- line 8: vega should be required directly; if it cannot be loaded, the whole service basically becomes unusable, so it seems useless to even start the service without it
- line 33: putting : at the end of the defaultProtocol variable is highly unusual. It is not part of the protocol. Later, on line 198 // is appended to it, so that's the good place to put : as well. This also allows you to get rid of the hack on line 397
- line 50: use sUtil.HTTPError instead of Err, as it automatically generates the response and whitelists fields that are to be sent, so you can still put anything you'd like logged.
- line 343: better to return the failOnTimeout promise, so that the system may detect any uncaught errors and handle them gracefully.
A general note about logging: instead of using app.logger.log() please use the logger provided with the request object, as noted here. This allows us to track requests across different services, which is especially useful if Graphoid ends up behind RESTBase.