10x402 · Lint Envelope

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://10x402.com/lint/envelope", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify("{\"status\":402,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"x402Version\\\":1,\\\"accepts\\\":[{\\\"scheme\\\":\\\"exact\\\",\\\"network\\\":\\\"base\\\",\\\"maxAmountRequired\\\":\\\"1000\\\",\\\"resource\\\":\\\"https://example.com/api/thing\\\",\\\"description\\\":\\\"an example paid endpoint\\\",\\\"mimeType\\\":\\\"application/json\\\",\\\"payTo\\\":\\\"0x0000000000000000000000000000000000000001\\\",\\\"maxTimeoutSeconds\\\":60,\\\"asset\\\":\\\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\\\",\\\"extra\\\":{\\\"name\\\":\\\"USD Coin\\\",\\\"version\\\":\\\"2\\\"},\\\"outputSchema\\\":{\\\"input\\\":{\\\"type\\\":\\\"http\\\",\\\"method\\\":\\\"POST\\\",\\\"discoverable\\\":true,\\\"bodyType\\\":\\\"text\\\",\\\"description\\\":\\\"the request body\\\"},\\\"output\\\":{\\\"type\\\":\\\"string\\\",\\\"description\\\":\\\"the response body\\\"}}}]}\"}"),
});
const data = await res.json();

curl -X POST \
  "https://10x402.com/lint/envelope" \
  -H "Content-Type: application/json" \
  -d '"{\"status\":402,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"x402Version\\\":1,\\\"accepts\\\":[{\\\"scheme\\\":\\\"exact\\\",\\\"network\\\":\\\"base\\\",\\\"maxAmountRequired\\\":\\\"1000\\\",\\\"resource\\\":\\\"https://example.com/api/thing\\\",\\\"description\\\":\\\"an example paid endpoint\\\",\\\"mimeType\\\":\\\"application/json\\\",\\\"payTo\\\":\\\"0x0000000000000000000000000000000000000001\\\",\\\"maxTimeoutSeconds\\\":60,\\\"asset\\\":\\\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\\\",\\\"extra\\\":{\\\"name\\\":\\\"USD Coin\\\",\\\"version\\\":\\\"2\\\"},\\\"outputSchema\\\":{\\\"input\\\":{\\\"type\\\":\\\"http\\\",\\\"method\\\":\\\"POST\\\",\\\"discoverable\\\":true,\\\"bodyType\\\":\\\"text\\\",\\\"description\\\":\\\"the request body\\\"},\\\"output\\\":{\\\"type\\\":\\\"string\\\",\\\"description\\\":\\\"the response body\\\"}}}]}\"}"' \
  -H "X-PAYMENT: <signed x402 payment>"

"{\"grade\":\"A\",\"summary\":{\"versions_detected\":[1],\"payTo\":\"0x0000000000000000000000000000000000000001\",\"network\":\"base\",\"price\":\"$0.001 (1000 atomic)\",\"bazaar_ready\":\"n/a\",\"blockers\":[\"V2_HEADER_PRESENT\"]},\"findings\":[{\"severity\":\"error\",\"code\":\"V2_HEADER_PRESENT\",\"message\":\"no PAYMENT-REQUIRED response header — this endpoint publishes no x402 v2 envelope.\",\"fix\":\"Add a PAYMENT-REQUIRED response header to the 402 carrying the standard-base64 JSON v2 envelope. This costs you DISCOVERY rather than payment, and the distinction is worth being precise about: @x402/core reads the header first but DOES fall back to a v1 body when there is none, so the current client generation can still pay you. What it cannot do is find you — CDP marks the PAYMENT-REQUIRED header a required indexing check, so a v1-only 402 is not catalogued at all, and a strictly-v2 client cannot pay it either. Keep the v1 body exactly as it is; the two versions share a 402 without either noticing the other.\",\"core\":false,\"sources\":[{\"kind\":\"spec\",\"ref\":\"specs/transports-v2/http.md:7-25 § Payment Required Signaling\"},{\"kind\":\"cdp-validator\",\"ref\":\"cdp-validator-toolshed.json preflight[6] payment_required_header (required)\"},{\"kind\":\"client-code\",\"ref\":\"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the v2 client DOES fall back to a v1 body\"},{\"kind\":\"field-report\",\"ref\":\"x402-foundation/x402#3091 — x402-fetch@1.x is still a live buyer population\"}]}],\"checks_run\":28}"