+ EverOS Demo Relay
+ This service powers the public everos demo experience.
+ Service health
+
+
+
diff --git a/deploy/netlify_relay/tests/relay.test.mjs b/deploy/netlify_relay/tests/relay.test.mjs
new file mode 100644
index 00000000..5f103a34
--- /dev/null
+++ b/deploy/netlify_relay/tests/relay.test.mjs
@@ -0,0 +1,197 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import relay, { isAllowed } from "../netlify/functions/relay.mjs";
+
+const ORIGINAL_FETCH = globalThis.fetch;
+const ENV_NAMES = [
+ "EVEROS_CLOUD_API_KEY",
+ "EVEROS_CLOUD_UPSTREAM",
+ "UPSTASH_REDIS_REST_URL",
+ "UPSTASH_REDIS_REST_TOKEN",
+ "RELAY_RATE_PER_MIN",
+ "RELAY_DAILY_ROUNDS",
+ "RELAY_UPSTREAM_TIMEOUT_MS",
+ "RELAY_MAX_BODY_BYTES",
+];
+const ORIGINAL_ENV = Object.fromEntries(
+ ENV_NAMES.map((name) => [name, process.env[name]]),
+);
+
+function configureEnvironment() {
+ process.env.EVEROS_CLOUD_API_KEY = "server-secret";
+ process.env.EVEROS_CLOUD_UPSTREAM = "https://api.test";
+ process.env.UPSTASH_REDIS_REST_URL = "https://redis.test";
+ process.env.UPSTASH_REDIS_REST_TOKEN = "redis-secret";
+ process.env.RELAY_RATE_PER_MIN = "30";
+ process.env.RELAY_DAILY_ROUNDS = "3";
+}
+
+function restoreEnvironment() {
+ globalThis.fetch = ORIGINAL_FETCH;
+ for (const name of ENV_NAMES) {
+ if (ORIGINAL_ENV[name] === undefined) {
+ delete process.env[name];
+ } else {
+ process.env[name] = ORIGINAL_ENV[name];
+ }
+ }
+}
+
+function quotaResponse(minuteCount = 1, dailyCount = 1) {
+ return new Response(
+ JSON.stringify([
+ { result: minuteCount },
+ { result: 1 },
+ { result: dailyCount },
+ { result: 1 },
+ ]),
+ { status: 200, headers: { "content-type": "application/json" } },
+ );
+}
+
+test.afterEach(restoreEnvironment);
+
+test("allows only the demo API surface", () => {
+ assert.equal(isAllowed("POST", "/api/v2/memory/add"), true);
+ assert.equal(isAllowed("POST", "/api/v2/memory/flush"), true);
+ assert.equal(isAllowed("POST", "/api/v2/memory/search"), true);
+ assert.equal(isAllowed("GET", "/api/v1/tasks/task-123"), false);
+ assert.equal(isAllowed("DELETE", "/api/v2/memory/add"), false);
+ assert.equal(isAllowed("GET", "/api/v2/memory/get"), false);
+});
+
+test("reports deployment readiness without exposing secrets", async () => {
+ configureEnvironment();
+ const response = await relay(
+ new Request("https://demo.test/healthz"),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 200);
+ assert.deepEqual(await response.json(), {
+ ok: true,
+ upstream: "https://api.test",
+ key_configured: true,
+ quota_configured: true,
+ });
+});
+
+test("rejects non-demo endpoints", async () => {
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/get"),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 403);
+});
+
+test("injects the server key and never forwards client authorization", async () => {
+ configureEnvironment();
+ const calls = [];
+ globalThis.fetch = async (url, options) => {
+ calls.push({ url: String(url), options });
+ if (String(url).startsWith("https://redis.test")) {
+ return quotaResponse();
+ }
+ return new Response(JSON.stringify({ data: { status: "queued" } }), {
+ status: 202,
+ headers: { "content-type": "application/json" },
+ });
+ };
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/add", {
+ method: "POST",
+ headers: {
+ authorization: "Bearer client-secret",
+ "content-type": "application/json",
+ },
+ body: JSON.stringify({ messages: [] }),
+ }),
+ { ip: "192.0.2.1" },
+ );
+
+ assert.equal(response.status, 202);
+ assert.equal(calls.length, 2);
+ assert.equal(calls[1].url, "https://api.test/api/v2/memory/add");
+ assert.equal(calls[1].options.headers.authorization, "Bearer server-secret");
+ assert.notEqual(
+ calls[1].options.headers.authorization,
+ "Bearer client-secret",
+ );
+});
+
+test("enforces the distributed per-minute quota", async () => {
+ configureEnvironment();
+ globalThis.fetch = async () => quotaResponse(31, 31);
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/add", { method: "POST" }),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 429);
+ assert.match((await response.json()).error, /rate limit/);
+});
+
+test("enforces three demo rounds per day", async () => {
+ configureEnvironment();
+ globalThis.fetch = async () => quotaResponse(1, 4);
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/add", { method: "POST" }),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 429);
+ assert.match((await response.json()).error, /daily demo round limit/);
+});
+
+test("flush does not spend another demo round", async () => {
+ configureEnvironment();
+ const calls = [];
+ globalThis.fetch = async (url, options) => {
+ calls.push({ url: String(url), options });
+ if (String(url).startsWith("https://redis.test")) {
+ const commands = JSON.parse(options.body);
+ assert.equal(commands.length, 2);
+ return new Response(JSON.stringify([{ result: 1 }, { result: 1 }]), {
+ status: 200,
+ headers: { "content-type": "application/json" },
+ });
+ }
+ return new Response(JSON.stringify({ data: { status: "success" } }));
+ };
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/flush", { method: "POST" }),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 200);
+ assert.equal(calls.length, 2);
+});
+
+test("fails closed when the server API key is missing", async () => {
+ configureEnvironment();
+ delete process.env.EVEROS_CLOUD_API_KEY;
+ globalThis.fetch = async () => {
+ throw new Error("fetch must not be called without a server key");
+ };
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/flush", { method: "POST" }),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 500);
+ assert.match((await response.json()).error, /API key/);
+});
+
+test("fails closed when the quota store is unavailable", async () => {
+ configureEnvironment();
+ globalThis.fetch = async () => {
+ throw new Error("offline");
+ };
+
+ const response = await relay(
+ new Request("https://demo.test/api/v2/memory/flush", { method: "POST" }),
+ { ip: "192.0.2.1" },
+ );
+ assert.equal(response.status, 503);
+});
diff --git a/docs/everos-demo.md b/docs/everos-demo.md
index ab55ebbc..101510ad 100644
--- a/docs/everos-demo.md
+++ b/docs/everos-demo.md
@@ -1,8 +1,8 @@
# EverOS Demo
-`everos demo` is a local educational TUI. It helps new users feel the memory
-lifecycle before they configure API keys, start the server, or write real
-memory through the API.
+`everos demo` is an interactive TUI that lets new users feel the memory
+lifecycle — type a memory, ask for it back, watch EverOS recall it — before they
+configure their own API keys.
## Run It
@@ -10,48 +10,51 @@ memory through the API.
everos demo
```
-The command asks for one memory and one recall question, then opens a
-full-screen terminal UI. The visual flow is deterministic and local to the CLI:
-conversation -> memory sphere -> recall -> source proof -> confetti.
+This opens a full-screen terminal UI with an input box. Type something EverOS
+should remember, then ask a question that recalls it. No API key or server setup
+is needed for the default demo.
-For non-interactive shells or a copyable preview, use:
+Each round runs the memory lifecycle and visualizes its four stages:
-```bash
-everos demo --plain
-```
+1. **Ingest** receives what you want EverOS to remember.
+2. **Extract** identifies the useful memory inside the conversation.
+3. **Index** prepares that memory for retrieval.
+4. **Recall** finds it again when you ask a related question.
-For the looping showroom view used by README media, use:
+The same particle sphere flows continuously across all four stages. At the end,
+the particles burst across the memory field and fade away. A small core of
+yellow and white particles keeps moving at the center, then expands smoothly as
+the next ingest cycle begins.
-```bash
-everos demo --cinematic
-```
+If the demo service is temporarily unavailable or the trial limit is reached,
+the UI explains what happened and points you toward running with your own key.
+It never fabricates a memory result.
-## Run It Against A Server
+## Run It With Your Own Cloud Key
-After `everos init` and `everos server start`, run:
+Get a key from 
-