@optima-chat/dev-skills 0.7.43 → 0.8.0

package/.claude/skills/grant-balance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "grant-balance"
-description: "当用户请求赠送余额、充值 USD 余额、grant balance、加余额、奖励、补偿、推荐奖励、运营发放时，使用此技能。支持 Stage、Prod、cn-prod 三个环境。"
+description: "当用户请求赠送余额、充值 USD 余额、grant balance、加余额、奖励、补偿、推荐奖励、运营发放时，使用此技能。支持 Stage、Prod、cn-prod、cn-stage 四个环境。"
 allowed-tools: ["Bash"]
 ---
 
@@ -50,9 +50,11 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `<email>` | 用户邮箱（必填） | - |
 | `--amount <usd>` | USD 金额（必填，> 0） | - |
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
-| `--env <env>` | 环境：stage, prod, cn-prod | stage |
+| `--env <env>` | 环境：stage, prod, cn-prod, cn-stage | stage |
 
 > **cn-prod（国内环境）**：全程 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找走 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分，与 CN ¥1 = 100 积分同一账本单位）。例：`optima-grant-balance user@example.com --amount 1 --env cn-prod`
+>
+> **cn-stage（阿里云预发）**：同 cn-prod 走 HTTPS（auth.stage.optima.chat / billing-api.stage.optima.chat）。M2M 凭证读 cn Infisical **staging** /shared-secrets/oauth-clients，运行时需 `INFISICAL_CN_EMAIL`/`INFISICAL_CN_PASSWORD`（admin user）。例：`optima-grant-balance user@example.com --amount 1 --env cn-stage`
 
 ## 与 grant-subscription 的区别
 

package/.claude/skills/grant-subscription/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "grant-subscription"
-description: "当用户请求开通会员、赠送订阅、grant subscription、开通 Pro/Starter/Enterprise、升级计划、给用户开会员时，使用此技能。支持 Stage、Prod、cn-prod 三个环境。"
+description: "当用户请求开通会员、赠送订阅、grant subscription、开通 Pro/Starter/Enterprise、升级计划、给用户开会员时，使用此技能。支持 Stage、Prod、cn-prod、cn-stage 四个环境。"
 allowed-tools: ["Bash"]
 ---
 
@@ -50,6 +50,10 @@ optima-grant-subscription user@example.com --plan enterprise --env prod
 # cn-prod（国内环境）：plan 用 -cn 档，默认 pro-cn
 optima-grant-subscription user@example.com --env cn-prod
 optima-grant-subscription user@example.com --plan starter-cn --env cn-prod
+
+# cn-stage（阿里云预发）：同 cn-prod 用 -cn 档；需 INFISICAL_CN_EMAIL/PASSWORD。
+# ⚠️ cn-stage billing 的 plan 目录可能未 seed（报 403 Plan not found）——属 cn-stage 基建缺口，非本工具问题。
+optima-grant-subscription user@example.com --plan pro-cn --env cn-stage
 ```
 
 ### 参数说明

package/.codex/skills/grant-balance/SKILL.md

@@ -49,9 +49,10 @@ optima-grant-balance user@example.com --amount 20 --description "服务中断补
 | `<email>` | 用户邮箱（必填） | - |
 | `--amount <usd>` | USD 金额（必填，> 0） | - |
 | `--description <text>` | 描述/原因（仅 console 输出） | - |
-| `--env <env>` | 环境：stage, prod, cn-prod | stage |
+| `--env <env>` | 环境：stage, prod, cn-prod, cn-stage | stage |
 
 > **cn-prod**：走 HTTPS（auth.yzsgo.com / billing-api.yzsgo.com），email 查找经 user-auth internal lookup API（无 SSH 隧道）。金额输入仍是 USD（$1 = 700 积分 = ¥7 档积分口径一致）。
+> **cn-stage（阿里云预发）**：同 cn-prod 走 HTTPS（auth.stage.optima.chat / billing-api.stage.optima.chat）；M2M 凭证读 cn Infisical staging，需 `INFISICAL_CN_EMAIL`/`INFISICAL_CN_PASSWORD`。
 
 ## 与 grant-subscription 的区别
 

package/.codex/skills/grant-subscription/SKILL.md

@@ -25,12 +25,16 @@ optima-grant-subscription user@example.com --plan enterprise --env prod
 # cn-prod（国内环境）：plan 用 -cn 档，默认 pro-cn
 optima-grant-subscription user@example.com --env cn-prod
 optima-grant-subscription user@example.com --plan starter-cn --env cn-prod
+
+# cn-stage（阿里云预发）：同 cn-prod 用 -cn 档；需 INFISICAL_CN_EMAIL/PASSWORD。
+# ⚠️ cn-stage billing plan 目录可能未 seed（403 Plan not found）——cn-stage 基建缺口，非本工具问题。
+optima-grant-subscription user@example.com --plan pro-cn --env cn-stage
 ```
 
 ## Guidance
 
 - Default to `stage`.
-- Confirm the user email before running on `prod` / `cn-prod`.
-- `cn-prod` plans are the CNY-priced `-cn` ids (`starter-cn`, `pro-cn`, `enterprise-cn`, plus `trial`); bare USD ids are rejected client-side to avoid granting a USD-priced plan to a CN user.
+- Confirm the user email before running on `prod` / `cn-prod` / `cn-stage`.
+- `cn-prod` / `cn-stage` plans are the CNY-priced `-cn` ids (`starter-cn`, `pro-cn`, `enterprise-cn`, plus `trial`); bare USD ids are rejected client-side to avoid granting a USD-priced plan to a CN user.
 - This operation replaces existing subscription state and resets the wallet granted balance according to the selected plan.
 - Use `optima-query-db` afterward if the user asks for verification.

package/bin/cli.js

@@ -44,7 +44,7 @@ switch (command) {
     log('  session-gateway  optima-scout  billing  browser-backend  optima-generation', 'cyan');
 
     log('\nEnvironments:', 'yellow');
-    log('  stage (default)   prod', 'cyan');
+    log('  stage (default)   prod   cn-prod (阿里云生产)   cn-stage (阿里云预发)', 'cyan');
 
     log('\nExamples:', 'yellow');
     log('  /logs commerce-backend 100 prod', 'cyan');

package/bin/helpers/billing-http.ts

@@ -1,19 +1,22 @@
 import { execSync } from 'child_process';
 import { fetchInfisicalSecret } from './infisical-secrets';
-import { getInfisicalConfig, getInfisicalToken } from './db-utils';
+import { getInfisicalConfig, getInfisicalToken, getCnInfisicalToken, getCnSecrets } from './db-utils';
 
 const USER_AUTH_URLS: Record<string, string> = {
   stage: 'https://auth.stage.optima.onl',
   prod: 'https://auth.optima.onl',
   // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 auth-cn.optima.chat 路由已下线
   'cn-prod': 'https://auth.yzsgo.com',
+  // cn-stage（阿里云预发，独立于 AWS stage `.optima.onl`）
+  'cn-stage': 'https://auth.stage.optima.chat',
 };
 
-// cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
+// cn URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
 // separate instance dev-skills has no machine identity for, and these domains
 // are stable. AWS envs keep reading /shared-secrets/domain-urls.
 // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 billing-cn.optima.chat 路由已下线
 const CN_PROD_BILLING_URL = 'https://billing-api.yzsgo.com';
+const CN_STAGE_BILLING_URL = 'https://billing-api.stage.optima.chat';
 
 /**
  * Validate the --env flag value at command entry, before any I/O.
@@ -39,9 +42,9 @@ export function validateEnv(env: string): 'stage' | 'prod' {
  * exist for cn-prod (Aliyun VPC-internal RDS) — keep them on validateEnv so a
  * cn-prod typo fails fast instead of dying inside the tunnel setup.
  */
-export function validateEnvCnProd(env: string): 'stage' | 'prod' | 'cn-prod' {
-  if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod') {
-    throw new Error(`--env must be "stage", "prod" or "cn-prod" (got: ${env})`);
+export function validateEnvCnProd(env: string): 'stage' | 'prod' | 'cn-prod' | 'cn-stage' {
+  if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod' && env !== 'cn-stage') {
+    throw new Error(`--env must be "stage", "prod", "cn-prod" or "cn-stage" (got: ${env})`);
   }
   return env;
 }
@@ -84,6 +87,7 @@ const skillsUrlCache: Record<string, string> = {};
 
 function getBillingUrl(env: string): string {
   if (env === 'cn-prod') return CN_PROD_BILLING_URL;
+  if (env === 'cn-stage') return CN_STAGE_BILLING_URL;
   if (billingUrlCache[env]) return billingUrlCache[env];
   const url = fetchInfisicalSecret(env, '/shared-secrets/domain-urls', 'BILLING_URL');
   billingUrlCache[env] = url;
@@ -100,17 +104,33 @@ function getSkillsUrl(env: string): string {
 export function getServiceToken(env: string): string {
   if (tokenCache[env]) return tokenCache[env];
 
-  const cfg = getInfisicalConfig();
-  const tok = getInfisicalToken(cfg);
-  // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
-  // cn-prod credentials are mirrored in the AWS Infisical *prod* environment
-  // (fetchInfisicalSecret has no cn-prod env slug), under CN-specific keys.
-  const isCn = env === 'cn-prod';
-  const infisicalEnv = isCn ? 'prod' : env;
-  const idKey = isCn ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
-  const secretKey = isCn ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
-  const clientId = fetchInfisicalSecret(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
-  const clientSecret = fetchInfisicalSecret(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+  // cn-prod 与 cn-stage 都用 client_credentials M2M token，scope=internal:users:write。
+  // 凭证来源不同：
+  //  · cn-prod —— 镜像在 AWS Infisical prod 环境（CN_PROD_ 前缀键），复用既有 AWS 访问。
+  //  · cn-stage —— canonical 在 cn Infisical staging /shared-secrets/oauth-clients
+  //    （dev-skills 无该 client 的 AWS 镜像；用 admin email/password 直读，
+  //     运行时需 INFISICAL_CN_EMAIL/PASSWORD，与 query-db cn 同一前提）。
+  const isCn = env === 'cn-prod' || env === 'cn-stage';
+  let clientId: string;
+  let clientSecret: string;
+  if (env === 'cn-stage') {
+    const cnTok = getCnInfisicalToken();
+    const oc = getCnSecrets(cnTok, '/shared-secrets/oauth-clients', false, 'staging');
+    clientId = oc['DEV_SKILLS_OAUTH_CLIENT_ID'];
+    clientSecret = oc['DEV_SKILLS_OAUTH_CLIENT_SECRET'];
+    if (!clientId || !clientSecret) {
+      throw new Error('cn-stage dev-skills OAuth client 凭证缺失（cn Infisical staging /shared-secrets/oauth-clients 的 DEV_SKILLS_OAUTH_CLIENT_ID/SECRET）。');
+    }
+  } else {
+    const cfg = getInfisicalConfig();
+    const tok = getInfisicalToken(cfg);
+    // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
+    const infisicalEnv = env === 'cn-prod' ? 'prod' : env;
+    const idKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
+    const secretKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
+    clientId = fetchInfisicalSecret(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
+    clientSecret = fetchInfisicalSecret(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+  }
 
   const authUrl = USER_AUTH_URLS[env];
   if (!authUrl) throw new Error(`Unknown env: ${env}`);

package/bin/helpers/db-utils.ts

@@ -29,15 +29,33 @@ const EC2_HOST = '3.0.210.113';
 // ─── cn-prod (阿里云) 常量 ────────────────────────────────────────────────────
 // cn-prod 跑在阿里云 SAE，与海外 AWS 完全独立：独立 Infisical (secrets-cn.optima.chat)
 // + 内网 RDS（无公网端点）经 buildbox ECS 跳板 SSH 隧道访问。设计见 optima-dev-skills#21。
+// cn Infisical 是【单实例双环境】：prod=cn-prod、staging=cn-stage（URL/org/project 共享，
+// 只切 environment 参数）。cn-stage 数据面共用 prod VPC，故走【同一 buildbox】跳板。
 const CN_INFISICAL_URL     = process.env.INFISICAL_CN_URL     || 'https://secrets-cn.optima.chat';
 const CN_INFISICAL_ORG     = process.env.INFISICAL_CN_ORG     || 'f44012fa-0659-4f7e-b0ac-ed01244efc8a';
 const CN_INFISICAL_PROJECT = process.env.INFISICAL_CN_PROJECT || '4deef229-11be-40a5-8f56-b61f0bce7240';
-const CN_RDS_HOST          = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com';
+const CN_RDS_HOST          = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com'; // cn-prod RDS
+const CN_STAGE_RDS_HOST    = 'pgm-2zem1u9zdh06boim.pg.rds.aliyuncs.com'; // cn-stage RDS（独立实例，共用 prod VPC）
 const CN_BUILDBOX_HOST     = process.env.OPTIMA_CN_BUILDBOX_HOST || '47.94.105.163';
 
-/** env 是否指向 cn-prod（阿里云）。接受 `cn` / `cn-prod`。 */
+/** env 是否指向阿里云（cn-prod 或 cn-stage）。接受 `cn` / `cn-prod` / `cn-stage`。 */
 export function isCnEnv(env: string): boolean {
-  return env === 'cn' || env === 'cn-prod';
+  return env === 'cn' || env === 'cn-prod' || env === 'cn-stage';
+}
+
+/** env 是否指向 cn-stage（阿里云预发）。 */
+export function isCnStageEnv(env: string): boolean {
+  return env === 'cn-stage';
+}
+
+/** cn env → cn Infisical environment slug。cn-stage→staging，其余 cn→prod。 */
+export function cnInfisicalEnv(env: string): 'prod' | 'staging' {
+  return env === 'cn-stage' ? 'staging' : 'prod';
+}
+
+/** cn env → 内网 RDS host。cn-stage→stage 实例，其余 cn→prod 实例。 */
+export function cnRdsHost(env: string): string {
+  return env === 'cn-stage' ? CN_STAGE_RDS_HOST : CN_RDS_HOST;
 }
 
 // ─── SQL escaping ───────────────────────────────────────────────────────────
@@ -117,10 +135,13 @@ export function getCnInfisicalToken(): string {
   return org.token;
 }
 
-/** 读 cn Infisical 某 folder（prod env）→ key→value map。expand=true 让服务端解析 `${...}` 引用。 */
-export function getCnSecrets(token: string, secretPath: string, expand = false): Record<string, string> {
+/**
+ * 读 cn Infisical 某 folder → key→value map。expand=true 让服务端解析 `${...}` 引用。
+ * environment：cn-prod 用 `prod`、cn-stage 用 `staging`（同一实例双环境）。
+ */
+export function getCnSecrets(token: string, secretPath: string, expand = false, environment: 'prod' | 'staging' = 'prod'): Record<string, string> {
   const data = curlJson([
-    `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=prod&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
+    `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
     '-H', `Authorization: Bearer ${token}`,
   ]);
   const secrets: Record<string, string> = {};
@@ -417,17 +438,18 @@ export function queryDB(conn: DBConnection, sql: string): string {
  * 连 cn-prod 某服务库：creds 取自 cn Infisical 的 /shared-secrets/database-users +
  * /database-names（按 prefix，如 AUTH/BILLING），经 buildbox 跳板隧道（动态端口）。
  */
-export function connectCnDB(prefix: string): { query: (sql: string) => string } {
+export function connectCnDB(prefix: string, cnEnv: string = 'cn-prod'): { query: (sql: string) => string } {
+  const infEnv = cnInfisicalEnv(cnEnv);
   const token = getCnInfisicalToken();
-  const users = getCnSecrets(token, '/shared-secrets/database-users');
-  const names = getCnSecrets(token, '/shared-secrets/database-names');
+  const users = getCnSecrets(token, '/shared-secrets/database-users', false, infEnv);
+  const names = getCnSecrets(token, '/shared-secrets/database-names', false, infEnv);
   const user = users[`${prefix}_DB_USER`];
   const password = users[`${prefix}_DB_PASSWORD`];
   const database = names[`${prefix}_DB_NAME`];
   if (!user || !password || !database) {
     throw new Error(`cn DB creds 不全 for ${prefix}（需 ${prefix}_DB_USER/PASSWORD@database-users + ${prefix}_DB_NAME@database-names）。该服务 cn 可能用字面 DATABASE_URL，见 optima-dev-skills#21。`);
   }
-  const port = ensureTunnel(CN_RDS_HOST, 'cn-buildbox');
+  const port = ensureTunnel(cnRdsHost(cnEnv), 'cn-buildbox');
   const conn: DBConnection = { host: 'localhost', port, user, password, database };
   return { query: (sql: string) => queryDB(conn, sql) };
 }
@@ -437,9 +459,9 @@ export function connectCnDB(prefix: string): { query: (sql: string) => string }
  * 用于 cred 不在 shared-secrets/database-users 的服务（如 gateway-core）。
  * expandSecretReferences=true 让 cn Infisical 解析 `${...}` 引用为字面值。
  */
-export function connectCnDBFromUrl(servicePath: string): { query: (sql: string) => string } {
+export function connectCnDBFromUrl(servicePath: string, cnEnv: string = 'cn-prod'): { query: (sql: string) => string } {
   const token = getCnInfisicalToken();
-  const secrets = getCnSecrets(token, servicePath, true);
+  const secrets = getCnSecrets(token, servicePath, true, cnInfisicalEnv(cnEnv));
   const dbUrl = secrets['DATABASE_URL'];
   if (!dbUrl) throw new Error(`cn DATABASE_URL 未找到 at ${servicePath}`);
   // 注意：DATABASE_URL 含凭证，报错只说事实，不回显值

package/bin/helpers/generate-test-token.ts

@@ -24,7 +24,7 @@ interface MerchantSetupResponse {
   user_id: string;
 }
 
-type Environment = 'ci' | 'stage' | 'prod' | 'cn-prod';
+type Environment = 'ci' | 'stage' | 'prod' | 'cn-prod' | 'cn-stage';
 
 interface EnvironmentConfig {
   authUrl: string;
@@ -60,6 +60,14 @@ const ENV_CONFIG: Record<Environment, EnvironmentConfig> = {
     // 注意不要换成同名的 confidential client `commerce-cli-cn-prod-*`，那个需要 client_secret，走不通 CLI 的 public ROPC flow。
     clientId: 'dev-skill-cli-cn-pro-acvkmcuq',
     envName: 'cn-prod'
+  },
+  'cn-stage': {
+    // 阿里云预发（独立于 AWS stage `.optima.onl`）。域名 *.stage.optima.chat。
+    authUrl: 'https://auth.stage.optima.chat',
+    apiUrl: 'https://commerce.stage.optima.chat',
+    // cn-stage user-auth 里注册的 public client（开 password grant，ROPC flow）。
+    clientId: 'dev-skill-cli-cn-sta-3dvsxzdo',
+    envName: 'cn-stage'
   }
 };
 
@@ -183,6 +191,7 @@ async function main() {
   let phone: string | undefined;
   let address: string | undefined;
   let environment: Environment = 'ci';
+  let skipMerchant = false;
 
   // 解析命令行参数
   for (let i = 0; i < args.length; i++) {
@@ -198,12 +207,14 @@ async function main() {
       phone = args[++i];
     } else if (arg === '--address' && args[i + 1]) {
       address = args[++i];
+    } else if (arg === '--skip-merchant') {
+      skipMerchant = true;
     } else if (arg === '--env' && args[i + 1]) {
       const envArg = args[++i];
-      if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod') {
+      if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod' || envArg === 'cn-stage') {
         environment = envArg as Environment;
       } else {
-        console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', or 'cn-prod'.`);
+        console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', 'cn-prod', or 'cn-stage'.`);
         process.exit(1);
       }
     } else if (arg === '--help' || arg === '-h') {
@@ -216,20 +227,24 @@ Options:
   --business-name <name>       Merchant business name (default: auto-generated)
   --phone <phone>              Merchant phone number (optional)
   --address <address>          Merchant address (optional)
-  --env <environment>          Environment: ci (default), stage, prod, or cn-prod
+  --skip-merchant              只注册用户 + 拿 token，跳过 Commerce merchant profile 设置
+                               （token-only；用于 gateway E2E、或 commerce 未就绪的环境）
+  --env <environment>          Environment: ci (default), stage, prod, cn-prod, or cn-stage
   --help, -h                   Show this help message
 
 Environments:
-  ci       CI 环境 (auth.optima.chat, api.optima.chat)
-  stage    Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
-  prod     Prod 环境 (auth.optima.onl, api.optima.onl)
-  cn-prod  阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
+  ci        CI 环境 (auth.optima.chat, api.optima.chat)
+  stage     Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
+  prod      Prod 环境 (auth.optima.onl, api.optima.onl)
+  cn-prod   阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
+  cn-stage  阿里云预发环境 (auth.stage.optima.chat, commerce.stage.optima.chat)
 
 Example:
   optima-generate-test-token
   optima-generate-test-token --env stage
   optima-generate-test-token --env prod
   optima-generate-test-token --env cn-prod
+  optima-generate-test-token --env cn-stage
   optima-generate-test-token --business-name "My Test Shop" --env stage
       `);
       process.exit(0);
@@ -254,8 +269,11 @@ Example:
     // 2. 获取 token
     const token = await getToken(email, password, config);
 
-    // 3. 设置 merchant profile（Commerce API）
-    const merchantProfile = await setupMerchantProfile(token, businessName, config);
+    // 3. 设置 merchant profile（Commerce API）；--skip-merchant 时跳过（token-only）
+    const merchantProfile = skipMerchant
+      ? { merchant_id: 'N/A (skipped)' } as MerchantSetupResponse
+      : await setupMerchantProfile(token, businessName, config);
+    if (skipMerchant) console.log('\n⏭️  Skipped merchant profile setup (--skip-merchant)');
 
     // 4. 保存 token 到临时文件
     const tmpDir = os.tmpdir();

package/bin/helpers/grant-balance.ts

@@ -19,13 +19,14 @@ $1 = 700 credits (P15 unified ledger; the USD wallet is retired).
 Options:
   --amount <usd>        USD amount to grant (required, e.g. 5 for $5.00 = 3500 credits)
   --description <text>  Description for audit trail (optional)
-  --env <env>           Environment: stage, prod, cn-prod (default: stage)
+  --env <env>           Environment: stage, prod, cn-prod, cn-stage (default: stage)
   -h, --help            Show this help
 
 Examples:
   optima-grant-balance user@example.com --amount 5 --env prod
   optima-grant-balance user@example.com --amount 10 --description "Service outage compensation"
-  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)`);
+  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)
+  optima-grant-balance user@example.com --amount 1 --env cn-stage  # 阿里云预发`);
     process.exit(0);
   }
 
@@ -55,10 +56,10 @@ async function main() {
   console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} (${Math.round(amountUsd * 700)} credits) to ${email} [${env.toUpperCase()}]\n`);
   if (description) console.log(`   Reason: ${description}`);
 
-  // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-  // internal lookup API instead of the direct SQL path.
+  // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
+  // user-auth's internal lookup API instead of the direct SQL path.
   let userId: string;
-  if (env === 'cn-prod') {
+  if (env === 'cn-prod' || env === 'cn-stage') {
     userId = await resolveUserIdByEmail(env, email);
   } else {
     const infisicalConfig = getInfisicalConfig();

package/bin/helpers/grant-subscription.ts

@@ -60,7 +60,7 @@ export function assertPhoneMatch(inputPhone: string, accountPhone: string | null
  */
 export function assertAwsEmailOnly(env: string, kind: 'email' | 'phone' | 'userId'): void {
   if ((env === 'stage' || env === 'prod') && kind !== 'email') {
-    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod / cn-stage 可用');
   }
 }
 
@@ -71,6 +71,8 @@ const PLANS_BY_ENV: Record<string, string[]> = {
   stage: ['trial', 'starter', 'pro', 'enterprise'],
   prod: ['trial', 'starter', 'pro', 'enterprise'],
   'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+  // cn-stage 卖同一套 CNY -cn plan（billing plan 目录与 cn-prod 一致）
+  'cn-stage': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
 };
 
 function parseArgs(args: string[]): { identifier: string; plan: string; months: number; env: string } {
@@ -79,9 +81,9 @@ function parseArgs(args: string[]): { identifier: string; plan: string; months:
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
-                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
+                    cn-prod/cn-stage plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod, cn-prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod, cn-stage (default: stage)
   -h, --help        Show this help`);
     process.exit(0);
   }
@@ -98,7 +100,7 @@ Options:
   }
 
   validateEnvCnProd(env);
-  plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+  plan = plan ?? (env === 'cn-prod' || env === 'cn-stage' ? 'pro-cn' : 'pro');
   const allowed = PLANS_BY_ENV[env];
   if (!allowed.includes(plan)) {
     console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
@@ -118,13 +120,13 @@ async function main() {
 
   // identity is the verified target account to print on success. AWS keeps the
   // pre-change behavior (email-only, no internal HTTP reverse-verify); only
-  // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
+  // cn-prod / cn-stage run the full classify→resolve→getUserById→phone-assert防呆 path.
   let userId: string;
   let identity: { phone: string | null; email: string | null };
 
-  if (env === 'cn-prod') {
-    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
-    // and its dev-skills token carries internal:users:write for the lookups.
+  if (env === 'cn-prod' || env === 'cn-stage') {
+    // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
+    // user-auth, and the dev-skills token carries internal:users:write for lookups.
     if (kind === 'userId') {
       userId = identifier;
     } else if (kind === 'phone') {

package/bin/helpers/query-db.ts

@@ -157,7 +157,7 @@ async function main() {
     console.error('Usage: query-db.ts <service> <sql> [environment]');
     console.error('');
     console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-    console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
+    console.error('Environments: ci (default), stage, prod, cn-prod (阿里云生产), cn-stage (阿里云预发)');
     console.error('');
     console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
     process.exit(1);
@@ -174,17 +174,20 @@ async function main() {
   // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
   // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
   if (isCnEnv(environment)) {
+    // cn-prod / cn-stage 共用 SERVICE_DB_MAP[*].prod 的 userKey/databaseUrlPath（prefix、
+    // /services/<svc> 路径两环境一致）；connectCn* 按 env 切 cn Infisical 环境 + RDS 实例。
+    const label = environment === 'cn-stage' ? 'CN-STAGE' : 'CN-PROD';
     const prodCfg = SERVICE_DB_MAP[service as keyof typeof SERVICE_DB_MAP].prod as any;
     let db: { query: (sql: string) => string };
     if (prodCfg?.userKey) {
       const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
-      console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
-      db = connectCnDB(prefix);
+      console.log(`\n🔍 Querying ${service} (${label}, prefix ${prefix})...`);
+      db = connectCnDB(prefix, environment);
     } else if (prodCfg?.databaseUrlPath) {
-      console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
-      db = connectCnDBFromUrl(prodCfg.databaseUrlPath);
+      console.log(`\n🔍 Querying ${service} (${label}, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+      db = connectCnDBFromUrl(prodCfg.databaseUrlPath, environment);
     } else {
-      console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+      console.error(`${label} query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
       process.exit(1);
     }
     console.log('\n' + db.query(sql));

package/bin/helpers/show-env.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { execSync } from 'child_process';
-import { getInfisicalConfig, getInfisicalToken, InfisicalConfig } from './db-utils';
+import { getInfisicalConfig, getInfisicalToken, InfisicalConfig, isCnEnv, cnInfisicalEnv, getCnInfisicalToken, getCnSecrets } from './db-utils';
 
 // 支持的服务列表（Infisical 路径为 /services/<service-name>）
 const SUPPORTED_SERVICES = [
@@ -32,12 +32,17 @@ const SUPPORTED_SERVICES = [
   'shopify-backend',
 ];
 
-// 环境到 Infisical environment 的映射
+// 环境到 AWS Infisical environment 的映射（cn 走独立 cn Infisical，见下方分支）
 const ENV_MAP: Record<string, string> = {
   stage: 'staging',
   prod: 'prod'
 };
 
+/** 该 environment 是否被支持（AWS stage/prod 或阿里云 cn-prod/cn-stage）。 */
+function isSupportedEnv(env: string): boolean {
+  return ENV_MAP[env] !== undefined || isCnEnv(env);
+}
+
 // NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
 // unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
@@ -60,17 +65,22 @@ Usage: optima-show-env <service> <environment> [options]
 
 Arguments:
   service      Service name (${SUPPORTED_SERVICES.join(', ')})
-  environment  Environment (stage, prod)
+  environment  Environment (stage, prod, cn-prod, cn-stage)
 
 Options:
   --filter     Filter by key pattern (e.g., --filter DATABASE)
   --keys-only  Show only key names, not values
   --help       Show this help message
 
+Note:
+  cn-prod / cn-stage 读阿里云 cn Infisical（需 INFISICAL_CN_EMAIL/PASSWORD 环境变量，
+  admin user，见 optima-dev-skills#21）。stage/prod 读 AWS Infisical（GitHub Variables）。
+
 Examples:
   optima-show-env commerce-backend stage
   optima-show-env user-auth prod --filter DATABASE
-  optima-show-env bi stage --keys-only
+  optima-show-env gateway-core cn-stage
+  optima-show-env bi-backend stage --keys-only
 `);
 }
 
@@ -114,9 +124,9 @@ async function main() {
   }
 
   // 验证环境
-  if (!ENV_MAP[environment]) {
+  if (!isSupportedEnv(environment)) {
     console.error(`Error: Unknown environment '${environment}'`);
-    console.error('Available environments: stage, prod');
+    console.error('Available environments: stage, prod, cn-prod, cn-stage');
     process.exit(1);
   }
 
@@ -126,15 +136,24 @@ async function main() {
   console.log(`\n🔍 Fetching environment variables for ${service} (${environment.toUpperCase()})...\n`);
 
   try {
-    const infisicalConfig = getInfisicalConfig();
-    console.log('✓ Loaded Infisical config from GitHub Variables');
-
-    const token = getInfisicalToken(infisicalConfig);
-    console.log('✓ Obtained Infisical access token');
-
-    const infisicalEnv = ENV_MAP[environment];
-    const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
-    console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+    let secrets: Record<string, string>;
+    if (isCnEnv(environment)) {
+      // 阿里云 cn Infisical（独立实例，admin email/password 认证；prod / staging 双环境）
+      const cnToken = getCnInfisicalToken();
+      console.log('✓ Obtained cn Infisical access token');
+      secrets = getCnSecrets(cnToken, secretPath, false, cnInfisicalEnv(environment));
+      console.log(`✓ Retrieved secrets from cn Infisical (env: ${cnInfisicalEnv(environment)}, path: ${secretPath})\n`);
+    } else {
+      const infisicalConfig = getInfisicalConfig();
+      console.log('✓ Loaded Infisical config from GitHub Variables');
+
+      const token = getInfisicalToken(infisicalConfig);
+      console.log('✓ Obtained Infisical access token');
+
+      const infisicalEnv = ENV_MAP[environment];
+      secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
+      console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+    }
 
     const keys = Object.keys(secrets).sort();
 

package/bin/helpers/verify-health.ts

@@ -29,22 +29,23 @@ import { promises as dns } from 'node:dns';
 import * as tls from 'node:tls';
 import * as https from 'node:https';
 
-type Env = 'stage' | 'prod' | 'cn';
-interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; }
+type Env = 'stage' | 'prod' | 'cn' | 'cn-stage';
+interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; 'cn-stage'?: string; 'cn-stage_path'?: string; }
 
 // 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
 // cn-prod 真实 subdomain 抄自 optima-terraform alicloud/stacks/cn-prod-ingress-sae/main.tf。
 // #201 (2026-06-12): yzsgo.com 全量迁移完成,旧 *-cn.optima.chat 路由已下线。
+// cn-stage（阿里云预发）域名 *.stage.optima.chat，抄自 cn-stage-ingress-sae services map。
 const SERVICES: Record<string, SvcCfg> = {
-  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com' },
-  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'app.yzsgo.com' },
-  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'commerce.yzsgo.com', cn_path: '/health/live' },
+  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com', 'cn-stage': 'auth.stage.optima.chat' },
+  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'app.yzsgo.com', 'cn-stage': 'app.stage.optima.chat' },
+  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'commerce.yzsgo.com', cn_path: '/health/live', 'cn-stage': 'commerce.stage.optima.chat', 'cn-stage_path': '/health/live' },
   'mcp-host':         { path: '/health',     stage: 'mcp-stage.optima.onl',  prod: 'mcp.optima.onl' },
-  'gateway-core':     { path: '/health',     cn: 'gw.yzsgo.com' },
-  'optima-scout':     { path: '/health',     cn: 'scout.yzsgo.com' },
-  'optima-skills':    { path: '/health',     cn: 'skills.yzsgo.com' },
+  'gateway-core':     { path: '/health',     cn: 'gw.yzsgo.com', 'cn-stage': 'gw.stage.optima.chat' },
+  'optima-scout':     { path: '/health',     cn: 'scout.yzsgo.com', 'cn-stage': 'scout.stage.optima.chat' },
+  'optima-skills':    { path: '/health',     cn: 'skills.yzsgo.com', 'cn-stage': 'skills.stage.optima.chat' },
 };
-const ENVS: Env[] = ['stage', 'prod', 'cn'];
+const ENVS: Env[] = ['stage', 'prod', 'cn', 'cn-stage'];
 
 const G = '\x1b[32m', R = '\x1b[31m', Y = '\x1b[33m', B = '\x1b[34m', N = '\x1b[0m';
 const MARK: Record<string, string> = { ok: `${G}✅${N}`, fail: `${R}❌${N}`, warn: `${Y}⚠️ ${N}`, na: `${B}··${N}` };

package/dist/bin/helpers/billing-http.js

@@ -16,12 +16,15 @@ const USER_AUTH_URLS = {
     prod: 'https://auth.optima.onl',
     // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 auth-cn.optima.chat 路由已下线
     'cn-prod': 'https://auth.yzsgo.com',
+    // cn-stage（阿里云预发，独立于 AWS stage `.optima.onl`）
+    'cn-stage': 'https://auth.stage.optima.chat',
 };
-// cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
+// cn URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
 // separate instance dev-skills has no machine identity for, and these domains
 // are stable. AWS envs keep reading /shared-secrets/domain-urls.
 // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 billing-cn.optima.chat 路由已下线
 const CN_PROD_BILLING_URL = 'https://billing-api.yzsgo.com';
+const CN_STAGE_BILLING_URL = 'https://billing-api.stage.optima.chat';
 /**
  * Validate the --env flag value at command entry, before any I/O.
  *
@@ -46,8 +49,8 @@ function validateEnv(env) {
  * cn-prod typo fails fast instead of dying inside the tunnel setup.
  */
 function validateEnvCnProd(env) {
-    if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod') {
-        throw new Error(`--env must be "stage", "prod" or "cn-prod" (got: ${env})`);
+    if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod' && env !== 'cn-stage') {
+        throw new Error(`--env must be "stage", "prod", "cn-prod" or "cn-stage" (got: ${env})`);
     }
     return env;
 }
@@ -86,6 +89,8 @@ const skillsUrlCache = {};
 function getBillingUrl(env) {
     if (env === 'cn-prod')
         return CN_PROD_BILLING_URL;
+    if (env === 'cn-stage')
+        return CN_STAGE_BILLING_URL;
     if (billingUrlCache[env])
         return billingUrlCache[env];
     const url = (0, infisical_secrets_1.fetchInfisicalSecret)(env, '/shared-secrets/domain-urls', 'BILLING_URL');
@@ -102,17 +107,34 @@ function getSkillsUrl(env) {
 function getServiceToken(env) {
     if (tokenCache[env])
         return tokenCache[env];
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const tok = (0, db_utils_1.getInfisicalToken)(cfg);
-    // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
-    // cn-prod credentials are mirrored in the AWS Infisical *prod* environment
-    // (fetchInfisicalSecret has no cn-prod env slug), under CN-specific keys.
-    const isCn = env === 'cn-prod';
-    const infisicalEnv = isCn ? 'prod' : env;
-    const idKey = isCn ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
-    const secretKey = isCn ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
-    const clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
-    const clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+    // cn-prod 与 cn-stage 都用 client_credentials M2M token，scope=internal:users:write。
+    // 凭证来源不同：
+    //  · cn-prod —— 镜像在 AWS Infisical prod 环境（CN_PROD_ 前缀键），复用既有 AWS 访问。
+    //  · cn-stage —— canonical 在 cn Infisical staging /shared-secrets/oauth-clients
+    //    （dev-skills 无该 client 的 AWS 镜像；用 admin email/password 直读，
+    //     运行时需 INFISICAL_CN_EMAIL/PASSWORD，与 query-db cn 同一前提）。
+    const isCn = env === 'cn-prod' || env === 'cn-stage';
+    let clientId;
+    let clientSecret;
+    if (env === 'cn-stage') {
+        const cnTok = (0, db_utils_1.getCnInfisicalToken)();
+        const oc = (0, db_utils_1.getCnSecrets)(cnTok, '/shared-secrets/oauth-clients', false, 'staging');
+        clientId = oc['DEV_SKILLS_OAUTH_CLIENT_ID'];
+        clientSecret = oc['DEV_SKILLS_OAUTH_CLIENT_SECRET'];
+        if (!clientId || !clientSecret) {
+            throw new Error('cn-stage dev-skills OAuth client 凭证缺失（cn Infisical staging /shared-secrets/oauth-clients 的 DEV_SKILLS_OAUTH_CLIENT_ID/SECRET）。');
+        }
+    }
+    else {
+        const cfg = (0, db_utils_1.getInfisicalConfig)();
+        const tok = (0, db_utils_1.getInfisicalToken)(cfg);
+        // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
+        const infisicalEnv = env === 'cn-prod' ? 'prod' : env;
+        const idKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
+        const secretKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
+        clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
+        clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+    }
     const authUrl = USER_AUTH_URLS[env];
     if (!authUrl)
         throw new Error(`Unknown env: ${env}`);

package/dist/bin/helpers/db-utils.js

@@ -35,6 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RDS_HOSTS = void 0;
 exports.isCnEnv = isCnEnv;
+exports.isCnStageEnv = isCnStageEnv;
+exports.cnInfisicalEnv = cnInfisicalEnv;
+exports.cnRdsHost = cnRdsHost;
 exports.escapeSQL = escapeSQL;
 exports.getGitHubVariable = getGitHubVariable;
 exports.getInfisicalConfig = getInfisicalConfig;
@@ -67,14 +70,29 @@ const EC2_HOST = '3.0.210.113';
 // ─── cn-prod (阿里云) 常量 ────────────────────────────────────────────────────
 // cn-prod 跑在阿里云 SAE，与海外 AWS 完全独立：独立 Infisical (secrets-cn.optima.chat)
 // + 内网 RDS（无公网端点）经 buildbox ECS 跳板 SSH 隧道访问。设计见 optima-dev-skills#21。
+// cn Infisical 是【单实例双环境】：prod=cn-prod、staging=cn-stage（URL/org/project 共享，
+// 只切 environment 参数）。cn-stage 数据面共用 prod VPC，故走【同一 buildbox】跳板。
 const CN_INFISICAL_URL = process.env.INFISICAL_CN_URL || 'https://secrets-cn.optima.chat';
 const CN_INFISICAL_ORG = process.env.INFISICAL_CN_ORG || 'f44012fa-0659-4f7e-b0ac-ed01244efc8a';
 const CN_INFISICAL_PROJECT = process.env.INFISICAL_CN_PROJECT || '4deef229-11be-40a5-8f56-b61f0bce7240';
-const CN_RDS_HOST = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com';
+const CN_RDS_HOST = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com'; // cn-prod RDS
+const CN_STAGE_RDS_HOST = 'pgm-2zem1u9zdh06boim.pg.rds.aliyuncs.com'; // cn-stage RDS（独立实例，共用 prod VPC）
 const CN_BUILDBOX_HOST = process.env.OPTIMA_CN_BUILDBOX_HOST || '47.94.105.163';
-/** env 是否指向 cn-prod（阿里云）。接受 `cn` / `cn-prod`。 */
+/** env 是否指向阿里云（cn-prod 或 cn-stage）。接受 `cn` / `cn-prod` / `cn-stage`。 */
 function isCnEnv(env) {
-    return env === 'cn' || env === 'cn-prod';
+    return env === 'cn' || env === 'cn-prod' || env === 'cn-stage';
+}
+/** env 是否指向 cn-stage（阿里云预发）。 */
+function isCnStageEnv(env) {
+    return env === 'cn-stage';
+}
+/** cn env → cn Infisical environment slug。cn-stage→staging，其余 cn→prod。 */
+function cnInfisicalEnv(env) {
+    return env === 'cn-stage' ? 'staging' : 'prod';
+}
+/** cn env → 内网 RDS host。cn-stage→stage 实例，其余 cn→prod 实例。 */
+function cnRdsHost(env) {
+    return env === 'cn-stage' ? CN_STAGE_RDS_HOST : CN_RDS_HOST;
 }
 // ─── SQL escaping ───────────────────────────────────────────────────────────
 /** Escape a string value for safe inclusion in SQL single-quoted literals. */
@@ -146,10 +164,13 @@ function getCnInfisicalToken() {
         throw new Error(`cn Infisical select-organization 失败: ${JSON.stringify(org).slice(0, 200)}`);
     return org.token;
 }
-/** 读 cn Infisical 某 folder（prod env）→ key→value map。expand=true 让服务端解析 `${...}` 引用。 */
-function getCnSecrets(token, secretPath, expand = false) {
+/**
+ * 读 cn Infisical 某 folder → key→value map。expand=true 让服务端解析 `${...}` 引用。
+ * environment：cn-prod 用 `prod`、cn-stage 用 `staging`（同一实例双环境）。
+ */
+function getCnSecrets(token, secretPath, expand = false, environment = 'prod') {
     const data = curlJson([
-        `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=prod&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
+        `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
         '-H', `Authorization: Bearer ${token}`,
     ]);
     const secrets = {};
@@ -460,17 +481,18 @@ function queryDB(conn, sql) {
  * 连 cn-prod 某服务库：creds 取自 cn Infisical 的 /shared-secrets/database-users +
  * /database-names（按 prefix，如 AUTH/BILLING），经 buildbox 跳板隧道（动态端口）。
  */
-function connectCnDB(prefix) {
+function connectCnDB(prefix, cnEnv = 'cn-prod') {
+    const infEnv = cnInfisicalEnv(cnEnv);
     const token = getCnInfisicalToken();
-    const users = getCnSecrets(token, '/shared-secrets/database-users');
-    const names = getCnSecrets(token, '/shared-secrets/database-names');
+    const users = getCnSecrets(token, '/shared-secrets/database-users', false, infEnv);
+    const names = getCnSecrets(token, '/shared-secrets/database-names', false, infEnv);
     const user = users[`${prefix}_DB_USER`];
     const password = users[`${prefix}_DB_PASSWORD`];
     const database = names[`${prefix}_DB_NAME`];
     if (!user || !password || !database) {
         throw new Error(`cn DB creds 不全 for ${prefix}（需 ${prefix}_DB_USER/PASSWORD@database-users + ${prefix}_DB_NAME@database-names）。该服务 cn 可能用字面 DATABASE_URL，见 optima-dev-skills#21。`);
     }
-    const port = ensureTunnel(CN_RDS_HOST, 'cn-buildbox');
+    const port = ensureTunnel(cnRdsHost(cnEnv), 'cn-buildbox');
     const conn = { host: 'localhost', port, user, password, database };
     return { query: (sql) => queryDB(conn, sql) };
 }
@@ -479,9 +501,9 @@ function connectCnDB(prefix) {
  * 用于 cred 不在 shared-secrets/database-users 的服务（如 gateway-core）。
  * expandSecretReferences=true 让 cn Infisical 解析 `${...}` 引用为字面值。
  */
-function connectCnDBFromUrl(servicePath) {
+function connectCnDBFromUrl(servicePath, cnEnv = 'cn-prod') {
     const token = getCnInfisicalToken();
-    const secrets = getCnSecrets(token, servicePath, true);
+    const secrets = getCnSecrets(token, servicePath, true, cnInfisicalEnv(cnEnv));
     const dbUrl = secrets['DATABASE_URL'];
     if (!dbUrl)
         throw new Error(`cn DATABASE_URL 未找到 at ${servicePath}`);

package/dist/bin/helpers/generate-test-token.js

@@ -64,6 +64,14 @@ const ENV_CONFIG = {
         // 注意不要换成同名的 confidential client `commerce-cli-cn-prod-*`，那个需要 client_secret，走不通 CLI 的 public ROPC flow。
         clientId: 'dev-skill-cli-cn-pro-acvkmcuq',
         envName: 'cn-prod'
+    },
+    'cn-stage': {
+        // 阿里云预发（独立于 AWS stage `.optima.onl`）。域名 *.stage.optima.chat。
+        authUrl: 'https://auth.stage.optima.chat',
+        apiUrl: 'https://commerce.stage.optima.chat',
+        // cn-stage user-auth 里注册的 public client（开 password grant，ROPC flow）。
+        clientId: 'dev-skill-cli-cn-sta-3dvsxzdo',
+        envName: 'cn-stage'
     }
 };
 async function httpRequest(url, options = {}) {
@@ -166,6 +174,7 @@ async function main() {
     let phone;
     let address;
     let environment = 'ci';
+    let skipMerchant = false;
     // 解析命令行参数
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -184,13 +193,16 @@ async function main() {
         else if (arg === '--address' && args[i + 1]) {
             address = args[++i];
         }
+        else if (arg === '--skip-merchant') {
+            skipMerchant = true;
+        }
         else if (arg === '--env' && args[i + 1]) {
             const envArg = args[++i];
-            if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod') {
+            if (envArg === 'ci' || envArg === 'stage' || envArg === 'prod' || envArg === 'cn-prod' || envArg === 'cn-stage') {
                 environment = envArg;
             }
             else {
-                console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', or 'cn-prod'.`);
+                console.error(`❌ Invalid environment: ${envArg}. Must be 'ci', 'stage', 'prod', 'cn-prod', or 'cn-stage'.`);
                 process.exit(1);
             }
         }
@@ -204,20 +216,24 @@ Options:
   --business-name <name>       Merchant business name (default: auto-generated)
   --phone <phone>              Merchant phone number (optional)
   --address <address>          Merchant address (optional)
-  --env <environment>          Environment: ci (default), stage, prod, or cn-prod
+  --skip-merchant              只注册用户 + 拿 token，跳过 Commerce merchant profile 设置
+                               （token-only；用于 gateway E2E、或 commerce 未就绪的环境）
+  --env <environment>          Environment: ci (default), stage, prod, cn-prod, or cn-stage
   --help, -h                   Show this help message
 
 Environments:
-  ci       CI 环境 (auth.optima.chat, api.optima.chat)
-  stage    Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
-  prod     Prod 环境 (auth.optima.onl, api.optima.onl)
-  cn-prod  阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
+  ci        CI 环境 (auth.optima.chat, api.optima.chat)
+  stage     Stage 环境 (auth.stage.optima.onl, api.stage.optima.onl)
+  prod      Prod 环境 (auth.optima.onl, api.optima.onl)
+  cn-prod   阿里云生产环境 (auth.yzsgo.com, commerce.yzsgo.com) [#201]
+  cn-stage  阿里云预发环境 (auth.stage.optima.chat, commerce.stage.optima.chat)
 
 Example:
   optima-generate-test-token
   optima-generate-test-token --env stage
   optima-generate-test-token --env prod
   optima-generate-test-token --env cn-prod
+  optima-generate-test-token --env cn-stage
   optima-generate-test-token --business-name "My Test Shop" --env stage
       `);
             process.exit(0);
@@ -237,8 +253,12 @@ Example:
         const user = await registerMerchant(email, password, businessName, config, phone, address);
         // 2. 获取 token
         const token = await getToken(email, password, config);
-        // 3. 设置 merchant profile（Commerce API）
-        const merchantProfile = await setupMerchantProfile(token, businessName, config);
+        // 3. 设置 merchant profile（Commerce API）；--skip-merchant 时跳过（token-only）
+        const merchantProfile = skipMerchant
+            ? { merchant_id: 'N/A (skipped)' }
+            : await setupMerchantProfile(token, businessName, config);
+        if (skipMerchant)
+            console.log('\n⏭️  Skipped merchant profile setup (--skip-merchant)');
         // 4. 保存 token 到临时文件
         const tmpDir = os.tmpdir();
         const tokenFileName = `optima-test-token-${Date.now()}.txt`;

package/dist/bin/helpers/grant-balance.js

@@ -19,13 +19,14 @@ $1 = 700 credits (P15 unified ledger; the USD wallet is retired).
 Options:
   --amount <usd>        USD amount to grant (required, e.g. 5 for $5.00 = 3500 credits)
   --description <text>  Description for audit trail (optional)
-  --env <env>           Environment: stage, prod, cn-prod (default: stage)
+  --env <env>           Environment: stage, prod, cn-prod, cn-stage (default: stage)
   -h, --help            Show this help
 
 Examples:
   optima-grant-balance user@example.com --amount 5 --env prod
   optima-grant-balance user@example.com --amount 10 --description "Service outage compensation"
-  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)`);
+  optima-grant-balance user@example.com --amount 1 --env cn-prod   # ¥-priced env, still USD input ($1 = 700 credits)
+  optima-grant-balance user@example.com --amount 1 --env cn-stage  # 阿里云预发`);
         process.exit(0);
     }
     const email = args[0];
@@ -55,10 +56,10 @@ async function main() {
     console.log(`\n🎁 Granting $${amountUsd.toFixed(2)} (${Math.round(amountUsd * 700)} credits) to ${email} [${env.toUpperCase()}]\n`);
     if (description)
         console.log(`   Reason: ${description}`);
-    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth's
-    // internal lookup API instead of the direct SQL path.
+    // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
+    // user-auth's internal lookup API instead of the direct SQL path.
     let userId;
-    if (env === 'cn-prod') {
+    if (env === 'cn-prod' || env === 'cn-stage') {
         userId = await (0, billing_http_1.resolveUserIdByEmail)(env, email);
     }
     else {

package/dist/bin/helpers/grant-subscription.js

@@ -55,7 +55,7 @@ function assertPhoneMatch(inputPhone, accountPhone) {
  */
 function assertAwsEmailOnly(env, kind) {
     if ((env === 'stage' || env === 'prod') && kind !== 'email') {
-        throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+        throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod / cn-stage 可用');
     }
 }
 // cn-prod sells the CNY-priced -cn plans (P12); the bare USD plan ids also
@@ -65,6 +65,8 @@ const PLANS_BY_ENV = {
     stage: ['trial', 'starter', 'pro', 'enterprise'],
     prod: ['trial', 'starter', 'pro', 'enterprise'],
     'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+    // cn-stage 卖同一套 CNY -cn plan（billing plan 目录与 cn-prod 一致）
+    'cn-stage': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
 };
 function parseArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
@@ -72,9 +74,9 @@ function parseArgs(args) {
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
-                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
+                    cn-prod/cn-stage plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod, cn-prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod, cn-stage (default: stage)
   -h, --help        Show this help`);
         process.exit(0);
     }
@@ -94,7 +96,7 @@ Options:
         }
     }
     (0, billing_http_1.validateEnvCnProd)(env);
-    plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+    plan = plan ?? (env === 'cn-prod' || env === 'cn-stage' ? 'pro-cn' : 'pro');
     const allowed = PLANS_BY_ENV[env];
     if (!allowed.includes(plan)) {
         console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
@@ -113,12 +115,12 @@ async function main() {
     console.log(`\n🎁 Granting ${plan} subscription to ${identifier} (${kind}) for ${months} month(s) [${env.toUpperCase()}]\n`);
     // identity is the verified target account to print on success. AWS keeps the
     // pre-change behavior (email-only, no internal HTTP reverse-verify); only
-    // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
+    // cn-prod / cn-stage run the full classify→resolve→getUserById→phone-assert防呆 path.
     let userId;
     let identity;
-    if (env === 'cn-prod') {
-        // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
-        // and its dev-skills token carries internal:users:write for the lookups.
+    if (env === 'cn-prod' || env === 'cn-stage') {
+        // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
+        // user-auth, and the dev-skills token carries internal:users:write for lookups.
         if (kind === 'userId') {
             userId = identifier;
         }

package/dist/bin/helpers/query-db.js

@@ -170,7 +170,7 @@ async function main() {
         console.error('Usage: query-db.ts <service> <sql> [environment]');
         console.error('');
         console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-        console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
+        console.error('Environments: ci (default), stage, prod, cn-prod (阿里云生产), cn-stage (阿里云预发)');
         console.error('');
         console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
         process.exit(1);
@@ -184,19 +184,22 @@ async function main() {
     // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
     // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
     if ((0, db_utils_1.isCnEnv)(environment)) {
+        // cn-prod / cn-stage 共用 SERVICE_DB_MAP[*].prod 的 userKey/databaseUrlPath（prefix、
+        // /services/<svc> 路径两环境一致）；connectCn* 按 env 切 cn Infisical 环境 + RDS 实例。
+        const label = environment === 'cn-stage' ? 'CN-STAGE' : 'CN-PROD';
         const prodCfg = SERVICE_DB_MAP[service].prod;
         let db;
         if (prodCfg?.userKey) {
             const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
-            console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
-            db = (0, db_utils_1.connectCnDB)(prefix);
+            console.log(`\n🔍 Querying ${service} (${label}, prefix ${prefix})...`);
+            db = (0, db_utils_1.connectCnDB)(prefix, environment);
         }
         else if (prodCfg?.databaseUrlPath) {
-            console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
-            db = (0, db_utils_1.connectCnDBFromUrl)(prodCfg.databaseUrlPath);
+            console.log(`\n🔍 Querying ${service} (${label}, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+            db = (0, db_utils_1.connectCnDBFromUrl)(prodCfg.databaseUrlPath, environment);
         }
         else {
-            console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+            console.error(`${label} query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
             process.exit(1);
         }
         console.log('\n' + db.query(sql));

package/dist/bin/helpers/show-env.js

@@ -31,11 +31,15 @@ const SUPPORTED_SERVICES = [
     'optima-sentinel-worker',
     'shopify-backend',
 ];
-// 环境到 Infisical environment 的映射
+// 环境到 AWS Infisical environment 的映射（cn 走独立 cn Infisical，见下方分支）
 const ENV_MAP = {
     stage: 'staging',
     prod: 'prod'
 };
+/** 该 environment 是否被支持（AWS stage/prod 或阿里云 cn-prod/cn-stage）。 */
+function isSupportedEnv(env) {
+    return ENV_MAP[env] !== undefined || (0, db_utils_1.isCnEnv)(env);
+}
 // NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
 // unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config, token, environment, secretPath) {
@@ -53,17 +57,22 @@ Usage: optima-show-env <service> <environment> [options]
 
 Arguments:
   service      Service name (${SUPPORTED_SERVICES.join(', ')})
-  environment  Environment (stage, prod)
+  environment  Environment (stage, prod, cn-prod, cn-stage)
 
 Options:
   --filter     Filter by key pattern (e.g., --filter DATABASE)
   --keys-only  Show only key names, not values
   --help       Show this help message
 
+Note:
+  cn-prod / cn-stage 读阿里云 cn Infisical（需 INFISICAL_CN_EMAIL/PASSWORD 环境变量，
+  admin user，见 optima-dev-skills#21）。stage/prod 读 AWS Infisical（GitHub Variables）。
+
 Examples:
   optima-show-env commerce-backend stage
   optima-show-env user-auth prod --filter DATABASE
-  optima-show-env bi stage --keys-only
+  optima-show-env gateway-core cn-stage
+  optima-show-env bi-backend stage --keys-only
 `);
 }
 async function main() {
@@ -101,22 +110,32 @@ async function main() {
         process.exit(1);
     }
     // 验证环境
-    if (!ENV_MAP[environment]) {
+    if (!isSupportedEnv(environment)) {
         console.error(`Error: Unknown environment '${environment}'`);
-        console.error('Available environments: stage, prod');
+        console.error('Available environments: stage, prod, cn-prod, cn-stage');
         process.exit(1);
     }
     // Infisical 路径为 /services/<service-name>
     const secretPath = `/services/${service}`;
     console.log(`\n🔍 Fetching environment variables for ${service} (${environment.toUpperCase()})...\n`);
     try {
-        const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
-        console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
-        console.log('✓ Obtained Infisical access token');
-        const infisicalEnv = ENV_MAP[environment];
-        const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
-        console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+        let secrets;
+        if ((0, db_utils_1.isCnEnv)(environment)) {
+            // 阿里云 cn Infisical（独立实例，admin email/password 认证；prod / staging 双环境）
+            const cnToken = (0, db_utils_1.getCnInfisicalToken)();
+            console.log('✓ Obtained cn Infisical access token');
+            secrets = (0, db_utils_1.getCnSecrets)(cnToken, secretPath, false, (0, db_utils_1.cnInfisicalEnv)(environment));
+            console.log(`✓ Retrieved secrets from cn Infisical (env: ${(0, db_utils_1.cnInfisicalEnv)(environment)}, path: ${secretPath})\n`);
+        }
+        else {
+            const infisicalConfig = (0, db_utils_1.getInfisicalConfig)();
+            console.log('✓ Loaded Infisical config from GitHub Variables');
+            const token = (0, db_utils_1.getInfisicalToken)(infisicalConfig);
+            console.log('✓ Obtained Infisical access token');
+            const infisicalEnv = ENV_MAP[environment];
+            secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
+            console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+        }
         const keys = Object.keys(secrets).sort();
         if (keys.length === 0) {
             console.log('No environment variables found.');

package/dist/bin/helpers/verify-health.js

@@ -66,16 +66,17 @@ const https = __importStar(require("node:https"));
 // 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
 // cn-prod 真实 subdomain 抄自 optima-terraform alicloud/stacks/cn-prod-ingress-sae/main.tf。
 // #201 (2026-06-12): yzsgo.com 全量迁移完成,旧 *-cn.optima.chat 路由已下线。
+// cn-stage（阿里云预发）域名 *.stage.optima.chat，抄自 cn-stage-ingress-sae services map。
 const SERVICES = {
-    'user-auth': { path: '/health', stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com' },
-    'agentic-chat': { path: '/api/health', stage: 'ai-stage.optima.onl', prod: 'ai.optima.onl', cn: 'app.yzsgo.com' },
-    'commerce-backend': { path: '/health', stage: 'api-stage.optima.onl', prod: 'api.optima.onl', cn: 'commerce.yzsgo.com', cn_path: '/health/live' },
+    'user-auth': { path: '/health', stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com', 'cn-stage': 'auth.stage.optima.chat' },
+    'agentic-chat': { path: '/api/health', stage: 'ai-stage.optima.onl', prod: 'ai.optima.onl', cn: 'app.yzsgo.com', 'cn-stage': 'app.stage.optima.chat' },
+    'commerce-backend': { path: '/health', stage: 'api-stage.optima.onl', prod: 'api.optima.onl', cn: 'commerce.yzsgo.com', cn_path: '/health/live', 'cn-stage': 'commerce.stage.optima.chat', 'cn-stage_path': '/health/live' },
     'mcp-host': { path: '/health', stage: 'mcp-stage.optima.onl', prod: 'mcp.optima.onl' },
-    'gateway-core': { path: '/health', cn: 'gw.yzsgo.com' },
-    'optima-scout': { path: '/health', cn: 'scout.yzsgo.com' },
-    'optima-skills': { path: '/health', cn: 'skills.yzsgo.com' },
+    'gateway-core': { path: '/health', cn: 'gw.yzsgo.com', 'cn-stage': 'gw.stage.optima.chat' },
+    'optima-scout': { path: '/health', cn: 'scout.yzsgo.com', 'cn-stage': 'scout.stage.optima.chat' },
+    'optima-skills': { path: '/health', cn: 'skills.yzsgo.com', 'cn-stage': 'skills.stage.optima.chat' },
 };
-const ENVS = ['stage', 'prod', 'cn'];
+const ENVS = ['stage', 'prod', 'cn', 'cn-stage'];
 const G = '\x1b[32m', R = '\x1b[31m', Y = '\x1b[33m', B = '\x1b[34m', N = '\x1b[0m';
 const MARK = { ok: `${G}✅${N}`, fail: `${R}❌${N}`, warn: `${Y}⚠️ ${N}`, na: `${B}··${N}` };
 const verdict = (ls) => ls.some((l) => l.result === 'fail') ? 'fail' : ls.some((l) => l.result === 'warn') ? 'warn' : 'pass';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.43",
+  "version": "0.8.0",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {