADER,
+  FULLSCRIPT_PRESETS,
+  createRuntime2 as createRuntime,
+  FULLSCRIPT_NAMESPACE,
+  apiErrors,
+  oauthError,
+  issueAccessToken,
+  tokenCredential,
+  publicEvent,
+  envelope,
+  FullscriptAPI
+};
+//# sourceMappingURL=chunk-CJAYCSOW.js.map