your-ai-workflow-firebase-os 1.2.33 → 1.2.34

package/dist/your-ai-workflow-firebase-os.cjs.js

@@ -7,7 +7,7 @@ RULES — these override anything you infer from the rest of the project:
 4. Use a DEFAULT export: \`export default function ${e}(...)\`. A named-only export is silently ignored by the registry.
 5. Do NOT render \`<DashboardNav />\`, a navbar, or any tab menu. The page already has one.
 6. Do NOT render an \`<h1>\` or a page title. The page already renders it.
-7. Your component renders INSIDE the page's existing panel. No full-page wrapper, no \`min-h-screen\`, no \`fixed\` positioning.`,Y="Design rules:\n- Dark glassmorphism. NO bg-white, NO text-gray-*, NO bg-indigo-*, no hard-coded colors.\n- Cards: `bg-background border border-[var(--panel-border)] rounded-2xl` (or the `glass-panel` class).\n- Text: `text-foreground`, `text-foreground/50`. Accent: `text-accent`, `bg-accent/10`.\n- Inputs: `bg-foreground/[0.03] border border-[var(--panel-border)] rounded-xl text-foreground`. Flat and clean — no glow, no highlight, no inner shadow.\n- Buttons: `btn-primary rounded-xl`. No other button styles.\n- Prebuilt UI is importable: `import { Button, Input, CustomSelect, ConfirmModal } from 'your-ai-workflow-firebase-os';`\n- Icons: `lucide-react`. Motion: `framer-motion`.",X=e=>{let t=q(e?.pageName||e?.pageId,`PublicPage`);return`${J(t)}
+7. Your component renders INSIDE the page's existing panel. No full-page wrapper, no \`min-h-screen\`, no \`fixed\` positioning.`,Y="Design rules:\n- Dark glassmorphism. NO bg-white, NO text-gray-*, NO bg-indigo-*, no hard-coded colors.\n- Cards: `bg-background border border-[var(--panel-border)] rounded-2xl` (or the `glass-panel` class).\n- Text: `text-foreground`, `text-foreground/50`. Accent: `text-accent`, `bg-accent/10`.\n- Inputs: `bg-foreground/[0.03] border border-[var(--panel-border)] rounded-xl text-foreground`. Flat and clean — no glow, no highlight, no inner shadow.\n- Buttons: `btn-primary rounded-xl`. No other button styles.\n- Prebuilt UI is importable: `import { Button, Input, CustomSelect, ConfirmModal } from 'your-ai-workflow-firebase-os';`\n- Icons: `lucide-react`. Motion: `framer-motion`.\n- NEVER touch the logo or favicon (`logoUrl` / `faviconUrl` in theme.config.ts). Only the site owner changes those, by uploading at Drive > Public and setting them in /theme.",X=e=>{let t=q(e?.pageName||e?.pageId,`PublicPage`);return`${J(t)}
 
 Create file: ${G}/${t}.tsx
 

package/dist/your-ai-workflow-firebase-os.es.js

@@ -5403,7 +5403,7 @@ RULES — these override anything you infer from the rest of the project:
 4. Use a DEFAULT export: \`export default function ${e}(...)\`. A named-only export is silently ignored by the registry.
 5. Do NOT render \`<DashboardNav />\`, a navbar, or any tab menu. The page already has one.
 6. Do NOT render an \`<h1>\` or a page title. The page already renders it.
-7. Your component renders INSIDE the page's existing panel. No full-page wrapper, no \`min-h-screen\`, no \`fixed\` positioning.`, Sn = "Design rules:\n- Dark glassmorphism. NO bg-white, NO text-gray-*, NO bg-indigo-*, no hard-coded colors.\n- Cards: `bg-background border border-[var(--panel-border)] rounded-2xl` (or the `glass-panel` class).\n- Text: `text-foreground`, `text-foreground/50`. Accent: `text-accent`, `bg-accent/10`.\n- Inputs: `bg-foreground/[0.03] border border-[var(--panel-border)] rounded-xl text-foreground`. Flat and clean — no glow, no highlight, no inner shadow.\n- Buttons: `btn-primary rounded-xl`. No other button styles.\n- Prebuilt UI is importable: `import { Button, Input, CustomSelect, ConfirmModal } from 'your-ai-workflow-firebase-os';`\n- Icons: `lucide-react`. Motion: `framer-motion`.", Cn = (e) => {
+7. Your component renders INSIDE the page's existing panel. No full-page wrapper, no \`min-h-screen\`, no \`fixed\` positioning.`, Sn = "Design rules:\n- Dark glassmorphism. NO bg-white, NO text-gray-*, NO bg-indigo-*, no hard-coded colors.\n- Cards: `bg-background border border-[var(--panel-border)] rounded-2xl` (or the `glass-panel` class).\n- Text: `text-foreground`, `text-foreground/50`. Accent: `text-accent`, `bg-accent/10`.\n- Inputs: `bg-foreground/[0.03] border border-[var(--panel-border)] rounded-xl text-foreground`. Flat and clean — no glow, no highlight, no inner shadow.\n- Buttons: `btn-primary rounded-xl`. No other button styles.\n- Prebuilt UI is importable: `import { Button, Input, CustomSelect, ConfirmModal } from 'your-ai-workflow-firebase-os';`\n- Icons: `lucide-react`. Motion: `framer-motion`.\n- NEVER touch the logo or favicon (`logoUrl` / `faviconUrl` in theme.config.ts). Only the site owner changes those, by uploading at Drive > Public and setting them in /theme.", Cn = (e) => {
 	let t = bn(e?.pageName || e?.pageId, "PublicPage");
 	return `${xn(t)}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "your-ai-workflow-firebase-os",
-  "version": "1.2.33",
+  "version": "1.2.34",
   "description": "A complete Firebase-powered admin OS — one React component.",
   "type": "module",
   "main": "dist/your-ai-workflow-firebase-os.cjs.js",

package/scripts/logoProtection.test.ts

@@ -0,0 +1,70 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * The logo and favicon are the site owner's brand. An assistant asked to
+ * "rebrand" would happily rewrite logoUrl — the config file even invited it
+ * with a plain "Links to your logo and favicon" comment, and the generated
+ * contract listed logoUrl among the things to change.
+ *
+ * Read from disk: vitest stubs .css out and these are cross-project files.
+ */
+const read = (p: string) => readFileSync(resolve(process.cwd(), p), 'utf8');
+
+const themeConfig = read('src/configs/theme.config.ts');
+const postinstall = read('scripts/postinstall.js');
+const promptShared = read('src/prompts/shared.ts');
+
+describe('the logo is off limits to the AI', () => {
+  it('the config file warns right above the two values', () => {
+    const at = themeConfig.indexOf('logoUrl:');
+    expect(at).toBeGreaterThan(-1);
+    const preamble = themeConfig.slice(Math.max(0, at - 900), at);
+    expect(preamble).toContain('DO NOT EDIT');
+    // The old comment read as an invitation to set them.
+    expect(preamble).not.toMatch(/^\s*\/\/ Links to your logo and favicon/m);
+  });
+
+  it('the generated contract forbids it outright', () => {
+    expect(postinstall).toContain('off limits');
+    expect(postinstall).toMatch(/NEVER touch either one/);
+  });
+
+  it('the generated contract no longer lists the logo as editable', () => {
+    // It used to appear in the "and globally:" list of theme keys to change.
+    const at = postinstall.indexOf('and globally:');
+    expect(at).toBeGreaterThan(-1);
+    const keyList = postinstall.slice(at, at + 400);
+    expect(keyList).not.toContain('logoUrl');
+    expect(keyList).not.toContain('faviconUrl');
+  });
+
+  it('names the owner-only upload route instead', () => {
+    expect(postinstall).toContain('Drive > Public');
+    expect(postinstall).toContain('/theme');
+  });
+
+  it('survives a rebrand request', () => {
+    expect(postinstall).toMatch(/leave the logo image and the favicon exactly as they are/);
+  });
+
+  it('locks the favicon as firmly as the logo', () => {
+    for (const src of [themeConfig, postinstall, promptShared]) {
+      expect(src).toContain('faviconUrl');
+    }
+    const at = postinstall.indexOf('off limits');
+    expect(postinstall.slice(at, at + 900)).toContain('faviconUrl');
+  });
+
+  it('still allows the app name to be changed', () => {
+    // The owner explicitly wants appName editable; only the icon is locked.
+    expect(postinstall).toMatch(/app NAME is different and you MAY change it/);
+    const at = postinstall.indexOf('and globally:');
+    expect(postinstall.slice(at, at + 400)).toContain('appName');
+  });
+
+  it('every generated prompt carries the rule too', () => {
+    expect(promptShared).toMatch(/NEVER touch the logo or favicon/);
+  });
+});

package/scripts/postinstall.js

@@ -397,7 +397,7 @@ textGradient: ['#f0eeff', '#c4b5fd'],  // gradient used by page titles
 selectionBg, selectionText,
 \`\`\`
 
-and globally: \`appName\`, \`logoUrl\`, \`faviconUrl\`,
+and globally: \`appName\`,
 \`defaultTheme\` (\`'system' | 'light' | 'dark'\`), \`showThemeToggle\`,
 \`fontFamily\` (Inter, Outfit, Roboto, Space Grotesk, Plus Jakarta Sans,
 System UI), \`cornerRounding\` (\`'default' | 'custom'\`) and \`cornerRadii\`
@@ -406,6 +406,24 @@ System UI), \`cornerRounding\` (\`'default' | 'custom'\`) and \`cornerRadii\`
 ALWAYS set both \`colors.dark\` and \`colors.light\`. Editing only one leaves the
 other theme unreadable.
 
+### The logo image and the favicon are off limits
+
+\`logoUrl\` is the icon shown in the top bar; \`faviconUrl\` is the browser tab
+icon. NEVER touch either one. Do not set them, do not clear them, do not swap
+them, do not "improve" them, and never point them at a placeholder or at an
+image you generated. They are the owner's brand.
+
+Only the owner changes them, and only by uploading an image under
+Drive > Public and pasting its URL into \`/theme\`.
+
+The app NAME is different and you MAY change it: \`appName\` is ordinary text
+and is fair game when asked.
+
+So this holds even during a rebrand: change the colours, the fonts and
+\`appName\` freely — leave the logo image and the favicon exactly as they are.
+If someone asks you to change the logo, tell them to upload it at
+Drive > Public and set it in \`/theme\`, and do not edit the file.
+
 ## Creating a page, a tab or a form
 
 You can create these yourself. They are auto-discovered config files — no

package/src/configs/theme.config.ts

@@ -17,7 +17,15 @@ export const themeConfig = {
   // Show or hide the Sun/Moon toggle button in the top menu
   showThemeToggle: true,
 
-  // Links to your logo and favicon (Can be a URL or a local path like /favicon.svg)
+  // ── DO NOT EDIT: logoUrl / faviconUrl ───────────────────────────────────
+  // logoUrl is the icon in the top bar; faviconUrl is the browser tab icon.
+  // Both belong to the site owner and are changed ONLY by the owner, by
+  // uploading an image under Drive > Public and pasting its URL into /theme.
+  // An AI assistant must never set, clear, swap or "improve" these two
+  // values, and must never point them at a placeholder or a generated image.
+  // Leave both exactly as they are. (appName above is text, and may be
+  // changed freely.)
+  // (Can be a URL or a local path like /favicon.svg)
   logoUrl: 'https://firebasestorage.googleapis.com/v0/b/fir-os-47863.firebasestorage.app/o/pub_files%2F1776321238933_favicon_smaller.png?alt=media&token=efecb55c-2456-4cbe-a20a-b86db54a1e55',
   faviconUrl: 'https://firebasestorage.googleapis.com/v0/b/fir-os-47863.firebasestorage.app/o/pub_files%2F1776321238933_favicon_smaller.png?alt=media&token=efecb55c-2456-4cbe-a20a-b86db54a1e55',
 

package/src/prompts/shared.ts

@@ -53,4 +53,5 @@ export const design = `Design rules:
 - Inputs: \`bg-foreground/[0.03] border border-[var(--panel-border)] rounded-xl text-foreground\`. Flat and clean — no glow, no highlight, no inner shadow.
 - Buttons: \`btn-primary rounded-xl\`. No other button styles.
 - Prebuilt UI is importable: \`import { Button, Input, CustomSelect, ConfirmModal } from 'your-ai-workflow-firebase-os';\`
-- Icons: \`lucide-react\`. Motion: \`framer-motion\`.`;
+- Icons: \`lucide-react\`. Motion: \`framer-motion\`.
+- NEVER touch the logo or favicon (\`logoUrl\` / \`faviconUrl\` in theme.config.ts). Only the site owner changes those, by uploading at Drive > Public and setting them in /theme.`;