@optima-chat/dev-skills 0.7.43 → 0.8.1

package/bin/helpers/grant-subscription.ts

@@ -60,7 +60,7 @@ export function assertPhoneMatch(inputPhone: string, accountPhone: string | null
  */
 export function assertAwsEmailOnly(env: string, kind: 'email' | 'phone' | 'userId'): void {
   if ((env === 'stage' || env === 'prod') && kind !== 'email') {
-    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod 可用');
+    throw new Error('stage/prod 仅支持 email 标识；手机号/userId 解析仅 cn-prod / cn-stage 可用');
   }
 }
 
@@ -71,6 +71,8 @@ const PLANS_BY_ENV: Record<string, string[]> = {
   stage: ['trial', 'starter', 'pro', 'enterprise'],
   prod: ['trial', 'starter', 'pro', 'enterprise'],
   'cn-prod': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
+  // cn-stage 卖同一套 CNY -cn plan（billing plan 目录与 cn-prod 一致）
+  'cn-stage': ['trial', 'starter-cn', 'pro-cn', 'enterprise-cn'],
 };
 
 function parseArgs(args: string[]): { identifier: string; plan: string; months: number; env: string } {
@@ -79,9 +81,9 @@ function parseArgs(args: string[]): { identifier: string; plan: string; months:
 
 Options:
   --plan <id>       Plan: trial, starter, pro, enterprise (default: pro)
-                    cn-prod plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
+                    cn-prod/cn-stage plans: trial, starter-cn, pro-cn, enterprise-cn (default: pro-cn)
   --months <n>      Duration in months (default: 1)
-  --env <env>       Environment: stage, prod, cn-prod (default: stage)
+  --env <env>       Environment: stage, prod, cn-prod, cn-stage (default: stage)
   -h, --help        Show this help`);
     process.exit(0);
   }
@@ -98,7 +100,7 @@ Options:
   }
 
   validateEnvCnProd(env);
-  plan = plan ?? (env === 'cn-prod' ? 'pro-cn' : 'pro');
+  plan = plan ?? (env === 'cn-prod' || env === 'cn-stage' ? 'pro-cn' : 'pro');
   const allowed = PLANS_BY_ENV[env];
   if (!allowed.includes(plan)) {
     console.error(`Unknown plan for ${env}: ${plan}. Available: ${allowed.join(', ')}`);
@@ -118,13 +120,13 @@ async function main() {
 
   // identity is the verified target account to print on success. AWS keeps the
   // pre-change behavior (email-only, no internal HTTP reverse-verify); only
-  // cn-prod runs the full classify→resolve→getUserById→phone-assert防呆 path.
+  // cn-prod / cn-stage run the full classify→resolve→getUserById→phone-assert防呆 path.
   let userId: string;
   let identity: { phone: string | null; email: string | null };
 
-  if (env === 'cn-prod') {
-    // cn-prod has no SSH tunnel into the Aliyun RDS — resolve via user-auth,
-    // and its dev-skills token carries internal:users:write for the lookups.
+  if (env === 'cn-prod' || env === 'cn-stage') {
+    // cn-prod / cn-stage have no SSH tunnel into the Aliyun RDS — resolve via
+    // user-auth, and the dev-skills token carries internal:users:write for lookups.
     if (kind === 'userId') {
       userId = identifier;
     } else if (kind === 'phone') {

package/bin/helpers/query-db.ts

@@ -157,7 +157,7 @@ async function main() {
     console.error('Usage: query-db.ts <service> <sql> [environment]');
     console.error('');
     console.error('Services: commerce-backend, user-auth, agentic-chat, bi-backend, session-gateway, gateway-core, optima-logistics, billing, ads-backend, amazon-backend, browser-backend, shopify-backend, optima-generation, optima-sentinel');
-    console.error('Environments: ci (default), stage, prod, cn (阿里云 cn-prod)');
+    console.error('Environments: ci (default), stage, prod, cn-prod (阿里云生产), cn-stage (阿里云预发)');
     console.error('');
     console.error('Example: query-db.ts user-auth "SELECT COUNT(*) FROM users" prod');
     process.exit(1);
@@ -174,17 +174,20 @@ async function main() {
   // cn-prod（阿里云）：独立 Infisical + 经 buildbox 跳板连内网 RDS（动态端口隧道）。
   // 两类 cred：① shared-secrets/database-users（按 prefix）② 服务自己的 DATABASE_URL（展开引用）。
   if (isCnEnv(environment)) {
+    // cn-prod / cn-stage 共用 SERVICE_DB_MAP[*].prod 的 userKey/databaseUrlPath（prefix、
+    // /services/<svc> 路径两环境一致）；connectCn* 按 env 切 cn Infisical 环境 + RDS 实例。
+    const label = environment === 'cn-stage' ? 'CN-STAGE' : 'CN-PROD';
     const prodCfg = SERVICE_DB_MAP[service as keyof typeof SERVICE_DB_MAP].prod as any;
     let db: { query: (sql: string) => string };
     if (prodCfg?.userKey) {
       const prefix = prodCfg.userKey.replace(/_DB_USER$/, '');
-      console.log(`\n🔍 Querying ${service} (CN-PROD, prefix ${prefix})...`);
-      db = connectCnDB(prefix);
+      console.log(`\n🔍 Querying ${service} (${label}, prefix ${prefix})...`);
+      db = connectCnDB(prefix, environment);
     } else if (prodCfg?.databaseUrlPath) {
-      console.log(`\n🔍 Querying ${service} (CN-PROD, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
-      db = connectCnDBFromUrl(prodCfg.databaseUrlPath);
+      console.log(`\n🔍 Querying ${service} (${label}, DATABASE_URL @ ${prodCfg.databaseUrlPath})...`);
+      db = connectCnDBFromUrl(prodCfg.databaseUrlPath, environment);
     } else {
-      console.error(`cn-prod query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
+      console.error(`${label} query 暂不支持 ${service}（既无 userKey 也无 databaseUrlPath）。见 optima-dev-skills#21。`);
       process.exit(1);
     }
     console.log('\n' + db.query(sql));

package/bin/helpers/show-env.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { execSync } from 'child_process';
-import { getInfisicalConfig, getInfisicalToken, InfisicalConfig } from './db-utils';
+import { getInfisicalConfig, getInfisicalToken, InfisicalConfig, isCnEnv, cnInfisicalEnv, getCnInfisicalToken, getCnSecrets } from './db-utils';
 
 // 支持的服务列表（Infisical 路径为 /services/<service-name>）
 const SUPPORTED_SERVICES = [
@@ -32,12 +32,17 @@ const SUPPORTED_SERVICES = [
   'shopify-backend',
 ];
 
-// 环境到 Infisical environment 的映射
+// 环境到 AWS Infisical environment 的映射（cn 走独立 cn Infisical，见下方分支）
 const ENV_MAP: Record<string, string> = {
   stage: 'staging',
   prod: 'prod'
 };
 
+/** 该 environment 是否被支持（AWS stage/prod 或阿里云 cn-prod/cn-stage）。 */
+function isSupportedEnv(env: string): boolean {
+  return ENV_MAP[env] !== undefined || isCnEnv(env);
+}
+
 // NOTE: getInfisicalSecrets is kept local because it encodes secretPath (encodeURIComponent),
 // unlike db-utils' raw-path variant; getGitHubVariable/getInfisicalConfig/getInfisicalToken are shared from db-utils.
 function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
@@ -60,17 +65,22 @@ Usage: optima-show-env <service> <environment> [options]
 
 Arguments:
   service      Service name (${SUPPORTED_SERVICES.join(', ')})
-  environment  Environment (stage, prod)
+  environment  Environment (stage, prod, cn-prod, cn-stage)
 
 Options:
   --filter     Filter by key pattern (e.g., --filter DATABASE)
   --keys-only  Show only key names, not values
   --help       Show this help message
 
+Note:
+  cn-prod / cn-stage 读阿里云 cn Infisical（需 INFISICAL_CN_EMAIL/PASSWORD 环境变量，
+  admin user，见 optima-dev-skills#21）。stage/prod 读 AWS Infisical（GitHub Variables）。
+
 Examples:
   optima-show-env commerce-backend stage
   optima-show-env user-auth prod --filter DATABASE
-  optima-show-env bi stage --keys-only
+  optima-show-env gateway-core cn-stage
+  optima-show-env bi-backend stage --keys-only
 `);
 }
 
@@ -114,9 +124,9 @@ async function main() {
   }
 
   // 验证环境
-  if (!ENV_MAP[environment]) {
+  if (!isSupportedEnv(environment)) {
     console.error(`Error: Unknown environment '${environment}'`);
-    console.error('Available environments: stage, prod');
+    console.error('Available environments: stage, prod, cn-prod, cn-stage');
     process.exit(1);
   }
 
@@ -126,15 +136,24 @@ async function main() {
   console.log(`\n🔍 Fetching environment variables for ${service} (${environment.toUpperCase()})...\n`);
 
   try {
-    const infisicalConfig = getInfisicalConfig();
-    console.log('✓ Loaded Infisical config from GitHub Variables');
-
-    const token = getInfisicalToken(infisicalConfig);
-    console.log('✓ Obtained Infisical access token');
-
-    const infisicalEnv = ENV_MAP[environment];
-    const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
-    console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+    let secrets: Record<string, string>;
+    if (isCnEnv(environment)) {
+      // 阿里云 cn Infisical（独立实例，admin email/password 认证；prod / staging 双环境）
+      const cnToken = getCnInfisicalToken();
+      console.log('✓ Obtained cn Infisical access token');
+      secrets = getCnSecrets(cnToken, secretPath, false, cnInfisicalEnv(environment));
+      console.log(`✓ Retrieved secrets from cn Infisical (env: ${cnInfisicalEnv(environment)}, path: ${secretPath})\n`);
+    } else {
+      const infisicalConfig = getInfisicalConfig();
+      console.log('✓ Loaded Infisical config from GitHub Variables');
+
+      const token = getInfisicalToken(infisicalConfig);
+      console.log('✓ Obtained Infisical access token');
+
+      const infisicalEnv = ENV_MAP[environment];
+      secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, secretPath);
+      console.log(`✓ Retrieved secrets from Infisical (path: ${secretPath})\n`);
+    }
 
     const keys = Object.keys(secrets).sort();
 

package/bin/helpers/verify-health.ts

@@ -29,22 +29,23 @@ import { promises as dns } from 'node:dns';
 import * as tls from 'node:tls';
 import * as https from 'node:https';
 
-type Env = 'stage' | 'prod' | 'cn';
-interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; }
+type Env = 'stage' | 'prod' | 'cn' | 'cn-stage';
+interface SvcCfg { path: string; stage?: string; prod?: string; cn?: string; cn_path?: string; 'cn-stage'?: string; 'cn-stage_path'?: string; }
 
 // 服务 × 环境 FQDN 表。某服务某环境没部署 → 该 env 键缺省,探时跳过。
 // cn-prod 真实 subdomain 抄自 optima-terraform alicloud/stacks/cn-prod-ingress-sae/main.tf。
 // #201 (2026-06-12): yzsgo.com 全量迁移完成,旧 *-cn.optima.chat 路由已下线。
+// cn-stage（阿里云预发）域名 *.stage.optima.chat，抄自 cn-stage-ingress-sae services map。
 const SERVICES: Record<string, SvcCfg> = {
-  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com' },
-  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'app.yzsgo.com' },
-  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'commerce.yzsgo.com', cn_path: '/health/live' },
+  'user-auth':        { path: '/health',     stage: 'auth-stage.optima.onl', prod: 'auth.optima.onl', cn: 'auth.yzsgo.com', 'cn-stage': 'auth.stage.optima.chat' },
+  'agentic-chat':     { path: '/api/health', stage: 'ai-stage.optima.onl',   prod: 'ai.optima.onl',   cn: 'app.yzsgo.com', 'cn-stage': 'app.stage.optima.chat' },
+  'commerce-backend': { path: '/health',     stage: 'api-stage.optima.onl',  prod: 'api.optima.onl',  cn: 'commerce.yzsgo.com', cn_path: '/health/live', 'cn-stage': 'commerce.stage.optima.chat', 'cn-stage_path': '/health/live' },
   'mcp-host':         { path: '/health',     stage: 'mcp-stage.optima.onl',  prod: 'mcp.optima.onl' },
-  'gateway-core':     { path: '/health',     cn: 'gw.yzsgo.com' },
-  'optima-scout':     { path: '/health',     cn: 'scout.yzsgo.com' },
-  'optima-skills':    { path: '/health',     cn: 'skills.yzsgo.com' },
+  'gateway-core':     { path: '/health',     cn: 'gw.yzsgo.com', 'cn-stage': 'gw.stage.optima.chat' },
+  'optima-scout':     { path: '/health',     cn: 'scout.yzsgo.com', 'cn-stage': 'scout.stage.optima.chat' },
+  'optima-skills':    { path: '/health',     cn: 'skills.yzsgo.com', 'cn-stage': 'skills.stage.optima.chat' },
 };
-const ENVS: Env[] = ['stage', 'prod', 'cn'];
+const ENVS: Env[] = ['stage', 'prod', 'cn', 'cn-stage'];
 
 const G = '\x1b[32m', R = '\x1b[31m', Y = '\x1b[33m', B = '\x1b[34m', N = '\x1b[0m';
 const MARK: Record<string, string> = { ok: `${G}✅${N}`, fail: `${R}❌${N}`, warn: `${Y}⚠️ ${N}`, na: `${B}··${N}` };

package/dist/bin/helpers/billing-http.js

@@ -6,6 +6,7 @@ exports.getServiceToken = getServiceToken;
 exports.callBilling = callBilling;
 exports.callSkills = callSkills;
 exports.resolveUserIdByEmail = resolveUserIdByEmail;
+exports.resolveUserIdByEmailAnyEnv = resolveUserIdByEmailAnyEnv;
 exports.resolveUserIdByPhone = resolveUserIdByPhone;
 exports.getUserById = getUserById;
 const child_process_1 = require("child_process");
@@ -16,12 +17,15 @@ const USER_AUTH_URLS = {
     prod: 'https://auth.optima.onl',
     // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 auth-cn.optima.chat 路由已下线
     'cn-prod': 'https://auth.yzsgo.com',
+    // cn-stage（阿里云预发，独立于 AWS stage `.optima.onl`）
+    'cn-stage': 'https://auth.stage.optima.chat',
 };
-// cn-prod URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
+// cn URLs are hardcoded: cn Infisical (secrets-cn.optima.chat) is a
 // separate instance dev-skills has no machine identity for, and these domains
 // are stable. AWS envs keep reading /shared-secrets/domain-urls.
 // #201: yzsgo.com 全量迁移 (2026-06-12), 旧 billing-cn.optima.chat 路由已下线
 const CN_PROD_BILLING_URL = 'https://billing-api.yzsgo.com';
+const CN_STAGE_BILLING_URL = 'https://billing-api.stage.optima.chat';
 /**
  * Validate the --env flag value at command entry, before any I/O.
  *
@@ -46,8 +50,8 @@ function validateEnv(env) {
  * cn-prod typo fails fast instead of dying inside the tunnel setup.
  */
 function validateEnvCnProd(env) {
-    if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod') {
-        throw new Error(`--env must be "stage", "prod" or "cn-prod" (got: ${env})`);
+    if (env !== 'stage' && env !== 'prod' && env !== 'cn-prod' && env !== 'cn-stage') {
+        throw new Error(`--env must be "stage", "prod", "cn-prod" or "cn-stage" (got: ${env})`);
     }
     return env;
 }
@@ -86,6 +90,8 @@ const skillsUrlCache = {};
 function getBillingUrl(env) {
     if (env === 'cn-prod')
         return CN_PROD_BILLING_URL;
+    if (env === 'cn-stage')
+        return CN_STAGE_BILLING_URL;
     if (billingUrlCache[env])
         return billingUrlCache[env];
     const url = (0, infisical_secrets_1.fetchInfisicalSecret)(env, '/shared-secrets/domain-urls', 'BILLING_URL');
@@ -102,17 +108,34 @@ function getSkillsUrl(env) {
 function getServiceToken(env) {
     if (tokenCache[env])
         return tokenCache[env];
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const tok = (0, db_utils_1.getInfisicalToken)(cfg);
-    // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
-    // cn-prod credentials are mirrored in the AWS Infisical *prod* environment
-    // (fetchInfisicalSecret has no cn-prod env slug), under CN-specific keys.
-    const isCn = env === 'cn-prod';
-    const infisicalEnv = isCn ? 'prod' : env;
-    const idKey = isCn ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
-    const secretKey = isCn ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
-    const clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
-    const clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+    // cn-prod 与 cn-stage 都用 client_credentials M2M token，scope=internal:users:write。
+    // 凭证来源不同：
+    //  · cn-prod —— 镜像在 AWS Infisical prod 环境（CN_PROD_ 前缀键），复用既有 AWS 访问。
+    //  · cn-stage —— canonical 在 cn Infisical staging /shared-secrets/oauth-clients
+    //    （dev-skills 无该 client 的 AWS 镜像；用 admin email/password 直读，
+    //     运行时需 INFISICAL_CN_EMAIL/PASSWORD，与 query-db cn 同一前提）。
+    const isCn = env === 'cn-prod' || env === 'cn-stage';
+    let clientId;
+    let clientSecret;
+    if (env === 'cn-stage') {
+        const cnTok = (0, db_utils_1.getCnInfisicalToken)();
+        const oc = (0, db_utils_1.getCnSecrets)(cnTok, '/shared-secrets/oauth-clients', false, 'staging');
+        clientId = oc['DEV_SKILLS_OAUTH_CLIENT_ID'];
+        clientSecret = oc['DEV_SKILLS_OAUTH_CLIENT_SECRET'];
+        if (!clientId || !clientSecret) {
+            throw new Error('cn-stage dev-skills OAuth client 凭证缺失（cn Infisical staging /shared-secrets/oauth-clients 的 DEV_SKILLS_OAUTH_CLIENT_ID/SECRET）。');
+        }
+    }
+    else {
+        const cfg = (0, db_utils_1.getInfisicalConfig)();
+        const tok = (0, db_utils_1.getInfisicalToken)(cfg);
+        // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
+        const infisicalEnv = env === 'cn-prod' ? 'prod' : env;
+        const idKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_ID_KEY : DEV_SKILLS_CLIENT_ID_KEY;
+        const secretKey = env === 'cn-prod' ? DEV_SKILLS_CN_CLIENT_SECRET_KEY : DEV_SKILLS_CLIENT_SECRET_KEY;
+        clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, idKey, cfg, tok);
+        clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(infisicalEnv, DEV_SKILLS_OAUTH_PATH, secretKey, cfg, tok);
+    }
     const authUrl = USER_AUTH_URLS[env];
     if (!authUrl)
         throw new Error(`Unknown env: ${env}`);
@@ -234,6 +257,24 @@ async function resolveUserIdByEmail(env, email) {
     console.log(`✓ Found user: ${parsed.user_id}`);
     return parsed.user_id;
 }
+/**
+ * Resolve email → userId across all envs, picking the path that exists for
+ * each cloud. AWS (stage/prod) reaches the database over the RDS SSH tunnel
+ * (db-utils.resolveUserId). cn-prod / cn-stage have no tunnel into the Aliyun
+ * VPC-internal RDS, so they resolve via user-auth's internal HTTP lookup
+ * (resolveUserIdByEmail) — the cn dev-skills token carries the
+ * internal:users:write scope that endpoint requires. Lets the entitlement
+ * subcommands support cn the same way grant-subscription already does, without
+ * each call site re-implementing the branch.
+ */
+async function resolveUserIdByEmailAnyEnv(env, email) {
+    if (env === 'cn-prod' || env === 'cn-stage') {
+        return resolveUserIdByEmail(env, email);
+    }
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(cfg);
+    return (0, db_utils_1.resolveUserId)(email, env, cfg, token);
+}
 /**
  * Resolve a user's id by phone via user-auth's internal lookup endpoint
  * (POST /api/v1/internal/users/lookup with {phone}). Mirrors

package/dist/bin/helpers/confirm-prompt.js

@@ -36,13 +36,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.confirmIfProd = confirmIfProd;
 const readline = __importStar(require("readline"));
 /**
- * On prod, print the resolved action and require typing "yes" to proceed.
- * No-op on stage or when --yes was passed. Exits 1 if user declines.
+ * On a production env, print the resolved action and require typing "yes" to
+ * proceed. Both AWS `prod` and Aliyun `cn-prod` are production — cn-prod must
+ * gate identically or the cn rollout silently loses the prod safety prompt.
+ * No-op on stage / cn-stage or when --yes was passed. Exits 1 if user declines.
  */
+const PROD_ENVS = new Set(['prod', 'cn-prod']);
 async function confirmIfProd(env, actionDescription, skipFlag) {
-    if (env !== 'prod' || skipFlag)
+    if (!PROD_ENVS.has(env) || skipFlag)
         return;
-    console.log(`\n⚠️  About to perform on PROD:\n${actionDescription}\n`);
+    console.log(`\n⚠️  About to perform on ${env.toUpperCase()}:\n${actionDescription}\n`);
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const answer = await new Promise((resolve) => {
         rl.question('Type "yes" to confirm: ', (a) => { rl.close(); resolve(a.trim()); });

package/dist/bin/helpers/db-utils.js

@@ -35,6 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RDS_HOSTS = void 0;
 exports.isCnEnv = isCnEnv;
+exports.isCnStageEnv = isCnStageEnv;
+exports.cnInfisicalEnv = cnInfisicalEnv;
+exports.cnRdsHost = cnRdsHost;
 exports.escapeSQL = escapeSQL;
 exports.getGitHubVariable = getGitHubVariable;
 exports.getInfisicalConfig = getInfisicalConfig;
@@ -67,14 +70,29 @@ const EC2_HOST = '3.0.210.113';
 // ─── cn-prod (阿里云) 常量 ────────────────────────────────────────────────────
 // cn-prod 跑在阿里云 SAE，与海外 AWS 完全独立：独立 Infisical (secrets-cn.optima.chat)
 // + 内网 RDS（无公网端点）经 buildbox ECS 跳板 SSH 隧道访问。设计见 optima-dev-skills#21。
+// cn Infisical 是【单实例双环境】：prod=cn-prod、staging=cn-stage（URL/org/project 共享，
+// 只切 environment 参数）。cn-stage 数据面共用 prod VPC，故走【同一 buildbox】跳板。
 const CN_INFISICAL_URL = process.env.INFISICAL_CN_URL || 'https://secrets-cn.optima.chat';
 const CN_INFISICAL_ORG = process.env.INFISICAL_CN_ORG || 'f44012fa-0659-4f7e-b0ac-ed01244efc8a';
 const CN_INFISICAL_PROJECT = process.env.INFISICAL_CN_PROJECT || '4deef229-11be-40a5-8f56-b61f0bce7240';
-const CN_RDS_HOST = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com';
+const CN_RDS_HOST = 'pgm-2zexwx9eso9e4yla.pg.rds.aliyuncs.com'; // cn-prod RDS
+const CN_STAGE_RDS_HOST = 'pgm-2zem1u9zdh06boim.pg.rds.aliyuncs.com'; // cn-stage RDS（独立实例，共用 prod VPC）
 const CN_BUILDBOX_HOST = process.env.OPTIMA_CN_BUILDBOX_HOST || '47.94.105.163';
-/** env 是否指向 cn-prod（阿里云）。接受 `cn` / `cn-prod`。 */
+/** env 是否指向阿里云（cn-prod 或 cn-stage）。接受 `cn` / `cn-prod` / `cn-stage`。 */
 function isCnEnv(env) {
-    return env === 'cn' || env === 'cn-prod';
+    return env === 'cn' || env === 'cn-prod' || env === 'cn-stage';
+}
+/** env 是否指向 cn-stage（阿里云预发）。 */
+function isCnStageEnv(env) {
+    return env === 'cn-stage';
+}
+/** cn env → cn Infisical environment slug。cn-stage→staging，其余 cn→prod。 */
+function cnInfisicalEnv(env) {
+    return env === 'cn-stage' ? 'staging' : 'prod';
+}
+/** cn env → 内网 RDS host。cn-stage→stage 实例，其余 cn→prod 实例。 */
+function cnRdsHost(env) {
+    return env === 'cn-stage' ? CN_STAGE_RDS_HOST : CN_RDS_HOST;
 }
 // ─── SQL escaping ───────────────────────────────────────────────────────────
 /** Escape a string value for safe inclusion in SQL single-quoted literals. */
@@ -146,10 +164,13 @@ function getCnInfisicalToken() {
         throw new Error(`cn Infisical select-organization 失败: ${JSON.stringify(org).slice(0, 200)}`);
     return org.token;
 }
-/** 读 cn Infisical 某 folder（prod env）→ key→value map。expand=true 让服务端解析 `${...}` 引用。 */
-function getCnSecrets(token, secretPath, expand = false) {
+/**
+ * 读 cn Infisical 某 folder → key→value map。expand=true 让服务端解析 `${...}` 引用。
+ * environment：cn-prod 用 `prod`、cn-stage 用 `staging`（同一实例双环境）。
+ */
+function getCnSecrets(token, secretPath, expand = false, environment = 'prod') {
     const data = curlJson([
-        `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=prod&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
+        `${CN_INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${CN_INFISICAL_PROJECT}&environment=${environment}&secretPath=${encodeURIComponent(secretPath)}&expandSecretReferences=${expand}`,
         '-H', `Authorization: Bearer ${token}`,
     ]);
     const secrets = {};
@@ -460,17 +481,18 @@ function queryDB(conn, sql) {
  * 连 cn-prod 某服务库：creds 取自 cn Infisical 的 /shared-secrets/database-users +
  * /database-names（按 prefix，如 AUTH/BILLING），经 buildbox 跳板隧道（动态端口）。
  */
-function connectCnDB(prefix) {
+function connectCnDB(prefix, cnEnv = 'cn-prod') {
+    const infEnv = cnInfisicalEnv(cnEnv);
     const token = getCnInfisicalToken();
-    const users = getCnSecrets(token, '/shared-secrets/database-users');
-    const names = getCnSecrets(token, '/shared-secrets/database-names');
+    const users = getCnSecrets(token, '/shared-secrets/database-users', false, infEnv);
+    const names = getCnSecrets(token, '/shared-secrets/database-names', false, infEnv);
     const user = users[`${prefix}_DB_USER`];
     const password = users[`${prefix}_DB_PASSWORD`];
     const database = names[`${prefix}_DB_NAME`];
     if (!user || !password || !database) {
         throw new Error(`cn DB creds 不全 for ${prefix}（需 ${prefix}_DB_USER/PASSWORD@database-users + ${prefix}_DB_NAME@database-names）。该服务 cn 可能用字面 DATABASE_URL，见 optima-dev-skills#21。`);
     }
-    const port = ensureTunnel(CN_RDS_HOST, 'cn-buildbox');
+    const port = ensureTunnel(cnRdsHost(cnEnv), 'cn-buildbox');
     const conn = { host: 'localhost', port, user, password, database };
     return { query: (sql) => queryDB(conn, sql) };
 }
@@ -479,9 +501,9 @@ function connectCnDB(prefix) {
  * 用于 cred 不在 shared-secrets/database-users 的服务（如 gateway-core）。
  * expandSecretReferences=true 让 cn Infisical 解析 `${...}` 引用为字面值。
  */
-function connectCnDBFromUrl(servicePath) {
+function connectCnDBFromUrl(servicePath, cnEnv = 'cn-prod') {
     const token = getCnInfisicalToken();
-    const secrets = getCnSecrets(token, servicePath, true);
+    const secrets = getCnSecrets(token, servicePath, true, cnInfisicalEnv(cnEnv));
     const dbUrl = secrets['DATABASE_URL'];
     if (!dbUrl)
         throw new Error(`cn DATABASE_URL 未找到 at ${servicePath}`);

package/dist/bin/helpers/discount/create.js

@@ -24,7 +24,7 @@ Optional:
   --ends <date>            Valid-until
   --max <N>                Max total redemptions (default: unlimited; 1 = single-use)
   --campaign <label>       Grouping label
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -81,7 +81,7 @@ Optional:
 }
 async function runCreate(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Create discount code ${args.code.toUpperCase()} (${args.percentOff}% off)`, args.yes);
     const body = { code: args.code, percentOff: args.percentOff };
     if (args.productKeys)

package/dist/bin/helpers/discount/disable.js

@@ -11,7 +11,7 @@ Required:
   --code <CODE>
 
 Optional:
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -40,7 +40,7 @@ Optional:
 }
 async function runDisable(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Disable discount code ${args.code.toUpperCase()}`, args.yes);
     const res = await (0, billing_http_1.callBilling)(args.env, 'PATCH', `/api/billing/admin/discount-codes/${encodeURIComponent(args.code)}`, { status: 'DISABLED' });
     console.log(`✓ Disabled (HTTP ${res.status}):`);

package/dist/bin/helpers/discount/generate.js

@@ -59,7 +59,7 @@ Optional:
   --products <a,b,...>     Limit to these productKeys
   --starts <date>          Valid-from (YYYY-MM-DD or ISO)
   --ends <date>            Valid-until
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -114,7 +114,7 @@ Optional:
 }
 async function runGenerate(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Generate ${args.count} unique discount codes (${args.percentOff}% off, campaign ${args.campaign})`, args.yes);
     const body = { count: args.count, percentOff: args.percentOff, campaign: args.campaign };
     if (args.productKeys)

package/dist/bin/helpers/discount/list.js

@@ -10,7 +10,7 @@ Optional:
   --campaign <label>       Filter by campaign
   --code <CODE>            Filter by exact code
   --limit <N>              Max rows (default 500, max 1000)
-  --env stage|prod         (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
         process.exit(0);
     }
     const out = { env: 'stage' };
@@ -45,7 +45,7 @@ Optional:
 }
 async function runList(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     const qs = new URLSearchParams();
     if (args.campaign)
         qs.set('campaign', args.campaign);

package/dist/bin/helpers/entitlement/grant.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runGrant = runGrant;
 const billing_http_1 = require("../billing-http");
 const confirm_prompt_1 = require("../confirm-prompt");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement grant --email <user> --product-key <slug> --justification "..." [options]
@@ -15,7 +14,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy=<clientId>.`);
         process.exit(0);
@@ -57,10 +56,8 @@ Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy
 }
 async function runGrant(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: GRANT product '${args.productKey}' to user ${args.email} (userId=${userId}) on ${args.env.toUpperCase()}\nJustification: ${args.justification}`, args.yes);
     console.log(`\n🎁 Granting ${args.productKey} to ${args.email}...`);
     const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/grant-entitlement', {

package/dist/bin/helpers/entitlement/list.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runList = runList;
 const billing_http_1 = require("../billing-http");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement list --email <user-email> [options]
@@ -11,7 +10,7 @@ Required:
   --email <user-email>             Resolved to userId via user-auth DB
 
 Optional:
-  --env stage|prod                 (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
         process.exit(0);
     }
     const out = { env: 'stage' };
@@ -36,10 +35,8 @@ Optional:
 }
 async function runList(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     const res = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
     const rows = res.body.entitlements ?? [];
     if (rows.length === 0) {

package/dist/bin/helpers/entitlement/revoke.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runRevoke = runRevoke;
 const billing_http_1 = require("../billing-http");
 const confirm_prompt_1 = require("../confirm-prompt");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement revoke --email <user> --product-key <slug> --reason "..." [options]
@@ -15,7 +14,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Refuses non-ADMIN_GRANT sources (PAYMENT, PARTNER) with source-specific
 error pointing to the right reversal flow.`);
@@ -60,10 +59,8 @@ const PAYMENT_REFUSAL = `refusing to revoke a PAYMENT-source entitlement via CLI
 const PARTNER_REFUSAL = `refusing to revoke a PARTNER-source entitlement via CLI; PARTNER grants are issued out-of-band and must be reversed via the partner contract / process that issued them. Manual psql is the escape hatch if absolutely necessary.`;
 async function runRevoke(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     // Step 1: Fetch user's entitlements
     const listRes = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
     const all = listRes.body.entitlements ?? [];