@agent-native/core 0.98.3 → 0.98.5

package/dist/demo/config.js

@@ -1,12 +1,12 @@
 /**
  * Demo mode gate.
  *
- * Demo mode replaces email addresses and numbers in every action result with
- * deterministic fake data — for both the UI and what the agent sees — while
- * preserving names, free text, labels, IDs, dates, URLs, and structure so the
- * app keeps working. The redaction WALK (see ./redact.ts) is expensive on
- * large payloads, so callers MUST gate it behind this function and only walk
- * when it returns true.
+ * Demo mode replaces every email address with `anonymous@builder.io` and
+ * anonymizes numbers in every action result — for both the UI and what the
+ * agent sees — while preserving names, free text, labels, IDs, dates, URLs,
+ * and structure so the app keeps working. The redaction WALK (see ./redact.ts)
+ * is expensive on large payloads, so callers MUST gate it behind this function
+ * and only walk when it returns true.
  *
  * This gate itself is intentionally cheap:
  *   - An env-forced deployment (a hosted demo site) short-circuits with zero

package/dist/demo/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/demo/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAEtE,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEhE,oEAAoE;AACpE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,UAAU,GAAG,mBAAmB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Demo mode gate.\n *\n * Demo mode replaces email addresses and numbers in every action result with\n * deterministic fake data — for both the UI and what the agent sees — while\n * preserving names, free text, labels, IDs, dates, URLs, and structure so the\n * app keeps working. The redaction WALK (see ./redact.ts) is expensive on\n * large payloads, so callers MUST gate it behind this function and only walk\n * when it returns true.\n *\n * This gate itself is intentionally cheap:\n *   - An env-forced deployment (a hosted demo site) short-circuits with zero\n *     I/O — `DEMO_MODE=true`.\n *   - The per-user runtime toggle lives in `application_state` under the\n *     `demo-mode` key (`{ enabled: boolean }`), written by the settings UI and\n *     the `toggle-demo-mode` agent action. It's read behind a short in-process\n *     TTL cache keyed by user, so a tight agent tool-call loop doesn't hit the\n *     DB on every result.\n */\nimport { readAppState } from \"../application-state/script-helpers.js\";\n\nconst TTL_MS = 3_000;\nconst cache = new Map<string, { value: boolean; at: number }>();\n\n/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */\nexport function isDemoModeForced(): boolean {\n  return process.env.DEMO_MODE === \"true\";\n}\n\n/**\n * Whether demo-mode redaction should run for the current request/user.\n * Cheap by design — safe to call before every action result; the expensive\n * walk only happens when this is true.\n */\nexport async function isDemoModeEnabled(): Promise<boolean> {\n  if (isDemoModeForced()) return true;\n  try {\n    let sessionKey = \"_\";\n    try {\n      const { getRequestUserEmail } =\n        await import(\"../server/request-context.js\");\n      sessionKey = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL ?? \"_\";\n    } catch {\n      // request-context unavailable (CLI / non-server) — use default key\n    }\n    const now = Date.now();\n    const hit = cache.get(sessionKey);\n    if (hit && now - hit.at < TTL_MS) return hit.value;\n    const state = await readAppState(\"demo-mode\");\n    const enabled = state?.enabled === true;\n    cache.set(sessionKey, { value: enabled, at: now });\n    return enabled;\n  } catch {\n    // No request context / DB unavailable — fail closed (no redaction).\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/demo/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAEtE,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEhE,oEAAoE;AACpE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,UAAU,GAAG,mBAAmB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Demo mode gate.\n *\n * Demo mode replaces every email address with `anonymous@builder.io` and\n * anonymizes numbers in every action result — for both the UI and what the\n * agent sees — while preserving names, free text, labels, IDs, dates, URLs,\n * and structure so the app keeps working. The redaction WALK (see ./redact.ts)\n * is expensive on large payloads, so callers MUST gate it behind this function\n * and only walk when it returns true.\n *\n * This gate itself is intentionally cheap:\n *   - An env-forced deployment (a hosted demo site) short-circuits with zero\n *     I/O — `DEMO_MODE=true`.\n *   - The per-user runtime toggle lives in `application_state` under the\n *     `demo-mode` key (`{ enabled: boolean }`), written by the settings UI and\n *     the `toggle-demo-mode` agent action. It's read behind a short in-process\n *     TTL cache keyed by user, so a tight agent tool-call loop doesn't hit the\n *     DB on every result.\n */\nimport { readAppState } from \"../application-state/script-helpers.js\";\n\nconst TTL_MS = 3_000;\nconst cache = new Map<string, { value: boolean; at: number }>();\n\n/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */\nexport function isDemoModeForced(): boolean {\n  return process.env.DEMO_MODE === \"true\";\n}\n\n/**\n * Whether demo-mode redaction should run for the current request/user.\n * Cheap by design — safe to call before every action result; the expensive\n * walk only happens when this is true.\n */\nexport async function isDemoModeEnabled(): Promise<boolean> {\n  if (isDemoModeForced()) return true;\n  try {\n    let sessionKey = \"_\";\n    try {\n      const { getRequestUserEmail } =\n        await import(\"../server/request-context.js\");\n      sessionKey = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL ?? \"_\";\n    } catch {\n      // request-context unavailable (CLI / non-server) — use default key\n    }\n    const now = Date.now();\n    const hit = cache.get(sessionKey);\n    if (hit && now - hit.at < TTL_MS) return hit.value;\n    const state = await readAppState(\"demo-mode\");\n    const enabled = state?.enabled === true;\n    cache.set(sessionKey, { value: enabled, at: now });\n    return enabled;\n  } catch {\n    // No request context / DB unavailable — fail closed (no redaction).\n    return false;\n  }\n}\n"]}

package/dist/demo/fetch-interceptor.d.ts

@@ -1,3 +1,4 @@
+export declare function shouldSkipDemoResponseRedaction(url: string): boolean;
 /** Refresh demo mode after the shared DB-sync stream reports a real change. */
 export declare function refreshDemoModeFetchInterceptor(): Promise<void>;
 /**

package/dist/demo/fetch-interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-interceptor.d.ts","sourceRoot":"","sources":["../../src/demo/fetch-interceptor.ts"],"names":[],"mappings":"AA2GA,+EAA+E;AAC/E,wBAAgB,+BAA+B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ/D;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CA+DrD"}
+{"version":3,"file":"fetch-interceptor.d.ts","sourceRoot":"","sources":["../../src/demo/fetch-interceptor.ts"],"names":[],"mappings":"AAkEA,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMpE;AA6DD,+EAA+E;AAC/E,wBAAgB,+BAA+B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ/D;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAqErD"}

package/dist/demo/fetch-interceptor.js

@@ -44,6 +44,26 @@ const SKIP_SUBSTRINGS = [
     // exhaust its retries ("agent connection kept failing").
     "/_agent-native/runs",
 ];
+// Raw rrweb payloads are playback data, not ordinary app UI records. Skipping
+// these is not just a perf optimization that avoids walking/cloning huge
+// DOM/event trees on the main thread: demo number
+// redaction previously ran over this exact raw replay JSON and faked any
+// integer >= 1000 it found — Meta/ViewportResize widths, pointer x/y
+// coordinates, and numeric values inside `_cssText` and SVG attributes. That
+// was the root cause of the 2026-07 "ultra-wide replay" bugs (stages
+// rendered thousands of pixels wide, frozen/teleporting cursors, giant
+// icons) even though every stored recording was always geometrically sane —
+// the corruption happened at *view* time, not at capture/storage time. Small
+// list/summary/manifest responses stay eligible so rendered visitor identities
+// are still anonymized. NEVER remove the raw payload skips or broaden them to
+// metadata endpoints that the UI renders directly.
+const RAW_REPLAY_PAYLOAD_RE = /\/api\/session-replay\/recordings\/[^/?#]+\/(?:chunks(?:\/[^/?#]+)?|events)(?:[/?#]|$)/;
+const RAW_AGENT_REPLAY_EVENTS_RE = /\/api\/session-replay\/agent-events\.json(?:[?#]|$)/;
+export function shouldSkipDemoResponseRedaction(url) {
+    return (SKIP_SUBSTRINGS.some((substring) => url.includes(substring)) ||
+        RAW_REPLAY_PAYLOAD_RE.test(url) ||
+        RAW_AGENT_REPLAY_EVENTS_RE.test(url));
+}
 let installed = false;
 let demoEnabled = false;
 let originalFetch = null;
@@ -138,7 +158,7 @@ export function ensureDemoModeFetchInterceptor() {
             return res;
         try {
             const url = urlOf(input);
-            if (SKIP_SUBSTRINGS.some((s) => url.includes(s)))
+            if (shouldSkipDemoResponseRedaction(url))
                 return res;
             // Only buffered, finite JSON. SSE / streaming / chunked-forever bodies
             // never reach `redactDemoData`: streaming content-types are excluded,
@@ -156,7 +176,13 @@ export function ensureDemoModeFetchInterceptor() {
             if (res.bodyUsed)
                 return res;
             const data = await withTimeout(res.clone().json(), 3_000);
-            const redacted = redactDemoData(data);
+            // Frontend reads only need identity privacy. Dashboard charts apply
+            // their purpose-built demo trend transform at render time, so mutating
+            // every numeric field in every JSON response is unnecessary work.
+            const redacted = redactDemoData(data, {
+                redactNumbers: false,
+                redactProtectedEmails: true,
+            });
             const headers = new Headers(res.headers);
             // Body is re-serialized — these would be wrong now.
             headers.delete("content-length");

package/dist/demo/fetch-interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-interceptor.js","sourceRoot":"","sources":["../../src/demo/fetch-interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,GAAG,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAClE,MAAM,eAAe,GAAG;IACtB,4BAA4B;IAC5B,qBAAqB;IACrB,uBAAuB;IACvB,iEAAiE;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,sCAAsC;IACtC,sBAAsB;IACtB,wEAAwE;IACxE,oEAAoE;IACpE,yDAAyD;IACzD,qBAAqB;CACtB,CAAC;AAEF,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,aAAa,GAAwB,IAAI,CAAC;AAC9C,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,8EAA8E;AAC9E,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,0EAA0E;AAC1E,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAC1D;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB;IACrC,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QAC5C,OAAQ,KAAiB,CAAC,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB,EAAE,IAAkB;IAC5D,MAAM,CAAC,GACL,IAAI,EAAE,MAAM;QACZ,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC;YACnD,CAAC,CAAE,KAAiB,CAAC,MAAM;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,CAAC;IACR,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,CAAC,GAAG,aAAa,IAAI,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAGtB,CAAC;QACT,WAAW,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;YAAS,CAAC;QACT,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,eAAe,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9C,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B;IAC5C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC;IAE3B,MAAM,CAAC,KAAK,GAAG,KAAK,UAAU,YAAY,CACxC,KAAwB,EACxB,IAAkB;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAEpC,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;YAAE,OAAO,GAAG,CAAC;QACjD,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC;YAE7D,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IACE,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACpC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC9B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC9B,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YAEtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,oDAAoD;YACpD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAEnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,sEAAsE;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,+BAA+B,EAAE,CAAC;AACzC,CAAC","sourcesContent":["import { agentNativePath } from \"../client/api-path.js\";\n/**\n * Client-side demo-mode redaction.\n *\n * Why client-side and not (only) at the server action boundary: templates\n * serve a lot of their UI data through their OWN custom Nitro `/api/*`\n * handlers (e.g. mail's `/api/emails`, `/api/threads/:id/messages`,\n * `/api/contacts`, `/api/apollo/person`), which never pass through the\n * framework action runtime. On this stack (Nitro v3 / h3 v2) there is no\n * single server hook that can safely rewrite every JSON body (the `response`\n * hook hands you an immutable Web `Response` and returns `void`). Patching the\n * browser's `fetch` is the one place that is BOTH universal (every template's\n * reads — actions and custom routes alike — go through it) AND low-risk: it\n * can only ever post-process JSON the app already parses for display, so it\n * physically cannot break auth, SSE streams, SSR HTML, or binary downloads.\n *\n * The agent is handled separately and in-process (its action tool results are\n * redacted in `production-agent.ts`), so it doesn't depend on this at all.\n *\n * Scope intentionally narrow:\n *   - Only same-document `GET` requests are redacted. Mutation responses\n *     (POST/PUT/PATCH/DELETE) pass through untouched so a draft you just\n *     typed isn't echoed back as fake data mid-demo.\n *   - Only `application/json` 2xx bodies. Streams (`text/event-stream`),\n *     HTML, and binary are skipped by content-type.\n *   - Framework infra endpoints (poll, events, the demo-status endpoint\n *     itself) are skipped — no PII and avoids self-recursion.\n *   - Any error during interception falls back to the original response.\n */\nimport { redactDemoData } from \"./redact.js\";\n\nconst STATUS_PATH = agentNativePath(\"/_agent-native/demo/status\");\nconst SKIP_SUBSTRINGS = [\n  \"/_agent-native/demo/status\",\n  \"/_agent-native/poll\",\n  \"/_agent-native/events\",\n  // Never touch agent transport. The agent already gets in-process\n  // redaction of its tool results; faking its own transcript adds no demo\n  // value and must stay clear of the tool_use/tool_result protocol. Covers\n  // \"/_agent-native/agent\" (stream) and \"/_agent-native/agent-chat\"\n  // (thread history) and any sub-paths.\n  \"/_agent-native/agent\",\n  // Run-manager state read by the reconnect/recovery loop. Faking numeric\n  // run state here would make recovery think it's not progressing and\n  // exhaust its retries (\"agent connection kept failing\").\n  \"/_agent-native/runs\",\n];\n\nlet installed = false;\nlet demoEnabled = false;\nlet originalFetch: typeof fetch | null = null;\nlet refreshPromise: Promise<void> | null = null;\n\n// Set once the first demo-status check completes. We DO NOT block requests on\n// it — if status isn't known yet a response is simply passed through\n// un-redacted (a brief first-paint window) rather than delaying transport.\n// Injecting latency into early GETs previously risked the agent's streaming\n// reconnect logic; transport safety wins over redacting the first paint.\nlet firstStatusDone = false;\n\n/** Reject after `ms` so a misclassified streaming body can never hang. */\nfunction withTimeout<T>(p: Promise<T>, ms: number): Promise<T> {\n  return Promise.race([\n    p,\n    new Promise<T>((_, reject) =>\n      setTimeout(() => reject(new Error(\"redact-timeout\")), ms),\n    ),\n  ]);\n}\n\nfunction urlOf(input: RequestInfo | URL): string {\n  try {\n    if (typeof input === \"string\") return input;\n    if (input instanceof URL) return input.href;\n    return (input as Request).url ?? \"\";\n  } catch {\n    return \"\";\n  }\n}\n\nfunction methodOf(input: RequestInfo | URL, init?: RequestInit): string {\n  const m =\n    init?.method ??\n    (typeof input !== \"string\" && !(input instanceof URL)\n      ? (input as Request).method\n      : undefined) ??\n    \"GET\";\n  return m.toUpperCase();\n}\n\nasync function refreshDemoFlag(): Promise<void> {\n  const f = originalFetch ?? fetch;\n  try {\n    const res = await f(STATUS_PATH, { credentials: \"same-origin\" });\n    if (!res.ok) return;\n    const json = (await res.json()) as {\n      enabled?: boolean;\n      forced?: boolean;\n    } | null;\n    demoEnabled = json?.enabled === true || json?.forced === true;\n  } catch {\n    // Status endpoint unreachable — leave the last known value.\n  } finally {\n    firstStatusDone = true;\n  }\n}\n\n/** Refresh demo mode after the shared DB-sync stream reports a real change. */\nexport function refreshDemoModeFetchInterceptor(): Promise<void> {\n  if (!installed) return Promise.resolve();\n  if (!refreshPromise) {\n    refreshPromise = refreshDemoFlag().finally(() => {\n      refreshPromise = null;\n    });\n  }\n  return refreshPromise;\n}\n\n/**\n * Install the demo-mode fetch interceptor and read demo status once. Later\n * changes are driven by the shared DB-sync transport instead of a separate\n * fixed polling loop.\n * Idempotent and browser-only — safe to call from any hook that runs in\n * every template root (we call it from `useDbSync`). A no-op until demo\n * mode is actually on.\n */\nexport function ensureDemoModeFetchInterceptor(): void {\n  if (typeof window === \"undefined\") return;\n  if (installed) return;\n  installed = true;\n\n  originalFetch = window.fetch.bind(window);\n  const base = originalFetch;\n\n  window.fetch = async function patchedFetch(\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> {\n    const res = await base(input, init);\n\n    // Fast path: anything that isn't a demo-enabled, plain GET returns the\n    // ORIGINAL response with zero body work and zero extra awaits — when\n    // demo mode is off this wrapper is byte-for-byte native fetch, so it\n    // cannot influence agent/run/stream transport.\n    if (!demoEnabled || !firstStatusDone) return res;\n    if (methodOf(input, init) !== \"GET\") return res;\n    if (!res.ok) return res;\n\n    try {\n      const url = urlOf(input);\n      if (SKIP_SUBSTRINGS.some((s) => url.includes(s))) return res;\n\n      // Only buffered, finite JSON. SSE / streaming / chunked-forever bodies\n      // never reach `redactDemoData`: streaming content-types are excluded,\n      // and the JSON read is hard-timeout-bounded so a misclassified stream\n      // degrades to \"return the original response\" instead of hanging the\n      // request (which is what tripped the reconnect/recovery loop).\n      const contentType = res.headers.get(\"content-type\") ?? \"\";\n      if (!contentType.includes(\"application/json\")) return res;\n      if (\n        contentType.includes(\"event-stream\") ||\n        contentType.includes(\"ndjson\") ||\n        contentType.includes(\"stream\")\n      ) {\n        return res;\n      }\n      if (res.bodyUsed) return res;\n\n      const data = await withTimeout(res.clone().json(), 3_000);\n      const redacted = redactDemoData(data);\n\n      const headers = new Headers(res.headers);\n      // Body is re-serialized — these would be wrong now.\n      headers.delete(\"content-length\");\n      headers.delete(\"content-encoding\");\n\n      return new Response(JSON.stringify(redacted), {\n        status: res.status,\n        statusText: res.statusText,\n        headers,\n      });\n    } catch {\n      // Never let redaction break a request — fall back to the real\n      // response (its body stream is untouched; we only ever read a clone).\n      return res;\n    }\n  };\n\n  void refreshDemoModeFetchInterceptor();\n}\n"]}
+{"version":3,"file":"fetch-interceptor.js","sourceRoot":"","sources":["../../src/demo/fetch-interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,GAAG,eAAe,CAAC,4BAA4B,CAAC,CAAC;AAClE,MAAM,eAAe,GAAG;IACtB,4BAA4B;IAC5B,qBAAqB;IACrB,uBAAuB;IACvB,iEAAiE;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,sCAAsC;IACtC,sBAAsB;IACtB,wEAAwE;IACxE,oEAAoE;IACpE,yDAAyD;IACzD,qBAAqB;CACtB,CAAC;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,kDAAkD;AAClD,yEAAyE;AACzE,qEAAqE;AACrE,6EAA6E;AAC7E,qEAAqE;AACrE,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,mDAAmD;AACnD,MAAM,qBAAqB,GACzB,wFAAwF,CAAC;AAC3F,MAAM,0BAA0B,GAC9B,qDAAqD,CAAC;AAExD,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5D,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,aAAa,GAAwB,IAAI,CAAC;AAC9C,IAAI,cAAc,GAAyB,IAAI,CAAC;AAEhD,8EAA8E;AAC9E,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,0EAA0E;AAC1E,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAC1D;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB;IACrC,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QAC5C,OAAQ,KAAiB,CAAC,GAAG,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB,EAAE,IAAkB;IAC5D,MAAM,CAAC,GACL,IAAI,EAAE,MAAM;QACZ,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC;YACnD,CAAC,CAAE,KAAiB,CAAC,MAAM;YAC3B,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,CAAC;IACR,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,CAAC,GAAG,aAAa,IAAI,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAGtB,CAAC;QACT,WAAW,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;YAAS,CAAC;QACT,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,eAAe,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9C,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B;IAC5C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO;IAC1C,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC;IAE3B,MAAM,CAAC,KAAK,GAAG,KAAK,UAAU,YAAY,CACxC,KAAwB,EACxB,IAAkB;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAEpC,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;YAAE,OAAO,GAAG,CAAC;QACjD,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,+BAA+B,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAErD,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC1D,IACE,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACpC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC9B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC9B,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE;gBACpC,aAAa,EAAE,KAAK;gBACpB,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,oDAAoD;YACpD,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAEnC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,sEAAsE;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,+BAA+B,EAAE,CAAC;AACzC,CAAC","sourcesContent":["import { agentNativePath } from \"../client/api-path.js\";\n/**\n * Client-side demo-mode redaction.\n *\n * Why client-side and not (only) at the server action boundary: templates\n * serve a lot of their UI data through their OWN custom Nitro `/api/*`\n * handlers (e.g. mail's `/api/emails`, `/api/threads/:id/messages`,\n * `/api/contacts`, `/api/apollo/person`), which never pass through the\n * framework action runtime. On this stack (Nitro v3 / h3 v2) there is no\n * single server hook that can safely rewrite every JSON body (the `response`\n * hook hands you an immutable Web `Response` and returns `void`). Patching the\n * browser's `fetch` is the one place that is BOTH universal (every template's\n * reads — actions and custom routes alike — go through it) AND low-risk: it\n * can only ever post-process JSON the app already parses for display, so it\n * physically cannot break auth, SSE streams, SSR HTML, or binary downloads.\n *\n * The agent is handled separately and in-process (its action tool results are\n * redacted in `production-agent.ts`), so it doesn't depend on this at all.\n *\n * Scope intentionally narrow:\n *   - Only same-document `GET` requests are redacted. Mutation responses\n *     (POST/PUT/PATCH/DELETE) pass through untouched so a draft you just\n *     typed isn't echoed back as fake data mid-demo.\n *   - Only `application/json` 2xx bodies. Streams (`text/event-stream`),\n *     HTML, and binary are skipped by content-type.\n *   - Framework infra endpoints (poll, events, the demo-status endpoint\n *     itself) are skipped — no PII and avoids self-recursion.\n *   - Any error during interception falls back to the original response.\n */\nimport { redactDemoData } from \"./redact.js\";\n\nconst STATUS_PATH = agentNativePath(\"/_agent-native/demo/status\");\nconst SKIP_SUBSTRINGS = [\n  \"/_agent-native/demo/status\",\n  \"/_agent-native/poll\",\n  \"/_agent-native/events\",\n  // Never touch agent transport. The agent already gets in-process\n  // redaction of its tool results; faking its own transcript adds no demo\n  // value and must stay clear of the tool_use/tool_result protocol. Covers\n  // \"/_agent-native/agent\" (stream) and \"/_agent-native/agent-chat\"\n  // (thread history) and any sub-paths.\n  \"/_agent-native/agent\",\n  // Run-manager state read by the reconnect/recovery loop. Faking numeric\n  // run state here would make recovery think it's not progressing and\n  // exhaust its retries (\"agent connection kept failing\").\n  \"/_agent-native/runs\",\n];\n\n// Raw rrweb payloads are playback data, not ordinary app UI records. Skipping\n// these is not just a perf optimization that avoids walking/cloning huge\n// DOM/event trees on the main thread: demo number\n// redaction previously ran over this exact raw replay JSON and faked any\n// integer >= 1000 it found — Meta/ViewportResize widths, pointer x/y\n// coordinates, and numeric values inside `_cssText` and SVG attributes. That\n// was the root cause of the 2026-07 \"ultra-wide replay\" bugs (stages\n// rendered thousands of pixels wide, frozen/teleporting cursors, giant\n// icons) even though every stored recording was always geometrically sane —\n// the corruption happened at *view* time, not at capture/storage time. Small\n// list/summary/manifest responses stay eligible so rendered visitor identities\n// are still anonymized. NEVER remove the raw payload skips or broaden them to\n// metadata endpoints that the UI renders directly.\nconst RAW_REPLAY_PAYLOAD_RE =\n  /\\/api\\/session-replay\\/recordings\\/[^/?#]+\\/(?:chunks(?:\\/[^/?#]+)?|events)(?:[/?#]|$)/;\nconst RAW_AGENT_REPLAY_EVENTS_RE =\n  /\\/api\\/session-replay\\/agent-events\\.json(?:[?#]|$)/;\n\nexport function shouldSkipDemoResponseRedaction(url: string): boolean {\n  return (\n    SKIP_SUBSTRINGS.some((substring) => url.includes(substring)) ||\n    RAW_REPLAY_PAYLOAD_RE.test(url) ||\n    RAW_AGENT_REPLAY_EVENTS_RE.test(url)\n  );\n}\n\nlet installed = false;\nlet demoEnabled = false;\nlet originalFetch: typeof fetch | null = null;\nlet refreshPromise: Promise<void> | null = null;\n\n// Set once the first demo-status check completes. We DO NOT block requests on\n// it — if status isn't known yet a response is simply passed through\n// un-redacted (a brief first-paint window) rather than delaying transport.\n// Injecting latency into early GETs previously risked the agent's streaming\n// reconnect logic; transport safety wins over redacting the first paint.\nlet firstStatusDone = false;\n\n/** Reject after `ms` so a misclassified streaming body can never hang. */\nfunction withTimeout<T>(p: Promise<T>, ms: number): Promise<T> {\n  return Promise.race([\n    p,\n    new Promise<T>((_, reject) =>\n      setTimeout(() => reject(new Error(\"redact-timeout\")), ms),\n    ),\n  ]);\n}\n\nfunction urlOf(input: RequestInfo | URL): string {\n  try {\n    if (typeof input === \"string\") return input;\n    if (input instanceof URL) return input.href;\n    return (input as Request).url ?? \"\";\n  } catch {\n    return \"\";\n  }\n}\n\nfunction methodOf(input: RequestInfo | URL, init?: RequestInit): string {\n  const m =\n    init?.method ??\n    (typeof input !== \"string\" && !(input instanceof URL)\n      ? (input as Request).method\n      : undefined) ??\n    \"GET\";\n  return m.toUpperCase();\n}\n\nasync function refreshDemoFlag(): Promise<void> {\n  const f = originalFetch ?? fetch;\n  try {\n    const res = await f(STATUS_PATH, { credentials: \"same-origin\" });\n    if (!res.ok) return;\n    const json = (await res.json()) as {\n      enabled?: boolean;\n      forced?: boolean;\n    } | null;\n    demoEnabled = json?.enabled === true || json?.forced === true;\n  } catch {\n    // Status endpoint unreachable — leave the last known value.\n  } finally {\n    firstStatusDone = true;\n  }\n}\n\n/** Refresh demo mode after the shared DB-sync stream reports a real change. */\nexport function refreshDemoModeFetchInterceptor(): Promise<void> {\n  if (!installed) return Promise.resolve();\n  if (!refreshPromise) {\n    refreshPromise = refreshDemoFlag().finally(() => {\n      refreshPromise = null;\n    });\n  }\n  return refreshPromise;\n}\n\n/**\n * Install the demo-mode fetch interceptor and read demo status once. Later\n * changes are driven by the shared DB-sync transport instead of a separate\n * fixed polling loop.\n * Idempotent and browser-only — safe to call from any hook that runs in\n * every template root (we call it from `useDbSync`). A no-op until demo\n * mode is actually on.\n */\nexport function ensureDemoModeFetchInterceptor(): void {\n  if (typeof window === \"undefined\") return;\n  if (installed) return;\n  installed = true;\n\n  originalFetch = window.fetch.bind(window);\n  const base = originalFetch;\n\n  window.fetch = async function patchedFetch(\n    input: RequestInfo | URL,\n    init?: RequestInit,\n  ): Promise<Response> {\n    const res = await base(input, init);\n\n    // Fast path: anything that isn't a demo-enabled, plain GET returns the\n    // ORIGINAL response with zero body work and zero extra awaits — when\n    // demo mode is off this wrapper is byte-for-byte native fetch, so it\n    // cannot influence agent/run/stream transport.\n    if (!demoEnabled || !firstStatusDone) return res;\n    if (methodOf(input, init) !== \"GET\") return res;\n    if (!res.ok) return res;\n\n    try {\n      const url = urlOf(input);\n      if (shouldSkipDemoResponseRedaction(url)) return res;\n\n      // Only buffered, finite JSON. SSE / streaming / chunked-forever bodies\n      // never reach `redactDemoData`: streaming content-types are excluded,\n      // and the JSON read is hard-timeout-bounded so a misclassified stream\n      // degrades to \"return the original response\" instead of hanging the\n      // request (which is what tripped the reconnect/recovery loop).\n      const contentType = res.headers.get(\"content-type\") ?? \"\";\n      if (!contentType.includes(\"application/json\")) return res;\n      if (\n        contentType.includes(\"event-stream\") ||\n        contentType.includes(\"ndjson\") ||\n        contentType.includes(\"stream\")\n      ) {\n        return res;\n      }\n      if (res.bodyUsed) return res;\n\n      const data = await withTimeout(res.clone().json(), 3_000);\n      // Frontend reads only need identity privacy. Dashboard charts apply\n      // their purpose-built demo trend transform at render time, so mutating\n      // every numeric field in every JSON response is unnecessary work.\n      const redacted = redactDemoData(data, {\n        redactNumbers: false,\n        redactProtectedEmails: true,\n      });\n\n      const headers = new Headers(res.headers);\n      // Body is re-serialized — these would be wrong now.\n      headers.delete(\"content-length\");\n      headers.delete(\"content-encoding\");\n\n      return new Response(JSON.stringify(redacted), {\n        status: res.status,\n        statusText: res.statusText,\n        headers,\n      });\n    } catch {\n      // Never let redaction break a request — fall back to the real\n      // response (its body stream is untouched; we only ever read a clone).\n      return res;\n    }\n  };\n\n  void refreshDemoModeFetchInterceptor();\n}\n"]}

package/dist/demo/redact.d.ts

@@ -1,19 +1,26 @@
 /**
  * Pure, dependency-free, deterministic demo-mode redactor.
  *
- * Replaces sensitive values (emails and free numbers) with stable fake
- * substitutes so a demo looks coherent — the same input always maps to the
- * same fake. Crucially, it NEVER rewrites identifiers, structural tokens, or
- * timestamps. Names and other free text are deliberately left alone because
- * guessing whether arbitrary text is a person's name is too inaccurate. The
- * string redactor uses a protect-first strategy (mask IDs with opaque
- * placeholders before any transform runs, restore them byte-identical
+ * Replaces every email with one canonical anonymous address and free numbers
+ * with stable fake substitutes. Crucially, it NEVER rewrites identifiers,
+ * structural tokens, or timestamps. Names and other free text are deliberately
+ * left alone because guessing whether arbitrary text is a person's name is too
+ * inaccurate. The string redactor uses a protect-first strategy (mask IDs with
+ * opaque placeholders before any transform runs, restore them byte-identical
  * afterwards), and the structure-aware walker additionally protects leaf
  * values by key name.
  */
 export interface RedactOptions {
     salt?: string;
+    /** Redact numeric values. Defaults to true for backward compatibility. */
+    redactNumbers?: boolean;
+    /**
+     * Redact emails stored in otherwise protected structural fields such as
+     * `userId` and `userKey`. Intended for display-only frontend responses.
+     */
+    redactProtectedEmails?: boolean;
 }
+export declare const DEMO_ANONYMOUS_EMAIL = "anonymous@builder.io";
 export declare function redactDemoString(text: string, opts?: RedactOptions): string;
 export declare function redactDemoData<T>(value: T, opts?: RedactOptions): T;
 /**

package/dist/demo/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/demo/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAghBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAE3E;AAsGD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,CAAC,CAGnE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/demo/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAwID,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAwQ3D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAM3E;AA8HD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,CAAC,CAUnE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/dist/demo/redact.js

@@ -1,13 +1,12 @@
 /**
  * Pure, dependency-free, deterministic demo-mode redactor.
  *
- * Replaces sensitive values (emails and free numbers) with stable fake
- * substitutes so a demo looks coherent — the same input always maps to the
- * same fake. Crucially, it NEVER rewrites identifiers, structural tokens, or
- * timestamps. Names and other free text are deliberately left alone because
- * guessing whether arbitrary text is a person's name is too inaccurate. The
- * string redactor uses a protect-first strategy (mask IDs with opaque
- * placeholders before any transform runs, restore them byte-identical
+ * Replaces every email with one canonical anonymous address and free numbers
+ * with stable fake substitutes. Crucially, it NEVER rewrites identifiers,
+ * structural tokens, or timestamps. Names and other free text are deliberately
+ * left alone because guessing whether arbitrary text is a person's name is too
+ * inaccurate. The string redactor uses a protect-first strategy (mask IDs with
+ * opaque placeholders before any transform runs, restore them byte-identical
  * afterwards), and the structure-aware walker additionally protects leaf
  * values by key name.
  */
@@ -42,9 +41,6 @@ function seededRng(value, salt) {
     const seedFn = xmur3(`${value}${salt}`);
     return mulberry32(seedFn());
 }
-function pick(rng, pool) {
-    return pool[Math.floor(rng() * pool.length) % pool.length];
-}
 /* ------------------------------------------------------------------ *
  * Stable mapping cache (bounded, TTL, leak-free)
  *
@@ -135,145 +131,12 @@ idempotent = true) {
         rememberProduced(value);
     return value;
 }
-/* ------------------------------------------------------------------ *
- * Curated name pools
- * ------------------------------------------------------------------ */
-const FIRST_NAMES = [
-    "Jane",
-    "John",
-    "Alex",
-    "Maria",
-    "Sam",
-    "Olivia",
-    "Liam",
-    "Emma",
-    "Noah",
-    "Ava",
-    "Lucas",
-    "Mia",
-    "Ethan",
-    "Sofia",
-    "Mason",
-    "Isla",
-    "Leo",
-    "Aria",
-    "Henry",
-    "Zoe",
-    "Owen",
-    "Nora",
-    "Caleb",
-    "Lily",
-    "Ryan",
-    "Ruby",
-    "Adam",
-    "Chloe",
-    "Eli",
-    "Hazel",
-    "Max",
-    "Iris",
-    "Ben",
-    "Clara",
-    "Theo",
-    "Maya",
-    "Felix",
-    "Elena",
-    "Jonah",
-    "Greta",
-];
-const LAST_NAMES = [
-    "Doe",
-    "Smith",
-    "Johnson",
-    "Lee",
-    "Brown",
-    "Garcia",
-    "Miller",
-    "Davis",
-    "Wilson",
-    "Moore",
-    "Taylor",
-    "Anderson",
-    "Thomas",
-    "Jackson",
-    "White",
-    "Harris",
-    "Martin",
-    "Clark",
-    "Lewis",
-    "Walker",
-    "Hall",
-    "Young",
-    "King",
-    "Wright",
-    "Hill",
-    "Green",
-    "Adams",
-    "Baker",
-    "Nelson",
-    "Carter",
-    "Mitchell",
-    "Perez",
-    "Roberts",
-    "Turner",
-    "Phillips",
-    "Campbell",
-    "Parker",
-    "Evans",
-    "Edwards",
-    "Collins",
-];
 /* ------------------------------------------------------------------ *
  * Fake value generators (deterministic in value + salt)
  * ------------------------------------------------------------------ */
-// Realistic-looking but safe stand-in domains: real consumer providers (the
-// local part is fake, so no real mailbox is implied) plus the canonical
-// reserved fictional-company domains (Contoso/Fabrikam/Northwind), which read
-// as real businesses but are intentional placeholders. No example.com.
-const FAKE_EMAIL_DOMAINS = [
-    "gmail.com",
-    "outlook.com",
-    "icloud.com",
-    "yahoo.com",
-    "proton.me",
-    "hey.com",
-    "fastmail.com",
-    "contoso.com",
-    "fabrikam.com",
-    "northwind.com",
-    "acme.io",
-    "globex.net",
-];
+export const DEMO_ANONYMOUS_EMAIL = "anonymous@builder.io";
 function fakeEmail(original, salt) {
-    return memoFake("email", original.toLowerCase(), salt, () => {
-        const rng = seededRng(`email:${original.toLowerCase()}`, salt);
-        const first = pick(rng, FIRST_NAMES).toLowerCase();
-        const last = pick(rng, LAST_NAMES).toLowerCase();
-        const domain = pick(rng, FAKE_EMAIL_DOMAINS);
-        // Vary the local part so addresses don't all look templated.
-        const shape = Math.floor(rng() * 6);
-        let local;
-        switch (shape) {
-            case 0:
-                local = `${first}.${last}`;
-                break;
-            case 1:
-                local = `${first}${last}`;
-                break;
-            case 2:
-                local = `${first[0]}${last}`;
-                break;
-            case 3:
-                local = `${first}.${last}${1 + Math.floor(rng() * 89)}`;
-                break;
-            case 4:
-                local = `${first}_${last}`;
-                break;
-            default:
-                local = `${last}.${first}`;
-                break;
-        }
-        return `${local}@${domain}`;
-    });
+    return memoFake("email", original.toLowerCase(), salt, () => DEMO_ANONYMOUS_EMAIL);
 }
 /**
  * Replace every digit in `numericBody` with a freshly-generated digit while
@@ -463,17 +326,21 @@ function transformNumbers(text, salt) {
 /* ------------------------------------------------------------------ *
  * Public: string redactor
  * ------------------------------------------------------------------ */
-function redactDemoStringInternal(text, salt) {
+function redactDemoStringInternal(text, salt, redactNumbers) {
     if (typeof text !== "string" || text.length === 0)
         return text;
+    if (!text.includes("@") && (!redactNumbers || !/[\d$€£¥]/.test(text))) {
+        return text;
+    }
     const { text: masked, restore } = protect(text);
     let out = masked;
     out = transformEmails(out, salt);
-    out = transformNumbers(out, salt);
+    if (redactNumbers)
+        out = transformNumbers(out, salt);
     return unprotect(out, restore);
 }
 export function redactDemoString(text, opts) {
-    return redactDemoStringInternal(text, opts?.salt ?? "");
+    return redactDemoStringInternal(text, opts?.salt ?? "", opts?.redactNumbers !== false);
 }
 /* ------------------------------------------------------------------ *
  * Public: structure-aware redactor
@@ -510,17 +377,17 @@ function redactNumberLeaf(value, salt) {
         return value;
     return n;
 }
-function walk(value, salt, depth, seen) {
+function walk(value, salt, depth, seen, redactNumbers, redactProtectedEmails) {
     if (depth > MAX_DEPTH)
         return value;
     if (value === null || value === undefined)
         return value;
     const t = typeof value;
     if (t === "string") {
-        return redactDemoStringInternal(value, salt);
+        return redactDemoStringInternal(value, salt, redactNumbers);
     }
     if (t === "number") {
-        return redactNumberLeaf(value, salt);
+        return redactNumbers ? redactNumberLeaf(value, salt) : value;
     }
     if (t === "boolean" || t === "bigint" || t === "function" || t === "symbol") {
         return value;
@@ -531,7 +398,7 @@ function walk(value, salt, depth, seen) {
         if (seen.has(value))
             return value;
         seen.add(value);
-        const out = value.map((item) => walk(item, salt, depth + 1, seen));
+        const out = value.map((item) => walk(item, salt, depth + 1, seen, redactNumbers, redactProtectedEmails));
         seen.delete(value);
         return out;
     }
@@ -548,7 +415,12 @@ function walk(value, salt, depth, seen) {
                     !(entry instanceof Date)) {
                     // Still recurse into nested structures, but the protected key does
                     // not transform its own leaf value.
-                    out[key] = walk(entry, salt, depth + 1, seen);
+                    out[key] = walk(entry, salt, depth + 1, seen, redactNumbers, redactProtectedEmails);
+                }
+                else if (redactProtectedEmails &&
+                    typeof entry === "string" &&
+                    entry.includes("@")) {
+                    out[key] = redactDemoStringInternal(entry, salt, false);
                 }
                 else {
                     // Leaf under a protected key: pass through completely untouched.
@@ -556,7 +428,7 @@ function walk(value, salt, depth, seen) {
                 }
                 continue;
             }
-            out[key] = walk(entry, salt, depth + 1, seen);
+            out[key] = walk(entry, salt, depth + 1, seen, redactNumbers, redactProtectedEmails);
         }
         seen.delete(value);
         return out;
@@ -566,7 +438,7 @@ function walk(value, salt, depth, seen) {
 }
 export function redactDemoData(value, opts) {
     const salt = opts?.salt ?? "";
-    return walk(value, salt, 0, new WeakSet());
+    return walk(value, salt, 0, new WeakSet(), opts?.redactNumbers !== false, opts?.redactProtectedEmails === true);
 }
 /**
  * Clear the stable-mapping caches. Test-only — the caches are process-global