ozon-seller-mcp 2.2.0 → 2.3.0

package/README.md

@@ -37,7 +37,8 @@ Windows 上如果客户端找不到 `npx`，把 `command` 改为 `"cmd"`，`args
 
 | 变量 | 默认 | 说明 |
 |---|---|---|
-| `OZON_CLIENT_ID` / `OZON_API_KEY` | — | 店铺凭证，必填 |
+| `OZON_CLIENT_ID` / `OZON_API_KEY` | — | 单店凭证；只有一家店时用 |
+| `OZON_SHOPS` | — | 多店铺：JSON 数组，见下方「多店铺」；填了它就不再读单店的 4 个凭证变量 |
 | `OZON_READ_ONLY` | `true` | `false` 才允许写操作；其他值启动报错，拼写错误不会开放写入 |
 | `OZON_TOOLSET` | `core` | `core` 常用工具；`minimal` 只要组合工具和通用工具；`all` 全部接口；可追加接口路径或工具名，逗号分隔，如 `core,/v1/returns/list` |
 | `OZON_COMPACT` | `true` | 结果省略 null、空字符串、空数组、空对象 |
@@ -50,6 +51,32 @@ Windows 上如果客户端找不到 `npx`，把 `command` 改为 `"cmd"`，`args
 
 修改后需要重启 MCP。
 
+## 多店铺
+
+一个 MCP 连多家店：`OZON_SHOPS` 填一个 JSON 数组，每家店一项。
+
+```json
+"env": {
+  "OZON_SHOPS": "[{\"name\":\"shop-a\",\"client_id\":\"…\",\"api_key\":\"…\",\"perf_client_id\":\"…@advertising.performance.ozon.ru\",\"perf_client_secret\":\"…\",\"market\":true,\"default\":true},{\"name\":\"shop-b\",\"client_id\":\"…\",\"api_key\":\"…\",\"perf_client_id\":\"…\",\"perf_client_secret\":\"…\"}]",
+  "OZON_READ_ONLY": "true"
+}
+```
+
+| 字段 | 必填 | 说明 |
+|---|---|---|
+| `name` | 是 | 店铺名，1～32 个字母、数字、汉字、`_`、`-`，不能重复；调用时用它选店 |
+| `client_id` / `api_key` | 二选一 | 该店的 Seller API 凭证，两项要么都填要么都不填 |
+| `perf_client_id` / `perf_client_secret` | 二选一 | 该店的广告凭证，两项要么都填要么都不填；每家店至少填一组凭证（只做广告的店可以不填 Seller API） |
+| `access_token` | 否 | 该店的 Ozon Delivery OAuth 令牌 |
+| `default` | 否 | `true` = 调用不指定店铺时用它；不标就用第一项 |
+| `market` | 否 | `true` = 市场数据店，最多一家；没有店标它时，市场数据接口就用调用时选的那家店 |
+
+- 访问 Ozon 的工具（含组合工具、广告工具）都多一个可选参数 `shop`（店铺名），不填用默认店。结果里的 `shop` 字段写明实际用哪家店的凭证查的。只在本地运行的工具（`ozon_status`、目录、说明、校验、报告）没有这个参数。
+- **市场数据固定走 `market` 店**：类目大盘 `/v1/analytics/category/comparison`、全站热搜词 `/v1/search-queries/top`、`/v1/search-queries/text` 要 Premium Pro 订阅，结果和查询的店铺无关，所以不论 `shop` 填哪家，都用市场数据店的凭证查。本店相关的数据（销量、商品搜索词、价格指数、广告）一律用各自店的凭证。
+- 限流和 5 分钟读缓存按店铺（Client-Id）分开计；广告令牌每家店各一个。
+- 配置有错（JSON 不合法、缺凭证、重名、未知字段、两家店填了同一个 `client_id` / `perf_client_id`、两家都标 `market`）启动时直接报错，报错只说第几项哪个字段，不回显密钥。所有店的密钥都会从结果和报错里隐藏。
+- `ozon_status` 列出每家店的名称、Client-Id、是否默认 / 市场店、是否配了 Seller API / 广告凭证，不含密钥。
+
 ## 通过节点访问 Ozon
 
 国内网络直连 Ozon 经常不通。把节点链接填进 `OZON_PROXY` 即可，不用另装代理软件：

package/bin/ozon-seller-mcp.js

@@ -11,7 +11,11 @@ if (args.includes('--version') || args.includes('-v')) {
 用法：npx -y ozon-seller-mcp
 
 环境变量：
-  OZON_CLIENT_ID, OZON_API_KEY   店铺凭证（必填）
+  OZON_CLIENT_ID, OZON_API_KEY   单店凭证（只有一家店时用）
+  OZON_SHOPS                     多店铺：JSON 数组，每项 {"name","client_id","api_key",
+                                 "perf_client_id"?,"perf_client_secret"?,"access_token"?,"market"?,"default"?}；
+                                 填了它就不再读上面的单店变量。"market": true 的店负责
+                                 类目大盘、全站热搜词（需 Premium Pro）；工具多一个 shop 参数
   OZON_READ_ONLY                 true（默认，只读）/ false（允许写入）
   OZON_TOOLSET                   core（默认）/ all / minimal / 追加接口路径，逗号分隔
   OZON_COMPACT                   true（默认，省略空值字段）/ false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ozon-seller-mcp",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Ozon Seller API + Performance (ads) API MCP server: 482 seller endpoints, 48 advertising endpoints, one-call composite queries, read-only by default, strict schema validation.",
   "keywords": [
     "mcp",

package/src/ads/http.js

@@ -4,6 +4,7 @@ import { OzonError, ValidationError } from '../errors.js';
 import { currentFetch, describeNetworkError, getDispatcher, parseJson, readCapped, sleep } from '../http.js';
 import { redact } from '../privacy.js';
 import { enforceMode } from '../schema.js';
+import { currentShop, hasAds, shops } from '../shops.js';
 import { VERSION } from '../version.js';
 import { parseCsv } from './csv.js';
 import { SAFE_PATH_VALUE, pathParamNames, validateAdsRequest } from './schema.js';
@@ -22,27 +23,33 @@ export const CREDENTIAL_HELP = '在卖家后台 设置 → API 密钥 → Perfor
   + '把 Client ID（以 @advertising.performance.ozon.ru 结尾）和 Client Secret 分别填到 MCP env 的 OZON_PERF_CLIENT_ID、OZON_PERF_CLIENT_SECRET，然后重启 MCP。'
   + '它和 OZON_CLIENT_ID / OZON_API_KEY（Seller API）不是同一组凭证。';
 
-let cachedToken = null;
-let pendingToken = null;
+// One token per Performance client: shops alternating in one process must not evict each other's token.
+const cachedTokens = new Map();
+const pendingTokens = new Map();
 
 export function resetAdsToken() {
-  cachedToken = null;
-  pendingToken = null;
+  cachedTokens.clear();
+  pendingTokens.clear();
 }
 
-export const adsConfigured = () => Boolean((process.env.OZON_PERF_CLIENT_ID ?? '').trim() && (process.env.OZON_PERF_CLIENT_SECRET ?? '').trim());
+// True when any shop has Performance API credentials (the ads tools are listed then).
+export const adsConfigured = () => shops().some(hasAds);
 
 function adsCredentials() {
-  const clientId = (process.env.OZON_PERF_CLIENT_ID ?? '').trim();
-  const secret = (process.env.OZON_PERF_CLIENT_SECRET ?? '').trim();
-  if (!clientId || !secret) throw new OzonError(`广告数据需要 Performance API 凭证，OZON_PERF_CLIENT_ID / OZON_PERF_CLIENT_SECRET 未配置。${CREDENTIAL_HELP}`);
-  if (/[\r\n]/.test(clientId + secret)) throw new OzonError('Performance API 凭证包含无效换行，请检查 MCP 环境变量。');
-  return { clientId, secret };
+  const shop = currentShop();
+  if (!hasAds(shop)) {
+    throw new OzonError(shop.legacy
+      ? `广告数据需要 Performance API 凭证，OZON_PERF_CLIENT_ID / OZON_PERF_CLIENT_SECRET 未配置。${CREDENTIAL_HELP}`
+      : `店铺「${shop.name}」没有配置广告凭证（perf_client_id / perf_client_secret）。`);
+  }
+  if (/[\r\n]/.test(shop.perfClientId + shop.perfSecret)) throw new OzonError('Performance API 凭证包含无效换行，请检查 MCP 环境变量。');
+  return { clientId: shop.perfClientId, secret: shop.perfSecret, shop };
 }
 
-// Bearer tokens are credentials too: hide the one a request used as well as the current one.
+// Bearer tokens are credentials too: hide the one a request used as well as every cached one.
 function hideTokens(text, ...tokens) {
-  return [...tokens, cachedToken?.value].filter(Boolean).reduce((out, token) => out.replaceAll(token, '[已隐藏令牌]'), String(text));
+  const cached = [...cachedTokens.values()].map((t) => t.value);
+  return [...tokens, ...cached].filter(Boolean).reduce((out, token) => out.replaceAll(token, '[已隐藏令牌]'), String(text));
 }
 
 function scrubTokens(data, token) {
@@ -70,7 +77,7 @@ async function rejectRedirect(response, path) {
 
 const errorText = async (response, token) => hideTokens(redact((await response.text().catch(() => '')).slice(0, 2000)), token);
 
-async function requestToken({ clientId, secret }, agent) {
+async function requestToken({ clientId, secret, shop }, agent) {
   const response = await send(ADS_BASE_URL + TOKEN_PATH, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': USER_AGENT },
@@ -78,8 +85,9 @@ async function requestToken({ clientId, secret }, agent) {
   }, agent);
   await rejectRedirect(response, TOKEN_PATH);
   if (!response.ok) {
+    const fields = shop.legacy ? 'OZON_PERF_CLIENT_ID 和 OZON_PERF_CLIENT_SECRET' : `店铺「${shop.name}」的 perf_client_id 和 perf_client_secret`;
     const hint = response.status < 500
-      ? `检查 OZON_PERF_CLIENT_ID 和 OZON_PERF_CLIENT_SECRET 是否完整、密钥是否已被删除。${CREDENTIAL_HELP}`
+      ? `检查 ${fields} 是否完整、密钥是否已被删除。${shop.legacy ? CREDENTIAL_HELP : ''}`
       : 'Ozon 授权服务暂时不可用，稍后再试。';
     throw new OzonError(`Performance API 授权失败（HTTP ${response.status}）：${hint} ${await errorText(response)}`);
   }
@@ -96,21 +104,21 @@ async function requestToken({ clientId, secret }, agent) {
 
 // `rejected` is the token that just got a 401: a newer cached token is reused, otherwise a new one is fetched.
 async function getToken(credentials, agent, rejected) {
-  const usable = cachedToken && cachedToken.clientId === credentials.clientId
-    && cachedToken.value !== rejected && Date.now() < cachedToken.expiresAt;
-  if (usable) return cachedToken.value;
-  if (!pendingToken || pendingToken.clientId !== credentials.clientId) {
+  const { clientId } = credentials;
+  const cached = cachedTokens.get(clientId);
+  if (cached && cached.value !== rejected && Date.now() < cached.expiresAt) return cached.value;
+  if (!pendingTokens.has(clientId)) {
     const promise = requestToken(credentials, agent)
       .then((token) => {
-        cachedToken = token;
+        cachedTokens.set(clientId, token);
         return token.value;
       })
       .finally(() => {
-        if (pendingToken?.promise === promise) pendingToken = null;
+        if (pendingTokens.get(clientId) === promise) pendingTokens.delete(clientId);
       });
-    pendingToken = { clientId: credentials.clientId, promise };
+    pendingTokens.set(clientId, promise);
   }
-  return pendingToken.promise;
+  return pendingTokens.get(clientId);
 }
 
 function buildUrl(op, params) {

package/src/http.js

@@ -7,6 +7,7 @@ import { OzonError } from './errors.js';
 import { redact } from './privacy.js';
 import { afterSuccess, beforeRequest, rateLimitText, shareInflight } from './ratelimit.js';
 import { enforceMode, validate } from './schema.js';
+import { multiShop, shopForPath } from './shops.js';
 import { findOperation, mediaSource } from './spec.js';
 import { VlessConfigError, describeVless, isVlessLink, parseVless, vlessConnector } from './vless.js';
 
@@ -142,12 +143,16 @@ export function setFetchForTests(fn) {
 }
 export const currentFetch = () => fetchImpl;
 
-function credentials() {
-  const clientId = (process.env.OZON_CLIENT_ID ?? '').trim();
-  const apiKey = (process.env.OZON_API_KEY ?? '').trim();
-  if (!clientId || !apiKey) throw new OzonError('请在 MCP 配置 env 中填写 OZON_CLIENT_ID 和 OZON_API_KEY，然后重启 MCP 服务。');
-  if (/[\r\n]/.test(clientId + apiKey)) throw new OzonError('凭证包含无效换行，请检查 MCP 环境变量。');
-  return [clientId, apiKey];
+// The shop this call runs as; market endpoints always run as the market shop.
+function credentials(op) {
+  const shop = shopForPath(op.path);
+  if (!shop.clientId || !shop.apiKey) {
+    throw new OzonError(shop.legacy
+      ? '请在 MCP 配置 env 中填写 OZON_CLIENT_ID 和 OZON_API_KEY（或用 OZON_SHOPS 配置多个店铺），然后重启 MCP 服务。'
+      : `店铺「${shop.name}」缺少 client_id 或 api_key。`);
+  }
+  if (/[\r\n]/.test(shop.clientId + shop.apiKey)) throw new OzonError('凭证包含无效换行，请检查 MCP 环境变量。');
+  return shop;
 }
 
 const MIME = {
@@ -272,16 +277,17 @@ export async function request(endpoint, body = {}, method = 'POST') {
   if (body !== null && (typeof body !== 'object' || Array.isArray(body))) throw new OzonError('请求体必须为 JSON 对象。');
   body ??= {};
   validate(op.tool_name, body);
-  const [clientId, apiKey] = credentials();
+  const shop = credentials(op);
   // A broken proxy setting fails here, before a local rate-limit slot is taken.
   const agent = getDispatcher();
-  // Identical concurrent reads of a rate-limited endpoint share one request.
-  return shareInflight(op, body, () => beforeRequest(op, body) ?? send(op, body, clientId, apiKey, agent));
+  // Identical concurrent reads of a rate-limited endpoint share one request; limits count per account.
+  const scope = shop.clientId;
+  return shareInflight(op, body, () => beforeRequest(op, body, Date.now(), scope) ?? send(op, body, shop, agent), scope);
 }
 
-async function send(op, body, clientId, apiKey, agent) {
+async function send(op, body, shop, agent) {
   const endpoint = op.path;
-  const headers = { 'Client-Id': clientId, 'Api-Key': apiKey, Accept: 'application/json', 'User-Agent': USER_AGENT };
+  const headers = { 'Client-Id': shop.clientId, 'Api-Key': shop.apiKey, Accept: 'application/json', 'User-Agent': USER_AGENT };
   let payload;
   const [mediaType] = mediaSource(op);
   if (mediaType === 'multipart/form-data') {
@@ -293,8 +299,10 @@ async function send(op, body, clientId, apiKey, agent) {
   }
   if (op.method === 'GET') payload = undefined;
   if (op.tags.some((t) => OAUTH_TAGS.has(t))) {
-    const token = (process.env.OZON_ACCESS_TOKEN ?? '').trim();
-    if (!token) throw new OzonError('Ozon Delivery 接口需要 OAuth；请在 MCP env 中配置 OZON_ACCESS_TOKEN。');
+    const token = shop.accessToken;
+    if (!token) throw new OzonError(shop.legacy
+      ? 'Ozon Delivery 接口需要 OAuth；请在 MCP env 中配置 OZON_ACCESS_TOKEN。'
+      : `Ozon Delivery 接口需要 OAuth；请给店铺「${shop.name}」配置 access_token。`);
     if (/[\r\n]/.test(token)) throw new OzonError('OZON_ACCESS_TOKEN 包含无效换行。');
     headers.Authorization = 'Bearer ' + token;
   }
@@ -347,13 +355,14 @@ async function send(op, body, clientId, apiKey, agent) {
     }
     const result = {
       endpoint,
+      ...(multiShop() ? { shop: shop.name } : {}),
       http_status: response.status,
       queried_at_utc: new Date().toISOString(),
       elapsed_ms: Math.round(performance.now() - start),
       rate_limit_remaining: response.headers.get('ratelimit-remaining'),
       data: redact(data),
     };
-    afterSuccess(op, body, result);
+    afterSuccess(op, body, result, Date.now(), shop.clientId);
     return result;
   }
   throw new OzonError('查询未完成。');

package/src/privacy.js

@@ -1,22 +1,24 @@
+import { allSecrets } from './shops.js';
+
 const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
-const SECRET_KEYS = new Set(['api-key', 'api_key', 'authorization', 'client_secret', 'access_token']);
+const SECRET_KEYS = new Set(['api-key', 'api_key', 'authorization', 'client_secret', 'perf_client_secret', 'access_token']);
 
-// Keep credentials out of both upstream error text and tool results.
+// Keep credentials out of both upstream error text and tool results: every shop's secrets,
+// raw and trimmed (the trimmed form is what actually goes on the wire). The secret list is
+// built once per call, not once per string in a large result.
 export function redact(value) {
+  return scrub(value, allSecrets());
+}
+
+function scrub(value, secrets) {
   if (typeof value === 'string') {
-    for (const name of ['OZON_API_KEY', 'OZON_ACCESS_TOKEN', 'OZON_PERF_CLIENT_SECRET']) {
-      const raw = process.env[name] ?? '';
-      // The trimmed form is what actually goes on the wire.
-      for (const secret of new Set([raw, raw.trim()])) {
-        if (secret) value = value.replaceAll(secret, '[已隐藏密钥]');
-      }
-    }
+    for (const secret of secrets) value = value.replaceAll(secret, '[已隐藏密钥]');
     return value;
   }
-  if (Array.isArray(value)) return value.map(redact);
+  if (Array.isArray(value)) return value.map((v) => scrub(v, secrets));
   if (isObject(value)) {
     return Object.fromEntries(Object.entries(value)
-      .map(([k, v]) => [k, SECRET_KEYS.has(String(k).toLowerCase()) ? '[已隐藏]' : redact(v)]));
+      .map(([k, v]) => [k, SECRET_KEYS.has(String(k).toLowerCase()) ? '[已隐藏]' : scrub(v, secrets)]));
   }
   return value;
 }

package/src/ratelimit.js

@@ -1,5 +1,6 @@
 // Official per-endpoint limits, transcribed from the pinned spec descriptions.
-// Local counting is per MCP process; Ozon's server-side counter is authoritative.
+// Local counting is per MCP process and per seller account (`scope` = Client-Id: Ozon counts each
+// account separately); Ozon's server-side counter is authoritative.
 import { RateLimitError } from './errors.js';
 
 const MIN = 60_000;
@@ -49,20 +50,21 @@ function waitText(ms) {
   return `${Math.ceil(s / 3600)} 小时`;
 }
 
-const cacheKey = (op, body) => `${op.method} ${op.path} ${JSON.stringify(body ?? {})}`;
+const cacheKey = (op, body, scope) => `${scope}|${op.method} ${op.path} ${JSON.stringify(body ?? {})}`;
 
 // Returns a cached result for an identical read, throws if the local window is exhausted.
-export function beforeRequest(op, body, now = Date.now()) {
+export function beforeRequest(op, body, now = Date.now(), scope = '') {
   const rule = RATE_LIMITS[op.path];
   if (!rule?.windows) return null;
   if (op.read_only) {
-    const hit = cache.get(cacheKey(op, body));
+    const hit = cache.get(cacheKey(op, body, scope));
     if (hit && now - hit.at < CACHE_TTL) {
       return { ...hit.result, from_cache: true, cached_at_utc: new Date(hit.at).toISOString() };
     }
   }
-  const stamps = (history.get(op.path) ?? []).filter((t) => now - t < DAY);
-  history.set(op.path, stamps);
+  const historyKey = `${scope}|${op.path}`;
+  const stamps = (history.get(historyKey) ?? []).filter((t) => now - t < DAY);
+  history.set(historyKey, stamps);
   for (const [window, max] of rule.windows) {
     const used = stamps.filter((t) => now - t < window);
     if (used.length >= max) {
@@ -75,17 +77,17 @@ export function beforeRequest(op, body, now = Date.now()) {
   return null;
 }
 
-export function afterSuccess(op, body, result, now = Date.now()) {
+export function afterSuccess(op, body, result, now = Date.now(), scope = '') {
   if (!op.read_only || !RATE_LIMITS[op.path]?.windows) return;
   for (const [key, entry] of cache) if (now - entry.at >= CACHE_TTL) cache.delete(key);
-  cache.set(cacheKey(op, body), { at: now, result });
+  cache.set(cacheKey(op, body, scope), { at: now, result });
 }
 
 const inflight = new Map();
 
-export function shareInflight(op, body, fn) {
+export function shareInflight(op, body, fn, scope = '') {
   if (!op.read_only || !RATE_LIMITS[op.path]?.windows) return Promise.resolve().then(fn);
-  const key = cacheKey(op, body);
+  const key = cacheKey(op, body, scope);
   if (!inflight.has(key)) {
     inflight.set(key, Promise.resolve().then(fn).finally(() => inflight.delete(key)));
   }

package/src/server.js

@@ -1,5 +1,6 @@
 import { Server } from '@modelcontextprotocol/server';
 import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
+import { MARKET_PATHS, defaultShop, marketShop, multiShop, shops } from './shops.js';
 import { callTool, checkConfiguration, listTools } from './tools.js';
 import { VERSION } from './version.js';
 
@@ -11,8 +12,16 @@ const INSTRUCTIONS = [
   '工具说明或结果中出现“限流”时，必须把官方限制告诉用户，不要重复重试。默认只读。',
 ].join('');
 
+function instructions() {
+  if (!multiShop()) return INSTRUCTIONS;
+  const market = marketShop();
+  return INSTRUCTIONS + `多店铺：${shops().map((s) => s.name).join('、')}。访问店铺数据的工具都有 shop 参数，不填 = 默认店「${defaultShop().name}」；`
+    + '问到某家店时必须传 shop，比较多家店时逐店调用，结果里的 shop 字段写明是哪家店的数据。'
+    + (market ? `市场数据接口（${[...MARKET_PATHS].join('、')}）固定用「${market.name}」的凭证，结果对所有店通用。` : '');
+}
+
 export function createServer() {
-  const server = new Server({ name: 'ozon-seller', version: VERSION }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+  const server = new Server({ name: 'ozon-seller', version: VERSION }, { capabilities: { tools: {} }, instructions: instructions() });
   server.setRequestHandler('tools/list', async () => ({ tools: listTools() }));
   server.setRequestHandler('tools/call', async (request) => callTool(request.params.name, request.params.arguments));
   return server;

package/src/shops.js

@@ -0,0 +1,135 @@
+// Shops: OZON_SHOPS (a JSON array, one entry per shop) or the single-shop env variables.
+// The shop a tool call runs as travels in AsyncLocalStorage, so both transports pick the right
+// credentials without every helper threading a shop argument through.
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+const NAME = /^[\p{L}\p{N}_-]{1,32}$/u;
+const FIELDS = new Set(['name', 'client_id', 'api_key', 'perf_client_id', 'perf_client_secret', 'access_token', 'market', 'default']);
+
+// Platform-wide market data: the answer does not depend on which shop asks, and Ozon serves it
+// only under Premium Pro. These always run as the shop marked "market": true.
+export const MARKET_PATHS = new Set([
+  '/v1/analytics/category/comparison',
+  '/v1/search-queries/top',
+  '/v1/search-queries/text',
+]);
+
+export class ShopConfigError extends Error {}
+
+const text = (value) => {
+  if (typeof value === 'number' && Number.isInteger(value)) return String(value);
+  return typeof value === 'string' ? value.trim() : '';
+};
+
+function legacyShop() {
+  const env = (key) => (process.env[key] ?? '').trim();
+  return [{
+    name: 'default', legacy: true, isDefault: true, market: false,
+    clientId: env('OZON_CLIENT_ID'), apiKey: env('OZON_API_KEY'),
+    perfClientId: env('OZON_PERF_CLIENT_ID'), perfSecret: env('OZON_PERF_CLIENT_SECRET'),
+    accessToken: env('OZON_ACCESS_TOKEN'),
+  }];
+}
+
+// Messages name the entry and the field, never a value: a value may be a secret.
+function parseShops(raw) {
+  let list;
+  try {
+    list = JSON.parse(raw);
+  } catch {
+    throw new ShopConfigError('OZON_SHOPS 不是合法 JSON；应为数组，例如 [{"name":"shop-a","client_id":"…","api_key":"…","market":true}]。');
+  }
+  if (!Array.isArray(list) || !list.length) throw new ShopConfigError('OZON_SHOPS 必须是至少含一个店铺的 JSON 数组。');
+  const seen = new Set();
+  const shops = list.map((item, i) => {
+    const at = `OZON_SHOPS 第 ${i + 1} 项`;
+    if (item === null || typeof item !== 'object' || Array.isArray(item)) throw new ShopConfigError(`${at} 必须是对象。`);
+    const unknown = Object.keys(item).filter((k) => !FIELDS.has(k));
+    if (unknown.length) throw new ShopConfigError(`${at} 有未知字段：${unknown.join('、')}（可用 ${[...FIELDS].join('、')}）。`);
+    const name = text(item.name);
+    if (!NAME.test(name)) throw new ShopConfigError(`${at} 的 name 必须是 1～32 个字母、数字、汉字、_ 或 -。`);
+    if (seen.has(name)) throw new ShopConfigError(`${at} 的 name「${name}」重复。`);
+    seen.add(name);
+    const shop = {
+      name, legacy: false,
+      clientId: text(item.client_id), apiKey: text(item.api_key),
+      perfClientId: text(item.perf_client_id), perfSecret: text(item.perf_client_secret),
+      accessToken: text(item.access_token),
+      market: item.market ?? false, isDefault: item.default ?? false,
+    };
+    if (Boolean(shop.clientId) !== Boolean(shop.apiKey)) {
+      throw new ShopConfigError(`店铺「${name}」的 client_id 和 api_key 要么都填，要么都不填。`);
+    }
+    if (Boolean(shop.perfClientId) !== Boolean(shop.perfSecret)) {
+      throw new ShopConfigError(`店铺「${name}」的 perf_client_id 和 perf_client_secret 要么都填，要么都不填。`);
+    }
+    if (!hasSeller(shop) && !hasAds(shop)) {
+      throw new ShopConfigError(`店铺「${name}」至少要填一组凭证：client_id + api_key（Seller API），或 perf_client_id + perf_client_secret（广告）。`);
+    }
+    for (const flag of ['market', 'isDefault']) {
+      if (typeof shop[flag] !== 'boolean') throw new ShopConfigError(`店铺「${name}」的 ${flag === 'market' ? 'market' : 'default'} 只能是 true 或 false。`);
+    }
+    for (const [field, value] of Object.entries(shop)) {
+      if (typeof value === 'string' && /[\r\n]/.test(value)) throw new ShopConfigError(`店铺「${name}」的 ${field} 含有换行。`);
+    }
+    return shop;
+  });
+  // Rate limits, the read cache and ad tokens are keyed by these ids: two entries must not share one.
+  for (const [field, key] of [['client_id', 'clientId'], ['perf_client_id', 'perfClientId']]) {
+    const ids = shops.map((s) => s[key]).filter(Boolean);
+    const twice = ids.find((id, i) => ids.indexOf(id) !== i);
+    if (twice) throw new ShopConfigError(`OZON_SHOPS 里有两个店铺的 ${field} 相同（${shops.filter((s) => s[key] === twice).map((s) => s.name).join('、')}）。`);
+  }
+  if (shops.filter((s) => s.market).length > 1) throw new ShopConfigError('OZON_SHOPS 里只能有一个店铺标 "market": true。');
+  if (shops.filter((s) => s.isDefault).length > 1) throw new ShopConfigError('OZON_SHOPS 里只能有一个店铺标 "default": true。');
+  return shops;
+}
+
+let cached;
+let cachedFrom;
+const ENV_KEYS = ['OZON_SHOPS', 'OZON_CLIENT_ID', 'OZON_API_KEY', 'OZON_PERF_CLIENT_ID', 'OZON_PERF_CLIENT_SECRET', 'OZON_ACCESS_TOKEN'];
+
+export function shops() {
+  const from = ENV_KEYS.map((k) => process.env[k] ?? '').join('\u0000');
+  if (cached && cachedFrom === from) return cached;
+  const raw = (process.env.OZON_SHOPS ?? '').trim();
+  cached = raw ? parseShops(raw) : legacyShop();
+  cachedFrom = from;
+  return cached;
+}
+
+export const hasSeller = (shop) => Boolean(shop.clientId && shop.apiKey);
+export const hasAds = (shop) => Boolean(shop.perfClientId && shop.perfSecret);
+
+export const multiShop = () => shops().length > 1;
+export const defaultShop = () => shops().find((s) => s.isDefault) ?? shops()[0];
+// Only an explicit "market": true takes market endpoints away from the shop the caller chose.
+export const marketShop = () => shops().find((s) => s.market) ?? null;
+
+export function findShop(name) {
+  const shop = shops().find((s) => s.name === name);
+  if (!shop) throw new ShopConfigError(`没有名为「${name}」的店铺；可用：${shops().map((s) => s.name).join('、')}。`);
+  return shop;
+}
+
+const storage = new AsyncLocalStorage();
+export const runAsShop = (shop, fn) => storage.run(shop, fn);
+export const currentShop = () => storage.getStore() ?? defaultShop();
+
+// Market endpoints run as the market shop (when one is marked) whichever shop the call was made for.
+export const shopForPath = (path) => (MARKET_PATHS.has(path) && marketShop()) || currentShop();
+
+// Every configured secret, for redaction. Never throws: a broken config must not break error reporting.
+export function allSecrets() {
+  const out = [];
+  for (const key of ['OZON_API_KEY', 'OZON_ACCESS_TOKEN', 'OZON_PERF_CLIENT_SECRET']) {
+    const raw = process.env[key] ?? '';
+    out.push(raw, raw.trim());
+  }
+  try {
+    for (const s of shops()) out.push(s.apiKey, s.perfSecret, s.accessToken);
+  } catch {
+    // config errors are reported by checkConfiguration
+  }
+  return [...new Set(out.filter(Boolean))];
+}

package/src/tools.js

@@ -9,6 +9,7 @@ import { hidePersonal, redact } from './privacy.js';
 import { rateLimitText } from './ratelimit.js';
 import { renderReport } from './reports.js';
 import { compileSchema, describe, enforceMode, formatErrors, inputSchema, validate } from './schema.js';
+import { MARKET_PATHS, defaultShop, findShop, hasAds, hasSeller, marketShop, multiShop, runAsShop, shops } from './shops.js';
 import { CATALOG, OPERATIONS, findOperation, operationSource } from './spec.js';
 import { VERSION } from './version.js';
 
@@ -100,12 +101,34 @@ function makeTool(op) {
 
 const strip = ({ handler, ...tool }) => tool;
 
+// A tool reaches Ozon unless its annotations say otherwise (openWorldHint: false = local only).
+const reachesOzon = (tool) => tool.annotations?.openWorldHint !== false;
+
+function shopProperty() {
+  const market = marketShop();
+  return {
+    type: 'string', enum: shops().map((s) => s.name),
+    description: `店铺；不填 = 默认店「${defaultShop().name}」。`
+      + (market ? `市场数据接口（${[...MARKET_PATHS].join('、')}）不论填哪家都用「${market.name}」的凭证查询。` : ''),
+  };
+}
+
+// With several shops configured, every tool that reaches Ozon gains an optional `shop` argument.
+function withShop(tool, property) {
+  if (!property || !reachesOzon(tool)) return tool;
+  const base = tool.inputSchema ?? { type: 'object', properties: {} };
+  return { ...tool, inputSchema: { ...base, properties: { ...(base.properties ?? {}), shop: property } } };
+}
+
 export function listTools() {
-  return [...metaTools(), ...COMPOSITE_TOOLS.map(strip), ...listAdsTools(), ...selectedOperations().map(makeTool)];
+  const property = multiShop() ? shopProperty() : null;
+  return [...metaTools(), ...COMPOSITE_TOOLS.map(strip), ...listAdsTools(), ...selectedOperations().map(makeTool)]
+    .map((tool) => withShop(tool, property));
 }
 
 // Called once at startup so configuration typos fail loudly instead of mid-conversation.
 export function checkConfiguration() {
+  shops();
   readOnlyMode();
   compactEnabled();
   maxResultBytes();
@@ -156,16 +179,26 @@ async function execute(name, args) {
   switch (name) {
     case 'ozon_status': {
       const readOnly = readOnlyMode();
+      const main = defaultShop();
       return {
         version: VERSION, read_only: readOnly, toolset: toolsetSpec(), listed_tools: listTools().length,
-        api_key_configured: Boolean(process.env.OZON_API_KEY), client_id: process.env.OZON_CLIENT_ID || null,
+        api_key_configured: hasSeller(main), client_id: main.clientId || null,
+        ...(main.legacy ? {} : {
+          default_shop: main.name, market_shop: marketShop()?.name ?? null, market_endpoints: [...MARKET_PATHS],
+          shops: shops().map((s) => ({
+            name: s.name, client_id: s.clientId || null, default: s === main, market: s.market,
+            seller_api_configured: hasSeller(s), ads_configured: hasAds(s), ads_client_id: s.perfClientId || null,
+            delivery_token_configured: Boolean(s.accessToken),
+          })),
+        }),
         official_operations: OPERATIONS.size,
         available_api_operations: [...OPERATIONS.values()].filter((o) => !readOnly || o.read_only).length,
         compact_results: compactEnabled(), max_result_kb: Math.round(maxResultBytes() / 1024),
         source_date: CATALOG.source_date, source_version: CATALOG.source_version,
         node: process.version, platform: process.platform, proxy: proxySummary(),
         ads: {
-          credentials_configured: adsConfigured(), client_id: process.env.OZON_PERF_CLIENT_ID?.trim() || null,
+          // With several shops the per-shop list above says which ones have ads credentials.
+          credentials_configured: adsConfigured(), client_id: main.legacy ? main.perfClientId || null : undefined,
           official_operations: ADS_OPERATIONS.length, source_date: ADS_SOURCE.date, source_version: ADS_SOURCE.version,
           setup_hint: adsConfigured() ? undefined : `广告工具（ozon_ads_stats 等）未启用。${CREDENTIAL_HELP}`,
         },
@@ -198,17 +231,42 @@ async function execute(name, args) {
 }
 
 function checkToolArguments(name, args) {
-  const tool = metaTools().find((t) => t.name === name) ?? COMPOSITE.get(name) ?? ADS_TOOL_MAP.get(name);
+  const tool = toolDefinition(name);
   if (!tool) return;
   const check = compileSchema('tool:' + name, tool.inputSchema);
   if (!check(args)) throw new Error(`工具参数校验失败；未执行操作。${formatErrors(check.errors, 3).join('；')}`);
 }
 
+function toolDefinition(name) {
+  return metaTools().find((t) => t.name === name) ?? COMPOSITE.get(name) ?? ADS_TOOL_MAP.get(name);
+}
+
+// Generated endpoint tools always reach Ozon; the hand-written ones say so in their annotations.
+const isLocalTool = (name) => !OPERATIONS.has(name) && toolDefinition(name)?.annotations?.openWorldHint === false;
+
+// `shop` is ours, not part of any Ozon request body: take it off before the tool's own validation.
+function pickShop(name, args) {
+  const { shop, ...input } = args ?? {};
+  if (shop === undefined) return [defaultShop(), input];
+  if (isLocalTool(name)) throw new Error(`${name} 不访问店铺数据，不需要 shop 参数。`);
+  if (typeof shop !== 'string') throw new Error('shop 必须是店铺名（字符串）。');
+  return [findShop(shop), input];
+}
+
+const isPlainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+// With several shops, every result that came from Ozon says whose credentials answered it. Endpoint
+// results set it themselves (a market endpoint answers as the market shop); the rest ran as `shop`.
+function labelShop(name, shop, result) {
+  if (!multiShop() || isLocalTool(name) || !isPlainObject(result) || 'shop' in result) return result;
+  return { shop: shop.name, ...result };
+}
+
 export async function callTool(name, args) {
   try {
-    const input = args ?? {};
+    const [shop, input] = pickShop(name, args);
     checkToolArguments(name, input);
-    const result = redact(await execute(name, input));
+    const result = redact(labelShop(name, shop, await runAsShop(shop, () => execute(name, input))));
     return { content: [{ type: 'text', text: JSON.stringify(result) }] };
   } catch (error) {
     return { content: [{ type: 'text', text: redact(String(error?.message ?? error)) }], isError: true };