scvd-defects

scvd.store's x402 defect vocabulary as data: every class with what it asserts, what a buyer loses when it is present, whether an unpaid probe can see it, what would falsify a finding of it, and both halves of the remediation (what the operator does, what the buyer does). Plus recorded 402 doors as fixtures, each naming the checks it is bad in, for testing a client offline.

npm install scvd-defects

Use

import { VOCABULARY_VERSION, defectClass, defectsBySignal, remediationFor, byDetectability, isStale } from "scvd-defects";

defectClass("no-402");                 // the class, whole
defectsBySignal("accepts");            // every class that check name explains (two)
remediationFor("wrong-network");       // { operator, buyer, definition_url }
byDetectability().paid;                // the classes only a settled payment reveals
VOCABULARY_VERSION;                    // the bundled vocabulary version
await isStale();                       // { stale, snapshot, live }

import { readSettlementResponse } from "scvd-defects/settlement-response";

const reading = readSettlementResponse(paymentResponseHeader);
reading.outcome;   // "settled" | "failed" | "unresolved"
reading.failed;    // the settlement-response-v1 checks the bytes fail
reading.reading;   // one sentence on what a reader may conclude

defects.json is a snapshot of https://scvd.store/defects.json cut from the store's own source. The live document is the authority; definitions are never edited in place, so a snapshot is never wrong about its own version, only possibly behind, and isStale() says which. The package's minor version is the vocabulary version it carries; read VOCABULARY_VERSION for this snapshot's version.

The fixtures

fixtures/doors/*.json are recorded 402 responses — status, headers, body — each with expect_failed: the battery checks that door fails, and no others. They are the store's own release gate for a battery version; here they are a test corpus for your client: a parser that handles every one of them handles the shapes the August field run proved real.

fixtures/settlement-responses/*.json are settlement responses — the SettleResponse a buyer holds base64 in PAYMENT-RESPONSE, or a facilitator's /settle body — each with expect_failed (the settlement-response-v1 checks it fails), expect_outcome (what a reader must conclude: settled, failed or unresolved) and must_not_conclude. The pending shapes are the negative control: settlement_pending is non-terminal under x402 v2 §9, and a reader that maps success:false to failed re-challenges a buyer whose money is on its way. Run your own reader over the twelve and compare; a suite that passes them all and cannot fail the naive reader is not a suite. The reader beside them, readSettlementResponse, is the reference, and it reads the merged specification only: the settlement status vocabulary proposed on x402-foundation/x402#3325 is ignored until it merges.

What each fixture says about itself

Every fixture declares its own provenance, in the vocabulary agreed on x402-foundation/x402#3396:

| field | means | |---|---| | proves / why | the claim the fixture makes, inside the file rather than in prose beside it | | source | simulated (constructed from a specification), observed (bytes a live door served), or derived (a capture altered, and the alteration named) | | captured_at | when the bytes were taken; null for a constructed shape, which has no birth date |

The freshness half of the pair, last_verified_at, is not in these files: a file cannot know when it was last replayed. It rides the served index at https://scvd.store/fixtures.json, where it is the deploy that last ran the suite over every fixture. A conformance verdict is a claim about the day it ran, and this package ships the claim while the index dates it.

What it is not

Not a ranking and not a list of anybody: every class describes an observable property of one endpoint at one moment, and a hostname never appears here. The names are CC BY 4.0; the code is MIT.

Versioning

The minor version tracks the vocabulary version; patches fix the package, never a definition. Versions are immutable once published. The dated record is CHANGELOG.md; the vocabulary's own changelog rides inside defects.json.