Add a Falabella Seller Center adapter with sorted-query HMAC signing - #1543

Summary

This adds a Falabella Seller Center adapter (falabella.com marketplace: Chile, Colombia, Peru) and two opt-in options for the HMAC signer that its API needs.

Falabella signs every call with HMAC-SHA256 using the user's API key. The signed string is built like this:

• all query parameters except Signature;
• sorted by name;
• names and values percent-encoded per RFC 3986;
• joined as name=value with &.

The Timestamp is in ISO 8601. The existing ${sortedParams} (Alibaba IOP style: no separators, no encoding) and the s/ms timestamps cannot express this.

Changes

Engine (rest.engine.ts)

• ${sortedQuery} template variable:
  • query parameters as sent, sorted, RFC 3986 encoded, name=value&...;
  • without the signature parameter, keeping empty values;
  • no body.
• timestampFormat: "iso" → 2026-11-06T07:00:00+00:00 (UTC).
• Both are new values, so every existing adapter keeps its exact signature. rest.engine.hmac-pin.spec.ts and the IOP / Shopee specs pass unchanged; the Shopee spec's list of query-signed adapters gains the new slug.
• Documented in docs/tool-definition.md.

Adapter intl/falabella-seller-center.json, 25 tools:

• Reads: products, stock, brands, category tree / attributes / suggestion, warehouses, feeds (list, offset list, count, status), orders, order, order items (one or several), shipping label.
• Writes, on at install: create products, update products (XML from the model), update price (one SKU), update stock (one SKU, or XML for several / a warehouse), set images.
• Off at install: remove products, ready to ship, cancel.

Other details:

• Credentials: FALABELLA_USER_ID, FALABELLA_API_KEY (secret), FALABELLA_SELLER_ID, FALABELLA_BUSINESS_UNIT (FACL/FACO/FAPE).
• User-Agent: SELLER_ID/AnythingMCP/1.0/ANYTHINGMCP/BU, as Falabella requires.
• Errors come back with HTTP 200 in ErrorResponse; errorWhen maps them:
  • 7 signature → 401;
  • 3 / 4 timestamp → 401;
  • 9 access denied → 403;
  • 429 → 429;
  • anything else → 400.
• Writes are asynchronous feeds. The descriptions and the instructions point to the feed status tool.
• Logo falabella.svg, catalog regenerated, counts 712 → 713, llms.txt regenerated.

Cloud and self-hosted: the adapter and the signer behave the same in both.

Type

• New feature (adapter + opt-in engine option)

Testing

• Added/updated unit tests

In packages/backend:

• npx jest src/connectors/engines/rest.engine.sortedquery-signing.spec.ts src/connectors/engines/rest.engine.hmac-pin.spec.ts src/connectors/engines/rest.engine.iop-signing.spec.ts: 30 passed. The engine reproduces the vendor's published reference signature (3ceb8ed9…6041 for the documented key, user and timestamp). The spec also covers:
  • RFC 3986 edge cases;
  • + in the timestamp sent as %2B;
  • the XML body left out of the signature.
• npx jest src/adapters/intl/falabella-seller-center.live.spec.ts: 12 passed, live block skipped. Live calls are read-only, gated by RUN_FALABELLA_SELLER_CENTER_LIVE=1.
• npx jest src/adapters src/connectors/engines: 26,181 tests passed. 12 suites could not compile locally because this machine's node_modules lacks @types/picomatch (known local baseline, same on main). CI runs them.
• npx eslint on the changed TS files: clean.

From the repo root:

• node scripts/validate-adapters.mjs --warn: 729 passed, no warnings for the new adapter.
• node scripts/adapter-count.mjs --check: OK, 713 adapters.

Against the real host:

• An unsigned call answers {"ErrorResponse":{"Head":{"ErrorCode":"9","ErrorMessage":"E009: Access Denied"}}} with HTTP 200, which errorWhen maps to 403.
• Signed calls with real credentials are still pending. There is no public sandbox, and they will be run read-only once a seller's key is available.

Checklist

• My code follows the existing code style
• I have tested my changes locally