@sap/cds-dk 10.0.7 → 10.1.1

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,49 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.1.0 - 2026-09-02
+
+### Added
+
+- New `sqlite:memory` preset for `cds.requires.db` runs an in-memory SQLite database, now also in production
+- New `hana-serverless` kind for `cds.requires.db` connects to a HANA Cloud serverless instance (Beta)
+- Node.js-native `fetch` client now resolves named destinations through the SAP BTP Destination service for `NoAuthentication`, `BasicAuthentication`, and `OAuth2ClientCredentials` (proxy type `Internet` only) (beta)
+
+### Changed
+
+- `cds.spawn` uses dedicated, short-lived transaction for fetching extended models
+- Messaging webhook endpoints are no longer registered anonymously in production when neither `cds.requires.auth` nor `cds.requires.messaging.xsuaa` is configured.
+- UCL tenant mapping notification handlers will be scheduled as `tenant: receiverTenant` instead of anonymously
+
+### Fixed
+
+- `@assert` messages using `{i18n>...}` placeholders are no longer mistaken for structured `error(...)` results
+- JSON `$batch` requests now reject invalid `atomicityGroup` identifiers
+- Scheduling a task via `srv.schedule(...).after(<delay>)` or `.every(<interval>)` with a delay above Node's 32-bit `setTimeout` limit (~24.8 days, e.g. `.after('30d')`) no longer emits a `TimeoutOverflowWarning` or fires almost immediately. Such delays are now armed as chained timers, so the task still fires at its exact scheduled time.
+- OData requests with unknown key names in the key predicate (e.g. `Books(ID=1,sad=2)`) are now rejected with `400 Bad Request` instead of causing a `500` error
+- `cds-rc.js` schema now has a `$id` so `jsonschema` 1.5 resolves internal `$ref`s correctly
+- REST `HEAD` responses now report byte-accurate `Content-Length` headers for Unicode JSON payloads
+- Query properties like `limit` and `recurse` are no longer lost when forwarded to remote services
+- `cds.requires.<name>.service = <name>` (a required service naming itself) no longer fails with a spurious `conflicts with` error on server start
+- `UPDATE` and `DELETE` remote-service-queries, that use `.where` instead of a key to specify their subject, will throw
+- Navigating to or creating under a parent protected by an instance-based `@restrict.where` now returns `404` when the parent is not readable
+- A static `@restrict.where` on a collection-bound action is now enforced, rejecting callers who do not satisfy the condition — previously it was silently ignored
+
+### Removed
+
+- UCL GraphQL interface adapter as dead code after UCL deprecated the GraphQL on-boarding flow
+
+## Version 10.0.6 - 2026-08-18
+
+### Fixed
+
+- `$apply=filter(...)/groupby(...)/aggregate($count)` with non-UTC `DateTimeOffset` filter values now returns correct results on HANA
+- Generated index page now uses relative hrefs, fixing links when served behind an approuter with a path prefix
+- `$batch` sub-requests returned an empty body and headers when `@opentelemetry/instrumentation-express` (or any instrumentation that wraps Express handlers to arity 2) was active
+- `cds.xt.ModelProviderService` can be served in mtx sidecar
+- Modeled service events were not properly ignored in OData adapter
+- Generic handler for draft-specific actions not correctly being bound to the transaction context
+
 ## Version 10.0.5 - 2026-07-28
 
 ### Fixed
@@ -143,6 +186,20 @@
 - Internal `_initial` phase
 - Removed support for `async activate()` functions returned from `cds-plugin.js` modules, which was never documented, and deprecated since Oct 2023. If you need to run async code during plugin loading, just return a promise as default export.
 
+## Version 9.9.3 - 2026-07-21
+
+### Fixed
+
+- Fixed context propagation for local app and remote service calls
+
+## Version 9.9.2 - 2026-06-29
+
+### Fixed
+
+- `srv.model` propagation in extensibility scenarios
+- Restored `err.target:'in'` during draft activation with `cds.fiori.draft_messages=false` to avoid the `MULTIPLE_ERRORS` popup
+- `resolveView` prioritizes the original foreign key `parent_ID` if exposed multiple times, e.g., through `*, parent.ID as parentId`
+
 ## Version 9.9.1 - 2026-04-29
 
 ### Fixed

package/node_modules/@sap/cds/app/index.js

@@ -2,7 +2,8 @@ const cds = require('../lib')
 const { find, path, fs } = cds.utils
 
 const odata = endpoint => endpoint.kind.startsWith('odata')
-const metadata = endpoint => odata(endpoint) ? `<span>/</span> <a href="${endpoint.path}/$metadata"><span>$metadata</span></a>` : ``
+const rel = path => path.replace(/^\//, '')
+const metadata = endpoint => odata(endpoint) ? `<span>/</span> <a href="${rel(endpoint.path)}/$metadata"><span>$metadata</span></a>` : ``
 const asHtmlId = s => s.replace(/[.:/$&?@]/g, '_').toLowerCase()
 
 module.exports = { get html(){
@@ -22,12 +23,12 @@ module.exports = { get html(){
   .map (({srv, endpoint}) => `
       <div id="${asHtmlId(srv.name)}-${endpoint.kind}">
         <h3 class="header">
-          <a href="${endpoint.path}"><span>${endpoint.path}</span></a>${metadata(endpoint)} ${_moreLinks(srv, endpoint, undefined, false)}
+          <a href="${rel(endpoint.path)}"><span>${endpoint.path}</span></a>${metadata(endpoint)} ${_moreLinks(srv, endpoint, undefined, false)}
         </h3>
         <ul>${_entities_in(srv).map (e => `
           <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e)}">
             <div>
-              <a href="${endpoint.path}/${e.replace(/\./g, '_')}"><span>${e}</span></a>
+              <a href="${rel(endpoint.path)}/${e.replace(/\./g, '_')}"><span>${e}</span></a>
             </div>
             ${_moreLinks(srv, endpoint, e)}
           </li>`).join('')}
@@ -35,7 +36,7 @@ module.exports = { get html(){
         <ul>${_operations_in(srv).map (e => `
           <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e.name)}" class="operation">
             <div>
-              <a href="${endpoint.path}/${e.name}" title="${endpoint.path}/${e.name}"><span>${e.name} ${e.params}</span></a>
+              <a href="${rel(endpoint.path)}/${e.name}" title="${endpoint.path}/${e.name}"><span>${e.name} ${e.params}</span></a>
             </div>
           </li>`).join('')}
         </ul>

package/node_modules/@sap/cds/eslint.config.mjs

@@ -80,6 +80,7 @@ export const tests = { name: '@cap/eslint/tests',
   languageOptions: {
     globals: {
       mocha: 'readonly',
+      vi: 'readonly',
       jest: 'readonly',
       expect: 'readonly',
       describe: 'writable',

