Wizard-of-Oz Backend: Prototype Any App Against an API That an AI Fakes on the Fly

Build "Wizard-of-Oz Backend", a local mock API server for rapid prototyping. Node.js 18+ with no dependencies (built-in http, fs, fetch). Files: server.js, oz.config.json, a fixtures/ folder, a demo/ folder with a tiny frontend, and README.md.

How it works
- `node server.js` listens on port 4010 and accepts ANY method and path under /api (e.g. GET /api/recipes, GET /api/recipes/42, POST /api/recipes, DELETE /api/recipes/42). Enable CORS for every origin so any local frontend can call it.
- oz.config.json holds: "app" (one paragraph describing the app, e.g. "a recipe box for busy parents"), optional "schemas" (resource name -> example object or field list), "latencyMs" (simulated delay), and "llm" settings (OpenAI-compatible baseUrl, model, and the env var name that holds the API key; never write keys to disk or logs).
- For each request the server first checks fixtures/<METHOD>_<path>.json; if a fixture exists it is returned as-is. Otherwise it asks the LLM for a response: send the app description, the schema for that resource, the method, path, query, request body, and the current in-memory state for that resource; require strict JSON back (validate with JSON.parse, retry once with the parse error, then fall back).
- Offline fallback: if no API key is set, generate plausible data locally from the schema (field names like name, email, price, date, imageUrl get sensible fake values) so the project works with zero setup.

Memory (what makes it feel real)
- Keep an in-memory store per resource. Generated lists are saved, so the same GET returns the same items. POST adds an item with a new id, PUT/PATCH updates it, DELETE removes it, and later GETs reflect all of that. Ids stay consistent between list and detail routes.
- `?_reset=1` on any request clears that resource; `POST /_oz/reset` clears everything.

Freezing and inspecting
- `POST /_oz/freeze` writes every response served so far into fixtures/ so the prototype becomes deterministic and works offline.
- `GET /_oz` serves a small HTML dashboard: a live log of requests (method, path, status, source = fixture / llm / fallback, ms), a button to freeze one response, and the current store as pretty JSON.
- Honor an `X-Oz-Status` request header (e.g. 500 or 404) to simulate errors, and add the configured latency to every response.

Demo
- demo/index.html: a single-page "recipe box" that lists, views, adds and deletes recipes using only fetch calls to http://localhost:4010/api. It must work against the fake backend with no code that knows it is fake.

Quality bar: server.js under ~400 lines, no crashes on malformed JSON or unknown routes, and a test.js (node test.js) with at least 8 checks covering fixture precedence, POST-then-GET persistence, DELETE, reset, the X-Oz-Status header and the offline fallback generator.

When done, show a short session log (create, list, delete a recipe), explain how the store keeps the AI's invented data consistent, and note which prompt instruction most reduced invalid JSON.