erosolar-cli 2.1.243 → 2.1.244

package/dist/core/unifiedFraudOrchestrator.js

@@ -0,0 +1,1449 @@
+/**
+ * Unified Tech Fraud Investigation Orchestrator
+ *
+ * Purpose: Coordinate investigation of tech company fraud across multiple vectors:
+ * - Apple iMessage PQ3 (key substitution, false E2E claims)
+ * - Google Gmail (hidden threads, draft manipulation, unauthorized access)
+ * - Google Chrome (browser hijacking, session control, surveillance)
+ * - Cross-platform evidence correlation
+ *
+ * This orchestrator:
+ * 1. Manages investigation workflows across multiple targets
+ * 2. Correlates evidence across different fraud vectors
+ * 3. Detects patterns indicating coordinated manipulation
+ * 4. Generates unified legal evidence packages
+ * 5. Maintains cryptographic chain of custody
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { EventEmitter } from 'node:events';
+import { IntegrityVerificationEngine, hashString, } from './integrityVerification.js';
+import { iMessageVerificationEngine, APPLE_PQ3_CLAIMS, } from './iMessageVerification.js';
+// ─────────────────────────────────────────────────────────────────────────────
+// Google Security Claims (like Apple PQ3 claims)
+// ─────────────────────────────────────────────────────────────────────────────
+export const GOOGLE_GMAIL_CLAIMS = {
+    user_control: {
+        claim: "You're in control of your data in Gmail. You can export and delete your data anytime.",
+        source: 'https://safety.google/gmail/',
+        verifiable: 'partial',
+        reason: 'Cannot verify server-side manipulation of what is shown to user'
+    },
+    no_email_scanning_for_ads: {
+        claim: 'Gmail does not scan or read your emails for advertising purposes.',
+        source: 'https://support.google.com/mail/answer/6603',
+        verifiable: false,
+        reason: 'Closed source server, cannot verify processing'
+    },
+    confidential_mode: {
+        claim: 'Confidential mode helps protect sensitive information from unauthorized access.',
+        source: 'https://support.google.com/mail/answer/7674059',
+        verifiable: false,
+        reason: 'Google retains access to content and revocation keys'
+    },
+    security_alerts: {
+        claim: 'We notify you of suspicious activity on your account.',
+        source: 'https://support.google.com/accounts/answer/2590353',
+        verifiable: 'partial',
+        reason: 'Cannot verify all access is reported; Google-controlled infrastructure'
+    },
+    search_accuracy: {
+        claim: 'Search in Gmail finds all matching messages in your mailbox.',
+        source: 'https://support.google.com/mail/answer/7190',
+        verifiable: true,
+        reason: 'Can test by cross-referencing with IMAP/Takeout'
+    },
+    draft_integrity: {
+        claim: 'Drafts are saved automatically and preserved until you delete or send them.',
+        source: 'https://support.google.com/mail/answer/7684',
+        verifiable: true,
+        reason: 'Can monitor draft state over time and detect unauthorized changes'
+    }
+};
+export const GOOGLE_CHROME_CLAIMS = {
+    safe_browsing: {
+        claim: 'Safe Browsing protects you from dangerous sites and downloads.',
+        source: 'https://safebrowsing.google.com/',
+        verifiable: 'partial',
+        reason: 'Also reports all browsing URLs to Google servers'
+    },
+    sync_privacy: {
+        claim: 'Sync data is encrypted in transit and at rest.',
+        source: 'https://support.google.com/chrome/answer/165139',
+        verifiable: false,
+        reason: 'Google holds encryption keys; can access synced data'
+    },
+    user_control_history: {
+        claim: 'You can view and delete your browsing history at any time.',
+        source: 'https://support.google.com/chrome/answer/95589',
+        verifiable: 'partial',
+        reason: 'Cannot verify server-side retention after "deletion"'
+    },
+    no_unauthorized_access: {
+        claim: 'Chrome only accesses your data when you explicitly use a Google service.',
+        source: 'https://www.google.com/chrome/privacy/',
+        verifiable: true,
+        reason: 'Can monitor Chrome process network activity and launches'
+    },
+    extension_security: {
+        claim: 'Extensions must request permissions and users can control what extensions access.',
+        source: 'https://support.google.com/chrome_webstore/answer/2664769',
+        verifiable: 'partial',
+        reason: 'Cannot verify extension behavior matches stated permissions'
+    }
+};
+// ═══════════════════════════════════════════════════════════════════════════════
+// GMAIL INVESTIGATION ENGINE
+// ═══════════════════════════════════════════════════════════════════════════════
+export class GmailInvestigationEngine {
+    storageDir;
+    threadObservations = new Map();
+    draftObservations = new Map();
+    filterObservations = [];
+    accessLogs = [];
+    findings = [];
+    constructor(storageDir) {
+        this.storageDir = path.join(storageDir, 'gmail-investigation');
+    }
+    async initialize() {
+        await fs.mkdir(this.storageDir, { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'threads'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'drafts'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'filters'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'access'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'findings'), { recursive: true });
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Thread Monitoring (Hidden Threads Detection)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record observation of Gmail threads.
+     * Compare with previous observations to detect hidden threads.
+     *
+     * Detection methods:
+     * 1. Compare UI-visible threads vs API-returned threads
+     * 2. Compare search results vs direct thread access
+     * 3. Compare current state vs Google Takeout export
+     * 4. Monitor for threads that disappear from search but still exist
+     */
+    async recordThreadObservation(params) {
+        const now = new Date().toISOString();
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            ...params,
+            hash: '',
+        };
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            timestamp: observation.timestamp,
+            threadId: observation.threadId,
+            messageIds: observation.messageIds,
+            isVisible: observation.isVisible,
+            isInSearch: observation.isInSearch,
+        }));
+        // Get previous observations for this thread
+        const previous = this.threadObservations.get(params.threadId) || [];
+        const lastObs = previous[previous.length - 1];
+        let anomalyDetected = false;
+        let finding;
+        // Check for anomalies
+        if (lastObs) {
+            // Thread was visible, now hidden
+            if (lastObs.isVisible && !params.isVisible) {
+                anomalyDetected = true;
+                finding = await this.createFinding({
+                    vector: 'gmail_hidden_threads',
+                    severity: 'high',
+                    title: `Thread hidden: "${params.subject}"`,
+                    description: `Thread ${params.threadId} was visible in previous observation but is now hidden. This may indicate manipulation by Google to hide communications from the user.`,
+                    technicalDetails: {
+                        threadId: params.threadId,
+                        previouslyVisible: true,
+                        currentlyVisible: false,
+                        wasInSearch: lastObs.isInSearch,
+                        nowInSearch: params.isInSearch,
+                        timeSinceLastObservation: new Date(now).getTime() - new Date(lastObs.timestamp).getTime(),
+                    },
+                    evidenceIds: [lastObs.id, observation.id],
+                });
+            }
+            // Thread was in search, now excluded
+            if (lastObs.isInSearch && !params.isInSearch && params.isVisible) {
+                anomalyDetected = true;
+                finding = finding || await this.createFinding({
+                    vector: 'gmail_hidden_threads',
+                    severity: 'medium',
+                    title: `Thread excluded from search: "${params.subject}"`,
+                    description: `Thread ${params.threadId} is visible but no longer appears in search results. Google may be suppressing this thread from discovery.`,
+                    technicalDetails: {
+                        threadId: params.threadId,
+                        visible: true,
+                        excludedFromSearch: true,
+                    },
+                    evidenceIds: [lastObs.id, observation.id],
+                });
+            }
+            // Messages disappeared from thread
+            const missingMessages = lastObs.messageIds.filter(id => !params.messageIds.includes(id));
+            if (missingMessages.length > 0) {
+                anomalyDetected = true;
+                finding = finding || await this.createFinding({
+                    vector: 'gmail_hidden_threads',
+                    severity: 'critical',
+                    title: `Messages removed from thread: "${params.subject}"`,
+                    description: `${missingMessages.length} messages have been removed from thread ${params.threadId} without user action.`,
+                    technicalDetails: {
+                        threadId: params.threadId,
+                        missingMessageIds: missingMessages,
+                        previousMessageCount: lastObs.messageIds.length,
+                        currentMessageCount: params.messageIds.length,
+                    },
+                    evidenceIds: [lastObs.id, observation.id],
+                });
+            }
+        }
+        // Inconsistency: exists but not visible and not in search
+        if (!params.isVisible && !params.isInSearch) {
+            anomalyDetected = true;
+            finding = finding || await this.createFinding({
+                vector: 'gmail_hidden_threads',
+                severity: 'high',
+                title: `Thread completely hidden: "${params.subject}"`,
+                description: `Thread ${params.threadId} exists but is neither visible in inbox views nor discoverable via search. This is strong evidence of deliberate hiding.`,
+                technicalDetails: {
+                    threadId: params.threadId,
+                    captureMethod: params.captureMethod,
+                    lastMessageDate: params.lastMessageDate,
+                },
+                evidenceIds: [observation.id],
+            });
+        }
+        // Store observation
+        previous.push(observation);
+        this.threadObservations.set(params.threadId, previous);
+        await this.persistThreadObservation(observation);
+        return { observation, anomalyDetected, finding };
+    }
+    /**
+     * Compare multiple capture methods to detect discrepancies.
+     * If API shows different threads than UI or Takeout, that's manipulation.
+     */
+    async crossReferenceThreadSources(params) {
+        const allThreadIds = new Set([
+            ...params.apiThreadIds,
+            ...params.uiThreadIds,
+            ...(params.takeoutThreadIds || []),
+            ...(params.imapThreadIds || []),
+        ]);
+        const discrepancies = [];
+        for (const threadId of allThreadIds) {
+            const presentIn = [];
+            const missingFrom = [];
+            if (params.apiThreadIds.includes(threadId))
+                presentIn.push('api');
+            else
+                missingFrom.push('api');
+            if (params.uiThreadIds.includes(threadId))
+                presentIn.push('ui');
+            else
+                missingFrom.push('ui');
+            if (params.takeoutThreadIds?.includes(threadId))
+                presentIn.push('takeout');
+            else if (params.takeoutThreadIds)
+                missingFrom.push('takeout');
+            if (params.imapThreadIds?.includes(threadId))
+                presentIn.push('imap');
+            else if (params.imapThreadIds)
+                missingFrom.push('imap');
+            if (missingFrom.length > 0 && presentIn.length > 0) {
+                let implication = '';
+                if (missingFrom.includes('ui') && presentIn.includes('api')) {
+                    implication = 'Thread exists but is hidden from user interface - deliberate UI manipulation';
+                }
+                else if (missingFrom.includes('api') && presentIn.includes('takeout')) {
+                    implication = 'Thread in export but not in API - potential retroactive hiding';
+                }
+                else if (presentIn.includes('imap') && missingFrom.includes('ui')) {
+                    implication = 'Thread accessible via IMAP but hidden in webmail - selective hiding';
+                }
+                discrepancies.push({ threadId, presentIn, missingFrom, implication });
+            }
+        }
+        let finding;
+        if (discrepancies.length > 0) {
+            finding = await this.createFinding({
+                vector: 'gmail_hidden_threads',
+                severity: discrepancies.length > 5 ? 'critical' : 'high',
+                title: `Cross-reference reveals ${discrepancies.length} hidden threads`,
+                description: `Comparison of Gmail data sources reveals threads that exist in some views but are hidden from others. This is direct evidence of selective content manipulation.`,
+                technicalDetails: {
+                    discrepancyCount: discrepancies.length,
+                    discrepancies,
+                    sourcesCrossReferenced: ['api', 'ui', params.takeoutThreadIds ? 'takeout' : null, params.imapThreadIds ? 'imap' : null].filter(Boolean),
+                },
+                evidenceIds: [],
+            });
+        }
+        return { discrepancies, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Draft Monitoring (Draft Manipulation Detection)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record observation of a draft.
+     * Detect unauthorized modifications, deletions, or sends.
+     */
+    async recordDraftObservation(params) {
+        const now = new Date().toISOString();
+        const bodyHash = hashString(params.bodyContent);
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            draftId: params.draftId,
+            threadId: params.threadId,
+            subject: params.subject,
+            recipientCount: params.recipientCount,
+            bodyHash,
+            bodyLength: params.bodyContent.length,
+            hasAttachments: params.hasAttachments,
+            createdAt: params.createdAt,
+            modifiedAt: params.modifiedAt,
+            captureMethod: params.captureMethod,
+            hash: '',
+        };
+        // Get previous observations
+        const previous = this.draftObservations.get(params.draftId) || [];
+        const lastObs = previous[previous.length - 1];
+        const changes = [];
+        if (lastObs) {
+            observation.previousObservationId = lastObs.id;
+            // Check for content changes
+            if (lastObs.bodyHash !== bodyHash) {
+                const wasUserModified = new Date(params.modifiedAt) > new Date(lastObs.timestamp);
+                changes.push({
+                    type: 'content_changed',
+                    field: 'body',
+                    previousValue: `hash:${lastObs.bodyHash.slice(0, 16)}... (${lastObs.bodyLength} chars)`,
+                    newValue: `hash:${bodyHash.slice(0, 16)}... (${params.bodyContent.length} chars)`,
+                    userInitiated: wasUserModified, // heuristic - needs better detection
+                    suspicionLevel: wasUserModified ? 'normal' : 'highly_suspicious',
+                    reason: wasUserModified ? 'Draft modified' : 'Draft content changed without user modification timestamp update',
+                });
+            }
+            // Check for subject changes
+            if (lastObs.subject !== params.subject) {
+                changes.push({
+                    type: 'modified',
+                    field: 'subject',
+                    previousValue: lastObs.subject,
+                    newValue: params.subject,
+                    userInitiated: false, // cannot determine
+                    suspicionLevel: 'suspicious',
+                    reason: 'Subject line changed',
+                });
+            }
+            // Check for recipient changes
+            if (lastObs.recipientCount !== params.recipientCount) {
+                changes.push({
+                    type: 'modified',
+                    field: 'recipients',
+                    previousValue: String(lastObs.recipientCount),
+                    newValue: String(params.recipientCount),
+                    userInitiated: false,
+                    suspicionLevel: params.recipientCount > lastObs.recipientCount ? 'highly_suspicious' : 'suspicious',
+                    reason: params.recipientCount > lastObs.recipientCount
+                        ? 'Recipients ADDED to draft without user action'
+                        : 'Recipients changed',
+                });
+            }
+        }
+        observation.changes = changes.length > 0 ? changes : undefined;
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            timestamp: observation.timestamp,
+            draftId: observation.draftId,
+            bodyHash: observation.bodyHash,
+            modifiedAt: observation.modifiedAt,
+        }));
+        // Store observation
+        previous.push(observation);
+        this.draftObservations.set(params.draftId, previous);
+        await this.persistDraftObservation(observation);
+        // Generate finding if suspicious changes detected
+        let finding;
+        const suspiciousChanges = changes.filter(c => c.suspicionLevel !== 'normal');
+        if (suspiciousChanges.length > 0) {
+            finding = await this.createFinding({
+                vector: 'gmail_draft_manipulation',
+                severity: suspiciousChanges.some(c => c.suspicionLevel === 'highly_suspicious') ? 'critical' : 'high',
+                title: `Draft manipulated: "${params.subject}"`,
+                description: `Draft ${params.draftId} has been modified without clear user action. ${suspiciousChanges.map(c => c.reason).join('; ')}`,
+                technicalDetails: {
+                    draftId: params.draftId,
+                    changes: suspiciousChanges,
+                    previousObservationId: lastObs?.id,
+                },
+                evidenceIds: lastObs ? [lastObs.id, observation.id] : [observation.id],
+            });
+        }
+        return { observation, changes, finding };
+    }
+    /**
+     * Detect drafts that were sent without user action.
+     * This is a critical fraud indicator.
+     */
+    async detectUnauthorizedDraftSend(params) {
+        const draftObs = this.draftObservations.get(params.draftId);
+        const lastDraftState = draftObs?.[draftObs.length - 1];
+        const finding = await this.createFinding({
+            vector: 'gmail_draft_manipulation',
+            severity: 'critical',
+            title: `Draft sent without user action: "${lastDraftState?.subject || params.draftId}"`,
+            description: `Draft ${params.draftId} was sent at ${params.sentAt} without user initiation. User active: ${params.userWasActive}. This is unauthorized use of the user's email account.`,
+            technicalDetails: {
+                draftId: params.draftId,
+                sentMessageId: params.sentMessageId,
+                sentAt: params.sentAt,
+                userWasActive: params.userWasActive,
+                userLocation: params.userLocation,
+                sendingIp: params.sendingIp,
+                lastKnownDraftState: lastDraftState ? {
+                    subject: lastDraftState.subject,
+                    bodyHash: lastDraftState.bodyHash,
+                    recipientCount: lastDraftState.recipientCount,
+                    lastModified: lastDraftState.modifiedAt,
+                } : null,
+            },
+            evidenceIds: draftObs?.map(o => o.id) || [],
+        });
+        return finding;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Access Monitoring
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record account access and detect unauthorized access.
+     */
+    async recordAccessLog(params) {
+        const now = new Date().toISOString();
+        // Determine if suspicious
+        let suspicious = false;
+        let reason;
+        if (!params.wasUser) {
+            suspicious = true;
+            reason = 'Access not initiated by user';
+        }
+        // Check for Google internal IPs (they access accounts for "security")
+        if (params.ipAddress.startsWith('172.217.') ||
+            params.ipAddress.startsWith('142.250.') ||
+            params.ipAddress.startsWith('74.125.')) {
+            suspicious = true;
+            reason = 'Access from Google infrastructure IP';
+        }
+        const log = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            accessType: params.accessType,
+            ipAddress: params.ipAddress,
+            location: params.location,
+            userAgent: params.userAgent,
+            deviceType: params.deviceType,
+            wasUser: params.wasUser,
+            suspicious,
+            reason,
+            hash: '',
+        };
+        log.hash = hashString(JSON.stringify({
+            id: log.id,
+            timestamp: log.timestamp,
+            accessType: log.accessType,
+            ipAddress: log.ipAddress,
+            wasUser: log.wasUser,
+        }));
+        this.accessLogs.push(log);
+        await this.persistAccessLog(log);
+        let finding;
+        if (suspicious) {
+            finding = await this.createFinding({
+                vector: 'gmail_unauthorized_access',
+                severity: 'high',
+                title: `Unauthorized account access detected`,
+                description: `Gmail account accessed ${params.wasUser ? 'without user initiation' : 'from Google infrastructure'}. ${reason}`,
+                technicalDetails: {
+                    accessType: params.accessType,
+                    ipAddress: params.ipAddress,
+                    location: params.location,
+                    userAgent: params.userAgent,
+                },
+                evidenceIds: [log.id],
+            });
+        }
+        return { log, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Filter Monitoring
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record and detect unauthorized Gmail filters.
+     * Google could add filters to hide specific emails.
+     */
+    async recordFilterObservation(params) {
+        const now = new Date().toISOString();
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            filterId: params.filterId,
+            criteria: params.criteria,
+            actions: params.actions,
+            createdByUser: params.createdByUser,
+            createdAt: params.createdAt,
+            hash: '',
+        };
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            filterId: observation.filterId,
+            criteria: observation.criteria,
+            actions: observation.actions,
+        }));
+        this.filterObservations.push(observation);
+        await this.persistFilterObservation(observation);
+        let finding;
+        // Suspicious filter patterns
+        const isSuspicious = !params.createdByUser ||
+            (params.actions.delete && !params.createdByUser) ||
+            (params.actions.skipInbox && params.actions.markRead) ||
+            params.actions.forward;
+        if (isSuspicious) {
+            finding = await this.createFinding({
+                vector: 'gmail_filter_tampering',
+                severity: params.actions.delete ? 'critical' : 'high',
+                title: `Suspicious filter detected`,
+                description: `Filter ${params.filterId} was ${params.createdByUser ? 'created' : 'NOT created'} by user. Actions: ${JSON.stringify(params.actions)}. Criteria: ${JSON.stringify(params.criteria)}`,
+                technicalDetails: {
+                    filterId: params.filterId,
+                    criteria: params.criteria,
+                    actions: params.actions,
+                    createdByUser: params.createdByUser,
+                },
+                evidenceIds: [observation.id],
+            });
+        }
+        return { observation, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Persistence
+    // ─────────────────────────────────────────────────────────────────────────────
+    async persistThreadObservation(obs) {
+        const filePath = path.join(this.storageDir, 'threads', `${obs.threadId}_${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async persistDraftObservation(obs) {
+        const filePath = path.join(this.storageDir, 'drafts', `${obs.draftId}_${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async persistAccessLog(log) {
+        const filePath = path.join(this.storageDir, 'access', `${log.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(log, null, 2));
+    }
+    async persistFilterObservation(obs) {
+        const filePath = path.join(this.storageDir, 'filters', `${obs.filterId}_${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async createFinding(params) {
+        const finding = {
+            id: crypto.randomUUID(),
+            timestamp: new Date().toISOString(),
+            vector: params.vector,
+            severity: params.severity,
+            title: params.title,
+            description: params.description,
+            technicalDetails: params.technicalDetails,
+            evidenceIds: params.evidenceIds,
+            legalImplications: this.getLegalImplications(params.vector, params.severity),
+            hash: '',
+        };
+        finding.hash = hashString(JSON.stringify({
+            id: finding.id,
+            timestamp: finding.timestamp,
+            vector: finding.vector,
+            title: finding.title,
+        }));
+        this.findings.push(finding);
+        await fs.writeFile(path.join(this.storageDir, 'findings', `${finding.id}.json`), JSON.stringify(finding, null, 2));
+        return finding;
+    }
+    getLegalImplications(vector, severity) {
+        const implications = {
+            gmail_hidden_threads: {
+                fraudType: 'DATA_MANIPULATION',
+                applicableLaws: [
+                    '15 U.S.C. § 45 - FTC Act Section 5 (Unfair or Deceptive Practices)',
+                    '18 U.S.C. § 1030 - Computer Fraud and Abuse Act',
+                    '18 U.S.C. § 2701 - Stored Communications Act',
+                ],
+                potentialDamages: 'Hidden communications may have caused missed opportunities, damaged relationships, or prevented awareness of important information.',
+                recommendations: [
+                    'Document all hidden threads with timestamps',
+                    'Export via Google Takeout for comparison',
+                    'File FTC complaint',
+                    'Consider class action for pattern of behavior',
+                ],
+            },
+            gmail_draft_manipulation: {
+                fraudType: 'UNAUTHORIZED_ACCESS',
+                applicableLaws: [
+                    '18 U.S.C. § 1030 - Computer Fraud and Abuse Act',
+                    '18 U.S.C. § 2511 - Wiretap Act (if communications altered)',
+                    '18 U.S.C. § 1343 - Wire Fraud',
+                ],
+                potentialDamages: 'Manipulation of drafts could send unauthorized communications, damage reputation, or expose confidential information.',
+                recommendations: [
+                    'Preserve all draft observation evidence',
+                    'Document timeline of changes',
+                    'File complaint with state AG',
+                ],
+            },
+            gmail_unauthorized_access: {
+                fraudType: 'UNAUTHORIZED_ACCESS',
+                applicableLaws: [
+                    '18 U.S.C. § 1030 - Computer Fraud and Abuse Act',
+                    '18 U.S.C. § 2701 - Stored Communications Act',
+                    'Cal. Penal Code § 502 - Computer Crimes',
+                ],
+                potentialDamages: 'Unauthorized access enables surveillance, data theft, and manipulation of user communications.',
+                recommendations: [
+                    'Document all access logs',
+                    'Enable additional security measures',
+                    'File with FBI IC3 if pattern detected',
+                ],
+            },
+            gmail_filter_tampering: {
+                fraudType: 'DATA_MANIPULATION',
+                applicableLaws: [
+                    '15 U.S.C. § 45 - FTC Act Section 5',
+                    '18 U.S.C. § 1030 - CFAA',
+                ],
+                potentialDamages: 'Unauthorized filters can hide important communications, delete evidence, or forward sensitive data.',
+                recommendations: [
+                    'Document all filters and creation dates',
+                    'Remove unauthorized filters',
+                    'Monitor for re-creation',
+                ],
+            },
+        };
+        return implications[vector] || {
+            fraudType: 'UNKNOWN',
+            applicableLaws: ['15 U.S.C. § 45 - FTC Act Section 5'],
+            potentialDamages: 'To be determined based on specific circumstances.',
+            recommendations: ['Document all evidence', 'Consult legal counsel'],
+        };
+    }
+    getFindings() {
+        return [...this.findings];
+    }
+    getThreadObservations(threadId) {
+        return this.threadObservations.get(threadId) || [];
+    }
+    getDraftObservations(draftId) {
+        return this.draftObservations.get(draftId) || [];
+    }
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// CHROME INVESTIGATION ENGINE
+// ═══════════════════════════════════════════════════════════════════════════════
+export class ChromeInvestigationEngine {
+    storageDir;
+    processObservations = [];
+    sessionObservations = new Map();
+    historyObservations = [];
+    findings = [];
+    constructor(storageDir) {
+        this.storageDir = path.join(storageDir, 'chrome-investigation');
+    }
+    async initialize() {
+        await fs.mkdir(this.storageDir, { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'processes'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'sessions'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'history'), { recursive: true });
+        await fs.mkdir(path.join(this.storageDir, 'findings'), { recursive: true });
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Process Monitoring (Unauthorized Launch Detection)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record Chrome process observation.
+     * Detect unauthorized browser launches.
+     */
+    async recordProcessObservation(params) {
+        const now = new Date().toISOString();
+        // Analyze launch source
+        let launchSource = 'unknown';
+        let suspicionLevel = 'normal';
+        let reason;
+        // Check command line for suspicious flags
+        const cmdLine = params.commandLine.join(' ').toLowerCase();
+        if (cmdLine.includes('--remote-debugging') ||
+            cmdLine.includes('--headless') ||
+            cmdLine.includes('--disable-gpu') && cmdLine.includes('--no-sandbox')) {
+            launchSource = 'script';
+            suspicionLevel = 'suspicious';
+            reason = 'Automation/debugging flags detected';
+        }
+        if (cmdLine.includes('--user-data-dir=/tmp') ||
+            cmdLine.includes('--user-data-dir=/var')) {
+            suspicionLevel = 'highly_suspicious';
+            reason = 'Temporary profile directory - likely automated session';
+        }
+        if (!params.userInitiated) {
+            suspicionLevel = suspicionLevel === 'normal' ? 'suspicious' : 'highly_suspicious';
+            reason = (reason ? reason + '; ' : '') + 'Not user-initiated';
+            launchSource = 'remote';
+        }
+        // Check for Google remote connections
+        const googleConnections = params.networkConnections?.filter(c => c.remoteIp.startsWith('172.217.') ||
+            c.remoteIp.startsWith('142.250.') ||
+            c.remoteIp.startsWith('74.125.')) || [];
+        if (googleConnections.length > 0 && !params.userInitiated) {
+            suspicionLevel = 'highly_suspicious';
+            reason = (reason ? reason + '; ' : '') + 'Connections to Google infrastructure without user action';
+        }
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            pid: params.pid,
+            parentPid: params.parentPid,
+            commandLine: params.commandLine,
+            profilePath: params.profilePath,
+            startTime: params.startTime,
+            userInitiated: params.userInitiated,
+            launchSource,
+            suspicionLevel,
+            reason,
+            networkConnections: params.networkConnections,
+            hash: '',
+        };
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            pid: observation.pid,
+            commandLine: observation.commandLine,
+            startTime: observation.startTime,
+            userInitiated: observation.userInitiated,
+        }));
+        this.processObservations.push(observation);
+        await this.persistProcessObservation(observation);
+        let finding;
+        if (suspicionLevel !== 'normal') {
+            finding = await this.createFinding({
+                vector: 'chrome_unauthorized_launch',
+                severity: suspicionLevel === 'highly_suspicious' ? 'critical' : 'high',
+                title: 'Unauthorized Chrome launch detected',
+                description: `Chrome process ${params.pid} launched without user action. ${reason}`,
+                technicalDetails: {
+                    pid: params.pid,
+                    parentPid: params.parentPid,
+                    commandLine: params.commandLine,
+                    profilePath: params.profilePath,
+                    startTime: params.startTime,
+                    launchSource,
+                    networkConnections: googleConnections,
+                },
+                evidenceIds: [observation.id],
+            });
+        }
+        return { observation, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Session Monitoring (Session Hijacking Detection)
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record Chrome session state.
