sproutkit-code 1.4.0 → 1.5.1

package/dist/index.js

@@ -184,6 +184,10 @@ var require_db = __commonJS({
         }
       }
       for (const col of [
+        // Stable per-site key encrypting admin-auth.json in Blob. MUST survive
+        // redeploys: SESSION_SECRET is regenerated every deploy, so deriving from
+        // it would make the client's self-chosen password undecryptable each time.
+        "auth_enc_key TEXT",
         "booking_admin_url TEXT",
         "booking_admin_password TEXT",
         "handed_over_at TEXT",
@@ -33004,10 +33008,11 @@ var require_cms_runtime = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
+    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
     exports2.generateFriendlyPassword = generateFriendlyPassword;
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
+    var node_crypto_1 = require("node:crypto");
     exports2.API_CONTENT_JS = `import { list, put } from "@vercel/blob";
 
 // Per-site Blob namespace so many CMS sites share one store (one token per
@@ -33167,10 +33172,131 @@ export default async function handler(req, res) {
 }
 `;
     exports2.API_ADMIN_LOGIN_JS = `import bcrypt from "bcryptjs";
-import { createHmac } from "node:crypto";
+import { createHmac, createHash, createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { list, put } from "@vercel/blob";
 
 export const config = { runtime: "nodejs" };
 
+// Per-site Blob namespace, matching the other runtime files.
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+// The client's self-chosen password, if they've changed it. ADMIN_PASSWORD_HASH
+// is a Vercel env var and the site can't rewrite its own env, so an override
+// hash lives in Blob instead and takes precedence when present.
+const AUTH_KEY = PFX + "admin-auth.json";
+// Failed-attempt counters. Blob is the only shared state a serverless function
+// has \u2014 there's no memory between invocations. Best-effort by nature: two
+// concurrent attempts can read the same counter before either writes. That
+// still turns an unlimited online guessing attack into a slow one, which is the
+// point; bcrypt's own cost does the rest.
+const THROTTLE_KEY = PFX + "admin-throttle.json";
+
+const MAX_FAILS = 8;         // per IP, per window
+const WINDOW_MS = 15 * 60 * 1000;
+const LOCKOUT_MS = 15 * 60 * 1000;
+
+
+// admin-auth.json holds a bcrypt hash and lives in a PUBLIC Blob store at a
+// non-random path, so treat its URL as readable by anyone who learns it (the
+// store hostname leaks via photo URLs; only the per-site UUID stands between an
+// outsider and this file). A leaked bcrypt hash is crackable offline where our
+// login rate limit gives zero protection \u2014 so the contents are encrypted with
+// AES-256-GCM under a key derived from AUTH_ENC_KEY, which only ever exists as
+// a server-side env var. A public read then yields opaque bytes.
+function authKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+}
+
+function sealAuth(obj) {
+  const key = authKey();
+  const plain = JSON.stringify(obj);
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openAuth(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // v0 = written before encryption shipped (or with no key available).
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const key = authKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    const out = Buffer.concat([
+      decipher.update(Buffer.from(raw.ct, "base64")),
+      decipher.final(),
+    ]).toString("utf8");
+    return JSON.parse(out);
+  } catch {
+    // Wrong key or tampered payload \u2014 fall back to the env-var password rather
+    // than locking the owner out.
+    return null;
+  }
+}
+
+async function readJson(key, fallback) {
+  try {
+    const { blobs } = await list({ prefix: key, limit: 1 });
+    const target = blobs.find((b) => b.pathname === key);
+    if (!target) return fallback;
+    // cache: no-store \u2014 a stale throttle count would let attempts through.
+    const res = await fetch(target.url, { cache: "no-store" });
+    if (!res.ok) return fallback;
+    return await res.json();
+  } catch {
+    return fallback;
+  }
+}
+
+async function writeJson(key, value) {
+  try {
+    await put(key, JSON.stringify(value), {
+      access: "public",
+      addRandomSuffix: false,
+      allowOverwrite: true,
+      contentType: "application/json",
+    });
+  } catch {
+    // Non-fatal: failing to persist a counter must never lock out a real owner.
+  }
+}
+
+// Prefer headers Vercel sets itself. The leftmost x-forwarded-for entry is
+// client-controlled, so it's the last resort \u2014 and note a spoofer can only
+// throttle the identity they invent, not a real owner.
+function clientKey(req) {
+  const h = req.headers;
+  const raw =
+    h["x-vercel-forwarded-for"] ||
+    h["x-real-ip"] ||
+    String(h["x-forwarded-for"] || "").split(",")[0].trim() ||
+    "unknown";
+  // Hashed because this file is world-readable in public Blob; we never want to
+  // publish a list of visitor IPs.
+  return createHash("sha256").update(String(raw)).digest("hex").slice(0, 16);
+}
+
+function prune(state, now) {
+  const out = {};
+  for (const [k, v] of Object.entries(state || {})) {
+    if (!v || typeof v !== "object") continue;
+    const fresh = (v.until && v.until > now) || (v.first && now - v.first < WINDOW_MS);
+    if (fresh) out[k] = v;
+  }
+  return out;
+}
+
 function b64url(buf) {
   return Buffer.from(buf).toString("base64").replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
 }
@@ -33197,12 +33323,30 @@ export default async function handler(req, res) {
     res.status(405).json({ error: "method_not_allowed" });
     return;
   }
-  const hash = process.env.ADMIN_PASSWORD_HASH;
   const secret = process.env.SESSION_SECRET;
-  if (!hash || !secret) {
+  const envHash = process.env.ADMIN_PASSWORD_HASH;
+  if (!envHash || !secret) {
     res.status(500).json({ error: "not_configured" });
     return;
   }
+
+  const now = Date.now();
+  const who = clientKey(req);
+  let throttle = prune(await readJson(THROTTLE_KEY, {}), now);
+  const entry = throttle[who];
+  if (entry && entry.until && entry.until > now) {
+    const retryAfter = Math.ceil((entry.until - now) / 1000);
+    res.setHeader("Retry-After", String(retryAfter));
+    res.status(429).json({ error: "too_many_attempts", retryAfter });
+    return;
+  }
+
+  // The client's own password wins over the one we generated at build time.
+  const override = openAuth(await readJson(AUTH_KEY, null));
+  const hash =
+    override && typeof override.passwordHash === "string" && override.passwordHash
+      ? override.passwordHash
+      : envHash;
   let body = req.body;
   if (typeof body === "string") {
     try { body = JSON.parse(body); } catch { body = null; }
@@ -33221,10 +33365,25 @@ export default async function handler(req, res) {
   }
   const ok = await bcrypt.compare(password, hash);
   if (!ok) {
+    const prev = throttle[who] && throttle[who].first && now - throttle[who].first < WINDOW_MS
+      ? throttle[who]
+      : { fails: 0, first: now };
+    const fails = (prev.fails || 0) + 1;
+    const next = { fails, first: prev.first || now };
+    if (fails >= MAX_FAILS) next.until = now + LOCKOUT_MS;
+    throttle[who] = next;
+    await writeJson(THROTTLE_KEY, throttle);
     await new Promise((r) => setTimeout(r, 300));
-    res.status(401).json({ error: "invalid_password" });
+    const remaining = Math.max(0, MAX_FAILS - fails);
+    res.status(401).json({ error: "invalid_password", remaining });
     return;
   }
+
+  // Clean slate on success so a forgetful owner isn't punished later.
+  if (throttle[who]) {
+    delete throttle[who];
+    await writeJson(THROTTLE_KEY, throttle);
+  }
   const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 8; // 8h
   const token = sign({ role: "admin", exp }, secret);
   res.setHeader(
@@ -33270,6 +33429,191 @@ export default function handler(req, res) {
   }
   res.status(200).json({ ok: true });
 }
+`;
+    exports2.API_ADMIN_PASSWORD_JS = `import bcrypt from "bcryptjs";
+import {
+  createHmac,
+  timingSafeEqual,
+  createHash,
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from "node:crypto";
+import { list, put } from "@vercel/blob";
+
+export const config = { runtime: "nodejs" };
+
+const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
+const AUTH_KEY = PFX + "admin-auth.json";
+
+const MIN_LENGTH = 10;
+
+
+// admin-auth.json holds a bcrypt hash and lives in a PUBLIC Blob store at a
+// non-random path, so treat its URL as readable by anyone who learns it (the
+// store hostname leaks via photo URLs; only the per-site UUID stands between an
+// outsider and this file). A leaked bcrypt hash is crackable offline where our
+// login rate limit gives zero protection \u2014 so the contents are encrypted with
+// AES-256-GCM under a key derived from AUTH_ENC_KEY, which only ever exists as
+// a server-side env var. A public read then yields opaque bytes.
+function authKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+}
+
+function sealAuth(obj) {
+  const key = authKey();
+  const plain = JSON.stringify(obj);
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openAuth(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // v0 = written before encryption shipped (or with no key available).
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const key = authKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    const out = Buffer.concat([
+      decipher.update(Buffer.from(raw.ct, "base64")),
+      decipher.final(),
+    ]).toString("utf8");
+    return JSON.parse(out);
+  } catch {
+    // Wrong key or tampered payload \u2014 fall back to the env-var password rather
+    // than locking the owner out.
+    return null;
+  }
+}
+
+function verifySession(req) {
+  const cookie = req.headers.cookie || "";
+  const match = cookie.match(/sk_admin=([^;]+)/);
+  if (!match) return false;
+  const secret = process.env.SESSION_SECRET;
+  if (!secret) return false;
+  const [payload, sig] = match[1].split(".");
+  if (!payload || !sig) return false;
+  try {
+    const expected = createHmac("sha256", secret).update(payload).digest();
+    const provided = Buffer.from(sig.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    if (expected.length !== provided.length) return false;
+    if (!timingSafeEqual(expected, provided)) return false;
+    const data = JSON.parse(
+      Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
+    );
+    return typeof data.exp === "number" && data.exp > Date.now() / 1000;
+  } catch {
+    return false;
+  }
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+
+async function currentHash() {
+  try {
+    const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === AUTH_KEY);
+    if (target) {
+      const res = await fetch(target.url, { cache: "no-store" });
+      if (res.ok) {
+        const j = openAuth(await res.json());
+        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j.passwordHash;
+      }
+    }
+  } catch {
+    // fall through to the env var
+  }
+  return process.env.ADMIN_PASSWORD_HASH || "";
+}
+
+export default async function handler(req, res) {
+  if (req.method !== "POST") {
+    res.status(405).json({ error: "method_not_allowed" });
+    return;
+  }
+  // Must already be logged in AND know the current password \u2014 a stolen session
+  // cookie alone must not be enough to lock the real owner out.
+  if (!verifySession(req)) {
+    res.status(401).json({ error: "unauthorized" });
+    return;
+  }
+  let body = req.body;
+  if (typeof body === "string") {
+    try { body = JSON.parse(body); } catch { body = null; }
+  } else if (!body) {
+    try {
+      const raw = await readBody(req);
+      body = raw ? JSON.parse(raw) : {};
+    } catch {
+      body = {};
+    }
+  }
+  const currentPassword = String((body && body.currentPassword) || "");
+  const newPassword = String((body && body.newPassword) || "");
+
+  if (newPassword.length < MIN_LENGTH) {
+    res.status(400).json({ error: "too_short", minLength: MIN_LENGTH });
+    return;
+  }
+  if (newPassword.length > 200) {
+    res.status(400).json({ error: "too_long" });
+    return;
+  }
+  if (newPassword === currentPassword) {
+    res.status(400).json({ error: "unchanged" });
+    return;
+  }
+
+  const existing = await currentHash();
+  if (!existing) {
+    res.status(500).json({ error: "not_configured" });
+    return;
+  }
+  const ok = await bcrypt.compare(currentPassword, existing);
+  if (!ok) {
+    await new Promise((r) => setTimeout(r, 300));
+    res.status(401).json({ error: "wrong_current_password" });
+    return;
+  }
+
+  const salt = await bcrypt.genSalt(10);
+  const passwordHash = await bcrypt.hash(newPassword, salt);
+  try {
+    // clientChanged is read (unencrypted) by nothing sensitive \u2014 it only tells
+    // the agency "your stored copy is no longer the live password".
+    await put(AUTH_KEY, sealAuth({ passwordHash, updatedAt: new Date().toISOString(), clientChanged: true }), {
+      access: "public",
+      addRandomSuffix: false,
+      allowOverwrite: true,
+      contentType: "application/json",
+    });
+  } catch (e) {
+    res.status(500).json({ error: "save_failed", detail: (e && e.message) || "unknown" });
+    return;
+  }
+  res.status(200).json({ ok: true });
+}
 `;
     exports2.API_ADMIN_UPLOAD_JS = `import { put } from "@vercel/blob";
 
@@ -33990,6 +34334,98 @@ export default async function handler(req, res) {
     );
   }
 
+  function TabBar(props) {
+    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
+      props.tabs.map(function (t) {
+        var active = props.section[0] === t.id;
+        return h("button", {
+          key: t.id,
+          onClick: function () { props.section[1](t.id); },
+          style: {
+            background: active ? "var(--accent)" : "transparent",
+            color: active ? "#000" : "var(--text)",
+            border: "1px solid " + (active ? "var(--accent)" : "var(--border)"),
+            borderRadius: 999, padding: "8px 16px",
+            font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
+          }
+        }, t.label);
+      })
+    );
+  }
+
+  // Lets the owner replace the password we generated for them. Without this the
+  // agency permanently knows the client's login, which isn't acceptable for a
+  // panel holding customer names and phone numbers.
+  function PasswordPanel() {
+    var cur = useState(""); var next = useState(""); var again = useState("");
+    var busy = useState(false); var msg = useState(null); var err = useState("");
+
+    async function submit(e) {
+      e.preventDefault();
+      err[1](""); msg[1](null);
+      if (next[0].length < 10) { err[1]("New password must be at least 10 characters."); return; }
+      if (next[0] !== again[0]) { err[1]("The two new passwords don't match."); return; }
+      busy[1](true);
+      try {
+        var res = await fetch("/api/admin/password", {
+          method: "POST",
+          credentials: "same-origin",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ currentPassword: cur[0], newPassword: next[0] })
+        });
+        var data = null;
+        try { data = await res.json(); } catch (_) { data = null; }
+        if (res.ok) {
+          msg[1]("Password changed. Use the new one next time you sign in.");
+          cur[1](""); next[1](""); again[1]("");
+        } else if (res.status === 401) {
+          err[1]((data && data.error) === "wrong_current_password"
+            ? "That's not your current password."
+            : "Your session expired \u2014 reload and sign in again.");
+        } else if (data && data.error === "too_short") {
+          err[1]("New password must be at least " + (data.minLength || 10) + " characters.");
+        } else if (data && data.error === "unchanged") {
+          err[1]("That's already your password.");
+        } else {
+          err[1]("Couldn't change it (" + res.status + "). Try again.");
+        }
+      } catch (_) {
+        err[1]("Network error \u2014 check your connection and try again.");
+      }
+      busy[1](false);
+    }
+
+    var field = function (label, st, auto) {
+      return h("label", { style: { display: "block", marginBottom: 12 } },
+        h("div", { style: { fontSize: 12, color: "var(--muted)", marginBottom: 4 } }, label),
+        h("input", {
+          type: "password", value: st[0], autoComplete: auto,
+          onChange: function (e) { st[1](e.target.value); },
+          style: { width: "100%", maxWidth: 360 }
+        })
+      );
+    };
+
+    return h("div", null,
+      h("div", { className: "bar" },
+        h("div", null,
+          h("div", { style: { fontSize: 15, fontWeight: 600 } }, "Password"),
+          h("div", { style: { fontSize: 12, color: "var(--muted)" } },
+            "Change the password you were given")
+        )
+      ),
+      h("form", { onSubmit: submit, style: { maxWidth: 400 } },
+        field("Current password", cur, "current-password"),
+        field("New password", next, "new-password"),
+        field("Repeat new password", again, "new-password"),
+        err[0] ? h("div", { style: { color: "#b91c1c", fontSize: 13, margin: "8px 0" } }, err[0]) : null,
+        msg[0] ? h("div", { style: { color: "var(--accent)", fontSize: 13, margin: "8px 0" } }, msg[0]) : null,
+        h("button", { type: "submit", className: "primary", disabled: busy[0] },
+          busy[0] ? "Saving\u2026" : "Change password")
+      )
+    );
+  }
+
   function App() {
     var authed = useState(false);
     var section = useState("content");
@@ -34003,33 +34439,29 @@ export default async function handler(req, res) {
     // Bookings-only site: no Site content tab to switch to, and the public
     // booking page is the site root rather than /book.
     if (!ctl.available || !ctl.content) {
-      return h("div", { className: "app" }, h(BookingsPanel, { bookingPath: "/" }));
+      return h("div", { className: "app" },
+        h(TabBar, { tabs: [{ id: "bookings", label: "Bookings" }, { id: "password", label: "Password" }], section: section }),
+        section[0] === "password"
+          ? h(PasswordPanel, null)
+          : h(BookingsPanel, { bookingPath: "/" })
+      );
     }
 
-    // Top nav lets the owner flip between Site content and Bookings.
+    // Top nav lets the owner flip between site content, bookings and password.
     return h("div", { className: "app" },
-      h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
-        [
+      h(TabBar, {
+        tabs: [
           { id: "content", label: "Site content" },
-          { id: "bookings", label: "Bookings" }
-        ].map(function (t) {
-          var active = section[0] === t.id;
-          return h("button", {
-            key: t.id,
-            onClick: function () { section[1](t.id); },
-            style: {
-              background: active ? "var(--accent)" : "transparent",
-              color: active ? "#000" : "var(--text)",
-              border: "1px solid " + (active ? "var(--accent)" : "var(--border)"),
-              borderRadius: 999, padding: "8px 16px",
-              font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
-            }
-          }, t.label);
-        })
-      ),
+          { id: "bookings", label: "Bookings" },
+          { id: "password", label: "Password" }
+        ],
+        section: section
+      }),
       section[0] === "content"
         ? h(Editor, { content: ctl.content, setContent: ctl.setContent })
-        : h(BookingsPanel, null)
+        : section[0] === "password"
+          ? h(PasswordPanel, null)
+          : h(BookingsPanel, null)
     );
   }
 
@@ -34057,7 +34489,19 @@ export default async function handler(req, res) {
       "tidy",
       "warm",
       "wise",
-      "zesty"
+      "zesty",
+      "bold",
+      "crisp",
+      "fair",
+      "glad",
+      "jolly",
+      "keen",
+      "merry",
+      "noble",
+      "plucky",
+      "spry",
+      "tough",
+      "vivid"
     ];
     var ANIMALS = [
       "badger",
@@ -34079,13 +34523,29 @@ export default async function handler(req, res) {
       "wolf",
       "zebra",
       "boar",
-      "crane"
+      "crane",
+      "bison",
+      "dingo",
+      "eagle",
+      "falcon",
+      "gecko",
+      "ibex",
+      "jackal",
+      "kestrel",
+      "marten",
+      "osprey",
+      "panda",
+      "quail"
     ];
     function generateFriendlyPassword() {
-      const a = ADJECTIVES[Math.floor(Math.random() * ADJECTIVES.length)];
-      const b = ANIMALS[Math.floor(Math.random() * ANIMALS.length)];
-      const n = 10 + Math.floor(Math.random() * 89);
-      return `${a}-${b}-${n}`;
+      const pick = (arr) => arr[(0, node_crypto_1.randomInt)(arr.length)];
+      return [
+        pick(ADJECTIVES),
+        pick(ANIMALS),
+        pick(ADJECTIVES),
+        pick(ANIMALS),
+        String(100 + (0, node_crypto_1.randomInt)(900))
+      ].join("-");
     }
     async function hashPassword(plain) {
       const bcrypt = await Promise.resolve().then(() => __importStar(require_umd()));
@@ -79825,6 +80285,15 @@ var require_builder = __commonJS({
       db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
       return uid;
     }
+    function authEncKeyFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT auth_enc_key FROM leads WHERE id = ?", [leadId]);
+      if (row?.auth_enc_key)
+        return row.auth_enc_key;
+      const key = (0, crypto_1.randomUUID)() + (0, crypto_1.randomUUID)();
+      db2.run("UPDATE leads SET auth_enc_key = ? WHERE id = ?", [key, leadId]);
+      return key;
+    }
     var STOCK_HOSTS = [
       "unsplash.com",
       "images.unsplash.com",
@@ -80572,6 +81041,7 @@ export default defineConfig({ plugins: [react()] });`;
           SITE_ID: cmsSiteUid,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         });
         const vercelJson = JSON.stringify({
@@ -80585,6 +81055,7 @@ export default defineConfig({ plugins: [react()] });`;
           { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" },
           { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
           { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+          { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
           { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" },
           { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" },
           { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }
@@ -80682,7 +81153,7 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
       const viteConfigCms = `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
-      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
       if (!filesToRedeploy.some((f) => f.file === "src/App.jsx")) {
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
@@ -80692,6 +81163,7 @@ export default defineConfig({ plugins: [react()] });`;
         BLOB_READ_WRITE_TOKEN: blobToken,
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
+        AUTH_ENC_KEY: authEncKeyFor(lead.id),
         BUSINESS_NAME: lead.name
       };
       if (existingUid)
@@ -80790,7 +81262,8 @@ export default defineConfig({ plugins: [react()] });`;
         const adminEnv = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
-          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
+          SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+          AUTH_ENC_KEY: authEncKeyFor(lead.id)
         };
         if (bookingExistingUid)
           adminEnv.SITE_ID = bookingExistingUid;
@@ -80837,6 +81310,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+        { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
         { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }
       );
       onProgress("Deploying\u2026");
@@ -80882,7 +81356,8 @@ export default defineConfig({ plugins: [react()] });`;
         SITE_ID: standaloneSiteUid,
         // Admin panel auth.
         ADMIN_PASSWORD_HASH: adminHash,
-        SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)()
+        SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+        AUTH_ENC_KEY: authEncKeyFor(lead.id)
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -80895,6 +81370,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
+        { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
         // Serve /admin without a trailing-slash redirect dance.
         {
           file: "vercel.json",
@@ -81076,11 +81552,12 @@ export default defineConfig({ plugins: [react()] });`,
             ]
           }),
           encoding: "utf-8"
-        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: cms_runtime_1.ADMIN_INDEX_HTML, encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
         const env = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         };
         if (siteUid)
@@ -93969,7 +94446,10 @@ Interested?`;
           const status = input.status;
           const city = input.city;
           const limit = Math.min(Number(input.limit ?? 25), 100);
-          let sql = "SELECT id, name, status, type, city, phone, site_url, website, lead_kind, booking_status, booking_platform, booking_url FROM leads";
+          let sql = `SELECT id, name, status, type, city, phone, email, site_url, website, lead_kind,
+                booking_status, booking_platform, booking_url, admin_url, custom_domain,
+                handed_over_at
+         FROM leads`;
           const conds = [];
           const params = [];
           if (status) {
@@ -95356,7 +95836,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.4.0",
+      version: "1.5.1",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -96486,10 +96966,64 @@ async function cmdList(argv) {
     say(c.dim('  No leads yet. Try: sproutkit find "barbers in <area>"'));
     return;
   }
+  renderLeadTable(rows);
+}
+var STAGE_LABEL = {
+  discovered: "New",
+  site_built: "Built",
+  contacted: "Contacted",
+  replied: "Replied",
+  won: "Won",
+  dead: "Dead"
+};
+function cell(text, width) {
+  const t = text ?? "";
+  if (t.length === width) return t;
+  if (t.length < width) return t + " ".repeat(width - t.length);
+  return width <= 1 ? t.slice(0, width) : t.slice(0, width - 1) + "\u2026";
+}
+function renderLeadTable(rows) {
+  const term = process.stdout.columns && process.stdout.columns > 40 ? process.stdout.columns : 100;
+  const idW = Math.max(3, ...rows.map((r) => String(r.id).length + 1));
+  const stageW = Math.max(5, ...rows.map((r) => (STAGE_LABEL[r.status] ?? r.status).length));
+  const placeW = Math.min(14, Math.max(5, ...rows.map((r) => (r.city || "").length)));
+  const fixed = 2 + idW + 2 + stageW + 2 + placeW + 2;
+  const nameW = Math.max(16, Math.min(34, term - fixed - 24));
   say();
+  say(
+    "  " + c.dim(
+      cell("ID", idW) + "  " + cell("BUSINESS", nameW) + "  " + cell("STAGE", stageW) + "  " + cell("AREA", placeW) + "  WHAT THEY HAVE"
+    )
+  );
+  say("  " + c.dim("\u2500".repeat(Math.min(term - 4, idW + nameW + stageW + placeW + 23))));
   for (const r of rows) {
-    const site = r.site_url ? c.dim(`  ${r.site_url}`) : "";
-    say(`  ${c.greenBold("#" + r.id)} ${c.bold(r.name)} ${c.dim(`\xB7 ${r.status} \xB7 ${r.type}, ${r.city}`)}${site}`);
+    const stage = STAGE_LABEL[r.status] ?? r.status;
+    const stageColoured = r.status === "won" ? c.greenBold(cell(stage, stageW)) : r.status === "site_built" || r.status === "replied" ? c.green(cell(stage, stageW)) : r.status === "dead" ? c.dim(cell(stage, stageW)) : c.dim(cell(stage, stageW));
+    const short = (u) => u.replace(/^https?:\/\//, "").replace(/\/$/, "");
+    const assets = [];
+    if (r.custom_domain) assets.push(c.cyan(r.custom_domain));
+    else if (r.site_url) assets.push(short(r.site_url));
+    if (r.booking_url) assets.push(r.site_url ? c.dim("+ booking") : short(r.booking_url));
+    if (r.admin_url) assets.push(c.dim("+ admin"));
+    if (!r.site_url && !r.booking_url && r.website) {
+      assets.push(c.dim("own site: " + short(r.website)));
+    }
+    if (assets.length === 0) assets.push(c.dim("\u2014"));
+    if (r.handed_over_at) assets.push(c.greenBold("\u2713 delivered"));
+    say(
+      "  " + c.dim(cell("#" + r.id, idW)) + "  " + c.bold(cell(r.name, nameW)) + "  " + stageColoured + "  " + c.dim(cell(r.city || "\u2014", placeW)) + "  " + assets.join(c.dim(" \xB7 "))
+    );
+  }
+  const counts = rows.reduce((acc, r) => {
+    acc[r.status] = (acc[r.status] ?? 0) + 1;
+    return acc;
+  }, {});
+  const order = ["discovered", "site_built", "contacted", "replied", "won", "dead"];
+  const summary = order.filter((k) => counts[k]).map((k) => `${counts[k]} ${(STAGE_LABEL[k] ?? k).toLowerCase()}`).join(c.dim(" \xB7 "));
+  say();
+  say("  " + c.dim(`${rows.length} lead${rows.length === 1 ? "" : "s"} shown \u2014 `) + summary);
+  if (rows.length >= 25) {
+    say(c.dim("  More may exist \u2014 use --limit 100, or --status/--city to narrow."));
   }
   say();
 }
@@ -96756,6 +97290,7 @@ async function cmdHandover(argv) {
     if (r.admin) {
       say(`  Admin panel:   ${r.admin.url}`);
       say(`  Password:      ${c.bold(r.admin.password)}`);
+      say(c.dim("                 (unless the client has already changed it in the panel)"));
     }
     if (r.bookingUrl) say(`  Booking page:  ${r.bookingUrl}`);
     if (r.bookingAdmin) {
@@ -96867,6 +97402,8 @@ function sayAdminHandover(adminUrl, adminPassword) {
   say(`  Admin panel: ${adminUrl}`);
   say(`  Password:    ${adminPassword}`);
   say(c.dim("  Send these to the client \u2014 they manage bookings and content there."));
+  say(c.dim("  They can change this password under Password in the panel; after that"));
+  say(c.dim("  your copy is out of date and only they know the live one."));
 }
 async function cmdBook(argv) {
   const { flags, rest } = parseArgs(argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"