sproutkit-code 1.2.2 → 1.4.0

package/dist/commands/sproutkit-book.md

@@ -0,0 +1,18 @@
+---
+description: Build a booking site (for a lead, or any business by name)
+argument-hint: "<leadId> | \"Business Name, Town\" [--standalone]"
+allowed-tools: Bash(sproutkit *)
+---
+Build a booking site. The operator asked: $ARGUMENTS
+
+Use `sproutkit book`. Notes:
+- A lead id adds booking onto a site Sproutkit already built (same domain, /book).
+- `--standalone` gives a booking site on its OWN url — for a client who already
+  has their own website and just needs bookings.
+- A business NAME instead of an id works even if they aren't a lead yet: it looks
+  them up, reads their site, and builds a booking page in one shot.
+- `--archetype slots|reservation|enquiry`, `--instructions "…"`, `--email owner@x`.
+
+Booking sites include a client `/admin` panel. The result carries `adminUrl` and
+`adminPassword` — ALWAYS pass both on to the operator. The password is shown only
+at build time, so if you swallow it the client can't log in.

package/dist/commands/sproutkit-build.md

@@ -0,0 +1,18 @@
+---
+description: Build a demo website for a lead
+argument-hint: "<leadId> [--multipage] [instructions]"
+allowed-tools: Bash(sproutkit *)
+---
+Build a site. The operator asked: $ARGUMENTS
+
+Use `sproutkit build <leadId>`. Notes:
+- `--multipage` gives real separate pages instead of one long scroll.
+- Put any styling or content steer in `--instructions "…"`.
+- `--skip-qa` only if they want speed over polish.
+- No lead id given? Show `sproutkit list --status discovered` and ask which one.
+
+Every generated site carries a DEMO banner by design — that's what stops clients
+using the free preview as their real site. Don't try to remove it here; that's
+what `/sproutkit-handover` does once they've paid.
+
+When it's done, give the operator the live URL.

package/dist/commands/sproutkit-find.md

@@ -0,0 +1,15 @@
+---
+description: Find local businesses with no website (or no online booking)
+argument-hint: "[area] e.g. Leeds LS1, or \"Swansea --no-booking\""
+allowed-tools: Bash(sproutkit *)
+---
+Find new leads. The operator asked for: $ARGUMENTS
+
+Run `sproutkit find` with that area. Notes:
+- Default finds businesses with NO website. If they mention booking, WhatsApp
+  bookings, or "has a site already", add `--mode no_booking` instead.
+- Pass `--categories` only if they named specific trades.
+- Results stream in as each category returns, so let it finish before summarising.
+
+Then report how many were found and the most promising few, with a one-line
+reason each. Don't build anything yet.

package/dist/commands/sproutkit-handover.md

@@ -0,0 +1,22 @@
+---
+description: Hand a finished site to a paying client (removes the DEMO banner)
+argument-hint: "<leadId> [--domain thesalon.co.uk]"
+allowed-tools: Bash(sproutkit *)
+---
+Hand over a site. The operator asked: $ARGUMENTS
+
+This is the PAID-DELIVERABLE step. It removes the DEMO banner from a live site,
+attaches the client's domain, and marks the lead won. The banner is what stops a
+client using a free preview as their real site, so:
+
+1. Confirm the operator is telling you this client has PAID or signed off. If
+   that isn't explicit, ask — don't infer it from the site looking finished.
+2. Then run `sproutkit handover <leadId> --yes` (add `--domain x.co.uk` if given).
+   The command refuses without `--yes` by design.
+
+Afterwards, relay the whole credentials sheet verbatim: site URL, /admin panel
+and password, booking page and its password, and any DNS records the client has
+to set at their registrar. That output is the client handover — don't summarise
+the passwords away.
+
+To re-check whether a domain's DNS has propagated, run the same command again.

package/dist/commands/sproutkit-leads.md

@@ -0,0 +1,16 @@
+---
+description: Show current leads and their stage
+argument-hint: "[filter] e.g. site_built, or Leeds"
+allowed-tools: Bash(sproutkit *)
+---
+Leads:
+
+!`sproutkit list --compact 2>/dev/null`
+
+The operator asked to see: $ARGUMENTS
+
+Every lead is listed above (one JSON object per line, nothing truncated).
+
+Show the matching leads as a compact table — id, name, town, stage, and whether
+they have a site / booking page. If they didn't narrow it down, group by stage.
+Read-only: don't build, contact, or change anything.

package/dist/commands/sproutkit-outreach.md

@@ -0,0 +1,17 @@
+---
+description: Prepare outreach messages for leads with a built site
+argument-hint: "[--ids 3,5] [--channel sms|whatsapp|email]"
+allowed-tools: Bash(sproutkit *)
+---
+Prepare outreach. The operator asked: $ARGUMENTS
+
+This CONTACTS REAL BUSINESSES and moves leads to Contacted, so:
+
+1. First run `sproutkit list --status site_built --json` and show exactly who is
+   about to be contacted, with a count.
+2. Ask the operator to confirm before running `sproutkit outreach`.
+3. Only then run it. Never add `--ids` you invented — use the ones they gave.
+
+Routing is per-lead automatically: mobile number → SMS/WhatsApp, otherwise email
+(harvesting the address if needed). Only pass `--channel` if they asked for a
+specific one.

package/dist/commands/sproutkit-pipeline.md

@@ -0,0 +1,20 @@
+---
+description: Run the full pipeline — build then prepare outreach, in parallel
+argument-hint: "[x3] [--book] [--limit 10]"
+allowed-tools: Bash(sproutkit *)
+---
+Run the pipeline. The operator asked: $ARGUMENTS
+
+This builds sites AND prepares outreach to real businesses, for many leads at
+once. Before running:
+
+1. Show which leads are queued (`sproutkit list --status discovered --json`) and
+   the count.
+2. Confirm with the operator.
+3. Run `sproutkit pipeline x<N>` where N is the concurrency they asked for
+   (default 3). Add `--book` to include a booking page, `--limit`/`--ids` to
+   scope it.
+
+It prints a live board and can be stopped with the stop key. When it finishes,
+report how many succeeded, and pass on any client admin panel credentials it
+printed.

package/dist/commands/sproutkit.md

@@ -0,0 +1,15 @@
+---
+description: Sproutkit — show the pipeline and what to do next
+allowed-tools: Bash(sproutkit *)
+---
+Current pipeline:
+
+!`sproutkit list --compact 2>/dev/null`
+
+Setup check:
+
+!`sproutkit doctor 2>&1 | tail -20`
+
+Summarise the pipeline for the operator in a few lines: how many leads at each
+stage, and the single most useful next action. Mention any setup problem the
+doctor output reveals. Don't run anything else unless asked.

package/dist/index.js

@@ -183,6 +183,17 @@ var require_db = __commonJS({
         } catch {
         }
       }
+      for (const col of [
+        "booking_admin_url TEXT",
+        "booking_admin_password TEXT",
+        "handed_over_at TEXT",
+        "custom_domain TEXT"
+      ]) {
+        try {
+          db2.exec(`ALTER TABLE leads ADD COLUMN ${col}`);
+        } catch {
+        }
+      }
       try {
         db2.exec("ALTER TABLE leads ADD COLUMN dead_at TEXT");
       } catch {
@@ -31050,6 +31061,121 @@ export default function App() {
   }
 });
 
+// ../desktop/dist/main/lib/vercel-domains.js
+var require_vercel_domains = __commonJS({
+  "../desktop/dist/main/lib/vercel-domains.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.attachDomain = attachDomain;
+    exports2.domainStatus = domainStatus;
+    var axios_1 = __importDefault(require_axios());
+    function qs(teamId) {
+      return teamId ? `?teamId=${encodeURIComponent(teamId)}` : "";
+    }
+    function isApex(domain) {
+      const parts = domain.split(".");
+      if (parts.length <= 2)
+        return true;
+      const twoPartSuffixes = ["co.uk", "org.uk", "me.uk", "ac.uk", "com.au", "co.nz", "co.za", "com.br"];
+      return parts.length === 3 && twoPartSuffixes.includes(parts.slice(-2).join("."));
+    }
+    async function fetchConfig(domain, projectId, vercelToken, teamId) {
+      try {
+        const params = new URLSearchParams({ projectIdOrName: projectId });
+        if (teamId)
+          params.set("teamId", teamId);
+        const res = await axios_1.default.get(`https://api.vercel.com/v6/domains/${encodeURIComponent(domain)}/config?${params.toString()}`, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        return res.data;
+      } catch {
+        return null;
+      }
+    }
+    function recordsFrom(domain, cfg) {
+      const apex = isApex(domain);
+      if (!cfg)
+        return [];
+      if (apex) {
+        const ip = cfg.recommendedIPv4?.find((r) => r.rank === 1)?.value?.[0] ?? cfg.recommendedIPv4?.[0]?.value?.[0];
+        if (!ip)
+          return [];
+        return [{ type: "A", name: "@", value: ip, note: "root domain" }];
+      }
+      const target = cfg.recommendedCNAME?.find((r) => r.rank === 1)?.value ?? cfg.recommendedCNAME?.[0]?.value;
+      if (!target)
+        return [];
+      const sub = domain.split(".")[0];
+      return [{ type: "CNAME", name: sub, value: target }];
+    }
+    async function attachDomain(args) {
+      const { vercelToken, projectId, teamId } = args;
+      const domain = args.domain.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+      if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(domain)) {
+        throw new Error(`"${args.domain}" doesn't look like a domain name (expected e.g. thesalon.co.uk).`);
+      }
+      let verified = false;
+      let alreadyAttached = false;
+      let apexName = domain;
+      let ownershipChallenges = [];
+      let warning;
+      try {
+        const res = await axios_1.default.post(`https://api.vercel.com/v10/projects/${encodeURIComponent(projectId)}/domains${qs(teamId)}`, { name: domain }, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        verified = !!res.data.verified;
+        apexName = res.data.apexName ?? domain;
+        ownershipChallenges = (res.data.verification ?? []).filter((v) => v.type?.toUpperCase() === "TXT").map((v) => ({ type: "TXT", name: v.domain, value: v.value, note: v.reason }));
+      } catch (e) {
+        const err = e;
+        const status = err.response?.status;
+        const msg = err.response?.data?.error?.message ?? e.message;
+        if (status === 400) {
+          alreadyAttached = true;
+        } else if (status === 409) {
+          throw new Error(`${domain} is already attached to a different Vercel project or account. Remove it there first, then retry. (${msg})`);
+        } else if (status === 402) {
+          throw new Error(`Vercel needs a payment method on the account before adding a custom domain. (${msg})`);
+        } else if (status === 403) {
+          throw new Error(`Your Vercel token doesn't have permission to add ${domain}. (${msg})`);
+        } else {
+          throw new Error(`Couldn't attach ${domain}: ${msg}`);
+        }
+      }
+      const cfg = await fetchConfig(domain, projectId, vercelToken, teamId);
+      const records = recordsFrom(domain, cfg);
+      if (!records.length) {
+        warning = "Couldn't read the DNS records from Vercel. Open the project's Domains tab in the Vercel dashboard to see the exact A/CNAME values.";
+      }
+      return {
+        domain,
+        apexDomain: apexName,
+        verified,
+        dnsConfigured: cfg ? cfg.misconfigured === false : false,
+        alreadyAttached,
+        records,
+        ownershipChallenges,
+        warning
+      };
+    }
+    async function domainStatus(args) {
+      const { domain, projectId, vercelToken, teamId } = args;
+      let verified = false;
+      try {
+        const res = await axios_1.default.get(`https://api.vercel.com/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}${qs(teamId)}`, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        verified = !!res.data.verified;
+      } catch {
+      }
+      const cfg = await fetchConfig(domain, projectId, vercelToken, teamId);
+      return {
+        domain,
+        verified,
+        dnsConfigured: cfg ? cfg.misconfigured === false : false,
+        records: recordsFrom(domain, cfg)
+      };
+    }
+  }
+});
+
 // ../../node_modules/bcryptjs/umd/index.js
 var require_umd = __commonJS({
   "../../node_modules/bcryptjs/umd/index.js"(exports2, module2) {
@@ -33287,13 +33413,23 @@ export default async function handler(req, res) {
     var s = useState(null);
     var v = s[0], set = s[1];
     var loading = useState(true);
+    // Standalone booking sites ship /api/bookings but NO /api/content. Treat a
+    // missing content API as "this is a bookings-only site" instead of hanging
+    // the whole panel on a permanent Loading\u2026 state.
+    var available = useState(true);
     useEffect(function () {
-      fetch("/api/content").then(function (r) { return r.json(); }).then(function (d) {
+      fetch("/api/content").then(function (r) {
+        if (!r.ok) throw new Error("no content api");
+        return r.json();
+      }).then(function (d) {
         set(d);
         loading[1](false);
+      }).catch(function () {
+        available[1](false);
+        loading[1](false);
       });
     }, []);
-    return { content: v, setContent: set, loading: loading[0] };
+    return { content: v, setContent: set, loading: loading[0], available: available[0] };
   }
 
   function Login(props) {
@@ -33823,7 +33959,7 @@ export default async function handler(req, res) {
     );
   }
 
-  function BookingsPanel() {
+  function BookingsPanel(props) {
     var sub = useState("incoming");
     var b = useBookings();
     var c = useBookingConfig();
@@ -33832,7 +33968,7 @@ export default async function handler(req, res) {
         h("div", null,
           h("div", { style: { fontSize: 15, fontWeight: 600 } }, "Bookings"),
           h("div", { style: { fontSize: 12, color: "var(--muted)" } },
-            h("a", { href: "/book", target: "_blank" }, "Public booking page \u2192")
+            h("a", { href: props && props.bookingPath ? props.bookingPath : "/book", target: "_blank" }, "Public booking page \u2192")
           )
         ),
         h("div", { style: { display: "flex", gap: 4 } },
@@ -33861,9 +33997,14 @@ export default async function handler(req, res) {
     if (!authed[0]) {
       return h(Login, { onLogin: function () { authed[1](true); } });
     }
-    if (ctl.loading || !ctl.content) {
+    if (ctl.loading) {
       return h("div", { className: "app" }, "Loading\u2026");
     }
+    // Bookings-only site: no Site content tab to switch to, and the public
+    // booking page is the site root rather than /book.
+    if (!ctl.available || !ctl.content) {
+      return h("div", { className: "app" }, h(BookingsPanel, { bookingPath: "/" }));
+    }
 
     // Top nav lets the owner flip between Site content and Bookings.
     return h("div", { className: "app" },
@@ -34339,6 +34480,7 @@ export default async function handler(req, res) {
   </style>
 </head>
 <body>
+  <!--SPROUTKIT_BANNER-->
   <div id="root"></div>
   <script src="https://unpkg.com/react@18/umd/react.production.min.js" crossorigin></script>
   <script src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js" crossorigin></script>
@@ -79659,6 +79801,7 @@ var require_builder = __commonJS({
     exports2.redeployCmsOnly = redeployCmsOnly;
     exports2.deployBookingOnly = deployBookingOnly2;
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
+    exports2.handoverSite = handoverSite2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
     var crypto_1 = require("crypto");
@@ -79670,6 +79813,7 @@ var require_builder = __commonJS({
     var path3 = __importStar(require("path"));
     var models_1 = require_models();
     var cms_template_1 = require_cms_template();
+    var vercel_domains_1 = require_vercel_domains();
     var cms_runtime_1 = require_cms_runtime();
     var booking_runtime_1 = require_booking_runtime();
     function siteUidFor(leadId) {
@@ -79744,7 +79888,18 @@ var require_builder = __commonJS({
       const pattern = new RegExp(`https?:\\/\\/[^\\s"'\`)]*(${STOCK_HOSTS.map((h) => h.replace(/\./g, "\\.")).join("|")})[^\\s"'\`)]*`, "gi");
       return code.replace(pattern, "");
     }
-    function demoBanner(businessName) {
+    function bannerFor(lead) {
+      let handedOver = false;
+      try {
+        const row = (0, db_1.getDb)().get("SELECT handed_over_at FROM leads WHERE id = ?", [lead.id]);
+        handedOver = !!row?.handed_over_at;
+      } catch {
+      }
+      return demoBanner(lead.name, handedOver);
+    }
+    function demoBanner(businessName, handedOver) {
+      if (handedOver)
+        return "";
       const esc = (v) => v.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
       const label = `Preview site for ${esc(businessName)}`;
       return `<div id="sproutkit-demo-banner" role="note" style="all:initial;display:block;box-sizing:border-box;width:100%;background:#1f2937;color:#f9fafb;font-family:ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;font-size:13px;line-height:1.4;padding:10px 16px;text-align:center;letter-spacing:.01em">
@@ -80324,7 +80479,7 @@ ${prompt}` : prompt;
       onProgress("Deploying to Vercel...");
       const indexHtml = `<!DOCTYPE html>
 <html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head>
-<body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+<body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsx = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80519,7 +80674,7 @@ export default defineConfig({ plugins: [react()] });`;
           { source: "/book/", destination: "/book/index.html" }
         ]
       });
-      const indexHtmlCms = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      const indexHtmlCms = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsxCms = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80596,7 +80751,7 @@ export default defineConfig({ plugins: [react()] });`;
       snapshot[appJsxIndex] = { ...snapshot[appJsxIndex], data: modifiedApp };
       saveSnapshot(lead.id, snapshot);
       const files = snapshot.map((f) => ({ file: f.file, data: f.data, encoding: f.encoding }));
-      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsx = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80668,7 +80823,13 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "vercel.json", data: vercelJson, encoding: "utf-8" },
         { file: "api/bookings.js", data: booking_runtime_1.API_BOOKINGS_JS, encoding: "utf-8" },
         { file: "api/booking-config.js", data: booking_runtime_1.API_BOOKING_CONFIG_JS, encoding: "utf-8" },
-        { file: "public/book/index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
+        {
+          file: "public/book/index.html",
+          // The parent site's index.html already carries the banner; this page
+          // just needs the placeholder removed.
+          data: booking_runtime_1.BOOK_INDEX_HTML.replace("<!--SPROUTKIT_BANNER-->", ""),
+          encoding: "utf-8"
+        },
         { file: "public/book/app.js", data: booking_runtime_1.BOOK_APP_JS, encoding: "utf-8" },
         // Refresh the CMS admin app (contains the Bookings tab now)
         { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" },
@@ -80695,8 +80856,8 @@ export default defineConfig({ plugins: [react()] });`;
     }
     async function deployStandaloneBooking2(args) {
       const { lead, vercelToken, blobToken, resendKey, ownerEmail, bookingConfig, onProgress } = args;
-      const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
-      const projectName = `sprout-book-${lead.id}-${slug}`;
+      const adminPassword = args.reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
+      const projectName = standaloneBookingProjectName(lead);
       onProgress("Seeding booking config\u2026");
       const standaloneSiteUid = siteUidFor(lead.id);
       try {
@@ -80712,18 +80873,39 @@ export default defineConfig({ plugins: [react()] });`;
         throw new Error(`Failed to seed booking config: ${e.message}`);
       }
       onProgress("Setting booking env vars\u2026");
+      const adminHash = await (0, cms_runtime_1.hashPassword)(adminPassword);
       await setProjectEnv(projectName, vercelToken, {
         RESEND_API_KEY: resendKey,
         OWNER_EMAIL: ownerEmail,
         BUSINESS_NAME: lead.name,
         BLOB_READ_WRITE_TOKEN: blobToken,
-        SITE_ID: standaloneSiteUid
+        SITE_ID: standaloneSiteUid,
+        // Admin panel auth.
+        ADMIN_PASSWORD_HASH: adminHash,
+        SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
         { file: "app.js", data: booking_runtime_1.BOOK_APP_JS, encoding: "utf-8" },
         { file: "api/bookings.js", data: booking_runtime_1.API_BOOKINGS_JS, encoding: "utf-8" },
         { file: "api/booking-config.js", data: booking_runtime_1.API_BOOKING_CONFIG_JS, encoding: "utf-8" },
+        // The client's own dashboard: view bookings, edit services/hours. Same
+        // admin the CMS sites use — it already has a Bookings tab.
+        { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" },
+        { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
+        { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
+        { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+        // Serve /admin without a trailing-slash redirect dance.
+        {
+          file: "vercel.json",
+          data: JSON.stringify({
+            rewrites: [
+              { source: "/admin", destination: "/admin/index.html" },
+              { source: "/admin/", destination: "/admin/index.html" }
+            ]
+          }),
+          encoding: "utf-8"
+        },
         {
           file: "package.json",
           data: JSON.stringify({
@@ -80731,14 +80913,15 @@ export default defineConfig({ plugins: [react()] });`;
             private: true,
             version: "0.1.0",
             type: "module",
-            dependencies: { "@vercel/blob": "^0.23.4" }
+            // bcryptjs is required by api/admin/login.js.
+            dependencies: { "@vercel/blob": "^0.23.4", bcryptjs: "^2.4.3" }
           }),
           encoding: "utf-8"
         }
       ];
       files[0] = {
         file: "index.html",
-        data: booking_runtime_1.BOOK_INDEX_HTML.replace(/\/book\/app\.js/g, "/app.js"),
+        data: booking_runtime_1.BOOK_INDEX_HTML.replace(/\/book\/app\.js/g, "/app.js").replace("<!--SPROUTKIT_BANNER-->", bannerFor(lead)),
         encoding: "utf-8"
       };
       onProgress("Deploying booking site\u2026");
@@ -80765,7 +80948,154 @@ export default defineConfig({ plugins: [react()] });`;
         fallbackUrl: `https://${res.data.url}`
       });
       onProgress(`Live at ${publicUrl}`);
-      return { url: publicUrl, bookingUrl: publicUrl };
+      return {
+        url: publicUrl,
+        bookingUrl: publicUrl,
+        admin: { url: `${publicUrl}/admin`, password: adminPassword }
+      };
+    }
+    async function handoverSite2(args) {
+      const { lead, vercelToken, blobToken, domain, teamId, onProgress } = args;
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get(`SELECT site_url, booking_url, admin_url, admin_password,
+            booking_admin_url, booking_admin_password, handed_over_at, site_uid
+     FROM leads WHERE id = ?`, [lead.id]);
+      if (!row)
+        throw new Error("Lead not found");
+      if (!row.site_url && !row.booking_url) {
+        throw new Error("Nothing to hand over \u2014 this lead has no site and no booking page yet. Build one first.");
+      }
+      const alreadyHandedOver = !!row.handed_over_at;
+      db2.run("UPDATE leads SET handed_over_at = COALESCE(handed_over_at, datetime('now')) WHERE id = ?", [
+        lead.id
+      ]);
+      let url = row.site_url ?? row.booking_url ?? "";
+      let bannerRemoved = false;
+      if (row.site_url) {
+        try {
+          onProgress("Rebuilding site without the demo banner\u2026");
+          const result = await redeployWithoutBanner({
+            lead,
+            vercelToken,
+            blobToken: blobToken ?? null,
+            hasCms: !!row.admin_url,
+            adminPassword: row.admin_password,
+            siteUid: row.site_uid,
+            onProgress
+          });
+          url = result.url;
+          bannerRemoved = true;
+        } catch (e) {
+          db2.run("UPDATE leads SET handed_over_at = ? WHERE id = ?", [row.handed_over_at, lead.id]);
+          throw new Error(`Couldn't rebuild the site without the banner: ${e.message}`);
+        }
+      }
+      let domainInfo;
+      if (domain) {
+        onProgress(`Attaching ${domain}\u2026`);
+        const projectId = row.site_url ? projectNameFor(lead) : standaloneBookingProjectName(lead);
+        const attached = await (0, vercel_domains_1.attachDomain)({ domain, projectId, vercelToken, teamId });
+        domainInfo = {
+          domain: attached.domain,
+          verified: attached.verified,
+          dnsConfigured: attached.dnsConfigured,
+          records: attached.records,
+          ownershipChallenges: attached.ownershipChallenges,
+          warning: attached.warning
+        };
+        db2.run("UPDATE leads SET custom_domain = ? WHERE id = ?", [attached.domain, lead.id]);
+      }
+      return {
+        url,
+        admin: row.admin_url && row.admin_password ? { url: row.admin_url, password: row.admin_password } : void 0,
+        bookingUrl: row.booking_url ?? void 0,
+        bookingAdmin: row.booking_admin_url && row.booking_admin_password ? { url: row.booking_admin_url, password: row.booking_admin_password } : void 0,
+        domain: domainInfo,
+        bannerRemoved,
+        alreadyHandedOver
+      };
+    }
+    async function redeployWithoutBanner(args) {
+      const { lead, vercelToken, blobToken, hasCms, adminPassword, siteUid, onProgress } = args;
+      const projectName = projectNameFor(lead);
+      onProgress("Loading site source\u2026");
+      const snapshot = loadSnapshot(lead.id);
+      if (!snapshot || !snapshot.some((f) => f.file === "src/App.jsx")) {
+        throw new Error("No local snapshot of this site. Run `sproutkit regenerate` once to save one, then hand over again.");
+      }
+      const files = snapshot.map((f) => ({
+        file: f.file,
+        data: f.data,
+        encoding: f.encoding
+      }));
+      const multipage = /react-router-dom/.test(snapshot.find((f) => f.file === "src/App.jsx")?.data ?? "");
+      const deps = { react: "^18.3.1", "react-dom": "^18.3.1" };
+      if (multipage)
+        deps["react-router-dom"] = "^6.26.2";
+      if (hasCms) {
+        deps["@vercel/blob"] = "^0.23.4";
+        deps.bcryptjs = "^2.4.3";
+      }
+      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      files.push({ file: "index.html", data: indexHtml, encoding: "utf-8" }, {
+        file: "src/main.jsx",
+        data: `import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+import App from './App.jsx';
+createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMode>);`,
+        encoding: "utf-8"
+      }, {
+        file: "vite.config.js",
+        data: `import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+export default defineConfig({ plugins: [react()] });`,
+        encoding: "utf-8"
+      }, {
+        file: "package.json",
+        data: JSON.stringify({
+          name: "sprout-site",
+          private: true,
+          version: "0.1.0",
+          type: "module",
+          scripts: { build: "vite build", dev: "vite" },
+          dependencies: deps,
+          devDependencies: { "@vitejs/plugin-react": "^4.3.1", vite: "^5.4.2" }
+        }),
+        encoding: "utf-8"
+      });
+      if (hasCms && adminPassword && blobToken) {
+        onProgress("Preserving the admin panel\u2026");
+        files.push({
+          file: "vercel.json",
+          data: JSON.stringify({
+            rewrites: [
+              { source: "/admin", destination: "/admin/index.html" },
+              { source: "/admin/", destination: "/admin/index.html" },
+              { source: "/book", destination: "/book/index.html" },
+              { source: "/book/", destination: "/book/index.html" }
+            ]
+          }),
+          encoding: "utf-8"
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        const env = {
+          BLOB_READ_WRITE_TOKEN: blobToken,
+          ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
+          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+          BUSINESS_NAME: lead.name
+        };
+        if (siteUid)
+          env.SITE_ID = siteUid;
+        await setProjectEnv(projectName, vercelToken, env);
+      }
+      onProgress("Deploying\u2026");
+      const res = await postVercelDeployment({ name: projectName, files, projectSettings: { framework: "vite" }, target: "production" }, vercelToken, onProgress);
+      const url = await stableProjectUrl({
+        projectName,
+        vercelToken,
+        fallbackUrl: `https://${res.data.url}`
+      });
+      onProgress(`Live at ${url}`);
+      return { url };
     }
     function hasBookLink(code) {
       return /(href\s*=\s*["'`{]*\s*["'`]?\/book\/?["'`}]?)|(location(?:\.href)?\s*=\s*["'`]\/book["'`])/i.test(code);
@@ -80908,6 +81238,10 @@ Return this exact shape:
         return null;
       }
     }
+    function standaloneBookingProjectName(lead) {
+      const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
+      return `sprout-book-${lead.id}-${slug}`;
+    }
     function projectNameFor(lead) {
       const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 30);
       return `sprout-${lead.id}-${slug}`;
@@ -93317,6 +93651,24 @@ var require_chat_tools = __commonJS({
         },
         requiresConfirmation: true
       },
+      {
+        name: "hand_over_site",
+        description: "HAND OVER a finished site to the paying client: removes the DEMO/preview banner, optionally attaches the client's own domain, and returns every credential in one place (site URL, /admin panel + password, booking page + its password, and the DNS records the client must set at their registrar). This is the paid-deliverable step \u2014 the banner exists to stop clients using a free demo as their real site, so only run this when the user says the client has paid / signed off / is going live. Requires the lead to already have a built site or booking page.",
+        input_schema: {
+          type: "object",
+          properties: {
+            id: { type: "number", description: "Lead id to hand over." },
+            domain: {
+              type: "string",
+              description: "Optional: the client's own domain, e.g. 'thesalon.co.uk' or 'www.thesalon.co.uk'. Attaches it to the project and returns the exact DNS records to configure. Omit to keep the site on its .vercel.app URL."
+            }
+          },
+          required: ["id"]
+        },
+        // Commercial + hard to walk back: it unbrands a live client site and marks
+        // the lead won. Always ask first.
+        requiresConfirmation: true
+      },
       {
         name: "booking_site_for_business",
         description: "ONE-SHOT: build a standalone booking site for a business the user NAMES, even if it isn't a lead yet. Give it the business name (include the town/area if known, e.g. 'Kings Barbers, Leeds'). It looks the business up on Google Places, reads their existing website to understand the business and check whether they already take bookings online, saves them as a lead, and deploys a booking page on its own URL for them to link from their site. Use this for requests like 'build a booking site for The Oak Barbers' when that business isn't in the pipeline. Costs a Places lookup + a Vercel deploy.",
@@ -93928,7 +94280,11 @@ Interested?`;
             website: biz.website,
             currentBooking: check2.verdict === "messaging_only" ? check2.detail : check2.verdict,
             standalone: true,
-            ...result
+            ...result,
+            // Surfaced flat as well as nested so these always reach the operator —
+            // they are the only copy of the client's password.
+            adminUrl: result.admin.url,
+            adminPassword: result.admin.password
           };
         }
         case "add_booking_site": {
@@ -93944,7 +94300,14 @@ Interested?`;
               archetypeOverride: input.archetype,
               ownerEmail: input.ownerEmail
             });
-            return { ok: true, id, standalone: true, ...result2 };
+            return {
+              ok: true,
+              id,
+              standalone: true,
+              ...result2,
+              adminUrl: result2.admin.url,
+              adminPassword: result2.admin.password
+            };
           }
           if (!lead.site_url) {
             return {
@@ -93960,6 +94323,25 @@ Interested?`;
           });
           return { ok: true, id, ...result };
         }
+        case "hand_over_site": {
+          const id = Number(input.id);
+          const lead = db2.get("SELECT id, name, site_url, booking_url FROM leads WHERE id = ?", [id]);
+          if (!lead)
+            throw new Error(`Lead #${id} not found`);
+          if (!lead.site_url && !lead.booking_url) {
+            return {
+              ok: false,
+              error: `#${id} ${lead.name} has no site or booking page yet \u2014 build one before handing it over.`
+            };
+          }
+          const result = await ctx.invokeIpc("site:handover", {
+            leadId: id,
+            domain: input.domain
+          });
+          db2.run("UPDATE leads SET status = 'won' WHERE id = ?", [id]);
+          ctx.emitProgress?.({ channel: "leads:changed", payload: { reason: "handover" } });
+          return { ok: true, id, business: lead.name, ...result };
+        }
         case "provision_cms": {
           const id = Number(input.id);
           const result = await ctx.invokeIpc("cms:provision", id);
@@ -94974,7 +95356,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.2.2",
+      version: "1.4.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -95034,6 +95416,7 @@ var provisionCmsForLead = cms.provisionCmsForLead;
 var generatePreset = bookingPreset.generatePreset;
 var deployBookingOnly = builder.deployBookingOnly;
 var deployStandaloneBooking = builder.deployStandaloneBooking;
+var handoverSite = builder.handoverSite;
 var createBlobStore = vercelStore.createBlobStore;
 var refreshModels = models.refreshModels;
 var refreshIfStale = models.refreshIfStale;
@@ -95352,6 +95735,43 @@ var StatusBoard = class {
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
 var import_os2 = __toESM(require("os"));
+function bundledCommandsDir() {
+  const candidates = [
+    import_path.default.join(__dirname, "commands"),
+    import_path.default.join(__dirname, "..", "dist", "commands"),
+    import_path.default.join(__dirname, "..", "commands")
+  ];
+  for (const c2 of candidates) {
+    if (import_fs.default.existsSync(import_path.default.join(c2, "sproutkit.md"))) return c2;
+  }
+  return candidates[0];
+}
+function commandsTargetDir() {
+  return import_path.default.join(import_os2.default.homedir(), ".claude", "commands");
+}
+function installCommands() {
+  try {
+    const src = bundledCommandsDir();
+    if (!import_fs.default.existsSync(src)) {
+      return { ok: false, error: `Command source not found (looked in ${src}).` };
+    }
+    const dest = commandsTargetDir();
+    import_fs.default.mkdirSync(dest, { recursive: true });
+    let count = 0;
+    for (const f of import_fs.default.readdirSync(src)) {
+      if (!f.endsWith(".md")) continue;
+      if (f !== "sproutkit.md" && !f.startsWith("sproutkit-")) continue;
+      import_fs.default.copyFileSync(import_path.default.join(src, f), import_path.default.join(dest, f));
+      count++;
+    }
+    return { ok: true, count, path: dest };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+function commandsInstalled() {
+  return import_fs.default.existsSync(import_path.default.join(commandsTargetDir(), "sproutkit.md"));
+}
 function bundledSkillDir() {
   const candidates = [
     import_path.default.join(__dirname, "skill"),
@@ -95461,10 +95881,16 @@ async function offerSkillInstall(force) {
   const res = installSkill();
   if (res.ok) {
     say(c.green(`  \u2713 Skill installed to ${res.path}`));
-    say(c.dim("  Now run `claude` in any terminal and ask it to find or build leads."));
   } else {
     say(c.amber(`  Couldn't install the skill: ${res.error}`));
   }
+  const cmds = installCommands();
+  if (cmds.ok) {
+    say(c.green(`  \u2713 ${cmds.count} slash commands installed \u2014 type / in Claude Code`));
+    say(c.dim("  /sproutkit, /sproutkit-find, /sproutkit-build, /sproutkit-handover \u2026"));
+  } else {
+    say(c.amber(`  Couldn't install the slash commands: ${cmds.error}`));
+  }
   say();
 }
 async function onboardLicense(force) {
@@ -95895,21 +96321,42 @@ function makeInvokeIpc(emit) {
         resendKey: resendKey || "",
         ownerEmail: p.ownerEmail ?? "",
         bookingConfig: config,
+        reuseAdminPassword: lead.booking_admin_password ?? null,
         onProgress: (msg) => emit("bookings:progress", { leadId: p.leadId, msg })
       });
       db2.run(
-        "UPDATE leads SET booking_url = ?, owner_email = ?, booking_archetype = ?, booking_config = ? WHERE id = ?",
+        `UPDATE leads SET booking_url = ?, owner_email = ?, booking_archetype = ?, booking_config = ?,
+           booking_admin_url = ?, booking_admin_password = ?,
+           status = CASE WHEN status = 'discovered' THEN 'site_built' ELSE status END
+         WHERE id = ?`,
         [
           result.bookingUrl,
           p.ownerEmail ?? "",
           config.archetype,
           JSON.stringify(config),
+          result.admin.url,
+          result.admin.password,
           p.leadId
         ]
       );
       emit("bookings:done", { leadId: p.leadId, ...result });
       return result;
     }
+    if (channel === "site:handover") {
+      const p = payload;
+      const db2 = getDb();
+      const lead = db2.get("SELECT * FROM leads WHERE id = ?", [p.leadId]);
+      if (!lead) throw new Error("Lead not found");
+      const vercelToken = getSetting("vercel_token");
+      if (!vercelToken) throw new Error("Vercel token not set");
+      return await handoverSite({
+        lead,
+        vercelToken,
+        blobToken: getSetting("blob_token"),
+        domain: p.domain ?? null,
+        onProgress: (msg) => emit("sites:progress", { leadId: p.leadId, msg })
+      });
+    }
     throw new Error(`channel not supported in CLI: ${channel}`);
   };
 }
@@ -96017,6 +96464,24 @@ async function cmdList(argv) {
     emitJson(rows);
     return;
   }
+  if (flags.compact) {
+    for (const r of rows) {
+      process.stdout.write(
+        JSON.stringify({
+          id: r.id,
+          name: r.name,
+          city: r.city,
+          type: r.type,
+          status: r.status,
+          phone: r.phone || void 0,
+          site_url: r.site_url || void 0,
+          booking_url: r.booking_url || void 0,
+          lead_kind: r.lead_kind || void 0
+        }) + "\n"
+      );
+    }
+    return;
+  }
   if (rows.length === 0) {
     say(c.dim('  No leads yet. Try: sproutkit find "barbers in <area>"'));
     return;
@@ -96165,7 +96630,14 @@ async function cmdPipeline(argv) {
         setRow("building", "preparing outreach\u2026");
         await runTool("prepare_outreach", { ids: [t.id] }, makeCtx({ json: true }));
         setRow("built", booked.bookingUrl ?? "booking site live");
-        results.push({ id: t.id, name: t.name, ok: true, url: booked.bookingUrl });
+        results.push({
+          id: t.id,
+          name: t.name,
+          ok: true,
+          url: booked.bookingUrl,
+          adminUrl: booked.adminUrl,
+          adminPassword: booked.adminPassword
+        });
       } catch (e) {
         setRow("failed", e.message.slice(0, 60));
         results.push({ id: t.id, name: t.name, ok: false, error: e.message });
@@ -96232,8 +96704,98 @@ async function cmdPipeline(argv) {
     c.green(`  Pipeline ${cancelled ? "stopped" : "done"} \u2014 ${ok} client${ok === 1 ? "" : "s"} built + outreach prepared`) + (failed ? c.red(`, ${failed} failed`) : "") + (cancelled ? c.amber(`, ${cancelled} not started`) : "") + c.dim(` (concurrency ${concurrency}).`)
   );
   say(c.dim("  Open the message links above, or check emailed leads in your Contacted column."));
+  const withAdmin = results.filter((r) => r.ok && r.adminUrl && r.adminPassword);
+  if (withAdmin.length) {
+    say();
+    say(c.bold("  Client admin panels"));
+    for (const r of withAdmin) say(`  ${r.name} \u2014 ${r.adminUrl}  ${c.bold(String(r.adminPassword))}`);
+    say(c.dim("  Also stored per lead: sproutkit list --json"));
+  }
   say();
 }
+async function cmdHandover(argv) {
+  const { flags, rest } = parseArgs(argv);
+  const json = !!flags.json;
+  const id = Number(flags.id ?? rest[0]);
+  if (!id || Number.isNaN(id)) {
+    const err = "Usage: sproutkit handover <leadId> [--domain thesalon.co.uk]";
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const domain = flags.domain ? String(flags.domain) : void 0;
+  if (!flags.yes && !flags.y) {
+    const lead = await runTool("get_lead", { id }, makeCtx({ json: true }));
+    const label = lead?.name ? `${lead.name} (#${id})` : `lead #${id}`;
+    const msg = `This removes the DEMO banner from ${label} and marks them won \u2014 only do it once the client has paid. Re-run with --yes to confirm: sproutkit handover ${id}${domain ? ` --domain ${domain}` : ""} --yes`;
+    json ? emitJson({ ok: false, error: msg, needsConfirmation: true }) : say(c.amber("  " + msg));
+    process.exitCode = 1;
+    return;
+  }
+  const status = json ? void 0 : new Status();
+  if (status) status.start(`Handing over lead #${id}`);
+  try {
+    const r = await runTool("hand_over_site", { id, domain }, makeCtx({ json, status }));
+    if (r && r.ok === false) {
+      if (status) status.done(false, r.error ?? "Handover failed");
+      if (json) emitJson(r);
+      process.exitCode = 1;
+      return;
+    }
+    if (status) status.done(true, r.bannerRemoved ? "Demo banner removed" : "Handed over");
+    autoSync();
+    if (json) {
+      emitJson(r);
+      return;
+    }
+    say();
+    say(c.bold(`  Handover \u2014 ${r.business ?? `lead #${id}`}`));
+    if (r.alreadyHandedOver) say(c.dim("  (already handed over previously \u2014 re-running is safe)"));
+    say();
+    if (r.url) say(`  Website:       ${r.url}`);
+    if (r.admin) {
+      say(`  Admin panel:   ${r.admin.url}`);
+      say(`  Password:      ${c.bold(r.admin.password)}`);
+    }
+    if (r.bookingUrl) say(`  Booking page:  ${r.bookingUrl}`);
+    if (r.bookingAdmin) {
+      say(`  Booking admin: ${r.bookingAdmin.url}`);
+      say(`  Password:      ${c.bold(r.bookingAdmin.password)}`);
+    }
+    if (r.domain) {
+      const d = r.domain;
+      say();
+      say(c.bold(`  Domain \u2014 ${d.domain}`));
+      if (d.dnsConfigured) {
+        say(c.green("  DNS is already pointing at us. Nothing to do."));
+      } else {
+        say(c.dim("  Ask the client to add these records at their domain registrar:"));
+        if (d.records.length) {
+          for (const rec of d.records) {
+            say(`    ${rec.type.padEnd(6)} ${rec.name.padEnd(6)} ${rec.value}${rec.note ? c.dim(`   (${rec.note})`) : ""}`);
+          }
+        }
+        if (d.ownershipChallenges.length) {
+          say(c.dim("  Plus this record to prove ownership:"));
+          for (const rec of d.ownershipChallenges) {
+            say(`    ${rec.type.padEnd(6)} ${rec.name} ${rec.value}`);
+          }
+        }
+        if (d.warning) say(c.amber("  " + d.warning));
+        say(c.dim("  DNS can take minutes to 48h. Re-check with: sproutkit handover " + id + " --domain " + d.domain));
+      }
+    }
+    if (!r.bannerRemoved && r.bookingUrl && !r.url) {
+      say();
+      say(c.dim("  Booking-only client: the demo banner comes off next time the booking site deploys."));
+    }
+    say();
+  } catch (e) {
+    if (status) status.done(false, "Handover failed");
+    json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+    process.exitCode = 1;
+  }
+}
 async function cmdRegenerate(argv) {
   const { flags, rest } = parseArgs(argv);
   const json = !!flags.json;
@@ -96291,12 +96853,21 @@ async function cmdCms(argv) {
     if (status) status.done(true, result.publicUrl ? `CMS live at ${result.publicUrl}` : `CMS set up for #${id}`);
     autoSync();
     if (json) emitJson(result);
+    else sayAdminHandover(result.adminUrl, result.adminPassword);
   } catch (e) {
     if (status) status.done(false, "CMS setup failed");
     json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
     process.exitCode = 1;
   }
 }
+function sayAdminHandover(adminUrl, adminPassword) {
+  if (!adminUrl || !adminPassword) return;
+  say("");
+  say(c.bold("  Client handover"));
+  say(`  Admin panel: ${adminUrl}`);
+  say(`  Password:    ${adminPassword}`);
+  say(c.dim("  Send these to the client \u2014 they manage bookings and content there."));
+}
 async function cmdBook(argv) {
   const { flags, rest } = parseArgs(argv);
   const json = !!flags.json;
@@ -96326,7 +96897,10 @@ async function cmdBook(argv) {
       if (status2) status2.done(true, `${r.business} \u2014 ${r.bookingUrl}`);
       autoSync();
       if (json) emitJson(r);
-      else if (r.currentBooking) say(c.dim(`  They currently take bookings via ${r.currentBooking}.`));
+      else {
+        if (r.currentBooking) say(c.dim(`  They currently take bookings via ${r.currentBooking}.`));
+        sayAdminHandover(r.adminUrl, r.adminPassword);
+      }
     } catch (e) {
       if (status2) status2.done(false, "Failed");
       json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
@@ -96366,6 +96940,7 @@ async function cmdBook(argv) {
     if (status) status.done(true, result.bookingUrl ? `Booking live at ${result.bookingUrl}` : `Booking added to lead #${id}`);
     autoSync();
     if (json) emitJson(result);
+    else sayAdminHandover(result.adminUrl, result.adminPassword);
   } catch (e) {
     if (status) status.done(false, "Booking failed");
     json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
@@ -96591,6 +97166,14 @@ async function runDoctor() {
       fix: "Run 'sproutkit setup' and say yes to installing the skill, so `claude` can drive Sproutkit."
     }
   );
+  rows.push(
+    commandsInstalled() ? { level: "ok", label: "Slash commands", detail: commandsTargetDir() } : {
+      level: "warn",
+      label: "Slash commands",
+      detail: "not installed",
+      fix: "Run 'sproutkit setup' so /sproutkit-find, /sproutkit-build etc. appear when you type / in Claude Code."
+    }
+  );
   say();
   say(c.greenBold("  Sproutkit doctor"));
   say(c.dim(`  Backend: ${backend === "claude_code" ? "Claude subscription" : "Anthropic API key"}`));
@@ -96656,7 +97239,7 @@ async function main() {
     closeTty();
     return;
   }
-  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "outreach" || arg === "pipeline") {
+  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "outreach" || arg === "pipeline") {
     const subArgs = process.argv.slice(3);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       const USAGE = {
@@ -96668,7 +97251,7 @@ async function main() {
           "  --json           machine-readable output"
         ],
         list: [
-          "sproutkit list [--status <s>] [--city <c>] [--limit <n>] [--json]",
+          "sproutkit list [--status <s>] [--city <c>] [--limit <n>] [--json|--compact]",
           "  statuses: discovered, site_built, contacted, replied, won, dead"
         ],
         build: [
@@ -96696,6 +97279,13 @@ async function main() {
           '  --instructions "\u2026"   e.g. "45-min slots, add beard trim \xA312"',
           "  --email <addr>       owner email for booking notifications"
         ],
+        handover: [
+          "sproutkit handover <leadId> [--domain thesalon.co.uk]",
+          "  the paid-deliverable step: removes the DEMO banner, attaches the",
+          "  client's own domain, and prints every credential in one place",
+          "  --domain <domain>    client's domain; prints the DNS records to set",
+          "  --yes                required \u2014 confirms the client has paid"
+        ],
         outreach: [
           "sproutkit outreach [--ids 3,5] [--channel sms|whatsapp] [--json]",
           "  Per lead: phone -> a messaging link you open; no phone -> emailed (needs SMTP).",
@@ -96730,6 +97320,7 @@ async function main() {
     else if (arg === "regenerate") await cmdRegenerate(subArgs);
     else if (arg === "cms") await cmdCms(subArgs);
     else if (arg === "book") await cmdBook(subArgs);
+    else if (arg === "handover") await cmdHandover(subArgs);
     else if (arg === "pipeline") await cmdPipeline(subArgs);
     else await cmdOutreach(subArgs);
     closeTty();
@@ -96795,6 +97386,10 @@ async function main() {
     if (res.ok) say(c.dim("  Installed the Sproutkit skill for Claude Code."));
     else say(c.amber(`  Couldn't install the Sproutkit skill: ${res.error}`));
   }
+  if (!commandsInstalled()) {
+    const res = installCommands();
+    if (res.ok) say(c.dim(`  Installed ${res.count} /sproutkit slash commands.`));
+  }
   await notifyIfOutdated();
   say();
   say(c.greenBold("  Sproutkit") + c.dim(" \u2014 starting Claude Code"));

package/dist/skill/SKILL.md

@@ -65,6 +65,28 @@ you can parse results reliably, then summarise them for the user in prose.
     `--archetype slots|reservation|enquiry`, `--email owner@x.com`.
   - Use `book --standalone` when the user says the client "already has a
     website" or "just needs a booking page".
+  - Booking sites include a client `/admin` panel where the owner sees incoming
+    bookings and edits their services and hours. The JSON result carries
+    `adminUrl` and `adminPassword` — ALWAYS relay both to the user, they are the
+    client handover and the password is shown only at build time. It is stored
+    on the lead afterwards (`sproutkit list --json`) if they lose it.
+  - You can also name a business that isn't a lead yet:
+    `sproutkit book "Kings Barbers, Leeds" --json` looks them up, reads their
+    site, and builds a booking page in one shot.
+
+- **Hand a finished site to a paying client** — `sproutkit handover <leadId> --yes --json`
+  - THE PAID-DELIVERABLE STEP. Removes the DEMO banner, optionally attaches the
+    client's own domain, marks the lead won, and prints one sheet with the site
+    URL, /admin panel + password, booking page + password, and the DNS records
+    the client must set at their registrar.
+  - `--domain thesalon.co.uk` attaches their domain and returns the exact A or
+    CNAME record. DNS is out of our control, so re-run the same command later to
+    re-check whether it has propagated.
+  - `--yes` is REQUIRED. Without it the command refuses and explains why. Only
+    pass it when the user has clearly said the client has paid / signed off /
+    is going live — never infer it.
+  - The banner exists to stop clients using a free demo as their real site, so
+    do NOT run this just because a site looks finished.
 
 - **Run the full pipeline for many clients** — `sproutkit pipeline x3 --json` (optional `--book`, `--limit 10`, `--ids 3,5`)
   - Builds → (optionally adds booking) → prepares outreach for several clients

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"