@tomorrowos/sdk 0.9.23 → 0.9.24

package/README.md

@@ -72,7 +72,7 @@ IF any step contradicts Vercel, adapt to settings that Vercel can accept.
 ```
 
 That wizard asks: database (**Supabase** → **Neon** → SQLite demo), media (**Cloudinary** → **Vercel Blob** → local),
-branding (manual fields or **infer from a website URL**). Preview may use a thin **Next.js reverse proxy**;
+branding (manual fields or **website URL → `brand.json` only**, no login unless asked). Preview may use a thin **Next.js reverse proxy**;
 **Publish stays pure Node** `TomorrowOS.listen` (not Next). Cloudinary credentials are collected one-at-a-time
 (cloud name → API key → API secret). Sets `cms.hostingTarget` to `"vercel"`.
 

package/VERCEL_SETUP.md

@@ -5,7 +5,7 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`, not `LLM_PROMPT.md`).
 >
-> Protocol id: `vercel-setup/1.2` — pairs with `@tomorrowos/sdk` packages that ship `templates/cms-starter` and this file.
+> Protocol id: `vercel-setup/1.3` — pairs with `@tomorrowos/sdk` packages that ship `templates/cms-starter` and this file.
 
 ## User trigger (copy-paste)
 
@@ -16,7 +16,7 @@ Follow @tomorrowos/sdk VERCEL_SETUP.md and set up my TomorrowOS CMS.
 Ask only the questions listed in VERCEL_SETUP.md, in order. Do not use LLM_PROMPT.md or REPLIT_SETUP.md.
 If any step contradicts Vercel, adapt to settings Vercel can accept (document the adaptation).
 After all setup questions are answered (including Cloudinary or Vercel Blob Env Vars if you chose those), configure and deploy — minimal verification only (Control Panel at /). Prefer Supabase Session pooler URL or Neon pooled URL. Do not treat sandbox ENETUNREACH / IPv6 :5432 errors as a hard setup failure when a pooler URL is configured for production.
-Question 3 only updates brand.json. Do not skip steps.
+Question 3 only updates brand.json from colours/logo/name (a website URL is brand reference only — do not add CMS login/auth unless the user explicitly asks). Do not skip steps.
 Use Next.js only as a v0/Preview shell with a reverse proxy; Production Publish must remain pure Node TomorrowOS.listen (not Next).
 ```
 
@@ -105,6 +105,7 @@ Then ask **Question 1**.
 11. **Production:** export the HTTP server Vercel can capture: `const server = tomorrowos.listen(...); export default server;` (or equivalent). **Do not** make `next start` the Production entrypoint.
 12. **Preview:** if the environment is v0 / Next-hardwired, install the Next reverse-proxy shell (see **Preview adapter**). Do not leave Preview broken.
 13. After Q&A: **configure → install → run/deploy → minimal verify** (Control Panel at `/`). Do not run a long test suite.
+14. **No inventing CMS login.** A branding URL never means “build auth.” Only add login if the user **explicitly** requests it.
 
 **Question order:** Q1 → Q2 → Q3 → execution checklist.
 
@@ -458,6 +459,11 @@ import { put } from "@vercel/blob";
 ## Question 3 — Brand (`brand.json` only)
 
 > Updates **only** `brand.json`. Does **not** change Vercel project settings, Env Vars, or `server.ts` store wiring beyond what Q1–Q2 already required.
+>
+> **IRON RULE — website URL ≠ build a website / login / auth CMS.**  
+> If the user pastes a URL (or says “make it look like this site”), that input is **reference material for `brand.json` only** (name, colours, fonts, logo, tagline).  
+> **Do not** scaffold a login page, signup, OAuth, gated dashboard, or copy the reference site’s IA/pages — **unless the user explicitly asks for CMS login / auth**.  
+> Default TomorrowOS Control Panel has **no login**. Keep it that way.
 
 ### Step A — Ask branding input
 
@@ -465,8 +471,9 @@ import { put } from "@vercel/blob";
 
 > Let’s brand your TomorrowOS experience. You can answer in either way:
 >
-> **Option A — Website URL only**  
-> Paste **one public website URL** (your company / venue site). I will infer colours, fonts, name, tagline, and logo from that page and write `brand.json` to match its look.
+> **Option A — Website URL only (brand reference)**  
+> Paste **one public website URL**. I will use it **only** to infer colours, fonts, name, tagline, and logo for **`brand.json`**.  
+> I will **not** rebuild that website, add a login page, or change Control Panel features — unless you explicitly ask for login/auth later.
 >
 > **Option B — Manual fields**  
 > Provide:
@@ -483,7 +490,8 @@ import { put } from "@vercel/blob";
 **You must:**
 
 1. **Fetch and inspect** the page (HTTP GET the URL; follow one redirect if needed). Do not invent colours.
-2. **Derive branding** using this priority order:
+2. **Write / update `brand.json` only** from what you infer. Touch nothing else for this step (no new pages, no auth, no Next marketing site, no login UI).
+3. **Derive branding** using this priority order:
    - **Name:** `<title>`, `og:site_name`, or prominent header / logo `alt` text (trim to ≤ 60 chars).
    - **Tagline:** `meta[name="description"]`, `og:description`, or first hero subtitle (≤ 120 chars).
    - **Primary colour:** `meta[name="theme-color"]`, CSS `--primary` / `--brand` variables, or dominant accent from linked stylesheets / inline styles (convert to `#RRGGBB`).
@@ -492,10 +500,20 @@ import { put } from "@vercel/blob";
    - **Secondary colour:** muted border / secondary button colour, or a tint of the primary.
    - **Font:** first `font-family` on `body` (strip quotes; default `Inter` if generic system stack).
    - **Logo:** prefer `og:image`, then `link[rel="icon"]` / apple-touch-icon, then header `<img>` logo. Download into `./assets/logo.png` or `./assets/logo.svg` and set `logoPath` accordingly. If only favicon exists, use it and note size in the summary.
-3. **Contrast check:** if background is dark, set `activationScreen.theme` to `"dark"` and add `logoPathOnDark` when a light logo variant exists.
-4. **Infer `cms.useCase`** from page content when obvious (restaurant / retail / corporate / etc.); otherwise `"other"`.
-5. **Show a one-line summary** to the user (name + primary hex + logo path) before or while writing the file — do not ask a second branding question unless fetch failed.
-6. If the URL is unreachable, blocked, or has no usable styles, say so and fall back to **Option B** manual questions for missing fields only.
+4. **Contrast check:** if background is dark, set `activationScreen.theme` to `"dark"` and add `logoPathOnDark` when a light logo variant exists.
+5. **Infer `cms.useCase`** from page content when obvious (restaurant / retail / corporate / etc.); otherwise `"other"`.
+6. **Show a one-line summary** to the user (name + primary hex + logo path) before or while writing the file — do not ask a second branding question unless fetch failed.
+7. If the URL is unreachable, blocked, or has no usable styles, say so and fall back to **Option B** manual questions for missing fields only.
+
+**Explicitly forbidden when the user only gave a URL (no login request):**
+
+- ❌ Login / signup / “Sign in to continue” screens
+- ❌ Auth middleware, sessions, cookies, OAuth, password forms
+- ❌ Cloning the reference site as a marketing landing or multi-page CMS
+- ❌ Gating the Control Panel behind authentication
+- ❌ Treating “make it like this site” as “rebuild this site”
+
+If the reference site itself is a login page, **still only extract visual brand tokens** (colours/logo/name) into `brand.json` — do **not** recreate that login flow.
 
 ### Step C — Write `brand.json`
 
@@ -631,6 +649,7 @@ Tell the user:
 | Secrets in git | Mistake | Rotate keys; move to Vercel Env Vars |
 | Replit files present | Copied wrong protocol | Delete `.replit*`; use this file |
 | Brand colours wrong from URL | SPA / blocked fetch | Manual Option B for colours + logo |
+| Agent built a login page after user pasted a URL | Misread brand reference as product scope | Remove login; keep starter Control Panel; apply URL only to `brand.json` |
 
 ---
 
@@ -645,7 +664,7 @@ Tell the user:
 | Media | Cloudinary or Replit Object Storage | Cloudinary **or Vercel Blob** |
 | Preview | Replit Preview / Autoscale Node | **Next shell + proxy** when v0 hardwires Next |
 | Publish | Long-lived Node | **Node `TomorrowOS.listen` only** (not Next) |
-| Brand from URL | Not in Replit protocol | **Option A** in Question 3 — infer from website |
+| Brand from URL | Not in Replit protocol | **Option A** — infer **`brand.json` only**; never invent login |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.23",
+  "version": "0.9.24",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.23",
+  "version": "0.9.24",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.23",
+    "@tomorrowos/sdk": "^0.9.24",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },