@crvouga/mockingbird-service-rxvortex 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -1,15 +1,24 @@
 # Changelog — @crvouga/mockingbird-service-rxvortex
 
+## 1.1.1 (2026-09-26)
+
+### Fixes and improvements
+
+- take the rejected-request byte count from content-length, never by reading the body ([a0e5fb2](https://github.com/crvouga/mockingbird/commit/a0e5fb2fc80ab725c3552b612f3f091fd6c857fb))
+- reject a present body by media type, and log what a rejected request sent ([12e351a](https://github.com/crvouga/mockingbird/commit/12e351aba53cfb7b41e31a7809419455fc2902eb))
+
+## 1.1.0 (2026-09-25)
+
+### Features
+
+- load a preset catalog into a served mock and promote to ready ([471288e](https://github.com/crvouga/mockingbird/commit/471288e46b1f34a62f0c1b7e7a76dc30920c39e7))
+
 ## 1.0.0 (2026-09-24)
 
 ### ⚠️ Breaking changes
 
 - vendor branding for every service; purge internal mocks and consumer names ([f689534](https://github.com/crvouga/mockingbird/commit/f6895343543550dafcb7d76b426cae7635e03226))
 
-### Dependencies
-
-- `@crvouga/mockingbird-service-sqlite`
-
 ## 0.2.0 (2026-09-23)
 
 ### Features

package/README.md

@@ -29,9 +29,15 @@ value as `--webhook-secret`.
 npx mockingbird-rxvortex serve --port 8791 \
   --webhook-url http://127.0.0.1:3000/prescriptions/webhooks/rxvortex \
   --webhook-secret "$RXVORTEX_WEBHOOK_SECRET" \
-  --auto-advance "2000:Fill,Shipping,Delivered"
+  --auto-advance "2000:Fill,Shipping,Delivered" \
+  --catalog ./preset-catalog.json
 ```
 
+`--catalog` loads your own preset catalog into every namespace: a JSON array of rows, or the
+`{data: [...]}` body `GET /api/v1/preset-catalog-items` answers with, so a recorded sandbox
+response loads as-is. Only `catalog_id` and `medication_name` are required. `POST /__admin/reset`
+returns to these rows. Pass `--unknown-presets accept` to take any well-formed preset id instead.
+
 ```ts
 import { createRuntime } from "@crvouga/mockingbird-service-rxvortex"
 
@@ -62,7 +68,7 @@ await post("/__admin/orders/pay_123/transition", { to: "Delivered" })
 | Route | Behaviour |
 | --- | --- |
 | `POST /api/v1/generate-access-token` | JSON `{client_id, client_secret}` → `{access_token, token_type: "Bearer", expires_in: 86400}`. Any pair works unless `clients` is set (`PUT /__admin/settings`). Tokens stay valid 24 h on the mock clock; our client caches for 24 h and never refreshes on 401. |
-| `POST /api/v1/orders` | Validates the submit payload against the contract; a violation is 422 `{message, errors: {"patient.phone": ["…"]}}`. An inactive or unknown `preset_catalog_id` is 422. A repeated `order.sender_order_id` is 409. Success: `{success: true, order_tracking_id: "RXV-…", sender_order_id, status: "Created"}` (the tracking id is always a string). |
+| `POST /api/v1/orders` | Validates the submit payload against the contract; a violation is 422 `{message, errors: {"patient.phone": ["…"]}}`. An inactive or unknown `preset_catalog_id` is 422 (under `unknownPresets: "accept"` an unknown UUID becomes an active catalog row named after the request's `medication_name`). A repeated `order.sender_order_id` is 409. Success: `{success: true, order_tracking_id: "RXV-…", sender_order_id, status: "Created"}` (the tracking id is always a string). |
 | `GET /api/v1/orders/{id}` | `id` is the tracking id **or** the sender order id (our payment id, the recovery lookup). Returns `rxstatus`, `orderstatus`, `shipping_status`, `delivered_date`, `trackingnumber`, `shippingservice`, `shippingcarrier`, `shipmenttrackingurl`, `cancellable`, and the id under `order_tracking_id`, `tracking_id` and `orderReferenceID`. |
 | `DELETE /api/v1/orders/{id}` | Cancels while `cancellable` (until shipped), emitting the webhook; otherwise 409. |
 | `GET /api/v1/preset-catalog-items` | `{data: [...]}` rows with `catalog_id`, `medication_name`, `medication_strength`, `package_size`, `quantity`, `quantity_units`, `medication_form`, `route`, `states`, `status`. Includes the custom-cream anchor preset `e404ad76-0f82-4b04-8f25-841650e2e819` and one inactive row. |
@@ -82,7 +88,9 @@ now, and `PUT /__admin/webhook-endpoints` sets per-namespace receivers.
 | Route | Effect |
 | --- | --- |
 | `POST /__admin/orders/:id/transition` | `{to, trackingnumber?, shippingcarrier?, shippingservice?, delivered_date?}`. `to` is a vendor status: `Fill`, `PV1 Complete`, `Compound`, `Out of Stock`, `On Hold`, `Shipping`, `Delivered`, `Cancelled`, `Rejected`, `Error`, or any string (used verbatim). The three status fields move together; shipping generates tracking when none is given. |
-| `PUT /__admin/settings` | `{tokenTtlSeconds?, staticTokens?, clients?, autoAdvance?: {afterMs, path} \| null}` for the calling namespace. `staticTokens` admits `RXVORTEX_API_TOKEN` (the catalog client's static bearer). |
+| `PUT /__admin/catalog` | `{items: [{catalog_id, medication_name, medication_strength?, package_size?, quantity?, quantity_units?, medication_form?, route?, states?, status?}], mode?: "replace" \| "merge"}` for the calling namespace (`replace` is the default; `merge` upserts by `catalog_id`). Answers `{count}`, the namespace's row count. `items` may also be sent as `data`. |
+| `GET /__admin/catalog` | The namespace's rows, as `{data: [...]}`. |
+| `PUT /__admin/settings` | `{tokenTtlSeconds?, staticTokens?, clients?, autoAdvance?: {afterMs, path} \| null, unknownPresets?: "reject" \| "accept"}` for the calling namespace. `unknownPresets` defaults to `reject`, as the sandbox does. `staticTokens` admits `RXVORTEX_API_TOKEN` (the catalog client's static bearer). |
 | `POST /__admin/tick` | Apply every auto-advance step that is due on the mock clock (the served mock also ticks every 100 ms). |
 | `GET /__admin/orders` | The namespace's orders. |
 
@@ -104,7 +112,8 @@ the client id they were issued to).
 - Real fulfilment timing: nothing moves on its own unless `autoAdvance` is set.
 - Patient and prescriber details are validated, never stored or echoed back.
 - The live catalog: the default rows are synthesised in the live client's field names (no
-  sandbox recording exists); pass `catalog` to load recorded rows.
+  sandbox recording exists). Load recorded rows with `serve --catalog`, `PUT /__admin/catalog`,
+  or the `catalog` option.
 - Refills and multi-order shipments.
 
 ## API
@@ -118,7 +127,8 @@ the client id they were issued to).
 | `tokenCredential` | function | The client id a bearer token was issued to (how credentials map to namespaces). |
 | `CUSTOM_CREAM_ANCHOR_PRESET_ID` | string | The sandbox custom-cream anchor preset id. |
 | `DEFAULT_CATALOG` | array | The default preset catalog rows. |
+| `parseCatalog`, `parseCatalogItem` | functions | Catalog rows from a JSON array or a recorded `{data: [...]}` body (missing optional fields default to `null`, `states` to `[]`, `status` to `"active"`); throw on a malformed row. |
 | `document`, `operationIds`, `supportedOperationIds` | values | The vendored OpenAPI contract and its operation ids. |
-| `createServer`, `serveTarget`, `DEFAULT_PORT` (`./server`) | Node | Serve over `node:http` (auto-advance ticks every 100 ms); the `serve` CLI target; port 8791. |
+| `createServer`, `serveTarget`, `DEFAULT_PORT`, `loadCatalogFile` (`./server`) | Node | Serve over `node:http` (auto-advance ticks every 100 ms); the `serve` CLI target; port 8791; read a `--catalog` file. |
 
 Part of [mockingbird](https://github.com/crvouga/mockingbird).

package/dist/{chunk-DNELVPK4.js → chunk-5KK6W2PE.js}

@@ -1366,6 +1366,100 @@ var operationMetadata = (operation) => {
 
 // ../core/dist/service.js
 import { Hono } from "hono";
+
+// ../core/dist/validation.js
+var requestBodyOf = (context) => {
+  const requestBody = context.operation.operation.requestBody;
+  return requestBody ? deref(context.document, requestBody) : void 0;
+};
+var mediaTypeMatches = (accepted, actual) => {
+  const pattern = mediaTypeOf(accepted) ?? accepted.toLowerCase();
+  if (pattern === actual || pattern === "*/*")
+    return true;
+  const [type, subtype] = pattern.split("/");
+  const [actualType, actualSubtype] = actual.split("/");
+  if (type !== actualType && type !== "*")
+    return false;
+  if (subtype === void 0 || subtype === "*")
+    return true;
+  if (subtype.startsWith("*+"))
+    return actualSubtype?.endsWith(subtype.slice(1)) === true;
+  return false;
+};
+var acceptedKeyFor = (content, mediaType) => {
+  if (!content || mediaType === void 0)
+    return void 0;
+  const keys = Object.keys(content);
+  return keys.find((key) => mediaTypeOf(key) === mediaType) ?? keys.find((key) => mediaTypeMatches(key, mediaType));
+};
+var unsupportedMediaType = (context, options = {}) => {
+  if (context.body.kind === "empty" && options.includeEmpty !== true)
+    return void 0;
+  const content = requestBodyOf(context)?.content;
+  if (!content || Object.keys(content).length === 0)
+    return void 0;
+  const mediaType = mediaTypeOf(context.request.headers.get("content-type"));
+  if (acceptedKeyFor(content, mediaType) !== void 0)
+    return void 0;
+  return { mediaType: mediaType ?? null, accepted: Object.keys(content) };
+};
+var recorded = /* @__PURE__ */ new WeakMap();
+var recordedIssues = (request) => recorded.get(request);
+var bodyIssues = (context, contentType = "application/json") => {
+  const issues = findBodyIssues(context, contentType);
+  if (issues.length > 0)
+    recorded.set(context.request, issues);
+  return issues;
+};
+var findBodyIssues = (context, contentType) => {
+  const resolved = requestBodyOf(context);
+  if (!resolved)
+    return [];
+  const unsupported = unsupportedMediaType(context);
+  if (unsupported) {
+    return [
+      {
+        path: "",
+        kind: "media_type",
+        message: unsupported.mediaType === null ? "request body has no content-type" : `request body media type ${unsupported.mediaType} is not supported`
+      }
+    ];
+  }
+  const key = acceptedKeyFor(resolved.content, mediaTypeOf(context.request.headers.get("content-type"))) ?? contentType;
+  const schema = resolved.content?.[key]?.schema;
+  if (!schema)
+    return [];
+  if (context.body.kind === "invalid") {
+    return [
+      {
+        path: "",
+        kind: "syntax",
+        message: `request body is not valid ${context.body.mediaType}`
+      }
+    ];
+  }
+  const value = context.body.kind === "json" || context.body.kind === "form" || context.body.kind === "text" ? context.body.value : void 0;
+  if (value === void 0) {
+    return resolved.required && context.body.kind === "empty" ? [{ path: "", kind: "required", message: "request body is required" }] : [];
+  }
+  return validateValue(context.document, resolveSchema(context.document, schema), value).map((issue) => ({ path: issue.path.join("."), kind: "schema", message: issue.message }));
+};
+var issuesByField = (issues) => {
+  const out = {};
+  for (const issue of issues) {
+    const missing = /^missing required property (.+)$/.exec(issue.message);
+    const field = missing ? [issue.path, missing[1]].filter(Boolean).join(".") : issue.path || "body";
+    const message = missing ? `The ${field} field is required.` : `The ${field} field ${issue.message}.`;
+    out[field] = [...out[field] ?? [], message];
+  }
+  return out;
+};
+
+// ../core/dist/service.js
+var withIssues = (request, response) => {
+  const issues = response.status >= 400 ? recordedIssues(request) : void 0;
+  return issues && issues.length > 0 ? annotateResponse(response, { issues }) : response;
+};
 var defineOperations = (handlers) => handlers;
 var OperationRegistryError = class extends Error {
   problems;
@@ -1451,9 +1545,7 @@ var createService = (options) => {
         now
       };
       const short = await options.before?.(context);
-      if (short)
-        return short;
-      return handler(context);
+      return withIssues(request, short ?? await handler(context));
     };
     app.on(operation.method.toUpperCase(), honoPath(operation.path), route);
   }
@@ -1490,7 +1582,7 @@ var restoreNamespace = (sqlite, namespace, snapshot) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "1.0.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "1.1.1" : UNRELEASED_VERSION;
 
 // ../core/dist/signing.js
 var encoder = new TextEncoder();
@@ -2250,8 +2342,15 @@ var createRuntime = (options) => {
       const started = monotonicNow();
       const url = new URL(request.url);
       const operationId = operationIdFor(request, url.pathname);
+      const contentLength = request.headers.get("content-length");
+      const received = {
+        contentType: request.headers.get("content-type"),
+        bodyBytes: contentLength !== null && /^\d+$/.test(contentLength) ? Number(contentLength) : null,
+        transferEncoding: request.headers.get("transfer-encoding")
+      };
       const log = (status, faultId, response2) => {
         const noted = response2 ? responseNotes(response2) : void 0;
+        const rejected = status >= 400 && faultId === void 0;
         const entry = {
           service: options.name,
           namespace,
@@ -2263,7 +2362,9 @@ var createRuntime = (options) => {
           unmatched: options.document !== void 0 && operationId === void 0,
           ...faultId !== void 0 ? { faultId } : {},
           ...noted?.ids && Object.keys(noted.ids).length > 0 ? { ids: noted.ids } : {},
-          ...noted?.adopted ? { adopted: true } : {}
+          ...noted?.adopted ? { adopted: true } : {},
+          ...rejected ? { request: { ...received } } : {},
+          ...rejected && noted?.issues && noted.issues.length > 0 ? { issues: noted.issues.map((issue) => ({ ...issue })) } : {}
         };
         metrics.record(entry);
         journal.record({ ...entry, at: new Date(clock.now()).toISOString() });
@@ -2470,35 +2571,6 @@ var presetRoutes = (presets, runtime) => ({
   }
 });
 
-// ../core/dist/validation.js
-var bodyIssues = (context, contentType = "application/json") => {
-  const requestBody = context.operation.operation.requestBody;
-  if (!requestBody)
-    return [];
-  const resolved = deref(context.document, requestBody);
-  const schema = resolved.content?.[contentType]?.schema;
-  if (!schema)
-    return [];
-  const value = context.body.kind === "json" || context.body.kind === "form" ? context.body.value : void 0;
-  if (context.body.kind === "invalid") {
-    return [{ path: "", message: `request body is not valid ${context.body.mediaType}` }];
-  }
-  if (value === void 0) {
-    return resolved.required ? [{ path: "", message: "request body is required" }] : [];
-  }
-  return validateValue(context.document, resolveSchema(context.document, schema), value).map((issue) => ({ path: issue.path.join("."), message: issue.message }));
-};
-var issuesByField = (issues) => {
-  const out = {};
-  for (const issue of issues) {
-    const missing = /^missing required property (.+)$/.exec(issue.message);
-    const field = missing ? [issue.path, missing[1]].filter(Boolean).join(".") : issue.path || "body";
-    const message = missing ? `The ${field} field is required.` : `The ${field} field ${issue.message}.`;
-    out[field] = [...out[field] ?? [], message];
-  }
-  return out;
-};
-
 // src/generated/openapi.ts
 var document = JSON.parse(`{"openapi":"3.1.0","info":{"title":"RxVortex (Strive) pharmacy API (Mockingbird subset)","description":"Stateful mock subset of the RxVortex / Strive compounding-pharmacy API: client-credentials\\ntoken, order submit, status, cancel, lookup by sender order id (recovery), and the preset\\ncatalog. Hand-authored from the consumer's adapters (the vendor publishes no spec).\\n","version":"1","x-mockingbird-upstream":{"note":"Hand-authored from the wire shapes our consumer reads and writes (rxvortex-auth.service.ts, rxvortex-fulfillment.adapter.ts, rxvortex-live.client.ts)."}},"servers":[{"url":"https://sandbox.rxvortex.com"}],"security":[{"bearerAuth":[]}],"paths":{"/api/v1/generate-access-token":{"post":{"operationId":"GenerateAccessToken","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["client_id","client_secret"],"properties":{"client_id":{"type":"string","minLength":1,"maxLength":64},"client_secret":{"type":"string","minLength":1,"maxLength":64}}}}}},"responses":{"200":{"description":"Access token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TokenResponse"}}}},"401":{"description":"Bad credentials","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"422":{"description":"Validation failed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}}},"/api/v1/orders":{"post":{"operationId":"CreateOrder","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOrderBody"}}}},"responses":{"200":{"description":"Order accepted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOrderResponse"}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"409":{"description":"Duplicate sender_order_id","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"422":{"description":"Validation failed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidationError"}}}}}}},"/api/v1/orders/{orderId}":{"parameters":[{"name":"orderId","in":"path","required":true,"description":"The vendor order tracking id, or the sender order id (our payment id).","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"order","missing":"RXV-00000000-MISSING"}}}],"get":{"operationId":"GetOrder","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Order status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrderStatus"}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"404":{"description":"Unknown order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}}}},"delete":{"operationId":"CancelOrder","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"responses":{"200":{"description":"Cancelled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelResponse"}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"404":{"description":"Unknown order","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}},"409":{"description":"Not cancellable in its current status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}}}}},"/api/v1/preset-catalog-items":{"get":{"operationId":"ListPresetCatalogItems","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Preset catalog","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/CatalogItem"}}}}}}},"401":{"description":"Unauthenticated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorBody"}}}}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"TokenResponse":{"type":"object","required":["access_token","token_type","expires_in"],"properties":{"access_token":{"type":"string","x-mockingbird-volatile":{"kind":"token"}},"token_type":{"type":"string","enum":["Bearer"]},"expires_in":{"type":"integer"}}},"Address":{"type":"object","required":["line1","city","state","postal_code","country"],"properties":{"line1":{"type":"string","minLength":1,"maxLength":80},"line2":{"type":"string","maxLength":80},"city":{"type":"string","minLength":1,"maxLength":40},"state":{"type":"string","pattern":"^[A-Z]{2}$"},"postal_code":{"type":"string","pattern":"^[0-9]{5}(-[0-9]{4})?$"},"country":{"type":"string","enum":["US"]}}},"Patient":{"type":"object","required":["sender_patient_id","first_name","last_name","dob","gender","email","phone","address"],"properties":{"sender_patient_id":{"type":"string","minLength":1,"maxLength":64},"first_name":{"type":"string","minLength":1,"maxLength":40},"last_name":{"type":"string","minLength":1,"maxLength":40},"dob":{"type":"string","pattern":"^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])$"},"gender":{"type":"string","enum":["male","female"]},"email":{"type":"string","format":"email","maxLength":120},"phone":{"type":"string","pattern":"^[0-9]{3}-[0-9]{3}-[0-9]{4}$"},"address":{"$ref":"#/components/schemas/Address"}}},"Prescriber":{"type":"object","required":["first_name","last_name","npi"],"properties":{"first_name":{"type":"string","minLength":1,"maxLength":40},"last_name":{"type":"string","minLength":1,"maxLength":40},"npi":{"type":"string","pattern":"^[0-9]{10}$"},"dea_number":{"type":"string","maxLength":20},"license_number":{"type":"string","maxLength":20},"license_state":{"type":"string","maxLength":2},"phone":{"type":"string","maxLength":20},"address":{"$ref":"#/components/schemas/Address"}}},"MedicationRequest":{"type":"object","required":["type","preset_catalog_id","sender_med_request_id","medication_name","quantity","quantity_units","days_supply_duration","refills","instructions"],"properties":{"type":{"type":"string","enum":["new"]},"preset_catalog_id":{"type":"string","x-mockingbird-resource-ref":{"type":"catalog_item","missing":"00000000-0000-4000-8000-000000000000"}},"sender_med_request_id":{"type":"string","minLength":1,"maxLength":64},"medication_name":{"type":"string","minLength":1,"maxLength":120},"medication_strength":{"type":"string","maxLength":60},"medication_form":{"type":"string","maxLength":40},"quantity":{"type":"number","exclusiveMinimum":0,"maximum":1000},"quantity_units":{"type":"string","enum":["mL","grams","each"]},"days_supply_duration":{"type":"integer","minimum":1,"maximum":365},"refills":{"type":"integer","minimum":0,"maximum":12},"instructions":{"type":"string","minLength":1,"maxLength":500},"note":{"type":"string","maxLength":1000},"authored_on_datetime":{"type":"string","maxLength":40},"clinical_difference":{"type":"string","maxLength":1000},"schedule_code":{"type":"string","enum":["2","3","4","5"]}}},"ClinicalList":{"type":"object","properties":{"has_known_allergies":{"type":"boolean"},"has_known_diseases":{"type":"boolean"},"has_known_medications":{"type":"boolean"},"entries":{"type":"array","maxItems":5,"items":{"type":"object","required":["description"],"properties":{"description":{"type":"string","maxLength":200}}}}}},"CreateOrderBody":{"type":"object","required":["patient","prescriber","order","medication_requests"],"properties":{"patient":{"$ref":"#/components/schemas/Patient"},"prescriber":{"$ref":"#/components/schemas/Prescriber"},"order":{"type":"object","required":["bill_to","ship_to","sender_order_id"],"properties":{"bill_to":{"type":"string","enum":["practice","patient"]},"ship_to":{"type":"string","enum":["patient","practice"]},"sender_order_id":{"type":"string","minLength":1,"maxLength":64}}},"medication_requests":{"type":"array","minItems":1,"maxItems":3,"items":{"$ref":"#/components/schemas/MedicationRequest"}},"clinical":{"type":"object","properties":{"allergies":{"$ref":"#/components/schemas/ClinicalList"},"diseases":{"$ref":"#/components/schemas/ClinicalList"},"medications":{"$ref":"#/components/schemas/ClinicalList"}}},"shipment":{"type":"object","properties":{"recipient_first_name":{"type":"string","maxLength":40},"recipient_last_name":{"type":"string","maxLength":40},"recipient_email":{"type":"string","maxLength":80},"recipient_phone":{"type":"string","maxLength":20},"address":{"$ref":"#/components/schemas/Address"}}}}},"CreateOrderResponse":{"type":"object","required":["success","message","order_tracking_id","sender_order_id","status"],"properties":{"success":{"type":"boolean"},"message":{"type":"string"},"order_tracking_id":{"type":"string","x-mockingbird-resource":{"type":"order","identity":true},"x-mockingbird-volatile":{"kind":"id"}},"sender_order_id":{"type":"string"},"status":{"type":"string"}}},"OrderStatus":{"type":"object","required":["order_tracking_id","tracking_id","orderReferenceID","sender_order_id","rxstatus","orderstatus","shipping_status","cancellable","created_at","updated_at"],"properties":{"order_tracking_id":{"type":"string","x-mockingbird-volatile":{"kind":"id"}},"tracking_id":{"type":"string","x-mockingbird-volatile":{"kind":"id"}},"orderReferenceID":{"type":"string","x-mockingbird-volatile":{"kind":"id"}},"sender_order_id":{"type":"string"},"rxstatus":{"type":"string"},"orderstatus":{"type":"string"},"shipping_status":{"type":"string"},"delivered_date":{"type":["string","null"]},"trackingnumber":{"type":["string","null"]},"shippingservice":{"type":["string","null"]},"shippingcarrier":{"type":["string","null"]},"shipmenttrackingurl":{"type":["string","null"]},"cancellable":{"type":"boolean"},"created_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}},"updated_at":{"type":"string","x-mockingbird-volatile":{"kind":"timestamp"}}}},"CancelResponse":{"type":"object","required":["success","message","order_tracking_id","rxstatus"],"properties":{"success":{"type":"boolean"},"message":{"type":"string"},"order_tracking_id":{"type":"string","x-mockingbird-volatile":{"kind":"id"}},"rxstatus":{"type":"string"}}},"CatalogItem":{"type":"object","required":["catalog_id","medication_name","status"],"properties":{"catalog_id":{"type":"string","x-mockingbird-resource":{"type":"catalog_item","identity":true}},"medication_name":{"type":"string"},"medication_strength":{"type":["string","null"]},"package_size":{"type":["string","null"]},"quantity":{"type":["number","null"]},"quantity_units":{"type":["string","null"]},"medication_form":{"type":["string","null"]},"route":{"type":["string","null"]},"states":{"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["active","inactive"]}}},"ErrorBody":{"type":"object","required":["message"],"properties":{"message":{"type":"string"},"success":{"type":"boolean"}}},"ValidationError":{"type":"object","required":["message","errors"],"properties":{"message":{"type":"string"},"errors":{"oneOf":[{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},{"type":"array","items":{"type":"object"}}]}}}}}}`);
 var operationIds = ["GenerateAccessToken", "CreateOrder", "GetOrder", "CancelOrder", "ListPresetCatalogItems"];
@@ -2587,13 +2659,61 @@ var DEFAULT_CATALOG = [
     status: "inactive"
   }
 ];
+var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var optionalString = (row, key) => {
+  const value = row[key];
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "string") throw new Error(`${key} must be a string or null`);
+  return value;
+};
+var parseCatalogItem = (value) => {
+  if (!isRecord4(value)) throw new Error("a catalog row must be an object");
+  const { catalog_id, medication_name, quantity, states, status } = value;
+  if (typeof catalog_id !== "string" || catalog_id.length === 0) {
+    throw new Error("catalog_id must be a non-empty string");
+  }
+  if (typeof medication_name !== "string") {
+    throw new Error(`${catalog_id}: medication_name must be a string`);
+  }
+  if (quantity !== void 0 && quantity !== null && typeof quantity !== "number") {
+    throw new Error(`${catalog_id}: quantity must be a number or null`);
+  }
+  if (states !== void 0 && (!Array.isArray(states) || states.some((s) => typeof s !== "string"))) {
+    throw new Error(`${catalog_id}: states must be a list of state codes`);
+  }
+  if (status !== void 0 && status !== "active" && status !== "inactive") {
+    throw new Error(`${catalog_id}: status must be "active" or "inactive"`);
+  }
+  try {
+    return {
+      catalog_id,
+      medication_name,
+      medication_strength: optionalString(value, "medication_strength"),
+      package_size: optionalString(value, "package_size"),
+      quantity: typeof quantity === "number" ? quantity : null,
+      quantity_units: optionalString(value, "quantity_units"),
+      medication_form: optionalString(value, "medication_form"),
+      route: optionalString(value, "route"),
+      states: states ?? [],
+      status: status ?? "active"
+    };
+  } catch (error) {
+    throw new Error(`${catalog_id}: ${error.message}`);
+  }
+};
+var parseCatalog = (value) => {
+  const rows = Array.isArray(value) ? value : isRecord4(value) ? value.data : void 0;
+  if (!Array.isArray(rows)) throw new Error("a catalog must be an array or {data: [...]}");
+  return rows.map(parseCatalogItem);
+};
 
 // src/state.ts
 var DEFAULT_SETTINGS = {
   tokenTtlSeconds: 86400,
   staticTokens: [],
   clients: [],
-  autoAdvance: null
+  autoAdvance: null,
+  unknownPresets: "reject"
 };
 var RxVortexState = class {
   constructor(sqlite, namespace, seed) {
@@ -2611,15 +2731,25 @@ var RxVortexState = class {
   ids;
   /** Re-apply the catalog and settings after a reset. */
   ensureSeeded() {
-    if (this.catalog.count() === 0) {
-      for (const item of this.seed.catalog.length > 0 ? this.seed.catalog : DEFAULT_CATALOG) {
-        this.catalog.insert(item.catalog_id, item);
-      }
-    }
+    if (this.catalog.count() === 0) this.putCatalog(this.seed.catalog ?? DEFAULT_CATALOG, "merge");
     if (!this.settings.has("settings")) {
       this.settings.insert("settings", { ...DEFAULT_SETTINGS, ...this.seed.settings });
     }
   }
+  /** Load rows: `replace` drops every other row first, `merge` upserts by `catalog_id`. */
+  putCatalog(items, mode) {
+    if (mode === "replace") {
+      for (const row of this.catalog.list()) this.catalog.delete(row.id);
+    }
+    for (const item of items) {
+      if (this.catalog.has(item.catalog_id)) this.catalog.update(item.catalog_id, item);
+      else this.catalog.insert(item.catalog_id, item);
+    }
+    return this.catalog.count();
+  }
+  catalogRows() {
+    return this.catalog.list({ order: "oldest" }).map((row) => row.value);
+  }
   current() {
     return this.settings.get("settings") ?? DEFAULT_SETTINGS;
   }
@@ -2730,10 +2860,10 @@ var RXVORTEX_PRESETS = {
 };
 var json3 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 var adminError3 = (status, message) => json3(status, { error: { type: "mockingbird_admin", message } });
-var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var parseAutoAdvance = (value) => {
   if (value === null) return null;
-  if (!isRecord4(value)) return "autoAdvance must be {afterMs, path} or null";
+  if (!isRecord5(value)) return "autoAdvance must be {afterMs, path} or null";
   if (typeof value.afterMs !== "number" || value.afterMs < 0)
     return "autoAdvance.afterMs must be ms";
   if (!Array.isArray(value.path) || value.path.some((s) => typeof s !== "string")) {
@@ -2744,7 +2874,7 @@ var parseAutoAdvance = (value) => {
 var adminRoutes = (runtime) => ({
   "GET /orders": ({ namespace }) => json3(200, { orders: runtime.instance(namespace).orders() }),
   "POST /orders/:id/transition": ({ params, body, namespace }) => {
-    if (!isRecord4(body) || typeof body.to !== "string") {
+    if (!isRecord5(body) || typeof body.to !== "string") {
       return adminError3(
         400,
         'expected {"to": "<vendor status>", "trackingnumber"?, "shippingcarrier"?}'
@@ -2760,9 +2890,27 @@ var adminRoutes = (runtime) => ({
     });
     return order ? json3(200, order) : adminError3(404, `no order ${params.id}`);
   },
+  "GET /catalog": ({ namespace }) => json3(200, { data: runtime.instance(namespace).state.catalogRows() }),
+  "PUT /catalog": ({ body, namespace }) => {
+    const rows = isRecord5(body) ? body.items ?? body.data : void 0;
+    if (!isRecord5(body) || !Array.isArray(rows)) {
+      return adminError3(400, 'expected {"items": [{catalog_id, medication_name, \u2026}], "mode"?}');
+    }
+    const mode = body.mode ?? "replace";
+    if (mode !== "replace" && mode !== "merge") {
+      return adminError3(400, 'mode must be "replace" or "merge"');
+    }
+    let items;
+    try {
+      items = rows.map(parseCatalogItem);
+    } catch (error) {
+      return adminError3(400, `items: ${error.message}`);
+    }
+    return json3(200, { count: runtime.instance(namespace).state.putCatalog(items, mode) });
+  },
   "GET /settings": ({ namespace }) => json3(200, runtime.instance(namespace).state.current()),
   "PUT /settings": ({ body, namespace }) => {
-    if (!isRecord4(body)) return adminError3(400, "expected a JSON object");
+    if (!isRecord5(body)) return adminError3(400, "expected a JSON object");
     const patch = {};
     if (body.tokenTtlSeconds !== void 0) {
       if (typeof body.tokenTtlSeconds !== "number")
@@ -2776,7 +2924,7 @@ var adminRoutes = (runtime) => ({
     if (body.clients !== void 0) {
       if (!Array.isArray(body.clients))
         return adminError3(400, "clients: [{client_id, client_secret}]");
-      patch.clients = body.clients.filter(isRecord4).map((c) => ({
+      patch.clients = body.clients.filter(isRecord5).map((c) => ({
         client_id: String(c.client_id),
         client_secret: String(c.client_secret)
       }));
@@ -2786,6 +2934,12 @@ var adminRoutes = (runtime) => ({
       if (typeof parsed === "string") return adminError3(400, parsed);
       patch.autoAdvance = parsed;
     }
+    if (body.unknownPresets !== void 0) {
+      if (body.unknownPresets !== "reject" && body.unknownPresets !== "accept") {
+        return adminError3(400, 'unknownPresets: "reject" | "accept"');
+      }
+      patch.unknownPresets = body.unknownPresets;
+    }
     return json3(200, runtime.instance(namespace).state.update(patch));
   },
   "POST /tick": ({ namespace }) => json3(200, { applied: runtime.instance(namespace).tick() })
@@ -2843,6 +2997,7 @@ var createRuntime2 = (options = {}) => {
 // src/index.ts
 var RXVORTEX_NAMESPACE = "rxvortex";
 var TOKEN_PREFIX = "rxv_";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var base64url = (value) => toBase64(new TextEncoder().encode(value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var fromBase64url = (value) => {
   try {
@@ -2920,7 +3075,7 @@ var RxVortexAPI = class {
     this.now = options.now ?? (() => Date.now());
     this.onWebhook = options.onWebhook;
     this.state = new RxVortexState(sqlite, namespace, {
-      catalog: options.catalog ?? [],
+      catalog: options.catalog,
       settings: options.settings ?? {}
     });
     const handlers = defineOperations({
@@ -2928,9 +3083,7 @@ var RxVortexAPI = class {
       CreateOrder: (context) => this.createOrder(context),
       GetOrder: (context) => this.getOrder(context),
       CancelOrder: (context) => this.cancelOrder(context),
-      ListPresetCatalogItems: () => jsonRes(200, {
-        data: this.state.catalog.list({ order: "oldest" }).map((row) => row.value)
-      })
+      ListPresetCatalogItems: () => jsonRes(200, { data: this.state.catalogRows() })
     });
     this.service = createService({
       document,
@@ -3009,9 +3162,10 @@ var RxVortexAPI = class {
     }
     const order = body.order;
     const meds = body.medication_requests;
+    const adoptable = (med) => this.state.current().unknownPresets === "accept" && UUID.test(med.preset_catalog_id);
     const unknown = meds.find((med) => {
       const item = this.state.catalog.get(med.preset_catalog_id);
-      return !item || item.status !== "active";
+      return item ? item.status !== "active" : !adoptable(med);
     });
     if (unknown) {
       return jsonRes(422, {
@@ -3033,6 +3187,9 @@ var RxVortexAPI = class {
         { ids: { orderId: existing.order_tracking_id } }
       );
     }
+    for (const med of meds) {
+      if (!this.state.catalog.has(med.preset_catalog_id)) this.adoptPreset(med);
+    }
     const now = this.iso();
     const created = {
       order_tracking_id: this.state.nextTrackingId(),
@@ -3076,6 +3233,25 @@ var RxVortexAPI = class {
       { ids }
     );
   }
+  /**
+   * Under `unknownPresets: "accept"`, a well-formed preset id the catalog lacks becomes an
+   * active row described by the request, so later submits and catalog reads see it.
+   */
+  adoptPreset(med) {
+    const item = {
+      catalog_id: med.preset_catalog_id,
+      medication_name: med.medication_name,
+      medication_strength: med.medication_strength ?? null,
+      package_size: null,
+      quantity: med.quantity,
+      quantity_units: med.quantity_units,
+      medication_form: med.medication_form ?? null,
+      route: null,
+      states: [],
+      status: "active"
+    };
+    this.state.putCatalog([item], "merge");
+  }
   getOrder(context) {
     const order = this.state.findOrder(context.params.orderId ?? "");
     if (!order) return jsonRes(404, { message: "Order not found." });
@@ -3182,10 +3358,12 @@ export {
   supportedOperationIds,
   CUSTOM_CREAM_ANCHOR_PRESET_ID,
   DEFAULT_CATALOG,
+  parseCatalogItem,
+  parseCatalog,
   RXVORTEX_PRESETS,
   createRuntime2 as createRuntime,
   RXVORTEX_NAMESPACE,
   tokenCredential,
   RxVortexAPI
 };
-//# sourceMappingURL=chunk-DNELVPK4.js.map
+//# sourceMappingURL=chunk-5KK6W2PE.js.map