package/node_modules/@sap/cds/lib/compile/minify.js

@@ -17,7 +17,7 @@ class Minifier {
     if (skip_unused === 'services') o.services = 'all'
     const all = new Map (Object.entries( this.defs ??= csn.definitions || {} ))
     const children = (n,fn,pre=n+'.') => { for (let [n,d] of all) if (n.startsWith(pre)) fn (n,d) }
-    const keep = (d,kinds) => d.kind in kinds || _can_minify(d)
+    const _keep = (d,kinds) => d.kind in kinds || d['@cds.minify'] === false
     const _own = o.keep ??= { entity:1, type:1, event:1, action:1, function:1 }
     const _ext = { event:1, action:1, function:1 }
     const kept = this.kept = csn.definitions = {}
@@ -31,16 +31,23 @@ class Minifier {
       }
     } else {
       // Otherwise first mark all external services and their children as initially skipped
-      for (let [s,d] of all) if (d.kind === 'service' && _skip_service(s,d)) {
-        skipped[s] = 0; children (s, (c,d) => keep(d,_ext) ? this.keep(c,d,s) : skipped[c] = s) // used later on in this.keep()
+      for (let [s,d] of all) if (d.kind === 'service' && d['@cds.external'] >= 2) {
+        if (d['@cds.minify'] === false) continue
+        else skipped[s] = 0
+        children (s, (c,d) => _keep(d,_ext) ? this.keep(c,d,s) : skipped[c] = s) // used later on in this.keep()
       }
       // Then keep all own services and their children
-      for (let [s,d] of all) if (d.kind === 'service' && !(s in skipped)) {
-        this.keep(s,d); children (s, (c,d) => keep(d,_own) ? this.keep(c,d) : skipped[c] = 0)
+      for (let [s,d] of all) if (d.kind === 'service') {
+        if (s in skipped) continue
+        else this.keep(s,d)
+        children (s, (c,d) => _keep(d,_own) ? this.keep(c,d) : skipped[c] = 0)
       }
       // Also keep remaining non-service entities
-      for (let [e,d] of all) if (d.kind === 'entity' || !_can_minify(d)) {
-        e in kept || e in skipped || _skip_entity(e,d) || this.keep(e,d)
+      for (let [e,d] of all) if (d.kind === 'entity' || d['@cds.minify'] === false) {
+        if (e in skipped || e in kept) continue //> skip already kept or skipped definitions
+        if (d['@cds.persistence.skip'] === 'if-unused') continue //> skip initially, they are kept by reference if used
+        if (e.endsWith('.texts')) continue //> skip texts entities, they are kept by reference if used
+        else this.keep(e,d)
       }
     }
 
@@ -106,7 +113,4 @@ class Minifier {
 
 }
 
-const _skip_service = (s,d) => (d['@cds.external'] >= 2) && _can_minify(d)
-const _skip_entity = (e,d) => (d['@cds.external'] >= 2 || d['@cds.persistence.skip'] === 'if-unused') && _can_minify(d) || e.endsWith('.texts')
-const _can_minify = d => d['@cds.minify'] !== false
 exports.Minifier = Minifier

package/node_modules/@sap/cds/lib/env/cds-env.js

@@ -524,7 +524,7 @@ function _merge (dst, src, _profiles) {
     }
     else if (v !== undefined) dst[p] = v
   }
-  if (profiled.length > 0 && !_profiles.has('production')) {
+  if (profiled.length > 1 && !_profiles.has('production')) {
     const profiles = Array.from(_profiles)
     profiled.sort((a,b) => profiles.indexOf(b.profile) - profiles.indexOf(a.profile))
   }

package/node_modules/@sap/cds/lib/env/cds-requires.js

@@ -24,7 +24,8 @@ exports = module.exports = {
   _resolved() {
     const requires = { __proto__: this }
     for (let [name,e] of Object.entries(this)) if (e.service) {
-      if (!(e.service in requires) || e.override || e.service !== name) requires[e.service] = { ...e, name }
+      if (e.service === name) continue
+      if (!(e.service in requires) || e.override) requires[e.service] = { ...e, name }
       else throw new Error (`Config 'cds.requires.${name}.service = ${e.service}' conflicts with 'cds.requires.${e.service}'`)
     }
     return requires
@@ -127,9 +128,10 @@ const _db_data = {
 
