@optima-chat/dev-skills 0.7.40 → 0.7.42

package/.claude/skills/grant-balance/SKILL.md

@@ -52,7 +52,7 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
 | `--env <env>` | 环境：stage, prod, cn-prod | stage |
 
-> **cn-prod（国内环境）**：全程 HTTPS（auth-cn/billing-cn.optima.chat），email 查找走 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分，与 CN ¥1 = 100 积分同一账本单位）。例：`optima-grant-balance user@example.com --amount 1 --env cn-prod`
+> **cn-prod（国内环境）**：全程 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找走 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分，与 CN ¥1 = 100 积分同一账本单位）。例：`optima-grant-balance user@example.com --amount 1 --env cn-prod`
 
 ## 与 grant-subscription 的区别
 

package/.codex/skills/grant-balance/SKILL.md

@@ -51,7 +51,7 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
 | `--env <env>` | 环境：stage, prod, cn-prod | stage |
 
-> **cn-prod**：走 HTTPS（auth-cn/billing-cn.optima.chat），email 查找经 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分 = ¥7 档积分口径一致）。
+> **cn-prod**：走 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找经 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分 = ¥7 档积分口径一致）。
 
 ## 与 grant-subscription 的区别
 

package/bin/cli.js

@@ -35,7 +35,7 @@ switch (command) {
     log('  optima-verify-health <service> [--env cn|prod|all]   Probe L1-L5 上线健康', 'cyan');
     log('  optima-generate-test-token [--env production]        Generate test token', 'cyan');
     log('  optima-grant-balance <email> --amount <usd> [--env]  Grant USD wallet balance', 'cyan');
-    log('  optima-grant-subscription <email> --plan <p> [--env] Grant subscription', 'cyan');
+    log('  optima-grant-subscription <email|phone|userId> --plan <p> [--env] Grant subscription', 'cyan');
     log('  /logs <service> [lines] [env]                        View service logs (skill)', 'cyan');
     log('  /restart-ecs <service> [env]                         Restart ECS service (skill)', 'cyan');
 

package/bin/helpers/billing-http.ts

@@ -5,13 +5,15 @@ import { getInfisicalConfig, getInfisicalToken } from './db-utils';
 const USER_AUTH_URLS: Record<string, string> = {
   stage: 'https://auth.stage.optima.onl',
   prod: 'https://auth.optima.onl',
-  'cn-prod': 'https://auth-cn.optima.chat',
+  // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 auth-cn.optima.chat 路由已下线
+  'cn-prod': 'https://auth.yzsgo.com',
 };
 
 // cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
 // separate instance dev-skills has no machine identity for, and these domains
 // are stable. AWS envs keep reading /shared-secrets/domain-urls.
-const CN_PROD_BILLING_URL = 'https://billing-cn.optima.chat';
+// #201: yzsgo.com 全量迁移 (2026-06-12), 旧 billing-cn.optima.chat 路由已下线
+const CN_PROD_BILLING_URL = 'https://billing-api.yzsgo.com';
 
 /**
  * Validate the --env flag value at command entry, before any I/O.
@@ -269,3 +271,75 @@ export async function resolveUserIdByEmail(env: string, email: string): Promise<
   console.log(`✓ Found user: ${parsed.user_id}`);
   return parsed.user_id;
 }
+
+/**
+ * Resolve a user's id by phone via user-auth's internal lookup endpoint
+ * (POST /api/v1/internal/users/lookup with {phone}). Mirrors
+ * resolveUserIdByEmail — pure-phone CN users have no email, so this is the
+ * only id path for them (gateway#923 root cause: email-only lookup couldn't
+ * resolve them and a wrong userId got hand-fed instead).
+ */
+export async function resolveUserIdByPhone(env: string, phone: string): Promise<string> {
+  console.log(`Looking up user by phone: ${phone}`);
+  const token = getServiceToken(env);
+  const authUrl = USER_AUTH_URLS[env];
+  if (!authUrl) throw new Error(`Unknown env: ${env}`);
+
+  const res = await fetch(`${authUrl}/api/v1/internal/users/lookup`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ phone }),
+  });
+  const text = await res.text();
+  if (res.status === 404) {
+    throw new Error(`User not found by phone (${env}): ${phone}`);
+  }
+  if (!res.ok) {
+    throw new Error(formatServiceError(res.status, res.statusText, text));
+  }
+  let parsed: { user_id?: string };
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`user-auth lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+  }
+  if (!parsed.user_id) {
+    throw new Error(`user-auth lookup response missing user_id: ${text.slice(0, 200)}`);
+  }
+  console.log(`✓ Found user: ${parsed.user_id}`);
+  return parsed.user_id;
+}
+
+/**
+ * Fetch a user's identity by id via user-auth's internal endpoint
+ * (GET /api/v1/internal/users/{userId}). Used to reverse-verify the target
+ * account before granting — prints phone/email/current_plan so the operator
+ * can confirm they're hitting the right account (gateway#923).
+ */
+export async function getUserById(
+  env: string,
+  userId: string,
+): Promise<{ user_id: string; phone: string | null; email: string | null; current_plan?: string }> {
+  const token = getServiceToken(env);
+  const authUrl = USER_AUTH_URLS[env];
+  if (!authUrl) throw new Error(`Unknown env: ${env}`);
+
+  const res = await fetch(`${authUrl}/api/v1/internal/users/${encodeURIComponent(userId)}`, {
+    method: 'GET',
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  const text = await res.text();
+  if (res.status === 404) {
+    throw new Error(`User not found by id (${env}): ${userId}`);
+  }
+  if (!res.ok) {
+    throw new Error(formatServiceError(res.status, res.statusText, text));
+  }
+  let parsed: { user_id: string; phone: string | null; email: string | null; current_plan?: string };
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`user-auth user lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+  }
+  return parsed;
+}

package/bin/helpers/generate-test-token.ts

@@ -24,7 +24,7 @@ interface MerchantSetupResponse {
   user_id: string;
 }
 
-type Environment = 'ci' | 'stage' | 'prod';
+type Environment = 'ci' | 'stage' | 'prod' | 'cn-prod';
 
 interface EnvironmentConfig {
   authUrl: string;
@@ -51,6 +51,13 @@ const ENV_CONFIG: Record<Environment, EnvironmentConfig> = {
     apiUrl: 'https://api.optima.onl',
     clientId: 'commerce-cli-ecs-pro-i2r5of1h',
     envName: 'prod'
+  },
+  'cn-prod': {
+    // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 *-cn.optima.chat 路由已下线
+    authUrl: 'https://auth.yzsgo.com',
+    apiUrl: 'https://commerce.yzsgo.com',
+    clientId: 'commerce-cli-cn-prod',
+    envName: 'cn-prod'
   }
 };
 
@@ -190,10 +197,10 @@ async function main() {
       address = args[++i];
     } else if (arg === '--env' && args[i + 1]) {
       const envArg = args[++i];
-      if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod') {
-        environment = envArg;
+      if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod') {
+        environment = envArg as Environment;
       } else {
-        console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', or 'prod'.`);
+        console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', or 'cn-prod'.`);
         process.exit(1);
       }
     } else if (arg === '--help' || arg === '-h') {
@@ -206,18 +213,20 @@ Options:
   --business-name <name>       Merchant business name (default: auto-generated)
   --phone <phone>              Merchant phone number (optional)
   --address <address>          Merchant address (optional)
-  --env <environment>          Environment: ci (default), stage, or prod
+  --env <environment>          Environment: ci (default), stage, prod, or cn-prod
   --help, -h                   Show this help message
 
 Environments:
-  ci      CI 环境 (auth.optima.chat, api.optima.chat)
-  stage   Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
-  prod    Prod 环境 (auth.optima.onl, api.optima.onl)
+  ci       CI 环境 (auth.optima.chat, api.optima.chat)
+  stage    Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
+  prod     Prod 环境 (auth.optima.onl, api.optima.onl)
+  cn-prod  阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
 
 Example:
   optima-generate-test-token
   optima-generate-test-token --env stage
   optima-generate-test-token --env prod
+  optima-generate-test-token --env cn-prod
   optima-generate-test-token --business-name "My Test Shop" --env stage
       `);
       process.exit(0);

package/bin/helpers/grant-subscription.ts

@@ -4,7 +4,65 @@
 // 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
 // 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 import { getInfisicalConfig, getInfisicalToken, resolveUserId } from './db-utils';
-import { callBilling, resolveUserIdByEmail, validateEnvCnProd } from './billing-http';
+import {
+  callBilling,
+  resolveUserIdByEmail,
+  resolveUserIdByPhone,
+  getUserById,
+  validateEnvCnProd,
+} from './billing-http';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Auto-detect what kind of identifier the operator passed. gateway#923: a
+ * pure-phone CN user (no email) couldn't be resolved by the email-only CLI,
+ * so a wrong userId was hand-fed. Accepting phone/userId directly + this
+ * classifier removes the manual-userId footgun.
+ */
+export function classifyIdentifier(s: string): 'email' | 'phone' | 'userId' {
+  if (s.includes('@')) return 'email';
+  if (UUID_RE.test(s)) return 'userId';
+  const digits = s.replace(/\D/g, '');
+  if (/^\d{6,}$/.test(digits)) return 'phone';
+  throw new Error('无法识别 identifier（需 email / 手机号 / userId）');
+}
+
+/**
+ * Hard guard: when the operator gave a phone number, the resolved account's
+ * phone MUST match it. Normalizes both sides (strip non-digits) before
+ * comparing. A mismatch (or an account with no phone) throws to abort the
+ * grant — this is the assertion that would have stopped gateway#923.
+ */
+export function assertPhoneMatch(inputPhone: string, accountPhone: string | null): void {
+  const input = inputPhone.replace(/\D/g, '');
+  const account = (accountPhone ?? '').replace(/\D/g, '');
+  if (!account || input !== account) {
+    throw new Error(
+      '手机号不匹配：请求 ' +
+        input +
+        '，但该 userId 的手机号是 ' +
+        (accountPhone || '(无)') +
+        '——拒绝授予以防发错账号',
+    );
+  }
+}
+
+/**
+ * AWS (stage/prod) only supports email identifiers. The HTTP reverse-verify
+ * (getUserById) and phone/userId resolution rely on user-auth's internal
+ * endpoints, which require the token scope `internal:users:write` — only the
+ * cn-prod dev-skills client carries it (see billing-http getServiceToken).
+ * AWS resolves users via the RDS SSH tunnel (resolveUserId) and never hits
+ * those endpoints, so phone/userId here would 403. gateway#923 (wrong-account
+ * grant) is a cn-prod-only, pure-phone-user problem; AWS users have unambiguous
+ * emails, so restricting AWS to email is a zero-regression no-op for them.
+ */
+export function assertAwsEmailOnly(env: string, kind: 'email' | 'phone' | 'userId'): void {
+  if ((env === 'stage' || env === 'prod') && kind !== 'email') {
+    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+  }
+}
 
 // cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
 // exist in the cn DB, so a per-env whitelist (not billing-side validation)
@@ -15,9 +73,9 @@ const PLANS_BY_ENV: Record<string, string[]> = {
   'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
 };
 
-function parseArgs(args: string[]): { email: string; plan: string; months: number; env: string } {
+function parseArgs(args: string[]): { identifier: string; plan: string; months: number; env: string } {
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-    console.log(`Usage: optima-grant-subscription <email> [options]
+    console.log(`Usage: optima-grant-subscription <email|phone|userId> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
@@ -28,7 +86,7 @@ Options:
     process.exit(0);
   }
 
-  const email = args[0];
+  const identifier = args[0];
   let plan: string | null = null;
   let months = 1;
   let env = 'stage';
@@ -48,23 +106,54 @@ Options:
   }
   if (months < 1) { console.error('Months must be >= 1'); process.exit(1); }
 
-  return { email, plan, months, env };
+  return { identifier, plan, months, env };
 }
 
 async function main() {
-  const { email, plan, months, env } = parseArgs(process.argv.slice(2));
+  const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
 
-  console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
+  const kind = classifyIdentifier(identifier);
+  assertAwsEmailOnly(env, kind);
+  console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
 
-  // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-  // internal lookup API instead of the direct SQL path.
+  // identity is the verified target account to print on success. AWS keeps the
+  // pre-change behavior (email-only, no internal HTTP reverse-verify); only
+  // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
   let userId: string;
+  let identity: { phone: string | null; email: string | null };
+
   if (env === 'cn-prod') {
-    userId = await resolveUserIdByEmail(env, email);
+    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
+    // and its dev-skills token carries internal:users:write for the lookups.
+    if (kind === 'userId') {
+      userId = identifier;
+    } else if (kind === 'phone') {
+      userId = await resolveUserIdByPhone(env, identifier);
+    } else {
+      userId = await resolveUserIdByEmail(env, identifier);
+    }
+
+    // Reverse-verify: fetch and loudly print the target account identity
+    // before granting, so a wrong userId is caught by eye (gateway#923).
+    const acct = await getUserById(env, userId);
+    console.log(
+      `🎯 目标账号: userId=${userId} 手机=${acct.phone || '(无)'} email=${acct.email || '(无)'} 当前plan=${acct.current_plan || '?'}`,
+    );
+
+    // Hard assertion: a phone-input grant must land on an account whose phone
+    // matches. Runs BEFORE callBilling — a mismatch aborts without granting.
+    if (kind === 'phone') {
+      assertPhoneMatch(identifier, acct.phone);
+    }
+    identity = { phone: acct.phone, email: acct.email };
   } else {
+    // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No
+    // internal HTTP reverse-verify (token lacks internal:users:write → 403).
     const infisicalConfig = getInfisicalConfig();
     const token = getInfisicalToken(infisicalConfig);
-    userId = await resolveUserId(email, env, infisicalConfig, token);
+    userId = await resolveUserId(identifier, env, infisicalConfig, token);
+    console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
+    identity = { phone: null, email: identifier };
   }
 
   const { body } = await callBilling<{
@@ -82,10 +171,16 @@ async function main() {
   console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);
   console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
   if (body.warning) console.log(`⚠️  ${body.warning}`);
-  console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
+  console.log(
+    `\n✅ Done! 用户 userId=${userId} 手机=${identity.phone || '(无)'} email=${identity.email || '(无)'} now has ${body.planId} until ${body.expiresAt}\n`,
+  );
 }
 
-main().catch(error => {
-  console.error('\n❌ Error:', error.message);
-  process.exit(1);
-});
+// Only run the CLI flow when invoked directly — being require()'d (e.g. by the
+// unit tests for classifyIdentifier/assertPhoneMatch) must not trigger main().
+if (require.main === module) {
+  main().catch(error => {
+    console.error('\n❌ Error:', error.message);
+    process.exit(1);
+  });
+}

package/bin/helpers/verify-health.ts

@@ -20,7 +20,7 @@
  *   optima-verify-health user-auth --env prod        # 环境 stage|prod|cn|all
  *   optima-verify-health --all --env all             # stage/prod/cn 三环境矩阵
  *   optima-verify-health gateway-core --expect-commit a1b2c3d
- *   optima-verify-health --url https://auth-cn.optima.chat/health
+ *   optima-verify-health --url https://auth.yzsgo.com/health
  *   optima-verify-health --all --json                # 机器可读,接 CI
  *   optima-verify-health --all --strict              # warn 也算不通过
  * 退出码:fail → 非 0;warn 默认放行(0),--strict 让 warn 也非 0。
@@ -33,15 +33,16 @@ type Env = 'stage' | 'prod' | 'cn';
 interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; }
 
 // 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
-// cn-prod 真实 subdomain 抄自 optima-terraform 的 stack main.tf(非文档表,如 agentic-chat 真名是 agentic-chat-cn 不是 ai-cn)。
+// cn-prod 真实 subdomain 抄自 optima-terraform alicloud/stacks/cn-prod-ingress-sae/main.tf。
+// #201 (2026-06-12): yzsgo.com 全量迁移完成,旧 *-cn.optima.chat 路由已下线。
 const SERVICES: Record<string, SvcCfg> = {
-  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth-cn.optima.chat' },
-  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'agentic-chat-cn.optima.chat' },
-  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'api-cn.optima.chat', cn_path: '/health/live' },
+  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com' },
+  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'app.yzsgo.com' },
+  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'commerce.yzsgo.com', cn_path: '/health/live' },
   'mcp-host':         { path: '/health',     stage: 'mcp-stage.optima.onl',  prod: 'mcp.optima.onl' },
-  'gateway-core':     { path: '/health',     cn: 'gw-cn.optima.chat' },
-  'optima-scout':     { path: '/health',     cn: 'scout-cn.optima.chat' },
-  'optima-skills':    { path: '/health',     cn: 'skills-cn.optima.chat' },
+  'gateway-core':     { path: '/health',     cn: 'gw.yzsgo.com' },
+  'optima-scout':     { path: '/health',     cn: 'scout.yzsgo.com' },
+  'optima-skills':    { path: '/health',     cn: 'skills.yzsgo.com' },
 };
 const ENVS: Env[] = ['stage', 'prod', 'cn'];
 

package/dist/bin/helpers/billing-http.js

@@ -6,18 +6,22 @@ exports.getServiceToken = getServiceToken;
 exports.callBilling = callBilling;
 exports.callSkills = callSkills;
 exports.resolveUserIdByEmail = resolveUserIdByEmail;
+exports.resolveUserIdByPhone = resolveUserIdByPhone;
+exports.getUserById = getUserById;
 const child_process_1 = require("child_process");
 const infisical_secrets_1 = require("./infisical-secrets");
 const db_utils_1 = require("./db-utils");
 const USER_AUTH_URLS = {
     stage: 'https://auth.stage.optima.onl',
     prod: 'https://auth.optima.onl',
-    'cn-prod': 'https://auth-cn.optima.chat',
+    // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 auth-cn.optima.chat 路由已下线
+    'cn-prod': 'https://auth.yzsgo.com',
 };
 // cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
 // separate instance dev-skills has no machine identity for, and these domains
 // are stable. AWS envs keep reading /shared-secrets/domain-urls.
-const CN_PROD_BILLING_URL = 'https://billing-cn.optima.chat';
+// #201: yzsgo.com 全量迁移 (2026-06-12), 旧 billing-cn.optima.chat 路由已下线
+const CN_PROD_BILLING_URL = 'https://billing-api.yzsgo.com';
 /**
  * Validate the --env flag value at command entry, before any I/O.
  *
@@ -230,3 +234,72 @@ async function resolveUserIdByEmail(env, email) {
     console.log(`✓ Found user: ${parsed.user_id}`);
     return parsed.user_id;
 }
+/**
+ * Resolve a user's id by phone via user-auth's internal lookup endpoint
+ * (POST /api/v1/internal/users/lookup with {phone}). Mirrors
+ * resolveUserIdByEmail — pure-phone CN users have no email, so this is the
+ * only id path for them (gateway#923 root cause: email-only lookup couldn't
+ * resolve them and a wrong userId got hand-fed instead).
+ */
+async function resolveUserIdByPhone(env, phone) {
+    console.log(`Looking up user by phone: ${phone}`);
+    const token = getServiceToken(env);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const res = await fetch(`${authUrl}/api/v1/internal/users/lookup`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ phone }),
+    });
+    const text = await res.text();
+    if (res.status === 404) {
+        throw new Error(`User not found by phone (${env}): ${phone}`);
+    }
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`user-auth lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    if (!parsed.user_id) {
+        throw new Error(`user-auth lookup response missing user_id: ${text.slice(0, 200)}`);
+    }
+    console.log(`✓ Found user: ${parsed.user_id}`);
+    return parsed.user_id;
+}
+/**
+ * Fetch a user's identity by id via user-auth's internal endpoint
+ * (GET /api/v1/internal/users/{userId}). Used to reverse-verify the target
+ * account before granting — prints phone/email/current_plan so the operator
+ * can confirm they're hitting the right account (gateway#923).
+ */
+async function getUserById(env, userId) {
+    const token = getServiceToken(env);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const res = await fetch(`${authUrl}/api/v1/internal/users/${encodeURIComponent(userId)}`, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    const text = await res.text();
+    if (res.status === 404) {
+        throw new Error(`User not found by id (${env}): ${userId}`);
+    }
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`user-auth user lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    return parsed;
+}

package/dist/bin/helpers/generate-test-token.js

@@ -55,6 +55,13 @@ const ENV_CONFIG = {
         apiUrl: 'https://api.optima.onl',
         clientId: 'commerce-cli-ecs-pro-i2r5of1h',
         envName: 'prod'
+    },
+    'cn-prod': {
+        // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 *-cn.optima.chat 路由已下线
+        authUrl: 'https://auth.yzsgo.com',
+        apiUrl: 'https://commerce.yzsgo.com',
+        clientId: 'commerce-cli-cn-prod',
+        envName: 'cn-prod'
     }
 };
 async function httpRequest(url, options = {}) {
@@ -176,11 +183,11 @@ async function main() {
         }
         else if (arg === '--env' && args[i + 1]) {
             const envArg = args[++i];
-            if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod') {
+            if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod') {
                 environment = envArg;
             }
             else {
-                console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', or 'prod'.`);
+                console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', or 'cn-prod'.`);
                 process.exit(1);
             }
         }
@@ -194,18 +201,20 @@ Options:
   --business-name <name>       Merchant business name (default: auto-generated)
   --phone <phone>              Merchant phone number (optional)
   --address <address>          Merchant address (optional)
-  --env <environment>          Environment: ci (default), stage, or prod
+  --env <environment>          Environment: ci (default), stage, prod, or cn-prod
   --help, -h                   Show this help message
 
 Environments:
-  ci      CI 环境 (auth.optima.chat, api.optima.chat)
-  stage   Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
-  prod    Prod 环境 (auth.optima.onl, api.optima.onl)
+  ci       CI 环境 (auth.optima.chat, api.optima.chat)
+  stage    Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
+  prod     Prod 环境 (auth.optima.onl, api.optima.onl)
+  cn-prod  阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
 
 Example:
   optima-generate-test-token
   optima-generate-test-token --env stage
   optima-generate-test-token --env prod
+  optima-generate-test-token --env cn-prod
   optima-generate-test-token --business-name "My Test Shop" --env stage
       `);
             process.exit(0);

package/dist/bin/helpers/grant-subscription.js

@@ -1,11 +1,63 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyIdentifier = classifyIdentifier;
+exports.assertPhoneMatch = assertPhoneMatch;
+exports.assertAwsEmailOnly = assertAwsEmailOnly;
 // P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
 // 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
 // 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 const db_utils_1 = require("./db-utils");
 const billing_http_1 = require("./billing-http");
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Auto-detect what kind of identifier the operator passed. gateway#923: a
+ * pure-phone CN user (no email) couldn't be resolved by the email-only CLI,
+ * so a wrong userId was hand-fed. Accepting phone/userId directly + this
+ * classifier removes the manual-userId footgun.
+ */
+function classifyIdentifier(s) {
+    if (s.includes('@'))
+        return 'email';
+    if (UUID_RE.test(s))
+        return 'userId';
+    const digits = s.replace(/\D/g, '');
+    if (/^\d{6,}$/.test(digits))
+        return 'phone';
+    throw new Error('无法识别 identifier（需 email / 手机号 / userId）');
+}
+/**
+ * Hard guard: when the operator gave a phone number, the resolved account's
+ * phone MUST match it. Normalizes both sides (strip non-digits) before
+ * comparing. A mismatch (or an account with no phone) throws to abort the
+ * grant — this is the assertion that would have stopped gateway#923.
+ */
+function assertPhoneMatch(inputPhone, accountPhone) {
+    const input = inputPhone.replace(/\D/g, '');
+    const account = (accountPhone ?? '').replace(/\D/g, '');
+    if (!account || input !== account) {
+        throw new Error('手机号不匹配：请求 ' +
+            input +
+            '，但该 userId 的手机号是 ' +
+            (accountPhone || '(无)') +
+            '——拒绝授予以防发错账号');
+    }
+}
+/**
+ * AWS (stage/prod) only supports email identifiers. The HTTP reverse-verify
+ * (getUserById) and phone/userId resolution rely on user-auth's internal
+ * endpoints, which require the token scope `internal:users:write` — only the
+ * cn-prod dev-skills client carries it (see billing-http getServiceToken).
+ * AWS resolves users via the RDS SSH tunnel (resolveUserId) and never hits
+ * those endpoints, so phone/userId here would 403. gateway#923 (wrong-account
+ * grant) is a cn-prod-only, pure-phone-user problem; AWS users have unambiguous
+ * emails, so restricting AWS to email is a zero-regression no-op for them.
+ */
+function assertAwsEmailOnly(env, kind) {
+    if ((env === 'stage' || env === 'prod') && kind !== 'email') {
+        throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+    }
+}
 // cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
 // exist in the cn DB, so a per-env whitelist (not billing-side validation)
 // is what prevents accidentally granting a USD-priced plan to a CN user.
@@ -16,7 +68,7 @@ const PLANS_BY_ENV = {
 };
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-        console.log(`Usage: optima-grant-subscription <email> [options]
+        console.log(`Usage: optima-grant-subscription <email|phone|userId> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
@@ -26,7 +78,7 @@ Options:
   -h, --help        Show this help`);
         process.exit(0);
     }
-    const email = args[0];
+    const identifier = args[0];
     let plan = null;
     let months = 1;
     let env = 'stage';
@@ -52,21 +104,49 @@ Options:
         console.error('Months must be >= 1');
         process.exit(1);
     }
-    return { email, plan, months, env };
+    return { identifier, plan, months, env };
 }
 async function main() {
-    const { email, plan, months, env } = parseArgs(process.argv.slice(2));
-    console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
-    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-    // internal lookup API instead of the direct SQL path.
+    const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
+    const kind = classifyIdentifier(identifier);
+    assertAwsEmailOnly(env, kind);
+    console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
+    // identity is the verified target account to print on success. AWS keeps the
+    // pre-change behavior (email-only, no internal HTTP reverse-verify); only
+    // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
     let userId;
+    let identity;
     if (env === 'cn-prod') {
-        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
+        // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
+        // and its dev-skills token carries internal:users:write for the lookups.
+        if (kind === 'userId') {
+            userId = identifier;
+        }
+        else if (kind === 'phone') {
+            userId = await (0, billing_http_1.resolveUserIdByPhone)(env, identifier);
+        }
+        else {
+            userId = await (0, billing_http_1.resolveUserIdByEmail)(env, identifier);
+        }
+        // Reverse-verify: fetch and loudly print the target account identity
+        // before granting, so a wrong userId is caught by eye (gateway#923).
+        const acct = await (0, billing_http_1.getUserById)(env, userId);
+        console.log(`🎯 目标账号: userId=${userId} 手机=${acct.phone || '(无)'} email=${acct.email || '(无)'} 当前plan=${acct.current_plan || '?'}`);
+        // Hard assertion: a phone-input grant must land on an account whose phone
+        // matches. Runs BEFORE callBilling — a mismatch aborts without granting.
+        if (kind === 'phone') {
+            assertPhoneMatch(identifier, acct.phone);
+        }
+        identity = { phone: acct.phone, email: acct.email };
     }
     else {
+        // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No
+        // internal HTTP reverse-verify (token lacks internal:users:write → 403).
         const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
+        userId = await (0, db_utils_1.resolveUserId)(identifier, env, infisicalConfig, token);
+        console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
+        identity = { phone: null, email: identifier };
     }
     const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
     console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
@@ -74,9 +154,13 @@ async function main() {
     console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
     if (body.warning)
         console.log(`⚠️  ${body.warning}`);
-    console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
+    console.log(`\n✅ Done! 用户 userId=${userId} 手机=${identity.phone || '(无)'} email=${identity.email || '(无)'} now has ${body.planId} until ${body.expiresAt}\n`);
+}
+// Only run the CLI flow when invoked directly — being require()'d (e.g. by the
+// unit tests for classifyIdentifier/assertPhoneMatch) must not trigger main().
+if (require.main === module) {
+    main().catch(error => {
+        console.error('\n❌ Error:', error.message);
+        process.exit(1);
+    });
 }
-main().catch(error => {
-    console.error('\n❌ Error:', error.message);
-    process.exit(1);
-});

package/dist/bin/helpers/verify-health.js

@@ -55,7 +55,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  *   optima-verify-health user-auth --env prod        # 环境 stage|prod|cn|all
  *   optima-verify-health --all --env all             # stage/prod/cn 三环境矩阵
  *   optima-verify-health gateway-core --expect-commit a1b2c3d
- *   optima-verify-health --url https://auth-cn.optima.chat/health
+ *   optima-verify-health --url https://auth.yzsgo.com/health
  *   optima-verify-health --all --json                # 机器可读,接 CI
  *   optima-verify-health --all --strict              # warn 也算不通过
  * 退出码:fail → 非 0;warn 默认放行(0),--strict 让 warn 也非 0。
@@ -64,15 +64,16 @@ const node_dns_1 = require("node:dns");
 const tls = __importStar(require("node:tls"));
 const https = __importStar(require("node:https"));
 // 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
-// cn-prod 真实 subdomain 抄自 optima-terraform 的 stack main.tf(非文档表,如 agentic-chat 真名是 agentic-chat-cn 不是 ai-cn)。
+// cn-prod 真实 subdomain 抄自 optima-terraform alicloud/stacks/cn-prod-ingress-sae/main.tf。
+// #201 (2026-06-12): yzsgo.com 全量迁移完成,旧 *-cn.optima.chat 路由已下线。
 const SERVICES = {
-    'user-auth': { path: '/health', stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth-cn.optima.chat' },
-    'agentic-chat': { path: '/api/health', stage: 'ai-stage.optima.onl', prod: 'ai.optima.onl', cn: 'agentic-chat-cn.optima.chat' },
-    'commerce-backend': { path: '/health', stage: 'api-stage.optima.onl', prod: 'api.optima.onl', cn: 'api-cn.optima.chat', cn_path: '/health/live' },
+    'user-auth': { path: '/health', stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com' },
+    'agentic-chat': { path: '/api/health', stage: 'ai-stage.optima.onl', prod: 'ai.optima.onl', cn: 'app.yzsgo.com' },
+    'commerce-backend': { path: '/health', stage: 'api-stage.optima.onl', prod: 'api.optima.onl', cn: 'commerce.yzsgo.com', cn_path: '/health/live' },
     'mcp-host': { path: '/health', stage: 'mcp-stage.optima.onl', prod: 'mcp.optima.onl' },
-    'gateway-core': { path: '/health', cn: 'gw-cn.optima.chat' },
-    'optima-scout': { path: '/health', cn: 'scout-cn.optima.chat' },
-    'optima-skills': { path: '/health', cn: 'skills-cn.optima.chat' },
+    'gateway-core': { path: '/health', cn: 'gw.yzsgo.com' },
+    'optima-scout': { path: '/health', cn: 'scout.yzsgo.com' },
+    'optima-skills': { path: '/health', cn: 'skills.yzsgo.com' },
 };
 const ENVS = ['stage', 'prod', 'cn'];
 const G = '\x1b[32m', R = '\x1b[31m', Y = '\x1b[33m', B = '\x1b[34m', N = '\x1b[0m';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.40",
+  "version": "0.7.42",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {
@@ -19,7 +19,8 @@
   "scripts": {
     "postinstall": "node scripts/install.js",
     "build": "tsc",
-    "prepare": "npm run build"
+    "prepare": "npm run build",
+    "test": "node --test tests/*.test.js"
   },
   "keywords": [
     "claude-code",