From 87d7da019827abf06f3bcc04dc45af3bea4fd0f9 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Wed, 15 Apr 2026 18:09:01 +0200
Subject: [PATCH 1/2] fix(pitch-deck): point SDK demo URL mockup at
 admin-dev.breakpilot.ai

The SDK live-demo slide renders a fake browser URL bar to frame each
screenshot. It used admin.breakpilot.ai, but the actual demo instance
investors should be able to reach lives on admin-dev.breakpilot.ai.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 pitch-deck/components/slides/SDKDemoSlide.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pitch-deck/components/slides/SDKDemoSlide.tsx b/pitch-deck/components/slides/SDKDemoSlide.tsx
index 7802f36..b12b9e2 100644
--- a/pitch-deck/components/slides/SDKDemoSlide.tsx
+++ b/pitch-deck/components/slides/SDKDemoSlide.tsx
@@ -90,7 +90,7 @@ export default function SDKDemoSlide({ lang }: SDKDemoSlideProps) {
                 </div>
                 <div className="flex-1 ml-3">
                   <div className="bg-white/[0.06] rounded-md px-3 py-1 text-xs text-white/30 font-mono max-w-md">
-                    admin.breakpilot.ai/sdk/{shot.file.replace(/^\d+-/, '').replace('.png', '')}
+                    admin-dev.breakpilot.ai/sdk/{shot.file.replace(/^\d+-/, '').replace('.png', '')}
                   </div>
                 </div>
                 <button

From 44659a9dd7c921841adce1743896f3a1fbb112eb Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Wed, 15 Apr 2026 18:20:16 +0200
Subject: [PATCH 2/2] fix(pitch-deck): serve /screenshots/* past the auth
 middleware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SDK Live Demo slide renders screenshots via next/image from
/public/screenshots/*.png. Because /screenshots was not on the
PUBLIC_PATHS list, every request was 307-redirected to /auth, and the
next/image optimizer responded with
  HTTP 400 "The requested resource isn't a valid image."
leaving the slide with empty dark frames (surfaced in the pitch preview).

next/image also bypasses middleware itself (see the matcher), but the
server-side fetch it performs for the source URL does hit middleware
and carries no investor cookie, so whitelisting the path is required
even for authenticated viewers.

These PNGs are public marketing assets — there's no reason to gate them.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 pitch-deck/middleware.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pitch-deck/middleware.ts b/pitch-deck/middleware.ts
index 635afed..14fd7ed 100644
--- a/pitch-deck/middleware.ts
+++ b/pitch-deck/middleware.ts
@@ -12,6 +12,7 @@ const PUBLIC_PATHS = [
   '/manifest.json',
   '/sw.js',
   '/icons',
+  '/screenshots',             // SDK demo screenshots: public marketing assets. Must bypass auth because the next/image optimizer fetches them server-side without investor cookies.
   '/favicon.ico',
 ]