The rate limit answers 402 with the offer, not 429 with a description of it

[ralyodio]

What was wrong

The refusal already named the pass, its price and exactly how to buy it — in prose:

"buy": {
  "url": "https://rssamplifier.com/crawl",
  "price": "1.00 USD per day, USDC, settled by CoinPay",
  "how": "Fetch https://rssamplifier.com/crawl with Accept: application/json for an x402 offer, pay it, then send the pass in the x-crawl-pass header."
}

An x402 client cannot act on prose. A program that hit the wall had the same two options it arrived with — slow down, or spread itself over a proxy pool — plus a second round trip to /crawl to find out what to sign.

What changes

The refusal now is the offer. Status 402, with the accepts array spread into the body it already had, so a client can pay and carry on inside the same exchange.

The offer is read off the gateway rather than rebuilt here. payTo, the price, the currency and the network live in one place — a second copy is how a site ends up quoting a number its own /crawl disagrees with. That is what @profullstack/x402-gateway@0.6.0 adds: gateway.offer(), which was already computed inside the closure and is now just not private.

The paid rungs still get 429. A caller at the sponsor ceiling has bought everything there is; a 402 would be asking it to pay twice for nothing.

Tripping the anonymous rung takes 120 requests in a minute against a steady reader's thirty, so the caller being answered here is a machine.

What is deliberately NOT changed

lib/crawlThrottle.js stays exactly as it is, and this site does not adopt @profullstack/throttle.

The rest of the fleet is getting that package because their limiters only watched /api/. This one already meters every route, and it does something the package does not: it keys a declared crawler by the token in its own User-Agent, collapsing meta-externalagent's seventy addresses into one caller. Per-address metering never reaches that fleet. Swapping this for the generic package would be a downgrade.

What it was missing was the sale, and that is all this adds.

Verified

node --test test/*.test.js — 405 passed, 0 failed (two new). pnpm --filter @rssamplifier/web build clean with the proxy intact.

New tests read the behaviour off the source, the way the matcher test already does — importing proxy.js under node:test fails on a bare next/server specifier, which is why none of the tests here drive the proxy — plus one that actually calls gateway.offer() and checks every accepts entry names a network, a payTo and a positive amount.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​x402-gateway@​0.4.0 ⏵ 0.6.0			+1	+1

View full report