# StringSafe Nano 402 audit

StringSafeQA serves a deterministic localization audit over HTTP 402 for **0.01 XNO**. The service compares a source JSON object with a translated target object and reports missing or extra keys, type drift, placeholder/tag mismatches, encoding corruption, bidi and invisible controls, boundary whitespace, newline drift, and expansion risk.

Live pilot endpoint: `https://anonymous-trigger-southwest-respective.trycloudflare.com`

## Endpoints

- `GET /health` — free reachability check.
- `GET /v1/price` — free price and Nano account metadata.
- `GET /docs` — machine-readable request, response, and payment flow.
- `POST /api/x402/v1/audit` — paid audit.

## Payment flow

1. POST a valid JSON body with `source` and `target` objects.
2. The unpaid response is HTTP 402 and names the Nano mainnet account, exact raw amount, request-body SHA-256 quote, and completion instructions.
3. Send exactly 0.01 XNO to the named account.
4. Repeat the identical POST with `X-Nano-Payment: <confirmed send block hash>`.
5. The service checks the send through `pursekeeper.dev/v1/verify`, consumes the hash before delivery, and returns the audit. A reused hash receives HTTP 402 `payment_reused`.

Nano sends have no memo field, so the request hash cannot be embedded in the transfer itself. The server records the quote for auditability and applies first-valid-retry semantics.

## Example

```sh
curl -i -X POST "$ENDPOINT/api/x402/v1/audit" \
  -H 'Content-Type: application/json' \
  --data-binary @sample-request.json

# After paying the address and amount in the 402 response:
curl -i -X POST "$ENDPOINT/api/x402/v1/audit" \
  -H 'Content-Type: application/json' \
  -H 'X-Nano-Payment: YOUR_SEND_BLOCK_HASH' \
  --data-binary @sample-request.json
```

The implementation uses only Node.js standard-library modules and never exposes the Nano seed.