@tomorrowos/sdk 0.9.23 → 0.9.25

package/README.md

@@ -72,7 +72,7 @@ IF any step contradicts Vercel, adapt to settings that Vercel can accept.
 ```
 
 That wizard asks: database (**Supabase** → **Neon** → SQLite demo), media (**Cloudinary** → **Vercel Blob** → local),
-branding (manual fields or **infer from a website URL**). Preview may use a thin **Next.js reverse proxy**;
+branding (manual fields or **website URL → `brand.json` only**, no login unless asked). Preview may use a thin **Next.js reverse proxy**;
 **Publish stays pure Node** `TomorrowOS.listen` (not Next). Cloudinary credentials are collected one-at-a-time
 (cloud name → API key → API secret). Sets `cms.hostingTarget` to `"vercel"`.
 

package/VERCEL_SETUP.md

@@ -5,7 +5,7 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`, not `LLM_PROMPT.md`).
 >
-> Protocol id: `vercel-setup/1.2` — pairs with `@tomorrowos/sdk` packages that ship `templates/cms-starter` and this file.
+> Protocol id: `vercel-setup/1.4` — pairs with `@tomorrowos/sdk` packages that ship `templates/cms-starter` and this file.
 
 ## User trigger (copy-paste)
 
@@ -14,9 +14,10 @@ When a human pastes a prompt like this, **read this file and start Question 1 im
 ```text
 Follow @tomorrowos/sdk VERCEL_SETUP.md and set up my TomorrowOS CMS.
 Ask only the questions listed in VERCEL_SETUP.md, in order. Do not use LLM_PROMPT.md or REPLIT_SETUP.md.
+Do not ask for OpenAI / Anthropic / any LLM API keys — TomorrowOS CMS setup does not require them.
 If any step contradicts Vercel, adapt to settings Vercel can accept (document the adaptation).
 After all setup questions are answered (including Cloudinary or Vercel Blob Env Vars if you chose those), configure and deploy — minimal verification only (Control Panel at /). Prefer Supabase Session pooler URL or Neon pooled URL. Do not treat sandbox ENETUNREACH / IPv6 :5432 errors as a hard setup failure when a pooler URL is configured for production.
-Question 3 only updates brand.json. Do not skip steps.
+Question 3 only updates brand.json from colours/logo/name (a website URL is brand reference only — do not add CMS login/auth unless the user explicitly asks). Do not skip steps.
 Use Next.js only as a v0/Preview shell with a reverse proxy; Production Publish must remain pure Node TomorrowOS.listen (not Next).
 ```
 
@@ -82,6 +83,16 @@ Ask **only** these questions, in **this exact order**:
 
 **That is the complete list.** Do **not** ask how many screens / devices.
 
+**Forbidden extra questions (never ask, even if the user skips a step):**
+
+- ❌ OpenAI / Anthropic / Gemini / any LLM API key (`sk-…`, etc.)
+- ❌ “AI pairing”, “AI feature logic”, or inventing auth that needs an LLM key
+- ❌ Any secret not listed in Questions 1–3 (DB URL, media credentials, brand)
+
+TomorrowOS pairing and Control Panel logic live in `@tomorrowos/sdk`. They do **not** call OpenAI.
+
+If the user **skips** a Question 2 option, do **not** invent a substitute question. Re-state Question 2 choices, or proceed with a documented default (e.g. local uploads with a warning) — never pivot to LLM keys.
+
 If the user says “just set it up, don’t ask questions,” respond:
 
 > I need a few quick answers from VERCEL_SETUP.md (database — Supabase or Neon preferred — media storage, and branding). It takes about a minute and ensures the CMS works on Vercel.
@@ -92,9 +103,9 @@ Then ask **Question 1**.
 
 ## Hard rules
 
-1. **Ask only VERCEL_SETUP.md questions 1–3.** Never use `LLM_PROMPT.md` or `REPLIT_SETUP.md` as the questionnaire.
+1. **Ask only VERCEL_SETUP.md questions 1–3.** Never use `LLM_PROMPT.md` or `REPLIT_SETUP.md` as the questionnaire. **Never** ask for OpenAI or other LLM API keys.
 2. **One question / one credential at a time.** For Cloudinary: ask **cloud name**, then **API key alone**, then **API secret alone** — never one message that mixes key + secret.
-3. **Do not invent** Cloudinary credentials, database URLs, Vercel Blob tokens, or brand colours.
+3. **Do not invent** Cloudinary credentials, database URLs, Vercel Blob tokens, brand colours, **or LLM API keys**.
 4. **Postgres env naming:** prefer **`SUPABASE_URL`** when using Supabase; prefer **`DATABASE_URL`** (or `NEON_DATABASE_URL`) when using Neon. `createTomorrowOSStore` accepts `SUPABASE_URL` then `DATABASE_URL`.
 5. **Always prefer pooled connection strings** (Supabase Session pooler port **6543**; Neon pooled host). Direct `:5432` URLs commonly fail on Vercel/sandbox with **`ENETUNREACH`** (often IPv6).
 6. **Prefer `npx @tomorrowos/sdk init`** (or `templates/cms-starter`) as the seed. Do not rebuild pairing / WebSocket / playlist APIs.
@@ -105,6 +116,8 @@ Then ask **Question 1**.
 11. **Production:** export the HTTP server Vercel can capture: `const server = tomorrowos.listen(...); export default server;` (or equivalent). **Do not** make `next start` the Production entrypoint.
 12. **Preview:** if the environment is v0 / Next-hardwired, install the Next reverse-proxy shell (see **Preview adapter**). Do not leave Preview broken.
 13. After Q&A: **configure → install → run/deploy → minimal verify** (Control Panel at `/`). Do not run a long test suite.
+14. **No inventing CMS login.** A branding URL never means “build auth.” Only add login if the user **explicitly** requests it.
+15. **Skip ≠ invent.** If the user skips media choice or a credential, do not replace it with OpenAI/auth/login questions. Stay on Q1–Q3 only.
 
 **Question order:** Q1 → Q2 → Q3 → execution checklist.
 
@@ -361,6 +374,9 @@ Only proceed after the user explicitly confirms.
 
 ## Question 2 — Media storage
 
+> **This question is only about media files (images/videos).**  
+> It is **not** about OpenAI, AI pairing, or LLM keys. If you are about to ask for an `sk-` key, **stop** — you are off-protocol.
+
 ### Step A — Ask storage choice
 
 **Ask exactly:**
@@ -458,6 +474,11 @@ import { put } from "@vercel/blob";
 ## Question 3 — Brand (`brand.json` only)
 
 > Updates **only** `brand.json`. Does **not** change Vercel project settings, Env Vars, or `server.ts` store wiring beyond what Q1–Q2 already required.
+>
+> **IRON RULE — website URL ≠ build a website / login / auth CMS.**  
+> If the user pastes a URL (or says “make it look like this site”), that input is **reference material for `brand.json` only** (name, colours, fonts, logo, tagline).  
+> **Do not** scaffold a login page, signup, OAuth, gated dashboard, or copy the reference site’s IA/pages — **unless the user explicitly asks for CMS login / auth**.  
+> Default TomorrowOS Control Panel has **no login**. Keep it that way.
 
 ### Step A — Ask branding input
 
@@ -465,8 +486,9 @@ import { put } from "@vercel/blob";
 
 > Let’s brand your TomorrowOS experience. You can answer in either way:
 >
-> **Option A — Website URL only**  
-> Paste **one public website URL** (your company / venue site). I will infer colours, fonts, name, tagline, and logo from that page and write `brand.json` to match its look.
+> **Option A — Website URL only (brand reference)**  
+> Paste **one public website URL**. I will use it **only** to infer colours, fonts, name, tagline, and logo for **`brand.json`**.  
+> I will **not** rebuild that website, add a login page, or change Control Panel features — unless you explicitly ask for login/auth later.
 >
 > **Option B — Manual fields**  
 > Provide:
@@ -483,7 +505,8 @@ import { put } from "@vercel/blob";
 **You must:**
 
 1. **Fetch and inspect** the page (HTTP GET the URL; follow one redirect if needed). Do not invent colours.
-2. **Derive branding** using this priority order:
+2. **Write / update `brand.json` only** from what you infer. Touch nothing else for this step (no new pages, no auth, no Next marketing site, no login UI).
+3. **Derive branding** using this priority order:
    - **Name:** `<title>`, `og:site_name`, or prominent header / logo `alt` text (trim to ≤ 60 chars).
    - **Tagline:** `meta[name="description"]`, `og:description`, or first hero subtitle (≤ 120 chars).
    - **Primary colour:** `meta[name="theme-color"]`, CSS `--primary` / `--brand` variables, or dominant accent from linked stylesheets / inline styles (convert to `#RRGGBB`).
@@ -492,10 +515,20 @@ import { put } from "@vercel/blob";
    - **Secondary colour:** muted border / secondary button colour, or a tint of the primary.
    - **Font:** first `font-family` on `body` (strip quotes; default `Inter` if generic system stack).
    - **Logo:** prefer `og:image`, then `link[rel="icon"]` / apple-touch-icon, then header `<img>` logo. Download into `./assets/logo.png` or `./assets/logo.svg` and set `logoPath` accordingly. If only favicon exists, use it and note size in the summary.
-3. **Contrast check:** if background is dark, set `activationScreen.theme` to `"dark"` and add `logoPathOnDark` when a light logo variant exists.
-4. **Infer `cms.useCase`** from page content when obvious (restaurant / retail / corporate / etc.); otherwise `"other"`.
-5. **Show a one-line summary** to the user (name + primary hex + logo path) before or while writing the file — do not ask a second branding question unless fetch failed.
-6. If the URL is unreachable, blocked, or has no usable styles, say so and fall back to **Option B** manual questions for missing fields only.
+4. **Contrast check:** if background is dark, set `activationScreen.theme` to `"dark"` and add `logoPathOnDark` when a light logo variant exists.
+5. **Infer `cms.useCase`** from page content when obvious (restaurant / retail / corporate / etc.); otherwise `"other"`.
+6. **Show a one-line summary** to the user (name + primary hex + logo path) before or while writing the file — do not ask a second branding question unless fetch failed.
+7. If the URL is unreachable, blocked, or has no usable styles, say so and fall back to **Option B** manual questions for missing fields only.
+
+**Explicitly forbidden when the user only gave a URL (no login request):**
+
+- ❌ Login / signup / “Sign in to continue” screens
+- ❌ Auth middleware, sessions, cookies, OAuth, password forms
+- ❌ Cloning the reference site as a marketing landing or multi-page CMS
+- ❌ Gating the Control Panel behind authentication
+- ❌ Treating “make it like this site” as “rebuild this site”
+
+If the reference site itself is a login page, **still only extract visual brand tokens** (colours/logo/name) into `brand.json` — do **not** recreate that login flow.
 
 ### Step C — Write `brand.json`
 
@@ -631,6 +664,8 @@ Tell the user:
 | Secrets in git | Mistake | Rotate keys; move to Vercel Env Vars |
 | Replit files present | Copied wrong protocol | Delete `.replit*`; use this file |
 | Brand colours wrong from URL | SPA / blocked fetch | Manual Option B for colours + logo |
+| Agent asked for OpenAI / `sk-` key during setup | Hallucinated “AI pairing” requirement | **Refuse.** TomorrowOS does not need LLM keys. Return to Q2 media choices only |
+| Agent built a login page after user pasted a URL | Misread brand reference as product scope | Remove login; keep starter Control Panel; apply URL only to `brand.json` |
 
 ---
 
@@ -645,7 +680,7 @@ Tell the user:
 | Media | Cloudinary or Replit Object Storage | Cloudinary **or Vercel Blob** |
 | Preview | Replit Preview / Autoscale Node | **Next shell + proxy** when v0 hardwires Next |
 | Publish | Long-lived Node | **Node `TomorrowOS.listen` only** (not Next) |
-| Brand from URL | Not in Replit protocol | **Option A** in Question 3 — infer from website |
+| Brand from URL | Not in Replit protocol | **Option A** — infer **`brand.json` only**; never invent login |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.23",
+  "version": "0.9.25",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.23",
+  "version": "0.9.25",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.23",
+    "@tomorrowos/sdk": "^0.9.25",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },