[gracegenesis100-dot]

Closes #103. Adds an OTEL SDK bootstrap that remains no-op unless OTLP is configured.

[drips-wave]

@gracegenesis100-dot Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@gracegenesis100-dot CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

npm error Missing: @opentelemetry/sdk-node@0.57.2 from lock file
npm error Missing: @opentelemetry/api@1.9.1 from lock file
npm error Missing: @opentelemetry/api-logs@0.57.2 from lock file
npm error Missing: @opentelemetry/core@1.30.1 from lock file
npm error Missing: @opentelemetry/exporter-logs-otlp-grpc@0.57.2 from lock file
npm error Missing: @opentelemetry/exporter-logs-otlp-http@0.57.2 from lock file
npm error Missing: @opentelemetry/exporter-logs-otlp-proto@0.57.2 from lock file
npm error Missing: @opentelemetry/exporter-metrics-otlp-grpc@0.57.2 from lock file

The new @opentelemetry/* dependencies are in package.json but not in backend/package-lock.json. Run npm install in backend/ and commit the updated lockfile.

package-lock.json is out of sync with package.json. Run npm install and commit the updated lockfile.

[github-actions]

@gracegenesis100-dot This PR now has merge conflicts with main, most likely because #190 (test(integration): end-to-end care-thread integration test scaffold) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@gracegenesis100-dot This PR now has merge conflicts with main, most likely because #249 (chore(deps): clear new axios/zod/body-parser advisories failing the audit gate) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@gracegenesis100-dot This PR now has merge conflicts with main, most likely because #152 (Feat/verified wallet links for patients and facilities) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@gracegenesis100-dot This PR now has merge conflicts with main, most likely because #221 ([Phase 4] Expire unfulfilled orders) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@gracegenesis100-dot This PR conflicts with main again, so please rebase:

git fetch upstream
git rebase upstream/main
# fix the conflicts, then
git push --force-with-lease

After the rebase, the dependency audit will still fail on packages this PR adds:

GHSA-q7rr-3cgh-j5r3 (high): Prometheus exporter process crash via malformed HTTP request
GHSA-45rx-2jwx-cxfr (high): OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header

Bump @opentelemetry/exporter-prometheus and the OpenTelemetry propagator packages to their patched versions (run npm audit --omit=dev in backend/ to see them), or drop the Jaeger propagator if you don't need it. Then run npm run audit:prod locally. (The axios/zod/body-parser advisories in the same log are fixed on main by #249.)

[github-actions]

✅ Malware scan: clean

The earlier findings are resolved as of ac4fe8e.

[afeezorobsco-cyber]

Sweep: malware scan clean, CI green.

[afeezorobsco-cyber]

Sweep: malware scan clean, CI green.