Python may help

Class dc.Demo
{

ClassMethod ValidateJSON(data As %String = "") As %Status [ Language = python ]
{
import iris
import json
from json import JSONDecodeError

try:
    json.loads(data)
    return iris.system.Status.OK()
except JSONDecodeError as ex:
    return iris.system.Status.Error(5001, f"{ex.msg}: line {ex.lineno} column {ex.colno} (char {ex.pos})")
except Exception as ex:
    return iris.system.Status.Error(5001, repr(ex))
}

}

And result

USER>set status = ##class(dc.Demo).ValidateJSON("{""aa"":123 ""name"": ""value""}") do:'status $system.OBJ.DisplayError(status) 
ERROR #5001: Expecting ',' delimiter: line 1 column 11 (char 10)

USER>set status = ##class(dc.Demo).ValidateJSON("{""aa"": true, ") do:'status $system.OBJ.DisplayError(status) 
ERROR #5001: Expecting property name enclosed in double quotes: line 1 column 14 (char 13)

USER>set status = ##class(dc.Demo).ValidateJSON("{""aa"": wrong ") do:'status $system.OBJ.DisplayError(status) 
ERROR #5001: Expecting value: line 1 column 8 (char 7)

USER>set status = ##class(dc.Demo).ValidateJSON("{""aa"": true}") do:'status $system.OBJ.DisplayError(status)

Not so much magic in it, if you already know how to read it, the content of XData is just a Stream, which can be used both ways. Just Write to it, and %Save it. And you will probably need to compile the class

Class Demo.Test
{

XData OpenAPI [ MimeType = application/json ]
{
}

ClassMethod Update()
{
    set xdata = ##class(%Dictionary.XDataDefinition).IDKEYOpen($ClassName(), "OpenAPI")
    do xdata.Data.Write("{}")
    do xdata.%Save()
}

}

In VSCode, the content of XData will not appear after that, because it happened on the server, and VSCode will not see the changes, you'll need to export it manually

I've published online demo, where you could play with two executions of FHIR Load for two different patients.

This uncovers some interesting discoveries, like, about 40% of the time is spent on IndexResource

And about 20% to ValidateResource 

Of course, this can't be very accurate, but can help to understand what actually happens during the process, and at what moment. Including finding places, where it's not just reads of globals, but sets or even kills. Something like, 17% of GloKills are happening during CommitTransactionBundle

While the requests is ended up in IRIS, than IRIS is responsible for the response, and it should support responses in HTTP/2 which is very different from HTTP/1. In HTTP/1 it does not matter how many connections are, queries will be processed one by one, and responses will go accordingly one by one. But in HTTP/2 queries processed simultaneously and response will go to the client as soon as it's done, no matter where it's started and it goes through the same connection, while in HTTP/1 connection per request. And IRIS and for sure Caché does not have support for it, the only way it's working is to process one request per connection and response as soon as the result is ready.

So, even if you manage to mimic HTTP/2 somehow, it will not help almost at all, the queries in the connection still process synchronously.

So, if your application is using CSP files, the only way is to completely rewrite it with some external framework, Python could be a solution, most of the popular frameworks can work this way, just select one you like more, Django, Flask, FastAPI or whatever you find. Even if you have just only REST, it will not be easy to implement. 

I see no reasons to do it on ObjectScript, it will be quite difficult to achieve it.

Well, the issue is that Caché, or even IRIS, still uses one Job to process requests for the same session. So, anything higher than 1.1 will not help at all. So, the only solution is to make sure that as much more possible static files are processed without Caché/IRIS or WebGateway, through a webserver configured for HTTP/2/3. And only API requests which require data would go to Caché/IRIS, and best case if it will be session-less queries, meaning that your requests are not tied to the session on the server, and those queries could be processed in parallel, and everything needed can be reconstructed from the query, e.g. username to check permissions should go from Authorization header.

Moving from HTTP/1.1 to HTTP/2/3 is not as simple as you expect, differences between protocols are significant. And requires a lot of work on the application.

You can't publish manually to the public repository, you can do it only through OpenExchange, check IPM during application creation, and with the next release, it will publish your project for you

If you want to publish to your repo, you just have to specify login and password, with command like this

repo -r -n myrepo -url https://server/registry/ -user "test" -pass "test"