@tomorrowos/sdk 0.9.54 → 0.9.56

package/REPLIT_SETUP.md

@@ -11,9 +11,9 @@ When a human pastes a prompt like this, **read this file and start Question 1 im
 
 ```text
 Follow @tomorrowos/sdk REPLIT_SETUP.md and set up my TomorrowOS CMS.
-Ask only the questions listed in REPLIT_SETUP.md, in order. Do not use LLM_PROMPT.md.
+Ask only the questions listed in REPLIT_SETUP.md, in order. Do not invent a separate questionnaire.
 Artifact kind must be **web** (never **api**).
-Question 1 database options in this order: 1) Supabase (Recommended) 2) Built-in Replit PostgreSQL 3) SQLite.
+Question 1 database options in this order: 1) Supabase (Recommended) 2) Built-in Replit PostgreSQL.
 If Supabase: show the SUPABASE_URL Secrets input immediately after the choice (same Question 1 — once only).
 If Cloudinary: show all CLOUDINARY_* Secrets inputs immediately after the choice (same Question 2 — one multi-field dialog).
 Question 3: one multi-field dialog with all seven branding inputs stacked (all optional; blanks keep brand.json defaults). Never ask branding fields one-by-one with Next.
@@ -26,7 +26,7 @@ Alternate triggers that also activate this protocol:
 - “Set up TomorrowOS on Replit using REPLIT_SETUP.md”
 - “Configure my TomorrowOS CMS (Replit wizard)”
 
-When any of these triggers fire, **ignore `LLM_PROMPT.md` entirely** for the Q&A phase.
+When any of these triggers fire, stay on this file for the Q&A phase.
 
 **Before Question 1:** ensure the Replit workspace primary artifact **`kind` is `web`** (see **IRON RULE: `web` kind only**). If the project is `api` / API-only or not publishable, **fix artifact kind first** — do not continue the questionnaire on a broken project type.
 
@@ -62,7 +62,7 @@ Replit Agent must ask **only** the questions defined in **this file**, in **this
 
 | Step | Section | When |
 |------|---------|------|
-| 1 | **Question 1** — Database choice (Supabase → Replit Postgres → SQLite) | Always |
+| 1 | **Question 1** — Database choice (Supabase → Replit Postgres) | Always |
 | 2 | **Question 2** — Media storage (+ Cloudinary Secrets if chosen) | Always (after Q1) |
 | 3 | **Question 3** — Brand / TomorrowOS app look (**all fields optional**) | Always last, before execution |
 
@@ -79,11 +79,10 @@ Replit Agent must ask **only** the questions defined in **this file**, in **this
 **Critical — Question 1 option order (exact):** Present database choices in **this order only**:
 1. **Supabase Postgres (Recommended)**
 2. **Built-in Replit PostgreSQL**
-3. **SQLite (local file — fine for testing)**
 
 **Critical — Supabase path collected once only:** If the user picks Supabase, collect `SUPABASE_URL` **immediately after the choice**, in **one** step (Secrets UI **or** a single chat paste — not both). After it is saved, **never** ask for the connection string / `SUPABASE_URL` again.
 
-**Critical:** Question 2 is **not complete** when the user says “Cloudinary” or “yes”. You **must immediately** open the **multi-field** Cloudinary Secrets dialog (same Question 2 — **not** “2b”, **not** one key per message) and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3.
+**Critical:** Question 2 is **not complete** when the user says “Cloudinary” or **1**. You **must immediately** open the **multi-field** Cloudinary Secrets dialog (same Question 2 — **not** “2b”, **not** one key per message) and collect `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, and `CLOUDINARY_API_SECRET` **before** Question 3.
 
 **Critical — Question 3:** All seven branding fields are **optional** and must appear in **one stacked multi-input dialog**. Empty / skip / “use defaults” → keep starter **`brand.json`**. **Never** ask name, then colours, then logo across separate turns.
 
@@ -91,15 +90,15 @@ If the user volunteers extra info early (e.g. brand name before Q3), **record it
 
 If the user says “just set it up, don’t ask questions,” respond:
 
-> I need a few quick answers from REPLIT_SETUP.md (database choice — Supabase recommended, then Replit Postgres, then SQLite — media storage — plus Cloudinary credentials if you choose Cloudinary — and optional branding). It takes about a minute and ensures the CMS deploys correctly on Replit.
+> I need a few quick answers from REPLIT_SETUP.md (database choice — Supabase recommended, then Replit Postgres — media storage — plus Cloudinary credentials if you choose Cloudinary — and optional branding). It takes about a minute and ensures the CMS deploys correctly on Replit.
 
-Then ask **Question 1** — do not switch to `LLM_PROMPT.md`.
+Then ask **Question 1** — stay on this file.
 
 ---
 
 ## Hard rules
 
-1. **Ask only REPLIT_SETUP.md questions 1–3** (see **Questionnaire scope**). Never use `LLM_PROMPT.md` on Replit.
+1. **Ask only REPLIT_SETUP.md questions 1–3** (see **Questionnaire scope**). Do not invent alternate setup questionnaires on Replit.
 2. **One questionnaire step at a time (Q1 → Q2 → Q3).** Wait for that step to finish before opening the next. **Inside** a step, use **one multi-field dialog** when collecting Secrets or branding — **never** field-by-field “Next” wizards.
 2a. **Q1 Supabase:** choice → **immediately** `SUPABASE_URL` input (same Question 1).
 2b. **Q2 Cloudinary:** choice → **immediately** multi-field `CLOUDINARY_*` Secrets dialog (same Question 2).
@@ -404,20 +403,20 @@ Then (and only then) check: API vs Web type → `.replit` ports/`deploymentTarge
 
 ### Step A — Ask exactly (option order is mandatory)
 
-Present **exactly these three options, in this order** (Supabase first / recommended):
+Present **exactly these two options, in this order** (Supabase first / recommended):
 
 > **Database choice**
 >
 > 1. **Supabase Postgres (Recommended)** — I have a connection string  
-> 2. **Built-in Replit PostgreSQL** — no external account needed  
-> 3. **SQLite** (local file — fine for testing)
+> 2. **Built-in Replit PostgreSQL** — no external account needed
 >
-> Which do you want?
+> Which do you want? Reply **1** or **2**.
 
 **Forbidden option orders / labels:**
 
 - ❌ Putting Built-in Replit PostgreSQL first or marking it “recommended”
-- ❌ Omitting Supabase or SQLite
+- ❌ Omitting Supabase
+- ❌ Inventing SQLite or other database options not listed above
 - ❌ Asking only for a connection string without showing this choice first (unless `SUPABASE_URL` is already saved and the user is continuing a prior Supabase setup)
 
 **Agent auto-sets after the choice** (never ask the user to type these):
@@ -426,7 +425,6 @@ Present **exactly these three options, in this order** (Supabase first / recomme
 |--------|------------|---------------|
 | 1 Supabase | `TOMORROWOS_STORE=supabase`, `DATABASE_SSL=true` | `SUPABASE_URL` (**once**) |
 | 2 Replit PostgreSQL | `TOMORROWOS_STORE=postgres`, `DATABASE_SSL=true` | Use Replit’s built-in **`DATABASE_URL`** (do not ask them to invent a URI) |
-| 3 SQLite | `TOMORROWOS_STORE=sqlite` | Confirmation only |
 
 ### Step B1 — If **1 Supabase (Recommended)**
 
@@ -480,14 +478,6 @@ If `SUPABASE_URL` is **already** present in Replit Secrets when this branch star
 7. **Do not** test the DB connection in Preview — configuration only.
 8. Proceed to Question 2.
 
-### Step B3 — If **3 SQLite**
-
-1. Set `TOMORROWOS_STORE=sqlite` yourself.
-2. Ensure `data/tomorrowos.db` path via starter / `createTomorrowOSStore({ sqlitePath: join(__dirname, "data", "tomorrowos.db") })`.
-3. Warn briefly: SQLite is fine for testing; pairings may not survive some rebuilds as well as Postgres.
-4. **Do not** ask for any connection string.
-5. Proceed to Question 2.
-
 ### Shared `server.ts` shape (all Q1 paths)
 
 ```ts
@@ -501,7 +491,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const brand = JSON.parse(readFileSync(join(__dirname, "brand.json"), "utf8"));
 
 const store = createTomorrowOSStore({
-  // Supabase: SUPABASE_URL. Replit Postgres: DATABASE_URL. SQLite: ignores URL.
+  // Supabase: SUPABASE_URL. Replit Postgres: DATABASE_URL. Unused when TOMORROWOS_STORE is postgres/supabase.
   databaseUrl: process.env.SUPABASE_URL || process.env.DATABASE_URL,
   sqlitePath: join(__dirname, "data", "tomorrowos.db")
 });
@@ -527,15 +517,13 @@ tomorrowos.listen({
 
 > How should playlist media (images/videos) be stored?
 >
-> **Recommended: Cloudinary** — public HTTPS URLs, survives Replit restarts/redeploys, avoids Object Storage permission issues.
+> **1. Cloudinary (Recommended)** — public HTTPS URLs, survives Replit restarts/redeploys, avoids Object Storage permission issues.
 >
-> Alternatives:
-> - **Replit Object Storage** — keep files under `public/uploads` backed by Object Storage (no Cloudinary account).
-> - **Local disk only** — `public/uploads` on the Repl filesystem (fine for quick tests; files may disappear on rebuild if not persistent).
+> **2. Replit Object Storage** — keep files under `public/uploads` backed by Object Storage (no Cloudinary account).
 >
-> Do you want me to set up **Cloudinary**? (yes / no)
+> Reply **1** for Cloudinary or **2** for Replit Object Storage.
 
-### Step B — If YES / Cloudinary (same Question 2 — immediate multi-field Secrets dialog)
+### Step B — If **1 / Cloudinary** (same Question 2 — immediate multi-field Secrets dialog)
 
 **Do this in the same Question 2 flow, immediately when the user chooses Cloudinary.**
 
@@ -574,7 +562,7 @@ tomorrowos.listen({
 
 The SDK auto-detects these env vars and uploads media to Cloudinary. New uploads will return `https://res.cloudinary.com/...` URLs.
 
-### If NO — Replit Object Storage (or local)
+### If **2 / Replit Object Storage**
 
 **Do this:**
 
@@ -598,7 +586,7 @@ The SDK auto-detects these env vars and uploads media to Cloudinary. New uploads
 >
 > **Every field is optional.** Blank / skip / “use defaults” → keep starter `brand.json`. **Do not** re-ask for missing fields.
 
-> **This is the only branding block.** Do not ask separate LLM_PROMPT “target platform”, “use case”, or “hosting” questions. **Do not** ask screen count.
+> **This is the only branding block.** Do not ask separate “target platform”, “use case”, or “hosting” questions outside this branding block. **Do not** ask screen count.
 
 ### Preferred UI (Replit form / multi-input dialog)
 
@@ -715,12 +703,6 @@ DATABASE_SSL=true
 
 Use Replit’s **`DATABASE_URL`**. **Do not** ask for `SUPABASE_URL`.
 
-**If Q1 = SQLite:**
-
-```env
-TOMORROWOS_STORE=sqlite
-```
-
 **Cloudinary (if chosen):**
 
 ```env
@@ -782,7 +764,6 @@ Only investigate further if Preview is empty, server crashed, or user reports Pu
 
 ### Forbidden questionnaire sources
 
-- **`LLM_PROMPT.md`** — not used on Replit setup; its questions are **replaced** by REPLIT_SETUP Questions 1–3
 - Standalone “target platform” / “hosting target” / “use case” / **screen count** prompts outside Question 3
 
 Do **not** ask the user how to implement:
@@ -806,7 +787,7 @@ Do **not**:
 - Skip Cloudinary recommendation without stating the persistence tradeoff
 - **Skip Cloudinary Secrets** after the user chooses Cloudinary — always collect `CLOUDINARY_*` inside Question 2 before Question 3
 - **Announce “Question 2b”** or a separate follow-up question — show the Secrets form immediately instead
-- Claim uploads are “permanent” on Replit local disk without Object Storage or Cloudinary
+- Claim uploads are durable without configuring Cloudinary or Replit Object Storage — do not invent a local-disk-only media option
 - Leave `tsx` only in `devDependencies` if the Deploy pipeline installs production deps only
 - Use Canvas preview as the primary CMS verification surface
 - Serve a different app or API-only response at `/` instead of the Control Panel
@@ -822,22 +803,6 @@ Do **not**:
 
 ---
 
-## SQLite path — `server.ts` reference (Q1 option 3)
-
-```ts
-const store = createTomorrowOSStore({
-  sqlitePath: join(__dirname, "data", "tomorrowos.db")
-});
-```
-
-With Secrets / `.env`:
-
-```env
-TOMORROWOS_STORE=sqlite
-```
-
----
-
 ## Failure recovery cheat sheet
 
 | Symptom | Likely cause | Fix |
@@ -858,7 +823,9 @@ TOMORROWOS_STORE=sqlite
 
 ## Protocol version
 
-`replit-setup/1.11` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+`replit-setup/1.12` — aligned with TomorrowOS protocol `1.0` and `@tomorrowos/sdk` store drivers `sqlite` | `supabase` | `postgres` | `memory`.
+
+**Changelog 1.12:** Q1 no longer offers SQLite (Supabase or Replit Postgres only). Q2 no longer offers local disk (Cloudinary or Replit Object Storage only).
 
 **Changelog 1.11:** Q1 Supabase → **immediate** `SUPABASE_URL` Secrets input; Q2 Cloudinary → **immediate multi-field** `CLOUDINARY_*` dialog; Q3 = **one stacked dialog with all seven** branding inputs (no field-by-field Next).
 

package/REPLIT_UPGRADE.md

@@ -2,7 +2,7 @@
 
 > **This file is a contract for Replit Agent / Replit AI.**  
 > Follow it literally. This protocol **upgrades an existing CMS** to the latest `@tomorrowos/sdk`.  
-> It is **not** a greenfield setup. Do **not** use `REPLIT_SETUP.md` or `LLM_PROMPT.md` for this flow unless the user explicitly asks for a full re-setup.
+> It is **not** a greenfield setup. Do **not** use `REPLIT_SETUP.md` for this flow unless the user explicitly asks for a full re-setup.
 
 ---
 
@@ -24,7 +24,7 @@ Alternate triggers that also activate this protocol:
 
 When any of these triggers fire:
 
-1. **Ignore `LLM_PROMPT.md` and `REPLIT_SETUP.md` questionnaires** — this is an upgrade, not setup Q&A.
+1. **Ignore `REPLIT_SETUP.md` questionnaires** — this is an upgrade, not setup Q&A.
 2. **Do not** reinvent pairing, WebSocket, or playlist servers.
 3. Preserve project data and custom UI/server wiring.
 

package/VERCEL_QUESTIONS.md

@@ -1,70 +1,65 @@
-# Vercel / v0 閳?Verbatim question bank
+# Vercel / v0 ? Verbatim question bank
 
-> **Protocol:** `vercel-questions/1.0` (pairs with `VERCEL_SETUP.md` 1.9+ / `@tomorrowos/sdk` 0.9.54+)  
+> **Protocol:** `vercel-questions/1.1` (pairs with `VERCEL_SETUP.md` 1.10+ / `@tomorrowos/sdk` 0.9.56+)  
 > **For Agents:** When asking the user a setup question, **copy-paste the block below for that step EXACTLY**.  
-> Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no 閳ユ窂lob recommended閳? no 閳ユ竸isable media閳?.  
+> Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no "Blob recommended", no "disable media").  
 > After each answer, configure per `VERCEL_SETUP.md`, then paste the **next** block.
 
 ---
 
-## Q1 閳?Database (paste this entire block)
+## Q1 ? Database (paste this entire block)
 
 Which database should TomorrowOS use on Vercel?
 
-**1. Supabase Postgres (recommended)** 閳?durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
+**1. Supabase Postgres (recommended)** ? durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
 
-**2. Neon Postgres** 閳?serverless Postgres native to Vercel; use Neon閳ユ獨 **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
+**2. Neon Postgres** ? serverless Postgres native to Vercel; use Neon's **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
 
-**3. SQLite (`data/tomorrowos.db`)** 閳?**demo / local only on Vercel.** The filesystem is ephemeral; pairings and playlists will not survive redeploys. Only choose this if you understand the limitation.
-
-Reply with **1**, **2**, or **3** (or 閳ユ藩upabase閳?/ 閳ユ罚eon閳?/ 閳ユ藩QLite閳?.
+Reply with **1** or **2** (or "Supabase" / "Neon").
 
 ---
 
-## After Q1 閳?agent only (do not ask the user)
+## After Q1 ? agent only (do not ask the user)
 
 | Choice | You set silently | User only provides |
 |--------|------------------|--------------------|
 | 1 Supabase | `TOMORROWOS_STORE=supabase`, `DATABASE_SSL=true` | `SUPABASE_URL` (pooler) |
 | 2 Neon | `TOMORROWOS_STORE=postgres`, `DATABASE_SSL=true` | `DATABASE_URL` (pooled) |
-| 3 SQLite | `TOMORROWOS_STORE=sqlite` | confirmation |
 
 Never show blank Env fields for `TOMORROWOS_STORE` or `DATABASE_SSL`.
 
 ---
 
-## Q2 閳?Media (paste this entire block)
+## Q2 ? Media (paste this entire block)
 
 How should playlist media (images/videos) be stored?
 
-**1. Cloudinary (recommended)** 閳?durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
-
-**2. Vercel Blob** 閳?Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
+**1. Cloudinary (recommended)** ? durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
 
-**3. Local disk only** 閳?`cms-panel/uploads` or `public/uploads` (OK for quick local tests; **not** for production Vercel fleets 閳?files are ephemeral).
+**2. Vercel Blob** ? Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
 
-Reply with **1**, **2**, or **3** (or 閳ユ窅loudinary閳?/ 閳ユ钒ercel Blob閳?/ 閳ユ笓ocal閳?.
+Reply with **1** or **2** (or "Cloudinary" / "Vercel Blob").
 
-**Forbidden replacements (never ask these):** Vercel Blob as recommended #1; Supabase Storage; S3 / R2 / B2 / `MEDIA_S3_*`; 閳ユ笜o media storage閳?/ disable uploads.
+**Forbidden replacements (never ask these):** Vercel Blob as recommended #1; Supabase Storage; S3 / R2 / B2 / `MEDIA_S3_*`; "no media storage" / disable uploads; local disk only.
 
 ---
 
-## Q3 閳?Brand (paste this entire block)
+## Q3 ? Brand (paste this entire block)
 
-Let閳ユ獨 brand your TomorrowOS experience. Choose **one**:
+Let's brand your TomorrowOS experience. Choose **one**:
 
-**Option A 閳?Website URL (recommended if you have a site)**  
+**Option A ? Website URL (recommended if you have a site)**  
 Paste **one public website URL**. I will use it **only** to fill **`brand.json`**: product name, tagline, primary / secondary / **background** / text colours, fonts, and logo.  
-I will **not** rebuild that website or add login 閳?unless you explicitly ask for login/auth later.
+I will **not** rebuild that website or add login ? unless you explicitly ask for login/auth later.
 
-**Option B 閳?Manual brand fields**  
+**Option B ? Manual brand fields**  
 Send as many of these as you can (name + at least one colour + logo is ideal):
 1. **Product / venue name** (required)
 2. **Tagline** (optional)
 3. **Primary colour** (hex, e.g. `#FF8A3D`)
-4. **Background colour** (hex 閳?page / panel background)
-5. **Text colour** (hex, optional 閳?default `#0A0908`)
+4. **Background colour** (hex ? page / panel background)
+5. **Text colour** (hex, optional ? default `#0A0908`)
 6. **Secondary / accent colour** (hex, optional)
-7. **Logo** 閳?upload SVG/PNG into the project, or a public image URL I can fetch into `./assets/`
+7. **Logo** ? upload SVG/PNG into the project, or a public image URL I can fetch into `./assets/`
 
 Reply with a URL **or** the manual fields. Do not send only a name with no colours/logo unless you want defaults (I will confirm defaults before writing).

package/VERCEL_SETUP.md

@@ -3,9 +3,9 @@
 > **This file is a contract for Vercel Agent / AI coding assistants setting up TomorrowOS on Vercel.**  
 > Follow it literally. Ask questions in order. Do not invent secrets. Prefer configuring **Vercel Environment Variables**, `.env` (non-secrets only), `brand.json`, and `server.ts` store wiring over inventing a custom CMS.
 >
-> **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`, not `LLM_PROMPT.md`).
+> **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`).
 >
-> Protocol id: `vercel-setup/1.9` — pairs with `@tomorrowos/sdk` **0.9.54+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
+> Protocol id: `vercel-setup/1.9` ? pairs with `@tomorrowos/sdk` **0.9.56+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
 >
 > **Questions source of truth:** `VERCEL_QUESTIONS.md` ? Agents must **open that file and paste each Q block verbatim**. Do not paraphrase.  
 > **Copy questions verbatim from `VERCEL_QUESTIONS.md`.** Do not invent alternate Q2 options (no ?Supabase Storage?? no S3, no ?disable media?? no making Blob the recommended option).  
@@ -33,20 +33,30 @@ These rules override any platform-generated recommendation that conflicts with t
 When a human pastes a prompt like this, **read this file and start Question 1 immediately**:
 
 ```text
-Follow @tomorrowos/sdk VERCEL_SETUP.md and set up my TomorrowOS CMS.
-First open VERCEL_QUESTIONS.md. For Q1, Q2, Q3: paste each question block VERBATIM (character-for-character). Do not rephrase options.
-Q2 must show Cloudinary (recommended) as option 1 ??never Blob-as-recommended, never S3, never Supabase Storage.
-After database choice, YOU set TOMORROWOS_STORE and DATABASE_SSL ??do not ask me to fill those.
-Do not use LLM_PROMPT.md or REPLIT_SETUP.md. No OpenAI/LLM API keys.
-Apply the NON-NEGOTIABLE VERCEL RUNTIME CONTRACT exactly: one TomorrowOS instance; no public/ Output Directory; Preview Next only under preview/; Publish through the Fluid Function; verify /status JSON, / Control Panel, and WebSocket 101; pair devices only with the Production URL.
+Follow @tomorrowos/sdk (an NPM package) VERCEL_SETUP.md and set up my TomorrowOS CMS from scratch.
+
+Open VERCEL_QUESTIONS.md first.
+For Q1, Q2, Q3: paste each question block VERBATIM. Do not rephrase options.
+After Q1 database choice, YOU set TOMORROWOS_STORE and DATABASE_SSL. Do not ask me to fill those.
+After Q2 media storage choice, YOU set TOMORROWOS_MEDIA. Do not ask me to fill those.
+Run: npx @tomorrowos/sdk@0.9.56 init . --hosting v0 --force
+Keep cms-starter-v0 layout.
+Apply the NON-NEGOTIABLE VERCEL RUNTIME CONTRACT exactly:
+one TomorrowOS instance only
+never create a second TomorrowOS in api/ws.ts
+never use public/ as Vercel Output Directory
+Preview Next only under preview/
+Publish must be the Fluid Function
+after deploy verify: GET /status ? JSON, GET / ? Control Panel, WebSocket on / or /api ? 101
+pair devices against the Production URL only
 ```
 
 Alternate triggers:
 
-- ?Set up TomorrowOS on Vercel using VERCEL_SETUP.md??
-- ?Configure my TomorrowOS CMS (Vercel wizard)??
+- ?Set up TomorrowOS on Vercel using VERCEL_SETUP.md?
+- ?Configure my TomorrowOS CMS (Vercel wizard)?
 
-When any of these fire, **ignore `REPLIT_SETUP.md` and `LLM_PROMPT.md`** for the Q&A phase (you may skim Replit docs only for shared SDK semantics).
+When any of these fire, **ignore `REPLIT_SETUP.md`** for the Q&A phase (you may skim Replit docs only for shared SDK semantics).
 
 ---
 
@@ -149,8 +159,8 @@ Ask **only** these questions, in **this exact order**. **Copy the ?Ask exactly??
 
 | Step | Section | When |
 |------|---------|------|
-| 1 | **Question 1** ??Database (Supabase ??Neon ??SQLite) | Always |
-| 2 | **Question 2** ??Media (**Cloudinary recommended** ??Vercel Blob ??local) | Always (after Q1) |
+| 1 | **Question 1** ? Database (Supabase ? Neon) | Always |
+| 2 | **Question 2** ? Media (**Cloudinary recommended** ? Vercel Blob) | Always (after Q1) |
 | 3 | **Question 3** ??Brand / TomorrowOS look (`brand.json` only) | Always last |
 
 **That is the complete list.** Do **not** ask how many screens / devices.
@@ -177,7 +187,7 @@ Ask **only** these questions, in **this exact order**. **Copy the ?Ask exactly??
 
 TomorrowOS pairing and Control Panel logic live in `@tomorrowos/sdk`. They do **not** call OpenAI.
 
-If the user **skips** a Question 2 option, do **not** invent a substitute question. Re-state Question 2 choices **verbatim**, or proceed with local uploads + warning ??never pivot to LLM keys or Supabase Storage.
+If the user **skips** a Question 2 option, do **not** invent a substitute question. Re-state Question 2 choices **verbatim** ? never pivot to LLM keys, Supabase Storage, or local disk uploads.
 
 If the user says ?just set it up, don?t ask questions,??respond:
 
@@ -189,10 +199,10 @@ Then ask **Question 1**.
 
 ## Hard rules
 
-1. **Open `VERCEL_QUESTIONS.md` first.** Paste Q1 ??configure ??paste Q2 ??configure ??paste Q3. Never paraphrase question options. Never use `LLM_PROMPT.md` or `REPLIT_SETUP.md` as the questionnaire. **Never** ask for OpenAI or other LLM API keys.
-2. **Question 2 options are fixed:** (1) Cloudinary **(recommended)**, (2) Vercel Blob, (3) local disk. Do not reorder; do not invent Supabase Storage / disable-uploads.
+1. **Open `VERCEL_QUESTIONS.md` first.** Paste Q1 ??configure ??paste Q2 ??configure ??paste Q3. Never paraphrase question options. Never use `REPLIT_SETUP.md` as the questionnaire. **Never** ask for OpenAI or other LLM API keys.
+2. **Question 2 options are fixed:** (1) Cloudinary **(recommended)**, (2) Vercel Blob. Do not reorder; do not invent Supabase Storage, local disk, or disable-uploads.
 3. **Cloudinary:** open **one** Vercel Env popup with **all** Cloudinary fields together. Do **not** quiz one credential at a time.
-4. **`TOMORROWOS_STORE` + `DATABASE_SSL` = agent-owned.** After Q1 choice (and URL if needed), set them yourself in Vercel Env Vars. **Never** include them as blank fields for the customer. Mapping: Supabase ??`TOMORROWOS_STORE=supabase` + `DATABASE_SSL=true`; Neon ??`TOMORROWOS_STORE=postgres` + `DATABASE_SSL=true`; SQLite ??`TOMORROWOS_STORE=sqlite` (no `DATABASE_SSL` required).
+4. **`TOMORROWOS_STORE` + `DATABASE_SSL` = agent-owned.** After Q1 choice (and URL if needed), set them yourself in Vercel Env Vars. **Never** include them as blank fields for the customer. Mapping: Supabase ? `TOMORROWOS_STORE=supabase` + `DATABASE_SSL=true`; Neon ? `TOMORROWOS_STORE=postgres` + `DATABASE_SSL=true`. **Do not offer SQLite as a questionnaire choice** ? it is ephemeral on Vercel and unsuitable for production.
 5. **Do not invent** Cloudinary credentials, database URLs, Vercel Blob tokens, brand colours, **or LLM API keys**.
 6. **Postgres env naming:** prefer **`SUPABASE_URL`** for Supabase; prefer **`DATABASE_URL`** for Neon.
 7. **Always prefer pooled connection strings** (Supabase Session pooler **6543**; Neon pooled host).
@@ -582,10 +592,11 @@ If Vercel?s UI and this file disagree on bundling, **prefer whatever keeps a sin
 
 ---
 
-## Question 1 ??Database (always)
+## Question 1 ? Database (always)
 
-> **Do not** ask screen counts. Present all three options; recommend **Supabase** for Vercel fleets.  
-> **After the user picks a database:** collect the URL if needed, then **you** set `TOMORROWOS_STORE` + `DATABASE_SSL` (see mapping below). The customer must **never** be asked to type those two names or values.
+> **Do not** ask screen counts. Present both options; recommend **Supabase** for Vercel fleets.  
+> **After the user picks a database:** collect the URL if needed, then **you** set `TOMORROWOS_STORE` + `DATABASE_SSL` (see mapping below). The customer must **never** be asked to type those two names or values.  
+> **Forbidden:** offering SQLite as a user-facing Q1 choice (ephemeral filesystem on Vercel).
 
 ### Agent-owned env mapping (mandatory)
 
@@ -593,23 +604,20 @@ If Vercel?s UI and this file disagree on bundling, **prefer whatever keeps a sin
 |------------|--------------------|--------------------|
 | 1 Supabase | `TOMORROWOS_STORE=supabase`, `DATABASE_SSL=true` | `SUPABASE_URL` (pooler string) |
 | 2 Neon | `TOMORROWOS_STORE=postgres`, `DATABASE_SSL=true` | `DATABASE_URL` (pooled string) |
-| 3 SQLite | `TOMORROWOS_STORE=sqlite` | Confirmation only |
 
-If you open an Env configuration UI for Q1, fields visible to the user may include **only** `SUPABASE_URL` or `DATABASE_URL`. **Do not** show blank `TOMORROWOS_STORE` / `DATABASE_SSL` inputs ??write those yourself in the same step.
+If you open an Env configuration UI for Q1, fields visible to the user may include **only** `SUPABASE_URL` or `DATABASE_URL`. **Do not** show blank `TOMORROWOS_STORE` / `DATABASE_SSL` inputs ? write those yourself in the same step.
 
-### Step A ??Ask storage choice
+### Step A ? Ask storage choice
 
 **Ask exactly:**
 
 > Which database should TomorrowOS use on Vercel?
 >
-> **1. Supabase Postgres (recommended)** ??durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
+> **1. Supabase Postgres (recommended)** ? durable pairing/playlists; use the **Session pooler** URL (`*.pooler.supabase.com:6543`).
 >
-> **2. Neon Postgres** ??serverless Postgres native to Vercel; use Neon?s **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
+> **2. Neon Postgres** ? serverless Postgres native to Vercel; use Neon's **pooled** connection string from the Neon dashboard (not the direct un-pooled host for serverless).
 >
-> **3. SQLite (`data/tomorrowos.db`)** ??**demo / local only on Vercel.** The filesystem is ephemeral; pairings and playlists will not survive redeploys. Only choose this if you understand the limitation.
->
-> Reply with **1**, **2**, or **3** (or ?Supabase??/ ?Neon??/ ?SQLite??.
+> Reply with **1** or **2** (or "Supabase" / "Neon").
 
 ### Step B ??If **1 / Supabase**
 
@@ -653,21 +661,7 @@ If you open an Env configuration UI for Q1, fields visible to the user may inclu
 2. Wire `createTomorrowOSStore` for Postgres.
 3. **Do not** commit the real connection string.
 4. **Do not** ask the user to fill `TOMORROWOS_STORE` or `DATABASE_SSL` in chat or Env UI.
-5. If you see `ENETUNREACH` on `:5432`, switch to Neon?s **pooled** URL.
-
-### Step D ??If **3 / SQLite**
-
-**Warn exactly before continuing:**
-
-> SQLite on Vercel is **not** suitable for production fleets ??data in `data/tomorrowos.db` is lost when the instance is recycled or redeployed. Continue only for a quick demo.
-
-Only proceed after the user explicitly confirms.
-
-**You must then (automatic):**
-
-1. Set `TOMORROWOS_STORE=sqlite` yourself (do not ask the user to type it).
-2. Keep `sqlitePath` for `data/tomorrowos.db`.
-3. Warn again in the final summary that they should move to Supabase or Neon for real devices.
+5. If you see `ENETUNREACH` on `:5432`, switch to Neon's **pooled** URL.
 
 **Later in Question 3:** set `cms.hostingTarget` to **`"vercel"`** (all Q1 branches).
 
@@ -677,23 +671,21 @@ Only proceed after the user explicitly confirms.
 
 > **This question is only about media files (images/videos).**  
 > It is **not** about OpenAI, AI pairing, or LLM keys. If you are about to ask for an `sk-` key, **stop** ??you are off-protocol.  
-> **Copy the three options below verbatim.** Wrong examples that must **never** appear: ?Vercel Blob (recommended)?? ?Supabase Storage?? ?No media storage / disable uploads??
+> **Copy the two options below verbatim.** Wrong examples that must **never** appear: "Vercel Blob (recommended)", "Supabase Storage", "No media storage / disable uploads", "local disk only".
 
-### Step A ??Ask storage choice
+### Step A ? Ask storage choice
 
-**Ask exactly (wording must match ??Cloudinary is recommended):**
+**Ask exactly (wording must match ? Cloudinary is recommended):**
 
 > How should playlist media (images/videos) be stored?
 >
-> **1. Cloudinary (recommended)** ??durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
->
-> **2. Vercel Blob** ??Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
+> **1. Cloudinary (recommended)** ? durable public HTTPS URLs (`https://res.cloudinary.com/...`). Works out of the box with `@tomorrowos/sdk` auto-detection. **Prefer this on Vercel.**
 >
-> **3. Local disk only** ??`cms-panel/uploads` or `public/uploads` (OK for quick local tests; **not** for production Vercel fleets ??files are ephemeral).
+> **2. Vercel Blob** ? Vercel-native object storage; durable `https://*.public.blob.vercel-storage.com/...` URLs. Use when you want media on the same Vercel project without a Cloudinary account.
 >
-> Reply with **1**, **2**, or **3** (or ?Cloudinary??/ ?Vercel Blob??/ ?local??.
+> Reply with **1** or **2** (or "Cloudinary" / "Vercel Blob").
 
-If you catch yourself about to offer Blob-as-recommended, Supabase Storage, or ?no media?? **stop and paste the block above instead**.
+If you catch yourself about to offer Blob-as-recommended, Supabase Storage, local disk, or "no media" ? **stop and paste the block above instead**.
 
 ### Step B ??If **1 / Cloudinary** (same Question 2 ??**one Env popup**)
 
@@ -755,11 +747,6 @@ import { put } from "@vercel/blob";
 4. Warn: until the project?s Blob bridge is wired, Control Panel **Media** status may show local/ephemeral ??verify uploads return `https://*.blob.vercel-storage.com/...` before calling setup complete.
 5. Do **not** proceed to Question 3 until `BLOB_READ_WRITE_TOKEN` exists (or Blob is linked and token is confirmed in the Vercel dashboard).
 
-### Step D ??If **3 / local uploads**
-
-1. `mkdir -p public/uploads`
-2. Warn clearly: files may vanish on redeploy; players need stable HTTPS URLs ??Cloudinary or Vercel Blob is strongly preferred for Vercel.
-
 ---
 
 ## Question 3 ??Brand (`brand.json` only)
@@ -881,7 +868,7 @@ Then (**Scheme A ??mandatory for Publish**):
 |------|----------|--------------|
 | `SUPABASE_URL` | If Q1 = Supabase | User pastes URL |
 | `DATABASE_URL` | If Q1 = Neon | User pastes URL |
-| `TOMORROWOS_STORE` | Yes | **Agent auto-sets only** ??never a blank field for the user (`supabase` / `postgres` / `sqlite`) |
+| `TOMORROWOS_STORE` | Yes | **Agent auto-sets only** ? never a blank field for the user (`supabase` / `postgres`) |
 | `DATABASE_SSL` | Yes for Postgres | **Agent auto-sets only** ??never a blank field for the user (`true`) |
 | `CLOUDINARY_*` | If Q2 = Cloudinary | User via **one Env popup** (all fields) |
 | `BLOB_READ_WRITE_TOKEN` | If Q2 = Vercel Blob | User / Blob link |
@@ -965,7 +952,7 @@ Tell the user:
 | WebSocket fails on Publish | Fluid off / static-only / Next as Production / no Function WS | Enable Fluid; Scheme A; test 101 upgrade |
 | Devices fail only on Preview | Next proxy cannot upgrade `wss` | Expected ??pair on Publish URL |
 | Agent asked user to fill `TOMORROWOS_STORE` / `DATABASE_SSL` | Off-protocol | Agent must auto-set after DB choice; remove those fields from user Env forms |
-| Agent offered Blob-as-recommended / Supabase Storage / ?no media??for Q2 | Invented options | Re-ask Q2 verbatim: **1 Cloudinary (recommended)**, 2 Blob, 3 local |
+| Agent offered Blob-as-recommended / Supabase Storage / local disk / "no media" for Q2 | Invented options | Re-ask Q2 verbatim: **1 Cloudinary (recommended)**, 2 Vercel Blob |
 | Agent asked Cloudinary key/secret in three chat turns | Off-protocol | Use **one Env popup** with all Cloudinary fields |
 | Agent asked for OpenAI / `sk-` key during setup | Hallucinated ?AI pairing??requirement | **Refuse.** TomorrowOS does not need LLM keys. Return to Q2 media choices only |
 | Agent built a login page after user pasted a URL | Misread brand reference as product scope | Remove login; keep starter Control Panel; apply URL only to `brand.json` |
@@ -981,7 +968,7 @@ Tell the user:
 | Secrets | Replit Secrets | Vercel Environment Variables |
 | Deploy config | `.replit`, artifact `kind=web` | `vercel.json` + Fluid; **Framework = Other**; **no** `.replit` |
 | `hostingTarget` | `"here"` | `"vercel"` |
-| Database | Supabase (primary) | Supabase **or Neon** (pooled); SQLite demo only |
+| Database | Supabase (primary) | Supabase **or Neon** (pooled) |
 | Media | Cloudinary or Replit Object Storage | Cloudinary **or Vercel Blob** |
 | Preview | Replit Preview / Autoscale Node | **Next shell + proxy** when v0 hardwires Next |
 | Publish | Long-lived Node | **Node `TomorrowOS.listen` only** (not Next); gate on no `404 NOT_FOUND` |
@@ -997,8 +984,8 @@ After setup, report:
 2. **Publish health:** Framework = Other; Output ??`public`; `GET /status` ??JSON; `GET /` OK
 3. **Preview note:** Next proxy shell used / not needed
 4. **Env Vars set** (names only ??never values); note which were auto-set (`TOMORROWOS_STORE`, `DATABASE_SSL`)
-5. **Store:** Supabase pooler / Neon pooled / SQLite (with warning)
-6. **Media:** Cloudinary, Vercel Blob, or local (with warning)
+5. **Store:** Supabase pooler or Neon pooled
+6. **Media:** Cloudinary or Vercel Blob
 7. **Brand:** name + `hostingTarget: vercel` (+ note if derived from website URL)
 8. **Runtime split:** Preview = ??; Publish = Node TomorrowOS (confirm **not** Next)
 9. **Open action:** if Database still ERROR, paste the pooler instruction again

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.54",
+  "version": "0.9.56",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,13 +18,10 @@
     "dist",
     "templates",
     "README.md",
-    "LLM_PROMPT.md",
     "REPLIT_SETUP.md",
-    "LOVABLE_SETUP.md",
     "VERCEL_SETUP.md",
     "VERCEL_QUESTIONS.md",
     "REPLIT_UPGRADE.md",
-    "BUILD_GUARDRAILS.md",
     "PLAYER_INSTALL.md",
     "brand.schema.json",
     "brand.example.json"

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.54",
+  "version": "0.9.56",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.54",
+    "@tomorrowos/sdk": "^0.9.56",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter/policy.example.json

@@ -2,14 +2,13 @@
   "policy": {
     "playlists": [
       {
-        "id": "weekday-promo",
-        "name": "Weekday promo",
+        "id": "promo-window",
+        "name": "Promo window",
         "schedule": {
-          "startDate": "2026-05-01",
-          "endDate": "2026-05-31",
-          "daysOfWeek": [1, 2, 3, 4, 5],
-          "start": "09:00",
-          "end": "17:00"
+          "startDate": "2026-05-05",
+          "start": "13:00",
+          "endDate": "2026-05-08",
+          "end": "14:00"
         },
         "items": [
           {