cx-amazon-sp-api 0.1.2 → 0.1.4

package/README.md

@@ -0,0 +1 @@
+Lets cx work in your own Amazon store through Amazon's SP-API, in the marketplaces you authorise. cx can read your orders, listings, inventory and reports, and can make changes within what you authorise. Neither Amazon nor ComChatX charges for it.

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "cx-amazon-sp-api",
-  "version": "0.1.2",
+  "version": "0.1.4",
+  "description": "Reads and updates your own Amazon store.",
+  "author": "ComChatX",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -14,5 +16,31 @@
     "skills": [
       "./skills"
     ]
+  },
+  "comchatx": {
+    "name": "Amazon SP-API",
+    "about": "读取并更新你自己的亚马逊店铺。",
+    "description": "授权后，cx 可以通过亚马逊 SP-API 访问你的店铺，范围以你授权的站点为限。cx 可以读取订单、listing、库存和报告，并在授权范围内进行修改。亚马逊和 ComChatX 均不为此收费。",
+    "mark": {
+      "line": "layout"
+    },
+    "section": "data",
+    "order": 20,
+    "builds": [
+      "cx-sources"
+    ],
+    "skills": {
+      "amazon-sp-api": {
+        "about": {
+          "en": "Connects cx to your orders, listings, inventory, reports and finances.",
+          "zh": "连接 cx 与你的订单、Listing、库存、报告和财务数据。"
+        }
+      }
+    },
+    "source": {
+      "name": "amazon-sp-api",
+      "help": "https://developer-docs.amazon/sp-api/docs/self-authorization",
+      "aspects": {}
+    }
   }
 }

package/skills/amazon-sp-api/SKILL.md

@@ -3,7 +3,7 @@ name: amazon-sp-api
 description: The seller's own Amazon selling account through Amazon's Selling Partner API (SP-API) — orders, listings, inventory, reports, feeds, finances and every other operation Amazon's reference lists, read and write, in each region the seller authorised. Use before the first call that reads or changes the seller's own Amazon account. Needs cx-sources; if no cx-sources skill is listed, it is not installed, and the seller installs it in Plugins.
 ---
 
-Amazon SP-API is an open door through `cx raw`; read cx-sources first. The door carries any method, path, query, header and body to the origin the request names, attaches the seller's token, and lands Amazon's reply as Amazon gave it, at no charge. Amazon SP-API is off: Plugins does not offer its plugin yet.
+Amazon SP-API is an open door through `cx raw`; read cx-sources first. The door carries any method, path, query, header and body to the origin the request names, attaches the seller's token, and lands Amazon's reply as Amazon gave it, at no charge. If Amazon SP-API is off, the seller turns its plugin on in Plugins.
 
 ```sh
 cx raw amazon-sp-api --origin https://sellingpartnerapi-na.amazon.com --method GET --path /orders/v0/orders --query MarketplaceIds=ATVPDKIKX0DER --query CreatedAfter=2026-10-01T00:00:00Z
@@ -19,7 +19,7 @@ Amazon's reference: <https://developer-docs.amazon.com/sp-api>, models at <https
 | `https://sellingpartnerapi-eu.amazon.com` | `https://sandbox.sellingpartnerapi-eu.amazon.com` | `eu` |
 | `https://sellingpartnerapi-fe.amazon.com` | `https://sandbox.sellingpartnerapi-fe.amazon.com` | `fe` |
 
-The platform holds the client pair, `client_id` and `client_secret`, and the seller's connections, each a store, its region and its `refresh_token`; the box holds none. A call goes on its origin region's connection; where the region holds several, `--header x-cx-store=<store>` names one, and Amazon never sees it. Without the client pair or that connection, the door refuses `key_required`, naming what is missing, before anything is sent. A request naming `x-amz-access-token` is refused; only a call's own secrets land in its reply as `[redacted]`.
+The platform holds the client pair, `client_id` and `client_secret`, and the seller's connections, each a store, its region and its `refresh_token`; the box holds none. A call goes on its origin region's connection; where the region holds several, `--header x-cx-store=<store>` names one, and Amazon never sees it. Without the client pair or that connection, the door refuses `key_required`, naming what is missing, before anything is sent. A request naming `x-amz-access-token` is refused.
 
 ## Two headers
 

package/skills/amazon-sp-api/references/door.md

@@ -30,7 +30,7 @@ Amazon's developer page lists three scopes for a client-credentials trade: `sell
 - A reply outside 2xx that the door returns lands with its status, its headers and as much of its body as came, and the call ends `failed`, exit 1: the line reads `the source answered HTTP 403`, with the status and the reply's opening under it; a returned `429` is `provider_rate_limit`. A redirect is followed nowhere and nothing of it lands: a read ends `failed`, a change reads `sent, outcome unknown`. `x-amzn-RequestId` and `x-amzn-RateLimit-Limit` are among the receipt's headers.
 - A reply cut short ends `failed`, exit 1, whatever its status: the bytes that came land, and the line ends `reply cut short`. Where a 2xx reply broke off, Amazon had answered 2xx: the line reads `the source answered HTTP 200`, with `HTTP 200: the reply broke off after 86 bytes` under it, the status and the count of bytes kept.
 - A step or a reply that stalls past the gate's wait is not returned: the call keeps the gate's own ending, in the gate's words, as it does where the door throws. Stalled, a change with no reply begun reads `sent, outcome unknown`, one whose step stalled among them, though that request never left; a read ends `failed`; and a reply whose head arrived ends `failed (provider_unavailable)`, a `429` too: the line is the gate's sentence and then the status, as `HTTP 429`, which `--json` holds as `http_status`.
-- The gate strikes from a reply, its headers and a failure's words the saved fields that call was handed — the client pair and its connection's refresh token — and each token the door traded for on that call. Any other token lands as Amazon wrote it: an earlier call's, and a field of a reply shaped like one.
+- A reply and a failure's words land as Amazon wrote them, a token in them included; of a reply's headers, those that carry authority — cookies and authentication challenges — are left out.
 - The box keeps an ask's attempt open until it has recorded how it ended: a reply's landing, or an ending with nothing to land. Until then an identical ask is the same attempt: two in flight together are one call to Amazon, and one asked again after a landing that went unrecorded is answered the first reply where the gate kept it, under the same `request_id`, with nothing traded or sent. After that an identical ask is a new call, and a change asked twice is sent twice.
 - Amazon's rates are per operation and stated in each model; the door adds no wait, keeps no schedule and retries nothing of its own. A `429` is Amazon's answer that the operation's rate is spent: ask again after a wait, doubling the wait at each `429` from about a second, with a random part of up to half of it added so that two calls waiting together do not ask again together, and stop after five.