@crvouga/mockingbird-service-junction 0.1.1 → 0.2.0

package/dist/server.d.ts

@@ -0,0 +1,978 @@
+import { Server } from 'node:http';
+import { Hono } from 'hono';
+
+/**
+ * The single source of time for a service.
+ *
+ * Every timestamp a mock writes reads from here, so a suite moves time instead of
+ * sleeping: appointment windows, result delays and expiries become reachable in
+ * milliseconds. A frozen clock also makes timestamps reproducible from a seed.
+ */
+type ClockState$1 = {
+    /** Current epoch milliseconds. */
+    now: number;
+    /** True while time does not advance on its own. */
+    frozen: boolean;
+    /** Milliseconds this clock adds to its underlying source. */
+    offsetMs: number;
+};
+type Clock$1 = {
+    now(): number;
+    /** Pin the clock to an exact instant, keeping it frozen if it already was. */
+    set(epochMs: number): void;
+    /** Move the clock forward, or back with a negative delta. */
+    advance(deltaMs: number): void;
+    /** Stop time at the current instant. */
+    freeze(): void;
+    /** Resume from the current instant. */
+    unfreeze(): void;
+    /** Drop back to the underlying source, live. */
+    reset(): void;
+    state(): ClockState$1;
+};
+
+/** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
+type SqliteValue$2 = null | number | bigint | string | Uint8Array | boolean;
+/** Mutation counters returned by {@link SqliteStatement.run}. */
+type SqliteRunResult$2 = {
+    changes: number;
+    lastInsertRowid: number | bigint;
+};
+/**
+ * Prepared statement bound to a {@link SqliteClient}.
+ *
+ * Pass bind values as rest arguments on each call (no sticky `bind()`).
+ */
+interface SqliteStatement$2 {
+    run(...params: SqliteValue$2[]): SqliteRunResult$2;
+    all<T = Record<string, unknown>>(...params: SqliteValue$2[]): T[];
+    get<T = Record<string, unknown>>(...params: SqliteValue$2[]): T | undefined;
+}
+/**
+ * Sync SQLite client port owned by Mockingbird.
+ *
+ * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
+ * `bun:sqlite` instances all work when they expose this surface.
+ */
+interface SqliteClient$2 {
+    exec(sql: string): void;
+    prepare(sql: string): SqliteStatement$2;
+    transaction<T>(fn: () => T): T;
+}
+
+/**
+ * Seeded pseudo-random numbers, so anything a mock invents — ids, jitter, which
+ * request a percentage fault hits — is reproducible from a seed.
+ *
+ * mulberry32: small, fast, and stable across runtimes, which matters more here
+ * than statistical quality.
+ */
+type Rng$1 = {
+    /** Next value in `[0, 1)`. */
+    next(): number;
+    /** Next integer in `[min, max]`. */
+    int(min: number, max: number): number;
+    /** Restart the stream from its seed. */
+    reset(): void;
+    seed: number;
+};
+
+/**
+ * A deliberate failure injected in front of an operation.
+ *
+ * This is how a suite reaches the vendor's failure modes without the vendor: the
+ * quota error that only appears when a shared sandbox is full, the 429 that only
+ * appears under load, the 5xx that proves a retry path works.
+ */
+type FaultRule$1 = {
+    /** Stable id, so a suite can retire exactly the rule it added. */
+    id: string;
+    /** Fault only this operation. Omit to match every operation. */
+    operationId?: string;
+    /** Fault only this HTTP method, case-insensitive. Omit to match every method. */
+    method?: string;
+    /** Fault only paths starting with this prefix. Omit to match every path. */
+    pathPrefix?: string;
+    /**
+     * Fault only this namespace. Omit (or `"*"`) to fault every namespace — which is what
+     * an in-process caller usually wants, and what a parallel worker usually does not:
+     * rules added through `POST /__admin/faults` default to the calling namespace.
+     */
+    namespace?: string;
+    status: number;
+    /** Response body, serialized as JSON. A string is sent as-is. */
+    body?: unknown;
+    headers?: Record<string, string>;
+    /** Retire the rule after this many faults. Omit to keep it until removed. */
+    count?: number;
+    /** Fault this fraction of matching requests, `0`–`1`. Default `1`. */
+    rate?: number;
+    /** Hold the response back this long, to exercise timeouts. */
+    delayMs?: number;
+};
+/** What a request looks like to the fault matcher. */
+type FaultCandidate$1 = {
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    namespace: string;
+};
+type FaultRegistry$1 = {
+    add(rule: FaultRule$1): FaultRule$1;
+    list(): (FaultRule$1 & {
+        remaining: number | null;
+        hits: number;
+    })[];
+    remove(id: string): boolean;
+    clear(): void;
+    /**
+     * The fault this request should get, or `undefined` to let it through.
