{
  "service": "10x402",
  "tagline": "x402 conformance linting, sold per call over x402",
  "home": "https://10x402.blue",
  "support": "contact@correntelabs.com",
  "x402_versions": [
    1,
    2
  ],
  "networks": {
    "v1": "base",
    "v2": "eip155:8453"
  },
  "endpoints": [
    {
      "method": "GET",
      "path": "/check",
      "price": "free",
      "description": "Start here: service info, the full check catalogue with sources, prices and grades. Free."
    },
    {
      "method": "POST",
      "path": "/lint",
      "price": "$0.25",
      "description": "Find conformance blockers to x402 indexing and payment on a live endpoint",
      "input": "a JSON object: { \"url\": \"https://…\" } and optionally { \"method\": \"POST\" | \"GET\" }, default POST",
      "output": "a JSON lint report: grade, summary, findings[] and checks_run",
      "scope": "all 82 checks",
      "check_required": false,
      "fetches": true,
      "sample": {
        "url": "https://toolshed.lemon-agent.dev/convert/md-html",
        "method": "POST"
      }
    },
    {
      "method": "POST",
      "path": "/lint/one",
      "price": "$0.02",
      "description": "Run ONE named check against a live endpoint",
      "input": "a JSON object: { \"url\": \"https://…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check, plus optionally { \"method\": \"POST\" | \"GET\" }",
      "output": "a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary",
      "scope": "one named check",
      "check_required": true,
      "fetches": true,
      "sample": {
        "url": "https://toolshed.lemon-agent.dev/convert/md-html",
        "method": "POST",
        "check": "V2_B64_URLSAFE"
      }
    },
    {
      "method": "POST",
      "path": "/presence",
      "price": "$0.15",
      "description": "Where a live x402 resource stands with the registries — Bazaar, x402scan, and on-chain",
      "input": "a JSON object: { \"url\": \"https://…\" } — the live x402 resource to look up — and optionally { \"method\": \"POST\" | \"GET\" }, default POST",
      "output": "a JSON presence report: per-registry verdicts (listed | not_found | unknown) with evidence, on-chain settlement activity, and a summary",
      "scope": "all 82 checks",
      "check_required": false,
      "fetches": true,
      "sample": {
        "url": "https://toolshed.lemon-agent.dev/convert/md-html",
        "method": "POST"
      }
    },
    {
      "method": "POST",
      "path": "/lint/envelope",
      "price": "$0.10",
      "description": "Check a captured x402 402 for indexing and payment blockers — no fetch",
      "input": "a JSON object: { \"status\": 402, \"headers\": { \"payment-required\": \"…\", … }, \"body\": \"…\" }",
      "output": "a JSON lint report: grade, summary, findings[] and checks_run",
      "scope": "all 82 checks",
      "check_required": false,
      "fetches": false,
      "sample": {
        "status": 402,
        "headers": {
          "content-type": "application/json"
        },
        "body": "{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}"
      }
    },
    {
      "method": "POST",
      "path": "/lint/envelope/one",
      "price": "$0.01",
      "description": "Run ONE named check against a response you paste",
      "input": "a JSON object: { \"status\": 402, \"headers\": { … }, \"body\": \"…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check",
      "output": "a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary",
      "scope": "one named check",
      "check_required": true,
      "fetches": false,
      "sample": {
        "status": 402,
        "headers": {
          "content-type": "application/json"
        },
        "body": "{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}",
        "check": "V2_HEADER_PRESENT"
      }
    },
    {
      "method": "GET",
      "path": "/api/algo-hub/sentinel/audit",
      "price": "$0.01",
      "description": "Ashlar Blue — Explainable ML Security Sentinel & Algorand Sovereign Agent Arcade",
      "network": "algorand:wGHE2Pwdvd7S12BL5FaOP20EGYesN73ktiC1qzkkit8=",
      "scope": "Algorand L1 ML Audit"
    }
  ],
  "pricing": {
    "batch_multiples": {
      "live": 12.5,
      "pasted": 10
    },
    "per_check_advantage": {
      "live": 6.6,
      "pasted": 8.2
    },
    "singles_cheaper_through": {
      "live": 12,
      "pasted": 9
    },
    "note": "A full 82-check report costs 12.5x one check on a live URL and 10x on a pasted response — a 6.6x and 8.2x per-check advantage. Singles stay the cheaper buy through 12 questions live and 9 pasted; past that, buy the report.",
    "scope_pricing": "the two scopes are two products. A full report is priced for the incident it resolves. A single check is priced to be run in CI.",
    "envelope_discount": "the pasted-response routes cost less than the ones that fetch, because they make no outbound request on your behalf.",
    "per": "every price is per SERVED report."
  },
  "free_tier_daily": 0,
  "grades": [
    {
      "grade": "A",
      "when": "zero payment-regime errors and zero payment-regime warnings"
    },
    {
      "grade": "B",
      "when": "zero payment-regime errors, one or two warnings"
    },
    {
      "grade": "C",
      "when": "zero payment-regime errors, three or more warnings"
    },
    {
      "grade": "D",
      "when": "one or more payment-regime errors, none of them core"
    },
    {
      "grade": "F",
      "when": "any core error — the envelope is not usable as published"
    }
  ],
  "regimes": {
    "payment": "the specs' MUSTs and what shipping clients parse, throw on, or refuse to sign. These findings, and only these, set the grade.",
    "bazaar": "CDP's validator, prober and seller docs — what it takes to be INDEXED. These set summary.bazaar_ready and never the grade.",
    "hygiene": "house opinions and client-quirk defenses that break no payment and block no indexing. Info only, always."
  },
  "source_kinds": [
    "spec",
    "client-code",
    "cdp-docs",
    "cdp-validator",
    "live",
    "field-report",
    "house-opinion"
  ],
  "checks_total": 82,
  "checks": [
    {
      "id": "HTTP_STATUS_402",
      "area": "http",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "an unauthenticated request answers 402 — not core on a 404/405, which is as often the wrong verb as a missing route, and a 200 or a redirect is delegated to HTTP_FREE_TIER_200 and HTTP_REDIRECT rather than counted here twice",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling"
        },
        {
          "kind": "spec",
          "ref": "specs/transports-v1/http.md § Payment Required Signaling"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:19 (`if (response.status !== 402) return response`)"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[3] returns_402 (required)"
        }
      ]
    },
    {
      "id": "HTTP_FREE_TIER_200",
      "area": "http",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "no free tier serving 200s to unauthenticated callers",
      "sources": [
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:19 — a non-402 is returned unpaid; the client never attempts payment"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[3] returns_402 (required)"
        },
        {
          "kind": "cdp-docs",
          "ref": "https://docs.cdp.coinbase.com/x402/seller/get-discovered — endpoints are health-probed on an interval"
        }
      ]
    },
    {
      "id": "HTTP_SERVER_ERROR",
      "area": "http",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the endpoint is not 5xx",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:176-186 § Error Handling"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:19 — a 5xx is returned unpaid"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[2] endpoint_reachable (required)"
        }
      ]
    },
    {
      "id": "HTTP_REDIRECT",
      "area": "http",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "the 402 is not behind a redirect",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/fetch@2.23.0 dist/esm/index.mjs:10 — `await fetch(request)`, i.e. the default redirect mode, so redirects ARE followed"
        },
        {
          "kind": "spec",
          "ref": "RFC 9110 § 15.4.3 — 301/302 rewrite POST to GET; 307/308 do not"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[0] url_valid — the ADVERTISED url is what is probed"
        }
      ]
    },
    {
      "id": "HTTP_CONTENT_TYPE_JSON",
      "area": "http",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "the v1 envelope body is served as JSON",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v1/http.md § Payment Required Signaling (Content-Type: application/json)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/esm/chunk-BA2VL4DT.mjs:2163 — processResponse parses the body only when content-type includes application/json"
        },
        {
          "kind": "house-opinion",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22 does NOT branch on content-type, so this costs some client paths and not the main v1 one — hence warn"
        }
      ]
    },
    {
      "id": "ENVELOPE_PRESENT",
      "area": "http",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "at least one x402 envelope is published",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling"
        },
        {
          "kind": "spec",
          "ref": "specs/transports-v1/http.md § Payment Required Signaling"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — no header and no v1 body throws \"Invalid payment required response\""
        }
      ]
    },
    {
      "id": "HTTP_ROUTE_DISCRIMINATES",
      "area": "http",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "the host tells a real path from an impossible one, so the declared path’s answer is evidence the route exists (runs only when the one-request negative control could be fetched)",
      "sources": [
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 533-host census of the live catalog: 493/526 answering hosts (93.9%) return 404/410 for an impossible path; 10 hosts (1.9%) answer 402 for everything, clustered on 5 domains — a platform property, not a per-endpoint mistake"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — models the outcome as route_existence: confirmed | uninformative rather than pass/fail, and adopts the negative control into the x402-doctor design"
        }
      ]
    },
    {
      "id": "HTTP_SOFT_404",
      "area": "http",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "an impossible path is not answered with a success status — a soft-404 host defeats liveness checks, a different class than the 402 gate (runs only when the negative control could be fetched)",
      "sources": [
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 13/526 hosts (2.5%) answer 200 for an impossible path, diffuse across 13 distinct domains: independent mistakes, not a platform"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — \"it is not 'route exists', merely an indeterminate positive response\"; reported distinctly from both 404/410 and 402-before-routing"
        }
      ]
    },
    {
      "id": "V2_HEADER_PRESENT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "a PAYMENT-REQUIRED response header is present (CDP will not index a v1-only 402)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[6] payment_required_header (required)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the v2 client DOES fall back to a v1 body"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3091 — x402-fetch@1.x is still a live buyer population"
        }
      ]
    },
    {
      "id": "V2_B64_URLSAFE",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the header is standard base64, not base64url",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/utils/index.js:133 — Base64EncodedRegex = /^[A-Za-z0-9+/]*={0,2}$/"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1778-1781 — the regex is tested on the RAW header, then it throws, before any decode"
        },
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling — \"Base64-encoded\", SILENT on the alphabet",
          "context": true
        }
      ]
    },
    {
      "id": "V2_B64_DECODE",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the header decodes as base64",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1781 — JSON.parse(safeBase64Decode(header)), uncaught"
        },
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling"
        }
      ]
    },
    {
      "id": "V2_JSON",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the decoded header is JSON",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1781 — a SyntaxError escapes decodePaymentRequiredHeader"
        },
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:72-107 § 5.1.1 JSON Payload"
        }
      ]
    },
    {
      "id": "V2_VERSION",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the v2 payload declares x402Version 2",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:114 § 5.1.2 — x402Version Required, \"must be 2\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:111 — x402Version: z.literal(2), inside a discriminatedUnion"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 1 — a v1-shaped challenge on a v2 resource"
        }
      ]
    },
    {
      "id": "V2_ACCEPTS_NONEMPTY",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "accepts[] is a non-empty array",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:117 § 5.1.2 — accepts Required"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:114 — accepts: z.array(PaymentRequirementsV2Schema).min(1)"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[7] has_accepts (required)"
        }
      ]
    },
    {
      "id": "V2_SCHEME",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "each accept names a scheme",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — scheme: NonEmptyString"
        }
      ]
    },
    {
      "id": "V2_SCHEME_KNOWN",
      "area": "v2",
      "regime": "payment",
      "severity": "info",
      "core": false,
      "summary": "the scheme has a published specification (v2 leaves the field open, so this is an info)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/schemes/ — exact, upto, batch-settlement, auth-capture each have a scheme document"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[8] accepts[0].scheme, expected \"exact or upto\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — the v2 schema accepts any non-empty string, by design"
        }
      ]
    },
    {
      "id": "V2_NETWORK_CAIP2",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "network contains a colon (the client’s rule), and is not a v1 plain name",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:125 § 5.1.2 — network Required, CAIP-2 format"
        },
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:616-621 § 11.1 Network Identifiers"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:63-65 — NetworkSchemaV2 = z.string().min(3).refine(v => v.includes(\":\"))"
        }
      ]
    },
    {
      "id": "V2_NETWORK_CAIP2_STYLE",
      "area": "v2",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "the network string is CAIP-2 shaped (3–8 character namespace) — a style note, not a client rule",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:616-621 § 11.1 — \"Networks in x402 v2 use CAIP-2 format\""
        },
        {
          "kind": "house-opinion",
          "ref": "no shipping client bounds the namespace; @x402/core requires only min(3) and a colon, so this may only be an info"
        }
      ]
    },
    {
      "id": "V2_NAMESPACE_KNOWN",
      "area": "v2",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "the report says so when a network namespace was checked structurally rather than deeply",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:616-621 § 11.1 — namespaces are open-ended; \"ach:us\" and \"sepa:eu\" are given as examples"
        },
        {
          "kind": "spec",
          "ref": "specs/schemes/batch-settlement/scheme_batch_settlement_cloudflare.md:7 — cloudflare:402 is a real network with its own scheme document"
        },
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js addressFamily() — eip155 and solana are the namespaces whose address formats this linter knows; everything else is checked structurally, and the report says which"
        }
      ]
    },
    {
      "id": "V2_NETWORK_SUPPORTED",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "the eip155 chain is one CDP’s facilitator settles on",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[9] accepts[0].network, expected \"a facilitator-supported network (Base, Solana, Polygon, Arbitrum, World)\""
        },
        {
          "kind": "house-opinion",
          "ref": "a chain outside that set is legal x402 and payable through a self-hosted facilitator — it is CDP indexing that is lost, not payment"
        }
      ]
    },
    {
      "id": "V2_AMOUNT",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the price is in `amount`, not the v1 `maxAmountRequired`",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — amount: NonEmptyString; maxAmountRequired is not a v2 key"
        }
      ]
    },
    {
      "id": "V2_AMOUNT_ATOMIC",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the amount is a string of atomic units",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:570 — BigInt(authorization.value); BigInt(\"0.01\") throws"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — the reference facilitator schema refines on isInteger"
        }
      ]
    },
    {
      "id": "V2_AMOUNT_MINIMUM",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "the amount clears CDP’s 1000-atomic-unit ($0.001) indexing floor",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — the client itself applies no numeric bound, so the facilitator is the only enforcer"
        }
      ]
    },
    {
      "id": "V2_INDEX_AMOUNT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "the amount is a value CDP’s required amount preflight can read at all",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\" — the check compares a value, so an absent or non-integer amount cannot satisfy it"
        }
      ]
    },
    {
      "id": "V2_INDEX_TIMEOUT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "maxTimeoutSeconds is SET, which is what CDP’s required preflight asks",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required) — \"maxTimeoutSeconds is set\". Presence is the whole of the provider’s stated rule; the JSON type is a payment question and V2_MAX_TIMEOUT asks it"
        }
      ]
    },
    {
      "id": "V2_INDEX_ASSET",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "asset identifies a token on a chain CDP settles, so its required asset preflight can pass",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[10] accepts[0].asset (required) — \"Asset is USDC\", captured with a token contract address as the actual value"
        },
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:127 § 5.1.2 — on a chain, asset is the token contract address; a ticker cannot be the token CDP looks up"
        }
      ]
    },
    {
      "id": "V2_INDEX_PAYTO",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "payTo is an address, which is what CDP’s required payee preflight asks for",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[12] accepts[0].payTo (required) — \"payTo address present\", captured with a string address as the actual value"
        }
      ]
    },
    {
      "id": "V2_PAYTO",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "payTo has the address shape its network’s namespace requires",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:128 § 5.1.2 — \"Recipient wallet address or role constant (e.g., \\\"merchant\\\")\""
        },
        {
          "kind": "spec",
          "ref": "specs/schemes/exact/scheme_exact_svm.md:53-68 — a base58 payTo on solana:*"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:537 — `to: getAddress(paymentRequirements.payTo)`; viem throws on a non-address"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:106 — payTo: NonEmptyString, i.e. the shape rule is the scheme’s, not the envelope’s"
        }
      ]
    },
    {
      "id": "V2_ASSET",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "asset names the token in the form its network’s namespace requires",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:127 § 5.1.2 — \"Token contract address or ISO 4217 currency code for fiat\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:565 — verifyingContract: getAddress(requirements.asset)"
        },
        {
          "kind": "spec",
          "ref": "specs/schemes/exact/scheme_exact_svm.md:71 — asset is the token mint public key"
        }
      ]
    },
    {
      "id": "V2_MAX_TIMEOUT",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "maxTimeoutSeconds is a positive JSON number (a string \"60\" is not one)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:129 § 5.1.2 — maxTimeoutSeconds, type number, Required"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:107 — maxTimeoutSeconds: z.number().positive(), required, no coercion"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:539 — validBefore is computed from it; undefined yields BigInt(\"NaN\"), which throws"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required)"
        }
      ]
    },
    {
      "id": "V2_EXTRA_EIP712",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "extra.{name,version} is present on an eip3009 exact entry, where the client signs from it",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version, both \"(required)\""
        },
        {
          "kind": "spec",
          "ref": "specs/schemes/exact/scheme_exact_evm.md:171-172,285-286 — conditional under permit2, optional under erc7710"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:555-558 — signEIP3009Authorization throws when either is absent"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:1261 — assetTransferMethod defaults to \"eip3009\""
        }
      ]
    },
    {
      "id": "V2_ACCEPTS_V1_FIELDS",
      "area": "v2",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "the accept carries no v1-only fields",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:101-109 — a plain z.object, so unknown keys are STRIPPED on any re-parse"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/esm/client/index.mjs:262 — the raw entry is echoed as `accepted`, unstripped"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_OBJECT",
      "area": "v2",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "resource is the v2 object, not a v1 flat string",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:116 § 5.1.2 — resource Required, ResourceInfo object"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:113 — resource: ResourceInfoSchema"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[14] has_resource (required)"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_URL_PARSES",
      "area": "v2",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "resource.url parses as a URL at all — it is echoed into the payment payload",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:69 — url: NonEmptyString, so the client will happily carry a bare path"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/client/index.js:413 — resource is copied verbatim into the outgoing PaymentPayload, which is what a settlement is attributed to"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 3 — \"resource.url must be absolute, not a bare path\""
        }
      ]
    },
    {
      "id": "V2_RESOURCE_URL",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "resource.url is an absolute https URL",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[0] url_valid and preflight[1] url_https, both required"
        },
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table)"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 3"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_METHOD",
      "area": "v2",
      "regime": "bazaar",
      "severity": "warn",
      "core": false,
      "summary": "resource.method, when published, agrees with bazaar.info.input.method",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — there is no `method` member, so its absence is conformant"
        },
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:251-269 — info.input.method is the declared verb"
        },
        {
          "kind": "live",
          "ref": "cdp-validator-toolshed.json paymentRequirements.resource.method — indexed sellers do publish it"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_DESCRIPTION",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "resource.description is under 500 characters (absent is an info; over the limit is an error)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — description Optional"
        },
        {
          "kind": "cdp-docs",
          "ref": "https://docs.cdp.coinbase.com/x402/seller/get-discovered — \"the CDP Facilitator rejects verify and settle requests whose description exceeds that limit\" (500 characters)"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_MIMETYPE",
      "area": "v2",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "resource.mimeType, when published, looks like a media type",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — mimeType Optional"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:71 — mimeType: z.string().nullish()"
        }
      ]
    },
    {
      "id": "V2_RESOURCE_URL_MATCHES",
      "area": "v2",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "resource.url is the URL that was called",
      "sources": [
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/client/index.js:413 — settlement is attributed to the echoed resource"
        },
        {
          "kind": "house-opinion",
          "ref": "a proxy, a route template or a canonicalised host makes a mismatch legitimate, so this may only ever be an info"
        }
      ]
    },
    {
      "id": "V2_SERVICE_NAME",
      "area": "v2",
      "regime": "bazaar",
      "severity": "warn",
      "core": false,
      "summary": "resource.serviceName, when published, is ≤32 printable-ASCII characters (absence is silent)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:389 — \"length ≤ 32 characters\"; on violation, \"Drop the field.\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:72 — z.string().min(1).max(32).regex(/^[\\x20-\\x7e]+$/)"
        }
      ]
    },
    {
      "id": "V2_TAGS",
      "area": "v2",
      "regime": "bazaar",
      "severity": "warn",
      "core": false,
      "summary": "resource.tags, when published, are ≤5 entries of ≤32 printable-ASCII characters (absence is silent)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:390 — \"at most 5 entries; each entry non-empty, printable ASCII … length ≤ 32\""
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:73 — z.array(z.string().min(1).max(32).regex(PRINTABLE_ASCII)).max(5)"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_PRESENT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "extensions.bazaar is present — in v2 its presence IS the discovery opt-in",
      "sources": [
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[15] has_bazaar_extension (required)"
        },
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:512-517 § Client Behavior — omitting the extension means no cataloging"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 — a CDP engineer: `extensions.bazaar.discoverable` is \"not a valid field\""
        }
      ]
    },
    {
      "id": "V2_BAZAAR_INFO",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "extensions.bazaar.info is present",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — info Required"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[16] bazaar.info (required)"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_SCHEMA",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "extensions.bazaar.schema is present",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — schema Required"
        },
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:322 — \"Facilitators must validate info against schema before cataloging\""
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[23] bazaar.schema (required)"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_SCHEMA_CONTENT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "the bazaar schema meets its own content MUSTs: requires `input`, and every $ref/$id is same-document",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:313-322 § Schema Validation — Draft 2020-12, \"Must define an input property (required)\", and \"$ref and $id values must be same-document JSON Pointer fragments (starting with #); external references … are not allowed\""
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 5 — an external $ref broke CDP’s validator outright"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_INFO_VALIDATES",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "info validates against its own schema",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:322 — facilitators MUST validate info against schema before cataloging"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[24] parse (required)"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 — an info/schema mismatch is declined silently; nothing reaches the seller’s logs"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_BAG_MISMATCH",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "every key a schema parameter-bag requires is supplied by info in THAT bag, not a sibling bag",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:322 — the info/schema validation this contradiction is guaranteed to fail"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3104 (Circadian-agent, 2026-08-20) — 276 of 14,691 live listings with a `required` key fail their own schema, across 59 hosts; the named specimen requires `name` in queryParams while its own example supplies it in pathParams"
        },
        {
          "kind": "field-report",
          "ref": "Circadian-agent/agent-economy-data findings/bazaar-info-fails-own-schema-2026-08-20.md — the census behind those counts"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_INPUT",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "bazaar.info.input carries a worked sample call",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:245-282 § Discovery Info Structure — input is Required in every discriminant"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[17] bazaar.info.input (required)"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_INPUT_TYPE",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "bazaar.info.input.type is the \"http\" or \"mcp\" discriminator, with that branch’s required fields",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:251-282 — type Required (\"http\"/\"mcp\"); bodyType and body Required for POST/PUT/PATCH; toolName and inputSchema Required for mcp"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[18] bazaar.info.input.type (required)"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 4 — the missing `type` discriminator"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_INPUT_METHOD",
      "area": "v2",
      "regime": "bazaar",
      "severity": "error",
      "core": false,
      "summary": "bazaar.info.input.method is an HTTP verb from the spec’s enums, and matches the verb that was probed",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:251-269 — method Required, one of GET/HEAD/DELETE or POST/PUT/PATCH"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[19] bazaar.info.input.method and preflight[20] bazaar.info.input.method.matches_request, both required"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_OUTPUT_TYPE",
      "area": "v2",
      "regime": "bazaar",
      "severity": "warn",
      "core": false,
      "summary": "bazaar.info.output, when published, carries its Required `type`",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:284-294 § Output Types — output optional; within it, type Required"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[21] bazaar.info.output (advisory)"
        }
      ]
    },
    {
      "id": "V2_BAZAAR_OUTPUT_EXAMPLE",
      "area": "v2",
      "regime": "bazaar",
      "severity": "info",
      "core": false,
      "summary": "bazaar.info.output.example is a computed response — any JSON value, and CDP grades it advisory",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:284-294 — the example row is `example | any | No`"
        },
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:46-53 — the spec’s own GET example gives output.example as an OBJECT"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[22] bazaar.info.output.example (advisory)"
        }
      ]
    },
    {
      "id": "V1_ABSENT",
      "area": "v1",
      "regime": "payment",
      "severity": "info",
      "core": false,
      "summary": "a v1 body envelope is published alongside the v2 header",
      "sources": [
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22 — the v1 client reads the body and never looks at PAYMENT-REQUIRED"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3091 — the pre-header buyer population is real and shrinking"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[4] valid_json (required) — an EMPTY 402 body fails it, so serve at least `{}`"
        }
      ]
    },
    {
      "id": "V1_BODY_NOT_ENVELOPE",
      "area": "v1",
      "regime": "payment",
      "severity": "info",
      "core": false,
      "summary": "the 402 body is a v1 envelope or is empty, not something a v1 client will misread",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"
        },
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:19-25 — the spec’s own 402 example serves a body of `{}`"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — an error blob makes accepts undefined and .map throws"
        },
        {
          "kind": "cdp-validator",
          "ref": "cdp-validator-toolshed.json preflight[4] valid_json (required) — the body is parsed as JSON during indexing"
        }
      ]
    },
    {
      "id": "V1_BODY_PRESENT",
      "area": "v1",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "a v1 envelope is published in the 402 body",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v1/http.md § Payment Required Signaling"
        },
        {
          "kind": "house-opinion",
          "ref": "only fires when nothing was published in either transport; ENVELOPE_PRESENT carries the core error for that case"
        }
      ]
    },
    {
      "id": "V1_BODY_JSON",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the 402 body parses as JSON",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md § 5.1.1 JSON Payload"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22 — response.json() with no try/catch"
        }
      ]
    },
    {
      "id": "V1_VERSION",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the body declares x402Version 1",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:99-108 § 5.1.2"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1625 — the body fallback requires x402Version === 1 exactly"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:388 — x402Versions = [1]"
        }
      ]
    },
    {
      "id": "V1_ACCEPTS_NONEMPTY",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "accepts[] is a non-empty array",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:99-108 § 5.1.2 — accepts Required"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:93 — accepts: z.array(PaymentRequirementsV1Schema).min(1)"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:23 — accepts.map throws when accepts is absent"
        }
      ]
    },
    {
      "id": "V1_SCHEME",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "each accept names a scheme",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z.enum(schemes)"
        }
      ]
    },
    {
      "id": "V1_SCHEME_KNOWN",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "the v1 scheme is `exact` — v1’s enum is closed where v2’s is open",
      "sources": [
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:387 — var schemes = [\"exact\"]"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z3.enum(schemes), applied per accepts entry"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"
        }
      ]
    },
    {
      "id": "V1_MAX_AMOUNT_REQUIRED",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the price is in `maxAmountRequired`, not the v2 `amount`",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:440 — maxAmountRequired is required; `amount` is not a v1 key"
        }
      ]
    },
    {
      "id": "V1_AMOUNT_ATOMIC",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "maxAmountRequired is a string of atomic units",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — z3.string().refine(isInteger)"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:30 — BigInt(maxAmountRequired) throws on a non-digit string"
        }
      ]
    },
    {
      "id": "V1_NETWORK_NAME",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "network is a v1 plain name, not CAIP-2",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — NetworkSchema is a z.enum of plain names; no member contains a colon"
        }
      ]
    },
    {
      "id": "V1_NETWORK_KNOWN",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "the v1 network name is one of the seventeen the dominant v1 client’s enum admits",
      "sources": [
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the closed z.enum: abstract, abstract-testnet, base-sepolia, base, avalanche-fuji, avalanche, iotex, solana-devnet, solana, sei, sei-testnet, polygon, polygon-amoy, peaq, story, educhain, skale-base-sepolia"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"
        },
        {
          "kind": "house-opinion",
          "ref": "@x402/core@2.23.0's v1-compatibility schema is looser (@x402/core@2.23.0 dist/cjs/schemas/index.js:62, NonEmptyString), so this is a claim about the dominant v1 client rather than about every parser — hence error, not core"
        }
      ]
    },
    {
      "id": "V1_RESOURCE_STRING",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "resource is a flat, absolute URL string, not the v2 object",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:441 — resource: z3.string().url(), so a bare path is a hard ZodError"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 wire-format bug 3, in its v1 spelling"
        }
      ]
    },
    {
      "id": "V1_PAYTO",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "payTo has the address shape its v1 network requires (EVM 0x, or base58 on solana)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:435 — EvmOrSvmAddress = EvmAddressRegex.or(SvmAddressRegex)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the enum includes solana and solana-devnet"
        }
      ]
    },
    {
      "id": "V1_ASSET",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "asset names the token in the form its v1 network requires",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:436,447 — asset: mixedAddressOrSvmAddress"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:75 — verifyingContract: getAddress(asset), which throws on a ticker"
        }
      ]
    },
    {
      "id": "V1_MIMETYPE",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "mimeType is present (spec: Optional — but the dominant v1 client’s schema requires it)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — mimeType Optional"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:443 — mimeType: z3.string(), NOT .optional()"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"
        },
        {
          "kind": "house-opinion",
          "ref": "@x402/core@2.23.0's v1 schema does make it optional (@x402/core@2.23.0 dist/cjs/schemas/index.js:83) — the two v1 parsers disagree"
        }
      ]
    },
    {
      "id": "V1_DESCRIPTION",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "description is present (missing is an error; present-but-empty is a warn)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — description Required"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:442 — description: z3.string(), required"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:82 — required in the modern v1-compatibility schema too"
        }
      ]
    },
    {
      "id": "V1_MAX_TIMEOUT",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "maxTimeoutSeconds is a positive integer JSON number",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — maxTimeoutSeconds, type number, Required"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:446 — z3.number().int(), so the string \"60\" is a ZodError"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:86 — z.number().positive(), required"
        }
      ]
    },
    {
      "id": "V1_EXTRA_EIP712",
      "area": "v1",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "extra carries the EIP-712 domain the v1 client signs over (EVM networks only)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version required for eip3009"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:65-76 — signAuthorization reads extra?.name and extra?.version straight into the typed-data domain, with no fallback"
        },
        {
          "kind": "house-opinion",
          "ref": "the reference facilitator recomputes the domain from its own table, so the mismatch surfaces only as invalid_exact_evm_payload_signature"
        },
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:261 — v1 Solana exact uses TransferChecked, which has no EIP-712 domain"
        }
      ]
    },
    {
      "id": "V1_OUTPUT_SCHEMA",
      "area": "v1",
      "regime": "bazaar",
      "severity": "warn",
      "core": false,
      "summary": "outputSchema is present for v1 discovery",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — outputSchema Optional"
        },
        {
          "kind": "spec",
          "ref": "specs/extensions/bazaar.md:577+ § Backwards Compatibility — v1 discovery rode on outputSchema"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#2844 — indexing began after the metadata moved there"
        }
      ]
    },
    {
      "id": "V1_DISCOVERABLE",
      "area": "v1",
      "regime": "bazaar",
      "severity": "info",
      "core": false,
      "summary": "outputSchema.input.discoverable is an opt-OUT — absence means indexed",
      "sources": [
        {
          "kind": "client-code",
          "ref": "x402-foundation/x402 go/extensions/v1/facilitator.go (main, read 2026-08-19) — \"// Check if discoverable (default to true if not specified)\" followed by `discoverable := true`, then an override only when the key is present"
        },
        {
          "kind": "live",
          "ref": "worker/positive-control.js — a live indexed seller nests the flag under outputSchema.input"
        },
        {
          "kind": "cdp-docs",
          "ref": "https://docs.cdp.coinbase.com/x402/bazaar — v1 discovery data reads input.discoverable"
        }
      ]
    },
    {
      "id": "DUAL_PAYTO",
      "area": "dual",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "matched offers pay the same address",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — two views of one offer; divergence means half the revenue lands elsewhere"
        },
        {
          "kind": "client-code",
          "ref": "@x402/evm@2.23.0 dist/cjs/index.js:568 — getAddress is case-insensitive, so the comparison is too",
          "context": true
        }
      ]
    },
    {
      "id": "DUAL_PRICE",
      "area": "dual",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "matched offers quote the same price",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — one offer must not carry two prices; matched on (chain, asset) so different-decimal assets are not compared"
        }
      ]
    },
    {
      "id": "DUAL_NETWORK",
      "area": "dual",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "the two envelopes offer overlapping chains",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — a payment signed on one chain is worthless on the other"
        },
        {
          "kind": "client-code",
          "ref": "x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:52-70 — the client’s own EvmNetworkToChainId map, which is the two spellings of one chain",
          "context": true
        }
      ]
    },
    {
      "id": "DUAL_ASSET",
      "area": "dual",
      "regime": "payment",
      "severity": "error",
      "core": true,
      "summary": "matched offers name the same asset",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — different assets means the two versions are selling for different money"
        }
      ]
    },
    {
      "id": "DUAL_RESOURCE",
      "area": "dual",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "both versions name the same resource URL",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — two URLs split one endpoint’s settlement record across two listings"
        },
        {
          "kind": "field-report",
          "ref": "x402-foundation/x402#3045 — discovery keys on the resource URL"
        }
      ]
    },
    {
      "id": "VERSION_HEADER_SAYS_V1",
      "area": "version",
      "regime": "payment",
      "severity": "error",
      "core": false,
      "summary": "the PAYMENT-REQUIRED header does not carry a v1 payload",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:7-25 § Payment Required Signaling"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/schemas/index.js:128-131 — PaymentRequired is a discriminatedUnion on x402Version, so a v1 payload in the header is legally parsed AS v1"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/esm/client/index.mjs:219 — registeredClientSchemes.get(paymentRequired.x402Version): dispatch is on the PAYLOAD’s version, and a v1 client answers with X-PAYMENT while a v2 server reads PAYMENT-SIGNATURE"
        }
      ]
    },
    {
      "id": "VERSION_BODY_SAYS_V2",
      "area": "version",
      "regime": "payment",
      "severity": "warn",
      "core": false,
      "summary": "the 402 body does not carry a v2 payload (a core error when no valid v2 header is published)",
      "sources": [
        {
          "kind": "spec",
          "ref": "specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"
        },
        {
          "kind": "client-code",
          "ref": "@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the header wins whenever present; the body fallback accepts only x402Version === 1"
        },
        {
          "kind": "client-code",
          "ref": "x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — a v1 client reads the body with v1 rules whatever it declares"
        }
      ]
    },
    {
      "id": "ACCEPTS_TRUNCATED",
      "area": "report",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "at most 8 accepts[] entries are linted per envelope",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js MAX_ACCEPTS_LINTED = 8"
        }
      ]
    },
    {
      "id": "FINDINGS_TRUNCATED",
      "area": "report",
      "regime": "hygiene",
      "severity": "info",
      "core": false,
      "summary": "this report is complete — no bound clipped it",
      "sources": [
        {
          "kind": "house-opinion",
          "ref": "worker/lint.js — MAX_FINDINGS = 200, MAX_ACCEPTS_LINTED = 8, and the caller's body byte cap"
        }
      ]
    }
  ],
  "notes": [
    "A 402 from a paid endpoint here is a price quote, not an error.",
    "checks_run in a report is how many checks APPLIED — a v1-only endpoint legitimately skips every v2 check.",
    "A report carries TWO verdicts. grade answers \"can I be paid\"; summary.bazaar_ready answers \"can I be found\".",
    "POST /lint sends exactly one unauthenticated request to the URL you name.",
    "POST /lint/envelope fetches nothing, so it works on staging, on localhost and on an endpoint that is not deployed yet.",
    "The two /one routes answer about exactly ONE check you name in a required check field."
  ]
}