sproutkit-code 1.6.1 → 1.7.0

package/dist/index.js

@@ -225,6 +225,10 @@ var require_db = __commonJS({
         // redeploys: SESSION_SECRET is regenerated every deploy, so deriving from
         // it would make the client's self-chosen password undecryptable each time.
         "auth_enc_key TEXT",
+        // Read-only per-site key so `sproutkit report` can read visitor stats
+        // WITHOUT the client's password. Means handing the client full ownership
+        // doesn't cost the agency its reporting.
+        "report_key TEXT",
         // Reply loop: when we last contacted them, and the latest outcome. Kept on
         // the lead (as well as contact_log) so `followups` is a single cheap query.
         "last_contacted_at TEXT",
@@ -31319,6 +31323,7 @@ var require_analytics_runtime = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.TRACK_SNIPPET = exports2.API_STATS_JS = exports2.API_TRACK_JS = void 0;
     exports2.API_TRACK_JS = `import { list, put } from "@vercel/blob";
+import { createHash, createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
@@ -31333,6 +31338,54 @@ const EVENTS = ["view", "call", "book", "directions", "email", "menu"];
 // the file has to stay small enough to read on every request.
 const MAX_DAYS = 400;
 
+
+// stats.json lives in a PUBLIC Blob at a non-random path, and the store
+// hostname leaks through every photo URL on the site \u2014 so the file's URL must
+// be assumed guessable. Visitor counts are the client's commercial data and the
+// agency's renewal evidence, so the contents are encrypted with AES-256-GCM
+// under AUTH_ENC_KEY (a server-side env var). A direct public read yields
+// opaque bytes instead of the numbers.
+function statsKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-stats:" + material).digest();
+}
+
+function sealStats(obj) {
+  const key = statsKey();
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(JSON.stringify(obj), "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openStats(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // Unencrypted shapes: v0 (no key available) and pre-encryption files that
+  // stored { days } directly. Both must keep working.
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.days && raw.v === undefined) return raw;
+  if (raw.v !== 1) return null;
+  const key = statsKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    // Wrong key or tampered file \u2014 start fresh rather than throwing at a visitor.
+    return null;
+  }
+}
+
 function today() {
   return new Date().toISOString().slice(0, 10);
 }
@@ -31344,7 +31397,7 @@ async function readStats() {
     if (!target) return { days: {} };
     const res = await fetch(target.url, { cache: "no-store" });
     if (!res.ok) return { days: {} };
-    const j = await res.json();
+    const j = openStats(await res.json());
     return j && typeof j === "object" && j.days ? j : { days: {} };
   } catch {
     return { days: {} };
@@ -31391,7 +31444,7 @@ export default async function handler(req, res) {
   }
 
   try {
-    await put(STATS_KEY, JSON.stringify(stats), {
+    await put(STATS_KEY, sealStats(stats), {
       access: "public",
       addRandomSuffix: false,
       allowOverwrite: true,
@@ -31404,12 +31457,110 @@ export default async function handler(req, res) {
 }
 `;
     exports2.API_STATS_JS = `import { list } from "@vercel/blob";
-import { createHmac, timingSafeEqual } from "node:crypto";
+import {
+  createHmac,
+  timingSafeEqual,
+  createHash,
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
 const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
 const STATS_KEY = PFX + "stats.json";
+const AUTH_KEY = PFX + "admin-auth.json";
+
+
+// stats.json lives in a PUBLIC Blob at a non-random path, and the store
+// hostname leaks through every photo URL on the site \u2014 so the file's URL must
+// be assumed guessable. Visitor counts are the client's commercial data and the
+// agency's renewal evidence, so the contents are encrypted with AES-256-GCM
+// under AUTH_ENC_KEY (a server-side env var). A direct public read yields
+// opaque bytes instead of the numbers.
+function statsKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-stats:" + material).digest();
+}
+
+function sealStats(obj) {
+  const key = statsKey();
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(JSON.stringify(obj), "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openStats(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // Unencrypted shapes: v0 (no key available) and pre-encryption files that
+  // stored { days } directly. Both must keep working.
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.days && raw.v === undefined) return raw;
+  if (raw.v !== 1) return null;
+  const key = statsKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    // Wrong key or tampered file \u2014 start fresh rather than throwing at a visitor.
+    return null;
+  }
+}
+
+
+// Tokens carry the credential version they were minted under. A password change
+// bumps it, so cookies issued earlier stop working \u2014 without this, "I changed my
+// password" wouldn't revoke anyone for up to 8 hours, and the client couldn't
+// actually take their site back from the agency.
+//
+// Fails OPEN when the blob is unreadable: a Blob hiccup must not lock an owner
+// out of their own site. The password itself is still required to get a token.
+async function tokenVersionOk(data) {
+  try {
+    const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === AUTH_KEY);
+    if (!target) return true;
+    const res = await fetch(target.url, { cache: "no-store" });
+    if (!res.ok) return true;
+    const rec = openStatsRecord(await res.json());
+    const current = rec && Number(rec.tokenVersion) ? Number(rec.tokenVersion) : 0;
+    return (Number(data && data.ver) || 0) >= current;
+  } catch {
+    return true;
+  }
+}
+
+// admin-auth.json is sealed with a different key label than stats.json.
+function openStatsRecord(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  try {
+    const key = createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    return null;
+  }
+}
 
 function verifySession(req) {
   const cookie = req.headers.cookie || "";
@@ -31427,7 +31578,8 @@ function verifySession(req) {
     const data = JSON.parse(
       Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
     );
-    return typeof data.exp === "number" && data.exp > Date.now() / 1000;
+    if (!(typeof data.exp === "number" && data.exp > Date.now() / 1000)) return false;
+    return data;
   } catch {
     return false;
   }
@@ -31450,8 +31602,32 @@ function shiftDays(n) {
   return d.toISOString().slice(0, 10);
 }
 
+// The agency needs these numbers for renewal conversations, but must NOT need
+// the client's password to get them \u2014 otherwise the agency permanently holds the
+// client's login, and the client changing it silently breaks reporting.
+//
+// REPORT_KEY is a separate, per-site, read-only credential. It is accepted ONLY
+// here: it cannot edit content, read bookings, or change the password. So handing
+// the client full ownership and keeping agency reporting are no longer in
+// conflict.
+function verifyReportKey(req) {
+  const expected = process.env.REPORT_KEY;
+  if (!expected) return false;
+  const header = req.headers["authorization"] || req.headers["x-report-key"] || "";
+  const provided = String(header).replace(/^Bearer\\s+/i, "");
+  if (!provided || provided.length !== expected.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+
 export default async function handler(req, res) {
-  if (!verifySession(req)) {
+  const claims = verifySession(req);
+  const viaSession = claims ? await tokenVersionOk(claims) : false;
+  const viaReportKey = viaSession ? false : verifyReportKey(req);
+  if (!viaSession && !viaReportKey) {
     res.status(401).json({ error: "unauthorized" });
     return;
   }
@@ -31462,7 +31638,7 @@ export default async function handler(req, res) {
     if (target) {
       const r = await fetch(target.url, { cache: "no-store" });
       if (r.ok) {
-        const j = await r.json();
+        const j = openStats(await r.json());
         if (j && j.days) stats = j;
       }
     }
@@ -31473,6 +31649,7 @@ export default async function handler(req, res) {
   const today = shiftDays(0);
   res.setHeader("Cache-Control", "no-store");
   res.status(200).json({
+    via: viaSession ? "owner" : "report_key",
     last30: windowTotals(stats.days, shiftDays(-29), today),
     // The comparison window is what makes the number mean something.
     prev30: windowTotals(stats.days, shiftDays(-59), shiftDays(-30)),
@@ -33339,7 +33516,7 @@ var require_cms_runtime = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
+    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_LOGOUT_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
     exports2.generateFriendlyPassword = generateFriendlyPassword;
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
@@ -33715,11 +33892,23 @@ export default async function handler(req, res) {
     delete throttle[who];
     await writeJson(THROTTLE_KEY, throttle);
   }
-  const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 8; // 8h
-  const token = sign({ role: "admin", exp }, secret);
+  // 2h, not 8h. /api/stats checks the credential version and revokes instantly,
+  // but the content/upload/booking endpoints don't (each is a standalone
+  // serverless file and adding the check to all of them means duplicating the
+  // auth-blob crypto five more times). So a cookie issued before a password
+  // change can still WRITE for up to this long. Two hours keeps that window
+  // small; the honest fix is a shared auth module, which needs a bundler for the
+  // generated site.
+  const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 2;
+  // Stamp the credential version into the token. Changing the password bumps
+  // this, which instantly invalidates every cookie issued before the change \u2014
+  // otherwise "I changed my password" wouldn't actually lock anyone out for up
+  // to 8 hours, which makes handover a false promise.
+  const ver = (override && Number(override.tokenVersion)) || 0;
+  const token = sign({ role: "admin", ver, exp }, secret);
   res.setHeader(
     "Set-Cookie",
-    "sk_admin=" + token + "; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=" + 60 * 60 * 8
+    "sk_admin=" + token + "; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=" + 60 * 60 * 2
   );
   res.status(200).json({ ok: true });
 }
@@ -33861,7 +34050,7 @@ function readBody(req) {
   });
 }
 
-async function currentHash() {
+async function currentRecord() {
   try {
     const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
     const target = blobs.find((b) => b.pathname === AUTH_KEY);
@@ -33869,13 +34058,13 @@ async function currentHash() {
       const res = await fetch(target.url, { cache: "no-store" });
       if (res.ok) {
         const j = openAuth(await res.json());
-        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j.passwordHash;
+        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j;
       }
     }
   } catch {
     // fall through to the env var
   }
-  return process.env.ADMIN_PASSWORD_HASH || "";
+  return null;
 }
 
 export default async function handler(req, res) {
@@ -33916,7 +34105,8 @@ export default async function handler(req, res) {
     return;
   }
 
-  const existing = await currentHash();
+  const existingRecord = await currentRecord();
+  const existing = existingRecord ? existingRecord.passwordHash : process.env.ADMIN_PASSWORD_HASH || "";
   if (!existing) {
     res.status(500).json({ error: "not_configured" });
     return;
@@ -33933,7 +34123,13 @@ export default async function handler(req, res) {
   try {
     // clientChanged is read (unencrypted) by nothing sensitive \u2014 it only tells
     // the agency "your stored copy is no longer the live password".
-    await put(AUTH_KEY, sealAuth({ passwordHash, updatedAt: new Date().toISOString(), clientChanged: true }), {
+    const nextVersion = (Number(existingRecord && existingRecord.tokenVersion) || 0) + 1;
+    await put(AUTH_KEY, sealAuth({
+      passwordHash,
+      updatedAt: new Date().toISOString(),
+      clientChanged: true,
+      tokenVersion: nextVersion,
+    }), {
       access: "public",
       addRandomSuffix: false,
       allowOverwrite: true,
@@ -33943,6 +34139,20 @@ export default async function handler(req, res) {
     res.status(500).json({ error: "save_failed", detail: (e && e.message) || "unknown" });
     return;
   }
+  // Clear the caller's own cookie too \u2014 their old token is now invalid, so
+  // leaving it set would just produce confusing 401s until they reload.
+  res.setHeader("Set-Cookie", "sk_admin=; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=0");
+  res.status(200).json({ ok: true, signedOut: true });
+}
+`;
+    exports2.API_ADMIN_LOGOUT_JS = `export const config = { runtime: "nodejs" };
+
+export default function handler(req, res) {
+  if (req.method !== "POST") {
+    res.status(405).json({ error: "method_not_allowed" });
+    return;
+  }
+  res.setHeader("Set-Cookie", "sk_admin=; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=0");
   res.status(200).json({ ok: true });
 }
 `;
@@ -34727,7 +34937,11 @@ export default async function handler(req, res) {
   }
 
   function TabBar(props) {
-    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
+    async function signOut() {
+      try { await fetch("/api/admin/logout", { method: "POST", credentials: "same-origin" }); } catch (e) {}
+      window.location.reload();
+    }
+    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12, alignItems: "center" } },
       props.tabs.map(function (t) {
         var active = props.section[0] === t.id;
         return h("button", {
@@ -34741,7 +34955,19 @@ export default async function handler(req, res) {
             font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
           }
         }, t.label);
-      })
+      }).concat([
+        // Without this, a shared or public computer keeps a live admin session.
+        h("button", {
+          key: "__signout",
+          onClick: signOut,
+          title: "Sign out",
+          style: {
+            marginLeft: "auto", background: "transparent", color: "var(--muted)",
+            border: "1px solid var(--border)", borderRadius: 999, padding: "8px 14px",
+            font: "inherit", fontSize: 12, cursor: "pointer"
+          }
+        }, "Sign out")
+      ])
     );
   }
 
@@ -34768,8 +34994,11 @@ export default async function handler(req, res) {
         var data = null;
         try { data = await res.json(); } catch (_) { data = null; }
         if (res.ok) {
-          msg[1]("Password changed. Use the new one next time you sign in.");
+          msg[1]("Password changed \u2014 signing you back in\u2026");
           cur[1](""); next[1](""); again[1]("");
+          // The server invalidated this session, so stay logged in would just
+          // produce confusing 401s. Reload straight into the login screen.
+          setTimeout(function () { window.location.reload(); }, 1200);
         } else if (res.status === 401) {
           err[1]((data && data.error) === "wrong_current_password"
             ? "That's not your current password."
@@ -80691,6 +80920,15 @@ var require_builder = __commonJS({
       db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
       return uid;
     }
+    function reportKeyFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT report_key FROM leads WHERE id = ?", [leadId]);
+      if (row?.report_key)
+        return row.report_key;
+      const key = (0, crypto_1.randomUUID)().replace(/-/g, "") + (0, crypto_1.randomUUID)().replace(/-/g, "");
+      db2.run("UPDATE leads SET report_key = ? WHERE id = ?", [key, leadId]);
+      return key;
+    }
     function authEncKeyFor(leadId) {
       const db2 = (0, db_1.getDb)();
       const row = db2.get("SELECT auth_enc_key FROM leads WHERE id = ?", [leadId]);
@@ -81459,6 +81697,7 @@ export default defineConfig({ plugins: [react()] });`;
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
           AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         });
         const vercelJson = JSON.stringify({
@@ -81473,6 +81712,7 @@ export default defineConfig({ plugins: [react()] });`;
           { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
           { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
           { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+          { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
           { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" },
           { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" },
           { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }
@@ -81498,7 +81738,11 @@ export default defineConfig({ plugins: [react()] });`;
         await setProjectEnv(projectName, vercelToken, {
           BLOB_READ_WRITE_TOKEN: blobToken,
           SITE_ID: siteUidFor(lead.id),
-          BUSINESS_NAME: lead.name
+          BUSINESS_NAME: lead.name,
+          // Encrypts stats.json — the Blob is public and its path is guessable, so
+          // without this the visit counts are readable by anyone who finds the URL.
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id)
         });
       }
       const totalMb = allFiles.reduce((s, f) => s + f.data.length, 0) / 1048576;
@@ -81583,7 +81827,7 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
       const viteConfigCms = `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
-      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
       if (!filesToRedeploy.some((f) => f.file === "src/App.jsx")) {
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
@@ -81594,6 +81838,7 @@ export default defineConfig({ plugins: [react()] });`;
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
         AUTH_ENC_KEY: authEncKeyFor(lead.id),
+        REPORT_KEY: reportKeyFor(lead.id),
         BUSINESS_NAME: lead.name
       };
       if (existingUid)
@@ -81693,7 +81938,8 @@ export default defineConfig({ plugins: [react()] });`;
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
-          AUTH_ENC_KEY: authEncKeyFor(lead.id)
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id)
         };
         if (bookingExistingUid)
           adminEnv.SITE_ID = bookingExistingUid;
@@ -81741,6 +81987,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
         { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+        { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
         { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" },
         { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" },
         { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }
@@ -81789,7 +82036,8 @@ export default defineConfig({ plugins: [react()] });`;
         // Admin panel auth.
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
-        AUTH_ENC_KEY: authEncKeyFor(lead.id)
+        AUTH_ENC_KEY: authEncKeyFor(lead.id),
+        REPORT_KEY: reportKeyFor(lead.id)
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -81803,6 +82051,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
         { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+        { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
         { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" },
         { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" },
         // Serve /admin without a trailing-slash redirect dance.
@@ -81986,12 +82235,13 @@ export default defineConfig({ plugins: [react()] });`,
             ]
           }),
           encoding: "utf-8"
-        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
         const env = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
           AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         };
         if (siteUid)
@@ -83148,8 +83398,33 @@ var require_site_stats = __commonJS({
     exports2.fetchSiteStats = fetchSiteStats;
     exports2.pctChange = pctChange;
     var axios_1 = __importDefault(require_axios());
-    async function fetchSiteStats(siteUrl, adminPassword) {
+    async function fetchSiteStats(siteUrl, adminPassword, reportKey) {
       const base = siteUrl.replace(/\/$/, "");
+      if (reportKey) {
+        try {
+          const res = await axios_1.default.get(`${base}/api/stats`, {
+            timeout: 2e4,
+            headers: { Authorization: `Bearer ${reportKey}` },
+            validateStatus: () => true
+          });
+          if (res.status === 200)
+            return { ok: true, data: res.data };
+          if (res.status === 404) {
+            return {
+              ok: false,
+              error: "This site was built before analytics shipped. Run `sproutkit regenerate` on it to add them."
+            };
+          }
+        } catch (e) {
+          return { ok: false, error: `Couldn't reach the site: ${e.message}` };
+        }
+      }
+      if (!adminPassword) {
+        return {
+          ok: false,
+          error: "No report key on this site and no stored admin password. Rebuild it (`sproutkit regenerate`) to provision a read-only report key."
+        };
+      }
       let cookie;
       try {
         const login = await axios_1.default.post(`${base}/api/admin/login`, { password: adminPassword }, {
@@ -95946,20 +96221,22 @@ Interested?`;
         }
         case "site_report": {
           const id = Number(input.id);
-          const lead = db2.get("SELECT id, name, site_url, booking_url, admin_url, admin_password, booking_admin_password FROM leads WHERE id = ?", [id]);
+          const lead = db2.get(`SELECT id, name, site_url, booking_url, admin_url, admin_password,
+                booking_admin_password, report_key
+         FROM leads WHERE id = ?`, [id]);
           if (!lead)
             throw new Error(`Lead #${id} not found`);
           const base = lead.site_url || lead.booking_url;
           if (!base)
             return { ok: false, error: `#${id} ${lead.name} has no live site yet.` };
           const password = lead.admin_password || lead.booking_admin_password;
-          if (!password) {
+          if (!password && !lead.report_key) {
             return {
               ok: false,
-              error: `No admin password stored for #${id}, so I can't read its stats. Rebuild or hand over the site to provision one.`
+              error: `No report key or admin password stored for #${id}, so I can't read its stats. Run \`sproutkit regenerate ${id}\` to provision a read-only report key.`
             };
           }
-          const stats = await (0, site_stats_1.fetchSiteStats)(base, password);
+          const stats = await (0, site_stats_1.fetchSiteStats)(base, password, lead.report_key);
           if (!stats.ok)
             return { ok: false, error: stats.error, business: lead.name };
           return { ok: true, id, business: lead.name, url: base, ...stats.data };
@@ -96997,7 +97274,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.6.1",
+      version: "1.7.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sproutkit-code",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Sproutkit in your terminal — find leads, build sites, run outreach, all via chat.",
   "bin": {
     "sproutkit": "./dist/index.js"