cx-amazon-sp-api 0.1.3 → 0.1.5

package/package.json

@@ -1,22 +1,31 @@
 {
   "name": "cx-amazon-sp-api",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Reads and updates your own Amazon store.",
-  "author": "ComChatX",
   "license": "MIT",
+  "author": "ComChatX",
+  "homepage": "https://github.com/comchatx/cx-amazon-sp-api#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/HS-Jack-YZY/ComChatX.git",
-    "directory": "src/source-packages/cx-amazon-sp-api"
+    "url": "git+https://github.com/comchatx/cx-amazon-sp-api.git"
   },
+  "bugs": "https://github.com/comchatx/cx-amazon-sp-api/issues",
   "keywords": [
     "pi-package"
   ],
+  "type": "module",
   "pi": {
     "skills": [
       "./skills"
     ]
   },
+  "files": [
+    "skills"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
   "comchatx": {
     "name": "Amazon SP-API",
     "about": "读取并更新你自己的亚马逊店铺。",
@@ -42,5 +51,11 @@
       "help": "https://developer-docs.amazon/sp-api/docs/self-authorization",
       "aspects": {}
     }
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": "1.4.0",
+    "@types/node": "26.2.0",
+    "typescript": "7.0.2",
+    "vitest": "4.1.11"
   }
 }

package/skills/amazon-sp-api/SKILL.md

@@ -19,7 +19,7 @@ Amazon's reference: <https://developer-docs.amazon.com/sp-api>, models at <https
 | `https://sellingpartnerapi-eu.amazon.com` | `https://sandbox.sellingpartnerapi-eu.amazon.com` | `eu` |
 | `https://sellingpartnerapi-fe.amazon.com` | `https://sandbox.sellingpartnerapi-fe.amazon.com` | `fe` |
 
-The platform holds the client pair, `client_id` and `client_secret`, and the seller's connections, each a store, its region and its `refresh_token`; the box holds none. A call goes on its origin region's connection; where the region holds several, `--header x-cx-store=<store>` names one, and Amazon never sees it. Without the client pair or that connection, the door refuses `key_required`, naming what is missing, before anything is sent. A request naming `x-amz-access-token` is refused; only a call's own secrets land in its reply as `[redacted]`.
+The platform holds the client pair, `client_id` and `client_secret`, and the seller's connections, each a store, its region and its `refresh_token`; the box holds none. A call goes on its origin region's connection; where the region holds several, `--header x-cx-store=<store>` names one, and Amazon never sees it. Without the client pair or that connection, the door refuses `key_required`, naming what is missing, before anything is sent. A request naming `x-amz-access-token` is refused.
 
 ## Two headers
 

package/skills/amazon-sp-api/references/door.md

@@ -30,7 +30,7 @@ Amazon's developer page lists three scopes for a client-credentials trade: `sell
 - A reply outside 2xx that the door returns lands with its status, its headers and as much of its body as came, and the call ends `failed`, exit 1: the line reads `the source answered HTTP 403`, with the status and the reply's opening under it; a returned `429` is `provider_rate_limit`. A redirect is followed nowhere and nothing of it lands: a read ends `failed`, a change reads `sent, outcome unknown`. `x-amzn-RequestId` and `x-amzn-RateLimit-Limit` are among the receipt's headers.
 - A reply cut short ends `failed`, exit 1, whatever its status: the bytes that came land, and the line ends `reply cut short`. Where a 2xx reply broke off, Amazon had answered 2xx: the line reads `the source answered HTTP 200`, with `HTTP 200: the reply broke off after 86 bytes` under it, the status and the count of bytes kept.
 - A step or a reply that stalls past the gate's wait is not returned: the call keeps the gate's own ending, in the gate's words, as it does where the door throws. Stalled, a change with no reply begun reads `sent, outcome unknown`, one whose step stalled among them, though that request never left; a read ends `failed`; and a reply whose head arrived ends `failed (provider_unavailable)`, a `429` too: the line is the gate's sentence and then the status, as `HTTP 429`, which `--json` holds as `http_status`.
-- The gate strikes from a reply, its headers and a failure's words the saved fields that call was handed — the client pair and its connection's refresh token — and each token the door traded for on that call. Any other token lands as Amazon wrote it: an earlier call's, and a field of a reply shaped like one.
+- A reply and a failure's words land as Amazon wrote them, a token in them included; of a reply's headers, those that carry authority — cookies and authentication challenges — are left out.
 - The box keeps an ask's attempt open until it has recorded how it ended: a reply's landing, or an ending with nothing to land. Until then an identical ask is the same attempt: two in flight together are one call to Amazon, and one asked again after a landing that went unrecorded is answered the first reply where the gate kept it, under the same `request_id`, with nothing traded or sent. After that an identical ask is a new call, and a change asked twice is sent twice.
 - Amazon's rates are per operation and stated in each model; the door adds no wait, keeps no schedule and retries nothing of its own. A `429` is Amazon's answer that the operation's rate is spent: ask again after a wait, doubling the wait at each `429` from about a second, with a random part of up to half of it added so that two calls waiting together do not ask again together, and stop after five.