amazon-subscriptions 1.0.1__tar.gz

amazon_subscriptions-1.0.1/.github/workflows/automerge-schedule.yml

@@ -0,0 +1,43 @@
+---
+name: Schedule Release Automerge
+
+on:
+  schedule:
+    - cron: '0 9 * * 1' # Every Monday at 9am UTC
+  workflow_dispatch:
+
+jobs:
+  automerge:
+    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enable auto-merge on release-please PR
+        env:
+          GH_TOKEN: ${{ secrets.OVERRIDE_TOKEN }}
+        run: |
+          PRS=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --label "autorelease: pending" \
+            --base "${{ github.event.repository.default_branch }}" \
+            --state open \
+            --json number)
+
+          PR_COUNT=$(printf '%s' "$PRS" | jq 'length')
+
+          if [ "$PR_COUNT" -gt 1 ]; then
+            echo "Expected at most one open release-please PR, found $PR_COUNT"
+            exit 1
+          fi
+
+          PR=$(printf '%s' "$PRS" | jq -r '.[0].number // empty')
+
+          if [ -n "$PR" ]; then
+            # Auto-merge waits for the branch to be up to date with main, and release-please leaves it
+            # behind when the new commits don't change the release notes.
+            gh pr update-branch "$PR" --repo "${{ github.repository }}"
+            gh pr merge "$PR" --auto --squash --delete-branch \
+              --repo "${{ github.repository }}"
+            echo "Auto-merge enabled on PR #$PR"
+          else
+            echo "No open release-please PR found"
+          fi

amazon_subscriptions-1.0.1/.github/workflows/lint.yml

@@ -0,0 +1,87 @@
+---
+name: Lint
+
+on:
+  # Called by mr-test.yml, so its required job covers the linters too.
+  workflow_call:
+
+permissions:
+  contents: read
+
+# Python is linted in mr-test.yml. Each linter here is its own job so a failure names the file type. The linters'
+# versions are in mise.toml, where Renovate updates them.
+jobs:
+  markdown:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Files and rules come from .markdownlint-cli2.yaml, whose globs add to the action's default of the root files.
+      - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
+
+  markdown-links:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Restore lychee cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .lycheecache
+          key: lychee-${{ github.sha }}
+          restore-keys: lychee-
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          install_args: lychee
+
+      - name: lychee
+        env:
+          # Authenticated requests to GitHub links are not rate limited as quickly.
+          GITHUB_TOKEN: ${{ github.token }}
+        run: lychee --config lychee.toml --no-progress README.md
+
+  yaml:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          install_args: python uv pypi:yamllint
+
+      # Files and rules come from .yamllint.yml.
+      - name: yamllint
+        run: yamllint --strict --format github .
+
+  actions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          install_args: actionlint shellcheck
+
+      # Also runs shellcheck over every `run:` block.
+      - name: actionlint
+        run: actionlint
+
+  json:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Syntax only: release-please owns the formatting of the files it writes.
+      - name: jq
+        run: git ls-files -z '*.json' | xargs -0 -n1 jq empty

amazon_subscriptions-1.0.1/.github/workflows/mr-test.yml

@@ -0,0 +1,73 @@
+---
+name: MR Test
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # The oldest supported version (requires-python) and the one of mise.toml.
+        python: ["3.10", "3.14"]
+    env:
+      UV_PYTHON: ${{ matrix.python }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+
+      - name: Install dependencies
+        run: mise run install
+
+      - name: Lint
+        run: mise run lint
+
+      - name: Test
+        run: mise run test
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+
+      - name: Build
+        run: uv build
+
+  lint:
+    uses: ./.github/workflows/lint.yml
+
+  # One status check for the ruleset, whatever jobs are added later.
+  required:
+    runs-on: ubuntu-latest
+    needs: [test, build, lint]
+    if: always()
+    steps:
+      - name: Check result
+        run: |
+          if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            exit 1
+          fi

amazon_subscriptions-1.0.1/.github/workflows/pr-conventional-title.yml

@@ -0,0 +1,23 @@
+---
+name: Conventional PR Title
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+permissions:
+  pull-requests: read
+
+jobs:
+  # Required by the ruleset. Squash merges use the PR title as the commit
+  # message, which release-please reads.
+  conventional-pr-title:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

amazon_subscriptions-1.0.1/.github/workflows/publish.yml

@@ -0,0 +1,39 @@
+---
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/p/amazon-subscriptions
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Refuse dependencies by URL
+        run: |
+          if grep -n ' @ git+' pyproject.toml; then
+            echo "::error file=pyproject.toml::PyPI rejects dependencies by URL. Require a released version instead."
+            exit 1
+          fi
+
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+
+      - name: Build
+        run: uv build
+
+      # Trusted publishing: PyPI trusts this workflow and the pypi environment, no token needed.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

amazon_subscriptions-1.0.1/.github/workflows/release-please.yml

@@ -0,0 +1,21 @@
+---
+name: release-please
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      # OVERRIDE_TOKEN is required: a release created with GITHUB_TOKEN would not trigger publish.yml.
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.OVERRIDE_TOKEN }}

amazon_subscriptions-1.0.1/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+build/
+dist/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# Debug output of amazon-orders (real, unanonymized pages)
+output/
+
+.claude/worktrees/

amazon_subscriptions-1.0.1/.markdownlint-cli2.yaml

@@ -0,0 +1,13 @@
+---
+config:
+  # Prose is written one paragraph per line, and tables and command lines can't be wrapped.
+  MD013: false
+
+globs:
+  - "**/*.md"
+
+ignores:
+  # Generated by release-please.
+  - CHANGELOG.md
+  - .venv/**
+  - .claude/**

amazon_subscriptions-1.0.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.1"
+}

amazon_subscriptions-1.0.1/.yamllint.yml

@@ -0,0 +1,17 @@
+---
+extends: default
+
+ignore: |
+  .venv/
+  .claude/
+
+rules:
+  # `on:` is a workflow key, not a boolean.
+  truthy:
+    check-keys: false
+  # Workflow comments and step commands explain themselves on one line.
+  line-length:
+    max: 160
+  # SHA-pinned actions carry their version as `@sha # vX.Y.Z`.
+  comments:
+    min-spaces-from-content: 1

amazon_subscriptions-1.0.1/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+## [1.0.1](https://github.com/udondan/amazon-subscriptions/compare/v1.0.0...v1.0.1) (2026-10-28)
+
+
+### Documentation
+
+* install from PyPI, where every release is published ([#22](https://github.com/udondan/amazon-subscriptions/issues/22)) ([f56bba4](https://github.com/udondan/amazon-subscriptions/commit/f56bba404a031c7476a8887f9b45e9c4448bebf7))
+
+## [1.0.0](https://github.com/udondan/amazon-subscriptions/compare/v0.1.0...v1.0.0) (2026-10-28)
+
+
+### ⚠ BREAKING CHANGES
+
+* the English instead of the German pages are read, and the configured language package is ignored. The list price type "uvp" is now "rrp". amazon-orders comes from PyPI, version 5.2.0 or a later 5.x, which keeps the session of each site in its own file (e.g. cookies.amazon.de.json); a session stored in cookies.json is still used. Sites other than amazon.de are no longer rejected if they offer English.
+
+### Features
+
+* parse the English Subscribe & Save pages ([#20](https://github.com/udondan/amazon-subscriptions/issues/20)) ([f6361e4](https://github.com/udondan/amazon-subscriptions/commit/f6361e4fecd94247b5b4f13ad34ce57749251b94))
+
+## 0.1.0 (2026-10-13)
+
+
+### Features
+
+* attribute product page prices to their offer and add list price type and alternative offer ([#5](https://github.com/udondan/amazon-subscriptions/issues/5)) ([07550d4](https://github.com/udondan/amazon-subscriptions/commit/07550d442b58ac87edddbb92bb5ff41bc0580a4d))
+* read Subscribe & Save subscriptions and upcoming deliveries ([#1](https://github.com/udondan/amazon-subscriptions/issues/1)) ([0bdb700](https://github.com/udondan/amazon-subscriptions/commit/0bdb700d61ccac665897278de7c21d25a2697597))
+* read the ASIN of backup products and, with --with-prices, regular, list and unit prices ([#3](https://github.com/udondan/amazon-subscriptions/issues/3)) ([22d96f0](https://github.com/udondan/amazon-subscriptions/commit/22d96f0a7e128b0a12a552e4ec974edf7816c9f9))
+
+
+### Bug Fixes
+
+* read the seller name of alternative offers from the offer row and add seller_id ([#6](https://github.com/udondan/amazon-subscriptions/issues/6)) ([0accfb9](https://github.com/udondan/amazon-subscriptions/commit/0accfb9d4ce017e0a3fe50e47d2d29d709fd1b38))
+* return a partial result instead of failing when a delivery or product page cannot be read ([#7](https://github.com/udondan/amazon-subscriptions/issues/7)) ([3a3f08f](https://github.com/udondan/amazon-subscriptions/commit/3a3f08f8d797a0472b6add240c3ae454bb5755d2))
+
+
+### Dependencies
+
+* **deps:** update dependency ruff to v0.16.9 ([#9](https://github.com/udondan/amazon-subscriptions/issues/9)) ([ff25334](https://github.com/udondan/amazon-subscriptions/commit/ff25334c39d4e21857432ae0b9e83ddbfbcadf92))

amazon_subscriptions-1.0.1/CONTRIBUTING.md

@@ -0,0 +1,189 @@
+# Contributing
+
+## Pages of another Amazon site
+
+amazon-subscriptions reads the English Subscribe & Save pages of every Amazon site that offers English, but only
+amazon.de has been tested. The texts, the markup or the URLs of another site may differ. To find out, and to keep it
+working, anonymized pages of that site are needed as test fixtures. This guide shows how to capture and anonymize them
+step by step. You need a Subscribe & Save account on that site, and no knowledge of the code.
+
+> [!WARNING]
+> The raw pages you capture contain your name, your address, your subscriptions, order numbers, IDs and session
+> tokens. Never share them, attach them or commit them unchanged. Only share the anonymized pages, after checking
+> them yourself (step 5), and delete the raw pages when you are done (step 8).
+
+The examples use `amazon.co.uk`. Replace it with your site, and `co.uk` with the part after `amazon.`, e.g. `com`,
+`ca` or `com.au`.
+
+### 1. Install
+
+You need [git](https://git-scm.com/) and [uv](https://docs.astral.sh/uv/getting-started/installation/), which
+installs Python itself if needed.
+
+```sh
+git clone https://github.com/udondan/amazon-subscriptions
+cd amazon-subscriptions
+uv sync
+```
+
+All commands below are run in this directory.
+
+### 2. Log in
+
+```sh
+uv run amazon-subscriptions --domain amazon.co.uk login
+```
+
+This asks for your e-mail address, your password and, if enabled, a one-time password. They are sent to Amazon only
+and never stored. Only the session cookies are kept, in `~/.config/amazonorders/cookies.amazon.co.uk.json`, so the
+next commands do not need to log in. If you already have a session for this site, `login` signs out of it first.
+
+Check that it worked:
+
+```sh
+uv run amazon-subscriptions --domain amazon.co.uk check-session
+```
+
+### 3. Capture the pages
+
+```sh
+uv run amazon-subscriptions --domain amazon.co.uk --debug --output-dir raw list --with-prices
+```
+
+This only reads pages, it never changes a subscription. It writes every page it loads into the new directory `raw`:
+the Subscribe & Save overview, its further pages, one page per upcoming delivery and the product page of each
+subscription. Together, these are all pages that `list` and `upcoming` read, so you do not need to run `upcoming` as
+well. The requests are logged to the terminal.
+
+If the command fails or prints warnings, keep its output: it tells what is not understood yet (step 7). If it ends
+with an error before writing any page, open an issue with the error message instead.
+
+Always capture into a new, empty directory. If you capture again, delete `raw` first (`rm -rf raw`).
+
+### 4. Anonymize the pages
+
+```sh
+uv run python scripts/anonymize_fixtures.py --from-debug-dir raw --output-dir tests/fixtures/co.uk \
+    --replace "Jane Doe=Test Person" --sensitive "Jane" --sensitive "Doe" --sensitive "High Street"
+```
+
+Replace `Jane Doe` with your name as Amazon shows it, and add a `--sensitive` for each part of your name and address
+that must not appear in the result. Each option can be given several times.
+
+The script sorts the pages by their content and writes `landing.html`, `delivery-1.html`, `delivery-2.html` and so
+on, and, if the lists have further pages, `subscriptions-page-2.html` and `deliveries-page-2.html` to
+`tests/fixtures/co.uk/`. It replaces:
+
+- product titles with `Product 01`, `Product 02` and so on (followed by filler words), also in links,
+- ASINs, subscription IDs, delivery IDs and session IDs with fake values,
+- addresses, tokens and the values of your session cookies,
+- every text given with `--replace`.
+
+It does not replace free text, such as your name in a greeting or a message, and nothing the page shows in an
+unknown place. Prices, quantities, intervals and dates are kept.
+
+Afterwards, it checks every page for the sensitive values it has seen. If one is left, it prints `LEAK` and exits
+with status 1. It also prints a `WARN` line for text that looks like personal data: e-mail addresses, phone numbers,
+order and session numbers, customer IDs, names after "Hello" or "Deliver to", postcodes and product names in links.
+The value itself is masked. Look at each of them; if it is personal, add a `--replace` or `--sensitive` for it, delete
+`tests/fixtures/co.uk` and run the command again.
+
+At the end, it prints a command for the product pages, like this:
+
+```text
+    python scripts/extract_product_fixture.py --output-dir tests/fixtures/co.uk --asin-map raw/asin-map.json \
+        raw/B0XXXXXXXX_0.html raw/B0YYYYYYYY_0.html …
+```
+
+Run it with `uv run` in front:
+
+```sh
+uv run python scripts/extract_product_fixture.py --output-dir tests/fixtures/co.uk --asin-map raw/asin-map.json \
+    raw/B0XXXXXXXX_0.html raw/B0YYYYYYYY_0.html …
+```
+
+It reduces each product page to its title and price blocks, replaces titles, ASINs, seller names and IDs, and
+writes it as `product-<fake ASIN>.html`. For each page, it prints what the parser reads from it:
+
+```text
+ok   tests/fixtures/co.uk/product-B0TEST0024.html: price 8.69, list price 11.99 (rrp, from buybox), unit price 57.93 per l
+ok   tests/fixtures/co.uk/product-B0TEST0046.html: no price
+```
+
+Keep about five pages that show different things, e.g. a recommended retail price (`rrp`), a former price (`was`),
+a product without price (not available), one with an alternative offer, and one with a plain price. Delete the
+others. You may rename the ones you keep to say what they show, e.g. `product-rrp.html`.
+
+### 5. Check the pages yourself
+
+The scripts only replace what they know about. Search the anonymized pages for your own data, with every value you
+can think of: your first and last name, street, postcode, town, e-mail address and phone number.
+
+```sh
+grep -rniE "jane|doe|high street|SW1A 1AA|jane@example.com|7700 900123" tests/fixtures/co.uk/
+```
+
+Search for order numbers too; `000-0000000-0000000` is the placeholder of the scripts. This must find nothing:
+
+```sh
+grep -rnoE "[0-9]{3}-[0-9]{7}-[0-9]{7}" tests/fixtures/co.uk/ | grep -v 000-0000000-0000000
+```
+
+Then run the scan of step 4 once more on all pages, including the product pages:
+
+```sh
+uv run python scripts/privacy_scan.py tests/fixtures/co.uk/*.html
+```
+
+It ends with "Nothing found" or lists `WARN` lines as in step 4. If something personal is left, add a `--replace` or
+`--sensitive` for it in step 4, delete `tests/fixtures/co.uk` and run steps 4 and 5 again. For a product page, you
+can also delete it.
+
+### 6. Share the pages
+
+Either way, describe in a few words what your subscriptions look like (e.g. "one paused subscription, one with a
+backup product") and include the output and warnings of step 3, after checking them for personal data as well.
+
+- **Pull request**: [Fork the repository](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo),
+  commit only the directory `tests/fixtures/co.uk/` and open a pull request. Its title follows
+  [Conventional Commits](https://www.conventionalcommits.org/), e.g. `test: add pages of amazon.co.uk`.
+- **Issue**: If you do not want to open a pull request, pack the directory (`zip -r co.uk.zip tests/fixtures/co.uk`)
+  and attach the archive to a [new issue](https://github.com/udondan/amazon-subscriptions/issues/new).
+
+### 7. Unknown texts, formats and markup
+
+If step 3 printed warnings or the result misses values, the site shows something that is not known yet. You do not
+need to fix it yourself; the pages from step 6 are enough to do it. If you want to, this is where it goes:
+
+- **Texts** (e.g. "Next delivery:", "Arriving", "RRP", status and alert texts) and **date and amount formats**:
+  `amazon_subscriptions/locales/en.py`. The `TODO` comments there name the texts that are not known yet for any site.
+  Only take texts from real pages, never guess them.
+- **Currency**: `SITE_CURRENCIES` in `amazon_subscriptions/locales/__init__.py`.
+- **Markup**: the CSS selectors in `amazon_subscriptions/parse/selectors.py`.
+- **URLs**: the allow-list in `amazon_subscriptions/client.py`. Only add pages that are read; never add a URL that
+  changes a subscription.
+
+Add tests in `tests/` that read your fixtures, and run them with:
+
+```sh
+uv run ruff check .
+uv run ruff format --check .
+uv run mypy
+uv run pytest
+```
+
+(With [mise](https://mise.jdx.dev/), `mise run lint` and `mise run test` do the same.)
+
+### 8. Clean up
+
+Delete the raw pages, and the pages that could not be read, if any were saved:
+
+```sh
+rm -rf raw ~/.cache/amazon-subscriptions/failed
+```
+
+To end the session as well:
+
+```sh
+uv run amazon-subscriptions --domain amazon.co.uk logout
+```

amazon_subscriptions-1.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel Schroeder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.