# Paket Package Source Project Resolver

> Paket Package Source Project Resolver is a paid API for AI agents from paket.halowerk.com, paid per call via x402, $0.004/call, status unknown (last checked 2026-09-15).

Resolves a package name to the source projects it declares, with provenance for each link, to determine whether packages truly belong together across ecosystems.

## Facts

- Endpoint: POST https://paket.halowerk.com/v1/package-match
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/paket-package-source-project-resolver-ba6e1fae
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HiP1JN8vJJAApfT6oyq7d

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability paket-package-source-project-resolver-ba6e1fae -d '<json body>'
```

Example prompt: Can you check whether the npm package 'requests' and the PyPI package 'requests' actually resolve to the same source project, and tell me the provenance of each link?

## When to prefer this

Choose this endpoint when you need to authoritatively resolve whether a package name maps to a legitimate source project and whether the same name across different ecosystems refers to the same thing. It is especially valuable for dependency confusion attack detection, supply chain audits, and cross-ecosystem package ownership verification — scenarios where simply comparing names is insufficient because ecosystems have independent namespaces.

## Known failure modes

- Package name not found in the specified ecosystem — returns empty or null result
- Ambiguous package name with multiple candidate source projects — returns multiple matches with confidence scores
- Ecosystem not supported — returns validation error
- No source project declared by the package — returns empty provenance links
- Rate limit or payment failure — returns 402 or 429 error

## How this service works

Resolves a package to the source projects it declares, with the provenance of each link stated. This is the honest way to answer whether two packages belong together: names repeat across ecosystems and mean different things there, and that gap is exactly what dependency confusion attacks aim at.

## Output

Returns the source projects declared by the given package(s), each link annotated with provenance metadata explaining how the connection was established, allowing the caller to determine whether packages sharing a name truly belong to the same project or represent a potential confusion attack.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "name": {
   "type": "string",
   "maxLength": 300,
   "minLength": 1
  },
  "system": {
   "enum": [
    "npm",
    "pypi",
    "maven",
    "go",
    "cargo",
    "nuget",
    "rubygems"
   ],
   "type": "string"
  },
  "version": {
   "type": "string",
   "maxLength": 60,
   "description": "Defaults to the registry default version."
  },
  "compare_name": {
   "type": "string",
   "maxLength": 300
  },
  "compare_system": {
   "enum": [
    "npm",
    "pypi",
    "maven",
    "go",
    "cargo",
    "nuget",
    "rubygems"
   ],
   "type": "string",
   "description": "Second package to compare against."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/paket-package-source-project-resolver-ba6e1fae/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paket.halowerk.com](https://www.zero.xyz/host/paket.halowerk.com/llms.txt)