@pitcher/cli-scripts 2.10.0 → 2.11.0

package/dist/src/mcp/prompts/announcements.d.ts

@@ -0,0 +1,2 @@
+import type { PromptDescriptor } from './types.js';
+export declare const announcementsPrompts: PromptDescriptor[];

package/dist/src/mcp/prompts/announcements.js

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+import { instanceLine, recipePreamble } from './shared.js';
+export const announcementsPrompts = [
+    {
+        name: 'seed_announcement',
+        title: 'Create announcement',
+        description: 'Author an on-brand in-app announcement (title + body HTML + CTA) and create it in an instance.',
+        argsSchema: {
+            instance_id: z.string().optional().describe('Target instance ID (leave blank to resolve interactively)'),
+            vertical: z.string().optional().describe('pharma | medtech | cpg | finserv | generic'),
+            use_case: z.string().optional().describe('Short description of what this announcement is about'),
+        },
+        build: (args) => {
+            const vertical = args.vertical || 'generic';
+            const useCase = args.use_case || 'a general product / process announcement a rep would see in-app';
+            const text = [
+                recipePreamble(),
+                '',
+                '## Task: seed an announcement',
+                instanceLine(args.instance_id),
+                `Vertical: ${vertical}. Use case: ${useCase}.`,
+                '',
+                'Steps:',
+                '1. Draft a short, on-brand announcement: a concise title and a **body in inline-CSS HTML** ' +
+                    'following the principles above — a few sentences, one clear call-to-action, brand-derived colors, ' +
+                    'and any dynamic values via escaped `{{token}}` merge fields.',
+                '2. Create it by calling `pitcher_announcements_create` with `{ instanceId, title, body }` — ' +
+                    'pass the HTML **inline via `body`** (a file path cannot cross a host\'s sandbox boundary, so always inline). ' +
+                    'Add `priority` only if the user asks for an important announcement.',
+                '3. Report the created announcement id and title.',
+            ].join('\n');
+            return [{ role: 'user', content: { type: 'text', text } }];
+        },
+    },
+];

package/dist/src/mcp/prompts/dsr.d.ts

@@ -0,0 +1,2 @@
+import type { PromptDescriptor } from './types.js';
+export declare const dsrPrompts: PromptDescriptor[];

package/dist/src/mcp/prompts/dsr.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { instanceLine, safetyPreamble } from './shared.js';
+export const dsrPrompts = [
+    {
+        name: 'seed_dsr',
+        title: 'Create and share a DSR',
+        description: 'Share a canvas (or files) as a Digital Sales Room with the right gating, optionally branded with a landing page.',
+        argsSchema: {
+            instance_id: z.string().optional().describe('Target instance ID (leave blank to resolve interactively)'),
+            canvas_id: z.string().optional().describe('Canvas to share (leave blank to pick one interactively)'),
+            audience: z.string().optional().describe('Who the DSR is for, e.g. "internal", "a known contact", "an account/domain"'),
+        },
+        build: (args) => {
+            const audience = args.audience || 'the intended external recipient';
+            const text = [
+                // NOTE: this is a share WORKFLOW recipe, not an HTML-authoring one — it does NOT author a
+                // landing page (that is the separate `seed_dsr_landing` recipe). It only BINDS an existing
+                // template. So it embeds only the safety guidance, not the HTML design principles.
+                safetyPreamble(),
+                '',
+                '## DSR sharing guidance',
+                '- **Source is exactly one of** a canvas (`canvasId`) OR files (`shareboxFileIds`).',
+                `- **Pick the gating (\`authStrategy\`) by audience.** For ${audience}: internal/quick demo → \`none\` ` +
+                    '(open link); a known individual → `specified_emails` (+ `allowedEmails`); a company → ' +
+                    '`specified_domains` (+ `allowedDomains`); the server default is `any_email`. Add `validUntil` ' +
+                    '(ISO datetime) to time-box a customer-facing link; set `allowForward`/`allowDownload` deliberately.',
+                '- **Branding the pre-auth page is a SEPARATE step:** this recipe only **binds** an existing ' +
+                    'landing template (`landingTemplateId`, discover via `pitcher_dsr_landing_list`; pass ' +
+                    '`landingContext` merge fields **as a JSON object serialized to a string**, not as an object). ' +
+                    'If no suitable template exists and the user wants a ' +
+                    'branded landing, author one FIRST with the **`seed_dsr_landing`** recipe, then bind its id here. ' +
+                    'Do NOT hand-write landing HTML in this recipe.',
+                '',
+                '## Task: create and share a DSR',
+                instanceLine(args.instance_id),
+                args.canvas_id ? `Canvas to share: ${args.canvas_id}.` : 'No canvas given — help the user pick one via `pitcher_canvases_list`.',
+                `Audience: ${audience}.`,
+                '',
+                'Steps:',
+                '1. Resolve the source (the given `canvas_id`, or pick a canvas with the user via `pitcher_canvases_list`).',
+                '2. Choose the gating strategy with the user per the guidance above; set expiry/forward/download as appropriate.',
+                '3. (Optional) To brand the pre-auth page, list templates with `pitcher_dsr_landing_list` and bind one via ' +
+                    '`landingTemplateId` — or point the user at `seed_dsr_landing` to author a new one first.',
+                '4. Call `pitcher_dsr_create` with the resolved fields. A denied/failed landing bind returns the link with a ' +
+                    'warning (not a failure) — surface it. Report the returned `short_url`.',
+            ].join('\n');
+            return [{ role: 'user', content: { type: 'text', text } }];
+        },
+    },
+];

package/dist/src/mcp/prompts/registry.js

@@ -1,4 +1,6 @@
 import { emailTemplatePrompts } from './emailTemplate.js';
 import { dsrLandingPrompts } from './dsrLanding.js';
+import { dsrPrompts } from './dsr.js';
+import { announcementsPrompts } from './announcements.js';
 // Every recipe prompt the server can expose. Mirrors mcp/registry.ts (allTools).
-export const allPrompts = [...emailTemplatePrompts, ...dsrLandingPrompts];
+export const allPrompts = [...emailTemplatePrompts, ...dsrLandingPrompts, ...dsrPrompts, ...announcementsPrompts];

package/dist/src/mcp/prompts/shared.d.ts

@@ -1,2 +1,3 @@
 export declare function instanceLine(instanceId: string | undefined): string;
+export declare function safetyPreamble(): string;
 export declare function recipePreamble(): string;

package/dist/src/mcp/prompts/shared.js

@@ -6,16 +6,16 @@ export function instanceLine(instanceId) {
         ? `Target instance: ${instanceId}.`
         : 'No instance was given — call `pitcher_instances_list`, pick the right one with the user, and confirm before creating.';
 }
-// Shared preamble embedded at the top of every recipe prompt. Authored once so the
-// design principles, prod-awareness, and anti-XSS guidance can't drift between prompts.
-export function recipePreamble() {
+// Prod-awareness + anti-XSS guidance shared by EVERY recipe prompt (HTML-authoring or not).
+// Split out of recipePreamble so non-authoring workflow recipes (e.g. seed_dsr) can carry the
+// safety guidance without the HTML design principles. Contains the strings every prompt is
+// required to include: "demo/test instance", "{{token}}", "{{{ }}}".
+export function safetyPreamble() {
     return [
-        CONTENT_DESIGN_PRINCIPLES,
-        '',
         '## Before you create',
         'Confirm the resolved instance is a demo/test instance. These tools create **live, ' +
-            'org-visible** content; a DSR landing page is served to **external, unauthenticated** ' +
-            'viewers. Do not seed against a real customer instance without explicit confirmation from the user.',
+            'org-visible** content; a DSR is served to **external, unauthenticated** viewers. Do not ' +
+            'seed against a real customer instance without explicit confirmation from the user.',
         '',
         '## Safe content',
         'Put dynamic values through the platform `{{token}}` merge fields (the platform escapes them). ' +
@@ -24,3 +24,8 @@ export function recipePreamble() {
             'the generated markup.',
     ].join('\n');
 }
+// Full preamble for HTML-authoring recipes: the design principles + the safety guidance.
+// Authored once so the principles, prod-awareness, and anti-XSS guidance can't drift.
+export function recipePreamble() {
+    return [CONTENT_DESIGN_PRINCIPLES, '', safetyPreamble()].join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pitcher/cli-scripts",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "The Pitcher CLI for various tasks in its ecosystem.",
   "author": "Pitcher AG",
   "license": "MIT",