@crvouga/mockingbird-service-junction 0.1.2 → 0.2.0

package/dist/index.d.ts

@@ -1,5 +1,35 @@
 import { Hono } from 'hono';
 
+/**
+ * The single source of time for a service.
+ *
+ * Every timestamp a mock writes reads from here, so a suite moves time instead of
+ * sleeping: appointment windows, result delays and expiries become reachable in
+ * milliseconds. A frozen clock also makes timestamps reproducible from a seed.
+ */
+type ClockState = {
+    /** Current epoch milliseconds. */
+    now: number;
+    /** True while time does not advance on its own. */
+    frozen: boolean;
+    /** Milliseconds this clock adds to its underlying source. */
+    offsetMs: number;
+};
+type Clock = {
+    now(): number;
+    /** Pin the clock to an exact instant, keeping it frozen if it already was. */
+    set(epochMs: number): void;
+    /** Move the clock forward, or back with a negative delta. */
+    advance(deltaMs: number): void;
+    /** Stop time at the current instant. */
+    freeze(): void;
+    /** Resume from the current instant. */
+    unfreeze(): void;
+    /** Drop back to the underlying source, live. */
+    reset(): void;
+    state(): ClockState;
+};
+
 /** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
 type SqliteValue$1 = null | number | bigint | string | Uint8Array | boolean;
 /** Mutation counters returned by {@link SqliteStatement.run}. */
@@ -29,12 +59,183 @@ interface SqliteClient$1 {
     transaction<T>(fn: () => T): T;
 }
 
+/**
+ * Seeded pseudo-random numbers, so anything a mock invents — ids, jitter, which
+ * request a percentage fault hits — is reproducible from a seed.
+ *
+ * mulberry32: small, fast, and stable across runtimes, which matters more here
+ * than statistical quality.
+ */
+type Rng = {
+    /** Next value in `[0, 1)`. */
+    next(): number;
+    /** Next integer in `[min, max]`. */
+    int(min: number, max: number): number;
+    /** Restart the stream from its seed. */
+    reset(): void;
+    seed: number;
+};
+
+/**
+ * A deliberate failure injected in front of an operation.
+ *
+ * This is how a suite reaches the vendor's failure modes without the vendor: the
+ * quota error that only appears when a shared sandbox is full, the 429 that only
+ * appears under load, the 5xx that proves a retry path works.
+ */
+type FaultRule = {
+    /** Stable id, so a suite can retire exactly the rule it added. */
+    id: string;
+    /** Fault only this operation. Omit to match every operation. */
+    operationId?: string;
+    /** Fault only this HTTP method, case-insensitive. Omit to match every method. */
+    method?: string;
+    /** Fault only paths starting with this prefix. Omit to match every path. */
+    pathPrefix?: string;
+    /**
+     * Fault only this namespace. Omit (or `"*"`) to fault every namespace — which is what
+     * an in-process caller usually wants, and what a parallel worker usually does not:
+     * rules added through `POST /__admin/faults` default to the calling namespace.
+     */
+    namespace?: string;
+    status: number;
+    /** Response body, serialized as JSON. A string is sent as-is. */
+    body?: unknown;
+    headers?: Record<string, string>;
+    /** Retire the rule after this many faults. Omit to keep it until removed. */
+    count?: number;
+    /** Fault this fraction of matching requests, `0`–`1`. Default `1`. */
+    rate?: number;
+    /** Hold the response back this long, to exercise timeouts. */
+    delayMs?: number;
+};
+/** What a request looks like to the fault matcher. */
+type FaultCandidate = {
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    namespace: string;
+};
+type FaultRegistry = {
+    add(rule: FaultRule): FaultRule;
+    list(): (FaultRule & {
+        remaining: number | null;
+        hits: number;
+    })[];
+    remove(id: string): boolean;
+    clear(): void;
+    /**
+     * The fault this request should get, or `undefined` to let it through.
+     * Consumes one of the matching rule's remaining uses.
+     */
+    take(candidate: FaultCandidate): Promise<{
+        id: string;
+        response: Response;
+    } | undefined>;
+};
+
+/** One handled request, as the structured log sees it. */
+type RequestLog = {
+    service: string;
+    namespace: string;
+    operationId: string | undefined;
+    method: string;
+    path: string;
+    status: number;
+    durationMs: number;
+    /** True when the path matched no operation in the contract. */
+    unmatched: boolean;
+    /** Set when a fault rule produced the response. */
+    faultId?: string;
+};
+type MetricsReport = {
+    requests: number;
+    /** Counts keyed `<operationId> <status>`. */
+    byOperation: Record<string, number>;
+    /**
+     * Paths that matched no operation, most frequent first.
+     *
+     * This is the early-warning signal: a consumer calling something the mock does
+     * not implement shows up here as a count, before it fails a suite as a 404.
+     */
+    unmatched: {
+        method: string;
+        path: string;
+        count: number;
+    }[];
+    faults: number;
+    totalDurationMs: number;
+};
+type Metrics = {
+    record(entry: RequestLog): void;
+    report(): MetricsReport;
+    reset(): void;
+};
+
+/**
+ * A point-in-time copy of everything a service namespace holds.
+ *
+ * All service state lives in the two core tables keyed by namespace, so a snapshot
+ * is generic: any service gets per-test rollback without knowing its own schema.
+ * Restoring is much cheaper than rebuilding a namespace from a corpus.
+ */
+type NamespaceSnapshot = {
+    namespace: string;
+    records: {
+        collection: string;
+        id: string;
+        seq: number;
+        value: string;
+    }[];
+    sequences: {
+        name: string;
+        kind: string;
+        value: number;
+    }[];
+};
+
+/**
+ * Anything that can answer a Fetch `Request` with a `Response`.
+ *
+ * Every Mockingbird service implements this, and every runtime adapter consumes it.
+ * It is the only contract shared across the whole graph.
+ */
+interface FetchAPI$1 {
+    fetch(request: Request): Promise<Response>;
+}
+
+/** What the runtime needs from a service: a Fetch handler it can reset. */
+type ServiceInstance = FetchAPI$1 & {
+    reset(): Promise<void>;
+};
+type ServiceRuntime<T extends ServiceInstance> = FetchAPI$1 & {
+    readonly name: string;
+    readonly sqlite: SqliteClient$1;
+    readonly clock: Clock;
+    readonly faults: FaultRegistry;
+    readonly metrics: Metrics;
+    readonly rng: Rng;
+    /** The instance behind `namespace` (the default one when omitted), created on first use. */
+    instance(namespace?: string): T;
+    /** Public names of every namespace created so far. */
+    namespaces(): string[];
+    /** Reset one namespace, or every namespace with `"*"`. */
+    reset(namespace?: string): Promise<void>;
+    snapshot(namespace?: string): NamespaceSnapshot;
+    restore(snapshot: NamespaceSnapshot, namespace?: string): void;
+};
+
 /** Options every provider constructor accepts. */
 type APIOptions = {
     /** Sync SQLite client. Defaults to `@crvouga/mockingbird-service-sqlite`. */
     sqlite?: SqliteClient$1;
     /** Clock used for `created`-style fields. Default `Date.now`. */
     now?: () => number;
+    /**
+     * Storage namespace for this instance's records. Instances sharing one SQLite
+     * client stay isolated when their namespaces differ. Defaults to the service name.
