@optima-chat/dev-skills 0.7.41 → 0.7.43

package/.claude/skills/grant-balance/SKILL.md

@@ -52,7 +52,7 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
 | `--env <env>` | 环境：stage, prod, cn-prod | stage |
 
-> **cn-prod（国内环境）**：全程 HTTPS（auth-cn/billing-cn.optima.chat），email 查找走 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分，与 CN ¥1 = 100 积分同一账本单位）。例：`optima-grant-balance user@example.com --amount 1 --env cn-prod`
+> **cn-prod（国内环境）**：全程 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找走 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分，与 CN ¥1 = 100 积分同一账本单位）。例：`optima-grant-balance user@example.com --amount 1 --env cn-prod`
 
 ## 与 grant-subscription 的区别
 

package/.codex/skills/grant-balance/SKILL.md

@@ -51,7 +51,7 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
 | `--env <env>` | 环境：stage, prod, cn-prod | stage |
 
-> **cn-prod**：走 HTTPS（auth-cn/billing-cn.optima.chat），email 查找经 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分 = ¥7 档积分口径一致）。
+> **cn-prod**：走 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找经 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分 = ¥7 档积分口径一致）。
 
 ## 与 grant-subscription 的区别
 

package/bin/cli.js

@@ -35,7 +35,7 @@ switch (command) {
     log('  optima-verify-health <service> [--env cn|prod|all]   Probe L1-L5 上线健康', 'cyan');
     log('  optima-generate-test-token [--env production]        Generate test token', 'cyan');
     log('  optima-grant-balance <email> --amount <usd> [--env]  Grant USD wallet balance', 'cyan');
-    log('  optima-grant-subscription <email> --plan <p> [--env] Grant subscription', 'cyan');
+    log('  optima-grant-subscription <email|phone|userId> --plan <p> [--env] Grant subscription', 'cyan');
     log('  /logs <service> [lines] [env]                        View service logs (skill)', 'cyan');
     log('  /restart-ecs <service> [env]                         Restart ECS service (skill)', 'cyan');
 

package/bin/helpers/billing-http.ts

@@ -271,3 +271,75 @@ export async function resolveUserIdByEmail(env: string, email: string): Promise<
   console.log(`✓ Found user: ${parsed.user_id}`);
   return parsed.user_id;
 }
+
+/**
+ * Resolve a user's id by phone via user-auth's internal lookup endpoint
+ * (POST /api/v1/internal/users/lookup with {phone}). Mirrors
+ * resolveUserIdByEmail — pure-phone CN users have no email, so this is the
+ * only id path for them (gateway#923 root cause: email-only lookup couldn't
+ * resolve them and a wrong userId got hand-fed instead).
+ */
+export async function resolveUserIdByPhone(env: string, phone: string): Promise<string> {
+  console.log(`Looking up user by phone: ${phone}`);
+  const token = getServiceToken(env);
+  const authUrl = USER_AUTH_URLS[env];
+  if (!authUrl) throw new Error(`Unknown env: ${env}`);
+
+  const res = await fetch(`${authUrl}/api/v1/internal/users/lookup`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ phone }),
+  });
+  const text = await res.text();
+  if (res.status === 404) {
+    throw new Error(`User not found by phone (${env}): ${phone}`);
+  }
+  if (!res.ok) {
+    throw new Error(formatServiceError(res.status, res.statusText, text));
+  }
+  let parsed: { user_id?: string };
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`user-auth lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+  }
+  if (!parsed.user_id) {
+    throw new Error(`user-auth lookup response missing user_id: ${text.slice(0, 200)}`);
+  }
+  console.log(`✓ Found user: ${parsed.user_id}`);
+  return parsed.user_id;
+}
+
+/**
+ * Fetch a user's identity by id via user-auth's internal endpoint
+ * (GET /api/v1/internal/users/{userId}). Used to reverse-verify the target
+ * account before granting — prints phone/email/current_plan so the operator
+ * can confirm they're hitting the right account (gateway#923).
+ */
+export async function getUserById(
+  env: string,
+  userId: string,
+): Promise<{ user_id: string; phone: string | null; email: string | null; current_plan?: string }> {
+  const token = getServiceToken(env);
+  const authUrl = USER_AUTH_URLS[env];
+  if (!authUrl) throw new Error(`Unknown env: ${env}`);
+
+  const res = await fetch(`${authUrl}/api/v1/internal/users/${encodeURIComponent(userId)}`, {
+    method: 'GET',
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  const text = await res.text();
+  if (res.status === 404) {
+    throw new Error(`User not found by id (${env}): ${userId}`);
+  }
+  if (!res.ok) {
+    throw new Error(formatServiceError(res.status, res.statusText, text));
+  }
+  let parsed: { user_id: string; phone: string | null; email: string | null; current_plan?: string };
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`user-auth user lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+  }
+  return parsed;
+}

package/bin/helpers/generate-test-token.ts

@@ -56,7 +56,9 @@ const ENV_CONFIG: Record<Environment, EnvironmentConfig> = {
     // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 *-cn.optima.chat 路由已下线
     authUrl: 'https://auth.yzsgo.com',
     apiUrl: 'https://commerce.yzsgo.com',
-    clientId: 'commerce-cli-cn-prod',
+    // #31: 必须用 cn user-auth 里注册的 public client（开 password grant）。
+    // 注意不要换成同名的 confidential client `commerce-cli-cn-prod-*`，那个需要 client_secret，走不通 CLI 的 public ROPC flow。
+    clientId: 'dev-skill-cli-cn-pro-acvkmcuq',
     envName: 'cn-prod'
   }
 };
@@ -98,7 +100,8 @@ async function registerMerchant(
       body: JSON.stringify(payload)
     });
 
-    console.log(`✓ Merchant registered successfully (ID: ${result.user_id})`);
+    // #31: cn-prod register 返回体字段名是 `id`，AWS 是 `user_id`，两者兼容
+    console.log(`✓ Merchant registered successfully (ID: ${result.user_id ?? (result as any).id})`);
     return result;
   } catch (error: any) {
     if (error.message.includes('409') || error.message.includes('already exists')) {

package/bin/helpers/grant-subscription.ts

@@ -4,7 +4,65 @@
 // 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
 // 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 import { getInfisicalConfig, getInfisicalToken, resolveUserId } from './db-utils';
-import { callBilling, resolveUserIdByEmail, validateEnvCnProd } from './billing-http';
+import {
+  callBilling,
+  resolveUserIdByEmail,
+  resolveUserIdByPhone,
+  getUserById,
+  validateEnvCnProd,
+} from './billing-http';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Auto-detect what kind of identifier the operator passed. gateway#923: a
+ * pure-phone CN user (no email) couldn't be resolved by the email-only CLI,
+ * so a wrong userId was hand-fed. Accepting phone/userId directly + this
+ * classifier removes the manual-userId footgun.
+ */
+export function classifyIdentifier(s: string): 'email' | 'phone' | 'userId' {
+  if (s.includes('@')) return 'email';
+  if (UUID_RE.test(s)) return 'userId';
+  const digits = s.replace(/\D/g, '');
+  if (/^\d{6,}$/.test(digits)) return 'phone';
+  throw new Error('无法识别 identifier（需 email / 手机号 / userId）');
+}
+
+/**
+ * Hard guard: when the operator gave a phone number, the resolved account's
+ * phone MUST match it. Normalizes both sides (strip non-digits) before
+ * comparing. A mismatch (or an account with no phone) throws to abort the
+ * grant — this is the assertion that would have stopped gateway#923.
+ */
+export function assertPhoneMatch(inputPhone: string, accountPhone: string | null): void {
+  const input = inputPhone.replace(/\D/g, '');
+  const account = (accountPhone ?? '').replace(/\D/g, '');
+  if (!account || input !== account) {
+    throw new Error(
+      '手机号不匹配：请求 ' +
+        input +
+        '，但该 userId 的手机号是 ' +
+        (accountPhone || '(无)') +
+        '——拒绝授予以防发错账号',
+    );
+  }
+}
+
+/**
+ * AWS (stage/prod) only supports email identifiers. The HTTP reverse-verify
+ * (getUserById) and phone/userId resolution rely on user-auth's internal
+ * endpoints, which require the token scope `internal:users:write` — only the
+ * cn-prod dev-skills client carries it (see billing-http getServiceToken).
+ * AWS resolves users via the RDS SSH tunnel (resolveUserId) and never hits
+ * those endpoints, so phone/userId here would 403. gateway#923 (wrong-account
+ * grant) is a cn-prod-only, pure-phone-user problem; AWS users have unambiguous
+ * emails, so restricting AWS to email is a zero-regression no-op for them.
+ */
+export function assertAwsEmailOnly(env: string, kind: 'email' | 'phone' | 'userId'): void {
+  if ((env === 'stage' || env === 'prod') && kind !== 'email') {
+    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+  }
+}
 
 // cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
 // exist in the cn DB, so a per-env whitelist (not billing-side validation)
@@ -15,9 +73,9 @@ const PLANS_BY_ENV: Record<string, string[]> = {
   'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
 };
 
-function parseArgs(args: string[]): { email: string; plan: string; months: number; env: string } {
+function parseArgs(args: string[]): { identifier: string; plan: string; months: number; env: string } {
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-    console.log(`Usage: optima-grant-subscription <email> [options]
+    console.log(`Usage: optima-grant-subscription <email|phone|userId> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
@@ -28,7 +86,7 @@ Options:
     process.exit(0);
   }
 
-  const email = args[0];
+  const identifier = args[0];
   let plan: string | null = null;
   let months = 1;
   let env = 'stage';
@@ -48,23 +106,54 @@ Options:
   }
   if (months < 1) { console.error('Months must be >= 1'); process.exit(1); }
 
-  return { email, plan, months, env };
+  return { identifier, plan, months, env };
 }
 
 async function main() {
-  const { email, plan, months, env } = parseArgs(process.argv.slice(2));
+  const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
 
-  console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
+  const kind = classifyIdentifier(identifier);
+  assertAwsEmailOnly(env, kind);
+  console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
 
-  // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-  // internal lookup API instead of the direct SQL path.
+  // identity is the verified target account to print on success. AWS keeps the
+  // pre-change behavior (email-only, no internal HTTP reverse-verify); only
+  // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
   let userId: string;
+  let identity: { phone: string | null; email: string | null };
+
   if (env === 'cn-prod') {
-    userId = await resolveUserIdByEmail(env, email);
+    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
+    // and its dev-skills token carries internal:users:write for the lookups.
+    if (kind === 'userId') {
+      userId = identifier;
+    } else if (kind === 'phone') {
+      userId = await resolveUserIdByPhone(env, identifier);
+    } else {
+      userId = await resolveUserIdByEmail(env, identifier);
+    }
+
+    // Reverse-verify: fetch and loudly print the target account identity
+    // before granting, so a wrong userId is caught by eye (gateway#923).
+    const acct = await getUserById(env, userId);
+    console.log(
+      `🎯 目标账号: userId=${userId} 手机=${acct.phone || '(无)'} email=${acct.email || '(无)'} 当前plan=${acct.current_plan || '?'}`,
+    );
+
+    // Hard assertion: a phone-input grant must land on an account whose phone
+    // matches. Runs BEFORE callBilling — a mismatch aborts without granting.
+    if (kind === 'phone') {
+      assertPhoneMatch(identifier, acct.phone);
+    }
+    identity = { phone: acct.phone, email: acct.email };
   } else {
+    // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No
+    // internal HTTP reverse-verify (token lacks internal:users:write → 403).
     const infisicalConfig = getInfisicalConfig();
     const token = getInfisicalToken(infisicalConfig);
-    userId = await resolveUserId(email, env, infisicalConfig, token);
+    userId = await resolveUserId(identifier, env, infisicalConfig, token);
+    console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
+    identity = { phone: null, email: identifier };
   }
 
   const { body } = await callBilling<{
@@ -82,10 +171,16 @@ async function main() {
   console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);
   console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
   if (body.warning) console.log(`⚠️  ${body.warning}`);
-  console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
+  console.log(
+    `\n✅ Done! 用户 userId=${userId} 手机=${identity.phone || '(无)'} email=${identity.email || '(无)'} now has ${body.planId} until ${body.expiresAt}\n`,
+  );
 }
 
-main().catch(error => {
-  console.error('\n❌ Error:', error.message);
-  process.exit(1);
-});
+// Only run the CLI flow when invoked directly — being require()'d (e.g. by the
+// unit tests for classifyIdentifier/assertPhoneMatch) must not trigger main().
+if (require.main === module) {
+  main().catch(error => {
+    console.error('\n❌ Error:', error.message);
+    process.exit(1);
+  });
+}

package/dist/bin/helpers/billing-http.js

@@ -6,6 +6,8 @@ exports.getServiceToken = getServiceToken;
 exports.callBilling = callBilling;
 exports.callSkills = callSkills;
 exports.resolveUserIdByEmail = resolveUserIdByEmail;
+exports.resolveUserIdByPhone = resolveUserIdByPhone;
+exports.getUserById = getUserById;
 const child_process_1 = require("child_process");
 const infisical_secrets_1 = require("./infisical-secrets");
 const db_utils_1 = require("./db-utils");
@@ -232,3 +234,72 @@ async function resolveUserIdByEmail(env, email) {
     console.log(`✓ Found user: ${parsed.user_id}`);
     return parsed.user_id;
 }
+/**
+ * Resolve a user's id by phone via user-auth's internal lookup endpoint
+ * (POST /api/v1/internal/users/lookup with {phone}). Mirrors
+ * resolveUserIdByEmail — pure-phone CN users have no email, so this is the
+ * only id path for them (gateway#923 root cause: email-only lookup couldn't
+ * resolve them and a wrong userId got hand-fed instead).
+ */
+async function resolveUserIdByPhone(env, phone) {
+    console.log(`Looking up user by phone: ${phone}`);
+    const token = getServiceToken(env);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const res = await fetch(`${authUrl}/api/v1/internal/users/lookup`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ phone }),
+    });
+    const text = await res.text();
+    if (res.status === 404) {
+        throw new Error(`User not found by phone (${env}): ${phone}`);
+    }
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`user-auth lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    if (!parsed.user_id) {
+        throw new Error(`user-auth lookup response missing user_id: ${text.slice(0, 200)}`);
+    }
+    console.log(`✓ Found user: ${parsed.user_id}`);
+    return parsed.user_id;
+}
+/**
+ * Fetch a user's identity by id via user-auth's internal endpoint
+ * (GET /api/v1/internal/users/{userId}). Used to reverse-verify the target
+ * account before granting — prints phone/email/current_plan so the operator
+ * can confirm they're hitting the right account (gateway#923).
+ */
+async function getUserById(env, userId) {
+    const token = getServiceToken(env);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const res = await fetch(`${authUrl}/api/v1/internal/users/${encodeURIComponent(userId)}`, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    const text = await res.text();
+    if (res.status === 404) {
+        throw new Error(`User not found by id (${env}): ${userId}`);
+    }
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`user-auth user lookup returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    return parsed;
+}

package/dist/bin/helpers/generate-test-token.js

@@ -60,7 +60,9 @@ const ENV_CONFIG = {
         // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 *-cn.optima.chat 路由已下线
         authUrl: 'https://auth.yzsgo.com',
         apiUrl: 'https://commerce.yzsgo.com',
-        clientId: 'commerce-cli-cn-prod',
+        // #31: 必须用 cn user-auth 里注册的 public client（开 password grant）。
+        // 注意不要换成同名的 confidential client `commerce-cli-cn-prod-*`，那个需要 client_secret，走不通 CLI 的 public ROPC flow。
+        clientId: 'dev-skill-cli-cn-pro-acvkmcuq',
         envName: 'cn-prod'
     }
 };
@@ -90,7 +92,8 @@ async function registerMerchant(email, password, businessName, config, phone, ad
             method: 'POST',
             body: JSON.stringify(payload)
         });
-        console.log(`✓ Merchant registered successfully (ID: ${result.user_id})`);
+        // #31: cn-prod register 返回体字段名是 `id`，AWS 是 `user_id`，两者兼容
+        console.log(`✓ Merchant registered successfully (ID: ${result.user_id ?? result.id})`);
         return result;
     }
     catch (error) {

package/dist/bin/helpers/grant-subscription.js

@@ -1,11 +1,63 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyIdentifier = classifyIdentifier;
+exports.assertPhoneMatch = assertPhoneMatch;
+exports.assertAwsEmailOnly = assertAwsEmailOnly;
 // P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
 // 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
 // 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 const db_utils_1 = require("./db-utils");
 const billing_http_1 = require("./billing-http");
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Auto-detect what kind of identifier the operator passed. gateway#923: a
+ * pure-phone CN user (no email) couldn't be resolved by the email-only CLI,
+ * so a wrong userId was hand-fed. Accepting phone/userId directly + this
+ * classifier removes the manual-userId footgun.
+ */
+function classifyIdentifier(s) {
+    if (s.includes('@'))
+        return 'email';
+    if (UUID_RE.test(s))
+        return 'userId';
+    const digits = s.replace(/\D/g, '');
+    if (/^\d{6,}$/.test(digits))
+        return 'phone';
+    throw new Error('无法识别 identifier（需 email / 手机号 / userId）');
+}
+/**
+ * Hard guard: when the operator gave a phone number, the resolved account's
+ * phone MUST match it. Normalizes both sides (strip non-digits) before
+ * comparing. A mismatch (or an account with no phone) throws to abort the
+ * grant — this is the assertion that would have stopped gateway#923.
+ */
+function assertPhoneMatch(inputPhone, accountPhone) {
+    const input = inputPhone.replace(/\D/g, '');
+    const account = (accountPhone ?? '').replace(/\D/g, '');
+    if (!account || input !== account) {
+        throw new Error('手机号不匹配：请求 ' +
+            input +
+            '，但该 userId 的手机号是 ' +
+            (accountPhone || '(无)') +
+            '——拒绝授予以防发错账号');
+    }
+}
+/**
+ * AWS (stage/prod) only supports email identifiers. The HTTP reverse-verify
+ * (getUserById) and phone/userId resolution rely on user-auth's internal
+ * endpoints, which require the token scope `internal:users:write` — only the
+ * cn-prod dev-skills client carries it (see billing-http getServiceToken).
+ * AWS resolves users via the RDS SSH tunnel (resolveUserId) and never hits
+ * those endpoints, so phone/userId here would 403. gateway#923 (wrong-account
+ * grant) is a cn-prod-only, pure-phone-user problem; AWS users have unambiguous
+ * emails, so restricting AWS to email is a zero-regression no-op for them.
+ */
+function assertAwsEmailOnly(env, kind) {
+    if ((env === 'stage' || env === 'prod') && kind !== 'email') {
+        throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+    }
+}
 // cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
 // exist in the cn DB, so a per-env whitelist (not billing-side validation)
 // is what prevents accidentally granting a USD-priced plan to a CN user.
@@ -16,7 +68,7 @@ const PLANS_BY_ENV = {
 };
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-        console.log(`Usage: optima-grant-subscription <email> [options]
+        console.log(`Usage: optima-grant-subscription <email|phone|userId> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
@@ -26,7 +78,7 @@ Options:
   -h, --help        Show this help`);
         process.exit(0);
     }
-    const email = args[0];
+    const identifier = args[0];
     let plan = null;
     let months = 1;
     let env = 'stage';
@@ -52,21 +104,49 @@ Options:
         console.error('Months must be >= 1');
         process.exit(1);
     }
-    return { email, plan, months, env };
+    return { identifier, plan, months, env };
 }
 async function main() {
-    const { email, plan, months, env } = parseArgs(process.argv.slice(2));
-    console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
-    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-    // internal lookup API instead of the direct SQL path.
+    const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
+    const kind = classifyIdentifier(identifier);
+    assertAwsEmailOnly(env, kind);
+    console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
+    // identity is the verified target account to print on success. AWS keeps the
+    // pre-change behavior (email-only, no internal HTTP reverse-verify); only
+    // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
     let userId;
+    let identity;
     if (env === 'cn-prod') {
-        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
+        // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
+        // and its dev-skills token carries internal:users:write for the lookups.
+        if (kind === 'userId') {
+            userId = identifier;
+        }
+        else if (kind === 'phone') {
+            userId = await (0, billing_http_1.resolveUserIdByPhone)(env, identifier);
+        }
+        else {
+            userId = await (0, billing_http_1.resolveUserIdByEmail)(env, identifier);
+        }
+        // Reverse-verify: fetch and loudly print the target account identity
+        // before granting, so a wrong userId is caught by eye (gateway#923).
+        const acct = await (0, billing_http_1.getUserById)(env, userId);
+        console.log(`🎯 目标账号: userId=${userId} 手机=${acct.phone || '(无)'} email=${acct.email || '(无)'} 当前plan=${acct.current_plan || '?'}`);
+        // Hard assertion: a phone-input grant must land on an account whose phone
+        // matches. Runs BEFORE callBilling — a mismatch aborts without granting.
+        if (kind === 'phone') {
+            assertPhoneMatch(identifier, acct.phone);
+        }
+        identity = { phone: acct.phone, email: acct.email };
     }
     else {
+        // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No
+        // internal HTTP reverse-verify (token lacks internal:users:write → 403).
         const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
+        userId = await (0, db_utils_1.resolveUserId)(identifier, env, infisicalConfig, token);
+        console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
+        identity = { phone: null, email: identifier };
     }
     const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
     console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
@@ -74,9 +154,13 @@ async function main() {
     console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
     if (body.warning)
         console.log(`⚠️  ${body.warning}`);
-    console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
+    console.log(`\n✅ Done! 用户 userId=${userId} 手机=${identity.phone || '(无)'} email=${identity.email || '(无)'} now has ${body.planId} until ${body.expiresAt}\n`);
+}
+// Only run the CLI flow when invoked directly — being require()'d (e.g. by the
+// unit tests for classifyIdentifier/assertPhoneMatch) must not trigger main().
+if (require.main === module) {
+    main().catch(error => {
+        console.error('\n❌ Error:', error.message);
+        process.exit(1);
+    });
 }
-main().catch(error => {
-    console.error('\n❌ Error:', error.message);
-    process.exit(1);
-});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.41",
+  "version": "0.7.43",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {