Makor CPG

Stateful mock of the legacy Makor AI API ("CPG") for test suites. It covers:

• care-plan details and the plus-user toggle (Intercom sync, user-actions queue);
• the bloodwork-results webhook (ODX);
• subscription and Wholescripts order reads;
• AI patient summaries and async-review scripts, which the EMR frontend calls straight from the browser.

Generation answers at once and deterministically. Review scripts move from processing to complete on the mock clock, so the EMR panels and the backend jobs run with no Railway staging server and no 30–50 s LLM wait.

This is not the in-repo makor-ecosystem gateway (MAKOR_GATEWAY_URL). That gateway is out of scope; see "Deliberately not modelled".

• Operation coverage: SUPPORT.md
• The vendor publishes no spec. The contract (openapi.yaml) is hand-authored from our consumers' wire shapes: makor-ai.types.ts and the EMR async-review-script.types.ts / user-summary.service.ts.

#Install

npm install -D @crvouga/mockingbird-service-makor-cpg

ESM only. Node >= 22 or Bun >= 1.2. No native dependencies. Serve it with npx mockingbird-makor-cpg serve, createServer from ./server (Node), or createRuntime with any Fetch server.

#Usage

npx mockingbird-makor-cpg serve --port 8806 --processing-ms 2000

import { createRuntime } from "@crvouga/mockingbird-service-makor-cpg"

const cpg = createRuntime({ settings: { processingMs: 45_000 } })
const admin = (method: string, path: string, body?: unknown) =>
  cpg.fetch(
    new Request(`http://makor.test/__admin${path}`, {
      method,
      headers: { "content-type": "application/json" },
      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
    }),
  )

// Member 1652 has an approved plan (the Intercom sync reads it); nobody else does (404, normal).
await admin("PUT", "/care-plans/1652", { status: "Approved", state: "CA" })
// …the EMR generates a review script: it answers `processing` at once…
cpg.clock.advance(45_000)
// …and the next GET /api/async-review-script/1652/<labTestId> answers `complete`.

#Routes

Every route needs x-api-key. Any non-empty key is accepted unless apiKeys is set. Errors are {error, message, statusCode}.

Script content comes from the most specific fixture: user + lab test, then user, then lab test, then *. Without a fixture it is a deterministic placeholder ScriptContent, with every labFindings group, nutrition recommendations and fiber guidance filled in. Intake text, charting notes and demographics are validated but never stored, echoed or journaled.

#CORS

The EMR frontend calls this API straight from the browser. cpg-api.ts sends x-api-key and Content-Type: application/json from the page, so every call is preceded by a CORS preflight. The mock:

• answers every OPTIONS request with 204, unauthenticated, since browsers send no custom headers on a preflight;
• echoes Origin in Access-Control-Allow-Origin, or sends * when there is no Origin;
• allows GET, POST, PUT, PATCH, DELETE, OPTIONS;
• echoes Access-Control-Request-Headers, defaulting to content-type, x-api-key, x-mockingbird-namespace, authorization;
• exposes x-mockingbird and sets Access-Control-Max-Age: 600.

It stamps the same headers on every response: vendor, 401, fault presets, admin and health. An injected 500 then reaches the page as a 500, not as a CORS "network error". This is deliberately permissive, because the key is public in the browser bundle anyway. withCors(request, response) and CORS_HEADERS are exported.

#Admin (beyond the standard contract)

Fault presets (POST /__admin/faults {"preset": "<name>", "count"?: n, "latencyMs"?: ms}):

#Namespaces

• the x-mockingbird-namespace header (the EMR's axios instance can add it);
• a /ns/<name> prefix on the base URL;
• the API key: PUT /__admin/credentials {"credentials": {"<x-api-key>": "<namespace>"}}.

The request journal records operation ids, statuses and the user, lab test and review ids. It never records request bodies.

#Deliberately not modelled

• The makor-ecosystem gateway (MAKOR_GATEWAY_URL: /v1/makor/*, /v1/care-team-chat/*, /v1/plans/*). It is in-repo, not third-party, and a stub for it (an SSE replayer) is tracked separately.
• Real AI output. Summaries and scripts are fixtures or deterministic placeholders, and biomarker_analysis is passed through as given.
• The real server's internal polling. The 30–50 s latency is only a preset.
• Stripe side effects of subscription cancel. Only the stored row changes.
• Review history listing (ReviewHistoryResponse), which no live caller reaches.

#API

Part of mockingbird.