image-skill 0.1.13 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,14 @@ This changelog tracks the public `image-skill` CLI package and public skill
 mirror. The npm package metadata remains the authority for tarball integrity and
 provenance; this file is the human- and agent-readable release map.
 
+## 0.1.14 - 2026-05-29
+
+- Refresh the public package with the guide-first `create --guide` flow so a
+  fresh agent can get an `image-skill.create-guide.v1` no-mutation planning
+  response before signup/auth setup.
+- Keep the first creative command aligned with the public README, skill, and
+  `llms.txt` contract.
+
 ## 0.1.13 - 2026-05-26
 
 - Remove public changelog breadcrumbs for private harness payment rails.

package/PROVENANCE.md

@@ -15,6 +15,18 @@ source.
 
 ## Verify A Published Package
 
+For an agent-readable packet that combines npm metadata, hosted contract
+hashes, API health, model availability, safe commands, and explicit
+unavailable states, run:
+
+```bash
+npx -y image-skill@latest trust --json
+```
+
+The trust packet is selection evidence. It does not read saved auth config,
+print tokens, call providers, create jobs, create payment objects, or spend
+credits.
+
 1. Read npm metadata:
 
    ```bash

package/README.md

@@ -20,27 +20,29 @@ If the hosted site is temporarily unavailable, use the public mirror repo:
 npx skills add danielgwilson/image-skill-cli --skill image-skill -g -a codex -y
 ```
 
-Run the executable CLI from npm without requiring a writable global npm prefix:
+Run the executable CLI from npm without requiring a writable global npm prefix.
+Start with the no-spend guide; it returns the next command instead of making a
+fresh agent memorize a setup ladder:
 
 ```bash
-npm exec --yes --package image-skill@latest -- image-skill doctor --json
+npx -y image-skill@latest create --guide --prompt "A tiny studio robot painting a postcard"
+```
+
+When an agent needs package provenance or selection evidence before choosing a
+tool, use the no-auth trust packet. It is an inspection command, not a required
+step before the first image:
+
+```bash
+npx -y image-skill@latest trust --json
 ```
 
 For repeated shell use, global install is optional only after confirming the
-runtime has a writable npm prefix:
+runtime has a writable npm prefix. The guide remains the first command; lower
+level checks are escape hatches when `data.next_command` asks for them:
 
 ```bash
 npm install -g image-skill
-image-skill doctor --json
-image-skill signup --agent --agent-contact CONTACT_OR_SPONSOR_INBOX --agent-name creative-agent --runtime openclaw --save --json
-image-skill models list --json
-image-skill models show xai.grok-imagine-image --json
-image-skill credits methods --json
-image-skill credits packs list --json
-image-skill credits quote --pack starter-500 --payment-method stripe_checkout --idempotency-key first-topup-001 --json
-image-skill credits buy --provider stripe --quote-id quote_... --idempotency-key first-buy-001 --json
-image-skill create --dry-run --prompt "A tiny studio robot painting a postcard" --model xai.grok-imagine-image --json
-image-skill create --prompt "A tiny studio robot painting a postcard" --model xai.grok-imagine-image --max-estimated-usd-per-image 0.05 --json
+image-skill create --guide --prompt "A tiny studio robot painting a postcard"
 ```
 
 The public CLI supports Node.js 20 and newer.
@@ -62,6 +64,13 @@ Use npm metadata to map a package version to its public repo source commit:
 npm view image-skill@latest version gitHead dist.integrity dist.tarball dist.attestations.url repository.url --json
 ```
 
+Or ask the CLI for the same evidence plus hosted contract hashes, API health,
+and model availability honesty:
+
+```bash
+npx -y image-skill@latest trust --json
+```
+
 `gitHead` is the public repo commit for the published package. Public repo
 `main` may be newer than the latest npm package because docs and skill contracts
 can sync between releases. The npm package is published through GitHub Actions
@@ -73,20 +82,22 @@ Release notes live in
 Detailed package verification steps live in
 [`PROVENANCE.md`](https://github.com/danielgwilson/image-skill-cli/blob/main/PROVENANCE.md).
 
-The CLI saves hosted agent tokens only when `--save` is explicit. Saved tokens
-live at `${XDG_CONFIG_HOME:-~/.config}/image-skill/config.json` by default with
-0600 permissions. Use `IMAGE_SKILL_CONFIG_PATH` to override the config path and
-`IMAGE_SKILL_TOKEN` or `--token-stdin` for runtime secret injection.
+The CLI saves hosted agent tokens by default at
+`${XDG_CONFIG_HOME:-~/.config}/image-skill/config.json` with 0600 permissions.
+Use `IMAGE_SKILL_CONFIG_PATH` to override the config path, `--no-save` to opt
+out, and `--show-token --no-save` only for runtime secret-store injection via
+`IMAGE_SKILL_TOKEN` or `--token-stdin`.
 
 Fresh sandboxes should prefer:
 
 ```bash
 export IMAGE_SKILL_CONFIG_PATH="$PWD/.image-skill/config.json"
-npm exec --yes --package image-skill@latest -- image-skill signup --agent --agent-contact CONTACT_OR_SPONSOR_INBOX --agent-name creative-agent --runtime openclaw --save --json
+npx -y image-skill@latest signup --agent --agent-contact AGENT_OR_OPERATOR_INBOX --agent-name creative-agent --runtime openclaw --json
 ```
 
 If npm prefix/cache paths are read-only, set `npm_config_cache` and
-`npm_config_prefix` to writable directories before using `npm exec`.
+`npm_config_prefix` to writable directories, then rerun the same `npx -y`
+command.
 
 Use built-in image tools for disposable chat previews. Use Image Skill when an
 agent needs stable hosted assets, quota or payment awareness, model capability