@odatano/x402 0.3.0 → 0.4.0

package/srv/middleware/cap.js

@@ -72,6 +72,32 @@ function getResourceUrl(req, opts) {
     const httpReq = req;
     return httpReq.http?.req?.originalUrl ?? httpReq.http?.req?.url ?? `cap://${req.event}`;
 }
+function getHttpRes(req) {
+    return req.http?.res;
+}
+/**
+ * Emit a 402 with the canonical x402 v2 body on the wire.
+ *
+ * When an Express response is reachable we write the body ourselves so
+ * third-party x402 clients see `{ x402Version: 2, accepts: [...] }` at
+ * the top level rather than CAP's OData-wrapped `{ error: { message:
+ * "<v2-json-string>", ... } }`. The `req.reject` call is always made:
+ * its synchronous throw is what terminates CAP's handler pipeline (so
+ * the gated `on` handler never runs); CAP's own render attempt no-ops
+ * because `headersSent` is already true. Validated against `@sap/cds ^9`.
+ *
+ * For non-HTTP transports (event invocations, `$batch` reuse, tests
+ * without `http.res`) we skip the direct write and let `req.reject` do
+ * the whole job — the wrap is irrelevant when there's no HTTP buyer.
+ */
+function send402(req, body) {
+    const httpRes = getHttpRes(req);
+    if (httpRes && !httpRes.headersSent) {
+        httpRes.status(402).json(body);
+    }
+    req
+        .reject(402, JSON.stringify(body));
+}
 /**
  * Attach the x402 gate to a CAP ApplicationService. Returns the service
  * (chainable) so callers can fluently wire multiple middlewares.
@@ -207,8 +233,7 @@ function gateService(srv, opts) {
             if (result.txHash)
                 body.transaction = result.txHash;
         }
-        req
-            .reject(402, JSON.stringify(body));
+        send402(req, body);
     });
     return srv;
 }