@tomorrowos/sdk 0.8.0 → 0.8.1

package/REPLIT_SETUP.md

@@ -35,16 +35,15 @@ Replit Agent must ask **only** the questions defined in **this file**, in **this
 |------|---------|------|
 | 1 | **Question 1** — How many screens / devices? | Always |
 | 2 | **Question 2** — Supabase connection | Only if answer to Q1 is **> 5** |
-| 3 | **Question 3** — Media storage (Cloudinary vs Object Storage) | Always (after Q1 or Q2) |
-| 3b | **Question 3b** — Cloudinary credentials (Secrets) | **Mandatory** if Q3 answer is Cloudinary / yes — **before Q4** |
+| 3 | **Question 3** — Media storage (+ Cloudinary Secrets if chosen) | Always (after Q1 or Q2) |
 | 4 | **Question 4** — Brand / TomorrowOS app look | Always last, before execution |
 
-**That is the complete list.** There are no other setup questions.
+**That is the complete list.** There are no other setup questions. There is **no** “Question 3b” — Cloudinary credentials are collected **inside Question 3**, immediately after the user chooses Cloudinary.
 
-**Critical:** Question 3 is **not complete** when the user says “Cloudinary” or “yes”. You **must** run **Question 3b** and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` (as Replit Secrets) **before** asking Question 4. Do **not** skip to branding with placeholder or invented credentials.
+**Critical:** Question 3 is **not complete** when the user says “Cloudinary” or “yes”. You **must** immediately show the Cloudinary Secrets input (same step — do **not** label a new question) and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 4. Do **not** skip to branding with placeholder or invented credentials.
 
 
-If the user volunteers extra info early (e.g. brand name before Q4), **record it** and still ask the current question’s required fields you do not yet have. Do not skip ahead to execution until Q1–Q4 (or Q1, Q3, Q3b, Q4 if ≤5 screens and Cloudinary) are complete.
+If the user volunteers extra info early (e.g. brand name before Q4), **record it** and still ask the current question’s required fields you do not yet have. Do not skip ahead to execution until Q1–Q4 are complete (Question 3 includes Cloudinary Secrets when applicable).
 
 If the user says “just set it up, don’t ask questions,” respond:
 
@@ -56,8 +55,8 @@ Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
 
 ## Hard rules
 
-1. **Ask only REPLIT_SETUP.md questions 1–4 and 3b when required** (see **Questionnaire scope**). Never use `LLM_PROMPT.md` on Replit.
-2. **One question at a time.** Wait for the user’s answer before asking the next question (unless they already answered several in one message). **Exception:** Question 3b may ask for all three Cloudinary Secrets in one message — still **stop and wait** for the user’s values before Question 4.
+1. **Ask only REPLIT_SETUP.md questions 1–4** (see **Questionnaire scope**). Never use `LLM_PROMPT.md` on Replit.
+2. **One question at a time.** Wait for the user’s answer before asking the next question (unless they already answered several in one message). **Exception:** If the user chooses Cloudinary in Question 3, **stay on Question 3** and immediately show the Secrets form — do **not** open a separate “3b” step or announce a new question number.
 3. **Do not invent** screen counts, Cloudinary credentials, Supabase URLs, or brand colours.
 4. **Do not use Replit’s reserved `DATABASE_URL` Secret for Supabase.** On Replit, `DATABASE_URL` is often pre-claimed. Always use **`SUPABASE_URL`** for TomorrowOS ↔ Supabase.
 5. **Prefer `npx @tomorrowos/sdk init`** (or the package’s `templates/cms-starter`) as the project seed. Do not rebuild pairing, WebSocket, or playlist APIs from scratch.
@@ -67,10 +66,10 @@ Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
 
 **Question order after Q1:**
 
-- If **≤ 5 screens:** Q1 → Q3 → (Q3b if Cloudinary) → Q4 → execution checklist
-- If **> 5 screens:** Q1 → Q2 → Q3 → (Q3b if Cloudinary) → Q4 → execution checklist
+- If **≤ 5 screens:** Q1 → Q3 → Q4 → execution checklist
+- If **> 5 screens:** Q1 → Q2 → Q3 → Q4 → execution checklist
 
-Never insert extra questions between these steps. **Never skip Question 3b** when the user chose Cloudinary.
+Never insert extra questions between these steps. When the user chooses Cloudinary, **Question 3 continues** with the Secrets form immediately — then proceed to Q4 only after secrets are saved.
 
 ---
 
@@ -201,7 +200,7 @@ Allowed extras (optional): `"build-player": "tomorrowos build --platform tizen"`
     "node": ">=20"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.8.0",
+    "@tomorrowos/sdk": "^0.8.1",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },
@@ -410,6 +409,8 @@ If the user refuses Supabase but chose > 5 screens, warn them SQLite on Replit i
 
 ## Question 3 — Media storage (uploads / thumbnails)
 
+### Step A — Ask storage choice
+
 **Ask exactly:**
 
 > How should playlist media (images/videos) be stored?
@@ -422,47 +423,38 @@ If the user refuses Supabase but chose > 5 screens, warn them SQLite on Replit i
 >
 > Do you want me to set up **Cloudinary**? (yes / no)
 
-### If YES — Cloudinary → go to Question 3b (do not ask Question 4 yet)
-
-Choosing Cloudinary **does not finish** Question 3. Immediately continue to **Question 3b** below.
+### Step B — If YES / Cloudinary (same Question 3 — no “3b”, no extra question)
 
----
+**Do this immediately** when the user chooses Cloudinary. **Do not** say “Question 3b”, “next step”, or “Great — I’ll use Cloudinary” as a separate message before the form. **Go straight to the Secrets input.**
 
-## Question 3b — Cloudinary credentials (mandatory if Q3 = Cloudinary)
+**Preferred on Replit:** open the **Replit Secrets** UI with fields for:
 
-> **Ask this before Question 4.** Do not jump to `brand.json` until the user has provided credentials or confirmed they are saved as Replit Secrets.
+- `CLOUDINARY_CLOUD_NAME`
+- `CLOUDINARY_API_KEY`
+- `CLOUDINARY_API_SECRET`
+- Optional: `CLOUDINARY_FOLDER` (e.g. `tomorrowos`)
 
-**Ask exactly (copy wording):**
+**If Secrets UI is unavailable, ask exactly (one message with all fields):**
 
-> Great — I’ll use **Cloudinary** for media uploads.
->
-> Please paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) → Dashboard → **API Keys**). I will store them as Replit **Secrets** — never in committed files:
+> Paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) → Dashboard → **API Keys**). I will store them as Replit **Secrets**:
 >
-> 1. **`CLOUDINARY_CLOUD_NAME`** — your cloud name (e.g. `dxyz123abc`)
-> 2. **`CLOUDINARY_API_KEY`** — API Key
-> 3. **`CLOUDINARY_API_SECRET`** — API Secret
+> 1. **`CLOUDINARY_CLOUD_NAME`**
+> 2. **`CLOUDINARY_API_KEY`**
+> 3. **`CLOUDINARY_API_SECRET`**
 >
-> Optional: **`CLOUDINARY_FOLDER`** (e.g. `tomorrowos`) — say if you want a folder prefix.
->
-> You can paste all three in one reply, or use Replit’s Secrets panel and tell me when each Secret is set.
+> Optional: **`CLOUDINARY_FOLDER`**
 
 **You must then:**
 
-1. Create / update Replit Secrets:
-   - `CLOUDINARY_CLOUD_NAME=<user value>`
-   - `CLOUDINARY_API_KEY=<user value>`
-   - `CLOUDINARY_API_SECRET=<user value>`
-   - Optional: `CLOUDINARY_FOLDER=<user value>`
-2. **Do not** write real secrets into `.env` files that are committed to git. Replit Secrets only (or `.env` that is gitignored and references env vars).
-3. **Do not** invent or placeholder Cloudinary credentials.
+1. Save Replit Secrets: `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, `CLOUDINARY_API_SECRET` (and optional `CLOUDINARY_FOLDER`).
+2. **Do not** write real secrets into committed files.
+3. **Do not** invent or placeholder credentials.
 4. **Do not** proceed to Question 4 until all three required Secrets exist.
 5. **Do not** run a Cloudinary upload test — configuration only.
 
-Tell the user:
-
-> After Cloudinary Secrets are set, we’ll finish branding and start the CMS. New uploads will return `https://res.cloudinary.com/...` URLs.
+**If the user does not have a Cloudinary account yet:** tell them to sign up at cloudinary.com and return with API keys. **Wait** on Question 3 — do not skip to Question 4.
 
-**If the user does not have a Cloudinary account yet:** tell them to sign up at cloudinary.com, create API keys, then return with the three values. **Wait** — do not skip to Question 4.
+The SDK auto-detects these env vars and uploads media to Cloudinary. New uploads will return `https://res.cloudinary.com/...` URLs.
 
 ### If NO — Replit Object Storage (or local)
 
@@ -641,7 +633,8 @@ Do **not**:
 - Change the production start command away from `tsx server.ts` / `npm run start`
 - Point Supabase at Replit’s reserved `DATABASE_URL` when `SUPABASE_URL` should be used
 - Skip Cloudinary recommendation without stating the persistence tradeoff
-- **Skip Question 3b** after the user chooses Cloudinary — always collect `CLOUDINARY_*` Secrets before Question 4
+- **Skip Cloudinary Secrets** after the user chooses Cloudinary — always collect `CLOUDINARY_*` inside Question 3 before Question 4
+- **Announce “Question 3b”** or a separate follow-up question — show the Secrets form immediately instead
 - Claim uploads are “permanent” on Replit local disk without Object Storage or Cloudinary
 - Leave `tsx` only in `devDependencies` if the Deploy pipeline installs production deps only
 - Use Canvas preview as the primary CMS verification surface
@@ -689,8 +682,10 @@ TOMORROWOS_STORE=sqlite
 
 ## Protocol version
 
-`replit-setup/1.4` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+`replit-setup/1.5` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+
+**Changelog 1.5:** Cloudinary Secrets collected **inside Question 3** — no separate “3b” step; show Secrets form immediately when user picks Cloudinary.
 
-**Changelog 1.4:** **Question 3b** — mandatory Cloudinary credential collection (Replit Secrets) before Question 4; fixes agents skipping secrets after “yes” to Cloudinary.
+**Changelog 1.4:** mandatory Cloudinary credential collection before Question 4 (superseded by 1.5 flow).
 
 **Changelog 1.3:** minimal post-Q&A verification — no Supabase/WS smoke tests; prioritize **Web app vs API** only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.8.0",
+    "@tomorrowos/sdk": "^0.8.1",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },