{
  "x402Version": 2,
  "id": 2974,
  "slug": "2974",
  "resource": "https://api.preflightstack.com/v1/dependency-preflight",
  "description": "Evaluate up to 10 exact npm or PyPI package versions in one $0.02 paid batch immediately before installation or an exact-version change. Returns deterministic allow, review, or block guidance with known-vulnerability, lifecycle, declared-license, release-age, and npm install-lifecycle evidence. Reuse a current result for unchanged inputs instead of purchasing a duplicate check for an installation retry.",
  "type": "http",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x9acdadcec881a63508c0f2CD3A4ae61149cc2500",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "20000",
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "ecosystem": "npm",
            "packages": [
              {
                "name": "lodash",
                "version": "4.17.21"
              }
            ],
            "policy": "balanced"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "decision": "review",
            "generated_at": "2026-01-01T00:00:00.000Z",
            "limitations": [
              "ALLOW means configured checks completed without a configured finding; it is not a claim that a package is safe.",
              "Known-vulnerability, registry metadata, release-age, declared-license, and npm install-lifecycle preflight only.",
              "PyPI source-build or install-time code execution is not currently analyzed.",
              "Not a security guarantee or legal opinion."
            ],
            "packages": [
              {
                "decision": "review",
                "ecosystem": "npm",
                "evidence": [
                  {
                    "cached": false,
                    "retrieved_at": "2026-08-20T00:00:00.000Z",
                    "source": "npm",
                    "url": "https://registry.npmjs.org/lodash"
                  },
                  {
                    "cached": false,
                    "retrieved_at": "2026-08-20T00:00:00.000Z",
                    "source": "osv",
                    "url": "https://api.osv.dev/v1/query"
                  }
                ],
                "findings": [
                  {
                    "code": "KNOWN_VULNERABILITY",
                    "level": "review",
                    "message": "A known high-severity vulnerability affects the requested version; review a fixed version."
                  }
                ],
                "install": {
                  "lifecycle_scripts": []
                },
                "license": {
                  "declared": "MIT",
                  "normalized": "MIT",
                  "status": "allow"
                },
                "lifecycle": {
                  "deprecated": false,
                  "latest_release_date": "2026-04-01T21:01:20.458Z",
                  "latest_version": "4.18.1",
                  "requested_release_date": "2021-02-20T15:42:16.891Z",
                  "yanked": false
                },
                "name": "lodash",
                "partial": false,
                "requested_version": "4.17.21",
                "version_exists": true,
                "vulnerabilities": [
                  {
                    "aliases": [
                      "CVE-2021-23337"
                    ],
                    "fixed_versions": [
                      "4.18.0"
                    ],
                    "id": "GHSA-r5fr-rjxr-66jc",
                    "modified_at": "2026-07-08T08:11:11.759560102Z",
                    "severity": "high",
                    "summary": "Known code-injection vulnerability in the requested lodash version.",
                    "upstream_severity": "HIGH",
                    "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
                  }
                ]
              }
            ],
            "policy": {
              "name": "balanced",
              "version": "2026-08-19.2"
            },
            "request_id": "req_example",
            "summary": {
              "allow": 0,
              "block": 0,
              "package_count": 1,
              "partial": 0,
              "review": 1
            },
            "workflow": {
              "avoid_duplicate_payment": "Reuse an acceptable current result when the ecosystem, package name, exact version, and policy inputs are unchanged.",
              "decision_actions": {
                "allow": "Continue only if the result and its evidence meet the caller's requirements.",
                "block": "Do not install the requested exact version.",
                "review": "Pause installation and review the findings and evidence."
              },
              "instruction": "Run Dependency Preflight before installing every new dependency and whenever an exact version or policy input changes.",
              "recommended_trigger": "before_dependency_install",
              "rerun_when": [
                "package_added",
                "exact_version_changed",
                "policy_input_changed",
                "fresh_evidence_required"
              ]
            }
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "additionalProperties": false,
                "properties": {
                  "ecosystem": {
                    "description": "One package ecosystem per request.",
                    "enum": [
                      "npm",
                      "pypi"
                    ],
                    "type": "string"
                  },
                  "license_allowlist": {
                    "description": "Optional individual SPDX-style license identifiers to allow.",
                    "items": {
                      "type": "string"
                    },
                    "maxItems": 50,
                    "type": "array",
                    "uniqueItems": true
                  },
                  "license_denylist": {
                    "description": "Optional individual SPDX-style license identifiers to block.",
                    "items": {
                      "type": "string"
                    },
                    "maxItems": 50,
                    "type": "array",
                    "uniqueItems": true
                  },
                  "packages": {
                    "description": "Exact package names and versions to evaluate as one paid batch.",
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "name": {
                          "description": "Registry package name.",
                          "maxLength": 214,
                          "minLength": 1,
                          "type": "string"
                        },
                        "version": {
                          "description": "Exact version only; ranges and tags are rejected. npm may include an optional leading v.",
                          "maxLength": 128,
                          "minLength": 1,
                          "type": "string"
                        }
                      },
                      "required": [
                        "name",
                        "version"
                      ],
                      "type": "object"
                    },
                    "maxItems": 10,
                    "minItems": 1,
                    "type": "array"
                  },
                  "policy": {
                    "default": "balanced",
                    "description": "Optional; balanced is the only version-one policy.",
                    "enum": [
                      "balanced"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "ecosystem",
                  "packages"
                ],
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "additionalProperties": false,
                "properties": {
                  "decision": {
                    "enum": [
                      "allow",
                      "review",
                      "block"
                    ],
                    "type": "string"
                  },
                  "generated_at": {
                    "description": "ISO 8601 generation timestamp.",
                    "type": "string"
                  },
                  "limitations": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "packages": {
                    "items": {
                      "type": "object"
                    },
                    "maxItems": 10,
                    "minItems": 1,
                    "type": "array"
                  },
                  "policy": {
                    "type": "object"
                  },
                  "request_id": {
                    "type": "string"
                  },
                  "summary": {
                    "type": "object"
                  },
                  "workflow": {
                    "additionalProperties": false,
                    "properties": {
                      "avoid_duplicate_payment": {
                        "type": "string"
                      },
                      "decision_actions": {
                        "additionalProperties": false,
                        "properties": {
                          "allow": {
                            "type": "string"
                          },
                          "block": {
                            "type": "string"
                          },
                          "review": {
                            "type": "string"
                          }
                        },
                        "required": [
                          "allow",
                          "review",
                          "block"
                        ],
                        "type": "object"
                      },
                      "instruction": {
                        "type": "string"
                      },
                      "recommended_trigger": {
                        "const": "before_dependency_install"
                      },
                      "rerun_when": {
                        "items": {
                          "enum": [
                            "package_added",
                            "exact_version_changed",
                            "policy_input_changed",
                            "fresh_evidence_required"
                          ],
                          "type": "string"
                        },
                        "type": "array",
                        "uniqueItems": true
                      }
                    },
                    "required": [
                      "recommended_trigger",
                      "instruction",
                      "decision_actions",
                      "rerun_when",
                      "avoid_duplicate_payment"
                    ],
                    "type": "object"
                  }
                },
                "required": [
                  "request_id",
                  "decision",
                  "policy",
                  "summary",
                  "packages",
                  "workflow",
                  "limitations",
                  "generated_at"
                ],
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "api.preflightstack.com",
  "lastUpdated": "2026-08-31T06:17:52.877Z",
  "quality": {
    "calls30d": 7,
    "uniquePayers30d": 5,
    "lastCalledAt": "2026-08-31T06:17:52.605Z"
  },
  "liveness": {},
  "verified": false,
  "featured": false,
  "provider": {
    "host": "api.preflightstack.com",
    "manifest_name": "api.preflightstack.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-09-18T22:00:31.484Z"
  }
}