@evomap/evolver 1.89.4 → 1.89.6

package/src/proxy/trace/usage.js

@@ -1,105 +1 @@
-'use strict';
-
-// Per-run token-usage rollup over the proxy trace log.
-//
-// The local proxy (src/proxy) meters real Anthropic input/output tokens for
-// every Hand /v1/messages call into proxy-traces.jsonl. This reads that log
-// back -- decrypting encrypted rows with the local EvoMap node secret -- and
-// sums the real tokens spent within a time window, giving solidify the
-// MEASURED cost of a derive loop.
-//
-// Best-effort by design: returns measured:false (and never throws) when the
-// proxy was inactive, the node secret is missing, no rows fall in the window,
-// or the in-window rows carried no usage (e.g. streamed-but-unobserved calls).
-// Callers fall back to a grounded estimate in that case.
-
-const fs = require('fs');
-const {
-  resolveTraceFile,
-  resolveEvomapNodeSecret,
-  decryptTraceEnvelope,
-} = require('./extractor');
-
-const EMPTY = Object.freeze({
-  input_tokens: 0,
-  output_tokens: 0,
-  total_tokens: 0,
-  calls: 0,
-  measured: false,
-});
-
-function _rowTimestampMs(row) {
-  const iso = row && (row.timestamp || row.createdAtIso);
-  if (iso) {
-    const ms = Date.parse(iso);
-    if (Number.isFinite(ms)) return ms;
-  }
-  // createdAt is unix seconds in the Prism trace shape.
-  if (row && Number.isFinite(Number(row.createdAt))) return Number(row.createdAt) * 1000;
-  return null;
-}
-
-/**
- * Sum the real token usage the proxy recorded within a run's time window.
- *
- * @param {object} opts
- * @param {string} opts.sinceIso - REQUIRED lower bound (e.g. last_run.created_at).
- *   Without a window we cannot attribute traces to this run, so we report
- *   unmeasured rather than summing unrelated calls.
- * @param {string} [opts.untilIso] - upper bound; defaults to now.
- * @returns {{input_tokens:number,output_tokens:number,total_tokens:number,calls:number,measured:boolean}}
- */
-function sumRunUsage(opts = {}) {
-  const sinceMs = opts && opts.sinceIso != null ? Date.parse(opts.sinceIso) : NaN;
-  if (!Number.isFinite(sinceMs)) return { ...EMPTY };
-  const untilMs = opts && opts.untilIso != null && Number.isFinite(Date.parse(opts.untilIso))
-    ? Date.parse(opts.untilIso)
-    : Date.now();
-
-  let raw;
-  try {
-    const file = resolveTraceFile();
-    if (!fs.existsSync(file)) return { ...EMPTY };
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (_) {
-    return { ...EMPTY };
-  }
-
-  let secret = null;
-  try { secret = resolveEvomapNodeSecret(); } catch (_) { secret = null; }
-
-  let input = 0;
-  let output = 0;
-  let calls = 0;
-  for (const line of raw.split('\n')) {
-    const s = line.trim();
-    if (!s) continue;
-    let row;
-    try { row = JSON.parse(s); } catch (_) { continue; }
-    if (row && row.encrypted) {
-      if (!secret) continue; // cannot decrypt -> treat as unobserved
-      try { row = decryptTraceEnvelope(row, secret); } catch (_) { continue; }
-    }
-    if (!row || typeof row !== 'object') continue;
-    const ms = _rowTimestampMs(row);
-    if (ms == null || ms < sinceMs || ms > untilMs) continue;
-    const i = Number(row.input_tokens);
-    const o = Number(row.output_tokens);
-    const hasI = Number.isFinite(i) && i > 0;
-    const hasO = Number.isFinite(o) && o > 0;
-    if (hasI) input += i;
-    if (hasO) output += o;
-    if (hasI || hasO) calls += 1;
-  }
-
-  if (calls === 0) return { ...EMPTY };
-  return {
-    input_tokens: input,
-    output_tokens: output,
-    total_tokens: input + output,
-    calls,
-    measured: true,
-  };
-}
-
-module.exports = { sumRunUsage };
+const _0x310b33=_0x339b;(function(_0x87107f,_0x164caf){const _0x3b1b5a=_0x339b,_0x331b9f=_0x87107f();while(!![]){try{const _0x17807b=-parseInt(_0x3b1b5a(0x126,'\x46\x25\x4c\x6c'))/(-0xb*-0x37d+-0x4f1*-0x5+0x1*-0x3f13)+parseInt(_0x3b1b5a(0x143,'\x5a\x6a\x29\x32'))/(-0x84e+0x1119*-0x2+0x2*0x1541)+-parseInt(_0x3b1b5a(0x107,'\x61\x38\x4f\x40'))/(-0x2*-0xe0f+0xa4f+0x1335*-0x2)+parseInt(_0x3b1b5a(0x140,'\x4e\x4e\x4a\x76'))/(-0xd8f+0xb72*-0x1+0x1905)*(parseInt(_0x3b1b5a(0x10f,'\x4a\x6b\x75\x6c'))/(-0x20a5+0x1a33+-0x677*-0x1))+parseInt(_0x3b1b5a(0x134,'\x25\x73\x37\x26'))/(-0x925+-0xb3d+0x1468)*(parseInt(_0x3b1b5a(0x10b,'\x62\x59\x28\x4f'))/(0x2*0xdf1+-0x229*-0x1+-0x1e04))+-parseInt(_0x3b1b5a(0x13d,'\x78\x6d\x6f\x29'))/(-0x1*-0x1a6b+-0x103b+0x14*-0x82)*(-parseInt(_0x3b1b5a(0x122,'\x53\x59\x36\x6c'))/(0x3*0x283+0x1e11+-0x1*0x2591))+parseInt(_0x3b1b5a(0x11c,'\x29\x4d\x55\x70'))/(-0x2e*0xa9+0x431+-0x1a37*-0x1)*(parseInt(_0x3b1b5a(0xd9,'\x36\x30\x5d\x24'))/(-0x2*-0xadc+-0x158c+-0x3*0xb));if(_0x17807b===_0x164caf)break;else _0x331b9f['push'](_0x331b9f['shift']());}catch(_0x4c7b91){_0x331b9f['push'](_0x331b9f['shift']());}}}(_0x9577,0x1a55dd+-0xa*0x2452d+0xa8eba));const _0x522fc7=(function(){const _0x5274ed=_0x339b,_0x288aea={'\x65\x4b\x6d\x68\x4a':function(_0xc1efb9){return _0xc1efb9();},'\x77\x4d\x44\x72\x78':'\x75\x74\x66\x38','\x41\x78\x64\x6b\x4b':_0x5274ed(0xec,'\x34\x69\x4b\x56'),'\x68\x66\x5a\x68\x59':function(_0x4e9c16,_0x2a1c29){return _0x4e9c16!==_0x2a1c29;},'\x57\x63\x77\x74\x56':_0x5274ed(0x11e,'\x4c\x46\x50\x73')};let _0x18b9ab=!![];return function(_0x503384,_0x14002f){const _0xfd1a27=_0x5274ed,_0x96192b={'\x63\x44\x4c\x44\x72':function(_0x1cc242){const _0x5023bf=_0x339b;return _0x288aea[_0x5023bf(0xf2,'\x40\x29\x5b\x73')](_0x1cc242);},'\x77\x4c\x74\x50\x79':_0x288aea[_0xfd1a27(0xf8,'\x34\x69\x4b\x56')],'\x6c\x48\x48\x6c\x62':function(_0x46b298,_0x3e945f){return _0x46b298===_0x3e945f;},'\x44\x79\x61\x77\x4a':_0x288aea[_0xfd1a27(0x14a,'\x5a\x6a\x29\x32')]};if(_0x288aea[_0xfd1a27(0x129,'\x6d\x4c\x50\x23')](_0x288aea[_0xfd1a27(0xfc,'\x40\x28\x70\x51')],_0x288aea[_0xfd1a27(0x135,'\x6d\x4c\x50\x23')]))_0x2510b9=null;else{const _0x1c035a=_0x18b9ab?function(){const _0x18b5f6=_0xfd1a27;if(_0x96192b[_0x18b5f6(0x149,'\x72\x30\x23\x64')](_0x18b5f6(0x12b,'\x59\x5e\x24\x4d'),_0x96192b['\x44\x79\x61\x77\x4a'])){const _0x45c900=_0x96192b[_0x18b5f6(0x138,'\x77\x6a\x32\x4b')](_0x39e6da),_0x531e34={..._0xba1a8c};if(!_0xe7d194['\x65\x78\x69\x73\x74\x73\x53\x79'+'\x6e\x63'](_0x45c900))return _0x531e34;_0x3d09c7=_0x2eacde[_0x18b5f6(0x142,'\x39\x26\x77\x51')+_0x18b5f6(0xde,'\x41\x30\x55\x67')](_0x45c900,_0x96192b[_0x18b5f6(0xe9,'\x40\x47\x74\x70')]);}else{if(_0x14002f){const _0x10b2fb=_0x14002f['\x61\x70\x70\x6c\x79'](_0x503384,arguments);return _0x14002f=null,_0x10b2fb;}}}:function(){};return _0x18b9ab=![],_0x1c035a;}};}()),_0x4af8e1=_0x522fc7(this,function(){const _0x29a350=_0x339b,_0x31de28={};_0x31de28[_0x29a350(0xe6,'\x35\x36\x6c\x4b')]=_0x29a350(0xf4,'\x6d\x4c\x50\x23')+_0x29a350(0x14d,'\x72\x30\x23\x64');const _0x4e9bc9=_0x31de28;return _0x4af8e1[_0x29a350(0x156,'\x36\x30\x5d\x24')]()[_0x29a350(0xf5,'\x6d\x4c\x50\x23')](_0x4e9bc9[_0x29a350(0x125,'\x5a\x6a\x29\x32')])[_0x29a350(0xd8,'\x34\x69\x4b\x56')]()[_0x29a350(0xdd,'\x25\x73\x37\x26')+_0x29a350(0xfa,'\x4c\x46\x50\x73')](_0x4af8e1)['\x73\x65\x61\x72\x63\x68'](_0x4e9bc9[_0x29a350(0x12c,'\x46\x25\x4c\x6c')]);});_0x4af8e1();'use strict';function _0x339b(_0x6ffe90,_0x12f5b6){_0x6ffe90=_0x6ffe90-(0x1323+0x1*0x7f2+-0x1a3e);const _0x42d0a6=_0x9577();let _0x2c67b4=_0x42d0a6[_0x6ffe90];if(_0x339b['\x41\x42\x52\x51\x44\x56']===undefined){var _0x46d8dc=function(_0x5ccb11){const _0x131c79='\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d';let _0xa89060='',_0x593a98='',_0x4737fe=_0xa89060+_0x46d8dc,_0x29adb9=(''+function(){return-0x1*-0x336+0x2330+-0x2666*0x1;})['\x69\x6e\x64\x65\x78\x4f\x66']('\x0a')!==-(-0x5*-0x666+0x91d+-0x291a);for(let _0x24abc6=-0x1*0x1697+0x4f9*0x6+0x1*-0x73f,_0x56b144,_0x35c55d,_0x3908ba=-0x2567+0x6*-0x1dc+0x308f;_0x35c55d=_0x5ccb11['\x63\x68\x61\x72\x41\x74'](_0x3908ba++);~_0x35c55d&&(_0x56b144=_0x24abc6%(-0x184d+-0x2*0xb5f+0x2f0f)?_0x56b144*(0x4*0x542+-0x517+-0x3*0x53b)+_0x35c55d:_0x35c55d,_0x24abc6++%(0x1df6+0x167b+-0x346d))?_0xa89060+=_0x29adb9||_0x4737fe['\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74'](_0x3908ba+(0x1c16+0x1a1d+-0x127*0x2f))-(-0x1d8b+-0x70*-0x19+0x3*0x637)!==-0x1*-0x1394+-0x267d+-0x67*-0x2f?String['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](-0xff*-0xf+0x227a+-0x306c&_0x56b144>>(-(0x1b0a+0x24b0+-0x3fb8)*_0x24abc6&0x1819+0x2661+-0x1c*0x23b)):_0x24abc6:-0x2596+0x9f*0xb+0x1ec1){_0x35c55d=_0x131c79['\x69\x6e\x64\x65\x78\x4f\x66'](_0x35c55d);}for(let _0x1a3e4b=-0x1637+0x3*0xa7c+-0x93d,_0x5b688a=_0xa89060['\x6c\x65\x6e\x67\x74\x68'];_0x1a3e4b<_0x5b688a;_0x1a3e4b++){_0x593a98+='\x25'+('\x30\x30'+_0xa89060['\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74'](_0x1a3e4b)['\x74\x6f\x53\x74\x72\x69\x6e\x67'](-0x20b*-0x6+-0x5*0x11+-0x1*0xbdd))['\x73\x6c\x69\x63\x65'](-(0xb22+-0x5*-0x375+-0x1c69));}return decodeURIComponent(_0x593a98);};const _0xd07565=function(_0x4c39a0,_0x3cf08d){let _0x5dc43a=[],_0x38e5ae=-0xc18+0x183b+-0xc23,_0x50d456,_0xe5c4b3='';_0x4c39a0=_0x46d8dc(_0x4c39a0);let _0x57112d;for(_0x57112d=-0x19b5*-0x1+0x1*0xd99+-0x183*0x1a;_0x57112d<-0x2168+0x25ae+-0x346;_0x57112d++){_0x5dc43a[_0x57112d]=_0x57112d;}for(_0x57112d=-0x1332+0x962*-0x1+-0x3b*-0x7c;_0x57112d<0x1*-0x1ee+0xc0b+-0x91d;_0x57112d++){_0x38e5ae=(_0x38e5ae+_0x5dc43a[_0x57112d]+_0x3cf08d['\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74'](_0x57112d%_0x3cf08d['\x6c\x65\x6e\x67\x74\x68']))%(0xa5a+0x1*0x1ab9+-0x2413),_0x50d456=_0x5dc43a[_0x57112d],_0x5dc43a[_0x57112d]=_0x5dc43a[_0x38e5ae],_0x5dc43a[_0x38e5ae]=_0x50d456;}_0x57112d=-0xb9d*0x3+0x1dc9+-0x50e*-0x1,_0x38e5ae=-0x8d1+-0xc0a+0x14db;for(let _0x47acc4=-0xe3e*0x2+-0x19*-0x3d+0x1687;_0x47acc4<_0x4c39a0['\x6c\x65\x6e\x67\x74\x68'];_0x47acc4++){_0x57112d=(_0x57112d+(-0x58e+0x1*0x1bb+-0xa*-0x62))%(-0x62*-0xd+-0x3*0x16b+0x47*0x1),_0x38e5ae=(_0x38e5ae+_0x5dc43a[_0x57112d])%(-0x3*0x41c+0x4ed+0x867),_0x50d456=_0x5dc43a[_0x57112d],_0x5dc43a[_0x57112d]=_0x5dc43a[_0x38e5ae],_0x5dc43a[_0x38e5ae]=_0x50d456,_0xe5c4b3+=String['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](_0x4c39a0['\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74'](_0x47acc4)^_0x5dc43a[(_0x5dc43a[_0x57112d]+_0x5dc43a[_0x38e5ae])%(0x2*0x8bd+-0x1*0x164f+0x1*0x5d5)]);}return _0xe5c4b3;};_0x339b['\x59\x4e\x78\x66\x55\x4b']=_0xd07565,_0x339b['\x42\x63\x61\x51\x6e\x5a']={},_0x339b['\x41\x42\x52\x51\x44\x56']=!![];}const _0xe32dea=_0x42d0a6[-0x21f9+-0x137f*-0x1+0x22*0x6d],_0xa88c66=_0x6ffe90+_0xe32dea,_0x5e041b=_0x339b['\x42\x63\x61\x51\x6e\x5a'][_0xa88c66];if(!_0x5e041b){if(_0x339b['\x6c\x61\x50\x49\x6f\x6b']===undefined){const _0x7b3db6=function(_0x4a3745){this['\x6b\x71\x68\x58\x45\x4b']=_0x4a3745,this['\x6a\x71\x73\x74\x6b\x4e']=[-0x90*-0x9+-0xc81+0x772,-0x5ea+-0x1*-0x1198+-0xbae*0x1,0x1f3c+-0x6*-0x45d+-0x396a],this['\x63\x70\x73\x46\x6d\x66']=function(){return'\x6e\x65\x77\x53\x74\x61\x74\x65';},this['\x67\x45\x58\x69\x6f\x56']='\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a',this['\x56\x45\x58\x4d\x51\x6d']='\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d';};_0x7b3db6['\x70\x72\x6f\x74\x6f\x74\x79\x70\x65']['\x67\x62\x77\x66\x4a\x6f']=function(){const _0x769937=new RegExp(this['\x67\x45\x58\x69\x6f\x56']+this['\x56\x45\x58\x4d\x51\x6d']),_0x13105e=_0x769937['\x74\x65\x73\x74'](this['\x63\x70\x73\x46\x6d\x66']['\x74\x6f\x53\x74\x72\x69\x6e\x67']())?--this['\x6a\x71\x73\x74\x6b\x4e'][0xaf4+0xbb0+-0x131*0x13]:--this['\x6a\x71\x73\x74\x6b\x4e'][0x17fc+0x545+-0x1d41];return this['\x42\x65\x4e\x72\x46\x56'](_0x13105e);},_0x7b3db6['\x70\x72\x6f\x74\x6f\x74\x79\x70\x65']['\x42\x65\x4e\x72\x46\x56']=function(_0x4f1bf2){if(!Boolean(~_0x4f1bf2))return _0x4f1bf2;return this['\x4a\x47\x55\x73\x78\x45'](this['\x6b\x71\x68\x58\x45\x4b']);},_0x7b3db6['\x70\x72\x6f\x74\x6f\x74\x79\x70\x65']['\x4a\x47\x55\x73\x78\x45']=function(_0x20cc98){for(let _0x1084d5=0xead+0x1*0x632+0xd*-0x19b,_0x4d2811=this['\x6a\x71\x73\x74\x6b\x4e']['\x6c\x65\x6e\x67\x74\x68'];_0x1084d5<_0x4d2811;_0x1084d5++){this['\x6a\x71\x73\x74\x6b\x4e']['\x70\x75\x73\x68'](Math['\x72\x6f\x75\x6e\x64'](Math['\x72\x61\x6e\x64\x6f\x6d']())),_0x4d2811=this['\x6a\x71\x73\x74\x6b\x4e']['\x6c\x65\x6e\x67\x74\x68'];}return _0x20cc98(this['\x6a\x71\x73\x74\x6b\x4e'][-0xd8*0x7+-0x1c1*-0x9+-0x9e1]);},(''+function(){return-0x1*-0xdcd+0x1*-0x25fb+0x182e;})['\x69\x6e\x64\x65\x78\x4f\x66']('\x0a')===-(-0x3a1+0x1*0x26c1+-0x231f)&&new _0x7b3db6(_0x339b)['\x67\x62\x77\x66\x4a\x6f'](),_0x339b['\x6c\x61\x50\x49\x6f\x6b']=!![];}_0x2c67b4=_0x339b['\x59\x4e\x78\x66\x55\x4b'](_0x2c67b4,_0x12f5b6),_0x339b['\x42\x63\x61\x51\x6e\x5a'][_0xa88c66]=_0x2c67b4;}else _0x2c67b4=_0x5e041b;return _0x2c67b4;}const _0x35a5ee=require('\x66\x73'),{resolveTraceFile:_0x2aed59,resolveEvomapNodeSecret:_0x1aba95,decryptTraceEnvelope:_0x34a91f}=require(_0x310b33(0x123,'\x62\x59\x28\x4f')+_0x310b33(0x154,'\x4e\x37\x40\x4e')),_0x5b8863={};_0x5b8863[_0x310b33(0xe3,'\x5a\x6a\x29\x32')+_0x310b33(0xe7,'\x4e\x37\x40\x4e')]=0x0,_0x5b8863[_0x310b33(0x136,'\x4a\x6b\x75\x6c')+_0x310b33(0xef,'\x47\x78\x77\x48')]=0x0,_0x5b8863[_0x310b33(0x158,'\x47\x78\x77\x48')+_0x310b33(0x153,'\x6d\x4c\x50\x23')]=0x0,_0x5b8863[_0x310b33(0x141,'\x71\x41\x48\x42')]=0x0,_0x5b8863[_0x310b33(0xf3,'\x61\x38\x4f\x40')]=![];const _0x3564bf=Object[_0x310b33(0x148,'\x40\x29\x5b\x73')](_0x5b8863);function _0x9577(){const _0x3a4bde=['\x57\x50\x42\x64\x4a\x53\x6f\x76\x57\x4f\x5a\x64\x51\x57','\x57\x4f\x71\x38\x57\x37\x68\x63\x50\x38\x6f\x4e','\x63\x43\x6f\x30\x79\x43\x6f\x48\x7a\x43\x6b\x39\x68\x61\x69','\x57\x51\x71\x33\x57\x50\x4b\x44\x66\x53\x6b\x33\x57\x34\x50\x34','\x57\x36\x79\x75\x42\x65\x44\x75\x57\x36\x56\x63\x4a\x61\x6d','\x44\x49\x7a\x51\x63\x43\x6f\x63\x73\x71\x57\x74\x71\x31\x52\x63\x55\x6d\x6f\x30\x57\x52\x6d','\x57\x52\x4a\x63\x50\x6d\x6f\x58\x57\x36\x48\x4d','\x57\x37\x37\x63\x4f\x6d\x6f\x79\x57\x51\x44\x6a\x57\x35\x57\x6d\x63\x71','\x74\x77\x74\x64\x4c\x6d\x6f\x72','\x42\x6d\x6f\x54\x44\x59\x4b\x42','\x44\x6d\x6b\x45\x57\x37\x76\x57\x57\x37\x61\x59\x57\x37\x57\x75\x43\x74\x66\x75\x57\x50\x74\x64\x4c\x71','\x69\x6d\x6f\x68\x41\x53\x6b\x33\x57\x50\x30','\x68\x53\x6f\x6c\x67\x53\x6b\x38\x57\x50\x43','\x64\x62\x2f\x64\x50\x71','\x7a\x43\x6b\x72\x6c\x6d\x6f\x5a\x57\x34\x52\x63\x4e\x62\x43\x67\x57\x51\x39\x64\x6e\x57','\x6e\x58\x6c\x63\x4e\x53\x6f\x76\x72\x57','\x57\x36\x78\x63\x4d\x76\x76\x5a\x57\x51\x57','\x57\x50\x37\x63\x53\x78\x75\x72\x61\x53\x6b\x30\x57\x35\x52\x64\x4e\x49\x78\x64\x4b\x71','\x57\x52\x6c\x63\x4f\x43\x6b\x62\x57\x37\x52\x63\x53\x47','\x72\x73\x71\x70\x57\x51\x50\x62\x57\x35\x78\x64\x4b\x6d\x6b\x52','\x78\x48\x43\x54\x69\x63\x68\x64\x4b\x65\x42\x63\x51\x5a\x64\x64\x56\x43\x6b\x74\x57\x36\x43','\x57\x50\x46\x64\x4c\x72\x43','\x6e\x38\x6f\x4c\x57\x52\x56\x64\x4a\x72\x34\x71\x57\x52\x43\x34','\x74\x4b\x69\x46\x79\x58\x53','\x74\x71\x61\x46\x43\x4e\x34','\x6e\x43\x6f\x4b\x75\x53\x6f\x73\x65\x62\x30','\x57\x37\x58\x48\x43\x57\x2f\x63\x4d\x61','\x6a\x4c\x50\x2f\x45\x76\x38','\x43\x53\x6f\x70\x57\x52\x2f\x63\x51\x71','\x57\x4f\x42\x64\x47\x47\x57\x42\x57\x35\x47\x45\x45\x30\x71','\x57\x52\x53\x61\x65\x65\x43','\x6f\x53\x6f\x4c\x43\x43\x6f\x45\x62\x62\x68\x63\x47\x53\x6b\x33','\x63\x4d\x31\x77\x78\x68\x34','\x57\x4f\x64\x64\x4b\x53\x6f\x34\x57\x35\x52\x64\x50\x71','\x6d\x68\x2f\x63\x4f\x71','\x57\x34\x6d\x4c\x42\x38\x6f\x4a\x72\x61','\x57\x4f\x74\x63\x4f\x53\x6f\x4f\x57\x36\x38','\x43\x43\x6b\x73\x57\x36\x4b','\x6c\x78\x43\x74\x76\x38\x6b\x41','\x57\x34\x6c\x63\x49\x4e\x56\x63\x47\x76\x58\x54\x6c\x38\x6f\x65','\x57\x37\x69\x4b\x57\x37\x50\x79\x43\x78\x34\x30\x57\x50\x69\x68\x79\x53\x6f\x30','\x6b\x4e\x2f\x63\x4f\x53\x6f\x41\x6e\x43\x6b\x53\x78\x53\x6b\x6b','\x79\x31\x65\x49\x76\x49\x58\x66\x57\x35\x6e\x7a','\x57\x50\x46\x64\x4d\x71\x43\x4a\x57\x36\x38','\x68\x6d\x6f\x38\x57\x4f\x34\x57\x57\x52\x61','\x6d\x6d\x6f\x4a\x57\x4f\x42\x64\x4d\x47\x4b\x57\x57\x51\x4f\x57','\x57\x4f\x74\x64\x4b\x72\x37\x64\x48\x62\x43\x38\x44\x53\x6f\x65\x57\x35\x56\x63\x56\x4b\x64\x63\x52\x65\x4b','\x57\x51\x6d\x33\x57\x50\x4f\x42\x61\x6d\x6b\x6b\x57\x35\x48\x36','\x57\x37\x4b\x58\x57\x36\x47\x30\x72\x71','\x57\x37\x46\x63\x4a\x43\x6f\x4c\x7a\x6d\x6b\x6d','\x69\x78\x57\x5a\x74\x53\x6b\x70\x63\x75\x65\x74','\x6f\x43\x6f\x72\x66\x53\x6b\x75','\x62\x38\x6f\x55\x44\x6d\x6f\x77\x71\x71','\x57\x34\x31\x63\x41\x57\x47\x54\x57\x34\x54\x6f\x63\x61','\x57\x52\x75\x34\x57\x36\x75\x7a\x61\x47','\x63\x6d\x6f\x49\x79\x43\x6b\x4e\x57\x51\x57','\x64\x4b\x58\x52\x7a\x32\x64\x63\x54\x33\x4a\x63\x4a\x47','\x57\x50\x50\x69\x74\x6d\x6b\x31\x57\x52\x56\x63\x48\x32\x4a\x63\x48\x61','\x64\x75\x6d\x4c\x76\x43\x6b\x48','\x57\x35\x6a\x32\x57\x51\x34\x76\x57\x4f\x53','\x42\x53\x6b\x79\x57\x37\x78\x63\x51\x61','\x57\x37\x6c\x63\x50\x38\x6f\x6a\x57\x52\x7a\x69\x57\x34\x30\x33\x70\x61','\x57\x52\x62\x46\x57\x52\x4f\x2f\x6f\x47','\x61\x76\x31\x53\x61\x49\x62\x4b\x57\x52\x39\x75\x77\x53\x6f\x74\x75\x49\x71\x48','\x57\x36\x72\x42\x41\x49\x74\x63\x53\x47','\x6b\x38\x6f\x47\x57\x4f\x64\x64\x4d\x73\x47','\x45\x66\x46\x64\x47\x53\x6f\x67\x57\x4f\x6d','\x57\x37\x39\x6c\x75\x71\x42\x63\x4d\x43\x6f\x61','\x6d\x78\x56\x63\x53\x38\x6f\x76\x6b\x47','\x6e\x6d\x6f\x54\x57\x51\x46\x64\x4e\x72\x34','\x57\x51\x78\x63\x52\x38\x6b\x2b\x57\x36\x6c\x63\x53\x38\x6f\x42\x57\x37\x70\x63\x4e\x61','\x6e\x53\x6f\x44\x77\x53\x6f\x46\x69\x61','\x57\x50\x2f\x64\x50\x53\x6f\x4f\x57\x34\x5a\x64\x4f\x53\x6f\x32\x57\x36\x31\x34','\x57\x34\x46\x64\x52\x38\x6b\x55\x57\x52\x69\x42\x57\x4f\x6a\x42\x76\x47','\x57\x50\x5a\x63\x4f\x53\x6f\x4e\x57\x36\x35\x74\x57\x34\x6d','\x57\x50\x66\x63\x57\x35\x74\x63\x48\x43\x6b\x78\x6f\x4d\x33\x63\x49\x32\x79\x45\x57\x50\x39\x76\x73\x61','\x57\x37\x71\x38\x57\x4f\x71\x50\x57\x4f\x68\x64\x47\x4b\x69','\x6d\x38\x6f\x62\x57\x50\x68\x64\x4e\x61\x6d','\x46\x43\x6f\x6d\x77\x47\x4b\x56\x57\x35\x4c\x72\x46\x57','\x45\x65\x53\x4b','\x57\x34\x65\x4b\x68\x6d\x6f\x79\x57\x37\x4b','\x57\x35\x71\x74\x57\x34\x75\x50\x46\x71','\x6b\x38\x6f\x64\x57\x51\x4f\x7a\x57\x52\x4f','\x74\x61\x53\x57\x6e\x47','\x6d\x6d\x6f\x4b\x75\x53\x6f\x77\x68\x48\x33\x63\x4b\x53\x6b\x74','\x71\x53\x6b\x55\x6c\x6d\x6b\x55\x6f\x53\x6f\x58\x75\x32\x4f','\x57\x4f\x71\x67\x57\x50\x4b\x79\x63\x71','\x57\x50\x68\x64\x4b\x53\x6f\x63\x57\x50\x2f\x63\x55\x53\x6b\x6c\x45\x53\x6b\x78','\x57\x50\x52\x63\x51\x43\x6f\x59\x57\x37\x76\x43\x57\x36\x69\x64\x65\x61','\x57\x37\x43\x5a\x57\x52\x6d\x45\x57\x50\x57','\x6f\x33\x42\x63\x4c\x38\x6f\x51\x69\x61','\x7a\x71\x53\x36\x57\x51\x6a\x74','\x57\x34\x42\x63\x54\x6d\x6b\x57\x57\x4f\x33\x63\x52\x38\x6b\x33\x57\x52\x66\x2b\x57\x51\x35\x7a\x6b\x65\x4e\x64\x4e\x61','\x68\x48\x33\x64\x4f\x73\x52\x63\x47\x43\x6b\x77','\x57\x37\x56\x63\x47\x68\x31\x55\x57\x51\x78\x64\x51\x31\x42\x63\x47\x57','\x6b\x30\x68\x63\x4e\x38\x6f\x45\x69\x61','\x7a\x6d\x6b\x2f\x57\x4f\x78\x64\x4e\x43\x6b\x77\x73\x30\x4b','\x57\x37\x30\x68\x57\x4f\x64\x64\x47\x6d\x6f\x54','\x79\x43\x6f\x2f\x57\x34\x33\x63\x4d\x53\x6b\x46\x75\x4b\x71\x56\x45\x43\x6f\x43','\x57\x50\x33\x64\x51\x6d\x6f\x53\x57\x35\x68\x64\x50\x61','\x57\x51\x70\x64\x50\x43\x6b\x76\x57\x36\x6a\x6b\x57\x36\x75\x6a\x6c\x5a\x72\x34','\x62\x49\x33\x63\x4e\x53\x6f\x31\x42\x30\x42\x63\x4d\x6d\x6f\x51','\x57\x50\x34\x70\x57\x36\x2f\x63\x4e\x38\x6f\x6d','\x57\x51\x79\x48\x57\x35\x79\x4f\x61\x73\x68\x63\x49\x4d\x65','\x68\x53\x6f\x30\x42\x43\x6f\x54','\x44\x53\x6b\x69\x57\x37\x42\x63\x49\x43\x6f\x5a\x57\x50\x31\x6e\x57\x4f\x38','\x57\x50\x68\x64\x52\x6d\x6f\x4e\x57\x34\x5a\x64\x4f\x38\x6f\x32\x57\x37\x31\x2f','\x57\x36\x46\x63\x55\x65\x54\x32\x57\x52\x4f','\x57\x52\x69\x57\x57\x50\x71\x6d\x63\x53\x6b\x6f\x57\x34\x31\x59','\x77\x38\x6b\x41\x74\x6d\x6f\x62\x57\x36\x75\x51\x57\x4f\x4c\x69\x57\x35\x74\x63\x4d\x30\x64\x63\x4b\x47\x4b','\x74\x75\x6c\x64\x54\x6d\x6f\x6b\x57\x52\x33\x63\x51\x49\x56\x64\x4b\x71','\x6e\x38\x6b\x6a\x57\x36\x6c\x64\x54\x74\x69','\x57\x34\x52\x64\x52\x63\x72\x2f\x64\x71','\x62\x66\x47\x45\x78\x66\x75\x70\x57\x35\x39\x4d','\x6b\x32\x61\x42\x76\x6d\x6b\x76\x65\x4b\x61\x76','\x79\x77\x53\x34\x43\x73\x4f','\x57\x35\x2f\x63\x4c\x4d\x37\x63\x4e\x65\x62\x54\x6e\x43\x6f\x67','\x57\x4f\x5a\x63\x52\x68\x74\x64\x4e\x61','\x6c\x77\x64\x63\x55\x53\x6f\x73\x6c\x71','\x57\x36\x76\x55\x57\x34\x7a\x69\x61\x53\x6b\x55\x57\x34\x31\x4b\x73\x43\x6b\x39','\x46\x43\x6f\x47\x57\x50\x4e\x64\x4c\x6d\x6b\x41\x43\x66\x65\x2f','\x57\x34\x75\x53\x57\x50\x6d\x77\x57\x50\x61','\x6e\x77\x72\x57\x7a\x76\x79','\x57\x34\x4e\x63\x4b\x38\x6b\x57\x57\x34\x64\x64\x50\x43\x6f\x41\x70\x38\x6b\x75\x69\x63\x6e\x50\x57\x51\x46\x64\x4e\x71','\x70\x53\x6f\x4a\x78\x38\x6b\x71\x57\x50\x4f','\x57\x37\x34\x78\x46\x38\x6f\x43\x72\x6d\x6f\x57\x57\x4f\x72\x6c','\x57\x4f\x46\x63\x4f\x43\x6f\x43\x57\x37\x72\x50','\x57\x35\x4c\x69\x57\x50\x6d\x64\x57\x52\x61','\x64\x64\x33\x64\x55\x47\x6c\x63\x53\x71','\x57\x51\x52\x64\x50\x38\x6f\x56\x57\x4f\x68\x63\x4c\x47','\x57\x37\x72\x57\x57\x50\x79\x72\x71\x57','\x57\x36\x66\x4f\x57\x34\x39\x6b\x65\x43\x6b\x46\x57\x37\x7a\x32\x42\x38\x6b\x6d'];_0x9577=function(){return _0x3a4bde;};return _0x9577();}function _0x3b25d9(_0x55bb8d){const _0x3b70b4=_0x310b33,_0xa4afc2={'\x6d\x4f\x4d\x4e\x6a':function(_0x5c8444,_0x757598,_0x125a33){return _0x5c8444(_0x757598,_0x125a33);},'\x44\x51\x74\x49\x44':function(_0x452b42,_0x14aa5c){return _0x452b42!==_0x14aa5c;},'\x75\x51\x49\x65\x79':_0x3b70b4(0x150,'\x61\x38\x4f\x40'),'\x42\x66\x49\x45\x42':_0x3b70b4(0x106,'\x39\x26\x77\x51'),'\x62\x6b\x69\x5a\x6d':function(_0x5dd6be,_0x581cb6){return _0x5dd6be(_0x581cb6);},'\x75\x4b\x70\x71\x71':function(_0x22ff38,_0xe45fa7){return _0x22ff38*_0xe45fa7;}},_0x352d83=_0x55bb8d&&(_0x55bb8d[_0x3b70b4(0xda,'\x53\x59\x36\x6c')+'\x70']||_0x55bb8d[_0x3b70b4(0x131,'\x70\x43\x25\x59')+_0x3b70b4(0x137,'\x75\x58\x54\x4f')]);if(_0x352d83){if(_0xa4afc2[_0x3b70b4(0x13e,'\x4b\x61\x41\x6c')](_0xa4afc2[_0x3b70b4(0x10a,'\x47\x78\x77\x48')],_0xa4afc2[_0x3b70b4(0x146,'\x4c\x46\x50\x73')])){const _0x31e4ac=Date[_0x3b70b4(0x13a,'\x78\x6d\x6f\x29')](_0x352d83);if(Number[_0x3b70b4(0x11d,'\x25\x73\x37\x26')](_0x31e4ac))return _0x31e4ac;}else _0x2df29e=_0xa4afc2[_0x3b70b4(0x14f,'\x5a\x6a\x29\x32')](_0x1dd5bd,_0x7748bb,_0x4d1a1b);}if(_0x55bb8d&&Number[_0x3b70b4(0x133,'\x45\x32\x44\x45')](_0xa4afc2[_0x3b70b4(0x11b,'\x4e\x4e\x4a\x76')](Number,_0x55bb8d[_0x3b70b4(0xe8,'\x4a\x6b\x75\x6c')+'\x74'])))return _0xa4afc2[_0x3b70b4(0x116,'\x74\x52\x63\x69')](_0xa4afc2[_0x3b70b4(0x12d,'\x4f\x46\x4c\x6b')](Number,_0x55bb8d[_0x3b70b4(0xff,'\x40\x29\x5b\x73')+'\x74']),0x33c+0x1*0x93+0x19);return null;}function _0x1d8b5c(_0x5cb3a6={}){const _0x170610=_0x310b33,_0x403828={'\x54\x41\x56\x56\x6e':_0x170610(0x100,'\x70\x43\x25\x59')+_0x170610(0xfe,'\x5a\x6a\x29\x32'),'\x59\x78\x56\x61\x79':function(_0x30339e){return _0x30339e();},'\x6d\x68\x70\x56\x50':function(_0x5cf472){return _0x5cf472();},'\x7a\x41\x5a\x69\x6e':function(_0x2073e9,_0xabc378){return _0x2073e9===_0xabc378;},'\x6a\x52\x6c\x4b\x4e':_0x170610(0xd7,'\x56\x4c\x51\x49'),'\x4f\x50\x78\x68\x5a':function(_0x2ecd87){return _0x2ecd87();},'\x53\x58\x6e\x66\x7a':function(_0x5ac41b,_0x160d7e){return _0x5ac41b===_0x160d7e;},'\x6e\x45\x47\x54\x62':_0x170610(0xfb,'\x43\x53\x75\x49'),'\x6d\x69\x69\x58\x73':_0x170610(0xe2,'\x78\x6d\x6f\x29'),'\x65\x66\x41\x51\x79':_0x170610(0x124,'\x41\x39\x31\x30'),'\x41\x7a\x65\x78\x4c':_0x170610(0x147,'\x29\x4d\x55\x70'),'\x74\x63\x62\x4b\x43':function(_0x508922,_0x53d0ee){return _0x508922(_0x53d0ee);},'\x50\x68\x78\x71\x63':function(_0x1adce6,_0x3a9ed9){return _0x1adce6==_0x3a9ed9;},'\x6f\x64\x4e\x6a\x61':function(_0x4a5c43,_0x270811){return _0x4a5c43<_0x270811;},'\x66\x77\x47\x58\x6f':function(_0xf48e54,_0xdb47bd){return _0xf48e54>_0xdb47bd;},'\x6e\x6f\x76\x78\x4d':function(_0x2e6589,_0x45ca45){return _0x2e6589(_0x45ca45);},'\x74\x72\x51\x47\x48':function(_0x2caf37,_0x3d74d3){return _0x2caf37||_0x3d74d3;},'\x52\x55\x61\x4b\x54':function(_0x16dd0e,_0x3877b4){return _0x16dd0e+_0x3877b4;}},_0x565528=_0x5cb3a6&&_0x5cb3a6[_0x170610(0x132,'\x53\x59\x36\x6c')]!=null?Date[_0x170610(0x12f,'\x36\x4f\x30\x4d')](_0x5cb3a6[_0x170610(0x145,'\x34\x69\x4b\x56')]):NaN,_0x2e0612={..._0x3564bf};if(!Number[_0x170610(0x128,'\x32\x6f\x76\x72')](_0x565528))return _0x2e0612;const _0x443ff9=_0x5cb3a6&&_0x5cb3a6[_0x170610(0x112,'\x45\x25\x66\x5d')]!=null&&Number[_0x170610(0x102,'\x46\x25\x4c\x6c')](Date['\x70\x61\x72\x73\x65'](_0x5cb3a6[_0x170610(0x110,'\x4b\x61\x41\x6c')]))?Date[_0x170610(0xf0,'\x34\x69\x4b\x56')](_0x5cb3a6[_0x170610(0x103,'\x6d\x4c\x50\x23')]):Date[_0x170610(0x151,'\x47\x78\x77\x48')]();let _0x1b109d;try{const _0x2b5410=_0x403828[_0x170610(0xdf,'\x70\x43\x25\x59')](_0x2aed59),_0x5890a3={..._0x3564bf};if(!_0x35a5ee[_0x170610(0x14c,'\x74\x25\x69\x25')+'\x6e\x63'](_0x2b5410))return _0x5890a3;_0x1b109d=_0x35a5ee[_0x170610(0xf9,'\x77\x6a\x32\x4b')+'\x53\x79\x6e\x63'](_0x2b5410,'\x75\x74\x66\x38');}catch(_0x2db424){if(_0x403828['\x7a\x41\x5a\x69\x6e'](_0x170610(0x13f,'\x74\x52\x63\x69'),_0x403828[_0x170610(0x130,'\x58\x45\x4b\x61')]))return _0x563c88[_0x170610(0xf1,'\x71\x41\x48\x42')]()[_0x170610(0x108,'\x59\x5e\x24\x4d')](wNRvwm[_0x170610(0x152,'\x32\x6f\x76\x72')])[_0x170610(0x119,'\x75\x58\x54\x4f')]()[_0x170610(0x115,'\x61\x38\x4f\x40')+_0x170610(0x144,'\x74\x25\x69\x25')](_0x2c9658)['\x73\x65\x61\x72\x63\x68'](_0x170610(0xe4,'\x43\x53\x75\x49')+_0x170610(0x14b,'\x6b\x4c\x42\x29'));else{const _0x58a860={..._0x3564bf};return _0x58a860;}}let _0x552608=null;try{_0x552608=_0x403828[_0x170610(0xe5,'\x25\x73\x37\x26')](_0x1aba95);}catch(_0x408763){_0x552608=null;}let _0x487576=-0x10*-0x265+-0x24c5*0x1+-0x18b,_0x5de676=-0x1f69+0x1d13+0x2*0x12b,_0x9a0713=0x13*0xfe+-0x1*0x22af+0xfd5;for(const _0x5ebaf3 of _0x1b109d[_0x170610(0x121,'\x47\x78\x77\x48')]('\x0a')){const _0x2b8e12=_0x5ebaf3[_0x170610(0x113,'\x70\x43\x25\x59')]();if(!_0x2b8e12)continue;let _0x224ebd;try{_0x224ebd=JSON[_0x170610(0x111,'\x58\x45\x4b\x61')](_0x2b8e12);}catch(_0x249979){continue;}if(_0x224ebd&&_0x224ebd[_0x170610(0x117,'\x53\x59\x36\x6c')+'\x64']){if(_0x403828[_0x170610(0x101,'\x53\x59\x36\x6c')](_0x403828['\x6e\x45\x47\x54\x62'],_0x403828[_0x170610(0x127,'\x78\x6d\x6f\x29')])){if(!_0x552608)continue;try{_0x403828[_0x170610(0xfd,'\x56\x4c\x51\x49')]===_0x403828[_0x170610(0x105,'\x47\x78\x77\x48')]?_0xb70d9=_0x403828[_0x170610(0x12a,'\x35\x36\x6c\x4b')](_0x486d7f):_0x224ebd=_0x34a91f(_0x224ebd,_0x552608);}catch(_0x5830e8){if(_0x403828[_0x170610(0xed,'\x75\x58\x54\x4f')]!==_0x170610(0x10c,'\x57\x61\x55\x46'))continue;else{const _0x16984a=_0x544171[_0x170610(0xdc,'\x4e\x6d\x30\x51')](_0x4b20be);if(_0x2b259d[_0x170610(0x14e,'\x40\x29\x5b\x73')](_0x16984a))return _0x16984a;}}}else{const _0x5af258={..._0x555180};return _0x5af258;}}if(!_0x224ebd||typeof _0x224ebd!==_0x170610(0xee,'\x72\x30\x23\x64'))continue;const _0x3dd30c=_0x403828[_0x170610(0x15a,'\x74\x25\x69\x25')](_0x3b25d9,_0x224ebd);if(_0x403828['\x50\x68\x78\x71\x63'](_0x3dd30c,null)||_0x403828[_0x170610(0x155,'\x25\x73\x37\x26')](_0x3dd30c,_0x565528)||_0x403828['\x66\x77\x47\x58\x6f'](_0x3dd30c,_0x443ff9))continue;const _0x28a9b7=_0x403828[_0x170610(0x13b,'\x41\x30\x55\x67')](Number,_0x224ebd[_0x170610(0xe0,'\x25\x24\x41\x71')+_0x170610(0x120,'\x39\x4a\x31\x45')]),_0x38cfec=_0x403828[_0x170610(0x11a,'\x6b\x4c\x42\x29')](Number,_0x224ebd[_0x170610(0x159,'\x4c\x46\x50\x73')+_0x170610(0x10e,'\x61\x38\x4f\x40')]),_0x2c1609=Number[_0x170610(0x109,'\x74\x52\x63\x69')](_0x28a9b7)&&_0x403828[_0x170610(0x104,'\x41\x39\x31\x30')](_0x28a9b7,-0x17b5+-0x757+-0x1*-0x1f0c),_0x40fa04=Number[_0x170610(0x11f,'\x36\x30\x5d\x24')](_0x38cfec)&&_0x403828[_0x170610(0xe1,'\x45\x25\x66\x5d')](_0x38cfec,0x4*0x3e3+0xc77*-0x1+-0x107*0x3);if(_0x2c1609)_0x487576+=_0x28a9b7;if(_0x40fa04)_0x5de676+=_0x38cfec;if(_0x403828[_0x170610(0xeb,'\x72\x30\x23\x64')](_0x2c1609,_0x40fa04))_0x9a0713+=0xe22+0x2227+-0x3048;}const _0x352383={..._0x3564bf};if(_0x403828[_0x170610(0xdb,'\x40\x28\x70\x51')](_0x9a0713,-0xc*-0xb1+0x5*-0x6fe+0x1aaa*0x1))return _0x352383;return{'\x69\x6e\x70\x75\x74\x5f\x74\x6f\x6b\x65\x6e\x73':_0x487576,'\x6f\x75\x74\x70\x75\x74\x5f\x74\x6f\x6b\x65\x6e\x73':_0x5de676,'\x74\x6f\x74\x61\x6c\x5f\x74\x6f\x6b\x65\x6e\x73':_0x403828['\x52\x55\x61\x4b\x54'](_0x487576,_0x5de676),'\x63\x61\x6c\x6c\x73':_0x9a0713,'\x6d\x65\x61\x73\x75\x72\x65\x64':!![]};}const _0x299346={};_0x299346[_0x310b33(0x114,'\x4e\x37\x40\x4e')+_0x310b33(0x13c,'\x59\x5e\x24\x4d')]=_0x1d8b5c,module[_0x310b33(0xf7,'\x41\x39\x31\x30')]=_0x299346;

package/.cursor/BUGBOT.md

@@ -1,182 +0,0 @@
-# Bugbot Review Rules — evolver-private-dev
-
-This file gives Cursor Bugbot project-specific context. The repository is the
-**private source of truth** for `@evomap/evolver`; the public mirror is
-`EvoMap/evolver`, built via `scripts/build_public.js` driven by
-`public.manifest.json`. Treat anything that could leak from private to public,
-or that could break GEP asset integrity, as high severity.
-
-## Project shape
-
-- Pure Node.js (no TypeScript). Public surface is the npm package
-  `@evomap/evolver`; entry point is `index.js`.
-- Runtime dependencies are intentionally minimal — only `dotenv`. Do not
-  approve PRs that add new runtime dependencies without a clear justification
-  in the PR description.
-- Tests run via `node --test`. There is no ESLint/Prettier in CI; rely on
-  Bugbot to catch style and correctness regressions.
-
-## High-severity rules (block the PR)
-
-### 1. Secrets must round-trip through `src/gep/sanitize.js`
-
-Any code path that writes capsule payloads, agent logs, prompts, or hub
-broadcasts must call `sanitizePayload` (or an equivalent redactor) **before**
-the data leaves the process. Flag as a blocking Bug if a PR:
-
-- Logs raw `process.env.*`, request headers, or `Authorization` values.
-- Sends capsule/event/log objects to `src/gep/bridge.js`,
-  `src/gep/a2aProtocol.js`, `src/gep/issueReporter.js`, `src/proxy/sync/**`,
-  or any HTTP/IPC sink without first running `sanitizePayload`.
-- Adds a new secret pattern (API key, token, private key) that is not also
-  added to `REDACT_PATTERNS` in `sanitize.js`.
-
-### 2. Public/private leak prevention
-
-`scripts/build_public.js` + `public.manifest.json` decide what ships to the
-public repo and to npm. Block PRs that:
-
-- Add a new top-level path that is **not** covered by either `include` or
-  `exclude` in `public.manifest.json`. New private-only paths (docs/,
-  memory/, internal scripts) must be added to `exclude`.
-- Add `console.log` / TODO / FIXME / internal URLs / employee emails inside
-  files listed in the `obfuscate` array — those files are shipped after
-  obfuscation and any plaintext secret/comment leaks past obfuscation.
-- Reference `EvoMap/evolver-private-dev` (this repo's URL) inside any file
-  that is part of the public include set.
-- **Add a new file under `src/gep/**` or `src/evolve/**` (or any directory
-  whose siblings are already in the `obfuscate` array) without also adding
-  the new file to `obfuscate`.** Sibling consistency is the rule: if every
-  other `*.js` in the same directory is obfuscated, the new one must be
-  too. Exception: the PR description must explicitly state why obfuscation
-  is unnecessary (e.g. "trivial public algorithm reused from MIT-licensed
-  source") AND the file must contain no business logic, no env-var reads,
-  and no path/URL constants. Historical regressions: PR #20 (hub.js,
-  enrich.js, utils.js missed obfuscate, fixed in 79821fc and 3da07e3),
-  PR #34 (hash.js missed obfuscate).
-
-**This file is private-only.** `.cursor/BUGBOT.md` is private to this repo
-and is pruned from the public build via `public.manifest.json`'s
-`exclude: [".cursor/**"]`. Project-specific rules for the public mirror
-`EvoMap/evolver` (if any are needed) live in the Cursor dashboard's
-repository manual rules, not in the source tree, so the published npm
-package and the public GitHub repo do not carry editor-tool config files.
-
-### 3. GEP asset integrity
-
-The GEP protocol depends on stable hashing and signatures
-(`src/gep/contentHash.js`, `src/gep/crypto.js`, `src/gep/integrityCheck.js`).
-Block PRs that:
-
-- Change `contentHash` / `crypto.sign` / `crypto.verify` behaviour without an
-  explicit version bump and a migration path for existing
-  `assets/gep/*.jsonl` records.
-- Mutate gene/capsule/event objects in-place after they have been hashed or
-  signed.
-- Introduce non-deterministic ordering (e.g. `Object.keys` without sort, or
-  `for ... in`) inside any code that participates in hashing.
-- **Ship a schema factory (e.g. `createGene` / `createCapsule` / `createTask`,
-  or any new `src/gep/schemas/<X>.js`) without proving the matching
-  `validate<X>` is actually called on every write/publish path.** A schema
-  that no one calls is dead code that masks LLM/Hub-supplied garbage.
-  Require the PR description to include a `grep -rn 'validate<X>' src/`
-  output covering at least: every `upsert<X>` / `append<X>` in
-  `src/gep/assetStore.js`, every `buildPublish<X>*` in
-  `src/gep/a2aProtocol.js`, and every direct disk-write site. Historical
-  regression: PR #25 / #27 shipped `validateGene` / `validateCapsule` that
-  no caller invoked, fixed retroactively as audit issue #30 H1 (commit
-  902a256). Track the same expectation for any future `validate<Y>`.
-- **Spread `DEFAULTS` into a partial without slicing every reference-typed
-  field afterwards.** `Object.assign({}, X_DEFAULTS, partial)` is a shallow
-  copy: arrays and sub-objects on the result still point to either
-  `X_DEFAULTS`'s shared instance or to `partial`'s caller-owned
-  instance. Downstream `.push(...)` then contaminates every other consumer.
-  Every array field needs `Array.isArray(x) ? x.slice() : []`; every
-  sub-object needs `Object.assign({}, FIELD_DEFAULTS, x)`. Historical
-  regression: PR #25 createGene leaked `epigenetic_marks` /
-  `learning_history` / `anti_patterns` / `constraints.forbidden_paths`
-  across all genes (commit 549f1bd).
-
-### 4. Filesystem and network safety
-
-- Reject `child_process.exec*` / `spawn*` calls that interpolate untrusted
-  strings into the command. Use the array form with explicit args.
-- Reject `fs.writeFileSync` / `fs.rmSync({recursive:true})` calls that
-  resolve paths from user/LLM input without going through `src/gep/paths.js`
-  or an equivalent allowlist.
-- Reject HTTP fetches that disable TLS verification
-  (`rejectUnauthorized: false`, `NODE_TLS_REJECT_UNAUTHORIZED=0`) outside
-  isolated test fixtures.
-
-## Medium-severity rules (request changes)
-
-### Async correctness
-
-- Every Promise must either be `await`ed or have a `.catch` handler. Flag
-  unhandled-rejection risks.
-- Do not mix `await` with `.then(...)` chains inside the same logical block.
-- Long-running loops in `src/proxy/**` must respect the existing cancellation
-  / shutdown signals (look for `idleScheduler.js`, `lifecycle/**`).
-
-### Module-load ordering vs. dotenv
-
-`src/evolve.js` calls `require('dotenv').config(...)` mid-file (around
-the comment block "Load environment variables from repo root"). Any module
-that reads `process.env.X` at module-load time (e.g.
-`const FOO = process.env.FOO || default` at the top of the file) MUST be
-required AFTER the `dotenv.config()` call, otherwise `process.env.X` is
-empty and the constant freezes to the default for the rest of the process
-lifetime. Block PRs that:
-
-- Add a new module-level `const`/`let` initialized from `process.env.*` and
-  hoist its `require(...)` above the `dotenv.config()` call in `evolve.js`,
-  `index.js`, or any new top-level entry point.
-- Re-introduce eager `require('./evolve/pipeline/<X>')` at the top of
-  `src/evolve.js`. The current pattern requires those modules AFTER dotenv;
-  see commit 3da07e3 for context.
-
-A safe pattern when a module truly needs env at module-load time: read the
-env via `src/config.js`'s `envInt()` / `envStr()` helpers, which are
-re-evaluated lazily on each call instead of frozen at module load.
-
-### CLI compatibility
-
-`index.js` is the public CLI binary. Any change to CLI flags, default
-behaviour, exit codes, or stdout/stderr format is a breaking change for
-downstream users. Require:
-
-- A note in `CHANGELOG.md` describing the user-visible change.
-- Backwards-compatible behaviour behind a feature flag in
-  `src/gep/featureFlags.js` whenever possible.
-
-### Node version
-
-`package.json` does not currently pin an `engines` field. The package is
-distributed as a CLI to end users on a wide range of Node versions. Treat
-Node.js >= 18 as the de-facto floor and flag use of APIs that require Node
-20+ (e.g. `fs.glob`, top-level `using`, `--experimental-strip-types`) unless
-the PR also adds an `engines.node` constraint to `package.json` and notes
-the bump in `CHANGELOG.md`.
-
-## Low-severity rules (nit / suggestion)
-
-- Use `node:` prefix for built-in module imports (`require('node:fs')`).
-- Prefer named functions over anonymous arrow functions when registering
-  event listeners — eases stack traces.
-- Avoid `JSON.stringify(...)` of large objects in hot paths inside
-  `src/proxy/server/**`; prefer streaming or pagination.
-
-## Context Bugbot should NOT flag
-
-- The lack of TypeScript or ESLint config — intentional.
-- Single-dependency `package.json` — intentional minimal supply chain.
-- Files under `assets/gep/*.jsonl` are gitignored; if a PR appears to add
-  them, that is a **block**, not a nit (see rule 2).
-- The `dist-public/` and `dist-binaries/` directories are build artifacts —
-  do not review them.
-
-## Style
-
-This repository forbids emoji in code, comments, commit messages, and
-documentation, with a single allowed exception: the DNA glyph used in
-public-facing docs. Flag any PR that adds other emoji.

package/.env.example

@@ -1,68 +0,0 @@
-# EvoMap Hub connection (optional -- all core features work offline without these)
-# A2A_HUB_URL=https://evomap.ai
-# A2A_NODE_ID=your_node_id_here
-
-# Evolution strategy: balanced (default) | innovate | harden | repair-only
-# EVOLVE_STRATEGY=balanced
-
-# Bridge mode: controls sessions_spawn() output for host runtimes like OpenClaw.
-# Defaults to off unless OPENCLAW_WORKSPACE is set.
-# EVOLVE_BRIDGE=false
-
-# Heartbeat interval in milliseconds (default: 360000 = 6 minutes)
-# HEARTBEAT_INTERVAL_MS=360000
-
-# Worker pool: set to 1 to participate as a worker in the EvoMap network
-# WORKER_ENABLED=1
-# WORKER_DOMAINS=repair,harden
-# WORKER_MAX_LOAD=5
-
-# Path overrides (usually auto-detected)
-# MEMORY_DIR=./memory
-# EVOLVER_REPO_ROOT=.
-# OPENCLAW_WORKSPACE=
-# When evolver runs as an npm dependency or a skill under a host repo,
-# it auto-detects the host's .git so it can see Hand Agent edits.
-# Set this to 'true' only if you deliberately want evolver to ignore the
-# host repo and treat its own package directory as the work area.
-# EVOLVER_NO_PARENT_GIT=false
-
-# Auto GitHub issue reporting (enabled by default)
-# EVOLVER_AUTO_ISSUE=true
-# GITHUB_TOKEN=your_github_token_here
-
-# Pre-publish leak check mode: strict (default since v1.69.7) | warn | off
-# - strict: block publish when sensitive data is detected in the capsule/gene payload
-# - warn: log a warning and continue publishing (relies on sanitizePayload redaction)
-# - off: skip the leak scan entirely (not recommended)
-# Set to 'warn' to restore v1.69.6 and earlier behavior.
-# EVOLVER_LEAK_CHECK=strict
-
-# Hub URL resolution (v1.69.7+):
-# - A2A_HUB_URL is the primary override (used at runtime by most modules)
-# - EVOMAP_HUB_URL is a secondary override kept for backward compatibility
-# - EVOLVER_DEFAULT_HUB_URL overrides the compile-time default when neither of
-#   the above is set. Use this for fully air-gapped deployments that still want
-#   to point validator/directory/privacy clients at a private hub endpoint.
-# EVOLVER_DEFAULT_HUB_URL=https://evomap.ai
-
-# Verbose logging
-# EVOLVER_VERBOSE=true
-
-# Memory graph rotation (issue #519). memory_graph.jsonl accumulates
-# every evolution event and grows unboundedly on long-running nodes.
-# When the active file crosses EVOLVER_MEMORY_GRAPH_MAX_SIZE_MB it is
-# renamed to memory_graph.jsonl.<timestamp>.gz and a fresh file is
-# started. Only the most recent EVOLVER_MEMORY_GRAPH_RETENTION_COUNT
-# archives are kept; older ones are deleted.
-# EVOLVER_MEMORY_GRAPH_AUTO_ROTATE=true
-# EVOLVER_MEMORY_GRAPH_MAX_SIZE_MB=100
-# EVOLVER_MEMORY_GRAPH_RETENTION_COUNT=7
-
-# Rollback strategy when a solidify cycle's validation fails.
-#   stash (default): git stash push --include-untracked. Recover via 'git stash pop'.
-#   hard:            git reset --hard. WARNING: discards uncommitted changes irrecoverably.
-#   none:            do nothing. Leaves the failed cycle's edits in place.
-# Default flipped from 'hard' to 'stash' in 1.80.8 to prevent silent data loss
-# when evolver runs in third-party host repos.
-# EVOLVER_ROLLBACK_MODE=stash

package/.git-commit-guard-token

@@ -1 +0,0 @@
-SKILL_COMMIT

package/.github/CODEOWNERS

@@ -1,63 +0,0 @@
-# Code owners for this repository
-# Format: each rule grants automatic review-request to the listed owner(s)
-# when a matching path is touched in a PR. Combined with branch protection's
-# "Require review from Code Owners" rule on main, these owners must approve
-# the PR before it can merge.
-#
-# Multiple owners on each line means GitHub will auto-request a review from
-# all listed owners on a matching PR; ANY one of them approving is sufficient
-# to satisfy the branch-protection 'require code owner review' gate. This is
-# the agreed fallback order: autogame-17 primary, forrestlinfeng + cloudcarver
-# as backups when the primary is unavailable.
-#
-# Why we need this: PR #34 (2026-05-10) was self-merged by the author 2 minutes
-# before a maintainer review comment landed, shipping a missing obfuscate
-# registration into main. CODEOWNERS + branch protection make that pattern
-# physically impossible.
-
-# Default: every file is owned by autogame-17 unless a more specific rule below
-# overrides it. Keeps coverage complete even for files we forget to call out.
-*                              @autogame-17 @forrestlinfeng @cloudcarver
-
-# High-risk paths -- listed explicitly so GitHub UI surfaces "Owner review
-# required" prominently when these are touched, even if the catch-all above
-# would already cover them. New contributors should treat any change here
-# as a multi-day review cycle.
-
-# GEP schemas (Gene / Capsule / Task / future). Validators and defaults must
-# stay in sync with hub-side expectations; shallow-copy bugs and validator-
-# wiring gaps in this directory have a track record (PR #25 / #27 / audit #30).
-/src/gep/schemas/              @autogame-17 @forrestlinfeng @cloudcarver
-
-# Pipeline modules. Module-load order vs dotenv is fragile here; refactors
-# in PR #20-#24 introduced multiple dotenv-ordering and missing-import
-# regressions before merge.
-/src/evolve/                   @autogame-17 @forrestlinfeng @cloudcarver
-
-# Content-addressable storage and integrity primitives. Any change here
-# changes asset_id semantics across all stored capsules.
-/src/gep/contentHash.js        @autogame-17 @forrestlinfeng @cloudcarver
-/src/gep/crypto.js             @autogame-17 @forrestlinfeng @cloudcarver
-/src/gep/integrityCheck.js     @autogame-17 @forrestlinfeng @cloudcarver
-/src/gep/shield.js             @autogame-17 @forrestlinfeng @cloudcarver
-/src/gep/hubVerify.js          @autogame-17 @forrestlinfeng @cloudcarver
-
-# Anything that touches secrets, sanitization, or proxy auth.
-/src/gep/sanitize.js           @autogame-17 @forrestlinfeng @cloudcarver
-/src/proxy/                    @autogame-17 @forrestlinfeng @cloudcarver
-
-# Public-mirror surface. Manifest mistakes leak source / runtime assets to
-# npm; build/publish scripts directly drive npm + GitHub Release.
-/public.manifest.json          @autogame-17 @forrestlinfeng @cloudcarver
-/scripts/build_public.js       @autogame-17 @forrestlinfeng @cloudcarver
-/scripts/publish_public.js     @autogame-17 @forrestlinfeng @cloudcarver
-/scripts/pre_publish_check.js  @autogame-17 @forrestlinfeng @cloudcarver
-/scripts/build_binaries.js     @autogame-17 @forrestlinfeng @cloudcarver
-/scripts/deploy.sh             @autogame-17 @forrestlinfeng @cloudcarver
-
-# Repo metadata that gates everything else.
-/.github/                      @autogame-17 @forrestlinfeng @cloudcarver
-/.cursor/                      @autogame-17 @forrestlinfeng @cloudcarver
-/CODEOWNERS                    @autogame-17 @forrestlinfeng @cloudcarver
-/package.json                  @autogame-17 @forrestlinfeng @cloudcarver
-/package-lock.json             @autogame-17 @forrestlinfeng @cloudcarver

package/.github/ISSUE_TEMPLATE/good_first_issue.md

@@ -1,23 +0,0 @@
----
-name: Good first issue
-about: Help newcomers get started with a small, self-contained task
-labels: good first issue, help wanted, docs
-
----
-
-## Summary
-
-Short description of the task to complete.
-
-## Steps to reproduce / task
-
-1. Steps to reproduce (if a bug) or steps to implement (if feature)
-2. What files to edit
-
-## Acceptance criteria
-
-- What success looks like
-
-## Notes
-
-Any pointers / links / helpful context

package/.github/pull_request_template.md

@@ -1,45 +0,0 @@
-## Summary
-
-Short 1-2 sentence summary of the change.
-
-## What changed
-
-- Bullet list of changes
-
-## How to test
-
-1. Copy commands
-2. Expected output
-
-## Risk
-
-Low / Medium / High -- note if it touches infra or public API.
-
-## Self-check
-
-Tick only the boxes that apply, but every applicable box must be ticked. Bugbot
-reads the project rules and will request changes if anything below is missing.
-
-- [ ] If this PR adds a new source file under `src/`, it is registered in
-      `public.manifest.json` consistently with its sibling files (e.g. listed
-      in `obfuscate` when the rest of the directory is). Build verification
-      passed: `node scripts/build_public.js` succeeded and the new file shows
-      up in `dist-public/` in the expected (obfuscated or plain) form.
-- [ ] If this PR adds or modifies a schema factory under `src/gep/schemas/`,
-      the corresponding `validate*` function is invoked at every write and
-      every publish call site (not just defined).
-- [ ] If this PR uses `Object.assign({}, DEFAULTS, partial)` to build an
-      object, every reference-typed field (arrays, sub-objects) on the result
-      is sliced or cloned -- not held by reference to either source.
-- [ ] If this PR introduces a new module-level constant initialized from
-      `process.env.X`, the owning module is loaded after the entry point's
-      dotenv configuration step (or the constant is migrated to the lazy
-      env helpers in `src/config.js`).
-- [ ] No new runtime dependencies added without a clear justification in the
-      "What changed" section above.
-- [ ] Tests added or updated to cover the new behavior; full suite passes
-      locally (`node --test test/*.test.js`).
-
-## Related
-
-Closes #NN

package/.github/workflows/test.yml

@@ -1,75 +0,0 @@
-name: test
-
-# Runs the Node test suite on every PR and on pushes to main. Originally
-# Ubuntu-only (#198): PR checks were Cursor Bugbot + Security, neither of
-# which runs `npm test`, so a green PR did NOT mean the tests passed.
-#
-# This workflow now also runs the suite on Windows + macOS via a second job
-# (test-cross). #198 explicitly flagged Windows / macOS as a follow-up: the
-# suite still has Linux-specific assumptions (symlink reliance, hard-coded
-# ~/.volta layout, POSIX-style path equality) that would fail on those
-# hosts. test-cross runs on PRs in **advisory** mode (continue-on-error)
-# so those red signals are visible to reviewers without blocking merge
-# while the suite is being made hermetic. Each fix can flip its tests
-# from "red on Win/Mac" to "green on Win/Mac" incrementally. Once the
-# remaining failures are cleaned up, drop `continue-on-error: true` and
-# add `test-cross` to required checks to make cross-platform green a
-# hard merge gate.
-#
-# main pushes skip test-cross to keep private-repo billing predictable
-# (macos-latest is 10x and windows-latest is 2x the ubuntu rate).
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: test-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22' # engines: node >=22.12
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests (node --test)
-        run: npm test
-
-  test-cross:
-    # Advisory cross-platform run: PR-only (skips main push to save billing),
-    # continue-on-error so a known Win/Mac regression does not block merge
-    # while the suite is being hardened. Reviewers still see the result and
-    # can opt-in to wait for a fix on a per-PR basis.
-    if: github.event_name == 'pull_request'
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: npm
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests (node --test)
-        run: npm test