feat: implement P0 greenfield subsystems (telemetry backpressure, RES…

package.json

@@ -34,6 +34,10 @@
     "security:api-drift:update": "node scripts/detect-api-drift.js --update",
     "security:api-drift:server": "node scripts/detect-api-drift.js --root server --check",
     "security:api-drift:pin": "node scripts/detect-api-drift.js --check --require-exact-pin",
+    "security:wasm-verify:telemetry": "bash src/wasm/telemetry_reader/build.sh --check",
+    "test:telemetry": "vitest run test/telemetry-pipeline.test.js && node --test server/tests/telemetry-backpressure.node-test.mjs",
+    "test:contract": "vitest run test/api-contract.test.js test/sql-cache.test.js",
+    "bench:telemetry": "node --expose-gc src/utils/telemetryBench.js --out docs/benchmarks/telemetry-parser.json",
     "test:server-features": "node --test server/tests/telemetry-ws.test.js",
     "test:ws-cluster": "node server/tests/ws-cluster.js",
     "zk:shard": "python circuits/scripts/shard-aegis.py circuits/target/aegis.json public/zk-assets",

scripts/detect-api-drift.js

@@ -39,7 +39,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
-import ts from "typescript";
+import * as tsNamespace from "typescript";
+const ts = tsNamespace.default || tsNamespace;
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = path.resolve(HERE, "..");

scripts/generate-soroban-bindings.js

@@ -1,7 +1,7 @@
 import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { basename, join, relative } from 'node:path';
 
-const ROOT = new URL('..', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1');
+const ROOT = process.cwd();
 const CONTRACTS_DIR = join(ROOT, 'contracts');
 const OUT_FILE = join(ROOT, 'src', 'generated', 'soroban-bindings.ts');
 

server/app.ts

@@ -0,0 +1,43 @@
+import express, { type Express, type NextFunction, type Request, type Response } from 'express';
+import { installDomainRoutes } from './routes/index.ts';
+import { installTelemetryRoutes } from './telemetryBootstrap.js';
+import type { DomainStore } from './lib/domainStore.ts';
+
+export interface AppOptions {
+  store?: DomainStore;
+  telemetry?: boolean;
+  graphqlPath?: string;
+}
+
+/**
+ * Compose the HTTP application.
+ *
+ * Middleware hardening (CSP/CORS/rate limits/HTTP2 push) is installed by
+ * server/hardening.ts; this factory owns only route composition so contract
+ * tests can run without the ZK prover or a live collector.
+ */
+export function createApp(options: AppOptions = {}): Express {
+  const app = express();
+  app.disable('x-powered-by');
+  app.use(express.json({ limit: '1mb' }));
+
+  if (options.telemetry !== false) installTelemetryRoutes(app);
+  installDomainRoutes(app, { store: options.store, graphqlPath: options.graphqlPath });
+
+  app.use((req: Request, res: Response) => {
+    res.status(404).json({ error: 'not_found', path: req.path });
+  });
+
+  app.use((error: unknown, _req: Request, res: Response, _next: NextFunction) => {
+    const typed = error as { status?: number; type?: string; message?: string };
+    const status = typed.status ?? (typed.type === 'entity.parse.failed' ? 400 : 500);
+    res.status(status).json({
+      error: status === 400 ? 'bad_request' : 'internal_error',
+      message: status === 400 ? 'invalid JSON body' : 'unexpected server error',
+    });
+  });
+
+  return app;
+}
+
+export default createApp;

server/contract/domain-contract.json

@@ -0,0 +1,114 @@
+{
+  "version": 1,
+  "description": "Canonical REST ↔ GraphQL ↔ DB field table. Any change here is a contract change and must be reviewed with --update.",
+  "surfaces": {
+    "rest": "swagger.json",
+    "graphql": "server/graphql/schema.graphql",
+    "database": "server/lib/domainStore.ts"
+  },
+  "entities": {
+    "Incident": {
+      "dbTable": "incidents",
+      "restPath": "/api/dispatch/{id}",
+      "restRoot": "incident",
+      "fields": {
+        "id": { "db": "id", "graphqlType": "ID!", "nullable": false },
+        "status": { "db": "status", "graphqlType": "IncidentStatus!", "nullable": false },
+        "priority": { "db": "priority", "graphqlType": "Priority!", "nullable": false },
+        "createdAt": { "db": "created_at", "graphqlType": "String!", "nullable": false },
+        "version": { "db": "version", "graphqlType": "Int!", "nullable": false },
+        "location": { "db": "location", "graphqlType": "Location!", "nullable": false },
+        "responders": { "db": "join:responders", "graphqlType": "[Responder!]!", "nullable": false, "list": true },
+        "events": { "db": "join:events", "graphqlType": "[Event!]!", "nullable": false, "list": true }
+      }
+    },
+    "Responder": {
+      "dbTable": "responders",
+      "restPath": "/api/dispatch/{id}",
+      "restRoot": "incident.responders",
+      "fields": {
+        "id": { "db": "id", "graphqlType": "ID!", "nullable": false },
+        "incidentId": { "db": "incident_id", "graphqlType": "ID!", "nullable": false },
+        "name": { "db": "name", "graphqlType": "String!", "nullable": false },
+        "status": { "db": "status", "graphqlType": "ResponderStatus!", "nullable": false },
+        "location": { "db": "location", "graphqlType": "Location!", "nullable": false },
+        "lastEvent": { "db": "join:events", "graphqlType": "Event", "nullable": true }
+      }
+    },
+    "Event": {
+      "dbTable": "events",
+      "restPath": "/api/events",
+      "restRoot": "events",
+      "fields": {
+        "id": { "db": "id", "graphqlType": "ID!", "nullable": false },
+        "incidentId": { "db": "incident_id", "graphqlType": "ID!", "nullable": false },
+        "responderId": { "db": "responder_id", "graphqlType": "ID", "nullable": true },
+        "type": { "db": "type", "graphqlType": "String!", "nullable": false },
+        "at": { "db": "at", "graphqlType": "String!", "nullable": false },
+        "cursor": { "db": "cursor", "graphqlType": "String!", "nullable": false },
+        "payload": { "db": "payload", "graphqlType": "JSON", "nullable": true }
+      }
+    },
+    "Location": {
+      "dbTable": "inline",
+      "restPath": "/api/dispatch/{id}",
+      "restRoot": "incident.location",
+      "fields": {
+        "lat": { "db": "lat", "graphqlType": "Float!", "nullable": false },
+        "lng": { "db": "lng", "graphqlType": "Float!", "nullable": false }
+      }
+    },
+    "SyncConflict": {
+      "dbTable": "inline",
+      "restPath": "/api/sync/flush",
+      "restRoot": "conflict",
+      "fields": {
+        "conflict": { "db": "conflict", "graphqlType": "Boolean!", "nullable": false },
+        "serverVersion": { "db": "version", "graphqlType": "Int!", "nullable": false },
+        "mergeProposal": { "db": "merge_proposal", "graphqlType": "JSON!", "nullable": false }
+      }
+    },
+    "SyncSuccess": {
+      "dbTable": "inline",
+      "restPath": "/api/sync/flush",
+      "restRoot": "ok",
+      "fields": {
+        "ok": { "db": "ok", "graphqlType": "Boolean!", "nullable": false },
+        "serverVersion": { "db": "version", "graphqlType": "Int!", "nullable": false },
+        "incident": { "db": "incidents", "graphqlType": "Incident!", "nullable": false }
+      }
+    },
+    "ValidationError": {
+      "dbTable": "inline",
+      "restPath": "/api/dispatch",
+      "restRoot": "issues",
+      "fields": {
+        "error": { "db": "error", "graphqlType": "String!", "nullable": false },
+        "issues": { "db": "issues", "graphqlType": "[ValidationIssue!]!", "nullable": false, "list": true }
+      }
+    },
+    "ValidationIssue": {
+      "dbTable": "inline",
+      "restPath": "/api/dispatch",
+      "restRoot": "issues[]",
+      "fields": {
+        "path": { "db": "path", "graphqlType": "String!", "nullable": false },
+        "message": { "db": "message", "graphqlType": "String!", "nullable": false }
+      }
+    }
+  },
+  "enums": {
+    "IncidentStatus": ["open", "assigned", "acknowledged", "resolved"],
+    "Priority": ["low", "normal", "high", "critical"],
+    "ResponderStatus": ["assigned", "en_route", "on_scene", "offline"]
+  },
+  "operations": {
+    "getIncident": { "rest": "GET /api/dispatch/{id}", "graphql": "Query.incident", "write": false },
+    "listIncidents": { "rest": "GET /api/dispatch", "graphql": "Query.incidents", "write": false },
+    "listEvents": { "rest": "GET /api/events", "graphql": "Query.events", "write": false },
+    "createIncident": { "rest": "POST /api/dispatch", "graphql": null, "write": true },
+    "assignResponder": { "rest": "POST /api/dispatch/{id}/assign", "graphql": "Mutation.assignResponder", "write": true },
+    "acknowledgeIncident": { "rest": "POST /api/dispatch/{id}/ack", "graphql": null, "write": true },
+    "flushSync": { "rest": "POST /api/sync/flush", "graphql": "Mutation.syncFlush", "write": true }
+  }
+}