{
  "openapi": "3.1.0",
  "info": {
    "title": "ToolMint DevSec Pack JSON",
    "version": "0.1.0",
    "description": "Dependency check for AI coding agents: trust, vulnerabilities at a version (OSV + CISA KEV + FIRST EPSS) and license obligations in one call. Pay per call with USDC on Base via x402. Heuristic, not legal advice.",
    "x-guidance": "GET /pack?eco=npm|pypi&name=<pkg>[&version=<exact>]. Omit version for latest. verdict is allow|review|block; actions[] says what to do. Unpaid calls get HTTP 402 (x402, USDC on Base). 4xx/5xx are not charged. Free: /, /health, /openapi.json, /.well-known/x402.",
    "contact": {
      "email": "toolmint.dev@gmail.com",
      "name": "ToolMint"
    }
  },
  "paths": {
    "/health": {
      "get": {
        "operationId": "health",
        "summary": "Liveness",
        "security": [],
        "responses": {
          "200": {
            "description": "ok"
          }
        }
      }
    },
    "/pack": {
      "get": {
        "operationId": "devsec_pack",
        "summary": "DevSec pack for one package version",
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.008000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ],
          "network": "eip155:8453",
          "payTo": "0xfbF7413bcB3a604936775C96FDbe0b0C9c9E37F5",
          "asset": "USDC",
          "scheme": "exact",
          "amountAtomic": "8000"
        },
        "parameters": [
          {
            "name": "eco",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "enum": [
                "npm",
                "pypi"
              ]
            }
          },
          {
            "name": "name",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string",
              "maxLength": 214
            }
          },
          {
            "name": "version",
            "in": "query",
            "schema": {
              "type": "string",
              "maxLength": 64
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Pack: verdict, actions, trust, vulns (with KEV/EPSS/fixedIn), license obligations, warnings, sources"
          },
          "400": {
            "description": "Bad parameters (not charged)"
          },
          "402": {
            "description": "Payment Required"
          },
          "404": {
            "description": "Package or version not found (not charged); may include typoNeighbors"
          },
          "502": {
            "description": "Registry or OSV unavailable (not charged)"
          }
        }
      }
    },
    "/pack/{eco}/{name}": {
      "get": {
        "operationId": "devsec_pack_by_path",
        "summary": "DevSec pack (path form)",
        "x-payment-info": {
          "price": {
            "mode": "fixed",
            "currency": "USD",
            "amount": "0.008000"
          },
          "protocols": [
            {
              "x402": {}
            }
          ],
          "network": "eip155:8453",
          "payTo": "0xfbF7413bcB3a604936775C96FDbe0b0C9c9E37F5",
          "asset": "USDC",
          "scheme": "exact",
          "amountAtomic": "8000"
        },
        "parameters": [
          {
            "name": "eco",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "enum": [
                "npm",
                "pypi"
              ]
            }
          },
          {
            "name": "name",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "version",
            "in": "query",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Pack: verdict, actions, trust, vulns (with KEV/EPSS/fixedIn), license obligations, warnings, sources"
          },
          "400": {
            "description": "Bad parameters (not charged)"
          },
          "402": {
            "description": "Payment Required"
          },
          "404": {
            "description": "Package or version not found (not charged); may include typoNeighbors"
          },
          "502": {
            "description": "Registry or OSV unavailable (not charged)"
          }
        }
      }
    }
  }
}