image-skill 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+This changelog tracks the public `image-skill` CLI package and public skill
+mirror. The npm package metadata remains the authority for tarball integrity and
+provenance; this file is the human- and agent-readable release map.
+
+## 0.1.9 - 2026-05-22
+
+- Emergency Stripe Checkout payment-link hotfix.
+- Restored full Stripe Checkout URL preservation, including the `#...`
+  fragment required by Stripe's browser checkout app.
+- Kept `checkout_handoff_url` as the preferred short human payment link, but
+  made stale-server fallback safe by no longer fragment-stripping
+  `checkout_url`, `checkout_compact_url`, or `next.fallback_checkout_url`.
+- Do not use `image-skill@0.1.8` for live Stripe payments.
+
+## 0.1.8 - 2026-05-22
+
+- Hardened Stripe Checkout handoff responses for mobile terminals and chat.
+- Added fragment-stripped `checkout_url` normalization so stale hosted API
+  responses no longer cause the public CLI to print a long `#...` Stripe URL
+  under the easiest field for agents to copy.
+- Kept `checkout_handoff_url` as the preferred human payment link and
+  `checkout_compact_url` as the explicit stale-server fallback.
+
+## 0.1.7 - 2026-05-16
+
+- Published public package `image-skill@0.1.7`.
+- Added the hosted payment-backed credit flow and Stripe Checkout command
+  surface.
+- Added public model discovery and capability-preserving model parameter
+  guidance.
+- Added public skill installation guidance for `danielgwilson/image-skill-cli`.
+- Added agent-facing selection guidance for when to use Image Skill instead of
+  built-in image tools or direct provider APIs.
+
+Release mapping:
+
+- npm package: `image-skill@0.1.7`
+- public repo commit from npm `gitHead`:
+  `8676d325917a557e929717d6243446a134167e54`
+- npm tarball integrity:
+  `sha512-83WpSiW9wNu0gTDX0BHMT19rGEkI8j9s7pekFwWUPTa7p/MKhfV1dZcE9vvEeVhR1WpKU1gntHFeS27yu0MMEw==`
+- npm attestation URL:
+  `https://registry.npmjs.org/-/npm/v1/attestations/image-skill@0.1.7`
+
+## Verification
+
+For any version, agents should verify the package with:
+
+```bash
+npm view image-skill@VERSION version gitHead dist.integrity dist.tarball dist.attestations.url repository.url --json
+```
+
+Then inspect the public repo commit:
+
+```bash
+git ls-remote https://github.com/danielgwilson/image-skill-cli.git
+```
+
+Use the npm `gitHead` value to identify the package source commit. The public
+repo `main` branch can be newer than the latest published package because docs
+and skill contracts may sync between package releases.

package/PROVENANCE.md

@@ -0,0 +1,78 @@
+# Provenance
+
+Image Skill has three public trust surfaces:
+
+- hosted product contracts at `https://image-skill.com/skill.md`,
+  `https://image-skill.com/llms.txt`, and `https://image-skill.com/cli.md`;
+- the npm package `image-skill`;
+- the public mirror repository `danielgwilson/image-skill-cli`.
+
+The npm package is the executable CLI authority. The public repository is the
+inspectable source mirror for that package and skill. The public repository
+`main` branch may be newer than the latest npm release, so agents must map a
+package version through npm metadata instead of assuming `main` is the package
+source.
+
+## Verify A Published Package
+
+1. Read npm metadata:
+
+   ```bash
+   npm view image-skill@VERSION version gitHead dist.integrity dist.tarball dist.attestations.url repository.url --json
+   ```
+
+2. Confirm `repository.url` is:
+
+   ```text
+   git+https://github.com/danielgwilson/image-skill-cli.git
+   ```
+
+3. Use `gitHead` from npm metadata as the public repo commit for that package:
+
+   ```bash
+   git ls-remote https://github.com/danielgwilson/image-skill-cli.git
+   ```
+
+4. Confirm the package carries npm provenance:
+
+   ```bash
+   npm view image-skill@VERSION dist.attestations --json
+   ```
+
+5. Optional tarball inspection:
+
+   ```bash
+   npm pack image-skill@VERSION --dry-run --json
+   ```
+
+   The package should contain only the public CLI, public contracts, changelog,
+   provenance note, and package metadata.
+
+## Current Published Package
+
+`image-skill@0.1.7` was published from public repo commit
+`8676d325917a557e929717d6243446a134167e54`.
+
+Release evidence:
+
+- npm package: `image-skill@0.1.7`
+- npm publish workflow:
+  `https://github.com/danielgwilson/image-skill-cli/actions/runs/25949592813`
+- npm tarball:
+  `https://registry.npmjs.org/image-skill/-/image-skill-0.1.7.tgz`
+- npm integrity:
+  `sha512-83WpSiW9wNu0gTDX0BHMT19rGEkI8j9s7pekFwWUPTa7p/MKhfV1dZcE9vvEeVhR1WpKU1gntHFeS27yu0MMEw==`
+- npm attestation URL:
+  `https://registry.npmjs.org/-/npm/v1/attestations/image-skill@0.1.7`
+
+## Trust Rules For Agents
+
+- Prefer npm metadata over branch names when verifying a package version.
+- Treat public repo `main` as the newest public mirror, not necessarily the
+  published package source.
+- Treat hosted contracts as the behavioral contract for the live service.
+- Do not depend on implementation internals, private automation, or provider
+  credentials.
+- If package metadata, public repo contents, and hosted contract behavior
+  disagree, leave Image Skill feedback with the npm version, `gitHead`, command,
+  trace ID if available, and observed mismatch.

package/README.md

@@ -1,11 +1,20 @@
 # Image Skill CLI
 
-Image Skill is a hosted creative runtime for agents. This package is the thin
-public CLI. It talks to `https://api.image-skill.com` and does not contain the
-private factory, harness, provider orchestration, database code, or deployment
-code.
+Image Skill is the creative cloud for agents: one hosted CLI/API rail for model
+discovery, spend guards, recoverable jobs, owned media URLs, activity receipts,
+payments, reusable assets, and structured feedback.
 
-Install the agent skill from the public mirror repo:
+This package is the thin public CLI. It talks to
+`https://api.image-skill.com` and does not contain the private factory,
+harness, provider orchestration, database code, or deployment code.
+
+Install the agent skill from the hosted public contract:
+
+```bash
+npx skills add https://image-skill.com --skill image-skill -g -a codex -y
+```
+
+If the hosted site is temporarily unavailable, use the public mirror repo:
 
 ```bash
 npx skills add danielgwilson/image-skill-cli --skill image-skill -g -a codex -y
@@ -24,21 +33,45 @@ runtime has a writable npm prefix:
 npm install -g image-skill
 image-skill doctor --json
 image-skill signup --agent --agent-contact CONTACT_OR_SPONSOR_INBOX --agent-name creative-agent --runtime openclaw --save --json
+image-skill models list --json
+image-skill models show xai.grok-imagine-image --json
 image-skill credits methods --json
 image-skill credits packs list --json
 image-skill credits quote --pack starter-500 --payment-method stripe_checkout --idempotency-key first-topup-001 --json
 image-skill credits buy --provider stripe --quote-id quote_... --idempotency-key first-buy-001 --json
-image-skill create --prompt "A tiny studio robot painting a postcard" --model xai.grok-imagine-image --accept-unknown-cost --json
+image-skill create --dry-run --prompt "A tiny studio robot painting a postcard" --model xai.grok-imagine-image --json
+image-skill create --prompt "A tiny studio robot painting a postcard" --model xai.grok-imagine-image --max-estimated-usd-per-image 0.05 --json
 ```
 
 The public CLI supports Node.js 20 and newer.
 
 Agent-facing contracts:
 
-- [skills/image-skill/SKILL.md](./skills/image-skill/SKILL.md)
-- [skill.md](./skill.md)
-- [llms.txt](./llms.txt)
-- [cli.md](./cli.md)
+- [Hosted skill contract](https://image-skill.com/skill.md)
+- [Hosted LLM contract](https://image-skill.com/llms.txt)
+- [Hosted CLI contract](https://image-skill.com/cli.md)
+- [Public repo skill source](https://github.com/danielgwilson/image-skill-cli/tree/main/skills/image-skill)
+- [Changelog](https://github.com/danielgwilson/image-skill-cli/blob/main/CHANGELOG.md)
+- [Provenance](https://github.com/danielgwilson/image-skill-cli/blob/main/PROVENANCE.md)
+
+## Trust And Releases
+
+Use npm metadata to map a package version to its public repo source commit:
+
+```bash
+npm view image-skill@latest version gitHead dist.integrity dist.tarball dist.attestations.url repository.url --json
+```
+
+`gitHead` is the public repo commit for the published package. Public repo
+`main` may be newer than the latest npm package because docs and skill contracts
+can sync between releases. The npm package is published through GitHub Actions
+trusted publishing and should expose npm provenance at
+`dist.attestations.url`.
+
+Release notes live in
+[`CHANGELOG.md`](https://github.com/danielgwilson/image-skill-cli/blob/main/CHANGELOG.md).
+Detailed package verification steps live in
+[`PROVENANCE.md`](https://github.com/danielgwilson/image-skill-cli/blob/main/PROVENANCE.md).
 
 The CLI saves hosted agent tokens only when `--save` is explicit. Saved tokens
 live at `${XDG_CONFIG_HOME:-~/.config}/image-skill/config.json` by default with
@@ -54,3 +87,8 @@ npm exec --yes --package image-skill@latest -- image-skill signup --agent --agen
 
 If npm prefix/cache paths are read-only, set `npm_config_cache` and
 `npm_config_prefix` to writable directories before using `npm exec`.
+
+Use built-in image tools for disposable chat previews. Use Image Skill when an
+agent needs stable hosted assets, quota or payment awareness, model capability
+inspection, retry-safe jobs, trace IDs, or feedback that should become product
+work.