Validate medication JSONB arrays in rowToMedicationRecord

[BigSimmo]

Summary

rowToMedicationRecord now Zod-parses the stats, sections, and quick JSONB columns and defaults each field to [] when the payload is not a usable array of the expected clinical objects. Valid snapshot rows still parse in full, including nested patient metadata. database.types.tsJson = any is unchanged, and medication accent defaults remain the Postgres column hex — they are not remapped to --clinical-accent.

Verification

• Focused rowToMedicationRecord test: malformed JSONB → empty arrays; valid rows parse (tests/medication-records.test.ts, 5 passed)
• Medications suite: Test Files 15 passed (15) / Tests 262 passed (262)
• npm run verify:pr-local

verify:pr-local completed: check:runtime, check:installed-lock-parity, format:changed, lint, typecheck, test, check:repo-awareness-snapshot, build, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report. failed: (none). Full unit suite: Test Files 896 passed (896) / Tests 10839 passed | 1 skipped (10840). Build: Compiled successfully in 42s. Offline RAG fixtures: 36 golden cases, 26 suites. Medication interactions: 525 rows up to date. Lexicon report: 37 catalogue terms up to date.

During development, use npm run verify:cheap as the faster iteration gate before the final PR-local preflight.

• UI verification not run: no UI, routing, styling, or browser behaviour changed
• Verification not run: npm run verify:release — not requested; no release or handoff confidence claim

For retrieval, ranking, selection, chunking, source/citation rendering, or answer-contract changes, verify:pr-local runs eval:rag:offline automatically. Run the offline command directly during iteration before spending a live eval.

• Retrieval/ranking eval not run: this change does not touch retrieval, ranking, selection, chunking, or scoring behaviour
• Answer-generation eval not run: this change does not touch answer generation, the synthesis prompt, or answer post-processing
• npm run check:production-readiness not run: no privacy, environment, Supabase, source-governance, or deployment behaviour changed beyond conservative empty-array fallback on unusable catalogue JSONB
• npm run check:deployment-readiness not run: deployment startup, hosting, and rollout behaviour are unchanged

Risk and rollout

• Risk: Medium — malformed medication JSONB that previously flowed through an as cast will now render empty stats/sections/quick instead of untyped objects. That is conservative degradation: clinicians see missing catalogue fields rather than a guessed shape. Well-formed snapshot and database rows keep their existing content.
• Rollback: Revert this commit; rowToMedicationRecord returns to unchecked as casts and the focused test is removed.
• Provider or production effects: None. No migrations, no schema change, no hosted apply, no provider calls.
• RAG impact: no retrieval behaviour change — this only validates medication catalogue JSONB at the row-to-record mapper; retrieval RPCs, ranking, selection, and answer generation are untouched.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

This mapper change does not introduce or alter clinical decision-support behaviour. Unusable JSONB degrades to empty arrays rather than guessed clinical content. SaMD/TGA classification is unchanged.

Notes

PR 3e only. No database.types.ts Json narrowing. No accent token remapping. No migrations.

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 102 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1aca02c3-1ff2-4694-87b8-6ce7fdafbfc1

📥 Commits

Reviewing files that changed from the base of the PR and between 1efbe25 and c9e1aa0.

📒 Files selected for processing (2)

• src/lib/medication-records.ts
• tests/medication-records.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9b42e6d7-acc0-47e7-95f0-9d8960e6f2e9)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8bed57bf-fd05-4172-86aa-147bce7ebff8)