agent-commerce import openapi

agent-commerce import openapi <source> [options]

#Options

#Examples

agent-commerce import openapi ./openapi.yaml

$ agent-commerce import openapi ./openapi.yaml
OpenAPI 3.1: ./openapi.yaml

Imported: 12
Skipped:  1
Warnings: 3

Skipped operations:
  …

Warnings:
  …

Generated:
  openapi.agent-commerce.yaml

Pricing/exposure were not inferred.
Review the generated resources before merging them into config.yaml.

#What a draft looks like

POST /users/{userId}/orders?notify=true with a JSON body becomes:

# Generated by agent-commerce import openapi. Review before use.
# Source: openapi.yaml (OpenAPI 3.1)
# Merge the resources below into config.yaml once pricing, exposure and
# any backend authentication have been decided.

resources:
  # REVIEW: pricing and exposure are not inferred from OpenAPI. Add e.g.
  #   pricing: { type: free }   # or { type: fixed, amount: "0.01", currency: USDC } with payments: [x402]
  #   expose: [http]           # http | mcp | a2a | acp
  createOrder:
    name: Create an order
    description: Create an order
    input:
      type: object
      properties:
        path:
          type: object
          properties:
            userId:
              type: string
          required:
            - userId
          additionalProperties: false
        query:
          type: object
          properties:
            notify:
              type: boolean
          required:
            - notify
          additionalProperties: false
        body:
          type: object
          properties:
            productId:
              type: string
            quantity:
              type: integer
          required:
            - productId
          additionalProperties: false
      required:
        - path
        - query
        - body
      additionalProperties: false
    backend:
      type: http
      method: POST
      url: https://api.example.com/users/{userId}/orders
      inputBindings:
        path: path
        query: query
        body: body

Ids come from operationId, normalized, or from <method>_<path>. They are stable across runs; two operations that resolve to the same id fail the import instead of being renamed.

#Support matrix

A required unsupported feature skips the whole operation; an optional one is left out with a warning. A body on GET or DELETE is always left out with a warning. Schemas keep type, properties, required, additionalProperties, enum and items; validation keywords the gateway would not enforce are dropped and listed.

The draft also gets an output schema from one explicit 2xx JSON response: 200, then 201, 202, then the lowest other status. If that response has no schema, or one that cannot be converted, the output is left out with a warning; no other response is tried.

#Security properties

• Local files only, at most 10 MiB. Nothing in the document is executed, and the importer makes no network requests.
• Every external $ref is refused before validation; internal references get cycle and depth checks, and __proto__ is refused as a reference segment, parameter name or property name.
• Backend hosts come only from servers or --base-url. A relative or non-HTTP(S) server URL, or one with a query or fragment, skips that operation.
• Security declarations become a warning and a review comment, never credentials or agent input. Accept, Content-Type and Authorization header parameters are ignored.
• Vendor extensions are ignored and cannot set pricing, payments, backend URLs or exposure.
• Output is written to a temporary sibling and renamed; replacing an existing file needs --force.

#Exit codes

0 on success, warnings included. 1 on a load, import or write error, an --operation that matched nothing, an --expose value that is not a supported protocol, an existing output file without --force, no supported operation imported, or any warning under --strict. A failed run writes no file.