+     */
+    namespace?: string;
 };
 
 /** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
@@ -139,6 +340,104 @@ type WebhookDeliveryAttempt = {
     timeout_ms: number;
     acknowledged: boolean;
 };
+type OrderEventRecord = {
+    id: number;
+    created_at: string;
+    status: string;
+    status_detail: null;
+};
+type OrderTransactionEmbed = {
+    id: string;
+    status: "active" | "completed" | "cancelled";
+    orders: Array<{
+        id: string;
+        low_level_status: string;
+        low_level_status_created_at: string;
+        origin: string;
+        parent_id: null;
+        created_at: string;
+        updated_at: string;
+    }>;
+};
+type OrderRecord = {
+    id: string;
+    user_id: string;
+    team_id: string;
+    patient_details: Record<string, unknown>;
+    patient_address: Record<string, unknown>;
+    lab_test: LabTestRecord;
+    details: Record<string, unknown>;
+    sample_id: string | null;
+    notes: null;
+    clinical_notes: string | null;
+    passthrough: string | null;
+    /** Echoed from the request's opaque provider account id; absent when the order had none. */
+    lab_account_id?: string;
+    created_at: string;
+    updated_at: string;
+    events: OrderEventRecord[];
+    status: string;
+    last_event: OrderEventRecord;
+    physician: {
+        first_name: string;
+        last_name: string;
+        npi: string;
+    };
+    health_insurance_id: null;
+    requisition_form_url: string | null;
+    shipping_details: null;
+    has_abn: boolean;
+    billing_type: string;
+    priority: boolean;
+    activate_by: null;
+    icd_codes: string[] | null;
+    interpretation: string | null;
+    has_missing_results: boolean | null;
+    result_types: string[] | null;
+    expected_result_by_date: string | null;
+    worst_case_result_by_date: string | null;
+    origin: string;
+    order_transaction: OrderTransactionEmbed;
+};
+/**
+ * A lab account as the ordering rules read it. Structurally `LabAccountRecord` from
+ * lab-accounts.ts, restated here because that module imports this one.
+ */
+type StoredLabAccount = {
+    id: string;
+    lab: string;
+    org_id: string | null;
+    status: "active" | "pending" | "suspended" | "ready_to_launch";
+    delegated_flow: "order_delegated" | "result_delegated" | "fully_delegated" | "not_delegated";
+    provider_account_id: string;
+    account_name: string | null;
+    default_clinical_notes: string | null;
+    business_units: string[] | null;
+    allowed_billing: Record<string, readonly string[]>;
+    team_id_allowlist: readonly string[];
+};
+/**
+ * A chosen result for one order, installed through the admin API. Replaces the
+ * generated biomarker lines, so a suite can assert on an exact payload — an abnormal
+ * panel, a critical value, a missing marker — instead of whatever the generator made.
+ */
+type ResultFixture = {
+    /** The fixture's name, for logs and `GET /__admin/results`. */
+    name: string;
+    results?: unknown[];
+    missing_results?: unknown[] | null;
+    interpretation?: string;
+    /** Served from `GET /v3/order/{id}/result/pdf` instead of the generated PDF. */
+    pdf_base64?: string;
+};
+/**
+ * How serviceability reads answer a ZIP the loaded corpus has no record for.
+ *
+ * - `synthetic`: invent plausible coverage. Right for property tests that walk random ZIPs.
+ * - `corpus`: refuse with a documented Mockingbird error. Right for a mock standing in for
+ *   the vendor, where invented coverage would silently disagree with production.
+ */
+type GeoMode = "synthetic" | "corpus";
 type WebhookPublisher = (event: JunctionWebhookEvent) => void;
 type JunctionWebhookOptions = {
     seed?: number;
@@ -156,6 +455,50 @@ interface FetchAPI {
     fetch(request: Request): Promise<Response>;
 }
 
+type LabAccountStatus = "active" | "pending" | "suspended" | "ready_to_launch";
+type LabAccountDelegatedFlow = "order_delegated" | "result_delegated" | "fully_delegated" | "not_delegated";
+type LabAccountRecord = {
+    id: string;
+    lab: string;
+    org_id: string | null;
+    status: LabAccountStatus;
+    delegated_flow: LabAccountDelegatedFlow;
+    provider_account_id: string;
+    account_name: string | null;
+    default_clinical_notes: string | null;
+    business_units: string[] | null;
+    allowed_billing: Record<string, readonly string[]>;
+    team_id_allowlist: readonly string[];
+};
+/** The 50 `USState` values from the docs, alphabetical by state name. */
+declare const US_STATES: readonly string[];
+declare const TEAM_LAB_ACCOUNTS: readonly LabAccountRecord[];
+/**
+ * A lab account as a consumer configures it. Mirrors `ClientFacingLabAccount`, with
+ * every field but `id` and `lab` optional, plus a `states` shorthand for the common
+ * case of an account that client-bills in a fixed set of states.