 const _databases = {
 
-  "db-defaults": { kind: 'sql', ..._db_data }, //> applied only for cds.requires.db: true 
-  
+  "db-defaults": { kind: 'sql', ..._db_data }, //> applied only for cds.requires.db: true
+
   "sql": {
+    // REVISIT: should be '[development]': { kind: 'sqlite:memory' },
     '[development]': { kind: 'sqlite', credentials: { url: ':memory:' } },
     '[production]': { kind: 'hana' },
   },
@@ -138,22 +140,33 @@ const _databases = {
     impl: '@cap-js/sqlite', credentials: { url: 'db.sqlite' },
     ..._db_data,
   },
+  "sqlite:memory": {
+    kind: 'sqlite', credentials: { url: ':memory:' },
+  },
   "hana": {
     impl: '@cap-js/hana',
     ..._db_data,
   },
   "hana-cloud": {
-    kind: 'hana', "deploy-format": "hdbtable",
+    kind: 'hana',
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
+  },
+  "hana-serverless": {
+    kind: 'hana',
+    serverless: true,
+    vcap: { label: 'hana-cloud', plan: 'serverless' },
+    dialect: "hana", //> REVISIT: why needed?
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
   },
+
   "sql-mt": { // For compatibility only
     '[development]': { kind: 'sqlite' },
     '[production]': { kind: 'hana-mt' },
   },
   "hana-mt": { // For compatibility only
-    kind: 'hana', "deploy-format": "hdbtable",
-    "vcap": {
-      "label": "service-manager"
-    }
+    kind: 'hana',
+    "vcap": { "label": "service-manager" },
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
   },
 }
 
@@ -277,12 +290,10 @@ const _messaging = {
 const _platform_services = {
 
   ucl: {
-    model: '@sap/cds/srv/ucl-service.cds',
+    model: '@sap/cds/srv/ucl-service.cds'
     // REVISIT: how to configure such that a cds.connect.to('ucl') returns the already initialized UCLService?
     // service: 'UCLService',
     // impl: `${_runtime}/ucl/Service.js`,
-    // REVISIT: remove default as only needed for push mode
-    vcap: { label: 'xsuaa' }
   },
 
   destinations: {

package/node_modules/@sap/cds/lib/env/defaults.js

@@ -35,11 +35,11 @@ module.exports = exports = {
     sql_simple_queries: 0,
     pre_compile_edmxs: false,
     live_reload: !production,
-    in_memory_db: !production,
     test_data: !production,
     test_mocks: !production,
     with_mocks: !production,
     mocked_bindings: !production,
+    in_memory_db: true,
     // skip_unused: 'all',
     skip_unused: true,
     deploy_data_onconflict: 'insert',
@@ -223,6 +223,9 @@ module.exports = exports = {
 
   remote: {
     native_fetch: undefined,
+    timeout: '10s',
+    cache_size: 0,
+    cache_expiry_buffer: '5min',
   },
 
 }

package/node_modules/@sap/cds/lib/env/schemas/cds-rc.js

@@ -3,6 +3,7 @@ const cds = require('../../index')
 module.exports = {
   _version: cds.version,
 
+  $id: 'cdsjsonschema://schemas/cds-rc.json',
   title: 'JSON schema for CDS configuration',
   $schema: 'https://json-schema.org/draft-07/schema',
   description: 'This is a JSON schema representation for CDS project configuration',
@@ -961,12 +962,14 @@ module.exports = {
       enum: [
         'hana',
         'sql',
-        'sqlite'
+        'sqlite',
+        'sqlite:memory'
       ],
       enumDescriptions: [
         'SAP HANA',
         'In-memory SQLite (development), SAP HANA (production)',
-        'File-based SQLite'
+        'File-based SQLite',
+        'In-memory SQLite'
       ]
     },
 

package/node_modules/@sap/cds/lib/plugins.js

@@ -1,6 +1,12 @@
 const DEBUG = /\b(y|all|plugins)\b/.test(process.env.DEBUG) ? console : undefined // eslint-disable-line no-console
 const cds = require('.')
 
