feat(skills): identity verification coverage + announcement type (0.3.0)

Two platform features shipped since the skills last looked:

usertour-sdk-install — identity verification (the enforced-JWT identify):
- new references/identity-verification.md: the contract (HS256, utv_
  signing secret, sub/companyId claims), the silent-rejection symptom,
  per-environment secrets, validator/coverage debugging; per-language
  minting snippets stay in the live guide (Node/Python/Ruby/PHP/Go) —
  the skill points there instead of copying them
- SKILL.md: identify step + non-negotiables gain the enforced-token
  requirement; utv_ joins utp_ in the never-in-client-code grep;
  retrieval table gains the identity-verification guide
- identify.md: the { token } option; troubleshooting.md: "identify looks
  ignored / user never appears" symptom → silent enforcement rejection

usertour-content-authoring — announcement type:
- type lists include announcement; patterns.md picker gains the row plus
  a banner-vs-announcement distinction and the reach-through-a-
  resource-center-block trap

Version 0.2.15 → 0.3.0 across the six manifests (validate.js green).

Author: winter100004

.agents/plugins/marketplace.json

@@ -2,7 +2,7 @@
   "plugins": [
     {
       "name": "usertour",
-      "version": "0.2.15",
+      "version": "0.3.0",
       "category": "Coding",
       "source": {
         "type": "local",

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "usertour",
       "source": "./",
       "description": "Skills for authoring Usertour in-app onboarding content",
-      "version": "0.2.15"
+      "version": "0.3.0"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "usertour",
   "description": "Skills for Usertour in-app onboarding — authoring content (flows, checklists, launchers, banners, surveys) and installing the Web SDK — via the Usertour API/MCP",
-  "version": "0.2.15",
+  "version": "0.3.0",
   "author": {
     "name": "Usertour",
     "url": "https://www.usertour.io"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "usertour",
-  "version": "0.2.15",
+  "version": "0.3.0",
   "description": "Skills for Usertour in-app onboarding — authoring content (flows, checklists, launchers, banners, surveys) and installing the Web SDK — via the Usertour API/MCP",
   "author": {
     "name": "Usertour",

.cursor-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "usertour",
       "source": "./",
       "description": "Skills for authoring Usertour in-app onboarding content",
-      "version": "0.2.15"
+      "version": "0.3.0"
     }
   ]
 }

.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "usertour",
-  "version": "0.2.15",
+  "version": "0.3.0",
   "description": "Skills for Usertour in-app onboarding — authoring content (flows, checklists, launchers, banners, surveys) and installing the Web SDK — via the Usertour API/MCP",
   "author": {
     "name": "Usertour",

skills/usertour-content-authoring/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: usertour-content-authoring
-description: Author and publish Usertour in-app onboarding content — flows (tours), checklists, launchers, banners, surveys, trackers — via the Usertour API/MCP. Use when the user mentions Usertour, building a product tour / onboarding / in-app guide / checklist, or asks to create, update, validate, or publish Usertour content. Biases toward retrieving the live schema and authoring guide from the Usertour MCP over pre-trained knowledge.
+description: Author and publish Usertour in-app onboarding content — flows (tours), checklists, launchers, banners, announcements (release notes / product news), surveys, trackers — via the Usertour API/MCP. Use when the user mentions Usertour, building a product tour / onboarding / in-app guide / checklist, or asks to create, update, validate, or publish Usertour content. Biases toward retrieving the live schema and authoring guide from the Usertour MCP over pre-trained knowledge.
 ---
 
 # Usertour content authoring
@@ -15,7 +15,7 @@ always current.
 | Source | How | Use for |
 |--------|-----|---------|
 | `get_authoring_guide` (MCP tool) | call it at the start | Lifecycle, step types, markdown subset, frequency, what each type needs to publish |
-| `get_content_schema` (MCP tool) | `get_content_schema({ type })` | The exact write body — `steps` for `flow`, `data` for checklist/launcher/banner/tracker/resource-center. **Fetch before authoring a non-flow type** (its `data` is polymorphic). |
+| `get_content_schema` (MCP tool) | `get_content_schema({ type })` | The exact write body — `steps` for `flow`, `data` for checklist/launcher/banner/tracker/announcement/resource-center. **Fetch before authoring a non-flow type** (its `data` is polymorphic). |
 | `validate_content_version` (MCP tool) | dry-run a draft | The publishable-or-not check + precise errors |
 | v2 docs | https://docs.usertour.io (API reference v2 → Concepts) | Human reference: blocks, conditions & actions, rules, type data |
 

skills/usertour-content-authoring/references/patterns.md

@@ -12,8 +12,9 @@ don't transcribe them here. For exact fields use `get_content_schema`.
 | A guided multi-step walkthrough (steps must happen now, in order) | **flow** |
 | A "get started" list of independent, self-paced tasks | **checklist** |
 | A persistent help button / spotlight that opens a tooltip or runs an action | **launcher** |
-| A top/bottom announcement bar | **banner** |
+| A one-time notice strip at the top/bottom of the page | **banner** |
 | A help hub with tabs of content | **resource-center** |
+| Release notes / product news users can revisit, with an unread badge or one-time popup | **announcement** |
 | Fire an analytics event when conditions match, no UI | **tracker** |
 
 Two opposite mistakes to avoid:
@@ -25,6 +26,13 @@ Two opposite mistakes to avoid:
 
 Ongoing help belongs in a **launcher** / **resource-center**, not a tour.
 
+**Banner vs announcement:** a banner is a one-shot notice (each user sees it
+once, dismiss and it's gone forever — think maintenance windows); an
+announcement is a FEED item (release notes, product news) users can revisit,
+delivered with an unread badge or a one-time popup. Announcements reach users
+ONLY through a resource center with an `announcement` block — publish alone
+surfaces nothing (the guide's Announcements section has the wiring).
+
 ## Make the flow follow the user
 
 A step that can only advance via its own button gets stranded the moment the user

skills/usertour-sdk-install/SKILL.md

@@ -21,6 +21,7 @@ retrieval**: read the live docs for the snippet, and get the token from the MCP.
 | `get_authoring_guide` (MCP tool) | call it | The "Making it appear (the SDK)" section — the cross-surface gotchas |
 | `list_environments` (MCP tool) | call it | The **environment token** for `init()` (the `token` field) |
 | Self-hosted SDK config | WebFetch https://docs.usertour.io/open-source/usertourjs | `USERTOURJS_ENV_VARS` keys when the instance isn't Usertour Cloud |
+| Identity verification guide | WebFetch https://docs.usertour.io/developers/identity-verification | Backend-signed identify JWTs, when the environment enforces them |
 
 If the `usertour` MCP isn't connected, you can still install from the docs, but
 ask the user for the environment token (Settings → Environments) — it is the
@@ -53,7 +54,10 @@ ask the user for the environment token (Settings → Environments) — it is the
    Call `usertour.identify(userId, attributes)` when the app knows the user.
    **`userId` must equal the `externalId`** the content's segments / start-rules
    target, or published content silently never shows. Call `usertour.reset()` on
-   logout.
+   logout. If the environment **requires identity verification**, `identify()` /
+   `group()` must also carry a backend-signed JWT (the `{ token }` option) or the
+   identity is **silently rejected** at connect — see
+   [references/identity-verification.md](references/identity-verification.md).
 6. **SPA routing** — for single-page apps, confirm content re-evaluates on route
    change (see the framework reference).
 7. **Verify** — [references/verify.md](references/verify.md). Load the app,
@@ -62,10 +66,17 @@ ask the user for the environment token (Settings → Environments) — it is the
 
 ## Non-negotiables
 
-- **Token type (security):** environment token for `init()`; the API token never
-  touches client code.
+- **Token type (security):** environment token for `init()`; the API token
+  (`utp_…`) and the identity-verification **signing secret** (`utv_…`) never
+  touch client code — only the backend-signed JWT does. Grep the app for both
+  prefixes before finishing.
 - **Identify linkage:** `identify()` id == the `externalId` used in
   segments / start-rules, or nothing renders (the #1 "it's not showing" cause).
+- **Enforced identity verification:** when the target environment requires it,
+  the install is not done until `identify()`/`group()` carry a valid signed
+  token — unsigned calls are rejected **silently** (looks exactly like
+  "identify ignored"). See
+  [references/identity-verification.md](references/identity-verification.md).
 - **Defer the API to the docs:** this skill is the wiring + gotchas, not a copy of
   the snippet. Read the reference; it's the source of truth.
 - **Self-host target:** if the instance isn't Usertour Cloud, point the SDK at it

skills/usertour-sdk-install/references/identify.md

@@ -57,3 +57,19 @@ Attribute **codes** must match those defined in Usertour
 If you target by company/account, also call
 `usertour.group(companyId, { name, plan, … })`. The `companyId` likewise must
 match the company `externalId` used in targeting.
+
+## Identity verification (when the environment enforces it)
+
+Some environments require every `identify()` / `group()` to be **proven** with a
+JWT the app's backend signs (HS256, the environment's `utv_…` signing secret,
+claims `{ sub: userId, companyId? }`). Pass it as the third argument:
+
+```js
+usertour.identify(currentUser.id, attributes, { token: usertourJwt });
+usertour.group(company.id, companyAttributes, { token: usertourJwt });
+```
+
+Without a valid token in an enforcing environment the identity is rejected
+**silently** — the user never appears in Usertour and nothing renders. Details,
+backend snippet, and debugging:
+[identity-verification.md](identity-verification.md).