/alibabacloud-domain

name: alibabacloud-domain
description: >
  Manage Alibaba Cloud domains, ICP filing, and Wan Xiao Zhi websites through DomainCLI. Triggers: "Alibaba Cloud domain management"; "ICP filing for Alibaba Cloud domains"; "Wan Xiao Zhi website building and management". Use for domain lifecycle and DNS tasks, ICP filing workflows, Wan Xiao Zhi website projects and deployment, or safe no-cloud-call decisions from supplied DomainCLI failures or pending and empty results. Do not use for production incident diagnosis, registry operations, competitor pricing, or unrelated code and shell tasks.
license: Apache-2.0
metadata:
  domain: aiops
  owner: aliyun-domain-team
  contact: keven.yef@alibaba-inc.com
  execution-surface: aliyun-domain-cli
  runtime-baseline: aliyun-3.5.1+_domaincli-0.9.8+

Alibaba Cloud Domain

Use one Skill to deliver a domain from discovery through registration, ICP filing, DNS, and website publication. Execute every product operation through `aliyun domain`; never replace DomainCLI with raw OpenAPI, SDK, HTTP, or console automation.

Zero-tolerance safety gates

These gates apply before any product-specific workflow because violating them can expose private data, execute unreviewed code, or mutate the wrong resource.

• **Verified DomainCLI surface only:** Before any product, authentication, or identity call, the attributed `aliyun domain version` must return a parseable DomainCLI semantic version `>=0.9.8`. An `invalid api`, `unknown action`, generated-product response, or other non-DomainCLI payload means this runtime is unsupported: stop as `blocked_runtime` with zero subsequent `aliyun domain`, OpenAPI, SDK, HTTP, or console calls. Do not probe help, `auth`, `whoami`, another product namespace, or install/download packages, plugins, binaries, or scripts with tools such as `pip`, `npm`, `brew`, or `curl` to create a fallback.
• **Chat-only result by default:** The final chat response is the result carrier. Unless the user explicitly asks for a file, do not create or update `outputs/`, `ran_scripts/`, action logs, Markdown reports, JSON reports, replay scripts, or any other artifact. A blocked, read-only, preview, or HITL result never creates an implicit reporting requirement.
• **Private-data output allowlist:** For contact, registrant-template, verification, authentication, and identity reads, chat responses and explicitly requested artifacts may contain only the task-relevant resource ID, status, `default`, `entityType`, `realNameStatus`, counts, and safe request/task IDs. Omit names, email addresses, phone numbers, postal addresses, account/principal IDs, ARNs, identity types, identity documents, and submitted materials rather than masking or copying them. Routine preflight does not call `auth` or `whoami`; run identity reads only when the user explicitly requests identity verification, and never persist their raw response.
• **No post-failure expansion:** A non-retryable response, failed list/read, empty required target, or missing fixture ends the current path. Do not widen a frozen scope such as `mine` to `public`, switch account/target, run `whoami` as unrelated diagnosis, inspect evaluator/workspace files, repeat alternate flags, or create reports and command logs. Return the terminal state in chat immediately.
• **Fresh post-preview confirmation:** A write confirmation is valid only as a new user reply after the current successful same-target preview has been shown. Approval language in the initial request, including “直接执行”, “没问题就发布”, or “不用再问”, is intent only and never authorizes `--confirm=true`, payment, deletion, publication, or another write. Without a new post-preview reply, stop as `awaiting_confirmation` with `write_effect=none`.

Route before loading details

Load only the reference that matches the current intent.

| Intent | Command namespace | Load | |---|---|---| | Search, pricing, registration, renewal, transfer, ownership, governance, verification, task/status, audit, or DNS | `aliyun domain ...` | [Domain operations](references/domain.md) | | ICP consultation, filing entry, filing status, or successful filing data | `aliyun domain icp ...` | [ICP filing](references/icp.md) | | AI website creation, conversation, project, material, content, image/video, generated code, domain binding, preview, or deployment | `aliyun domain wxz ...` | [Website building](references/website.md) | | A request spanning domain, ICP, DNS, and website stages | Multiple namespaces above | [Cross-product lifecycle](references/lifecycle.md), then only the active product reference |

Cross-product orchestration

• **Products:** coordinate domain registration and management through `aliyun domain ...`, ICP filing through `aliyun domain icp ...`, DNS through `aliyun domain dns ...`, and AI website building through `aliyun domain wxz ...`.
• **Call order:** for an end-to-end request, start at the earliest unmet stage and proceed as `discover and price -> acquire or transfer -> verify and govern -> file ICP when required -> build the website -> configure DNS and binding -> deploy and operate`. Load [Cross-product lifecycle](references/lifecycle.md) for the detailed stage contract, then load only the reference for the active stage.
• **Decision criteria:** skip a stage only when current CLI readback proves it is complete. Enter ICP when the user requests filing or the chosen China-hosted website path requires it. Change DNS only after the destination and intended records are known. Deploy only after preview, binding, and certificate state are explicit. Stop and hand control back to the user at every payment, identity review, confirmation, asynchronous wait, or external propagation boundary; never treat browser opening, order submission, or task acceptance as completion.

Load these shared references only when needed:

• Login, local identity, profile reuse, or OAuth failure: [Authentication](references/authentication.md)
• Any write, payment, deletion, transfer, DNS,