+const prioritized = {
+  '@sap/cds-mtxs': true,    // plugins may register handlers for mtxs services
+  '@cap-js/sqlite': true,   // to enable override by @cap-js/ai
+  '@cap-js/telemetry': true // to allow better instrumentation
+}
+
 /**
  * Fetch cds-plugins from project's package dependencies.
  * Called in cds.env to populate the plugins configuration
@@ -8,7 +14,7 @@ const cds = require('.')
  */
 exports.fetch = function (DEV = process.env.NODE_ENV !== 'production') {
   DEBUG?.time ('[cds.plugins] - fetched plugins in')
-  const plugins = JSON.parse(process.env.CDS_PLUGINS||'{}')
+  let plugins = JSON.parse(process.env.CDS_PLUGINS||'{}')
   fetch_plugins_in (cds.home, false)
   fetch_plugins_in (cds.root, DEV)
   function fetch_plugins_in (root, dev) {
@@ -19,6 +25,8 @@ exports.fetch = function (DEV = process.env.NODE_ENV !== 'production') {
       plugins[each] = { impl }
     } catch { /* no cds-plugin.js */ }
   }
+  for (const each in prioritized)
+    if (each in plugins) plugins = Object.assign({ [each]: plugins[each] }, plugins)
   DEBUG?.timeEnd ('[cds.plugins] - fetched plugins in')
   return plugins
 }
@@ -30,10 +38,6 @@ exports.fetch = function (DEV = process.env.NODE_ENV !== 'production') {
 exports.activate = async function (plugins = cds.env?.plugins || exports.fetch()) {
   DEBUG?.time ('[cds.plugins] - loaded plugins in')
   const all = Object.entries(plugins), { local } = cds.utils
-  const prioritized = {
-    '@sap/cds-mtxs': true,    // plugins may register handlers for mtxs services
-    '@cap-js/telemetry': true // to allow better instrumentation
-  }
   await Promise.all (all.map (([n,c]) => n in prioritized && _load(n,c)))
   await Promise.all (all.map (([n,c]) => n in prioritized || _load(n,c)))
   async function _load (plugin, conf) {

package/node_modules/@sap/cds/lib/req/spawn.js

@@ -12,7 +12,7 @@ module.exports = function spawn (o, fn, /** @type {import('../index')} */ cds=th
       if (cds.model && (cds.env.requires.extensibility || cds.env.requires.toggles)) {
         const ctx = cds.context
         const ExtendedModels = require('../srv/srv-models') // the sentinel is automatically started when required
-        cds.context.model = await ExtendedModels.model4(ctx.tenant, ctx.features)
+        cds.context.model = await cds.tx(() => ExtendedModels.model4(ctx.tenant, ctx.features))
         tx.model = cds.context.model
       }
       return Promise.resolve(fn(tx))

package/node_modules/@sap/cds/lib/srv/srv-dispatch.js

@@ -113,5 +113,5 @@ const _ensure_fqn = (x,p,srv, name = x[p]) => {
 
 const _unhandled = (srv,req) => {
   const event = req.event + (req.path ? ' ' + req.path : '')
-  return req.reject (501, `Service "${srv.name}" has no handler for "${event}".`)
+  cds.error (501, `Service "${srv.name}" has no handler for "${event}".`)
 }

package/node_modules/@sap/cds/lib/srv/srv-models.js

@@ -148,7 +148,7 @@ if (!extensibility) {
 // helper to get model for tenant/features
 const _is_extended = extensibility ? ()=> cds.db.exists('cds.xt.Extensions') : ()=> false
 const _get_model4 = async (tenant, features) => {
-  const { 'cds.xt.ModelProviderService':mps } = cds.services
+  const mps = await cds.connect.to('cds.xt.ModelProviderService')
   const csn = await mps.getCsn (tenant, features)
   const nsn = cds.compile.for.nodejs(csn)
   if (cds.edmxs) await cds.compile.to.edmx.files ( csn,

package/node_modules/@sap/cds/lib/utils/cds-utils.js

@@ -389,7 +389,8 @@ exports.sh = function shell (cmd,..._) {
  */
 const ms4 = exports.ms4 = (ts, unit, u=unit) => {
   if (typeof ts === 'string') [,ts,u] = /(\d+) ?(\w*)/.exec(ts) || cds.error `Invalid time span format: ${ts}`
-  return ts * ms4[u||unit||'ms'] || cds.error `Invalid time span unit: ${unit} in ${ts}`
+  const factor = ms4[u||unit||'ms'] || cds.error `Invalid time span unit: ${unit} in ${ts}`
+  return ts * factor
 }
 
 /**

package/node_modules/@sap/cds/libx/_runtime/common/generic/assert.js

@@ -132,9 +132,8 @@ module.exports = cds.service.impl(function () {
               // If error function was used in @assert expression -> use its output
               // Note: depending on DB, function result may be JavaScript object or JSON string
               if (typeof message === 'string') {
-                if (message[0] === '{')
-                  message = JSON.parse(message) //> it's an error function result
-                else return error //> it's a plain message string
+                if (message[0] !== '{' || message.startsWith('{i18n>')) return error //> it's a plain message string
+                message = JSON.parse(message) //> it's an error function result
               }
               let { targets = [], ...details } = message
               if (targets.length) details.target = targets.shift()

package/node_modules/@sap/cds/libx/_runtime/common/generic/auth/restrict.js

@@ -238,7 +238,14 @@ async function enforce_auth(req) {
   // REVISIT with cds^11
   // - remove compat_static_auth
   // - make check on CREATE/ NEW and unbound a compat opt-in
-  if (cds.env.features.compat_static_auth || req.event in { CREATE: 1, NEW: 1 } || this.operations[req.event]) {
+  const boundAction = req.target?.actions?.[req.event]
+  if (
+    cds.env.features.compat_static_auth ||
+    req.event in { CREATE: 1, NEW: 1 } ||
+    this.operations[req.event] ||
+    // collection-bound actions have no instance to filter -> only a static where can apply
+    (boundAction && isBoundToCollection(boundAction))
+  ) {
     const staticAuthRestriction = _getStaticAuthRestrictions(resolvedApplicables)
     if (staticAuthRestriction.length > 0) {
       return _handleStaticAuthRestrictions(staticAuthRestriction, req)

package/node_modules/@sap/cds/libx/_runtime/common/generic/crud.js

@@ -2,6 +2,8 @@ const cds = require('../../cds')
 const { SELECT } = cds.ql
 
 module.exports = exports = cds.service.impl(function () {
+  const { parent_skip_auth } = cds.env.features
+
   // prettier-ignore
   this.on(['CREATE', 'READ', 'UPDATE', 'UPSERT', 'DELETE'], '*', async function handle_crud_requests(req) {
     if (!cds.db)
@@ -11,18 +13,26 @@ module.exports = exports = cds.service.impl(function () {
     if (req.target['@cds.persistence.skip'] === true && req.target['@cds.persistence.table'] !== true)
       return req.reject(501, `Entity "${req.target.name}" is annotated with "@cds.persistence.skip" and cannot be served generically.`)
 
-    const { ref } = req.query.INSERT?.into || req.query.SELECT?.from || {}
-    const check_parent = ref?.length > 1 ? SELECT.one(1).from({ ref: ref.slice(0, -1) }) : null
-    if (check_parent && req.event === 'CREATE') (await check_parent) || req.reject(404)
-    else if (req.target?._isSingleton) await handle_singleton_request(req)
-    else if (req.query?.SELECT && req.locale) req.query.SELECT.localized ??= true
+    const { ref } = req.query?.INSERT?.into || req.query?.SELECT?.from || {}
+    const parent_exists_query = ref?.length > 1 && !('$parent' in (req.query?.elements ?? {}))
+      ? SELECT.one`1 as $parent`.from({ ref: ref.slice(0, -1) })
+      : null
+    const parent_readable_check = parent_exists_query
+      ? async () => (parent_skip_auth ? cds.db : this).run(parent_exists_query).catch(() => null)
+      : null
+
+    if (req.event === 'CREATE' && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
+
+    if (req.target?._isSingleton) await handle_singleton_request(req)
+
+    if (req.query?.SELECT && req.locale) req.query.SELECT.localized ??= true
 
     // REVISIT for cds^10: can we always use cds.db.dispatch(req)?
     const result = req.iterator && !req.objectMode
       ? await cds.db.dispatch(req)
       : await cds.run(req.query, req.data)
 
-    return await exports._handle_result(req, result, check_parent)
+    return await exports._handle_result(req, result, parent_readable_check)
   })
 })
 
@@ -42,14 +52,14 @@ async function handle_singleton_request(req) {
   req.query.where(singleton)
 }
 
-async function new_behavior(req, result, parent) {
+async function new_behavior(req, result, parent_readable_check) {
   const n = result?.affected ?? result?.length ?? result
 
   // prettier-ignore
   switch (req.event) {
     case 'READ':
       if (!n && req._etagValidationType === 'if-match') req.reject(412)
-      if (!n) !parent || (await parent) || req.reject(404)
+      if (!n && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
       return result
     case 'INSERT': case 'CREATE':
       if (result.affected != null) return result //> db service returned [affected]

package/node_modules/@sap/cds/libx/_runtime/fiori/lean-draft.js

@@ -453,7 +453,7 @@ const compileUpdatedDraftMessages = (newMessages, persistedMessages, requestData
   if (!prefixRef) return null
 
   const draftMessageTargetPrefix = cds.odata.urlify(
-    { SELECT: { from: { ref: prefixRef } } },
+    { query: { SELECT: { from: { ref: prefixRef } } }, subject: { ref: prefixRef } },
     { kind: 'odata-v4', model: txModel }
   ).path
 
@@ -483,7 +483,7 @@ const compileUpdatedDraftMessages = (newMessages, persistedMessages, requestData
     }
 
     message.prefix = cds.odata.urlify(
-      { SELECT: { from: { ref: messagePrefixRef } } },
+      { query: { SELECT: { from: { ref: messagePrefixRef } } }, subject: { ref: messagePrefixRef } },
       { kind: 'odata-v4', model: txModel }
     ).path
 
@@ -1437,11 +1437,11 @@ const Read = {
 
           // TODO: This seems excessive ... how to compare more efficiently?
           const queryPrefixUrl = cds.odata.urlify(
-            { SELECT: { from: { ref: queryPrefixRef } } },
+            { query: { SELECT: { from: { ref: queryPrefixRef } } }, subject: { ref: queryPrefixRef } },
             { kind: 'odata-v4', model: txModel }
           ).path
           const msgPrefixUrl = cds.odata.urlify(
-            { SELECT: { from: { ref: msgPrefixRef } } },
+            { query: { SELECT: { from: { ref: msgPrefixRef } } }, subject: { ref: msgPrefixRef } },
             { kind: 'odata-v4', model: txModel }
           ).path
 
@@ -2443,7 +2443,7 @@ async function onCancel(req, next) {
 
         const prefixRef = _extractPrefixRef(req.query.DELETE.from.ref, queryRootEntity)
         const messageTargetPrefix = cds.odata.urlify(
-          { SELECT: { from: { ref: prefixRef } } },
+          { query: { SELECT: { from: { ref: prefixRef } } }, subject: { ref: prefixRef } },
           { kind: 'odata-v4', model: req.context.tx.model }
         ).path
 
@@ -2570,6 +2570,7 @@ const _readAfterDraftAction = async function ({ req, payload, action }) {
   }
 }
 
+// prettier-ignore
 module.exports = cds.service.impl(function () {
   if (!this.entities?.DraftAdministrativeData) return
 
@@ -2577,14 +2578,17 @@ module.exports = cds.service.impl(function () {
   Object.defineProperty(this, '_datasource', { value: cds.db })
 
   // Extend the AppService's API by draft specific functions
-  this.new = (draft, key) => ({
-    then: (r, e) => this.send('NEW', draft, key).then(r, e),
-    for: key => this.send('EDIT', typeof draft === 'string' ? draft.replace(/\.drafts$/, '') : draft.actives, key)
-  })
-  this.edit = (active, key) => this.send('EDIT', active, key)
-  this.save = (draft, key) => this.send('SAVE', draft, key)
-  this.cancel = (draft, key) => this.send('CANCEL', draft, key)
-  this.discard = (draft, key) => this.send('DISCARD', draft, key)
+  this.new = function (draft, key) {
+    return {
+      then: (r, e) => this.send('NEW', draft, key).then(r, e),
+      for: key => this.send('EDIT', typeof draft === 'string' ? draft.replace(/\.drafts$/, '') : draft.actives, key)
+    }
+  }
+
+  this.edit = function (active, key) { return this.send('EDIT', active, key) }
+  this.save = function (draft, key) { return this.send('SAVE', draft, key) }
+  this.cancel = function (draft, key) { return this.send('CANCEL', draft, key) }
+  this.discard = function (draft, key) { return this.send('DISCARD', draft, key) }
 
   // Override the AppService's handle function
   this.handle = !cds.env.features.legacy_srv_results
@@ -2596,9 +2600,13 @@ module.exports = cds.service.impl(function () {
         return Array.isArray(res) && 'affected' in res ? req.data : res
       }
 
-  this.on('NEW', '*', onNew.bind(this))
-  this.on('EDIT', '*', onEdit.bind(this))
-  this.on('CANCEL', '*', onCancel.bind(this))
-  this.on('draftPrepare', '*', onPrepare.bind(this))
+  // NOTE: These handler registrations MUST use inline functions
+  // NOTE: > Arrow functions or functions bound with `.bind` will 
+  // NOTE: > ... not be able to access the context tx from `this` 
+  this.on('NEW', '*', function (req, next) { return onNew.call(this, req, next) })
+  this.on('EDIT', '*', function (req, next) { return onEdit.call(this, req, next) })
+  this.on('CANCEL', '*', function (req, next) { return onCancel.call(this, req, next) })
+  this.on('draftPrepare', '*', function (req, next) { return onPrepare.call(this, req, next) })
 })
+
 module.exports.compileUpdatedDraftMessages = compileUpdatedDraftMessages

package/node_modules/@sap/cds/libx/_runtime/messaging/enterprise-messaging-utils/registerEndpoints.js

@@ -20,16 +20,18 @@ class EndpointRegistry {
     this.webhookCallbacks = new Map()
     this.deployCallbacks = new Map()
 
-    const _IS_SECURED = !!(
+    const _HAS_APP_AUTH = !!(
       cds.env.requires.auth &&
       (cds.env.requires.auth.impl || !(cds.env.requires.auth.kind in { mocked: 1, 'mocked-auth': 1 }))
     )
+    const _HAS_MESSAGING_XSUAA = !!cds.env.requires.messaging?.xsuaa
+    const _IS_SECURED = _HAS_APP_AUTH || _HAS_MESSAGING_XSUAA
     const _IS_PRODUCTION = process.env.NODE_ENV === 'production'
 
     cds.app.use(basePath, cds.middlewares.context())
     if (_IS_SECURED) {
       // unofficial XSUAA fallback
-      if (cds.env.requires.messaging?.xsuaa) {
+      if (_HAS_MESSAGING_XSUAA) {
         cds.app.use(basePath, _xsuaa_fallback())
       } else {
         cds.app.use(basePath, cds.middlewares.auth())
@@ -38,7 +40,11 @@ class EndpointRegistry {
       cds.app.use(basePath, (_req, _res, next) => {
         next(cds.context.user._is_anonymous ? 401 : undefined)
       })
-    } else if (_IS_PRODUCTION) LOG.warn('Messaging endpoints not secured')
+    } else if (_IS_PRODUCTION) {
+      throw new Error(
+        'Messaging endpoints require authentication in production. Configure cds.requires.auth or cds.requires.messaging.xsuaa.'
+      )
+    }
 
     cds.app.use(basePath, express.json({ type: 'application/*+json' }))
     cds.app.use(basePath, express.json())