@xiashe/skill 0.1.22 → 0.1.23

package/README.md

@@ -31,7 +31,8 @@ The user-facing product flow should point creators at the official publish Markd
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs --help
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs inspect .
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs doctor .
-node packages/xiashe-skill-cli/bin/xiashe-skill.mjs publish . --code XS-XXXX-XXXX --to xiashe,red
+node packages/xiashe-skill-cli/bin/xiashe-skill.mjs preflight --claim-url https://<registry-host>/registry/skill/claim --json
+node packages/xiashe-skill-cli/bin/xiashe-skill.mjs publish . --code XS-XXXX-XXXX --claim-url https://<registry-host>/registry/skill/claim --to xiashe,red
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs setup . --code XS-XXXX-XXXX --hub all
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs setup . --code XS-XXXX-XXXX --hub red
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs verify . --hub red --dry-run --json
@@ -42,3 +43,17 @@ node packages/xiashe-skill-cli/bin/xiashe-skill.mjs prompt . --hub red --source-
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs snippet . --target js
 node packages/xiashe-skill-cli/bin/xiashe-skill.mjs track . --event skill_invoked --hub red --dry-run --json
 ```
+
+Use the `claimUrl` returned with a dashboard dynamic code exactly as issued. `publish` runs the same preflight automatically before it consumes a code: it verifies the exact registry origin, protocol version, and environment id exposed by that deployment. A dynamic code without an explicit `--claim-url` is rejected before the code is consumed, so development, CN, and global codes cannot accidentally be sent to the production registry. For a resumed upload, the CLI uses the registry origin stored in the local private manifest and preflights it again.
+
+## Reliable publish and recovery
+
+The publish path keeps three different values separate:
+
+- **Source fingerprint** — a stable SHA-256 of reviewed Skill source files. It is the idempotency key for the publish job.
+- **Artifact checksum** — SHA-256 of the generated `.tgz` bytes. The backend compares it only with storage's checksum for those exact bytes.
+- **Storage checksum** — the checksum reported after upload. It must match the artifact checksum; it is never compared with the source fingerprint.
+
+If the network breaks after the server receives a dynamic-code claim, rerun the exact same `publish` command before that code expires. The registry accepts only the same code and source fingerprint, returns the original local manifest credentials, and reuses the same package job. It never creates a second Skill or a second upload job. Do not generate a new dashboard code merely because a local HTTP response was interrupted.
+
+If an upload has already started, rerun the same command. The CLI queries the existing package job first and either reports success, waits for processing, or resumes the failed upload with the same public token and source fingerprint.

package/bin/xiashe-skill.mjs

@@ -68,7 +68,7 @@ function isTransportError(error) {
 }
 
 const LOCAL_ENV_DEFAULTS = loadLocalEnvDefaults();
-const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.22';
+const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.23';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
@@ -102,8 +102,6 @@ const HANDOFF_FILE = 'UPLOAD_HANDOFF.md';
 const DEFAULT_REGISTRY_URL = process.env.XIASHE_SKILL_REGISTRY_URL || `${DEFAULT_BASE_URL}/registry/skill-events`;
 const DEFAULT_AGENT_ACK_URL = process.env.XIASHE_SKILL_AGENT_ACK_URL || `${DEFAULT_BASE_URL}/registry/agent-ack`;
 const DEFAULT_CLAIM_URL = process.env.XIASHE_SKILL_CLAIM_URL || `${DEFAULT_BASE_URL}/registry/skill/claim`;
-const DEFAULT_PACKAGE_UPLOAD_URL = process.env.XIASHE_SKILL_PACKAGE_UPLOAD_URL || `${DEFAULT_BASE_URL}/registry/skill/package-upload-url`;
-const DEFAULT_PACKAGE_ARTIFACT_URL = process.env.XIASHE_SKILL_PACKAGE_ARTIFACT_URL || `${DEFAULT_BASE_URL}/registry/skill/package-artifact`;
 const EVENT_SCHEMA_VERSION = process.env.XIASHE_SKILL_EVENT_SCHEMA_VERSION || (REGISTRY_PROVIDER === 'agentpie'
   ? 'agentpie.skill.event.v1'
   : 'xiashe.skill.event.v1');
@@ -185,8 +183,8 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['platform description field', 'README', 'SKILL.md', `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`, `${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md`, `${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md`],
     runtimeDataPolicy: 'agent_ack_supported',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: `Follow the official Red Skill uploader.md / skillhub-upload flow. Put public source, safety, creator-card attribution, and the no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml + ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md + ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md protocol files in the public package when Markdown/YAML files are accepted. Keep .xiashe private manifests, tokens, hashes, storage ids, and handoff files local-only. Send Agent Ack events only when the host can safely call HTTP/MCP.`,
-    xiasheLocalOnlyFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'internal handoff/checklists'],
+    allowedFilePolicy: `Follow the official Red Skill uploader.md / skillhub-upload flow. Put public source, safety, creator-card attribution, and the no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml + ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md + ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md protocol files in the public package when Markdown/YAML files are accepted. Keep ${WORK_DIR} private manifests, tokens, hashes, storage ids, and handoff files local-only. Send Agent Ack events only when the host can safely call HTTP/MCP.`,
+    localOnlyRegistryFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'internal handoff/checklists'],
     forbiddenPublicFiles: ['credentials', 'cookies', 'browser/account sessions', 'public tokens', 'signing secrets', 'hidden telemetry'],
     safetyChecklist: [
       '功能描述真实、清晰、有实际使用价值，不夸大或误导用户。',
@@ -205,7 +203,7 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['SKILL.md', 'README', 'platform description field'],
     runtimeDataPolicy: 'agent_ack_supported',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: 'Follow ClawHub official file rules. Treat XiaShe registry files as local-only unless ClawHub explicitly accepts them. Add public Agent Ack instructions where ClawHub allows Skill instructions.',
+    allowedFilePolicy: `Follow ClawHub official file rules. Treat ${PRODUCT_NAME} registry files as local-only unless ClawHub explicitly accepts them. Add public Agent Ack instructions where ClawHub allows Skill instructions.`,
     forbiddenPublicFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'public tokens', 'signing secrets']
   },
   skillhub: {
@@ -285,7 +283,7 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['README', 'SKILL.md', 'platform description field'],
     runtimeDataPolicy: 'runtime_if_http_or_mcp',
     defaultDataSource: 'attribution',
-    allowedFilePolicy: 'Follow the target platform official rules first; merge only safe XiaShe disclosure and callbacks.',
+    allowedFilePolicy: `Follow the target platform official rules first; merge only safe ${PRODUCT_NAME} disclosure and callbacks.`,
     forbiddenPublicFiles: ['public tokens in public docs', 'signing secrets', 'hidden background processes']
   }
 };
@@ -317,6 +315,7 @@ Usage:
   ${COMMAND_NAME} setup [skill-dir] --code <dynamic-code> [--hub all|${FIRST_PARTY_HUB}|red]
   ${COMMAND_NAME} setup [skill-dir] --public-token <token> --skill-id <id> [--hub all|${FIRST_PARTY_HUB}|red]
   ${COMMAND_NAME} doctor [skill-dir] [--json]
+  ${COMMAND_NAME} preflight --claim-url <url> [--json]
   ${COMMAND_NAME} verify [skill-dir] [--hub <hub>] [--scenario <label>] [--dry-run]
   ${COMMAND_NAME} attach [skill-dir] --code <dynamic-code> [--name <name>]
   ${COMMAND_NAME} attach [skill-dir] --public-token <token> [--skill-id <id>] [--name <name>]
@@ -328,6 +327,7 @@ Options:
   --public-token <token>      Public write token issued by ${PRODUCT_NAME} registry.
   --code <dynamic-code>       One-time ${PRODUCT_NAME} dashboard code used to claim registry identity.
   --claim-url <url>           Code claim endpoint. Defaults to XIASHE_SKILL_CLAIM_URL or ${DEFAULT_CLAIM_URL}
+  --registry-doctor-url <url> Registry preflight endpoint. Defaults to the claim URL origin.
   --skill-id <id>             Public ${PRODUCT_NAME} Skill registry id.
   --registry-url <url>        Event endpoint written to the manifest.
   --agent-ack-url <url>       No-secret Agent Ack endpoint written to the local manifest.
@@ -356,11 +356,13 @@ Options:
   --source-url <url>          User-provided source URL an Agent can use during third-party upload.
   --package-url <url>         Deprecated alias for --source-url.
   --skill-version <version>   Override the Skill release version without editing package.json.
-  --package-upload-url <url>  Package upload ticket endpoint. Defaults to ${DEFAULT_PACKAGE_UPLOAD_URL}
-  --package-artifact-url <url> Package artifact attach endpoint. Defaults to ${DEFAULT_PACKAGE_ARTIFACT_URL}
+  --package-upload-url <url>  Package upload ticket endpoint on the same registry origin.
+  --package-artifact-url <url> Package artifact attach endpoint on the same registry origin.
   --out <path>                Output prompt or snippet file.
   --out-dir <path>            Output directory for setup artifacts. Defaults to ${WORK_DIR}/.
   --no-package-upload         Skip automatic ${PRODUCT_NAME} complete package upload.
+  --paid-skill                Treat third-party packages as protected paid-Skill connectors only.
+  --protected-skill           Alias for --paid-skill. Never upload full paid prompt/source to third-party hubs.
   --embed-skill-md            Also write a clearly marked registry section into SKILL.md.
   --no-skill-md               Do not write registry text into SKILL.md. Red hub embeds by default.
   --no-snippet                Setup should skip writing the runtime analytics snippet.
@@ -379,7 +381,7 @@ function fail(message, code = 1) {
 
 function parseArgs(argv) {
   const args = { _: [], json: false, dryRun: false };
-  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-package-upload', 'no-xiashe-package-upload']);
+  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-package-upload', 'no-xiashe-package-upload', 'paid-skill', 'protected-skill']);
   for (let i = 0; i < argv.length; i += 1) {
     const value = argv[i];
     if (value === '--help' || value === '-h') {
@@ -534,7 +536,7 @@ function latestVersionEndpoint(inspectedOrRegistry = {}) {
 
 function creatorFooterTemplate(inspected, language = 'zh') {
   const registry = inspected.registry || {};
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorName = normalizeText(registry.creatorProfile?.displayName || registry.creatorDisplayName || registry.creatorName, 120) || '待创作者补充';
   const creatorSignal = normalizeText(registry.creatorProfile?.xiaSignal || registry.creatorXiaSignal || registry.xiaSignal, 80);
   if (language === 'en') {
@@ -632,8 +634,48 @@ function isLikelyEntrypointFile(filePath) {
   return /(^|\/)(package\.json|requirements\.txt|pyproject\.toml|deno\.json|mcp\.json|manifest\.json|skill\.json|index\.(js|mjs|cjs|ts|tsx|py)|main\.(js|mjs|cjs|ts|tsx|py)|server\.(js|mjs|cjs|ts|tsx|py))$/i.test(filePath);
 }
 
+function truthyPaidValue(value) {
+  if (value === true) return true;
+  if (typeof value === 'number') return value > 0;
+  const text = normalizeText(value, 120).toLowerCase();
+  return [
+    'paid',
+    'protected',
+    'requires_payment',
+    'requires-entitlement',
+    'entitlement',
+    'alipay_ai_collect',
+    'stripe',
+    'charging',
+    '收费',
+    '付费'
+  ].includes(text);
+}
+
+function isProtectedPaidSkill(inspected) {
+  const registry = inspected.registry || {};
+  const candidates = [
+    inspected.isPaid,
+    inspected.requiresEntitlement,
+    inspected.billingModel,
+    inspected.monetizationMode,
+    inspected.accessMode,
+    registry.isPaid,
+    registry.paidAccess,
+    registry.requiresEntitlement,
+    registry.billingModel,
+    registry.monetizationMode,
+    registry.accessMode,
+    registry.payment?.required,
+    registry.payment?.channel
+  ];
+  return candidates.some(truthyPaidValue);
+}
+
 function packagePlanForHub(inspected, hub) {
   const profile = reviewProfileForHub(hub);
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const thirdPartyProtectedPackage = protectedPaidSkill && !['agentpie', 'xiashe'].includes(profile.hub);
   const localOnly = [];
   const candidateUploadFiles = [];
   const forbiddenPatterns = [
@@ -654,6 +696,14 @@ function packagePlanForHub(inspected, hub) {
       localOnly.push(file.path);
       continue;
     }
+    if (thirdPartyProtectedPackage) {
+      if (isPublicRuntimeProtocolFile(file.path) || /^README(\.[a-z0-9]+)?$/i.test(file.path)) {
+        candidateUploadFiles.push(file.path);
+      } else {
+        localOnly.push(file.path);
+      }
+      continue;
+    }
     if (profile.packageMode === 'full_skill_package') {
       candidateUploadFiles.push(file.path);
       continue;
@@ -683,6 +733,8 @@ function packagePlanForHub(inspected, hub) {
   return {
     hub: profile.hub,
     label: profile.label,
+    protectedPaidSkill,
+    thirdPartyProtectedPackage,
     reviewProfile: profile,
     dataSourcePolicy: {
       runtime: 'Only real Skill execution callbacks, MCP/HTTP/API Tool calls, webhooks, or external Agent ack.',
@@ -698,17 +750,24 @@ function packagePlanForHub(inspected, hub) {
       `${WORK_DIR}/runtime-events.js`,
       `${WORK_DIR}/platform-profiles.json`
     ])).sort(),
-    disclosureTargets: profile.disclosurePlacement,
+    disclosureTargets: thirdPartyProtectedPackage
+      ? ['README', `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`, `${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md`, `${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md`, 'platform private/admin field']
+      : profile.disclosurePlacement,
     forbiddenPatterns,
     safetyChecklist: profile.safetyChecklist || [],
     requiresUserConfirmation: true,
     notes: [
+      thirdPartyProtectedPackage
+        ? `Protected paid Skill mode is active. Third-party packages must be connector/bootstrap only: do not upload the complete prompt, source package, ${WORK_DIR}/ files, package URLs, storage IDs, or install artifacts. The complete protected Skill package is delivered only through the ${PRODUCT_NAME} Gateway after entitlement is verified.`
+        : '',
       profile.allowedFilePolicy,
       profile.manifestPolicy === 'local_only'
-        ? `Keep ${WORK_DIR}/${MANIFEST_FILE} local by default. Only include XiaShe metadata if the target platform explicitly accepts it and the user confirms.`
+        ? `Keep ${WORK_DIR}/${MANIFEST_FILE} local by default. Only include ${PRODUCT_NAME} metadata if the target platform explicitly accepts it and the user confirms.`
         : 'Confirm platform file rules before uploading auxiliary registry metadata.',
       hub === 'red'
-        ? `For Red Skill, include only public source files plus no-secret ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml when Markdown/YAML files are accepted. Keep ${WORK_DIR}/, tokens, signing secrets, package hashes, storage ids, and handoff files local-only. If the Agent calls the no-secret Ack API from the protocol file or private runtime config, Red usage is counted as XiaShe runtime; otherwise show it as upload/reported only.`
+        ? thirdPartyProtectedPackage
+          ? `For paid Red Skill distribution, publish only the ${PRODUCT_NAME} connector/bootstrap description and no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md. The external Agent must obtain a user-specific access session from ${PRODUCT_NAME}; after entitlement is confirmed, it must retrieve, verify, unpack, and read the complete protected Skill package locally. Do not mirror that package into Red.`
+          : `For Red Skill, include only public source files plus no-secret ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml when Markdown/YAML files are accepted. Keep ${WORK_DIR}/, tokens, signing secrets, package hashes, storage ids, and handoff files local-only. If the Agent calls the no-secret Ack API from the protocol file or private runtime config, Red usage is counted as ${PRODUCT_NAME} runtime; otherwise show it as upload/reported only.`
         : '',
       profile.runtimeDataPolicy === 'attribution_only_by_default'
         ? 'Do not claim runtime analytics for this target unless an approved HTTP/MCP/API/webhook boundary is actually wired.'
@@ -770,12 +829,22 @@ async function inferSkillMetadata(root, flags = {}) {
     skillKey: safeSkillKey(flags['skill-key'] || manifest?.skillKey || packageJson?.name || name),
     description: normalizeText(flags.description || manifest?.description || packageJson?.description || firstParagraph || '', 500),
     version: normalizeText(flags['skill-version'] || packageJson?.version || manifest?.version || '0.1.0', 80),
+    isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || manifest?.isPaid || manifest?.registry?.isPaid || manifest?.registry?.paidAccess),
+    requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || manifest?.requiresEntitlement || manifest?.registry?.requiresEntitlement),
+    billingModel: normalizeText(flags['billing-model'] || manifest?.billingModel || manifest?.registry?.billingModel, 80) || null,
+    monetizationMode: normalizeText(flags['monetization-mode'] || manifest?.monetizationMode || manifest?.registry?.monetizationMode, 80) || null,
+    accessMode: normalizeText(flags['access-mode'] || manifest?.accessMode || manifest?.registry?.accessMode, 80) || null,
     registry: manifest?.registry || null
   };
 }
 
 function shouldIgnore(name) {
-  return DEFAULT_IGNORE.has(name) || name.endsWith('~') || name.endsWith('.tmp') || name.endsWith('.log');
+  return DEFAULT_IGNORE.has(name) ||
+    name.startsWith('.env.') ||
+    /\.(pem|key)$/i.test(name) ||
+    name.endsWith('~') ||
+    name.endsWith('.tmp') ||
+    name.endsWith('.log');
 }
 
 async function walkFiles(root, current = root, out = []) {
@@ -821,6 +890,7 @@ async function postJson(url, body, timeoutMs = 20_000) {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
+      redirect: 'error',
       signal: controller.signal
     });
     const text = await response.text();
@@ -845,13 +915,166 @@ async function postJson(url, body, timeoutMs = 20_000) {
   }
 }
 
-function urlForRegistryPath(baseUrl, pathname, fallback) {
-  const base = normalizeText(baseUrl, 1_000) || fallback;
+function registryClaimEndpoint(claimUrl) {
+  const raw = normalizeText(claimUrl, 1_000) || DEFAULT_CLAIM_URL;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INVALID: claim URL is not a valid URL.');
+  }
+  const pathname = url.pathname.replace(/\/+$/, '');
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || pathname !== '/registry/skill/claim') {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INVALID: claim URL must be a clean https://<trusted-host>/registry/skill/claim endpoint.');
+  }
+  const host = url.hostname.toLowerCase();
+  const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
+  if (url.protocol !== 'https:' && !(isLocalhost && process.env.XIASHE_SKILL_ALLOW_INSECURE_LOCALHOST === '1')) {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INSECURE: only HTTPS registry endpoints are accepted.');
+  }
+  return url;
+}
+
+function explicitClaimUrl(flags = {}) {
+  return normalizeText(
+    flags['claim-url'] ||
+    process.env.XIASHE_SKILL_CLAIM_URL ||
+    LOCAL_ENV_DEFAULTS.XIASHE_SKILL_CLAIM_URL,
+    1_000
+  );
+}
+
+function claimUrlFromRegistryOrigin(registryOrigin) {
+  const origin = normalizeBaseUrl(registryOrigin);
+  return origin ? `${origin}/registry/skill/claim` : '';
+}
+
+function claimUrlForCode(flags = {}) {
+  const claimUrl = explicitClaimUrl(flags);
+  if (!claimUrl) {
+    throw new Error(
+      'CREATOR_SKILL_CLAIM_URL_REQUIRED: a dynamic code must be used with the exact --claim-url issued by the dashboard. ' +
+      'This prevents dev, CN, and global registry codes from being sent to the wrong environment.'
+    );
+  }
+  return claimUrl;
+}
+
+function claimUrlForExistingManifest(flags = {}, registry = {}) {
+  return (
+    explicitClaimUrl(flags) ||
+    claimUrlFromRegistryOrigin(registry.registryOrigin) ||
+    DEFAULT_CLAIM_URL
+  );
+}
+
+function configuredRegistryOrigins() {
+  const supplied = [
+    process.env.XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS,
+    LOCAL_ENV_DEFAULTS.XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS,
+    DEFAULT_BASE_URL
+  ]
+    .filter(Boolean)
+    .flatMap((value) => String(value).split(','))
+    .map((value) => normalizeBaseUrl(value))
+    .filter(Boolean)
+    .map((value) => new URL(value).origin.toLowerCase());
+  return new Set(supplied);
+}
+
+function isTrustedRegistryClaimUrl(claimUrl) {
+  const endpoint = registryClaimEndpoint(claimUrl);
+  const host = endpoint.hostname.toLowerCase();
+  const isOfficialHost =
+    host === 'xiashe.chat' || host.endsWith('.xiashe.chat') ||
+    host === 'agentpie.app' || host.endsWith('.agentpie.app');
+  const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
+  const trustedOrigins = configuredRegistryOrigins();
+  if (!isOfficialHost && !isLocalhost && !trustedOrigins.has(endpoint.origin.toLowerCase())) {
+    throw new Error('CREATOR_SKILL_REGISTRY_ORIGIN_UNTRUSTED: this dynamic code points to an untrusted registry origin. Use the exact dashboard command, or configure XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS for an approved self-hosted endpoint.');
+  }
+  return endpoint;
+}
+
+async function getJson(url, timeoutMs = 12_000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { method: 'GET', redirect: 'error', signal: controller.signal });
+    const text = await response.text();
+    let payload = {};
+    try {
+      payload = text ? JSON.parse(text) : {};
+    } catch {
+      throw new Error(`Bad JSON response from ${url}`);
+    }
+    if (!response.ok || payload.ok === false) {
+      throw new Error(payload.error || payload.message || `HTTP ${response.status}`);
+    }
+    return payload;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error || 'unknown error');
+    if (!isTransportError(error)) throw error;
+    throw new Error(`Network request failed for ${url}: ${message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function preflightRegistryClaim(claimUrl, flags = {}) {
+  const endpoint = isTrustedRegistryClaimUrl(claimUrl);
+  const expectedOrigin = endpoint.origin.replace(/\/+$/, '');
+  const doctorUrl = registryEndpointUrl(
+    endpoint,
+    '/registry/skill/doctor',
+    flags['registry-doctor-url'],
+    'registry doctor'
+  );
+  const doctor = await getJson(doctorUrl, Number(flags['timeout-ms'] || 20_000));
+  const registryOrigin = normalizeBaseUrl(doctor.registryOrigin);
+  const protocolVersion = normalizeText(doctor.protocolVersion, 120);
+  const environmentId = normalizeText(doctor.environmentId, 160);
+  if (!registryOrigin || registryOrigin !== expectedOrigin) {
+    throw new Error(`CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: claim endpoint ${expectedOrigin} does not match the registry doctor origin ${registryOrigin || 'missing'}. Do not consume this code; regenerate it from the same environment.`);
+  }
+  if (!protocolVersion || !environmentId) {
+    throw new Error('CREATOR_SKILL_REGISTRY_DOCTOR_INCOMPLETE: update the registry backend before using a dynamic code.');
+  }
+  return {
+    ok: true,
+    claimUrl: endpoint.toString(),
+    doctorUrl,
+    registryOrigin,
+    protocolVersion,
+    environmentId,
+    provider: normalizeText(doctor.provider, 80) || REGISTRY_PROVIDER
+  };
+}
+
+function registryEndpointUrl(claimEndpoint, pathname, suppliedUrl, label) {
+  const endpoint = isTrustedRegistryClaimUrl(claimEndpoint);
+  const expected = new URL(pathname, endpoint.origin);
+  const raw = normalizeText(suppliedUrl, 1_000);
+  if (!raw) return expected.toString();
+  let candidate;
   try {
-    return new URL(pathname, base).toString();
+    candidate = new URL(raw);
   } catch {
-    return fallback;
+    throw new Error(`CREATOR_SKILL_REGISTRY_URL_INVALID: ${label} URL is not valid.`);
+  }
+  if (
+    candidate.origin !== endpoint.origin ||
+    candidate.pathname.replace(/\/+$/, '') !== expected.pathname.replace(/\/+$/, '') ||
+    candidate.username ||
+    candidate.password ||
+    candidate.search ||
+    candidate.hash
+  ) {
+    throw new Error(
+      `CREATOR_SKILL_REGISTRY_ENDPOINT_MISMATCH: ${label} must stay on the exact registry origin and path bound to the dynamic code.`
+    );
   }
+  return candidate.toString();
 }
 
 function shouldIgnorePackageEntry(relativePath, entryName, isDirectory = false) {
@@ -936,11 +1159,14 @@ function tarHeader(file, size) {
   const header = Buffer.alloc(512, 0);
   const split = splitTarPath(file.relative);
   header.write(split.name, 0, 100, 'utf8');
-  header.write(octal(file.mode & 0o777 || 0o644, 8), 100, 8, 'ascii');
+  // Keep archive bytes reproducible. Local mtimes and group permissions are
+  // machine-specific and must not make a valid retry look like a new package.
+  const normalizedMode = file.mode & 0o111 ? 0o755 : 0o644;
+  header.write(octal(normalizedMode, 8), 100, 8, 'ascii');
   header.write(octal(0, 8), 108, 8, 'ascii');
   header.write(octal(0, 8), 116, 8, 'ascii');
   header.write(octal(size, 12), 124, 12, 'ascii');
-  header.write(octal(Math.floor(new Date(file.mtime).getTime() / 1000), 12), 136, 12, 'ascii');
+  header.write(octal(0, 12), 136, 12, 'ascii');
   header.fill(0x20, 148, 156);
   header.write('0', 156, 1, 'ascii');
   header.write('ustar', 257, 6, 'ascii');
@@ -975,7 +1201,10 @@ async function createTarGz(files) {
   }
   chunks.push(Buffer.alloc(1024, 0));
   const tar = Buffer.concat(chunks);
-  const gzipped = await gzipAsync(tar, { level: 9 });
+  // Node's current gzip implementation defaults to deterministic metadata,
+  // but make the invariant explicit so retries on another host have the same
+  // archive checksum when the files are unchanged.
+  const gzipped = await gzipAsync(tar, { level: 9, mtime: 0 });
   if (gzipped.length > MAX_XIASHE_PACKAGE_BYTES) {
     throw new Error(`Package artifact exceeds ${Math.round(MAX_XIASHE_PACKAGE_BYTES / (1024 * 1024))}MB.`);
   }
@@ -1028,6 +1257,7 @@ async function uploadBytesToStorage(uploadUrl, bytes, contentType, timeoutMs = 6
       method: 'POST',
       headers: { 'content-type': contentType || 'application/octet-stream' },
       body: bytes,
+      redirect: 'error',
       signal: controller.signal
     });
     const text = await response.text();
@@ -1056,6 +1286,29 @@ async function uploadBytesToStorage(uploadUrl, bytes, contentType, timeoutMs = 6
   }
 }
 
+async function getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags = {}) {
+  return await postJson(
+    registryEndpointUrl(claimUrl, '/registry/skill/package-status', flags['package-status-url'], 'package status'),
+    {
+      publicToken,
+      uploadJobId: normalizeText(uploadJobId, 160) || undefined,
+      idempotencyKey: normalizeText(idempotencyKey, 220) || undefined
+    },
+    Number(flags['timeout-ms'] || 20_000)
+  );
+}
+
+async function waitForPackagePublish(claimUrl, publicToken, uploadJobId, idempotencyKey, flags = {}) {
+  const timeoutMs = Math.max(5_000, Math.min(90_000, Number(flags['publish-status-timeout-ms'] || 45_000)));
+  const deadline = Date.now() + timeoutMs;
+  let status = await getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags);
+  while (status.found && (status.state === 'queued' || status.state === 'processing') && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 1_000));
+    status = await getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags);
+  }
+  return status;
+}
+
 async function uploadXiashePackageArtifact(root, flags, manifestResult) {
   if (flags.dryRun || flags['no-package-upload'] || flags['no-xiashe-package-upload']) {
     return {
@@ -1075,32 +1328,86 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     normalizeText(manifestResult.manifest?.sourceFingerprint?.sha256, 128) ||
     normalizeText(inspected.package?.sha256, 128) ||
     artifact.sourceSha256;
-  const claimUrl = normalizeText(flags['claim-url'], 800) || DEFAULT_CLAIM_URL;
+  // A resumed upload has no dynamic code to protect it. Bind it back to the
+  // origin recorded in the private manifest instead of silently falling back
+  // to the production registry, then verify that origin before any write.
+  const claimUrl = claimUrlForExistingManifest(flags, registry);
+  const registryPreflight = await preflightRegistryClaim(claimUrl, flags);
+  const expectedRegistryOrigin = normalizeBaseUrl(registry.registryOrigin);
+  const expectedEnvironmentId = normalizeText(registry.environmentId, 160);
+  if (
+    (expectedRegistryOrigin && expectedRegistryOrigin !== registryPreflight.registryOrigin) ||
+    (expectedEnvironmentId && expectedEnvironmentId !== registryPreflight.environmentId)
+  ) {
+    throw new Error(
+      'CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the local manifest belongs to a different registry environment. ' +
+      'Do not upload or claim a new code; switch to the original environment or start a new dashboard task.'
+    );
+  }
   const uploadTicket =
     manifestResult.claimPackageArtifactUpload ||
     await postJson(
-      normalizeText(flags['package-upload-url'], 1_000) || urlForRegistryPath(claimUrl, '/registry/skill/package-upload-url', DEFAULT_PACKAGE_UPLOAD_URL),
+      registryEndpointUrl(claimUrl, '/registry/skill/package-upload-url', flags['package-upload-url'], 'package upload'),
       {
         publicToken,
         idempotencyKey: registrySourceSha256
       },
       Number(flags['timeout-ms'] || 20_000)
     );
-  const uploadUrl = normalizeText(uploadTicket?.uploadUrl, 2_000);
+  let activeUploadTicket = uploadTicket;
+  let uploadUrl = normalizeText(activeUploadTicket?.uploadUrl, 2_000);
   if (!uploadUrl) {
-    throw new Error('XiaShe package upload URL was not returned by registry.');
+    const priorStatus = await waitForPackagePublish(
+      claimUrl,
+      publicToken,
+      normalizeText(activeUploadTicket?.uploadJobId, 160),
+      registrySourceSha256,
+      flags
+    );
+    if (priorStatus.found && priorStatus.state === 'succeeded') {
+      return {
+        ok: true,
+        skipped: false,
+        resumed: true,
+        artifactPath: artifact.artifactPath,
+        fileName: artifact.fileName,
+        sizeBytes: artifact.sizeBytes,
+        sourceSha256: registrySourceSha256,
+        archiveSourceSha256: artifact.sourceSha256,
+        artifactSha256: artifact.artifactSha256,
+        fileCount: artifact.fileCount,
+        storageId: priorStatus.storageId ?? null,
+        publishStatus: priorStatus.status,
+        uploadJobId: priorStatus.uploadJobId,
+        attachResult: priorStatus
+      };
+    }
+    if (priorStatus.found && (priorStatus.state === 'queued' || priorStatus.state === 'processing')) {
+      throw new Error(`${PRODUCT_NAME} package publish is still processing (job ${priorStatus.uploadJobId}). Run the same publish command again to resume; it will not create a second job.`);
+    }
+    activeUploadTicket = await postJson(
+      registryEndpointUrl(claimUrl, '/registry/skill/package-upload-url', flags['package-upload-url'], 'package upload'),
+      { publicToken, idempotencyKey: registrySourceSha256 },
+      Number(flags['timeout-ms'] || 20_000)
+    );
+    uploadUrl = normalizeText(activeUploadTicket?.uploadUrl, 2_000);
+    if (!uploadUrl) {
+      throw new Error(`${PRODUCT_NAME} package upload cannot resume yet. Query /registry/skill/package-status with the existing publicToken and uploadJobId; do not claim a new code.`);
+    }
   }
   const bytes = await readFile(artifact.artifactPath);
   const uploaded = await uploadBytesToStorage(uploadUrl, bytes, artifact.contentType, Number(flags['upload-timeout-ms'] || 90_000));
   const attachResult = await postJson(
-    normalizeText(flags['package-artifact-url'], 1_000) || urlForRegistryPath(claimUrl, '/registry/skill/package-artifact', DEFAULT_PACKAGE_ARTIFACT_URL),
+    registryEndpointUrl(claimUrl, '/registry/skill/package-artifact', flags['package-artifact-url'], 'package artifact'),
     {
       publicToken,
       storageId: uploaded.storageId,
-      uploadJobId: normalizeText(uploadTicket?.uploadJobId, 160) || undefined,
+      uploadJobId: normalizeText(activeUploadTicket?.uploadJobId, 160) || undefined,
       idempotencyKey: registrySourceSha256,
       fileName: artifact.fileName,
       contentType: artifact.contentType,
+      sourceSha256: registrySourceSha256,
+      artifactSha256: artifact.artifactSha256,
       packageSha256: registrySourceSha256,
       packageFileCount: artifact.fileCount,
       packageTotalBytes: artifact.sourceTotalBytes,
@@ -1113,6 +1420,16 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     },
     Number(flags['timeout-ms'] || 20_000)
   );
+  const finalStatus = await waitForPackagePublish(
+    claimUrl,
+    publicToken,
+    normalizeText(attachResult.uploadJobId || activeUploadTicket?.uploadJobId, 160),
+    registrySourceSha256,
+    flags
+  );
+  if (finalStatus.found && finalStatus.state === 'failed') {
+    throw new Error(`${PRODUCT_NAME} package publish failed: ${normalizeText(finalStatus.lastError, 500) || 'unknown validation error'}. Rerun the same command after correcting the reported package issue; do not claim a new code.`);
+  }
   return {
     ok: true,
     skipped: false,
@@ -1120,13 +1437,14 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     fileName: artifact.fileName,
     sizeBytes: artifact.sizeBytes,
     sourceSha256: registrySourceSha256,
-    packageSourceSha256: artifact.sourceSha256,
+    archiveSourceSha256: artifact.sourceSha256,
     artifactSha256: artifact.artifactSha256,
     fileCount: artifact.fileCount,
     storageId: uploaded.storageId,
-    publishStatus: attachResult.publishStatus ?? null,
-    uploadJobId: attachResult.uploadJobId ?? normalizeText(uploadTicket?.uploadJobId, 160) ?? null,
-    attachResult
+    publishStatus: finalStatus.status ?? attachResult.publishStatus ?? null,
+    uploadJobId: attachResult.uploadJobId ?? normalizeText(activeUploadTicket?.uploadJobId, 160) ?? null,
+    attachResult,
+    finalStatus
   };
 }
 
@@ -1155,9 +1473,19 @@ async function inspectSkill(root, flags = {}) {
 async function writeManifest(root, flags) {
   const inspected = await inspectSkill(root, flags);
   const code = normalizeText(flags.code, 80);
+  const existingRegistry = inspected.registry || {};
+  const suppliedPublicToken = normalizeText(flags['public-token'], 512);
+  if (!code && suppliedPublicToken && !explicitClaimUrl(flags) && !claimUrlFromRegistryOrigin(existingRegistry.registryOrigin)) {
+    throw new Error(
+      'CREATOR_SKILL_CLAIM_URL_REQUIRED: a new manifest created from --public-token must include --claim-url. ' +
+      'Existing manifests resume through their saved registry origin.'
+    );
+  }
+  const claimUrl = code ? claimUrlForCode(flags) : claimUrlForExistingManifest(flags, existingRegistry);
+  const registryPreflight = code ? await preflightRegistryClaim(claimUrl, flags) : null;
   const claim = code
     ? await postJson(
-        normalizeText(flags['claim-url'], 800) || DEFAULT_CLAIM_URL,
+        registryPreflight.claimUrl,
         {
           code,
           skill: {
@@ -1165,6 +1493,9 @@ async function writeManifest(root, flags) {
             skillKey: inspected.skillKey,
             description: inspected.description,
             version: inspected.version,
+            sourceSha256: inspected.package.sha256,
+            // Compatibility with registries published before v2. The value is
+            // still a source fingerprint, never a compressed archive hash.
             packageSha256: inspected.package.sha256,
             packageFileCount: inspected.package.fileCount,
             packageTotalBytes: inspected.package.totalBytes
@@ -1177,7 +1508,13 @@ async function writeManifest(root, flags) {
         Number(flags['timeout-ms'] || 20_000)
       )
     : null;
-  const existingRegistry = inspected.registry || {};
+  if (claim && registryPreflight) {
+    const claimEnvironment = normalizeText(claim.registry?.environmentId, 160);
+    const claimOrigin = normalizeBaseUrl(claim.registry?.registryOrigin);
+    if (claimEnvironment !== registryPreflight.environmentId || claimOrigin !== registryPreflight.registryOrigin) {
+      throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the claimed Skill identity was returned by a different registry environment. No package upload was attempted.');
+    }
+  }
   const publicToken = normalizeText(flags['public-token'] || claim?.publicToken || existingRegistry.publicToken, 512);
   if (!publicToken) {
     throw new Error('Missing --code or --public-token.');
@@ -1204,10 +1541,23 @@ async function writeManifest(root, flags) {
     skillKey: safeSkillKey(claim?.skillKey || inspected.skillKey),
     description: normalizeText(claim?.description, 500) || inspected.description,
     version: normalizeText(claim?.version, 80) || inspected.version,
+    isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.isPaid || existingRegistry.isPaid || existingRegistry.paidAccess),
+    requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.requiresEntitlement || existingRegistry.requiresEntitlement),
+    billingModel: normalizeText(flags['billing-model'] || inspected.billingModel || existingRegistry.billingModel, 80) || null,
+    monetizationMode: normalizeText(flags['monetization-mode'] || inspected.monetizationMode || existingRegistry.monetizationMode, 80) || null,
+    accessMode: normalizeText(flags['access-mode'] || inspected.accessMode || existingRegistry.accessMode, 80) || null,
     registry: {
       provider: REGISTRY_PROVIDER,
+      protocolVersion: normalizeText(claim?.registry?.protocolVersion || registryPreflight?.protocolVersion, 120) || null,
+      environmentId: normalizeText(claim?.registry?.environmentId || registryPreflight?.environmentId, 160) || null,
+      registryOrigin: normalizeBaseUrl(claim?.registry?.registryOrigin || registryPreflight?.registryOrigin) || null,
       skillId: normalizeText(flags['skill-id'] || claim?.skillId || existingRegistry.skillId, 160) || null,
       publicToken,
+      isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.isPaid || existingRegistry.isPaid || existingRegistry.paidAccess),
+      requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.requiresEntitlement || existingRegistry.requiresEntitlement),
+      billingModel: normalizeText(flags['billing-model'] || inspected.billingModel || existingRegistry.billingModel, 80) || null,
+      monetizationMode: normalizeText(flags['monetization-mode'] || inspected.monetizationMode || existingRegistry.monetizationMode, 80) || null,
+      accessMode: normalizeText(flags['access-mode'] || inspected.accessMode || existingRegistry.accessMode, 80) || null,
       registryUrl: normalizeText(flags['registry-url'] || claim?.registryUrl || existingRegistry.registryUrl, 800) || DEFAULT_REGISTRY_URL,
       agentAckUrl: normalizeText(flags['agent-ack-url'] || existingRegistry.agentAckUrl, 800) || DEFAULT_AGENT_ACK_URL,
       creatorCardUrl,
@@ -1282,7 +1632,8 @@ async function writeManifest(root, flags) {
     ok: true,
     manifestPath,
     manifest,
-    claimPackageArtifactUpload: claim?.packageArtifactUpload ?? null
+    claimPackageArtifactUpload: claim?.packageArtifactUpload ?? null,
+    registryPreflight
   };
 }
 
@@ -1294,13 +1645,13 @@ function hubInstruction(hub) {
     return '虾舍商店发布是完整 Skill 包和 registry manifest 的主流程。请保留公开披露、归因和 runtime analytics 回传能力；如果本地 manifest 有 registry public token 或已有创作者认证 CLI/API 会话，就创建或复用虾舍商店草稿。';
   }
   if (hub === 'red') {
-    return 'Red Skill 的官方 uploader.md / skillhub-upload / 页面流程是主流程。请优先使用本机 skillhub-upload；虾舍负责在 SKILL.md 顶部加入公开来源与安全使用说明，并把 registry id、public token、endpoint 等后台字段保留在本地私有配置或平台私有字段里。';
+    return `Red Skill 的官方 uploader.md / skillhub-upload / 页面流程是主流程。请优先使用本机 skillhub-upload；${PRODUCT_NAME} 负责生成平台安全披露、connector/运行时协议和本地 registry handoff，并把 registry id、public token、endpoint 等后台字段保留在本地私有配置或平台私有字段里。`;
   }
   if (hub === 'clawhub') {
-    return 'ClawHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 ClawHub 当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+    return `ClawHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 ClawHub 当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
   }
   if (hub === 'skillhub') {
-    return 'SkillHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 SkillHub 当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+    return `SkillHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 SkillHub 当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
   }
   if (hub === 'claude') {
     return 'Claude Skills 的官方上传/导入流程是主流程。请先确认 Claude 当前 Skill 格式和共享要求，再把下面的 registry 披露文本放入允许的说明文件。';
@@ -1320,7 +1671,7 @@ function hubInstruction(hub) {
   if (hub === 'coze') {
     return 'Coze Agent/Plugin/Workflow 的官方配置和发布流程是主流程。请先按 Coze 当前工具、插件或知识库要求配置，再把下面的 registry 回调作为可选 HTTP/API 步骤接入。';
   }
-  return '目标 Skill Hub 的官方 CLI、prompt 或页面流程是主流程。请先确认平台当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+  return `目标 Skill Hub 的官方 CLI、prompt 或页面流程是主流程。请先确认平台当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
 }
 
 function platformPromptPlaceholder(hub) {
@@ -1331,36 +1682,36 @@ function platformPromptPlaceholder(hub) {
     return '如果用户要发布到虾舍商店，并且当前环境已有创作者认证 CLI/API 会话，请优先创建虾舍商店草稿；如果没有认证会话，请完成 registry setup、披露、平台 profile 和 handoff 文件，不要要求 Agent 宿主登录或索取账号凭证。不要把第三方平台限制套用到虾舍完整 Skill 包。';
   }
   if (hub === 'red') {
-    return '如果本机有 skillhub-upload，请按小红书官方 CLI 流程 login --agent、打包并提交；否则请让用户从小红书创作服务平台复制 uploader.md 里的官方对话上传口令。不要用虾舍 prompt 替代 Red Skill 官方流程。';
+    return `如果本机有 skillhub-upload，请按小红书官方 CLI 流程 login --agent、打包并提交；否则请让用户从小红书创作服务平台复制 uploader.md 里的官方对话上传口令。不要用 ${PRODUCT_NAME} prompt 替代 Red Skill 官方流程。`;
   }
   if (hub === 'clawhub') {
-    return '如果 ClawHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代 ClawHub 官方流程。';
+    return `如果 ClawHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代 ClawHub 官方流程。`;
   }
   if (hub === 'skillhub') {
-    return '如果 SkillHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代 SkillHub 官方流程。';
+    return `如果 SkillHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代 SkillHub 官方流程。`;
   }
   if (hub === 'claude') {
-    return '如果 Claude 提供官方 Skill 导入/上传说明，请优先使用官方说明；不要用虾舍 prompt 替代 Claude 官方流程。';
+    return `如果 Claude 提供官方 Skill 导入/上传说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Claude 官方流程。`;
   }
   if (hub === 'codex') {
-    return '如果 Codex 提供官方 Skill 或 Agent 能力安装说明，请优先使用官方说明；不要用虾舍 prompt 替代 Codex 官方流程。';
+    return `如果 Codex 提供官方 Skill 或 Agent 能力安装说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Codex 官方流程。`;
   }
   if (hub === 'cursor') {
-    return '如果 Cursor 提供官方规则、扩展或 Agent 能力安装说明，请优先使用官方说明；不要用虾舍 prompt 替代 Cursor 官方流程。';
+    return `如果 Cursor 提供官方规则、扩展或 Agent 能力安装说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Cursor 官方流程。`;
   }
   if (hub === 'workbuddy') {
-    return '如果 WorkBuddy 提供官方上传 prompt、网页或 API 流程，请优先使用官方流程；不要用虾舍 prompt 替代 WorkBuddy 官方流程。';
+    return `如果 WorkBuddy 提供官方上传 prompt、网页或 API 流程，请优先使用官方流程；不要用 ${PRODUCT_NAME} prompt 替代 WorkBuddy 官方流程。`;
   }
   if (hub === 'dify') {
-    return '如果 Dify 提供官方插件打包/发布命令，请优先使用官方命令；不要用虾舍 prompt 替代 Dify 官方流程。';
+    return `如果 Dify 提供官方插件打包/发布命令，请优先使用官方命令；不要用 ${PRODUCT_NAME} prompt 替代 Dify 官方流程。`;
   }
   if (hub === 'coze') {
-    return '如果 Coze 提供 Agent/Plugin/Workflow 的配置步骤，请优先使用 Coze 官方配置；不要用虾舍 prompt 替代 Coze 官方流程。';
+    return `如果 Coze 提供 Agent/Plugin/Workflow 的配置步骤，请优先使用 Coze 官方配置；不要用 ${PRODUCT_NAME} prompt 替代 Coze 官方流程。`;
   }
-  return '如果目标平台提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代平台官方流程。';
+  return `如果目标平台提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代平台官方流程。`;
 }
 
-function uploadCompatibilityLines(hub, manifestFile) {
+function uploadCompatibilityLines(hub, manifestFile, protectedPaidSkill = false) {
   const localManifest = `${WORK_DIR}/${manifestFile}`;
   if (hub === 'agentpie') {
     return [
@@ -1381,14 +1732,16 @@ function uploadCompatibilityLines(hub, manifestFile) {
   if (hub === 'red') {
     return [
       'Red Skill 兼容性要求：',
-      '- 以小红书官方 `uploader.md`、`skillhub-upload` 或页面上传流程为准；不要用虾舍 prompt 替代官方流程。',
-      `- 上传包必须在 SKILL.md 最开头写清楚 ${PRODUCT_NAME} Required Runtime Contract：更新检查、创作者名片、强制 footer、公开来源和安全使用边界。`,
+      `- 以小红书官方 \`uploader.md\`、\`skillhub-upload\` 或页面上传流程为准；不要用 ${PRODUCT_NAME} prompt 替代官方流程。`,
+      protectedPaidSkill
+        ? `- 付费受保护 Skill 的 Red 公开包只能是 connector/bootstrap：写清楚 ${PRODUCT_NAME} Gateway 接入、付费访问边界、创作者名片和安全使用边界，不上传完整 SKILL.md/prompt/source。`
+        : `- 上传包必须在 SKILL.md 最开头写清楚 ${PRODUCT_NAME} Required Runtime Contract：更新检查、创作者名片、强制 footer、公开来源与安全使用边界。`,
       `- 如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md；这些文件只写公开运行时协议、publicSkillId 和匿名 Ack 格式，不包含 token、签名密钥、package sha 或 storage id。`,
       '- 不要要求用户可见回复追加广告占位、telemetry JSON、包指纹、后台字段或本地路径。',
-      `- ${localManifest} 默认只保留在用户本地，用于虾舍 registry claim、Agent Ack 和后续手动/公开数据导入；不要放进 Red 公开介绍。`,
-      '- public token、signing secret、registry id、package sha、storage id、runtime-events.js、.xiashe 内部 handoff/checklist 不进入 Red 公开介绍或公开包。',
+      `- ${localManifest} 默认只保留在用户本地，用于 ${PRODUCT_NAME} registry claim、Agent Ack 和后续手动/公开数据导入；不要放进 Red 公开介绍。`,
+      `- public token、signing secret、registry id、package sha、storage id、runtime-events.js、${WORK_DIR} 内部 handoff/checklist 不进入 Red 公开介绍或公开包。`,
       '- publicSkillId 与 Agent Ack endpoint 只能出现在专门的 no-secret 协议文件或平台私有配置里；不要写进营销介绍、用户可见回复或截图说明。',
-      '- Agent 使用 Skill 后，只有宿主平台或本地私有配置实际执行安全 Ack，虾舍才会记录 installed / used / completed / failed 真实统计。',
+      `- Agent 使用 Skill 后，只有宿主平台或本地私有配置实际执行安全 Ack，${PRODUCT_NAME} 才会记录 installed / used / completed / failed 真实统计。`,
       '- 如果 Red 平台或运行环境没有执行 Agent Ack，则不要伪造 runtime；只保留上传成功和 reported 数据。',
       '',
       'Red Skill 基础安全规范：',
@@ -1413,20 +1766,22 @@ function uploadCompatibilityLines(hub, manifestFile) {
 function publicDisclosure(inspected, registryUrl, hub = 'generic') {
   const creatorCardUrl = normalizeText(inspected.registry?.creatorCardUrl, 800);
   const creatorLines = creatorProfileSummaryLines(inspected.registry || {}, 'en');
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   if (hub === 'red') {
     return [
       '公开披露文本：',
       '```markdown',
       `### ${PRODUCT_NAME} Attribution Disclosure`,
       '',
-      `This Skill may include a ${PRODUCT_NAME} creator attribution or disclosure link for public listing and aggregate reporting.`,
-      creatorCardUrl ? `Creator card: ${creatorCardUrl}` : 'Creator card: <creator card link from XiaShe dashboard>',
+      `This Skill may include ${PRODUCT_NAME} creator attribution or a disclosure link for public listing and aggregate reporting.`,
+      creatorCardUrl ? `Creator card: ${creatorCardUrl}` : `Creator card: <creator card link from ${PRODUCT_NAME} dashboard>`,
       ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
       '',
       `- Public protocol files, when included: ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md.`,
+      protectedPaidSkill ? `- Paid access: this Red package is a connector/bootstrap for ${PRODUCT_NAME}. The complete paid Skill package is delivered by ${PRODUCT_NAME} Gateway only after entitlement verification, then retrieved into the current Agent private workspace.` : null,
       '- Data mode for Red Skill upload: Agent Ack runtime only when the host Agent calls a no-secret Ack protocol; upload/reported otherwise.',
-      '- Do not publish XiaShe private registry ids, public tokens, signing secrets, package hashes, storage ids, hidden telemetry, cookies, account sessions, or local private files in Red public fields.',
-      '- Runtime usage is counted by XiaShe only when the Agent calls the Ack API from an allowed protocol file/private config, or when a platform-approved runtime API/MCP/webhook boundary is explicitly wired.',
+      `- Do not publish ${PRODUCT_NAME} private registry ids, public tokens, signing secrets, package hashes, storage ids, hidden telemetry, cookies, account sessions, or local private files in Red public fields.`,
+      `- Runtime usage is counted by ${PRODUCT_NAME} only when the Agent calls the Ack API from an allowed protocol file/private config, or when a platform-approved runtime API/MCP/webhook boundary is explicitly wired.`,
       '- Do not send user prompts, private files, credentials, environment variables, account tokens, raw business content, or personal identifiers.',
       '```'
     ];
@@ -1440,7 +1795,7 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
     '',
     `- Registry provider: ${REGISTRY_PROVIDER}`,
     `- Skill key: ${inspected.skillKey}`,
-    `- Creator card: ${creatorCardUrl || '<creator card link from XiaShe dashboard>'}`,
+    `- Creator card: ${creatorCardUrl || `<creator card link from ${PRODUCT_NAME} dashboard>`}`,
     ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
     '- Events, if enabled by the runtime/platform, should contain only public metadata and aggregate status.',
     '- Do not expose package hashes, storage IDs, upload job IDs, public tokens, private endpoints, local paths, hidden telemetry files, credentials, account sessions, or environment variables.',
@@ -1452,9 +1807,10 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
 
 function agentAckInstructionBlock(inspected, hub = 'generic') {
   const registry = inspected.registry || {};
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
   const ackUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const eventSchemaVersion = registry.runtimeSchemaVersion || RUNTIME_SCHEMA_VERSION;
   const normalizedHub = normalizeHub(hub) || hub || 'generic';
   const distributionPlatform = runtimeDistributionPlatformForHub(normalizedHub);
@@ -1473,10 +1829,16 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
     `- Runtime schema: ${eventSchemaVersion}`,
     `- Platform hub: ${normalizedHub}`,
     `- Distribution platform: ${distributionPlatform}`,
+    protectedPaidSkill
+      ? `- Access mode: protected paid Skill. This public package is only a connector/bootstrap. The complete protected Skill package is delivered by the ${PRODUCT_NAME} Gateway only after the user's entitlement is verified, then must be downloaded, verified, unpacked, and read locally.`
+      : `- Access mode: public/free Skill instructions may be used according to this package and the target platform rules.`,
+    protectedPaidSkill
+      ? `- On first real use, call the ${PRODUCT_NAME} Gateway to obtain the complete package. If it returns \`paymentRequired\`, present its explicit price and purpose, wait for the user's confirmation, complete the official payment flow, poll status, then retry. Do not treat a hosted status page as a payment page, and do not complete the task before the complete package is locally available.`
+      : null,
     '- Send only anonymous aggregate usage status. Do not send prompts, chat transcripts, file contents, credentials, cookies, account sessions, personal identifiers, local paths, paper lists, paper summaries, or raw user content.',
     '- User-facing replies should be concise and useful. Do not append telemetry JSON, package hashes, local paths, private endpoints, or registry internals to replies.',
     `- Read \`${PUBLIC_PROTOCOL_DIR}/runtime.yaml\` first when it exists, then read this file. If \`runtime.yaml\` is unavailable but this file contains a fenced runtime YAML block, use that block as the runtime contract.`,
-    '- Match XiaShe display text to the current conversation language. Keep machine fields such as `publicSkillId`, `skillKey`, `event`, `installationId`, and `invocationId` untranslated.',
+    `- Match ${PRODUCT_NAME} display text to the current conversation language. Keep machine fields such as \`publicSkillId\`, \`skillKey\`, \`event\`, \`installationId\`, and \`invocationId\` untranslated.`,
     '- Every completed Skill turn response must include the localized footer from the runtime contract. Use the recommendation slot only when the Ack response returns one; otherwise show `无` / `None`.',
     '- Before first use or once per day when network is available, check the latest version endpoint. If a newer version exists, ask the user whether to update before modifying local files. If the version is blocked, tell the user and do not continue silently.',
     '- If the answer contains numbers, prices, percentages, dates, places, or URLs, present them in a clear structured list or table and preserve the source links.',
@@ -1530,8 +1892,9 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
 
 function redPublicTrackingContractBlock(inspected) {
   const registry = inspected.registry || {};
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const marker = `${REGISTRY_PROVIDER}-runtime-contract`;
-  const cardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const cardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const currentVersion = normalizeText(inspected.version || registry.version, 80) || '1.0.0';
   const updateEndpoint = latestVersionEndpoint(inspected);
   const footer = creatorFooterTemplate(inspected, 'zh');
@@ -1540,6 +1903,9 @@ function redPublicTrackingContractBlock(inspected) {
     `## ${PRODUCT_NAME} Required Runtime Contract`,
     '',
     '使用本 Skill 时，必须优先遵循本小节。这个区块是给下游 Agent 读取的公开运行时契约，不是内部注释。',
+    protectedPaidSkill
+      ? `\n### 付费访问边界\n\n- 这是受保护的付费 Skill 连接器，不是完整 Skill prompt/source 包。\n- 第一次真实调用时，必须通过 ${PRODUCT_NAME} Gateway 获取完整本地包；如果返回 paymentRequired，向用户展示购买信息，等待支付确认后轮询状态并重试。\n- 付费权益确认后，必须下载、校验、解压并阅读 Gateway 返回的完整包中的 SKILL.md；完成前不要自行完成任务，也不要把公开 connector 当成完整 Skill 使用。\n- 同一 ${PRODUCT_NAME} 账户再次在其他 Agent 使用时，必须新领接入凭证和当前 Agent 的交付地址；已有权益会复用，不得共享 runtime token、下载地址或完整包。\n- 不要把完整 prompt、源码包、包下载地址、storage id、public token 或内部 manifest 上传到 Red Skill。\n`
+      : '',
     '',
     '### 检查更新',
     '',
@@ -1558,7 +1924,7 @@ function redPublicTrackingContractBlock(inspected) {
     footer,
     '```',
     '',
-    '如果当前对话使用英文，可以使用 runtime.yaml 里的英文 footer；否则默认使用上面的中文 footer。推荐位只使用 XiaShe Ack 响应返回的内容，没有返回时写“无”。',
+    `如果当前对话使用英文，可以使用 runtime.yaml 里的英文 footer；否则默认使用上面的中文 footer。推荐位只使用 ${PRODUCT_NAME} Ack 响应返回的内容，没有返回时写“无”。`,
     '',
     '### 安全边界',
     '',
@@ -1579,7 +1945,8 @@ function skillMdRegistryBlock(inspected, hub) {
     return redPublicTrackingContractBlock(inspected);
   }
   const registry = inspected.registry || {};
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const marker = `${REGISTRY_PROVIDER}-registry`;
   const currentVersion = normalizeText(inspected.version || registry.version, 80) || '1.0.0';
   const updateEndpoint = latestVersionEndpoint(inspected);
@@ -1588,6 +1955,9 @@ function skillMdRegistryBlock(inspected, hub) {
     `## ${PRODUCT_NAME} Required Runtime Contract`,
     '',
     `This Skill is published by its creator through ${PRODUCT_NAME}. Follow this section before using the Skill.`,
+    protectedPaidSkill
+      ? `\n### Protected Paid Access\n\n- This public package is a connector/bootstrap, not the complete paid Skill package or source package.\n- On first real use, call the ${PRODUCT_NAME} Gateway. If it returns \`paymentRequired\`, present the returned price and purpose, wait for confirmation, complete the official payment flow, poll status, and retry. A hosted status page is not a payment page.\n- After entitlement verification, download, verify, unpack, and read the complete package locally. Do not complete the task before that delivery succeeds.\n`
+      : '',
     '',
     '### Update Check',
     '',
@@ -1669,8 +2039,9 @@ function runtimeDistributionPlatformForHub(hub) {
 
 function buildRuntimeYaml(inspected, hub = 'red') {
   const registry = inspected.registry || {};
-  const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from XiaShe registry>';
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const publicSkillId = registry.skillId || registry.publicSkillId || `<public skill id from ${PRODUCT_NAME} registry>`;
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorName = normalizeText(registry.creatorProfile?.displayName || registry.creatorDisplayName || registry.creatorName, 120) || '<creator display name>';
   const creatorSignal = normalizeText(registry.creatorProfile?.xiaSignal || registry.creatorXiaSignal || registry.xiaSignal, 80) || '<creator signal>';
   const ackUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
@@ -1682,6 +2053,11 @@ function buildRuntimeYaml(inspected, hub = 'red') {
     `publicSkillId: ${yamlString(publicSkillId)}`,
     `skillKey: ${yamlString(inspected.skillKey)}`,
     `skillVersion: ${yamlString(skillVersion)}`,
+    'access:',
+    `  mode: ${yamlString(protectedPaidSkill ? 'protected_paid_connector' : 'public_or_free')}`,
+    `  paidPromptDeliveredBy: ${yamlString(protectedPaidSkill ? `${PRODUCT_NAME} Gateway after entitlement verification` : 'public package or target platform rules')}`,
+    `  firstUsePayment: ${yamlString(protectedPaidSkill ? 'show hosted payment session returned by gateway, poll status, retry prompt after entitlement' : 'not_required_by_protocol')}`,
+    `  neverUploadToThirdParty: ${yamlString(protectedPaidSkill ? 'full prompt, source package, package URL, storage id, public token, internal manifest' : 'secrets, private manifest, tokens, package hashes, storage ids')}`,
     'updateCheck:',
     "  mode: 'prompt_user'",
     `  currentVersion: ${yamlString(skillVersion)}`,
@@ -1801,7 +2177,7 @@ async function writePublicProtocolFiles(root, inspected, hub = 'red') {
   const disclosurePath = path.join(protocolDir, 'REGISTRY_DISCLOSURE.md');
   const runtimePath = path.join(protocolDir, 'runtime.yaml');
   const registry = inspected.registry || {};
-  const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from XiaShe registry>';
+  const publicSkillId = registry.skillId || registry.publicSkillId || `<public skill id from ${PRODUCT_NAME} registry>`;
   const agentAck = [
     agentAckInstructionBlock(inspected, hub),
     '',
@@ -1871,6 +2247,7 @@ async function uploadPrompt(inspected, flags) {
   const hub = normalizeHub(flags.hub || 'generic') || 'generic';
   const reviewProfile = reviewProfileForHub(hub);
   const packagePlan = packagePlanForHub(inspected, hub);
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const sourceUrl = normalizeText(flags['source-url'] || flags['package-url'], 1000);
   const platformCommand = normalizeText(flags['platform-command'], 1000);
   const platformPrompt = await readPlatformPrompt(flags);
@@ -1878,11 +2255,11 @@ async function uploadPrompt(inspected, flags) {
   const registryUrl = registry.registryUrl || DEFAULT_REGISTRY_URL;
   const agentAckUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorProfileLines = creatorProfileSummaryLines(registry, 'zh').filter((line) => !line.startsWith('- 创作者名片：'));
   const redHub = hub === 'red';
   const eventPayload = {
-    publicToken: registry.publicToken || '<xiashe public token from xiashe.skill.json>',
+    publicToken: registry.publicToken || `<public token from ${WORK_DIR}/${MANIFEST_FILE}>`,
     schemaVersion: registry.eventSchemaVersion || EVENT_SCHEMA_VERSION,
     eventType: 'hub_upload_succeeded',
     eventSource: 'cli',
@@ -1934,15 +2311,15 @@ async function uploadPrompt(inspected, flags) {
     '第三方平台官方流程：',
     `- ${hubLine}`,
     redHub
-      ? '- 平台官方 prompt / CLI / 页面表单是上传依据；虾舍提供本地 registry、Agent Ack 真实统计、安全披露和上传状态记录。'
-      : '- 平台官方 prompt / CLI / 页面表单是上传依据；虾舍只提供 registry 和 analytics 附加要求。',
-    '- 如果平台官方要求与虾舍附加说明冲突，以平台官方上传要求为准；不要为了 analytics 绕过平台规则。',
+      ? `- 平台官方 prompt / CLI / 页面表单是上传依据；${PRODUCT_NAME} 提供本地 registry、Agent Ack 真实统计、安全披露和上传状态记录。`
+      : `- 平台官方 prompt / CLI / 页面表单是上传依据；${PRODUCT_NAME} 只提供 registry 和 analytics 附加要求。`,
+    `- 如果平台官方要求与 ${PRODUCT_NAME} 附加说明冲突，以平台官方上传要求为准；不要为了 analytics 绕过平台规则。`,
     platformCommand ? `- 用户提供的官方命令：${platformCommand}` : `- ${platformPromptPlaceholder(hub)}`
   ];
   if (platformPrompt) {
     officialFlowLines.push('', '用户提供的第三方平台官方 prompt：', '```text', platformPrompt.trim(), '```');
   }
-  const compatibilityLines = uploadCompatibilityLines(hub, MANIFEST_FILE);
+  const compatibilityLines = uploadCompatibilityLines(hub, MANIFEST_FILE, protectedPaidSkill);
   const disclosureLines = publicDisclosure(inspected, registryUrl, hub);
   const runtimeGuidanceLines = redHub
     ? [
@@ -1953,14 +2330,21 @@ async function uploadPrompt(inspected, flags) {
         `- 描述：${inspected.description || '<从 SKILL.md/README.md 中提炼>'}`,
         `- 创作者名片：${creatorCardUrl}`,
         ...creatorProfileLines,
-        `- Red Skill 上传包按官方流程准备；如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这三个无密钥运行时协议文件。`,
+        protectedPaidSkill
+          ? `- 这是付费受保护 Skill：Red Skill 公开包只能是 ${PRODUCT_NAME} connector/bootstrap。不要上传完整 prompt、源码包、包下载链接、storage id、内部 manifest 或任何可绕过网关的材料。`
+          : `- Red Skill 上传包按官方流程准备；如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这三个无密钥运行时协议文件。`,
+        protectedPaidSkill
+          ? `- 外部 Agent 第一次真实使用时必须回到 ${PRODUCT_NAME} Gateway 获取完整受保护包；如果返回 paymentRequired，就展示购买信息、等待用户确认支付、轮询 status，再重试 get_skill_prompt，然后下载、校验、解压并读取 SKILL.md。`
+          : null,
         `- ${WORK_DIR}/、public token、signing secret、registry id、package sha、storage id、upload job id、runtime-events.js 和内部 handoff/checklist 默认只在本地保留，不进入 Red 公开包。`,
         `- publicSkillId 和 Agent Ack endpoint 只能出现在 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置里；不要写进营销介绍、用户可见回复或截图说明。`,
-        `- SKILL.md 最开头必须写 ${PRODUCT_NAME} Required Runtime Contract：当前版本、latest version endpoint、用户确认后更新、创作者名片链接、强制 footer 和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`,
+        protectedPaidSkill
+          ? `- 公开 connector 说明必须写清楚 ${PRODUCT_NAME} Gateway 接入、付费访问边界、latest version endpoint、用户确认后更新、创作者名片链接和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`
+          : `- SKILL.md 最开头必须写 ${PRODUCT_NAME} Required Runtime Contract：当前版本、latest version endpoint、用户确认后更新、创作者名片链接、强制 footer 和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`,
         '- 使用 Skill 前如果能联网，Agent 应先检查最新版本；有新版本就提示用户是否更新，无法联网则继续但说明更新状态未检查。',
-        '- 如果输出数字或链接，必须结构化展示；如果平台无法执行安全 Ack，不要伪造虾舍 runtime 数据。',
+        `- 如果输出数字或链接，必须结构化展示；如果平台无法执行安全 Ack，不要伪造 ${PRODUCT_NAME} runtime 数据。`,
         '- 上传成功后可以用 hub_upload_succeeded 记录公开 URL；这属于 attribution，不代表真实运行次数。',
-        `- 如果 Agent 读取 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置并执行 Agent Ack，installed / used / completed / failed 会进入虾舍 runtime 统计。`,
+        `- 如果 Agent 读取 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置并执行 Agent Ack，installed / used / completed / failed 会进入 ${PRODUCT_NAME} runtime 统计。`,
         '- 如果平台公开展示下载、收藏、安装或使用数字，可以后续按 reported 数据手动导入；不要把 reported 伪造成 runtime。',
         '- 先检查“能否安全上传”，再检查“Agent Ack 能否被执行”；二者在报告里分开。',
         `- Agent Ack 的字段要拆清楚：distributionPlatform 是分发平台，runtimeAgent 是实际运行的 Agent，runtimeHost 是宿主环境，sourceSurface 是发现入口，scenario 是枚举键，scenarioLabel 是短的人类可读场景。`,
@@ -1998,7 +2382,9 @@ async function uploadPrompt(inspected, flags) {
         '',
         JSON.stringify(eventPayload, null, 2),
         '',
-        'Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 SKILL.md 只保留创作者名片和安全使用边界。'
+        protectedPaidSkill
+          ? `Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 connector 只保留 ${PRODUCT_NAME} Gateway 接入、创作者名片和安全使用边界。`
+          : 'Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 SKILL.md 只保留创作者名片和安全使用边界。'
       ]
     : [
         `发布成功后，请把公开链接和平台返回的信息回传给${PRODUCT_NAME} registry。只发送公开元数据和聚合事件，不发送用户内容、私密输入或账号凭据。`,
@@ -2054,7 +2440,7 @@ async function uploadPrompt(inspected, flags) {
     '- attribution：发布、上传、归因链接点击、公开披露访问，只代表来源漏斗。',
     '- reported：平台公开数字或手动导入，例如收藏、下载、安装、静态平台显示使用数。',
     '- 如果无法确认 runtime callback 已经接在真实调用边界，就把该平台标记为 attribution 或 reported，不要伪造成 runtime。',
-    '- Agent ack：只有平台宿主、安装器或本地私有配置实际执行安全 Ack，才可以在安装/使用/完成/失败后计入虾舍实时使用数据。',
+    `- Agent ack：只有平台宿主、安装器或本地私有配置实际执行安全 Ack，才可以在安装/使用/完成/失败后计入 ${PRODUCT_NAME} 实时使用数据。`,
     '',
     ...compatibilityLines,
     '',
@@ -2064,10 +2450,12 @@ async function uploadPrompt(inspected, flags) {
       ? [
           'Red 公开包边界：',
           '',
-          `- 可以包含：SKILL.md、README/公开 references，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。`,
-          `- 不要包含：${WORK_DIR}/、${WORK_DIR}/${MANIFEST_FILE}、runtime-events.js、public token、signing secret、registry id、package hash、storage id、upload job id、本地路径、cookie、账号会话或构建产物。`,
+          protectedPaidSkill
+            ? `- 付费 Skill 只能包含：README/公开 connector 说明，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。不要把完整 SKILL.md/prompt/source 放入 Red 公开包。`
+            : `- 可以包含：SKILL.md、README/公开 references，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。`,
+          `- 不要包含：${WORK_DIR}/、${WORK_DIR}/${MANIFEST_FILE}、runtime-events.js、public token、signing secret、registry id、package hash、storage id、upload job id、本地路径、cookie、账号会话、构建产物${protectedPaidSkill ? '、完整 prompt 或源码包' : ''}。`,
           `- publicSkillId 和 Agent Ack endpoint 只能放在 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置里；不要放进营销介绍、用户可见回复或截图说明。`,
-          '- 如果宿主 Agent 不能读取协议文件/私有配置并执行 Ack，Red 安装成功不会自动变成虾舍 runtime 数据。'
+          `- 如果宿主 Agent 不能读取协议文件/私有配置并执行 Ack，Red 安装成功不会自动变成 ${PRODUCT_NAME} runtime 数据。`
         ]
       : [
           'Agent Ack 指令（只放在私有 runtime 配置、平台后台字段，或明确不会公开展示的安装说明中）：',
@@ -2106,6 +2494,7 @@ async function writePrompt(root, flags) {
 
 async function writeUnifiedHandoff(root, args) {
   const relativeOutDir = path.relative(root, args.outDir) || WORK_DIR;
+  const protectedPaidSkill = isProtectedPaidSkill(args.inspected);
   const promptIndex = args.promptResults
     .map((item) => `- ${item.hub}: ${path.relative(root, item.promptPath)}`)
     .join('\n');
@@ -2114,7 +2503,7 @@ async function writeUnifiedHandoff(root, args) {
     .join('\n');
   const registry = args.inspected.registry || {};
   const registryUrl = registry.registryUrl || DEFAULT_REGISTRY_URL;
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const content = [
     `# ${PRODUCT_NAME} Skill Upload Handoff`,
     '',
@@ -2131,7 +2520,7 @@ async function writeUnifiedHandoff(root, args) {
     '1. Identify the target platform from that official prompt, URL, command, or user message.',
     `2. Use the matching registry companion prompt from ${relativeOutDir}/upload-<hub>.md only as an internal checklist.`,
     '3. Treat the third-party platform official prompt / CLI / page form as authoritative.',
-    `4. For XiaShe Store, create or reuse the searchable listing. For Red Skill, use the official uploader.md / skillhub-upload flow.`,
+    `4. For ${PRODUCT_NAME} Registry, create or reuse the searchable listing. For Red Skill, use the official uploader.md / skillhub-upload flow.`,
     `5. For Red Skill, include no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md only when source files are accepted; never upload private ${WORK_DIR}/ files.`,
     `6. Ensure SKILL.md starts with ${PRODUCT_NAME} Required Runtime Contract: current version, latest version endpoint, user-approved update rule, creator card, required footer, and safety boundary.`,
     '7. Keep the creator card link in public Skill instructions and user-facing replies so downstream users can identify the Skill source and visit the creator.',
@@ -2141,10 +2530,15 @@ async function writeUnifiedHandoff(root, args) {
     '',
     'Red Skill exception:',
     '',
+    protectedPaidSkill
+      ? `- This is a protected paid Skill. Red Skill receives only a ${PRODUCT_NAME} connector/bootstrap package, not the full prompt/source package. Users must obtain access through ${PRODUCT_NAME} Gateway; payment and entitlement are enforced server-side before the complete protected package is delivered, downloaded, verified, and read locally.`
+      : null,
     '- Red Skill should use the official uploader.md / skillhub-upload / web upload flow as the source of truth.',
-    `- Public Red Markdown/YAML packages may include ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files.`,
+    protectedPaidSkill
+      ? `- Public Red Markdown/YAML packages may include only connector docs plus ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files. Do not include the complete SKILL.md/prompt/source package.`
+      : `- Public Red Markdown/YAML packages may include ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files.`,
     `- Keep ${WORK_DIR}/${MANIFEST_FILE}, ${WORK_DIR}/runtime-events.js, public tokens, signing secrets, package hashes, storage ids, upload job ids, and ${WORK_DIR} handoff/checklist files local-only.`,
-    '- Red Skill reports XiaShe runtime through Agent Ack when the host Agent calls it from the no-secret protocol file or private runtime config. If no Agent Ack occurs, show only upload/reported data.',
+    `- Red Skill reports ${PRODUCT_NAME} runtime through Agent Ack when the host Agent calls it from the no-secret protocol file or private runtime config. If no Agent Ack occurs, show only upload/reported data.`,
     '- Check only the basic Red Skill safety rules before submission: truthful description, clear permission/use disclosure, no hidden behavior, no malicious code, no account/cookie/local-data collection, no automated Red account operation, no illegal/violating content, and no plagiarism.',
     '',
     '## Platform mapping',
@@ -2224,11 +2618,11 @@ async function writeUnifiedHandoff(root, args) {
     '',
     'If the hub cannot run callbacks, keep upload attribution and use campaign links or manual imports. Do not fake runtime events.',
     '',
-    '## XiaShe Store draft auth',
+    `## ${PRODUCT_NAME} Registry draft auth`,
     '',
-    `For XiaShe Store, first check whether a submission already exists for this registry. ${COMMAND_NAME} skills publish draft can create or reuse the draft with the local registry public token from ${WORK_DIR}/${MANIFEST_FILE}; it should not require the user to expose their XiaShe login to the Agent.`,
+    `For ${PRODUCT_NAME} Registry, first check whether a submission already exists for this registry. ${COMMAND_NAME} skills publish draft can create or reuse the draft with the local registry public token from ${WORK_DIR}/${MANIFEST_FILE}; it should not require the user to expose their ${PRODUCT_NAME} login to the Agent.`,
     '',
-    'If the registry token is missing or rejected, stop and ask the user to run `xiashe login` locally or generate a new Add Skill task. Do not upload the package as another creator.',
+    `If the registry token is missing or rejected, stop and ask the user to run the local ${PRODUCT_NAME} login command or generate a new Add Skill task. Do not upload the package as another creator.`,
     '',
     'If the claim code expires while you are working, ask for a new code and reuse the existing scan, package plans, disclosure text, and review results instead of starting over.',
     ''
@@ -2519,7 +2913,7 @@ async function runDoctor(root, flags) {
     hasManifest && registry.publicToken && registry.registryUrl
       ? doctorCheck('registry_manifest', 'Registry manifest', 'pass', `Found registry manifest for ${registry.provider || REGISTRY_PROVIDER}.`)
       : redHub
-        ? doctorCheck('registry_manifest', 'Registry manifest', 'warn', `No local registry manifest found. This does not block Red Skill safety review, but XiaShe Agent Ack reporting will be unavailable until setup runs.`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> --hub red if XiaShe tracking is needed.`)
+        ? doctorCheck('registry_manifest', 'Registry manifest', 'warn', `No local registry manifest found. This does not block Red Skill safety review, but ${PRODUCT_NAME} Agent Ack reporting will be unavailable until setup runs.`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> --hub red if ${PRODUCT_NAME} tracking is needed.`)
         : doctorCheck('registry_manifest', 'Registry manifest', 'fail', `Missing usable registry manifest (${MANIFEST_FILE} or ${WORK_DIR}/${MANIFEST_FILE}).`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> or ${COMMAND_NAME} attach . --public-token <token> --skill-id <id>.`),
     registryBlockPresent(skillMd)
       ? doctorCheck('registry_block', 'Registry block', 'pass', 'SKILL.md contains the explicit registry disclosure block.')
@@ -2534,7 +2928,7 @@ async function runDoctor(root, flags) {
       ? doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'pass', 'SKILL.md contains the current runtime contract, required footer, and update check endpoint.')
       : redHub
         ? doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'fail', 'SKILL.md is missing the Required Runtime Contract, footer, or update check endpoint.', `Run ${COMMAND_NAME} setup . --code <code> --hub red to rewrite SKILL.md with the current contract.`)
-        : doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'warn', 'SKILL.md does not yet contain the Required Runtime Contract.', `Run ${COMMAND_NAME} setup . --code <code> --embed-skill-md if this hub allows XiaShe public runtime instructions.`),
+        : doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'warn', 'SKILL.md does not yet contain the Required Runtime Contract.', `Run ${COMMAND_NAME} setup . --code <code> --embed-skill-md if this hub allows ${PRODUCT_NAME} public runtime instructions.`),
     runtimeCallbackPresent
       ? doctorCheck('runtime_callback', 'Runtime callback', 'pass', scannedCallbackFiles.length > 0 ? `Runtime callback references found in ${scannedCallbackFiles.slice(0, 5).join(', ')}.` : 'Runtime callback snippet/reference detected.')
       : redHub
@@ -2562,6 +2956,11 @@ async function runDoctor(root, flags) {
       : redHub
         ? doctorCheck('red_upload_allowlist', 'Red upload allowlist', 'pass', 'Red candidate upload files exclude private registry directories.')
         : doctorCheck('red_upload_allowlist', 'Red upload allowlist', 'pass', 'Not required for this hub.'),
+    redHub && protectedPaidSkill && packagePlan.candidateUploadFiles.some((file) => /(^|\/)SKILL(\.[a-z0-9]+)?$/i.test(file) || (!isPublicRuntimeProtocolFile(file) && !/^README(\.[a-z0-9]+)?$/i.test(file)))
+      ? doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'fail', `Paid Red candidate upload files include full Skill content: ${packagePlan.candidateUploadFiles.join(', ')}`, `Use protected connector packaging only. Regenerate with ${COMMAND_NAME} setup . --code <code> --hub red --paid-skill.`)
+      : redHub && protectedPaidSkill
+        ? doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'pass', 'Protected paid Red package is connector/protocol only and excludes full SKILL.md/source content.')
+        : doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'pass', 'Not required for this hub/Skill.'),
     redHub && ['AGENT_ACK.md', 'REGISTRY_DISCLOSURE.md', 'runtime.yaml'].every((name) => packagePlan.candidateUploadFiles.includes(`${PUBLIC_PROTOCOL_DIR}/${name}`))
       ? doctorCheck('red_runtime_allowlist', 'Red runtime allowlist', 'pass', `Red candidate upload files include ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml.`)
       : redHub
@@ -2868,6 +3267,23 @@ async function main() {
       }
       return;
     }
+    if (command === 'preflight') {
+      const claimUrl = explicitClaimUrl(flags);
+      if (!claimUrl) {
+        throw new Error('CREATOR_SKILL_CLAIM_URL_REQUIRED: pass the exact --claim-url issued by the dashboard.');
+      }
+      const result = await preflightRegistryClaim(
+        claimUrl,
+        flags
+      );
+      print(flags.json ? result : [
+        `${PRODUCT_NAME} registry preflight passed.`,
+        `Environment: ${result.environmentId}`,
+        `Registry: ${result.registryOrigin}`,
+        `Protocol: ${result.protocolVersion}`
+      ].join('\n'), flags.json);
+      return;
+    }
     if (command === 'verify') {
       const result = await verifyRegistry(root, flags);
       print(flags.json ? result : formatVerify(result), flags.json);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/skill",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "type": "module",
   "bin": {
     "xiashe-skill": "bin/xiashe-skill.mjs"