{"openapi":"3.1.0","info":{"title":"Package Evidence API","version":"0.1.0","description":"Paid, agent-ready npm package evidence over x402: registry facts, distribution integrity, provenance, and factual flags.","x-guidance":"Call /v1/npm/evidence with a public npm package name. Failed validation and unavailable upstream registry responses are not settled. Flags are factual observations about published metadata, never a safety, trust, or quality verdict."},"servers":[{"url":"https://packages.melchiorlabs.com"}],"paths":{"/v1/npm/evidence":{"post":{"summary":"Fetch deterministic npm package evidence","description":"Requires a valid x402 payment signature. Settlement occurs only after a successful response.","x-payment-info":{"price":{"mode":"fixed","currency":"USD","amount":"0.003"},"protocols":[{"x402":{"network":"eip155:8453","asset":"USDC"}},{"x402":{"network":"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp","asset":"USDC"}}]},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvidenceInput"},"example":{"package":"@x402/core","version":"latest"}}}},"responses":{"200":{"description":"Deterministic npm package evidence","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EvidenceResponse"}}}},"400":{"description":"Invalid input; payment is not settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"402":{"description":"x402 payment required"},"404":{"description":"Package or version not found; payment is not settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"429":{"description":"Per-caller unpaid-quote rate limit exceeded before payment processing; carries a Retry-After header; payment is not settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"502":{"description":"Upstream npm registry unavailable; payment is not settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"503":{"description":"Bounded upstream concurrency queue is saturated; carries a Retry-After header; payment is not settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}},"/v1/health":{"get":{"summary":"Check Package Evidence service health","responses":{"200":{"description":"Service is healthy","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HealthResponse"}}}}}}}},"components":{"schemas":{"EvidenceInput":{"type":"object","additionalProperties":false,"required":["package"],"properties":{"package":{"type":"string","maxLength":214,"description":"Public npm package name, scoped or unscoped, lowercase."},"version":{"type":"string","maxLength":64,"default":"latest","description":"Exact semver or dist-tag."},"nodeVersion":{"type":"string","maxLength":64,"description":"Exact stable semver; enables the node_engine_mismatch flag."}}},"EvidenceResponse":{"type":"object","required":["requestId","generatedAt","query","resolvedVersion","description","license","repositoryUrl","homepageUrl","engines","moduleType","exportsPresent","executables","fundingPresent","dependencies","dependencyCount","optionalDependencies","optionalDependencyCount","peerDependencies","peerDependencyCount","deprecated","distribution","maintainers","maintainerCount","downloads","downloadsWarning","flags","limitations","sourceUrls","fetchedAt","digests"],"properties":{"requestId":{"type":"string","format":"uuid"},"generatedAt":{"type":"string","format":"date-time"},"query":{"type":"object","required":["package","version"],"properties":{"package":{"type":"string"},"version":{"type":"string"},"nodeVersion":{"type":"string"}}},"resolvedVersion":{"type":"string"},"description":{"type":["string","null"]},"license":{"type":["string","null"]},"repositoryUrl":{"type":["string","null"]},"homepageUrl":{"type":["string","null"]},"engines":{"type":"object","additionalProperties":{"type":"string"}},"moduleType":{"type":"string","enum":["module","commonjs"]},"exportsPresent":{"type":"boolean"},"executables":{"type":"array","items":{"type":"string"}},"fundingPresent":{"type":"boolean"},"dependencies":{"type":"object","additionalProperties":{"type":"string"}},"dependencyCount":{"type":"integer","minimum":0},"optionalDependencies":{"type":"object","additionalProperties":{"type":"string"}},"optionalDependencyCount":{"type":"integer","minimum":0},"peerDependencies":{"type":"object","additionalProperties":{"type":"string"}},"peerDependencyCount":{"type":"integer","minimum":0},"deprecated":{"type":["string","null"]},"distribution":{"type":"object","required":["integrity","sha1","unpackedSize","fileCount","signatureCount","signatureKeyIds","attestationUrl","attestationPredicateType","trustedPublisherProvider"],"properties":{"integrity":{"type":["string","null"],"description":"Subresource integrity digest (dist.integrity) published for this version."},"sha1":{"type":["string","null"],"description":"Legacy SHA-1 shasum (dist.shasum) published for this version."},"unpackedSize":{"type":["integer","null"],"minimum":0},"fileCount":{"type":["integer","null"],"minimum":0},"signatureCount":{"type":"integer","minimum":0},"signatureKeyIds":{"type":"array","items":{"type":"string"}},"attestationUrl":{"type":["string","null"],"format":"uri","description":"Registry attestations index URL; never fetched by this service."},"attestationPredicateType":{"type":["string","null"]},"trustedPublisherProvider":{"type":["string","null"],"description":"OIDC trusted-publisher provider id (e.g. github) when the registry records one."}}},"maintainers":{"type":"array","items":{"type":"string"},"description":"Maintainer usernames only; never email addresses."},"maintainerCount":{"type":"integer","minimum":0},"downloads":{"type":["object","null"],"properties":{"weekly":{"type":"integer","minimum":0},"start":{"type":"string","format":"date"},"end":{"type":"string","format":"date"}}},"downloadsWarning":{"type":["string","null"]},"flags":{"type":"array","items":{"type":"string","enum":["deprecated","license_missing","repository_missing","integrity_missing","registry_signature_missing","provenance_attestation_missing","node_engine_mismatch"]}},"limitations":{"type":"array","items":{"type":"string"}},"sourceUrls":{"type":"object","required":["registry","downloads"],"properties":{"registry":{"type":"string","format":"uri"},"downloads":{"type":["string","null"],"format":"uri"}}},"fetchedAt":{"type":"object","required":["registry","downloads"],"properties":{"registry":{"type":"string","format":"date-time"},"downloads":{"type":["string","null"],"format":"date-time"}}},"digests":{"type":"object","required":["input","result"],"properties":{"input":{"type":"string","description":"SHA-256 of the canonicalized request query."},"result":{"type":"string","description":"SHA-256 of the canonicalized evidence, excluding requestId, generatedAt, and fetch timestamps."}}}}},"ErrorResponse":{"type":"object","required":["error","requestId"],"properties":{"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"}}},"requestId":{"type":"string","format":"uuid"}}},"HealthResponse":{"type":"object","required":["status","service","version","revision","uptimeSeconds","timestamp"],"properties":{"status":{"type":"string","const":"ok"},"service":{"type":"string"},"version":{"type":"string"},"revision":{"type":["string","null"]},"uptimeSeconds":{"type":"integer","minimum":0},"timestamp":{"type":"string","format":"date-time"}}}}},"x-x402":{"networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"asset":"USDC","resources":{"/v1/npm/evidence":"$0.003"}}}