chain-insights 0.2.32 → 0.3.3

package/dist/index.cjs

@@ -6,7 +6,7 @@ const require_wallet = require("./wallet-gC2jxh7j.cjs");
 const require_tools = require("./tools-BhTI3Lmg.cjs");
 const require_topup_server = require("./topup-server-DhYlOOBM.cjs");
 const require_client = require("./client-Db6IV1tv.cjs");
-const require_viz = require("./viz-Da9YWN_I.cjs");
+const require_viz = require("./viz-Dqp3C5kb.cjs");
 exports.buildTopupInfo = require_tools.buildTopupInfo;
 exports.createApp = require_app.createApp;
 exports.createMcpFetchClient = require_client.createMcpFetchClient;

package/dist/index.mjs

@@ -5,5 +5,5 @@ import { a as setWalletPrivateKey, i as normalizeWalletPrivateKey, n as encryptK
 import { a as getWalletAccount, i as getBalanceUsdc, n as formatWalletBalance, o as getWalletBalanceText, r as getBalanceEth, t as buildTopupInfo } from "./tools-v6kcdojg.mjs";
 import { i as generateArtifactHtml, n as startTopupServer, t as getTopupUrl } from "./topup-server-R3dNp-p8.mjs";
 import { i as createMcpFetchClient } from "./client-D4JE7fFF.mjs";
-import { t as generateVisualization } from "./viz-DkJyqlUu.mjs";
+import { t as generateVisualization } from "./viz-5y24S5X1.mjs";
 export { buildTopupInfo, createApp, createMcpFetchClient, decryptKey, encryptKey, formatWalletBalance, generateArtifactHtml, generateVisualization, getBalanceEth, getBalanceUsdc, getTopupUrl, getWalletAccount, getWalletBalanceText, isWalletConfigured, loadConfig, normalizeWalletPrivateKey, resetConfigCache, saveConfig, setWalletPrivateKey, startServer, startTopupServer, walletAddressFromPrivateKey };

package/dist/{init-DBC9Ml33.mjs → init-DLBL_nVG.mjs}

@@ -158,11 +158,37 @@ Rules:
 - Keep evidence compact: select only the fields needed to support the claim.
   Avoid storing whole node or relationship property blobs in evidence unless
   the purpose of the query is schema discovery or debugging.
+- When using BFS, fixed-depth traversal fallbacks, or any manual \`FLOWS_TO\`
+  traversal, treat exchange hot wallets as terminal endpoints only. Do not
+  expand from, through, or classify exchange nodes as deposit, suspect, or
+  intermediate candidates. In Cypher, require every non-terminal traversal node
+  to satisfy \`is_exchange IS NULL\`; only the final exchange endpoint should
+  satisfy \`is_exchange IS NOT NULL\`.
 - Keep analysis products separate from evidence: graph JSON belongs under
   \`reports/graphs/\`, tabular extracts under \`reports/tables/\`, and analyst
   narrative under \`reports/\`.
 - Evidence Markdown should be a short provenance record with key facts and
   pointers. Large JSON belongs in \`reports/tables/\`, not inline in evidence.
+
+Trace tool chaining:
+
+1. Use \`trace_victim_funds\` when the user gives victim/source addresses.
+2. Pass returned \`continuation.candidate_deposit_addresses\` to
+   \`trace_deposit_sources\`; do not make victim tracing run deposit traceback
+   internally.
+3. Pass high-confidence \`continuation.candidate_suspect_addresses\` from
+   deposit traceback to \`trace_suspect_funds\`.
+4. Use \`trace_suspect_funds\` when the user gives suspected scammer, mule,
+   operator, or laundering-ring addresses. \`incident_timestamp_ms\` is
+   optional.
+5. Use \`address_risk\` for single-address enrichment, and
+   \`graph_query_batch\` only when the role-specific tools do not answer the
+   exact question.
+
+All trace tools return \`chain-insights.trace.v1\`. Preserve full addresses in
+\`input.addresses\`, \`addresses[].address\`, \`edges[].from_address\`,
+\`edges[].to_address\`, \`paths[].addresses\`, \`candidate_labels[].address\`,
+and \`continuation\` address lists.
 `;
 const SCHEMA_README = `# Runtime Schema Captures
 
@@ -229,4 +255,4 @@ async function initWorkspace(options) {
 //#endregion
 export { initWorkspace };
 
-//# sourceMappingURL=init-DBC9Ml33.mjs.map
+//# sourceMappingURL=init-DLBL_nVG.mjs.map

package/dist/{init-DBC9Ml33.mjs.map → init-DLBL_nVG.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"init-DBC9Ml33.mjs","names":[],"sources":["../src/workspace/init.ts"],"sourcesContent":["import { access, mkdir, writeFile } from 'node:fs/promises'\nimport path from 'node:path'\nimport { LOCAL_GRAPH_MCP_ENDPOINT } from '../config/mcp-endpoint.js'\n\nexport interface InitWorkspaceOptions {\n  targetDir: string\n  force?: boolean\n}\n\nexport interface InitWorkspaceResult {\n  workspaceRoot: string\n  filesWritten: string[]\n}\n\nconst WORKSPACE_DIRS = [\n  '.chain-insights',\n  '.chain-insights/schema',\n  '.chain-insights/runtime',\n  '.chain-insights/runtime/logs',\n  '.chain-insights/runtime-skill',\n  'cases',\n  'imports',\n  'reports',\n  'reports/graphs',\n  'reports/tables',\n  'templates',\n]\n\nfunction todayIso(): string {\n  return new Date().toISOString().slice(0, 10)\n}\n\nfunction workspaceJson(workspaceRoot: string): string {\n  return JSON.stringify({\n    schema: 'chain-insights.workspace.v1',\n    name: 'Chain Insights Investigations',\n    workspace_root: workspaceRoot,\n    default_network: 'bittensor',\n    graph_mcp_endpoint: LOCAL_GRAPH_MCP_ENDPOINT,\n    cases_dir: 'cases',\n    imports_dir: 'imports',\n    reports_dir: 'reports',\n    templates_dir: 'templates',\n    created_at: todayIso(),\n  }, null, 2) + '\\n'\n}\n\nconst README = `# Chain Insights Investigations\n\nThis is a workspace for Chain Insights AML investigations.\n\n## Start\n\n\\`\\`\\`bash\nchain-insights mcp tools --refresh\nchain-insights wallet ready --check-only\n\\`\\`\\`\n\n## Layout\n\n\\`\\`\\`text\n.chain-insights/   Workspace metadata\ncases/             Case exports and notes\nimports/           External reports, CSVs, screenshots, raw notes\nreports/           Final or interim analyst reports\nreports/graphs/    Graph JSON for visualization\nreports/tables/    Compact tabular extracts\ntemplates/         Reusable case/report templates\n.chain-insights/schema/         Runtime graph schema captures\n.chain-insights/runtime/        Workspace-local runtime process state and debug logs\n.chain-insights/runtime-skill/  Workspace-specific agent schema notes\n\\`\\`\\`\n`\n\nconst AGENTS = `# Agent Instructions\n\nYou are operating inside a Chain Insights investigation workspace.\n\n- Read README.md first.\n- If this directory is not initialized, run \\`cia init .\\` before investigation-producing commands.\n- Do not rerun init in an existing workspace unless replacing scaffolding with \\`--force\\`.\n- Read .chain-insights/runtime-skill/SKILL.md before graph queries.\n- Preserve full blockchain addresses exactly.\n- Do not guess the network for graph queries.\n- Capture or refresh graph schema before the first case query.\n- Save compact evidence with original graph field names.\n- Put canonical graph JSON in reports/graphs/ and analyst tables in reports/tables/.\n- Evidence files should summarize and point to graph/table outputs; do not paste large raw JSON blobs into evidence Markdown.\n- Investigation output must stay in this initialized workspace.\n- Never write cases, evidence, reports, graph JSON, HTML, schema captures, or logs to ~/.chain-insights.\n- Keep theories lightweight until evidence supports them.\n`\n\nconst CLAUDE = AGENTS\n\nconst CASE_BRIEF = `# Case Brief\n\n## Summary\n\nStatus:\nNetwork:\nCurrent Assessment:\n\n## Known Addresses\n\n## Claims To Validate\n\n## Evidence\n\n## Next Steps\n`\n\nconst IMPORTS_README = `# External Investigation Inputs\n\nPut user-provided or third-party investigation material here before turning it\ninto case evidence.\n\nExamples:\n\n- Exchange support exports\n- CSV extracts\n- Screenshots\n- Raw notes\n- Partner reports\n\nFiles in this directory are inputs, not verified evidence. When an import\nsupports a claim, summarize it into the case evidence manifest and reference\nthe original file path.\n`\n\nconst TEMPLATES_README = `# Reusable Workspace Templates\n\nStore local report, case, prompt, and evidence templates here.\n\nTemplates are optional workspace helpers. They are not evidence and should not\nbe treated as case state until copied into a case, evidence file, dossier, or\nreport.\n`\n\nconst RUNTIME_SKILL = `---\nname: chain-insights-runtime-schema\ndescription: Workspace-local Chain Insights runtime schema notes. Refresh this after connecting to a graph MCP endpoint.\n---\n\n# Runtime Graph Schema\n\nBefore the first investigation query, capture the live graph schema into:\n\n\\`\\`\\`text\n.chain-insights/schema/<network>.graph-schema.json\n\\`\\`\\`\n\nUse \\`graph_query_batch\\` for schema capture. Prefix current topology reads\nwith \\`USE live_topology\\`, historical topology reads with\n\\`USE archive_topology\\`, and fact reads with \\`USE facts\\`, for example:\n\n\\`\\`\\`bash\ncia mcp call graph_query_batch network=<network> 'queries=[{\"id\":\"node_labels\",\"query\":\"USE live_topology MATCH (n:Address) RETURN \\\"Address\\\" AS node_label, count(n) AS sample_count LIMIT 1\"},{\"id\":\"archive_flow_sample\",\"query\":\"USE archive_topology MATCH (:Address)-[f:FLOWS_TO]->(:Address) RETURN f.period_granularity AS granularity, f.amount_sum AS amount_sum LIMIT 20\"}]'\n\\`\\`\\`\n\nThen update this file with observed labels, relationship types, and allowed\nproperty names for the active network.\n\nRules:\n\n- Prefer \\`graph_query\\` and \\`graph_query_batch\\` for graph-language reads.\n- Use \\`USE live_topology\\` for recent topology, \\`USE archive_topology\\`\n  for historical topology, and \\`USE facts\\` for labels, features,\n  risk scores, assets, and enrichment. Address facts can be reached through\n  relationships such as \\`(:Address)-[:HAS_FEATURE]->(:AddressFeature)\\`.\n  Archived money-flow topology is exposed as\n  \\`(:Address)-[:FLOWS_TO]->(:Address)\\` with \\`period_granularity\\`,\n  \\`period_start_date\\`, and \\`period_end_date\\` on the relationship.\n- Preserve source schema field names in evidence and generated data files.\n- Do not rename, reinterpret, or add unit labels to graph fields unless the\n  schema or query result explicitly supports that interpretation.\n- Keep evidence compact: select only the fields needed to support the claim.\n  Avoid storing whole node or relationship property blobs in evidence unless\n  the purpose of the query is schema discovery or debugging.\n- Keep analysis products separate from evidence: graph JSON belongs under\n  \\`reports/graphs/\\`, tabular extracts under \\`reports/tables/\\`, and analyst\n  narrative under \\`reports/\\`.\n- Evidence Markdown should be a short provenance record with key facts and\n  pointers. Large JSON belongs in \\`reports/tables/\\`, not inline in evidence.\n`\n\nconst SCHEMA_README = `# Runtime Schema Captures\n\nStore graph schema captures here, for example:\n\n\\`\\`\\`text\nbittensor.graph-schema.json\n\\`\\`\\`\n\nSchema captures should be generated before the first case query in a fresh\nworkspace, then referenced by evidence, reports, and runtime skill notes.\n`\n\nfunction workspaceFiles(workspaceRoot: string): Array<[string, string]> {\n  return [\n    ['.chain-insights/workspace.json', workspaceJson(workspaceRoot)],\n    ['README.md', README],\n    ['AGENTS.md', AGENTS],\n    ['CLAUDE.md', CLAUDE],\n    ['imports/README.md', IMPORTS_README],\n    ['templates/README.md', TEMPLATES_README],\n    ['templates/case-brief.md', CASE_BRIEF],\n    ['.chain-insights/runtime-skill/SKILL.md', RUNTIME_SKILL],\n    ['.chain-insights/schema/README.md', SCHEMA_README],\n    ['.chain-insights/runtime/.keep', ''],\n    ['.chain-insights/runtime/logs/.keep', ''],\n  ]\n}\n\nasync function assertNoFileCollisions(workspaceRoot: string): Promise<void> {\n  for (const [relativePath] of workspaceFiles(workspaceRoot)) {\n    const filePath = path.join(workspaceRoot, relativePath)\n    try {\n      await access(filePath)\n      throw new Error(`Refusing to overwrite ${filePath}. Re-run with --force to replace workspace files.`)\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        continue\n      }\n      throw err\n    }\n  }\n}\n\nexport async function initWorkspace(options: InitWorkspaceOptions): Promise<InitWorkspaceResult> {\n  const workspaceRoot = path.resolve(options.targetDir)\n  if (!options.force) {\n    await assertNoFileCollisions(workspaceRoot)\n  }\n\n  for (const dir of WORKSPACE_DIRS) {\n    await mkdir(path.join(workspaceRoot, dir), { recursive: true })\n  }\n\n  const filesWritten: string[] = []\n  const flag = options.force ? 'w' : 'wx'\n  for (const [relativePath, content] of workspaceFiles(workspaceRoot)) {\n    const filePath = path.join(workspaceRoot, relativePath)\n    try {\n      await writeFile(filePath, content, { mode: 0o600, flag })\n      filesWritten.push(relativePath)\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'EEXIST') {\n        throw new Error(`Refusing to overwrite ${filePath}. Re-run with --force to replace workspace files.`)\n      }\n      throw err\n    }\n  }\n\n  return { workspaceRoot, filesWritten }\n}\n"],"mappings":";;;;AAcA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,WAAmB;CAC1B,wBAAO,IAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC7C;AAEA,SAAS,cAAc,eAA+B;CACpD,OAAO,KAAK,UAAU;EACpB,QAAQ;EACR,MAAM;EACN,gBAAgB;EAChB,iBAAiB;EACjB,oBAAoB;EACpB,WAAW;EACX,aAAa;EACb,aAAa;EACb,eAAe;EACf,YAAY,SAAS;CACvB,GAAG,MAAM,CAAC,IAAI;AAChB;AAEA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;AA2Bf,MAAM,SAAS;;;;;;;;;;;;;;;;;;AAmBf,MAAM,SAAS;AAEf,MAAM,aAAa;;;;;;;;;;;;;;;;AAiBnB,MAAM,iBAAiB;;;;;;;;;;;;;;;;;AAkBvB,MAAM,mBAAmB;;;;;;;;AASzB,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CtB,MAAM,gBAAgB;;;;;;;;;;;AAYtB,SAAS,eAAe,eAAgD;CACtE,OAAO;EACL,CAAC,kCAAkC,cAAc,aAAa,CAAC;EAC/D,CAAC,aAAa,MAAM;EACpB,CAAC,aAAa,MAAM;EACpB,CAAC,aAAa,MAAM;EACpB,CAAC,qBAAqB,cAAc;EACpC,CAAC,uBAAuB,gBAAgB;EACxC,CAAC,2BAA2B,UAAU;EACtC,CAAC,0CAA0C,aAAa;EACxD,CAAC,oCAAoC,aAAa;EAClD,CAAC,iCAAiC,EAAE;EACpC,CAAC,sCAAsC,EAAE;CAC3C;AACF;AAEA,eAAe,uBAAuB,eAAsC;CAC1E,KAAK,MAAM,CAAC,iBAAiB,eAAe,aAAa,GAAG;EAC1D,MAAM,WAAW,KAAK,KAAK,eAAe,YAAY;EACtD,IAAI;GACF,MAAM,OAAO,QAAQ;GACrB,MAAM,IAAI,MAAM,yBAAyB,SAAS,kDAAkD;EACtG,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,UAC1C;GAEF,MAAM;EACR;CACF;AACF;AAEA,eAAsB,cAAc,SAA6D;CAC/F,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,SAAS;CACpD,IAAI,CAAC,QAAQ,OACX,MAAM,uBAAuB,aAAa;CAG5C,KAAK,MAAM,OAAO,gBAChB,MAAM,MAAM,KAAK,KAAK,eAAe,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;CAGhE,MAAM,eAAyB,CAAC;CAChC,MAAM,OAAO,QAAQ,QAAQ,MAAM;CACnC,KAAK,MAAM,CAAC,cAAc,YAAY,eAAe,aAAa,GAAG;EACnE,MAAM,WAAW,KAAK,KAAK,eAAe,YAAY;EACtD,IAAI;GACF,MAAM,UAAU,UAAU,SAAS;IAAE,MAAM;IAAO;GAAK,CAAC;GACxD,aAAa,KAAK,YAAY;EAChC,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,UAC1C,MAAM,IAAI,MAAM,yBAAyB,SAAS,kDAAkD;GAEtG,MAAM;EACR;CACF;CAEA,OAAO;EAAE;EAAe;CAAa;AACvC"}
+{"version":3,"file":"init-DLBL_nVG.mjs","names":[],"sources":["../src/workspace/init.ts"],"sourcesContent":["import { access, mkdir, writeFile } from 'node:fs/promises'\nimport path from 'node:path'\nimport { LOCAL_GRAPH_MCP_ENDPOINT } from '../config/mcp-endpoint.js'\n\nexport interface InitWorkspaceOptions {\n  targetDir: string\n  force?: boolean\n}\n\nexport interface InitWorkspaceResult {\n  workspaceRoot: string\n  filesWritten: string[]\n}\n\nconst WORKSPACE_DIRS = [\n  '.chain-insights',\n  '.chain-insights/schema',\n  '.chain-insights/runtime',\n  '.chain-insights/runtime/logs',\n  '.chain-insights/runtime-skill',\n  'cases',\n  'imports',\n  'reports',\n  'reports/graphs',\n  'reports/tables',\n  'templates',\n]\n\nfunction todayIso(): string {\n  return new Date().toISOString().slice(0, 10)\n}\n\nfunction workspaceJson(workspaceRoot: string): string {\n  return JSON.stringify({\n    schema: 'chain-insights.workspace.v1',\n    name: 'Chain Insights Investigations',\n    workspace_root: workspaceRoot,\n    default_network: 'bittensor',\n    graph_mcp_endpoint: LOCAL_GRAPH_MCP_ENDPOINT,\n    cases_dir: 'cases',\n    imports_dir: 'imports',\n    reports_dir: 'reports',\n    templates_dir: 'templates',\n    created_at: todayIso(),\n  }, null, 2) + '\\n'\n}\n\nconst README = `# Chain Insights Investigations\n\nThis is a workspace for Chain Insights AML investigations.\n\n## Start\n\n\\`\\`\\`bash\nchain-insights mcp tools --refresh\nchain-insights wallet ready --check-only\n\\`\\`\\`\n\n## Layout\n\n\\`\\`\\`text\n.chain-insights/   Workspace metadata\ncases/             Case exports and notes\nimports/           External reports, CSVs, screenshots, raw notes\nreports/           Final or interim analyst reports\nreports/graphs/    Graph JSON for visualization\nreports/tables/    Compact tabular extracts\ntemplates/         Reusable case/report templates\n.chain-insights/schema/         Runtime graph schema captures\n.chain-insights/runtime/        Workspace-local runtime process state and debug logs\n.chain-insights/runtime-skill/  Workspace-specific agent schema notes\n\\`\\`\\`\n`\n\nconst AGENTS = `# Agent Instructions\n\nYou are operating inside a Chain Insights investigation workspace.\n\n- Read README.md first.\n- If this directory is not initialized, run \\`cia init .\\` before investigation-producing commands.\n- Do not rerun init in an existing workspace unless replacing scaffolding with \\`--force\\`.\n- Read .chain-insights/runtime-skill/SKILL.md before graph queries.\n- Preserve full blockchain addresses exactly.\n- Do not guess the network for graph queries.\n- Capture or refresh graph schema before the first case query.\n- Save compact evidence with original graph field names.\n- Put canonical graph JSON in reports/graphs/ and analyst tables in reports/tables/.\n- Evidence files should summarize and point to graph/table outputs; do not paste large raw JSON blobs into evidence Markdown.\n- Investigation output must stay in this initialized workspace.\n- Never write cases, evidence, reports, graph JSON, HTML, schema captures, or logs to ~/.chain-insights.\n- Keep theories lightweight until evidence supports them.\n`\n\nconst CLAUDE = AGENTS\n\nconst CASE_BRIEF = `# Case Brief\n\n## Summary\n\nStatus:\nNetwork:\nCurrent Assessment:\n\n## Known Addresses\n\n## Claims To Validate\n\n## Evidence\n\n## Next Steps\n`\n\nconst IMPORTS_README = `# External Investigation Inputs\n\nPut user-provided or third-party investigation material here before turning it\ninto case evidence.\n\nExamples:\n\n- Exchange support exports\n- CSV extracts\n- Screenshots\n- Raw notes\n- Partner reports\n\nFiles in this directory are inputs, not verified evidence. When an import\nsupports a claim, summarize it into the case evidence manifest and reference\nthe original file path.\n`\n\nconst TEMPLATES_README = `# Reusable Workspace Templates\n\nStore local report, case, prompt, and evidence templates here.\n\nTemplates are optional workspace helpers. They are not evidence and should not\nbe treated as case state until copied into a case, evidence file, dossier, or\nreport.\n`\n\nconst RUNTIME_SKILL = `---\nname: chain-insights-runtime-schema\ndescription: Workspace-local Chain Insights runtime schema notes. Refresh this after connecting to a graph MCP endpoint.\n---\n\n# Runtime Graph Schema\n\nBefore the first investigation query, capture the live graph schema into:\n\n\\`\\`\\`text\n.chain-insights/schema/<network>.graph-schema.json\n\\`\\`\\`\n\nUse \\`graph_query_batch\\` for schema capture. Prefix current topology reads\nwith \\`USE live_topology\\`, historical topology reads with\n\\`USE archive_topology\\`, and fact reads with \\`USE facts\\`, for example:\n\n\\`\\`\\`bash\ncia mcp call graph_query_batch network=<network> 'queries=[{\"id\":\"node_labels\",\"query\":\"USE live_topology MATCH (n:Address) RETURN \\\"Address\\\" AS node_label, count(n) AS sample_count LIMIT 1\"},{\"id\":\"archive_flow_sample\",\"query\":\"USE archive_topology MATCH (:Address)-[f:FLOWS_TO]->(:Address) RETURN f.period_granularity AS granularity, f.amount_sum AS amount_sum LIMIT 20\"}]'\n\\`\\`\\`\n\nThen update this file with observed labels, relationship types, and allowed\nproperty names for the active network.\n\nRules:\n\n- Prefer \\`graph_query\\` and \\`graph_query_batch\\` for graph-language reads.\n- Use \\`USE live_topology\\` for recent topology, \\`USE archive_topology\\`\n  for historical topology, and \\`USE facts\\` for labels, features,\n  risk scores, assets, and enrichment. Address facts can be reached through\n  relationships such as \\`(:Address)-[:HAS_FEATURE]->(:AddressFeature)\\`.\n  Archived money-flow topology is exposed as\n  \\`(:Address)-[:FLOWS_TO]->(:Address)\\` with \\`period_granularity\\`,\n  \\`period_start_date\\`, and \\`period_end_date\\` on the relationship.\n- Preserve source schema field names in evidence and generated data files.\n- Do not rename, reinterpret, or add unit labels to graph fields unless the\n  schema or query result explicitly supports that interpretation.\n- Keep evidence compact: select only the fields needed to support the claim.\n  Avoid storing whole node or relationship property blobs in evidence unless\n  the purpose of the query is schema discovery or debugging.\n- When using BFS, fixed-depth traversal fallbacks, or any manual \\`FLOWS_TO\\`\n  traversal, treat exchange hot wallets as terminal endpoints only. Do not\n  expand from, through, or classify exchange nodes as deposit, suspect, or\n  intermediate candidates. In Cypher, require every non-terminal traversal node\n  to satisfy \\`is_exchange IS NULL\\`; only the final exchange endpoint should\n  satisfy \\`is_exchange IS NOT NULL\\`.\n- Keep analysis products separate from evidence: graph JSON belongs under\n  \\`reports/graphs/\\`, tabular extracts under \\`reports/tables/\\`, and analyst\n  narrative under \\`reports/\\`.\n- Evidence Markdown should be a short provenance record with key facts and\n  pointers. Large JSON belongs in \\`reports/tables/\\`, not inline in evidence.\n\nTrace tool chaining:\n\n1. Use \\`trace_victim_funds\\` when the user gives victim/source addresses.\n2. Pass returned \\`continuation.candidate_deposit_addresses\\` to\n   \\`trace_deposit_sources\\`; do not make victim tracing run deposit traceback\n   internally.\n3. Pass high-confidence \\`continuation.candidate_suspect_addresses\\` from\n   deposit traceback to \\`trace_suspect_funds\\`.\n4. Use \\`trace_suspect_funds\\` when the user gives suspected scammer, mule,\n   operator, or laundering-ring addresses. \\`incident_timestamp_ms\\` is\n   optional.\n5. Use \\`address_risk\\` for single-address enrichment, and\n   \\`graph_query_batch\\` only when the role-specific tools do not answer the\n   exact question.\n\nAll trace tools return \\`chain-insights.trace.v1\\`. Preserve full addresses in\n\\`input.addresses\\`, \\`addresses[].address\\`, \\`edges[].from_address\\`,\n\\`edges[].to_address\\`, \\`paths[].addresses\\`, \\`candidate_labels[].address\\`,\nand \\`continuation\\` address lists.\n`\n\nconst SCHEMA_README = `# Runtime Schema Captures\n\nStore graph schema captures here, for example:\n\n\\`\\`\\`text\nbittensor.graph-schema.json\n\\`\\`\\`\n\nSchema captures should be generated before the first case query in a fresh\nworkspace, then referenced by evidence, reports, and runtime skill notes.\n`\n\nfunction workspaceFiles(workspaceRoot: string): Array<[string, string]> {\n  return [\n    ['.chain-insights/workspace.json', workspaceJson(workspaceRoot)],\n    ['README.md', README],\n    ['AGENTS.md', AGENTS],\n    ['CLAUDE.md', CLAUDE],\n    ['imports/README.md', IMPORTS_README],\n    ['templates/README.md', TEMPLATES_README],\n    ['templates/case-brief.md', CASE_BRIEF],\n    ['.chain-insights/runtime-skill/SKILL.md', RUNTIME_SKILL],\n    ['.chain-insights/schema/README.md', SCHEMA_README],\n    ['.chain-insights/runtime/.keep', ''],\n    ['.chain-insights/runtime/logs/.keep', ''],\n  ]\n}\n\nasync function assertNoFileCollisions(workspaceRoot: string): Promise<void> {\n  for (const [relativePath] of workspaceFiles(workspaceRoot)) {\n    const filePath = path.join(workspaceRoot, relativePath)\n    try {\n      await access(filePath)\n      throw new Error(`Refusing to overwrite ${filePath}. Re-run with --force to replace workspace files.`)\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        continue\n      }\n      throw err\n    }\n  }\n}\n\nexport async function initWorkspace(options: InitWorkspaceOptions): Promise<InitWorkspaceResult> {\n  const workspaceRoot = path.resolve(options.targetDir)\n  if (!options.force) {\n    await assertNoFileCollisions(workspaceRoot)\n  }\n\n  for (const dir of WORKSPACE_DIRS) {\n    await mkdir(path.join(workspaceRoot, dir), { recursive: true })\n  }\n\n  const filesWritten: string[] = []\n  const flag = options.force ? 'w' : 'wx'\n  for (const [relativePath, content] of workspaceFiles(workspaceRoot)) {\n    const filePath = path.join(workspaceRoot, relativePath)\n    try {\n      await writeFile(filePath, content, { mode: 0o600, flag })\n      filesWritten.push(relativePath)\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'EEXIST') {\n        throw new Error(`Refusing to overwrite ${filePath}. Re-run with --force to replace workspace files.`)\n      }\n      throw err\n    }\n  }\n\n  return { workspaceRoot, filesWritten }\n}\n"],"mappings":";;;;AAcA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAS,WAAmB;CAC1B,wBAAO,IAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC7C;AAEA,SAAS,cAAc,eAA+B;CACpD,OAAO,KAAK,UAAU;EACpB,QAAQ;EACR,MAAM;EACN,gBAAgB;EAChB,iBAAiB;EACjB,oBAAoB;EACpB,WAAW;EACX,aAAa;EACb,aAAa;EACb,eAAe;EACf,YAAY,SAAS;CACvB,GAAG,MAAM,CAAC,IAAI;AAChB;AAEA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;AA2Bf,MAAM,SAAS;;;;;;;;;;;;;;;;;;AAmBf,MAAM,SAAS;AAEf,MAAM,aAAa;;;;;;;;;;;;;;;;AAiBnB,MAAM,iBAAiB;;;;;;;;;;;;;;;;;AAkBvB,MAAM,mBAAmB;;;;;;;;AASzB,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEtB,MAAM,gBAAgB;;;;;;;;;;;AAYtB,SAAS,eAAe,eAAgD;CACtE,OAAO;EACL,CAAC,kCAAkC,cAAc,aAAa,CAAC;EAC/D,CAAC,aAAa,MAAM;EACpB,CAAC,aAAa,MAAM;EACpB,CAAC,aAAa,MAAM;EACpB,CAAC,qBAAqB,cAAc;EACpC,CAAC,uBAAuB,gBAAgB;EACxC,CAAC,2BAA2B,UAAU;EACtC,CAAC,0CAA0C,aAAa;EACxD,CAAC,oCAAoC,aAAa;EAClD,CAAC,iCAAiC,EAAE;EACpC,CAAC,sCAAsC,EAAE;CAC3C;AACF;AAEA,eAAe,uBAAuB,eAAsC;CAC1E,KAAK,MAAM,CAAC,iBAAiB,eAAe,aAAa,GAAG;EAC1D,MAAM,WAAW,KAAK,KAAK,eAAe,YAAY;EACtD,IAAI;GACF,MAAM,OAAO,QAAQ;GACrB,MAAM,IAAI,MAAM,yBAAyB,SAAS,kDAAkD;EACtG,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,UAC1C;GAEF,MAAM;EACR;CACF;AACF;AAEA,eAAsB,cAAc,SAA6D;CAC/F,MAAM,gBAAgB,KAAK,QAAQ,QAAQ,SAAS;CACpD,IAAI,CAAC,QAAQ,OACX,MAAM,uBAAuB,aAAa;CAG5C,KAAK,MAAM,OAAO,gBAChB,MAAM,MAAM,KAAK,KAAK,eAAe,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;CAGhE,MAAM,eAAyB,CAAC;CAChC,MAAM,OAAO,QAAQ,QAAQ,MAAM;CACnC,KAAK,MAAM,CAAC,cAAc,YAAY,eAAe,aAAa,GAAG;EACnE,MAAM,WAAW,KAAK,KAAK,eAAe,YAAY;EACtD,IAAI;GACF,MAAM,UAAU,UAAU,SAAS;IAAE,MAAM;IAAO;GAAK,CAAC;GACxD,aAAa,KAAK,YAAY;EAChC,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,UAC1C,MAAM,IAAI,MAAM,yBAAyB,SAAS,kDAAkD;GAEtG,MAAM;EACR;CACF;CAEA,OAAO;EAAE;EAAe;CAAa;AACvC"}

package/dist/{init-CFaUWgjK.cjs → init-zqbd7i-_.cjs}

@@ -160,11 +160,37 @@ Rules:
 - Keep evidence compact: select only the fields needed to support the claim.
   Avoid storing whole node or relationship property blobs in evidence unless
   the purpose of the query is schema discovery or debugging.
+- When using BFS, fixed-depth traversal fallbacks, or any manual \`FLOWS_TO\`
+  traversal, treat exchange hot wallets as terminal endpoints only. Do not
+  expand from, through, or classify exchange nodes as deposit, suspect, or
+  intermediate candidates. In Cypher, require every non-terminal traversal node
+  to satisfy \`is_exchange IS NULL\`; only the final exchange endpoint should
+  satisfy \`is_exchange IS NOT NULL\`.
 - Keep analysis products separate from evidence: graph JSON belongs under
   \`reports/graphs/\`, tabular extracts under \`reports/tables/\`, and analyst
   narrative under \`reports/\`.
 - Evidence Markdown should be a short provenance record with key facts and
   pointers. Large JSON belongs in \`reports/tables/\`, not inline in evidence.
+
+Trace tool chaining:
+
+1. Use \`trace_victim_funds\` when the user gives victim/source addresses.
+2. Pass returned \`continuation.candidate_deposit_addresses\` to
+   \`trace_deposit_sources\`; do not make victim tracing run deposit traceback
+   internally.
+3. Pass high-confidence \`continuation.candidate_suspect_addresses\` from
+   deposit traceback to \`trace_suspect_funds\`.
+4. Use \`trace_suspect_funds\` when the user gives suspected scammer, mule,
+   operator, or laundering-ring addresses. \`incident_timestamp_ms\` is
+   optional.
+5. Use \`address_risk\` for single-address enrichment, and
+   \`graph_query_batch\` only when the role-specific tools do not answer the
+   exact question.
+
+All trace tools return \`chain-insights.trace.v1\`. Preserve full addresses in
+\`input.addresses\`, \`addresses[].address\`, \`edges[].from_address\`,
+\`edges[].to_address\`, \`paths[].addresses\`, \`candidate_labels[].address\`,
+and \`continuation\` address lists.
 `;
 const SCHEMA_README = `# Runtime Schema Captures