chore(core/api): upgrade @apollo/server v4→v5, add @as-integrations/express4

[k9ert]

Summary

Upgrades Apollo Server in core/api from v4 (EOL) to v5:

• @apollo/server: ^4.12.2 → ^5.0.0 (resolved: 5.5.0)
• NEW @as-integrations/express4: ^1.0.0 (resolved: 1.1.2) — replaces @apollo/server/express4 subpath

Motivation: Apollo Server v4 is End of Life. Tracked in blinkbitcoin/blink-wip#634 (parent: blinkbitcoin/blink-wip#631).

What changed

core/api/package.json

• Bumped @apollo/server from ^4.12.2 to ^5.0.0
• Added @as-integrations/express4 as new dependency

core/api/src/servers/graphql-server.ts

One import change:

-import { expressMiddleware } from "@apollo/server/express4"
+import { expressMiddleware } from "@as-integrations/express4"

This is the only code change. The expressMiddleware function has the same API — only the package location moved.

pnpm-lock.yaml

Lockfile update.

Breaking changes reviewed (Apollo Server v4 → v5)

Full migration guide: https://www.apollographql.com/docs/apollo-server/migration/

Breaking change	Impact on core/api	Action
Node.js ≥ v20 required	package.json already specifies "node": "20"	None
graphql.js ≥ v16.11.0 required	Currently ^16.11.0 — satisfies	None
Express integration extracted to @as-integrations/express4	This is the main change. expressMiddleware import moved from @apollo/server/express4 to @as-integrations/express4. Same API, same function signature	Import updated
status400ForVariableCoercionErrors now defaults to true	Variable coercion errors now return HTTP 400 instead of 200. Correct per GraphQL spec	None (improvement)
cache: "bounded" constructor option	Still supported in v5, no change needed	None
formatError callback	API unchanged. Our custom formatError with unwrapResolverError works as-is. unwrapResolverError still exported from @apollo/server/errors	None
ApolloServerPluginDrainHttpServer	Still at @apollo/server/plugin/drainHttpServer, unchanged	None
ApolloServer constructor + ApolloServerPlugin type	Still exported from @apollo/server, unchanged	None
startStandaloneServer no longer uses Express	Not used in core/api (uses explicit Express setup)	N/A
precomputedNonce option removed	Not used	N/A
Native fetch instead of node-fetch	No HTTP proxy usage	N/A
Compiled targeting ES2023	Fine for Node.js 20	None

Subpath exports verified in @apollo/server v5

The following subpath imports used by core/api are all still present in v5:

• @apollo/server — ApolloServer, ApolloServerPlugin ✅
• @apollo/server/errors — unwrapResolverError ✅
• @apollo/server/plugin/drainHttpServer — ApolloServerPluginDrainHttpServer ✅
• @apollo/server/express4 — removed, replaced by @as-integrations/express4 ✅ (updated)

@as-integrations/express4

• Peer deps: @apollo/server ^4.0.0 || ^5.0.0, express ^4.0.0
• API: expressMiddleware — identical signature to what was in @apollo/server/express4
• https://github.com/apollo-server-integrations/apollo-server-integration-express

Verification

• pnpm install --filter api — clean install ✅
• tsc --noEmit — zero Apollo-related type errors ✅

Closes blinkbitcoin/blink-wip#634

🤖 Generated with Claude Code