{
  "projectId": "x402",
  "title": "x402 客户端、验证与结算的分层",
  "summary": "核心发行包把买方构建付款凭据与 facilitator 的验证、结算分开。支付协议本身不等于一个自主交易 Agent。",
  "scope": "npm @x402/core@2.28.0 的选定发布文件；REA 解析 2 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:33:56.289295+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "客户端按 scheme 和 network 选择付款实现",
      "detail": "x402Client 的 createPaymentPayload 把支付要求交给已注册的 scheme/network 实现，并提供策略与生命周期 hooks；支持哪条链和哪种钱包取决于外部注册的实现。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_767c16792ab678651d32b53bcfe68deb77e6db1bc220ec274d8eb44d1f3dd238"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@x402/core/-/core-2.28.0.tgz"
      ]
    },
    {
      "title": "verify 与 settle 是两个独立步骤",
      "detail": "facilitator 分别暴露 verify 和 settle，委托 schemeNetworkFacilitator 对应方法，并包含待结算状态存储。验证通过不等于链上结算已完成。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_767c16792ab678651d32b53bcfe68deb77e6db1bc220ec274d8eb44d1f3dd238"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@x402/core/-/core-2.28.0.tgz"
      ]
    }
  ],
  "limitations": [
    "只覆盖 core 的客户端与 facilitator；未运行具体链支付方案。",
    "没有发送支付、签名或执行商户端到端结算。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "@x402/core@2.28.0",
      "url": "https://registry.npmjs.org/@x402/core/-/core-2.28.0.tgz",
      "sha256": "bf005c228d127ebb0ba58d3722bf5cd5540f0316a17c09dff352127a4c018e34"
    },
    {
      "label": "dist--cjs--client--index.js",
      "url": "https://registry.npmjs.org/@x402/core/-/core-2.28.0.tgz",
      "sha256": "fef97a6df4e89862d3bc16c70ee344a2817fd5cece03e2e7c8b9dedb982f1160"
    },
    {
      "label": "dist--cjs--facilitator--index.js",
      "url": "https://registry.npmjs.org/@x402/core/-/core-2.28.0.tgz",
      "sha256": "79d8a7142d702db234b66753ff772300c1decefd940fec0383e6ab10011fecb7"
    }
  ],
  "evidenceIds": [
    "ev_767c16792ab678651d32b53bcfe68deb77e6db1bc220ec274d8eb44d1f3dd238"
  ],
  "reportUrl": "/research/rea/x402.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "fe759b46d6a60ab7491138390f222e234ba4500131a465a75ca3b8a4470341a0",
    "inputFileCount": 2,
    "inputBytes": 63170,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}