sproutkit-code 1.3.0 → 1.5.0

package/dist/index.js

@@ -183,6 +183,21 @@ var require_db = __commonJS({
         } catch {
         }
       }
+      for (const col of [
+        // Stable per-site key encrypting admin-auth.json in Blob. MUST survive
+        // redeploys: SESSION_SECRET is regenerated every deploy, so deriving from
+        // it would make the client's self-chosen password undecryptable each time.
+        "auth_enc_key TEXT",
+        "booking_admin_url TEXT",
+        "booking_admin_password TEXT",
+        "handed_over_at TEXT",
+        "custom_domain TEXT"
+      ]) {
+        try {
+          db2.exec(`ALTER TABLE leads ADD COLUMN ${col}`);
+        } catch {
+        }
+      }
       try {
         db2.exec("ALTER TABLE leads ADD COLUMN dead_at TEXT");
       } catch {
@@ -31050,6 +31065,121 @@ export default function App() {
   }
 });
 
+// ../desktop/dist/main/lib/vercel-domains.js
+var require_vercel_domains = __commonJS({
+  "../desktop/dist/main/lib/vercel-domains.js"(exports2) {
+    "use strict";
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.attachDomain = attachDomain;
+    exports2.domainStatus = domainStatus;
+    var axios_1 = __importDefault(require_axios());
+    function qs(teamId) {
+      return teamId ? `?teamId=${encodeURIComponent(teamId)}` : "";
+    }
+    function isApex(domain) {
+      const parts = domain.split(".");
+      if (parts.length <= 2)
+        return true;
+      const twoPartSuffixes = ["co.uk", "org.uk", "me.uk", "ac.uk", "com.au", "co.nz", "co.za", "com.br"];
+      return parts.length === 3 && twoPartSuffixes.includes(parts.slice(-2).join("."));
+    }
+    async function fetchConfig(domain, projectId, vercelToken, teamId) {
+      try {
+        const params = new URLSearchParams({ projectIdOrName: projectId });
+        if (teamId)
+          params.set("teamId", teamId);
+        const res = await axios_1.default.get(`https://api.vercel.com/v6/domains/${encodeURIComponent(domain)}/config?${params.toString()}`, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        return res.data;
+      } catch {
+        return null;
+      }
+    }
+    function recordsFrom(domain, cfg) {
+      const apex = isApex(domain);
+      if (!cfg)
+        return [];
+      if (apex) {
+        const ip = cfg.recommendedIPv4?.find((r) => r.rank === 1)?.value?.[0] ?? cfg.recommendedIPv4?.[0]?.value?.[0];
+        if (!ip)
+          return [];
+        return [{ type: "A", name: "@", value: ip, note: "root domain" }];
+      }
+      const target = cfg.recommendedCNAME?.find((r) => r.rank === 1)?.value ?? cfg.recommendedCNAME?.[0]?.value;
+      if (!target)
+        return [];
+      const sub = domain.split(".")[0];
+      return [{ type: "CNAME", name: sub, value: target }];
+    }
+    async function attachDomain(args) {
+      const { vercelToken, projectId, teamId } = args;
+      const domain = args.domain.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+      if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(domain)) {
+        throw new Error(`"${args.domain}" doesn't look like a domain name (expected e.g. thesalon.co.uk).`);
+      }
+      let verified = false;
+      let alreadyAttached = false;
+      let apexName = domain;
+      let ownershipChallenges = [];
+      let warning;
+      try {
+        const res = await axios_1.default.post(`https://api.vercel.com/v10/projects/${encodeURIComponent(projectId)}/domains${qs(teamId)}`, { name: domain }, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        verified = !!res.data.verified;
+        apexName = res.data.apexName ?? domain;
+        ownershipChallenges = (res.data.verification ?? []).filter((v) => v.type?.toUpperCase() === "TXT").map((v) => ({ type: "TXT", name: v.domain, value: v.value, note: v.reason }));
+      } catch (e) {
+        const err = e;
+        const status = err.response?.status;
+        const msg = err.response?.data?.error?.message ?? e.message;
+        if (status === 400) {
+          alreadyAttached = true;
+        } else if (status === 409) {
+          throw new Error(`${domain} is already attached to a different Vercel project or account. Remove it there first, then retry. (${msg})`);
+        } else if (status === 402) {
+          throw new Error(`Vercel needs a payment method on the account before adding a custom domain. (${msg})`);
+        } else if (status === 403) {
+          throw new Error(`Your Vercel token doesn't have permission to add ${domain}. (${msg})`);
+        } else {
+          throw new Error(`Couldn't attach ${domain}: ${msg}`);
+        }
+      }
+      const cfg = await fetchConfig(domain, projectId, vercelToken, teamId);
+      const records = recordsFrom(domain, cfg);
+      if (!records.length) {
+        warning = "Couldn't read the DNS records from Vercel. Open the project's Domains tab in the Vercel dashboard to see the exact A/CNAME values.";
+      }
+      return {
+        domain,
+        apexDomain: apexName,
+        verified,
+        dnsConfigured: cfg ? cfg.misconfigured === false : false,
+        alreadyAttached,
+        records,
+        ownershipChallenges,
+        warning
+      };
+    }
+    async function domainStatus(args) {
+      const { domain, projectId, vercelToken, teamId } = args;
+      let verified = false;
+      try {
+        const res = await axios_1.default.get(`https://api.vercel.com/v9/projects/${encodeURIComponent(projectId)}/domains/${encodeURIComponent(domain)}${qs(teamId)}`, { headers: { Authorization: `Bearer ${vercelToken}` }, timeout: 2e4 });
+        verified = !!res.data.verified;
+      } catch {
+      }
+      const cfg = await fetchConfig(domain, projectId, vercelToken, teamId);
+      return {
+        domain,
+        verified,
+        dnsConfigured: cfg ? cfg.misconfigured === false : false,
+        records: recordsFrom(domain, cfg)
+      };
+    }
+  }
+});
+
 // ../../node_modules/bcryptjs/umd/index.js
 var require_umd = __commonJS({
   "../../node_modules/bcryptjs/umd/index.js"(exports2, module2) {
@@ -32878,10 +33008,11 @@ var require_cms_runtime = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
+    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
     exports2.generateFriendlyPassword = generateFriendlyPassword;
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
+    var node_crypto_1 = require("node:crypto");
     exports2.API_CONTENT_JS = `import { list, put } from "@vercel/blob";
 
 // Per-site Blob namespace so many CMS sites share one store (one token per
@@ -33041,10 +33172,131 @@ export default async function handler(req, res) {
 }
 `;
     exports2.API_ADMIN_LOGIN_JS = `import bcrypt from "bcryptjs";
-import { createHmac } from "node:crypto";
+import { createHmac, createHash, createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { list, put } from "@vercel/blob";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site Blob namespace, matching the other runtime files.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+// The client's self-chosen password, if they've changed it. ADMIN_PASSWORD_HASH
+// is a Vercel env var and the site can't rewrite its own env, so an override
+// hash lives in Blob instead and takes precedence when present.
+const AUTH_KEY = PFX + "admin-auth.json";
+// Failed-attempt counters. Blob is the only shared state a serverless function
+// has \u2014 there's no memory between invocations. Best-effort by nature: two
+// concurrent attempts can read the same counter before either writes. That
+// still turns an unlimited online guessing attack into a slow one, which is the
+// point; bcrypt's own cost does the rest.
+const THROTTLE_KEY = PFX + "admin-throttle.json";
+
+const MAX_FAILS = 8;         // per IP, per window
+const WINDOW_MS = 15 * 60 * 1000;
+const LOCKOUT_MS = 15 * 60 * 1000;
+
+
+// admin-auth.json holds a bcrypt hash and lives in a PUBLIC Blob store at a
+// non-random path, so treat its URL as readable by anyone who learns it (the
+// store hostname leaks via photo URLs; only the per-site UUID stands between an
+// outsider and this file). A leaked bcrypt hash is crackable offline where our
+// login rate limit gives zero protection \u2014 so the contents are encrypted with
+// AES-256-GCM under a key derived from AUTH_ENC_KEY, which only ever exists as
+// a server-side env var. A public read then yields opaque bytes.
+function authKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+}
+
+function sealAuth(obj) {
+  const key = authKey();
+  const plain = JSON.stringify(obj);
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openAuth(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // v0 = written before encryption shipped (or with no key available).
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const key = authKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    const out = Buffer.concat([
+      decipher.update(Buffer.from(raw.ct, "base64")),
+      decipher.final(),
+    ]).toString("utf8");
+    return JSON.parse(out);
+  } catch {
+    // Wrong key or tampered payload \u2014 fall back to the env-var password rather
+    // than locking the owner out.
+    return null;
+  }
+}
+
+async function readJson(key, fallback) {
+  try {
+    const { blobs } = await list({ prefix: key, limit: 1 });
+    const target = blobs.find((b) => b.pathname === key);
+    if (!target) return fallback;
+    // cache: no-store \u2014 a stale throttle count would let attempts through.
+    const res = await fetch(target.url, { cache: "no-store" });
+    if (!res.ok) return fallback;
+    return await res.json();
+  } catch {
+    return fallback;
+  }
+}
+
+async function writeJson(key, value) {
+  try {
+    await put(key, JSON.stringify(value), {
+      access: "public",
+      addRandomSuffix: false,
+      allowOverwrite: true,
+      contentType: "application/json",
+    });
+  } catch {
+    // Non-fatal: failing to persist a counter must never lock out a real owner.
+  }
+}
+
+// Prefer headers Vercel sets itself. The leftmost x-forwarded-for entry is
+// client-controlled, so it's the last resort \u2014 and note a spoofer can only
+// throttle the identity they invent, not a real owner.
+function clientKey(req) {
+  const h = req.headers;
+  const raw =
+    h["x-vercel-forwarded-for"] ||
+    h["x-real-ip"] ||
+    String(h["x-forwarded-for"] || "").split(",")[0].trim() ||
+    "unknown";
+  // Hashed because this file is world-readable in public Blob; we never want to
+  // publish a list of visitor IPs.
+  return createHash("sha256").update(String(raw)).digest("hex").slice(0, 16);
+}
+
+function prune(state, now) {
+  const out = {};
+  for (const [k, v] of Object.entries(state || {})) {
+    if (!v || typeof v !== "object") continue;
+    const fresh = (v.until && v.until > now) || (v.first && now - v.first < WINDOW_MS);
+    if (fresh) out[k] = v;
+  }
+  return out;
+}
+
 function b64url(buf) {
   return Buffer.from(buf).toString("base64").replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
 }
@@ -33071,12 +33323,30 @@ export default async function handler(req, res) {
     res.status(405).json({ error: "method_not_allowed" });
     return;
   }
-  const hash = process.env.ADMIN_PASSWORD_HASH;
   const secret = process.env.SESSION_SECRET;
-  if (!hash || !secret) {
+  const envHash = process.env.ADMIN_PASSWORD_HASH;
+  if (!envHash || !secret) {
     res.status(500).json({ error: "not_configured" });
     return;
   }
+
+  const now = Date.now();
+  const who = clientKey(req);
+  let throttle = prune(await readJson(THROTTLE_KEY, {}), now);
+  const entry = throttle[who];
+  if (entry && entry.until && entry.until > now) {
+    const retryAfter = Math.ceil((entry.until - now) / 1000);
+    res.setHeader("Retry-After", String(retryAfter));
+    res.status(429).json({ error: "too_many_attempts", retryAfter });
+    return;
+  }
+
+  // The client's own password wins over the one we generated at build time.
+  const override = openAuth(await readJson(AUTH_KEY, null));
+  const hash =
+    override && typeof override.passwordHash === "string" && override.passwordHash
+      ? override.passwordHash
+      : envHash;
   let body = req.body;
   if (typeof body === "string") {
     try { body = JSON.parse(body); } catch { body = null; }
@@ -33095,10 +33365,25 @@ export default async function handler(req, res) {
   }
   const ok = await bcrypt.compare(password, hash);
   if (!ok) {
+    const prev = throttle[who] && throttle[who].first && now - throttle[who].first < WINDOW_MS
+      ? throttle[who]
+      : { fails: 0, first: now };
+    const fails = (prev.fails || 0) + 1;
+    const next = { fails, first: prev.first || now };
+    if (fails >= MAX_FAILS) next.until = now + LOCKOUT_MS;
+    throttle[who] = next;
+    await writeJson(THROTTLE_KEY, throttle);
     await new Promise((r) => setTimeout(r, 300));
-    res.status(401).json({ error: "invalid_password" });
+    const remaining = Math.max(0, MAX_FAILS - fails);
+    res.status(401).json({ error: "invalid_password", remaining });
     return;
   }
+
+  // Clean slate on success so a forgetful owner isn't punished later.
+  if (throttle[who]) {
+    delete throttle[who];
+    await writeJson(THROTTLE_KEY, throttle);
+  }
   const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 8; // 8h
   const token = sign({ role: "admin", exp }, secret);
   res.setHeader(
@@ -33144,6 +33429,191 @@ export default function handler(req, res) {
   }
   res.status(200).json({ ok: true });
 }
+`;
+    exports2.API_ADMIN_PASSWORD_JS = `import bcrypt from "bcryptjs";
+import {
+  createHmac,
+  timingSafeEqual,
+  createHash,
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from "node:crypto";
+import { list, put } from "@vercel/blob";
+
+export const config = { runtime: "nodejs" };
+
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const AUTH_KEY = PFX + "admin-auth.json";
+
+const MIN_LENGTH = 10;
+
+
+// admin-auth.json holds a bcrypt hash and lives in a PUBLIC Blob store at a
+// non-random path, so treat its URL as readable by anyone who learns it (the
+// store hostname leaks via photo URLs; only the per-site UUID stands between an
+// outsider and this file). A leaked bcrypt hash is crackable offline where our
+// login rate limit gives zero protection \u2014 so the contents are encrypted with
+// AES-256-GCM under a key derived from AUTH_ENC_KEY, which only ever exists as
+// a server-side env var. A public read then yields opaque bytes.
+function authKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+}
+
+function sealAuth(obj) {
+  const key = authKey();
+  const plain = JSON.stringify(obj);
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openAuth(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // v0 = written before encryption shipped (or with no key available).
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const key = authKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    const out = Buffer.concat([
+      decipher.update(Buffer.from(raw.ct, "base64")),
+      decipher.final(),
+    ]).toString("utf8");
+    return JSON.parse(out);
+  } catch {
+    // Wrong key or tampered payload \u2014 fall back to the env-var password rather
+    // than locking the owner out.
+    return null;
+  }
+}
+
+function verifySession(req) {
+  const cookie = req.headers.cookie || "";
+  const match = cookie.match(/sk_admin=([^;]+)/);
+  if (!match) return false;
+  const secret = process.env.SESSION_SECRET;
+  if (!secret) return false;
+  const [payload, sig] = match[1].split(".");
+  if (!payload || !sig) return false;
+  try {
+    const expected = createHmac("sha256", secret).update(payload).digest();
+    const provided = Buffer.from(sig.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    if (expected.length !== provided.length) return false;
+    if (!timingSafeEqual(expected, provided)) return false;
+    const data = JSON.parse(
+      Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
+    );
+    return typeof data.exp === "number" && data.exp > Date.now() / 1000;
+  } catch {
+    return false;
+  }
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+
+async function currentHash() {
+  try {
+    const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === AUTH_KEY);
+    if (target) {
+      const res = await fetch(target.url, { cache: "no-store" });
+      if (res.ok) {
+        const j = openAuth(await res.json());
+        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j.passwordHash;
+      }
+    }
+  } catch {
+    // fall through to the env var
+  }
+  return process.env.ADMIN_PASSWORD_HASH || "";
+}
+
+export default async function handler(req, res) {
+  if (req.method !== "POST") {
+    res.status(405).json({ error: "method_not_allowed" });
+    return;
+  }
+  // Must already be logged in AND know the current password \u2014 a stolen session
+  // cookie alone must not be enough to lock the real owner out.
+  if (!verifySession(req)) {
+    res.status(401).json({ error: "unauthorized" });
+    return;
+  }
+  let body = req.body;
+  if (typeof body === "string") {
+    try { body = JSON.parse(body); } catch { body = null; }
+  } else if (!body) {
+    try {
+      const raw = await readBody(req);
+      body = raw ? JSON.parse(raw) : {};
+    } catch {
+      body = {};
+    }
+  }
+  const currentPassword = String((body && body.currentPassword) || "");
+  const newPassword = String((body && body.newPassword) || "");
+
+  if (newPassword.length < MIN_LENGTH) {
+    res.status(400).json({ error: "too_short", minLength: MIN_LENGTH });
+    return;
+  }
+  if (newPassword.length > 200) {
+    res.status(400).json({ error: "too_long" });
+    return;
+  }
+  if (newPassword === currentPassword) {
+    res.status(400).json({ error: "unchanged" });
+    return;
+  }
+
+  const existing = await currentHash();
+  if (!existing) {
+    res.status(500).json({ error: "not_configured" });
+    return;
+  }
+  const ok = await bcrypt.compare(currentPassword, existing);
+  if (!ok) {
+    await new Promise((r) => setTimeout(r, 300));
+    res.status(401).json({ error: "wrong_current_password" });
+    return;
+  }
+
+  const salt = await bcrypt.genSalt(10);
+  const passwordHash = await bcrypt.hash(newPassword, salt);
+  try {
+    // clientChanged is read (unencrypted) by nothing sensitive \u2014 it only tells
+    // the agency "your stored copy is no longer the live password".
+    await put(AUTH_KEY, sealAuth({ passwordHash, updatedAt: new Date().toISOString(), clientChanged: true }), {
+      access: "public",
+      addRandomSuffix: false,
+      allowOverwrite: true,
+      contentType: "application/json",
+    });
+  } catch (e) {
+    res.status(500).json({ error: "save_failed", detail: (e && e.message) || "unknown" });
+    return;
+  }
+  res.status(200).json({ ok: true });
+}
 `;
     exports2.API_ADMIN_UPLOAD_JS = `import { put } from "@vercel/blob";
 
@@ -33864,6 +34334,98 @@ export default async function handler(req, res) {
     );
   }
 
+  function TabBar(props) {
+    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
+      props.tabs.map(function (t) {
+        var active = props.section[0] === t.id;
+        return h("button", {
+          key: t.id,
+          onClick: function () { props.section[1](t.id); },
+          style: {
+            background: active ? "var(--accent)" : "transparent",
+            color: active ? "#000" : "var(--text)",
+            border: "1px solid " + (active ? "var(--accent)" : "var(--border)"),
+            borderRadius: 999, padding: "8px 16px",
+            font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
+          }
+        }, t.label);
+      })
+    );
+  }
+
+  // Lets the owner replace the password we generated for them. Without this the
+  // agency permanently knows the client's login, which isn't acceptable for a
+  // panel holding customer names and phone numbers.
+  function PasswordPanel() {
+    var cur = useState(""); var next = useState(""); var again = useState("");
+    var busy = useState(false); var msg = useState(null); var err = useState("");
+
+    async function submit(e) {
+      e.preventDefault();
+      err[1](""); msg[1](null);
+      if (next[0].length < 10) { err[1]("New password must be at least 10 characters."); return; }
+      if (next[0] !== again[0]) { err[1]("The two new passwords don't match."); return; }
+      busy[1](true);
+      try {
+        var res = await fetch("/api/admin/password", {
+          method: "POST",
+          credentials: "same-origin",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ currentPassword: cur[0], newPassword: next[0] })
+        });
+        var data = null;
+        try { data = await res.json(); } catch (_) { data = null; }
+        if (res.ok) {
+          msg[1]("Password changed. Use the new one next time you sign in.");
+          cur[1](""); next[1](""); again[1]("");
+        } else if (res.status === 401) {
+          err[1]((data && data.error) === "wrong_current_password"
+            ? "That's not your current password."
+            : "Your session expired \u2014 reload and sign in again.");
+        } else if (data && data.error === "too_short") {
+          err[1]("New password must be at least " + (data.minLength || 10) + " characters.");
+        } else if (data && data.error === "unchanged") {
+          err[1]("That's already your password.");
+        } else {
+          err[1]("Couldn't change it (" + res.status + "). Try again.");
+        }
+      } catch (_) {
+        err[1]("Network error \u2014 check your connection and try again.");
+      }
+      busy[1](false);
+    }
+
+    var field = function (label, st, auto) {
+      return h("label", { style: { display: "block", marginBottom: 12 } },
+        h("div", { style: { fontSize: 12, color: "var(--muted)", marginBottom: 4 } }, label),
+        h("input", {
+          type: "password", value: st[0], autoComplete: auto,
+          onChange: function (e) { st[1](e.target.value); },
+          style: { width: "100%", maxWidth: 360 }
+        })
+      );
+    };
+
+    return h("div", null,
+      h("div", { className: "bar" },
+        h("div", null,
+          h("div", { style: { fontSize: 15, fontWeight: 600 } }, "Password"),
+          h("div", { style: { fontSize: 12, color: "var(--muted)" } },
+            "Change the password you were given")
+        )
+      ),
+      h("form", { onSubmit: submit, style: { maxWidth: 400 } },
+        field("Current password", cur, "current-password"),
+        field("New password", next, "new-password"),
+        field("Repeat new password", again, "new-password"),
+        err[0] ? h("div", { style: { color: "#b91c1c", fontSize: 13, margin: "8px 0" } }, err[0]) : null,
+        msg[0] ? h("div", { style: { color: "var(--accent)", fontSize: 13, margin: "8px 0" } }, msg[0]) : null,
+        h("button", { type: "submit", className: "primary", disabled: busy[0] },
+          busy[0] ? "Saving\u2026" : "Change password")
+      )
+    );
+  }
+
   function App() {
     var authed = useState(false);
     var section = useState("content");
@@ -33877,33 +34439,29 @@ export default async function handler(req, res) {
     // Bookings-only site: no Site content tab to switch to, and the public
     // booking page is the site root rather than /book.
     if (!ctl.available || !ctl.content) {
-      return h("div", { className: "app" }, h(BookingsPanel, { bookingPath: "/" }));
+      return h("div", { className: "app" },
+        h(TabBar, { tabs: [{ id: "bookings", label: "Bookings" }, { id: "password", label: "Password" }], section: section }),
+        section[0] === "password"
+          ? h(PasswordPanel, null)
+          : h(BookingsPanel, { bookingPath: "/" })
+      );
     }
 
-    // Top nav lets the owner flip between Site content and Bookings.
+    // Top nav lets the owner flip between site content, bookings and password.
     return h("div", { className: "app" },
-      h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
-        [
+      h(TabBar, {
+        tabs: [
           { id: "content", label: "Site content" },
-          { id: "bookings", label: "Bookings" }
-        ].map(function (t) {
-          var active = section[0] === t.id;
-          return h("button", {
-            key: t.id,
-            onClick: function () { section[1](t.id); },
-            style: {
-              background: active ? "var(--accent)" : "transparent",
-              color: active ? "#000" : "var(--text)",
-              border: "1px solid " + (active ? "var(--accent)" : "var(--border)"),
-              borderRadius: 999, padding: "8px 16px",
-              font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
-            }
-          }, t.label);
-        })
-      ),
+          { id: "bookings", label: "Bookings" },
+          { id: "password", label: "Password" }
+        ],
+        section: section
+      }),
       section[0] === "content"
         ? h(Editor, { content: ctl.content, setContent: ctl.setContent })
-        : h(BookingsPanel, null)
+        : section[0] === "password"
+          ? h(PasswordPanel, null)
+          : h(BookingsPanel, null)
     );
   }
 
@@ -33931,7 +34489,19 @@ export default async function handler(req, res) {
       "tidy",
       "warm",
       "wise",
-      "zesty"
+      "zesty",
+      "bold",
+      "crisp",
+      "fair",
+      "glad",
+      "jolly",
+      "keen",
+      "merry",
+      "noble",
+      "plucky",
+      "spry",
+      "tough",
+      "vivid"
     ];
     var ANIMALS = [
       "badger",
@@ -33953,13 +34523,29 @@ export default async function handler(req, res) {
       "wolf",
       "zebra",
       "boar",
-      "crane"
+      "crane",
+      "bison",
+      "dingo",
+      "eagle",
+      "falcon",
+      "gecko",
+      "ibex",
+      "jackal",
+      "kestrel",
+      "marten",
+      "osprey",
+      "panda",
+      "quail"
     ];
     function generateFriendlyPassword() {
-      const a = ADJECTIVES[Math.floor(Math.random() * ADJECTIVES.length)];
-      const b = ANIMALS[Math.floor(Math.random() * ANIMALS.length)];
-      const n = 10 + Math.floor(Math.random() * 89);
-      return `${a}-${b}-${n}`;
+      const pick = (arr) => arr[(0, node_crypto_1.randomInt)(arr.length)];
+      return [
+        pick(ADJECTIVES),
+        pick(ANIMALS),
+        pick(ADJECTIVES),
+        pick(ANIMALS),
+        String(100 + (0, node_crypto_1.randomInt)(900))
+      ].join("-");
     }
     async function hashPassword(plain) {
       const bcrypt = await Promise.resolve().then(() => __importStar(require_umd()));
@@ -34354,6 +34940,7 @@ export default async function handler(req, res) {
   </style>
 </head>
 <body>
+  <!--SPROUTKIT_BANNER-->
   <div id="root"></div>
   <script src="https://unpkg.com/react@18/umd/react.production.min.js" crossorigin></script>
   <script src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js" crossorigin></script>
@@ -79674,6 +80261,7 @@ var require_builder = __commonJS({
     exports2.redeployCmsOnly = redeployCmsOnly;
     exports2.deployBookingOnly = deployBookingOnly2;
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
+    exports2.handoverSite = handoverSite2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
     var crypto_1 = require("crypto");
@@ -79685,6 +80273,7 @@ var require_builder = __commonJS({
     var path3 = __importStar(require("path"));
     var models_1 = require_models();
     var cms_template_1 = require_cms_template();
+    var vercel_domains_1 = require_vercel_domains();
     var cms_runtime_1 = require_cms_runtime();
     var booking_runtime_1 = require_booking_runtime();
     function siteUidFor(leadId) {
@@ -79696,6 +80285,15 @@ var require_builder = __commonJS({
       db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
       return uid;
     }
+    function authEncKeyFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT auth_enc_key FROM leads WHERE id = ?", [leadId]);
+      if (row?.auth_enc_key)
+        return row.auth_enc_key;
+      const key = (0, crypto_1.randomUUID)() + (0, crypto_1.randomUUID)();
+      db2.run("UPDATE leads SET auth_enc_key = ? WHERE id = ?", [key, leadId]);
+      return key;
+    }
     var STOCK_HOSTS = [
       "unsplash.com",
       "images.unsplash.com",
@@ -79759,7 +80357,18 @@ var require_builder = __commonJS({
       const pattern = new RegExp(`https?:\\/\\/[^\\s"'\`)]*(${STOCK_HOSTS.map((h) => h.replace(/\./g, "\\.")).join("|")})[^\\s"'\`)]*`, "gi");
       return code.replace(pattern, "");
     }
-    function demoBanner(businessName) {
+    function bannerFor(lead) {
+      let handedOver = false;
+      try {
+        const row = (0, db_1.getDb)().get("SELECT handed_over_at FROM leads WHERE id = ?", [lead.id]);
+        handedOver = !!row?.handed_over_at;
+      } catch {
+      }
+      return demoBanner(lead.name, handedOver);
+    }
+    function demoBanner(businessName, handedOver) {
+      if (handedOver)
+        return "";
       const esc = (v) => v.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
       const label = `Preview site for ${esc(businessName)}`;
       return `<div id="sproutkit-demo-banner" role="note" style="all:initial;display:block;box-sizing:border-box;width:100%;background:#1f2937;color:#f9fafb;font-family:ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;font-size:13px;line-height:1.4;padding:10px 16px;text-align:center;letter-spacing:.01em">
@@ -80339,7 +80948,7 @@ ${prompt}` : prompt;
       onProgress("Deploying to Vercel...");
       const indexHtml = `<!DOCTYPE html>
 <html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head>
-<body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+<body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsx = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80432,6 +81041,7 @@ export default defineConfig({ plugins: [react()] });`;
           SITE_ID: cmsSiteUid,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         });
         const vercelJson = JSON.stringify({
@@ -80445,6 +81055,7 @@ export default defineConfig({ plugins: [react()] });`;
           { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" },
           { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
           { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+          { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
           { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" },
           { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" },
           { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }
@@ -80534,7 +81145,7 @@ export default defineConfig({ plugins: [react()] });`;
           { source: "/book/", destination: "/book/index.html" }
         ]
       });
-      const indexHtmlCms = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      const indexHtmlCms = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsxCms = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80542,7 +81153,7 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
       const viteConfigCms = `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
-      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
       if (!filesToRedeploy.some((f) => f.file === "src/App.jsx")) {
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
@@ -80552,6 +81163,7 @@ export default defineConfig({ plugins: [react()] });`;
         BLOB_READ_WRITE_TOKEN: blobToken,
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
+        AUTH_ENC_KEY: authEncKeyFor(lead.id),
         BUSINESS_NAME: lead.name
       };
       if (existingUid)
@@ -80611,7 +81223,7 @@ export default defineConfig({ plugins: [react()] });`;
       snapshot[appJsxIndex] = { ...snapshot[appJsxIndex], data: modifiedApp };
       saveSnapshot(lead.id, snapshot);
       const files = snapshot.map((f) => ({ file: f.file, data: f.data, encoding: f.encoding }));
-      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${demoBanner(lead.name)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
       const mainJsx = `import { StrictMode } from 'react';
 import { createRoot } from 'react-dom/client';
 import App from './App.jsx';
@@ -80650,7 +81262,8 @@ export default defineConfig({ plugins: [react()] });`;
         const adminEnv = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
-          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
+          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+          AUTH_ENC_KEY: authEncKeyFor(lead.id)
         };
         if (bookingExistingUid)
           adminEnv.SITE_ID = bookingExistingUid;
@@ -80683,7 +81296,13 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "vercel.json", data: vercelJson, encoding: "utf-8" },
         { file: "api/bookings.js", data: booking_runtime_1.API_BOOKINGS_JS, encoding: "utf-8" },
         { file: "api/booking-config.js", data: booking_runtime_1.API_BOOKING_CONFIG_JS, encoding: "utf-8" },
-        { file: "public/book/index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
+        {
+          file: "public/book/index.html",
+          // The parent site's index.html already carries the banner; this page
+          // just needs the placeholder removed.
+          data: booking_runtime_1.BOOK_INDEX_HTML.replace("<!--SPROUTKIT_BANNER-->", ""),
+          encoding: "utf-8"
+        },
         { file: "public/book/app.js", data: booking_runtime_1.BOOK_APP_JS, encoding: "utf-8" },
         // Refresh the CMS admin app (contains the Bookings tab now)
         { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" },
@@ -80691,6 +81310,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+        { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
         { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }
       );
       onProgress("Deploying\u2026");
@@ -80711,8 +81331,7 @@ export default defineConfig({ plugins: [react()] });`;
     async function deployStandaloneBooking2(args) {
       const { lead, vercelToken, blobToken, resendKey, ownerEmail, bookingConfig, onProgress } = args;
       const adminPassword = args.reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
-      const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
-      const projectName = `sprout-book-${lead.id}-${slug}`;
+      const projectName = standaloneBookingProjectName(lead);
       onProgress("Seeding booking config\u2026");
       const standaloneSiteUid = siteUidFor(lead.id);
       try {
@@ -80737,7 +81356,8 @@ export default defineConfig({ plugins: [react()] });`;
         SITE_ID: standaloneSiteUid,
         // Admin panel auth.
         ADMIN_PASSWORD_HASH: adminHash,
-        SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
+        SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+        AUTH_ENC_KEY: authEncKeyFor(lead.id)
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -80750,6 +81370,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+        { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
         // Serve /admin without a trailing-slash redirect dance.
         {
           file: "vercel.json",
@@ -80776,7 +81397,7 @@ export default defineConfig({ plugins: [react()] });`;
       ];
       files[0] = {
         file: "index.html",
-        data: booking_runtime_1.BOOK_INDEX_HTML.replace(/\/book\/app\.js/g, "/app.js"),
+        data: booking_runtime_1.BOOK_INDEX_HTML.replace(/\/book\/app\.js/g, "/app.js").replace("<!--SPROUTKIT_BANNER-->", bannerFor(lead)),
         encoding: "utf-8"
       };
       onProgress("Deploying booking site\u2026");
@@ -80809,6 +81430,150 @@ export default defineConfig({ plugins: [react()] });`;
         admin: { url: `${publicUrl}/admin`, password: adminPassword }
       };
     }
+    async function handoverSite2(args) {
+      const { lead, vercelToken, blobToken, domain, teamId, onProgress } = args;
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get(`SELECT site_url, booking_url, admin_url, admin_password,
+            booking_admin_url, booking_admin_password, handed_over_at, site_uid
+     FROM leads WHERE id = ?`, [lead.id]);
+      if (!row)
+        throw new Error("Lead not found");
+      if (!row.site_url && !row.booking_url) {
+        throw new Error("Nothing to hand over \u2014 this lead has no site and no booking page yet. Build one first.");
+      }
+      const alreadyHandedOver = !!row.handed_over_at;
+      db2.run("UPDATE leads SET handed_over_at = COALESCE(handed_over_at, datetime('now')) WHERE id = ?", [
+        lead.id
+      ]);
+      let url = row.site_url ?? row.booking_url ?? "";
+      let bannerRemoved = false;
+      if (row.site_url) {
+        try {
+          onProgress("Rebuilding site without the demo banner\u2026");
+          const result = await redeployWithoutBanner({
+            lead,
+            vercelToken,
+            blobToken: blobToken ?? null,
+            hasCms: !!row.admin_url,
+            adminPassword: row.admin_password,
+            siteUid: row.site_uid,
+            onProgress
+          });
+          url = result.url;
+          bannerRemoved = true;
+        } catch (e) {
+          db2.run("UPDATE leads SET handed_over_at = ? WHERE id = ?", [row.handed_over_at, lead.id]);
+          throw new Error(`Couldn't rebuild the site without the banner: ${e.message}`);
+        }
+      }
+      let domainInfo;
+      if (domain) {
+        onProgress(`Attaching ${domain}\u2026`);
+        const projectId = row.site_url ? projectNameFor(lead) : standaloneBookingProjectName(lead);
+        const attached = await (0, vercel_domains_1.attachDomain)({ domain, projectId, vercelToken, teamId });
+        domainInfo = {
+          domain: attached.domain,
+          verified: attached.verified,
+          dnsConfigured: attached.dnsConfigured,
+          records: attached.records,
+          ownershipChallenges: attached.ownershipChallenges,
+          warning: attached.warning
+        };
+        db2.run("UPDATE leads SET custom_domain = ? WHERE id = ?", [attached.domain, lead.id]);
+      }
+      return {
+        url,
+        admin: row.admin_url && row.admin_password ? { url: row.admin_url, password: row.admin_password } : void 0,
+        bookingUrl: row.booking_url ?? void 0,
+        bookingAdmin: row.booking_admin_url && row.booking_admin_password ? { url: row.booking_admin_url, password: row.booking_admin_password } : void 0,
+        domain: domainInfo,
+        bannerRemoved,
+        alreadyHandedOver
+      };
+    }
+    async function redeployWithoutBanner(args) {
+      const { lead, vercelToken, blobToken, hasCms, adminPassword, siteUid, onProgress } = args;
+      const projectName = projectNameFor(lead);
+      onProgress("Loading site source\u2026");
+      const snapshot = loadSnapshot(lead.id);
+      if (!snapshot || !snapshot.some((f) => f.file === "src/App.jsx")) {
+        throw new Error("No local snapshot of this site. Run `sproutkit regenerate` once to save one, then hand over again.");
+      }
+      const files = snapshot.map((f) => ({
+        file: f.file,
+        data: f.data,
+        encoding: f.encoding
+      }));
+      const multipage = /react-router-dom/.test(snapshot.find((f) => f.file === "src/App.jsx")?.data ?? "");
+      const deps = { react: "^18.3.1", "react-dom": "^18.3.1" };
+      if (multipage)
+        deps["react-router-dom"] = "^6.26.2";
+      if (hasCms) {
+        deps["@vercel/blob"] = "^0.23.4";
+        deps.bcryptjs = "^2.4.3";
+      }
+      const indexHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${lead.name}</title></head><body style="margin:0">${bannerFor(lead)}<div id="root"></div><script type="module" src="/src/main.jsx"></script></body></html>`;
+      files.push({ file: "index.html", data: indexHtml, encoding: "utf-8" }, {
+        file: "src/main.jsx",
+        data: `import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+import App from './App.jsx';
+createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMode>);`,
+        encoding: "utf-8"
+      }, {
+        file: "vite.config.js",
+        data: `import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+export default defineConfig({ plugins: [react()] });`,
+        encoding: "utf-8"
+      }, {
+        file: "package.json",
+        data: JSON.stringify({
+          name: "sprout-site",
+          private: true,
+          version: "0.1.0",
+          type: "module",
+          scripts: { build: "vite build", dev: "vite" },
+          dependencies: deps,
+          devDependencies: { "@vitejs/plugin-react": "^4.3.1", vite: "^5.4.2" }
+        }),
+        encoding: "utf-8"
+      });
+      if (hasCms && adminPassword && blobToken) {
+        onProgress("Preserving the admin panel\u2026");
+        files.push({
+          file: "vercel.json",
+          data: JSON.stringify({
+            rewrites: [
+              { source: "/admin", destination: "/admin/index.html" },
+              { source: "/admin/", destination: "/admin/index.html" },
+              { source: "/book", destination: "/book/index.html" },
+              { source: "/book/", destination: "/book/index.html" }
+            ]
+          }),
+          encoding: "utf-8"
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        const env = {
+          BLOB_READ_WRITE_TOKEN: blobToken,
+          ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
+          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          BUSINESS_NAME: lead.name
+        };
+        if (siteUid)
+          env.SITE_ID = siteUid;
+        await setProjectEnv(projectName, vercelToken, env);
+      }
+      onProgress("Deploying\u2026");
+      const res = await postVercelDeployment({ name: projectName, files, projectSettings: { framework: "vite" }, target: "production" }, vercelToken, onProgress);
+      const url = await stableProjectUrl({
+        projectName,
+        vercelToken,
+        fallbackUrl: `https://${res.data.url}`
+      });
+      onProgress(`Live at ${url}`);
+      return { url };
+    }
     function hasBookLink(code) {
       return /(href\s*=\s*["'`{]*\s*["'`]?\/book\/?["'`}]?)|(location(?:\.href)?\s*=\s*["'`]\/book["'`])/i.test(code);
     }
@@ -80950,6 +81715,10 @@ Return this exact shape:
         return null;
       }
     }
+    function standaloneBookingProjectName(lead) {
+      const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 26);
+      return `sprout-book-${lead.id}-${slug}`;
+    }
     function projectNameFor(lead) {
       const slug = lead.name.toLowerCase().replace(/[^a-z0-9]/g, "-").replace(/-+/g, "-").slice(0, 30);
       return `sprout-${lead.id}-${slug}`;
@@ -93359,6 +94128,24 @@ var require_chat_tools = __commonJS({
         },
         requiresConfirmation: true
       },
+      {
+        name: "hand_over_site",
+        description: "HAND OVER a finished site to the paying client: removes the DEMO/preview banner, optionally attaches the client's own domain, and returns every credential in one place (site URL, /admin panel + password, booking page + its password, and the DNS records the client must set at their registrar). This is the paid-deliverable step \u2014 the banner exists to stop clients using a free demo as their real site, so only run this when the user says the client has paid / signed off / is going live. Requires the lead to already have a built site or booking page.",
+        input_schema: {
+          type: "object",
+          properties: {
+            id: { type: "number", description: "Lead id to hand over." },
+            domain: {
+              type: "string",
+              description: "Optional: the client's own domain, e.g. 'thesalon.co.uk' or 'www.thesalon.co.uk'. Attaches it to the project and returns the exact DNS records to configure. Omit to keep the site on its .vercel.app URL."
+            }
+          },
+          required: ["id"]
+        },
+        // Commercial + hard to walk back: it unbrands a live client site and marks
+        // the lead won. Always ask first.
+        requiresConfirmation: true
+      },
       {
         name: "booking_site_for_business",
         description: "ONE-SHOT: build a standalone booking site for a business the user NAMES, even if it isn't a lead yet. Give it the business name (include the town/area if known, e.g. 'Kings Barbers, Leeds'). It looks the business up on Google Places, reads their existing website to understand the business and check whether they already take bookings online, saves them as a lead, and deploys a booking page on its own URL for them to link from their site. Use this for requests like 'build a booking site for The Oak Barbers' when that business isn't in the pipeline. Costs a Places lookup + a Vercel deploy.",
@@ -94013,6 +94800,25 @@ Interested?`;
           });
           return { ok: true, id, ...result };
         }
+        case "hand_over_site": {
+          const id = Number(input.id);
+          const lead = db2.get("SELECT id, name, site_url, booking_url FROM leads WHERE id = ?", [id]);
+          if (!lead)
+            throw new Error(`Lead #${id} not found`);
+          if (!lead.site_url && !lead.booking_url) {
+            return {
+              ok: false,
+              error: `#${id} ${lead.name} has no site or booking page yet \u2014 build one before handing it over.`
+            };
+          }
+          const result = await ctx.invokeIpc("site:handover", {
+            leadId: id,
+            domain: input.domain
+          });
+          db2.run("UPDATE leads SET status = 'won' WHERE id = ?", [id]);
+          ctx.emitProgress?.({ channel: "leads:changed", payload: { reason: "handover" } });
+          return { ok: true, id, business: lead.name, ...result };
+        }
         case "provision_cms": {
           const id = Number(input.id);
           const result = await ctx.invokeIpc("cms:provision", id);
@@ -95027,7 +95833,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.3.0",
+      version: "1.5.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -95087,6 +95893,7 @@ var provisionCmsForLead = cms.provisionCmsForLead;
 var generatePreset = bookingPreset.generatePreset;
 var deployBookingOnly = builder.deployBookingOnly;
 var deployStandaloneBooking = builder.deployStandaloneBooking;
+var handoverSite = builder.handoverSite;
 var createBlobStore = vercelStore.createBlobStore;
 var refreshModels = models.refreshModels;
 var refreshIfStale = models.refreshIfStale;
@@ -95405,6 +96212,43 @@ var StatusBoard = class {
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
 var import_os2 = __toESM(require("os"));
+function bundledCommandsDir() {
+  const candidates = [
+    import_path.default.join(__dirname, "commands"),
+    import_path.default.join(__dirname, "..", "dist", "commands"),
+    import_path.default.join(__dirname, "..", "commands")
+  ];
+  for (const c2 of candidates) {
+    if (import_fs.default.existsSync(import_path.default.join(c2, "sproutkit.md"))) return c2;
+  }
+  return candidates[0];
+}
+function commandsTargetDir() {
+  return import_path.default.join(import_os2.default.homedir(), ".claude", "commands");
+}
+function installCommands() {
+  try {
+    const src = bundledCommandsDir();
+    if (!import_fs.default.existsSync(src)) {
+      return { ok: false, error: `Command source not found (looked in ${src}).` };
+    }
+    const dest = commandsTargetDir();
+    import_fs.default.mkdirSync(dest, { recursive: true });
+    let count = 0;
+    for (const f of import_fs.default.readdirSync(src)) {
+      if (!f.endsWith(".md")) continue;
+      if (f !== "sproutkit.md" && !f.startsWith("sproutkit-")) continue;
+      import_fs.default.copyFileSync(import_path.default.join(src, f), import_path.default.join(dest, f));
+      count++;
+    }
+    return { ok: true, count, path: dest };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+function commandsInstalled() {
+  return import_fs.default.existsSync(import_path.default.join(commandsTargetDir(), "sproutkit.md"));
+}
 function bundledSkillDir() {
   const candidates = [
     import_path.default.join(__dirname, "skill"),
@@ -95514,10 +96358,16 @@ async function offerSkillInstall(force) {
   const res = installSkill();
   if (res.ok) {
     say(c.green(`  \u2713 Skill installed to ${res.path}`));
-    say(c.dim("  Now run `claude` in any terminal and ask it to find or build leads."));
   } else {
     say(c.amber(`  Couldn't install the skill: ${res.error}`));
   }
+  const cmds = installCommands();
+  if (cmds.ok) {
+    say(c.green(`  \u2713 ${cmds.count} slash commands installed \u2014 type / in Claude Code`));
+    say(c.dim("  /sproutkit, /sproutkit-find, /sproutkit-build, /sproutkit-handover \u2026"));
+  } else {
+    say(c.amber(`  Couldn't install the slash commands: ${cmds.error}`));
+  }
   say();
 }
 async function onboardLicense(force) {
@@ -95948,12 +96798,12 @@ function makeInvokeIpc(emit) {
         resendKey: resendKey || "",
         ownerEmail: p.ownerEmail ?? "",
         bookingConfig: config,
-        reuseAdminPassword: lead.admin_password ?? null,
+        reuseAdminPassword: lead.booking_admin_password ?? null,
         onProgress: (msg) => emit("bookings:progress", { leadId: p.leadId, msg })
       });
       db2.run(
         `UPDATE leads SET booking_url = ?, owner_email = ?, booking_archetype = ?, booking_config = ?,
-           admin_url = ?, admin_password = ?,
+           booking_admin_url = ?, booking_admin_password = ?,
            status = CASE WHEN status = 'discovered' THEN 'site_built' ELSE status END
          WHERE id = ?`,
         [
@@ -95969,6 +96819,21 @@ function makeInvokeIpc(emit) {
       emit("bookings:done", { leadId: p.leadId, ...result });
       return result;
     }
+    if (channel === "site:handover") {
+      const p = payload;
+      const db2 = getDb();
+      const lead = db2.get("SELECT * FROM leads WHERE id = ?", [p.leadId]);
+      if (!lead) throw new Error("Lead not found");
+      const vercelToken = getSetting("vercel_token");
+      if (!vercelToken) throw new Error("Vercel token not set");
+      return await handoverSite({
+        lead,
+        vercelToken,
+        blobToken: getSetting("blob_token"),
+        domain: p.domain ?? null,
+        onProgress: (msg) => emit("sites:progress", { leadId: p.leadId, msg })
+      });
+    }
     throw new Error(`channel not supported in CLI: ${channel}`);
   };
 }
@@ -96076,6 +96941,24 @@ async function cmdList(argv) {
     emitJson(rows);
     return;
   }
+  if (flags.compact) {
+    for (const r of rows) {
+      process.stdout.write(
+        JSON.stringify({
+          id: r.id,
+          name: r.name,
+          city: r.city,
+          type: r.type,
+          status: r.status,
+          phone: r.phone || void 0,
+          site_url: r.site_url || void 0,
+          booking_url: r.booking_url || void 0,
+          lead_kind: r.lead_kind || void 0
+        }) + "\n"
+      );
+    }
+    return;
+  }
   if (rows.length === 0) {
     say(c.dim('  No leads yet. Try: sproutkit find "barbers in <area>"'));
     return;
@@ -96307,6 +97190,90 @@ async function cmdPipeline(argv) {
   }
   say();
 }
+async function cmdHandover(argv) {
+  const { flags, rest } = parseArgs(argv);
+  const json = !!flags.json;
+  const id = Number(flags.id ?? rest[0]);
+  if (!id || Number.isNaN(id)) {
+    const err = "Usage: sproutkit handover <leadId> [--domain thesalon.co.uk]";
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const domain = flags.domain ? String(flags.domain) : void 0;
+  if (!flags.yes && !flags.y) {
+    const lead = await runTool("get_lead", { id }, makeCtx({ json: true }));
+    const label = lead?.name ? `${lead.name} (#${id})` : `lead #${id}`;
+    const msg = `This removes the DEMO banner from ${label} and marks them won \u2014 only do it once the client has paid. Re-run with --yes to confirm: sproutkit handover ${id}${domain ? ` --domain ${domain}` : ""} --yes`;
+    json ? emitJson({ ok: false, error: msg, needsConfirmation: true }) : say(c.amber("  " + msg));
+    process.exitCode = 1;
+    return;
+  }
+  const status = json ? void 0 : new Status();
+  if (status) status.start(`Handing over lead #${id}`);
+  try {
+    const r = await runTool("hand_over_site", { id, domain }, makeCtx({ json, status }));
+    if (r && r.ok === false) {
+      if (status) status.done(false, r.error ?? "Handover failed");
+      if (json) emitJson(r);
+      process.exitCode = 1;
+      return;
+    }
+    if (status) status.done(true, r.bannerRemoved ? "Demo banner removed" : "Handed over");
+    autoSync();
+    if (json) {
+      emitJson(r);
+      return;
+    }
+    say();
+    say(c.bold(`  Handover \u2014 ${r.business ?? `lead #${id}`}`));
+    if (r.alreadyHandedOver) say(c.dim("  (already handed over previously \u2014 re-running is safe)"));
+    say();
+    if (r.url) say(`  Website:       ${r.url}`);
+    if (r.admin) {
+      say(`  Admin panel:   ${r.admin.url}`);
+      say(`  Password:      ${c.bold(r.admin.password)}`);
+      say(c.dim("                 (unless the client has already changed it in the panel)"));
+    }
+    if (r.bookingUrl) say(`  Booking page:  ${r.bookingUrl}`);
+    if (r.bookingAdmin) {
+      say(`  Booking admin: ${r.bookingAdmin.url}`);
+      say(`  Password:      ${c.bold(r.bookingAdmin.password)}`);
+    }
+    if (r.domain) {
+      const d = r.domain;
+      say();
+      say(c.bold(`  Domain \u2014 ${d.domain}`));
+      if (d.dnsConfigured) {
+        say(c.green("  DNS is already pointing at us. Nothing to do."));
+      } else {
+        say(c.dim("  Ask the client to add these records at their domain registrar:"));
+        if (d.records.length) {
+          for (const rec of d.records) {
+            say(`    ${rec.type.padEnd(6)} ${rec.name.padEnd(6)} ${rec.value}${rec.note ? c.dim(`   (${rec.note})`) : ""}`);
+          }
+        }
+        if (d.ownershipChallenges.length) {
+          say(c.dim("  Plus this record to prove ownership:"));
+          for (const rec of d.ownershipChallenges) {
+            say(`    ${rec.type.padEnd(6)} ${rec.name} ${rec.value}`);
+          }
+        }
+        if (d.warning) say(c.amber("  " + d.warning));
+        say(c.dim("  DNS can take minutes to 48h. Re-check with: sproutkit handover " + id + " --domain " + d.domain));
+      }
+    }
+    if (!r.bannerRemoved && r.bookingUrl && !r.url) {
+      say();
+      say(c.dim("  Booking-only client: the demo banner comes off next time the booking site deploys."));
+    }
+    say();
+  } catch (e) {
+    if (status) status.done(false, "Handover failed");
+    json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+    process.exitCode = 1;
+  }
+}
 async function cmdRegenerate(argv) {
   const { flags, rest } = parseArgs(argv);
   const json = !!flags.json;
@@ -96364,6 +97331,7 @@ async function cmdCms(argv) {
     if (status) status.done(true, result.publicUrl ? `CMS live at ${result.publicUrl}` : `CMS set up for #${id}`);
     autoSync();
     if (json) emitJson(result);
+    else sayAdminHandover(result.adminUrl, result.adminPassword);
   } catch (e) {
     if (status) status.done(false, "CMS setup failed");
     json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
@@ -96377,6 +97345,8 @@ function sayAdminHandover(adminUrl, adminPassword) {
   say(`  Admin panel: ${adminUrl}`);
   say(`  Password:    ${adminPassword}`);
   say(c.dim("  Send these to the client \u2014 they manage bookings and content there."));
+  say(c.dim("  They can change this password under Password in the panel; after that"));
+  say(c.dim("  your copy is out of date and only they know the live one."));
 }
 async function cmdBook(argv) {
   const { flags, rest } = parseArgs(argv);
@@ -96676,6 +97646,14 @@ async function runDoctor() {
       fix: "Run 'sproutkit setup' and say yes to installing the skill, so `claude` can drive Sproutkit."
     }
   );
+  rows.push(
+    commandsInstalled() ? { level: "ok", label: "Slash commands", detail: commandsTargetDir() } : {
+      level: "warn",
+      label: "Slash commands",
+      detail: "not installed",
+      fix: "Run 'sproutkit setup' so /sproutkit-find, /sproutkit-build etc. appear when you type / in Claude Code."
+    }
+  );
   say();
   say(c.greenBold("  Sproutkit doctor"));
   say(c.dim(`  Backend: ${backend === "claude_code" ? "Claude subscription" : "Anthropic API key"}`));
@@ -96741,7 +97719,7 @@ async function main() {
     closeTty();
     return;
   }
-  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "outreach" || arg === "pipeline") {
+  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "outreach" || arg === "pipeline") {
     const subArgs = process.argv.slice(3);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       const USAGE = {
@@ -96753,7 +97731,7 @@ async function main() {
           "  --json           machine-readable output"
         ],
         list: [
-          "sproutkit list [--status <s>] [--city <c>] [--limit <n>] [--json]",
+          "sproutkit list [--status <s>] [--city <c>] [--limit <n>] [--json|--compact]",
           "  statuses: discovered, site_built, contacted, replied, won, dead"
         ],
         build: [
@@ -96781,6 +97759,13 @@ async function main() {
           '  --instructions "\u2026"   e.g. "45-min slots, add beard trim \xA312"',
           "  --email <addr>       owner email for booking notifications"
         ],
+        handover: [
+          "sproutkit handover <leadId> [--domain thesalon.co.uk]",
+          "  the paid-deliverable step: removes the DEMO banner, attaches the",
+          "  client's own domain, and prints every credential in one place",
+          "  --domain <domain>    client's domain; prints the DNS records to set",
+          "  --yes                required \u2014 confirms the client has paid"
+        ],
         outreach: [
           "sproutkit outreach [--ids 3,5] [--channel sms|whatsapp] [--json]",
           "  Per lead: phone -> a messaging link you open; no phone -> emailed (needs SMTP).",
@@ -96815,6 +97800,7 @@ async function main() {
     else if (arg === "regenerate") await cmdRegenerate(subArgs);
     else if (arg === "cms") await cmdCms(subArgs);
     else if (arg === "book") await cmdBook(subArgs);
+    else if (arg === "handover") await cmdHandover(subArgs);
     else if (arg === "pipeline") await cmdPipeline(subArgs);
     else await cmdOutreach(subArgs);
     closeTty();
@@ -96880,6 +97866,10 @@ async function main() {
     if (res.ok) say(c.dim("  Installed the Sproutkit skill for Claude Code."));
     else say(c.amber(`  Couldn't install the Sproutkit skill: ${res.error}`));
   }
+  if (!commandsInstalled()) {
+    const res = installCommands();
+    if (res.ok) say(c.dim(`  Installed ${res.count} /sproutkit slash commands.`));
+  }
   await notifyIfOutdated();
   say();
   say(c.greenBold("  Sproutkit") + c.dim(" \u2014 starting Claude Code"));