diff --git a/README.md b/README.md
index ea779fd..9f3db08 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,11 @@ VelarOS HTML Artifacts is a dependency-free browser runtime with a small TypeScr
 
 ## Install
 
-Authenticate npm for the private `@velaros-ai` GitHub Packages scope, then install:
+`@velaros-ai/html-artifacts` is a public package hosted on GitHub Packages. GitHub's
+npm registry currently still requires authentication to install public packages:
+use a personal access token (classic) with at least `read:packages` locally, or the
+repository-authorized `GITHUB_TOKEN` in GitHub Actions. Map the `@velaros-ai` scope
+to `https://npm.pkg.github.com`, provide the token, then install:
 
 ```bash
 npm install @velaros-ai/html-artifacts
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 134eaff..8bfc79b 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -11,7 +11,11 @@ VelarOS HTML Artifacts 是一个零运行时依赖的浏览器库。它统一负
 
 ## 安装
 
-为 GitHub Packages 的私有 `@velaros-ai` scope 配置 npm 认证后安装：
+`@velaros-ai/html-artifacts` 是托管在 GitHub Packages 上的公开包。GitHub 的 npm
+registry 当前安装公开包仍然需要认证：本地使用至少具有 `read:packages` 权限的
+personal access token（classic），GitHub Actions 使用已获仓库授权的
+`GITHUB_TOKEN`。将 `@velaros-ai` scope 映射到
+`https://npm.pkg.github.com`，提供 token 后安装：
 
 ```bash
 npm install @velaros-ai/html-artifacts
diff --git a/package-lock.json b/package-lock.json
index 7708c4b..2181ab1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@velaros-ai/html-artifacts",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@velaros-ai/html-artifacts",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "devDependencies": {
         "typescript": "^5.7.0",
diff --git a/package.json b/package.json
index b2ef918..d4aa59e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@velaros-ai/html-artifacts",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "A framework-neutral streaming HTML artifact protocol and sandboxed iframe runtime.",
   "keywords": [
     "ai",
diff --git a/scripts/check-package-contract.mjs b/scripts/check-package-contract.mjs
index 6c6f019..80ac253 100644
--- a/scripts/check-package-contract.mjs
+++ b/scripts/check-package-contract.mjs
@@ -6,6 +6,11 @@ import { fileURLToPath } from 'node:url'
 
 const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const manifest = JSON.parse(await readFile(path.join(repositoryRoot, 'package.json'), 'utf8'))
+const readme = await readFile(path.join(repositoryRoot, 'README.md'), 'utf8')
+const chineseReadme = await readFile(
+  path.join(repositoryRoot, 'README.zh-CN.md'),
+  'utf8'
+)
 const documentation = await readFile(
   path.join(repositoryRoot, 'docs/api.zh-CN.md'),
   'utf8'
@@ -29,6 +34,38 @@ for (const field of ['description', 'license', 'repository']) {
 if (!manifest.engines?.node) throw new Error(`${manifest.name} is missing a Node.js engine range`)
 if (manifest.sideEffects === undefined) throw new Error(`${manifest.name} must declare sideEffects`)
 if (!manifest.files?.includes('docs')) throw new Error(`${manifest.name} does not publish docs`)
+if (manifest.publishConfig?.access !== 'public') {
+  throw new Error(`${manifest.name} must publish with public access`)
+}
+if (manifest.publishConfig?.registry !== 'https://npm.pkg.github.com') {
+  throw new Error(`${manifest.name} must publish through GitHub Packages`)
+}
+
+const privatePackageClaims = [
+  /\bprivate\b[^\n]{0,80}@velaros-ai/iu,
+  /@velaros-ai[^\n]{0,80}\bprivate\b/iu,
+  /私有[^\n]{0,80}@velaros-ai/u,
+  /@velaros-ai[^\n]{0,80}私有/u,
+]
+for (const [fileName, contents] of [
+  ['README.md', readme],
+  ['README.zh-CN.md', chineseReadme],
+  ['docs/api.zh-CN.md', documentation],
+]) {
+  for (const pattern of privatePackageClaims) {
+    if (pattern.test(contents)) {
+      throw new Error(`${fileName} must not describe the public package or scope as private`)
+    }
+  }
+}
+if (!readme.includes('public package') || !readme.includes('read:packages')) {
+  throw new Error('README.md must document public package visibility and GitHub npm authentication')
+}
+if (!chineseReadme.includes('公开包') || !chineseReadme.includes('read:packages')) {
+  throw new Error(
+    'README.zh-CN.md must document public package visibility and GitHub npm authentication'
+  )
+}
 for (const section of requiredDocumentSections) {
   if (!documentation.includes(`## ${section}`)) {
     throw new Error(`${manifest.name} API documentation is missing "${section}"`)