A demo build can claim a real shop instead of running on its own

The first demo sealed the office cameras into the package and ran the
PC standalone - a copy of the product with no head office. The bundle
can now carry an installation code instead: setup redeems it exactly as
the app's Setup screen does, the PC joins the shop, and its cameras
arrive from head office on the first sync. The demo then IS the product
- login, Loya, head office - not a local imitation of it. The code is
single-use, so one bundle is one install. release.sh ships the bundle
with DEMO_PACK=.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

agent/cmd/behavision-setup/main.go

@@ -38,6 +38,7 @@ import (
 	"github.com/loyaly/behavision-agent/pkg/config"
 	"github.com/loyaly/behavision-agent/pkg/demo"
 	"github.com/loyaly/behavision-agent/pkg/engine"
+	"github.com/loyaly/behavision-agent/pkg/enrol"
 	"github.com/loyaly/behavision-agent/pkg/paths"
 )
 
@@ -76,12 +77,19 @@ func run() error {
 	// A demo release ships its cameras sealed. Ask for the code NOW, before
 	// the ten-minute download, so a mistyped one costs seconds; the cameras
 	// are actually added at the end, through the running engine.
-	demoCams, err := unlockDemo(src)
+	bundle, err := unlockDemo(src)
 	if err != nil {
 		return err
 	}
-	if demoCams != nil {
-		step("Demo cameras", fmt.Sprintf("%d unlocked", len(demoCams)))
+	var demoCams []demo.Camera
+	if bundle != nil {
+		demoCams = bundle.Cameras
+		switch {
+		case bundle.EnrolCode != "":
+			step("Demo", "unlocked - this PC will join a shop at head office")
+		default:
+			step("Demo cameras", fmt.Sprintf("%d unlocked", len(demoCams)))
+		}
 	}
 
 	py, ver, err := findPython()
@@ -132,9 +140,21 @@ func run() error {
 		return fmt.Errorf("the engine installed but would not start: %w", err)
 	}
 	step("Engine starts and answers", "verified")
-	if demoCams != nil {
+	if len(demoCams) > 0 {
 		step("Demo cameras", "added to the engine")
-		// No head office in a demo. Without this the app opens on "type an
+	}
+	switch {
+	case bundle != nil && bundle.EnrolCode != "":
+		// The demo that IS the product: this PC claims a real shop, exactly
+		// as a customer install does, and its cameras arrive from head office
+		// on the first sync. The app then opens on Login.
+		siteName, err := claimShop(bundle.EnrolCode, bundle.CloudBase)
+		if err != nil {
+			return fmt.Errorf("could not join the shop at head office: %w", err)
+		}
+		step("Head office", "linked to "+siteName)
+	case bundle != nil:
+		// No head office in this demo. Without this the app opens on "type an
 		// installation code" and sits there; with it, it opens on Live.
 		if err := markStandalone(); err != nil {
 			return err
@@ -446,7 +466,7 @@ func pause() {
 // unlockDemo returns the sealed cameras a demo release ships, or nil when this
 // is not a demo release. Asks for the unlock code on the console; three tries,
 // because a code is read down a phone and typed by hand.
-func unlockDemo(src string) ([]demo.Camera, error) {
+func unlockDemo(src string) (*demo.Payload, error) {
 	sealed, err := os.ReadFile(filepath.Join(src, "demo-cameras.enc"))
 	if err != nil {
 		return nil, nil // not a demo release
@@ -461,12 +481,12 @@ func unlockDemo(src string) ([]demo.Camera, error) {
 		line, _ := in.ReadString('\n')
 		plain, err := demo.Open(line, sealed)
 		if err == nil {
-			var cams []demo.Camera
-			if err := json.Unmarshal(plain, &cams); err != nil {
+			payload, err := demo.Decode(plain)
+			if err != nil {
 				return nil, fmt.Errorf("the bundle unlocked but did not parse: %w", err)
 			}
 			fmt.Println()
-			return cams, nil
+			return &payload, nil
 		}
 		fmt.Printf("  %v\n", err)
 	}
@@ -474,6 +494,46 @@ func unlockDemo(src string) ([]demo.Camera, error) {
 		"with whoever gave you this release and run setup again")
 }
 
+// claimShop redeems the installation code sealed in the bundle: the same call
+// the app's Setup screen and `behavision-agent claim` make, so the PC ends up
+// in exactly the state a customer's would - broker login, API token, the
+// broker's CA on disk - and head office pushes its cameras down on the first
+// sync.
+func claimShop(code, base string) (string, error) {
+	if base == "" {
+		base = "https://mcp.loyaly.ai"
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	b, err := enrol.Claim(ctx, base, code)
+	if err != nil {
+		return "", err
+	}
+	path := paths.AgentConfig()
+	cfg, err := config.Load(path)
+	if err != nil {
+		return "", err
+	}
+	cfg.ClientID = b.ClientSlug
+	cfg.SiteID = b.SiteSlug
+	cfg.SiteName = b.SiteName
+	cfg.BrokerURL = b.MQTTURL
+	cfg.BrokerUsername = b.MQTTUser
+	cfg.BrokerPassword = b.MQTTPass
+	cfg.AgentToken = b.AgentToken
+	cfg.CloudBase = base
+	cfg.Standalone = false
+	caPath, err := enrol.SaveCA(b.CACert, paths.BrokerCA())
+	if err != nil {
+		return "", err
+	}
+	cfg.BrokerCAFile = caPath
+	if err := cfg.Save(path); err != nil {
+		return "", err
+	}
+	return b.SiteName, nil
+}
+
 // addCameras posts each demo camera to the running engine, with the credential
 // the engine generated for itself on first start.
 func addCameras(cams []demo.Camera) error {