+     * Consumes one of the matching rule's remaining uses.
+     */
+    take(candidate: FaultCandidate$1): Promise<{
+        id: string;
+        response: Response;
+    } | undefined>;
+};
+
+/** One handled request, as the structured log sees it. */
+type RequestLog$1 = {
+    service: string;
+    namespace: string;
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+    /** True when the path matched no operation in the contract. */
+    unmatched: boolean;
+    /** Set when a fault rule produced the response. */
+    faultId?: string;
+};
+type MetricsReport$1 = {
+    requests: number;
+    /** Counts keyed `<operationId> <status>`. */
+    byOperation: Record<string, number>;
+    /**
+     * Paths that matched no operation, most frequent first.
+     *
+     * This is the early-warning signal: a consumer calling something the mock does
+     * not implement shows up here as a count, before it fails a suite as a 404.
+     */
+    unmatched: {
+        method: string;
+        path: string;
+        count: number;
+    }[];
+    faults: number;
+    totalDurationMs: number;
+};
+type Metrics$1 = {
+    record(entry: RequestLog$1): void;
+    report(): MetricsReport$1;
+    reset(): void;
+};
+
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot$1 = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
+/**
+ * Anything that can answer a Fetch `Request` with a `Response`.
+ *
+ * Every Mockingbird service implements this, and every runtime adapter consumes it.
+ * It is the only contract shared across the whole graph.
+ */
+interface FetchAPI$2 {
+    fetch(request: Request): Promise<Response>;
+}
+
+/** What the runtime needs from a service: a Fetch handler it can reset. */
+type ServiceInstance$1 = FetchAPI$2 & {
+    reset(): Promise<void>;
+};
+type ServiceRuntime$1<T extends ServiceInstance$1> = FetchAPI$2 & {
+    readonly name: string;
+    readonly sqlite: SqliteClient$2;
+    readonly clock: Clock$1;
+    readonly faults: FaultRegistry$1;
+    readonly metrics: Metrics$1;
+    readonly rng: Rng$1;
+    /** The instance behind `namespace` (the default one when omitted), created on first use. */
+    instance(namespace?: string): T;
+    /** Public names of every namespace created so far. */
+    namespaces(): string[];
+    /** Reset one namespace, or every namespace with `"*"`. */
+    reset(namespace?: string): Promise<void>;
+    snapshot(namespace?: string): NamespaceSnapshot$1;
+    restore(snapshot: NamespaceSnapshot$1, namespace?: string): void;
+};
+
+type CliOption = {
+    type: "string" | "boolean";
+    description: string;
+    /** Shown in help; the value placeholder, e.g. `<port>`. */
+    value?: string;
+    default?: string | boolean;
+};
+type CliValues = Record<string, string | boolean | undefined>;
+type CommonServeOptions = {
+    adminKey: string | undefined;
+    seed: string | undefined;
+    onLog: ((entry: RequestLog$1) => void) | undefined;
+};
+/**
+ * What a service contributes to `serve`: how to build its runtime from CLI flags,
+ * and what to say at startup. Every service's `./server` entry exports one as
+ * `serveTarget`, which is also how `serve --config` finds services by name.
+ */
+type ServeTarget = {
+    name: string;
+    defaultPort: number;
+    /** Serve flags beyond the common ones. */
+    options?: Record<string, CliOption>;
+    create(values: CliValues, common: CommonServeOptions): Promise<ServiceRuntime$1<ServiceInstance$1>> | ServiceRuntime$1<ServiceInstance$1>;
+    /** Startup lines after the listen address, e.g. the loaded corpus version. */
+    banner?(runtime: ServiceRuntime$1<ServiceInstance$1>): string[];
+};
+
+/** A running server, with the address it actually bound. */
+type Listening = {
+    url: string;
+    port: number;
+    host: string;
+    server: Server;
+    close(): Promise<void>;
+};
+
+/**
+ * The single source of time for a service.
+ *
+ * Every timestamp a mock writes reads from here, so a suite moves time instead of
+ * sleeping: appointment windows, result delays and expiries become reachable in
+ * milliseconds. A frozen clock also makes timestamps reproducible from a seed.
+ */
+type ClockState = {
+    /** Current epoch milliseconds. */
+    now: number;
+    /** True while time does not advance on its own. */
+    frozen: boolean;
+    /** Milliseconds this clock adds to its underlying source. */
+    offsetMs: number;
+};
+type Clock = {
+    now(): number;
+    /** Pin the clock to an exact instant, keeping it frozen if it already was. */
+    set(epochMs: number): void;
+    /** Move the clock forward, or back with a negative delta. */
+    advance(deltaMs: number): void;
+    /** Stop time at the current instant. */
+    freeze(): void;
+    /** Resume from the current instant. */
+    unfreeze(): void;
+    /** Drop back to the underlying source, live. */
+    reset(): void;
+    state(): ClockState;
+};
+
+/** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
+type SqliteValue$1 = null | number | bigint | string | Uint8Array | boolean;
+/** Mutation counters returned by {@link SqliteStatement.run}. */
+type SqliteRunResult$1 = {
+    changes: number;
+    lastInsertRowid: number | bigint;
+};
+/**
+ * Prepared statement bound to a {@link SqliteClient}.
+ *
+ * Pass bind values as rest arguments on each call (no sticky `bind()`).
+ */
+interface SqliteStatement$1 {
+    run(...params: SqliteValue$1[]): SqliteRunResult$1;
+    all<T = Record<string, unknown>>(...params: SqliteValue$1[]): T[];
+    get<T = Record<string, unknown>>(...params: SqliteValue$1[]): T | undefined;
+}
+/**
+ * Sync SQLite client port owned by Mockingbird.
+ *
+ * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
+ * `bun:sqlite` instances all work when they expose this surface.
+ */
+interface SqliteClient$1 {
+    exec(sql: string): void;
+    prepare(sql: string): SqliteStatement$1;
+    transaction<T>(fn: () => T): T;
+}
+
+/**
+ * Seeded pseudo-random numbers, so anything a mock invents — ids, jitter, which
+ * request a percentage fault hits — is reproducible from a seed.
+ *
+ * mulberry32: small, fast, and stable across runtimes, which matters more here
+ * than statistical quality.
+ */
+type Rng = {
+    /** Next value in `[0, 1)`. */
+    next(): number;
+    /** Next integer in `[min, max]`. */
+    int(min: number, max: number): number;
+    /** Restart the stream from its seed. */
+    reset(): void;
+    seed: number;
+};
+
+/**
+ * A deliberate failure injected in front of an operation.
+ *
+ * This is how a suite reaches the vendor's failure modes without the vendor: the
+ * quota error that only appears when a shared sandbox is full, the 429 that only
+ * appears under load, the 5xx that proves a retry path works.
+ */
+type FaultRule = {
+    /** Stable id, so a suite can retire exactly the rule it added. */
+    id: string;
+    /** Fault only this operation. Omit to match every operation. */
+    operationId?: string;
+    /** Fault only this HTTP method, case-insensitive. Omit to match every method. */
+    method?: string;
+    /** Fault only paths starting with this prefix. Omit to match every path. */
+    pathPrefix?: string;
+    /**
+     * Fault only this namespace. Omit (or `"*"`) to fault every namespace — which is what
+     * an in-process caller usually wants, and what a parallel worker usually does not:
+     * rules added through `POST /__admin/faults` default to the calling namespace.
+     */
+    namespace?: string;
+    status: number;
+    /** Response body, serialized as JSON. A string is sent as-is. */
+    body?: unknown;
+    headers?: Record<string, string>;
+    /** Retire the rule after this many faults. Omit to keep it until removed. */
+    count?: number;
+    /** Fault this fraction of matching requests, `0`–`1`. Default `1`. */
+    rate?: number;
+    /** Hold the response back this long, to exercise timeouts. */
+    delayMs?: number;
+};
+/** What a request looks like to the fault matcher. */
+type FaultCandidate = {
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    namespace: string;
+};
+type FaultRegistry = {
+    add(rule: FaultRule): FaultRule;
+    list(): (FaultRule & {
+        remaining: number | null;
+        hits: number;
+    })[];
+    remove(id: string): boolean;
+    clear(): void;
+    /**
+     * The fault this request should get, or `undefined` to let it through.
+     * Consumes one of the matching rule's remaining uses.
+     */
+    take(candidate: FaultCandidate): Promise<{
+        id: string;
+        response: Response;
+    } | undefined>;
+};
+
+/** One handled request, as the structured log sees it. */
+type RequestLog = {
+    service: string;
+    namespace: string;
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+    /** True when the path matched no operation in the contract. */
+    unmatched: boolean;
+    /** Set when a fault rule produced the response. */
+    faultId?: string;
+};
+type MetricsReport = {
+    requests: number;
+    /** Counts keyed `<operationId> <status>`. */
+    byOperation: Record<string, number>;
+    /**
+     * Paths that matched no operation, most frequent first.
+     *
+     * This is the early-warning signal: a consumer calling something the mock does
+     * not implement shows up here as a count, before it fails a suite as a 404.
+     */
+    unmatched: {
+        method: string;
+        path: string;
+        count: number;
+    }[];
+    faults: number;
+    totalDurationMs: number;
+};
+type Metrics = {
+    record(entry: RequestLog): void;
+    report(): MetricsReport;
+    reset(): void;
+};
+
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
+/**
+ * Anything that can answer a Fetch `Request` with a `Response`.
+ *
+ * Every Mockingbird service implements this, and every runtime adapter consumes it.
+ * It is the only contract shared across the whole graph.
+ */
+interface FetchAPI$1 {
+    fetch(request: Request): Promise<Response>;
+}
+
+/** What the runtime needs from a service: a Fetch handler it can reset. */
+type ServiceInstance = FetchAPI$1 & {
+    reset(): Promise<void>;
+};
+type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
+    readonly name: string;
+    readonly sqlite: SqliteClient$1;
+    readonly clock: Clock;
+    readonly faults: FaultRegistry;
+    readonly metrics: Metrics;
+    readonly rng: Rng;
+    /** The instance behind `namespace` (the default one when omitted), created on first use. */
+    instance(namespace?: string): T;
+    /** Public names of every namespace created so far. */
+    namespaces(): string[];
+    /** Reset one namespace, or every namespace with `"*"`. */
+    reset(namespace?: string): Promise<void>;
+    snapshot(namespace?: string): NamespaceSnapshot;
+    restore(snapshot: NamespaceSnapshot, namespace?: string): void;
+};
+
+/** Options every provider constructor accepts. */
+type APIOptions = {
+    /** Sync SQLite client. Defaults to `@crvouga/mockingbird-service-sqlite`. */
+    sqlite?: SqliteClient$1;
+    /** Clock used for `created`-style fields. Default `Date.now`. */
+    now?: () => number;
+    /**
+     * Storage namespace for this instance's records. Instances sharing one SQLite
+     * client stay isolated when their namespaces differ. Defaults to the service name.
+     */
+    namespace?: string;
+};
+
+/** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
+type SqliteValue = null | number | bigint | string | Uint8Array | boolean;
+/** Mutation counters returned by {@link SqliteStatement.run}. */
+type SqliteRunResult = {
+    changes: number;
+    lastInsertRowid: number | bigint;
+};
+/**
+ * Prepared statement bound to a {@link SqliteClient}.
+ *
+ * Pass bind values as rest arguments on each call (no sticky `bind()`).
+ */
+interface SqliteStatement {
+    run(...params: SqliteValue[]): SqliteRunResult;
+    all<T = Record<string, unknown>>(...params: SqliteValue[]): T[];
+    get<T = Record<string, unknown>>(...params: SqliteValue[]): T | undefined;
+}
+/**
+ * Sync SQLite client port owned by Mockingbird.
+ *
+ * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
+ * `bun:sqlite` instances all work when they expose this surface.
+ */
+interface SqliteClient {
+    exec(sql: string): void;
+    prepare(sql: string): SqliteStatement;
+    transaction<T>(fn: () => T): T;
+}
+
+/** Lab-test catalog mirrored from the Junction sandbox (`GET /v3/lab_test`). */
+type CatalogMarker = {
+    id: number;
+    name: string;
+    slug: string;
+    description: string | null;
+    lab_id: number | null;
+    provider_id: string | null;
+    type: string | null;
+    unit: string | null;
+    price: string | null;
+    aoe: unknown;
+    a_la_carte_enabled: boolean;
+    common_tat_days: number | null;
+    worst_case_tat_days: number | null;
+    is_orderable: boolean | null;
+};
+type ExpectedResultLoinc = {
+    id: number;
+    name: string;
+    slug: string;
+    code: string;
+    unit: string | null;
+};
+type ExpectedResult = {
+    id: number;
+    name: string;
+    slug: string;
+    lab_id: number | null;
+    provider_id: string | null;
+    required: boolean;
+    loinc: ExpectedResultLoinc | null;
+};
+type LabTestRecord = {
+    id: string;
+    slug: string;
+    name: string;
+    sample_type: string;
+    method: string;
+    price: number;
+    is_active: boolean;
+    status: string;
+    fasting: boolean;
+    lab: Record<string, unknown>;
+    markers: CatalogMarker[] | null;
+    is_delegated: boolean;
+    auto_generated: boolean;
+    has_collection_instructions: boolean | null;
+    common_tat_days: number | null;
+    worst_case_tat_days: number | null;
+};
+
+type GetCacheEntry = {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+};
+type JunctionWebhookEvent = {
+    event_type: "labtest.order.created" | "labtest.order.updated" | "labtest.appointment.updated";
+    data: Record<string, unknown>;
+    team_id: string;
+    user_id: string;
+    client_user_id: string;
+};
+type WebhookDeliveryAttempt = {
+    message_id: string;
+    event: JunctionWebhookEvent;
+    attempt: number;
+    scheduled_at: string;
+    timeout_ms: number;
+    acknowledged: boolean;
+};
+type OrderEventRecord = {
+    id: number;
+    created_at: string;
+    status: string;
+    status_detail: null;
+};
+type OrderTransactionEmbed = {
+    id: string;
+    status: "active" | "completed" | "cancelled";
+    orders: Array<{
+        id: string;
+        low_level_status: string;
+        low_level_status_created_at: string;
+        origin: string;
+        parent_id: null;
+        created_at: string;
+        updated_at: string;
+    }>;
+};
+type OrderRecord = {
+    id: string;
+    user_id: string;
+    team_id: string;
+    patient_details: Record<string, unknown>;
+    patient_address: Record<string, unknown>;
+    lab_test: LabTestRecord;
+    details: Record<string, unknown>;
+    sample_id: string | null;
+    notes: null;
+    clinical_notes: string | null;
+    passthrough: string | null;
+    /** Echoed from the request's opaque provider account id; absent when the order had none. */
+    lab_account_id?: string;
+    created_at: string;
+    updated_at: string;
+    events: OrderEventRecord[];
+    status: string;
+    last_event: OrderEventRecord;
+    physician: {
+        first_name: string;
+        last_name: string;
+        npi: string;
+    };
+    health_insurance_id: null;
+    requisition_form_url: string | null;
+    shipping_details: null;
+    has_abn: boolean;
+    billing_type: string;
+    priority: boolean;
+    activate_by: null;
+    icd_codes: string[] | null;
+    interpretation: string | null;
+    has_missing_results: boolean | null;
+    result_types: string[] | null;
+    expected_result_by_date: string | null;
+    worst_case_result_by_date: string | null;
+    origin: string;
+    order_transaction: OrderTransactionEmbed;
+};
+/**
+ * A lab account as the ordering rules read it. Structurally `LabAccountRecord` from
+ * lab-accounts.ts, restated here because that module imports this one.
+ */
+type StoredLabAccount = {
+    id: string;
+    lab: string;
+    org_id: string | null;
+    status: "active" | "pending" | "suspended" | "ready_to_launch";
+    delegated_flow: "order_delegated" | "result_delegated" | "fully_delegated" | "not_delegated";
+    provider_account_id: string;
+    account_name: string | null;
+    default_clinical_notes: string | null;
+    business_units: string[] | null;
+    allowed_billing: Record<string, readonly string[]>;
+    team_id_allowlist: readonly string[];
+};
+/**
+ * A chosen result for one order, installed through the admin API. Replaces the
+ * generated biomarker lines, so a suite can assert on an exact payload — an abnormal
+ * panel, a critical value, a missing marker — instead of whatever the generator made.
+ */
+type ResultFixture = {
+    /** The fixture's name, for logs and `GET /__admin/results`. */
+    name: string;
+    results?: unknown[];
+    missing_results?: unknown[] | null;
+    interpretation?: string;
+    /** Served from `GET /v3/order/{id}/result/pdf` instead of the generated PDF. */
+    pdf_base64?: string;
+};
+/**
+ * How serviceability reads answer a ZIP the loaded corpus has no record for.
+ *
+ * - `synthetic`: invent plausible coverage. Right for property tests that walk random ZIPs.
+ * - `corpus`: refuse with a documented Mockingbird error. Right for a mock standing in for
+ *   the vendor, where invented coverage would silently disagree with production.
+ */
+type GeoMode = "synthetic" | "corpus";
+type WebhookPublisher = (event: JunctionWebhookEvent) => void;
+type JunctionWebhookOptions = {
+    seed?: number;
+    jitterRatio?: number;
+    timeoutMs?: number;
+};
+
+/**
+ * Anything that can answer a Fetch `Request` with a `Response`.
+ *
+ * Every Mockingbird service implements this, and every runtime adapter consumes it.
+ * It is the only contract shared across the whole graph.
+ */
+interface FetchAPI {
+    fetch(request: Request): Promise<Response>;
+}
+
+type LabAccountStatus = "active" | "pending" | "suspended" | "ready_to_launch";
+type LabAccountDelegatedFlow = "order_delegated" | "result_delegated" | "fully_delegated" | "not_delegated";
+/**
+ * A lab account as a consumer configures it. Mirrors `ClientFacingLabAccount`, with
+ * every field but `id` and `lab` optional, plus a `states` shorthand for the common
+ * case of an account that client-bills in a fixed set of states.
+ */
+type LabAccountInput = {
+    id: string;
+    /** Lab slug, e.g. `"quest"`, `"labcorp"`, `"bioreference"`. */
+    lab: string;
+    status?: LabAccountStatus;
+    delegated_flow?: LabAccountDelegatedFlow;
+    account_name?: string | null;
+    provider_account_id?: string;
+    org_id?: string | null;
+    business_units?: string[] | null;
+    default_clinical_notes?: string | null;
+    /** Billing type → states it is allowed in. Takes precedence over `states`. */
+    allowed_billing?: Record<string, readonly string[]>;
+    /** Shorthand for `allowed_billing: { client_bill: states }`. Default: every state. */
+    states?: readonly string[];
+    /** Teams the account is linked to. Default: the mock team, so it is selectable. */
+    team_id_allowlist?: readonly string[];
+};
+
+/**
+ * Version of the sealed-corpus on-disk format. Bumped whenever the shape changes so a
+ * stale recording is rejected instead of half-applied.
+ */
+declare const SEALED_CORPUS_VERSION = 1;
+/**
+ * Exact sandbox recording of the provider-owned reads a drop-in consumer depends on:
+ * parameter-stable GET observations (area/PSC inventory), the lab catalog, team labs, and
+ * lab accounts. Availability is intentionally absent — its slot dates and single-use
+ * `booking_key`s can never match a live cache key, so it stays with the generator.
+ */
+type SealedCorpus = {
+    version: typeof SEALED_CORPUS_VERSION;
+    recordedAt: string;
+    source: string;
+    /** SHA-256 of the recording's content, written by `corpus pull`. Identifies it in logs. */
+    fingerprint?: string;
+    observations: Record<string, GetCacheEntry>;
+    catalog: {
+        labTests: LabTestRecord[];
+        labs: Record<string, unknown>[];
+        expectedResults: Record<string, ExpectedResult[]>;
+    };
+    labAccounts: Record<string, unknown>[];
+};
+
+type SeedSource = {
+    fetch: (request: Request) => Promise<Response>;
+    baseUrl: string;
+    headers: Record<string, string>;
+};
+type SeedObservations = {
+    getCache?: ReadonlyMap<string, GetCacheEntry>;
+};
+type SeedReport = {
+    users: number;
+    orders: number;
+    appointments: number;
+    catalogTests: number;
+    labs: number;
+    cacheEntries: number;
+};
+
+/**
+ * Signed webhook delivery, the way Junction delivers through Svix.
+ *
+ * Signing lives here, next to the events, so a consumer never hand-rolls it. The
+ * signature is standard Svix — `v1,` + base64 HMAC-SHA256, keyed by the base64 part of
+ * `whsec_…`, over `"<svix-id>.<svix-timestamp>.<body>"` — so the official `svix`
+ * verifier, and a receiver written for real Junction webhooks, accept it unchanged.
+ */
+type WebhookEndpoint = {
+    url: string;
+    /** Svix signing secret, `whsec_<base64>`. A bare base64 secret is accepted too. */
+    secret: string;
+    /**
+     * Delay before each attempt, in ms; the first entry delays the first attempt. Default:
+     * Svix's schedule (immediately, 5 s, 5 min, 30 min, 2 h, 5 h, 10 h, 10 h).
+     */
+    retryDelaysMs?: readonly number[];
+    /** Abort an attempt that takes longer than this. Default 15 s, like Svix. */
+    timeoutMs?: number;
+    /** Added to every delivery, e.g. a routing scope for a shared receiver. */
+    headers?: Record<string, string>;
+    fetch?: (request: Request) => Promise<Response>;
+};
+type WebhookAttempt = {
+    attempt: number;
+    /** Wall-clock time of the attempt, ISO-8601. */
+    at: string;
+    /** Receiver's status code, or `null` when the request never completed. */
+    status: number | null;
+    error: string | null;
+    durationMs: number;
+};
+type WebhookDelivery = {
+    messageId: string;
+    namespace: string;
+    event: JunctionWebhookEvent;
+    state: "pending" | "delivered" | "failed";
+    attempts: WebhookAttempt[];
+};
+type WebhookDispatcher = {
+    /** Queue an event for delivery. Returns immediately; delivery runs in the background. */
+    publish(event: JunctionWebhookEvent, namespace: string): WebhookDelivery;
+    deliveries(namespace?: string): WebhookDelivery[];
+    /** Deliver a message again now, as a new attempt, whatever its state. */
+    replay(messageId: string): Promise<WebhookDelivery | undefined>;
+    /** Run every pending retry now instead of waiting out its delay. */
+    flush(): Promise<void>;
+    /** Resolve once no delivery is in flight. */
+    idle(): Promise<void>;
+    /** Cancel pending retries and forget every delivery. */
+    clear(namespace?: string): void;
+};
+
+/**
+ * Stateful mock of the Junction (Vital) API user and lab-testing surfaces.
+ *
+ * Docs: https://docs.junction.com/
+ * Auth: `x-vital-api-key` — https://docs.junction.com/api-details/junction-api
+ */
+type JunctionAPIOptions = APIOptions & {
+    onWebhook?: WebhookPublisher;
+    webhook?: JunctionWebhookOptions;
+    /** Install a recorded corpus at construction; it is re-applied on every `reset()`. */
+    corpus?: SealedCorpus;
+    /**
+     * How serviceability reads answer a ZIP the corpus does not cover. Default: `corpus`
+     * when a corpus is given (refuse, loudly), otherwise `synthetic` (invent coverage).
+     */
+    geo?: GeoMode;
+    /**
+     * The team's lab accounts, replacing the built-in fixtures (and any from the corpus).
+     * `create_order` routes, accepts and rejects `lab_account_id` against these.
+     */
+    labAccounts?: readonly LabAccountInput[];
+};
+/** What a loaded corpus covers, for `/health` and startup logs. */
+type CorpusInfo = {
+    label: string;
+    recordedAt: string;
+    source: string;
+    observations: number;
+    labTests: number;
+    labAccounts: number;
+    zips: number;
+};
+declare class JunctionAPI implements FetchAPI {
+    readonly app: Hono;
+    readonly sqlite: SqliteClient;
+    private readonly service;
+    private readonly state;
+    private corpus;
+    private labAccountConfig;
+    constructor(options?: JunctionAPIOptions);
+    fetch(request: Request): Promise<Response>;
+    reset(): Promise<void>;
+    /**
+     * Install a sealed sandbox recording: seed the observation cache and replace the catalog,
+     * labs, and lab accounts with the recording's exact values. Re-applied on `reset()`.
+     */
+    installCorpus(corpus: SealedCorpus): void;
+    /**
+     * Which lab accounts the ordering rules see, in order of precedence: the configured
+     * ones, then a corpus's real accounts, then the built-in fixtures (which a corpus
+     * recorded from a team with no accounts leaves in place).
+     */
+    private seedLabAccounts;
+    /** Replace the team's lab accounts; `undefined` restores the default. Kept across resets. */
+    configureLabAccounts(accounts: readonly LabAccountInput[] | undefined): StoredLabAccount[];
+    labAccounts(): StoredLabAccount[];
+    corpusInfo(): CorpusInfo | undefined;
+    get geoMode(): GeoMode;
+    set geoMode(mode: GeoMode);
+    order(id: string): OrderRecord | undefined;
+    orders(): OrderRecord[];
+    /**
+     * Put an order straight into a status (a full `<status>.<method>.<event>` value) and
+     * publish the webhook a real transition would. `flags` takes the same keys as
+     * `simulate_order`'s body: `interpretation`, `result_types`, `has_missing_results`.
+     */
+    transitionOrder(id: string, status: string, options: {
+        now: () => number;
+        flags?: Record<string, unknown> | null;
+    }): OrderRecord | undefined;
+    /** Serve `fixture` as this order's results, replacing the generated ones. */
+    installResultFixture(orderId: string, fixture: ResultFixture): boolean;
+    resultFixture(orderId: string): ResultFixture | undefined;
+    seedFrom(source: SeedSource, observations?: SeedObservations): Promise<SeedReport>;
+    ensureLabTests(source: SeedSource, ids: readonly string[]): Promise<number>;
+    ensureOrders(source: SeedSource, ids: readonly string[]): Promise<number>;
+    markUserDeleted(userId: string): void;
+    webhookEvents(): JunctionWebhookEvent[];
+    webhookDeliveryAttempts(): WebhookDeliveryAttempt[];
+}
+
+type JunctionRuntimeOptions = {
+    /**
+     * Recorded vendor data every namespace starts from. The served mock loads the corpus
+     * shipped at `@crvouga/mockingbird-service-junction/corpus` unless told otherwise.
+     */
+    corpus?: SealedCorpus;
+    /** Default: `corpus` when a corpus is loaded, otherwise `synthetic`. */
+    geo?: GeoMode;
+    /** The team's lab accounts; see {@link JunctionAPIOptions.labAccounts}. */
+    labAccounts?: readonly LabAccountInput[];
+    /** Deliver signed webhooks here, with Svix's retry schedule. */
+    webhooks?: WebhookEndpoint;
+    /** Called in-process for every webhook event, delivered or not. */
+    onWebhook?: (event: Parameters<WebhookPublisher>[0], namespace: string) => void;
+    sqlite?: SqliteClient;
+    clock?: Clock;
+    /** Seeds fault rates and webhook retry jitter. */
+    seed?: number | string;
+    /** Require `x-mockingbird-admin-key` on `/__admin/*`. */
+    adminKey?: string;
+    onLog?: (entry: RequestLog) => void;
+};
+type JunctionRuntime = ServiceRuntime<JunctionAPI> & {
+    /** Signed delivery, when `webhooks` was configured. */
+    readonly webhooks: WebhookDispatcher | undefined;
+};
+
+/** Port `mockingbird-junction serve` listens on when none is given. */
+declare const DEFAULT_PORT = 8787;
+/** A corpus to serve: the shipped one, none (synthetic), a file path, or a loaded corpus. */
+type CorpusSource = "default" | "none" | (string & {}) | SealedCorpus;
+type JunctionServerOptions = Omit<JunctionRuntimeOptions, "corpus"> & {
+    /** Default `0`: the OS picks a free port (read it from `url` / `port`). */
+    port?: number;
+    /** Default `127.0.0.1`. */
+    host?: string;
+    /** Default `"default"`: the corpus shipped with this package. */
+    corpus?: CorpusSource;
+};
+type JunctionServer = Listening & {
+    runtime: JunctionRuntime;
+};
+/** Resolve a {@link CorpusSource} to a corpus, or `undefined` for synthetic data. */
+declare const loadCorpus: (source: CorpusSource) => Promise<SealedCorpus | undefined>;
+/**
+ * Serve the Junction mock over `node:http`. Resolves once it is listening.
+ *
+ *   const server = await createServer()
+ *   // point the Vital SDK at server.url; await server.close() when done
+ */
+declare const createServer: (options?: JunctionServerOptions) => Promise<JunctionServer>;
+/** How `serve` (and `serve --config`) builds the Junction mock from flags. */
+declare const serveTarget: ServeTarget;
+
+export { DEFAULT_PORT, createServer, loadCorpus, serveTarget };
+export type { CorpusSource, JunctionServer, JunctionServerOptions };