chain-insights 0.2.31 → 0.3.3

package/dist/cli.mjs

@@ -19,12 +19,16 @@ if (installerFlags.length > 0 && !rawArgs.some((a) => !a.startsWith("-"))) {
 	}
 	process.exit(0);
 }
-if (rawArgs[0] === "mcp" && rawArgs[1] === "trace-funds") {
-	console.error("error: unknown command 'trace-funds'");
+if (rawArgs[0] === "mcp" && [
+	"trace-funds",
+	"track-funds",
+	"scam-topology"
+].includes(rawArgs[1] ?? "")) {
+	console.error(`error: unknown command '${rawArgs[1]}'`);
 	process.exit(1);
 }
 async function resolveCaseSelector(input) {
-	const { resolveCaseSelector } = await import("./selector-CTUiQrzI.mjs");
+	const { resolveCaseSelector } = await import("./selector-CF2o5gxN.mjs");
 	return resolveCaseSelector(input);
 }
 async function scopeCasesToInvocationDir() {
@@ -33,7 +37,7 @@ async function scopeCasesToInvocationDir() {
 	process.env["CHAIN_INSIGHTS_CASES_ROOT"] = activeCasesRoot();
 }
 async function showCaseContext(caseSelector) {
-	const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+	const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 	const caseId = await resolveCaseSelector(caseSelector);
 	const ctx = await CaseStore.loadContext(caseId);
 	console.log(`\n=== Case: ${ctx.case.id} ===`);
@@ -63,11 +67,6 @@ function optionalNumberArg(value, name) {
 	if (typeof value === "string") return optionalNumber(value);
 	throw new Error(`Invalid number for ${name}: ${String(value)}`);
 }
-function optionalScamTopologyActivityPolicy(value) {
-	if (value === void 0 || value === null || value === "") return void 0;
-	if (value === "node_relative_only" || value === "global_incident_only") return value;
-	throw new Error("activity_policy must be one of: node_relative_only, global_incident_only");
-}
 async function withGraphMcpClient(name, fn) {
 	const { loadConfig } = await import("./config-Drgc2HuF.mjs").then((n) => n.t);
 	const config = await loadConfig();
@@ -213,7 +212,7 @@ program.command("access-key").description("Configure Graph MCP test access key m
 }));
 program.command("init").description("Initialize an investigation workspace").argument("[dir]", "Workspace directory to initialize", ".").option("--force", "Overwrite existing workspace files").action(async (dir, opts) => {
 	try {
-		const { initWorkspace } = await import("./init-DBC9Ml33.mjs");
+		const { initWorkspace } = await import("./init-DLBL_nVG.mjs");
 		const result = await initWorkspace({
 			targetDir: dir,
 			force: opts.force
@@ -361,7 +360,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 	try {
 		const { loadSchema, saveSchema } = await import("./schema-cache-DwDvPy4e.mjs");
 		const { formatToolsTable } = await import("./format-Bq94jSyw.mjs");
-		const { visibleRemoteTools } = await import("./tool-visibility-BHRFLXuU.mjs").then((n) => n.n);
+		const { visibleRemoteTools } = await import("./tool-visibility-BpyZHRBi.mjs").then((n) => n.n);
 		const { loadConfig } = await import("./config-Drgc2HuF.mjs").then((n) => n.t);
 		const { createConfiguredGraphMcpFetch, resolveGraphMcpEndpoint } = await import("./client-D4JE7fFF.mjs").then((n) => n.n);
 		const config = await loadConfig();
@@ -402,7 +401,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				}));
 				return;
 			}
-			const { addressRisk } = await import("./public-tools-DoRNhMn9.mjs");
+			const { addressRisk } = await import("./public-tools-wJoAFDFa.mjs");
 			const result = await addressRisk(client, {
 				address: opts.address,
 				network: opts.network,
@@ -414,29 +413,30 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 		console.error(err.message);
 		process.exit(1);
 	}
-})).addCommand(new Command("track-funds").description("Trace trusted/victim addresses and optional known untrusted/scammer addresses").requiredOption("--trusted-addresses <addresses>", "Comma-separated full trusted/victim addresses, max 5").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--untrusted-addresses <addresses>", "Comma-separated full known untrusted/scammer addresses, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").option("--max-hops <number>", "Maximum trace hops, 1-5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--remote", "Force remote MCP tool call instead of local Chain Insights recipe").action(async (opts) => {
+})).addCommand(new Command("trace-victim-funds").description("Trace victim/source addresses forward to exchange deposit candidates").requiredOption("--victim-addresses <addresses>", "Comma-separated full victim/source addresses, max 5").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--known-suspect-addresses <addresses>", "Optional known suspect addresses for context only, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").option("--incident-timestamp-ms <milliseconds>", "Optional incident timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, 1-5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--remote", "Force remote MCP tool call instead of local Chain Insights recipe").action(async (opts) => {
 	try {
 		const { requireWorkspaceRoot } = await import("./output-root-BRhzhhXZ.mjs").then((n) => n.t);
 		requireWorkspaceRoot();
-		await withGraphMcpClient("chain-insights-cli-track-funds", async (client, config) => {
+		await withGraphMcpClient("chain-insights-cli-trace-victim-funds", async (client, config) => {
 			if (opts.remote) {
 				printMcpTextContent(await client.callTool({
-					name: "track_funds",
+					name: "trace_victim_funds",
 					arguments: {
-						trusted_addresses: opts.trustedAddresses,
+						victim_addresses: opts.victimAddresses,
 						network: opts.network,
-						...opts.untrustedAddresses ? { untrusted_addresses: opts.untrustedAddresses } : {}
+						...opts.knownSuspectAddresses ? { known_suspect_addresses: opts.knownSuspectAddresses } : {}
 					}
 				}));
 				return;
 			}
-			const { trackFunds } = await import("./public-tools-DoRNhMn9.mjs");
+			const { traceVictimFunds } = await import("./public-tools-wJoAFDFa.mjs");
 			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
-			const result = await trackFunds(client, config, {
-				trustedAddresses: opts.trustedAddresses,
-				untrustedAddresses: opts.untrustedAddresses,
+			const result = await traceVictimFunds(client, config, {
+				victimAddresses: opts.victimAddresses,
+				knownSuspectAddresses: opts.knownSuspectAddresses,
 				network: opts.network,
 				caseId,
+				incidentTimestampMs: optionalNumber(opts.incidentTimestampMs),
 				maxHops: optionalNumber(opts.maxHops),
 				perAddressLimit: optionalNumber(opts.perAddressLimit),
 				minAmountSum: optionalNumber(opts.minAmountSum)
@@ -448,21 +448,40 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 		console.error(err.message);
 		process.exit(1);
 	}
-})).addCommand(new Command("scam-topology").description("Build victim-incident scam topology and ML-ready scam labels").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--victim-address <address>", "Full victim/source address that anchors the incident").requiredOption("--incident-timestamp-ms <milliseconds>", "Earliest known incident transfer timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, default 16, max 64").option("--activity-policy <mode>", "Traversal activity policy: node_relative_only or global_incident_only", "node_relative_only").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
+})).addCommand(new Command("trace-suspect-funds").description("Trace suspected scammer, mule, operator, or laundering-ring addresses forward to cashout topology").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--suspect-addresses <addresses>", "Comma-separated full suspect-controlled addresses, max 5").option("--incident-timestamp-ms <milliseconds>", "Optional incident timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, default 3, max 5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
+	try {
+		const { requireWorkspaceRoot } = await import("./output-root-BRhzhhXZ.mjs").then((n) => n.t);
+		requireWorkspaceRoot();
+		await withGraphMcpClient("chain-insights-cli-trace-suspect-funds", async (client, config) => {
+			const { traceSuspectFunds } = await import("./public-tools-wJoAFDFa.mjs");
+			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
+			const result = await traceSuspectFunds(client, config, {
+				suspectAddresses: opts.suspectAddresses,
+				network: opts.network,
+				maxHops: optionalNumber(opts.maxHops),
+				perAddressLimit: optionalNumber(opts.perAddressLimit),
+				minAmountSum: optionalNumber(opts.minAmountSum),
+				incidentTimestampMs: optionalNumber(opts.incidentTimestampMs),
+				caseId
+			});
+			console.log(result.summaryText);
+			console.log(JSON.stringify(result.structuredContent, null, 2));
+		});
+	} catch (err) {
+		console.error(err.message);
+		process.exit(1);
+	}
+})).addCommand(new Command("trace-deposit-sources").description("Trace backward from suspected deposit/cashout addresses to upstream sources and convergence").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--deposit-addresses <addresses>", "Comma-separated full suspected deposit/cashout addresses, max 5").option("--max-hops <number>", "Maximum reverse traceback hops, default 2, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
 	try {
 		const { requireWorkspaceRoot } = await import("./output-root-BRhzhhXZ.mjs").then((n) => n.t);
 		requireWorkspaceRoot();
-		await withGraphMcpClient("chain-insights-cli-scam-topology", async (client, config) => {
-			const { scamTopology } = await import("./public-tools-DoRNhMn9.mjs");
-			const incidentTimestampMs = optionalNumber(opts.incidentTimestampMs);
-			if (incidentTimestampMs === void 0) throw new Error("incident-timestamp-ms is required");
+		await withGraphMcpClient("chain-insights-cli-trace-deposit-sources", async (client, config) => {
+			const { traceDepositSources } = await import("./public-tools-wJoAFDFa.mjs");
 			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
-			const result = await scamTopology(client, config, {
-				victimAddress: opts.victimAddress,
+			const result = await traceDepositSources(client, config, {
+				depositAddresses: opts.depositAddresses,
 				network: opts.network,
 				maxHops: optionalNumber(opts.maxHops),
-				incidentTimestampMs,
-				activityPolicyMode: optionalScamTopologyActivityPolicy(opts.activityPolicy),
 				caseId
 			});
 			console.log(result.summaryText);
@@ -475,7 +494,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 })).addCommand(new Command("stake-insights").description("Explain Bittensor staking behavior around an address, coldkey, or hotkey").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--address <address>", "Full Bittensor address to inspect as either coldkey or hotkey").option("--coldkey <address>", "Full Bittensor coldkey address to inspect").option("--hotkey <address>", "Full Bittensor hotkey address to inspect").option("--netuid <number>", "Optional subnet netuid filter").option("--start-timestamp-ms <milliseconds>", "Optional inclusive lower activity timestamp bound").option("--end-timestamp-ms <milliseconds>", "Optional inclusive upper activity timestamp bound").option("--start-block <number>", "Optional start block. Current stake graph parity may require timestamp windows instead.").option("--end-block <number>", "Optional end block. Current stake graph parity may require timestamp windows instead.").option("--depth <number>", "Optional expansion depth limit, default 1, max 3").action(async (opts) => {
 	try {
 		await withGraphMcpClient("chain-insights-cli-stake-insights", async (client) => {
-			const { stakeInsights } = await import("./public-tools-DoRNhMn9.mjs");
+			const { stakeInsights } = await import("./public-tools-wJoAFDFa.mjs");
 			const result = await stakeInsights(client, {
 				network: opts.network,
 				address: opts.address,
@@ -498,12 +517,12 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 })).addCommand(new Command("call").description("Call an MCP tool directly (debug)").argument("<tool>", "Tool name to call").argument("[args...]", "Key=value arguments (e.g. address=0x1234 chain=ethereum)").action(async (tool, rawArgs) => {
 	try {
 		const { parseMcpCallArgs } = await import("./call-args-DPXdX3_D.mjs");
-		const { assertPublicMcpToolName } = await import("./tool-visibility-BHRFLXuU.mjs").then((n) => n.n);
+		const { assertPublicMcpToolName } = await import("./tool-visibility-BpyZHRBi.mjs").then((n) => n.n);
 		const args = parseMcpCallArgs(rawArgs);
 		assertPublicMcpToolName(tool);
 		await withGraphMcpClient("chain-insights-cli-call", async (client, config) => {
 			if (tool === "address_risk") {
-				const { addressRisk } = await import("./public-tools-DoRNhMn9.mjs");
+				const { addressRisk } = await import("./public-tools-wJoAFDFa.mjs");
 				const result = await addressRisk(client, {
 					address: String(args["address"] ?? ""),
 					network: String(args["network"] ?? ""),
@@ -512,13 +531,14 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				console.log(result.summaryText);
 				return;
 			}
-			if (tool === "track_funds") {
-				const { trackFunds } = await import("./public-tools-DoRNhMn9.mjs");
-				const result = await trackFunds(client, config, {
-					trustedAddresses: args["trusted_addresses"] ?? "",
-					untrustedAddresses: args["untrusted_addresses"],
+			if (tool === "trace_victim_funds") {
+				const { traceVictimFunds } = await import("./public-tools-wJoAFDFa.mjs");
+				const result = await traceVictimFunds(client, config, {
+					victimAddresses: args["victim_addresses"] ?? "",
+					knownSuspectAddresses: args["known_suspect_addresses"],
 					network: String(args["network"] ?? ""),
 					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
+					incidentTimestampMs: optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms"),
 					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0,
 					perAddressLimit: typeof args["per_address_limit"] === "number" ? args["per_address_limit"] : void 0,
 					minAmountSum: typeof args["min_amount_sum"] === "number" ? args["min_amount_sum"] : void 0
@@ -527,26 +547,35 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				console.log(JSON.stringify(result.structuredContent, null, 2));
 				return;
 			}
-			if (tool === "scam_topology") {
-				const { scamTopology } = await import("./public-tools-DoRNhMn9.mjs");
-				const victimAddress = String(args["victim_address"] ?? "").trim();
-				if (!victimAddress) throw new Error("victim_address is required");
-				const incidentTimestampMs = optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms");
-				if (incidentTimestampMs === void 0) throw new Error("incident_timestamp_ms is required");
-				const result = await scamTopology(client, config, {
-					victimAddress,
+			if (tool === "trace_suspect_funds") {
+				const { traceSuspectFunds } = await import("./public-tools-wJoAFDFa.mjs");
+				const result = await traceSuspectFunds(client, config, {
+					suspectAddresses: args["suspect_addresses"] ?? "",
 					network: String(args["network"] ?? ""),
 					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
 					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0,
-					incidentTimestampMs,
-					activityPolicyMode: optionalScamTopologyActivityPolicy(args["activity_policy"])
+					perAddressLimit: typeof args["per_address_limit"] === "number" ? args["per_address_limit"] : void 0,
+					minAmountSum: typeof args["min_amount_sum"] === "number" ? args["min_amount_sum"] : void 0,
+					incidentTimestampMs: optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms")
+				});
+				console.log(result.summaryText);
+				console.log(JSON.stringify(result.structuredContent, null, 2));
+				return;
+			}
+			if (tool === "trace_deposit_sources") {
+				const { traceDepositSources } = await import("./public-tools-wJoAFDFa.mjs");
+				const result = await traceDepositSources(client, config, {
+					depositAddresses: args["deposit_addresses"] ?? "",
+					network: String(args["network"] ?? ""),
+					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
+					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0
 				});
 				console.log(result.summaryText);
 				console.log(JSON.stringify(result.structuredContent, null, 2));
 				return;
 			}
 			if (tool === "stake_insights") {
-				const { stakeInsights } = await import("./public-tools-DoRNhMn9.mjs");
+				const { stakeInsights } = await import("./public-tools-wJoAFDFa.mjs");
 				const result = await stakeInsights(client, {
 					network: String(args["network"] ?? ""),
 					address: args["address"] === void 0 ? void 0 : String(args["address"]),
@@ -578,14 +607,14 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 }).addCommand(new Command("open").description("Open a new investigation case").argument("<name>", "Case name (e.g. \"Tornado Mixer Investigation\")").option("--tags <tags>", "Comma-separated tags (e.g. aml,mixer,defi)", "").option("--description <desc>", "Brief description of the investigation", "").action(async (name, opts) => {
 	try {
 		if (/^[1-9]\d*$/.test(name.trim())) throw new Error("Numeric case names look like list selectors. Use a descriptive case name, e.g. `cia case open \"Tracking stolen funds from <address>\"`.");
-		const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+		const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 		const tags = opts.tags ? opts.tags.split(",").map((t) => t.trim()).filter(Boolean) : [];
 		const c = await CaseStore.create({
 			name,
 			tags,
 			description: opts.description
 		});
-		const { casesRoot } = await import("./store-BT2SCcQr.mjs");
+		const { casesRoot } = await import("./store-CTtqQtaE.mjs").then((n) => n.r);
 		console.log(`Case opened: ${c.id}`);
 		console.log(`Directory:   ${path.join(casesRoot(), c.id)}/`);
 		console.log(`Status:      ${c.status}`);
@@ -595,7 +624,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("activate").description("Activate a case (set status to active)").argument("<case-id>", "Case ID to activate").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+		const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "active");
 		console.log(`Case ${c.id} is now: active`);
@@ -605,7 +634,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("suspend").description("Suspend a case (set status to suspended)").argument("<case-id>", "Case ID to suspend").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+		const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "suspended");
 		console.log(`Case ${c.id} is now: suspended`);
@@ -615,7 +644,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("close").description("Close a case permanently").argument("<case-id>", "Case ID to close").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+		const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "closed");
 		console.log(`Case ${c.id} is now: closed`);
@@ -625,7 +654,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("list").description("List all investigation cases").option("--status <status>", "Filter by status (open|active|suspended|closed)").action(async (opts) => {
 	try {
-		const { CaseStore } = await import("./cases-qjPtbnUd.mjs");
+		const { CaseStore } = await import("./cases-Cp9DUbEV.mjs");
 		const cases = await CaseStore.list();
 		const filtered = opts.status ? cases.filter((c) => c.status === opts.status) : cases;
 		if (filtered.length === 0) {
@@ -639,7 +668,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("evidence").description("Manage case evidence").addCommand(new Command("add").description("Add evidence to a case from an MCP query result").argument("<case-id>", "Case ID to add evidence to").option("--source <tool>", "MCP tool name that produced this evidence", "manual").option("--content <text>", "Evidence content (MCP response or notes)", "").option("--query-params <params>", "Query parameters used (e.g. address=0x1234)", "").action(async (caseSelector, opts) => {
 	try {
-		const { EvidenceStore } = await import("./cases-qjPtbnUd.mjs");
+		const { EvidenceStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const result = await EvidenceStore.append(caseId, {
 			source: opts.source,
@@ -654,7 +683,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("verify").description("Verify evidence manifest integrity for a case").argument("<case-id>", "Case ID to verify").action(async (caseSelector) => {
 	try {
-		const { EvidenceStore } = await import("./cases-qjPtbnUd.mjs");
+		const { EvidenceStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const result = await EvidenceStore.verifyManifest(caseId);
 		if (result.ok) console.log(`Manifest OK — ${result.count} evidence file(s) verified`);
@@ -668,7 +697,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 }))).addCommand(new Command("dossier").description("Manage entity dossiers for a case").addCommand(new Command("update").description("Append a finding to an entity dossier").argument("<case-id>", "Case ID").argument("<address>", "Entity address or identifier").option("--finding <text>", "Finding to append to the dossier", "").option("--type <type>", "Entity type (eoa|contract|exchange|mixer|unknown)", "unknown").action(async (caseSelector, address, opts) => {
 	try {
-		const { DossierStore } = await import("./cases-qjPtbnUd.mjs");
+		const { DossierStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const entityType = [
 			"eoa",
@@ -685,7 +714,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 }))).addCommand(new Command("session").description("Manage investigation sessions").addCommand(new Command("start").description("Start a new investigation session for a case").argument("<case-id>", "Case ID").argument("[title...]", "Optional session title").action(async (caseSelector, titleParts) => {
 	try {
-		const { SessionStore } = await import("./cases-qjPtbnUd.mjs");
+		const { SessionStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		const title = titleParts.join(" ").trim();
 		const s = await SessionStore.start(caseId, title ? { title } : {});
@@ -696,7 +725,7 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 	}
 })).addCommand(new Command("end").description("End the current session with findings and next steps").argument("<case-id>", "Case ID").option("--findings <text>", "Key findings from this session", "").option("--next-steps <text>", "Next steps for the investigation", "").action(async (caseSelector, opts) => {
 	try {
-		const { SessionStore } = await import("./cases-qjPtbnUd.mjs");
+		const { SessionStore } = await import("./cases-Cp9DUbEV.mjs");
 		const caseId = await resolveCaseSelector(caseSelector);
 		await SessionStore.end(caseId, {
 			findings: opts.findings,
@@ -708,7 +737,34 @@ const caseCommand = new Command("case").description("Manage investigation cases"
 		console.error(err.message);
 		process.exit(1);
 	}
-}))).addCommand(new Command("show").description("Show saved case context").argument("<case-id>", "Case ID or case list number to show").action(async (caseSelector) => {
+}))).addCommand(new Command("export").description("Export a case for Obsidian, LLMWiki, and agents").argument("<case-id>", "Case ID or case list number to export").option("--target <target>", "Export target: obsidian-llmwiki", "obsidian-llmwiki").option("--mode <mode>", "Redaction mode: private|partner|public", "private").option("--out <directory>", "Output directory. Defaults to published/<case-slug>").action(async (caseSelector, opts) => {
+	try {
+		const target = opts.target === "obsidian-llmwiki" ? opts.target : void 0;
+		const mode = [
+			"private",
+			"partner",
+			"public"
+		].includes(opts.mode) ? opts.mode : void 0;
+		if (!target) throw new Error(`Unsupported export target: ${opts.target}`);
+		if (!mode) throw new Error(`Unsupported export mode: ${opts.mode}`);
+		const caseId = await resolveCaseSelector(caseSelector);
+		const { exportCase } = await import("./export-BqTCO9lP.mjs");
+		const result = await exportCase({
+			caseId,
+			target,
+			mode,
+			outputDir: opts.out
+		});
+		console.log(`Case exported: ${result.outputDir}`);
+		console.log(`Manifest:      ${result.manifestPath}`);
+		console.log(`Files:         ${result.fileCount}`);
+		console.log(`Open first:    ${result.nextFile}`);
+		for (const warning of result.warnings) console.warn(`Warning: ${warning}`);
+	} catch (err) {
+		console.error(err.message);
+		process.exit(1);
+	}
+})).addCommand(new Command("show").description("Show saved case context").argument("<case-id>", "Case ID or case list number to show").action(async (caseSelector) => {
 	try {
 		await showCaseContext(caseSelector);
 	} catch (err) {
@@ -733,7 +789,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 			}
 			resolvedParams[key] = kv.slice(eq + 1);
 		}
-		const { resolvePlaybookContent } = await import("./resolver-D7VBb0uB.mjs");
+		const { resolvePlaybookContent } = await import("./resolver-2jXNtWQO.mjs");
 		const markdown = await resolvePlaybookContent(name);
 		const { PlaybookParser } = await import("./parser-CJfMsOl6.mjs");
 		const definition = PlaybookParser.parse(markdown, resolvedParams);
@@ -746,7 +802,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 			console.error(`Invalid --from value: "${opts.from}". Must be a positive integer.`);
 			process.exit(1);
 		}
-		const { PlaybookRunner } = await import("./runner-CTFK0Qcg.mjs");
+		const { PlaybookRunner } = await import("./runner-DIJSbkjc.mjs");
 		await PlaybookRunner.run(definition, {
 			caseId: opts.case,
 			from: fromN,
@@ -759,7 +815,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 	}
 })).addCommand(new Command("list").description("List available playbooks (built-in and user-defined)").action(async () => {
 	try {
-		const { listPlaybooks } = await import("./resolver-D7VBb0uB.mjs");
+		const { listPlaybooks } = await import("./resolver-2jXNtWQO.mjs");
 		const playbooks = await listPlaybooks();
 		if (playbooks.length === 0) {
 			console.log("No playbooks found.");
@@ -772,7 +828,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 	}
 })).addCommand(new Command("show").description("Show steps for a playbook without executing").argument("<name>", "Playbook name").action(async (name) => {
 	try {
-		const { resolvePlaybookContent } = await import("./resolver-D7VBb0uB.mjs");
+		const { resolvePlaybookContent } = await import("./resolver-2jXNtWQO.mjs");
 		const { PlaybookParser } = await import("./parser-CJfMsOl6.mjs");
 		const markdown = await resolvePlaybookContent(name);
 		const definition = PlaybookParser.parse(markdown, {});
@@ -796,7 +852,7 @@ program.command("viz").description("Generate money flow visualization").argument
 			console.error("Provide either a case ID or --data <file.json>");
 			process.exit(1);
 		}
-		const { generateVisualization } = await import("./viz-DkJyqlUu.mjs").then((n) => n.n);
+		const { generateVisualization } = await import("./viz-5y24S5X1.mjs").then((n) => n.n);
 		const result = await generateVisualization({
 			caseId,
 			dataFile: opts.data