@optima-chat/dev-skills 0.7.38 → 0.7.40

package/dist/bin/helpers/grant-subscription.js

@@ -1,20 +1,33 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+// P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
+// 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
+// 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 const db_utils_1 = require("./db-utils");
+const billing_http_1 = require("./billing-http");
+// cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
+// exist in the cn DB, so a per-env whitelist (not billing-side validation)
+// is what prevents accidentally granting a USD-priced plan to a CN user.
+const PLANS_BY_ENV = {
+    stage: ['trial', 'starter', 'pro', 'enterprise'],
+    prod: ['trial', 'starter', 'pro', 'enterprise'],
+    'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+};
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
         console.log(`Usage: optima-grant-subscription <email> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
+                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod (default: stage)
   -h, --help        Show this help`);
         process.exit(0);
     }
     const email = args[0];
-    let plan = 'pro';
+    let plan = null;
     let months = 1;
     let env = 'stage';
     for (let i = 1; i < args.length; i++) {
@@ -28,103 +41,40 @@ Options:
             env = args[++i];
         }
     }
-    if (!['trial', 'starter', 'pro', 'enterprise'].includes(plan)) {
-        console.error(`Unknown plan: ${plan}. Available: trial, starter, pro, enterprise`);
+    (0, billing_http_1.validateEnvCnProd)(env);
+    plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+    const allowed = PLANS_BY_ENV[env];
+    if (!allowed.includes(plan)) {
+        console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
         process.exit(1);
     }
     if (months < 1) {
         console.error('Months must be >= 1');
         process.exit(1);
     }
-    if (!['stage', 'prod'].includes(env)) {
-        console.error('Env must be stage or prod (billing DB not available in CI)');
-        process.exit(1);
-    }
     return { email, plan, months, env };
 }
 async function main() {
     const { email, plan, months, env } = parseArgs(process.argv.slice(2));
-    const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
     console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
-    const userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
-    const billing = await (0, db_utils_1.connectBillingDB)(env, infisicalConfig, token);
-    const bq = billing.query;
-    // Read plan config from DB
-    console.log(`Loading plan config: ${plan}`);
-    const planRow = bq(`SELECT name, monthly_credits, session_token_limit, weekly_token_limit FROM plans WHERE id='${(0, db_utils_1.escapeSQL)(plan)}'`);
-    if (!planRow) {
-        console.error(`❌ Plan not found in DB: ${plan}`);
-        process.exit(1);
+    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
+    // internal lookup API instead of the direct SQL path.
+    let userId;
+    if (env === 'cn-prod') {
+        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
     }
-    const [planName, monthlyCreditsStr, sessionTokenLimitStr, weeklyTokenLimitStr] = planRow.split('|');
-    const monthlyCredits = parseInt(monthlyCreditsStr, 10);
-    const grantMicros = monthlyCredits * 10000; // 1 credit = $0.01 = 10,000 micros
-    const sessionTokenLimit = parseInt(sessionTokenLimitStr, 10);
-    const weeklyTokenLimit = parseInt(weeklyTokenLimitStr, 10);
-    console.log(`✓ Plan: ${planName} (grant: $${(grantMicros / 1000000).toFixed(2)}, session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
-    // Execute all mutations in a single transaction
-    const now = new Date().toISOString();
-    const periodEnd = new Date();
-    periodEnd.setMonth(periodEnd.getMonth() + months);
-    const periodEndISO = periodEnd.toISOString();
-    const sessionEnd = new Date(new Date().getTime() + 5 * 60 * 60 * 1000).toISOString();
-    const weekEnd = new Date(new Date().getTime() + 7 * 24 * 60 * 60 * 1000).toISOString();
-    const safeUserId = (0, db_utils_1.escapeSQL)(userId);
-    const safePlan = (0, db_utils_1.escapeSQL)(plan);
-    const safePlanName = (0, db_utils_1.escapeSQL)(planName);
-    console.log('Executing transaction...');
-    const txSQL = `
-BEGIN;
-
--- Cancel active subscriptions
-UPDATE subscriptions SET status='canceled', canceled_at='${now}'
-WHERE user_id='${safeUserId}' AND status IN ('active','trialing');
-
--- Create new subscription
-INSERT INTO subscriptions (id, user_id, plan_id, status, billing_interval, current_period_start, current_period_end, created_at, updated_at)
-VALUES (concat('sub_gift_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'active', 'monthly', '${now}', '${periodEndISO}', '${now}', '${now}');
-
--- Ensure wallet exists (upsert)
-INSERT INTO usd_wallets (id, user_id, balance_micros, reserved_micros, granted_balance_micros, created_at, updated_at)
-VALUES (gen_random_uuid(), '${safeUserId}', 0, 0, 0, '${now}', '${now}')
-ON CONFLICT (user_id) DO NOTHING;
-
--- Reset granted balance and set new grant
-UPDATE usd_wallets SET granted_balance_micros = ${grantMicros}, updated_at = '${now}'
-WHERE user_id = '${safeUserId}';
-
--- Record topup for audit trail
-INSERT INTO usd_wallet_topups (id, wallet_id, amount_micros, service_fee_micros, net_credit_micros, status, source, service_namespace, created_at, completed_at)
-SELECT gen_random_uuid(), w.id, ${grantMicros}, 0, ${grantMicros}, 'completed', 'subscription_grant', 'platform', '${now}', '${now}'
-FROM usd_wallets w WHERE w.user_id = '${safeUserId}';
-
--- Update existing active session quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${sessionTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_sess_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'session', ${sessionTokenLimit}, 0, '${now}', '${sessionEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}');
-
--- Update existing active weekly quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${weeklyTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_week_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'weekly', ${weeklyTokenLimit}, 0, '${now}', '${weekEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}');
-
-COMMIT;
-  `.trim();
-    bq(txSQL);
-    console.log('✓ Old subscriptions canceled');
-    console.log(`✓ ${planName} subscription created (expires: ${periodEnd.toLocaleDateString()})`);
-    if (grantMicros > 0) {
-        console.log(`✓ Wallet granted $${(grantMicros / 1000000).toFixed(2)} (${monthlyCredits} credits equivalent)`);
+    else {
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
+        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
     }
-    console.log(`✓ Token quotas updated (session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
-    console.log(`\n✅ Done! ${email} now has ${planName} plan until ${periodEnd.toLocaleDateString()}\n`);
+    const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
+    console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
+    console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);
+    console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
+    if (body.warning)
+        console.log(`⚠️  ${body.warning}`);
+    console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
 }
 main().catch(error => {
     console.error('\n❌ Error:', error.message);

package/dist/bin/helpers/query-db.js

@@ -114,44 +114,8 @@ const RDS_HOSTS = {
     stage: 'optima-stage-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com',
     prod: 'optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com'
 };
-function parseDatabaseUrl(url) {
-    // postgresql://user:password@host:port/database?params
-    const match = url.match(/^postgresql:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/);
-    if (!match) {
-        throw new Error(`Failed to parse DATABASE_URL: ${url}`);
-    }
-    return {
-        user: decodeURIComponent(match[1]),
-        password: decodeURIComponent(match[2]),
-        host: match[3],
-        port: parseInt(match[4]),
-        database: match[5]
-    };
-}
-function getGitHubVariable(name) {
-    return (0, child_process_1.execSync)(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-function getInfisicalConfig() {
-    return {
-        url: getGitHubVariable('INFISICAL_URL'),
-        clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-        clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-        projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-    };
-}
-function getInfisicalToken(config) {
-    const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
-    return JSON.parse(response).accessToken;
-}
-function getInfisicalSecrets(config, token, environment, secretPath) {
-    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
-    const data = JSON.parse(response);
-    const secrets = {};
-    for (const secret of data.secrets || []) {
-        secrets[secret.secretKey] = secret.secretValue;
-    }
-    return secrets;
-}
+// parseDatabaseUrl 统一用 db-utils 的实现：右切 userinfo 容忍密码特殊字符，
+// 且报错不回显 URL（这里曾把含密码的完整 URL 打进错误信息）。
 function findPsqlPath() {
     // 1. 优先从 PATH 中查找
     const whichCmd = process.platform === 'win32' ? 'where psql' : 'which psql';
@@ -206,7 +170,7 @@ async function main() {
         console.error('Usage: query-db.ts <service> <sql> [environment]');
         console.error('');
         console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-        console.error('Environments: ci (default), stage, prod');
+        console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
         console.error('');
         console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
         process.exit(1);
@@ -217,6 +181,27 @@ async function main() {
         console.error('Available services:', Object.keys(SERVICE_DB_MAP).join(', '));
         process.exit(1);
     }
+    // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
+    // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
+    if ((0, db_utils_1.isCnEnv)(environment)) {
+        const prodCfg = SERVICE_DB_MAP[service].prod;
+        let db;
+        if (prodCfg?.userKey) {
+            const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
+            console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
+            db = (0, db_utils_1.connectCnDB)(prefix);
+        }
+        else if (prodCfg?.databaseUrlPath) {
+            console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+            db = (0, db_utils_1.connectCnDBFromUrl)(prodCfg.databaseUrlPath);
+        }
+        else {
+            console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+            process.exit(1);
+        }
+        console.log('\n' + db.query(sql));
+        return;
+    }
     const serviceConfig = SERVICE_DB_MAP[service][environment];
     if (!serviceConfig) {
         console.error(`Service ${service} is not available in ${environment.toUpperCase()} environment.`);
@@ -228,18 +213,18 @@ async function main() {
     console.log(`\n🔍 Querying ${service} (${environment.toUpperCase()})...`);
     if (environment === 'ci') {
         // CI 环境：通过 SSH + Docker Exec
-        const ciUser = getGitHubVariable('CI_SSH_USER');
-        const ciHost = getGitHubVariable('CI_SSH_HOST');
-        const ciPassword = getGitHubVariable('CI_SSH_PASSWORD');
+        const ciUser = (0, db_utils_1.getGitHubVariable)('CI_SSH_USER');
+        const ciHost = (0, db_utils_1.getGitHubVariable)('CI_SSH_HOST');
+        const ciPassword = (0, db_utils_1.getGitHubVariable)('CI_SSH_PASSWORD');
         const { container, user, database } = serviceConfig;
         const result = (0, child_process_1.execSync)(`sshpass -p "${ciPassword}" ssh -o StrictHostKeyChecking=no ${ciUser}@${ciHost} "docker exec ${container} psql -U ${user} -d ${database} -c \\"${sql}\\""`, { encoding: 'utf-8' });
         console.log('\n' + result);
     }
     else {
         // Stage/Prod 环境：通过 SSH 隧道访问 RDS
-        const infisicalConfig = getInfisicalConfig();
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = getInfisicalToken(infisicalConfig);
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
         const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
         let dbUser;
@@ -249,13 +234,13 @@ async function main() {
         if ('databaseUrlPath' in serviceConfig) {
             // 从服务路径获取 DATABASE_URL 并解析
             const { databaseUrlPath, databaseUrlKey } = serviceConfig;
-            const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, databaseUrlPath);
+            const secrets = (0, db_utils_1.getInfisicalSecrets)(infisicalConfig, token, infisicalEnv, databaseUrlPath);
             console.log(`✓ Retrieved DATABASE_URL from Infisical (path: ${databaseUrlPath})`);
             const databaseUrl = secrets[databaseUrlKey];
             if (!databaseUrl) {
                 throw new Error(`DATABASE_URL not found in Infisical at ${databaseUrlPath}`);
             }
-            const parsed = parseDatabaseUrl(databaseUrl);
+            const parsed = (0, db_utils_1.parseDatabaseUrl)(databaseUrl);
             dbUser = parsed.user;
             dbPassword = parsed.password;
             dbHost = parsed.host;
@@ -263,7 +248,7 @@ async function main() {
         }
         else {
             // 从 shared-secrets/database-users 获取凭证
-            const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
+            const secrets = (0, db_utils_1.getInfisicalSecrets)(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
             console.log('✓ Retrieved database credentials from Infisical');
             const { userKey, passwordKey } = serviceConfig;
             database = serviceConfig.database;
@@ -274,8 +259,7 @@ async function main() {
                 throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
             }
         }
-        const localPort = environment === 'stage' ? 15432 : 15433;
-        (0, db_utils_1.setupTunnel)(dbHost, localPort);
+        const localPort = (0, db_utils_1.ensureTunnel)(dbHost);
         const result = queryDatabase('localhost', localPort, dbUser, dbPassword, database, sql);
         console.log('\n' + result);
     }

package/dist/bin/helpers/show-env.js

@@ -2,6 +2,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
+const db_utils_1 = require("./db-utils");
 // 支持的服务列表（Infisical 路径为 /services/<service-name>）
 const SUPPORTED_SERVICES = [
     'ads-backend',
@@ -35,21 +36,8 @@ const ENV_MAP = {
     stage: 'staging',
     prod: 'prod'
 };
-function getGitHubVariable(name) {
-    return (0, child_process_1.execSync)(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-function getInfisicalConfig() {
-    return {
-        url: getGitHubVariable('INFISICAL_URL'),
-        clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-        clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-        projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-    };
-}
-function getInfisicalToken(config) {
-    const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
-    return JSON.parse(response).accessToken;
-}
+// NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
+// unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config, token, environment, secretPath) {
     const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
     const data = JSON.parse(response);
@@ -122,9 +110,9 @@ async function main() {
     const secretPath = `/services/${service}`;
     console.log(`\n🔍 Fetching environment variables for ${service} (${environment.toUpperCase()})...\n`);
     try {
-        const infisicalConfig = getInfisicalConfig();
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = getInfisicalToken(infisicalConfig);
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
         const infisicalEnv = ENV_MAP[environment];
         const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.38",
+  "version": "0.7.40",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {