sproutkit-code 1.6.1 → 1.8.0

package/dist/index.js

@@ -225,6 +225,16 @@ var require_db = __commonJS({
         // redeploys: SESSION_SECRET is regenerated every deploy, so deriving from
         // it would make the client's self-chosen password undecryptable each time.
         "auth_enc_key TEXT",
+        // Read-only per-site key so `sproutkit report` can read visitor stats
+        // WITHOUT the client's password. Means handing the client full ownership
+        // doesn't cost the agency its reporting.
+        "report_key TEXT",
+        // `sproutkit audit` findings: how bad the business's EXISTING site is, and
+        // the specific problems to lead outreach with. Distinct from lead_kind's
+        // absence-based gaps.
+        "site_score INTEGER",
+        "site_issues TEXT",
+        "audited_at TEXT",
         // Reply loop: when we last contacted them, and the latest outcome. Kept on
         // the lead (as well as contact_log) so `followups` is a single cheap query.
         "last_contacted_at TEXT",
@@ -31319,6 +31329,7 @@ var require_analytics_runtime = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.TRACK_SNIPPET = exports2.API_STATS_JS = exports2.API_TRACK_JS = void 0;
     exports2.API_TRACK_JS = `import { list, put } from "@vercel/blob";
+import { createHash, createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
@@ -31333,6 +31344,54 @@ const EVENTS = ["view", "call", "book", "directions", "email", "menu"];
 // the file has to stay small enough to read on every request.
 const MAX_DAYS = 400;
 
+
+// stats.json lives in a PUBLIC Blob at a non-random path, and the store
+// hostname leaks through every photo URL on the site \u2014 so the file's URL must
+// be assumed guessable. Visitor counts are the client's commercial data and the
+// agency's renewal evidence, so the contents are encrypted with AES-256-GCM
+// under AUTH_ENC_KEY (a server-side env var). A direct public read yields
+// opaque bytes instead of the numbers.
+function statsKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-stats:" + material).digest();
+}
+
+function sealStats(obj) {
+  const key = statsKey();
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(JSON.stringify(obj), "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openStats(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // Unencrypted shapes: v0 (no key available) and pre-encryption files that
+  // stored { days } directly. Both must keep working.
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.days && raw.v === undefined) return raw;
+  if (raw.v !== 1) return null;
+  const key = statsKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    // Wrong key or tampered file \u2014 start fresh rather than throwing at a visitor.
+    return null;
+  }
+}
+
 function today() {
   return new Date().toISOString().slice(0, 10);
 }
@@ -31344,7 +31403,7 @@ async function readStats() {
     if (!target) return { days: {} };
     const res = await fetch(target.url, { cache: "no-store" });
     if (!res.ok) return { days: {} };
-    const j = await res.json();
+    const j = openStats(await res.json());
     return j && typeof j === "object" && j.days ? j : { days: {} };
   } catch {
     return { days: {} };
@@ -31391,7 +31450,7 @@ export default async function handler(req, res) {
   }
 
   try {
-    await put(STATS_KEY, JSON.stringify(stats), {
+    await put(STATS_KEY, sealStats(stats), {
       access: "public",
       addRandomSuffix: false,
       allowOverwrite: true,
@@ -31404,12 +31463,110 @@ export default async function handler(req, res) {
 }
 `;
     exports2.API_STATS_JS = `import { list } from "@vercel/blob";
-import { createHmac, timingSafeEqual } from "node:crypto";
+import {
+  createHmac,
+  timingSafeEqual,
+  createHash,
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from "node:crypto";
 
 export const config = { runtime: "nodejs" };
 
 const PFX = process.env.SITE_ID ? "sites/" + process.env.SITE_ID + "/" : "";
 const STATS_KEY = PFX + "stats.json";
+const AUTH_KEY = PFX + "admin-auth.json";
+
+
+// stats.json lives in a PUBLIC Blob at a non-random path, and the store
+// hostname leaks through every photo URL on the site \u2014 so the file's URL must
+// be assumed guessable. Visitor counts are the client's commercial data and the
+// agency's renewal evidence, so the contents are encrypted with AES-256-GCM
+// under AUTH_ENC_KEY (a server-side env var). A direct public read yields
+// opaque bytes instead of the numbers.
+function statsKey() {
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  return createHash("sha256").update("sproutkit-stats:" + material).digest();
+}
+
+function sealStats(obj) {
+  const key = statsKey();
+  if (!key) return JSON.stringify({ v: 0, plain: obj });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(JSON.stringify(obj), "utf8"), cipher.final()]);
+  return JSON.stringify({
+    v: 1,
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    ct: ct.toString("base64"),
+  });
+}
+
+function openStats(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  // Unencrypted shapes: v0 (no key available) and pre-encryption files that
+  // stored { days } directly. Both must keep working.
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.days && raw.v === undefined) return raw;
+  if (raw.v !== 1) return null;
+  const key = statsKey();
+  if (!key) return null;
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    // Wrong key or tampered file \u2014 start fresh rather than throwing at a visitor.
+    return null;
+  }
+}
+
+
+// Tokens carry the credential version they were minted under. A password change
+// bumps it, so cookies issued earlier stop working \u2014 without this, "I changed my
+// password" wouldn't revoke anyone for up to 8 hours, and the client couldn't
+// actually take their site back from the agency.
+//
+// Fails OPEN when the blob is unreadable: a Blob hiccup must not lock an owner
+// out of their own site. The password itself is still required to get a token.
+async function tokenVersionOk(data) {
+  try {
+    const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
+    const target = blobs.find((b) => b.pathname === AUTH_KEY);
+    if (!target) return true;
+    const res = await fetch(target.url, { cache: "no-store" });
+    if (!res.ok) return true;
+    const rec = openStatsRecord(await res.json());
+    const current = rec && Number(rec.tokenVersion) ? Number(rec.tokenVersion) : 0;
+    return (Number(data && data.ver) || 0) >= current;
+  } catch {
+    return true;
+  }
+}
+
+// admin-auth.json is sealed with a different key label than stats.json.
+function openStatsRecord(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  if (raw.v === 0 && raw.plain) return raw.plain;
+  if (raw.v !== 1) return null;
+  const material = process.env.AUTH_ENC_KEY || "";
+  if (!material) return null;
+  try {
+    const key = createHash("sha256").update("sproutkit-admin-auth:" + material).digest();
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(raw.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(raw.tag, "base64"));
+    return JSON.parse(
+      Buffer.concat([decipher.update(Buffer.from(raw.ct, "base64")), decipher.final()]).toString("utf8")
+    );
+  } catch {
+    return null;
+  }
+}
 
 function verifySession(req) {
   const cookie = req.headers.cookie || "";
@@ -31427,7 +31584,8 @@ function verifySession(req) {
     const data = JSON.parse(
       Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")
     );
-    return typeof data.exp === "number" && data.exp > Date.now() / 1000;
+    if (!(typeof data.exp === "number" && data.exp > Date.now() / 1000)) return false;
+    return data;
   } catch {
     return false;
   }
@@ -31450,8 +31608,32 @@ function shiftDays(n) {
   return d.toISOString().slice(0, 10);
 }
 
+// The agency needs these numbers for renewal conversations, but must NOT need
+// the client's password to get them \u2014 otherwise the agency permanently holds the
+// client's login, and the client changing it silently breaks reporting.
+//
+// REPORT_KEY is a separate, per-site, read-only credential. It is accepted ONLY
+// here: it cannot edit content, read bookings, or change the password. So handing
+// the client full ownership and keeping agency reporting are no longer in
+// conflict.
+function verifyReportKey(req) {
+  const expected = process.env.REPORT_KEY;
+  if (!expected) return false;
+  const header = req.headers["authorization"] || req.headers["x-report-key"] || "";
+  const provided = String(header).replace(/^Bearer\\s+/i, "");
+  if (!provided || provided.length !== expected.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(provided), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+
 export default async function handler(req, res) {
-  if (!verifySession(req)) {
+  const claims = verifySession(req);
+  const viaSession = claims ? await tokenVersionOk(claims) : false;
+  const viaReportKey = viaSession ? false : verifyReportKey(req);
+  if (!viaSession && !viaReportKey) {
     res.status(401).json({ error: "unauthorized" });
     return;
   }
@@ -31462,7 +31644,7 @@ export default async function handler(req, res) {
     if (target) {
       const r = await fetch(target.url, { cache: "no-store" });
       if (r.ok) {
-        const j = await r.json();
+        const j = openStats(await r.json());
         if (j && j.days) stats = j;
       }
     }
@@ -31473,6 +31655,7 @@ export default async function handler(req, res) {
   const today = shiftDays(0);
   res.setHeader("Cache-Control", "no-store");
   res.status(200).json({
+    via: viaSession ? "owner" : "report_key",
     last30: windowTotals(stats.days, shiftDays(-29), today),
     // The comparison window is what makes the number mean something.
     prev30: windowTotals(stats.days, shiftDays(-59), shiftDays(-30)),
@@ -33339,7 +33522,7 @@ var require_cms_runtime = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
+    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_LOGOUT_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
     exports2.generateFriendlyPassword = generateFriendlyPassword;
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
@@ -33715,11 +33898,23 @@ export default async function handler(req, res) {
     delete throttle[who];
     await writeJson(THROTTLE_KEY, throttle);
   }
-  const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 8; // 8h
-  const token = sign({ role: "admin", exp }, secret);
+  // 2h, not 8h. /api/stats checks the credential version and revokes instantly,
+  // but the content/upload/booking endpoints don't (each is a standalone
+  // serverless file and adding the check to all of them means duplicating the
+  // auth-blob crypto five more times). So a cookie issued before a password
+  // change can still WRITE for up to this long. Two hours keeps that window
+  // small; the honest fix is a shared auth module, which needs a bundler for the
+  // generated site.
+  const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 2;
+  // Stamp the credential version into the token. Changing the password bumps
+  // this, which instantly invalidates every cookie issued before the change \u2014
+  // otherwise "I changed my password" wouldn't actually lock anyone out for up
+  // to 8 hours, which makes handover a false promise.
+  const ver = (override && Number(override.tokenVersion)) || 0;
+  const token = sign({ role: "admin", ver, exp }, secret);
   res.setHeader(
     "Set-Cookie",
-    "sk_admin=" + token + "; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=" + 60 * 60 * 8
+    "sk_admin=" + token + "; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=" + 60 * 60 * 2
   );
   res.status(200).json({ ok: true });
 }
@@ -33861,7 +34056,7 @@ function readBody(req) {
   });
 }
 
-async function currentHash() {
+async function currentRecord() {
   try {
     const { blobs } = await list({ prefix: AUTH_KEY, limit: 1 });
     const target = blobs.find((b) => b.pathname === AUTH_KEY);
@@ -33869,13 +34064,13 @@ async function currentHash() {
       const res = await fetch(target.url, { cache: "no-store" });
       if (res.ok) {
         const j = openAuth(await res.json());
-        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j.passwordHash;
+        if (j && typeof j.passwordHash === "string" && j.passwordHash) return j;
       }
     }
   } catch {
     // fall through to the env var
   }
-  return process.env.ADMIN_PASSWORD_HASH || "";
+  return null;
 }
 
 export default async function handler(req, res) {
@@ -33916,7 +34111,8 @@ export default async function handler(req, res) {
     return;
   }
 
-  const existing = await currentHash();
+  const existingRecord = await currentRecord();
+  const existing = existingRecord ? existingRecord.passwordHash : process.env.ADMIN_PASSWORD_HASH || "";
   if (!existing) {
     res.status(500).json({ error: "not_configured" });
     return;
@@ -33933,7 +34129,13 @@ export default async function handler(req, res) {
   try {
     // clientChanged is read (unencrypted) by nothing sensitive \u2014 it only tells
     // the agency "your stored copy is no longer the live password".
-    await put(AUTH_KEY, sealAuth({ passwordHash, updatedAt: new Date().toISOString(), clientChanged: true }), {
+    const nextVersion = (Number(existingRecord && existingRecord.tokenVersion) || 0) + 1;
+    await put(AUTH_KEY, sealAuth({
+      passwordHash,
+      updatedAt: new Date().toISOString(),
+      clientChanged: true,
+      tokenVersion: nextVersion,
+    }), {
       access: "public",
       addRandomSuffix: false,
       allowOverwrite: true,
@@ -33943,6 +34145,20 @@ export default async function handler(req, res) {
     res.status(500).json({ error: "save_failed", detail: (e && e.message) || "unknown" });
     return;
   }
+  // Clear the caller's own cookie too \u2014 their old token is now invalid, so
+  // leaving it set would just produce confusing 401s until they reload.
+  res.setHeader("Set-Cookie", "sk_admin=; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=0");
+  res.status(200).json({ ok: true, signedOut: true });
+}
+`;
+    exports2.API_ADMIN_LOGOUT_JS = `export const config = { runtime: "nodejs" };
+
+export default function handler(req, res) {
+  if (req.method !== "POST") {
+    res.status(405).json({ error: "method_not_allowed" });
+    return;
+  }
+  res.setHeader("Set-Cookie", "sk_admin=; Path=/; HttpOnly; SameSite=Lax; Secure; Max-Age=0");
   res.status(200).json({ ok: true });
 }
 `;
@@ -34727,7 +34943,11 @@ export default async function handler(req, res) {
   }
 
   function TabBar(props) {
-    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12 } },
+    async function signOut() {
+      try { await fetch("/api/admin/logout", { method: "POST", credentials: "same-origin" }); } catch (e) {}
+      window.location.reload();
+    }
+    return h("div", { style: { display: "flex", gap: 4, marginBottom: 24, borderBottom: "1px solid var(--border)", paddingBottom: 12, alignItems: "center" } },
       props.tabs.map(function (t) {
         var active = props.section[0] === t.id;
         return h("button", {
@@ -34741,7 +34961,19 @@ export default async function handler(req, res) {
             font: "inherit", fontWeight: 500, fontSize: 13, cursor: "pointer"
           }
         }, t.label);
-      })
+      }).concat([
+        // Without this, a shared or public computer keeps a live admin session.
+        h("button", {
+          key: "__signout",
+          onClick: signOut,
+          title: "Sign out",
+          style: {
+            marginLeft: "auto", background: "transparent", color: "var(--muted)",
+            border: "1px solid var(--border)", borderRadius: 999, padding: "8px 14px",
+            font: "inherit", fontSize: 12, cursor: "pointer"
+          }
+        }, "Sign out")
+      ])
     );
   }
 
@@ -34768,8 +35000,11 @@ export default async function handler(req, res) {
         var data = null;
         try { data = await res.json(); } catch (_) { data = null; }
         if (res.ok) {
-          msg[1]("Password changed. Use the new one next time you sign in.");
+          msg[1]("Password changed \u2014 signing you back in\u2026");
           cur[1](""); next[1](""); again[1]("");
+          // The server invalidated this session, so stay logged in would just
+          // produce confusing 401s. Reload straight into the login screen.
+          setTimeout(function () { window.location.reload(); }, 1200);
         } else if (res.status === 401) {
           err[1]((data && data.error) === "wrong_current_password"
             ? "That's not your current password."
@@ -80691,6 +80926,15 @@ var require_builder = __commonJS({
       db2.run("UPDATE leads SET site_uid = ? WHERE id = ?", [uid, leadId]);
       return uid;
     }
+    function reportKeyFor(leadId) {
+      const db2 = (0, db_1.getDb)();
+      const row = db2.get("SELECT report_key FROM leads WHERE id = ?", [leadId]);
+      if (row?.report_key)
+        return row.report_key;
+      const key = (0, crypto_1.randomUUID)().replace(/-/g, "") + (0, crypto_1.randomUUID)().replace(/-/g, "");
+      db2.run("UPDATE leads SET report_key = ? WHERE id = ?", [key, leadId]);
+      return key;
+    }
     function authEncKeyFor(leadId) {
       const db2 = (0, db_1.getDb)();
       const row = db2.get("SELECT auth_enc_key FROM leads WHERE id = ?", [leadId]);
@@ -81459,6 +81703,7 @@ export default defineConfig({ plugins: [react()] });`;
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: sessionSecret,
           AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         });
         const vercelJson = JSON.stringify({
@@ -81473,6 +81718,7 @@ export default defineConfig({ plugins: [react()] });`;
           { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
           { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
           { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+          { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
           { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" },
           { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" },
           { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }
@@ -81498,7 +81744,11 @@ export default defineConfig({ plugins: [react()] });`;
         await setProjectEnv(projectName, vercelToken, {
           BLOB_READ_WRITE_TOKEN: blobToken,
           SITE_ID: siteUidFor(lead.id),
-          BUSINESS_NAME: lead.name
+          BUSINESS_NAME: lead.name,
+          // Encrypts stats.json — the Blob is public and its path is guessable, so
+          // without this the visit counts are readable by anyone who finds the URL.
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id)
         });
       }
       const totalMb = allFiles.reduce((s, f) => s + f.data.length, 0) / 1048576;
@@ -81583,7 +81833,7 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
       const viteConfigCms = `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
-      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
       if (!filesToRedeploy.some((f) => f.file === "src/App.jsx")) {
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
@@ -81594,6 +81844,7 @@ export default defineConfig({ plugins: [react()] });`;
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: sessionSecret,
         AUTH_ENC_KEY: authEncKeyFor(lead.id),
+        REPORT_KEY: reportKeyFor(lead.id),
         BUSINESS_NAME: lead.name
       };
       if (existingUid)
@@ -81693,7 +81944,8 @@ export default defineConfig({ plugins: [react()] });`;
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: adminHash,
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
-          AUTH_ENC_KEY: authEncKeyFor(lead.id)
+          AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id)
         };
         if (bookingExistingUid)
           adminEnv.SITE_ID = bookingExistingUid;
@@ -81741,6 +81993,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
         { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+        { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
         { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" },
         { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" },
         { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }
@@ -81789,7 +82042,8 @@ export default defineConfig({ plugins: [react()] });`;
         // Admin panel auth.
         ADMIN_PASSWORD_HASH: adminHash,
         SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
-        AUTH_ENC_KEY: authEncKeyFor(lead.id)
+        AUTH_ENC_KEY: authEncKeyFor(lead.id),
+        REPORT_KEY: reportKeyFor(lead.id)
       });
       const files = [
         { file: "index.html", data: booking_runtime_1.BOOK_INDEX_HTML, encoding: "utf-8" },
@@ -81803,6 +82057,7 @@ export default defineConfig({ plugins: [react()] });`;
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
         { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
+        { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
         { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" },
         { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" },
         // Serve /admin without a trailing-slash redirect dance.
@@ -81986,12 +82241,13 @@ export default defineConfig({ plugins: [react()] });`,
             ]
           }),
           encoding: "utf-8"
-        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
         const env = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
           SESSION_SECRET: (0, cms_runtime_1.generateSessionSecret)(),
           AUTH_ENC_KEY: authEncKeyFor(lead.id),
+          REPORT_KEY: reportKeyFor(lead.id),
           BUSINESS_NAME: lead.name
         };
         if (siteUid)
@@ -82540,6 +82796,389 @@ var require_booking_detect = __commonJS({
   }
 });
 
+// ../desktop/dist/main/lib/site-audit.js
+var require_site_audit = __commonJS({
+  "../desktop/dist/main/lib/site-audit.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    var __importDefault = exports2 && exports2.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.auditSite = auditSite;
+    exports2.isRebuildProspect = isRebuildProspect;
+    exports2.headlineIssues = headlineIssues;
+    var axios_1 = __importDefault(require_axios());
+    var tls = __importStar(require("tls"));
+    var url_1 = require("url");
+    var WEIGHT = {
+      critical: 30,
+      major: 15,
+      minor: 6
+    };
+    async function checkTls(hostname) {
+      return new Promise((resolve) => {
+        let settled = false;
+        const done = (r) => {
+          if (settled)
+            return;
+          settled = true;
+          socket.destroy();
+          resolve(r);
+        };
+        const socket = tls.connect({ host: hostname, port: 443, servername: hostname, timeout: 12e3 }, () => {
+          if (!socket.authorized) {
+            done({
+              ok: false,
+              issue: {
+                code: "tls_invalid",
+                label: "The security certificate isn\u2019t valid \u2014 browsers warn visitors before they can see the site",
+                severity: "critical",
+                detail: socket.authorizationError ? String(socket.authorizationError) : void 0
+              }
+            });
+            return;
+          }
+          const cert = socket.getPeerCertificate();
+          if (!cert || !cert.valid_to) {
+            done({ ok: true });
+            return;
+          }
+          const days = Math.round((new Date(cert.valid_to).getTime() - Date.now()) / 864e5);
+          if (days < 0) {
+            done({
+              ok: false,
+              daysToExpiry: days,
+              issue: {
+                code: "tls_expired",
+                label: "The security certificate has expired \u2014 visitors see a full-page warning",
+                severity: "critical",
+                detail: `expired ${Math.abs(days)} days ago`
+              }
+            });
+            return;
+          }
+          if (days <= 14) {
+            done({
+              ok: true,
+              daysToExpiry: days,
+              issue: {
+                code: "tls_expiring",
+                label: "The security certificate expires within two weeks",
+                severity: "major",
+                detail: `${days} days left`
+              }
+            });
+            return;
+          }
+          done({ ok: true, daysToExpiry: days });
+        });
+        socket.on("error", (err) => {
+          const msg = err.message || "";
+          const code = err.code ?? "";
+          let issue;
+          if (/certificate has expired|CERT_HAS_EXPIRED/i.test(msg + code)) {
+            issue = {
+              code: "tls_expired",
+              label: "The security certificate has expired \u2014 visitors see a full-page browser warning before they reach the site",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/self.signed|SELF_SIGNED/i.test(msg + code)) {
+            issue = {
+              code: "tls_self_signed",
+              label: "The security certificate isn\u2019t from a recognised authority, so browsers warn visitors away",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/altnames|hostname\/ip does not match|ERR_TLS_CERT_ALTNAME/i.test(msg + code)) {
+            issue = {
+              code: "tls_wrong_host",
+              label: "The security certificate was issued for a different domain, so browsers reject it",
+              severity: "critical",
+              detail: msg
+            };
+          } else if (/ECONNREFUSED|ENOTFOUND|EHOSTUNREACH|ECONNRESET/i.test(msg + code)) {
+            issue = {
+              code: "tls_unavailable",
+              label: "The site has no working HTTPS \u2014 Chrome labels it \u201CNot secure\u201D to every visitor",
+              severity: "critical",
+              detail: msg
+            };
+          } else {
+            issue = {
+              code: "tls_error",
+              label: "Secure connections to the site fail",
+              severity: "major",
+              detail: msg
+            };
+          }
+          done({ ok: false, issue });
+        });
+        socket.on("timeout", () => {
+          done({
+            ok: false,
+            issue: {
+              code: "tls_timeout",
+              label: "Secure connections to the site time out",
+              severity: "major"
+            }
+          });
+        });
+      });
+    }
+    function markupIssues(html, finalUrl) {
+      const issues = [];
+      const head = html.slice(0, 6e4);
+      if (!/<meta[^>]+name=["']?viewport/i.test(head)) {
+        issues.push({
+          code: "not_mobile",
+          label: "Not built for phones \u2014 the page loads zoomed out and has to be pinched to read",
+          severity: "critical"
+        });
+      }
+      const tableCount = (html.match(/<table/gi) ?? []).length;
+      if (tableCount >= 3 || /<table[^>]*>[\s\S]{0,400}<table/i.test(html)) {
+        issues.push({
+          code: "table_layout",
+          label: "Built with table layouts, a technique abandoned around 2010",
+          severity: "major",
+          detail: `${tableCount} tables`
+        });
+      }
+      if (/<(font|center|marquee|blink)\b/i.test(html)) {
+        const tag = html.match(/<(font|center|marquee|blink)\b/i)?.[1]?.toLowerCase();
+        issues.push({
+          code: "obsolete_tags",
+          label: `Uses HTML tags (<${tag}>) that have been removed from the web standard`,
+          severity: "major"
+        });
+      }
+      if (/\.swf\b|application\/x-shockwave-flash|<embed[^>]+flash/i.test(html)) {
+        issues.push({
+          code: "flash",
+          label: "Contains Flash content, which no browser has supported since 2020 \u2014 that part of the site is invisible",
+          severity: "critical"
+        });
+      }
+      const jq = html.match(/jquery[.-]?(\d+)\.(\d+)(?:\.(\d+))?(?:\.min)?\.js/i);
+      if (jq) {
+        const major = Number(jq[1]);
+        if (major < 3) {
+          issues.push({
+            code: "old_jquery",
+            label: "Runs a jQuery version with publicly known security vulnerabilities",
+            severity: "major",
+            detail: `jQuery ${jq[1]}.${jq[2]}${jq[3] ? "." + jq[3] : ""}`
+          });
+        }
+      }
+      const year = (/* @__PURE__ */ new Date()).getFullYear();
+      const years = [...html.matchAll(/(?:©|&copy;|copyright)\s*(?:\d{4}\s*[-–]\s*)?(\d{4})/gi)].map((m) => Number(m[1])).filter((y) => y >= 1995 && y <= year);
+      if (years.length) {
+        const newest = Math.max(...years);
+        const age = year - newest;
+        if (age >= 2) {
+          issues.push({
+            code: "stale_copyright",
+            label: `The footer still says ${newest} \u2014 visitors read that as \u201Cpossibly closed down\u201D`,
+            severity: age >= 5 ? "major" : "minor",
+            detail: `${age} years out of date`
+          });
+        }
+      }
+      if (/under construction|coming soon|website is being (?:built|updated)/i.test(head)) {
+        issues.push({
+          code: "under_construction",
+          label: "Still shows an \u201Cunder construction\u201D placeholder",
+          severity: "critical"
+        });
+      }
+      if (/this domain (?:is|may be) for sale|parked (?:free )?(?:at|by)|godaddy\.com\/domainfind|default web page/i.test(head)) {
+        issues.push({
+          code: "parked",
+          label: "The domain shows a parking page rather than a real website",
+          severity: "critical"
+        });
+      }
+      if (finalUrl.startsWith("https://")) {
+        const insecure = html.match(/(?:src|href)=["']http:\/\/(?!localhost)/gi);
+        if (insecure && insecure.length >= 2) {
+          issues.push({
+            code: "mixed_content",
+            label: "Loads images or scripts insecurely, so browsers block them and parts of the page break",
+            severity: "major",
+            detail: `${insecure.length} insecure references`
+          });
+        }
+      }
+      const title = html.match(/<title[^>]*>([\s\S]{0,200}?)<\/title>/i)?.[1]?.trim();
+      if (!title) {
+        issues.push({
+          code: "no_title",
+          label: "The page has no title, so search results show a bare web address",
+          severity: "major"
+        });
+      } else if (/^(home|untitled|new page \d*|document|index|website)$/i.test(title)) {
+        issues.push({
+          code: "default_title",
+          label: `The page title is still the template default (\u201C${title}\u201D), which is what Google shows`,
+          severity: "major"
+        });
+      }
+      if (!/<meta[^>]+name=["']?description/i.test(head)) {
+        issues.push({
+          code: "no_description",
+          label: "No search description, so Google invents one from whatever text it finds",
+          severity: "minor"
+        });
+      }
+      if (/<frameset|<frame\b/i.test(html)) {
+        issues.push({
+          code: "frames",
+          label: "Built with frames, which search engines cannot index properly",
+          severity: "critical"
+        });
+      }
+      return issues;
+    }
+    async function auditSite(websiteUrl) {
+      const raw = (websiteUrl ?? "").trim();
+      if (!raw)
+        return { url: raw, reachable: false, score: 0, issues: [], error: "No URL" };
+      const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`;
+      let hostname;
+      try {
+        hostname = new url_1.URL(withScheme).hostname;
+      } catch {
+        return { url: raw, reachable: false, score: 0, issues: [], error: "Unparseable URL" };
+      }
+      const issues = [];
+      const listedAsHttp = /^http:\/\//i.test(raw);
+      const [tlsResult, page] = await Promise.all([
+        checkTls(hostname).catch(() => ({ ok: true })),
+        fetchPage(withScheme)
+      ]);
+      if (tlsResult.issue)
+        issues.push(tlsResult.issue);
+      if (listedAsHttp && !tlsResult.issue) {
+        issues.push({
+          code: "listed_insecure",
+          label: "The address the business gives out starts with http:// \u2014 visitors following it get a \u201CNot secure\u201D warning",
+          severity: "major"
+        });
+      }
+      if (!page.ok) {
+        return {
+          url: raw,
+          reachable: false,
+          score: scoreOf(issues),
+          issues,
+          error: page.error
+        };
+      }
+      if (page.finalUrl.startsWith("http://") && !tlsResult.issue) {
+        issues.push({
+          code: "no_https_redirect",
+          label: "The site falls back to an unencrypted connection instead of staying secure",
+          severity: "major"
+        });
+      }
+      issues.push(...markupIssues(page.html, page.finalUrl));
+      const htmlKb = Math.round(page.html.length / 1024);
+      if (htmlKb > 600) {
+        issues.push({
+          code: "heavy_page",
+          label: "The page is unusually heavy, so it loads slowly on mobile data",
+          severity: "minor",
+          detail: `${htmlKb} KB of HTML`
+        });
+      }
+      return { url: raw, reachable: true, score: scoreOf(issues), issues, htmlKb };
+    }
+    async function fetchPage(url) {
+      try {
+        const res = await axios_1.default.get(url, {
+          timeout: 2e4,
+          maxRedirects: 5,
+          responseType: "text",
+          // Some hosts serve a stripped page to a bare client.
+          headers: {
+            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36",
+            Accept: "text/html,application/xhtml+xml"
+          },
+          maxContentLength: 5e6,
+          validateStatus: () => true,
+          // We want to inspect a broken-cert site's markup too; the cert problem is
+          // reported separately by checkTls, so this doesn't hide anything.
+          httpsAgent: void 0
+        });
+        if (res.status >= 400) {
+          return { ok: false, error: `HTTP ${res.status}` };
+        }
+        const html = typeof res.data === "string" ? res.data : String(res.data ?? "");
+        if (!html)
+          return { ok: false, error: "Empty response" };
+        const finalUrl = res.request?.res?.responseUrl || url;
+        return { ok: true, html, finalUrl };
+      } catch (e) {
+        return { ok: false, error: e.message };
+      }
+    }
+    function scoreOf(issues) {
+      const total = issues.reduce((sum, i) => sum + WEIGHT[i.severity], 0);
+      return Math.min(100, total);
+    }
+    function isRebuildProspect(audit) {
+      if (!audit.issues.length)
+        return false;
+      const critical = audit.issues.filter((i) => i.severity === "critical").length;
+      const major = audit.issues.filter((i) => i.severity === "major").length;
+      return critical >= 1 || major >= 2;
+    }
+    function headlineIssues(audit, limit = 3) {
+      const rank = { critical: 0, major: 1, minor: 2 };
+      return [...audit.issues].sort((a, b) => rank[a.severity] - rank[b.severity]).slice(0, limit);
+    }
+  }
+});
+
 // ../desktop/dist/main/lib/lead-search.js
 var require_lead_search = __commonJS({
   "../desktop/dist/main/lib/lead-search.js"(exports2) {
@@ -82550,11 +83189,14 @@ var require_lead_search = __commonJS({
     var db_1 = require_db();
     var places_1 = require_places();
     var booking_detect_1 = require_booking_detect();
+    var site_audit_1 = require_site_audit();
     async function searchAndSaveLeadsStream(args, onLead) {
       const db2 = (0, db_1.getDb)();
       const cap = args.maxResults ?? 50;
       const seen = /* @__PURE__ */ new Set();
       const bookingMode = args.mode === "no_booking";
+      const auditMode = args.mode === "outdated";
+      const wantsSiteHavers = bookingMode || auditMode;
       let saved = 0;
       let found = 0;
       await (0, places_1.searchPlacesStream)({
@@ -82563,8 +83205,8 @@ var require_lead_search = __commonJS({
         types: args.types,
         center: args.center,
         radiusMeters: args.radiusMeters,
-        // Booking mode needs the businesses that DO have a website.
-        includeWithWebsite: bookingMode
+        // Booking and audit modes need the businesses that DO have a website.
+        includeWithWebsite: wantsSiteHavers
       }, async (batch) => {
         for (const r of batch) {
           found++;
@@ -82579,7 +83221,19 @@ var require_lead_search = __commonJS({
           let leadKind = "no_website";
           let bookingStatus = null;
           let bookingPlatform = null;
-          if (bookingMode) {
+          let siteScore = null;
+          let siteIssues = null;
+          if (auditMode) {
+            if (!r.website)
+              continue;
+            args.onProgress?.(`Auditing ${r.name}'s website\u2026`);
+            const audit = await (0, site_audit_1.auditSite)(r.website);
+            if (!(0, site_audit_1.isRebuildProspect)(audit))
+              continue;
+            siteScore = audit.score;
+            siteIssues = JSON.stringify(audit.issues);
+            leadKind = "outdated";
+          } else if (bookingMode) {
             if (!r.website)
               continue;
             args.onProgress?.(`Checking ${r.name}'s booking setup\u2026`);
@@ -82593,8 +83247,8 @@ var require_lead_search = __commonJS({
             continue;
           }
           db2.run(`INSERT INTO leads
-            (place_id, name, type, city, address, phone, website, rating, review_count, lat, lng, score, price_level, business_status, status, lead_kind, booking_status, booking_platform)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'discovered', ?, ?, ?)`, [
+            (place_id, name, type, city, address, phone, website, rating, review_count, lat, lng, score, price_level, business_status, status, lead_kind, booking_status, booking_platform, site_score, site_issues, audited_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'discovered', ?, ?, ?, ?, ?, ?)`, [
             r.place_id,
             r.name,
             r.type,
@@ -82611,7 +83265,10 @@ var require_lead_search = __commonJS({
             r.business_status,
             leadKind,
             bookingStatus,
-            bookingPlatform
+            bookingPlatform,
+            siteScore,
+            siteIssues,
+            siteScore === null ? null : (/* @__PURE__ */ new Date()).toISOString()
           ]);
           const row = db2.get("SELECT id FROM leads WHERE place_id = ?", [r.place_id]);
           saved++;
@@ -83148,8 +83805,33 @@ var require_site_stats = __commonJS({
     exports2.fetchSiteStats = fetchSiteStats;
     exports2.pctChange = pctChange;
     var axios_1 = __importDefault(require_axios());
-    async function fetchSiteStats(siteUrl, adminPassword) {
+    async function fetchSiteStats(siteUrl, adminPassword, reportKey) {
       const base = siteUrl.replace(/\/$/, "");
+      if (reportKey) {
+        try {
+          const res = await axios_1.default.get(`${base}/api/stats`, {
+            timeout: 2e4,
+            headers: { Authorization: `Bearer ${reportKey}` },
+            validateStatus: () => true
+          });
+          if (res.status === 200)
+            return { ok: true, data: res.data };
+          if (res.status === 404) {
+            return {
+              ok: false,
+              error: "This site was built before analytics shipped. Run `sproutkit regenerate` on it to add them."
+            };
+          }
+        } catch (e) {
+          return { ok: false, error: `Couldn't reach the site: ${e.message}` };
+        }
+      }
+      if (!adminPassword) {
+        return {
+          ok: false,
+          error: "No report key on this site and no stored admin password. Rebuild it (`sproutkit regenerate`) to provision a read-only report key."
+        };
+      }
       let cookie;
       try {
         const login = await axios_1.default.post(`${base}/api/admin/login`, { password: adminPassword }, {
@@ -94983,6 +95665,7 @@ var require_chat_tools = __commonJS({
     var lead_search_1 = require_lead_search();
     var places_1 = require_places();
     var booking_detect_1 = require_booking_detect();
+    var site_audit_1 = require_site_audit();
     var followup_1 = require_followup();
     var invoicing_1 = require_invoicing();
     var agency_1 = require_agency();
@@ -95174,6 +95857,44 @@ var require_chat_tools = __commonJS({
           required: ["id"]
         }
       },
+      {
+        name: "audit_sites",
+        description: "AUDIT existing websites in an area and save the bad ones as rebuild prospects. Unlike find_leads (which looks for businesses with NO website), this finds businesses that DO have a website and checks it for real, nameable faults: expired or missing HTTPS certificates, no mobile support, table layouts, Flash, obsolete jQuery, parked or under-construction pages, stale copyright years. Each prospect is scored (higher = worse) and its specific problems are stored so outreach can cite them. Use this when the user wants to find outdated, insecure or badly built websites to pitch a rebuild against. Costs the same Places lookup as find_leads plus one fetch per site.",
+        input_schema: {
+          type: "object",
+          properties: {
+            location: {
+              type: "string",
+              description: "Town, postcode, area or address to search, e.g. 'Leeds LS1' or 'Shoreditch, London'."
+            },
+            categories: {
+              type: "array",
+              items: { type: "string" },
+              description: "Business types to search, e.g. ['barber shop','cafe','plumber']."
+            },
+            radiusMeters: {
+              type: "number",
+              description: "Search radius in metres. Defaults to 10000."
+            },
+            limit: {
+              type: "number",
+              description: "Maximum prospects to save. Defaults to 25."
+            }
+          },
+          required: ["location", "categories"]
+        }
+      },
+      {
+        name: "audit_one_site",
+        description: "Audit a SINGLE website by URL and report its faults, without saving anything. Use this when the user names a specific site and asks what's wrong with it, or to check a business's site before pitching them.",
+        input_schema: {
+          type: "object",
+          properties: {
+            url: { type: "string", description: "The website to audit, e.g. 'thebarbers.co.uk'." },
+            id: { type: "number", description: "Or a lead id \u2014 audits that lead's website and stores the result." }
+          }
+        }
+      },
       {
         name: "hand_over_site",
         description: "HAND OVER a finished site to the paying client: removes the DEMO/preview banner, optionally attaches the client's own domain, and returns every credential in one place (site URL, /admin panel + password, booking page + its password, and the DNS records the client must set at their registrar). This is the paid-deliverable step \u2014 the banner exists to stop clients using a free demo as their real site, so only run this when the user says the client has paid / signed off / is going live. Requires the lead to already have a built site or booking page.",
@@ -95946,24 +96667,97 @@ Interested?`;
         }
         case "site_report": {
           const id = Number(input.id);
-          const lead = db2.get("SELECT id, name, site_url, booking_url, admin_url, admin_password, booking_admin_password FROM leads WHERE id = ?", [id]);
+          const lead = db2.get(`SELECT id, name, site_url, booking_url, admin_url, admin_password,
+                booking_admin_password, report_key
+         FROM leads WHERE id = ?`, [id]);
           if (!lead)
             throw new Error(`Lead #${id} not found`);
           const base = lead.site_url || lead.booking_url;
           if (!base)
             return { ok: false, error: `#${id} ${lead.name} has no live site yet.` };
           const password = lead.admin_password || lead.booking_admin_password;
-          if (!password) {
+          if (!password && !lead.report_key) {
             return {
               ok: false,
-              error: `No admin password stored for #${id}, so I can't read its stats. Rebuild or hand over the site to provision one.`
+              error: `No report key or admin password stored for #${id}, so I can't read its stats. Run \`sproutkit regenerate ${id}\` to provision a read-only report key.`
             };
           }
-          const stats = await (0, site_stats_1.fetchSiteStats)(base, password);
+          const stats = await (0, site_stats_1.fetchSiteStats)(base, password, lead.report_key);
           if (!stats.ok)
             return { ok: false, error: stats.error, business: lead.name };
           return { ok: true, id, business: lead.name, url: base, ...stats.data };
         }
+        case "audit_sites": {
+          const location = String(input.location ?? "").trim();
+          const categories = input.categories ?? [];
+          if (!location || categories.length === 0) {
+            return { ok: false, error: "Give me a location and at least one business category." };
+          }
+          const placesKey = getDecryptedSetting("places_key");
+          if (!placesKey)
+            throw new Error("Google Places API key not set in Settings");
+          ctx.emitProgress?.({
+            channel: "leads:searching",
+            payload: { msg: `Auditing websites in ${location}\u2026` }
+          });
+          const matches = await (0, places_1.geocodeForward)(location, 1);
+          const place = matches[0];
+          const result = await (0, lead_search_1.searchAndSaveLeadsStream)({
+            placesKey,
+            city: location,
+            types: categories,
+            maxResults: Math.min(Number(input.limit ?? 25), 100),
+            center: place ? { lat: place.lat, lng: place.lng } : void 0,
+            radiusMeters: Number(input.radiusMeters ?? 1e4),
+            mode: "outdated"
+          }, (lead) => ctx.emitProgress?.({ channel: "leads:found", payload: { lead } }));
+          ctx.emitProgress?.({ channel: "leads:changed", payload: { reason: "audit_sites" } });
+          const saved = db2.all(`SELECT id, name, website, site_score, site_issues
+         FROM leads
+         WHERE lead_kind = 'outdated' AND audited_at IS NOT NULL
+         ORDER BY audited_at DESC, site_score DESC
+         LIMIT ?`, [Number(input.limit ?? 25)]);
+          return {
+            ok: true,
+            found: result.found,
+            saved: result.saved,
+            prospects: saved.map((r) => ({
+              id: r.id,
+              business: r.name,
+              website: r.website,
+              score: r.site_score,
+              issues: JSON.parse(r.site_issues || "[]").slice(0, 3).map((i) => `${i.severity}: ${i.label}`)
+            }))
+          };
+        }
+        case "audit_one_site": {
+          let url = input.url ?? "";
+          let leadId = null;
+          if (input.id != null) {
+            leadId = Number(input.id);
+            const lead = db2.get("SELECT id, name, website FROM leads WHERE id = ?", [leadId]);
+            if (!lead)
+              throw new Error(`Lead #${leadId} not found`);
+            if (!lead.website)
+              return { ok: false, error: `#${leadId} ${lead.name} has no website on record.` };
+            url = lead.website;
+          }
+          if (!url)
+            return { ok: false, error: "Give me a website URL or a lead id." };
+          const audit = await (0, site_audit_1.auditSite)(url);
+          if (leadId !== null) {
+            db2.run("UPDATE leads SET site_score = ?, site_issues = ?, audited_at = ? WHERE id = ?", [audit.score, JSON.stringify(audit.issues), (/* @__PURE__ */ new Date()).toISOString(), leadId]);
+          }
+          return {
+            ok: true,
+            url: audit.url,
+            reachable: audit.reachable,
+            score: audit.score,
+            worthRebuilding: (0, site_audit_1.isRebuildProspect)(audit),
+            issues: audit.issues,
+            error: audit.error
+          };
+        }
         case "hand_over_site": {
           const id = Number(input.id);
           const lead = db2.get("SELECT id, name, site_url, booking_url FROM leads WHERE id = ?", [id]);
@@ -96997,7 +97791,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.6.1",
+      version: "1.8.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -98869,6 +99663,135 @@ async function cmdReport(argv) {
     process.exitCode = 1;
   }
 }
+async function cmdAudit(argv) {
+  const { flags, rest } = parseArgs(argv);
+  const json = !!flags.json;
+  const SEV_COLOUR = {
+    critical: c.red,
+    major: c.amber,
+    minor: c.dim
+  };
+  const asId = Number(flags.id ?? rest[0]);
+  const singleUrl = flags.url ? String(flags.url) : void 0;
+  const looksLikeUrl = singleUrl || rest[0] && /\./.test(String(rest[0])) && !flags.categories;
+  if (singleUrl || !Number.isNaN(asId) && rest.length === 1 && !flags.categories || looksLikeUrl) {
+    const status2 = json ? void 0 : new Status();
+    const target = singleUrl ?? (Number.isNaN(asId) ? String(rest[0]) : `lead #${asId}`);
+    if (status2) status2.start(`Auditing ${target}`);
+    try {
+      const r = await runTool(
+        "audit_one_site",
+        Number.isNaN(asId) || singleUrl ? { url: singleUrl ?? String(rest[0]) } : { id: asId },
+        makeCtx({ json, status: status2 })
+      );
+      if (r && r.ok === false) {
+        if (status2) status2.done(false, r.error ?? "Couldn't audit it");
+        if (json) emitJson(r);
+        process.exitCode = 1;
+        return;
+      }
+      if (status2) {
+        status2.done(
+          true,
+          r.issues && r.issues.length ? `${r.issues.length} issue${r.issues.length === 1 ? "" : "s"} \xB7 score ${r.score}` : "No problems found"
+        );
+      }
+      if (json) {
+        emitJson(r);
+        return;
+      }
+      say();
+      say(`  ${c.bold(String(r.url))}` + c.dim(`  \xB7  score ${r.score}/100`));
+      if (!r.issues?.length) {
+        say(c.dim("  Nothing worth pitching against \u2014 this site is in decent shape."));
+        say();
+        return;
+      }
+      say();
+      for (const i of r.issues) {
+        const tint = SEV_COLOUR[i.severity] ?? c.dim;
+        say(`  ${tint("\u25CF")} ${i.label}${i.detail ? c.dim(`  (${i.detail})`) : ""}`);
+      }
+      say();
+      say(
+        r.worthRebuilding ? c.green("  Worth approaching \u2014 these are concrete problems you can name.") : c.dim("  Minor only. Probably not worth a rebuild pitch.")
+      );
+      say();
+    } catch (e) {
+      if (status2) status2.done(false, "Audit failed");
+      json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+      process.exitCode = 1;
+    }
+    return;
+  }
+  const location = rest.join(" ").trim() || (flags.location ? String(flags.location) : "");
+  if (!location) {
+    const err = 'Usage: sproutkit audit "<area>" --categories "barber shop,cafe"\n         single site: sproutkit audit <leadId>  \xB7  sproutkit audit --url thebarbers.co.uk';
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const categories = flags.categories ? String(flags.categories).split(",").map((t) => t.trim()).filter(Boolean) : [];
+  if (categories.length === 0) {
+    const err = 'Which trades? e.g. --categories "barber shop,cafe,plumber"';
+    json ? emitJson({ ok: false, error: err }) : say(c.red("  " + err));
+    process.exitCode = 1;
+    return;
+  }
+  const status = json ? void 0 : new Status();
+  if (status) status.start(`Auditing websites in ${location}`);
+  try {
+    const r = await runTool(
+      "audit_sites",
+      {
+        location,
+        categories,
+        radiusMeters: flags.radius ? Number(flags.radius) : void 0,
+        limit: flags.limit ? Number(flags.limit) : void 0
+      },
+      makeCtx({ json, status })
+    );
+    if (r && r.ok === false) {
+      if (status) status.done(false, r.error ?? "Audit failed");
+      if (json) emitJson(r);
+      process.exitCode = 1;
+      return;
+    }
+    if (status) status.done(true, `${r.saved} rebuild prospect${r.saved === 1 ? "" : "s"} from ${r.found} checked`);
+    autoSync();
+    if (json) {
+      emitJson(r);
+      return;
+    }
+    const list = r.prospects ?? [];
+    if (!list.length) {
+      say();
+      say(c.dim(`  Checked ${r.found} businesses \u2014 none had a site bad enough to pitch against.`));
+      say(c.dim("  That's a good sign for the area; try a different trade or a wider radius."));
+      say();
+      return;
+    }
+    say();
+    say(c.dim("  Worst first \u2014 these are the easiest conversations to start."));
+    say();
+    for (const p of list) {
+      say(`  ${c.greenBold("#" + p.id)} ${c.bold(p.business)}  ${c.dim(p.website.replace(/^https?:\/\//, ""))}`);
+      say(`      ${c.amber("score " + p.score + "/100")}`);
+      for (const issue of p.issues) {
+        const [sev, ...restText] = issue.split(": ");
+        const tint = SEV_COLOUR[sev] ?? c.dim;
+        say(`      ${tint("\u25CF")} ${restText.join(": ")}`);
+      }
+      say();
+    }
+    say(c.dim("  Build one: sproutkit build <id>   \xB7   see everything: sproutkit audit <id>"));
+    say();
+  } catch (e) {
+    if (status) status.done(false, "Audit failed");
+    json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
+    process.exitCode = 1;
+  }
+}
 async function cmdRegenerate(argv) {
   const { flags, rest } = parseArgs(argv);
   const json = !!flags.json;
@@ -99131,6 +100054,8 @@ When a request is missing information the command needs, ask a SHORT, STRUCTURED
 COMMANDS:
 - sproutkit find "<area>" --categories "<type>,<type>" --json   \u2014 find website-less leads
 - sproutkit find "<area>" --categories "\u2026" --booking --json     \u2014 find businesses that HAVE a site but take bookings via WhatsApp/phone only (booking-page prospects)
+- sproutkit audit "<area>" --categories "\u2026" --json              \u2014 find businesses whose EXISTING site is insecure/outdated
+- sproutkit audit <id> | --url <site> --json                    \u2014 audit one site, list its faults
 - sproutkit list [--status <s>] [--city <c>] [--limit 100]      \u2014 formatted table; SHOW IT VERBATIM
 - sproutkit list --json                                         \u2014 same data as JSON, for reading ids only
 - sproutkit build <id> --json [--instructions "..."] [--cms] [--multipage]  \u2014 build a demo site (--multipage = real Home/Services/About/Contact pages, not one scroll)
@@ -99330,7 +100255,7 @@ async function main() {
     closeTty();
     return;
   }
-  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "brand" || arg === "invoice" || arg === "letter" || arg === "reply" || arg === "followups" || arg === "report" || arg === "outreach" || arg === "pipeline") {
+  if (arg === "find" || arg === "list" || arg === "build" || arg === "build-all" || arg === "regenerate" || arg === "cms" || arg === "book" || arg === "handover" || arg === "audit" || arg === "brand" || arg === "invoice" || arg === "letter" || arg === "reply" || arg === "followups" || arg === "report" || arg === "outreach" || arg === "pipeline") {
     const subArgs = process.argv.slice(3);
     if (subArgs.includes("--help") || subArgs.includes("-h")) {
       const USAGE = {
@@ -99370,6 +100295,16 @@ async function main() {
           '  --instructions "\u2026"   e.g. "45-min slots, add beard trim \xA312"',
           "  --email <addr>       owner email for booking notifications"
         ],
+        audit: [
+          'sproutkit audit "<area>" --categories "barber shop,cafe"',
+          "  finds businesses that HAVE a website but whose site is costing them",
+          "  work \u2014 no HTTPS, unusable on phones, built in 2008 \u2014 and scores it",
+          "  --radius <m>         search radius (default 10000)",
+          "  --limit <n>          max prospects to save (default 25)",
+          "",
+          "  one site: sproutkit audit <leadId>",
+          "            sproutkit audit --url thebarbers.co.uk"
+        ],
         brand: [
           'sproutkit brand --name "Your Studio" --email you@x.com [--vat-rate 20]',
           "  your agency identity \u2014 goes on invoices, letters, the site footer",
@@ -99447,6 +100382,7 @@ async function main() {
     else if (arg === "cms") await cmdCms(subArgs);
     else if (arg === "book") await cmdBook(subArgs);
     else if (arg === "handover") await cmdHandover(subArgs);
+    else if (arg === "audit") await cmdAudit(subArgs);
     else if (arg === "brand") await cmdBrand(subArgs);
     else if (arg === "invoice") await cmdInvoice(subArgs);
     else if (arg === "letter") await cmdLetter(subArgs);