{"service":"10x402","tagline":"x402 conformance linting, sold per call over x402","home":"https://10x402.com","support":"support@10x402.com","x402_versions":[1,2],"networks":{"v1":"base","v2":"eip155:8453"},"endpoints":[{"method":"GET","path":"/check","price":"free","description":"Start here: service info, the full check catalogue with sources, prices and grades. Free."},{"method":"POST","path":"/lint","price":"$0.25","description":"Find conformance blockers to x402 indexing and payment on a live endpoint","input":"a JSON object: { \"url\": \"https://…\" } and optionally { \"method\": \"POST\" | \"GET\" }, default POST","output":"a JSON lint report: grade, summary, findings[] and checks_run","scope":"all 82 checks","check_required":false,"fetches":true,"paired_with":"/lint/one","sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST"}},{"method":"POST","path":"/lint/one","price":"$0.02","description":"Run ONE named check against a live endpoint","input":"a JSON object: { \"url\": \"https://…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check, plus optionally { \"method\": \"POST\" | \"GET\" }","output":"a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary","scope":"one named check","check_required":true,"fetches":true,"paired_with":"/lint","sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST","check":"V2_B64_URLSAFE"}},{"method":"POST","path":"/presence","price":"$0.15","description":"Where a live x402 resource stands with the registries — Bazaar, x402scan, and on-chain","input":"a JSON object: { \"url\": \"https://…\" } — the live x402 resource to look up — and optionally { \"method\": \"POST\" | \"GET\" }, default POST","output":"a JSON presence report: per-registry verdicts (listed | not_found | unknown) with evidence, on-chain settlement activity, and a summary","scope":"all 82 checks","check_required":false,"fetches":true,"paired_with":null,"sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST"}},{"method":"POST","path":"/lint/envelope","price":"$0.10","description":"Check a captured x402 402 for indexing and payment blockers — no fetch","input":"a JSON object: { \"status\": 402, \"headers\": { \"payment-required\": \"…\", … }, \"body\": \"…\" }","output":"a JSON lint report: grade, summary, findings[] and checks_run","scope":"all 82 checks","check_required":false,"fetches":false,"paired_with":"/lint/envelope/one","sample":{"status":402,"headers":{"content-type":"application/json"},"body":"{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}"}},{"method":"POST","path":"/lint/envelope/one","price":"$0.01","description":"Run ONE named check against a response you paste","input":"a JSON object: { \"status\": 402, \"headers\": { … }, \"body\": \"…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check","output":"a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary","scope":"one named check","check_required":true,"fetches":false,"paired_with":"/lint/envelope","sample":{"status":402,"headers":{"content-type":"application/json"},"body":"{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}","check":"V2_HEADER_PRESENT"}}],"pricing":{"batch_multiples":{"live":12.5,"pasted":10},"per_check_advantage":{"live":6.6,"pasted":8.2},"singles_cheaper_through":{"live":12,"pasted":9},"note":"A full 82-check report costs 12.5x one check on a live URL and 10x on a pasted response — a 6.6x and 8.2x per-check advantage. Singles stay the cheaper buy through 12 questions live and 9 pasted; past that, buy the report.","scope_pricing":"the two scopes are two products. A full report is priced for the incident it resolves — a 402 that passes validate and still is not indexed, with nothing in the stack saying which of 82 things is wrong. A single check is priced to be run in CI, over and over, which is why it stays micro.","envelope_discount":"the pasted-response routes cost less than the ones that fetch, because they make no outbound request on your behalf.","per":"every price is per SERVED report — a bad URL, an unreachable target, a malformed paste or an unknown check id settles nothing, even when the payment verified."},"free_tier_daily":0,"grades":[{"grade":"A","when":"zero payment-regime errors and zero payment-regime warnings"},{"grade":"B","when":"zero payment-regime errors, one or two warnings"},{"grade":"C","when":"zero payment-regime errors, three or more warnings"},{"grade":"D","when":"one or more payment-regime errors, none of them core"},{"grade":"F","when":"any core error — the envelope is not usable as published"}],"regimes":{"payment":"the specs' MUSTs and what shipping clients parse, throw on, or refuse to sign. These findings, and only these, set the grade.","bazaar":"CDP's validator, prober and seller docs — what it takes to be INDEXED. These set summary.bazaar_ready and never the grade.","hygiene":"house opinions and client-quirk defenses that break no payment and block no indexing. Info only, always."},"source_kinds":["spec","client-code","cdp-docs","cdp-validator","live","field-report","house-opinion"],"checks_total":82,"checks":[{"id":"HTTP_STATUS_402","area":"http","regime":"payment","severity":"error","core":true,"summary":"an unauthenticated request answers 402 — not core on a 404/405, which is as often the wrong verb as a missing route, and a 200 or a redirect is delegated to HTTP_FREE_TIER_200 and HTTP_REDIRECT rather than counted here twice","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 (`if (response.status !== 402) return response`)"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[3] returns_402 (required)"}]},{"id":"HTTP_FREE_TIER_200","area":"http","regime":"payment","severity":"warn","core":false,"summary":"no free tier serving 200s to unauthenticated callers","sources":[{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 — a non-402 is returned unpaid; the client never attempts payment"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[3] returns_402 (required)"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/seller/get-discovered — endpoints are health-probed on an interval"}]},{"id":"HTTP_SERVER_ERROR","area":"http","regime":"payment","severity":"error","core":true,"summary":"the endpoint is not 5xx","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:176-186 § Error Handling"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 — a 5xx is returned unpaid"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[2] endpoint_reachable (required)"}]},{"id":"HTTP_REDIRECT","area":"http","regime":"payment","severity":"warn","core":false,"summary":"the 402 is not behind a redirect","sources":[{"kind":"client-code","ref":"@x402/fetch@2.23.0 dist/esm/index.mjs:10 — `await fetch(request)`, i.e. the default redirect mode, so redirects ARE followed"},{"kind":"spec","ref":"RFC 9110 § 15.4.3 — 301/302 rewrite POST to GET; 307/308 do not"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[0] url_valid — the ADVERTISED url is what is probed"}]},{"id":"HTTP_CONTENT_TYPE_JSON","area":"http","regime":"payment","severity":"warn","core":false,"summary":"the v1 envelope body is served as JSON","sources":[{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling (Content-Type: application/json)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/chunk-BA2VL4DT.mjs:2163 — processResponse parses the body only when content-type includes application/json"},{"kind":"house-opinion","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 does NOT branch on content-type, so this costs some client paths and not the main v1 one — hence warn"}]},{"id":"ENVELOPE_PRESENT","area":"http","regime":"payment","severity":"error","core":true,"summary":"at least one x402 envelope is published","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — no header and no v1 body throws \"Invalid payment required response\""}]},{"id":"HTTP_ROUTE_DISCRIMINATES","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"the host tells a real path from an impossible one, so the declared path’s answer is evidence the route exists (runs only when the one-request negative control could be fetched)","sources":[{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 533-host census of the live catalog: 493/526 answering hosts (93.9%) return 404/410 for an impossible path; 10 hosts (1.9%) answer 402 for everything, clustered on 5 domains — a platform property, not a per-endpoint mistake"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — models the outcome as route_existence: confirmed | uninformative rather than pass/fail, and adopts the negative control into the x402-doctor design"}]},{"id":"HTTP_SOFT_404","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"an impossible path is not answered with a success status — a soft-404 host defeats liveness checks, a different class than the 402 gate (runs only when the negative control could be fetched)","sources":[{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 13/526 hosts (2.5%) answer 200 for an impossible path, diffuse across 13 distinct domains: independent mistakes, not a platform"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — \"it is not 'route exists', merely an indeterminate positive response\"; reported distinctly from both 404/410 and 402-before-routing"}]},{"id":"V2_HEADER_PRESENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"a PAYMENT-REQUIRED response header is present (CDP will not index a v1-only 402)","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[6] payment_required_header (required)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the v2 client DOES fall back to a v1 body"},{"kind":"field-report","ref":"x402-foundation/x402#3091 — x402-fetch@1.x is still a live buyer population"}]},{"id":"V2_B64_URLSAFE","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the header is standard base64, not base64url","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/utils/index.js:133 — Base64EncodedRegex = /^[A-Za-z0-9+/]*={0,2}$/"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1778-1781 — the regex is tested on the RAW header, then it throws, before any decode"},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling — \"Base64-encoded\", SILENT on the alphabet","context":true}]},{"id":"V2_B64_DECODE","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the header decodes as base64","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1781 — JSON.parse(safeBase64Decode(header)), uncaught"},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"}]},{"id":"V2_JSON","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the decoded header is JSON","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1781 — a SyntaxError escapes decodePaymentRequiredHeader"},{"kind":"spec","ref":"specs/x402-specification-v2.md:72-107 § 5.1.1 JSON Payload"}]},{"id":"V2_VERSION","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the v2 payload declares x402Version 2","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:114 § 5.1.2 — x402Version Required, \"must be 2\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:111 — x402Version: z.literal(2), inside a discriminatedUnion"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 1 — a v1-shaped challenge on a v2 resource"}]},{"id":"V2_ACCEPTS_NONEMPTY","area":"v2","regime":"payment","severity":"error","core":true,"summary":"accepts[] is a non-empty array","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:117 § 5.1.2 — accepts Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:114 — accepts: z.array(PaymentRequirementsV2Schema).min(1)"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[7] has_accepts (required)"}]},{"id":"V2_SCHEME","area":"v2","regime":"payment","severity":"error","core":true,"summary":"each accept names a scheme","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — scheme: NonEmptyString"}]},{"id":"V2_SCHEME_KNOWN","area":"v2","regime":"payment","severity":"info","core":false,"summary":"the scheme has a published specification (v2 leaves the field open, so this is an info)","sources":[{"kind":"spec","ref":"specs/schemes/ — exact, upto, batch-settlement, auth-capture each have a scheme document"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[8] accepts[0].scheme, expected \"exact or upto\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — the v2 schema accepts any non-empty string, by design"}]},{"id":"V2_NETWORK_CAIP2","area":"v2","regime":"payment","severity":"error","core":true,"summary":"network contains a colon (the client’s rule), and is not a v1 plain name","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:125 § 5.1.2 — network Required, CAIP-2 format"},{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 Network Identifiers"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:63-65 — NetworkSchemaV2 = z.string().min(3).refine(v => v.includes(\":\"))"}]},{"id":"V2_NETWORK_CAIP2_STYLE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"the network string is CAIP-2 shaped (3–8 character namespace) — a style note, not a client rule","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 — \"Networks in x402 v2 use CAIP-2 format\""},{"kind":"house-opinion","ref":"no shipping client bounds the namespace; @x402/core requires only min(3) and a colon, so this may only be an info"}]},{"id":"V2_NAMESPACE_KNOWN","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"the report says so when a network namespace was checked structurally rather than deeply","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 — namespaces are open-ended; \"ach:us\" and \"sepa:eu\" are given as examples"},{"kind":"spec","ref":"specs/schemes/batch-settlement/scheme_batch_settlement_cloudflare.md:7 — cloudflare:402 is a real network with its own scheme document"},{"kind":"house-opinion","ref":"worker/lint.js addressFamily() — eip155 and solana are the namespaces whose address formats this linter knows; everything else is checked structurally, and the report says which"}]},{"id":"V2_NETWORK_SUPPORTED","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the eip155 chain is one CDP’s facilitator settles on","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[9] accepts[0].network, expected \"a facilitator-supported network (Base, Solana, Polygon, Arbitrum, World)\""},{"kind":"house-opinion","ref":"a chain outside that set is legal x402 and payable through a self-hosted facilitator — it is CDP indexing that is lost, not payment"}]},{"id":"V2_AMOUNT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the price is in `amount`, not the v1 `maxAmountRequired`","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — amount: NonEmptyString; maxAmountRequired is not a v2 key"}]},{"id":"V2_AMOUNT_ATOMIC","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the amount is a string of atomic units","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:570 — BigInt(authorization.value); BigInt(\"0.01\") throws"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — the reference facilitator schema refines on isInteger"}]},{"id":"V2_AMOUNT_MINIMUM","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the amount clears CDP’s 1000-atomic-unit ($0.001) indexing floor","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — the client itself applies no numeric bound, so the facilitator is the only enforcer"}]},{"id":"V2_INDEX_AMOUNT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the amount is a value CDP’s required amount preflight can read at all","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\" — the check compares a value, so an absent or non-integer amount cannot satisfy it"}]},{"id":"V2_INDEX_TIMEOUT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"maxTimeoutSeconds is SET, which is what CDP’s required preflight asks","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required) — \"maxTimeoutSeconds is set\". Presence is the whole of the provider’s stated rule; the JSON type is a payment question and V2_MAX_TIMEOUT asks it"}]},{"id":"V2_INDEX_ASSET","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"asset identifies a token on a chain CDP settles, so its required asset preflight can pass","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[10] accepts[0].asset (required) — \"Asset is USDC\", captured with a token contract address as the actual value"},{"kind":"spec","ref":"specs/x402-specification-v2.md:127 § 5.1.2 — on a chain, asset is the token contract address; a ticker cannot be the token CDP looks up"}]},{"id":"V2_INDEX_PAYTO","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"payTo is an address, which is what CDP’s required payee preflight asks for","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[12] accepts[0].payTo (required) — \"payTo address present\", captured with a string address as the actual value"}]},{"id":"V2_PAYTO","area":"v2","regime":"payment","severity":"error","core":true,"summary":"payTo has the address shape its network’s namespace requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:128 § 5.1.2 — \"Recipient wallet address or role constant (e.g., \\\"merchant\\\")\""},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_svm.md:53-68 — a base58 payTo on solana:*"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:537 — `to: getAddress(paymentRequirements.payTo)`; viem throws on a non-address"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:106 — payTo: NonEmptyString, i.e. the shape rule is the scheme’s, not the envelope’s"}]},{"id":"V2_ASSET","area":"v2","regime":"payment","severity":"error","core":true,"summary":"asset names the token in the form its network’s namespace requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:127 § 5.1.2 — \"Token contract address or ISO 4217 currency code for fiat\""},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:565 — verifyingContract: getAddress(requirements.asset)"},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_svm.md:71 — asset is the token mint public key"}]},{"id":"V2_MAX_TIMEOUT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"maxTimeoutSeconds is a positive JSON number (a string \"60\" is not one)","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:129 § 5.1.2 — maxTimeoutSeconds, type number, Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:107 — maxTimeoutSeconds: z.number().positive(), required, no coercion"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:539 — validBefore is computed from it; undefined yields BigInt(\"NaN\"), which throws"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required)"}]},{"id":"V2_EXTRA_EIP712","area":"v2","regime":"payment","severity":"error","core":false,"summary":"extra.{name,version} is present on an eip3009 exact entry, where the client signs from it","sources":[{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version, both \"(required)\""},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:171-172,285-286 — conditional under permit2, optional under erc7710"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:555-558 — signEIP3009Authorization throws when either is absent"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:1261 — assetTransferMethod defaults to \"eip3009\""}]},{"id":"V2_ACCEPTS_V1_FIELDS","area":"v2","regime":"payment","severity":"warn","core":false,"summary":"the accept carries no v1-only fields","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:101-109 — a plain z.object, so unknown keys are STRIPPED on any re-parse"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/client/index.mjs:262 — the raw entry is echoed as `accepted`, unstripped"}]},{"id":"V2_RESOURCE_OBJECT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"resource is the v2 object, not a v1 flat string","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:116 § 5.1.2 — resource Required, ResourceInfo object"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:113 — resource: ResourceInfoSchema"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[14] has_resource (required)"}]},{"id":"V2_RESOURCE_URL_PARSES","area":"v2","regime":"payment","severity":"warn","core":false,"summary":"resource.url parses as a URL at all — it is echoed into the payment payload","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:69 — url: NonEmptyString, so the client will happily carry a bare path"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/client/index.js:413 — resource is copied verbatim into the outgoing PaymentPayload, which is what a settlement is attributed to"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3 — \"resource.url must be absolute, not a bare path\""}]},{"id":"V2_RESOURCE_URL","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"resource.url is an absolute https URL","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[0] url_valid and preflight[1] url_https, both required"},{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3"}]},{"id":"V2_RESOURCE_METHOD","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.method, when published, agrees with bazaar.info.input.method","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — there is no `method` member, so its absence is conformant"},{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — info.input.method is the declared verb"},{"kind":"live","ref":"cdp-validator-toolshed.json paymentRequirements.resource.method — indexed sellers do publish it"}]},{"id":"V2_RESOURCE_DESCRIPTION","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"resource.description is under 500 characters (absent is an info; over the limit is an error)","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — description Optional"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/seller/get-discovered — \"the CDP Facilitator rejects verify and settle requests whose description exceeds that limit\" (500 characters)"}]},{"id":"V2_RESOURCE_MIMETYPE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"resource.mimeType, when published, looks like a media type","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — mimeType Optional"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:71 — mimeType: z.string().nullish()"}]},{"id":"V2_RESOURCE_URL_MATCHES","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"resource.url is the URL that was called","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/client/index.js:413 — settlement is attributed to the echoed resource"},{"kind":"house-opinion","ref":"a proxy, a route template or a canonicalised host makes a mismatch legitimate, so this may only ever be an info"}]},{"id":"V2_SERVICE_NAME","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.serviceName, when published, is ≤32 printable-ASCII characters (absence is silent)","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:389 — \"length ≤ 32 characters\"; on violation, \"Drop the field.\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:72 — z.string().min(1).max(32).regex(/^[\\x20-\\x7e]+$/)"}]},{"id":"V2_TAGS","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.tags, when published, are ≤5 entries of ≤32 printable-ASCII characters (absence is silent)","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:390 — \"at most 5 entries; each entry non-empty, printable ASCII … length ≤ 32\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:73 — z.array(z.string().min(1).max(32).regex(PRINTABLE_ASCII)).max(5)"}]},{"id":"V2_BAZAAR_PRESENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar is present — in v2 its presence IS the discovery opt-in","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[15] has_bazaar_extension (required)"},{"kind":"spec","ref":"specs/extensions/bazaar.md:512-517 § Client Behavior — omitting the extension means no cataloging"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — a CDP engineer: `extensions.bazaar.discoverable` is \"not a valid field\""}]},{"id":"V2_BAZAAR_INFO","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar.info is present","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — info Required"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[16] bazaar.info (required)"}]},{"id":"V2_BAZAAR_SCHEMA","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar.schema is present","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — schema Required"},{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — \"Facilitators must validate info against schema before cataloging\""},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[23] bazaar.schema (required)"}]},{"id":"V2_BAZAAR_SCHEMA_CONTENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the bazaar schema meets its own content MUSTs: requires `input`, and every $ref/$id is same-document","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:313-322 § Schema Validation — Draft 2020-12, \"Must define an input property (required)\", and \"$ref and $id values must be same-document JSON Pointer fragments (starting with #); external references … are not allowed\""},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 5 — an external $ref broke CDP’s validator outright"}]},{"id":"V2_BAZAAR_INFO_VALIDATES","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"info validates against its own schema","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — facilitators MUST validate info against schema before cataloging"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[24] parse (required)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — an info/schema mismatch is declined silently; nothing reaches the seller’s logs"}]},{"id":"V2_BAZAAR_BAG_MISMATCH","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"every key a schema parameter-bag requires is supplied by info in THAT bag, not a sibling bag","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — the info/schema validation this contradiction is guaranteed to fail"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-20) — 276 of 14,691 live listings with a `required` key fail their own schema, across 59 hosts; the named specimen requires `name` in queryParams while its own example supplies it in pathParams"},{"kind":"field-report","ref":"Circadian-agent/agent-economy-data findings/bazaar-info-fails-own-schema-2026-08-20.md — the census behind those counts"}]},{"id":"V2_BAZAAR_INPUT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input carries a worked sample call","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:245-282 § Discovery Info Structure — input is Required in every discriminant"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[17] bazaar.info.input (required)"}]},{"id":"V2_BAZAAR_INPUT_TYPE","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input.type is the \"http\" or \"mcp\" discriminator, with that branch’s required fields","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:251-282 — type Required (\"http\"/\"mcp\"); bodyType and body Required for POST/PUT/PATCH; toolName and inputSchema Required for mcp"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[18] bazaar.info.input.type (required)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 4 — the missing `type` discriminator"}]},{"id":"V2_BAZAAR_INPUT_METHOD","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input.method is an HTTP verb from the spec’s enums, and matches the verb that was probed","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — method Required, one of GET/HEAD/DELETE or POST/PUT/PATCH"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[19] bazaar.info.input.method and preflight[20] bazaar.info.input.method.matches_request, both required"}]},{"id":"V2_BAZAAR_OUTPUT_TYPE","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"bazaar.info.output, when published, carries its Required `type`","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:284-294 § Output Types — output optional; within it, type Required"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[21] bazaar.info.output (advisory)"}]},{"id":"V2_BAZAAR_OUTPUT_EXAMPLE","area":"v2","regime":"bazaar","severity":"info","core":false,"summary":"bazaar.info.output.example is a computed response — any JSON value, and CDP grades it advisory","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:284-294 — the example row is `example | any | No`"},{"kind":"spec","ref":"specs/extensions/bazaar.md:46-53 — the spec’s own GET example gives output.example as an OBJECT"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[22] bazaar.info.output.example (advisory)"}]},{"id":"V1_ABSENT","area":"v1","regime":"payment","severity":"info","core":false,"summary":"a v1 body envelope is published alongside the v2 header","sources":[{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 — the v1 client reads the body and never looks at PAYMENT-REQUIRED"},{"kind":"field-report","ref":"x402-foundation/x402#3091 — the pre-header buyer population is real and shrinking"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[4] valid_json (required) — an EMPTY 402 body fails it, so serve at least `{}`"}]},{"id":"V1_BODY_NOT_ENVELOPE","area":"v1","regime":"payment","severity":"info","core":false,"summary":"the 402 body is a v1 envelope or is empty, not something a v1 client will misread","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"},{"kind":"spec","ref":"specs/transports-v2/http.md:19-25 — the spec’s own 402 example serves a body of `{}`"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — an error blob makes accepts undefined and .map throws"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[4] valid_json (required) — the body is parsed as JSON during indexing"}]},{"id":"V1_BODY_PRESENT","area":"v1","regime":"payment","severity":"warn","core":false,"summary":"a v1 envelope is published in the 402 body","sources":[{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"house-opinion","ref":"only fires when nothing was published in either transport; ENVELOPE_PRESENT carries the core error for that case"}]},{"id":"V1_BODY_JSON","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the 402 body parses as JSON","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md § 5.1.1 JSON Payload"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 — response.json() with no try/catch"}]},{"id":"V1_VERSION","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the body declares x402Version 1","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:99-108 § 5.1.2"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1625 — the body fallback requires x402Version === 1 exactly"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:388 — x402Versions = [1]"}]},{"id":"V1_ACCEPTS_NONEMPTY","area":"v1","regime":"payment","severity":"error","core":true,"summary":"accepts[] is a non-empty array","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:99-108 § 5.1.2 — accepts Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:93 — accepts: z.array(PaymentRequirementsV1Schema).min(1)"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:23 — accepts.map throws when accepts is absent"}]},{"id":"V1_SCHEME","area":"v1","regime":"payment","severity":"error","core":true,"summary":"each accept names a scheme","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z.enum(schemes)"}]},{"id":"V1_SCHEME_KNOWN","area":"v1","regime":"payment","severity":"error","core":false,"summary":"the v1 scheme is `exact` — v1’s enum is closed where v2’s is open","sources":[{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:387 — var schemes = [\"exact\"]"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z3.enum(schemes), applied per accepts entry"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"}]},{"id":"V1_MAX_AMOUNT_REQUIRED","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the price is in `maxAmountRequired`, not the v2 `amount`","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:440 — maxAmountRequired is required; `amount` is not a v1 key"}]},{"id":"V1_AMOUNT_ATOMIC","area":"v1","regime":"payment","severity":"error","core":true,"summary":"maxAmountRequired is a string of atomic units","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — z3.string().refine(isInteger)"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:30 — BigInt(maxAmountRequired) throws on a non-digit string"}]},{"id":"V1_NETWORK_NAME","area":"v1","regime":"payment","severity":"error","core":true,"summary":"network is a v1 plain name, not CAIP-2","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — NetworkSchema is a z.enum of plain names; no member contains a colon"}]},{"id":"V1_NETWORK_KNOWN","area":"v1","regime":"payment","severity":"error","core":false,"summary":"the v1 network name is one of the seventeen the dominant v1 client’s enum admits","sources":[{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the closed z.enum: abstract, abstract-testnet, base-sepolia, base, avalanche-fuji, avalanche, iotex, solana-devnet, solana, sei, sei-testnet, polygon, polygon-amoy, peaq, story, educhain, skale-base-sepolia"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"},{"kind":"house-opinion","ref":"@x402/core@2.23.0's v1-compatibility schema is looser (@x402/core@2.23.0 dist/cjs/schemas/index.js:62, NonEmptyString), so this is a claim about the dominant v1 client rather than about every parser — hence error, not core"}]},{"id":"V1_RESOURCE_STRING","area":"v1","regime":"payment","severity":"error","core":true,"summary":"resource is a flat, absolute URL string, not the v2 object","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:441 — resource: z3.string().url(), so a bare path is a hard ZodError"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3, in its v1 spelling"}]},{"id":"V1_PAYTO","area":"v1","regime":"payment","severity":"error","core":true,"summary":"payTo has the address shape its v1 network requires (EVM 0x, or base58 on solana)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:435 — EvmOrSvmAddress = EvmAddressRegex.or(SvmAddressRegex)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the enum includes solana and solana-devnet"}]},{"id":"V1_ASSET","area":"v1","regime":"payment","severity":"error","core":true,"summary":"asset names the token in the form its v1 network requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:436,447 — asset: mixedAddressOrSvmAddress"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:75 — verifyingContract: getAddress(asset), which throws on a ticker"}]},{"id":"V1_MIMETYPE","area":"v1","regime":"payment","severity":"error","core":false,"summary":"mimeType is present (spec: Optional — but the dominant v1 client’s schema requires it)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — mimeType Optional"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:443 — mimeType: z3.string(), NOT .optional()"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"},{"kind":"house-opinion","ref":"@x402/core@2.23.0's v1 schema does make it optional (@x402/core@2.23.0 dist/cjs/schemas/index.js:83) — the two v1 parsers disagree"}]},{"id":"V1_DESCRIPTION","area":"v1","regime":"payment","severity":"error","core":false,"summary":"description is present (missing is an error; present-but-empty is a warn)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — description Required"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:442 — description: z3.string(), required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:82 — required in the modern v1-compatibility schema too"}]},{"id":"V1_MAX_TIMEOUT","area":"v1","regime":"payment","severity":"error","core":true,"summary":"maxTimeoutSeconds is a positive integer JSON number","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — maxTimeoutSeconds, type number, Required"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:446 — z3.number().int(), so the string \"60\" is a ZodError"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:86 — z.number().positive(), required"}]},{"id":"V1_EXTRA_EIP712","area":"v1","regime":"payment","severity":"error","core":false,"summary":"extra carries the EIP-712 domain the v1 client signs over (EVM networks only)","sources":[{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version required for eip3009"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:65-76 — signAuthorization reads extra?.name and extra?.version straight into the typed-data domain, with no fallback"},{"kind":"house-opinion","ref":"the reference facilitator recomputes the domain from its own table, so the mismatch surfaces only as invalid_exact_evm_payload_signature"},{"kind":"spec","ref":"specs/x402-specification-v1.md:261 — v1 Solana exact uses TransferChecked, which has no EIP-712 domain"}]},{"id":"V1_OUTPUT_SCHEMA","area":"v1","regime":"bazaar","severity":"warn","core":false,"summary":"outputSchema is present for v1 discovery","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — outputSchema Optional"},{"kind":"spec","ref":"specs/extensions/bazaar.md:577+ § Backwards Compatibility — v1 discovery rode on outputSchema"},{"kind":"field-report","ref":"x402-foundation/x402#2844 — indexing began after the metadata moved there"}]},{"id":"V1_DISCOVERABLE","area":"v1","regime":"bazaar","severity":"info","core":false,"summary":"outputSchema.input.discoverable is an opt-OUT — absence means indexed","sources":[{"kind":"client-code","ref":"x402-foundation/x402 go/extensions/v1/facilitator.go (main, read 2026-08-19) — \"// Check if discoverable (default to true if not specified)\" followed by `discoverable := true`, then an override only when the key is present"},{"kind":"live","ref":"worker/positive-control.js — a live indexed seller nests the flag under outputSchema.input"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/bazaar — v1 discovery data reads input.discoverable"}]},{"id":"DUAL_PAYTO","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers pay the same address","sources":[{"kind":"house-opinion","ref":"worker/lint.js — two views of one offer; divergence means half the revenue lands elsewhere"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:568 — getAddress is case-insensitive, so the comparison is too","context":true}]},{"id":"DUAL_PRICE","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers quote the same price","sources":[{"kind":"house-opinion","ref":"worker/lint.js — one offer must not carry two prices; matched on (chain, asset) so different-decimal assets are not compared"}]},{"id":"DUAL_NETWORK","area":"dual","regime":"payment","severity":"error","core":true,"summary":"the two envelopes offer overlapping chains","sources":[{"kind":"house-opinion","ref":"worker/lint.js — a payment signed on one chain is worthless on the other"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:52-70 — the client’s own EvmNetworkToChainId map, which is the two spellings of one chain","context":true}]},{"id":"DUAL_ASSET","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers name the same asset","sources":[{"kind":"house-opinion","ref":"worker/lint.js — different assets means the two versions are selling for different money"}]},{"id":"DUAL_RESOURCE","area":"dual","regime":"payment","severity":"warn","core":false,"summary":"both versions name the same resource URL","sources":[{"kind":"house-opinion","ref":"worker/lint.js — two URLs split one endpoint’s settlement record across two listings"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — discovery keys on the resource URL"}]},{"id":"VERSION_HEADER_SAYS_V1","area":"version","regime":"payment","severity":"error","core":false,"summary":"the PAYMENT-REQUIRED header does not carry a v1 payload","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:128-131 — PaymentRequired is a discriminatedUnion on x402Version, so a v1 payload in the header is legally parsed AS v1"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/client/index.mjs:219 — registeredClientSchemes.get(paymentRequired.x402Version): dispatch is on the PAYLOAD’s version, and a v1 client answers with X-PAYMENT while a v2 server reads PAYMENT-SIGNATURE"}]},{"id":"VERSION_BODY_SAYS_V2","area":"version","regime":"payment","severity":"warn","core":false,"summary":"the 402 body does not carry a v2 payload (a core error when no valid v2 header is published)","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the header wins whenever present; the body fallback accepts only x402Version === 1"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — a v1 client reads the body with v1 rules whatever it declares"}]},{"id":"ACCEPTS_TRUNCATED","area":"report","regime":"hygiene","severity":"info","core":false,"summary":"at most 8 accepts[] entries are linted per envelope","sources":[{"kind":"house-opinion","ref":"worker/lint.js MAX_ACCEPTS_LINTED = 8"}]},{"id":"FINDINGS_TRUNCATED","area":"report","regime":"hygiene","severity":"info","core":false,"summary":"this report is complete — no bound clipped it","sources":[{"kind":"house-opinion","ref":"worker/lint.js — MAX_FINDINGS = 200, MAX_ACCEPTS_LINTED = 8, and the caller's body byte cap"}]}],"notes":["A 402 from a paid endpoint here is a price quote, not an error.","checks_run in a report is how many checks APPLIED — a v1-only endpoint legitimately skips every v2 check.","A report carries TWO verdicts. `grade` answers \"can I be paid\" from payment-regime findings only; `summary.bazaar_ready` answers \"can I be found\" from bazaar-regime errors, and names its blockers. An endpoint can be grade A and bazaar_ready false — that is the commonest interesting report this service produces.","Every check publishes its `sources`. A rule with no citation is a rule this service will not sell you.","POST /lint sends exactly one unauthenticated request to the URL you name, follows no redirects, and reads at most 256 KB.","POST /lint/envelope fetches nothing, so it works on staging, on localhost and on an endpoint that is not deployed yet.","The two /one routes answer about exactly ONE check you name in a required `check` field, taken from checks[] below. An unknown id is a 400 that lints nothing and charges nothing.","A single-check answer distinguishes THREE outcomes: passed true, passed false with the finding and its fix, and applied false — the named check did not run against this response, which is not a pass and is never reported as one."]}