sproutkit-code 1.9.1 → 1.11.0

package/dist/index.js

@@ -96,7 +96,8 @@ var require_runtime = __commonJS({
       "resend_key",
       "report_key",
       "smtp_pass",
-      "imap_pass"
+      "imap_pass",
+      "stripe_secret_key"
     ]);
     function isSecretSetting(key) {
       return SECRET_SETTINGS.has(key);
@@ -314,6 +315,84 @@ var require_db = __commonJS({
       last_result TEXT,
       created_at TEXT DEFAULT (datetime('now'))
     );
+  `);
+      try {
+        db2.exec("ALTER TABLE schedules ADD COLUMN config TEXT");
+      } catch {
+      }
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS messages (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lead_id INTEGER NOT NULL,
+      direction TEXT NOT NULL,
+      from_addr TEXT,
+      to_addr TEXT,
+      subject TEXT,
+      body TEXT,
+      message_id TEXT UNIQUE,
+      in_reply_to TEXT,
+      at TEXT NOT NULL DEFAULT (datetime('now')),
+      intent TEXT,
+      intent_summary TEXT,
+      confidence REAL,
+      handled TEXT NOT NULL DEFAULT 'new',
+      draft_subject TEXT,
+      draft_body TEXT,
+      sent_by TEXT
+    );
+  `);
+      try {
+        db2.exec("CREATE INDEX IF NOT EXISTS idx_messages_lead ON messages(lead_id, at)");
+      } catch {
+      }
+      try {
+        db2.exec(`
+      INSERT INTO messages (lead_id, direction, from_addr, body, at, handled)
+      SELECT id, 'in', email, last_reply_snippet, COALESCE(last_reply_at, replied_at, datetime('now')), 'done'
+        FROM leads
+       WHERE last_reply_snippet IS NOT NULL AND last_reply_snippet != ''
+         AND NOT EXISTS (SELECT 1 FROM messages m WHERE m.lead_id = leads.id)
+    `);
+      } catch {
+      }
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS do_not_contact (
+      email TEXT PRIMARY KEY,
+      lead_id INTEGER,
+      reason TEXT,
+      at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `);
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS activity_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      at TEXT NOT NULL DEFAULT (datetime('now')),
+      actor TEXT NOT NULL,
+      action TEXT NOT NULL,
+      lead_id INTEGER,
+      detail TEXT,
+      needs_you INTEGER NOT NULL DEFAULT 0
+    );
+  `);
+      db2.exec(`
+    CREATE TABLE IF NOT EXISTS deals (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lead_id INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'open',
+      site_pence INTEGER NOT NULL,
+      care_pence INTEGER NOT NULL DEFAULT 0,
+      currency TEXT NOT NULL,
+      payment_link_id TEXT,
+      payment_url TEXT,
+      checkout_session_id TEXT,
+      stripe_customer_id TEXT,
+      subscription_id TEXT,
+      care_status TEXT,
+      invoice_number TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      paid_at TEXT,
+      handed_over_at TEXT
+    );
   `);
     }
     function getDb2() {
@@ -30587,12 +30666,31 @@ var require_llm = __commonJS({
         backend: "api"
       };
     }
+    var STALE_MODEL = /issue with the selected model|model .*(does not exist|not found|may not exist)|invalid model/i;
+    var FALLBACK_ALIASES = ["sonnet", "opus", "haiku"];
     async function generateViaClaudeCode(args) {
+      const preferred = getClaudeCodeModel2();
+      try {
+        return await runClaudeCode(args, preferred);
+      } catch (e) {
+        if (!STALE_MODEL.test(e.message))
+          throw e;
+        for (const alias of FALLBACK_ALIASES.filter((a) => a !== preferred)) {
+          try {
+            return await runClaudeCode(args, alias);
+          } catch (e2) {
+            if (!STALE_MODEL.test(e2.message))
+              throw e2;
+          }
+        }
+        throw e;
+      }
+    }
+    async function runClaudeCode(args, alias) {
       if (args.images && args.images.length > 0) {
         throw new Error("Image input isn't supported on the Claude subscription backend. This step needs an Anthropic API key.");
       }
       const cliArgs = ["-p", "--output-format", "json"];
-      const alias = getClaudeCodeModel2();
       if (alias)
         cliArgs.push("--model", alias);
       if (args.allowWebSearch)
@@ -31721,6 +31819,8 @@ export default async function handler(req, res) {
 `;
     exports2.TRACK_SNIPPET = `<script>
 (function(){
+  // The owner editing their own page in /edit isn't a visitor.
+  if (location.search.indexOf("sk_edit=") > -1) return;
   function send(ev){
     try {
       var body = JSON.stringify({ event: ev });
@@ -33576,7 +33676,7 @@ var require_cms_runtime = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_LOGOUT_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
+    exports2.ADMIN_APP_JS = exports2.ADMIN_INDEX_HTML = exports2.EDIT_INDEX_HTML = exports2.API_ADMIN_UPLOAD_JS = exports2.API_ADMIN_LOGOUT_JS = exports2.API_ADMIN_PASSWORD_JS = exports2.API_ADMIN_WHOAMI_JS = exports2.API_ADMIN_LOGIN_JS = exports2.API_CONTENT_JS = void 0;
     exports2.generateFriendlyPassword = generateFriendlyPassword;
     exports2.hashPassword = hashPassword;
     exports2.generateSessionSecret = generateSessionSecret;
@@ -34283,6 +34383,548 @@ export default async function handler(req, res) {
     res.status(500).json({ error: "upload_failed", message: String(e) });
   }
 }
+`;
+    exports2.EDIT_INDEX_HTML = String.raw`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover" />
+<meta name="robots" content="noindex" />
+<meta name="apple-mobile-web-app-capable" content="yes" />
+<meta name="mobile-web-app-capable" content="yes" />
+<meta name="theme-color" content="#0a0a0a" />
+<title>__EDIT_TITLE__</title>
+<style>
+  :root { --accent: #22c55e; --ink: #0a0a0a; --muted: #6b7280; --line: #e5e5e0; }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; height: 100%; overflow: hidden; background: #f4f4f1; color: var(--ink);
+    font-family: Inter, system-ui, -apple-system, "Segoe UI", sans-serif; -webkit-text-size-adjust: 100%; }
+  #site { position: fixed; top: 0; left: 0; width: 100%; border: 0; display: block; background: #fff;
+    height: calc(100% - 64px - env(safe-area-inset-bottom)); }
+  #bar { position: fixed; left: 0; right: 0; bottom: 0; z-index: 5; display: flex; align-items: center; gap: 8px;
+    min-height: calc(64px + env(safe-area-inset-bottom)); padding: 10px 12px calc(10px + env(safe-area-inset-bottom));
+    background: #0a0a0a; color: #fff; }
+  #status { flex: 1; min-width: 0; font-size: 13px; line-height: 1.3; }
+  #status b { display: block; font-size: 14px; }
+  #status span { display: block; color: #a1a1aa; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  button { font: inherit; font-size: 14px; font-weight: 600; border: 0; border-radius: 10px; padding: 11px 16px;
+    cursor: pointer; -webkit-tap-highlight-color: transparent; }
+  .primary { background: var(--accent); color: #04130a; }
+  .primary:disabled { opacity: 0.4; cursor: default; }
+  .ghost { background: #27272a; color: #fff; }
+  .icon { background: transparent; color: #fff; padding: 8px 10px; font-size: 20px; line-height: 1; }
+  #menu { position: fixed; right: 10px; bottom: calc(72px + env(safe-area-inset-bottom)); z-index: 6; display: none;
+    min-width: 230px; padding: 6px; background: #fff; border: 1px solid var(--line); border-radius: 12px;
+    box-shadow: 0 12px 32px rgba(0,0,0,0.18); }
+  #menu a, #menu button { display: block; width: 100%; padding: 12px 14px; border-radius: 8px; background: transparent;
+    color: var(--ink); text-align: left; text-decoration: none; font-size: 14px; font-weight: 500; }
+  #menu a:hover, #menu button:hover { background: #f4f4f1; }
+  #sheet { position: fixed; inset: 0; z-index: 10; display: none; align-items: center; justify-content: center;
+    padding: 16px; background: rgba(10,10,10,0.55); }
+  #sheet form { width: 100%; max-width: 360px; padding: 24px; background: #fff; border-radius: 16px; }
+  #sheet h1 { margin: 0 0 4px; font-size: 20px; letter-spacing: -0.01em; }
+  #sheet p { margin: 0 0 16px; color: var(--muted); font-size: 14px; }
+  #sheet input { width: 100%; margin-bottom: 12px; padding: 12px; border: 1px solid var(--line); border-radius: 10px;
+    font: inherit; font-size: 16px; }
+  #sheet button { width: 100%; }
+  #err { min-height: 1em; margin-top: 10px; color: #b91c1c; font-size: 13px; }
+  #toast { position: fixed; left: 50%; bottom: calc(76px + env(safe-area-inset-bottom)); z-index: 7;
+    max-width: calc(100% - 32px); transform: translateX(-50%); padding: 10px 16px; border-radius: 999px;
+    background: #fff; color: var(--ink); border: 1px solid var(--line); box-shadow: 0 8px 24px rgba(0,0,0,0.15);
+    font-size: 13px; font-weight: 500; text-align: center; opacity: 0; transition: opacity 0.2s; pointer-events: none; }
+  #toast.on { opacity: 1; }
+</style>
+</head>
+<body>
+<iframe id="site" title="Your website"></iframe>
+<div id="bar">
+  <div id="status"><b>Edit mode</b><span>Loading your site…</span></div>
+  <button id="discard" class="ghost" hidden>Undo</button>
+  <button id="save" class="primary" disabled>Save</button>
+  <button id="more" class="icon" aria-label="More options">&#8943;</button>
+</div>
+<div id="menu">
+  <a href="/admin">All settings &mdash; services, hours, photos</a>
+  <a href="/" target="_blank" rel="noopener">View live site</a>
+  <button id="signout" type="button">Sign out</button>
+</div>
+<div id="sheet">
+  <form id="login">
+    <h1>Edit your website</h1>
+    <p>Enter your password to start editing.</p>
+    <input id="pw" type="password" autocomplete="current-password" placeholder="Password" />
+    <button class="primary" type="submit" id="go">Sign in</button>
+    <div id="err"></div>
+  </form>
+</div>
+<input id="file" type="file" accept="image/*" hidden />
+<div id="toast"></div>
+<script src="https://unpkg.com/browser-image-compression@2.0.2/dist/browser-image-compression.js" crossorigin></script>
+<script>
+(function () {
+  var $ = function (id) { return document.getElementById(id); };
+  var frame = $("site"), saveBtn = $("save"), discardBtn = $("discard"), statusEl = $("status");
+  var menu = $("menu"), sheet = $("sheet"), pw = $("pw"), err = $("err"), fileInput = $("file");
+
+  // Fields the owner can change in place. Reviews come live from Google and
+  // the theme is a design choice, so neither is offered here.
+  var TEXT_PATHS = /^(business\.(name|tagline)|hero\.(headline|subheadline|ctaText)|about|services\.\d+\.(title|description|price)|contact\.(address|phone|email)|contact\.hours\.\d+)$/;
+  var MULTILINE = /^(about|hero\.subheadline|services\.\d+\.description)$/;
+  var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+  var base = null;   // content as last saved
+  var draft = null;  // content including unsaved edits
+  var dirty = {};    // path -> true while it differs from base
+  var editing = null, saving = false, loginResolve = null, photoIdx = null;
+  var chipFor = new Map(), observer = null, scanTimer = null;
+
+  function norm(s) { return String(s == null ? "" : s).replace(/\s+/g, " ").trim(); }
+  function clone(o) { return JSON.parse(JSON.stringify(o)); }
+  function get(obj, path) {
+    return path.split(".").reduce(function (o, k) { return o == null ? undefined : o[k]; }, obj);
+  }
+  function put(obj, path, v) {
+    var ks = path.split("."), o = obj;
+    for (var i = 0; i < ks.length - 1; i++) { o = o[ks[i]]; if (o == null) return; }
+    o[ks[ks.length - 1]] = v;
+  }
+  function leaves(obj, prefix, out) {
+    if (typeof obj === "string") { if (TEXT_PATHS.test(prefix)) out.push(prefix); }
+    else if (obj && typeof obj === "object") {
+      Object.keys(obj).forEach(function (k) { leaves(obj[k], prefix ? prefix + "." + k : k, out); });
+    }
+    return out;
+  }
+
+  var toastTimer = null;
+  function toast(msg, ms) {
+    var t = $("toast");
+    t.textContent = msg; t.classList.add("on");
+    clearTimeout(toastTimer);
+    toastTimer = setTimeout(function () { t.classList.remove("on"); }, ms || 2600);
+  }
+
+  function updateBar() {
+    var n = Object.keys(dirty).length;
+    saveBtn.disabled = n === 0 || saving;
+    saveBtn.textContent = saving ? "Saving…" : "Save";
+    discardBtn.hidden = n === 0 || saving;
+    statusEl.innerHTML = n
+      ? "<b>" + n + " unsaved change" + (n > 1 ? "s" : "") + "</b><span>Press Save to put them live</span>"
+      : "<b>Edit mode</b><span>Tap any outlined text or photo to change it</span>";
+  }
+
+  function refreshDirty(paths) {
+    paths.forEach(function (p) {
+      var a = get(draft, p), b = get(base, p);
+      if (p.indexOf("photos.") === 0 ? a !== b : norm(a) !== norm(b)) dirty[p] = true;
+      else delete dirty[p];
+    });
+    updateBar();
+  }
+
+  // ---- Login ----------------------------------------------------------------
+  function requireLogin() {
+    return new Promise(function (resolve) {
+      loginResolve = resolve;
+      err.textContent = "";
+      sheet.style.display = "flex";
+      setTimeout(function () { pw.focus(); }, 50);
+    });
+  }
+  $("login").addEventListener("submit", async function (e) {
+    e.preventDefault();
+    if (!pw.value) return;
+    $("go").disabled = true; err.textContent = "";
+    try {
+      var r = await fetch("/api/admin/login", {
+        method: "POST", credentials: "same-origin",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password: pw.value })
+      });
+      if (r.status === 429) {
+        var lock = await r.json().catch(function () { return {}; });
+        err.textContent = "Too many tries. Wait " + Math.ceil((lock.retryAfter || 900) / 60) + " minutes and try again.";
+      } else if (!r.ok) {
+        err.textContent = r.status === 401 ? "That password didn't work." : "Couldn't sign in (" + r.status + ").";
+      } else {
+        var who = await fetch("/api/admin/whoami", { credentials: "same-origin" });
+        if (!who.ok) {
+          err.textContent = "Signed in, but your browser blocked the login cookie. Turn off strict tracking protection for this site.";
+        } else {
+          pw.value = ""; sheet.style.display = "none";
+          if (loginResolve) { loginResolve(); loginResolve = null; }
+        }
+      }
+    } catch (x) {
+      err.textContent = "No connection. Check your signal and try again.";
+    }
+    $("go").disabled = false;
+  });
+
+  // ---- Matching the page to content.json ------------------------------------
+  // A field may render as one element or, when it has blank-line breaks, one
+  // element per paragraph. "about#1" means the second paragraph of about.
+  function paras(v) { return String(v == null ? "" : v).split(/\n\s*\n/); }
+  function readField(obj, ref) {
+    var at = ref.indexOf("#");
+    if (at < 0) return get(obj, ref);
+    return paras(get(obj, ref.slice(0, at)))[Number(ref.slice(at + 1))];
+  }
+  function writeField(obj, ref, v) {
+    var at = ref.indexOf("#");
+    if (at < 0) return put(obj, ref, v);
+    var path = ref.slice(0, at), list = paras(get(obj, path));
+    list[Number(ref.slice(at + 1))] = v;
+    put(obj, path, list.join("\n\n"));
+  }
+  function fieldOf(ref) { var at = ref.indexOf("#"); return at < 0 ? ref : ref.slice(0, at); }
+
+  function textIndex() {
+    // Saved values too, so a page that still shows old text (a second page of
+    // a multipage site, say) is still recognised — then shown with the draft.
+    var map = {};
+    function add(t, ref) {
+      t = norm(t);
+      if (t.length < 2) return;
+      map[t] = map[t] || [];
+      if (map[t].indexOf(ref) < 0) map[t].push(ref);
+    }
+    leaves(draft, "", []).forEach(function (p) {
+      [draft, base].forEach(function (src) {
+        var v = get(src, p);
+        add(v, p);
+        var list = paras(v);
+        if (list.length > 1) list.forEach(function (para, i) { add(para, p + "#" + i); });
+      });
+    });
+    return map;
+  }
+
+  // Text, line breaks and inline styling (a coloured word in a headline) are
+  // fine to edit in place; anything structural is not.
+  var INLINE = /^(BR|EM|STRONG|B|I|U|SPAN|SMALL|MARK|SUP|SUB)$/;
+  function editableShape(el, text) {
+    for (var i = 0; i < el.children.length; i++) {
+      var c = el.children[i];
+      if (!INLINE.test(c.tagName) || c.children.length > 0) return false;
+      if (norm(c.textContent) === text) return false; // the child is the better match
+    }
+    return true;
+  }
+
+  function injectStyle(doc) {
+    if (doc.getElementById("sk-edit-style")) return;
+    var s = doc.createElement("style");
+    s.id = "sk-edit-style";
+    s.textContent =
+      "[data-sk-path]{outline:1.5px dashed rgba(34,197,94,.9)!important;outline-offset:3px;cursor:text!important;border-radius:2px;-webkit-user-select:text;user-select:text}" +
+      "[data-sk-path].sk-changed{outline-color:#f59e0b!important}" +
+      "[data-sk-path][contenteditable]{outline:2px solid #22c55e!important;background:rgba(34,197,94,.12)!important}" +
+      ".sk-chip{position:absolute;z-index:2147483646;padding:9px 12px;border-radius:999px;border:1px solid rgba(255,255,255,.3);background:rgba(10,10,10,.85);color:#fff;font:600 12px/1 Inter,system-ui,sans-serif;cursor:pointer;box-shadow:0 4px 14px rgba(0,0,0,.3)}";
+    doc.head.appendChild(s);
+  }
+
+  function scan() {
+    var doc = frame.contentDocument;
+    if (!doc || !doc.body || !draft || editing) return;
+    injectStyle(doc);
+    var root = doc.getElementById("root") || doc.body;
+    var map = textIndex();
+    var els = root.querySelectorAll("*");
+    for (var i = 0; i < els.length; i++) {
+      var el = els[i];
+      if (el.namespaceURI !== HTML_NS || /^(SCRIPT|STYLE|NOSCRIPT|IFRAME|INPUT|TEXTAREA|SELECT|OPTION)$/.test(el.tagName)) continue;
+      var text = norm(el.textContent);
+      var paths = map[text] && editableShape(el, text) ? map[text] : null;
+      if (paths) {
+        el.setAttribute("data-sk-path", paths.join("|"));
+        var want = readField(draft, paths[0]);
+        if (norm(want) !== text) el.textContent = want;
+        el.classList.toggle("sk-changed", paths.some(function (p) { return dirty[fieldOf(p)]; }));
+      } else if (el.hasAttribute("data-sk-path")) {
+        el.removeAttribute("data-sk-path");
+        el.classList.remove("sk-changed");
+      }
+    }
+    placeChips(doc);
+  }
+
+  function scheduleScan() {
+    clearTimeout(scanTimer);
+    scanTimer = setTimeout(scan, 250);
+  }
+
+  // ---- Photos ---------------------------------------------------------------
+  function abs(u, doc) { try { return new URL(u, doc.baseURI).href; } catch (x) { return u; } }
+  function shownUrl(el, win) {
+    if (el.tagName === "IMG") return el.currentSrc || el.src;
+    var m = (win.getComputedStyle(el).backgroundImage || "").match(/url\(["']?(.*?)["']?\)/);
+    return m ? m[1] : null;
+  }
+  function showPhoto(el, url) {
+    if (el.tagName === "IMG") { el.removeAttribute("srcset"); el.src = url; return; }
+    var cur = el.style.backgroundImage;
+    el.style.backgroundImage = /url\(/.test(cur)
+      ? cur.replace(/url\((["']?)(.*?)\1\)/, 'url("' + url + '")')
+      : 'url("' + url + '")';
+  }
+
+  function placeChips(doc) {
+    var win = frame.contentWindow;
+    var known = {};
+    (base.photos || []).forEach(function (p, i) { if (p && p.url) known[abs(p.url, doc)] = i; });
+    (draft.photos || []).forEach(function (p, i) { if (p && p.url) known[abs(p.url, doc)] = i; });
+    var seen = new Set();
+    var els = doc.querySelectorAll('#root img, #root [style*="url("]');
+    for (var i = 0; i < els.length; i++) {
+      var el = els[i], u = shownUrl(el, win);
+      var idx = u ? known[abs(u, doc)] : undefined;
+      if (idx === undefined) continue;
+      var want = draft.photos[idx] && draft.photos[idx].url;
+      if (want && abs(want, doc) !== abs(u, doc)) showPhoto(el, want);
+      var r = el.getBoundingClientRect(), cs = win.getComputedStyle(el);
+      var chip = chipFor.get(el);
+      if (r.width < 80 || r.height < 60 || cs.visibility === "hidden" || Number(cs.opacity) < 0.1) {
+        if (chip) chip.style.display = "none";
+        seen.add(el);
+        continue;
+      }
+      if (!chip) {
+        chip = doc.createElement("button");
+        chip.type = "button";
+        chip.className = "sk-chip";
+        chip.setAttribute("data-sk-ui", "1");
+        chip.textContent = "Change photo";
+        chip.addEventListener("click", function (e) {
+          e.preventDefault(); e.stopPropagation();
+          photoIdx = Number(e.currentTarget.getAttribute("data-idx"));
+          fileInput.value = "";
+          fileInput.click();
+        });
+        doc.body.appendChild(chip);
+        chipFor.set(el, chip);
+      }
+      chip.setAttribute("data-idx", String(idx));
+      chip.style.display = "";
+      chip.style.top = (r.top + win.scrollY + 10) + "px";
+      chip.style.left = (r.left + win.scrollX + 10) + "px";
+      seen.add(el);
+    }
+    chipFor.forEach(function (chip, el) {
+      if (!seen.has(el)) { chip.remove(); chipFor.delete(el); }
+    });
+  }
+
+  fileInput.addEventListener("change", async function () {
+    var f = fileInput.files && fileInput.files[0];
+    if (!f || photoIdx === null) return;
+    var idx = photoIdx;
+    toast("Uploading photo…", 60000);
+    try {
+      var blob = f;
+      if (window.imageCompression) {
+        blob = await imageCompression(f, { maxSizeMB: 1.5, maxWidthOrHeight: 1600, fileType: "image/webp", useWebWorker: true });
+      }
+      var send = function () {
+        return fetch("/api/admin/upload", {
+          method: "POST", credentials: "same-origin",
+          headers: { "Content-Type": blob.type || "image/webp" }, body: blob
+        });
+      };
+      var r = await send();
+      if (r.status === 401) { await requireLogin(); r = await send(); }
+      if (r.status === 413) throw new Error("that photo is too big");
+      if (!r.ok) throw new Error("upload failed (" + r.status + ")");
+      var data = await r.json();
+      draft.photos[idx] = { url: data.url, alt: (draft.photos[idx] && draft.photos[idx].alt) || "" };
+      refreshDirty(["photos." + idx]);
+      scan();
+      toast("Photo changed. Press Save to put it live.");
+    } catch (x) {
+      toast("Couldn't change the photo: " + (x && x.message ? x.message : x), 4000);
+    }
+  });
+
+  // ---- Editing text ---------------------------------------------------------
+  function pathsOf(el) { return (el.getAttribute("data-sk-path") || "").split("|").filter(Boolean); }
+
+  function startEdit(el) {
+    if (editing === el) return;
+    if (editing) editing.blur();
+    editing = el;
+    try { el.contentEditable = "plaintext-only"; } catch (x) { /* older browsers */ }
+    if (el.contentEditable !== "plaintext-only") el.contentEditable = "true";
+    el.spellcheck = true;
+    el.addEventListener("input", onInput);
+    el.addEventListener("keydown", onKey);
+    el.addEventListener("paste", onPaste);
+    el.addEventListener("blur", onBlur);
+    el.focus();
+    var doc = el.ownerDocument, sel = doc.getSelection(), range = doc.createRange();
+    range.selectNodeContents(el); range.collapse(false);
+    sel.removeAllRanges(); sel.addRange(range);
+  }
+
+  function onInput(e) {
+    var el = e.currentTarget, paths = pathsOf(el);
+    var v = el.innerText.replace(/\u00a0/g, " ");
+    // A single paragraph can't hold a paragraph break — it would split on reload.
+    if (!MULTILINE.test(paths[0]) || paths[0].indexOf("#") > -1) v = v.replace(/\s*\n\s*/g, " ");
+    v = v.trim();
+    paths.forEach(function (p) { writeField(draft, p, v); });
+    // The same text shown elsewhere on the page (name in the nav and footer).
+    var others = el.ownerDocument.querySelectorAll("[data-sk-path]");
+    for (var i = 0; i < others.length; i++) {
+      if (others[i] !== el && others[i].getAttribute("data-sk-path") === el.getAttribute("data-sk-path")) others[i].textContent = v;
+    }
+    refreshDirty(paths.map(fieldOf));
+  }
+
+  function onKey(e) {
+    var el = e.currentTarget;
+    var ref = pathsOf(el)[0];
+    if (e.key === "Escape" || (e.key === "Enter" && !e.shiftKey && (!MULTILINE.test(ref) || ref.indexOf("#") > -1))) {
+      e.preventDefault();
+      el.blur();
+    }
+  }
+
+  function onPaste(e) {
+    if (e.currentTarget.contentEditable === "plaintext-only") return;
+    e.preventDefault();
+    var text = (e.clipboardData || window.clipboardData).getData("text/plain");
+    e.currentTarget.ownerDocument.execCommand("insertText", false, text);
+  }
+
+  function onBlur(e) {
+    var el = e.currentTarget;
+    el.removeAttribute("contenteditable");
+    el.removeEventListener("input", onInput);
+    el.removeEventListener("keydown", onKey);
+    el.removeEventListener("paste", onPaste);
+    el.removeEventListener("blur", onBlur);
+    el.classList.toggle("sk-changed", pathsOf(el).some(function (p) { return dirty[fieldOf(p)]; }));
+    editing = null;
+    scheduleScan();
+  }
+
+  // ---- The site frame -------------------------------------------------------
+  function onFrameClick(e) {
+    var t = e.target;
+    if (t && t.nodeType !== 1) t = t.parentElement;
+    if (!t || !t.closest || t.closest("[data-sk-ui]")) return;
+    var field = t.closest("[data-sk-path]");
+    if (field) {
+      // Also stops the site's own handler, so tapping a button's label edits
+      // the label instead of pressing the button.
+      e.preventDefault(); e.stopPropagation();
+      startEdit(field);
+      return;
+    }
+    var a = t.closest("a[href]");
+    if (!a) return;
+    var url = null;
+    try { url = new URL(a.getAttribute("href"), a.ownerDocument.baseURI); } catch (x) {}
+    var samePage = url && url.origin === location.origin && !a.target && !/^\/(admin|edit|api|book)(\/|$)/.test(url.pathname);
+    if (samePage) return; // moving between the site's own pages is fine
+    e.preventDefault(); e.stopPropagation();
+    toast("Links don't open while you're editing");
+  }
+
+  function onFrameLoad() {
+    var doc = frame.contentDocument;
+    if (!doc || !doc.body) return;
+    chipFor = new Map();
+    editing = null;
+    doc.addEventListener("click", onFrameClick, true);
+    doc.addEventListener("submit", function (e) {
+      e.preventDefault(); e.stopPropagation();
+      toast("Forms don't send while you're editing");
+    }, true);
+    if (observer) observer.disconnect();
+    observer = new MutationObserver(scheduleScan);
+    observer.observe(doc.getElementById("root") || doc.body, {
+      childList: true, subtree: true, characterData: true, attributes: true, attributeFilter: ["src", "style"]
+    });
+    frame.contentWindow.addEventListener("resize", scheduleScan);
+    scan();
+  }
+
+  // ---- Save / undo ----------------------------------------------------------
+  async function save() {
+    if (editing) editing.blur();
+    if (!Object.keys(dirty).length) return;
+    saving = true; updateBar();
+    try {
+      var send = function () {
+        return fetch("/api/content", {
+          method: "POST", credentials: "same-origin",
+          headers: { "Content-Type": "application/json" }, body: JSON.stringify(draft)
+        });
+      };
+      var r = await send();
+      if (r.status === 401) { await requireLogin(); r = await send(); }
+      if (!r.ok) throw new Error("the server said " + r.status);
+      var d = await r.json();
+      base = d.content || clone(draft);
+      draft = clone(base);
+      dirty = {};
+      toast("Saved. Visitors will see it within a minute.", 3500);
+    } catch (x) {
+      toast("Couldn't save: " + (x && x.message ? x.message : x) + ". Your changes are still here.", 5000);
+    }
+    saving = false;
+    updateBar();
+    scan();
+  }
+
+  saveBtn.addEventListener("click", save);
+  discardBtn.addEventListener("click", function () {
+    if (!confirm("Undo all unsaved changes?")) return;
+    draft = clone(base); dirty = {};
+    updateBar();
+    frame.contentWindow.location.reload();
+  });
+  $("more").addEventListener("click", function (e) {
+    e.stopPropagation();
+    menu.style.display = menu.style.display === "block" ? "none" : "block";
+  });
+  document.addEventListener("click", function () { menu.style.display = "none"; });
+  $("signout").addEventListener("click", async function () {
+    if (Object.keys(dirty).length && !confirm("You have unsaved changes. Sign out anyway?")) return;
+    dirty = {};
+    await fetch("/api/admin/logout", { method: "POST", credentials: "same-origin" }).catch(function () {});
+    location.href = "/";
+  });
+  window.addEventListener("beforeunload", function (e) {
+    if (Object.keys(dirty).length) { e.preventDefault(); e.returnValue = ""; }
+  });
+
+  async function init() {
+    frame.addEventListener("load", onFrameLoad);
+    frame.src = "/?sk_edit=1";
+    var who = await fetch("/api/admin/whoami", { credentials: "same-origin" }).catch(function () { return null; });
+    if (!who || !who.ok) await requireLogin();
+    var r = await fetch("/api/content?t=" + Date.now(), { cache: "no-store" }).catch(function () { return null; });
+    if (!r || !r.ok) {
+      statusEl.innerHTML = "<b>Editing isn't switched on</b><span>Ask whoever built your site to turn on the editor.</span>";
+      return;
+    }
+    base = await r.json();
+    if (!Array.isArray(base.photos)) base.photos = [];
+    draft = clone(base);
+    updateBar();
+    scan();
+    // Layout settles as fonts and images load; keep the photo chips in place.
+    setInterval(function () { if (!editing) scan(); }, 1500);
+    toast("Tap anything with a dashed outline to change it", 4000);
+  }
+  init();
+})();
+</script>
+</body>
+</html>
 `;
     exports2.ADMIN_INDEX_HTML = `<!DOCTYPE html>
 <html lang="en">
@@ -34522,7 +35164,10 @@ export default async function handler(req, res) {
       h("div", { className: "bar" },
         h("div", null,
           h("div", { style: { fontSize: 15, fontWeight: 600 } }, "Editing " + (content.business?.name || "your site")),
-          h("div", { style: { fontSize: 12, color: "var(--muted)" } }, h("a", { href: "/" }, "View site \u2192"))
+          h("div", { style: { fontSize: 12, color: "var(--muted)" } },
+            h("a", { href: "/" }, "View site \u2192"), " \xB7 ",
+            h("a", { href: "/edit" }, "Edit on the page \u2192")
+          )
         ),
         h("button", { className: "primary", onClick: save, disabled: saving[0] }, saving[0] ? "Saving\u2026" : "Save changes")
       ),
@@ -80955,6 +81600,7 @@ var require_builder = __commonJS({
     exports2.deployBookingOnly = deployBookingOnly2;
     exports2.deployStandaloneBooking = deployStandaloneBooking2;
     exports2.handoverSite = handoverSite2;
+    exports2.addEditorToSite = addEditorToSite2;
     var sdk_1 = __importDefault(require_sdk());
     var axios_1 = __importDefault(require_axios());
     var crypto_1 = require("crypto");
@@ -81066,6 +81712,11 @@ var require_builder = __commonJS({
       const title = p.name ? `${p.name} \u2014 site manager` : "Site editor";
       return cms_runtime_1.ADMIN_INDEX_HTML.replace("__ADMIN_TITLE__", title.replace(/[<>&]/g, ""));
     }
+    function editHtml() {
+      const p = (0, agency_1.getAgencyProfile)();
+      const title = p.name ? `Edit your site \u2014 ${p.name}` : "Edit your site";
+      return cms_runtime_1.EDIT_INDEX_HTML.replace("__EDIT_TITLE__", title.replace(/[<>&]/g, ""));
+    }
     function bannerFor(lead) {
       let handedOver = false;
       try {
@@ -81763,7 +82414,9 @@ export default defineConfig({ plugins: [react()] });`;
         const vercelJson = JSON.stringify({
           rewrites: [
             { source: "/admin", destination: "/admin/index.html" },
-            { source: "/admin/", destination: "/admin/index.html" }
+            { source: "/admin/", destination: "/admin/index.html" },
+            { source: "/edit", destination: "/edit/index.html" },
+            { source: "/edit/", destination: "/edit/index.html" }
           ]
         });
         cmsExtraFiles = [
@@ -81775,7 +82428,8 @@ export default defineConfig({ plugins: [react()] });`;
           { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" },
           { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" },
           { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" },
-          { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }
+          { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
+          { file: "public/edit/index.html", data: editHtml(), encoding: "utf-8" }
         ];
         cmsAdmin = { url: "", password: adminPassword };
       }
@@ -81875,6 +82529,8 @@ export default defineConfig({ plugins: [react()] });`;
         rewrites: [
           { source: "/admin", destination: "/admin/index.html" },
           { source: "/admin/", destination: "/admin/index.html" },
+          { source: "/edit", destination: "/edit/index.html" },
+          { source: "/edit/", destination: "/edit/index.html" },
           { source: "/book", destination: "/book/index.html" },
           { source: "/book/", destination: "/book/index.html" }
         ]
@@ -81887,7 +82543,7 @@ createRoot(document.getElementById('root')).render(<StrictMode><App /></StrictMo
       const viteConfigCms = `import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
 export default defineConfig({ plugins: [react()] });`;
-      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+      filesToRedeploy.push({ file: "index.html", data: indexHtmlCms, encoding: "utf-8" }, { file: "src/main.jsx", data: mainJsxCms, encoding: "utf-8" }, { file: "vite.config.js", data: viteConfigCms, encoding: "utf-8" }, { file: "package.json", data: packageJsonCms, encoding: "utf-8" }, { file: "vercel.json", data: vercelJson, encoding: "utf-8" }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }, { file: "public/edit/index.html", data: editHtml(), encoding: "utf-8" });
       if (!filesToRedeploy.some((f) => f.file === "src/App.jsx")) {
         throw new Error("Couldn't fetch src/App.jsx from the existing deployment. Try Regenerate website first, then Redeploy CMS.");
       }
@@ -82023,6 +82679,8 @@ export default defineConfig({ plugins: [react()] });`;
         rewrites: [
           { source: "/admin", destination: "/admin/index.html" },
           { source: "/admin/", destination: "/admin/index.html" },
+          { source: "/edit", destination: "/edit/index.html" },
+          { source: "/edit/", destination: "/edit/index.html" },
           { source: "/book", destination: "/book/index.html" },
           { source: "/book/", destination: "/book/index.html" }
         ]
@@ -82043,6 +82701,7 @@ export default defineConfig({ plugins: [react()] });`;
         // Refresh the CMS admin app (contains the Bookings tab now)
         { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" },
         { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
+        { file: "public/edit/index.html", data: editHtml(), encoding: "utf-8" },
         { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
@@ -82108,6 +82767,7 @@ export default defineConfig({ plugins: [react()] });`;
         // admin the CMS sites use — it already has a Bookings tab.
         { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" },
         { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" },
+        { file: "public/edit/index.html", data: editHtml(), encoding: "utf-8" },
         { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" },
         { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" },
         { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" },
@@ -82120,7 +82780,9 @@ export default defineConfig({ plugins: [react()] });`;
           data: JSON.stringify({
             rewrites: [
               { source: "/admin", destination: "/admin/index.html" },
-              { source: "/admin/", destination: "/admin/index.html" }
+              { source: "/admin/", destination: "/admin/index.html" },
+              { source: "/edit", destination: "/edit/index.html" },
+              { source: "/edit/", destination: "/edit/index.html" }
             ]
           }),
           encoding: "utf-8"
@@ -82290,12 +82952,14 @@ export default defineConfig({ plugins: [react()] });`,
             rewrites: [
               { source: "/admin", destination: "/admin/index.html" },
               { source: "/admin/", destination: "/admin/index.html" },
+              { source: "/edit", destination: "/edit/index.html" },
+              { source: "/edit/", destination: "/edit/index.html" },
               { source: "/book", destination: "/book/index.html" },
               { source: "/book/", destination: "/book/index.html" }
             ]
           }),
           encoding: "utf-8"
-        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" });
+        }, { file: "api/content.js", data: cms_runtime_1.API_CONTENT_JS, encoding: "utf-8" }, { file: "api/admin/login.js", data: cms_runtime_1.API_ADMIN_LOGIN_JS, encoding: "utf-8" }, { file: "api/admin/whoami.js", data: cms_runtime_1.API_ADMIN_WHOAMI_JS, encoding: "utf-8" }, { file: "api/admin/password.js", data: cms_runtime_1.API_ADMIN_PASSWORD_JS, encoding: "utf-8" }, { file: "api/admin/logout.js", data: cms_runtime_1.API_ADMIN_LOGOUT_JS, encoding: "utf-8" }, { file: "api/track.js", data: analytics_runtime_1.API_TRACK_JS, encoding: "utf-8" }, { file: "api/stats.js", data: analytics_runtime_1.API_STATS_JS, encoding: "utf-8" }, { file: "api/admin/upload.js", data: cms_runtime_1.API_ADMIN_UPLOAD_JS, encoding: "utf-8" }, { file: "public/admin/index.html", data: adminHtml(), encoding: "utf-8" }, { file: "public/admin/app.js", data: cms_runtime_1.ADMIN_APP_JS, encoding: "utf-8" }, { file: "public/edit/index.html", data: editHtml(), encoding: "utf-8" });
         const env = {
           BLOB_READ_WRITE_TOKEN: blobToken,
           ADMIN_PASSWORD_HASH: await (0, cms_runtime_1.hashPassword)(adminPassword),
@@ -82318,6 +82982,132 @@ export default defineConfig({ plugins: [react()] });`,
       onProgress(`Live at ${url}`);
       return { url };
     }
+    async function addEditorToSite2(args) {
+      const { lead, anthropicKey, vercelToken, blobToken, reuseAdminPassword, onProgress } = args;
+      onProgress("Loading site source\u2026");
+      const snapshot = loadSnapshot(lead.id);
+      const appIdx = snapshot ? snapshot.findIndex((f) => f.file === "src/App.jsx") : -1;
+      if (!snapshot || appIdx < 0) {
+        throw new Error("No local copy of this site's code. Regenerate the website once (that saves a copy), then add the editor.");
+      }
+      const photoPaths = snapshot.map((f) => f.file.match(/^public\/(photo(\d+)\.jpg)$/)).filter((m) => !!m).sort((a, b) => Number(a[2]) - Number(b[2])).map((m) => `/${m[1]}`);
+      let seed = null;
+      if (!/["'`]\/api\/content["'`]/.test(snapshot[appIdx].data)) {
+        onProgress("Connecting the page's text and photos to the editor\u2026");
+        const wired = await wireAppToCms({
+          anthropicKey,
+          appJsx: snapshot[appIdx].data,
+          lead
+        });
+        snapshot[appIdx] = { ...snapshot[appIdx], data: wired.app };
+        saveSnapshot(lead.id, snapshot);
+        seed = {
+          reviews: [],
+          theme: { variant: "premium-dark", accent: "#22c55e" },
+          ...wired.content,
+          photos: photoPaths.map((url2) => ({ url: url2, alt: "" }))
+        };
+      }
+      const siteUid = siteUidFor(lead.id);
+      if (seed) {
+        onProgress("Saving the page's current text\u2026");
+        const { put } = await Promise.resolve().then(() => __importStar(require_dist5()));
+        await put(`sites/${siteUid}/content.json`, JSON.stringify(seed), {
+          access: "public",
+          addRandomSuffix: false,
+          allowOverwrite: true,
+          contentType: "application/json",
+          token: blobToken
+        });
+      }
+      const password = reuseAdminPassword ?? (0, cms_runtime_1.generateFriendlyPassword)();
+      const { url } = await redeployWithoutBanner({
+        lead,
+        vercelToken,
+        blobToken,
+        hasCms: true,
+        adminPassword: password,
+        siteUid,
+        onProgress
+      });
+      return { url, admin: { url: `${url}/admin`, password } };
+    }
+    async function wireAppToCms(args) {
+      const { anthropicKey, appJsx, lead } = args;
+      const prompt = `You are editing an existing, approved React website (App.jsx below) so its owner can edit the copy through a CMS. The design is final: the page must look IDENTICAL after your change.
+
+Change ONLY where the text comes from:
+
+1. Add near the top:
+   const FALLBACK = { ...exactly the content JSON you output below... };
+2. Inside App:
+   const [content, setContent] = useState(FALLBACK);
+   useEffect(() => {
+     fetch("/api/content").then(r => r.ok ? r.json() : null).then(d => {
+       if (d && d.business) setContent(prev => ({ ...prev, ...d }));
+     }).catch(() => {});
+   }, []);
+   If the file has several components (pages, sections), pass content down as a prop \u2014 keep the fetch in App only.
+3. Replace each hardcoded string that matches a field below with that field, e.g. <h1>{content.hero.headline}</h1>. The rendered text must stay character-for-character the same, so put the exact current wording into the JSON.
+4. Photos: const photos = (content.photos && content.photos.length > 0) ? content.photos.map(p => p.url) : PHOTOS; and use photos wherever PHOTOS / photo paths were used. If the file has no PHOTOS constant, define const PHOTOS = [the photo paths it uses, in order].
+5. Opening hours: render content.contact.hours if the page shows hours; if that array is empty the page must omit the hours block.
+
+Content fields (use only what the page actually shows; leave others as "" or []):
+{
+  "business": { "name": string, "tagline": string },
+  "hero": { "headline": string, "subheadline": string, "ctaText": string },
+  "about": string,
+  "services": [{ "title": string, "description": string, "price": string }],
+  "contact": { "address": string, "phone": string, "email": string, "hours": [string] }
+}
+Business name: ${JSON.stringify(lead.name)}. Phone: ${JSON.stringify(lead.phone ?? "")}. Address: ${JSON.stringify(lead.address ?? "")}.
+
+Do NOT change: layout, styles, colours, fonts, class names, component structure, section order, animations, links, imports (other than adding useState/useEffect), or any text that has no field above \u2014 leave that hardcoded. Keep \`export default App;\` as the final line.
+
+Reply in exactly this format and nothing else:
+<content>
+{ the content JSON }
+</content>
+<app>
+the complete new App.jsx
+</app>
+
+App.jsx:
+${appJsx}`;
+      let lastErr = "";
+      for (let attempt = 0; attempt < 2; attempt++) {
+        const res = await (0, llm_1.generateText)({
+          apiKey: anthropicKey,
+          prompt: attempt === 0 ? prompt : `${prompt}
+
+Your previous reply was unusable (${lastErr}). Follow the reply format exactly.`,
+          model: (0, models_1.getPreferredModel)(),
+          maxTokens: 64e3,
+          timeoutMs: 3e5
+        });
+        const text = res.text ?? "";
+        const contentRaw = text.match(/<content>\s*([\s\S]*?)\s*<\/content>/)?.[1];
+        const appRaw = text.match(/<app>\s*([\s\S]*?)\s*<\/app>/)?.[1];
+        if (!contentRaw || !appRaw) {
+          lastErr = res.stopReason === "max_tokens" ? "it was cut off" : "missing <content> or <app>";
+          continue;
+        }
+        let content;
+        try {
+          content = JSON.parse(contentRaw.replace(/^```[a-z]*\s*/i, "").replace(/\s*```$/, ""));
+        } catch {
+          lastErr = "the content wasn't valid JSON";
+          continue;
+        }
+        const app = appRaw.replace(/^```[a-z]*\s*/i, "").replace(/\s*```$/, "").trim();
+        if (!app.includes("export default App") || !/\/api\/content/.test(app)) {
+          lastErr = "the code didn't fetch /api/content or was incomplete";
+          continue;
+        }
+        return { app, content };
+      }
+      throw new Error(`Couldn't connect this site to the editor (${lastErr}). Try again \u2014 nothing was changed.`);
+    }
     function hasBookLink(code) {
       return /(href\s*=\s*["'`{]*\s*["'`]?\/book\/?["'`}]?)|(location(?:\.href)?\s*=\s*["'`]\/book["'`])/i.test(code);
     }
@@ -82572,6 +83362,7 @@ var require_places = __commonJS({
     async function searchOneType(args) {
       const all = [];
       let pageToken;
+      let error;
       for (let page = 0; page < 3; page++) {
         const body = {
           textQuery: `${args.type} in ${args.city}`,
@@ -82598,11 +83389,13 @@ var require_places = __commonJS({
           pageToken = r.data.nextPageToken;
           if (!pageToken)
             break;
-        } catch {
+        } catch (e) {
+          const ax = e;
+          error = ax.response?.data?.error?.message ?? ax.message ?? "Places request failed";
           break;
         }
       }
-      return { type: args.type, places: all };
+      return { type: args.type, places: all, error };
     }
     function processRawPlaces(type, places, center, radiusMeters, includeWithWebsite) {
       const out = [];
@@ -82640,16 +83433,28 @@ var require_places = __commonJS({
       return out;
     }
     async function searchPlacesStream(args, onBatch) {
+      const stats = { scanned: 0, withWebsite: 0, outsideArea: 0, errors: [] };
       await Promise.all(args.types.map(async (type) => {
-        const { places } = await searchOneType({
+        const { places, error } = await searchOneType({
           apiKey: args.apiKey,
           city: args.city,
           type,
           center: args.center,
           radiusMeters: args.radiusMeters
         });
+        if (error)
+          stats.errors.push(error);
+        stats.scanned += places.length;
+        for (const p of places) {
+          if (p.websiteUri)
+            stats.withWebsite++;
+          else if (args.center && args.radiusMeters && p.location && haversineMeters(args.center.lat, args.center.lng, p.location.latitude, p.location.longitude) > args.radiusMeters) {
+            stats.outsideArea++;
+          }
+        }
         await onBatch(processRawPlaces(type, places, args.center, args.radiusMeters, args.includeWithWebsite));
       }));
+      return stats;
     }
     async function searchPlaces(args) {
       const batches = await Promise.all(args.types.map((type) => searchOneType({
@@ -82737,15 +83542,24 @@ var require_places = __commonJS({
       if (!query.trim())
         return [];
       const r = await axios_1.default.get("https://nominatim.openstreetmap.org/search", {
-        params: { q: query, format: "json", limit, addressdetails: 1 },
+        params: { q: query, format: "json", limit, addressdetails: 1, "accept-language": "en" },
         headers: { "User-Agent": "Sproutio/0.1 (desktop app)" }
       });
       return (r.data ?? []).map((d) => ({
         lat: parseFloat(d.lat),
         lng: parseFloat(d.lon),
-        label: d.display_name
+        label: d.display_name,
+        short: shortPlaceName(d.address, d.display_name)
       }));
     }
+    function shortPlaceName(a, fallback) {
+      if (!a)
+        return fallback;
+      const place = a.suburb && (a.city || a.town) ? `${a.suburb}, ${a.city || a.town}` : a.city || a.town || a.village || a.hamlet || a.suburb || a.municipality || a.county;
+      const region = a.state_district || a.county || a.state;
+      const parts = [place, region !== place ? region : null, a.country].filter(Boolean);
+      return parts.length ? [...new Set(parts)].join(", ") : fallback;
+    }
     async function geocodeReverse(lat, lng) {
       const r = await axios_1.default.get("https://nominatim.openstreetmap.org/reverse", {
         params: { lat, lon: lng, format: "json", addressdetails: 1, zoom: 16 },
@@ -83253,7 +84067,8 @@ var require_lead_search = __commonJS({
       const wantsSiteHavers = bookingMode || auditMode;
       let saved = 0;
       let found = 0;
-      await (0, places_1.searchPlacesStream)({
+      let alreadyInPipeline = 0;
+      const stats = await (0, places_1.searchPlacesStream)({
         apiKey: args.placesKey,
         city: args.city,
         types: args.types,
@@ -83270,8 +84085,10 @@ var require_lead_search = __commonJS({
             continue;
           seen.add(r.place_id);
           const existing = db2.all("SELECT id FROM leads WHERE place_id = ?", [r.place_id]);
-          if (existing.length > 0)
+          if (existing.length > 0) {
+            alreadyInPipeline++;
             continue;
+          }
           let leadKind = "no_website";
           let bookingStatus = null;
           let bookingPlatform = null;
@@ -83338,7 +84155,15 @@ var require_lead_search = __commonJS({
           });
         }
       });
-      return { found, saved };
+      return {
+        found,
+        saved,
+        scanned: stats.scanned,
+        withWebsite: stats.withWebsite,
+        outsideArea: stats.outsideArea,
+        alreadyInPipeline,
+        errors: [...new Set(stats.errors)]
+      };
     }
     async function searchAndSaveLeads(args) {
       const db2 = (0, db_1.getDb)();
@@ -95590,8 +96415,8 @@ var require_email = __commonJS({
     var nodemailer_1 = __importDefault(require_nodemailer());
     function smtpFromSettings(get) {
       const host = get("smtp_host");
-      const user = get("smtp_user");
-      const pass = get("smtp_pass");
+      const user = get("smtp_user") || get("imap_user");
+      const pass = get("smtp_pass") || get("imap_pass");
       if (!host || !user || !pass)
         return null;
       const port = Number(get("smtp_port") || "587");
@@ -95611,7 +96436,9 @@ var require_email = __commonJS({
           from: cfg.from,
           to: args.to,
           subject: args.subject,
-          text: args.text
+          text: args.text,
+          ...args.inReplyTo ? { inReplyTo: args.inReplyTo } : {},
+          ...args.references ? { references: args.references } : {}
         });
         return { ok: true, messageId: info.messageId };
       } catch (e) {
@@ -95706,6 +96533,488 @@ Respond with ONLY compact JSON, no prose: {"email": string|null}`;
   }
 });
 
+// ../desktop/dist/main/lib/guardrails.js
+var require_guardrails = __commonJS({
+  "../desktop/dist/main/lib/guardrails.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.getAutopilotSettings = getAutopilotSettings;
+    exports2.setAutopilotSettings = setAutopilotSettings;
+    exports2.emailsSentToday = emailsSentToday;
+    exports2.sendBlockedReason = sendBlockedReason;
+    exports2.isSuppressed = isSuppressed;
+    exports2.suppress = suppress;
+    exports2.unsuppress = unsuppress;
+    exports2.listSuppressed = listSuppressed;
+    exports2.logActivity = logActivity;
+    exports2.listActivity = listActivity;
+    exports2.clearNeedsYou = clearNeedsYou;
+    var db_1 = require_db();
+    var DEFAULTS = {
+      paused: false,
+      replyMode: "draft",
+      sendProposals: true,
+      handoverMode: "ask",
+      maxEmailsPerDay: 30,
+      minConfidence: 0.8,
+      sitePence: 19900,
+      carePence: 0,
+      callUrl: null
+    };
+    function read(key) {
+      const row = (0, db_1.getDb)().get("SELECT value FROM settings WHERE key = ?", [key]);
+      return row?.value ?? null;
+    }
+    function write(key, value) {
+      (0, db_1.getDb)().run("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", [key, value]);
+    }
+    var num = (v, d) => v != null && v !== "" && !Number.isNaN(Number(v)) ? Number(v) : d;
+    function getAutopilotSettings() {
+      const mode = read("auto_reply_mode");
+      return {
+        paused: read("autopilot_paused") === "1",
+        replyMode: mode === "off" || mode === "auto" || mode === "draft" ? mode : DEFAULTS.replyMode,
+        sendProposals: read("auto_send_proposals") !== "0",
+        handoverMode: read("auto_handover_mode") === "auto" ? "auto" : "ask",
+        maxEmailsPerDay: num(read("cap_emails_per_day"), DEFAULTS.maxEmailsPerDay),
+        minConfidence: num(read("auto_min_confidence"), DEFAULTS.minConfidence),
+        sitePence: num(read("price_site_pence"), DEFAULTS.sitePence),
+        carePence: num(read("price_care_pence"), DEFAULTS.carePence),
+        callUrl: read("call_booking_url") || null
+      };
+    }
+    function setAutopilotSettings(patch) {
+      if (patch.paused !== void 0)
+        write("autopilot_paused", patch.paused ? "1" : "0");
+      if (patch.replyMode)
+        write("auto_reply_mode", patch.replyMode);
+      if (patch.sendProposals !== void 0)
+        write("auto_send_proposals", patch.sendProposals ? "1" : "0");
+      if (patch.handoverMode)
+        write("auto_handover_mode", patch.handoverMode);
+      if (patch.maxEmailsPerDay !== void 0)
+        write("cap_emails_per_day", String(Math.max(0, Math.floor(patch.maxEmailsPerDay))));
+      if (patch.minConfidence !== void 0)
+        write("auto_min_confidence", String(Math.min(1, Math.max(0.5, patch.minConfidence))));
+      if (patch.sitePence !== void 0)
+        write("price_site_pence", String(Math.max(0, Math.round(patch.sitePence))));
+      if (patch.carePence !== void 0)
+        write("price_care_pence", String(Math.max(0, Math.round(patch.carePence))));
+      if (patch.callUrl !== void 0)
+        write("call_booking_url", patch.callUrl ?? "");
+      return getAutopilotSettings();
+    }
+    function emailsSentToday() {
+      const row = (0, db_1.getDb)().get(`SELECT COUNT(*) AS n FROM messages
+      WHERE direction = 'out' AND date(at) = date('now')`, []);
+      return row?.n ?? 0;
+    }
+    function sendBlockedReason() {
+      const s = getAutopilotSettings();
+      if (s.paused)
+        return "Autopilot is paused.";
+      const sent = emailsSentToday();
+      if (sent >= s.maxEmailsPerDay)
+        return `Daily email limit reached (${sent}/${s.maxEmailsPerDay}).`;
+      return null;
+    }
+    var norm = (e) => e.trim().toLowerCase();
+    function isSuppressed(email) {
+      if (!email)
+        return false;
+      return !!(0, db_1.getDb)().get("SELECT 1 FROM do_not_contact WHERE email = ?", [norm(email)]);
+    }
+    function suppress(email, reason, leadId) {
+      (0, db_1.getDb)().run(`INSERT INTO do_not_contact (email, lead_id, reason) VALUES (?, ?, ?)
+     ON CONFLICT(email) DO UPDATE SET reason = excluded.reason`, [norm(email), leadId ?? null, reason]);
+    }
+    function unsuppress(email) {
+      (0, db_1.getDb)().run("DELETE FROM do_not_contact WHERE email = ?", [norm(email)]);
+    }
+    function listSuppressed() {
+      return (0, db_1.getDb)().all("SELECT email, lead_id, reason, at FROM do_not_contact ORDER BY at DESC", []);
+    }
+    function logActivity(args) {
+      (0, db_1.getDb)().run("INSERT INTO activity_log (actor, action, lead_id, detail, needs_you) VALUES (?, ?, ?, ?, ?)", [args.actor ?? "autopilot", args.action, args.leadId ?? null, args.detail ?? null, args.needsYou ? 1 : 0]);
+    }
+    function listActivity(limit = 100) {
+      return (0, db_1.getDb)().all(`SELECT a.*, l.name AS lead_name FROM activity_log a
+       LEFT JOIN leads l ON l.id = a.lead_id
+      ORDER BY a.id DESC LIMIT ?`, [limit]);
+    }
+    function clearNeedsYou(id) {
+      (0, db_1.getDb)().run("UPDATE activity_log SET needs_you = 0 WHERE id = ?", [id]);
+    }
+  }
+});
+
+// ../desktop/dist/main/lib/inbox.js
+var require_inbox = __commonJS({
+  "../desktop/dist/main/lib/inbox.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.recordOutgoing = recordOutgoing;
+    exports2.recordIncoming = recordIncoming;
+    exports2.listThreads = listThreads;
+    exports2.getThread = getThread;
+    exports2.extractReplyText = extractReplyText;
+    exports2.runReplyAgent = runReplyAgent;
+    exports2.sendDraft = sendDraft;
+    exports2.dismissMessage = dismissMessage;
+    exports2.resetForAgent = resetForAgent;
+    exports2.sendFollowUps = sendFollowUps;
+    var db_1 = require_db();
+    var email_1 = require_email();
+    var llm_1 = require_llm();
+    var followup_1 = require_followup();
+    var agency_1 = require_agency();
+    var guardrails_1 = require_guardrails();
+    var AUTO_SENDABLE = ["interested", "price_question", "question"];
+    function recordOutgoing(args) {
+      (0, db_1.getDb)().run(`INSERT OR IGNORE INTO messages
+       (lead_id, direction, from_addr, to_addr, subject, body, message_id, in_reply_to, handled, sent_by)
+     VALUES (?, 'out', ?, ?, ?, ?, ?, ?, 'done', ?)`, [args.leadId, args.from ?? null, args.to, args.subject, args.body, args.messageId ?? null, args.inReplyTo ?? null, args.sentBy]);
+      if (args.messageId) {
+        (0, db_1.getDb)().run("UPDATE leads SET last_email_message_id = ? WHERE id = ?", [args.messageId, args.leadId]);
+      }
+    }
+    function recordIncoming(args) {
+      const db2 = (0, db_1.getDb)();
+      if (args.messageId && db2.get("SELECT 1 FROM messages WHERE message_id = ?", [args.messageId]))
+        return false;
+      db2.run(`INSERT INTO messages (lead_id, direction, from_addr, subject, body, message_id, in_reply_to, at)
+     VALUES (?, 'in', ?, ?, ?, ?, ?, ?)`, [
+        args.leadId,
+        args.from,
+        args.subject,
+        args.body,
+        args.messageId,
+        args.inReplyTo,
+        (args.at ?? /* @__PURE__ */ new Date()).toISOString()
+      ]);
+      return true;
+    }
+    function listThreads() {
+      const rows = (0, db_1.getDb)().all(`SELECT l.id AS lead_id, l.name, l.email, l.status, l.site_url,
+            m.at AS last_at, m.direction AS last_direction, substr(m.body, 1, 160) AS last_preview,
+            (SELECT COUNT(*) FROM messages p WHERE p.lead_id = l.id AND p.direction = 'in'
+               AND p.handled IN ('new','drafted','needs_you')) AS pending,
+            (SELECT intent FROM messages q WHERE q.lead_id = l.id AND q.direction = 'in'
+               AND q.intent IS NOT NULL ORDER BY q.at DESC LIMIT 1) AS latest_intent
+       FROM leads l
+       JOIN messages m ON m.id = (SELECT id FROM messages WHERE lead_id = l.id ORDER BY at DESC, id DESC LIMIT 1)
+      ORDER BY pending > 0 DESC, m.at DESC`, []);
+      return rows.map((r) => ({ ...r, suppressed: (0, guardrails_1.isSuppressed)(r.email) }));
+    }
+    function getThread(leadId) {
+      return (0, db_1.getDb)().all("SELECT * FROM messages WHERE lead_id = ? ORDER BY at ASC, id ASC", [leadId]);
+    }
+    function splitHead(raw) {
+      const m = raw.match(/\r?\n\r?\n/);
+      if (!m || m.index === void 0)
+        return [raw, ""];
+      return [raw.slice(0, m.index), raw.slice(m.index + m[0].length)];
+    }
+    function header(head, name) {
+      const unfolded = head.replace(/\r?\n[ \t]+/g, " ");
+      const line = unfolded.split(/\r?\n/).find((l) => l.toLowerCase().startsWith(name.toLowerCase() + ":"));
+      return line ? line.slice(line.indexOf(":") + 1).trim() : "";
+    }
+    function decodeBody(body, encoding) {
+      const enc = encoding.toLowerCase();
+      if (enc === "base64") {
+        try {
+          return Buffer.from(body.replace(/\s+/g, ""), "base64").toString("utf-8");
+        } catch {
+          return body;
+        }
+      }
+      if (enc === "quoted-printable") {
+        const bytes = body.replace(/=\r?\n/g, "").replace(/=([0-9A-F]{2})/gi, (_, h) => String.fromCharCode(parseInt(h, 16)));
+        return Buffer.from(bytes, "latin1").toString("utf-8");
+      }
+      return body;
+    }
+    function htmlToText(html) {
+      return html.replace(/<(style|script)[\s\S]*?<\/\1>/gi, "").replace(/<br\s*\/?>/gi, "\n").replace(/<\/(p|div|li|tr|h\d)>/gi, "\n").replace(/<[^>]+>/g, "").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&#39;|&apos;/g, "'").replace(/&quot;/g, '"');
+    }
+    function partText(raw, depth = 0) {
+      const [head, body] = splitHead(raw);
+      const type = header(head, "content-type").toLowerCase();
+      const enc = header(head, "content-transfer-encoding");
+      if (type.startsWith("multipart/") && depth < 5) {
+        const b = header(head, "content-type").match(/boundary="?([^";]+)"?/i)?.[1];
+        if (!b)
+          return { plain: body };
+        const out = {};
+        for (const part of body.split(`--${b}`).slice(1)) {
+          if (part.startsWith("--"))
+            break;
+          const r = partText(part.replace(/^\r?\n/, ""), depth + 1);
+          out.plain ??= r.plain;
+          out.html ??= r.html;
+        }
+        return out;
+      }
+      if (type.includes("text/html"))
+        return { html: decodeBody(body, enc) };
+      if (!type || type.includes("text/plain"))
+        return { plain: decodeBody(body, enc) };
+      return {};
+    }
+    function extractReplyText(raw) {
+      const parts = partText(raw);
+      const text = parts.plain ?? (parts.html ? htmlToText(parts.html) : "");
+      const lines = [];
+      for (const line of text.split(/\r?\n/)) {
+        const t = line.trim();
+        if (t === "--" || t === "-- ")
+          break;
+        if (/^On .+wrote:$/i.test(t) || /^-{2,} ?Original Message ?-{2,}$/i.test(t) || /^From: .+/.test(t) && lines.length > 0)
+          break;
+        if (t.startsWith(">"))
+          continue;
+        lines.push(line.trimEnd());
+      }
+      return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim().slice(0, 4e3);
+    }
+    function parseJson(text) {
+      const m = text.match(/\{[\s\S]*\}/);
+      if (!m)
+        return null;
+      try {
+        const j = JSON.parse(m[0]);
+        const intents = ["interested", "price_question", "question", "change_request", "not_interested", "unsubscribe", "auto_reply", "other"];
+        return {
+          intent: intents.includes(j.intent) ? j.intent : "other",
+          confidence: Math.max(0, Math.min(1, Number(j.confidence) || 0)),
+          summary: String(j.summary ?? "").slice(0, 300),
+          reply_subject: j.reply_subject ? String(j.reply_subject) : null,
+          reply_body: j.reply_body ? String(j.reply_body) : null
+        };
+      } catch {
+        return null;
+      }
+    }
+    async function analyse(msg, deps) {
+      const db2 = (0, db_1.getDb)();
+      const lead = db2.get("SELECT name, type, city, status, site_url, booking_url, handed_over_at FROM leads WHERE id = ?", [msg.lead_id]);
+      if (!lead)
+        return null;
+      const s = (0, guardrails_1.getAutopilotSettings)();
+      const agency2 = (0, agency_1.getAgencyProfile)();
+      const history = getThread(msg.lead_id).filter((m) => m.id !== msg.id).slice(-6).map((m) => `${m.direction === "out" ? "US" : "THEM"} (${m.at.slice(0, 10)}): ${(m.body ?? "").slice(0, 1200)}`).join("\n\n");
+      const isClient = !!lead.handed_over_at || lead.status === "won";
+      const prompt = `You handle email replies for ${agency2.name ?? "a small web design studio"}, which builds websites for local businesses.
+
+Business you're talking to: ${lead.name}${lead.type ? ` (${lead.type})` : ""}${lead.city ? `, ${lead.city}` : ""}.
+${isClient ? "They are already a paying client." : `They're a prospect. We built them a free demo site${lead.site_url ? `: ${lead.site_url}` : ""}.`}
+
+Pricing you may quote (never discount or promise anything else):
+- Website made live on their own domain: ${(0, agency_1.formatMoney)(s.sitePence, agency2.currency)} one-off.
+${s.carePence > 0 ? `- Optional care plan (hosting, updates, small edits): ${(0, agency_1.formatMoney)(s.carePence, agency2.currency)} a month.` : "- Hosting is included for the first year."}
+${s.callUrl ? `Call booking link: ${s.callUrl}` : "No call booking link \u2014 offer to reply by email or ask for a good time to call."}
+
+Earlier emails:
+${history || "(none stored)"}
+
+Their new email:
+${(msg.body ?? "").slice(0, 3e3)}
+
+Classify the new email and, unless it's an unsubscribe, an auto-reply or a clear no, write the reply we should send.
+
+Intents: interested (wants to go ahead or keen), price_question, question (anything else they ask), change_request (wants changes to the site), not_interested, unsubscribe (asks not to be contacted), auto_reply (out-of-office or automated), other.
+
+Reply rules:
+- Plain, friendly, professional British English. Short: 60\u2013140 words. No hype, no pressure.
+- Answer exactly what they asked. If you don't know something (dates, technical specifics not given above), say we'll confirm rather than inventing it.
+- If they're interested or asking the price and want to proceed, include the literal placeholder {payment_link} on its own line as the way to go ahead.
+- Use {call_link} only if a call booking link exists above.
+- Sign off as ${agency2.name ?? "the team"}.
+- Never claim results, guarantees or testimonials.
+
+Respond with JSON only:
+{"intent": "...", "confidence": 0.0-1.0, "summary": "one sentence on what they want", "reply_subject": "Re: ..." or null, "reply_body": "..." or null}`;
+      const res = await (0, llm_1.generateText)({ apiKey: deps.apiKey, prompt, maxTokens: 1500, timeoutMs: 12e4 });
+      return parseJson(res.text);
+    }
+    function fill(body, links) {
+      let out = body;
+      out = links.payment ? out.replace(/\{payment_link\}/g, links.payment) : out.split("\n").filter((l) => !l.includes("{payment_link}")).join("\n");
+      out = links.call ? out.replace(/\{call_link\}/g, links.call) : out.split("\n").filter((l) => !l.includes("{call_link}")).join("\n");
+      return out.trim();
+    }
+    async function runReplyAgent(deps) {
+      const settings = (0, guardrails_1.getAutopilotSettings)();
+      if (settings.replyMode === "off")
+        return { processed: 0, sent: 0 };
+      const db2 = (0, db_1.getDb)();
+      const pending = db2.all("SELECT * FROM messages WHERE direction = 'in' AND handled = 'new' ORDER BY at ASC LIMIT 10", []);
+      let processed = 0;
+      let sent = 0;
+      for (const msg of pending) {
+        let a = null;
+        try {
+          a = await analyse(msg, deps);
+        } catch (e) {
+          (0, guardrails_1.logActivity)({ action: "Couldn't read reply", leadId: msg.lead_id, detail: e.message, needsYou: true });
+        }
+        if (!a) {
+          db2.run("UPDATE messages SET handled = 'needs_you' WHERE id = ?", [msg.id]);
+          continue;
+        }
+        processed++;
+        db2.run("UPDATE messages SET intent = ?, intent_summary = ?, confidence = ? WHERE id = ?", [a.intent, a.summary, a.confidence, msg.id]);
+        if (a.intent === "unsubscribe" || a.intent === "not_interested") {
+          if (msg.from_addr)
+            (0, guardrails_1.suppress)(msg.from_addr, a.intent === "unsubscribe" ? "unsubscribed" : "not interested", msg.lead_id);
+          (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "in", channel: "email", outcome: "not_interested", note: a.summary });
+          db2.run("UPDATE messages SET handled = 'done' WHERE id = ?", [msg.id]);
+          (0, guardrails_1.logActivity)({ action: a.intent === "unsubscribe" ? "Unsubscribed \u2014 won't be contacted again" : "Not interested \u2014 closed", leadId: msg.lead_id, detail: a.summary });
+          continue;
+        }
+        if (a.intent === "auto_reply") {
+          db2.run("UPDATE messages SET handled = 'ignored' WHERE id = ?", [msg.id]);
+          continue;
+        }
+        if (a.intent === "interested") {
+          (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "in", channel: "email", outcome: "interested", note: a.summary });
+        }
+        let body = a.reply_body ?? "";
+        let payment = null;
+        if (body.includes("{payment_link}") && settings.sendProposals) {
+          try {
+            payment = await deps.createPaymentLink(msg.lead_id);
+          } catch (e) {
+            (0, guardrails_1.logActivity)({ action: "Couldn't create payment link", leadId: msg.lead_id, detail: e.message, needsYou: true });
+          }
+        }
+        body = fill(body, { payment, call: settings.callUrl });
+        const subject = a.reply_subject || `Re: ${msg.subject ?? ""}`.trim();
+        db2.run("UPDATE messages SET draft_subject = ?, draft_body = ?, handled = 'drafted' WHERE id = ?", [subject, body, msg.id]);
+        const canAuto = settings.replyMode === "auto" && AUTO_SENDABLE.includes(a.intent) && a.confidence >= settings.minConfidence && !!body && !(0, guardrails_1.isSuppressed)(msg.from_addr) && !(0, guardrails_1.sendBlockedReason)();
+        if (canAuto) {
+          const r = await sendDraft(msg.id, { subject, body }, deps.smtp, "autopilot");
+          if (r.ok) {
+            sent++;
+            (0, guardrails_1.logActivity)({ action: `Replied automatically (${a.intent.replace("_", " ")})`, leadId: msg.lead_id, detail: a.summary });
+            continue;
+          }
+          (0, guardrails_1.logActivity)({ action: "Auto-reply failed to send", leadId: msg.lead_id, detail: r.error, needsYou: true });
+        }
+        const why = settings.replyMode === "draft" ? "Draft ready for you to check" : !AUTO_SENDABLE.includes(a.intent) ? `Needs you (${a.intent.replace("_", " ")})` : a.confidence < settings.minConfidence ? "Needs you (agent wasn't sure)" : (0, guardrails_1.sendBlockedReason)() ?? "Needs you";
+        (0, guardrails_1.logActivity)({ action: why, leadId: msg.lead_id, detail: a.summary, needsYou: true });
+      }
+      if (processed)
+        deps.emit?.("inbox:changed", { processed, sent });
+      return { processed, sent };
+    }
+    async function sendDraft(messageId, content, smtp, sentBy) {
+      if (!smtp)
+        return { ok: false, error: "Set up email sending in Settings first." };
+      const db2 = (0, db_1.getDb)();
+      const msg = db2.get("SELECT * FROM messages WHERE id = ?", [messageId]);
+      if (!msg)
+        return { ok: false, error: "Message not found." };
+      if (!msg.from_addr)
+        return { ok: false, error: "No address to reply to." };
+      if ((0, guardrails_1.isSuppressed)(msg.from_addr))
+        return { ok: false, error: "This address is on the do-not-contact list." };
+      if (sentBy === "autopilot") {
+        const blocked = (0, guardrails_1.sendBlockedReason)();
+        if (blocked)
+          return { ok: false, error: blocked };
+      }
+      const res = await (0, email_1.sendEmail)(smtp, {
+        to: msg.from_addr,
+        subject: content.subject,
+        text: content.body,
+        inReplyTo: msg.message_id,
+        references: msg.message_id
+      });
+      if (!res.ok)
+        return { ok: false, error: res.error };
+      recordOutgoing({
+        leadId: msg.lead_id,
+        to: msg.from_addr,
+        from: smtp.from,
+        subject: content.subject,
+        body: content.body,
+        messageId: res.messageId,
+        inReplyTo: msg.message_id,
+        sentBy
+      });
+      db2.run("UPDATE messages SET handled = 'replied', draft_subject = ?, draft_body = ? WHERE id = ?", [content.subject, content.body, messageId]);
+      (0, followup_1.logContact)({ leadId: msg.lead_id, direction: "out", channel: "email", note: content.subject });
+      return { ok: true };
+    }
+    function dismissMessage(messageId) {
+      (0, db_1.getDb)().run("UPDATE messages SET handled = 'done' WHERE id = ?", [messageId]);
+    }
+    function resetForAgent(messageId) {
+      (0, db_1.getDb)().run("UPDATE messages SET handled = 'new', draft_subject = NULL, draft_body = NULL WHERE id = ? AND direction = 'in'", [messageId]);
+    }
+    async function sendFollowUps(args) {
+      if (!args.smtp)
+        return { sent: 0, skipped: 0, error: "Email sending isn't set up." };
+      const db2 = (0, db_1.getDb)();
+      const due = db2.all(`SELECT id, name, email, site_url, booking_url, last_email_message_id
+       FROM leads
+      WHERE last_contacted_at IS NOT NULL
+        AND last_reply_at IS NULL AND replied_at IS NULL
+        AND status NOT IN ('dead','won')
+        AND COALESCE(followed_up_count, 0) <= 1
+        AND email IS NOT NULL AND email != ''
+        AND julianday('now') - julianday(last_contacted_at) >= ?
+        ${args.onlyLeadIds ? `AND id IN (${args.onlyLeadIds.map(Number).join(",") || "NULL"})` : ""}
+      ORDER BY last_contacted_at ASC
+      LIMIT ?`, [args.afterDays, args.limit]);
+      const agency2 = (0, agency_1.getAgencyProfile)().name ?? "";
+      let sent = 0;
+      let skipped = 0;
+      for (const l of due) {
+        if ((0, guardrails_1.isSuppressed)(l.email)) {
+          skipped++;
+          continue;
+        }
+        const blocked = (0, guardrails_1.sendBlockedReason)();
+        if (blocked)
+          return { sent, skipped: skipped + (due.length - sent - skipped), error: blocked };
+        const link = l.site_url || l.booking_url || "";
+        const subject = `Following up \u2014 ${l.name}`;
+        const body = [
+          "Hello,",
+          "",
+          `Just following up on the free demo website I put together for ${l.name}${link ? `:
+${link}` : "."}`,
+          "",
+          `Happy to answer any questions or make changes. If it's not for you, just reply "no thanks" and I won't get in touch again.`,
+          "",
+          "Best regards",
+          agency2
+        ].join("\n");
+        const res = await (0, email_1.sendEmail)(args.smtp, {
+          to: l.email,
+          subject,
+          text: body,
+          inReplyTo: l.last_email_message_id,
+          references: l.last_email_message_id
+        });
+        if (!res.ok) {
+          (0, guardrails_1.logActivity)({ action: "Follow-up failed to send", leadId: l.id, detail: res.error });
+          skipped++;
+          continue;
+        }
+        recordOutgoing({ leadId: l.id, to: l.email, from: args.smtp.from, subject, body, messageId: res.messageId ?? null, inReplyTo: l.last_email_message_id, sentBy: "autopilot" });
+        (0, followup_1.logContact)({ leadId: l.id, direction: "out", channel: "email", note: "follow-up" });
+        (0, guardrails_1.logActivity)({ action: "Sent a follow-up", leadId: l.id });
+        sent++;
+      }
+      return { sent, skipped };
+    }
+  }
+});
+
 // ../desktop/dist/main/lib/chat-tools.js
 var require_chat_tools = __commonJS({
   "../desktop/dist/main/lib/chat-tools.js"(exports2) {
@@ -95727,6 +97036,8 @@ var require_chat_tools = __commonJS({
     var site_stats_1 = require_site_stats();
     var email_1 = require_email();
     var email_harvest_1 = require_email_harvest();
+    var guardrails_1 = require_guardrails();
+    var inbox_1 = require_inbox();
     exports2.TOOLS = [
       {
         name: "find_leads",
@@ -95806,7 +97117,7 @@ var require_chat_tools = __commonJS({
       },
       {
         name: "whatsapp_message",
-        description: "Generate a pre-filled WhatsApp message link for a lead. Returns a URL the user can open. Doesn't actually send.",
+        description: "Generate a pre-filled WhatsApp message link for a lead. Only use this when the user explicitly asks for WhatsApp \u2014 outreach is email by default. Returns a URL the user can open. Doesn't actually send.",
         input_schema: {
           type: "object",
           properties: {
@@ -95833,7 +97144,7 @@ var require_chat_tools = __commonJS({
             channel: {
               type: "string",
               enum: ["email", "whatsapp", "sms"],
-              description: "Preferred channel. 'email' (default) sends via the user's SMTP \u2014 the only channel that works unattended on every platform \u2014 falling back to a WhatsApp link for leads with no email address. 'whatsapp' opens WhatsApp and 'sms' opens the device's Messages app (Messages on macOS, Phone Link on Windows); both fall back to email when a lead has no phone. Omit to use the saved preference."
+              description: "Preferred channel. 'email' (default, and the professional choice) sends via the user's SMTP \u2014 the only channel that works unattended on every platform. Leads with no email address are reported as unreachable, never switched to WhatsApp. 'whatsapp' opens WhatsApp and 'sms' opens the device's Messages app (Messages on macOS, Phone Link on Windows); both fall back to email when a lead has no phone. Omit to use the saved preference."
             }
           }
         },
@@ -96094,7 +97405,7 @@ var require_chat_tools = __commonJS({
       },
       {
         name: "provision_cms",
-        description: "Set up a CMS for a paying customer (lead in 'won' status). Creates Supabase records, redeploys with the dynamic CMS template, returns a one-time claim link.",
+        description: "Give a built site its editor, keeping the design exactly as it is: the owner taps text and photos on their own page at <site>/edit (works on a phone) and has /admin for services, hours and photos. Returns the edit link and password to hand to the customer.",
         input_schema: {
           type: "object",
           properties: { id: { type: "number" } },
@@ -96202,11 +97513,19 @@ Want it live on your own domain?`;
     }
     function outreachTemplate(db2) {
       const row = db2.get("SELECT value FROM settings WHERE key = ?", ["outreach_template"]);
-      return row?.value ?? `Hi, we built {name} a free demo website: {site_url}
+      return row?.value ?? `Hello,
+
+I came across {name} on Google and noticed you don't have a website yet, so I put together a free demo to show what one could look like:
+
+{site_url}
+
+It's built from your real reviews and photos. If you like it, I can put it live on your own domain with your details for a one-off fee of \xA3199 \u2014 no monthly charges.
 
-It's not fully live yet. We can make it live for \xA3199 \u2014 your own domain, photos & content. One-time fee.
+Would you be open to a quick chat this week?
 
-Interested?`;
+Best regards
+
+If you'd rather not hear from me again, just reply and let me know.`;
     }
     function normaliseChannel(value) {
       switch (String(value ?? "").toLowerCase()) {
@@ -96352,11 +97671,19 @@ Interested?`;
           const phone = (lead.phone ?? "").replace(/[^\d+]/g, "");
           const e164 = phone.startsWith("+") ? phone : phone.startsWith("0") ? `+44${phone.slice(1)}` : phone;
           const tplRow = db2.get("SELECT value FROM settings WHERE key = ?", ["outreach_template"]);
-          const template = tplRow?.value ?? `Hi, we built {name} a free demo website: {site_url}
+          const template = tplRow?.value ?? `Hello,
+
+I came across {name} on Google and noticed you don't have a website yet, so I put together a free demo to show what one could look like:
+
+{site_url}
+
+It's built from your real reviews and photos. If you like it, I can put it live on your own domain with your details for a one-off fee of \xA3199 \u2014 no monthly charges.
+
+Would you be open to a quick chat this week?
 
-It's not fully live yet. We can make it live for \xA3199 \u2014 your own domain, photos & content. One-time fee.
+Best regards
 
-Interested?`;
+If you'd rather not hear from me again, just reply and let me know.`;
           const body = input.message ?? template.replace(/\{name\}/g, lead.name).replace(/\{site_url\}/g, lead.site_url ?? "");
           const url = `https://wa.me/${e164.replace(/^\+/, "")}?text=${encodeURIComponent(body)}`;
           return { url, message: body, phone: e164 };
@@ -96383,7 +97710,7 @@ Interested?`;
           const template = outreachTemplate(db2);
           const bookingTemplate = bookingOutreachTemplate(db2);
           const preferEmail = channel === "email";
-          const linkChannel = channel === "email" ? "whatsapp" : channel;
+          const linkChannel = channel === "email" ? null : channel;
           const smtp = (0, email_1.smtpFromSettings)((k) => getDecryptedSetting(k));
           const emailSubject = getDecryptedSetting("outreach_email_subject") || "A free demo website for {name}";
           const prepared = [];
@@ -96409,9 +97736,17 @@ Interested?`;
                 harvested++;
               }
             }
+            if (r.email && (0, guardrails_1.isSuppressed)(r.email)) {
+              prepared.push({ id: r.id, name: r.name, via: "none", email: r.email, message, emailError: "On the do-not-contact list" });
+              continue;
+            }
+            if (preferEmail && (0, guardrails_1.emailsSentToday)() >= (0, guardrails_1.getAutopilotSettings)().maxEmailsPerDay) {
+              prepared.push({ id: r.id, name: r.name, via: "none", email: r.email ?? void 0, message, emailError: "Daily email limit reached \u2014 try again tomorrow" });
+              continue;
+            }
             const leadEmail = smtp && r.email ? r.email : null;
             const useEmail = leadEmail !== null && (preferEmail || !e164);
-            if (!useEmail && e164) {
+            if (!useEmail && e164 && linkChannel) {
               prepared.push({
                 id: r.id,
                 name: r.name,
@@ -96423,11 +97758,16 @@ Interested?`;
             } else if (useEmail && smtp && leadEmail) {
               const subject = emailSubject.replace(/\{name\}/g, r.name);
               const res = await (0, email_1.sendEmail)(smtp, { to: leadEmail, subject, text: message });
-              if (res.ok && res.messageId) {
-                db2.run("UPDATE leads SET last_email_message_id = ? WHERE id = ?", [
-                  res.messageId,
-                  r.id
-                ]);
+              if (res.ok) {
+                (0, inbox_1.recordOutgoing)({
+                  leadId: r.id,
+                  to: leadEmail,
+                  from: smtp.from,
+                  subject,
+                  body: message,
+                  messageId: res.messageId ?? null,
+                  sentBy: "outreach"
+                });
               }
               prepared.push({
                 id: r.id,
@@ -96457,7 +97797,7 @@ Interested?`;
               (0, followup_1.logContact)({
                 leadId: r.id,
                 direction: "out",
-                channel: last.via === "email" ? "email" : linkChannel
+                channel: last.via === "email" ? "email" : linkChannel ?? "sms"
               });
             }
           }
@@ -96861,8 +98201,15 @@ Interested?`;
         }
         case "provision_cms": {
           const id = Number(input.id);
-          const result = await ctx.invokeIpc("cms:provision", id);
-          return result;
+          const result = await ctx.invokeIpc("sites:addEditor", id);
+          return {
+            ok: true,
+            id,
+            publicUrl: result.url,
+            editUrl: `${result.url}/edit`,
+            adminUrl: result.admin?.url,
+            adminPassword: result.admin?.password
+          };
         }
         case "delete_lead": {
           const id = Number(input.id);
@@ -96890,7 +98237,7 @@ var require_chat = __commonJS({
     var sdk_1 = __importDefault(require_sdk());
     var chat_tools_1 = require_chat_tools();
     var models_1 = require_models();
-    var SYSTEM_PROMPT = `You are Sproutkit's built-in assistant \u2014 STRICTLY scoped to helping the user run their lead-generation, website-building, and outreach work inside the Sproutkit app.
+    var SYSTEM_PROMPT = `You are Sprout, Sproutkit's built-in assistant (the operator's friendly sidekick) \u2014 STRICTLY scoped to helping the user run their lead-generation, website-building, and outreach work inside the Sproutkit app.
 
 You can do the user's real work through tools \u2014 you are not a help desk pointing at buttons. Many users prefer chatting to using the UI, so if something can be done with a tool, DO IT.
 
@@ -96937,7 +98284,7 @@ Confirmation rules:
 You can help with:
 - Finding leads (running the search itself, plus strategy, categories, filtering)
 - Building demo websites (design ideas, copy suggestions, fixing issues)
-- Outreach (drafting WhatsApp / SMS / email messages, follow-ups, kanban moves)
+- Outreach (email by default \u2014 draft and send professional emails; only use WhatsApp/SMS when the user asks; follow-ups, kanban moves)
 - The CMS, claim flow, customer onboarding
 - Sproutkit features and how to use them
 - Pricing, business advice for selling websites to local small businesses
@@ -96946,7 +98293,7 @@ STAYING ON THE RAILS \u2014 you are capable, but you only act through the tools
 - You can ONLY do what a tool does. If a request maps to a tool (even loosely, via an instructions field), do it. If NO tool fits \u2014 e.g. "run their Google Ads", "post to their Instagram", "phone the owner", "take payment" \u2014 say so plainly in one line and name the closest thing you CAN do. Example: "I can't run ads, but I can build them a site and draft the outreach \u2014 want that?"
 - NEVER claim to have done something you have no tool for. NEVER invent a result, URL, price, or status. If you didn't get it from a tool result, don't state it as fact.
 - Don't drift into general marketing consultancy, coding help, or business strategy essays. A one-line pointer is fine; a lecture is not.
-- Refuse anything genuinely off-topic (general coding, creative writing, personal advice, news, politics) briefly: "I'm Sproutkit's assistant \u2014 I help with finding leads, building sites, booking, and outreach. What would you like to do?" and stop.
+- Refuse anything genuinely off-topic (general coding, creative writing, personal advice, news, politics) briefly: "I'm Sprout, Sproutkit's assistant \u2014 I help with finding leads, building sites, booking, and outreach. What would you like to do?" and stop.
 
 Be concise, action-oriented, and use plain English. Never apologise excessively. Never lecture.
 
@@ -97119,6 +98466,7 @@ var require_auto_mode = __commonJS({
     exports2.resumeAutoJob = resumeAutoJob;
     exports2.cancelAutoJob = cancelAutoJob2;
     exports2.getAutoJobStatus = getAutoJobStatus;
+    exports2.waitForAutoJob = waitForAutoJob;
     var db_1 = require_db();
     var builder_1 = require_builder();
     var AutoJob = class {
@@ -97330,6 +98678,20 @@ var require_auto_mode = __commonJS({
     function getAutoJobStatus() {
       return activeJob ? activeJob.snapshot() : null;
     }
+    async function waitForAutoJob(jobId, onProgress, timeoutMs = 90 * 6e4) {
+      const started = Date.now();
+      for (; ; ) {
+        const snap = activeJob && activeJob.id === jobId ? activeJob.snapshot() : null;
+        if (!snap)
+          return null;
+        onProgress?.(snap);
+        if (snap.state === "completed" || snap.state === "cancelled")
+          return snap;
+        if (Date.now() - started > timeoutMs)
+          return snap;
+        await new Promise((r) => setTimeout(r, 2e3));
+      }
+    }
   }
 });
 
@@ -97869,7 +99231,7 @@ var require_vercel_store = __commonJS({
 });
 
 // src/engine.ts
-var db, chat, chatTools, autoMode, cms, bookingPreset, builder, vercelStore, agency, followup, invoicing, models, llm, initDatabase, getDb, chatWithTools, runTool, TOOLS, startAutoJob, cancelAutoJob, provisionCmsForLead, generatePreset, deployBookingOnly, deployStandaloneBooking, handoverSite, createBlobStore, refreshModels, refreshIfStale, listCachedModels, getPreferredModel, getAgencyProfile, setAgencyProfile, agencyConfigured, formatMoney, dueFollowUps, outreachStats, contactHistory, renderLetterPdf, listInvoicesRaw, checkClaudeCodeAuth, llmBackend, claudeBin, CLAUDE_CODE_MODELS, getClaudeCodeModel;
+var db, chat, chatTools, autoMode, cms, bookingPreset, builder, vercelStore, agency, followup, invoicing, models, llm, initDatabase, getDb, chatWithTools, runTool, TOOLS, startAutoJob, cancelAutoJob, provisionCmsForLead, generatePreset, deployBookingOnly, deployStandaloneBooking, handoverSite, addEditorToSite, createBlobStore, refreshModels, refreshIfStale, listCachedModels, getPreferredModel, getAgencyProfile, setAgencyProfile, agencyConfigured, formatMoney, dueFollowUps, outreachStats, contactHistory, renderLetterPdf, listInvoicesRaw, checkClaudeCodeAuth, llmBackend, claudeBin, CLAUDE_CODE_MODELS, getClaudeCodeModel;
 var init_engine = __esm({
   "src/engine.ts"() {
     "use strict";
@@ -97898,6 +99260,7 @@ var init_engine = __esm({
     deployBookingOnly = builder.deployBookingOnly;
     deployStandaloneBooking = builder.deployStandaloneBooking;
     handoverSite = builder.handoverSite;
+    addEditorToSite = builder.addEditorToSite;
     createBlobStore = vercelStore.createBlobStore;
     refreshModels = models.refreshModels;
     refreshIfStale = models.refreshIfStale;
@@ -98365,7 +99728,7 @@ var require_package2 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sproutkit-code",
-      version: "1.9.1",
+      version: "1.11.0",
       description: "Sproutkit in your terminal \u2014 find leads, build sites, run outreach, all via chat.",
       bin: {
         sproutkit: "./dist/index.js"
@@ -98443,6 +99806,31 @@ function makeInvokeIpc(emit2) {
         emit: emit2
       });
     }
+    if (channel === "sites:addEditor") {
+      const leadId = Number(payload);
+      const db2 = getDb();
+      const lead = db2.get("SELECT * FROM leads WHERE id = ?", [leadId]);
+      if (!lead) throw new Error("Lead not found");
+      if (!lead.site_url) throw new Error("Build the website first, then add the editor.");
+      const vercelToken = getSetting("vercel_token");
+      if (!vercelToken) throw new Error("Vercel token not set");
+      const blobToken = await requireBlobToken(vercelToken, emit2, leadId);
+      const result = await addEditorToSite({
+        lead,
+        anthropicKey: getSetting("anthropic_key"),
+        vercelToken,
+        blobToken,
+        reuseAdminPassword: lead.admin_password ?? null,
+        onProgress: (msg) => emit2("cms:progress", { leadId, msg })
+      });
+      db2.run("UPDATE leads SET site_url = ?, admin_url = ?, admin_password = ? WHERE id = ?", [
+        result.url,
+        result.admin?.url ?? null,
+        result.admin?.password ?? null,
+        leadId
+      ]);
+      return result;
+    }
     if (channel === "cms:provision") {
       const leadId = Number(payload);
       const db2 = getDb();
@@ -100312,23 +101700,24 @@ async function cmdCms(argv) {
     return;
   }
   const status = json ? void 0 : new Status();
-  if (status) status.start(`Setting up CMS for lead #${id}`);
+  if (status) status.start(`Adding the editor to lead #${id}'s site`);
   try {
     const result = await runTool("provision_cms", { id }, makeCtx({ json, status }));
-    if (status) status.done(true, result.publicUrl ? `CMS live at ${result.publicUrl}` : `CMS set up for #${id}`);
+    if (status) status.done(true, result.publicUrl ? `Editor live at ${result.publicUrl}/edit` : `Editor added for #${id}`);
     autoSync();
     if (json) emitJson(result);
-    else sayAdminHandover(result.adminUrl, result.adminPassword);
+    else sayAdminHandover(result.adminUrl, result.adminPassword, result.editUrl);
   } catch (e) {
     if (status) status.done(false, "CMS setup failed");
     json ? emitJson({ ok: false, error: e.message }) : say(c.red("  " + e.message));
     process.exitCode = 1;
   }
 }
-function sayAdminHandover(adminUrl, adminPassword) {
+function sayAdminHandover(adminUrl, adminPassword, editUrl) {
   if (!adminUrl || !adminPassword) return;
   say("");
   say(c.bold("  Client handover"));
+  if (editUrl) say(`  Edit page:   ${editUrl}  (tap text/photos to change them \u2014 works on a phone)`);
   say(`  Admin panel: ${adminUrl}`);
   say(`  Password:    ${adminPassword}`);
   say(c.dim("  Send these to the client \u2014 they manage bookings and content there."));