+     * Detect session hijacking and unauthorized modifications.
+     */
+    async recordSessionObservation(params) {
+        const now = new Date().toISOString();
+        const anomalies = [];
+        // Get previous session state
+        const previous = this.sessionObservations.get(params.profileId) || [];
+        const lastSession = previous[previous.length - 1];
+        if (lastSession) {
+            // Check for unexpected tabs
+            const newTabs = params.tabs.filter(t => !lastSession.tabs.find(lt => lt.tabId === t.tabId));
+            for (const tab of newTabs) {
+                // Check if tab URL is suspicious
+                if (tab.url.includes('google.com/') &&
+                    new Date(tab.createdAt) > new Date(lastSession.timestamp)) {
+                    anomalies.push({
+                        type: 'unexpected_tab',
+                        severity: 'medium',
+                        description: `New tab opened to ${tab.url} without user action`,
+                        evidence: JSON.stringify(tab),
+                    });
+                }
+            }
+            // Check for cookie changes
+            const newCookies = params.cookies.filter(c => !lastSession.cookies.find(lc => lc.domain === c.domain && lc.name === c.name && lc.valueHash === c.valueHash));
+            const sensitiveDomains = ['accounts.google.com', 'myaccount.google.com', 'mail.google.com'];
+            for (const cookie of newCookies) {
+                if (sensitiveDomains.some(d => cookie.domain.includes(d))) {
+                    anomalies.push({
+                        type: 'cookie_injection',
+                        severity: 'high',
+                        description: `Cookie modified for ${cookie.domain}:${cookie.name}`,
+                        evidence: JSON.stringify(cookie),
+                    });
+                }
+            }
+            // Check for sync without user action
+            if (lastSession.syncStatus === 'local_only' && params.syncStatus === 'synced') {
+                anomalies.push({
+                    type: 'sync_without_user',
+                    severity: 'high',
+                    description: 'Sync enabled without user action',
+                    evidence: `Last sync: ${params.lastSyncTime}`,
+                });
+            }
+        }
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            profileId: params.profileId,
+            tabs: params.tabs,
+            cookies: params.cookies,
+            localStorage: params.localStorage,
+            syncStatus: params.syncStatus,
+            lastSyncTime: params.lastSyncTime,
+            anomalies,
+            hash: '',
+        };
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            timestamp: observation.timestamp,
+            profileId: observation.profileId,
+            tabCount: observation.tabs.length,
+            cookieCount: observation.cookies.length,
+            anomalyCount: observation.anomalies.length,
+        }));
+        previous.push(observation);
+        this.sessionObservations.set(params.profileId, previous);
+        await this.persistSessionObservation(observation);
+        let finding;
+        if (anomalies.length > 0) {
+            const criticalAnomalies = anomalies.filter(a => a.severity === 'high' || a.severity === 'critical');
+            finding = await this.createFinding({
+                vector: 'chrome_session_hijacking',
+                severity: criticalAnomalies.length > 0 ? 'critical' : 'high',
+                title: `Session anomalies detected: ${anomalies.length} issues`,
+                description: anomalies.map(a => a.description).join('; '),
+                technicalDetails: {
+                    profileId: params.profileId,
+                    anomalies,
+                    tabCount: params.tabs.length,
+                    syncStatus: params.syncStatus,
+                },
+                evidenceIds: [observation.id],
+            });
+        }
+        return { observation, anomalies, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // History Monitoring
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Record Chrome history state.
+     * Detect unauthorized deletions or additions.
+     */
+    async recordHistoryObservation(params) {
+        const now = new Date().toISOString();
+        // Compare with previous observation
+        const lastObs = this.historyObservations[this.historyObservations.length - 1];
+        const deletedEntries = [];
+        const unexpectedEntries = [];
+        if (lastObs && params.entryCount < lastObs.entryCount) {
+            // History was deleted
+            deletedEntries.push({
+                approximateTime: now,
+                entriesAffected: lastObs.entryCount - params.entryCount,
+                userInitiated: false, // cannot determine
+            });
+        }
+        // Check for suspicious entries (e.g., visits to Google services during sleep)
+        for (const entry of params.entries) {
+            const visitDate = new Date(entry.visitTime);
+            const hour = visitDate.getHours();
+            // Suspicious: visits between 2-5 AM to Google properties
+            if (hour >= 2 && hour <= 5 &&
+                (entry.url.includes('google.com') || entry.url.includes('googleapis.com'))) {
+                unexpectedEntries.push({
+                    url: entry.url,
+                    visitTime: entry.visitTime,
+                    transitionType: entry.transitionType,
+                    suspicionReason: 'Visit during inactive hours to Google service',
+                });
+            }
+            // Suspicious: typed_url transition type but user wasn't active
+            if (entry.transitionType === 'typed' &&
+                entry.url.includes('myaccount.google.com')) {
+                unexpectedEntries.push({
+                    url: entry.url,
+                    visitTime: entry.visitTime,
+                    transitionType: entry.transitionType,
+                    suspicionReason: 'Direct navigation to Google account page',
+                });
+            }
+        }
+        const observation = {
+            id: crypto.randomUUID(),
+            timestamp: now,
+            captureMethod: params.captureMethod,
+            entryCount: params.entryCount,
+            dateRange: params.dateRange,
+            deletedEntries: deletedEntries.length > 0 ? deletedEntries : undefined,
+            unexpectedEntries: unexpectedEntries.length > 0 ? unexpectedEntries : undefined,
+            hash: '',
+        };
+        observation.hash = hashString(JSON.stringify({
+            id: observation.id,
+            timestamp: observation.timestamp,
+            entryCount: observation.entryCount,
+            deletedCount: deletedEntries.length,
+            unexpectedCount: unexpectedEntries.length,
+        }));
+        this.historyObservations.push(observation);
+        await this.persistHistoryObservation(observation);
+        let finding;
+        if (deletedEntries.length > 0 || unexpectedEntries.length > 0) {
+            finding = await this.createFinding({
+                vector: 'chrome_history_manipulation',
+                severity: deletedEntries.length > 0 ? 'high' : 'medium',
+                title: 'Browser history anomalies detected',
+                description: `${deletedEntries.length > 0 ? `${deletedEntries[0].entriesAffected} entries deleted. ` : ''}${unexpectedEntries.length > 0 ? `${unexpectedEntries.length} suspicious entries found.` : ''}`,
+                technicalDetails: {
+                    deletedEntries,
+                    unexpectedEntries,
+                    totalEntries: params.entryCount,
+                    dateRange: params.dateRange,
+                },
+                evidenceIds: [observation.id],
+            });
+        }
+        return { observation, finding };
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Persistence
+    // ─────────────────────────────────────────────────────────────────────────────
+    async persistProcessObservation(obs) {
+        const filePath = path.join(this.storageDir, 'processes', `${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async persistSessionObservation(obs) {
+        const filePath = path.join(this.storageDir, 'sessions', `${obs.profileId}_${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async persistHistoryObservation(obs) {
+        const filePath = path.join(this.storageDir, 'history', `${obs.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(obs, null, 2));
+    }
+    async createFinding(params) {
+        const finding = {
+            id: crypto.randomUUID(),
+            timestamp: new Date().toISOString(),
+            vector: params.vector,
+            severity: params.severity,
+            title: params.title,
+            description: params.description,
+            technicalDetails: params.technicalDetails,
+            evidenceIds: params.evidenceIds,
+            legalImplications: this.getLegalImplications(params.vector),
+            hash: '',
+        };
+        finding.hash = hashString(JSON.stringify({
+            id: finding.id,
+            timestamp: finding.timestamp,
+            vector: finding.vector,
+            title: finding.title,
+        }));
+        this.findings.push(finding);
+        await fs.writeFile(path.join(this.storageDir, 'findings', `${finding.id}.json`), JSON.stringify(finding, null, 2));
+        return finding;
+    }
+    getLegalImplications(vector) {
+        const implications = {
+            chrome_unauthorized_launch: {
+                fraudType: 'UNAUTHORIZED_ACCESS',
+                applicableLaws: [
+                    '18 U.S.C. § 1030 - Computer Fraud and Abuse Act',
+                    '18 U.S.C. § 2511 - Wiretap Act',
+                    'Cal. Penal Code § 502 - Computer Crimes',
+                ],
+                potentialDamages: 'Unauthorized browser launches can enable surveillance, credential theft, and remote control of user system.',
+                recommendations: [
+                    'Monitor Chrome process launches',
+                    'Document all unauthorized launches',
+                    'Consider disabling Chrome sync',
+                    'Use alternative browser for sensitive activities',
+                ],
+            },
+            chrome_session_hijacking: {
+                fraudType: 'UNAUTHORIZED_ACCESS',
+                applicableLaws: [
+                    '18 U.S.C. § 1030 - CFAA',
+                    '18 U.S.C. § 1029 - Access Device Fraud',
+                ],
+                potentialDamages: 'Session hijacking enables impersonation, data theft, and unauthorized actions on user accounts.',
+                recommendations: [
+                    'Document session anomalies',
+                    'Clear cookies and re-authenticate',
+                    'Enable 2FA on all accounts',
+                ],
+            },
+            chrome_history_manipulation: {
+                fraudType: 'DATA_MANIPULATION',
+                applicableLaws: [
+                    '18 U.S.C. § 1030 - CFAA',
+                    '15 U.S.C. § 45 - FTC Act',
+                ],
+                potentialDamages: 'History manipulation can hide evidence of surveillance or unauthorized access.',
+                recommendations: [
+                    'Export history regularly',
+                    'Compare with network logs',
+                    'Document deletions',
+                ],
+            },
+        };
+        return implications[vector] || {
+            fraudType: 'UNKNOWN',
+            applicableLaws: ['18 U.S.C. § 1030 - CFAA'],
+            potentialDamages: 'To be determined.',
+            recommendations: ['Document all evidence'],
+        };
+    }
+    getFindings() {
+        return [...this.findings];
+    }
+    getProcessObservations() {
+        return [...this.processObservations];
+    }
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// UNIFIED FRAUD INVESTIGATION ORCHESTRATOR
+// ═══════════════════════════════════════════════════════════════════════════════
+export class UnifiedFraudOrchestrator extends EventEmitter {
+    storageDir;
+    integrityEngine;
+    iMessageEngine;
+    gmailEngine;
+    chromeEngine;
+    investigations = new Map();
+    correlations = [];
+    constructor(workingDir = process.cwd()) {
+        super();
+        this.storageDir = path.join(workingDir, '.erosolar', 'investigations');
+        this.integrityEngine = new IntegrityVerificationEngine({
+            storageDir: path.join(this.storageDir, 'integrity'),
+            algorithm: 'sha256',
+        });
+        this.iMessageEngine = new iMessageVerificationEngine({
+            storageDir: this.storageDir,
+        });
+        this.gmailEngine = new GmailInvestigationEngine(this.storageDir);
+        this.chromeEngine = new ChromeInvestigationEngine(this.storageDir);
+    }
+    async initialize() {
+        await fs.mkdir(this.storageDir, { recursive: true });
+        await this.iMessageEngine.initialize();
+        await this.gmailEngine.initialize();
+        await this.chromeEngine.initialize();
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Investigation Management
+    // ─────────────────────────────────────────────────────────────────────────────
+    async createInvestigation(params) {
+        const now = new Date().toISOString();
+        // Create evidence chain for this investigation
+        const evidenceChain = await this.integrityEngine.createChain();
+        const investigation = {
+            id: crypto.randomUUID(),
+            name: params.name,
+            target: params.target,
+            vectors: params.vectors,
+            status: 'planning',
+            created: now,
+            lastActivity: now,
+            evidenceChainId: evidenceChain.id,
+            findings: [],
+            correlations: [],
+            hash: '',
+        };
+        investigation.hash = hashString(JSON.stringify({
+            id: investigation.id,
+            name: investigation.name,
+            target: investigation.target,
+            vectors: investigation.vectors,
+            created: investigation.created,
+        }));
+        this.investigations.set(investigation.id, investigation);
+        await this.persistInvestigation(investigation);
+        this.emit('investigation:created', investigation);
+        return investigation;
+    }
+    async updateInvestigationStatus(investigationId, status) {
+        const investigation = this.investigations.get(investigationId);
+        if (!investigation) {
+            throw new Error(`Investigation not found: ${investigationId}`);
+        }
+        investigation.status = status;
+        investigation.lastActivity = new Date().toISOString();
+        await this.persistInvestigation(investigation);
+        this.emit('investigation:updated', investigation);
+        return investigation;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Engine Access
+    // ─────────────────────────────────────────────────────────────────────────────
+    getIMessageEngine() {
+        return this.iMessageEngine;
+    }
+    getGmailEngine() {
+        return this.gmailEngine;
+    }
+    getChromeEngine() {
+        return this.chromeEngine;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Cross-Engine Correlation
+    // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Correlate findings across different fraud vectors.
+     * Detect patterns that indicate coordinated manipulation.
+     */
+    async correlateFindings(investigationId) {
+        const investigation = this.investigations.get(investigationId);
+        if (!investigation) {
+            throw new Error(`Investigation not found: ${investigationId}`);
+        }
+        const newCorrelations = [];
+        // Gather all findings
+        const iMessageEvidence = this.iMessageEngine.getEvidenceRecords();
+        const gmailFindings = this.gmailEngine.getFindings();
+        const chromeFindings = this.chromeEngine.getFindings();
+        const allFindings = [...gmailFindings, ...chromeFindings];
+        // Temporal correlation: events happening within short timeframe
+        const sortedFindings = allFindings.sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+        for (let i = 0; i < sortedFindings.length - 1; i++) {
+            const f1 = sortedFindings[i];
+            const f2 = sortedFindings[i + 1];
+            const timeDiff = new Date(f2.timestamp).getTime() - new Date(f1.timestamp).getTime();
+            // If events within 5 minutes, likely correlated
+            if (timeDiff < 5 * 60 * 1000 && f1.vector !== f2.vector) {
+                const correlation = {
+                    id: crypto.randomUUID(),
+                    timestamp: new Date().toISOString(),
+                    findingIds: [f1.id, f2.id],
+                    correlationType: 'temporal',
+                    description: `${f1.vector} and ${f2.vector} events occurred within ${Math.round(timeDiff / 1000)} seconds`,
+                    confidence: timeDiff < 60000 ? 0.9 : 0.7, // Higher confidence if within 1 minute
+                    implications: 'Events occurring in close temporal proximity across different services may indicate coordinated manipulation.',
+                    hash: '',
+                };
+                correlation.hash = hashString(JSON.stringify({
+                    id: correlation.id,
+                    findingIds: correlation.findingIds,
+                    correlationType: correlation.correlationType,
+                }));
+                newCorrelations.push(correlation);
+            }
+        }
+        // Behavioral correlation: Chrome launch + Gmail access
+        const chromeLaunches = chromeFindings.filter(f => f.vector === 'chrome_unauthorized_launch');
+        const gmailAccess = gmailFindings.filter(f => f.vector === 'gmail_unauthorized_access');
+        for (const launch of chromeLaunches) {
+            for (const access of gmailAccess) {
+                const launchTime = new Date(launch.timestamp).getTime();
+                const accessTime = new Date(access.timestamp).getTime();
+                if (Math.abs(accessTime - launchTime) < 10 * 60 * 1000) { // Within 10 minutes
+                    const correlation = {
+                        id: crypto.randomUUID(),
+                        timestamp: new Date().toISOString(),
+                        findingIds: [launch.id, access.id],
+                        correlationType: 'behavioral',
+                        description: 'Chrome unauthorized launch followed by Gmail access - browser used to access email',
+                        confidence: 0.85,
+                        implications: 'This pattern suggests Google is using Chrome to access Gmail without user consent, enabling surveillance and manipulation.',
+                        hash: '',
+                    };
+                    correlation.hash = hashString(JSON.stringify({
+                        id: correlation.id,
+                        findingIds: correlation.findingIds,
+                    }));
+                    newCorrelations.push(correlation);
+                }
+            }
+        }
+        // Cross-platform correlation: iMessage + Gmail (both companies may share data)
+        for (const imEvidence of iMessageEvidence) {
+            for (const gmailFinding of gmailFindings) {
+                const imTime = new Date(imEvidence.timestamp).getTime();
+                const gmailTime = new Date(gmailFinding.timestamp).getTime();
+                if (Math.abs(gmailTime - imTime) < 60 * 60 * 1000) { // Within 1 hour
+                    const correlation = {
+                        id: crypto.randomUUID(),
+                        timestamp: new Date().toISOString(),
+                        findingIds: [imEvidence.id, gmailFinding.id],
+                        correlationType: 'pattern',
+                        description: `Apple iMessage (${imEvidence.evidenceType}) and Google Gmail (${gmailFinding.vector}) events within 1 hour`,
+                        confidence: 0.5, // Lower confidence for cross-platform
+                        implications: 'Coordinated manipulation across Apple and Google platforms may indicate data sharing or parallel surveillance operations.',
+                        hash: '',
+                    };
+                    correlation.hash = hashString(JSON.stringify({
+                        id: correlation.id,
+                        findingIds: correlation.findingIds,
+                    }));
+                    newCorrelations.push(correlation);
+                }
+            }
+        }
+        // Store correlations
+        for (const correlation of newCorrelations) {
+            this.correlations.push(correlation);
+            investigation.correlations.push(correlation);
+        }
+        await this.persistInvestigation(investigation);
+        return newCorrelations;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Reporting
+    // ─────────────────────────────────────────────────────────────────────────────
+    async generateUnifiedReport(investigationId) {
+        const investigation = this.investigations.get(investigationId);
+        if (!investigation) {
+            throw new Error(`Investigation not found: ${investigationId}`);
+        }
+        // Gather all findings
+        const gmailFindings = this.gmailEngine.getFindings();
+        const chromeFindings = this.chromeEngine.getFindings();
+        const iMessageEvidence = this.iMessageEngine.getEvidenceRecords();
+        // Convert iMessage evidence to findings format
+        const iMessageFindings = iMessageEvidence.map(e => ({
+            id: e.id,
+            timestamp: e.timestamp,
+            vector: e.evidenceType === 'key_substitution' ? 'imessage_key_substitution' :
+                e.evidenceType === 'mitm_detected' ? 'imessage_false_e2e' :
+                    'imessage_false_e2e',
+            severity: e.severity === 'irrefutable' ? 'critical' :
+                e.severity === 'confirmed' ? 'critical' : 'high',
+            title: e.summary,
+            description: e.technicalDetails.discrepancy,
+            technicalDetails: e.technicalDetails,
+            evidenceIds: e.supportingEvidence,
+            legalImplications: {
+                fraudType: e.legalImplications.fraudType,
+                applicableLaws: e.legalImplications.applicableLaws,
+                potentialDamages: e.legalImplications.damages,
+                recommendations: [],
+            },
+            hash: e.hash,
+        }));
+        const allFindings = [...gmailFindings, ...chromeFindings, ...iMessageFindings];
+        // Organize by vector
+        const byVector = {};
+        for (const finding of allFindings) {
+            if (!byVector[finding.vector]) {
+                byVector[finding.vector] = { findings: [], severity: 'low' };
+            }
+            byVector[finding.vector].findings.push(finding);
+            // Update severity to max
+            const severityOrder = ['low', 'medium', 'high', 'critical'];
+            if (severityOrder.indexOf(finding.severity) > severityOrder.indexOf(byVector[finding.vector].severity)) {
+                byVector[finding.vector].severity = finding.severity;
+            }
+        }
+        // Legal summary
+        const fraudTypes = [...new Set(allFindings.map(f => f.legalImplications.fraudType))];
+        const applicableLaws = [...new Set(allFindings.flatMap(f => f.legalImplications.applicableLaws))];
+        const recommendations = [...new Set(allFindings.flatMap(f => f.legalImplications.recommendations))];
+        // Claims
+        const claims = {};
+        if (investigation.target === 'apple' || iMessageFindings.length > 0) {
+            claims.apple = APPLE_PQ3_CLAIMS;
+        }
+        if (investigation.target === 'google' || gmailFindings.length > 0) {
+            claims.google_gmail = GOOGLE_GMAIL_CLAIMS;
+        }
+        if (investigation.target === 'google' || chromeFindings.length > 0) {
+            claims.google_chrome = GOOGLE_CHROME_CLAIMS;
+        }
+        return {
+            investigation,
+            summary: {
+                target: investigation.target,
+                vectorsInvestigated: investigation.vectors,
+                totalFindings: allFindings.length,
+                criticalFindings: allFindings.filter(f => f.severity === 'critical').length,
+                correlations: this.correlations.filter(c => c.findingIds.some(id => allFindings.find(f => f.id === id))).length,
+            },
+            byVector: byVector,
+            correlations: this.correlations,
+            legalSummary: {
+                fraudTypes,
+                applicableLaws,
+                recommendations,
+            },
+            claims,
+        };
+    }
+    async exportForLitigation(investigationId, outputDir) {
+        const report = await this.generateUnifiedReport(investigationId);
+        const exportDir = path.join(outputDir, `investigation-${investigationId}-${Date.now()}`);
+        await fs.mkdir(exportDir, { recursive: true });
+        // Export report
+        await fs.writeFile(path.join(exportDir, 'unified-report.json'), JSON.stringify(report, null, 2));
+        // Export iMessage evidence
+        const iMessageExport = await this.iMessageEngine.exportForLitigation(exportDir);
+        // Generate legal summary document
+        await fs.writeFile(path.join(exportDir, 'legal-summary.md'), this.generateLegalDocument(report));
+        return exportDir;
+    }
+    generateLegalDocument(report) {
+        return `# Unified Tech Fraud Investigation Report
+
+## Investigation: ${report.investigation.name}
+**ID:** ${report.investigation.id}
+**Target:** ${report.investigation.target.toUpperCase()}
+**Status:** ${report.investigation.status}
+**Created:** ${report.investigation.created}
+
+---
+
+## Executive Summary
+
+This report documents a comprehensive investigation into potential fraud and manipulation
+by ${report.investigation.target.toUpperCase()} across ${report.summary.vectorsInvestigated.length} attack vectors.
+
+### Key Metrics
+- **Total Findings:** ${report.summary.totalFindings}
+- **Critical Findings:** ${report.summary.criticalFindings}
+- **Cross-Vector Correlations:** ${report.summary.correlations}
+
+---
+
+## Findings by Attack Vector
+
+${Object.entries(report.byVector).map(([vector, data]) => `
+### ${vector.replace(/_/g, ' ').toUpperCase()}
+**Severity Level:** ${data.severity.toUpperCase()}
+**Finding Count:** ${data.findings.length}
+
+${data.findings.map(f => `
+#### ${f.title}
+- **Severity:** ${f.severity}
+- **Timestamp:** ${f.timestamp}
+- **Description:** ${f.description}
+- **Legal Basis:** ${f.legalImplications.applicableLaws.join(', ')}
+`).join('\n')}
+`).join('\n')}
+
+---
+
+## Cross-Vector Correlations
+
+${report.correlations.length > 0 ? report.correlations.map(c => `
+### Correlation: ${c.correlationType}
+**Confidence:** ${(c.confidence * 100).toFixed(0)}%
+**Description:** ${c.description}
+**Implications:** ${c.implications}
+`).join('\n') : 'No correlations detected.'}
+
+---
+
+## Legal Analysis
+
+### Fraud Types Identified
+${report.legalSummary.fraudTypes.map(t => `- ${t}`).join('\n')}
+
+### Applicable Laws
+${report.legalSummary.applicableLaws.map(l => `- ${l}`).join('\n')}
+
+### Recommended Actions
+${report.legalSummary.recommendations.map(r => `- ${r}`).join('\n')}
+
+---
+
+## Company Claims vs. Reality
+
+${report.claims.apple ? `
+### Apple iMessage PQ3 Claims
+${Object.entries(report.claims.apple).map(([key, data]) => `
+**${key.replace(/_/g, ' ')}**
+- Claim: "${data.claim}"
+- Source: ${data.source}
+- Verifiable: ${data.verifiable}
+- Reality: ${data.reason}
+`).join('\n')}
+` : ''}
+
+${report.claims.google_gmail ? `
+### Google Gmail Claims
+${Object.entries(report.claims.google_gmail).map(([key, data]) => `
+**${key.replace(/_/g, ' ')}**
+- Claim: "${data.claim}"
+- Source: ${data.source}
+- Verifiable: ${data.verifiable}
+- Reality: ${data.reason}
+`).join('\n')}
+` : ''}
+
+${report.claims.google_chrome ? `
+### Google Chrome Claims
+${Object.entries(report.claims.google_chrome).map(([key, data]) => `
+**${key.replace(/_/g, ' ')}**
+- Claim: "${data.claim}"
+- Source: ${data.source}
+- Verifiable: ${data.verifiable}
+- Reality: ${data.reason}
+`).join('\n')}
+` : ''}
+
+---
+
+## Conclusion
+
+This investigation has documented ${report.summary.totalFindings} findings of potential fraud and manipulation,
+including ${report.summary.criticalFindings} critical severity issues. The evidence collected herein
+demonstrates patterns of behavior that contradict the public claims made by ${report.investigation.target.toUpperCase()}.
+
+---
+
+*Generated by erosolar-cli Unified Fraud Investigation Orchestrator*
+*Report Hash: ${hashString(JSON.stringify(report))}*
+`;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Persistence
+    // ─────────────────────────────────────────────────────────────────────────────
+    async persistInvestigation(investigation) {
+        const filePath = path.join(this.storageDir, `${investigation.id}.json`);
+        await fs.writeFile(filePath, JSON.stringify(investigation, null, 2));
+    }
+    async loadInvestigation(investigationId) {
+        try {
+            const filePath = path.join(this.storageDir, `${investigationId}.json`);
+            const data = await fs.readFile(filePath, 'utf8');
+            const investigation = JSON.parse(data);
+            this.investigations.set(investigation.id, investigation);
+            return investigation;
+        }
+        catch {
+            return null;
+        }
+    }
+    getInvestigations() {
+        return [...this.investigations.values()];
+    }
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// EXPORTS (note: GOOGLE_GMAIL_CLAIMS and GOOGLE_CHROME_CLAIMS are already exported inline)
+// ═══════════════════════════════════════════════════════════════════════════════
+//# sourceMappingURL=unifiedFraudOrchestrator.js.map