@tomorrowos/sdk 0.9.42 → 0.9.43

package/LOVABLE_SETUP.md

@@ -12,21 +12,21 @@ When a human pastes a prompt like this, **read this file and start Question 1 im
 ```text
 Follow @tomorrowos/sdk LOVABLE_SETUP.md and set up my TomorrowOS CMS.
 Ask only the questions listed in LOVABLE_SETUP.md, in order. Do not use LLM_PROMPT.md.
-Do not build a Vite/React mock of TomorrowOS �?use @tomorrowos/sdk cms-starter (Node + WebSocket).
+Do not build a Vite/React mock of TomorrowOS 鈥?use @tomorrowos/sdk cms-starter (Node + WebSocket).
 Question 3 only updates brand.json.
-After setup questions (including Cloudinary Secrets if chosen), configure and deploy �?minimal verification only.
-Never test Supabase connection �?save SUPABASE_URL and move on. No Supabase or WebSocket tests.
+After setup questions (including Cloudinary Secrets if chosen), configure and deploy 鈥?minimal verification only.
+Never test Supabase connection 鈥?save SUPABASE_URL and move on. No Supabase or WebSocket tests.
 Do not skip steps.
 ```
 
 Alternate triggers that also activate this protocol:
 
-- “Set up TomorrowOS on Lovable using LOVABLE_SETUP.md�?
-- “Configure my TomorrowOS CMS (Lovable wizard)�?
+- 鈥淪et up TomorrowOS on Lovable using LOVABLE_SETUP.md鈥?
+- 鈥淐onfigure my TomorrowOS CMS (Lovable wizard)鈥?
 
 When any of these triggers fire, **ignore `LLM_PROMPT.md` entirely** for the Q&A phase.
 
-**Before Question 1:** read **IRON RULE: real Node CMS only** below. If the project is already a default Lovable Vite + React app with no `@tomorrowos/sdk` server, **do not** keep building that as the TV CMS �?seed or replace with the SDK `cms-starter` layout first.
+**Before Question 1:** read **IRON RULE: real Node CMS only** below. If the project is already a default Lovable Vite + React app with no `@tomorrowos/sdk` server, **do not** keep building that as the TV CMS 鈥?seed or replace with the SDK `cms-starter` layout first.
 
 ---
 
@@ -41,78 +41,78 @@ TomorrowOS CMS needs a **Node.js process** that:
 - serves the Control Panel at **`GET /`**
 - keeps **WebSocket** connections open for Tizen / BrightSign players
 
-Lovable’s default app is **Vite + React + Lovable Cloud** (Postgres / Auth / Storage / Edge Functions). That stack **cannot** replace `@tomorrowos/sdk`’s long-lived WebSocket CMS by itself.
+Lovable鈥檚 default app is **Vite + React + Lovable Cloud** (Postgres / Auth / Storage / Edge Functions). That stack **cannot** replace `@tomorrowos/sdk`鈥檚 long-lived WebSocket CMS by itself.
 
 | Required | Forbidden |
 |----------|-----------|
 | Project seeded from **`npx @tomorrowos/sdk init`** (or `templates/cms-starter`) | Rebuilding pairing / WebSocket / `setPolicy` in React or Edge Functions |
-| Live Node entry: `npm run start` �?`tsx server.ts` | Claiming Lovable Cloud **Publish** alone is the TV CMS endpoint |
-| Control Panel HTML at `/` via `staticRoot: public` | Vite-only SPA that “looks like�?a CMS but has no TomorrowOS server |
+| Live Node entry: `npm run start` 鈫?`tsx server.ts` | Claiming Lovable Cloud **Publish** alone is the TV CMS endpoint |
+| Control Panel HTML at `/` via `staticRoot: public` | Vite-only SPA that 鈥渓ooks like鈥?a CMS but has no TomorrowOS server |
 | Durable DB via Supabase / Lovable Cloud Postgres URL | Inventing a hand-rolled store protocol |
 
 ### How Publish works on Lovable (read carefully)
 
-1. **Lovable Agent** = wizard + editor (ask Q1–Q3, write Secrets / `brand.json` / `server.ts`).
+1. **Lovable Agent** = wizard + editor (ask Q1鈥換3, write Secrets / `brand.json` / `server.ts`).
 2. **GitHub sync** = required so the Node CMS can be hosted where Node + WebSocket work.
 3. **TV-facing CMS host** (pick one; do not invent a fourth):
-   - **Railway** (recommended companion) �?long-lived Node, `npm run start`
-   - **Render / Fly.io** �?same pattern as Railway
-   - **Vercel Fluid** �?only if following **`VERCEL_SETUP.md`** / `cms-starter-v0` (do not mix Replit-style root `server.ts` with broken Vercel static deploy)
+   - **Railway** (recommended companion) 鈥?long-lived Node, `npm run start`
+   - **Render / Fly.io** 鈥?same pattern as Railway
+   - **Vercel Fluid** 鈥?only if following **`VERCEL_SETUP.md`** / `cms-starter-v0` (do not mix Replit-style root `server.ts` with broken Vercel static deploy)
 
-**Do not tell the user “Publish on Lovable Cloud�?is done** unless the **Node CMS URL** (Railway / Render / Fly / Vercel Fluid) is live and serves the Control Panel at `/`.
+**Do not tell the user 鈥淧ublish on Lovable Cloud鈥?is done** unless the **Node CMS URL** (Railway / Render / Fly / Vercel Fluid) is live and serves the Control Panel at `/`.
 
 Lovable Cloud remains useful for:
 
 - **Secrets** UI
-- **Postgres** (same family as Supabase �?use as `SUPABASE_URL` / database URL)
-- **Lovable Cloud Storage** (Object Storage replacement �?see Question 2)
+- **Postgres** (same family as Supabase 鈥?use as `SUPABASE_URL` / database URL)
+- **Lovable Cloud Storage** (Object Storage replacement 鈥?see Question 2)
 
 ---
 
-## Questionnaire scope (STRICT �?read before asking anything)
+## Questionnaire scope (STRICT 鈥?read before asking anything)
 
 Lovable Agent must ask **only** the questions defined in **this file**, in **this exact order**:
 
 | Step | Section | When |
 |------|---------|------|
-| 1 | **Question 1** �?Supabase / Lovable Cloud Postgres connection string | Always |
-| 2 | **Question 2** �?Media storage (+ Cloudinary Secrets if chosen) | Always (after Q1) |
-| 3 | **Question 3** �?Brand / TomorrowOS app look | Always last, before execution |
+| 1 | **Question 1** 鈥?Supabase / Lovable Cloud Postgres connection string | Always |
+| 2 | **Question 2** 鈥?Media storage (+ Cloudinary Secrets if chosen) | Always (after Q1) |
+| 3 | **Question 3** 鈥?Brand / TomorrowOS app look | Always last, before execution |
 
-**That is the complete list.** There are no other setup questions. **Do not** ask how many screens / devices. There is **no** “Question 2b�?�?Cloudinary credentials are collected **inside Question 2**, immediately after the user chooses Cloudinary.
+**That is the complete list.** There are no other setup questions. **Do not** ask how many screens / devices. There is **no** 鈥淨uestion 2b鈥?鈥?Cloudinary credentials are collected **inside Question 2**, immediately after the user chooses Cloudinary.
 
