@omnitronix/game-engine-sdk 1.0.4 → 2.0.2

package/dist/esm/common/error-handling/all-exceptions.filter.js

@@ -4,22 +4,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 var ExceptionsFilter_1;
 import { Logger } from '../logger/logger';
-import { METRICS_PORT } from '../metrics/metrics.port';
-import { Catch, HttpException, HttpStatus, Inject, } from '@nestjs/common';
+import { Catch, HttpException, HttpStatus } from '@nestjs/common';
 import { DomainException } from './domain.exception';
 import { ErrorCodeMapper } from './error-code-mapper';
 import { InternalErrorCode } from './internal-error-code';
 let ExceptionsFilter = ExceptionsFilter_1 = class ExceptionsFilter {
-    constructor(metricsPort) {
-        this.metricsPort = metricsPort;
+    constructor() {
         this.logger = new Logger(ExceptionsFilter_1.name);
     }
     catch(exception, host) {
@@ -44,14 +36,17 @@ let ExceptionsFilter = ExceptionsFilter_1 = class ExceptionsFilter {
     handleDomainException(exception, request) {
         const status = ErrorCodeMapper.mapToHttpStatus(exception.errorCode);
         const level = status >= 500 ? 'error' : 'warn';
+        // Log full internal details for debugging — never sent to client
         this.logger.log(`DomainException (status: ${status} at ${request.method} ${request.url}): Internal Code ${exception.errorCode} Message: ${exception.message}`, { level });
         if (exception.cause) {
             this.logger.error('Exception cause:', exception.cause);
         }
+        // OWASP A01: Return error code only — never expose internal error.message to clients.
+        // Consistent with gRPC error sanitization in GameEngineGrpcInAdapter.
         return this.buildResponsePayload({
             status,
             internalCode: exception.errorCode,
-            message: exception.message,
+            message: exception.errorCode,
             path: request.url,
         });
     }
@@ -59,17 +54,29 @@ let ExceptionsFilter = ExceptionsFilter_1 = class ExceptionsFilter {
         const status = exception.getStatus();
         const responseData = exception.getResponse();
         // Check if this is a custom validation error response
-        if (typeof responseData === 'object' &&
-            responseData.internalCode &&
-            responseData.statusCode) {
-            return responseData;
+        const responseRecord = typeof responseData === 'object' && responseData !== null
+            ? responseData
+            : null;
+        if (responseRecord &&
+            typeof responseRecord.internalCode === 'string' &&
+            typeof responseRecord.statusCode === 'number' &&
+            typeof responseRecord.message !== 'undefined') {
+            return {
+                statusCode: responseRecord.statusCode,
+                internalCode: responseRecord.internalCode,
+                message: String(responseRecord.message),
+                timestamp: typeof responseRecord.timestamp === 'string'
+                    ? responseRecord.timestamp
+                    : new Date().toISOString(),
+                path: typeof responseRecord.path === 'string' ? responseRecord.path : request.url,
+            };
         }
         let message = 'HTTP Exception';
         if (typeof responseData === 'string') {
             message = responseData;
         }
-        else if (typeof responseData === 'object' && responseData.message) {
-            message = responseData.message;
+        else if (responseRecord && typeof responseRecord.message === 'string') {
+            message = responseRecord.message;
         }
         const level = status >= 500 ? 'error' : 'warn';
         this.logger.log(`HttpException (status: ${status} at ${request.method} ${request.url}): ${message}`, { level });
@@ -82,12 +89,21 @@ let ExceptionsFilter = ExceptionsFilter_1 = class ExceptionsFilter {
                 path: request.url,
             });
         }
-        if (status === HttpStatus.INTERNAL_SERVER_ERROR) {
+        // OWASP A01: Never expose internal error details for server errors.
+        // 5xx messages may contain stack traces, DB errors, or internal details.
+        if (status >= 500) {
             this.logger.error('HttpException stack:', exception.stack);
+            return this.buildResponsePayload({
+                status,
+                internalCode: InternalErrorCode.INTERNAL_SERVER_ERROR,
+                message: 'Internal server error',
+                path: request.url,
+            });
         }
+        // 4xx client errors — framework messages are safe (e.g., "Not Found", "Bad Request")
         return this.buildResponsePayload({
             status,
-            internalCode: InternalErrorCode.INTERNAL_SERVER_ERROR,
+            internalCode: InternalErrorCode.VALIDATION_ERROR,
             message,
             path: request.url,
         });
@@ -121,8 +137,6 @@ let ExceptionsFilter = ExceptionsFilter_1 = class ExceptionsFilter {
     }
 };
 ExceptionsFilter = ExceptionsFilter_1 = __decorate([
-    Catch(),
-    __param(0, Inject(METRICS_PORT)),
-    __metadata("design:paramtypes", [Object])
+    Catch()
 ], ExceptionsFilter);
 export { ExceptionsFilter };

package/dist/esm/common/error-handling/error-code-mapper.js

@@ -2,88 +2,33 @@ import { InternalErrorCode } from './internal-error-code';
 // HTTP status codes
 const HttpStatus = {
     BAD_REQUEST: 400,
-    CONFLICT: 409,
+    UNAUTHORIZED: 401,
     FORBIDDEN: 403,
     NOT_FOUND: 404,
+    CONFLICT: 409,
     UNPROCESSABLE_ENTITY: 422,
     INTERNAL_SERVER_ERROR: 500,
     SERVICE_UNAVAILABLE: 503,
 };
 export class ErrorCodeMapper {
     static mapToHttpStatus(errorCode) {
-        return this.ERROR_CODE_TO_HTTP_MAP[errorCode] || HttpStatus.BAD_REQUEST;
+        return this.ERROR_CODE_TO_HTTP_MAP[errorCode] ?? HttpStatus.INTERNAL_SERVER_ERROR;
     }
 }
 ErrorCodeMapper.ERROR_CODE_TO_HTTP_MAP = {
-    [InternalErrorCode.FORBIDDEN]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.INVALID_CURRENCY_CODE]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INSUFFICIENT_FUNDS]: HttpStatus.UNPROCESSABLE_ENTITY,
-    [InternalErrorCode.INTERNAL_SERVER_ERROR]: HttpStatus.INTERNAL_SERVER_ERROR,
-    // Game Catalog errors
-    [InternalErrorCode.GAME_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.GAME_CONFIG_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.GAME_CONFIG_ALREADY_EXISTS_WITH_SAME_JURISDICTION_AND_RTP]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.OPERATOR_GAME_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.OPERATOR_GAME_ALREADY_ENABLED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INVALID_GAME_CONFIG_DATA]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INVALID_GAME_UPDATE_DATA]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.GAME_CODE_ALREADY_EXISTS]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.GAME_OR_GAME_CONFIG_DISABLED]: HttpStatus.BAD_REQUEST,
+    // Core game engine errors
+    [InternalErrorCode.GAME_ENGINE_ERROR]: HttpStatus.INTERNAL_SERVER_ERROR,
     [InternalErrorCode.DEBUG_COMMANDS_DISABLED]: HttpStatus.FORBIDDEN,
-    // Game Orchestrator errors
-    [InternalErrorCode.INVALID_SESSION]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.SESSION_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.SESSION_NOT_ACTIVE]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.SESSION_MISMATCH]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INVALID_STATE_TRANSITION]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INVALID_BET_AMOUNT]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.REALITY_CHECK_IN_PROGRESS]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.UNKNOWN_COMMAND]: HttpStatus.NOT_FOUND,
-    // Operator errors
-    [InternalErrorCode.MISSING_OPERATOR_CODE]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INVALID_OPERATOR_CODE]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.OPERATOR_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.OPERATOR_INACTIVE]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.COUNTRY_CODE_RESTRICTED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.UNAUTHORIZED]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.AUTH_VALIDATION_FAILED]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.BALANCE_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.INVALID_AUTH_DATA]: HttpStatus.BAD_REQUEST,
+    [InternalErrorCode.UNKNOWN_COMMAND]: HttpStatus.BAD_REQUEST,
+    [InternalErrorCode.INVALID_COMMAND]: HttpStatus.BAD_REQUEST,
+    // RNG integrity (GLI-19)
+    [InternalErrorCode.INVALID_RNG_SEED]: HttpStatus.INTERNAL_SERVER_ERROR,
+    // Infrastructure errors
+    [InternalErrorCode.INTERNAL_SERVER_ERROR]: HttpStatus.INTERNAL_SERVER_ERROR,
+    [InternalErrorCode.FORBIDDEN]: HttpStatus.FORBIDDEN,
+    [InternalErrorCode.UNAUTHORIZED]: HttpStatus.UNAUTHORIZED,
     [InternalErrorCode.VALIDATION_ERROR]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.JURISDICTION_CONFIG_ALREADY_EXISTS]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.JURISDICTION_CONFIG_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.OPERATOR_JURISDICTION_CONFIG_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.GAME_ENGINE_ERROR]: HttpStatus.INTERNAL_SERVER_ERROR,
-    [InternalErrorCode.DEBIT_FAILED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.CREDIT_FAILED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.GAME_ROUND_LOG_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    // Geo Validation errors
-    [InternalErrorCode.COUNTRY_NOT_PERMITTED]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.GEO_VALIDATION_SERVICE_UNAVAILABLE]: HttpStatus.INTERNAL_SERVER_ERROR,
-    [InternalErrorCode.RESOURCE_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.FINANCIAL_TRANSACTION_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.SESSION_TERMINATED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.SESSION_CANNOT_BE_TERMINATED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.SESSION_AUTO_RESOLVE_FAILED]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.SESSION_ALREADY_EXISTS]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.INCOMPATIBLE_GAMEPLAY_CONFIG]: HttpStatus.BAD_REQUEST,
-    // Health check errors
-    [InternalErrorCode.HEALTH_CHECK_FAILED]: HttpStatus.SERVICE_UNAVAILABLE,
-    //Jackpot errors
-    [InternalErrorCode.JACKPOT_TYPE_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.JACKPOT_TIER_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.JACKPOT_CONFIGURATION_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.JACKPOT_CONFIGURATION_IS_ACTIVE]: HttpStatus.BAD_REQUEST,
-    // RNG and Replay errors
-    [InternalErrorCode.RNG_SEED_NOT_FOUND]: HttpStatus.NOT_FOUND,
-    [InternalErrorCode.RNG_SEED_MISMATCH]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.MASTER_HASH_INVALID]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.REPLAY_OUTCOME_MISMATCH]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.JACKPOT_POOL_CONTRIBUTION_ALREADY_PROCESSED]: HttpStatus.INTERNAL_SERVER_ERROR,
-    [InternalErrorCode.JACKPOT_TYPE_DOES_NOT_SUPPORT_TIERS]: HttpStatus.BAD_REQUEST,
-    [InternalErrorCode.CONCURRENT_MODIFICATION]: HttpStatus.CONFLICT,
-    [InternalErrorCode.ACCOUNT_LOCKED]: HttpStatus.FORBIDDEN,
-    [InternalErrorCode.DAILY_LIMIT_EXCEEDED]: HttpStatus.UNPROCESSABLE_ENTITY,
-    [InternalErrorCode.INVALID_AMOUNT]: HttpStatus.BAD_REQUEST,
     [InternalErrorCode.SERVICE_UNAVAILABLE]: HttpStatus.SERVICE_UNAVAILABLE,
+    // Health check
+    [InternalErrorCode.HEALTH_CHECK_FAILED]: HttpStatus.SERVICE_UNAVAILABLE,
 };

package/dist/esm/common/error-handling/internal-error-code.js

@@ -1,77 +1,25 @@
+/**
+ * Error codes relevant to game engine services.
+ *
+ * Scoped to game-engine SDK concerns only.
+ * Platform-level codes (sessions, operators, jackpots, geo, etc.)
+ * belong in the RGS platform, not in individual engine services.
+ */
 export var InternalErrorCode;
 (function (InternalErrorCode) {
-    InternalErrorCode["FORBIDDEN"] = "FORBIDDEN";
-    InternalErrorCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
-    InternalErrorCode["INSUFFICIENT_FUNDS"] = "INSUFFICIENT_FUNDS";
-    InternalErrorCode["INVALID_CURRENCY_CODE"] = "INVALID_CURRENCY_CODE";
-    // Game Catalog errors
-    InternalErrorCode["GAME_NOT_FOUND"] = "GAME_NOT_FOUND";
-    InternalErrorCode["GAME_CONFIG_NOT_FOUND"] = "GAME_CONFIG_NOT_FOUND";
-    InternalErrorCode["GAME_CONFIG_ALREADY_EXISTS_WITH_SAME_JURISDICTION_AND_RTP"] = "GAME_CONFIG_ALREADY_EXISTS_WITH_SAME_JURISDICTION_AND_RTP";
-    InternalErrorCode["OPERATOR_GAME_NOT_FOUND"] = "OPERATOR_GAME_NOT_FOUND";
-    InternalErrorCode["OPERATOR_GAME_ALREADY_ENABLED"] = "OPERATOR_GAME_ALREADY_ENABLED";
-    InternalErrorCode["INVALID_GAME_CONFIG_DATA"] = "INVALID_GAME_CONFIG_DATA";
-    InternalErrorCode["INVALID_GAME_UPDATE_DATA"] = "INVALID_GAME_UPDATE_DATA";
-    InternalErrorCode["GAME_CODE_ALREADY_EXISTS"] = "GAME_CODE_ALREADY_EXISTS";
+    // Core game engine errors
     InternalErrorCode["GAME_ENGINE_ERROR"] = "GAME_ENGINE_ERROR";
-    InternalErrorCode["GAME_OR_GAME_CONFIG_DISABLED"] = "GAME_OR_GAME_CONFIG_DISABLED";
     InternalErrorCode["DEBUG_COMMANDS_DISABLED"] = "DEBUG_COMMANDS_DISABLED";
-    // Game Orchestrator errors
-    InternalErrorCode["INVALID_SESSION"] = "INVALID_SESSION";
-    InternalErrorCode["SESSION_NOT_FOUND"] = "SESSION_NOT_FOUND";
-    InternalErrorCode["SESSION_NOT_ACTIVE"] = "SESSION_NOT_ACTIVE";
-    InternalErrorCode["SESSION_MISMATCH"] = "SESSION_MISMATCH";
-    InternalErrorCode["INVALID_STATE_TRANSITION"] = "INVALID_STATE_TRANSITION";
-    InternalErrorCode["INVALID_BET_AMOUNT"] = "INVALID_BET_AMOUNT";
-    InternalErrorCode["REALITY_CHECK_IN_PROGRESS"] = "REALITY_CHECK_IN_PROGRESS";
-    InternalErrorCode["SESSION_TERMINATED"] = "SESSION_TERMINATED";
-    InternalErrorCode["SESSION_CANNOT_BE_TERMINATED"] = "SESSION_CANNOT_BE_TERMINATED";
-    InternalErrorCode["SESSION_AUTO_RESOLVE_FAILED"] = "SESSION_AUTO_RESOLVE_FAILED";
-    InternalErrorCode["SESSION_ALREADY_EXISTS"] = "SESSION_ALREADY_EXISTS";
-    InternalErrorCode["INCOMPATIBLE_GAMEPLAY_CONFIG"] = "INCOMPATIBLE_GAMEPLAY_CONFIG";
     InternalErrorCode["UNKNOWN_COMMAND"] = "UNKNOWN_COMMAND";
-    // Operator errors
-    InternalErrorCode["MISSING_OPERATOR_CODE"] = "MISSING_OPERATOR_CODE";
-    InternalErrorCode["INVALID_OPERATOR_CODE"] = "INVALID_OPERATOR_CODE";
-    InternalErrorCode["OPERATOR_NOT_FOUND"] = "OPERATOR_NOT_FOUND";
-    InternalErrorCode["OPERATOR_INACTIVE"] = "OPERATOR_INACTIVE";
-    InternalErrorCode["COUNTRY_CODE_RESTRICTED"] = "COUNTRY_CODE_RESTRICTED";
+    InternalErrorCode["INVALID_COMMAND"] = "INVALID_COMMAND";
+    // RNG integrity (GLI-19)
+    InternalErrorCode["INVALID_RNG_SEED"] = "INVALID_RNG_SEED";
+    // Infrastructure errors
+    InternalErrorCode["INTERNAL_SERVER_ERROR"] = "INTERNAL_SERVER_ERROR";
+    InternalErrorCode["FORBIDDEN"] = "FORBIDDEN";
     InternalErrorCode["UNAUTHORIZED"] = "UNAUTHORIZED";
-    InternalErrorCode["AUTH_VALIDATION_FAILED"] = "AUTH_VALIDATION_FAILED";
-    InternalErrorCode["BALANCE_NOT_FOUND"] = "BALANCE_NOT_FOUND";
-    InternalErrorCode["DEBIT_FAILED"] = "DEBIT_FAILED";
-    InternalErrorCode["CREDIT_FAILED"] = "CREDIT_FAILED";
-    InternalErrorCode["INVALID_AUTH_DATA"] = "INVALID_AUTH_DATA";
     InternalErrorCode["VALIDATION_ERROR"] = "VALIDATION_ERROR";
-    InternalErrorCode["JURISDICTION_CONFIG_ALREADY_EXISTS"] = "JURISDICTION_CONFIG_ALREADY_EXISTS";
-    InternalErrorCode["JURISDICTION_CONFIG_NOT_FOUND"] = "JURISDICTION_CONFIG_NOT_FOUND";
-    InternalErrorCode["OPERATOR_JURISDICTION_CONFIG_NOT_FOUND"] = "OPERATOR_JURISDICTION_CONFIG_NOT_FOUND";
-    // Game round log errors
-    InternalErrorCode["GAME_ROUND_LOG_NOT_FOUND"] = "GAME_ROUND_LOG_NOT_FOUND";
-    // Geo Validation errors
-    InternalErrorCode["COUNTRY_NOT_PERMITTED"] = "COUNTRY_NOT_PERMITTED";
-    InternalErrorCode["GEO_VALIDATION_SERVICE_UNAVAILABLE"] = "GEO_VALIDATION_SERVICE_UNAVAILABLE";
-    InternalErrorCode["RESOURCE_NOT_FOUND"] = "RESOURCE_NOT_FOUND";
-    // Financial transaction errors
-    InternalErrorCode["FINANCIAL_TRANSACTION_NOT_FOUND"] = "FINANCIAL_TRANSACTION_NOT_FOUND";
-    //Health check errors
-    InternalErrorCode["HEALTH_CHECK_FAILED"] = "HEALTH_CHECK_FAILED";
-    //Jackpot errors
-    InternalErrorCode["JACKPOT_TYPE_NOT_FOUND"] = "JACKPOT_TYPE_NOT_FOUND";
-    InternalErrorCode["JACKPOT_TIER_NOT_FOUND"] = "JACKPOT_TIER_NOT_FOUND";
-    InternalErrorCode["JACKPOT_CONFIGURATION_NOT_FOUND"] = "JACKPOT_CONFIGURATION_NOT_FOUND";
-    InternalErrorCode["JACKPOT_CONFIGURATION_IS_ACTIVE"] = "JACKPOT_CONFIGURATION_IS_ACTIVE";
-    InternalErrorCode["JACKPOT_POOL_CONTRIBUTION_ALREADY_PROCESSED"] = "JACKPOT_POOL_CONTRIBUTION_ALREADY_PROCESSED";
-    InternalErrorCode["JACKPOT_TYPE_DOES_NOT_SUPPORT_TIERS"] = "JACKPOT_TYPE_DOES_NOT_SUPPORT_TIERS";
-    // RNG and Replay errors
-    InternalErrorCode["RNG_SEED_NOT_FOUND"] = "RNG_SEED_NOT_FOUND";
-    InternalErrorCode["RNG_SEED_MISMATCH"] = "RNG_SEED_MISMATCH";
-    InternalErrorCode["MASTER_HASH_INVALID"] = "MASTER_HASH_INVALID";
-    InternalErrorCode["REPLAY_OUTCOME_MISMATCH"] = "REPLAY_OUTCOME_MISMATCH";
-    // Concurrency
-    InternalErrorCode["CONCURRENT_MODIFICATION"] = "CONCURRENT_MODIFICATION";
-    InternalErrorCode["ACCOUNT_LOCKED"] = "ACCOUNT_LOCKED";
-    InternalErrorCode["DAILY_LIMIT_EXCEEDED"] = "DAILY_LIMIT_EXCEEDED";
-    InternalErrorCode["INVALID_AMOUNT"] = "INVALID_AMOUNT";
     InternalErrorCode["SERVICE_UNAVAILABLE"] = "SERVICE_UNAVAILABLE";
+    // Health check
+    InternalErrorCode["HEALTH_CHECK_FAILED"] = "HEALTH_CHECK_FAILED";
 })(InternalErrorCode || (InternalErrorCode = {}));

package/dist/esm/common/logger/logger.js

@@ -66,25 +66,12 @@ export class Logger {
             return output;
         }));
     }
-    safeStringify(obj) {
-        try {
-            return JSON.stringify(obj, (key, value) => {
-                if (typeof value === 'bigint') {
-                    return value.toString();
-                }
-                return value;
-            });
-        }
-        catch (_error) {
-            return '[Object cannot be serialized]';
-        }
-    }
     getTransports() {
-        const logTransports = [new transports.Console()];
+        const consoleTransport = new transports.Console();
         if (process.env.LOG_TO_FILE === 'true') {
-            logTransports.push(new transports.File({ filename: 'logs/app.log' }));
+            return [consoleTransport, new transports.File({ filename: 'logs/app.log' })];
         }
-        return logTransports;
+        return [consoleTransport];
     }
     log(message, { level = 'info', ...rest } = {}) {
         switch (level) {

package/dist/esm/common/logger/logging.middleware.js

@@ -10,11 +10,23 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var LoggingMiddleware_1;
 import { Injectable } from '@nestjs/common';
 import { Logger } from './logger';
-const BLOCKED_ENDPOINTS = ['/api/races/active'];
+/** Endpoints to suppress from logging on success. Configurable via LOG_BLOCKED_ENDPOINTS env var (comma-separated). */
+const BLOCKED_ENDPOINTS = process.env.LOG_BLOCKED_ENDPOINTS
+    ? process.env.LOG_BLOCKED_ENDPOINTS.split(',').map(e => e.trim())
+    : [];
 const SENSITIVE_FIELDS = new Set([
-    'password', 'token', 'secret', 'authorization',
-    'apikey', 'api_key', 'accesstoken', 'refreshtoken',
-    'creditcard', 'ssn', 'private_key', 'privatekey',
+    'password',
+    'token',
+    'secret',
+    'authorization',
+    'apikey',
+    'api_key',
+    'accesstoken',
+    'refreshtoken',
+    'creditcard',
+    'ssn',
+    'private_key',
+    'privatekey',
 ]);
 function sanitize(obj) {
     if (obj === null || obj === undefined || typeof obj !== 'object')

package/dist/esm/common/metrics/prometheus.service.js

@@ -30,8 +30,9 @@ let PrometheusService = class PrometheusService {
         this.metricsRegistry = new Map();
         this.initializeRegistry();
     }
-    initializeMetricsFromDatabase() {
-        throw new Error('Method not implemented.');
+    async initializeMetricsFromDatabase() {
+        // No-op: Game engine metrics are initialized from Prometheus registry, not database.
+        // Override in subclass if database-backed metric initialization is needed.
     }
     initializeRegistry() {
         this.metricsRegistry.set('game_engine_commands_total', this.engineCommandsTotal);
@@ -68,8 +69,14 @@ let PrometheusService = class PrometheusService {
         }
         return metric;
     }
+    /**
+     * Returns Prometheus text format metrics from the default prom-client registry.
+     * The @willsoto/nestjs-prometheus module also exposes a /metrics HTTP endpoint
+     * automatically — this method is for programmatic access via the MetricsPort.
+     */
     async getMetrics() {
-        return '';
+        const { register } = await import('prom-client');
+        return register.metrics();
     }
 };
 PrometheusService = __decorate([

package/dist/esm/common/retry/retry-policy.js

@@ -21,7 +21,7 @@ export class RetryPolicy {
                 return result;
             }
             catch (error) {
-                const err = error;
+                const err = error instanceof Error ? error : new Error(String(error));
                 lastError = err;
                 if (!this.isRetryable(err)) {
                     throw err;
@@ -36,7 +36,9 @@ export class RetryPolicy {
                     try {
                         this.onRetry(attempt, err);
                     }
-                    catch { }
+                    catch (callbackError) {
+                        this.logger.debug(`onRetry callback threw: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`);
+                    }
                 }
                 await this.sleep(delay);
             }
@@ -46,8 +48,11 @@ export class RetryPolicy {
     isRetryable(error) {
         if (!this.retryableErrors || this.retryableErrors.length === 0)
             return true;
-        const causeCode = error?.cause?.code ?? '';
-        const text = `${error?.code ?? ''} ${error?.name ?? ''} ${error.message} ${causeCode}`;
+        const errorRecord = error;
+        const cause = errorRecord.cause;
+        const causeCode = typeof cause?.code === 'string' ? cause.code : '';
+        const errorCode = typeof errorRecord.code === 'string' ? errorRecord.code : '';
+        const text = `${errorCode} ${error.name} ${error.message} ${causeCode}`;
         return this.retryableErrors.some(pattern => text.includes(pattern));
     }
     calculateDelay(attempt) {

package/dist/esm/common/secrets-provider/secrets-provider.aws.js

@@ -50,7 +50,8 @@ let AwsSecretsProvider = AwsSecretsProvider_1 = class AwsSecretsProvider {
             this.logger.log(`Successfully loaded secrets from AWS Secrets Manager.`);
         }
         catch (error) {
-            this.logger.error(`Failed to retrieve secrets from AWS: ${error.message}`);
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            this.logger.error(`Failed to retrieve secrets from AWS: ${errorMessage}`);
             throw error;
         }
     }

package/dist/esm/generated/game-engine-registry_pb.js

@@ -1,27 +1,21 @@
-// @generated by protoc-gen-es v2.10.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
 // @generated from file game-engine-registry.proto (package game_engine_registry, syntax proto3)
 /* eslint-disable */
-import { fileDesc, messageDesc, serviceDesc } from '@bufbuild/protobuf/codegenv2';
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
 /**
  * Describes the file game-engine-registry.proto.
  */
-export const file_game_engine_registry = 
-/*@__PURE__*/
-fileDesc('ChpnYW1lLWVuZ2luZS1yZWdpc3RyeS5wcm90bxIUZ2FtZV9lbmdpbmVfcmVnaXN0cnkilgEKGVJlZ2lzdGVyR2FtZUVuZ2luZVJlcXVlc3QSEQoJZ2FtZV9jb2RlGAEgASgJEg8KB3ZlcnNpb24YAiABKAkSCwoDcnRwGAMgASgBEhEKCWdhbWVfdHlwZRgEIAEoCRIQCghncnBjX3VybBgFIAEoCRIRCglnYW1lX25hbWUYBiABKAkSEAoIcHJvdmlkZXIYByABKAkiTwoaUmVnaXN0ZXJHYW1lRW5naW5lUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBIUCgdtZXNzYWdlGAIgASgJSACIAQFCCgoIX21lc3NhZ2UylAEKGUdhbWVFbmdpbmVSZWdpc3RyeVNlcnZpY2USdwoSUmVnaXN0ZXJHYW1lRW5naW5lEi8uZ2FtZV9lbmdpbmVfcmVnaXN0cnkuUmVnaXN0ZXJHYW1lRW5naW5lUmVxdWVzdBowLmdhbWVfZW5naW5lX3JlZ2lzdHJ5LlJlZ2lzdGVyR2FtZUVuZ2luZVJlc3BvbnNlYgZwcm90bzM');
+export const file_game_engine_registry = /*@__PURE__*/ fileDesc("ChpnYW1lLWVuZ2luZS1yZWdpc3RyeS5wcm90bxIUZ2FtZV9lbmdpbmVfcmVnaXN0cnkilgEKGVJlZ2lzdGVyR2FtZUVuZ2luZVJlcXVlc3QSEQoJZ2FtZV9jb2RlGAEgASgJEg8KB3ZlcnNpb24YAiABKAkSCwoDcnRwGAMgASgBEhEKCWdhbWVfdHlwZRgEIAEoCRIQCghncnBjX3VybBgFIAEoCRIRCglnYW1lX25hbWUYBiABKAkSEAoIcHJvdmlkZXIYByABKAkiTwoaUmVnaXN0ZXJHYW1lRW5naW5lUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBIUCgdtZXNzYWdlGAIgASgJSACIAQFCCgoIX21lc3NhZ2UylAEKGUdhbWVFbmdpbmVSZWdpc3RyeVNlcnZpY2USdwoSUmVnaXN0ZXJHYW1lRW5naW5lEi8uZ2FtZV9lbmdpbmVfcmVnaXN0cnkuUmVnaXN0ZXJHYW1lRW5naW5lUmVxdWVzdBowLmdhbWVfZW5naW5lX3JlZ2lzdHJ5LlJlZ2lzdGVyR2FtZUVuZ2luZVJlc3BvbnNlYgZwcm90bzM");
 /**
  * Describes the message game_engine_registry.RegisterGameEngineRequest.
  * Use `create(RegisterGameEngineRequestSchema)` to create a new message.
  */
-export const RegisterGameEngineRequestSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine_registry, 0);
+export const RegisterGameEngineRequestSchema = /*@__PURE__*/ messageDesc(file_game_engine_registry, 0);
 /**
  * Describes the message game_engine_registry.RegisterGameEngineResponse.
  * Use `create(RegisterGameEngineResponseSchema)` to create a new message.
  */
-export const RegisterGameEngineResponseSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine_registry, 1);
+export const RegisterGameEngineResponseSchema = /*@__PURE__*/ messageDesc(file_game_engine_registry, 1);
 /**
  * @generated from service game_engine_registry.GameEngineRegistryService
  */

package/dist/esm/generated/game-engine_pb.js

@@ -1,56 +1,42 @@
-// @generated by protoc-gen-es v2.10.0 with parameter "target=ts"
+// @generated by protoc-gen-es v2.11.0 with parameter "target=ts"
 // @generated from file game-engine.proto (package game_engine, syntax proto3)
 /* eslint-disable */
-import { fileDesc, messageDesc, serviceDesc } from '@bufbuild/protobuf/codegenv2';
-import { file_google_protobuf_struct } from '@bufbuild/protobuf/wkt';
+import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_google_protobuf_struct } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file game-engine.proto.
  */
-export const file_game_engine = 
-/*@__PURE__*/
-fileDesc('ChFnYW1lLWVuZ2luZS5wcm90bxILZ2FtZV9lbmdpbmUi5QEKFVByb2Nlc3NDb21tYW5kUmVxdWVzdBIyCgxwdWJsaWNfc3RhdGUYASABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SACIAQESMwoNcHJpdmF0ZV9zdGF0ZRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAYgBARI0Cgdjb21tYW5kGAMgASgLMh4uZ2FtZV9lbmdpbmUuR2FtZUFjdGlvbkNvbW1hbmRIAogBAUIPCg1fcHVibGljX3N0YXRlQhAKDl9wcml2YXRlX3N0YXRlQgoKCF9jb21tYW5kImgKEUdhbWVBY3Rpb25Db21tYW5kEgoKAmlkGAEgASgJEgwKBHR5cGUYAiABKAkSLQoHcGF5bG9hZBgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAIgBAUIKCghfcGF5bG9hZCJKChBSbmdPdXRjb21lUmVjb3JkEg4KBnJlc3VsdBgBIAEoARIMCgRzZWVkGAIgASgJEgsKA21pbhgDIAEoARILCgNtYXgYBCABKAEirgMKFlByb2Nlc3NDb21tYW5kUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBIyCgxwdWJsaWNfc3RhdGUYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SACIAQESMwoNcHJpdmF0ZV9zdGF0ZRgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAYgBARItCgdvdXRjb21lGAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgCiAEBEhQKB21lc3NhZ2UYBSABKAlIA4gBARJICgtybmdfb3V0Y29tZRgGIAMoCzIzLmdhbWVfZW5naW5lLlByb2Nlc3NDb21tYW5kUmVzcG9uc2UuUm5nT3V0Y29tZUVudHJ5GlAKD1JuZ091dGNvbWVFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKAsyHS5nYW1lX2VuZ2luZS5SbmdPdXRjb21lUmVjb3JkOgI4AUIPCg1fcHVibGljX3N0YXRlQhAKDl9wcml2YXRlX3N0YXRlQgoKCF9vdXRjb21lQgoKCF9tZXNzYWdlIhoKGEdldEdhbWVFbmdpbmVJbmZvUmVxdWVzdCJfChlHZXRHYW1lRW5naW5lSW5mb1Jlc3BvbnNlEhEKCWdhbWVfY29kZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJEgsKA3J0cBgDIAEoARIRCglnYW1lX3R5cGUYBCABKAky0gEKEUdhbWVFbmdpbmVTZXJ2aWNlElkKDlByb2Nlc3NDb21tYW5kEiIuZ2FtZV9lbmdpbmUuUHJvY2Vzc0NvbW1hbmRSZXF1ZXN0GiMuZ2FtZV9lbmdpbmUuUHJvY2Vzc0NvbW1hbmRSZXNwb25zZRJiChFHZXRHYW1lRW5naW5lSW5mbxIlLmdhbWVfZW5naW5lLkdldEdhbWVFbmdpbmVJbmZvUmVxdWVzdBomLmdhbWVfZW5naW5lLkdldEdhbWVFbmdpbmVJbmZvUmVzcG9uc2ViBnByb3RvMw', [file_google_protobuf_struct]);
+export const file_game_engine = /*@__PURE__*/ fileDesc("ChFnYW1lLWVuZ2luZS5wcm90bxILZ2FtZV9lbmdpbmUisAIKFVByb2Nlc3NDb21tYW5kUmVxdWVzdBIyCgxwdWJsaWNfc3RhdGUYASABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SACIAQESMwoNcHJpdmF0ZV9zdGF0ZRgCIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAYgBARI0Cgdjb21tYW5kGAMgASgLMh4uZ2FtZV9lbmdpbmUuR2FtZUFjdGlvbkNvbW1hbmRIAogBARI1Cg9hZGRpdGlvbmFsX2RhdGEYBCABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SAOIAQFCDwoNX3B1YmxpY19zdGF0ZUIQCg5fcHJpdmF0ZV9zdGF0ZUIKCghfY29tbWFuZEISChBfYWRkaXRpb25hbF9kYXRhImgKEUdhbWVBY3Rpb25Db21tYW5kEgoKAmlkGAEgASgJEgwKBHR5cGUYAiABKAkSLQoHcGF5bG9hZBgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAIgBAUIKCghfcGF5bG9hZCJKChBSbmdPdXRjb21lUmVjb3JkEg4KBnJlc3VsdBgBIAEoARIMCgRzZWVkGAIgASgJEgsKA21pbhgDIAEoARILCgNtYXgYBCABKAEi+QMKFlByb2Nlc3NDb21tYW5kUmVzcG9uc2USDwoHc3VjY2VzcxgBIAEoCBIyCgxwdWJsaWNfc3RhdGUYAiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0SACIAQESMwoNcHJpdmF0ZV9zdGF0ZRgDIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIAYgBARItCgdvdXRjb21lGAQgASgLMhcuZ29vZ2xlLnByb3RvYnVmLlN0cnVjdEgCiAEBEhQKB21lc3NhZ2UYBSABKAlIA4gBARJICgtybmdfb3V0Y29tZRgGIAMoCzIzLmdhbWVfZW5naW5lLlByb2Nlc3NDb21tYW5kUmVzcG9uc2UuUm5nT3V0Y29tZUVudHJ5EjUKD2FkZGl0aW9uYWxfZGF0YRgHIAEoCzIXLmdvb2dsZS5wcm90b2J1Zi5TdHJ1Y3RIBIgBARpQCg9SbmdPdXRjb21lRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgLMh0uZ2FtZV9lbmdpbmUuUm5nT3V0Y29tZVJlY29yZDoCOAFCDwoNX3B1YmxpY19zdGF0ZUIQCg5fcHJpdmF0ZV9zdGF0ZUIKCghfb3V0Y29tZUIKCghfbWVzc2FnZUISChBfYWRkaXRpb25hbF9kYXRhIhoKGEdldEdhbWVFbmdpbmVJbmZvUmVxdWVzdCKEAQoZR2V0R2FtZUVuZ2luZUluZm9SZXNwb25zZRIRCglnYW1lX2NvZGUYASABKAkSDwoHdmVyc2lvbhgCIAEoCRILCgNydHAYAyABKAESEQoJZ2FtZV90eXBlGAQgASgJEhEKCWdhbWVfbmFtZRgFIAEoCRIQCghwcm92aWRlchgGIAEoCTLSAQoRR2FtZUVuZ2luZVNlcnZpY2USWQoOUHJvY2Vzc0NvbW1hbmQSIi5nYW1lX2VuZ2luZS5Qcm9jZXNzQ29tbWFuZFJlcXVlc3QaIy5nYW1lX2VuZ2luZS5Qcm9jZXNzQ29tbWFuZFJlc3BvbnNlEmIKEUdldEdhbWVFbmdpbmVJbmZvEiUuZ2FtZV9lbmdpbmUuR2V0R2FtZUVuZ2luZUluZm9SZXF1ZXN0GiYuZ2FtZV9lbmdpbmUuR2V0R2FtZUVuZ2luZUluZm9SZXNwb25zZWIGcHJvdG8z", [file_google_protobuf_struct]);
 /**
  * Describes the message game_engine.ProcessCommandRequest.
  * Use `create(ProcessCommandRequestSchema)` to create a new message.
  */
-export const ProcessCommandRequestSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 0);
+export const ProcessCommandRequestSchema = /*@__PURE__*/ messageDesc(file_game_engine, 0);
 /**
  * Describes the message game_engine.GameActionCommand.
  * Use `create(GameActionCommandSchema)` to create a new message.
  */
-export const GameActionCommandSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 1);
+export const GameActionCommandSchema = /*@__PURE__*/ messageDesc(file_game_engine, 1);
 /**
  * Describes the message game_engine.RngOutcomeRecord.
  * Use `create(RngOutcomeRecordSchema)` to create a new message.
  */
-export const RngOutcomeRecordSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 2);
+export const RngOutcomeRecordSchema = /*@__PURE__*/ messageDesc(file_game_engine, 2);
 /**
  * Describes the message game_engine.ProcessCommandResponse.
  * Use `create(ProcessCommandResponseSchema)` to create a new message.
  */
-export const ProcessCommandResponseSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 3);
+export const ProcessCommandResponseSchema = /*@__PURE__*/ messageDesc(file_game_engine, 3);
 /**
  * Describes the message game_engine.GetGameEngineInfoRequest.
  * Use `create(GetGameEngineInfoRequestSchema)` to create a new message.
  */
-export const GetGameEngineInfoRequestSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 4);
+export const GetGameEngineInfoRequestSchema = /*@__PURE__*/ messageDesc(file_game_engine, 4);
 /**
  * Describes the message game_engine.GetGameEngineInfoResponse.
  * Use `create(GetGameEngineInfoResponseSchema)` to create a new message.
  */
-export const GetGameEngineInfoResponseSchema = 
-/*@__PURE__*/
-messageDesc(file_game_engine, 5);
+export const GetGameEngineInfoResponseSchema = /*@__PURE__*/ messageDesc(file_game_engine, 5);
 /**
  * @generated from service game_engine.GameEngineService
  */

package/dist/esm/grpc/connect-router.middleware.js

@@ -3,14 +3,20 @@ import { GameEngineService } from '../generated/game-engine_pb';
 /**
  * Creates Connect router middleware for GameEngineService.
  * This replaces NestJS built-in gRPC transport with Connect-compatible server.
+ *
+ * @param gameEngineAdapter - The gRPC adapter handling game engine requests
+ * @param options - Optional configuration including additional route registration
  */
-export function createConnectRouter(gameEngineAdapter) {
+export function createConnectRouter(gameEngineAdapter, options) {
     return connectNodeAdapter({
         routes: router => {
             router.service(GameEngineService, {
                 processCommand: gameEngineAdapter.processCommand.bind(gameEngineAdapter),
                 getGameEngineInfo: gameEngineAdapter.getGameEngineInfo.bind(gameEngineAdapter),
             });
+            if (options?.additionalRoutes) {
+                options.additionalRoutes(router);
+            }
         },
     });
 }