+ */
+type LabAccountInput = {
+    id: string;
+    /** Lab slug, e.g. `"quest"`, `"labcorp"`, `"bioreference"`. */
+    lab: string;
+    status?: LabAccountStatus;
+    delegated_flow?: LabAccountDelegatedFlow;
+    account_name?: string | null;
+    provider_account_id?: string;
+    org_id?: string | null;
+    business_units?: string[] | null;
+    default_clinical_notes?: string | null;
+    /** Billing type → states it is allowed in. Takes precedence over `states`. */
+    allowed_billing?: Record<string, readonly string[]>;
+    /** Shorthand for `allowed_billing: { client_bill: states }`. Default: every state. */
+    states?: readonly string[];
+    /** Teams the account is linked to. Default: the mock team, so it is selectable. */
+    team_id_allowlist?: readonly string[];
+};
+/** Normalize a consumer's configuration into the record the ordering rules read. */
+declare const labAccountFromInput: (input: LabAccountInput) => LabAccountRecord;
+
 /**
  * Version of the sealed-corpus on-disk format. Bumped whenever the shape changes so a
  * stale recording is rejected instead of half-applied.
@@ -171,6 +514,8 @@ type SealedCorpus = {
     version: typeof SEALED_CORPUS_VERSION;
     recordedAt: string;
     source: string;
+    /** SHA-256 of the recording's content, written by `corpus pull`. Identifies it in logs. */
+    fingerprint?: string;
     observations: Record<string, GetCacheEntry>;
     catalog: {
         labTests: LabTestRecord[];
@@ -199,6 +544,150 @@ type SeedReport = {
     cacheEntries: number;
 };
 
+/**
+ * Signed webhook delivery, the way Junction delivers through Svix.
+ *
+ * Signing lives here, next to the events, so a consumer never hand-rolls it. The
+ * signature is standard Svix — `v1,` + base64 HMAC-SHA256, keyed by the base64 part of
+ * `whsec_…`, over `"<svix-id>.<svix-timestamp>.<body>"` — so the official `svix`
+ * verifier, and a receiver written for real Junction webhooks, accept it unchanged.
+ */
+type WebhookEndpoint = {
+    url: string;
+    /** Svix signing secret, `whsec_<base64>`. A bare base64 secret is accepted too. */
+    secret: string;
+    /**
+     * Delay before each attempt, in ms; the first entry delays the first attempt. Default:
+     * Svix's schedule (immediately, 5 s, 5 min, 30 min, 2 h, 5 h, 10 h, 10 h).
+     */
+    retryDelaysMs?: readonly number[];
+    /** Abort an attempt that takes longer than this. Default 15 s, like Svix. */
+    timeoutMs?: number;
+    /** Added to every delivery, e.g. a routing scope for a shared receiver. */
+    headers?: Record<string, string>;
+    fetch?: (request: Request) => Promise<Response>;
+};
+type WebhookAttempt = {
+    attempt: number;
+    /** Wall-clock time of the attempt, ISO-8601. */
+    at: string;
+    /** Receiver's status code, or `null` when the request never completed. */
+    status: number | null;
+    error: string | null;
+    durationMs: number;
+};
+type WebhookDelivery = {
+    messageId: string;
+    namespace: string;
+    event: JunctionWebhookEvent;
+    state: "pending" | "delivered" | "failed";
+    attempts: WebhookAttempt[];
+};
+type WebhookDispatcher = {
+    /** Queue an event for delivery. Returns immediately; delivery runs in the background. */
+    publish(event: JunctionWebhookEvent, namespace: string): WebhookDelivery;
+    deliveries(namespace?: string): WebhookDelivery[];
+    /** Deliver a message again now, as a new attempt, whatever its state. */
+    replay(messageId: string): Promise<WebhookDelivery | undefined>;
+    /** Run every pending retry now instead of waiting out its delay. */
+    flush(): Promise<void>;
+    /** Resolve once no delivery is in flight. */
+    idle(): Promise<void>;
+    /** Cancel pending retries and forget every delivery. */
+    clear(namespace?: string): void;
+};
+/** The `svix-signature` value for one message: `v1,<base64 HMAC-SHA256>`. */
+declare const signSvix: (secret: string, messageId: string, timestampSeconds: number, body: string) => Promise<string>;
+/**
+ * Check a delivery's signature the way the `svix` verifier does: any `v1,` entry in the
+ * space-separated header matches, and the timestamp is within `toleranceSeconds`.
+ */
+declare const verifySvix: (secret: string, headers: {
+    "svix-id": string;
+    "svix-timestamp": string;
+    "svix-signature": string;
+}, body: string, options?: {
+    toleranceSeconds?: number;
+    now?: () => number;
+}) => Promise<boolean>;
+declare const createWebhookDispatcher: (endpoint: WebhookEndpoint) => WebhookDispatcher;
+
+/**
+ * Every order status the contract defines, by collection method (from the vendored
+ * OpenAPI enum). An admin transition may only target a status real Junction can emit.
+ */
+declare const ORDER_STATUSES_BY_METHOD: Readonly<Record<string, readonly string[]>>;
+/**
+ * Friendly transition targets, per method, mapped onto the contract's own statuses.
+ * A name is absent for a method when no real status means it — walk-in tests have no
+ * draw event, so `collected` is refused there rather than approximated.
+ */
+declare const TRANSITION_ALIASES: Readonly<Record<string, Readonly<Record<string, string>>>>;
+/**
+ * Named results, as the flags `simulate_order` accepts. They steer the generator, so
+ * the payload keeps Junction's exact shape; `PUT /__admin/results/{order}` installs an
+ * exact payload instead.
+ */
+declare const RESULT_FIXTURES: Readonly<Record<string, Record<string, unknown>>>;
+/**
+ * Junction failure modes a suite can switch on by name. `sandbox_user_quota` reproduces
+ * the shared-sandbox error byte for byte (message as observed from a real sandbox team);
+ * the others are shape-plausible, not verified against Junction.
+ */
+declare const FAULT_PRESETS: Readonly<Record<string, Omit<FaultRule, "id">>>;
+/** Resolve a target (`completed`, `completed.completed`, or a full status) for a method. */
+declare const resolveTransition: (method: string, target: string) => {
+    status: string;
+} | {
+    error: string;
+};
+type JunctionAdminOptions = {
+    webhooks: WebhookDispatcher | undefined;
+};
+
+declare const DEFAULT_JUNCTION_BASE_URL = "https://api.sandbox.tryvital.io";
+/** Key prefixes of sandbox team keys. `corpus pull` and `verify` refuse any other key. */
+declare const SANDBOX_KEY_PREFIXES: readonly ["sk_us_", "sk_eu_"];
+declare const isSandboxKey: (key: string) => boolean;
+type PullCorpusOptions = {
+    apiKey: string;
+    baseUrl?: string;
+    /** ZIPs to record area and PSC coverage for. Default: the shipped coverage set. */
+    zips?: readonly string[];
+    /**
+     * Refresh only `zips` on top of this corpus, keeping everything else. How a single
+     * ZIP is added to a committed corpus without re-recording the whole thing.
+     */
+    base?: SealedCorpus;
+    /** Skip the team's catalog and lab accounts (coverage only). */
+    coverageOnly?: boolean;
+    fetch?: (request: Request) => Promise<Response>;
+    /** Pause between vendor calls, to stay under rate limits. Default 50 ms. */
+    minIntervalMs?: number;
+    onProgress?: (message: string) => void;
+};
+/** SHA-256 over a corpus's content — not its recording time — so a re-pull of unchanged data matches. */
+declare const fingerprintCorpus: (corpus: SealedCorpus) => Promise<string>;
+/** Record a sealed corpus from a real Junction team. Read-only: it only issues GETs. */
+declare const pullCorpus: (options: PullCorpusOptions) => Promise<SealedCorpus>;
+type SetDiff = {
+    added: string[];
+    removed: string[];
+    changed: string[];
+};
+type CorpusDiff = {
+    identical: boolean;
+    observations: SetDiff;
+    labTests: SetDiff;
+    labAccounts: SetDiff;
+    zips: {
+        added: string[];
+        removed: string[];
+    };
+};
+/** What changed between two recordings: coverage, catalog, accounts and raw observations. */
+declare const diffCorpus: (before: SealedCorpus, after: SealedCorpus) => CorpusDiff;
+
 /** High-signal ZIPs for availability prefetch (full routing corpus still used for area/psc). */
 declare const PSC_AVAILABILITY_ZIPS: readonly ["85004", "85234", "11050", "10006", "90012", "96101", "92101", "60601", "33130", "98104", "75034", "07030"];
 /**
@@ -483,6 +972,105 @@ declare const reshapeCoverageGeoCommand: (command: LogicalCommand, _state: Explo
     labIds?: readonly number[];
 }) => LogicalCommand;
 
+type JunctionRuntimeOptions = {
+    /**
+     * Recorded vendor data every namespace starts from. The served mock loads the corpus
+     * shipped at `@crvouga/mockingbird-service-junction/corpus` unless told otherwise.
+     */
+    corpus?: SealedCorpus;
+    /** Default: `corpus` when a corpus is loaded, otherwise `synthetic`. */
+    geo?: GeoMode;
+    /** The team's lab accounts; see {@link JunctionAPIOptions.labAccounts}. */
+    labAccounts?: readonly LabAccountInput[];
+    /** Deliver signed webhooks here, with Svix's retry schedule. */
+    webhooks?: WebhookEndpoint;
+    /** Called in-process for every webhook event, delivered or not. */
+    onWebhook?: (event: Parameters<WebhookPublisher>[0], namespace: string) => void;
+    sqlite?: SqliteClient;
+    clock?: Clock;
+    /** Seeds fault rates and webhook retry jitter. */
+    seed?: number | string;
+    /** Require `x-mockingbird-admin-key` on `/__admin/*`. */
+    adminKey?: string;
+    onLog?: (entry: RequestLog) => void;
+};
+type JunctionRuntime = ServiceRuntime<JunctionAPI> & {
+    /** Signed delivery, when `webhooks` was configured. */
+    readonly webhooks: WebhookDispatcher | undefined;
+};
+/**
+ * The Junction mock with Mockingbird's full service contract: unauthenticated
+ * `/health`, the `/__admin/*` control plane, per-request namespaces
+ * (`x-mockingbird-namespace`), clock control, fault injection and request metrics.
+ * Runtime-neutral: serve it with any Fetch-native server, or use `./server` for Node.
+ */
+declare const createRuntime: (options?: JunctionRuntimeOptions) => JunctionRuntime;
+
+/**
+ * Appointment scheduling surface: phlebotomy + PSC availability/booking lifecycle,
+ * cancellation reasons, area serviceability, and PSC site info.
+ *
+ * Slot data is generated deterministically (seeded by zip/site/date), so walks are
+ * reproducible without any provider-side state.
+ */
+
+/** Status of the unknown-ZIP error: unused by Junction, and not retried by HTTP clients. */
+declare const UNKNOWN_ZIP_STATUS = 424;
+declare const UNKNOWN_ZIP_ERROR_TYPE = "MOCKINGBIRD_UNKNOWN_ZIP";
+
+/**
+ * Differential verification: the same requests against real Junction and the mock,
+ * with every divergence reported. Two checks:
+ *
+ * - drift: each recorded corpus observation re-fetched from the real API. A stale
+ *   entry means the corpus no longer matches production and should be re-pulled.
+ * - scenario: a fixed script of stateful calls (users, catalog, serviceability, and
+ *   optionally orders) run against both sides, comparing status codes, response
+ *   shapes, and — for the documented error bodies — exact bytes.
+ *
+ * Only a sandbox team should be used: the scenario creates, and always deletes, one
+ * user (and, with `orders`, places and cancels one order).
+ */
+type VerifyOptions = {
+    realKey: string;
+    realUrl?: string;
+    /** The mock under test, e.g. `createRuntime({ corpus })`. */
+    mock: {
+        fetch(request: Request): Promise<Response>;
+    };
+    corpus: SealedCorpus;
+    /** Re-fetch at most this many observations (spread evenly). Default: all of them. */
+    sample?: number;
+    /** Skip the drift check. */
+    skipDrift?: boolean;
+    /** Also place, read and cancel an order on the real team. */
+    orders?: boolean;
+    fetch?: (request: Request) => Promise<Response>;
+    minIntervalMs?: number;
+    onProgress?: (message: string) => void;
+};
+type Divergence = {
+    check: string;
+    kind: "status" | "shape" | "body" | "error";
+    /** JSON path of the first difference, when there is one. */
+    at?: string;
+    real: unknown;
+    mock: unknown;
+};
+type VerifyReport = {
+    ok: boolean;
+    drift: {
+        checked: number;
+        stale: number;
+    };
+    scenario: {
+        steps: number;
+        divergent: number;
+    };
+    divergences: Divergence[];
+};
+declare const verifyAgainstReal: (options: VerifyOptions) => Promise<VerifyReport>;
+
 declare const JUNCTION_NAMESPACE = "junction";
 /**
  * Stateful mock of the Junction (Vital) API user and lab-testing surfaces.
@@ -493,13 +1081,38 @@ declare const JUNCTION_NAMESPACE = "junction";
 type JunctionAPIOptions = APIOptions & {
     onWebhook?: WebhookPublisher;
     webhook?: JunctionWebhookOptions;
+    /** Install a recorded corpus at construction; it is re-applied on every `reset()`. */
+    corpus?: SealedCorpus;
+    /**
+     * How serviceability reads answer a ZIP the corpus does not cover. Default: `corpus`
+     * when a corpus is given (refuse, loudly), otherwise `synthetic` (invent coverage).
+     */
+    geo?: GeoMode;
+    /**
+     * The team's lab accounts, replacing the built-in fixtures (and any from the corpus).
+     * `create_order` routes, accepts and rejects `lab_account_id` against these.
+     */
+    labAccounts?: readonly LabAccountInput[];
+};
+/** What a loaded corpus covers, for `/health` and startup logs. */
+type CorpusInfo = {
+    label: string;
+    recordedAt: string;
+    source: string;
+    observations: number;
+    labTests: number;
+    labAccounts: number;
+    zips: number;
 };
+/** A short, stable name for a corpus: its recording date plus a digest of what it holds. */
+declare const corpusLabel: (corpus: SealedCorpus) => string;
 declare class JunctionAPI implements FetchAPI {
     readonly app: Hono;
     readonly sqlite: SqliteClient;
     private readonly service;
     private readonly state;
     private corpus;
+    private labAccountConfig;
     constructor(options?: JunctionAPIOptions);
     fetch(request: Request): Promise<Response>;
     reset(): Promise<void>;
@@ -508,6 +1121,32 @@ declare class JunctionAPI implements FetchAPI {
      * labs, and lab accounts with the recording's exact values. Re-applied on `reset()`.
      */
     installCorpus(corpus: SealedCorpus): void;
+    /**
+     * Which lab accounts the ordering rules see, in order of precedence: the configured
+     * ones, then a corpus's real accounts, then the built-in fixtures (which a corpus
+     * recorded from a team with no accounts leaves in place).
+     */
+    private seedLabAccounts;
+    /** Replace the team's lab accounts; `undefined` restores the default. Kept across resets. */
+    configureLabAccounts(accounts: readonly LabAccountInput[] | undefined): StoredLabAccount[];
+    labAccounts(): StoredLabAccount[];
+    corpusInfo(): CorpusInfo | undefined;
+    get geoMode(): GeoMode;
+    set geoMode(mode: GeoMode);
+    order(id: string): OrderRecord | undefined;
+    orders(): OrderRecord[];
+    /**
+     * Put an order straight into a status (a full `<status>.<method>.<event>` value) and
+     * publish the webhook a real transition would. `flags` takes the same keys as
+     * `simulate_order`'s body: `interpretation`, `result_types`, `has_missing_results`.
+     */
+    transitionOrder(id: string, status: string, options: {
+        now: () => number;
+        flags?: Record<string, unknown> | null;
+    }): OrderRecord | undefined;
+    /** Serve `fixture` as this order's results, replacing the generated ones. */
+    installResultFixture(orderId: string, fixture: ResultFixture): boolean;
+    resultFixture(orderId: string): ResultFixture | undefined;
     seedFrom(source: SeedSource, observations?: SeedObservations): Promise<SeedReport>;
     ensureLabTests(source: SeedSource, ids: readonly string[]): Promise<number>;
     ensureOrders(source: SeedSource, ids: readonly string[]): Promise<number>;
@@ -516,5 +1155,5 @@ declare class JunctionAPI implements FetchAPI {
     webhookDeliveryAttempts(): WebhookDeliveryAttempt[];
 }
 
-export { AVAILABILITY_ADDRESS, AVAILABILITY_START_DATE, COVERAGE_ZIPS, JUNCTION_NAMESPACE, JunctionAPI, PHLEBOTOMY_AVAILABILITY_ZIPS, PSC_AVAILABILITY_ZIPS, PSC_LAB_IDS, SEALED_CORPUS_VERSION, document, observationCacheKey, operationIds, parseSealedCorpus, prefetchCoverageObservations, reshapeCoverageGeoCommand, supportedOperationIds };
-export type { FetchAPI, GetCacheEntry, JunctionAPIOptions, JunctionWebhookEvent, JunctionWebhookOptions, OperationId, SealedCorpus, SeedObservations, SeedReport, SeedSource, SqliteClient, SupportedOperationId, WebhookPublisher };
+export { AVAILABILITY_ADDRESS, AVAILABILITY_START_DATE, COVERAGE_ZIPS, DEFAULT_JUNCTION_BASE_URL, FAULT_PRESETS, JUNCTION_NAMESPACE, JunctionAPI, ORDER_STATUSES_BY_METHOD, PHLEBOTOMY_AVAILABILITY_ZIPS, PSC_AVAILABILITY_ZIPS, PSC_LAB_IDS, RESULT_FIXTURES, SANDBOX_KEY_PREFIXES, SEALED_CORPUS_VERSION, TEAM_LAB_ACCOUNTS, TRANSITION_ALIASES, UNKNOWN_ZIP_ERROR_TYPE, UNKNOWN_ZIP_STATUS, US_STATES, corpusLabel, createRuntime, createWebhookDispatcher, diffCorpus, document, fingerprintCorpus, isSandboxKey, labAccountFromInput, observationCacheKey, operationIds, parseSealedCorpus, prefetchCoverageObservations, pullCorpus, reshapeCoverageGeoCommand, resolveTransition, signSvix, supportedOperationIds, verifyAgainstReal, verifySvix };
+export type { CorpusDiff, CorpusInfo, Divergence, FetchAPI, GeoMode, GetCacheEntry, JunctionAPIOptions, JunctionAdminOptions, JunctionRuntime, JunctionRuntimeOptions, JunctionWebhookEvent, JunctionWebhookOptions, LabAccountDelegatedFlow, LabAccountInput, LabAccountRecord, LabAccountStatus, OperationId, OrderRecord, PullCorpusOptions, ResultFixture, SealedCorpus, SeedObservations, SeedReport, SeedSource, SetDiff, SqliteClient, StoredLabAccount, SupportedOperationId, VerifyOptions, VerifyReport, WebhookAttempt, WebhookDelivery, WebhookDispatcher, WebhookEndpoint, WebhookPublisher };