chain-insights 0.2.32 → 0.3.4

package/README.md

@@ -3,8 +3,8 @@
 [Website](https://chain-insights.ai) | [GitHub](https://github.com/chainswarm/chain-insights) | [npm](https://www.npmjs.com/package/chain-insights)
 
 Chain Insights is an open-source AML investigation toolkit for AI agents and
-analysts. Install it from npm to screen blockchain addresses, trace funds,
-expand scam topologies, manage case evidence, and generate graph reports.
+analysts. Install it from npm to screen blockchain addresses, trace role-specific
+fund flows, manage case evidence, and generate graph reports.
 
 Graph access is configuration-driven. The package defaults to a local GraphRAG
 MCP endpoint for development; hosted endpoints are set explicitly with
@@ -16,8 +16,9 @@ MCP endpoint for development; hosted endpoints are set explicitly with
 | --- | --- |
 | `address_risk` | Screen one address for risk, behavior, neighborhood context, and exchange exposure |
 | `stake_insights` | Explain Bittensor staking relationships, net stake movement, and counterparties |
-| `track_funds` | Trace victim/source funds through intermediaries to exchange deposit candidates |
-| `scam_topology` | Expand a known victim incident into reviewable scam infrastructure and label candidates |
+| `trace_victim_funds` | Trace victim/source funds forward to exchange deposit candidates |
+| `trace_deposit_sources` | Trace backward from suspected deposit/cashout addresses to upstream sources and convergence |
+| `trace_suspect_funds` | Trace suspected scammer, mule, operator, or laundering-ring funds forward to cashout topology |
 | `usage_status` | Check the caller's public free graph query quota for today |
 | `graph_query` | Run one read-only GQL/Cypher query against a GraphRAG MCP graph layer |
 | `graph_query_batch` | Run related read-only graph queries as one MCP call |
@@ -123,9 +124,9 @@ cia case open "First Chain Insights investigation" \
   --tags aml,bittensor \
   --description "Screen and trace a known source address"
 
-cia mcp track-funds \
+cia mcp trace-victim-funds \
   --network bittensor \
-  --trusted-addresses 5GTjfJaLpBNrgybhY24NqhDnKW9r94z72RSYLxeodxJfSkj5 \
+  --victim-addresses 5GTjfJaLpBNrgybhY24NqhDnKW9r94z72RSYLxeodxJfSkj5 \
   --case 1
 ```
 
@@ -136,6 +137,24 @@ cia case show 1
 find reports cases -maxdepth 3 -type f | sort
 ```
 
+## Export To Obsidian, LLM Wiki, And Agents
+
+After a case has evidence, export a local knowledge bundle:
+
+```bash
+cia case evidence verify 1
+cia case export 1 --target obsidian-llmwiki --mode private
+```
+
+The export writes Markdown notes, `manifest.chain-insights.json`,
+`graph.chain-insights.json`, `Graph.canvas`, LLM Wiki entrypoints, and prompts
+for Codex, Claude Code, and ChatGPT under `published/<case-slug>/`.
+
+Private exports may include full addresses. Use `--mode public` only for
+shareable demos; public mode aliases addresses and removes secrets by default.
+Install and opening steps live in
+[Knowledge exports](docs/knowledge-exports.md).
+
 ## Demo
 
 Run a direct live topology query:
@@ -154,13 +173,12 @@ cia mcp call graph_query_batch \
   'queries=[{"id":"count","query":"USE live_topology MATCH (n) RETURN count(n) AS count LIMIT 1"},{"id":"archive_flows","query":"USE archive_topology MATCH (src:Address)-[f:FLOWS_TO]->(dst:Address) RETURN f.period_granularity AS granularity, src.address AS source, dst.address AS target LIMIT 3"},{"id":"facts_sample","query":"USE facts MATCH (a:Address)-[:HAS_FEATURE]->(f:AddressFeature) RETURN a.address AS address, f.sent_count AS sent_count LIMIT 3"}]'
 ```
 
-Run victim incident topology:
+Run suspect topology without requiring an incident timestamp:
 
 ```bash
-cia mcp scam-topology \
+cia mcp trace-suspect-funds \
   --network bittensor \
-  --victim-address 5... \
-  --incident-timestamp-ms 1715532228001 \
+  --suspect-addresses 5... \
   --max-hops 16 \
   --case 1
 ```
@@ -208,10 +226,20 @@ and local case state:
 - `stake_insights` explains Bittensor coldkey-hotkey-netuid staking
   relationships, aggregate stake movement amounts, top counterparties, first
   and last activity, and source backend evidence.
-- `track_funds` traces trusted victim/source funds through intermediaries to
-  exchange deposit candidates.
-- `scam_topology` expands from a known victim incident into reviewable
-  topology, safety decisions, and ML-ready label candidates.
+- `trace_victim_funds` traces victim/source funds forward through
+  intermediaries to exchange deposit candidates.
+- `trace_deposit_sources` traces backward from suspected deposit/cashout
+  addresses to upstream sources and shared-source convergence.
+- `trace_suspect_funds` traces suspected scammer, mule, operator, or
+  laundering-ring funds forward to cashout topology.
+
+The three trace tools share `chain-insights.trace.v1` and return compact,
+chainable results. Full graph/table/report artifacts remain on disk under the
+workspace, with pointers in the tool result and case evidence.
+
+Trace traversal treats exchange hot wallets as terminal endpoints only. Tools do
+not expand through exchange nodes or classify them as deposit, suspect, or
+intermediate candidates.
 
 When a case is provided, tools can save compact evidence pointers and graph
 reports under the workspace instead of embedding large payloads in case notes.
@@ -222,6 +250,7 @@ reports under the workspace instead of embedding large payloads in case notes.
 | --- | --- |
 | [Graph tools](docs/graph-tools.md) | GraphRAG MCP layers, `graph_query`, `graph_query_batch`, AML tool contracts, graph reports, evidence pointers |
 | [Investigation workspaces](docs/investigation-workspaces.md) | `cia init`, case layout, evidence, dossiers, imports, templates, sessions, reports |
+| [Knowledge exports](docs/knowledge-exports.md) | Install Obsidian and LLM Wiki, export verified cases, open vaults, ingest agent-ready Markdown and graph JSON |
 | [MCP proxy](docs/mcp-proxy.md) | Stdio proxy behavior, endpoint configuration, agent installers, local tools, auth modes, Inspector validation |
 | [Architecture](docs/architecture.md) | Product layers, data flow, local storage, security model, config keys |
 | [Development](docs/development.md) | Build, test, and local install commands |

package/dist/cases-Cp9DUbEV.mjs

@@ -0,0 +1,6 @@
+import "./frontmatter-D0ccQnUM.mjs";
+import { t as DossierStore } from "./dossier-Bjpcbcxa.mjs";
+import { t as CaseStore } from "./store-CTtqQtaE.mjs";
+import { t as EvidenceStore } from "./evidence-D96PTzOQ.mjs";
+import { t as SessionStore } from "./session-DROyhebe.mjs";
+export { CaseStore, DossierStore, EvidenceStore, SessionStore };

package/dist/{cases-c0iV-XLI.cjs → cases-sTY5aXav.cjs}

@@ -1,8 +1,8 @@
 require("./frontmatter-Dvqa5HX6.cjs");
-const require_dossier = require("./dossier-Br62hCG7.cjs");
-const require_store = require("./store-DogLawSj.cjs");
+const require_dossier = require("./dossier-BXy57V4-.cjs");
+const require_store = require("./store-CqPfs47P.cjs");
 const require_evidence = require("./evidence-CvEesemA.cjs");
-const require_session = require("./session-DwyikazY.cjs");
+const require_session = require("./session-BT7VpbAd.cjs");
 exports.CaseStore = require_store.CaseStore;
 exports.DossierStore = require_dossier.DossierStore;
 exports.EvidenceStore = require_evidence.EvidenceStore;

package/dist/cli.cjs

@@ -21,12 +21,16 @@ if (installerFlags.length > 0 && !rawArgs.some((a) => !a.startsWith("-"))) {
 	}
 	process.exit(0);
 }
-if (rawArgs[0] === "mcp" && rawArgs[1] === "trace-funds") {
-	console.error("error: unknown command 'trace-funds'");
+if (rawArgs[0] === "mcp" && [
+	"trace-funds",
+	"track-funds",
+	"scam-topology"
+].includes(rawArgs[1] ?? "")) {
+	console.error(`error: unknown command '${rawArgs[1]}'`);
 	process.exit(1);
 }
 async function resolveCaseSelector(input) {
-	const { resolveCaseSelector } = await Promise.resolve().then(() => require("./selector-DBS2jYH4.cjs"));
+	const { resolveCaseSelector } = await Promise.resolve().then(() => require("./selector-DfAMZEC9.cjs"));
 	return resolveCaseSelector(input);
 }
 async function scopeCasesToInvocationDir() {
@@ -35,7 +39,7 @@ async function scopeCasesToInvocationDir() {
 	process.env["CHAIN_INSIGHTS_CASES_ROOT"] = activeCasesRoot();
 }
 async function showCaseContext(caseSelector) {
-	const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+	const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 	const caseId = await resolveCaseSelector(caseSelector);
 	const ctx = await CaseStore.loadContext(caseId);
 	console.log(`\n=== Case: ${ctx.case.id} ===`);
@@ -65,11 +69,6 @@ function optionalNumberArg(value, name) {
 	if (typeof value === "string") return optionalNumber(value);
 	throw new Error(`Invalid number for ${name}: ${String(value)}`);
 }
-function optionalScamTopologyActivityPolicy(value) {
-	if (value === void 0 || value === null || value === "") return void 0;
-	if (value === "node_relative_only" || value === "global_incident_only") return value;
-	throw new Error("activity_policy must be one of: node_relative_only, global_incident_only");
-}
 async function withGraphMcpClient(name, fn) {
 	const { loadConfig } = await Promise.resolve().then(() => require("./config-BwVx19Og.cjs")).then((n) => n.config_exports);
 	const config = await loadConfig();
@@ -215,7 +214,7 @@ program.command("access-key").description("Configure Graph MCP test access key m
 }));
 program.command("init").description("Initialize an investigation workspace").argument("[dir]", "Workspace directory to initialize", ".").option("--force", "Overwrite existing workspace files").action(async (dir, opts) => {
 	try {
-		const { initWorkspace } = await Promise.resolve().then(() => require("./init-CFaUWgjK.cjs"));
+		const { initWorkspace } = await Promise.resolve().then(() => require("./init-zqbd7i-_.cjs"));
 		const result = await initWorkspace({
 			targetDir: dir,
 			force: opts.force
@@ -363,7 +362,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 	try {
 		const { loadSchema, saveSchema } = await Promise.resolve().then(() => require("./schema-cache-CJk1EL3L.cjs"));
 		const { formatToolsTable } = await Promise.resolve().then(() => require("./format-9NLBykEL.cjs"));
-		const { visibleRemoteTools } = await Promise.resolve().then(() => require("./tool-visibility-iAVQV3t0.cjs")).then((n) => n.tool_visibility_exports);
+		const { visibleRemoteTools } = await Promise.resolve().then(() => require("./tool-visibility-Buq7YdUZ.cjs")).then((n) => n.tool_visibility_exports);
 		const { loadConfig } = await Promise.resolve().then(() => require("./config-BwVx19Og.cjs")).then((n) => n.config_exports);
 		const { createConfiguredGraphMcpFetch, resolveGraphMcpEndpoint } = await Promise.resolve().then(() => require("./client-Db6IV1tv.cjs")).then((n) => n.client_exports);
 		const config = await loadConfig();
@@ -404,7 +403,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				}));
 				return;
 			}
-			const { addressRisk } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
+			const { addressRisk } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 			const result = await addressRisk(client, {
 				address: opts.address,
 				network: opts.network,
@@ -416,29 +415,30 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 		console.error(err.message);
 		process.exit(1);
 	}
-})).addCommand(new commander.Command("track-funds").description("Trace trusted/victim addresses and optional known untrusted/scammer addresses").requiredOption("--trusted-addresses <addresses>", "Comma-separated full trusted/victim addresses, max 5").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--untrusted-addresses <addresses>", "Comma-separated full known untrusted/scammer addresses, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").option("--max-hops <number>", "Maximum trace hops, 1-5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--remote", "Force remote MCP tool call instead of local Chain Insights recipe").action(async (opts) => {
+})).addCommand(new commander.Command("trace-victim-funds").description("Trace victim/source addresses forward to exchange deposit candidates").requiredOption("--victim-addresses <addresses>", "Comma-separated full victim/source addresses, max 5").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--known-suspect-addresses <addresses>", "Optional known suspect addresses for context only, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").option("--incident-timestamp-ms <milliseconds>", "Optional incident timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, 1-5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--remote", "Force remote MCP tool call instead of local Chain Insights recipe").action(async (opts) => {
 	try {
 		const { requireWorkspaceRoot } = await Promise.resolve().then(() => require("./output-root-YIbl6PwF.cjs")).then((n) => n.output_root_exports);
 		requireWorkspaceRoot();
-		await withGraphMcpClient("chain-insights-cli-track-funds", async (client, config) => {
+		await withGraphMcpClient("chain-insights-cli-trace-victim-funds", async (client, config) => {
 			if (opts.remote) {
 				printMcpTextContent(await client.callTool({
-					name: "track_funds",
+					name: "trace_victim_funds",
 					arguments: {
-						trusted_addresses: opts.trustedAddresses,
+						victim_addresses: opts.victimAddresses,
 						network: opts.network,
-						...opts.untrustedAddresses ? { untrusted_addresses: opts.untrustedAddresses } : {}
+						...opts.knownSuspectAddresses ? { known_suspect_addresses: opts.knownSuspectAddresses } : {}
 					}
 				}));
 				return;
 			}
-			const { trackFunds } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
+			const { traceVictimFunds } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
-			const result = await trackFunds(client, config, {
-				trustedAddresses: opts.trustedAddresses,
-				untrustedAddresses: opts.untrustedAddresses,
+			const result = await traceVictimFunds(client, config, {
+				victimAddresses: opts.victimAddresses,
+				knownSuspectAddresses: opts.knownSuspectAddresses,
 				network: opts.network,
 				caseId,
+				incidentTimestampMs: optionalNumber(opts.incidentTimestampMs),
 				maxHops: optionalNumber(opts.maxHops),
 				perAddressLimit: optionalNumber(opts.perAddressLimit),
 				minAmountSum: optionalNumber(opts.minAmountSum)
@@ -450,21 +450,40 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 		console.error(err.message);
 		process.exit(1);
 	}
-})).addCommand(new commander.Command("scam-topology").description("Build victim-incident scam topology and ML-ready scam labels").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--victim-address <address>", "Full victim/source address that anchors the incident").requiredOption("--incident-timestamp-ms <milliseconds>", "Earliest known incident transfer timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, default 16, max 64").option("--activity-policy <mode>", "Traversal activity policy: node_relative_only or global_incident_only", "node_relative_only").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
+})).addCommand(new commander.Command("trace-suspect-funds").description("Trace suspected scammer, mule, operator, or laundering-ring addresses forward to cashout topology").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--suspect-addresses <addresses>", "Comma-separated full suspect-controlled addresses, max 5").option("--incident-timestamp-ms <milliseconds>", "Optional incident timestamp in milliseconds").option("--max-hops <number>", "Maximum trace hops, default 3, max 5").option("--per-address-limit <number>", "Maximum exchange paths/results per address, 1-10").option("--min-amount-sum <number>", "Minimum r.amount_sum for traced edges").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
+	try {
+		const { requireWorkspaceRoot } = await Promise.resolve().then(() => require("./output-root-YIbl6PwF.cjs")).then((n) => n.output_root_exports);
+		requireWorkspaceRoot();
+		await withGraphMcpClient("chain-insights-cli-trace-suspect-funds", async (client, config) => {
+			const { traceSuspectFunds } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
+			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
+			const result = await traceSuspectFunds(client, config, {
+				suspectAddresses: opts.suspectAddresses,
+				network: opts.network,
+				maxHops: optionalNumber(opts.maxHops),
+				perAddressLimit: optionalNumber(opts.perAddressLimit),
+				minAmountSum: optionalNumber(opts.minAmountSum),
+				incidentTimestampMs: optionalNumber(opts.incidentTimestampMs),
+				caseId
+			});
+			console.log(result.summaryText);
+			console.log(JSON.stringify(result.structuredContent, null, 2));
+		});
+	} catch (err) {
+		console.error(err.message);
+		process.exit(1);
+	}
+})).addCommand(new commander.Command("trace-deposit-sources").description("Trace backward from suspected deposit/cashout addresses to upstream sources and convergence").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").requiredOption("--deposit-addresses <addresses>", "Comma-separated full suspected deposit/cashout addresses, max 5").option("--max-hops <number>", "Maximum reverse traceback hops, default 2, max 5").option("--case <id>", "Case ID to attach compact evidence pointers").action(async (opts) => {
 	try {
 		const { requireWorkspaceRoot } = await Promise.resolve().then(() => require("./output-root-YIbl6PwF.cjs")).then((n) => n.output_root_exports);
 		requireWorkspaceRoot();
-		await withGraphMcpClient("chain-insights-cli-scam-topology", async (client, config) => {
-			const { scamTopology } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
-			const incidentTimestampMs = optionalNumber(opts.incidentTimestampMs);
-			if (incidentTimestampMs === void 0) throw new Error("incident-timestamp-ms is required");
+		await withGraphMcpClient("chain-insights-cli-trace-deposit-sources", async (client, config) => {
+			const { traceDepositSources } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 			const caseId = opts.case ? await resolveCaseSelector(opts.case) : void 0;
-			const result = await scamTopology(client, config, {
-				victimAddress: opts.victimAddress,
+			const result = await traceDepositSources(client, config, {
+				depositAddresses: opts.depositAddresses,
 				network: opts.network,
 				maxHops: optionalNumber(opts.maxHops),
-				incidentTimestampMs,
-				activityPolicyMode: optionalScamTopologyActivityPolicy(opts.activityPolicy),
 				caseId
 			});
 			console.log(result.summaryText);
@@ -477,7 +496,7 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 })).addCommand(new commander.Command("stake-insights").description("Explain Bittensor staking behavior around an address, coldkey, or hotkey").requiredOption("--network <network>", "Network to query. Run `cia mcp networks` for supported networks.").option("--address <address>", "Full Bittensor address to inspect as either coldkey or hotkey").option("--coldkey <address>", "Full Bittensor coldkey address to inspect").option("--hotkey <address>", "Full Bittensor hotkey address to inspect").option("--netuid <number>", "Optional subnet netuid filter").option("--start-timestamp-ms <milliseconds>", "Optional inclusive lower activity timestamp bound").option("--end-timestamp-ms <milliseconds>", "Optional inclusive upper activity timestamp bound").option("--start-block <number>", "Optional start block. Current stake graph parity may require timestamp windows instead.").option("--end-block <number>", "Optional end block. Current stake graph parity may require timestamp windows instead.").option("--depth <number>", "Optional expansion depth limit, default 1, max 3").action(async (opts) => {
 	try {
 		await withGraphMcpClient("chain-insights-cli-stake-insights", async (client) => {
-			const { stakeInsights } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
+			const { stakeInsights } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 			const result = await stakeInsights(client, {
 				network: opts.network,
 				address: opts.address,
@@ -500,12 +519,12 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 })).addCommand(new commander.Command("call").description("Call an MCP tool directly (debug)").argument("<tool>", "Tool name to call").argument("[args...]", "Key=value arguments (e.g. address=0x1234 chain=ethereum)").action(async (tool, rawArgs) => {
 	try {
 		const { parseMcpCallArgs } = await Promise.resolve().then(() => require("./call-args-CcUV6gFS.cjs"));
-		const { assertPublicMcpToolName } = await Promise.resolve().then(() => require("./tool-visibility-iAVQV3t0.cjs")).then((n) => n.tool_visibility_exports);
+		const { assertPublicMcpToolName } = await Promise.resolve().then(() => require("./tool-visibility-Buq7YdUZ.cjs")).then((n) => n.tool_visibility_exports);
 		const args = parseMcpCallArgs(rawArgs);
 		assertPublicMcpToolName(tool);
 		await withGraphMcpClient("chain-insights-cli-call", async (client, config) => {
 			if (tool === "address_risk") {
-				const { addressRisk } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
+				const { addressRisk } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 				const result = await addressRisk(client, {
 					address: String(args["address"] ?? ""),
 					network: String(args["network"] ?? ""),
@@ -514,13 +533,14 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				console.log(result.summaryText);
 				return;
 			}
-			if (tool === "track_funds") {
-				const { trackFunds } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
-				const result = await trackFunds(client, config, {
-					trustedAddresses: args["trusted_addresses"] ?? "",
-					untrustedAddresses: args["untrusted_addresses"],
+			if (tool === "trace_victim_funds") {
+				const { traceVictimFunds } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
+				const result = await traceVictimFunds(client, config, {
+					victimAddresses: args["victim_addresses"] ?? "",
+					knownSuspectAddresses: args["known_suspect_addresses"],
 					network: String(args["network"] ?? ""),
 					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
+					incidentTimestampMs: optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms"),
 					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0,
 					perAddressLimit: typeof args["per_address_limit"] === "number" ? args["per_address_limit"] : void 0,
 					minAmountSum: typeof args["min_amount_sum"] === "number" ? args["min_amount_sum"] : void 0
@@ -529,26 +549,35 @@ program.command("mcp").description("Interact with the Chain Insights MCP endpoin
 				console.log(JSON.stringify(result.structuredContent, null, 2));
 				return;
 			}
-			if (tool === "scam_topology") {
-				const { scamTopology } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
-				const victimAddress = String(args["victim_address"] ?? "").trim();
-				if (!victimAddress) throw new Error("victim_address is required");
-				const incidentTimestampMs = optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms");
-				if (incidentTimestampMs === void 0) throw new Error("incident_timestamp_ms is required");
-				const result = await scamTopology(client, config, {
-					victimAddress,
+			if (tool === "trace_suspect_funds") {
+				const { traceSuspectFunds } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
+				const result = await traceSuspectFunds(client, config, {
+					suspectAddresses: args["suspect_addresses"] ?? "",
 					network: String(args["network"] ?? ""),
 					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
 					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0,
-					incidentTimestampMs,
-					activityPolicyMode: optionalScamTopologyActivityPolicy(args["activity_policy"])
+					perAddressLimit: typeof args["per_address_limit"] === "number" ? args["per_address_limit"] : void 0,
+					minAmountSum: typeof args["min_amount_sum"] === "number" ? args["min_amount_sum"] : void 0,
+					incidentTimestampMs: optionalNumberArg(args["incident_timestamp_ms"], "incident_timestamp_ms")
+				});
+				console.log(result.summaryText);
+				console.log(JSON.stringify(result.structuredContent, null, 2));
+				return;
+			}
+			if (tool === "trace_deposit_sources") {
+				const { traceDepositSources } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
+				const result = await traceDepositSources(client, config, {
+					depositAddresses: args["deposit_addresses"] ?? "",
+					network: String(args["network"] ?? ""),
+					caseId: args["case_id"] === void 0 ? void 0 : String(args["case_id"]),
+					maxHops: typeof args["max_hops"] === "number" ? args["max_hops"] : void 0
 				});
 				console.log(result.summaryText);
 				console.log(JSON.stringify(result.structuredContent, null, 2));
 				return;
 			}
 			if (tool === "stake_insights") {
-				const { stakeInsights } = await Promise.resolve().then(() => require("./public-tools-BwguvIsf.cjs"));
+				const { stakeInsights } = await Promise.resolve().then(() => require("./public-tools-BvMb3H2P.cjs"));
 				const result = await stakeInsights(client, {
 					network: String(args["network"] ?? ""),
 					address: args["address"] === void 0 ? void 0 : String(args["address"]),
@@ -580,14 +609,14 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 }).addCommand(new commander.Command("open").description("Open a new investigation case").argument("<name>", "Case name (e.g. \"Tornado Mixer Investigation\")").option("--tags <tags>", "Comma-separated tags (e.g. aml,mixer,defi)", "").option("--description <desc>", "Brief description of the investigation", "").action(async (name, opts) => {
 	try {
 		if (/^[1-9]\d*$/.test(name.trim())) throw new Error("Numeric case names look like list selectors. Use a descriptive case name, e.g. `cia case open \"Tracking stolen funds from <address>\"`.");
-		const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const tags = opts.tags ? opts.tags.split(",").map((t) => t.trim()).filter(Boolean) : [];
 		const c = await CaseStore.create({
 			name,
 			tags,
 			description: opts.description
 		});
-		const { casesRoot } = await Promise.resolve().then(() => require("./store-DogLawSj.cjs"));
+		const { casesRoot } = await Promise.resolve().then(() => require("./store-CqPfs47P.cjs")).then((n) => n.store_exports);
 		console.log(`Case opened: ${c.id}`);
 		console.log(`Directory:   ${node_path.default.join(casesRoot(), c.id)}/`);
 		console.log(`Status:      ${c.status}`);
@@ -597,7 +626,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("activate").description("Activate a case (set status to active)").argument("<case-id>", "Case ID to activate").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "active");
 		console.log(`Case ${c.id} is now: active`);
@@ -607,7 +636,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("suspend").description("Suspend a case (set status to suspended)").argument("<case-id>", "Case ID to suspend").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "suspended");
 		console.log(`Case ${c.id} is now: suspended`);
@@ -617,7 +646,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("close").description("Close a case permanently").argument("<case-id>", "Case ID to close").action(async (caseSelector) => {
 	try {
-		const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const c = await CaseStore.setStatus(caseId, "closed");
 		console.log(`Case ${c.id} is now: closed`);
@@ -627,7 +656,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("list").description("List all investigation cases").option("--status <status>", "Filter by status (open|active|suspended|closed)").action(async (opts) => {
 	try {
-		const { CaseStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { CaseStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const cases = await CaseStore.list();
 		const filtered = opts.status ? cases.filter((c) => c.status === opts.status) : cases;
 		if (filtered.length === 0) {
@@ -641,7 +670,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("evidence").description("Manage case evidence").addCommand(new commander.Command("add").description("Add evidence to a case from an MCP query result").argument("<case-id>", "Case ID to add evidence to").option("--source <tool>", "MCP tool name that produced this evidence", "manual").option("--content <text>", "Evidence content (MCP response or notes)", "").option("--query-params <params>", "Query parameters used (e.g. address=0x1234)", "").action(async (caseSelector, opts) => {
 	try {
-		const { EvidenceStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { EvidenceStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const result = await EvidenceStore.append(caseId, {
 			source: opts.source,
@@ -656,7 +685,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("verify").description("Verify evidence manifest integrity for a case").argument("<case-id>", "Case ID to verify").action(async (caseSelector) => {
 	try {
-		const { EvidenceStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { EvidenceStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const result = await EvidenceStore.verifyManifest(caseId);
 		if (result.ok) console.log(`Manifest OK — ${result.count} evidence file(s) verified`);
@@ -670,7 +699,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 }))).addCommand(new commander.Command("dossier").description("Manage entity dossiers for a case").addCommand(new commander.Command("update").description("Append a finding to an entity dossier").argument("<case-id>", "Case ID").argument("<address>", "Entity address or identifier").option("--finding <text>", "Finding to append to the dossier", "").option("--type <type>", "Entity type (eoa|contract|exchange|mixer|unknown)", "unknown").action(async (caseSelector, address, opts) => {
 	try {
-		const { DossierStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { DossierStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const entityType = [
 			"eoa",
@@ -687,7 +716,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 }))).addCommand(new commander.Command("session").description("Manage investigation sessions").addCommand(new commander.Command("start").description("Start a new investigation session for a case").argument("<case-id>", "Case ID").argument("[title...]", "Optional session title").action(async (caseSelector, titleParts) => {
 	try {
-		const { SessionStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { SessionStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		const title = titleParts.join(" ").trim();
 		const s = await SessionStore.start(caseId, title ? { title } : {});
@@ -698,7 +727,7 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 	}
 })).addCommand(new commander.Command("end").description("End the current session with findings and next steps").argument("<case-id>", "Case ID").option("--findings <text>", "Key findings from this session", "").option("--next-steps <text>", "Next steps for the investigation", "").action(async (caseSelector, opts) => {
 	try {
-		const { SessionStore } = await Promise.resolve().then(() => require("./cases-c0iV-XLI.cjs"));
+		const { SessionStore } = await Promise.resolve().then(() => require("./cases-sTY5aXav.cjs"));
 		const caseId = await resolveCaseSelector(caseSelector);
 		await SessionStore.end(caseId, {
 			findings: opts.findings,
@@ -710,7 +739,34 @@ const caseCommand = new commander.Command("case").description("Manage investigat
 		console.error(err.message);
 		process.exit(1);
 	}
-}))).addCommand(new commander.Command("show").description("Show saved case context").argument("<case-id>", "Case ID or case list number to show").action(async (caseSelector) => {
+}))).addCommand(new commander.Command("export").description("Export a case for Obsidian, LLMWiki, and agents").argument("<case-id>", "Case ID or case list number to export").option("--target <target>", "Export target: obsidian-llmwiki", "obsidian-llmwiki").option("--mode <mode>", "Redaction mode: private|partner|public", "private").option("--out <directory>", "Output directory. Defaults to published/<case-slug>").action(async (caseSelector, opts) => {
+	try {
+		const target = opts.target === "obsidian-llmwiki" ? opts.target : void 0;
+		const mode = [
+			"private",
+			"partner",
+			"public"
+		].includes(opts.mode) ? opts.mode : void 0;
+		if (!target) throw new Error(`Unsupported export target: ${opts.target}`);
+		if (!mode) throw new Error(`Unsupported export mode: ${opts.mode}`);
+		const caseId = await resolveCaseSelector(caseSelector);
+		const { exportCase } = await Promise.resolve().then(() => require("./export-DsXgtCwO.cjs"));
+		const result = await exportCase({
+			caseId,
+			target,
+			mode,
+			outputDir: opts.out
+		});
+		console.log(`Case exported: ${result.outputDir}`);
+		console.log(`Manifest:      ${result.manifestPath}`);
+		console.log(`Files:         ${result.fileCount}`);
+		console.log(`Open first:    ${result.nextFile}`);
+		for (const warning of result.warnings) console.warn(`Warning: ${warning}`);
+	} catch (err) {
+		console.error(err.message);
+		process.exit(1);
+	}
+})).addCommand(new commander.Command("show").description("Show saved case context").argument("<case-id>", "Case ID or case list number to show").action(async (caseSelector) => {
 	try {
 		await showCaseContext(caseSelector);
 	} catch (err) {
@@ -735,7 +791,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 			}
 			resolvedParams[key] = kv.slice(eq + 1);
 		}
-		const { resolvePlaybookContent } = await Promise.resolve().then(() => require("./resolver-BUU7ZgW-.cjs"));
+		const { resolvePlaybookContent } = await Promise.resolve().then(() => require("./resolver-CZdQwKvh.cjs"));
 		const markdown = await resolvePlaybookContent(name);
 		const { PlaybookParser } = await Promise.resolve().then(() => require("./parser-BXLAHYnZ.cjs"));
 		const definition = PlaybookParser.parse(markdown, resolvedParams);
@@ -748,7 +804,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 			console.error(`Invalid --from value: "${opts.from}". Must be a positive integer.`);
 			process.exit(1);
 		}
-		const { PlaybookRunner } = await Promise.resolve().then(() => require("./runner-BCDeBYsR.cjs"));
+		const { PlaybookRunner } = await Promise.resolve().then(() => require("./runner-BhZ4lnF1.cjs"));
 		await PlaybookRunner.run(definition, {
 			caseId: opts.case,
 			from: fromN,
@@ -761,7 +817,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 	}
 })).addCommand(new commander.Command("list").description("List available playbooks (built-in and user-defined)").action(async () => {
 	try {
-		const { listPlaybooks } = await Promise.resolve().then(() => require("./resolver-BUU7ZgW-.cjs"));
+		const { listPlaybooks } = await Promise.resolve().then(() => require("./resolver-CZdQwKvh.cjs"));
 		const playbooks = await listPlaybooks();
 		if (playbooks.length === 0) {
 			console.log("No playbooks found.");
@@ -774,7 +830,7 @@ program.command("playbook").description("Run and manage investigation playbooks"
 	}
 })).addCommand(new commander.Command("show").description("Show steps for a playbook without executing").argument("<name>", "Playbook name").action(async (name) => {
 	try {
-		const { resolvePlaybookContent } = await Promise.resolve().then(() => require("./resolver-BUU7ZgW-.cjs"));
+		const { resolvePlaybookContent } = await Promise.resolve().then(() => require("./resolver-CZdQwKvh.cjs"));
 		const { PlaybookParser } = await Promise.resolve().then(() => require("./parser-BXLAHYnZ.cjs"));
 		const markdown = await resolvePlaybookContent(name);
 		const definition = PlaybookParser.parse(markdown, {});
@@ -798,7 +854,7 @@ program.command("viz").description("Generate money flow visualization").argument
 			console.error("Provide either a case ID or --data <file.json>");
 			process.exit(1);
 		}
-		const { generateVisualization } = await Promise.resolve().then(() => require("./viz-Da9YWN_I.cjs")).then((n) => n.viz_exports);
+		const { generateVisualization } = await Promise.resolve().then(() => require("./viz-Dqp3C5kb.cjs")).then((n) => n.viz_exports);
 		const result = await generateVisualization({
 			caseId,
 			dataFile: opts.data