@optima-chat/dev-skills 0.8.1 → 0.9.0

package/dist/bin/helpers/entitlement/revoke.js

@@ -3,18 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runRevoke = runRevoke;
 const billing_http_1 = require("../billing-http");
 const confirm_prompt_1 = require("../confirm-prompt");
+const grant_subscription_1 = require("../grant-subscription");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
-        console.log(`Usage: optima-entitlement revoke --email <user> --product-key <slug> --reason "..." [options]
+        console.log(`Usage: optima-entitlement revoke <email|phone|userId> --product-key <slug> --reason "..." [options]
 
 Required:
-  --email <user-email>             Resolved to userId via user-auth DB
+  <email|phone|userId>             Target user. phone/userId only on cn-prod / cn-stage (AWS resolves email only).
   --product-key <productKey>
   --reason "..."                   Required by billing (400 otherwise); stored on entitlement.refundReason
 
 Optional:
-  --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod|cn-prod|cn-stage  (default: stage)
+  --yes                            Skip prod/cn-prod confirmation prompt (no-op on stage / cn-stage)
+  --env stage|prod|cn-prod|cn-stage   (default: stage)
 
 Refuses non-ADMIN_GRANT sources (PAYMENT, PARTNER) with source-specific
 error pointing to the right reversal flow.`);
@@ -26,9 +27,9 @@ error pointing to the right reversal flow.`);
         const next = argv[i + 1];
         switch (a) {
             case '--email':
-                out.email = next;
+                out.identifier = next;
                 i++;
-                break;
+                break; // back-compat alias for the positional identifier
             case '--product-key':
                 out.productKey = next;
                 i++;
@@ -44,11 +45,16 @@ error pointing to the right reversal flow.`);
                 out.env = next;
                 i++;
                 break;
-            default: throw new Error(`Unknown arg: ${a}`);
+            default:
+                if (a.startsWith('--'))
+                    throw new Error(`Unknown arg: ${a}`);
+                if (out.identifier)
+                    throw new Error(`Unexpected positional arg: ${a} (identifier already set to ${out.identifier})`);
+                out.identifier = a;
         }
     }
-    if (!out.email)
-        throw new Error('--email required');
+    if (!out.identifier)
+        throw new Error('target user required (<email|phone|userId> positional, or --email)');
     if (!out.productKey)
         throw new Error('--product-key required');
     if (!out.reason)
@@ -60,7 +66,7 @@ const PARTNER_REFUSAL = `refusing to revoke a PARTNER-source entitlement via CLI
 async function runRevoke(argv) {
     const args = parseArgs(argv);
     (0, billing_http_1.validateEnvCnProd)(args.env);
-    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
+    const { userId } = await (0, grant_subscription_1.resolveTargetUser)(args.env, args.identifier);
     // Step 1: Fetch user's entitlements
     const listRes = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
     const all = listRes.body.entitlements ?? [];
@@ -68,10 +74,10 @@ async function runRevoke(argv) {
     const matches = all.filter((e) => e.status === 'ACTIVE' && e.productKey === args.productKey);
     // Step 3: Validate count (partial unique index enforces ≤1 ACTIVE)
     if (matches.length === 0) {
-        throw new Error(`no active entitlement for (user=${args.email}, product=${args.productKey}) on ${args.env}`);
+        throw new Error(`no active entitlement for (user=${args.identifier}, product=${args.productKey}) on ${args.env}`);
     }
     if (matches.length > 1) {
-        throw new Error(`unexpected: ${matches.length} ACTIVE entitlements for (user, product) — partial unique constraint should prevent this. Inspect with: optima-entitlement list --email ${args.email}`);
+        throw new Error(`unexpected: ${matches.length} ACTIVE entitlements for (user, product) — partial unique constraint should prevent this. Inspect with: optima-entitlement list ${args.identifier}`);
     }
     const target = matches[0];
     // Step 4: Validate source
@@ -81,7 +87,7 @@ async function runRevoke(argv) {
         throw new Error(PARTNER_REFUSAL);
     if (target.source !== 'ADMIN_GRANT')
         throw new Error(`unknown entitlement source: ${target.source}`);
-    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: REVOKE entitlement ${target.id} (productKey=${target.productKey}) for user ${args.email} (userId=${userId}) on ${args.env.toUpperCase()}\nReason: ${args.reason}`, args.yes);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: REVOKE entitlement ${target.id} (productKey=${target.productKey}) for ${args.identifier} (userId=${userId}) on ${args.env.toUpperCase()}\nReason: ${args.reason}`, args.yes);
     // Step 5: Refund
     // refundAmountCents=0 is always correct for ADMIN_GRANT (priceCents=0,
     // no upstream charge). Pass explicitly so billing's auto-compute
@@ -91,7 +97,7 @@ async function runRevoke(argv) {
     // this branch only ever runs for ADMIN_GRANT (priceCents=0) — Stripe
     // refund path in billing (admin-products.ts:296-307) is gated on
     // source=PAYMENT and won't trigger here.
-    console.log(`\n♻️  Revoking entitlement ${target.id} for ${args.email}...`);
+    console.log(`\n♻️  Revoking entitlement ${target.id} for ${args.identifier}...`);
     const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/refund-entitlement', {
         entitlementId: target.id,
         refundReason: args.reason,

package/dist/bin/helpers/grant-balance.js

@@ -6,16 +6,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // 改调 billing 服务态端点（grantCredits → bonus 积分）。
 // ⚠️ 语义变化：旧 wallet granted 无期限；积分 bonus 桶标准 30 天有效期。
 const crypto_1 = require("crypto");
-const db_utils_1 = require("./db-utils");
 const billing_http_1 = require("./billing-http");
+const grant_subscription_1 = require("./grant-subscription");
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
-        console.log(`Usage: optima-grant-balance <email> --amount <usd> [options]
+        console.log(`Usage: optima-grant-balance <email|phone|userId> --amount <usd> [options]
 
 Grant credits to a user (bonus bucket, expires in 30 days).
 Used for promotional grants, compensation, referral rewards, etc.
 $1 = 700 credits (P15 unified ledger; the USD wallet is retired).
 
+Target user: <email|phone|userId> (positional). phone/userId only on
+cn-prod / cn-stage; AWS stage/prod resolve email only.
+
 Options:
   --amount <usd>        USD amount to grant (required, e.g. 5 for $5.00 = 3500 credits)
   --description <text>  Description for audit trail (optional)
@@ -24,12 +27,11 @@ Options:
 
 Examples:
   optima-grant-balance user@example.com --amount 5 --env prod
-  optima-grant-balance user@example.com --amount 10 --description "Service outage compensation"
-  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)
+  optima-grant-balance 18898654855 --amount 1 --env cn-prod   # 手机号（cn 用户多为手机号注册）
   optima-grant-balance user@example.com --amount 1 --env cn-stage  # 阿里云预发`);
         process.exit(0);
     }
-    const email = args[0];
+    const identifier = args[0];
     let amountUsd = 0;
     let description = null;
     let env = 'stage';
@@ -49,24 +51,17 @@ Examples:
         process.exit(1);
     }
     (0, billing_http_1.validateEnvCnProd)(env);
-    return { email, amountUsd, description, env };
+    return { identifier, amountUsd, description, env };
 }
 async function main() {
-    const { email, amountUsd, description, env } = parseArgs(process.argv.slice(2));
-    console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} (${Math.round(amountUsd * 700)} credits) to ${email} [${env.toUpperCase()}]\n`);
+    const { identifier, amountUsd, description, env } = parseArgs(process.argv.slice(2));
+    console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} (${Math.round(amountUsd * 700)} credits) to ${identifier} [${env.toUpperCase()}]\n`);
     if (description)
         console.log(`   Reason: ${description}`);
-    // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
-    // user-auth's internal lookup API instead of the direct SQL path.
-    let userId;
-    if (env === 'cn-prod' || env === 'cn-stage') {
-        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
-    }
-    else {
-        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
-    }
+    // Shared resolver: classify→resolve→reverse-verify echo→phone-assert on cn
+    // (so phone/userId works for cn's phone-registered users, gateway#923);
+    // email-only via the RDS SSH tunnel on AWS.
+    const { userId } = await (0, grant_subscription_1.resolveTargetUser)(env, identifier);
     // 幂等键 per-invocation 生成、callBilling 的 5xx retry 复用同 body —— 「已
     // commit 但响应 5xx」场景重试不双发（billing spec R2-M3）。
     const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-credits', {
@@ -76,7 +71,7 @@ async function main() {
         idempotencyKey: `dev-skills-grant:${(0, crypto_1.randomUUID)()}`,
     });
     console.log(`✓ Granted ${body.credits} credits (lot ${body.lotId})`);
-    console.log(`\n✅ Done! ${email} received ${body.credits} bonus credits (expires in 30 days)\n`);
+    console.log(`\n✅ Done! ${identifier} received ${body.credits} bonus credits (expires in 30 days)\n`);
 }
 main().catch(error => {
     console.error('\n❌ Error:', error.message);

package/dist/bin/helpers/grant-subscription.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyIdentifier = classifyIdentifier;
 exports.assertPhoneMatch = assertPhoneMatch;
 exports.assertAwsEmailOnly = assertAwsEmailOnly;
+exports.resolveTargetUser = resolveTargetUser;
 // P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
 // 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
 // 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
@@ -108,19 +109,29 @@ Options:
     }
     return { identifier, plan, months, env };
 }
-async function main() {
-    const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
+/**
+ * Resolve a CLI identifier (`<email|phone|userId>`) to a userId + verified
+ * account identity, handling the AWS-vs-cn split. Shared by grant-subscription,
+ * grant-balance, the optima-entitlement subcommands, and optima-account so all
+ * four accept the same identifier forms (gateway#923: phone/userId on cn).
+ *
+ * - AWS (stage/prod): email-only via the RDS SSH tunnel; no internal HTTP
+ *   reverse-verify (the AWS dev-skills token lacks internal:users:write).
+ * - cn-prod / cn-stage: no tunnel into the Aliyun RDS — classify → resolve via
+ *   user-auth internal endpoints → getUserById reverse-verify → phone-assert.
+ *   cn-stage shares cn-prod's HTTP path (same internal endpoints, cn-stage M2M
+ *   token); the split is AWS-vs-cn, NOT prod-vs-stage.
+ *
+ * Prints a `🎯 目标账号` line in BOTH branches before returning, so a wrong
+ * userId is caught by eye before any destructive call (ban/grant/revoke).
+ */
+async function resolveTargetUser(env, identifier) {
     const kind = classifyIdentifier(identifier);
     assertAwsEmailOnly(env, kind);
-    console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
-    // identity is the verified target account to print on success. AWS keeps the
-    // pre-change behavior (email-only, no internal HTTP reverse-verify); only
-    // cn-prod / cn-stage run the full classify→resolve→getUserById→phone-assert防呆 path.
-    let userId;
-    let identity;
     if (env === 'cn-prod' || env === 'cn-stage') {
         // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
         // user-auth, and the dev-skills token carries internal:users:write for lookups.
+        let userId;
         if (kind === 'userId') {
             userId = identifier;
         }
@@ -131,25 +142,31 @@ async function main() {
             userId = await (0, billing_http_1.resolveUserIdByEmail)(env, identifier);
         }
         // Reverse-verify: fetch and loudly print the target account identity
-        // before granting, so a wrong userId is caught by eye (gateway#923).
+        // before any mutation, so a wrong userId is caught by eye (gateway#923).
         const acct = await (0, billing_http_1.getUserById)(env, userId);
         console.log(`🎯 目标账号: userId=${userId} 手机=${acct.phone || '(无)'} email=${acct.email || '(无)'} 当前plan=${acct.current_plan || '?'}`);
         // Hard assertion: a phone-input grant must land on an account whose phone
-        // matches. Runs BEFORE callBilling — a mismatch aborts without granting.
+        // matches. Runs BEFORE the caller's mutation — a mismatch aborts.
         if (kind === 'phone') {
             assertPhoneMatch(identifier, acct.phone);
         }
-        identity = { phone: acct.phone, email: acct.email };
-    }
-    else {
-        // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No
-        // internal HTTP reverse-verify (token lacks internal:users:write → 403).
-        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-        userId = await (0, db_utils_1.resolveUserId)(identifier, env, infisicalConfig, token);
-        console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
-        identity = { phone: null, email: identifier };
+        return { userId, kind, identity: { phone: acct.phone, email: acct.email } };
     }
+    // AWS (stage/prod): email-only, resolved via the RDS SSH tunnel. No internal
+    // HTTP reverse-verify (token lacks internal:users:write → 403), but still
+    // echo the resolved account so destructive ops have a confirmation line (R1).
+    const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
+    const userId = await (0, db_utils_1.resolveUserId)(identifier, env, infisicalConfig, token);
+    console.log(`🎯 目标账号: userId=${userId} email=${identifier}`);
+    return { userId, kind, identity: { phone: null, email: identifier } };
+}
+async function main() {
+    const { identifier, plan, months, env } = parseArgs(process.argv.slice(2));
+    console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${classifyIdentifier(identifier)}) for ${months} month(s) [${env.toUpperCase()}]\n`);
+    // Shared resolver: classify → resolve → reverse-verify echo → phone-assert
+    // (cn-prod/cn-stage), or email-only via SSH tunnel (AWS). See resolveTargetUser.
+    const { userId, identity } = await resolveTargetUser(env, identifier);
     const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
     console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
     console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);

package/dist/bin/helpers/logs.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * optima-logs —— 一条命令直取服务日志,四环境统一,用 --env 区分。
+ *
+ *   stage / prod     : AWS CloudWatch(`aws logs tail /ecs/<svc>-<env>`)
+ *   cn-prod / cn-stage: 阿里云 SLS 直连(`aliyun sls GetLogs`)
+ *
+ * cn 的关键改进:旧流程要 SSH 进 buildbox 再调 SAE `DescribeInstanceLog`,
+ * 只能看实例**当前缓冲**(重启即丢、不能检索)。现在 cn-prod/cn-stage 全部
+ * 服务已接 SLS,GetLogs 是公网控制面 API,本机 `aliyun-optima` profile 直连即可:
+ *   - 免 buildbox 跳板
+ *   - 支持时间窗(--since)+ 关键词检索(--grep)+ 历史(重启不丢)
+ *
+ * 前置:
+ *   AWS  → 已配 aws CLI 凭证(ap-southeast-1)
+ *   cn   → 已配 aliyun CLI profile `aliyun-optima`(cn-beijing)
+ *
+ * 用法:
+ *   optima-logs gateway-core                       # 默认 cn-prod,最近 1h,100 行
+ *   optima-logs gateway-core --env cn-stage
+ *   optima-logs user-auth --env prod --since 2h
+ *   optima-logs commerce-backend --grep error -n 200
+ *   optima-logs gateway-core --since 30m --json     # 机器可读
+ *
+ * service == SLS logstore == AWS 日志组 `/ecs/<svc>-<env>` 的 <svc>(同名)。
+ */
+const child_process_1 = require("child_process");
+const ALIYUN_ACCOUNT = '1911493506120573';
+const ALIYUN_PROFILE = 'aliyun-optima';
+const ALIYUN_REGION = 'cn-beijing';
+const AWS_REGION = 'ap-southeast-1';
+const AWS_ENVS = ['stage', 'prod'];
+const CN_ENVS = ['cn-prod', 'cn-stage'];
+const ALL_ENVS = [...AWS_ENVS, ...CN_ENVS];
+const C = { g: '\x1b[32m', y: '\x1b[33m', b: '\x1b[34m', d: '\x1b[2m', n: '\x1b[0m' };
+const HELP = `Usage: optima-logs <service> [options]
+
+四环境统一查日志,cn 直连阿里云 SLS(免 buildbox),AWS 走 CloudWatch。
+
+Required:
+  <service>                服务名(== SLS logstore == /ecs/<svc>-<env> 的 <svc>)
+
+Optional:
+  --env <e>                stage | prod | cn-prod | cn-stage   (default: cn-prod)
+  --lines, -n <N>          返回行数                            (default: 100)
+  --since <dur>            时间窗,如 30m / 2h / 1d / 3600(秒)  (default: 1h)
+  --grep <kw>              关键词检索(cn=SLS query / aws=filter-pattern)
+  --json                   原始 JSON 输出(接管道)
+  --help, -h               显示本帮助
+
+Examples:
+  optima-logs gateway-core
+  optima-logs user-auth --env prod --since 2h
+  optima-logs commerce-backend --env cn-prod --grep error -n 200`;
+/** 把 30m / 2h / 1d / 纯秒 解析成秒数;同时回填给 aws 用的带单位字符串。 */
+function parseSince(raw) {
+    const m = raw.match(/^(\d+)([smhdw]?)$/);
+    if (!m)
+        throw new Error(`--since 格式非法: ${raw}(用 30m / 2h / 1d / 纯秒)`);
+    const n = parseInt(m[1], 10);
+    const unit = m[2] || 's';
+    const mult = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
+    return { sec: n * mult[unit], awsStr: `${n}${unit}` };
+}
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(HELP);
+        process.exit(0);
+    }
+    const out = { env: 'cn-prod', lines: 100, since: '1h', json: false };
+    const positional = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            case '--lines':
+            case '-n': {
+                const v = parseInt(next, 10);
+                if (isNaN(v) || v <= 0)
+                    throw new Error('--lines 需要正整数');
+                out.lines = v;
+                i++;
+                break;
+            }
+            case '--since':
+                out.since = next;
+                i++;
+                break;
+            case '--grep':
+                out.grep = next;
+                i++;
+                break;
+            case '--json':
+                out.json = true;
+                break;
+            default:
+                if (a.startsWith('-'))
+                    throw new Error(`未知参数: ${a}`);
+                positional.push(a);
+        }
+    }
+    if (positional.length === 0)
+        throw new Error('缺少 <service>(见 --help)');
+    if (positional.length > 1)
+        throw new Error(`多余参数: ${positional.slice(1).join(' ')}`);
+    out.service = positional[0];
+    if (!ALL_ENVS.includes(out.env)) {
+        throw new Error(`--env 非法: ${out.env}(可选 ${ALL_ENVS.join(' | ')})`);
+    }
+    return out;
+}
+function run(cmd, args) {
+    return (0, child_process_1.execFileSync)(cmd, args, { encoding: 'utf-8', maxBuffer: 128 * 1024 * 1024 });
+}
+/** AWS CloudWatch:aws logs tail /ecs/<svc>-<env>。 */
+function fetchAws(args) {
+    const group = `/ecs/${args.service}-${args.env}`;
+    const { awsStr } = parseSince(args.since);
+    const cmd = ['logs', 'tail', group, '--since', awsStr, '--region', AWS_REGION, '--format', args.json ? 'json' : 'short'];
+    if (args.grep)
+        cmd.push('--filter-pattern', args.grep);
+    process.stderr.write(`${C.d}# AWS CloudWatch ${group} (since ${awsStr}${args.grep ? `, grep "${args.grep}"` : ''})${C.n}\n`);
+    try {
+        process.stdout.write(run('aws', cmd));
+    }
+    catch (e) {
+        if (/ResourceNotFoundException/.test(e.stderr || e.message || '')) {
+            throw new Error(`日志组不存在: ${group}\n  确认服务名/环境对,或该服务未部署在 ${args.env}。`);
+        }
+        throw new Error(e.stderr || e.message);
+    }
+}
+/** 阿里云 SLS:aliyun sls GetLogs,project=optima-<env>-<account>,logstore=service。 */
+function fetchCn(args) {
+    const project = `optima-${args.env}-${ALIYUN_ACCOUNT}`;
+    const { sec } = parseSince(args.since);
+    const now = Math.floor(Date.now() / 1000);
+    const from = now - sec;
+    const cmd = [
+        'sls', 'GetLogs',
+        '--project', project,
+        '--logstore', args.service,
+        '--from', String(from),
+        '--to', String(now),
+        '--line', String(args.lines),
+        '--reverse', 'true', // 先拿最新 N 条
+        '--region', ALIYUN_REGION,
+        '--profile', ALIYUN_PROFILE,
+    ];
+    if (args.grep) {
+        cmd.push('--query', args.grep);
+    }
+    process.stderr.write(`${C.d}# 阿里云 SLS ${project}/${args.service} (since ${args.since}${args.grep ? `, query "${args.grep}"` : ''})${C.n}\n`);
+    let raw;
+    try {
+        raw = run('aliyun', cmd);
+    }
+    catch (e) {
+        const msg = e.stderr || e.message || '';
+        if (/LogStoreNotExist|ProjectNotExist/.test(msg)) {
+            throw new Error(`SLS logstore 不存在: ${project}/${args.service}\n  确认服务名对,或该服务未接 SLS。列全部:\n  aliyun sls ListLogStores --project ${project} --region ${ALIYUN_REGION} --profile ${ALIYUN_PROFILE}`);
+        }
+        throw new Error(msg);
+    }
+    const rows = JSON.parse(raw || '[]');
+    // reverse=true 取到的是新→旧,翻回旧→新便于阅读
+    rows.reverse();
+    if (args.json) {
+        console.log(JSON.stringify(rows, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        process.stderr.write(`${C.y}(无日志:该时间窗内 ${args.service} 无输出,或 --grep 没命中)${C.n}\n`);
+        return;
+    }
+    for (const r of rows) {
+        // SLS 存的 content 已含容器时间戳 + stream(stdout/stderr)前缀,直接打印即可
+        process.stdout.write((r.content ?? JSON.stringify(r)) + '\n');
+    }
+}
+function main() {
+    let args;
+    try {
+        args = parseArgs(process.argv.slice(2));
+    }
+    catch (e) {
+        console.error(`${C.y}✗ ${e.message}${C.n}`);
+        process.exit(1);
+    }
+    try {
+        if (CN_ENVS.includes(args.env))
+            fetchCn(args);
+        else
+            fetchAws(args);
+    }
+    catch (e) {
+        console.error(`${C.y}✗ ${e.message}${C.n}`);
+        process.exit(1);
+    }
+}
+main();

package/docs/.admin-cli-4env/spec.md

@@ -0,0 +1,109 @@
+# SPEC — dev-skills 运营 admin CLI 4-环境统一 + 账号禁用
+
+> 状态：FINAL（r1+r2 fresh-agent review 已过；OPEN-1/2/3/5 闭环，OPEN-4 留 T0 验证）
+> 作者：本次 session · 日期：2026-06-16
+> 目标来源（用户原话，2026-06-15）："4个环境（stage, prod, cn-stage, cn-prod）的 grant 和 entitlement 的授予和撤销，以及状态查询。另外加一个账号禁用和恢复。同时支持手机号和邮箱。"
+> 用户锁定：subscription=授予+查询(无撤销)；entitlement=授予+撤销+查询；credits=授予(修手机号)；ban/unban=4环境(admin-用户凭证)。命令面=`optima-account status|ban|unban` 聚合。status 含 credits 余额。
+
+## 1. 目标与范围（已锁定）
+
+| 域 | 授予 | 撤销 | 状态查询 | 备注 |
+|---|---|---|---|---|
+| subscription | ✅ 已有 `grant-subscription` | ❌ 不做 | ✅ 并入 `account status` | billing 无 admin 撤销端点 |
+| entitlement | ✅ 已有 | ✅ 已有 `refund-entitlement` | ✅ 已有 `admin/entitlements` | |
+| credits | ✅ 已有 `grant-balance` | ❌ 无端点 | ✅ 并入 `account status` | **修缺陷：支持手机号** |
+| account ban/unban | — | — | ✅ `account status` 显示 is_active/banned | ✅ 全新，4 环境 |
+
+4 环境：`stage`/`prod`/`cn-stage`/`cn-prod`。标识符：cn 支持 `phone/email/userId`，AWS `email` only（SSH 隧道 + M2M scope 限制）。
+不在范围：subscription 撤销、credits 撤销、AWS 手机号解析。
+
+## 2. 命令面（已定）
+
+- `optima-grant-subscription <email|phone|userId> --plan --months --env` —— 授予会员（已支持 4 环境，本次仅随 `resolveTargetUser` 抽取而调整）。
+- `optima-grant-balance <email|phone|userId> --amount --env` —— 授予 credits。**改**：接 `resolveTargetUser`（支持手机号），位置参数 identifier，`--email` 兼容别名。
+- `optima-entitlement grant|revoke|list <email|phone|userId> --env` —— **改**：cn-prod + cn-stage（基于 main 抽取的 resolver）。
+- `optima-account status|ban|unban <email|phone|userId> --env` —— **新 bin**：
+  - `status`（只读，聚合）：订阅(membership-status) + 权益(admin/entitlements) + 账号状态(is_active/banned) + **credits 余额**。
+  - `ban --reason "..."`：user-auth `is_active=false`。prod/cn-prod confirm。**AWS 与 cn 都须在执行前打印解析到的目标账号（email/phone+userId）做反查回显**（见 R1）。
+  - `unban`。
+
+## 3. 每环境 鉴权 + 解析 矩阵
+
+| 环境 | 身份 | userId 解析 | 解析 token | billing 写 | ban 写 |
+|---|---|---|---|---|---|
+| stage/prod (AWS) | email | RDS SSH 隧道 `resolveUserId(email)` | AWS Infisical | M2M client_credentials | **admin-用户 token（新）** |
+| cn-prod/cn-stage (阿里云) | 手机号为主 | HTTP `/internal/users/lookup`(phone/email)+`getUserById`反查+`assertPhoneMatch` | M2M(cn, scope `internal:users:write`) | 同 M2M | **admin-用户 token（新）** |
+
+**端点（已源码核实；impl T0 须逐环境真实请求复核，CLAUDE.md）**：
+- 解析：user-auth `POST /api/v1/internal/users/lookup`、`GET /api/v1/internal/users/{id}`（M2M, verify_internal_service_token）。
+- subscription 授予：billing `POST /api/billing/admin/grant-subscription`（requireAdminService/M2M）。
+- subscription 状态：billing `GET /api/internal/users/{userId}/membership-status`（extractAnyServiceAuth/M2M）→ `{active, planId, status}`。**注意路径前缀 `/api/internal`，非 `/api/billing/admin`；用 callBilling(billing baseURL) 调（见 OPEN-4）**。
+- entitlement：billing `POST /api/billing/admin/{grant,refund}-entitlement`、`GET /api/billing/admin/entitlements?userId=`。
+- credits 授予：billing `POST /api/billing/admin/grant-credits`。
+- credits 余额读取：**待 T0 确认 M2M 可读端点**（候选 billing internal/admin；若无则 status 的 credits 部分降级为"不可读"提示，不阻塞）。
+- ban/unban：user-auth `POST /api/v1/admin/users/{id}/ban`(body `{reason}`)、`/unban`。鉴权 `get_current_admin_user`（role=ADMIN **用户** token，非 M2M）。
+
+## 4. resolveTargetUser：从 main 抽取（**修正 r1-HIGH-1**）
+
+**基线认知（已核实）**：当前 **main(0.8.0) 已完整支持 cn-stage**——`grant-subscription.ts` 的 cn 分支是 `if (env === 'cn-prod' || env === 'cn-stage')`（main grant-subscription.ts:127），billing-http 有 cn-stage URL/token 分支。**PR #33 是更旧、更窄的产物**：它抽出的 `resolveTargetUser` 只判 `env === 'cn-prod'`（#33 grant-subscription.ts:85），**会回归 cn-stage**。
+
+**做法**：不要"移植 #33 的 resolver"。而是**从 main 现有的 inline cn-prod||cn-stage 逻辑抽出** `resolveTargetUser(env, identifier)`，保留 cn-stage；丢弃 #33 的 cn-prod-only 版本，只取它的 entitlement 接线思路。动代码前先 `diff` main 与 #33 的 cn 分支确认无遗漏。
+
+```
+kind = classifyIdentifier(identifier)        # email/phone/userId
+assertAwsEmailOnly(env, kind)
+if env in {cn-prod, cn-stage}:               # ← 必须含 cn-stage
+    userId = resolveByPhone|Email|userId
+    acct = getUserById(env, userId); 打印 🎯 目标账号
+    if kind == phone: assertPhoneMatch(...)
+else (stage/prod):
+    userId = resolveUserId(email) via SSH 隧道
+    打印 🎯 目标账号(email + userId)            # ← R1：AWS 也要回显
+```
+T2/T3/T5 全部依赖此函数（T1 先行）。
+
+## 5. ban/unban 鉴权设计
+
+- M2M token 无 user_id → 调 ban 404。须 **admin 用户**(role=ADMIN) **password grant**。
+- **复用 generate-test-token 已验证的 per-env public ROPC client**（修正 r1-HIGH-2，原 spec 的 `agent-portal-bc0osnsd` 作废）：
+  - stage `commerce-cli-stage-ihbbwplz` / prod `commerce-cli-ecs-pro-i2r5of1h` / cn-prod `dev-skill-cli-cn-pro-acvkmcuq` / cn-stage `dev-skill-cli-cn-sta-3dvsxzdo`。
+- userId 解析仍走 §4 `resolveTargetUser`（M2M lookup）；**仅最后 ban/unban 调用换 admin-用户 token**（无 chicken-and-egg，r1 已确认）。
+- 新增 `getAdminUserToken(env)`：读 admin email/password → password-grant → curl `oauth/token`。**独立缓存**，不复用 `billing-http.tokenCache`（M2M 缓存），避免冲突（R2）。
+- 新增 `callUserAuthAsAdmin(env, method, path, body)`：base=`USER_AUTH_URLS[env]` + admin-用户 bearer。当前仅有 `callBilling`/`callSkills`，无 user-auth helper（R4）。
+
+### ban 语义（已实测 + 决策 B1）
+- user-auth ban = `is_active=false` + ban 元数据。**已实测确认**：`verify_token`(oauth.py:267) 与 `get_current_user`(auth.py:13) **都不查 is_active**，verify_token 只认 `revoked_token:{jti}`（单 token）+ single-device session-superseded（需 flag）。→ **被 ban 用户已签发 access token 仍有效到过期**，ban 只挡新登录/刷新。
+- `revoke-user` 端点（`POST /api/v1/admin/tokens/revoke-user/{id}`）**是 TODO 桩**：`admin_service.revoke_user_tokens` 只写 `user_tokens_revoked:{id}` 这个 Redis key，**verify_token 全程不读它**（全仓仅 admin.py:365 一处写、零处读）→ 调它等于没用。要真·立刻踢须改 user-auth verify_token（接上 user 级 revoke 时间戳 vs token iat 比对）+ 部署 4 环境。
+- `is_active=false` 与账号软删除**共用同一标志**，仅靠 `banned_at` 区分。
+- **决策 B1（用户定）**：本次 `account ban` 只做 `is_active=false`（名义禁用），**不链 revoke-user**（桩，无效）。help/输出须明示"非即时踢会话，活跃 token 过期后失效"。`account status` 用 `banned_at` 区分 ban vs 软删除。真·即时踢作为 user-auth 后续。
+
+### admin 账号凭证（OPEN-1，已实测解决）
+- **4 环境统一一套凭证**：`admin@optima.chat` + **同一个 seed 密码**（1P item `okshqmbbtu4oes6jhjiz6byojm` "user-auth cn-prod admin (seed password)"；亦见 1P "Optima-admin" item，URL=三个 admin portal）。**已实测**：该密码在 stage / prod / cn-prod / cn-stage 的 `oauth/token` password grant 全部返回 `role=admin` token（配对应 ROPC client，见上）。所有 4 环境 user-auth 均存在 `admin@optima.chat`（role=ADMIN, has_pw=true）。
+- 说明：admin 账号日常虽走邮箱登录，但 DB seed 时种了密码（故可 ROPC）；1P item 里的 `auth-cn.optima.chat` URL 已废（迁 yzsgo.com），仅 item 元数据陈旧，凭证本身有效；`auth.yzsgo.com/` 返回的 `{"service":"user-auth",...}` 是根路径 banner，非异常。
+- **分发性（OPEN-1 已定）**：CLI 共享工具运行时从 **Infisical** 读该密码——落点 **`/shared-secrets/credentials`**（泛化凭证桶，区别于装 M2M 的 `oauth-clients`；已配好 stage/prod，键 USER_AUTH_ADMIN_EMAIL=admin@optima.chat / USER_AUTH_ADMIN_PASSWORD），键 `USER_AUTH_ADMIN_EMAIL` / `USER_AUTH_ADMIN_PASSWORD`。AWS Infisical 存一份（覆 stage/prod），cn Infisical 存一份（覆 cn-prod/cn-stage）；账密 4 环境相同，值从 1P 灌入。`getAdminUserToken(env)` 用 `fetchInfisicalSecret`(AWS) / cn Infisical(cn) 读，配各环境 ROPC client password-grant。
+
+## 6. 验收标准
+- `npm run build`（tsc）绿；repo 既有 lint/test 通过。
+- 单测：classify/assertPhoneMatch/assertAwsEmailOnly 保持；新增 `resolveTargetUser` 的 cn-stage 路由用例、`getAdminUserToken` 缓存隔离用例（mock）。
+- 各命令 ×4 环境 `--help` 正确。
+- T0 真实只读复核 6 类端点 ×相关环境（非 404/200）。
+- `account status <真实用户>` 4 环境各跑一次（只读）；ban/unban 在 stage/cn-stage 用测试账号实跑闭环；prod/cn-prod 仅用户授权下。
+- 向后兼容 `--email`。
+
+## 7. 任务分解
+- **T0**：逐环境真实请求复核 6 类端点（含 membership-status on AWS、credits 余额读取候选）。
+- **T1**：从 main 抽 `resolveTargetUser`（含 cn-stage）+ 单测。（被 T2/T3/T5 依赖）
+- **T2**：grant-balance 接 `resolveTargetUser`（identifier + 手机号）。依赖 T1。
+- **T3**：entitlement grant/list/revoke 落地（cn-prod+cn-stage，基于 main 抽取）。依赖 T1。
+- **T4**：`optima-account status`（membership-status + entitlements + 账号状态 + credits 余额聚合，只读）。依赖 T1。
+- **T5**：`getAdminUserToken`（读 `/shared-secrets/credentials`，独立缓存）+ `callUserAuthAsAdmin` + `optima-account ban/unban`（B1：仅 is_active；含 AWS 反查回显；help 注明非即时踢会话）。依赖 T1 + Infisical 灌值。
+- **T6**：SKILL.md/README/bin 注册/help 同步 4 环境。
+- **T7**：final review + 真实环境验证 + **处理 PR #33（关闭并改正描述）**。
+
+> **#33 需求保证**：丢弃 #33 不丢需求。#33 实现的部分（entitlement 接 cn-prod、位置参数 `<email|phone|userId>` + `--email` 兼容别名、抽 `resolveTargetUser`）由 T1+T3 在 main 基线上重新落地，并补齐 cn-stage。final review 须逐条对照用户原始需求清单确认无遗漏。
+
+## OPEN ITEMS
+- **OPEN-4（验证项，T0 解决）**：membership-status 经 callBilling+M2M 在 AWS 是否可读；credits 余额的 M2M 读取端点（r2 已初验：无 M2M 读他人余额端点 → status 的 credits 部分大概率降级为"不可读"提示，不阻塞）。
+- ~~OPEN-1~~ 已定：admin 凭证 `/shared-secrets/credentials`（USER_AUTH_ADMIN_EMAIL/PASSWORD），4 环境统一 admin@optima.chat+seed pw（实测可用）。
+- ~~OPEN-2~~ 已定：`optima-account` 聚合。 ~~OPEN-3~~ 已定：status 含 credits 余额。
+- ~~OPEN-5~~ 已定：B1——ban 仅 is_active，不链 revoke-user（桩无效）；即时踢列 user-auth 后续。

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {
     "optima-dev-skills": "bin/cli.js",
+    "optima-account": "dist/bin/helpers/account.js",
     "optima-entitlement": "dist/bin/helpers/entitlement.js",
     "optima-generate-test-token": "dist/bin/helpers/generate-test-token.js",
     "optima-grant-balance": "dist/bin/helpers/grant-balance.js",
     "optima-grant-subscription": "dist/bin/helpers/grant-subscription.js",
+    "optima-logs": "dist/bin/helpers/logs.js",
     "optima-plugin": "dist/bin/helpers/plugin.js",
     "optima-discount": "dist/bin/helpers/discount.js",
     "optima-product": "dist/bin/helpers/product.js",