@optima-chat/dev-skills 0.7.38 → 0.7.40

package/bin/helpers/grant-subscription.ts

@@ -1,6 +1,19 @@
 #!/usr/bin/env node
 
-import { getInfisicalConfig, getInfisicalToken, resolveUserId, connectBillingDB, escapeSQL } from './db-utils';
+// P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
+// 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
+// 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
+import { getInfisicalConfig, getInfisicalToken, resolveUserId } from './db-utils';
+import { callBilling, resolveUserIdByEmail, validateEnvCnProd } from './billing-http';
+
+// cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
+// exist in the cn DB, so a per-env whitelist (not billing-side validation)
+// is what prevents accidentally granting a USD-priced plan to a CN user.
+const PLANS_BY_ENV: Record<string, string[]> = {
+  stage: ['trial', 'starter', 'pro', 'enterprise'],
+  prod: ['trial', 'starter', 'pro', 'enterprise'],
+  'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+};
 
 function parseArgs(args: string[]): { email: string; plan: string; months: number; env: string } {
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
@@ -8,14 +21,15 @@ function parseArgs(args: string[]): { email: string; plan: string; months: numbe
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
+                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod (default: stage)
   -h, --help        Show this help`);
     process.exit(0);
   }
 
   const email = args[0];
-  let plan = 'pro';
+  let plan: string | null = null;
   let months = 1;
   let env = 'stage';
 
@@ -25,106 +39,50 @@ Options:
     else if (args[i] === '--env' && args[i + 1]) { env = args[++i]; }
   }
 
-  if (!['trial', 'starter', 'pro', 'enterprise'].includes(plan)) {
-    console.error(`Unknown plan: ${plan}. Available: trial, starter, pro, enterprise`);
+  validateEnvCnProd(env);
+  plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+  const allowed = PLANS_BY_ENV[env];
+  if (!allowed.includes(plan)) {
+    console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
     process.exit(1);
   }
   if (months < 1) { console.error('Months must be >= 1'); process.exit(1); }
-  if (!['stage', 'prod'].includes(env)) { console.error('Env must be stage or prod (billing DB not available in CI)'); process.exit(1); }
 
   return { email, plan, months, env };
 }
 
 async function main() {
   const { email, plan, months, env } = parseArgs(process.argv.slice(2));
-  const infisicalConfig = getInfisicalConfig();
-  const token = getInfisicalToken(infisicalConfig);
 
   console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
 
-  const userId = await resolveUserId(email, env, infisicalConfig, token);
-  const billing = await connectBillingDB(env, infisicalConfig, token);
-  const bq = billing.query;
-
-  // Read plan config from DB
-  console.log(`Loading plan config: ${plan}`);
-  const planRow = bq(`SELECT name, monthly_credits, session_token_limit, weekly_token_limit FROM plans WHERE id='${escapeSQL(plan)}'`);
-  if (!planRow) { console.error(`❌ Plan not found in DB: ${plan}`); process.exit(1); }
-
-  const [planName, monthlyCreditsStr, sessionTokenLimitStr, weeklyTokenLimitStr] = planRow.split('|');
-  const monthlyCredits = parseInt(monthlyCreditsStr, 10);
-  const grantMicros = monthlyCredits * 10000; // 1 credit = $0.01 = 10,000 micros
-  const sessionTokenLimit = parseInt(sessionTokenLimitStr, 10);
-  const weeklyTokenLimit = parseInt(weeklyTokenLimitStr, 10);
-  console.log(`✓ Plan: ${planName} (grant: $${(grantMicros / 1000000).toFixed(2)}, session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
-
-  // Execute all mutations in a single transaction
-  const now = new Date().toISOString();
-  const periodEnd = new Date();
-  periodEnd.setMonth(periodEnd.getMonth() + months);
-  const periodEndISO = periodEnd.toISOString();
-  const sessionEnd = new Date(new Date().getTime() + 5 * 60 * 60 * 1000).toISOString();
-  const weekEnd = new Date(new Date().getTime() + 7 * 24 * 60 * 60 * 1000).toISOString();
-
-  const safeUserId = escapeSQL(userId);
-  const safePlan = escapeSQL(plan);
-  const safePlanName = escapeSQL(planName);
-
-  console.log('Executing transaction...');
-  const txSQL = `
-BEGIN;
-
--- Cancel active subscriptions
-UPDATE subscriptions SET status='canceled', canceled_at='${now}'
-WHERE user_id='${safeUserId}' AND status IN ('active','trialing');
-
--- Create new subscription
-INSERT INTO subscriptions (id, user_id, plan_id, status, billing_interval, current_period_start, current_period_end, created_at, updated_at)
-VALUES (concat('sub_gift_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'active', 'monthly', '${now}', '${periodEndISO}', '${now}', '${now}');
-
--- Ensure wallet exists (upsert)
-INSERT INTO usd_wallets (id, user_id, balance_micros, reserved_micros, granted_balance_micros, created_at, updated_at)
-VALUES (gen_random_uuid(), '${safeUserId}', 0, 0, 0, '${now}', '${now}')
-ON CONFLICT (user_id) DO NOTHING;
-
--- Reset granted balance and set new grant
-UPDATE usd_wallets SET granted_balance_micros = ${grantMicros}, updated_at = '${now}'
-WHERE user_id = '${safeUserId}';
-
--- Record topup for audit trail
-INSERT INTO usd_wallet_topups (id, wallet_id, amount_micros, service_fee_micros, net_credit_micros, status, source, service_namespace, created_at, completed_at)
-SELECT gen_random_uuid(), w.id, ${grantMicros}, 0, ${grantMicros}, 'completed', 'subscription_grant', 'platform', '${now}', '${now}'
-FROM usd_wallets w WHERE w.user_id = '${safeUserId}';
-
--- Update existing active session quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${sessionTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_sess_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'session', ${sessionTokenLimit}, 0, '${now}', '${sessionEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}');
-
--- Update existing active weekly quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${weeklyTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_week_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'weekly', ${weeklyTokenLimit}, 0, '${now}', '${weekEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}');
-
-COMMIT;
-  `.trim();
-
-  bq(txSQL);
-
-  console.log('✓ Old subscriptions canceled');
-  console.log(`✓ ${planName} subscription created (expires: ${periodEnd.toLocaleDateString()})`);
-  if (grantMicros > 0) {
-    console.log(`✓ Wallet granted $${(grantMicros / 1000000).toFixed(2)} (${monthlyCredits} credits equivalent)`);
+  // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
+  // internal lookup API instead of the direct SQL path.
+  let userId: string;
+  if (env === 'cn-prod') {
+    userId = await resolveUserIdByEmail(env, email);
+  } else {
+    const infisicalConfig = getInfisicalConfig();
+    const token = getInfisicalToken(infisicalConfig);
+    userId = await resolveUserId(email, env, infisicalConfig, token);
   }
-  console.log(`✓ Token quotas updated (session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
 
-  console.log(`\n✅ Done! ${email} now has ${planName} plan until ${periodEnd.toLocaleDateString()}\n`);
+  const { body } = await callBilling<{
+    success: boolean;
+    subscriptionId: string;
+    planId: string;
+    credits: number;
+    sessionTokenLimit: number;
+    weeklyTokenLimit: number;
+    expiresAt: string;
+    warning?: string;
+  }>(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
+
+  console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
+  console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);
+  console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
+  if (body.warning) console.log(`⚠️  ${body.warning}`);
+  console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
 }
 
 main().catch(error => {

package/bin/helpers/query-db.ts

@@ -2,14 +2,7 @@
 
 import { execSync } from 'child_process';
 import * as fs from 'fs';
-import { setupTunnel } from './db-utils';
-
-interface InfisicalConfig {
-  url: string;
-  clientId: string;
-  clientSecret: string;
-  projectId: string;
-}
+import { ensureTunnel, getGitHubVariable, getInfisicalConfig, getInfisicalToken, getInfisicalSecrets, parseDatabaseUrl, isCnEnv, connectCnDB, connectCnDBFromUrl } from './db-utils';
 
 interface DatabaseConfig {
   host: string;
@@ -97,54 +90,8 @@ const RDS_HOSTS = {
   prod: 'optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com'
 };
 
-function parseDatabaseUrl(url: string): { user: string; password: string; host: string; port: number; database: string } {
-  // postgresql://user:password@host:port/database?params
-  const match = url.match(/^postgresql:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/);
-  if (!match) {
-    throw new Error(`Failed to parse DATABASE_URL: ${url}`);
-  }
-  return {
-    user: decodeURIComponent(match[1]),
-    password: decodeURIComponent(match[2]),
-    host: match[3],
-    port: parseInt(match[4]),
-    database: match[5]
-  };
-}
-
-function getGitHubVariable(name: string): string {
-  return execSync(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-
-function getInfisicalConfig(): InfisicalConfig {
-  return {
-    url: getGitHubVariable('INFISICAL_URL'),
-    clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-    clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-    projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-  };
-}
-
-function getInfisicalToken(config: InfisicalConfig): string {
-  const response = execSync(
-    `curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`,
-    { encoding: 'utf-8' }
-  );
-  return JSON.parse(response).accessToken;
-}
-
-function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
-  const response = execSync(
-    `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`,
-    { encoding: 'utf-8' }
-  );
-  const data = JSON.parse(response);
-  const secrets: Record<string, string> = {};
-  for (const secret of data.secrets || []) {
-    secrets[secret.secretKey] = secret.secretValue;
-  }
-  return secrets;
-}
+// parseDatabaseUrl 统一用 db-utils 的实现：右切 userinfo 容忍密码特殊字符，
+// 且报错不回显 URL（这里曾把含密码的完整 URL 打进错误信息）。
 
 function findPsqlPath(): string {
   // 1. 优先从 PATH 中查找
@@ -210,7 +157,7 @@ async function main() {
     console.error('Usage: query-db.ts <service> <sql> [environment]');
     console.error('');
     console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-    console.error('Environments: ci (default), stage, prod');
+    console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
     console.error('');
     console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
     process.exit(1);
@@ -224,6 +171,26 @@ async function main() {
     process.exit(1);
   }
 
+  // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
+  // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
+  if (isCnEnv(environment)) {
+    const prodCfg = SERVICE_DB_MAP[service as keyof typeof SERVICE_DB_MAP].prod as any;
+    let db: { query: (sql: string) => string };
+    if (prodCfg?.userKey) {
+      const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
+      console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
+      db = connectCnDB(prefix);
+    } else if (prodCfg?.databaseUrlPath) {
+      console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+      db = connectCnDBFromUrl(prodCfg.databaseUrlPath);
+    } else {
+      console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+      process.exit(1);
+    }
+    console.log('\n' + db.query(sql));
+    return;
+  }
+
   const serviceConfig = SERVICE_DB_MAP[service as keyof typeof SERVICE_DB_MAP][environment as 'ci' | 'stage' | 'prod'];
 
   if (!serviceConfig) {
@@ -296,9 +263,7 @@ async function main() {
       }
     }
 
-    const localPort = environment === 'stage' ? 15432 : 15433;
-
-    setupTunnel(dbHost, localPort);
+    const localPort = ensureTunnel(dbHost);
 
     const result = queryDatabase('localhost', localPort, dbUser, dbPassword, database, sql);
     console.log('\n' + result);

package/bin/helpers/show-env.ts

@@ -1,13 +1,7 @@
 #!/usr/bin/env node
 
 import { execSync } from 'child_process';
-
-interface InfisicalConfig {
-  url: string;
-  clientId: string;
-  clientSecret: string;
-  projectId: string;
-}
+import { getInfisicalConfig, getInfisicalToken, InfisicalConfig } from './db-utils';
 
 // 支持的服务列表（Infisical 路径为 /services/<service-name>）
 const SUPPORTED_SERVICES = [
@@ -44,27 +38,8 @@ const ENV_MAP: Record<string, string> = {
   prod: 'prod'
 };
 
-function getGitHubVariable(name: string): string {
-  return execSync(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-
-function getInfisicalConfig(): InfisicalConfig {
-  return {
-    url: getGitHubVariable('INFISICAL_URL'),
-    clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-    clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-    projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-  };
-}
-
-function getInfisicalToken(config: InfisicalConfig): string {
-  const response = execSync(
-    `curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`,
-    { encoding: 'utf-8' }
-  );
-  return JSON.parse(response).accessToken;
-}
-
+// NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
+// unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
   const response = execSync(
     `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}" -H "Authorization: Bearer ${token}"`,

package/dist/bin/helpers/billing-http.js

@@ -1,16 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateEnv = validateEnv;
+exports.validateEnvCnProd = validateEnvCnProd;
 exports.getServiceToken = getServiceToken;
 exports.callBilling = callBilling;
 exports.callSkills = callSkills;
+exports.resolveUserIdByEmail = resolveUserIdByEmail;
 const child_process_1 = require("child_process");
 const infisical_secrets_1 = require("./infisical-secrets");
 const db_utils_1 = require("./db-utils");
 const USER_AUTH_URLS = {
     stage: 'https://auth.stage.optima.onl',
     prod: 'https://auth.optima.onl',
+    'cn-prod': 'https://auth-cn.optima.chat',
 };
+// cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
+// separate instance dev-skills has no machine identity for, and these domains
+// are stable. AWS envs keep reading /shared-secrets/domain-urls.
+const CN_PROD_BILLING_URL = 'https://billing-cn.optima.chat';
 /**
  * Validate the --env flag value at command entry, before any I/O.
  *
@@ -27,12 +34,38 @@ function validateEnv(env) {
     }
     return env;
 }
+/**
+ * Variant for commands that also support cn-prod — currently grant-balance /
+ * grant-subscription, which reach billing + user-auth over HTTPS only.
+ * Other commands resolve users via the AWS RDS SSH tunnel, which does not
+ * exist for cn-prod (Aliyun VPC-internal RDS) — keep them on validateEnv so a
+ * cn-prod typo fails fast instead of dying inside the tunnel setup.
+ */
+function validateEnvCnProd(env) {
+    if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod') {
+        throw new Error(`--env must be "stage", "prod" or "cn-prod" (got: ${env})`);
+    }
+    return env;
+}
 // T1 discovered: client_id differs per env (stage=dev-skills-ubd3qz6n,
 // prod=dev-skills-hinxa0rs). Both stored in Infisical alongside the
 // secret at /shared-secrets/oauth-clients/.
 const DEV_SKILLS_OAUTH_PATH = '/shared-secrets/oauth-clients';
 const DEV_SKILLS_CLIENT_ID_KEY = 'DEV_SKILLS_OAUTH_CLIENT_ID';
 const DEV_SKILLS_CLIENT_SECRET_KEY = 'DEV_SKILLS_OAUTH_CLIENT_SECRET';
+// cn-prod: the client (dev-skills-ecee51qo) lives in cn user-auth, but its
+// credentials are mirrored into AWS Infisical (prod environment, same path)
+// under CN_PROD-prefixed keys so we reuse the existing Infisical access —
+// zero new credential chain. Canonical copy lives in cn Infisical
+// /shared-secrets/oauth-clients (DEV_SKILLS_OAUTH_CLIENT_ID/SECRET).
+const DEV_SKILLS_CN_CLIENT_ID_KEY = 'DEV_SKILLS_CN_PROD_OAUTH_CLIENT_ID';
+const DEV_SKILLS_CN_CLIENT_SECRET_KEY = 'DEV_SKILLS_CN_PROD_OAUTH_CLIENT_SECRET';
+// cn-prod tokens must carry this scope: resolveUserIdByEmail calls cn
+// user-auth POST /api/v1/internal/users/lookup, whose guard
+// (verify_internal_service_token) requires it. user-auth issues
+// request∩allowed_scopes and an unscoped request yields scope="" (verified
+// against cn-prod 2026-06-12), so the request must name it explicitly.
+const CN_PROD_TOKEN_SCOPE = 'internal:users:write';
 // ───── Cache (process-lifetime) ─────────────────────────────────────────────
 // One CLI invocation does at most a handful of HTTP calls. We mint the M2M
 // token once and reuse it. Cross-invocation re-mint is fine — JWT TTL is
@@ -47,6 +80,8 @@ const tokenCache = {};
 const billingUrlCache = {};
 const skillsUrlCache = {};
 function getBillingUrl(env) {
+    if (env === 'cn-prod')
+        return CN_PROD_BILLING_URL;
     if (billingUrlCache[env])
         return billingUrlCache[env];
     const url = (0, infisical_secrets_1.fetchInfisicalSecret)(env, '/shared-secrets/domain-urls', 'BILLING_URL');
@@ -66,12 +101,19 @@ function getServiceToken(env) {
     const cfg = (0, db_utils_1.getInfisicalConfig)();
     const tok = (0, db_utils_1.getInfisicalToken)(cfg);
     // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
-    const clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(env, DEV_SKILLS_OAUTH_PATH, DEV_SKILLS_CLIENT_ID_KEY, cfg, tok);
-    const clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(env, DEV_SKILLS_OAUTH_PATH, DEV_SKILLS_CLIENT_SECRET_KEY, cfg, tok);
+    // cn-prod credentials are mirrored in the AWS Infisical *prod* environment
+    // (fetchInfisicalSecret has no cn-prod env slug), under CN-specific keys.
+    const isCn = env === 'cn-prod';
+    const infisicalEnv = isCn ? 'prod' : env;
+    const idKey = isCn ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
+    const secretKey = isCn ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
+    const clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
+    const clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
     const authUrl = USER_AUTH_URLS[env];
     if (!authUrl)
         throw new Error(`Unknown env: ${env}`);
-    const body = `grant_type=client_credentials&client_id=${encodeURIComponent(clientId)}&client_secret=${encodeURIComponent(clientSecret)}`;
+    const scopeParam = isCn ? `&scope=${encodeURIComponent(CN_PROD_TOKEN_SCOPE)}` : '';
+    const body = `grant_type=client_credentials&client_id=${encodeURIComponent(clientId)}&client_secret=${encodeURIComponent(clientSecret)}${scopeParam}`;
     const response = (0, child_process_1.execSync)(`curl -s -X POST '${authUrl}/api/v1/oauth/token' -H 'Content-Type: application/x-www-form-urlencoded' -d '${body}'`, { encoding: 'utf-8' });
     let parsed;
     try {
@@ -151,3 +193,40 @@ async function callBilling(env, method, path, body) {
 async function callSkills(env, method, path, body) {
     return callService(getSkillsUrl(env), env, method, path, body);
 }
+/**
+ * Resolve a user's id by email via user-auth's internal lookup endpoint
+ * (POST /api/v1/internal/users/lookup). cn-prod only: AWS envs resolve via
+ * the RDS SSH tunnel (db-utils resolveUserId) and their dev-skills clients
+ * don't carry the internal:users:write scope this endpoint requires.
+ */
+async function resolveUserIdByEmail(env, email) {
+    console.log(`Looking up user by email: ${email}`);
+    const token = getServiceToken(env);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const res = await fetch(`${authUrl}/api/v1/internal/users/lookup`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email }),
+    });
+    const text = await res.text();
+    if (res.status === 404) {
+        throw new Error(`User not found (${env}): ${email}`);
+    }
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`user-auth lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    if (!parsed.user_id) {
+        throw new Error(`user-auth lookup response missing user_id: ${text.slice(0, 200)}`);
+    }
+    console.log(`✓ Found user: ${parsed.user_id}`);
+    return parsed.user_id;
+}