-**Critical:** Question 2 is **not complete** when the user says “Cloudinary�?or “yes�? You **must** immediately collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3. Do **not** skip to branding with placeholder or invented credentials.
+**Critical:** Question 2 is **not complete** when the user says 鈥淐loudinary鈥?or 鈥測es鈥? You **must** immediately collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3. Do **not** skip to branding with placeholder or invented credentials.
 
-If the user volunteers extra info early (e.g. brand name before Q3), **record it** and still ask the current question’s required fields you do not yet have. Do not skip ahead to execution until Q1–Q3 are complete (Question 2 includes Cloudinary Secrets when applicable).
+If the user volunteers extra info early (e.g. brand name before Q3), **record it** and still ask the current question鈥檚 required fields you do not yet have. Do not skip ahead to execution until Q1鈥換3 are complete (Question 2 includes Cloudinary Secrets when applicable).
 
-If the user says “just set it up, don’t ask questions,�?respond:
+If the user says 鈥渏ust set it up, don鈥檛 ask questions,鈥?respond:
 
-> I need a few quick answers from LOVABLE_SETUP.md (Postgres connection string, media storage �?plus Cloudinary credentials if you choose Cloudinary �?and branding). It takes about a minute and ensures the CMS deploys correctly with Lovable + a Node host.
+> I need a few quick answers from LOVABLE_SETUP.md (Postgres connection string, media storage 鈥?plus Cloudinary credentials if you choose Cloudinary 鈥?and branding). It takes about a minute and ensures the CMS deploys correctly with Lovable + a Node host.
 
-Then ask **Question 1** �?do not switch to `LLM_PROMPT.md`.
+Then ask **Question 1** 鈥?do not switch to `LLM_PROMPT.md`.
 
 ---
 
 ## Hard rules
 
-1. **Ask only LOVABLE_SETUP.md questions 1�?.** Never use `LLM_PROMPT.md` on Lovable for this wizard.
-2. **One question at a time.** Wait for the user’s answer before asking the next (unless they already answered several in one message). **Exception:** If the user chooses Cloudinary in Question 2, **stay on Question 2** and immediately collect Cloudinary Secrets �?do **not** announce a separate �?b�?
+1. **Ask only LOVABLE_SETUP.md questions 1鈥?.** Never use `LLM_PROMPT.md` on Lovable for this wizard.
+2. **One question at a time.** Wait for the user鈥檚 answer before asking the next (unless they already answered several in one message). **Exception:** If the user chooses Cloudinary in Question 2, **stay on Question 2** and immediately collect Cloudinary Secrets 鈥?do **not** announce a separate 鈥?b鈥?
 3. **Do not invent** Cloudinary credentials, database URLs, or brand colours. **Do not ask** screen / device count.
 4. **Prefer `SUPABASE_URL`** for the Postgres connection string Secret name (same as Replit). Lovable Cloud / linked Supabase both work. Do not commit passwords into git.
 5. **Prefer `npx @tomorrowos/sdk init`** (or copy `templates/cms-starter`) as the project seed. Do not rebuild pairing, WebSocket, or playlist APIs from scratch.
-6. **Never commit secrets.** Put credentials in Lovable **Cloud �?Secrets** (and the Node host’s env vars: Railway / Render / Fly / Vercel).
-7. After Q&A, **configure and deploy** �?do **not** run a long test suite (see **Post-Q&A: minimal verification only**).
-8. **Supabase / Lovable Postgres: configure only �?never test.** Save `SUPABASE_URL` + `TOMORROWOS_STORE=supabase` and proceed. Do not ping Postgres or treat preview DB errors as a failed setup.
+6. **Never commit secrets.** Put credentials in Lovable **Cloud 鈫?Secrets** (and the Node host鈥檚 env vars: Railway / Render / Fly / Vercel).
+7. After Q&A, **configure and deploy** 鈥?do **not** run a long test suite (see **Post-Q&A: minimal verification only**).
+8. **Supabase / Lovable Postgres: configure only 鈥?never test.** Save `SUPABASE_URL` + `TOMORROWOS_STORE=supabase` and proceed. Do not ping Postgres or treat preview DB errors as a failed setup.
 9. **Do not** replace `@tomorrowos/sdk` with Edge Functions, React state, or a fake WebSocket.
 10. **Media durability:** Lovable has **no Replit Object Storage mount** on a local `public/uploads` disk. Use **Cloudinary** or **Lovable Cloud Storage** (see Question 2). Plain local `public/uploads` is ephemeral on most Node hosts unless a volume is attached.
 
 **Question order (always):**
 
-- Q1 �?Q2 �?Q3 �?execution checklist
+- Q1 鈫?Q2 鈫?Q3 鈫?execution checklist
 
 ---
 
-## Question 1 �?Supabase / Lovable Cloud Postgres (always)
+## Question 1 鈥?Supabase / Lovable Cloud Postgres (always)
 
 > **This is the first setup question.** Always configure durable Postgres. **Do not** ask how many screens / devices.
 
@@ -122,7 +122,7 @@ Then ask **Question 1**
 >
 > Example shape: `postgresql://postgres.[PROJECT]:[PASSWORD]@aws-0-[REGION].pooler.supabase.com:6543/postgres`
 >
-> If you use **Lovable Cloud**, open **Cloud �?Database** (or project connection settings) and copy the Postgres URI. Also confirm SSL (usually **yes**).
+> If you use **Lovable Cloud**, open **Cloud 鈫?Database** (or project connection settings) and copy the Postgres URI. Also confirm SSL (usually **yes**).
 
 **You must then:**
 
@@ -130,7 +130,7 @@ Then ask **Question 1**
 2. Save also:
    - `TOMORROWOS_STORE=supabase`
    - `DATABASE_SSL=true` (unless the user explicitly says SSL is off)
-3. Mirror the same env vars on the **Node host** (Railway / Render / Fly / Vercel) �?Lovable Secrets alone do not reach a Railway process.
+3. Mirror the same env vars on the **Node host** (Railway / Render / Fly / Vercel) 鈥?Lovable Secrets alone do not reach a Railway process.
 4. Wire `server.ts` like the Replit starter:
 
 ```ts
@@ -158,7 +158,7 @@ tomorrowos.listen({
 ```
 
 5. **Do not** write the real password into committed files.
-6. **Do not** test the database connection after saving �?configuration only.
+6. **Do not** test the database connection after saving 鈥?configuration only.
 7. **Do not** proceed to Question 2 until `SUPABASE_URL` is saved.
 
 If the user refuses Postgres, warn that fleets need a durable store, then offer SQLite only after they explicitly confirm (SQLite is a poor fit on ephemeral Lovable/Railway disks).
@@ -167,27 +167,27 @@ If the user refuses Postgres, warn that fleets need a durable store, then offer
 
 ---
 
-## Question 2 �?Media storage (uploads / thumbnails)
+## Question 2 鈥?Media storage (uploads / thumbnails)
 
-### Step A �?Ask storage choice
+### Step A 鈥?Ask storage choice
 
 **Ask exactly:**
 
 > How should playlist media (images/videos) be stored?
 >
-> **Recommended: Cloudinary** �?public HTTPS URLs; `@tomorrowos/sdk` auto-detects `CLOUDINARY_*` Secrets and `/media/upload` works out of the box.
+> **Recommended: Cloudinary** 鈥?public HTTPS URLs; `@tomorrowos/sdk` auto-detects `CLOUDINARY_*` Secrets and `/media/upload` works out of the box.
 >
 > Alternatives:
-> - **Lovable Cloud Storage** (replaces Replit Object Storage) �?public Storage bucket on Lovable Cloud / Supabase Storage; durable HTTPS URLs for players.
-> - **Local disk only** �?`public/uploads` on the Node host (fine for quick tests; files may disappear on redeploy without a volume).
+> - **Lovable Cloud Storage** (replaces Replit Object Storage) 鈥?public Storage bucket on Lovable Cloud / Supabase Storage; durable HTTPS URLs for players.
+> - **Local disk only** 鈥?`public/uploads` on the Node host (fine for quick tests; files may disappear on redeploy without a volume).
 >
-> Do you want me to set up **Cloudinary**? (yes / no �?if no, say whether you want **Lovable Cloud Storage** or local only)
+> Do you want me to set up **Cloudinary**? (yes / no 鈥?if no, say whether you want **Lovable Cloud Storage** or local only)
 
-### Step B �?If YES / Cloudinary (same Question 2 �?no �?b�?
+### Step B 鈥?If YES / Cloudinary (same Question 2 鈥?no 鈥?b鈥?
 
 **Do this immediately** when the user chooses Cloudinary. **Go straight to collecting Secrets.**
 
-**Preferred:** Lovable **Cloud �?Secrets** fields for:
+**Preferred:** Lovable **Cloud 鈫?Secrets** fields for:
 
 - `CLOUDINARY_CLOUD_NAME`
 - `CLOUDINARY_API_KEY`
@@ -196,7 +196,7 @@ If the user refuses Postgres, warn that fleets need a durable store, then offer
 
 **If Secrets UI is unavailable, ask exactly:**
 
-> Paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) �?Dashboard �?**API Keys**). I will store them as Secrets:
+> Paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) 鈫?Dashboard 鈫?**API Keys**). I will store them as Secrets:
 >
 > 1. **`CLOUDINARY_CLOUD_NAME`**
 > 2. **`CLOUDINARY_API_KEY`**
@@ -209,20 +209,20 @@ If the user refuses Postgres, warn that fleets need a durable store, then offer
 1. Save those Secrets in Lovable **and** on the Node host.
 2. **Do not** invent or placeholder credentials.
 3. **Do not** proceed to Question 3 until all three required Secrets exist.
-4. **Do not** run a Cloudinary upload test �?configuration only.
+4. **Do not** run a Cloudinary upload test 鈥?configuration only.
 
 The SDK auto-detects these env vars; new uploads return `https://res.cloudinary.com/...` URLs.
 
-### If NO �?Lovable Cloud Storage (Object Storage replacement)
+### If NO 鈥?Lovable Cloud Storage (Object Storage replacement)
 
 This is the Lovable equivalent of **Replit Object Storage**: durable files with public HTTPS URLs, not an ephemeral disk folder.
 
 **Do this:**
 
-1. Open / use **Cloud �?Storage**.
+1. Open / use **Cloud 鈫?Storage**.
 2. Create a **public** bucket named **`tomorrowos-uploads`** (or confirm it exists). Public read is required so Tizen / BrightSign players can fetch media by URL.
 3. Save Secrets (Lovable + Node host) as needed for Storage access used by your upload path, typically:
-   - `SUPABASE_URL` (already from Q1 �?API URL form may differ from Postgres URI; if the project exposes a separate API URL, store it as `SUPABASE_API_URL` only when required)
+   - `SUPABASE_URL` (already from Q1 鈥?API URL form may differ from Postgres URI; if the project exposes a separate API URL, store it as `SUPABASE_API_URL` only when required)
    - Service role or upload-capable key **only in server-side Secrets**, never in client bundles
 4. Tell the user clearly:
    - Playlist items must use **absolute `https://...` Storage (or Cloudinary) URLs**.
@@ -231,7 +231,7 @@ This is the Lovable equivalent of **Replit Object Storage**: durable files with
 5. **Do not** claim that `public/uploads` on Lovable is durable like Replit Object Storage.
 6. **Do not** invent Cloudinary credentials.
 
-### If NO �?local disk only
+### If NO 鈥?local disk only
 
 1. Ensure `public/uploads` exists on the Node host (`mkdir -p public/uploads`).
 2. Warn: redeploys may wipe files unless the host has a persistent volume.
@@ -239,22 +239,22 @@ This is the Lovable equivalent of **Replit Object Storage**: durable files with
 
 ---
 
-## Question 3 �?Brand / TomorrowOS app look (`brand.json` only)
+## Question 3 鈥?Brand / TomorrowOS app look (`brand.json` only)
 
 > **Scope:** Question 3 answers **only** update **`brand.json`**.  
 > **Do not** change deploy host, Secrets, or `server.ts` from branding answers.
 
 **Ask exactly (one message; user may answer in one reply):**
 
-> Let’s brand your TomorrowOS experience. Please provide:
+> Let鈥檚 brand your TomorrowOS experience. Please provide:
 >
 > 1. **Product / venue name** (shown on screens and the Control Panel)
 > 2. **Tagline** (optional)
 > 3. **Primary colour** (hex, e.g. `#FF8A3D`)
-> 4. **Background colour** (hex, optional �?default `#FAFAF9`)
-> 5. **Text colour** (hex, optional �?default `#0A0908`)
+> 4. **Background colour** (hex, optional 鈥?default `#FAFAF9`)
+> 5. **Text colour** (hex, optional 鈥?default `#0A0908`)
 > 6. **Secondary / accent colour** (hex, optional)
-> 7. **Logo** �?upload an SVG/PNG into the project, or give a URL I can fetch into `./assets/`
+> 7. **Logo** 鈥?upload an SVG/PNG into the project, or give a URL I can fetch into `./assets/`
 
 If the user only gives a name and primary colour, use defaults for the rest and say what you assumed.
 
@@ -288,11 +288,11 @@ If the user only gives a name and primary colour, use defaults for the rest and
 
 - Default `cms.hostingTarget` to `"self-hosted"` for Railway / Render / Fly.
 - Use `"vercel"` only when following the Vercel Fluid path.
-- Set `cmsEndpoint` only if the user already knows the public `wss://…` URL; otherwise leave it out and tell them to point players at the published HTTPS CMS URL (player converts `https://` �?`wss://`).
+- Set `cmsEndpoint` only if the user already knows the public `wss://鈥 URL; otherwise leave it out and tell them to point players at the published HTTPS CMS URL (player converts `https://` 鈫?`wss://`).
 
 ---
 
-## After all answers �?execution checklist
+## After all answers 鈥?execution checklist
 
 ### A. Seed the TomorrowOS CMS (not a Lovable React mock)
 
@@ -347,7 +347,7 @@ Copy the same keys to the **Node host** env.
     "start": "tsx server.ts"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.42",
+    "@tomorrowos/sdk": "^0.9.43",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   }
@@ -362,10 +362,10 @@ Copy the same keys to the **Node host** env.
 1. Enable **GitHub sync** from Lovable (or push the cms-starter repo).
 2. Create a **Railway** (or Render / Fly) service from that repo.
 3. Set Start Command: `npm run start`
-4. Paste Secrets from Q1–Q2 into the host.
+4. Paste Secrets from Q1鈥換2 into the host.
 5. Deploy and open the public HTTPS URL.
 
-**If the user insists on Vercel:** stop using this Railway-oriented finish path and follow **`VERCEL_SETUP.md`** (`npx tomorrowos init --hosting v0`) instead �?do not half-migrate.
+**If the user insists on Vercel:** stop using this Railway-oriented finish path and follow **`VERCEL_SETUP.md`** (`npx tomorrowos init --hosting v0`) instead 鈥?do not half-migrate.
 
 ### F. Minimal verification only
 
@@ -390,21 +390,21 @@ Copy the same keys to the **Node host** env.
 
 1. Confirm real **`@tomorrowos/sdk`** server (not a React mock).
 2. Write Secrets / `.env` / `brand.json` / `server.ts` from answers.
-3. Deploy Node host �?Preview Control Panel at `/`.
+3. Deploy Node host 鈫?Preview Control Panel at `/`.
 
 ### Do NOT run after setup (unless user asks or deploy fails)
 
-- �?Supabase connection test
-- �?Cloudinary upload test
-- �?Formal WebSocket console gates
-- �?Long troubleshooting when `/` already shows the Control Panel
+- 鉂?Supabase connection test
+- 鉂?Cloudinary upload test
+- 鉂?Formal WebSocket console gates
+- 鉂?Long troubleshooting when `/` already shows the Control Panel
 
 ---
 
 ## What not to ask / change
 
-- **`LLM_PROMPT.md`** �?not used for this Lovable wizard
-- Standalone screen-count / platform / hosting questionnaires outside Q1–Q3
+- **`LLM_PROMPT.md`** 鈥?not used for this Lovable wizard
+- Standalone screen-count / platform / hosting questionnaires outside Q1鈥換3
 - Replacing `@tomorrowos/sdk` with Edge Functions or React
 - Saying **Lovable Cloud Publish** alone is enough for TVs
 - Treating **Lovable Cloud Storage** as automatic `public/uploads` persistence (it is **not** a disk mount like Replit Object Storage)
@@ -413,7 +413,7 @@ Copy the same keys to the **Node host** env.
 
 ---
 
-## SQLite fallback �?only if user refuses Postgres
+## SQLite fallback 鈥?only if user refuses Postgres
 
 ```ts
 const store = createTomorrowOSStore({
@@ -433,8 +433,8 @@ Warn that SQLite on ephemeral hosts loses pairings on redeploy.
 
 | Symptom | Likely cause | Fix |
 |---------|--------------|-----|
-| “CMS�?is a React app with no pairing | Agent built a Lovable mock | Re-seed with `npx @tomorrowos/sdk init`; deploy Node host |
-| Lovable Publish URL does not pair TVs | Expected �?no WebSocket CMS there | Deploy Railway / Render / Fly / Vercel Fluid; use that URL |
+| 鈥淐MS鈥?is a React app with no pairing | Agent built a Lovable mock | Re-seed with `npx @tomorrowos/sdk init`; deploy Node host |
+| Lovable Publish URL does not pair TVs | Expected 鈥?no WebSocket CMS there | Deploy Railway / Render / Fly / Vercel Fluid; use that URL |
 | `tsx: not found` on host | `tsx` only in devDependencies | Move `tsx` to `dependencies` |
 | Uploads vanish after redeploy | Local `public/uploads` | Cloudinary or Lovable Cloud Storage public URLs |
 | Storage files 403 on player | Private bucket | Make `tomorrowos-uploads` **public** read |
@@ -443,11 +443,11 @@ Warn that SQLite on ephemeral hosts loses pairings on redeploy.
 
 ---
 
-## Replit �?Lovable mapping (for Agents)
+## Replit 鈫?Lovable mapping (for Agents)
 
 | Replit | Lovable |
 |--------|---------|
-| Replit Secrets | Lovable **Cloud �?Secrets** (+ copy to Node host) |
+| Replit Secrets | Lovable **Cloud 鈫?Secrets** (+ copy to Node host) |
 | Replit Object Storage / `public/uploads` | **Lovable Cloud Storage** public bucket `tomorrowos-uploads` (or Cloudinary) |
 | `.replit` + Autoscale Publish | **GitHub sync + Railway/Render/Fly** `npm run start` (or **VERCEL_SETUP.md**) |
 | Artifact `kind = web` | Real cms-starter Node app with Control Panel at `/` |
@@ -457,6 +457,6 @@ Warn that SQLite on ephemeral hosts loses pairings on redeploy.
 
 ## Protocol version
 
-`lovable-setup/1.0` �?aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+`lovable-setup/1.0` 鈥?aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
 
-**Changelog 1.0:** Initial Lovable wizard mirroring REPLIT_SETUP Q1–Q3; IRON RULE that Lovable Cloud Publish is not the WebSocket CMS host; Replit Object Storage replaced by Lovable Cloud Storage (+ Cloudinary still recommended for `/media/upload`).
+**Changelog 1.0:** Initial Lovable wizard mirroring REPLIT_SETUP Q1鈥換3; IRON RULE that Lovable Cloud Publish is not the WebSocket CMS host; Replit Object Storage replaced by Lovable Cloud Storage (+ Cloudinary still recommended for `/media/upload`).

package/README.md

@@ -65,11 +65,12 @@ In Replit Agent, paste:
 Follow @tomorrowos/sdk REPLIT_SETUP.md and set up my TomorrowOS CMS.
 Ask me the questions in order. Do not skip steps.
 Q1 database order: Supabase (Recommended), then Built-in Replit PostgreSQL, then SQLite.
-If Supabase: collect SUPABASE_URL once only. Question 3 branding is all optional (defaults from brand.json).
+If Supabase: SUPABASE_URL Secrets input immediately after choice (once only).
+If Cloudinary: all CLOUDINARY_* Secrets in one multi-field dialog immediately after choice.
+Q3: one stacked dialog with all seven branding fields (optional; blanks keep brand.json defaults).
 ```
 
-That wizard asks database choice (**Supabase recommended first**), prefers Cloudinary for media, and writes
-`brand.json` from optional branding answers (missing fields keep starter defaults). On Replit, Supabase must use Secret
+That wizard asks database choice (**Supabase recommended first**), prefers Cloudinary for media, and collects optional branding in **one multi-field dialog**. On Replit, Supabase must use Secret
 **`SUPABASE_URL`** (not the reserved `DATABASE_URL` — that is for built-in Replit PostgreSQL).
 
 ### Lovable guided setup

package/REPLIT_SETUP.md

@@ -14,9 +14,10 @@ Follow @tomorrowos/sdk REPLIT_SETUP.md and set up my TomorrowOS CMS.
 Ask only the questions listed in REPLIT_SETUP.md, in order. Do not use LLM_PROMPT.md.
 Artifact kind must be **web** (never **api**).
 Question 1 database options in this order: 1) Supabase (Recommended) 2) Built-in Replit PostgreSQL 3) SQLite.
-If Supabase: collect SUPABASE_URL once only — never ask for the connection string twice.
-Question 3 branding fields are all optional; missing values keep starter brand.json defaults.
-After all setup questions are answered (including Cloudinary Secrets if you chose Cloudinary), configure and start — minimal verification only (Web app type + Preview at /). **Never test database connection** in Preview — configure and move on. No DB or WebSocket tests.
+If Supabase: show the SUPABASE_URL Secrets input immediately after the choice (same Question 1 — once only).
+If Cloudinary: show all CLOUDINARY_* Secrets inputs immediately after the choice (same Question 2 — one multi-field dialog).
+Question 3: one multi-field dialog with all seven branding inputs stacked (all optional; blanks keep brand.json defaults). Never ask branding fields one-by-one with Next.
+After all setup questions are answered, configure and start — minimal verification only (Web app type + Preview at /). **Never test database connection** in Preview — configure and move on. No DB or WebSocket tests.
 Do not skip steps.
 ```
 
@@ -67,16 +68,24 @@ Replit Agent must ask **only** the questions defined in **this file**, in **this
 
 **That is the complete list.** There are no other setup questions. **Do not** ask how many screens / devices. There is **no** “Question 2b” — Cloudinary credentials are collected **inside Question 2**, immediately after the user chooses Cloudinary.
 
+**Critical — UI shape (Replit multi-input dialogs):** Prefer Replit’s **Secrets / form UI with multiple input fields in one dialog**. Do **not** run a chat wizard that asks one field, waits, then “Next” for the next field.
+
+| Step | Required UI |
+|------|-------------|
+| Q1 + Supabase | Database choice → **immediately** one Secrets input for `SUPABASE_URL` (still Question 1) |
+| Q2 + Cloudinary | Media choice → **immediately** one multi-field Secrets dialog for all `CLOUDINARY_*` keys (still Question 2) |
+| Q3 branding | **One** multi-field dialog with **all seven** branding inputs stacked (name, tagline, primary, background, text, secondary, logo) |
+
 **Critical — Question 1 option order (exact):** Present database choices in **this order only**:
 1. **Supabase Postgres (Recommended)**
 2. **Built-in Replit PostgreSQL**
 3. **SQLite (local file — fine for testing)**
 
-**Critical — Supabase path collected once only:** If the user picks Supabase, collect `SUPABASE_URL` in **one** step (Secrets UI **or** chat paste — not both). After it is saved, **never** ask for the connection string / `SUPABASE_URL` again (not in Q2, Q3, execution, Publish, or “confirm Secrets”).
+**Critical — Supabase path collected once only:** If the user picks Supabase, collect `SUPABASE_URL` **immediately after the choice**, in **one** step (Secrets UI **or** a single chat paste — not both). After it is saved, **never** ask for the connection string / `SUPABASE_URL` again.
 
-**Critical:** Question 2 is **not complete** when the user says “Cloudinary” or “yes”. You **must** immediately show the Cloudinary Secrets input (same step — do **not** label a new question) and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3. Do **not** skip to branding with placeholder or invented credentials.
+**Critical:** Question 2 is **not complete** when the user says “Cloudinary” or “yes”. You **must immediately** open the **multi-field** Cloudinary Secrets dialog (same Question 2 — **not** “2b”, **not** one key per message) and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3.
 
-**Critical — Question 3:** Every branding field is **optional**. Empty / skip / “use defaults” → keep values from the starter **`brand.json`**. Do **not** re-ask for missing name or colours.
+**Critical — Question 3:** All seven branding fields are **optional** and must appear in **one stacked multi-input dialog**. Empty / skip / “use defaults” → keep starter **`brand.json`**. **Never** ask name, then colours, then logo across separate turns.
 
 If the user volunteers extra info early (e.g. brand name before Q3), **record it** and still ask the current question’s required fields you do not yet have. Do not skip ahead to execution until Q1–Q3 are complete (Question 2 includes Cloudinary Secrets when applicable). For Q3, “complete” includes the user skipping or leaving fields blank.
 
@@ -91,10 +100,13 @@ Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
 ## Hard rules
 
 1. **Ask only REPLIT_SETUP.md questions 1–3** (see **Questionnaire scope**). Never use `LLM_PROMPT.md` on Replit.
-2. **One question at a time.** Wait for the user’s answer before asking the next question (unless they already answered several in one message). **Exception:** If the user chooses Cloudinary in Question 2, **stay on Question 2** and immediately show the Secrets form — do **not** open a separate “2b” step or announce a new question number.
+2. **One questionnaire step at a time (Q1 → Q2 → Q3).** Wait for that step to finish before opening the next. **Inside** a step, use **one multi-field dialog** when collecting Secrets or branding — **never** field-by-field “Next” wizards.
+2a. **Q1 Supabase:** choice → **immediately** `SUPABASE_URL` input (same Question 1).
+2b. **Q2 Cloudinary:** choice → **immediately** multi-field `CLOUDINARY_*` Secrets dialog (same Question 2).
+2c. **Q3:** one dialog, **seven inputs stacked** (all optional).
 3. **Do not invent** Cloudinary credentials, Supabase URLs, or brand colours. **Do not ask** screen / device count.
 4. **Do not use Replit’s reserved `DATABASE_URL` Secret for Supabase.** On Replit, `DATABASE_URL` is often the **built-in Replit PostgreSQL** URL. For Supabase always use **`SUPABASE_URL`**. For built-in Replit Postgres, use **`DATABASE_URL`** with `TOMORROWOS_STORE=postgres`.
-4a. **If Supabase is chosen: never collect `SUPABASE_URL` twice.** One capture after the choice is enough for the whole wizard and execution checklist.
+4a. **If Supabase is chosen: never collect `SUPABASE_URL` twice.** One capture right after the choice is enough.
 4b. **Question 3 fields are all optional.** Missing values → keep starter `brand.json` defaults; do not block or re-prompt.
 4c. **`TOMORROWOS_STORE` + `DATABASE_SSL` are agent-owned.** After the Q1 choice (and URL if needed), set them yourself. Never ask the user to type those names/values.
 5. **Prefer `npx @tomorrowos/sdk init`** (or the package’s `templates/cms-starter`) as the project seed. Do not rebuild pairing, WebSocket, or playlist APIs from scratch.
@@ -108,7 +120,7 @@ Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
 
 - Q1 → Q2 → Q3 → execution checklist
 
-Never insert extra questions between these steps. When the user chooses Cloudinary, **Question 2 continues** with the Secrets form immediately — then proceed to Q3 only after secrets are saved.
+Never insert extra questions between these steps. When the user chooses Supabase, **Question 1 continues** with the `SUPABASE_URL` Secrets input **immediately**. When the user chooses Cloudinary, **Question 2 continues** with the multi-field Cloudinary Secrets dialog **immediately**.
 
 ---
 
@@ -418,21 +430,24 @@ Present **exactly these three options, in this order** (Supabase first / recomme
 
 ### Step B1 — If **1 Supabase (Recommended)**
 
+**Immediately after the user selects Supabase** (same Question 1 — do **not** go to Q2 first, do **not** announce “next question”): open the Secrets / connection-string input.
+
 Collect `SUPABASE_URL` **exactly once** (IRON RULE).
 
 | Allowed (pick **one**) | Forbidden |
 |------------------------|-----------|
-| Open the Replit **Secrets** UI for `SUPABASE_URL` **or** ask the user to paste the string in chat | Asking for the connection string again after Secrets was already filled |
+| **Immediately** open Replit **Secrets** UI for `SUPABASE_URL` after the choice | Waiting until later / Q2 / execution to ask for the URI |
 | Save Secret once, then move on | Opening Secrets **and** also asking them to paste the same URI in chat |
 | Reuse the saved Secret in execution | Asking again in Q2 / Q3 / “confirm your Supabase Secret” / Publish / checklist |
+| | Asking “Do you still want to add SUPABASE_URL?” as a separate step after they already chose Supabase |
 
 If `SUPABASE_URL` is **already** present in Replit Secrets when this branch starts, **do not** ask for it again — confirm you will use the existing Secret and proceed to Question 2 (unless the user explicitly wants to replace it).
 
-**Preferred on Replit:** open an **input / Secrets** UI for:
+**Preferred on Replit (same Question 1 turn after choice):** open an **input / Secrets** UI for:
 
 - `SUPABASE_URL`
 
-**Only if** the Secrets UI is unavailable, ask exactly in chat. **Do not** also open a second Secrets prompt for the same value:
+**Only if** the Secrets UI is unavailable, ask exactly in chat **in the very next message after the choice**. **Do not** also open a second Secrets prompt for the same value:
 
 > Paste your Supabase Postgres connection string below. I will store it as the Replit Secret **`SUPABASE_URL`** (not `DATABASE_URL` — that name is for built-in Replit PostgreSQL).
 >
@@ -520,26 +535,32 @@ tomorrowos.listen({
 >
 > Do you want me to set up **Cloudinary**? (yes / no)
 
-### Step B — If YES / Cloudinary (same Question 2 — no “2b”, no extra question)
+### Step B — If YES / Cloudinary (same Question 2 — immediate multi-field Secrets dialog)
+
+**Do this in the same Question 2 flow, immediately when the user chooses Cloudinary.**
 
-**Do this immediately** when the user chooses Cloudinary. **Do not** say “Question 2b”, “next step”, or “Great — I’ll use Cloudinary” as a separate message before the form. **Go straight to the Secrets input.**
+- ❌ Do **not** say “Question 2b”, “next step”, or “Great — I’ll use Cloudinary” as a separate message before the form  
+- ❌ Do **not** ask for cloud name, then API key, then secret across three turns  
+- ✅ **Go straight to one Secrets / form dialog with multiple inputs stacked**
 
-**Preferred on Replit:** open the **Replit Secrets** UI with fields for:
+**Preferred on Replit:** open the **Replit Secrets** UI **immediately** with **all** of these fields in **one** dialog:
 
 - `CLOUDINARY_CLOUD_NAME`
 - `CLOUDINARY_API_KEY`
 - `CLOUDINARY_API_SECRET`
 - Optional: `CLOUDINARY_FOLDER` (e.g. `tomorrowos`)
 
-**If Secrets UI is unavailable, ask exactly (one message with all fields):**
+**If Secrets UI is unavailable, ask exactly once (one message — all fields listed together; user may paste all in one reply):**
 
-> Paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) → Dashboard → **API Keys**). I will store them as Replit **Secrets**:
+> Paste your Cloudinary credentials (from [cloudinary.com/console](https://cloudinary.com/console) → Dashboard → **API Keys**). I will store them as Replit **Secrets** in one go:
 >
 > 1. **`CLOUDINARY_CLOUD_NAME`**
 > 2. **`CLOUDINARY_API_KEY`**
 > 3. **`CLOUDINARY_API_SECRET`**
 >
 > Optional: **`CLOUDINARY_FOLDER`**
+>
+> You can send all values in a single reply.
 
 **You must then:**
 
@@ -564,36 +585,60 @@ The SDK auto-detects these env vars and uploads media to Cloudinary. New uploads
 
 ---
 
-## Question 3 — Brand / TomorrowOS app look (`brand.json` only; **all fields optional**)
+## Question 3 — Brand / TomorrowOS app look (`brand.json` only; **one multi-field dialog**)
 
-> **Scope:** Question 3 answers **only** update **`brand.json`** — colours, name, tagline, logo path, etc. They configure how the **TomorrowOS player app** looks and metadata flags.
+> **Scope:** Question 3 answers **only** update **`brand.json`**.  
+> **Question 3 does NOT affect:** Replit Publish, artifact `kind`, `.replit`, `server.ts`, Secrets, Supabase, Cloudinary, ports, deployment target, or CMS server wiring.
+>
+> **IRON RULE — one dialog, seven stacked inputs:** Present **all seven** branding fields in a **single** Replit form / multi-input dialog (or one chat message that lists all seven for one reply). The user fills what they want and submits **once**.
 >
-> **Question 3 does NOT affect:** Replit Publish, artifact `kind`, `.replit`, `server.ts`, Secrets, Supabase, Cloudinary, ports, deployment target, or CMS server wiring. **Never** change deploy/runtime config based on branding answers.
+> ❌ **Forbidden:** asking product name → wait → Next → tagline → Next → primary colour → …  
+> ❌ **Forbidden:** splitting branding into multiple questionnaire steps  
+> ✅ **Required:** one stacked form with every field visible together  
 >
-> **Every field below is optional.** The user may skip the whole question, answer only some fields, or say “use defaults”. For anything missing, **keep the existing starter `brand.json` values** (from `templates/cms-starter/brand.json` / project `brand.json` after `init`). **Do not** invent a second branding prompt. **Do not** block setup because name or colours were omitted.
+> **Every field is optional.** Blank / skip / “use defaults” → keep starter `brand.json`. **Do not** re-ask for missing fields.
+
+> **This is the only branding block.** Do not ask separate LLM_PROMPT “target platform”, “use case”, or “hosting” questions. **Do not** ask screen count.
 
-> **This is the only branding / platform / use-case question block.** Do not ask separate LLM_PROMPT “target platform”, “use case”, or “hosting” questions before this. **Do not** ask screen count.
+### Preferred UI (Replit form / multi-input dialog)
 
-**Ask exactly (one message; user may answer in one reply, partially, or skip):**
+Open **one** dialog titled e.g. **Brand your TomorrowOS experience** with these **seven inputs stacked in this order** (labels may match exactly):
 
-> Let’s brand your TomorrowOS experience (**all optional** — reply “skip” or leave blank to keep the starter `brand.json` defaults):
+1. **Product / venue name** (optional — default from `brand.json`, e.g. `My Venue`)
+2. **Tagline** (optional — default e.g. `Digital signage`)
+3. **Primary colour** (optional hex — default e.g. `#FF8A3D`)
+4. **Background colour** (optional — default e.g. `#FAFAF9`)
+5. **Text colour** (optional — default e.g. `#0A0908`)
+6. **Secondary / accent colour** (optional — default e.g. `#F5F3EF`)
+7. **Logo** (optional) — upload SVG/PNG or paste a URL (otherwise keep `./assets/logo.svg`)
+
+Helper text on the dialog: *All fields optional. Leave blank to keep starter brand.json defaults. Submit once.*
+
+### If a form UI is unavailable — one chat message only
+
+Ask **exactly once** (user may answer all fields in a single reply, partially, or “skip”):
+
+> Let’s brand your TomorrowOS experience (**all optional — one reply**). Leave any field blank to keep starter `brand.json` defaults:
+>
+> 1. **Product / venue name**
+> 2. **Tagline**
+> 3. **Primary colour** (hex)
+> 4. **Background colour** (hex)
+> 5. **Text colour** (hex)
+> 6. **Secondary / accent colour** (hex)
+> 7. **Logo** (upload or URL)
 >
-> 1. **Product / venue name** (optional — default from `brand.json`, e.g. `My Venue`)
-> 2. **Tagline** (optional — default e.g. `Digital signage`)
-> 3. **Primary colour** (optional hex — default e.g. `#FF8A3D`)
-> 4. **Background colour** (optional — default e.g. `#FAFAF9`)
-> 5. **Text colour** (optional — default e.g. `#0A0908`)
-> 6. **Secondary / accent colour** (optional — default e.g. `#F5F3EF`)
-> 7. **Logo** (optional) — upload an SVG/PNG, or a URL to fetch into `./assets/` (otherwise keep `./assets/logo.svg`)
+> Reply with whatever you have in one message, or say **skip**.
 
 **Defaults rule (mandatory):**
 
 1. Start from the current project **`brand.json`** (after `init`, this matches the SDK starter).
-2. Overlay **only** fields the user actually provided.
+2. Overlay **only** fields the user actually provided in that single submission.
 3. If the user gives **no** product name → keep existing `"name"`.
 4. If the user gives **no** colours → keep existing `primaryColor` / `backgroundColor` / `textColor` / `secondaryColor`.
 5. If the user says **skip** / **defaults** / **n/a** / sends an empty answer → leave `brand.json` unchanged (except set `cms.hostingTarget` to `"here"` if needed — see below).
 6. **Never** re-ask for missing branding fields. **Never** treat blank name/colour as an error.
+7. **Never** follow up with “What about primary colour?” after they already submitted the branding dialog.
 
 **Then write / update `brand.json` only** at the project root (validate mentally against `brand.schema.json` in the SDK). **Do not** modify `.replit`, `server.ts`, Secrets, or deployment settings from these answers.
 
@@ -753,6 +798,9 @@ Do **not**:
 - Change the production start command away from `tsx server.ts` / `npm run start`
 - Point Supabase at Replit’s reserved `DATABASE_URL` when `SUPABASE_URL` should be used
 - List Q1 databases with **Replit PostgreSQL first** or mark it recommended instead of Supabase
+- Delay `SUPABASE_URL` until after Q1 is “done” or until Q2 — it must follow the Supabase choice **immediately**
+- Collect Cloudinary keys one-at-a-time with Next / separate turns — must be **one multi-field dialog** right after Cloudinary choice
+- Ask Q3 branding fields one-by-one (name → Next → colour → …) — must be **one stacked seven-field dialog**
 - **Ask for `SUPABASE_URL` / the Postgres connection string more than once** (Secrets UI + chat, or again during execution / Publish)
 - Ask the user to type `TOMORROWOS_STORE` or `DATABASE_SSL`
 - Skip Cloudinary recommendation without stating the persistence tradeoff
@@ -810,7 +858,9 @@ TOMORROWOS_STORE=sqlite
 
 ## Protocol version
 
-`replit-setup/1.10` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+`replit-setup/1.11` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+
+**Changelog 1.11:** Q1 Supabase → **immediate** `SUPABASE_URL` Secrets input; Q2 Cloudinary → **immediate multi-field** `CLOUDINARY_*` dialog; Q3 = **one stacked dialog with all seven** branding inputs (no field-by-field Next).
 
 **Changelog 1.10:** Question 1 is a **database choice** with fixed order: **1) Supabase (Recommended) → 2) Built-in Replit PostgreSQL → 3) SQLite**. Supabase still collects `SUPABASE_URL` once only.
 

package/VERCEL_QUESTIONS.md

@@ -1,27 +1,27 @@
-# Vercel / v0 �?Verbatim question bank
+# Vercel / v0 鈥?Verbatim question bank
 
-> **Protocol:** `vercel-questions/1.0` (pairs with `VERCEL_SETUP.md` 1.9+ / `@tomorrowos/sdk` 0.9.42+)  
+> **Protocol:** `vercel-questions/1.0` (pairs with `VERCEL_SETUP.md` 1.9+ / `@tomorrowos/sdk` 0.9.43+)  
 > **For Agents:** When asking the user a setup question, **copy-paste the block below for that step EXACTLY**.  
-> Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no “Blob recommended�? no “disable media�?.  
+> Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no 鈥淏lob recommended鈥? no 鈥渄isable media鈥?.  
 > After each answer, configure per `VERCEL_SETUP.md`, then paste the **next** block.
 
 ---
 
-## Q1 �?Database (paste this entire block)
+## Q1 鈥?Database (paste this entire block)
 
 Which database should TomorrowOS use on Vercel?
 
-**1. Supabase Postgres (recommended)** �?durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
+**1. Supabase Postgres (recommended)** 鈥?durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
 
-**2. Neon Postgres** �?serverless Postgres native to Vercel; use Neon’s **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
+**2. Neon Postgres** 鈥?serverless Postgres native to Vercel; use Neon鈥檚 **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
 
-**3. SQLite (`data/tomorrowos.db`)** �?**demo / local only on Vercel.** The filesystem is ephemeral; pairings and playlists will not survive redeploys. Only choose this if you understand the limitation.
+**3. SQLite (`data/tomorrowos.db`)** 鈥?**demo / local only on Vercel.** The filesystem is ephemeral; pairings and playlists will not survive redeploys. Only choose this if you understand the limitation.
 
-Reply with **1**, **2**, or **3** (or “Supabase�?/ “Neon�?/ “SQLite�?.
+Reply with **1**, **2**, or **3** (or 鈥淪upabase鈥?/ 鈥淣eon鈥?/ 鈥淪QLite鈥?.
 
 ---
 
-## After Q1 �?agent only (do not ask the user)
+## After Q1 鈥?agent only (do not ask the user)
 
 | Choice | You set silently | User only provides |
 |--------|------------------|--------------------|
@@ -33,38 +33,38 @@ Never show blank Env fields for `TOMORROWOS_STORE` or `DATABASE_SSL`.
 
 ---
 
-## Q2 �?Media (paste this entire block)
+## Q2 鈥?Media (paste this entire block)
 
 How should playlist media (images/videos) be stored?
 
-**1. Cloudinary (recommended)** �?durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
+**1. Cloudinary (recommended)** 鈥?durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
 
-**2. Vercel Blob** �?Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
+**2. Vercel Blob** 鈥?Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
 
-**3. Local disk only** �?`cms-panel/uploads` or `public/uploads` (OK for quick local tests; **not** for production Vercel fleets �?files are ephemeral).
+**3. Local disk only** 鈥?`cms-panel/uploads` or `public/uploads` (OK for quick local tests; **not** for production Vercel fleets 鈥?files are ephemeral).
 
-Reply with **1**, **2**, or **3** (or “Cloudinary�?/ “Vercel Blob�?/ “local�?.
+Reply with **1**, **2**, or **3** (or 鈥淐loudinary鈥?/ 鈥淰ercel Blob鈥?/ 鈥渓ocal鈥?.
 
-**Forbidden replacements (never ask these):** Vercel Blob as recommended #1; Supabase Storage; S3 / R2 / B2 / `MEDIA_S3_*`; “no media storage�?/ disable uploads.
+**Forbidden replacements (never ask these):** Vercel Blob as recommended #1; Supabase Storage; S3 / R2 / B2 / `MEDIA_S3_*`; 鈥渘o media storage鈥?/ disable uploads.
 
 ---
 
-## Q3 �?Brand (paste this entire block)
+## Q3 鈥?Brand (paste this entire block)
 
-Let’s brand your TomorrowOS experience. Choose **one**:
+Let鈥檚 brand your TomorrowOS experience. Choose **one**:
 
-**Option A �?Website URL (recommended if you have a site)**  
+**Option A 鈥?Website URL (recommended if you have a site)**  
 Paste **one public website URL**. I will use it **only** to fill **`brand.json`**: product name, tagline, primary / secondary / **background** / text colours, fonts, and logo.  
-I will **not** rebuild that website or add login �?unless you explicitly ask for login/auth later.
+I will **not** rebuild that website or add login 鈥?unless you explicitly ask for login/auth later.
 
-**Option B �?Manual brand fields**  
+**Option B 鈥?Manual brand fields**  
 Send as many of these as you can (name + at least one colour + logo is ideal):
 1. **Product / venue name** (required)
 2. **Tagline** (optional)
 3. **Primary colour** (hex, e.g. `#FF8A3D`)
-4. **Background colour** (hex �?page / panel background)
-5. **Text colour** (hex, optional �?default `#0A0908`)
+4. **Background colour** (hex 鈥?page / panel background)
+5. **Text colour** (hex, optional 鈥?default `#0A0908`)
 6. **Secondary / accent colour** (hex, optional)
-7. **Logo** �?upload SVG/PNG into the project, or a public image URL I can fetch into `./assets/`
+7. **Logo** 鈥?upload SVG/PNG into the project, or a public image URL I can fetch into `./assets/`
 
 Reply with a URL **or** the manual fields. Do not send only a name with no colours/logo unless you want defaults (I will confirm defaults before writing).

package/VERCEL_SETUP.md

@@ -5,7 +5,7 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`, not `LLM_PROMPT.md`).
 >
-> Protocol id: `vercel-setup/1.9` ? pairs with `@tomorrowos/sdk` **0.9.42+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
+> Protocol id: `vercel-setup/1.9` ? pairs with `@tomorrowos/sdk` **0.9.43+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
 >
 > **Questions source of truth:** `VERCEL_QUESTIONS.md` ? Agents must **open that file and paste each Q block verbatim**. Do not paraphrase.  
 > **Copy questions verbatim from `VERCEL_QUESTIONS.md`.** Do not invent alternate Q2 options (no ?Supabase Storage?? no S3, no ?disable media?? no making Blob the recommended option).  

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.42",
+  "version": "0.9.43",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.42",
+  "version": "0.9.43",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.42",
+    "@tomorrowos/sdk": "^0.9.43",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter-v0/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.42",
+  "version": "0.9.43",
   "description": "TomorrowOS CMS for Vercel / v0 Publish (Fluid Function + WebSockets + optional Next Preview).",
   "private": true,
   "type": "module",
@@ -17,7 +17,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.42",
+    "@tomorrowos/sdk": "^0.9.43",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },