@optima-chat/dev-skills 0.7.36 → 0.7.38

package/bin/helpers/verify-health.ts

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+/**
+ * optima-verify-health —— 服务上线健康探针(L1 DNS / L2 TLS / L3-L5 /health)。
+ *
+ * 逐层探、逐层报,逐层 pass 才算上线成功。零依赖(纯 Node 内置)。
+ * 配套静态合规审计 audit-probe.py 在 optima-terraform 仓 docs/cn-prod/probes/(读 terraform 文件,绑仓不搬)。
+ *
+ *   L1 DNS  : FQDN 能解析到 IP
+ *   L2 TLS  : 443 握手 + 证书链/有效期/SNI(SAN)匹配
+ *   L3 /health : optima-core 风格 /health,顶层 status 健康
+ *   L4 真部署  : 解析 gitCommit;传 --expect-commit <sha> 时比对(证明跑的是这次镜像)
+ *   L5 依赖    : checks[*] 全绿(DB/Redis/上游由服务在 health handler 自注册)
+ *
+ * ⚠️ optima-core 的 JS 与 Py 两套 /health schema 不一致,都兼容:
+ *   JS : gitCommit(camel) / status∈{healthy,unhealthy} / 不健康返 503 / 有 gitBranch
+ *   Py : git_commit(snake) / status∈{healthy,degraded} / 永远 200 / check 可 timeout|error / 无 git_branch
+ *
+ * 用法:
+ *   optima-verify-health user-auth                  # 默认 cn-prod
+ *   optima-verify-health user-auth --env prod        # 环境 stage|prod|cn|all
+ *   optima-verify-health --all --env all             # stage/prod/cn 三环境矩阵
+ *   optima-verify-health gateway-core --expect-commit a1b2c3d
+ *   optima-verify-health --url https://auth-cn.optima.chat/health
+ *   optima-verify-health --all --json                # 机器可读,接 CI
+ *   optima-verify-health --all --strict              # warn 也算不通过
+ * 退出码:fail → 非 0;warn 默认放行(0),--strict 让 warn 也非 0。
+ */
+import { promises as dns } from 'node:dns';
+import * as tls from 'node:tls';
+import * as https from 'node:https';
+
+type Env = 'stage' | 'prod' | 'cn';
+interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; }
+
+// 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
+// cn-prod 真实 subdomain 抄自 optima-terraform 的 stack main.tf(非文档表,如 agentic-chat 真名是 agentic-chat-cn 不是 ai-cn)。
+const SERVICES: Record<string, SvcCfg> = {
+  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth-cn.optima.chat' },
+  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'agentic-chat-cn.optima.chat' },
+  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'api-cn.optima.chat', cn_path: '/health/live' },
+  'mcp-host':         { path: '/health',     stage: 'mcp-stage.optima.onl',  prod: 'mcp.optima.onl' },
+  'gateway-core':     { path: '/health',     cn: 'gw-cn.optima.chat' },
+  'optima-scout':     { path: '/health',     cn: 'scout-cn.optima.chat' },
+  'optima-skills':    { path: '/health',     cn: 'skills-cn.optima.chat' },
+};
+const ENVS: Env[] = ['stage', 'prod', 'cn'];
+
+const G = '\x1b[32m', R = '\x1b[31m', Y = '\x1b[33m', B = '\x1b[34m', N = '\x1b[0m';
+const MARK: Record<string, string> = { ok: `${G}✅${N}`, fail: `${R}❌${N}`, warn: `${Y}⚠️ ${N}`, na: `${B}··${N}` };
+type Result = 'ok' | 'warn' | 'fail';
+interface Layer { layer: string; result: Result; detail: string; }
+
+const verdict = (ls: Layer[]): 'pass' | 'warn' | 'fail' =>
+  ls.some((l) => l.result === 'fail') ? 'fail' : ls.some((l) => l.result === 'warn') ? 'warn' : 'pass';
+
+const VTXT: Record<string, string> = {
+  pass: `${G}上线成功(L1-L5 全绿)${N}`,
+  warn: `${Y}存活但有告警(见上 ⚠️;非阻塞)${N}`,
+  fail: `${R}未通过 — 见上 ❌${N}`,
+};
+
+function tlsCheck(host: string, timeout = 10000): Promise<{ ok: boolean; detail: string; result: Result }> {
+  return new Promise((resolve) => {
+    const sock = tls.connect({ host, port: 443, servername: host, timeout }, () => {
+      const cert = sock.getPeerCertificate();
+      const days = Math.floor((new Date(cert.valid_to).getTime() - Date.now()) / 86400000);
+      const sans = (cert.subjectaltname || '').split(',').map((s) => s.trim().replace(/^DNS:/, '')).slice(0, 3);
+      sock.end();
+      resolve({ ok: true, result: days > 7 ? 'ok' : 'warn',
+        detail: `证书 ${days}d 后过期, SAN=${sans.join(',')}` + (days > 7 ? '' : ` (剩 ${days}d!)`) });
+    });
+    sock.on('error', (e: Error) => resolve({ ok: false, result: 'fail', detail: `握手/证书失败: ${e.message}` }));
+    sock.on('timeout', () => { sock.destroy(); resolve({ ok: false, result: 'fail', detail: '握手超时' }); });
+  });
+}
+
+function httpGet(url: string, timeout = 10000): Promise<{ code: number; body: string; location?: string }> {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, { headers: { 'User-Agent': 'optima-verify-health' }, timeout }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ code: res.statusCode || 0, body, location: res.headers.location }));
+    });
+    req.on('error', reject);
+    req.on('timeout', () => { req.destroy(new Error('请求超时')); });
+  });
+}
+
+async function probe(host: string, path: string, expect?: string): Promise<Layer[]> {
+  const layers: Layer[] = [];
+
+  // L1 DNS
+  try {
+    const addrs = await dns.lookup(host, { all: true });
+    const ips = [...new Set(addrs.map((a) => a.address))];
+    layers.push({ layer: 'L1 DNS', result: 'ok', detail: `${host} → ${ips.join(', ')}` });
+  } catch (e: any) {
+    layers.push({ layer: 'L1 DNS', result: 'fail', detail: `${host} 无法解析: ${e.message}` });
+    return layers;
+  }
+
+  // L2 TLS
+  const t = await tlsCheck(host);
+  layers.push({ layer: 'L2 TLS', result: t.result, detail: t.detail });
+  if (!t.ok) return layers;
+
+  // L3-L5 /health
+  const url = `https://${host}${path}`;
+  let r: { code: number; body: string; location?: string };
+  try {
+    r = await httpGet(url);
+  } catch (e: any) {
+    layers.push({ layer: 'L3 /health', result: 'fail', detail: `${url} 无法连接: ${e.message}` });
+    return layers;
+  }
+  if (r.code >= 300 && r.code < 400) {
+    layers.push({ layer: 'L3 /health', result: 'fail', detail: `HTTP ${r.code} 重定向到 ${r.location || '?'}(没路由到服务,疑似未部署/listener 缺失)` });
+    return layers;
+  }
+  let d: any;
+  try { d = JSON.parse(r.body || '{}'); } catch {
+    layers.push({ layer: 'L3 /health', result: 'fail', detail: `HTTP ${r.code} 但非 JSON(可能不是 optima-core /health): ${JSON.stringify(r.body.slice(0, 80))}` });
+    return layers;
+  }
+
+  const status = d.status ?? '?';
+  if (status === 'healthy') layers.push({ layer: 'L3 /health', result: 'ok', detail: `HTTP ${r.code} status=healthy svc=${d.service ?? '?'} ver=${d.version ?? '?'}` });
+  else if (['ok', 'up', 'pass'].includes(status)) layers.push({ layer: 'L3 /health', result: 'warn', detail: `HTTP ${r.code} status=${status}(存活,但非 optima-core 标准 health,L4/L5 无从验证)` });
+  else if (status === 'degraded') layers.push({ layer: 'L3 /health', result: 'warn', detail: `HTTP ${r.code} status=degraded(Py:部分依赖挂但服务起着,见 L5)` });
+  else layers.push({ layer: 'L3 /health', result: 'fail', detail: `HTTP ${r.code} status=${status}` });
+
+  // L4 真部署 / 非裸起
+  const commit: string = d.gitCommit || d.git_commit || '';
+  const branch: string = d.gitBranch || '';
+  const bt = `commit=${commit || '∅'}` + (branch ? ` branch=${branch}` : '');
+  if (!commit) layers.push({ layer: 'L4 部署', result: 'warn', detail: '无 gitCommit(没用 optima-core health,或 build-info 没烘进去)' });
+  else if (expect) {
+    const short = expect.slice(0, commit.length);
+    layers.push(commit === short
+      ? { layer: 'L4 部署', result: 'ok', detail: `${bt} == 期望 ${short} ✓ 跑的是这次镜像` }
+      : { layer: 'L4 部署', result: 'fail', detail: `${bt} != 期望 ${short} ✗ 旧镜像/部署没生效` });
+  } else layers.push({ layer: 'L4 部署', result: 'ok', detail: `${bt}(未传 --expect-commit,仅展示)` });
+
+  // L5 依赖 checks 全绿
+  const checks: Record<string, any> = d.checks || {};
+  const keys = Object.keys(checks);
+  if (keys.length === 0) layers.push({ layer: 'L5 依赖', result: 'warn', detail: 'health 未注册任何 checks(服务没在 handler 里挂 DB/Redis/上游)' });
+  else {
+    const bad = keys.filter((k) => checks[k].status !== 'healthy');
+    const summary = keys.map((k) => `${k}=${checks[k].status}(${checks[k].latencyMs ?? checks[k].latency_ms ?? '?'}ms)`).join(', ');
+    layers.push(bad.length
+      ? { layer: 'L5 依赖', result: 'fail', detail: `${bad.length} 个不健康: ${bad.map((k) => `${k}=${checks[k].status}`).join(',')} | 全部: ${summary}` }
+      : { layer: 'L5 依赖', result: 'ok', detail: `${keys.length} 个依赖全绿: ${summary}` });
+  }
+  return layers;
+}
+
+function resolve(svc: string, e: Env): [string, string, string] | null {
+  const cfg = SERVICES[svc];
+  const host = cfg[e];
+  if (!host) return null;
+  const path = (cfg as any)[`${e}_path`] || cfg.path;
+  return [`${svc} [${e}]`, host, path];
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const has = (f: string) => argv.includes(f);
+  const val = (f: string) => { const i = argv.indexOf(f); return i >= 0 ? argv[i + 1] : undefined; };
+  const asJson = has('--json'), strict = has('--strict');
+  const expect = val('--expect-commit');
+  const env = (val('--env') || 'cn') as Env | 'all';
+  const envs: Env[] = env === 'all' ? ENVS : [env as Env];
+  const positional = argv.filter((x, i) => !x.startsWith('--') && !(i > 0 && argv[i - 1].startsWith('--') && ['--env', '--expect-commit', '--url'].includes(argv[i - 1])));
+
+  let targets: [string, string, string][] = [];
+  if (has('--url')) {
+    const u = new URL(val('--url')!);
+    targets = [[u.hostname, u.hostname, u.pathname || '/health']];
+  } else if (has('--all')) {
+    for (const e of envs) for (const s of Object.keys(SERVICES)) { const t = resolve(s, e); if (t) targets.push(t); }
+  } else if (positional[0] && SERVICES[positional[0]]) {
+    for (const e of envs) { const t = resolve(positional[0], e); if (t) targets.push(t); }
+  } else {
+    console.log((require('fs').readFileSync(__filename, 'utf-8').match(/\/\*\*[\s\S]*?\*\//)?.[0] || '').replace(/^\s*\*?/gm, ''));
+    process.exit(2);
+  }
+  if (targets.length === 0) { console.log(`(无目标:${env} 环境下该服务无部署)`); process.exit(2); }
+
+  const results: any[] = [];
+  let worstOk = true;
+  for (const [name, host, path] of targets) {
+    const layers = await probe(host, path, expect);
+    const v = verdict(layers);
+    if (v === 'fail' || (strict && v === 'warn')) worstOk = false;
+    if (asJson) results.push({ service: name, url: `https://${host}${path}`, verdict: v, layers });
+    else {
+      console.log(`\n${'='.repeat(60)}\n  ${name}  https://${host}${path}\n${'='.repeat(60)}`);
+      for (const l of layers) console.log(`  ${MARK[l.result] || '?'} ${l.layer.padEnd(11)} ${l.detail}`);
+      console.log(`  ${'—'.repeat(56)}\n  ${'结论'.padEnd(10)} ${VTXT[v]}`);
+    }
+  }
+  if (asJson) console.log(JSON.stringify(results, null, 2));
+  // 用 exitCode 而非 process.exit():后者会在管道(--json | jq)未 flush 完就退出而截断输出
+  process.exitCode = worstOk ? 0 : 1;
+}
+
+main();

package/dist/bin/helpers/db-utils.js

@@ -41,17 +41,25 @@ exports.getInfisicalToken = getInfisicalToken;
 exports.getInfisicalSecrets = getInfisicalSecrets;
 exports.parseDatabaseUrl = parseDatabaseUrl;
 exports.setupSSHTunnel = setupSSHTunnel;
+exports.setupSSMTunnel = setupSSMTunnel;
+exports.setupTunnel = setupTunnel;
 exports.queryDB = queryDB;
 exports.connectAuthDB = connectAuthDB;
 exports.connectBillingDB = connectBillingDB;
 exports.resolveUserId = resolveUserId;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 // ─── Constants ──────────────────────────────────────────────────────────────
 exports.RDS_HOSTS = {
     stage: 'optima-stage-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com',
     prod: 'optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com',
 };
+// Shared bastion (optima-bi-data EC2, shared-services stack). Reached via SSM —
+// no public port 22 dependency, so it is immune to the MaxStartups throttling that
+// the open-to-world sshd suffers under internet scan load. SSH path kept as fallback.
+const AWS_REGION = 'ap-southeast-1';
+const BASTION_INSTANCE_ID = 'i-03286fb0a9ce7e6b1';
 const EC2_HOST = '3.0.210.113';
 // ─── SQL escaping ───────────────────────────────────────────────────────────
 /** Escape a string value for safe inclusion in SQL single-quoted literals. */
@@ -137,6 +145,82 @@ function setupSSHTunnel(dbHost, localPort) {
         `-o ExitOnForwardFailure=yes -o ConnectTimeout=10 ` +
         `-L ${localPort}:${dbHost}:5432 ec2-user@${EC2_HOST}`, { stdio: 'inherit' });
 }
+/** Block the current (sync) call for `ms` without spawning a subprocess. */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function assertSSMPrereqs() {
+    for (const [bin, hint] of [
+        ['session-manager-plugin', 'https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html'],
+        ['aws', 'AWS CLI v2: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html'],
+    ]) {
+        try {
+            (0, child_process_1.execSync)(`command -v ${bin}`, { stdio: 'ignore' });
+        }
+        catch {
+            throw new Error(`${bin} not found — required for the SSM DB tunnel. Install: ${hint}\n(or set OPTIMA_DB_TUNNEL=ssh to fall back to the legacy SSH tunnel)`);
+        }
+    }
+}
+/**
+ * Open a local→RDS tunnel through the shared bastion using SSM port forwarding.
+ * No public SSH port is touched. A healthy existing tunnel on the port is reused
+ * (the ~2s SSM cold start is paid once, then every query is just a round-trip).
+ */
+function setupSSMTunnel(dbHost, localPort) {
+    let portInUse = false;
+    try {
+        (0, child_process_1.execSync)(`lsof -ti:${localPort}`, { stdio: 'ignore' });
+        portInUse = true;
+    }
+    catch { /* free */ }
+    if (portInUse) {
+        if (isTunnelHealthy(localPort))
+            return; // warm reuse — no cold start
+        console.log(`! Tunnel on port ${localPort} not responding (zombie), replacing...`);
+        killOrphanTunnel(localPort);
+    }
+    assertSSMPrereqs();
+    console.log(`Creating SSM tunnel: localhost:${localPort} -> ${BASTION_INSTANCE_ID} -> ${dbHost}:5432`);
+    const logFile = `${os.tmpdir()}/optima-ssm-tunnel-${localPort}.log`;
+    const out = fs.openSync(logFile, 'w');
+    const child = (0, child_process_1.spawn)('aws', [
+        'ssm', 'start-session',
+        '--region', AWS_REGION,
+        '--target', BASTION_INSTANCE_ID,
+        '--document-name', 'AWS-StartPortForwardingSessionToRemoteHost',
+        '--parameters', `host=${dbHost},portNumber=5432,localPortNumber=${localPort}`,
+    ], { detached: true, stdio: ['ignore', out, out] });
+    child.unref();
+    // Wait until the remote leg actually forwards (pg_isready probes RDS through the
+    // tunnel). Local port binds instantly; the remote hop needs ~1-2s to come up.
+    const deadlineMs = Date.now() + 20000;
+    while (Date.now() < deadlineMs) {
+        if (isTunnelHealthy(localPort)) {
+            console.log(`✓ SSM tunnel ready on port ${localPort}`);
+            return;
+        }
+        sleepSync(500);
+    }
+    let tail = '(no log)';
+    try {
+        tail = fs.readFileSync(logFile, 'utf-8').split('\n').slice(-8).join('\n');
+    }
+    catch { /* ignore */ }
+    throw new Error(`SSM tunnel on port ${localPort} did not become ready within 20s.\n--- ${logFile} ---\n${tail}`);
+}
+/**
+ * Open a DB tunnel through the shared bastion. Defaults to SSM (no public port 22);
+ * set OPTIMA_DB_TUNNEL=ssh to fall back to the legacy SSH tunnel.
+ */
+function setupTunnel(dbHost, localPort) {
+    if ((process.env.OPTIMA_DB_TUNNEL || 'ssm').toLowerCase() === 'ssh') {
+        setupSSHTunnel(dbHost, localPort);
+    }
+    else {
+        setupSSMTunnel(dbHost, localPort);
+    }
+}
 // ─── psql ───────────────────────────────────────────────────────────────────
 function findPsqlPath() {
     try {
@@ -166,8 +250,7 @@ async function connectAuthDB(env, infisicalConfig, token) {
     const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
     const host = exports.RDS_HOSTS[env];
     const port = env === 'stage' ? 15432 : 15433;
-    setupSSHTunnel(host, port);
-    await new Promise(r => setTimeout(r, 1000));
+    setupTunnel(host, port);
     const conn = { host: 'localhost', port, user: secrets['AUTH_DB_USER'], password: secrets['AUTH_DB_PASSWORD'], database: 'optima_auth' };
     return { query: (sql) => queryDB(conn, sql) };
 }
@@ -180,8 +263,7 @@ async function connectBillingDB(env, infisicalConfig, token) {
         throw new Error('DATABASE_URL not found for billing service');
     const parsed = parseDatabaseUrl(dbUrl);
     const port = env === 'stage' ? 15434 : 15435;
-    setupSSHTunnel(parsed.host, port);
-    await new Promise(r => setTimeout(r, 1000));
+    setupTunnel(parsed.host, port);
     const conn = { host: 'localhost', port, user: parsed.user, password: parsed.password, database: parsed.database };
     return { query: (sql) => queryDB(conn, sql) };
 }

package/dist/bin/helpers/discount/create.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCreate = runCreate;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+/** Normalize a date/datetime arg to a full ISO datetime string (billing requires z.iso.datetime). */
+function toIso(v) {
+    const d = new Date(v);
+    if (isNaN(d.getTime()))
+        throw new Error(`Invalid date: ${v} (use YYYY-MM-DD or ISO datetime)`);
+    return d.toISOString();
+}
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-discount create --code <CODE> --percent <1-100> [options]
+
+Required:
+  --code <CODE>            Promo code (stored uppercased)
+  --percent <1-100>        Percentage off
+
+Optional:
+  --products <a,b,...>     Limit to these productKeys (default: all)
+  --starts <date>          Valid-from (YYYY-MM-DD or ISO; default: immediately)
+  --ends <date>            Valid-until
+  --max <N>                Max total redemptions (default: unlimited; 1 = single-use)
+  --campaign <label>       Grouping label
+  --env stage|prod         (default: stage)
+  --yes                    Skip prod confirmation`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--code':
+                out.code = next;
+                i++;
+                break;
+            case '--percent':
+                out.percentOff = parseInt(next, 10);
+                i++;
+                break;
+            case '--products':
+                if (!next)
+                    throw new Error('--products requires a value');
+                out.productKeys = next.split(',').map((s) => s.trim()).filter(Boolean);
+                i++;
+                break;
+            case '--starts':
+                out.startsAt = toIso(next);
+                i++;
+                break;
+            case '--ends':
+                out.endsAt = toIso(next);
+                i++;
+                break;
+            case '--max':
+                out.maxRedemptions = parseInt(next, 10);
+                i++;
+                break;
+            case '--campaign':
+                out.campaign = next;
+                i++;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.code)
+        throw new Error('--code required');
+    if (out.percentOff === undefined || isNaN(out.percentOff))
+        throw new Error('--percent required (1-100)');
+    return out;
+}
+async function runCreate(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Create discount code ${args.code.toUpperCase()} (${args.percentOff}% off)`, args.yes);
+    const body = { code: args.code, percentOff: args.percentOff };
+    if (args.productKeys)
+        body.productKeys = args.productKeys;
+    if (args.startsAt)
+        body.startsAt = args.startsAt;
+    if (args.endsAt)
+        body.endsAt = args.endsAt;
+    if (args.maxRedemptions !== undefined)
+        body.maxRedemptions = args.maxRedemptions;
+    if (args.campaign)
+        body.campaign = args.campaign;
+    console.log(`\n🎟️  Creating discount code on ${args.env.toUpperCase()}...`);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/discount-codes', body);
+    console.log(`✓ Created (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+}

package/dist/bin/helpers/discount/disable.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDisable = runDisable;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-discount disable --code <CODE> [options]
+
+Required:
+  --code <CODE>
+
+Optional:
+  --env stage|prod         (default: stage)
+  --yes                    Skip prod confirmation`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--code':
+                out.code = next;
+                i++;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.code)
+        throw new Error('--code required');
+    return out;
+}
+async function runDisable(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Disable discount code ${args.code.toUpperCase()}`, args.yes);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'PATCH', `/api/billing/admin/discount-codes/${encodeURIComponent(args.code)}`, { status: 'DISABLED' });
+    console.log(`✓ Disabled (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+}

package/dist/bin/helpers/discount/generate.js

@@ -0,0 +1,135 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGenerate = runGenerate;
+const fs = __importStar(require("fs"));
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+function toIso(v) {
+    const d = new Date(v);
+    if (isNaN(d.getTime()))
+        throw new Error(`Invalid date: ${v} (use YYYY-MM-DD or ISO datetime)`);
+    return d.toISOString();
+}
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-discount generate --count <N> --percent <1-100> --campaign <label> [options]
+
+Generates N unique single-use codes (maxRedemptions=1). Codes are written to a
+local file (NOT printed) to keep them copy-paste clean.
+
+Required:
+  --count <N>              How many codes (1-1000)
+  --percent <1-100>        Percentage off
+  --campaign <label>       Grouping label (also the code prefix)
+
+Optional:
+  --products <a,b,...>     Limit to these productKeys
+  --starts <date>          Valid-from (YYYY-MM-DD or ISO)
+  --ends <date>            Valid-until
+  --env stage|prod         (default: stage)
+  --yes                    Skip prod confirmation`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--count':
+                out.count = parseInt(next, 10);
+                i++;
+                break;
+            case '--percent':
+                out.percentOff = parseInt(next, 10);
+                i++;
+                break;
+            case '--campaign':
+                out.campaign = next;
+                i++;
+                break;
+            case '--products':
+                if (!next)
+                    throw new Error('--products requires a value');
+                out.productKeys = next.split(',').map((s) => s.trim()).filter(Boolean);
+                i++;
+                break;
+            case '--starts':
+                out.startsAt = toIso(next);
+                i++;
+                break;
+            case '--ends':
+                out.endsAt = toIso(next);
+                i++;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (out.count === undefined || isNaN(out.count))
+        throw new Error('--count required (1-1000)');
+    if (out.percentOff === undefined || isNaN(out.percentOff))
+        throw new Error('--percent required (1-100)');
+    if (!out.campaign)
+        throw new Error('--campaign required');
+    return out;
+}
+async function runGenerate(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Generate ${args.count} unique discount codes (${args.percentOff}% off, campaign ${args.campaign})`, args.yes);
+    const body = { count: args.count, percentOff: args.percentOff, campaign: args.campaign };
+    if (args.productKeys)
+        body.productKeys = args.productKeys;
+    if (args.startsAt)
+        body.startsAt = args.startsAt;
+    if (args.endsAt)
+        body.endsAt = args.endsAt;
+    console.log(`\n🎟️  Generating ${args.count} codes on ${args.env.toUpperCase()}...`);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/discount-codes/batch', body);
+    const codes = res.body.codes ?? [];
+    const safeCampaign = args.campaign.replace(/[^A-Za-z0-9_-]/g, '');
+    const file = `./discount-codes-${safeCampaign}-${Date.now()}.txt`;
+    // mode 0o600: single-use codes are sensitive-ish; written to the operator's CWD.
+    fs.writeFileSync(file, codes.join('\n') + '\n', { encoding: 'utf-8', mode: 0o600 });
+    console.log(`✓ Generated ${codes.length} codes (HTTP ${res.status}). Written to: ${file}`);
+    console.log(`  (codes are in the file, not printed, to keep them copy-paste clean)`);
+}