@xiashe/skill 0.1.22 → 0.1.24

package/bin/xiashe-skill.mjs

@@ -68,7 +68,7 @@ function isTransportError(error) {
 }
 
 const LOCAL_ENV_DEFAULTS = loadLocalEnvDefaults();
-const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.22';
+const VERSION = process.env.XIASHE_SKILL_CLI_VERSION || '0.1.24';
 const COMMAND_NAME = process.env.XIASHE_SKILL_CLI_NAME || 'xiashe-skill';
 const PRODUCT_NAME = process.env.XIASHE_SKILL_PRODUCT_NAME || (COMMAND_NAME === 'agentpie-skill' ? 'AgentPie' : 'XiaShe');
 const REGISTRY_PROVIDER = process.env.XIASHE_SKILL_REGISTRY_PROVIDER || (COMMAND_NAME === 'agentpie-skill' ? 'agentpie' : 'xiashe');
@@ -98,12 +98,11 @@ const MANIFEST_FILE = process.env.XIASHE_SKILL_MANIFEST_FILE || (COMMAND_NAME ==
   : 'xiashe.skill.json');
 const WORK_DIR = process.env.XIASHE_SKILL_WORK_DIR || (COMMAND_NAME === 'agentpie-skill' ? '.agentpie' : '.xiashe');
 const PUBLIC_PROTOCOL_DIR = process.env.XIASHE_SKILL_PUBLIC_PROTOCOL_DIR || (REGISTRY_PROVIDER === 'agentpie' ? 'agentpie' : 'xiashe');
+const PUBLIC_PACKAGE_MANIFEST_FILE = 'package-manifest.json';
 const HANDOFF_FILE = 'UPLOAD_HANDOFF.md';
 const DEFAULT_REGISTRY_URL = process.env.XIASHE_SKILL_REGISTRY_URL || `${DEFAULT_BASE_URL}/registry/skill-events`;
 const DEFAULT_AGENT_ACK_URL = process.env.XIASHE_SKILL_AGENT_ACK_URL || `${DEFAULT_BASE_URL}/registry/agent-ack`;
 const DEFAULT_CLAIM_URL = process.env.XIASHE_SKILL_CLAIM_URL || `${DEFAULT_BASE_URL}/registry/skill/claim`;
-const DEFAULT_PACKAGE_UPLOAD_URL = process.env.XIASHE_SKILL_PACKAGE_UPLOAD_URL || `${DEFAULT_BASE_URL}/registry/skill/package-upload-url`;
-const DEFAULT_PACKAGE_ARTIFACT_URL = process.env.XIASHE_SKILL_PACKAGE_ARTIFACT_URL || `${DEFAULT_BASE_URL}/registry/skill/package-artifact`;
 const EVENT_SCHEMA_VERSION = process.env.XIASHE_SKILL_EVENT_SCHEMA_VERSION || (REGISTRY_PROVIDER === 'agentpie'
   ? 'agentpie.skill.event.v1'
   : 'xiashe.skill.event.v1');
@@ -165,8 +164,8 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['Skill public page', 'README', `${WORK_DIR}/REGISTRY_DISCLOSURE.md`],
     runtimeDataPolicy: 'runtime_capable',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: 'Upload the complete reviewed Skill package, including the local registry manifest.',
-    forbiddenPublicFiles: ['.env', 'credentials', 'node_modules', 'dist', 'build', 'browser profiles', 'SSH keys']
+    allowedFilePolicy: 'Upload the complete reviewed Skill package together with the generated no-secret package manifest. Keep the local registry manifest and runtime credentials on the creator device.',
+    forbiddenPublicFiles: [WORK_DIR, '.env', 'credentials', 'node_modules', 'dist', 'build', 'browser profiles', 'SSH keys', 'public tokens', 'signing secrets']
   },
   xiashe: {
     label: 'XiaShe Store',
@@ -175,8 +174,8 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['Skill public page', 'README', `${WORK_DIR}/REGISTRY_DISCLOSURE.md`],
     runtimeDataPolicy: 'runtime_capable',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: 'Upload the complete reviewed Skill package, including the local registry manifest.',
-    forbiddenPublicFiles: ['.env', 'credentials', 'node_modules', 'dist', 'build', 'browser profiles', 'SSH keys']
+    allowedFilePolicy: 'Upload the complete reviewed Skill package together with the generated no-secret package manifest. Keep the local registry manifest and runtime credentials on the creator device.',
+    forbiddenPublicFiles: [WORK_DIR, '.env', 'credentials', 'node_modules', 'dist', 'build', 'browser profiles', 'SSH keys', 'public tokens', 'signing secrets']
   },
   red: {
     label: 'Red Skill',
@@ -185,8 +184,8 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['platform description field', 'README', 'SKILL.md', `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`, `${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md`, `${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md`],
     runtimeDataPolicy: 'agent_ack_supported',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: `Follow the official Red Skill uploader.md / skillhub-upload flow. Put public source, safety, creator-card attribution, and the no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml + ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md + ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md protocol files in the public package when Markdown/YAML files are accepted. Keep .xiashe private manifests, tokens, hashes, storage ids, and handoff files local-only. Send Agent Ack events only when the host can safely call HTTP/MCP.`,
-    xiasheLocalOnlyFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'internal handoff/checklists'],
+    allowedFilePolicy: `Follow the official Red Skill uploader.md / skillhub-upload flow. Put public source, safety, creator-card attribution, and the no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml + ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md + ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md protocol files in the public package when Markdown/YAML files are accepted. Keep ${WORK_DIR} private manifests, tokens, hashes, storage ids, and handoff files local-only. Send Agent Ack events only when the host can safely call HTTP/MCP.`,
+    localOnlyRegistryFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'internal handoff/checklists'],
     forbiddenPublicFiles: ['credentials', 'cookies', 'browser/account sessions', 'public tokens', 'signing secrets', 'hidden telemetry'],
     safetyChecklist: [
       '功能描述真实、清晰、有实际使用价值，不夸大或误导用户。',
@@ -205,7 +204,7 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['SKILL.md', 'README', 'platform description field'],
     runtimeDataPolicy: 'agent_ack_supported',
     defaultDataSource: 'runtime',
-    allowedFilePolicy: 'Follow ClawHub official file rules. Treat XiaShe registry files as local-only unless ClawHub explicitly accepts them. Add public Agent Ack instructions where ClawHub allows Skill instructions.',
+    allowedFilePolicy: `Follow ClawHub official file rules. Treat ${PRODUCT_NAME} registry files as local-only unless ClawHub explicitly accepts them. Add public Agent Ack instructions where ClawHub allows Skill instructions.`,
     forbiddenPublicFiles: [WORK_DIR, `${WORK_DIR}/${MANIFEST_FILE}`, `${WORK_DIR}/runtime-events.js`, 'public tokens', 'signing secrets']
   },
   skillhub: {
@@ -285,7 +284,7 @@ const PLATFORM_REVIEW_PROFILES = {
     disclosurePlacement: ['README', 'SKILL.md', 'platform description field'],
     runtimeDataPolicy: 'runtime_if_http_or_mcp',
     defaultDataSource: 'attribution',
-    allowedFilePolicy: 'Follow the target platform official rules first; merge only safe XiaShe disclosure and callbacks.',
+    allowedFilePolicy: `Follow the target platform official rules first; merge only safe ${PRODUCT_NAME} disclosure and callbacks.`,
     forbiddenPublicFiles: ['public tokens in public docs', 'signing secrets', 'hidden background processes']
   }
 };
@@ -317,6 +316,7 @@ Usage:
   ${COMMAND_NAME} setup [skill-dir] --code <dynamic-code> [--hub all|${FIRST_PARTY_HUB}|red]
   ${COMMAND_NAME} setup [skill-dir] --public-token <token> --skill-id <id> [--hub all|${FIRST_PARTY_HUB}|red]
   ${COMMAND_NAME} doctor [skill-dir] [--json]
+  ${COMMAND_NAME} preflight --claim-url <url> [--json]
   ${COMMAND_NAME} verify [skill-dir] [--hub <hub>] [--scenario <label>] [--dry-run]
   ${COMMAND_NAME} attach [skill-dir] --code <dynamic-code> [--name <name>]
   ${COMMAND_NAME} attach [skill-dir] --public-token <token> [--skill-id <id>] [--name <name>]
@@ -328,6 +328,7 @@ Options:
   --public-token <token>      Public write token issued by ${PRODUCT_NAME} registry.
   --code <dynamic-code>       One-time ${PRODUCT_NAME} dashboard code used to claim registry identity.
   --claim-url <url>           Code claim endpoint. Defaults to XIASHE_SKILL_CLAIM_URL or ${DEFAULT_CLAIM_URL}
+  --registry-doctor-url <url> Registry preflight endpoint. Defaults to the claim URL origin.
   --skill-id <id>             Public ${PRODUCT_NAME} Skill registry id.
   --registry-url <url>        Event endpoint written to the manifest.
   --agent-ack-url <url>       No-secret Agent Ack endpoint written to the local manifest.
@@ -356,11 +357,13 @@ Options:
   --source-url <url>          User-provided source URL an Agent can use during third-party upload.
   --package-url <url>         Deprecated alias for --source-url.
   --skill-version <version>   Override the Skill release version without editing package.json.
-  --package-upload-url <url>  Package upload ticket endpoint. Defaults to ${DEFAULT_PACKAGE_UPLOAD_URL}
-  --package-artifact-url <url> Package artifact attach endpoint. Defaults to ${DEFAULT_PACKAGE_ARTIFACT_URL}
+  --package-upload-url <url>  Package upload ticket endpoint on the same registry origin.
+  --package-artifact-url <url> Package artifact attach endpoint on the same registry origin.
   --out <path>                Output prompt or snippet file.
   --out-dir <path>            Output directory for setup artifacts. Defaults to ${WORK_DIR}/.
   --no-package-upload         Skip automatic ${PRODUCT_NAME} complete package upload.
+  --paid-skill                Treat third-party packages as protected paid-Skill connectors only.
+  --protected-skill           Alias for --paid-skill. Never upload full paid prompt/source to third-party hubs.
   --embed-skill-md            Also write a clearly marked registry section into SKILL.md.
   --no-skill-md               Do not write registry text into SKILL.md. Red hub embeds by default.
   --no-snippet                Setup should skip writing the runtime analytics snippet.
@@ -379,7 +382,7 @@ function fail(message, code = 1) {
 
 function parseArgs(argv) {
   const args = { _: [], json: false, dryRun: false };
-  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-package-upload', 'no-xiashe-package-upload']);
+  const booleanFlags = new Set(['embed-skill-md', 'no-skill-md', 'no-snippet', 'no-track', 'no-package-upload', 'no-xiashe-package-upload', 'paid-skill', 'protected-skill']);
   for (let i = 0; i < argv.length; i += 1) {
     const value = argv[i];
     if (value === '--help' || value === '-h') {
@@ -534,7 +537,7 @@ function latestVersionEndpoint(inspectedOrRegistry = {}) {
 
 function creatorFooterTemplate(inspected, language = 'zh') {
   const registry = inspected.registry || {};
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorName = normalizeText(registry.creatorProfile?.displayName || registry.creatorDisplayName || registry.creatorName, 120) || '待创作者补充';
   const creatorSignal = normalizeText(registry.creatorProfile?.xiaSignal || registry.creatorXiaSignal || registry.xiaSignal, 80);
   if (language === 'en') {
@@ -632,8 +635,48 @@ function isLikelyEntrypointFile(filePath) {
   return /(^|\/)(package\.json|requirements\.txt|pyproject\.toml|deno\.json|mcp\.json|manifest\.json|skill\.json|index\.(js|mjs|cjs|ts|tsx|py)|main\.(js|mjs|cjs|ts|tsx|py)|server\.(js|mjs|cjs|ts|tsx|py))$/i.test(filePath);
 }
 
+function truthyPaidValue(value) {
+  if (value === true) return true;
+  if (typeof value === 'number') return value > 0;
+  const text = normalizeText(value, 120).toLowerCase();
+  return [
+    'paid',
+    'protected',
+    'requires_payment',
+    'requires-entitlement',
+    'entitlement',
+    'alipay_ai_collect',
+    'stripe',
+    'charging',
+    '收费',
+    '付费'
+  ].includes(text);
+}
+
+function isProtectedPaidSkill(inspected) {
+  const registry = inspected.registry || {};
+  const candidates = [
+    inspected.isPaid,
+    inspected.requiresEntitlement,
+    inspected.billingModel,
+    inspected.monetizationMode,
+    inspected.accessMode,
+    registry.isPaid,
+    registry.paidAccess,
+    registry.requiresEntitlement,
+    registry.billingModel,
+    registry.monetizationMode,
+    registry.accessMode,
+    registry.payment?.required,
+    registry.payment?.channel
+  ];
+  return candidates.some(truthyPaidValue);
+}
+
 function packagePlanForHub(inspected, hub) {
   const profile = reviewProfileForHub(hub);
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const thirdPartyProtectedPackage = protectedPaidSkill && !['agentpie', 'xiashe'].includes(profile.hub);
   const localOnly = [];
   const candidateUploadFiles = [];
   const forbiddenPatterns = [
@@ -654,6 +697,14 @@ function packagePlanForHub(inspected, hub) {
       localOnly.push(file.path);
       continue;
     }
+    if (thirdPartyProtectedPackage) {
+      if (isPublicRuntimeProtocolFile(file.path) || /^README(\.[a-z0-9]+)?$/i.test(file.path)) {
+        candidateUploadFiles.push(file.path);
+      } else {
+        localOnly.push(file.path);
+      }
+      continue;
+    }
     if (profile.packageMode === 'full_skill_package') {
       candidateUploadFiles.push(file.path);
       continue;
@@ -683,6 +734,8 @@ function packagePlanForHub(inspected, hub) {
   return {
     hub: profile.hub,
     label: profile.label,
+    protectedPaidSkill,
+    thirdPartyProtectedPackage,
     reviewProfile: profile,
     dataSourcePolicy: {
       runtime: 'Only real Skill execution callbacks, MCP/HTTP/API Tool calls, webhooks, or external Agent ack.',
@@ -698,17 +751,24 @@ function packagePlanForHub(inspected, hub) {
       `${WORK_DIR}/runtime-events.js`,
       `${WORK_DIR}/platform-profiles.json`
     ])).sort(),
-    disclosureTargets: profile.disclosurePlacement,
+    disclosureTargets: thirdPartyProtectedPackage
+      ? ['README', `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`, `${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md`, `${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md`, 'platform private/admin field']
+      : profile.disclosurePlacement,
     forbiddenPatterns,
     safetyChecklist: profile.safetyChecklist || [],
     requiresUserConfirmation: true,
     notes: [
+      thirdPartyProtectedPackage
+        ? `Protected paid Skill mode is active. Third-party packages must be connector/bootstrap only: do not upload the complete prompt, source package, ${WORK_DIR}/ files, package URLs, storage IDs, or install artifacts. The complete protected Skill package is delivered only through the ${PRODUCT_NAME} Gateway after entitlement is verified.`
+        : '',
       profile.allowedFilePolicy,
       profile.manifestPolicy === 'local_only'
-        ? `Keep ${WORK_DIR}/${MANIFEST_FILE} local by default. Only include XiaShe metadata if the target platform explicitly accepts it and the user confirms.`
+        ? `Keep ${WORK_DIR}/${MANIFEST_FILE} local by default. Only include ${PRODUCT_NAME} metadata if the target platform explicitly accepts it and the user confirms.`
         : 'Confirm platform file rules before uploading auxiliary registry metadata.',
       hub === 'red'
-        ? `For Red Skill, include only public source files plus no-secret ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml when Markdown/YAML files are accepted. Keep ${WORK_DIR}/, tokens, signing secrets, package hashes, storage ids, and handoff files local-only. If the Agent calls the no-secret Ack API from the protocol file or private runtime config, Red usage is counted as XiaShe runtime; otherwise show it as upload/reported only.`
+        ? thirdPartyProtectedPackage
+          ? `For paid Red Skill distribution, publish only the ${PRODUCT_NAME} connector/bootstrap description and no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md. The external Agent must obtain a user-specific access session from ${PRODUCT_NAME}; after entitlement is confirmed, it must retrieve, verify, unpack, and read the complete protected Skill package locally. Do not mirror that package into Red.`
+          : `For Red Skill, include only public source files plus no-secret ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml when Markdown/YAML files are accepted. Keep ${WORK_DIR}/, tokens, signing secrets, package hashes, storage ids, and handoff files local-only. If the Agent calls the no-secret Ack API from the protocol file or private runtime config, Red usage is counted as ${PRODUCT_NAME} runtime; otherwise show it as upload/reported only.`
         : '',
       profile.runtimeDataPolicy === 'attribution_only_by_default'
         ? 'Do not claim runtime analytics for this target unless an approved HTTP/MCP/API/webhook boundary is actually wired.'
@@ -770,12 +830,22 @@ async function inferSkillMetadata(root, flags = {}) {
     skillKey: safeSkillKey(flags['skill-key'] || manifest?.skillKey || packageJson?.name || name),
     description: normalizeText(flags.description || manifest?.description || packageJson?.description || firstParagraph || '', 500),
     version: normalizeText(flags['skill-version'] || packageJson?.version || manifest?.version || '0.1.0', 80),
+    isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || manifest?.isPaid || manifest?.registry?.isPaid || manifest?.registry?.paidAccess),
+    requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || manifest?.requiresEntitlement || manifest?.registry?.requiresEntitlement),
+    billingModel: normalizeText(flags['billing-model'] || manifest?.billingModel || manifest?.registry?.billingModel, 80) || null,
+    monetizationMode: normalizeText(flags['monetization-mode'] || manifest?.monetizationMode || manifest?.registry?.monetizationMode, 80) || null,
+    accessMode: normalizeText(flags['access-mode'] || manifest?.accessMode || manifest?.registry?.accessMode, 80) || null,
     registry: manifest?.registry || null
   };
 }
 
 function shouldIgnore(name) {
-  return DEFAULT_IGNORE.has(name) || name.endsWith('~') || name.endsWith('.tmp') || name.endsWith('.log');
+  return DEFAULT_IGNORE.has(name) ||
+    name.startsWith('.env.') ||
+    /\.(pem|key)$/i.test(name) ||
+    name.endsWith('~') ||
+    name.endsWith('.tmp') ||
+    name.endsWith('.log');
 }
 
 async function walkFiles(root, current = root, out = []) {
@@ -821,6 +891,7 @@ async function postJson(url, body, timeoutMs = 20_000) {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(body),
+      redirect: 'error',
       signal: controller.signal
     });
     const text = await response.text();
@@ -845,13 +916,166 @@ async function postJson(url, body, timeoutMs = 20_000) {
   }
 }
 
-function urlForRegistryPath(baseUrl, pathname, fallback) {
-  const base = normalizeText(baseUrl, 1_000) || fallback;
+function registryClaimEndpoint(claimUrl) {
+  const raw = normalizeText(claimUrl, 1_000) || DEFAULT_CLAIM_URL;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INVALID: claim URL is not a valid URL.');
+  }
+  const pathname = url.pathname.replace(/\/+$/, '');
+  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || pathname !== '/registry/skill/claim') {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INVALID: claim URL must be a clean https://<trusted-host>/registry/skill/claim endpoint.');
+  }
+  const host = url.hostname.toLowerCase();
+  const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
+  if (url.protocol !== 'https:' && !(isLocalhost && process.env.XIASHE_SKILL_ALLOW_INSECURE_LOCALHOST === '1')) {
+    throw new Error('CREATOR_SKILL_REGISTRY_URL_INSECURE: only HTTPS registry endpoints are accepted.');
+  }
+  return url;
+}
+
+function explicitClaimUrl(flags = {}) {
+  return normalizeText(
+    flags['claim-url'] ||
+    process.env.XIASHE_SKILL_CLAIM_URL ||
+    LOCAL_ENV_DEFAULTS.XIASHE_SKILL_CLAIM_URL,
+    1_000
+  );
+}
+
+function claimUrlFromRegistryOrigin(registryOrigin) {
+  const origin = normalizeBaseUrl(registryOrigin);
+  return origin ? `${origin}/registry/skill/claim` : '';
+}
+
+function claimUrlForCode(flags = {}) {
+  const claimUrl = explicitClaimUrl(flags);
+  if (!claimUrl) {
+    throw new Error(
+      'CREATOR_SKILL_CLAIM_URL_REQUIRED: a dynamic code must be used with the exact --claim-url issued by the dashboard. ' +
+      'This prevents dev, CN, and global registry codes from being sent to the wrong environment.'
+    );
+  }
+  return claimUrl;
+}
+
+function claimUrlForExistingManifest(flags = {}, registry = {}) {
+  return (
+    explicitClaimUrl(flags) ||
+    claimUrlFromRegistryOrigin(registry.registryOrigin) ||
+    DEFAULT_CLAIM_URL
+  );
+}
+
+function configuredRegistryOrigins() {
+  const supplied = [
+    process.env.XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS,
+    LOCAL_ENV_DEFAULTS.XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS,
+    DEFAULT_BASE_URL
+  ]
+    .filter(Boolean)
+    .flatMap((value) => String(value).split(','))
+    .map((value) => normalizeBaseUrl(value))
+    .filter(Boolean)
+    .map((value) => new URL(value).origin.toLowerCase());
+  return new Set(supplied);
+}
+
+function isTrustedRegistryClaimUrl(claimUrl) {
+  const endpoint = registryClaimEndpoint(claimUrl);
+  const host = endpoint.hostname.toLowerCase();
+  const isOfficialHost =
+    host === 'xiashe.chat' || host.endsWith('.xiashe.chat') ||
+    host === 'agentpie.app' || host.endsWith('.agentpie.app');
+  const isLocalhost = host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.localhost');
+  const trustedOrigins = configuredRegistryOrigins();
+  if (!isOfficialHost && !isLocalhost && !trustedOrigins.has(endpoint.origin.toLowerCase())) {
+    throw new Error('CREATOR_SKILL_REGISTRY_ORIGIN_UNTRUSTED: this dynamic code points to an untrusted registry origin. Use the exact dashboard command, or configure XIASHE_SKILL_TRUSTED_REGISTRY_ORIGINS for an approved self-hosted endpoint.');
+  }
+  return endpoint;
+}
+
+async function getJson(url, timeoutMs = 12_000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { method: 'GET', redirect: 'error', signal: controller.signal });
+    const text = await response.text();
+    let payload = {};
+    try {
+      payload = text ? JSON.parse(text) : {};
+    } catch {
+      throw new Error(`Bad JSON response from ${url}`);
+    }
+    if (!response.ok || payload.ok === false) {
+      throw new Error(payload.error || payload.message || `HTTP ${response.status}`);
+    }
+    return payload;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error || 'unknown error');
+    if (!isTransportError(error)) throw error;
+    throw new Error(`Network request failed for ${url}: ${message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function preflightRegistryClaim(claimUrl, flags = {}) {
+  const endpoint = isTrustedRegistryClaimUrl(claimUrl);
+  const expectedOrigin = endpoint.origin.replace(/\/+$/, '');
+  const doctorUrl = registryEndpointUrl(
+    endpoint,
+    '/registry/skill/doctor',
+    flags['registry-doctor-url'],
+    'registry doctor'
+  );
+  const doctor = await getJson(doctorUrl, Number(flags['timeout-ms'] || 20_000));
+  const registryOrigin = normalizeBaseUrl(doctor.registryOrigin);
+  const protocolVersion = normalizeText(doctor.protocolVersion, 120);
+  const environmentId = normalizeText(doctor.environmentId, 160);
+  if (!registryOrigin || registryOrigin !== expectedOrigin) {
+    throw new Error(`CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: claim endpoint ${expectedOrigin} does not match the registry doctor origin ${registryOrigin || 'missing'}. Do not consume this code; regenerate it from the same environment.`);
+  }
+  if (!protocolVersion || !environmentId) {
+    throw new Error('CREATOR_SKILL_REGISTRY_DOCTOR_INCOMPLETE: update the registry backend before using a dynamic code.');
+  }
+  return {
+    ok: true,
+    claimUrl: endpoint.toString(),
+    doctorUrl,
+    registryOrigin,
+    protocolVersion,
+    environmentId,
+    provider: normalizeText(doctor.provider, 80) || REGISTRY_PROVIDER
+  };
+}
+
+function registryEndpointUrl(claimEndpoint, pathname, suppliedUrl, label) {
+  const endpoint = isTrustedRegistryClaimUrl(claimEndpoint);
+  const expected = new URL(pathname, endpoint.origin);
+  const raw = normalizeText(suppliedUrl, 1_000);
+  if (!raw) return expected.toString();
+  let candidate;
   try {
-    return new URL(pathname, base).toString();
+    candidate = new URL(raw);
   } catch {
-    return fallback;
+    throw new Error(`CREATOR_SKILL_REGISTRY_URL_INVALID: ${label} URL is not valid.`);
+  }
+  if (
+    candidate.origin !== endpoint.origin ||
+    candidate.pathname.replace(/\/+$/, '') !== expected.pathname.replace(/\/+$/, '') ||
+    candidate.username ||
+    candidate.password ||
+    candidate.search ||
+    candidate.hash
+  ) {
+    throw new Error(
+      `CREATOR_SKILL_REGISTRY_ENDPOINT_MISMATCH: ${label} must stay on the exact registry origin and path bound to the dynamic code.`
+    );
   }
+  return candidate.toString();
 }
 
 function shouldIgnorePackageEntry(relativePath, entryName, isDirectory = false) {
@@ -867,11 +1091,16 @@ function shouldIgnorePackageEntry(relativePath, entryName, isDirectory = false)
   if (entryName === '.env' || entryName.startsWith('.env.')) return true;
   if (/\.(pem|key)$/i.test(entryName)) return true;
   if (packageArtifactPrefix && normalized.startsWith(packageArtifactPrefix)) return true;
-  if (isDirectory && (normalized === WORK_DIR || normalized === PUBLIC_PROTOCOL_DIR)) return false;
-  if (isDirectory && (normalized.startsWith(`${WORK_DIR}/`) || normalized.startsWith(`${PUBLIC_PROTOCOL_DIR}/`))) return false;
-  if ((normalized === WORK_DIR || normalized.startsWith(localRegistryPrefix)) && !isXiashePackageRegistryFile(normalized)) {
+  // The local registry workspace carries the public token, signing key and
+  // resumable-upload state. It is intentionally never part of an installable
+  // archive, even for first-party distribution. A separate, no-secret
+  // package manifest is written below `PUBLIC_PROTOCOL_DIR` instead.
+  if (normalized === WORK_DIR || normalized.startsWith(localRegistryPrefix)) {
     return true;
   }
+  if (normalized === PUBLIC_PROTOCOL_DIR || normalized.startsWith(`${PUBLIC_PROTOCOL_DIR}/`)) {
+    return isDirectory ? false : !isXiashePackageRegistryFile(normalized);
+  }
   const otherRegistryDir = WORK_DIR === '.xiashe' ? '.agentpie' : '.xiashe';
   if (normalized === otherRegistryDir || normalized.startsWith(`${otherRegistryDir}/`)) return true;
   return false;
@@ -880,17 +1109,45 @@ function shouldIgnorePackageEntry(relativePath, entryName, isDirectory = false)
 function isXiashePackageRegistryFile(relativePath) {
   const normalized = String(relativePath || '').replace(/\\/g, '/');
   const allowed = new Set([
-    `${WORK_DIR}/${MANIFEST_FILE}`,
-    `${WORK_DIR}/AGENT_ACK.md`,
-    `${WORK_DIR}/REGISTRY_DISCLOSURE.md`,
-    `${WORK_DIR}/runtime-events.js`,
     `${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md`,
     `${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md`,
-    `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`
+    `${PUBLIC_PROTOCOL_DIR}/runtime.yaml`,
+    `${PUBLIC_PROTOCOL_DIR}/${PUBLIC_PACKAGE_MANIFEST_FILE}`
   ]);
   return allowed.has(normalized);
 }
 
+function publicPackageManifestRelativePath() {
+  return `${PUBLIC_PROTOCOL_DIR}/${PUBLIC_PACKAGE_MANIFEST_FILE}`;
+}
+
+async function writePublicPackageManifest(root, inspected) {
+  const registry = inspected.registry || {};
+  const outputPath = path.join(root, PUBLIC_PROTOCOL_DIR, PUBLIC_PACKAGE_MANIFEST_FILE);
+  const manifest = {
+    schemaVersion: `${REGISTRY_PROVIDER}.skill.package.v1`,
+    skill: {
+      name: inspected.name,
+      skillKey: inspected.skillKey,
+      description: inspected.description || null,
+      version: inspected.version || null,
+      isPaid: Boolean(inspected.isPaid),
+      requiresEntitlement: Boolean(inspected.requiresEntitlement)
+    },
+    creator: {
+      cardUrl: normalizeText(registry.creatorCardUrl || registry.creatorProfile?.cardUrl, 800) || null
+    },
+    safety: {
+      localRegistryStateIncluded: false,
+      credentialsIncluded: false,
+      signingMaterialIncluded: false
+    }
+  };
+  await mkdir(path.dirname(outputPath), { recursive: true });
+  await writeFile(outputPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644 });
+  return { outputPath, manifest };
+}
+
 async function walkXiashePackageFiles(root, current = root, out = []) {
   const entries = await readdir(current, { withFileTypes: true });
   for (const entry of entries) {
@@ -936,11 +1193,14 @@ function tarHeader(file, size) {
   const header = Buffer.alloc(512, 0);
   const split = splitTarPath(file.relative);
   header.write(split.name, 0, 100, 'utf8');
-  header.write(octal(file.mode & 0o777 || 0o644, 8), 100, 8, 'ascii');
+  // Keep archive bytes reproducible. Local mtimes and group permissions are
+  // machine-specific and must not make a valid retry look like a new package.
+  const normalizedMode = file.mode & 0o111 ? 0o755 : 0o644;
+  header.write(octal(normalizedMode, 8), 100, 8, 'ascii');
   header.write(octal(0, 8), 108, 8, 'ascii');
   header.write(octal(0, 8), 116, 8, 'ascii');
   header.write(octal(size, 12), 124, 12, 'ascii');
-  header.write(octal(Math.floor(new Date(file.mtime).getTime() / 1000), 12), 136, 12, 'ascii');
+  header.write(octal(0, 12), 136, 12, 'ascii');
   header.fill(0x20, 148, 156);
   header.write('0', 156, 1, 'ascii');
   header.write('ustar', 257, 6, 'ascii');
@@ -975,7 +1235,10 @@ async function createTarGz(files) {
   }
   chunks.push(Buffer.alloc(1024, 0));
   const tar = Buffer.concat(chunks);
-  const gzipped = await gzipAsync(tar, { level: 9 });
+  // Node's current gzip implementation defaults to deterministic metadata,
+  // but make the invariant explicit so retries on another host have the same
+  // archive checksum when the files are unchanged.
+  const gzipped = await gzipAsync(tar, { level: 9, mtime: 0 });
   if (gzipped.length > MAX_XIASHE_PACKAGE_BYTES) {
     throw new Error(`Package artifact exceeds ${Math.round(MAX_XIASHE_PACKAGE_BYTES / (1024 * 1024))}MB.`);
   }
@@ -989,8 +1252,9 @@ async function createTarGz(files) {
 
 async function buildXiashePackageArtifact(root, inspected, flags = {}) {
   const absoluteRoot = path.resolve(root || '.');
+  await writePublicPackageManifest(absoluteRoot, inspected);
   const files = await walkXiashePackageFiles(absoluteRoot);
-  const manifestRelative = `${WORK_DIR}/${MANIFEST_FILE}`;
+  const manifestRelative = publicPackageManifestRelativePath();
   const skillMarkdownPresent = files.some((file) => /^SKILL(\.[a-z0-9]+)?$/i.test(file.relative));
   const manifestPresent = files.some((file) => file.relative === manifestRelative);
   if (!skillMarkdownPresent) {
@@ -1028,6 +1292,7 @@ async function uploadBytesToStorage(uploadUrl, bytes, contentType, timeoutMs = 6
       method: 'POST',
       headers: { 'content-type': contentType || 'application/octet-stream' },
       body: bytes,
+      redirect: 'error',
       signal: controller.signal
     });
     const text = await response.text();
@@ -1056,6 +1321,29 @@ async function uploadBytesToStorage(uploadUrl, bytes, contentType, timeoutMs = 6
   }
 }
 
+async function getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags = {}) {
+  return await postJson(
+    registryEndpointUrl(claimUrl, '/registry/skill/package-status', flags['package-status-url'], 'package status'),
+    {
+      publicToken,
+      uploadJobId: normalizeText(uploadJobId, 160) || undefined,
+      idempotencyKey: normalizeText(idempotencyKey, 220) || undefined
+    },
+    Number(flags['timeout-ms'] || 20_000)
+  );
+}
+
+async function waitForPackagePublish(claimUrl, publicToken, uploadJobId, idempotencyKey, flags = {}) {
+  const timeoutMs = Math.max(5_000, Math.min(90_000, Number(flags['publish-status-timeout-ms'] || 45_000)));
+  const deadline = Date.now() + timeoutMs;
+  let status = await getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags);
+  while (status.found && (status.state === 'queued' || status.state === 'processing') && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 1_000));
+    status = await getPackagePublishStatus(claimUrl, publicToken, uploadJobId, idempotencyKey, flags);
+  }
+  return status;
+}
+
 async function uploadXiashePackageArtifact(root, flags, manifestResult) {
   if (flags.dryRun || flags['no-package-upload'] || flags['no-xiashe-package-upload']) {
     return {
@@ -1075,32 +1363,86 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     normalizeText(manifestResult.manifest?.sourceFingerprint?.sha256, 128) ||
     normalizeText(inspected.package?.sha256, 128) ||
     artifact.sourceSha256;
-  const claimUrl = normalizeText(flags['claim-url'], 800) || DEFAULT_CLAIM_URL;
+  // A resumed upload has no dynamic code to protect it. Bind it back to the
+  // origin recorded in the private manifest instead of silently falling back
+  // to the production registry, then verify that origin before any write.
+  const claimUrl = claimUrlForExistingManifest(flags, registry);
+  const registryPreflight = await preflightRegistryClaim(claimUrl, flags);
+  const expectedRegistryOrigin = normalizeBaseUrl(registry.registryOrigin);
+  const expectedEnvironmentId = normalizeText(registry.environmentId, 160);
+  if (
+    (expectedRegistryOrigin && expectedRegistryOrigin !== registryPreflight.registryOrigin) ||
+    (expectedEnvironmentId && expectedEnvironmentId !== registryPreflight.environmentId)
+  ) {
+    throw new Error(
+      'CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the local manifest belongs to a different registry environment. ' +
+      'Do not upload or claim a new code; switch to the original environment or start a new dashboard task.'
+    );
+  }
   const uploadTicket =
     manifestResult.claimPackageArtifactUpload ||
     await postJson(
-      normalizeText(flags['package-upload-url'], 1_000) || urlForRegistryPath(claimUrl, '/registry/skill/package-upload-url', DEFAULT_PACKAGE_UPLOAD_URL),
+      registryEndpointUrl(claimUrl, '/registry/skill/package-upload-url', flags['package-upload-url'], 'package upload'),
       {
         publicToken,
         idempotencyKey: registrySourceSha256
       },
       Number(flags['timeout-ms'] || 20_000)
     );
-  const uploadUrl = normalizeText(uploadTicket?.uploadUrl, 2_000);
+  let activeUploadTicket = uploadTicket;
+  let uploadUrl = normalizeText(activeUploadTicket?.uploadUrl, 2_000);
   if (!uploadUrl) {
-    throw new Error('XiaShe package upload URL was not returned by registry.');
+    const priorStatus = await waitForPackagePublish(
+      claimUrl,
+      publicToken,
+      normalizeText(activeUploadTicket?.uploadJobId, 160),
+      registrySourceSha256,
+      flags
+    );
+    if (priorStatus.found && priorStatus.state === 'succeeded') {
+      return {
+        ok: true,
+        skipped: false,
+        resumed: true,
+        artifactPath: artifact.artifactPath,
+        fileName: artifact.fileName,
+        sizeBytes: artifact.sizeBytes,
+        sourceSha256: registrySourceSha256,
+        archiveSourceSha256: artifact.sourceSha256,
+        artifactSha256: artifact.artifactSha256,
+        fileCount: artifact.fileCount,
+        storageId: priorStatus.storageId ?? null,
+        publishStatus: priorStatus.status,
+        uploadJobId: priorStatus.uploadJobId,
+        attachResult: priorStatus
+      };
+    }
+    if (priorStatus.found && (priorStatus.state === 'queued' || priorStatus.state === 'processing')) {
+      throw new Error(`${PRODUCT_NAME} package publish is still processing (job ${priorStatus.uploadJobId}). Run the same publish command again to resume; it will not create a second job.`);
+    }
+    activeUploadTicket = await postJson(
+      registryEndpointUrl(claimUrl, '/registry/skill/package-upload-url', flags['package-upload-url'], 'package upload'),
+      { publicToken, idempotencyKey: registrySourceSha256 },
+      Number(flags['timeout-ms'] || 20_000)
+    );
+    uploadUrl = normalizeText(activeUploadTicket?.uploadUrl, 2_000);
+    if (!uploadUrl) {
+      throw new Error(`${PRODUCT_NAME} package upload cannot resume yet. Query /registry/skill/package-status with the existing publicToken and uploadJobId; do not claim a new code.`);
+    }
   }
   const bytes = await readFile(artifact.artifactPath);
   const uploaded = await uploadBytesToStorage(uploadUrl, bytes, artifact.contentType, Number(flags['upload-timeout-ms'] || 90_000));
   const attachResult = await postJson(
-    normalizeText(flags['package-artifact-url'], 1_000) || urlForRegistryPath(claimUrl, '/registry/skill/package-artifact', DEFAULT_PACKAGE_ARTIFACT_URL),
+    registryEndpointUrl(claimUrl, '/registry/skill/package-artifact', flags['package-artifact-url'], 'package artifact'),
     {
       publicToken,
       storageId: uploaded.storageId,
-      uploadJobId: normalizeText(uploadTicket?.uploadJobId, 160) || undefined,
+      uploadJobId: normalizeText(activeUploadTicket?.uploadJobId, 160) || undefined,
       idempotencyKey: registrySourceSha256,
       fileName: artifact.fileName,
       contentType: artifact.contentType,
+      sourceSha256: registrySourceSha256,
+      artifactSha256: artifact.artifactSha256,
       packageSha256: registrySourceSha256,
       packageFileCount: artifact.fileCount,
       packageTotalBytes: artifact.sourceTotalBytes,
@@ -1113,6 +1455,16 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     },
     Number(flags['timeout-ms'] || 20_000)
   );
+  const finalStatus = await waitForPackagePublish(
+    claimUrl,
+    publicToken,
+    normalizeText(attachResult.uploadJobId || activeUploadTicket?.uploadJobId, 160),
+    registrySourceSha256,
+    flags
+  );
+  if (finalStatus.found && finalStatus.state === 'failed') {
+    throw new Error(`${PRODUCT_NAME} package publish failed: ${normalizeText(finalStatus.lastError, 500) || 'unknown validation error'}. Rerun the same command after correcting the reported package issue; do not claim a new code.`);
+  }
   return {
     ok: true,
     skipped: false,
@@ -1120,13 +1472,14 @@ async function uploadXiashePackageArtifact(root, flags, manifestResult) {
     fileName: artifact.fileName,
     sizeBytes: artifact.sizeBytes,
     sourceSha256: registrySourceSha256,
-    packageSourceSha256: artifact.sourceSha256,
+    archiveSourceSha256: artifact.sourceSha256,
     artifactSha256: artifact.artifactSha256,
     fileCount: artifact.fileCount,
     storageId: uploaded.storageId,
-    publishStatus: attachResult.publishStatus ?? null,
-    uploadJobId: attachResult.uploadJobId ?? normalizeText(uploadTicket?.uploadJobId, 160) ?? null,
-    attachResult
+    publishStatus: finalStatus.status ?? attachResult.publishStatus ?? null,
+    uploadJobId: attachResult.uploadJobId ?? normalizeText(activeUploadTicket?.uploadJobId, 160) ?? null,
+    attachResult,
+    finalStatus
   };
 }
 
@@ -1155,9 +1508,19 @@ async function inspectSkill(root, flags = {}) {
 async function writeManifest(root, flags) {
   const inspected = await inspectSkill(root, flags);
   const code = normalizeText(flags.code, 80);
+  const existingRegistry = inspected.registry || {};
+  const suppliedPublicToken = normalizeText(flags['public-token'], 512);
+  if (!code && suppliedPublicToken && !explicitClaimUrl(flags) && !claimUrlFromRegistryOrigin(existingRegistry.registryOrigin)) {
+    throw new Error(
+      'CREATOR_SKILL_CLAIM_URL_REQUIRED: a new manifest created from --public-token must include --claim-url. ' +
+      'Existing manifests resume through their saved registry origin.'
+    );
+  }
+  const claimUrl = code ? claimUrlForCode(flags) : claimUrlForExistingManifest(flags, existingRegistry);
+  const registryPreflight = code ? await preflightRegistryClaim(claimUrl, flags) : null;
   const claim = code
     ? await postJson(
-        normalizeText(flags['claim-url'], 800) || DEFAULT_CLAIM_URL,
+        registryPreflight.claimUrl,
         {
           code,
           skill: {
@@ -1165,6 +1528,9 @@ async function writeManifest(root, flags) {
             skillKey: inspected.skillKey,
             description: inspected.description,
             version: inspected.version,
+            sourceSha256: inspected.package.sha256,
+            // Compatibility with registries published before v2. The value is
+            // still a source fingerprint, never a compressed archive hash.
             packageSha256: inspected.package.sha256,
             packageFileCount: inspected.package.fileCount,
             packageTotalBytes: inspected.package.totalBytes
@@ -1177,7 +1543,13 @@ async function writeManifest(root, flags) {
         Number(flags['timeout-ms'] || 20_000)
       )
     : null;
-  const existingRegistry = inspected.registry || {};
+  if (claim && registryPreflight) {
+    const claimEnvironment = normalizeText(claim.registry?.environmentId, 160);
+    const claimOrigin = normalizeBaseUrl(claim.registry?.registryOrigin);
+    if (claimEnvironment !== registryPreflight.environmentId || claimOrigin !== registryPreflight.registryOrigin) {
+      throw new Error('CREATOR_SKILL_REGISTRY_ENVIRONMENT_MISMATCH: the claimed Skill identity was returned by a different registry environment. No package upload was attempted.');
+    }
+  }
   const publicToken = normalizeText(flags['public-token'] || claim?.publicToken || existingRegistry.publicToken, 512);
   if (!publicToken) {
     throw new Error('Missing --code or --public-token.');
@@ -1204,10 +1576,23 @@ async function writeManifest(root, flags) {
     skillKey: safeSkillKey(claim?.skillKey || inspected.skillKey),
     description: normalizeText(claim?.description, 500) || inspected.description,
     version: normalizeText(claim?.version, 80) || inspected.version,
+    isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.isPaid || existingRegistry.isPaid || existingRegistry.paidAccess),
+    requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.requiresEntitlement || existingRegistry.requiresEntitlement),
+    billingModel: normalizeText(flags['billing-model'] || inspected.billingModel || existingRegistry.billingModel, 80) || null,
+    monetizationMode: normalizeText(flags['monetization-mode'] || inspected.monetizationMode || existingRegistry.monetizationMode, 80) || null,
+    accessMode: normalizeText(flags['access-mode'] || inspected.accessMode || existingRegistry.accessMode, 80) || null,
     registry: {
       provider: REGISTRY_PROVIDER,
+      protocolVersion: normalizeText(claim?.registry?.protocolVersion || registryPreflight?.protocolVersion, 120) || null,
+      environmentId: normalizeText(claim?.registry?.environmentId || registryPreflight?.environmentId, 160) || null,
+      registryOrigin: normalizeBaseUrl(claim?.registry?.registryOrigin || registryPreflight?.registryOrigin) || null,
       skillId: normalizeText(flags['skill-id'] || claim?.skillId || existingRegistry.skillId, 160) || null,
       publicToken,
+      isPaid: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.isPaid || existingRegistry.isPaid || existingRegistry.paidAccess),
+      requiresEntitlement: Boolean(flags['paid-skill'] || flags['protected-skill'] || inspected.requiresEntitlement || existingRegistry.requiresEntitlement),
+      billingModel: normalizeText(flags['billing-model'] || inspected.billingModel || existingRegistry.billingModel, 80) || null,
+      monetizationMode: normalizeText(flags['monetization-mode'] || inspected.monetizationMode || existingRegistry.monetizationMode, 80) || null,
+      accessMode: normalizeText(flags['access-mode'] || inspected.accessMode || existingRegistry.accessMode, 80) || null,
       registryUrl: normalizeText(flags['registry-url'] || claim?.registryUrl || existingRegistry.registryUrl, 800) || DEFAULT_REGISTRY_URL,
       agentAckUrl: normalizeText(flags['agent-ack-url'] || existingRegistry.agentAckUrl, 800) || DEFAULT_AGENT_ACK_URL,
       creatorCardUrl,
@@ -1282,25 +1667,26 @@ async function writeManifest(root, flags) {
     ok: true,
     manifestPath,
     manifest,
-    claimPackageArtifactUpload: claim?.packageArtifactUpload ?? null
+    claimPackageArtifactUpload: claim?.packageArtifactUpload ?? null,
+    registryPreflight
   };
 }
 
 function hubInstruction(hub) {
   if (hub === 'agentpie') {
-    return 'AgentPie Registry publish is the full Skill package and registry manifest flow. Keep public disclosure, attribution, and runtime analytics callbacks; if the local manifest has a registry public token or a creator-authenticated CLI/API session exists, create or reuse the AgentPie registry draft.';
+    return 'AgentPie Registry publish is the full Skill package flow. The local registry manifest stays on the creator device; the installable package contains only the generated no-secret package manifest. Keep public disclosure, attribution, and runtime analytics callbacks; if a creator-authenticated CLI/API session exists, create or reuse the AgentPie registry draft.';
   }
   if (hub === 'xiashe') {
-    return '虾舍商店发布是完整 Skill 包和 registry manifest 的主流程。请保留公开披露、归因和 runtime analytics 回传能力；如果本地 manifest 有 registry public token 或已有创作者认证 CLI/API 会话，就创建或复用虾舍商店草稿。';
+    return '虾舍商店发布是完整 Skill 包的主流程。本地 registry manifest 仅保留在创作者设备；安装包只包含自动生成的不含敏感信息的 package manifest。请保留公开披露、归因和 runtime analytics 回传能力；如果已有创作者认证 CLI/API 会话，就创建或复用虾舍商店草稿。';
   }
   if (hub === 'red') {
-    return 'Red Skill 的官方 uploader.md / skillhub-upload / 页面流程是主流程。请优先使用本机 skillhub-upload；虾舍负责在 SKILL.md 顶部加入公开来源与安全使用说明，并把 registry id、public token、endpoint 等后台字段保留在本地私有配置或平台私有字段里。';
+    return `Red Skill 的官方 uploader.md / skillhub-upload / 页面流程是主流程。请优先使用本机 skillhub-upload；${PRODUCT_NAME} 负责生成平台安全披露、connector/运行时协议和本地 registry handoff，并把 registry id、public token、endpoint 等后台字段保留在本地私有配置或平台私有字段里。`;
   }
   if (hub === 'clawhub') {
-    return 'ClawHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 ClawHub 当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+    return `ClawHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 ClawHub 当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
   }
   if (hub === 'skillhub') {
-    return 'SkillHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 SkillHub 当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+    return `SkillHub 的官方 CLI、prompt 或页面流程是主流程。请先确认 SkillHub 当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
   }
   if (hub === 'claude') {
     return 'Claude Skills 的官方上传/导入流程是主流程。请先确认 Claude 当前 Skill 格式和共享要求，再把下面的 registry 披露文本放入允许的说明文件。';
@@ -1320,7 +1706,7 @@ function hubInstruction(hub) {
   if (hub === 'coze') {
     return 'Coze Agent/Plugin/Workflow 的官方配置和发布流程是主流程。请先按 Coze 当前工具、插件或知识库要求配置，再把下面的 registry 回调作为可选 HTTP/API 步骤接入。';
   }
-  return '目标 Skill Hub 的官方 CLI、prompt 或页面流程是主流程。请先确认平台当前要求，再把下面的虾舍 registry 要求作为附加说明合并进去。';
+  return `目标 Skill Hub 的官方 CLI、prompt 或页面流程是主流程。请先确认平台当前要求，再把下面的 ${PRODUCT_NAME} registry 要求作为附加说明合并进去。`;
 }
 
 function platformPromptPlaceholder(hub) {
@@ -1331,64 +1717,66 @@ function platformPromptPlaceholder(hub) {
     return '如果用户要发布到虾舍商店，并且当前环境已有创作者认证 CLI/API 会话，请优先创建虾舍商店草稿；如果没有认证会话，请完成 registry setup、披露、平台 profile 和 handoff 文件，不要要求 Agent 宿主登录或索取账号凭证。不要把第三方平台限制套用到虾舍完整 Skill 包。';
   }
   if (hub === 'red') {
-    return '如果本机有 skillhub-upload，请按小红书官方 CLI 流程 login --agent、打包并提交；否则请让用户从小红书创作服务平台复制 uploader.md 里的官方对话上传口令。不要用虾舍 prompt 替代 Red Skill 官方流程。';
+    return `如果本机有 skillhub-upload，请按小红书官方 CLI 流程 login --agent、打包并提交；否则请让用户从小红书创作服务平台复制 uploader.md 里的官方对话上传口令。不要用 ${PRODUCT_NAME} prompt 替代 Red Skill 官方流程。`;
   }
   if (hub === 'clawhub') {
-    return '如果 ClawHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代 ClawHub 官方流程。';
+    return `如果 ClawHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代 ClawHub 官方流程。`;
   }
   if (hub === 'skillhub') {
-    return '如果 SkillHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代 SkillHub 官方流程。';
+    return `如果 SkillHub 提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代 SkillHub 官方流程。`;
   }
   if (hub === 'claude') {
-    return '如果 Claude 提供官方 Skill 导入/上传说明，请优先使用官方说明；不要用虾舍 prompt 替代 Claude 官方流程。';
+    return `如果 Claude 提供官方 Skill 导入/上传说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Claude 官方流程。`;
   }
   if (hub === 'codex') {
-    return '如果 Codex 提供官方 Skill 或 Agent 能力安装说明，请优先使用官方说明；不要用虾舍 prompt 替代 Codex 官方流程。';
+    return `如果 Codex 提供官方 Skill 或 Agent 能力安装说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Codex 官方流程。`;
   }
   if (hub === 'cursor') {
-    return '如果 Cursor 提供官方规则、扩展或 Agent 能力安装说明，请优先使用官方说明；不要用虾舍 prompt 替代 Cursor 官方流程。';
+    return `如果 Cursor 提供官方规则、扩展或 Agent 能力安装说明，请优先使用官方说明；不要用 ${PRODUCT_NAME} prompt 替代 Cursor 官方流程。`;
   }
   if (hub === 'workbuddy') {
-    return '如果 WorkBuddy 提供官方上传 prompt、网页或 API 流程，请优先使用官方流程；不要用虾舍 prompt 替代 WorkBuddy 官方流程。';
+    return `如果 WorkBuddy 提供官方上传 prompt、网页或 API 流程，请优先使用官方流程；不要用 ${PRODUCT_NAME} prompt 替代 WorkBuddy 官方流程。`;
   }
   if (hub === 'dify') {
-    return '如果 Dify 提供官方插件打包/发布命令，请优先使用官方命令；不要用虾舍 prompt 替代 Dify 官方流程。';
+    return `如果 Dify 提供官方插件打包/发布命令，请优先使用官方命令；不要用 ${PRODUCT_NAME} prompt 替代 Dify 官方流程。`;
   }
   if (hub === 'coze') {
-    return '如果 Coze 提供 Agent/Plugin/Workflow 的配置步骤，请优先使用 Coze 官方配置；不要用虾舍 prompt 替代 Coze 官方流程。';
+    return `如果 Coze 提供 Agent/Plugin/Workflow 的配置步骤，请优先使用 Coze 官方配置；不要用 ${PRODUCT_NAME} prompt 替代 Coze 官方流程。`;
   }
-  return '如果目标平台提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用虾舍 prompt 替代平台官方流程。';
+  return `如果目标平台提供官方 CLI 命令或上传 prompt，请优先使用官方命令/prompt；不要用 ${PRODUCT_NAME} prompt 替代平台官方流程。`;
 }
 
-function uploadCompatibilityLines(hub, manifestFile) {
+function uploadCompatibilityLines(hub, manifestFile, protectedPaidSkill = false) {
   const localManifest = `${WORK_DIR}/${manifestFile}`;
   if (hub === 'agentpie') {
     return [
       'AgentPie Registry compatibility requirements:',
-      `- AgentPie Registry can receive the complete Skill package and ${localManifest} registry manifest.`,
-      '- Keep public disclosure text, attribution links, and runtime event callbacks; do not remove the registry manifest.',
+      `- AgentPie Registry receives the complete Skill package. Keep ${localManifest} on the creator device; it is not an installable-package file.`,
+      '- Keep public disclosure text, attribution links, and runtime event callbacks; do not remove the generated public protocol files.',
       '- Before submitting a draft, still exclude .env, keys, node_modules, dist/build, and unrelated local files.'
     ];
   }
   if (hub === 'xiashe') {
     return [
       '虾舍商店兼容性要求：',
-      `- 虾舍商店可以接收完整 Skill 包和 ${localManifest} registry manifest。`,
-      '- 保留公开披露文本、归因链接和 runtime event callback；不要删除 registry manifest。',
+      `- 虾舍商店接收完整 Skill 包；${localManifest} 仅保留在创作者设备，不属于安装包。`,
+      '- 保留公开披露文本、归因链接和 runtime event callback；不要删除生成的公开协议文件。',
       '- 提交草稿前仍需排除 .env、密钥、node_modules、dist/build 和无关本地文件。'
     ];
   }
   if (hub === 'red') {
     return [
       'Red Skill 兼容性要求：',
-      '- 以小红书官方 `uploader.md`、`skillhub-upload` 或页面上传流程为准；不要用虾舍 prompt 替代官方流程。',
-      `- 上传包必须在 SKILL.md 最开头写清楚 ${PRODUCT_NAME} Required Runtime Contract：更新检查、创作者名片、强制 footer、公开来源和安全使用边界。`,
+      `- 以小红书官方 \`uploader.md\`、\`skillhub-upload\` 或页面上传流程为准；不要用 ${PRODUCT_NAME} prompt 替代官方流程。`,
+      protectedPaidSkill
+        ? `- 付费受保护 Skill 的 Red 公开包只能是 connector/bootstrap：写清楚 ${PRODUCT_NAME} Gateway 接入、付费访问边界、创作者名片和安全使用边界，不上传完整 SKILL.md/prompt/source。`
+        : `- 上传包必须在 SKILL.md 最开头写清楚 ${PRODUCT_NAME} Required Runtime Contract：更新检查、创作者名片、强制 footer、公开来源与安全使用边界。`,
       `- 如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md；这些文件只写公开运行时协议、publicSkillId 和匿名 Ack 格式，不包含 token、签名密钥、package sha 或 storage id。`,
       '- 不要要求用户可见回复追加广告占位、telemetry JSON、包指纹、后台字段或本地路径。',
-      `- ${localManifest} 默认只保留在用户本地，用于虾舍 registry claim、Agent Ack 和后续手动/公开数据导入；不要放进 Red 公开介绍。`,
-      '- public token、signing secret、registry id、package sha、storage id、runtime-events.js、.xiashe 内部 handoff/checklist 不进入 Red 公开介绍或公开包。',
+      `- ${localManifest} 默认只保留在用户本地，用于 ${PRODUCT_NAME} registry claim、Agent Ack 和后续手动/公开数据导入；不要放进 Red 公开介绍。`,
+      `- public token、signing secret、registry id、package sha、storage id、runtime-events.js、${WORK_DIR} 内部 handoff/checklist 不进入 Red 公开介绍或公开包。`,
       '- publicSkillId 与 Agent Ack endpoint 只能出现在专门的 no-secret 协议文件或平台私有配置里；不要写进营销介绍、用户可见回复或截图说明。',
-      '- Agent 使用 Skill 后，只有宿主平台或本地私有配置实际执行安全 Ack，虾舍才会记录 installed / used / completed / failed 真实统计。',
+      `- Agent 使用 Skill 后，只有宿主平台或本地私有配置实际执行安全 Ack，${PRODUCT_NAME} 才会记录 installed / used / completed / failed 真实统计。`,
       '- 如果 Red 平台或运行环境没有执行 Agent Ack，则不要伪造 runtime；只保留上传成功和 reported 数据。',
       '',
       'Red Skill 基础安全规范：',
@@ -1413,20 +1801,22 @@ function uploadCompatibilityLines(hub, manifestFile) {
 function publicDisclosure(inspected, registryUrl, hub = 'generic') {
   const creatorCardUrl = normalizeText(inspected.registry?.creatorCardUrl, 800);
   const creatorLines = creatorProfileSummaryLines(inspected.registry || {}, 'en');
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   if (hub === 'red') {
     return [
       '公开披露文本：',
       '```markdown',
       `### ${PRODUCT_NAME} Attribution Disclosure`,
       '',
-      `This Skill may include a ${PRODUCT_NAME} creator attribution or disclosure link for public listing and aggregate reporting.`,
-      creatorCardUrl ? `Creator card: ${creatorCardUrl}` : 'Creator card: <creator card link from XiaShe dashboard>',
+      `This Skill may include ${PRODUCT_NAME} creator attribution or a disclosure link for public listing and aggregate reporting.`,
+      creatorCardUrl ? `Creator card: ${creatorCardUrl}` : `Creator card: <creator card link from ${PRODUCT_NAME} dashboard>`,
       ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
       '',
       `- Public protocol files, when included: ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md.`,
+      protectedPaidSkill ? `- Paid access: this Red package is a connector/bootstrap for ${PRODUCT_NAME}. The complete paid Skill package is delivered by ${PRODUCT_NAME} Gateway only after entitlement verification, then retrieved into the current Agent private workspace.` : null,
       '- Data mode for Red Skill upload: Agent Ack runtime only when the host Agent calls a no-secret Ack protocol; upload/reported otherwise.',
-      '- Do not publish XiaShe private registry ids, public tokens, signing secrets, package hashes, storage ids, hidden telemetry, cookies, account sessions, or local private files in Red public fields.',
-      '- Runtime usage is counted by XiaShe only when the Agent calls the Ack API from an allowed protocol file/private config, or when a platform-approved runtime API/MCP/webhook boundary is explicitly wired.',
+      `- Do not publish ${PRODUCT_NAME} private registry ids, public tokens, signing secrets, package hashes, storage ids, hidden telemetry, cookies, account sessions, or local private files in Red public fields.`,
+      `- Runtime usage is counted by ${PRODUCT_NAME} only when the Agent calls the Ack API from an allowed protocol file/private config, or when a platform-approved runtime API/MCP/webhook boundary is explicitly wired.`,
       '- Do not send user prompts, private files, credentials, environment variables, account tokens, raw business content, or personal identifiers.',
       '```'
     ];
@@ -1440,7 +1830,7 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
     '',
     `- Registry provider: ${REGISTRY_PROVIDER}`,
     `- Skill key: ${inspected.skillKey}`,
-    `- Creator card: ${creatorCardUrl || '<creator card link from XiaShe dashboard>'}`,
+    `- Creator card: ${creatorCardUrl || `<creator card link from ${PRODUCT_NAME} dashboard>`}`,
     ...creatorLines.filter((line) => !line.startsWith('- Creator card:')),
     '- Events, if enabled by the runtime/platform, should contain only public metadata and aggregate status.',
     '- Do not expose package hashes, storage IDs, upload job IDs, public tokens, private endpoints, local paths, hidden telemetry files, credentials, account sessions, or environment variables.',
@@ -1452,9 +1842,10 @@ function publicDisclosure(inspected, registryUrl, hub = 'generic') {
 
 function agentAckInstructionBlock(inspected, hub = 'generic') {
   const registry = inspected.registry || {};
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
   const ackUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const eventSchemaVersion = registry.runtimeSchemaVersion || RUNTIME_SCHEMA_VERSION;
   const normalizedHub = normalizeHub(hub) || hub || 'generic';
   const distributionPlatform = runtimeDistributionPlatformForHub(normalizedHub);
@@ -1473,10 +1864,16 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
     `- Runtime schema: ${eventSchemaVersion}`,
     `- Platform hub: ${normalizedHub}`,
     `- Distribution platform: ${distributionPlatform}`,
+    protectedPaidSkill
+      ? `- Access mode: protected paid Skill. This public package is only a connector/bootstrap. The complete protected Skill package is delivered by the ${PRODUCT_NAME} Gateway only after the user's entitlement is verified, then must be downloaded, verified, unpacked, and read locally.`
+      : `- Access mode: public/free Skill instructions may be used according to this package and the target platform rules.`,
+    protectedPaidSkill
+      ? `- On first real use, call the ${PRODUCT_NAME} Gateway to obtain the complete package. If it returns \`paymentRequired\`, present its explicit price and purpose, wait for the user's confirmation, complete the official payment flow, poll status, then retry. Do not treat a hosted status page as a payment page, and do not complete the task before the complete package is locally available.`
+      : null,
     '- Send only anonymous aggregate usage status. Do not send prompts, chat transcripts, file contents, credentials, cookies, account sessions, personal identifiers, local paths, paper lists, paper summaries, or raw user content.',
     '- User-facing replies should be concise and useful. Do not append telemetry JSON, package hashes, local paths, private endpoints, or registry internals to replies.',
     `- Read \`${PUBLIC_PROTOCOL_DIR}/runtime.yaml\` first when it exists, then read this file. If \`runtime.yaml\` is unavailable but this file contains a fenced runtime YAML block, use that block as the runtime contract.`,
-    '- Match XiaShe display text to the current conversation language. Keep machine fields such as `publicSkillId`, `skillKey`, `event`, `installationId`, and `invocationId` untranslated.',
+    `- Match ${PRODUCT_NAME} display text to the current conversation language. Keep machine fields such as \`publicSkillId\`, \`skillKey\`, \`event\`, \`installationId\`, and \`invocationId\` untranslated.`,
     '- Every completed Skill turn response must include the localized footer from the runtime contract. Use the recommendation slot only when the Ack response returns one; otherwise show `无` / `None`.',
     '- Before first use or once per day when network is available, check the latest version endpoint. If a newer version exists, ask the user whether to update before modifying local files. If the version is blocked, tell the user and do not continue silently.',
     '- If the answer contains numbers, prices, percentages, dates, places, or URLs, present them in a clear structured list or table and preserve the source links.',
@@ -1530,8 +1927,9 @@ function agentAckInstructionBlock(inspected, hub = 'generic') {
 
 function redPublicTrackingContractBlock(inspected) {
   const registry = inspected.registry || {};
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const marker = `${REGISTRY_PROVIDER}-runtime-contract`;
-  const cardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const cardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const currentVersion = normalizeText(inspected.version || registry.version, 80) || '1.0.0';
   const updateEndpoint = latestVersionEndpoint(inspected);
   const footer = creatorFooterTemplate(inspected, 'zh');
@@ -1540,6 +1938,9 @@ function redPublicTrackingContractBlock(inspected) {
     `## ${PRODUCT_NAME} Required Runtime Contract`,
     '',
     '使用本 Skill 时，必须优先遵循本小节。这个区块是给下游 Agent 读取的公开运行时契约，不是内部注释。',
+    protectedPaidSkill
+      ? `\n### 付费访问边界\n\n- 这是受保护的付费 Skill 连接器，不是完整 Skill prompt/source 包。\n- 第一次真实调用时，必须通过 ${PRODUCT_NAME} Gateway 获取完整本地包；如果返回 paymentRequired，向用户展示购买信息，等待支付确认后轮询状态并重试。\n- 付费权益确认后，必须下载、校验、解压并阅读 Gateway 返回的完整包中的 SKILL.md；完成前不要自行完成任务，也不要把公开 connector 当成完整 Skill 使用。\n- 同一 ${PRODUCT_NAME} 账户再次在其他 Agent 使用时，必须新领接入凭证和当前 Agent 的交付地址；已有权益会复用，不得共享 runtime token、下载地址或完整包。\n- 不要把完整 prompt、源码包、包下载地址、storage id、public token 或内部 manifest 上传到 Red Skill。\n`
+      : '',
     '',
     '### 检查更新',
     '',
@@ -1558,7 +1959,7 @@ function redPublicTrackingContractBlock(inspected) {
     footer,
     '```',
     '',
-    '如果当前对话使用英文，可以使用 runtime.yaml 里的英文 footer；否则默认使用上面的中文 footer。推荐位只使用 XiaShe Ack 响应返回的内容，没有返回时写“无”。',
+    `如果当前对话使用英文，可以使用 runtime.yaml 里的英文 footer；否则默认使用上面的中文 footer。推荐位只使用 ${PRODUCT_NAME} Ack 响应返回的内容，没有返回时写“无”。`,
     '',
     '### 安全边界',
     '',
@@ -1579,7 +1980,8 @@ function skillMdRegistryBlock(inspected, hub) {
     return redPublicTrackingContractBlock(inspected);
   }
   const registry = inspected.registry || {};
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const marker = `${REGISTRY_PROVIDER}-registry`;
   const currentVersion = normalizeText(inspected.version || registry.version, 80) || '1.0.0';
   const updateEndpoint = latestVersionEndpoint(inspected);
@@ -1588,6 +1990,9 @@ function skillMdRegistryBlock(inspected, hub) {
     `## ${PRODUCT_NAME} Required Runtime Contract`,
     '',
     `This Skill is published by its creator through ${PRODUCT_NAME}. Follow this section before using the Skill.`,
+    protectedPaidSkill
+      ? `\n### Protected Paid Access\n\n- This public package is a connector/bootstrap, not the complete paid Skill package or source package.\n- On first real use, call the ${PRODUCT_NAME} Gateway. If it returns \`paymentRequired\`, present the returned price and purpose, wait for confirmation, complete the official payment flow, poll status, and retry. A hosted status page is not a payment page.\n- After entitlement verification, download, verify, unpack, and read the complete package locally. Do not complete the task before that delivery succeeds.\n`
+      : '',
     '',
     '### Update Check',
     '',
@@ -1669,8 +2074,9 @@ function runtimeDistributionPlatformForHub(hub) {
 
 function buildRuntimeYaml(inspected, hub = 'red') {
   const registry = inspected.registry || {};
-  const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from XiaShe registry>';
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
+  const publicSkillId = registry.skillId || registry.publicSkillId || `<public skill id from ${PRODUCT_NAME} registry>`;
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorName = normalizeText(registry.creatorProfile?.displayName || registry.creatorDisplayName || registry.creatorName, 120) || '<creator display name>';
   const creatorSignal = normalizeText(registry.creatorProfile?.xiaSignal || registry.creatorXiaSignal || registry.xiaSignal, 80) || '<creator signal>';
   const ackUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
@@ -1682,6 +2088,11 @@ function buildRuntimeYaml(inspected, hub = 'red') {
     `publicSkillId: ${yamlString(publicSkillId)}`,
     `skillKey: ${yamlString(inspected.skillKey)}`,
     `skillVersion: ${yamlString(skillVersion)}`,
+    'access:',
+    `  mode: ${yamlString(protectedPaidSkill ? 'protected_paid_connector' : 'public_or_free')}`,
+    `  paidPromptDeliveredBy: ${yamlString(protectedPaidSkill ? `${PRODUCT_NAME} Gateway after entitlement verification` : 'public package or target platform rules')}`,
+    `  firstUsePayment: ${yamlString(protectedPaidSkill ? 'show hosted payment session returned by gateway, poll status, retry prompt after entitlement' : 'not_required_by_protocol')}`,
+    `  neverUploadToThirdParty: ${yamlString(protectedPaidSkill ? 'full prompt, source package, package URL, storage id, public token, internal manifest' : 'secrets, private manifest, tokens, package hashes, storage ids')}`,
     'updateCheck:',
     "  mode: 'prompt_user'",
     `  currentVersion: ${yamlString(skillVersion)}`,
@@ -1801,7 +2212,7 @@ async function writePublicProtocolFiles(root, inspected, hub = 'red') {
   const disclosurePath = path.join(protocolDir, 'REGISTRY_DISCLOSURE.md');
   const runtimePath = path.join(protocolDir, 'runtime.yaml');
   const registry = inspected.registry || {};
-  const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from XiaShe registry>';
+  const publicSkillId = registry.skillId || registry.publicSkillId || `<public skill id from ${PRODUCT_NAME} registry>`;
   const agentAck = [
     agentAckInstructionBlock(inspected, hub),
     '',
@@ -1871,6 +2282,7 @@ async function uploadPrompt(inspected, flags) {
   const hub = normalizeHub(flags.hub || 'generic') || 'generic';
   const reviewProfile = reviewProfileForHub(hub);
   const packagePlan = packagePlanForHub(inspected, hub);
+  const protectedPaidSkill = isProtectedPaidSkill(inspected);
   const sourceUrl = normalizeText(flags['source-url'] || flags['package-url'], 1000);
   const platformCommand = normalizeText(flags['platform-command'], 1000);
   const platformPrompt = await readPlatformPrompt(flags);
@@ -1878,11 +2290,11 @@ async function uploadPrompt(inspected, flags) {
   const registryUrl = registry.registryUrl || DEFAULT_REGISTRY_URL;
   const agentAckUrl = registry.agentAckUrl || DEFAULT_AGENT_ACK_URL;
   const publicSkillId = registry.skillId || registry.publicSkillId || '<public skill id from local registry manifest>';
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const creatorProfileLines = creatorProfileSummaryLines(registry, 'zh').filter((line) => !line.startsWith('- 创作者名片：'));
   const redHub = hub === 'red';
   const eventPayload = {
-    publicToken: registry.publicToken || '<xiashe public token from xiashe.skill.json>',
+    publicToken: registry.publicToken || `<public token from ${WORK_DIR}/${MANIFEST_FILE}>`,
     schemaVersion: registry.eventSchemaVersion || EVENT_SCHEMA_VERSION,
     eventType: 'hub_upload_succeeded',
     eventSource: 'cli',
@@ -1934,15 +2346,15 @@ async function uploadPrompt(inspected, flags) {
     '第三方平台官方流程：',
     `- ${hubLine}`,
     redHub
-      ? '- 平台官方 prompt / CLI / 页面表单是上传依据；虾舍提供本地 registry、Agent Ack 真实统计、安全披露和上传状态记录。'
-      : '- 平台官方 prompt / CLI / 页面表单是上传依据；虾舍只提供 registry 和 analytics 附加要求。',
-    '- 如果平台官方要求与虾舍附加说明冲突，以平台官方上传要求为准；不要为了 analytics 绕过平台规则。',
+      ? `- 平台官方 prompt / CLI / 页面表单是上传依据；${PRODUCT_NAME} 提供本地 registry、Agent Ack 真实统计、安全披露和上传状态记录。`
+      : `- 平台官方 prompt / CLI / 页面表单是上传依据；${PRODUCT_NAME} 只提供 registry 和 analytics 附加要求。`,
+    `- 如果平台官方要求与 ${PRODUCT_NAME} 附加说明冲突，以平台官方上传要求为准；不要为了 analytics 绕过平台规则。`,
     platformCommand ? `- 用户提供的官方命令：${platformCommand}` : `- ${platformPromptPlaceholder(hub)}`
   ];
   if (platformPrompt) {
     officialFlowLines.push('', '用户提供的第三方平台官方 prompt：', '```text', platformPrompt.trim(), '```');
   }
-  const compatibilityLines = uploadCompatibilityLines(hub, MANIFEST_FILE);
+  const compatibilityLines = uploadCompatibilityLines(hub, MANIFEST_FILE, protectedPaidSkill);
   const disclosureLines = publicDisclosure(inspected, registryUrl, hub);
   const runtimeGuidanceLines = redHub
     ? [
@@ -1953,14 +2365,21 @@ async function uploadPrompt(inspected, flags) {
         `- 描述：${inspected.description || '<从 SKILL.md/README.md 中提炼>'}`,
         `- 创作者名片：${creatorCardUrl}`,
         ...creatorProfileLines,
-        `- Red Skill 上传包按官方流程准备；如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这三个无密钥运行时协议文件。`,
+        protectedPaidSkill
+          ? `- 这是付费受保护 Skill：Red Skill 公开包只能是 ${PRODUCT_NAME} connector/bootstrap。不要上传完整 prompt、源码包、包下载链接、storage id、内部 manifest 或任何可绕过网关的材料。`
+          : `- Red Skill 上传包按官方流程准备；如果平台接受 Markdown/YAML 源包，可以包含 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 和 ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这三个无密钥运行时协议文件。`,
+        protectedPaidSkill
+          ? `- 外部 Agent 第一次真实使用时必须回到 ${PRODUCT_NAME} Gateway 获取完整受保护包；如果返回 paymentRequired，就展示购买信息、等待用户确认支付、轮询 status，再重试 get_skill_prompt，然后下载、校验、解压并读取 SKILL.md。`
+          : null,
         `- ${WORK_DIR}/、public token、signing secret、registry id、package sha、storage id、upload job id、runtime-events.js 和内部 handoff/checklist 默认只在本地保留，不进入 Red 公开包。`,
         `- publicSkillId 和 Agent Ack endpoint 只能出现在 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置里；不要写进营销介绍、用户可见回复或截图说明。`,
-        `- SKILL.md 最开头必须写 ${PRODUCT_NAME} Required Runtime Contract：当前版本、latest version endpoint、用户确认后更新、创作者名片链接、强制 footer 和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`,
+        protectedPaidSkill
+          ? `- 公开 connector 说明必须写清楚 ${PRODUCT_NAME} Gateway 接入、付费访问边界、latest version endpoint、用户确认后更新、创作者名片链接和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`
+          : `- SKILL.md 最开头必须写 ${PRODUCT_NAME} Required Runtime Contract：当前版本、latest version endpoint、用户确认后更新、创作者名片链接、强制 footer 和安全边界；不要要求下游 Agent 在用户可见回复里追加 telemetry JSON。`,
         '- 使用 Skill 前如果能联网，Agent 应先检查最新版本；有新版本就提示用户是否更新，无法联网则继续但说明更新状态未检查。',
-        '- 如果输出数字或链接，必须结构化展示；如果平台无法执行安全 Ack，不要伪造虾舍 runtime 数据。',
+        `- 如果输出数字或链接，必须结构化展示；如果平台无法执行安全 Ack，不要伪造 ${PRODUCT_NAME} runtime 数据。`,
         '- 上传成功后可以用 hub_upload_succeeded 记录公开 URL；这属于 attribution，不代表真实运行次数。',
-        `- 如果 Agent 读取 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置并执行 Agent Ack，installed / used / completed / failed 会进入虾舍 runtime 统计。`,
+        `- 如果 Agent 读取 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置并执行 Agent Ack，installed / used / completed / failed 会进入 ${PRODUCT_NAME} runtime 统计。`,
         '- 如果平台公开展示下载、收藏、安装或使用数字，可以后续按 reported 数据手动导入；不要把 reported 伪造成 runtime。',
         '- 先检查“能否安全上传”，再检查“Agent Ack 能否被执行”；二者在报告里分开。',
         `- Agent Ack 的字段要拆清楚：distributionPlatform 是分发平台，runtimeAgent 是实际运行的 Agent，runtimeHost 是宿主环境，sourceSurface 是发现入口，scenario 是枚举键，scenarioLabel 是短的人类可读场景。`,
@@ -1998,7 +2417,9 @@ async function uploadPrompt(inspected, flags) {
         '',
         JSON.stringify(eventPayload, null, 2),
         '',
-        'Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 SKILL.md 只保留创作者名片和安全使用边界。'
+        protectedPaidSkill
+          ? `Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 connector 只保留 ${PRODUCT_NAME} Gateway 接入、创作者名片和安全使用边界。`
+          : 'Red Skill 的真实统计只能由宿主平台、安装器或本地私有配置执行安全 Ack 后产生。公开 SKILL.md 只保留创作者名片和安全使用边界。'
       ]
     : [
         `发布成功后，请把公开链接和平台返回的信息回传给${PRODUCT_NAME} registry。只发送公开元数据和聚合事件，不发送用户内容、私密输入或账号凭据。`,
@@ -2054,7 +2475,7 @@ async function uploadPrompt(inspected, flags) {
     '- attribution：发布、上传、归因链接点击、公开披露访问，只代表来源漏斗。',
     '- reported：平台公开数字或手动导入，例如收藏、下载、安装、静态平台显示使用数。',
     '- 如果无法确认 runtime callback 已经接在真实调用边界，就把该平台标记为 attribution 或 reported，不要伪造成 runtime。',
-    '- Agent ack：只有平台宿主、安装器或本地私有配置实际执行安全 Ack，才可以在安装/使用/完成/失败后计入虾舍实时使用数据。',
+    `- Agent ack：只有平台宿主、安装器或本地私有配置实际执行安全 Ack，才可以在安装/使用/完成/失败后计入 ${PRODUCT_NAME} 实时使用数据。`,
     '',
     ...compatibilityLines,
     '',
@@ -2064,10 +2485,12 @@ async function uploadPrompt(inspected, flags) {
       ? [
           'Red 公开包边界：',
           '',
-          `- 可以包含：SKILL.md、README/公开 references，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。`,
-          `- 不要包含：${WORK_DIR}/、${WORK_DIR}/${MANIFEST_FILE}、runtime-events.js、public token、signing secret、registry id、package hash、storage id、upload job id、本地路径、cookie、账号会话或构建产物。`,
+          protectedPaidSkill
+            ? `- 付费 Skill 只能包含：README/公开 connector 说明，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。不要把完整 SKILL.md/prompt/source 放入 Red 公开包。`
+            : `- 可以包含：SKILL.md、README/公开 references，以及 ${PUBLIC_PROTOCOL_DIR}/runtime.yaml、${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md、${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md 这类无密钥运行时协议文件。`,
+          `- 不要包含：${WORK_DIR}/、${WORK_DIR}/${MANIFEST_FILE}、runtime-events.js、public token、signing secret、registry id、package hash、storage id、upload job id、本地路径、cookie、账号会话、构建产物${protectedPaidSkill ? '、完整 prompt 或源码包' : ''}。`,
           `- publicSkillId 和 Agent Ack endpoint 只能放在 ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md 或平台私有配置里；不要放进营销介绍、用户可见回复或截图说明。`,
-          '- 如果宿主 Agent 不能读取协议文件/私有配置并执行 Ack，Red 安装成功不会自动变成虾舍 runtime 数据。'
+          `- 如果宿主 Agent 不能读取协议文件/私有配置并执行 Ack，Red 安装成功不会自动变成 ${PRODUCT_NAME} runtime 数据。`
         ]
       : [
           'Agent Ack 指令（只放在私有 runtime 配置、平台后台字段，或明确不会公开展示的安装说明中）：',
@@ -2106,6 +2529,7 @@ async function writePrompt(root, flags) {
 
 async function writeUnifiedHandoff(root, args) {
   const relativeOutDir = path.relative(root, args.outDir) || WORK_DIR;
+  const protectedPaidSkill = isProtectedPaidSkill(args.inspected);
   const promptIndex = args.promptResults
     .map((item) => `- ${item.hub}: ${path.relative(root, item.promptPath)}`)
     .join('\n');
@@ -2114,7 +2538,7 @@ async function writeUnifiedHandoff(root, args) {
     .join('\n');
   const registry = args.inspected.registry || {};
   const registryUrl = registry.registryUrl || DEFAULT_REGISTRY_URL;
-  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || '<creator card link from XiaShe dashboard>';
+  const creatorCardUrl = normalizeText(registry.creatorCardUrl, 800) || `<creator card link from ${PRODUCT_NAME} dashboard>`;
   const content = [
     `# ${PRODUCT_NAME} Skill Upload Handoff`,
     '',
@@ -2131,7 +2555,7 @@ async function writeUnifiedHandoff(root, args) {
     '1. Identify the target platform from that official prompt, URL, command, or user message.',
     `2. Use the matching registry companion prompt from ${relativeOutDir}/upload-<hub>.md only as an internal checklist.`,
     '3. Treat the third-party platform official prompt / CLI / page form as authoritative.',
-    `4. For XiaShe Store, create or reuse the searchable listing. For Red Skill, use the official uploader.md / skillhub-upload flow.`,
+    `4. For ${PRODUCT_NAME} Registry, create or reuse the searchable listing. For Red Skill, use the official uploader.md / skillhub-upload flow.`,
     `5. For Red Skill, include no-secret ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md only when source files are accepted; never upload private ${WORK_DIR}/ files.`,
     `6. Ensure SKILL.md starts with ${PRODUCT_NAME} Required Runtime Contract: current version, latest version endpoint, user-approved update rule, creator card, required footer, and safety boundary.`,
     '7. Keep the creator card link in public Skill instructions and user-facing replies so downstream users can identify the Skill source and visit the creator.',
@@ -2141,10 +2565,15 @@ async function writeUnifiedHandoff(root, args) {
     '',
     'Red Skill exception:',
     '',
+    protectedPaidSkill
+      ? `- This is a protected paid Skill. Red Skill receives only a ${PRODUCT_NAME} connector/bootstrap package, not the full prompt/source package. Users must obtain access through ${PRODUCT_NAME} Gateway; payment and entitlement are enforced server-side before the complete protected package is delivered, downloaded, verified, and read locally.`
+      : null,
     '- Red Skill should use the official uploader.md / skillhub-upload / web upload flow as the source of truth.',
-    `- Public Red Markdown/YAML packages may include ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files.`,
+    protectedPaidSkill
+      ? `- Public Red Markdown/YAML packages may include only connector docs plus ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files. Do not include the complete SKILL.md/prompt/source package.`
+      : `- Public Red Markdown/YAML packages may include ${PUBLIC_PROTOCOL_DIR}/runtime.yaml, ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, and ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md as no-secret runtime protocol/disclosure files.`,
     `- Keep ${WORK_DIR}/${MANIFEST_FILE}, ${WORK_DIR}/runtime-events.js, public tokens, signing secrets, package hashes, storage ids, upload job ids, and ${WORK_DIR} handoff/checklist files local-only.`,
-    '- Red Skill reports XiaShe runtime through Agent Ack when the host Agent calls it from the no-secret protocol file or private runtime config. If no Agent Ack occurs, show only upload/reported data.',
+    `- Red Skill reports ${PRODUCT_NAME} runtime through Agent Ack when the host Agent calls it from the no-secret protocol file or private runtime config. If no Agent Ack occurs, show only upload/reported data.`,
     '- Check only the basic Red Skill safety rules before submission: truthful description, clear permission/use disclosure, no hidden behavior, no malicious code, no account/cookie/local-data collection, no automated Red account operation, no illegal/violating content, and no plagiarism.',
     '',
     '## Platform mapping',
@@ -2224,11 +2653,11 @@ async function writeUnifiedHandoff(root, args) {
     '',
     'If the hub cannot run callbacks, keep upload attribution and use campaign links or manual imports. Do not fake runtime events.',
     '',
-    '## XiaShe Store draft auth',
+    `## ${PRODUCT_NAME} Registry draft auth`,
     '',
-    `For XiaShe Store, first check whether a submission already exists for this registry. ${COMMAND_NAME} skills publish draft can create or reuse the draft with the local registry public token from ${WORK_DIR}/${MANIFEST_FILE}; it should not require the user to expose their XiaShe login to the Agent.`,
+    `For ${PRODUCT_NAME} Registry, first check whether a submission already exists for this registry. ${COMMAND_NAME} skills publish draft can create or reuse the draft with the local registry public token from ${WORK_DIR}/${MANIFEST_FILE}; it should not require the user to expose their ${PRODUCT_NAME} login to the Agent.`,
     '',
-    'If the registry token is missing or rejected, stop and ask the user to run `xiashe login` locally or generate a new Add Skill task. Do not upload the package as another creator.',
+    `If the registry token is missing or rejected, stop and ask the user to run the local ${PRODUCT_NAME} login command or generate a new Add Skill task. Do not upload the package as another creator.`,
     '',
     'If the claim code expires while you are working, ask for a new code and reuse the existing scan, package plans, disclosure text, and review results instead of starting over.',
     ''
@@ -2519,7 +2948,7 @@ async function runDoctor(root, flags) {
     hasManifest && registry.publicToken && registry.registryUrl
       ? doctorCheck('registry_manifest', 'Registry manifest', 'pass', `Found registry manifest for ${registry.provider || REGISTRY_PROVIDER}.`)
       : redHub
-        ? doctorCheck('registry_manifest', 'Registry manifest', 'warn', `No local registry manifest found. This does not block Red Skill safety review, but XiaShe Agent Ack reporting will be unavailable until setup runs.`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> --hub red if XiaShe tracking is needed.`)
+        ? doctorCheck('registry_manifest', 'Registry manifest', 'warn', `No local registry manifest found. This does not block Red Skill safety review, but ${PRODUCT_NAME} Agent Ack reporting will be unavailable until setup runs.`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> --hub red if ${PRODUCT_NAME} tracking is needed.`)
         : doctorCheck('registry_manifest', 'Registry manifest', 'fail', `Missing usable registry manifest (${MANIFEST_FILE} or ${WORK_DIR}/${MANIFEST_FILE}).`, `Run ${COMMAND_NAME} setup . --code <dashboard-code> or ${COMMAND_NAME} attach . --public-token <token> --skill-id <id>.`),
     registryBlockPresent(skillMd)
       ? doctorCheck('registry_block', 'Registry block', 'pass', 'SKILL.md contains the explicit registry disclosure block.')
@@ -2534,7 +2963,7 @@ async function runDoctor(root, flags) {
       ? doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'pass', 'SKILL.md contains the current runtime contract, required footer, and update check endpoint.')
       : redHub
         ? doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'fail', 'SKILL.md is missing the Required Runtime Contract, footer, or update check endpoint.', `Run ${COMMAND_NAME} setup . --code <code> --hub red to rewrite SKILL.md with the current contract.`)
-        : doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'warn', 'SKILL.md does not yet contain the Required Runtime Contract.', `Run ${COMMAND_NAME} setup . --code <code> --embed-skill-md if this hub allows XiaShe public runtime instructions.`),
+        : doctorCheck('skill_md_contract', 'SKILL.md runtime contract', 'warn', 'SKILL.md does not yet contain the Required Runtime Contract.', `Run ${COMMAND_NAME} setup . --code <code> --embed-skill-md if this hub allows ${PRODUCT_NAME} public runtime instructions.`),
     runtimeCallbackPresent
       ? doctorCheck('runtime_callback', 'Runtime callback', 'pass', scannedCallbackFiles.length > 0 ? `Runtime callback references found in ${scannedCallbackFiles.slice(0, 5).join(', ')}.` : 'Runtime callback snippet/reference detected.')
       : redHub
@@ -2562,6 +2991,11 @@ async function runDoctor(root, flags) {
       : redHub
         ? doctorCheck('red_upload_allowlist', 'Red upload allowlist', 'pass', 'Red candidate upload files exclude private registry directories.')
         : doctorCheck('red_upload_allowlist', 'Red upload allowlist', 'pass', 'Not required for this hub.'),
+    redHub && protectedPaidSkill && packagePlan.candidateUploadFiles.some((file) => /(^|\/)SKILL(\.[a-z0-9]+)?$/i.test(file) || (!isPublicRuntimeProtocolFile(file) && !/^README(\.[a-z0-9]+)?$/i.test(file)))
+      ? doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'fail', `Paid Red candidate upload files include full Skill content: ${packagePlan.candidateUploadFiles.join(', ')}`, `Use protected connector packaging only. Regenerate with ${COMMAND_NAME} setup . --code <code> --hub red --paid-skill.`)
+      : redHub && protectedPaidSkill
+        ? doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'pass', 'Protected paid Red package is connector/protocol only and excludes full SKILL.md/source content.')
+        : doctorCheck('red_paid_connector_boundary', 'Red paid connector boundary', 'pass', 'Not required for this hub/Skill.'),
     redHub && ['AGENT_ACK.md', 'REGISTRY_DISCLOSURE.md', 'runtime.yaml'].every((name) => packagePlan.candidateUploadFiles.includes(`${PUBLIC_PROTOCOL_DIR}/${name}`))
       ? doctorCheck('red_runtime_allowlist', 'Red runtime allowlist', 'pass', `Red candidate upload files include ${PUBLIC_PROTOCOL_DIR}/AGENT_ACK.md, ${PUBLIC_PROTOCOL_DIR}/REGISTRY_DISCLOSURE.md, and ${PUBLIC_PROTOCOL_DIR}/runtime.yaml.`)
       : redHub
@@ -2868,6 +3302,23 @@ async function main() {
       }
       return;
     }
+    if (command === 'preflight') {
+      const claimUrl = explicitClaimUrl(flags);
+      if (!claimUrl) {
+        throw new Error('CREATOR_SKILL_CLAIM_URL_REQUIRED: pass the exact --claim-url issued by the dashboard.');
+      }
+      const result = await preflightRegistryClaim(
+        claimUrl,
+        flags
+      );
+      print(flags.json ? result : [
+        `${PRODUCT_NAME} registry preflight passed.`,
+        `Environment: ${result.environmentId}`,
+        `Registry: ${result.registryOrigin}`,
+        `Protocol: ${result.protocolVersion}`
+      ].join('\n'), flags.json);
+      return;
+    }
     if (command === 'verify') {
       const result = await verifyRegistry(root, flags);
       print(flags.json ? result : formatVerify(result), flags.json);