Lockfile Change Report

{
  "added_count": 1,
  "after_lockfile_version": 3,
  "after_package_count": 3,
  "assumptions": [
    "Packages are keyed by name taken from the install path, so one package appearing at two paths is compared once.",
    "The same version with a different integrity hash means the published artifact changed under a version that was supposed to be immutable, which is reported as the most serious finding available here.",
    "A newly installed transitive package is reported even though no manifest changed, because that is what a lockfile diff exists to show."
  ],
  "before_lockfile_version": 3,
  "before_package_count": 3,
  "changed_count": 1,
  "changes": [
    {
      "from": "1.0.0",
      "kind": "removed",
      "name": "dropped",
      "to": null
    },
    {
      "dev": false,
      "from": "4.18.2",
      "kind": "major",
      "name": "express",
      "potentially_breaking": true,
      "to": "5.0.0"
    },
    {
      "dev": false,
      "from": null,
      "kind": "added",
      "name": "router",
      "to": "2.0.0"
    }
  ],
  "complete": true,
  "finding_count": 3,
  "findings": [
    {
      "code": "POTENTIALLY_BREAKING_RESOLUTION",
      "dependency": "express",
      "detail": "express resolved from 4.18.2 to 5.0.0, a major change."
    },
    {
      "code": "INTEGRITY_CHANGED_WITHOUT_VERSION",
      "dependency": "cookie",
      "detail": "cookie is still 0.5.0 but its integrity hash changed, so the artifact behind an immutable version is not the one that was there before."
    },
    {
      "code": "PACKAGE_ADDED",
      "dependency": "router",
      "detail": "router at 2.0.0 is newly installed."
    }
  ],
  "findings_by_code": {
    "INTEGRITY_CHANGED_WITHOUT_VERSION": 1,
    "PACKAGE_ADDED": 1,
    "POTENTIALLY_BREAKING_RESOLUTION": 1
  },
  "integrity_change_count": 1,
  "limitations": [
    "Lockfile comparison only. No registry is contacted, no integrity hash is verified against an artifact, and no advisory database is consulted, so this is not a vulnerability or supply-chain attestation...",
    "unchanged is true only when both lockfiles were fully read and nothing moved."
  ],
  "limits": {
    "maxComponents": 5000,
    "maxDependencies": 5000,
    "maxFindings": 500,
    "maxJobs": 200,
    "maxResources": 2000,
    "maxServices": 200,
    "maxVariables": 1000
  },
  "not_examined": [],
  "observed_at": "2026-10-02T00:00:00.000Z",
  "passed": false,
  "potentially_breaking_count": 1,
  "registry_change_count": 0,
  "removed_count": 1,
  "request_id": "example-request",
  "service_id": "lockfile_change_report",
  "service_version": "1.0.0",
  "unchanged": false
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://api.zfinia.com/x402/v1/lockfile-change-report' \
  -H 'content-type: application/json' \
  --data-raw '{"after":{"lockfileVersion":3,"packages":{"":{"name":"orders-api","version":"2.2.0"},"node_modules/cookie":{"integrity":"sha512-TAMPERED","resolved":"https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz","version":"0.5.0"},"node_modules/express":{"integrity":"sha512-DDDD","resolved":"https://registry.npmjs.org/express/-/express-5.0.0.tgz","version":"5.0.0"},"node_modules/router":{"integrity":"sha512-EEEE","resolved":"https://packages.internal.example/router/-/router-2.0.0.tgz","version":"2.0.0"}}},"before":{"lockfileVersion":3,"packages":{"":{"name":"orders-api","version":"2.1.0"},"node_modules/cookie":{"integrity":"sha512-BBBB","resolved":"https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz","version":"0.5.0"},"node_modules/dropped":{"integrity":"sha512-CCCC","resolved":"https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz","version":"1.0.0"},"node_modules/express":{"integrity":"sha512-AAAA","resolved":"https://registry.npmjs.org/express/-/express-4.18.2.tgz","version":"4.18.2"}}},"expected_registry":"https://registry.npmjs.org/"}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://api.zfinia.com/x402/v1/lockfile-change-report' \
  -H 'content-type: application/json' \
  --data-raw '{"after":{"lockfileVersion":3,"packages":{"":{"name":"orders-api","version":"2.2.0"},"node_modules/cookie":{"integrity":"sha512-TAMPERED","resolved":"https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz","version":"0.5.0"},"node_modules/express":{"integrity":"sha512-DDDD","resolved":"https://registry.npmjs.org/express/-/express-5.0.0.tgz","version":"5.0.0"},"node_modules/router":{"integrity":"sha512-EEEE","resolved":"https://packages.internal.example/router/-/router-2.0.0.tgz","version":"2.0.0"}}},"before":{"lockfileVersion":3,"packages":{"":{"name":"orders-api","version":"2.1.0"},"node_modules/cookie":{"integrity":"sha512-BBBB","resolved":"https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz","version":"0.5.0"},"node_modules/dropped":{"integrity":"sha512-CCCC","resolved":"https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz","version":"1.0.0"},"node_modules/express":{"integrity":"sha512-AAAA","resolved":"https://registry.npmjs.org/express/-/express-4.18.2.tgz","version":"4.18.2"}}},"expected_registry":"https://registry.npmjs.org/"}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.18 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.18" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.18 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fapi.zfinia.com%2Fx402%2Fv1%2Flockfile-change-report&method=POST
const res = await pay("https://api.zfinia.com/x402/v1/lockfile-change-report", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "after": {
      "lockfileVersion": 3,
      "packages": {
        "": {
          "name": "orders-api",
          "version": "2.2.0"
        },
        "node_modules/cookie": {
          "integrity": "sha512-TAMPERED",
          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
          "version": "0.5.0"
        },
        "node_modules/express": {
          "integrity": "sha512-DDDD",
          "resolved": "https://registry.npmjs.org/express/-/express-5.0.0.tgz",
          "version": "5.0.0"
        },
        "node_modules/router": {
          "integrity": "sha512-EEEE",
          "resolved": "https://packages.internal.example/router/-/router-2.0.0.tgz",
          "version": "2.0.0"
        }
      }
    },
    "before": {
      "lockfileVersion": 3,
      "packages": {
        "": {
          "name": "orders-api",
          "version": "2.1.0"
        },
        "node_modules/cookie": {
          "integrity": "sha512-BBBB",
          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
          "version": "0.5.0"
        },
        "node_modules/dropped": {
          "integrity": "sha512-CCCC",
          "resolved": "https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz",
          "version": "1.0.0"
        },
        "node_modules/express": {
          "integrity": "sha512-AAAA",
          "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
          "version": "4.18.2"
        }
      }
    },
    "expected_registry": "https://registry.npmjs.org/"
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.18 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.18"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://api.zfinia.com/x402/v1/lockfile-change-report",
        json={
            "after": {
                "lockfileVersion": 3,
                "packages": {
                    "": {
                        "name": "orders-api",
                        "version": "2.2.0",
                    },
                    "node_modules/cookie": {
                        "integrity": "sha512-TAMPERED",
                        "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                        "version": "0.5.0",
                    },
                    "node_modules/express": {
                        "integrity": "sha512-DDDD",
                        "resolved": "https://registry.npmjs.org/express/-/express-5.0.0.tgz",
                        "version": "5.0.0",
                    },
                    "node_modules/router": {
                        "integrity": "sha512-EEEE",
                        "resolved": "https://packages.internal.example/router/-/router-2.0.0.tgz",
                        "version": "2.0.0",
                    },
                },
            },
            "before": {
                "lockfileVersion": 3,
                "packages": {
                    "": {
                        "name": "orders-api",
                        "version": "2.1.0",
                    },
                    "node_modules/cookie": {
                        "integrity": "sha512-BBBB",
                        "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
                        "version": "0.5.0",
                    },
                    "node_modules/dropped": {
                        "integrity": "sha512-CCCC",
                        "resolved": "https://registry.npmjs.org/dropped/-/dropped-1.0.0.tgz",
                        "version": "1.0.0",
                    },
                    "node_modules/express": {
                        "integrity": "sha512-AAAA",
                        "resolved": "https://registry.npmjs.org/express/-/express-4.18.2.tgz",
                        "version": "4.18.2",
                    },
                },
            },
            "expected_registry": "https://registry.npmjs.org/",
        },
    )
    print(res.status_code, res.text)