@optima-chat/dev-skills 0.7.37 → 0.7.40

package/dist/bin/helpers/grant-balance.js

@@ -1,23 +1,31 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+// P15 D8b（optima-billing docs/2026-06-11-p15-wallet-sunset-spec.md）：
+// USD 钱包已退役——原「SSH 直写 usd_wallets.granted_balance_micros」作废，
+// 改调 billing 服务态端点（grantCredits → bonus 积分）。
+// ⚠️ 语义变化：旧 wallet granted 无期限；积分 bonus 桶标准 30 天有效期。
+const crypto_1 = require("crypto");
 const db_utils_1 = require("./db-utils");
+const billing_http_1 = require("./billing-http");
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
         console.log(`Usage: optima-grant-balance <email> --amount <usd> [options]
 
-Add USD balance to a user's wallet (granted_balance_micros).
+Grant credits to a user (bonus bucket, expires in 30 days).
 Used for promotional grants, compensation, referral rewards, etc.
+$1 = 700 credits (P15 unified ledger; the USD wallet is retired).
 
 Options:
-  --amount <usd>        USD amount to grant (required, e.g. 5 for $5.00)
+  --amount <usd>        USD amount to grant (required, e.g. 5 for $5.00 = 3500 credits)
   --description <text>  Description for audit trail (optional)
-  --env <env>           Environment: stage, prod (default: stage)
+  --env <env>           Environment: stage, prod, cn-prod (default: stage)
   -h, --help            Show this help
 
 Examples:
   optima-grant-balance user@example.com --amount 5 --env prod
-  optima-grant-balance user@example.com --amount 10 --description "Service outage compensation"`);
+  optima-grant-balance user@example.com --amount 10 --description "Service outage compensation"
+  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)`);
         process.exit(0);
     }
     const email = args[0];
@@ -39,51 +47,35 @@ Examples:
         console.error('--amount is required and must be > 0 (USD)');
         process.exit(1);
     }
-    if (!['stage', 'prod'].includes(env)) {
-        console.error('Env must be stage or prod (billing DB not available in CI)');
-        process.exit(1);
-    }
+    (0, billing_http_1.validateEnvCnProd)(env);
     return { email, amountUsd, description, env };
 }
 async function main() {
     const { email, amountUsd, description, env } = parseArgs(process.argv.slice(2));
-    const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-    // 1 USD = 1,000,000 micros. Round to integer micros.
-    const amountMicros = Math.round(amountUsd * 1000000);
-    console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} to ${email} [${env.toUpperCase()}]\n`);
+    console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} (${Math.round(amountUsd * 700)} credits) to ${email} [${env.toUpperCase()}]\n`);
     if (description)
         console.log(`   Reason: ${description}`);
-    const userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
-    const billing = await (0, db_utils_1.connectBillingDB)(env, infisicalConfig, token);
-    const bq = billing.query;
-    const now = new Date().toISOString();
-    const safeUserId = (0, db_utils_1.escapeSQL)(userId);
-    console.log(`Granting to wallet...`);
-    const txSQL = `
-BEGIN;
-
--- Ensure wallet exists
-INSERT INTO usd_wallets (id, user_id, balance_micros, reserved_micros, granted_balance_micros, created_at, updated_at)
-VALUES (gen_random_uuid(), '${safeUserId}', 0, 0, 0, '${now}', '${now}')
-ON CONFLICT (user_id) DO NOTHING;
-
--- Add to granted balance
-UPDATE usd_wallets SET granted_balance_micros = granted_balance_micros + ${amountMicros}, updated_at = '${now}'
-WHERE user_id = '${safeUserId}';
-
--- Record topup for audit trail (source='admin_grant' aligns with billing service convention)
-INSERT INTO usd_wallet_topups (id, wallet_id, amount_micros, service_fee_micros, net_credit_micros, status, source, service_namespace, created_at, completed_at)
-SELECT gen_random_uuid(), w.id, ${amountMicros}, 0, ${amountMicros}, 'completed', 'admin_grant', 'platform', '${now}', '${now}'
-FROM usd_wallets w WHERE w.user_id = '${safeUserId}';
-
-COMMIT;
-  `.trim();
-    bq(txSQL);
-    console.log(`✓ Granted $${amountUsd.toFixed(2)} to wallet`);
-    const balanceMicros = bq(`SELECT granted_balance_micros FROM usd_wallets WHERE user_id='${safeUserId}'`);
-    const balanceUsd = (parseInt(balanceMicros, 10) / 1000000).toFixed(2);
-    console.log(`\n✅ Done! ${email} now has $${balanceUsd} granted balance\n`);
+    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
+    // internal lookup API instead of the direct SQL path.
+    let userId;
+    if (env === 'cn-prod') {
+        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
+    }
+    else {
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
+        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
+    }
+    // 幂等键 per-invocation 生成、callBilling 的 5xx retry 复用同 body —— 「已
+    // commit 但响应 5xx」场景重试不双发（billing spec R2-M3）。
+    const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-credits', {
+        userId,
+        amountUsd,
+        description: description ?? undefined,
+        idempotencyKey: `dev-skills-grant:${(0, crypto_1.randomUUID)()}`,
+    });
+    console.log(`✓ Granted ${body.credits} credits (lot ${body.lotId})`);
+    console.log(`\n✅ Done! ${email} received ${body.credits} bonus credits (expires in 30 days)\n`);
 }
 main().catch(error => {
     console.error('\n❌ Error:', error.message);

package/dist/bin/helpers/grant-subscription.js

@@ -1,20 +1,33 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+// P15 D8b：USD 钱包退役——原「SSH 直写 subscriptions/usd_wallets/token_quotas」
+// 作废，改调 billing 服务态端点（与用户态 /api/admin/grant-subscription 同
+// 业务体：supersede 旧授予 + 实得 credits + token quota，重试双发不双倍）。
 const db_utils_1 = require("./db-utils");
+const billing_http_1 = require("./billing-http");
+// cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
+// exist in the cn DB, so a per-env whitelist (not billing-side validation)
+// is what prevents accidentally granting a USD-priced plan to a CN user.
+const PLANS_BY_ENV = {
+    stage: ['trial', 'starter', 'pro', 'enterprise'],
+    prod: ['trial', 'starter', 'pro', 'enterprise'],
+    'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+};
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
         console.log(`Usage: optima-grant-subscription <email> [options]
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
+                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod (default: stage)
   -h, --help        Show this help`);
         process.exit(0);
     }
     const email = args[0];
-    let plan = 'pro';
+    let plan = null;
     let months = 1;
     let env = 'stage';
     for (let i = 1; i < args.length; i++) {
@@ -28,103 +41,40 @@ Options:
             env = args[++i];
         }
     }
-    if (!['trial', 'starter', 'pro', 'enterprise'].includes(plan)) {
-        console.error(`Unknown plan: ${plan}. Available: trial, starter, pro, enterprise`);
+    (0, billing_http_1.validateEnvCnProd)(env);
+    plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+    const allowed = PLANS_BY_ENV[env];
+    if (!allowed.includes(plan)) {
+        console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
         process.exit(1);
     }
     if (months < 1) {
         console.error('Months must be >= 1');
         process.exit(1);
     }
-    if (!['stage', 'prod'].includes(env)) {
-        console.error('Env must be stage or prod (billing DB not available in CI)');
-        process.exit(1);
-    }
     return { email, plan, months, env };
 }
 async function main() {
     const { email, plan, months, env } = parseArgs(process.argv.slice(2));
-    const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
     console.log(`\n🎁 Granting ${plan} subscription to ${email} for ${months} month(s) [${env.toUpperCase()}]\n`);
-    const userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
-    const billing = await (0, db_utils_1.connectBillingDB)(env, infisicalConfig, token);
-    const bq = billing.query;
-    // Read plan config from DB
-    console.log(`Loading plan config: ${plan}`);
-    const planRow = bq(`SELECT name, monthly_credits, session_token_limit, weekly_token_limit FROM plans WHERE id='${(0, db_utils_1.escapeSQL)(plan)}'`);
-    if (!planRow) {
-        console.error(`❌ Plan not found in DB: ${plan}`);
-        process.exit(1);
+    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
+    // internal lookup API instead of the direct SQL path.
+    let userId;
+    if (env === 'cn-prod') {
+        userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
     }
-    const [planName, monthlyCreditsStr, sessionTokenLimitStr, weeklyTokenLimitStr] = planRow.split('|');
-    const monthlyCredits = parseInt(monthlyCreditsStr, 10);
-    const grantMicros = monthlyCredits * 10000; // 1 credit = $0.01 = 10,000 micros
-    const sessionTokenLimit = parseInt(sessionTokenLimitStr, 10);
-    const weeklyTokenLimit = parseInt(weeklyTokenLimitStr, 10);
-    console.log(`✓ Plan: ${planName} (grant: $${(grantMicros / 1000000).toFixed(2)}, session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
-    // Execute all mutations in a single transaction
-    const now = new Date().toISOString();
-    const periodEnd = new Date();
-    periodEnd.setMonth(periodEnd.getMonth() + months);
-    const periodEndISO = periodEnd.toISOString();
-    const sessionEnd = new Date(new Date().getTime() + 5 * 60 * 60 * 1000).toISOString();
-    const weekEnd = new Date(new Date().getTime() + 7 * 24 * 60 * 60 * 1000).toISOString();
-    const safeUserId = (0, db_utils_1.escapeSQL)(userId);
-    const safePlan = (0, db_utils_1.escapeSQL)(plan);
-    const safePlanName = (0, db_utils_1.escapeSQL)(planName);
-    console.log('Executing transaction...');
-    const txSQL = `
-BEGIN;
-
--- Cancel active subscriptions
-UPDATE subscriptions SET status='canceled', canceled_at='${now}'
-WHERE user_id='${safeUserId}' AND status IN ('active','trialing');
-
--- Create new subscription
-INSERT INTO subscriptions (id, user_id, plan_id, status, billing_interval, current_period_start, current_period_end, created_at, updated_at)
-VALUES (concat('sub_gift_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'active', 'monthly', '${now}', '${periodEndISO}', '${now}', '${now}');
-
--- Ensure wallet exists (upsert)
-INSERT INTO usd_wallets (id, user_id, balance_micros, reserved_micros, granted_balance_micros, created_at, updated_at)
-VALUES (gen_random_uuid(), '${safeUserId}', 0, 0, 0, '${now}', '${now}')
-ON CONFLICT (user_id) DO NOTHING;
-
--- Reset granted balance and set new grant
-UPDATE usd_wallets SET granted_balance_micros = ${grantMicros}, updated_at = '${now}'
-WHERE user_id = '${safeUserId}';
-
--- Record topup for audit trail
-INSERT INTO usd_wallet_topups (id, wallet_id, amount_micros, service_fee_micros, net_credit_micros, status, source, service_namespace, created_at, completed_at)
-SELECT gen_random_uuid(), w.id, ${grantMicros}, 0, ${grantMicros}, 'completed', 'subscription_grant', 'platform', '${now}', '${now}'
-FROM usd_wallets w WHERE w.user_id = '${safeUserId}';
-
--- Update existing active session quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${sessionTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_sess_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'session', ${sessionTokenLimit}, 0, '${now}', '${sessionEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='session' AND period_end > '${now}');
-
--- Update existing active weekly quota, or insert new one if none exists
-UPDATE token_quotas SET plan_id='${safePlan}', monthly_limit=${weeklyTokenLimit}, updated_at='${now}'
-WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}';
-
-INSERT INTO token_quotas (id, user_id, plan_id, period_type, monthly_limit, monthly_used, period_start, period_end, created_at, updated_at)
-SELECT concat('tq_week_', substr(md5(random()::text), 1, 16)), '${safeUserId}', '${safePlan}', 'weekly', ${weeklyTokenLimit}, 0, '${now}', '${weekEnd}', '${now}', '${now}'
-WHERE NOT EXISTS (SELECT 1 FROM token_quotas WHERE user_id='${safeUserId}' AND period_type='weekly' AND period_end > '${now}');
-
-COMMIT;
-  `.trim();
-    bq(txSQL);
-    console.log('✓ Old subscriptions canceled');
-    console.log(`✓ ${planName} subscription created (expires: ${periodEnd.toLocaleDateString()})`);
-    if (grantMicros > 0) {
-        console.log(`✓ Wallet granted $${(grantMicros / 1000000).toFixed(2)} (${monthlyCredits} credits equivalent)`);
+    else {
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
+        userId = await (0, db_utils_1.resolveUserId)(email, env, infisicalConfig, token);
     }
-    console.log(`✓ Token quotas updated (session: ${sessionTokenLimit.toLocaleString()}, weekly: ${weeklyTokenLimit.toLocaleString()})`);
-    console.log(`\n✅ Done! ${email} now has ${planName} plan until ${periodEnd.toLocaleDateString()}\n`);
+    const { body } = await (0, billing_http_1.callBilling)(env, 'POST', '/api/billing/admin/grant-subscription', { userId, planId: plan, months });
+    console.log(`✓ Subscription ${body.subscriptionId} (${body.planId})`);
+    console.log(`✓ Credits: ${body.credits.toLocaleString()} (expires ${body.expiresAt})`);
+    console.log(`✓ Token limits: session ${body.sessionTokenLimit.toLocaleString()} / weekly ${body.weeklyTokenLimit.toLocaleString()}`);
+    if (body.warning)
+        console.log(`⚠️  ${body.warning}`);
+    console.log(`\n✅ Done! ${email} now has ${body.planId} until ${body.expiresAt}\n`);
 }
 main().catch(error => {
     console.error('\n❌ Error:', error.message);

package/dist/bin/helpers/query-db.js

@@ -36,6 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const db_utils_1 = require("./db-utils");
 const SERVICE_DB_MAP = {
     'commerce-backend': {
         ci: { container: 'commerce-postgres', user: 'commerce', password: 'commerce123', database: 'commerce' },
@@ -113,64 +114,8 @@ const RDS_HOSTS = {
     stage: 'optima-stage-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com',
     prod: 'optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com'
 };
-// 统一使用 BI Data ARM Host 作为跳板机
-const EC2_HOST = '3.0.210.113';
-function parseDatabaseUrl(url) {
-    // postgresql://user:password@host:port/database?params
-    const match = url.match(/^postgresql:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)/);
-    if (!match) {
-        throw new Error(`Failed to parse DATABASE_URL: ${url}`);
-    }
-    return {
-        user: decodeURIComponent(match[1]),
-        password: decodeURIComponent(match[2]),
-        host: match[3],
-        port: parseInt(match[4]),
-        database: match[5]
-    };
-}
-function getGitHubVariable(name) {
-    return (0, child_process_1.execSync)(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-function getInfisicalConfig() {
-    return {
-        url: getGitHubVariable('INFISICAL_URL'),
-        clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-        clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-        projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-    };
-}
-function getInfisicalToken(config) {
-    const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
-    return JSON.parse(response).accessToken;
-}
-function getInfisicalSecrets(config, token, environment, secretPath) {
-    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
-    const data = JSON.parse(response);
-    const secrets = {};
-    for (const secret of data.secrets || []) {
-        secrets[secret.secretKey] = secret.secretValue;
-    }
-    return secrets;
-}
-function setupSSHTunnel(ec2Host, dbHost, localPort) {
-    // 检查是否已有隧道
-    try {
-        (0, child_process_1.execSync)(`lsof -ti:${localPort}`, { stdio: 'ignore' });
-        console.log(`✓ SSH tunnel already exists on port ${localPort}`);
-        return;
-    }
-    catch {
-        // 端口未占用，创建隧道
-    }
-    const sshKeyPath = `${process.env.HOME}/.ssh/optima-ec2-key`;
-    if (!fs.existsSync(sshKeyPath)) {
-        throw new Error(`SSH key not found: ${sshKeyPath}. Please obtain optima-ec2-key from xbfool.`);
-    }
-    console.log(`Creating SSH tunnel: localhost:${localPort} -> ${ec2Host} -> ${dbHost}:5432`);
-    (0, child_process_1.execSync)(`ssh -i ${sshKeyPath} -f -N -o StrictHostKeyChecking=no -L ${localPort}:${dbHost}:5432 ec2-user@${ec2Host}`, { stdio: 'inherit' });
-    console.log(`✓ SSH tunnel established on port ${localPort}`);
-}
+// parseDatabaseUrl 统一用 db-utils 的实现：右切 userinfo 容忍密码特殊字符，
+// 且报错不回显 URL（这里曾把含密码的完整 URL 打进错误信息）。
 function findPsqlPath() {
     // 1. 优先从 PATH 中查找
     const whichCmd = process.platform === 'win32' ? 'where psql' : 'which psql';
@@ -225,7 +170,7 @@ async function main() {
         console.error('Usage: query-db.ts <service> <sql> [environment]');
         console.error('');
         console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-        console.error('Environments: ci (default), stage, prod');
+        console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
         console.error('');
         console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
         process.exit(1);
@@ -236,6 +181,27 @@ async function main() {
         console.error('Available services:', Object.keys(SERVICE_DB_MAP).join(', '));
         process.exit(1);
     }
+    // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
+    // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
+    if ((0, db_utils_1.isCnEnv)(environment)) {
+        const prodCfg = SERVICE_DB_MAP[service].prod;
+        let db;
+        if (prodCfg?.userKey) {
+            const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
+            console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
+            db = (0, db_utils_1.connectCnDB)(prefix);
+        }
+        else if (prodCfg?.databaseUrlPath) {
+            console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+            db = (0, db_utils_1.connectCnDBFromUrl)(prodCfg.databaseUrlPath);
+        }
+        else {
+            console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+            process.exit(1);
+        }
+        console.log('\n' + db.query(sql));
+        return;
+    }
     const serviceConfig = SERVICE_DB_MAP[service][environment];
     if (!serviceConfig) {
         console.error(`Service ${service} is not available in ${environment.toUpperCase()} environment.`);
@@ -247,18 +213,18 @@ async function main() {
     console.log(`\n🔍 Querying ${service} (${environment.toUpperCase()})...`);
     if (environment === 'ci') {
         // CI 环境：通过 SSH + Docker Exec
-        const ciUser = getGitHubVariable('CI_SSH_USER');
-        const ciHost = getGitHubVariable('CI_SSH_HOST');
-        const ciPassword = getGitHubVariable('CI_SSH_PASSWORD');
+        const ciUser = (0, db_utils_1.getGitHubVariable)('CI_SSH_USER');
+        const ciHost = (0, db_utils_1.getGitHubVariable)('CI_SSH_HOST');
+        const ciPassword = (0, db_utils_1.getGitHubVariable)('CI_SSH_PASSWORD');
         const { container, user, database } = serviceConfig;
         const result = (0, child_process_1.execSync)(`sshpass -p "${ciPassword}" ssh -o StrictHostKeyChecking=no ${ciUser}@${ciHost} "docker exec ${container} psql -U ${user} -d ${database} -c \\"${sql}\\""`, { encoding: 'utf-8' });
         console.log('\n' + result);
     }
     else {
         // Stage/Prod 环境：通过 SSH 隧道访问 RDS
-        const infisicalConfig = getInfisicalConfig();
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = getInfisicalToken(infisicalConfig);
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
         const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
         let dbUser;
@@ -268,13 +234,13 @@ async function main() {
         if ('databaseUrlPath' in serviceConfig) {
             // 从服务路径获取 DATABASE_URL 并解析
             const { databaseUrlPath, databaseUrlKey } = serviceConfig;
-            const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, databaseUrlPath);
+            const secrets = (0, db_utils_1.getInfisicalSecrets)(infisicalConfig, token, infisicalEnv, databaseUrlPath);
             console.log(`✓ Retrieved DATABASE_URL from Infisical (path: ${databaseUrlPath})`);
             const databaseUrl = secrets[databaseUrlKey];
             if (!databaseUrl) {
                 throw new Error(`DATABASE_URL not found in Infisical at ${databaseUrlPath}`);
             }
-            const parsed = parseDatabaseUrl(databaseUrl);
+            const parsed = (0, db_utils_1.parseDatabaseUrl)(databaseUrl);
             dbUser = parsed.user;
             dbPassword = parsed.password;
             dbHost = parsed.host;
@@ -282,7 +248,7 @@ async function main() {
         }
         else {
             // 从 shared-secrets/database-users 获取凭证
-            const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
+            const secrets = (0, db_utils_1.getInfisicalSecrets)(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
             console.log('✓ Retrieved database credentials from Infisical');
             const { userKey, passwordKey } = serviceConfig;
             database = serviceConfig.database;
@@ -293,10 +259,7 @@ async function main() {
                 throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
             }
         }
-        const localPort = environment === 'stage' ? 15432 : 15433;
-        setupSSHTunnel(EC2_HOST, dbHost, localPort);
-        // 等待隧道建立
-        await new Promise(resolve => setTimeout(resolve, 1000));
+        const localPort = (0, db_utils_1.ensureTunnel)(dbHost);
         const result = queryDatabase('localhost', localPort, dbUser, dbPassword, database, sql);
         console.log('\n' + result);
     }

package/dist/bin/helpers/show-env.js

@@ -2,6 +2,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
+const db_utils_1 = require("./db-utils");
 // 支持的服务列表（Infisical 路径为 /services/<service-name>）
 const SUPPORTED_SERVICES = [
     'ads-backend',
@@ -35,21 +36,8 @@ const ENV_MAP = {
     stage: 'staging',
     prod: 'prod'
 };
-function getGitHubVariable(name) {
-    return (0, child_process_1.execSync)(`gh variable get ${name} -R Optima-Chat/optima-dev-skills`, { encoding: 'utf-8' }).trim();
-}
-function getInfisicalConfig() {
-    return {
-        url: getGitHubVariable('INFISICAL_URL'),
-        clientId: getGitHubVariable('INFISICAL_CLIENT_ID'),
-        clientSecret: getGitHubVariable('INFISICAL_CLIENT_SECRET'),
-        projectId: getGitHubVariable('INFISICAL_PROJECT_ID')
-    };
-}
-function getInfisicalToken(config) {
-    const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
-    return JSON.parse(response).accessToken;
-}
+// NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
+// unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config, token, environment, secretPath) {
     const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
     const data = JSON.parse(response);
@@ -122,9 +110,9 @@ async function main() {
     const secretPath = `/services/${service}`;
     console.log(`\n🔍 Fetching environment variables for ${service} (${environment.toUpperCase()})...\n`);
     try {
-        const infisicalConfig = getInfisicalConfig();
+        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
         console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = getInfisicalToken(infisicalConfig);
+        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
         const infisicalEnv = ENV_MAP[environment];
         const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);