@tomorrowos/sdk 0.9.66 → 0.9.68

package/README.md

@@ -79,7 +79,7 @@ Follow @tomorrowos/sdk (an NPM package) VERCEL_SETUP.md and set up my TomorrowOS
 
 Open VERCEL_QUESTIONS.md first.
 For Q1, Q2, Q3: paste each question block VERBATIM. Do not rephrase options.
-For Q3: DO NOT ask a branding question or offer choices. Immediately open one form with ALL SEVEN optional inputs visible at once (Product Name, Tagline, Primary/Background/Text/Secondary colour, Logo Upload above Logo URL). Never only Name + Primary colour. Blanks = brand.json defaults.
+For Q3: DO NOT ask a branding choice. Open one form with ALL SEVEN optional inputs at once, then HARD STOP and WAIT for my submit or "skip". Never auto-continue with defaults without my reply. Never only Name + Primary colour. Logo = Upload above Logo URL.
 After Q1 database choice, YOU set TOMORROWOS_STORE and DATABASE_SSL. Do not ask me to fill those.
 After Q2 media storage choice, YOU set TOMORROWOS_MEDIA. Do not ask me to fill those.
 Run: npx @tomorrowos/sdk@latest init . --hosting v0 --force
@@ -94,7 +94,7 @@ after deploy verify: GET /status → JSON, GET / → Control Panel, WebSocket on
 pair devices against the Production URL only
 ```
 
-Agents must paste questions from [`VERCEL_QUESTIONS.md`](./VERCEL_QUESTIONS.md) verbatim. Q1/Q2 are choice questions; **Q3 is a form only** — open **all seven** optional inputs at once (never a branding choice first; never only Name + Primary colour). Logo = Upload above Logo URL; blanks keep `brand.json` defaults. WebSockets require Fluid compute. The agent sets `cms.hostingTarget` to `"vercel"`.
+Agents must paste questions from [`VERCEL_QUESTIONS.md`](./VERCEL_QUESTIONS.md) verbatim. Q1/Q2 are choice questions; **Q3 is a form only** — open **all seven** optional inputs at once, then **wait** for submit or `"skip"` (never auto-skip because fields are optional; never a branding choice first; never only Name + Primary colour). Logo = Upload above Logo URL. WebSockets require Fluid compute. The agent sets `cms.hostingTarget` to `"vercel"`.
 
 Upgrading an existing Vercel / v0 CMS instead:
 
@@ -334,6 +334,7 @@ Works in either direction across `sqlite`, `postgres`, and `supabase`. It moves
 - **Local disk:** small files may use `POST /media/upload`. Larger files use **chunked upload** (`/media/upload-init` → `/media/upload-chunk` → `/media/upload-complete`).
 - **Replit Object Storage:** set `TOMORROWOS_MEDIA=replit-object-storage` (auto-preferred on Replit when Cloudinary is unset). Uses `@replit/object-storage`; URLs stay `/uploads/...` and are served from the bucket after Republish. Same upload HTTP routes as local.
 - **Cloudinary:** set `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, `CLOUDINARY_API_SECRET` (optional `CLOUDINARY_FOLDER`). The Control Panel uses **browser → Cloudinary** direct upload (`/media/upload-sign` + `/media/register`) when Cloudinary is configured.
+- **Vercel Blob:** set `BLOB_READ_WRITE_TOKEN` and `TOMORROWOS_MEDIA=vercel-blob` (token alone also auto-enables Blob when Cloudinary is unset). SDK uploads via `@vercel/blob` `put()`; asset URLs are absolute `https://*.public.blob.vercel-storage.com/...`.
 
 Cloudinary account plans still enforce their own max file sizes (for example Free plan video caps).
 
@@ -392,7 +393,7 @@ Fetch `GET /brand.json` from the panel’s network. A live WebSocket with a blac
 Policy URLs must be absolute and reachable from the screen. Relative paths or hosts only visible on your laptop will fail on the panel.
 
 **Upload fails with HTTP 413 on Replit (or similar hosts).**  
-Use `@tomorrowos/sdk` Control Panel / templates: non-Cloudinary uploads over ~2MB go through **chunked** `/media/upload-chunk`. On Replit, set `TOMORROWOS_MEDIA=replit-object-storage` (or rely on auto-detect) so files land in App Storage. With Cloudinary configured, the panel uses browser direct upload instead.
+Use `@tomorrowos/sdk` Control Panel / templates: non-Cloudinary uploads over ~2MB go through **chunked** `/media/upload-chunk`. On Replit, set `TOMORROWOS_MEDIA=replit-object-storage` (or rely on auto-detect) so files land in App Storage. On Vercel Blob, set `TOMORROWOS_MEDIA=vercel-blob` + `BLOB_READ_WRITE_TOKEN` so proxy/chunked complete stores absolute Blob URLs. With Cloudinary configured, the panel uses browser direct upload instead.
 
 **BrightSign zip has empty `cmsEndpoint`.**  
 You downloaded the mother zip from a static CDN instead of **this** CMS’s `/players/brightsign.zip`. Use Control Panel → Download Players → BrightSign on the deployed CMS.

package/VERCEL_QUESTIONS.md

@@ -1,10 +1,11 @@
 # Vercel / v0 - Verbatim question bank
 
-> **Protocol:** `vercel-questions/1.4` (pairs with `VERCEL_SETUP.md` 1.12+ / `@tomorrowos/sdk` 0.9.66+)  
+> **Protocol:** `vercel-questions/1.5` (pairs with `VERCEL_SETUP.md` 1.14+ / `@tomorrowos/sdk` 0.9.68+)  
 > **For Agents:** When asking the user a setup question, **copy-paste the block below for that step EXACTLY**.  
 > Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no "Blob recommended", no "disable media").  
 > After each answer, configure per `VERCEL_SETUP.md`, then paste the **next** block.  
-> **Q1 and Q2 are choice questions. Q3 is a form only - never a multiple-choice question.**
+> **Q1 and Q2 are choice questions. Q3 is a form only - never a multiple-choice question.**  
+> **HARD STOP on Q3:** show the form, then **wait** for the user's reply. Optional fields do **not** mean you may auto-skip.
 
 ---
 
@@ -45,17 +46,21 @@ Reply with **1** or **2** (or "Cloudinary" / "Vercel Blob").
 
 ---
 
-## Q3 - Brand form (NOT a question - open this form immediately)
+## Q3 - Brand form (NOT a question - open this form, then WAIT)
 
 **STOP - read before doing anything for branding:**
 
-1. Q3 is **not** a chat question and **not** a multiple-choice step.
+1. Q3 is **not** a chat multiple-choice step.
 2. **Do not** ask: "Want to customize branding?", "Option A / Option B", "skip or customize?", or any other choice first.
 3. **Do not** open a form with only Product Name + Primary colour (or any subset).
-4. **Immediately** open **one** multi-input form with **all seven fields visible at the same time**. User submits **once**. Every field is **optional**.
+4. **Immediately** open **one** multi-input form with **all seven fields visible at the same time**.
+5. **HARD STOP and WAIT** for the user to submit the form, reply with values, or say **"skip"**.  
+   - Fields being optional means blanks keep defaults **after** the user responds.  
+   - Fields being optional does **NOT** mean you may continue scaffolding without a user reply.  
+   - **Forbidden:** "fields are optional so I'll proceed with defaults" / auto-skip / thinking past Q3 in the same turn.
 
 **Title:** Brand your TomorrowOS experience  
-**Helper:** All fields optional. Leave blank to keep starter brand.json defaults. Submit once.
+**Helper:** All fields optional. Leave blank to keep starter brand.json defaults. Submit once (or reply "skip"). I will wait for your reply before continuing setup.
 
 **Create exactly these seven controls - all on screen together (no Next / no wizard steps):**
 
@@ -71,12 +76,15 @@ Reply with **1** or **2** (or "Cloudinary" / "Vercel Blob").
 
 **Pass / fail check before showing the user:** count the text inputs. If you see fewer than **six** text fields (Product Name, Tagline, Primary, Background, Text, Secondary) plus the Logo Upload+URL row, **do not show it** - rebuild the form with all seven.
 
-**Forbidden Q3 UIs:**
+**Forbidden Q3 UIs / behaviors:**
 
 - Any multiple-choice / radio / "1 or 2" / Option A vs B
 - A preliminary question before the form
 - Only Name + Primary colour (or any 1-2 field subset)
 - One freeform / Other box for all brand values
 - Field-by-field Next wizard
+- Auto-continuing to init/scaffold/deploy without a user Q3 reply or explicit "skip"
+- Interpreting "do not re-ask" as "do not wait for the first reply"
 
+After the user submits (including all-blank) or says "skip": apply `brand.json`, then continue. **Do not** re-ask Q3 a second time.
 Blank fields -> keep existing `brand.json`. Logo blank -> `./assets/logo.svg`.

package/VERCEL_SETUP.md

@@ -5,10 +5,10 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`).
 >
-> Protocol id: `vercel-setup/1.12` - pairs with `@tomorrowos/sdk` **0.9.66+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
+> Protocol id: `vercel-setup/1.14` - pairs with `@tomorrowos/sdk` **0.9.68+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
 >
 > **Questions source of truth:** `VERCEL_QUESTIONS.md` - Agents must **open that file and paste each Q block verbatim**. Do not paraphrase.  
-> **Q1/Q2 = choice questions. Q3 = form only:** immediately open **all seven optional inputs at once**. Never ask a branding choice first. Never show only Name + Primary colour. Logo = **Upload** above **Logo URL**. Blanks keep starter `brand.json`.  
+> **Q1/Q2 = choice questions. Q3 = form only:** open **all seven optional inputs at once**, then **HARD STOP and WAIT** for submit or "skip". Never auto-skip because fields are optional. Never ask a branding choice first. Never show only Name + Primary colour. Logo = **Upload** above **Logo URL**.  
 > **Copy questions verbatim from `VERCEL_QUESTIONS.md`.** Do not invent alternate Q2 options (no "Supabase Storage", no S3, no "disable media", no making Blob the recommended option).  
 > **`TOMORROWOS_STORE` and `DATABASE_SSL` are agent-only** - set them automatically after Q1; never put them in a user-facing Env form for the customer to type.
 
@@ -38,7 +38,7 @@ Follow @tomorrowos/sdk (an NPM package) VERCEL_SETUP.md and set up my TomorrowOS
 
 Open VERCEL_QUESTIONS.md first.
 For Q1, Q2, Q3: paste each question block VERBATIM. Do not rephrase options.
-For Q3: DO NOT ask a branding question or offer choices. Immediately open one form with ALL SEVEN optional inputs visible at once (Product Name, Tagline, Primary/Background/Text/Secondary colour, Logo Upload above Logo URL). Never only Name + Primary colour. Blanks = brand.json defaults.
+For Q3: DO NOT ask a branding choice. Open one form with ALL SEVEN optional inputs at once, then HARD STOP and WAIT for my submit or "skip". Never auto-continue with defaults without my reply. Never only Name + Primary colour. Logo = Upload above Logo URL.
 After Q1 database choice, YOU set TOMORROWOS_STORE and DATABASE_SSL. Do not ask me to fill those.
 After Q2 media storage choice, YOU set TOMORROWOS_MEDIA. Do not ask me to fill those.
 Run: npx @tomorrowos/sdk@latest init . --hosting v0 --force
@@ -219,9 +219,9 @@ Then ask **Question 1**.
 16. **No inventing CMS login** from a branding URL.
 17. **Skip ??invent.** Stay on Q1?Q3 only.
 18. **Publish gate:** `/status` JSON + WebSocket 101; no static `public/` trap.
-19. **Q3 is a form, not a question.** After Q2, **immediately** open one dialog with **all seven** optional inputs visible together. **Never** ask a preliminary branding choice. **Never** show only Product Name + Primary colour. **Never** use multiple-choice / Option A-B for branding. Logo = **Upload** above **Logo URL**.
+19. **Q3 is a form, not a question ? and you must WAIT.** After Q2, open one dialog with **all seven** optional inputs visible together, then **stop and wait** for submit or explicit **"skip"**. **Never** auto-continue because fields are optional. **Never** ask a preliminary branding choice. **Never** show only Product Name + Primary colour. **Never** use multiple-choice / Option A-B for branding. Logo = **Upload** above **Logo URL**.
 
-**Question order:** Q1 -> (auto-set store env) -> Q2 -> Q3 form -> execution checklist.
+**Question order:** Q1 -> (auto-set store env) -> Q2 -> Q3 form (**wait for user**) -> execution checklist.
 
 ---
 
@@ -465,7 +465,7 @@ Adapt script names / process runners as needed. **Invariant:**
 
 Use the latest published `@tomorrowos/sdk` when scaffolding (do not invent versions).
 
-Add `@vercel/blob` only when the user chooses **Vercel Blob** in Question 2.
+Add nothing extra for Blob when using `@tomorrowos/sdk@0.9.68+` (`@vercel/blob` is bundled). Only ensure `BLOB_READ_WRITE_TOKEN` + `TOMORROWOS_MEDIA=vercel-blob` when the user chooses **Vercel Blob** in Question 2.
 
 For Preview shell only, add as needed: `next`, `react`, `react-dom`, and a process runner (`concurrently` or equivalent). These must **not** become the Production CMS.
 
@@ -721,13 +721,13 @@ If you catch yourself about to offer Blob-as-recommended, Supabase Storage, loca
 
 The SDK auto-detects these env vars.
 
-### Step C ??If **2 / Vercel Blob** (same Question 2)
+### Step C - If **2 / Vercel Blob** (same Question 2)
 
 **Ask exactly:**
 
 > I will enable **Vercel Blob** for media uploads.
 >
-> 1. In the Vercel project: **Storage ??Create ??Blob** (or link an existing Blob store to this project).
+> 1. In the Vercel project: **Storage ? Create ? Blob** (or link an existing Blob store to this project).
 > 2. Confirm **`BLOB_READ_WRITE_TOKEN`** is available (Vercel usually injects it when Blob is linked).
 >
 > Paste the token only if it is not already set in your project Env Vars. Do you already have Blob linked on this Vercel project? (yes / no)
@@ -735,45 +735,41 @@ The SDK auto-detects these env vars.
 **You must then:**
 
 1. Set Vercel Env Var: `BLOB_READ_WRITE_TOKEN=<token>` (if not auto-injected). Prefer the Env popup when available.
-2. `npm install @vercel/blob` (add to `dependencies`).
-3. Wire uploads so media returns **absolute HTTPS Blob URLs** stored in `uploaded_assets` (players need stable public URLs).
-   - The SDK **natively auto-detects Cloudinary** today. For Vercel Blob, add a thin upload bridge in the CMS project (e.g. custom route or middleware that calls `put()` from `@vercel/blob` and persists the returned `url` the same way Cloudinary URLs are stored).
-   - Minimum pattern:
-
-```ts
-import { put } from "@vercel/blob";
-
-// On upload: const blob = await put(filename, body, { access: "public", token: process.env.BLOB_READ_WRITE_TOKEN });
-// Store blob.url in uploaded_assets ??same shape as Cloudinary secure URLs.
-```
-
-4. Warn: until the project?s Blob bridge is wired, Control Panel **Media** status may show local/ephemeral ??verify uploads return `https://*.blob.vercel-storage.com/...` before calling setup complete.
-5. Do **not** proceed to Question 3 until `BLOB_READ_WRITE_TOKEN` exists (or Blob is linked and token is confirmed in the Vercel dashboard).
+2. Set Vercel Env Var yourself (agent-owned): `TOMORROWOS_MEDIA=vercel-blob`. **Do not** ask the user to type this.
+3. Ensure `@tomorrowos/sdk@0.9.68+` is installed (`@vercel/blob` is a transitive dependency ? no project-level Blob bridge / custom `put()` middleware).
+4. The SDK **natively** uploads via Vercel Blob when the token is present (same HTTP routes as local: `/media/upload` and chunked complete). Returned asset URLs are absolute `https://*.public.blob.vercel-storage.com/...`.
+5. Confirm Control Panel **Media Server** shows provider **Blob** (not Local). Do **not** invent status copy about "Blob bridge" or paste the URL pattern as a status detail.
+6. Do **not** proceed to Question 3 until `BLOB_READ_WRITE_TOKEN` exists (or Blob is linked and token is confirmed in the Vercel dashboard).
 
+**Forbidden for Q2=Blob:** scaffolding a custom "Blob bridge", writing status text like "uploads persist to durable https://*.public.blob.vercel-storage.com/ URLs via the Blob bridge", or leaving uploads on local `cms-panel/uploads`.
 ---
 
-## Question 3 - Brand form (`brand.json` only; **not a choice question**)
+## Question 3 - Brand form (`brand.json` only; **not a choice question**; **must wait**)
 
 > Updates **only** `brand.json`. Does **not** change Vercel project settings, Env Vars, `vercel.json`, or `server.ts` store wiring beyond what Q1-Q2 already required.
 >
-> **IRON RULE - form, not question:** As soon as Q2 is done, **open the brand form**. Do **not** ask the user anything in chat first. Do **not** offer choices. Show **all seven optional fields on one screen at the same time**. User fills what they want (or leaves blank) and submits **once**.
+> **IRON RULE - form, not question; show then WAIT:** As soon as Q2 is done, **open the brand form**. Do **not** ask a choice first. Show **all seven optional fields on one screen at the same time**. Then **HARD STOP** until the user submits the form, replies with values, or says **"skip"**.
+>
+> **Optional fields ? optional step.** Leaving a field blank keeps the starter default **after the user responds**. It does **not** authorize you to skip waiting or auto-apply defaults in the same turn.
 >
 > - **Forbidden:** any preliminary question ("customize branding?", "skip or set brand?", Option A/B)
 > - **Forbidden:** multiple-choice / radio / "reply 1 or 2" for branding
 > - **Forbidden:** showing only Product Name + Primary colour (or any subset under 7)
 > - **Forbidden:** field-by-field Next wizard (name -> wait -> tagline -> ...)
 > - **Forbidden:** one freeform / Other box for all brand values
-> - **Required:** six text inputs + Logo Upload above Logo URL, all visible together before submit
+> - **Forbidden:** auto-continuing to init / scaffold / env / deploy because "fields are optional" or "I shouldn't re-ask"
+> - **Required:** six text inputs + Logo Upload above Logo URL, all visible together
+> - **Required:** wait for one user action (submit / values / "skip") before scaffolding continues
 >
 > **Self-check:** If the UI you are about to show has fewer than six text fields for name/tagline/four colours, **abort and rebuild** - that UI is off-protocol.
 >
-> **Every field is optional.** Blank / skip / "use defaults" -> keep starter **`brand.json`** values (from `templates/cms-starter-v0/brand.json` / project `brand.json` after `init`). **Do not** re-ask for missing fields. **Do not** invent a second branding prompt.
+> **Every field is optional** once the form is shown. After the user submits (including all-blank) or says "skip": keep starter **`brand.json`** for blanks; **do not** re-ask Q3 a second time. **Do not** invent a second branding prompt.
 >
 > Default TomorrowOS Control Panel has **no login**. Do **not** scaffold login/auth unless the user explicitly asks.
 
-### Preferred UI (open immediately - all seven at once)
+### Preferred UI (open immediately - all seven at once - then wait)
 
-Open **one** dialog titled **Brand your TomorrowOS experience**. Render **each row as its own control**. All rows must appear **together** on first paint - not revealed after a choice, not after filling a previous field.
+Open **one** dialog titled **Brand your TomorrowOS experience**. Render **each row as its own control**. All rows must appear **together** on first paint - not revealed after a choice, not after filling a previous field. After opening, **end your turn** and wait.
 
 | # | Exact label | Control type | Blank default |
 |---|-------------|--------------|---------------|
@@ -785,15 +781,15 @@ Open **one** dialog titled **Brand your TomorrowOS experience**. Render **each r
 | 6 | **Secondary colour** | text input (hex) | e.g. `#F5F3EF` |
 | 7 | **Logo** | **Upload** (SVG/PNG file picker) **above** **Logo URL** (text input) | keep `./assets/logo.svg` |
 
-Helper text: *All fields optional. Leave blank to keep starter brand.json defaults. Submit once. For logo: upload a file or paste a URL.*
+Helper text: *All fields optional. Leave blank to keep starter brand.json defaults. Submit once, or reply "skip". I will wait before continuing setup.*
 
 **Logo UX:** Upload control directly above Logo URL. Either is fine; if both provided, prefer the uploaded file.
 
-### If a form UI is unavailable - one chat message only (still no choice question)
+### If a form UI is unavailable - one chat message only (still wait)
 
-Only when the platform **cannot** render multi-field forms. Do **not** ask a choice first. Send **exactly one** message listing all seven fields (user may answer partially, attach a logo, or say "skip"):
+Only when the platform **cannot** render multi-field forms. Do **not** ask a choice first. Send **exactly one** message listing all seven fields, then **end your turn and wait** (user may answer partially, attach a logo, or say "skip"):
 
-> Brand your TomorrowOS experience (**all optional - reply once**). Leave any field blank to keep starter `brand.json` defaults:
+> Brand your TomorrowOS experience (**all optional - reply once**). Leave any field blank to keep starter `brand.json` defaults. I will wait for your reply before scaffolding:
 >
 > 1. **Product Name**
 > 2. **Tagline**
@@ -802,6 +798,8 @@ Only when the platform **cannot** render multi-field forms. Do **not** ask a cho
 > 5. **Text colour** (hex)
 > 6. **Secondary colour** (hex)
 > 7. **Logo** - attach SVG/PNG or paste a Logo URL
+>
+> Or reply **skip** to keep all defaults.
 
 ### After the user submits
 
@@ -868,7 +866,7 @@ Then (**Scheme A ??mandatory for Publish**):
 4. **Force Project Settings** per **Scheme A4** (Framework = Other, Output Directory empty, Start = `npm run start`, Fluid on). Patch dashboard via API if it still says Next.js.
 5. Do **not** add root `api/` catch-all for raw `http.Server`.
 6. Do **not** add `.replit*`.
-7. If Q2 = Vercel Blob: install `@vercel/blob` and wire the upload bridge.
+7. If Q2 = Vercel Blob: set `BLOB_READ_WRITE_TOKEN` + `TOMORROWOS_MEDIA=vercel-blob` (SDK-native; no custom bridge).
 
 ### B. Environment Variables (Vercel dashboard + local)
 
@@ -880,6 +878,7 @@ Then (**Scheme A ??mandatory for Publish**):
 | `DATABASE_SSL` | Yes for Postgres | **Agent auto-sets only** ??never a blank field for the user (`true`) |
 | `CLOUDINARY_*` | If Q2 = Cloudinary | User via **one Env popup** (all fields) |
 | `BLOB_READ_WRITE_TOKEN` | If Q2 = Vercel Blob | User / Blob link |
+| `TOMORROWOS_MEDIA` | If Q2 = Vercel Blob | **Agent auto-sets** `vercel-blob` |
 | `TOMORROWOS_INTERNAL_PORT` | Preview only | Agent (e.g. `3001`) |
 | `PORT` | Optional | Vercel injects for Production |
 
@@ -965,6 +964,7 @@ Tell the user:
 | Agent asked for OpenAI / `sk-` key during setup | Hallucinated ?AI pairing??requirement | **Refuse.** TomorrowOS does not need LLM keys. Return to Q2 media choices only |
 | Agent asked a branding choice / Option A-B / "customize?" before the form | Off-protocol Q3 | Close it; immediately open the **7-field form** (no choice step) |
 | Agent showed only Name + Primary colour (or any subset) | Off-protocol Q3 | Rebuild with **all seven** inputs visible at once |
+| Agent auto-continued after showing Q3 because "fields are optional" / "shouldn't re-ask" | Off-protocol Q3 | **HARD STOP** and wait for submit or explicit "skip"; do not scaffold yet |
 | Agent asked branding as Option A URL vs Option B, or field-by-field Next | Off-protocol Q3 | Re-open Q3 as **seven separate optional inputs** in one dialog; blanks keep `brand.json` |
 | Agent built a login page from branding answers | Misread brand step as product scope | Remove login; keep starter Control Panel; apply answers only to `brand.json` |
 | Secrets in git | Mistake | Rotate keys; move to Vercel Env Vars |
@@ -1013,7 +1013,11 @@ Protocol complete when:
 
 ## Protocol version
 
-`vercel-setup/1.12` - pairs with `@tomorrowos/sdk` 0.9.66+ and `VERCEL_QUESTIONS.md` 1.4.
+`vercel-setup/1.14` - pairs with `@tomorrowos/sdk` 0.9.68+ and `VERCEL_QUESTIONS.md` 1.5.
+
+**Changelog 1.14:** Vercel Blob is **SDK-native** (`BLOB_READ_WRITE_TOKEN` + `TOMORROWOS_MEDIA=vercel-blob`). No project Blob bridge. Status providers use display names (Neon, Supabase, Blob, Cloudinary, Replit Object Storage). Forbidden marketing status copy about blob URL patterns.
+
+**Changelog 1.13:** Q3 must **HARD STOP and WAIT** for user submit or "skip". Optional fields do **not** authorize auto-continuing with defaults. Clarifies "do not re-ask" = after the user already replied, not "skip waiting".
 
 **Changelog 1.12:** Q3 is a **form, not a question**. No preliminary branding choice. Must show **all seven** optional inputs at once (never only Name + Primary colour). Logo = Upload above Logo URL.
 

package/dist/server-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-status.d.ts","sourceRoot":"","sources":["../src/server-status.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,IAAI,GAAG,UAAU,GAAG,SAAS,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqUD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA6B7B"}
+{"version":3,"file":"server-status.d.ts","sourceRoot":"","sources":["../src/server-status.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,IAAI,GAAG,UAAU,GAAG,SAAS,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA4ZD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA6B7B"}

package/dist/server-status.js

@@ -2,6 +2,7 @@ import fs from "fs/promises";
 import path from "path";
 import { getReplitObjectStorageClient, isReplitHost, resolveReplitObjectStorageMode } from "./replit-object-storage.js";
 import { pingCloudinary, resolveCloudinaryConfig } from "./cloudinary-storage.js";
+import { isVercelBlobConfigured, pingVercelBlob, resolveVercelBlobMode, resolveVercelBlobToken } from "./vercel-blob-storage.js";
 import { getSdkPackageVersion } from "./sdk-version.js";
 /** Replit Preview/dev often cannot resolve Supabase hosts — not a config error. */
 function isReplitPreviewDnsFailure(message) {
@@ -13,33 +14,76 @@ function isReplitPreviewDnsFailure(message) {
         m.includes("cannot resolve") ||
         m.includes("name or service not known"));
 }
+function isNeonDatabaseUrl(url) {
+    const u = String(url || "").toLowerCase();
+    return (u.includes("neon.tech") ||
+        u.includes("neon.db") ||
+        /\.neon\./.test(u));
+}
+/**
+ * Display name shown next to "Database" in the Control Panel status card.
+ * Prefer specific products (Neon / Supabase / Replit Postgres) over generic PostgreSQL.
+ */
 function resolveDatabaseProvider(env) {
     const driver = String(env.TOMORROWOS_STORE || "").trim().toLowerCase();
-    const hasUrl = !!(env.SUPABASE_URL || env.DATABASE_URL);
-    if (driver === "supabase" || (!driver && env.SUPABASE_URL)) {
+    const supabaseUrl = String(env.SUPABASE_URL || "").trim();
+    const databaseUrl = String(env.DATABASE_URL || "").trim();
+    const hasUrl = !!(supabaseUrl || databaseUrl);
+    const probeUrl = supabaseUrl || databaseUrl;
+    if (driver === "supabase" || (!driver && supabaseUrl)) {
         return {
-            provider: "supabase",
+            provider: "Supabase",
             label: "Database",
-            configured: !!env.SUPABASE_URL || !!env.DATABASE_URL
+            configured: hasUrl,
+            kind: "supabase"
         };
     }
-    if (driver === "postgres" || (!driver && hasUrl && !env.SUPABASE_URL)) {
+    if (driver === "postgres" || (!driver && hasUrl && !supabaseUrl)) {
+        if (isNeonDatabaseUrl(probeUrl)) {
+            return {
+                provider: "Neon",
+                label: "Database",
+                configured: hasUrl,
+                kind: "postgres"
+            };
+        }
+        if (isReplitHost(env)) {
+            return {
+                provider: "Replit Postgres",
+                label: "Database",
+                configured: hasUrl,
+                kind: "postgres"
+            };
+        }
         return {
-            provider: "postgres",
+            provider: "PostgreSQL",
             label: "Database",
-            configured: hasUrl
+            configured: hasUrl,
+            kind: "postgres"
         };
     }
     if (driver === "memory") {
-        return { provider: "memory", label: "Database", configured: true };
+        return {
+            provider: "Memory",
+            label: "Database",
+            configured: true,
+            kind: "memory"
+        };
     }
     if (driver === "sqlite" || !driver) {
-        return { provider: "sqlite", label: "Database", configured: true };
+        return {
+            provider: "SQLite",
+            label: "Database",
+            configured: true,
+            kind: "sqlite"
+        };
     }
+    const pretty = driver.charAt(0).toUpperCase() + driver.slice(1).toLowerCase();
     return {
-        provider: driver || "unknown",
+        provider: pretty || "Unknown",
         label: "Database",
-        configured: hasUrl || driver === "sqlite" || driver === "memory"
+        configured: hasUrl || driver === "sqlite" || driver === "memory",
+        kind: "unknown"
     };
 }
 async function withTimeout(promise, timeoutMs, label) {
@@ -59,7 +103,7 @@ async function withTimeout(promise, timeoutMs, label) {
 }
 async function probeDatabase(store, env, timeoutMs) {
     const meta = resolveDatabaseProvider(env);
-    const wantsRemote = meta.provider === "supabase" || meta.provider === "postgres";
+    const wantsRemote = meta.kind === "supabase" || meta.kind === "postgres";
     if (wantsRemote && !meta.configured) {
         return {
             id: "database",
@@ -71,7 +115,7 @@ async function probeDatabase(store, env, timeoutMs) {
     }
     try {
         await withTimeout(store.listPairedDevices(), timeoutMs, meta.label);
-        if (meta.provider === "memory") {
+        if (meta.kind === "memory") {
             return {
                 id: "database",
                 label: meta.label,
@@ -80,7 +124,7 @@ async function probeDatabase(store, env, timeoutMs) {
                 detail: "In-memory only — data is lost on restart."
             };
         }
-        if (meta.provider === "sqlite" && isReplitHost(env)) {
+        if (meta.kind === "sqlite" && isReplitHost(env)) {
             return {
                 id: "database",
                 label: meta.label,
@@ -94,7 +138,7 @@ async function probeDatabase(store, env, timeoutMs) {
             label: meta.label,
             provider: meta.provider,
             state: "ok",
-            detail: `${meta.label} reachable`
+            detail: `${meta.provider} reachable`
         };
     }
     catch (err) {
@@ -127,7 +171,7 @@ async function probeMedia(staticRoot, env, timeoutMs) {
             return {
                 id: "media",
                 label: "Media Server",
-                provider: "cloudinary",
+                provider: "Cloudinary",
                 state: "ok",
                 detail: `Cloudinary (${cloudinary.cloudName}) reachable`
             };
@@ -137,7 +181,7 @@ async function probeMedia(staticRoot, env, timeoutMs) {
             return {
                 id: "media",
                 label: "Media Server",
-                provider: "cloudinary",
+                provider: "Cloudinary",
                 state: "error",
                 detail: message
             };
@@ -150,11 +194,47 @@ async function probeMedia(staticRoot, env, timeoutMs) {
         return {
             id: "media",
             label: "Media Server",
-            provider: "cloudinary",
+            provider: "Cloudinary",
             state: "error",
             detail: "Cloudinary config incomplete — set CLOUDINARY_CLOUD_NAME, CLOUDINARY_API_KEY, and CLOUDINARY_API_SECRET."
         };
     }
+    const blobMode = resolveVercelBlobMode(env);
+    if (blobMode !== "off") {
+        const token = resolveVercelBlobToken(env);
+        if (!token) {
+            return {
+                id: "media",
+                label: "Media Server",
+                provider: "Blob",
+                state: "error",
+                detail: "Vercel Blob required but BLOB_READ_WRITE_TOKEN is not set. Link a Blob store to this Vercel project."
+            };
+        }
+        try {
+            await withTimeout(pingVercelBlob(token), timeoutMs, "Blob");
+            return {
+                id: "media",
+                label: "Media Server",
+                provider: "Blob",
+                state: "ok",
+                detail: "Blob reachable"
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (blobMode === "required" || isVercelBlobConfigured(env)) {
+                return {
+                    id: "media",
+                    label: "Media Server",
+                    provider: "Blob",
+                    state: "error",
+                    detail: message
+                };
+            }
+            // preferred but ping failed: fall through
+        }
+    }
     const rosMode = resolveReplitObjectStorageMode(env);
     if (rosMode !== "off") {
         try {
@@ -164,16 +244,16 @@ async function probeMedia(staticRoot, env, timeoutMs) {
                 return {
                     id: "media",
                     label: "Media Server",
-                    provider: "replit-object-storage",
+                    provider: "Replit Object Storage",
                     state: "ok",
-                    detail: "Replit Object Storage (App Storage) reachable — uploads persist across Republish"
+                    detail: "Replit Object Storage reachable"
                 };
             }
             if (rosMode === "required") {
                 return {
                     id: "media",
                     label: "Media Server",
-                    provider: "replit-object-storage",
+                    provider: "Replit Object Storage",
                     state: "error",
                     detail: "TOMORROWOS_MEDIA requires Replit Object Storage but no client is available. Link an App Storage bucket and install @replit/object-storage."
                 };
@@ -185,7 +265,7 @@ async function probeMedia(staticRoot, env, timeoutMs) {
                 return {
                     id: "media",
                     label: "Media Server",
-                    provider: "replit-object-storage",
+                    provider: "Replit Object Storage",
                     state: "error",
                     detail: message
                 };
@@ -193,9 +273,10 @@ async function probeMedia(staticRoot, env, timeoutMs) {
             // preferred: fall through to local disk probe
         }
     }
-    const provider = isReplitHost(env) ? "replit-object-storage" : "local";
-    const providerLabel = provider === "replit-object-storage"
-        ? "Local uploads (Object Storage not active — files may not survive Republish)"
+    const onReplit = isReplitHost(env);
+    const provider = onReplit ? "Replit Object Storage" : "Local";
+    const providerLabel = onReplit
+        ? "Local uploads (Object Storage not active)"
         : "Local uploads";
     if (!staticRoot) {
         return {
@@ -203,7 +284,7 @@ async function probeMedia(staticRoot, env, timeoutMs) {
             label: "Media Server",
             provider,
             state: "missing",
-            detail: "No Cloudinary and staticRoot is unset — media uploads are unavailable."
+            detail: "No durable media backend and staticRoot is unset — uploads unavailable."
         };
     }
     const uploadsDir = path.join(path.resolve(staticRoot), "uploads");
@@ -215,7 +296,7 @@ async function probeMedia(staticRoot, env, timeoutMs) {
             label: "Media Server",
             provider,
             state: "warn",
-            detail: `${providerLabel} writable at ${uploadsDir}. Set TOMORROWOS_MEDIA=replit-object-storage and link App Storage for durable media, or use Cloudinary.`
+            detail: `${providerLabel} at ${uploadsDir}. Prefer Cloudinary, Blob, or Replit Object Storage for production.`
         };
     }
     catch (err) {
@@ -239,19 +320,22 @@ function buildBlockers(connectors) {
                 message: c.detail,
                 fixHint: c.state === "missing"
                     ? "Paste your Supabase Postgres connection string as Secret SUPABASE_URL, set TOMORROWOS_STORE=supabase, then restart the CMS."
-                    : "Check SUPABASE_URL / network / SSL (DATABASE_SSL=true). After Publish, confirm the live URL can reach Supabase."
+                    : "Check SUPABASE_URL / DATABASE_URL / network / SSL (DATABASE_SSL=true). After Publish, confirm the live URL can reach the database."
             });
         }
         if (c.id === "media" && c.state === "error") {
+            const provider = String(c.provider || "");
             blockers.push({
                 connectorId: c.id,
                 title: "Media storage not ready",
                 message: c.detail,
-                fixHint: c.provider === "cloudinary"
+                fixHint: provider === "Cloudinary"
                     ? "Fix Cloudinary Secrets (CLOUDINARY_CLOUD_NAME, CLOUDINARY_API_KEY, CLOUDINARY_API_SECRET) and restart."
-                    : c.provider === "replit-object-storage"
-                        ? "Link a Replit App Storage bucket, set TOMORROWOS_MEDIA=replit-object-storage, ensure @replit/object-storage is installed, then restart."
-                        : "Enable Object Storage for public/uploads, or configure Cloudinary for durable media URLs."
+                    : provider === "Blob"
+                        ? "Link a Vercel Blob store, set BLOB_READ_WRITE_TOKEN (and TOMORROWOS_MEDIA=vercel-blob), then redeploy."
+                        : provider === "Replit Object Storage"
+                            ? "Link a Replit App Storage bucket, set TOMORROWOS_MEDIA=replit-object-storage, ensure @replit/object-storage is installed, then restart."
+                            : "Configure Cloudinary, Vercel Blob, or Replit Object Storage for durable media URLs."
             });
         }
         if (c.id === "media" && c.state === "missing") {
@@ -259,7 +343,7 @@ function buildBlockers(connectors) {
                 connectorId: c.id,
                 title: "Media storage not configured",
                 message: c.detail,
-                fixHint: "Set Cloudinary Secrets, or ensure the CMS listens with staticRoot pointing at public/ (uploads folder)."
+                fixHint: "Set Cloudinary, Vercel Blob (BLOB_READ_WRITE_TOKEN), or ensure the CMS listens with staticRoot pointing at public/ / cms-panel/."
             });
         }
     }
@@ -280,7 +364,7 @@ export async function buildServerStatus(options) {
     const server = {
         id: "server",
         label: "Server",
-        provider: "tomorrowos",
+        provider: "TomorrowOS",
         state: "ok",
         detail: "CMS process is running"
     };

package/dist/tomorrowos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAaxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAuD1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAqE7B,iBAAiB;YAgEjB,qBAAqB;YA6BrB,mBAAmB;YA8FnB,qBAAqB;YAmCrB,sBAAsB;YAoCtB,yBAAyB;YAwDzB,yBAAyB;YAWzB,qBAAqB;YAcrB,qBAAqB;YAoGrB,uBAAuB;IA4ErC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6CjC,wBAAwB;YAiBxB,cAAc;IAuH5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YAsbV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}
+{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAaxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AA6D1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAqE7B,iBAAiB;YAgEjB,qBAAqB;YA6BrB,mBAAmB;YA8FnB,qBAAqB;YAmCrB,sBAAsB;YAoCtB,yBAAyB;YAwDzB,yBAAyB;YAWzB,qBAAqB;YAcrB,qBAAqB;YAoGrB,uBAAuB;IAqHrC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6CjC,wBAAwB;YAiBxB,cAAc;IAuH5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YAubV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}

package/dist/tomorrowos.js

@@ -10,6 +10,7 @@ import { PlaylistCatalog } from "./playlist-catalog.js";
 import { MemoryStore } from "./store/memory-store.js";
 import { resolveBrandLogoPath, syncProjectAssetsToStaticRoot } from "./brand-assets.js";
 import { createSignedUploadParams, deleteCloudinaryAsset, fetchCloudinaryResource, resolveCloudinaryConfig, uploadBufferToCloudinary } from "./cloudinary-storage.js";
+import { isVercelBlobConfigured, resolveVercelBlobMode, resolveVercelBlobToken, uploadBufferToVercelBlob } from "./vercel-blob-storage.js";
 import { probeVideoDurationMs } from "./media-probe.js";
 import { assembleChunkedUpload, cleanupChunkedUpload, cleanupStaleChunkedUploads, initChunkedUpload, MEDIA_UPLOAD_CHUNK_BYTES, storeChunkedUploadPart } from "./chunked-upload.js";
 import { buildBrightSignZipWithCmsEndpoint, resolveRequestCmsOrigin } from "./player-zip.js";
@@ -1342,6 +1343,44 @@ export class TomorrowOS extends EventEmitter {
             await this.store.setUploadedAsset(asset);
             return { asset, deduplicated: false };
         }
+        const blobMode = resolveVercelBlobMode();
+        const blobToken = resolveVercelBlobToken();
+        if (blobMode !== "off") {
+            if (!blobToken) {
+                if (blobMode === "required") {
+                    throw new Error("TOMORROWOS_MEDIA=vercel-blob requires BLOB_READ_WRITE_TOKEN. Link a Blob store to this Vercel project.");
+                }
+            }
+            else {
+                try {
+                    const storedName = buildContentAddressedNameFromHash(sha256, safeName);
+                    const uploaded = await uploadBufferToVercelBlob(body, {
+                        pathname: `uploads/${storedName}`,
+                        token: blobToken,
+                        contentType: mimeType
+                    });
+                    const asset = {
+                        id: existing?.id ?? randomUUID(),
+                        sha256,
+                        storageKey: uploaded.pathname || storedName,
+                        url: uploaded.url,
+                        originalFilename: safeName,
+                        mimeType,
+                        resourceType,
+                        bytes: body.length,
+                        createdAt: existing?.createdAt ?? now,
+                        updatedAt: now
+                    };
+                    await this.store.setUploadedAsset(asset);
+                    return { asset, deduplicated: false };
+                }
+                catch (err) {
+                    if (blobMode === "required")
+                        throw err;
+                    console.warn("[TomorrowOS] Vercel Blob upload failed; falling back:", err);
+                }
+            }
+        }
         return this.persistRelativeUpload(body, sha256, safeName, mimeType, existing, resourceType);
     }
     getAssetIdsFromItems(items) {
@@ -1665,7 +1704,8 @@ export class TomorrowOS extends EventEmitter {
                     status: "success",
                     chunked: Boolean(this.staticRoot),
                     chunkSize: MEDIA_UPLOAD_CHUNK_BYTES,
-                    cloudinary: Boolean(resolveCloudinaryConfig())
+                    cloudinary: Boolean(resolveCloudinaryConfig()),
+                    vercelBlob: isVercelBlobConfigured()
                 });
                 return;
             }

package/dist/vercel-blob-storage.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Vercel Blob media storage via `@vercel/blob`.
+ * Auto-detects `BLOB_READ_WRITE_TOKEN`; `TOMORROWOS_MEDIA=vercel-blob|blob` makes it required.
+ */
+export type VercelBlobMode = "off" | "preferred" | "required";
+export interface VercelBlobUploadResult {
+    url: string;
+    pathname: string;
+    contentType?: string;
+}
+export declare function isVercelHost(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * - `TOMORROWOS_MEDIA=vercel-blob|blob` → required
+ * - `BLOB_READ_WRITE_TOKEN` present (and media not forced elsewhere) → preferred
+ * - else → off
+ */
+export declare function resolveVercelBlobMode(env?: NodeJS.ProcessEnv): VercelBlobMode;
+export declare function resolveVercelBlobToken(env?: NodeJS.ProcessEnv): string | null;
+export declare function isVercelBlobConfigured(env?: NodeJS.ProcessEnv): boolean;
+export declare function uploadBufferToVercelBlob(body: Buffer, options: {
+    pathname: string;
+    token: string;
+    contentType?: string;
+    addRandomSuffix?: boolean;
+}): Promise<VercelBlobUploadResult>;
+/** Lightweight token / reachability check for CMS status UI. */
+export declare function pingVercelBlob(token: string): Promise<void>;
+//# sourceMappingURL=vercel-blob-storage.d.ts.map

package/dist/vercel-blob-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-blob-storage.d.ts","sourceRoot":"","sources":["../src/vercel-blob-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAIT;AAUD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GACA,OAAO,CAAC,sBAAsB,CAAC,CAejC;AAED,gEAAgE;AAChE,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjE"}

package/dist/vercel-blob-storage.js

@@ -0,0 +1,70 @@
+/**
+ * Vercel Blob media storage via `@vercel/blob`.
+ * Auto-detects `BLOB_READ_WRITE_TOKEN`; `TOMORROWOS_MEDIA=vercel-blob|blob` makes it required.
+ */
+function cleanOptional(value) {
+    const trimmed = String(value || "").trim();
+    return trimmed || undefined;
+}
+export function isVercelHost(env = process.env) {
+    return !!(env.VERCEL || env.VERCEL_ENV || env.VERCEL_URL);
+}
+/**
+ * - `TOMORROWOS_MEDIA=vercel-blob|blob` → required
+ * - `BLOB_READ_WRITE_TOKEN` present (and media not forced elsewhere) → preferred
+ * - else → off
+ */
+export function resolveVercelBlobMode(env = process.env) {
+    const media = cleanOptional(env.TOMORROWOS_MEDIA)?.toLowerCase();
+    if (media === "local" ||
+        media === "disk" ||
+        media === "filesystem" ||
+        media === "cloudinary" ||
+        media === "replit" ||
+        media === "replit-object-storage" ||
+        media === "object-storage" ||
+        media === "app-storage") {
+        return "off";
+    }
+    if (media === "vercel-blob" || media === "blob") {
+        return "required";
+    }
+    if (cleanOptional(env.BLOB_READ_WRITE_TOKEN)) {
+        return "preferred";
+    }
+    return "off";
+}
+export function resolveVercelBlobToken(env = process.env) {
+    return cleanOptional(env.BLOB_READ_WRITE_TOKEN) || null;
+}
+export function isVercelBlobConfigured(env = process.env) {
+    const mode = resolveVercelBlobMode(env);
+    if (mode === "off")
+        return false;
+    return !!resolveVercelBlobToken(env);
+}
+async function loadBlobApi() {
+    const mod = await import("@vercel/blob");
+    return { put: mod.put, list: mod.list };
+}
+export async function uploadBufferToVercelBlob(body, options) {
+    const { put } = await loadBlobApi();
+    const pathname = String(options.pathname || "upload").replace(/^\/+/, "");
+    const result = await put(pathname, body, {
+        access: "public",
+        token: options.token,
+        contentType: options.contentType,
+        addRandomSuffix: options.addRandomSuffix ?? false,
+        multipart: body.length > 4 * 1024 * 1024
+    });
+    return {
+        url: result.url,
+        pathname: result.pathname,
+        contentType: result.contentType
+    };
+}
+/** Lightweight token / reachability check for CMS status UI. */
+export async function pingVercelBlob(token) {
+    const { list } = await loadBlobApi();
+    await list({ limit: 1, token });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.66",
+  "version": "0.9.68",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",
@@ -36,6 +36,7 @@
   },
   "dependencies": {
     "@replit/object-storage": "^1.0.0",
+    "@vercel/blob": "^2.6.1",
     "better-sqlite3": "^12.11.1",
     "cloudinary": "^2.10.0",
     "fflate": "^0.8.3",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.66",
+  "version": "0.9.68",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.66",
+    "@tomorrowos/sdk": "^0.9.68",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter-v0/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.66",
+  "version": "0.9.68",
   "description": "TomorrowOS CMS for Vercel / v0 Publish (Fluid Function + WebSockets + optional Next Preview).",
   "private": true,
   "type": "module",
@@ -17,7 +17,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.66",
+    "@tomorrowos/sdk": "^0.9.68",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },