@tomorrowos/sdk 0.8.1 → 0.8.2

package/REPLIT_SETUP.md

@@ -12,7 +12,7 @@ When a human pastes a prompt like this, **read this file and start Question 1 im
 ```text
 Follow @tomorrowos/sdk REPLIT_SETUP.md and set up my TomorrowOS CMS.
 Ask only the questions listed in REPLIT_SETUP.md, in order. Do not use LLM_PROMPT.md.
-After all setup questions are answered (including Cloudinary Secrets if you chose Cloudinary), configure and start — minimal verification only (Web app type + Preview at /). No Supabase or WebSocket tests.
+After all setup questions are answered (including Cloudinary Secrets if you chose Cloudinary), configure and start — minimal verification only (Web app type + Preview at /). **Never test Supabase connection** — save `SUPABASE_URL` and move on. No Supabase or WebSocket tests.
 Do not skip steps.
 ```
 
@@ -63,6 +63,7 @@ Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
 6. **Never commit secrets** into git. Put credentials only in Replit **Secrets** (and optionally mirror non-secret flags in `.env` that reference env vars).
 7. After Q&A, **configure and start** — do **not** run a long test suite (see **Post-Q&A: minimal verification only**).
 8. **Follow the Runtime & Replit publish rules below exactly.** A project that cannot Deploy / Publish on Replit is incomplete.
+9. **Supabase: configure only — never test.** Save `SUPABASE_URL` + `TOMORROWOS_STORE=supabase` and proceed. **Do not** ping Postgres, run `psql`, start the server solely to verify DB connectivity, or treat log errors like `ENOTFOUND` / `database connection failure` in **Replit dev / Preview** as a failed setup. Supabase often works only after **Publish** (production networking), not in the dev shell.
 
 **Question order after Q1:**
 
@@ -200,7 +201,7 @@ Allowed extras (optional): `"build-player": "tomorrowos build --platform tizen"`
     "node": ">=20"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.8.1",
+    "@tomorrowos/sdk": "^0.8.2",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },
@@ -300,6 +301,22 @@ Replace `YOUR-REPLIT-DOMAIN` with the actual published hostname (e.g. `my-cms.re
 
 After Questions 1–4, **configure → `npm install` → `npm run start` → done.**
 
+### Supabase: never test in Replit dev (mandatory)
+
+When the user chose Supabase (>5 screens), setup is **save credentials + wire `server.ts` + start** — **nothing else**.
+
+**Forbidden after Q&A (and after Question 2):**
+
+- ❌ “Testing Supabase connection…”
+- ❌ `psql`, `pg`, Prisma `db pull`, or any one-off DB probe script
+- ❌ Restarting / debugging the server **because** logs show `database connection failure`, `getaddrinfo ENOTFOUND`, or `db.*.supabase.co can't be resolved`
+- ❌ Telling the user their Supabase URL is wrong **only** because dev Preview cannot resolve the host
+- ❌ Blocking setup completion on Supabase connectivity
+
+**Expected in Replit dev:** Supabase host may **not resolve** in the dev environment. That is **normal**. The Control Panel at `/` can still load. Mark setup **complete** when Web app type is correct and Preview shows the Control Panel — **even if** Supabase errors appear in logs.
+
+**When Supabase actually gets validated:** after the user **Publishes** the Repl and uses the live URL — not during the setup wizard.
+
 ### Do (maximum)
 
 1. Confirm **Web app** artifact (not API) — **most important**.
@@ -310,7 +327,7 @@ After Questions 1–4, **configure → `npm install` → `npm run start` → don
 
 ### Do NOT run after setup (unless user asks or Publish fails)
 
-- ❌ **Supabase connection test** (no `psql`, no DB ping, no “testing Supabase connection…”)
+- ❌ **Supabase connection test** — **never**, including after `npm run start` (no `psql`, no DB ping, no “verifying database…”, no retry loops for `ENOTFOUND`)
 - ❌ **Cloudinary upload test**
 - ❌ **`curl` / `fetch` on `/brand.json`** as a formal gate
 - ❌ **Browser WebSocket console snippet** as a formal gate
@@ -318,7 +335,7 @@ After Questions 1–4, **configure → `npm install` → `npm run start` → don
 - ❌ **Long troubleshooting loops** when Preview already shows the Control Panel
 - ❌ Re-running the full **Publish readiness checklist** item-by-item in chat
 
-If Preview shows the Control Panel and the project is **Web app** type, **stop testing** and give the user their URL and next steps.
+If Preview shows the Control Panel and the project is **Web app** type, **stop testing** and give the user their URL and next steps — **even when using Supabase and dev logs show DB connection errors**.
 
 ### Only if Preview is empty or Publish fails
 
@@ -401,7 +418,7 @@ DATABASE_SSL=true
 ```
 
 5. **Do not** write the real password into committed files.
-6. **Do not** test the Supabase connection after saving the Secret — configuration only.
+6. **Do not** test the Supabase connection after saving the Secret — **configuration only**. No probe, no `npm run start` just to verify DB, no fixing “connection failure” in dev. Saving `SUPABASE_URL` completes Question 2.
 
 If the user refuses Supabase but chose > 5 screens, warn them SQLite on Replit is fragile for fleets, then offer SQLite only after they confirm.
 
@@ -592,13 +609,13 @@ npm run start
 
 (Use `npm run dev` only for local edit/watch. **Publish / Deploy / Replit Run must use `npm run start`.**)
 
-**Minimal check:** logs contain `[TomorrowOS] listening on http://0.0.0.0:...` and Preview shows Control Panel at `/`. Then proceed to **G** — no further tests.
+**Minimal check:** logs contain `[TomorrowOS] listening on http://0.0.0.0:...` and Preview shows Control Panel at `/`. Then proceed to **G** — no further tests. **Ignore** Supabase `ENOTFOUND` / `database connection failure` in dev logs; do not debug DB for that reason alone.
 
 ### F. Done — skip extended verification
 
 If the **three-item Publish readiness checklist** passes (especially **Web app, not API**), mark setup complete.
 
-**Do not** run WebSocket console tests, Supabase connection tests, or `brand.json` curl checks here.
+**Do not** run WebSocket console tests, Supabase connection tests, or `brand.json` curl checks here. **Supabase `ENOTFOUND` in dev is not a setup failure** — tell the user DB will connect after Publish if needed.
 
 Only investigate further if Preview is empty, server crashed, or user reports Publish failure.
 
@@ -642,6 +659,7 @@ Do **not**:
 - Create the Repl as **API-only** or publish with **Static Deployment** only
 - Omit `[[ports]]` / `deploymentTarget` from `.replit` when setting up for Publish
 - Run **Supabase connection tests**, **WebSocket console tests**, or other post-setup smoke tests unless Preview fails or the user asks
+- **Debug or “fix” Supabase** because dev logs show `getaddrinfo ENOTFOUND` or `database connection failure` — save config and finish setup instead
 
 ---
 
@@ -675,14 +693,17 @@ TOMORROWOS_STORE=sqlite
 | `EADDRINUSE` on start | Old process holding port | Stop stale processes, clear background tasks, restart Repl |
 | Upload: `storage.objects.create` denied | Replit Object Storage IAM | Fix Object Storage permissions **or** switch to Cloudinary |
 | Upload OK then thumbnails vanish later | Non-persistent `public/uploads` | Object Storage or Cloudinary |
-| Supabase connection errors | Wrong URL or using reserved `DATABASE_URL` | Use `SUPABASE_URL` + `TOMORROWOS_STORE=supabase` |
+| Supabase `ENOTFOUND` / `can't be resolved` in **dev** logs after setup | Replit dev network cannot reach Supabase host | **Not a setup failure.** Finish wizard; user validates DB after **Publish** |
+| Supabase connection errors on **published** URL | Wrong URL or using reserved `DATABASE_URL` | Use `SUPABASE_URL` + `TOMORROWOS_STORE=supabase`; pooler URL `*.pooler.supabase.com:6543` |
 | Pairing works on one Repl but not another | That Repl’s WS/backend only | Compare Run command and logs with a known-good Repl |
 
 ---
 
 ## Protocol version
 
-`replit-setup/1.5` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+`replit-setup/1.6` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+
+**Changelog 1.6:** **Never test Supabase** in Replit dev — `ENOTFOUND` / connection errors in Preview logs are expected; setup completes when Control Panel loads.
 
 **Changelog 1.5:** Cloudinary Secrets collected **inside Question 3** — no separate “3b” step; show Secrets form immediately when user picks Cloudinary.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.8.1",
+    "@tomorrowos/sdk": "^0.8.2",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },