@chainpatrol/cli 0.10.0 → 0.12.0

package/dist/cli.js

@@ -13,8 +13,8 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-R2DZGMGT.js";
-import "./chunk-Z76CUWSS.js";
+} from "./chunk-W42ITB5J.js";
+import "./chunk-NQT77IB7.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";
@@ -92,14 +92,31 @@ var HELP = {
     usage: "chainpatrol logout"
   },
   asset: {
-    description: "Check whether one or more assets are BLOCKED, ALLOWED, or UNKNOWN.",
-    usage: "chainpatrol asset check <content> [<content> ...]",
+    description: "Check asset status or list blocked/allowed assets across the global ChainPatrol blocklist.",
+    usage: "chainpatrol asset <check|list>",
     examples: [
       "chainpatrol asset check https://phish.example",
-      "chainpatrol asset check a.example b.example c.example",
+      "chainpatrol asset list --asset-type URL --from 2026-05-01",
       "chainpatrol --json asset check 0xabc123\u2026"
     ]
   },
+  "asset list": {
+    description: "List assets in the global ChainPatrol blocklist for a given asset type. Defaults to BLOCKED assets updated in the last day. Use --from and --to to widen the window.",
+    usage: "chainpatrol asset list --asset-type <type> [--from ISO --to ISO] [filters]",
+    options: [
+      "--asset-type <type>     Asset type: URL|ADDRESS|TWITTER|TELEGRAM|DISCORD|...",
+      "--type <type>           Alias for --asset-type",
+      "--asset-status <s>      Status filter: BLOCKED|ALLOWED|UNKNOWN (default BLOCKED)",
+      "--from <iso>            Start date (YYYY-MM-DD)",
+      "--to <iso>              End date (YYYY-MM-DD)",
+      "--per-page <n>          Page size 1-10000 (default 100; --limit also accepted)",
+      "--next-page <cursor>    Cursor returned from a previous response"
+    ],
+    examples: [
+      "chainpatrol asset list --asset-type URL --from 2026-05-01 --to 2026-05-17",
+      "chainpatrol asset list --asset-type ADDRESS --per-page 500 --output csv"
+    ]
+  },
   "asset check": {
     description: "Look up one or more assets (URL, domain, or crypto address) against the ChainPatrol blocklist and external feeds. Returns the aggregated status plus a per-source breakdown. Multiple assets can be passed as positional arguments or via repeated --asset; they are checked in parallel (concurrency 10).",
     usage: "chainpatrol asset check <content> [<content> ...]",
@@ -127,17 +144,46 @@ var HELP = {
     examples: ["chainpatrol configs list --org acme"]
   },
   detections: {
-    description: "Validate, run, and update detection configs.",
-    usage: "chainpatrol detections <healthcheck|validate|drift|run|configs>",
+    description: "Validate, run, list, and update detection configs and results.",
+    usage: "chainpatrol detections <healthcheck|validate|drift|run|list|configs>",
     options: ["--org <slug>          Organization slug"],
     examples: [
       "chainpatrol detections healthcheck --org acme --run",
       "chainpatrol detections validate --org acme --min-results 5",
       "chainpatrol detections drift --org acme --lookback-hours 168",
       "chainpatrol detections run --org acme --source twitter",
+      "chainpatrol detections list --org acme --confidence medium,high",
       "chainpatrol detections configs update --org acme --config-id 1 --enable"
     ]
   },
+  "detections list": {
+    description: "List recent threat detection results for an organization. Returns human-readable confidence levels (none/low/medium/high) and report status. Filter parity with the app's detections view: source, confidence, asset status/type, brand, liveness, watchlist, reported, country, and deleted items.",
+    usage: "chainpatrol detections list --org <slug> [filters]",
+    options: [
+      "--org <slug>           Organization slug",
+      "--limit <n>            Page size 1-100 (default 50)",
+      "--cursor <n>           Pagination cursor",
+      "--search <q>           Search by threat content",
+      "--source <list>        Comma list of detection source keys",
+      "--confidence <list>    Comma list: none|low|medium|high",
+      "--asset-status <list>  Comma list: BLOCKED|ALLOWED|UNKNOWN",
+      "--asset-type <list>    Comma list of asset types",
+      "--brand <ids>          Comma list of brand IDs",
+      "--liveness <list>      Comma list: ALIVE|DEAD|UNKNOWN",
+      "--watchlist <list>     Comma list: ENABLED|DISABLED",
+      "--reported <list>      Comma list: reported|not_reported",
+      "--country-code <list>  Comma list of 2-letter ISO country codes (e.g. US,GB)",
+      "--only-deleted         Return only soft-deleted detections. Without this flag the endpoint returns both deleted and non-deleted (existing public-API behavior).",
+      "--from <iso>           Start date (ISO 8601)",
+      "--to <iso>             End date (ISO 8601)"
+    ],
+    examples: [
+      "chainpatrol detections list --org acme --confidence medium,high",
+      "chainpatrol detections list --org acme --source twitter --liveness ALIVE",
+      "chainpatrol detections list --org acme --reported not_reported --watchlist ENABLED",
+      "chainpatrol detections list --org acme --brand 12,34 --country-code US,GB"
+    ]
+  },
   "detections healthcheck": {
     description: "Run a health check across all detection configs for an org.",
     usage: "chainpatrol detections healthcheck --org <slug> [options]",
@@ -207,12 +253,28 @@ var HELP = {
   },
   metrics: {
     description: "Query organization metrics and breakdowns.",
-    usage: "chainpatrol metrics <summary|found|breakdown>",
+    usage: "chainpatrol metrics <summary|found|breakdown|organization>",
     options: ["--org <slug>          Organization slug"],
     examples: [
       "chainpatrol metrics summary --org acme --this-week",
       "chainpatrol metrics found --org acme --from 2025-01-01 --to 2025-02-01",
-      "chainpatrol metrics breakdown --org acme --by day --this-week"
+      "chainpatrol metrics breakdown --org acme --by day --this-week",
+      "chainpatrol metrics organization --org acme --from 2025-01-01 --to 2025-02-01"
+    ]
+  },
+  "metrics organization": {
+    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with both API key auth (org derived from key) and session auth (pass --org).",
+    usage: "chainpatrol metrics organization [--org <slug>] [--from ISO --to ISO]",
+    options: [
+      "--org <slug>          Organization slug (omit when using an API key)",
+      "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag)",
+      "--from <iso>          Start date (ISO 8601, e.g. 2026-01-01)",
+      "--to <iso>            End date (ISO 8601)"
+    ],
+    examples: [
+      "chainpatrol metrics organization --org acme",
+      "chainpatrol metrics organization --org acme --from 2026-01-01 --to 2026-02-01",
+      "CHAINPATROL_API_KEY=... chainpatrol metrics organization --json"
     ]
   },
   "metrics summary": {
@@ -248,11 +310,25 @@ var HELP = {
     ]
   },
   reports: {
-    description: "Create and list reports from the terminal.",
-    usage: "chainpatrol reports <create|list>",
+    description: "Create, list, and search reports from the terminal.",
+    usage: "chainpatrol reports <create|list|search>",
     examples: [
       'chainpatrol reports create --org acme --title "Phish" --asset "https://bad.site:BLOCKED"',
-      "chainpatrol reports list --org acme --limit 5"
+      "chainpatrol reports list --org acme --limit 5",
+      "chainpatrol reports search https://bad.site"
+    ]
+  },
+  "reports search": {
+    description: "Search existing reports in your organization by asset contents. Useful to check for an existing report before creating a duplicate.",
+    usage: "chainpatrol reports search <content> [<content> ...]",
+    options: [
+      "--asset <content>          Asset content (repeatable; alternative to positional args)",
+      "--reported-by-customer     Match only customer-submitted reports",
+      "--no-reported-by-customer  Match only non-customer reports"
+    ],
+    examples: [
+      "chainpatrol reports search https://bad.site",
+      "chainpatrol reports search https://a.site https://b.site --reported-by-customer"
     ]
   },
   "reports create": {
@@ -275,16 +351,34 @@ var HELP = {
     ]
   },
   "reports list": {
-    description: "List recent reports for an organization.",
-    usage: "chainpatrol reports list --org <slug> [options]",
+    description: "List recent reports for an organization with the same level of filtering as the app's Reports view.",
+    usage: "chainpatrol reports list --org <slug> [filters]",
     options: [
-      "--org <slug>             Organization slug",
-      "--limit <n>              Page size (1-20)",
-      "--cursor <id>            Pagination cursor",
-      "--status <s>             Filter by report status",
-      "--search <q>             Search query",
-      "--reported-by-customer   Show only customer-submitted reports",
-      "--no-reported-by-customer Show only non-customer reports"
+      "--org <slug>               Organization slug",
+      "--limit <n>                Page size (1-20)",
+      "--cursor <id>              Pagination cursor",
+      "--status <s>               Filter by report status: TODO|IN_PROGRESS|CLOSED",
+      "--search <q>               Search reports by title/description",
+      "--reporter-query <q>       Search reports by reporter name (legacy)",
+      "--reported-by-customer     Show only customer-submitted reports",
+      "--no-reported-by-customer  Show only non-customer reports",
+      "--exclude-automation       Exclude reports submitted by automation",
+      "--only-rejected            Only reports whose latest review decision was REJECT",
+      "--review-status <list>     Comma list: APPROVE|REJECT|SKIP|ESCALATE",
+      "--asset-type <list>        Comma list of asset types (URL,TWITTER,...)",
+      "--brand <ids>              Comma list of brand IDs",
+      "--country-code <list>      Comma list of 2-letter ISO country codes",
+      "--reviewed-by-user-id <n>  Only reports reviewed by a specific user ID",
+      "--from <iso>               Filter by Report.createdAt >= ISO date",
+      "--to <iso>                 Filter by Report.createdAt <= ISO date",
+      "--updated-from <iso>       Filter by Report.updatedAt >= ISO date",
+      "--updated-to <iso>         Filter by Report.updatedAt <= ISO date"
+    ],
+    examples: [
+      "chainpatrol reports list --org acme --status TODO --review-status REJECT",
+      "chainpatrol reports list --org acme --exclude-automation --reported-by-customer",
+      "chainpatrol reports list --org acme --from 2026-05-01 --updated-from 2026-05-10",
+      "chainpatrol reports list --org acme --brand 12,34 --country-code US,GB"
     ]
   },
   queues: {
@@ -295,6 +389,71 @@ var HELP = {
       "chainpatrol queues snapshot --all"
     ]
   },
+  threats: {
+    description: "List confirmed threats blocked by ChainPatrol.",
+    usage: "chainpatrol threats list [filters]",
+    examples: [
+      "chainpatrol threats list",
+      "chainpatrol threats list --from 2026-05-01 --asset-type URL"
+    ]
+  },
+  "threats list": {
+    description: "List threats blocked by ChainPatrol. Org is derived from your API key. Defaults to the last 1 day. Use --from and --to to widen the window.",
+    usage: "chainpatrol threats list [filters]",
+    options: [
+      "--query <text>          Search threat content (substring)",
+      "--from <iso>            Start date (YYYY-MM-DD)",
+      "--to <iso>              End date (YYYY-MM-DD)",
+      "--asset-type <list>     Comma list (URL,TWITTER,TELEGRAM,...)",
+      "--sort-by <key>         Sort key (e.g. blockedAt)",
+      "--sort-direction <dir>  asc|desc",
+      "--per-page <n>          Page size 1-100 (default 10)",
+      "--next-page <cursor>    Cursor returned from a previous response"
+    ],
+    examples: [
+      "chainpatrol threats list --from 2026-05-01 --asset-type URL",
+      "CHAINPATROL_API_KEY=... chainpatrol threats list --json"
+    ]
+  },
+  takedowns: {
+    description: "List individual takedown records for an organization.",
+    usage: "chainpatrol takedowns list [--org <slug>] [filters]",
+    examples: [
+      "chainpatrol takedowns list --org acme",
+      "chainpatrol takedowns list --org acme --takedown-status TODO,IN_PROGRESS",
+      "chainpatrol takedowns list --org acme --from 2026-01-01 --to 2026-02-01 --per-page 50"
+    ]
+  },
+  "takedowns list": {
+    description: "List takedowns for an organization with the same level of filtering as the app's Takedowns view. Defaults to takedowns updated in the last 30 days. Works with both API key auth (org derived from key) and session auth (pass --org).",
+    usage: "chainpatrol takedowns list [--org <slug>] [filters]",
+    options: [
+      "--org <slug>                       Organization slug (omit when using an API key)",
+      "--query <text>                     Search asset content (substring match)",
+      "--from <iso>                       Filter by Takedown.updatedAt >= ISO date",
+      "--to <iso>                         Filter by Takedown.updatedAt <= ISO date",
+      "--started-from <iso>               Filter by `started at` >= ISO date (earliest IN_PROGRESS event)",
+      "--started-to <iso>                 Filter by `started at` <= ISO date",
+      "--asset-type <list>                Comma list (URL,TWITTER,TELEGRAM,...)",
+      "--takedown-status <list>           Comma list (TODO,IN_PROGRESS,COMPLETED,CANCELLED,PENDING_INPUT,...)",
+      "--liveness-status <list>           Comma list (ALIVE,DEAD,UNKNOWN)",
+      "--brand <ids>                      Comma list of brand IDs",
+      "--assignee <ids>                   Comma list of assignee user IDs",
+      "--hide-automated-takedowns         Hide takedowns handled by the platform-takedown automation",
+      "--hide-automated-liveness-checks   Hide takedowns whose asset is checked for liveness automatically",
+      "--sort-by <key>                    Sort key: updatedAt|createdAt|takedownStatus|takedownUpdatedAt|assigneeId|brandId",
+      "--sort-direction <dir>             asc|desc (default desc)",
+      "--per-page <n>                     Page size 1-100 (default 10; --limit also accepted)",
+      "--next-page <cursor>               Cursor returned from a previous response"
+    ],
+    examples: [
+      "chainpatrol takedowns list --org acme --takedown-status TODO,IN_PROGRESS",
+      "chainpatrol takedowns list --org acme --asset-type URL --liveness-status ALIVE",
+      "chainpatrol takedowns list --org acme --brand 12,34 --assignee 7",
+      "chainpatrol takedowns list --org acme --started-from 2026-04-01 --hide-automated-takedowns",
+      "CHAINPATROL_API_KEY=... chainpatrol takedowns list --json"
+    ]
+  },
   "queues snapshot": {
     description: "Snapshot pending review proposals and open takedowns.",
     usage: "chainpatrol queues snapshot [--org <slug>|--all] [--window-hours <n>]",
@@ -305,13 +464,43 @@ var HELP = {
     ]
   },
   orgs: {
-    description: "List organizations accessible to you with subscription status and service toggles.",
-    usage: "chainpatrol orgs list [filters]",
+    description: "List organizations, their assets, and asset groups. Top-level `orgs list` lists organizations accessible to you; the nested subcommands operate on the org tied to your API key.",
+    usage: "chainpatrol orgs <list|assets list|asset-groups list>",
     examples: [
       "chainpatrol orgs list",
-      "chainpatrol orgs list --subscription-status ACTIVE --service-active takedowns --service-manual takedowns"
+      "chainpatrol orgs assets list --asset-type URL",
+      "chainpatrol orgs asset-groups list"
+    ]
+  },
+  "orgs assets": {
+    description: "List assets in your organization's allowlist.",
+    usage: "chainpatrol orgs assets list [filters]"
+  },
+  "orgs assets list": {
+    description: "List assets belonging to your organization's allowlist. Org is derived from your API key. Supports filtering by type, group, and search query.",
+    usage: "chainpatrol orgs assets list [filters]",
+    options: [
+      "--asset-type <type>     Filter by asset type (URL, ADDRESS, ...)",
+      "--type <type>           Alias for --asset-type",
+      "--group-id <n>          Filter by group ID. Use -1 for ungrouped assets only",
+      "--query <text>          Search asset content (substring)",
+      "--per-page <n>          Page size 1-1000 (default 100; --limit also accepted)",
+      "--next-page <cursor>    Cursor returned from a previous response"
+    ],
+    examples: [
+      "chainpatrol orgs assets list --asset-type URL",
+      "chainpatrol orgs assets list --group-id 12 --per-page 250 --output csv"
     ]
   },
+  "orgs asset-groups": {
+    description: "List asset groups in your organization.",
+    usage: "chainpatrol orgs asset-groups list"
+  },
+  "orgs asset-groups list": {
+    description: "List asset groups belonging to your organization with per-group asset counts. Org is derived from your API key.",
+    usage: "chainpatrol orgs asset-groups list",
+    examples: ["chainpatrol orgs asset-groups list --output csv"]
+  },
   "orgs list": {
     description: "List organizations with their subscription status and per-service active/automated flags. All filters compose with AND.",
     usage: "chainpatrol orgs list [filters]",
@@ -390,6 +579,15 @@ var HELP = {
     description: "Output a shell completion script.",
     usage: "chainpatrol completions <zsh|bash>",
     examples: ["chainpatrol completions zsh > _chainpatrol"]
+  },
+  whoami: {
+    description: "Show the current authenticated identity. With an API key, validates the key and reports the bound organization. With a session token, returns the logged-in user.",
+    usage: "chainpatrol whoami",
+    examples: [
+      "chainpatrol whoami",
+      "chainpatrol whoami --json",
+      "CHAINPATROL_API_KEY=... chainpatrol whoami"
+    ]
   }
 };
 function getCommandHelp(command2, subcommand2) {
@@ -414,14 +612,17 @@ function getTopLevelHelp() {
     "  Commands",
     "    login         Authenticate with ChainPatrol",
     "    logout        Clear stored credentials",
-    "    asset         Check asset status against ChainPatrol",
+    "    whoami        Show the current authenticated identity",
+    "    asset         Check or list assets in the global ChainPatrol blocklist",
     "    configs       Manage detection configs",
-    "    detections    Validate, run, update detection configs",
+    "    detections    Validate, run, list, update detection configs and results",
     "    healthchecks  List and run organization healthchecks",
     "    metrics       Query organization metrics and breakdowns",
-    "    reports       Create and list reports from terminal",
+    "    reports       Create, list, and search reports from terminal",
     "    queues        Snapshot operations review/takedown queues",
-    "    orgs          List organizations and filter by status/services",
+    "    takedowns     List individual takedown records",
+    "    threats       List confirmed threats blocked by ChainPatrol",
+    "    orgs          List organizations, org assets, and asset groups",
     "    presets       Run saved workflows for common jobs",
     "    setup         Install Claude Code skill and shell completions",
     "    uninstall     Remove Claude Code skill and shell completions",
@@ -592,11 +793,14 @@ var COMMANDS = [
   "metrics",
   "reports",
   "queues",
+  "takedowns",
+  "threats",
   "orgs",
   "presets",
   "setup",
   "uninstall",
   "completions",
+  "whoami",
   "help"
 ];
 function levenshtein(a, b) {
@@ -675,6 +879,35 @@ ${getTopLevelHelp()}
     serviceAutomated: { type: "string" },
     serviceManual: { type: "string" },
     query: { type: "string" },
+    assetType: { type: "string" },
+    takedownStatus: { type: "string" },
+    livenessStatus: { type: "string" },
+    nextPage: { type: "string" },
+    sortBy: { type: "string" },
+    sortDirection: { type: "string" },
+    perPage: { type: "number" },
+    brandSlug: { type: "string" },
+    type: { type: "string" },
+    groupId: { type: "number" },
+    confidence: { type: "string" },
+    assetStatus: { type: "string" },
+    liveness: { type: "string" },
+    watchlist: { type: "string" },
+    reported: { type: "string" },
+    countryCode: { type: "string" },
+    onlyDeleted: { type: "boolean", default: false },
+    assignee: { type: "string" },
+    startedFrom: { type: "string" },
+    startedTo: { type: "string" },
+    hideAutomatedTakedowns: { type: "boolean" },
+    hideAutomatedLivenessChecks: { type: "boolean" },
+    reporterQuery: { type: "string" },
+    excludeAutomation: { type: "boolean" },
+    onlyRejected: { type: "boolean" },
+    reviewStatus: { type: "string" },
+    reviewedByUserId: { type: "number" },
+    updatedFrom: { type: "string" },
+    updatedTo: { type: "string" },
     help: { type: "boolean", shortFlag: "h" },
     version: { type: "boolean", shortFlag: "V" },
     quiet: { type: "boolean", default: false, shortFlag: "q" },
@@ -765,26 +998,42 @@ function getConfigPatchFromSetFlags() {
   return patch;
 }
 function parseBrandIds() {
-  if (!cli.flags.brand) return void 0;
-  const values = cli.flags.brand.split(",").map((item) => item.trim()).filter(Boolean);
-  const ids = values.map((value) => Number(value)).filter((value) => !Number.isNaN(value));
-  return ids.length > 0 ? ids : void 0;
+  return parseIntList(cli.flags.brand, "brand");
 }
 function parseAssetInputs() {
   return getRepeatedFlag("asset");
 }
+function parseCsvList(value) {
+  if (!value) return void 0;
+  const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+  return items.length > 0 ? items : void 0;
+}
+function parseIntList(value, flagName) {
+  const items = parseCsvList(value);
+  if (!items) return void 0;
+  const parsed = items.map((item) => {
+    const n = Number(item);
+    if (!Number.isInteger(n) || n <= 0) {
+      throw new Error(
+        `--${flagName} expects positive integers; got '${item}'. Use comma-separated IDs (e.g. --${flagName} 12,34).`
+      );
+    }
+    return n;
+  });
+  return parsed;
+}
 function parseAttachmentUrls() {
   const values = getRepeatedFlag("attachment-url").filter(Boolean);
   return values.length > 0 ? values : void 0;
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-CEPGVUGF.js");
+    const { listConfigsJson } = await import("./list-json-T2Z7NV7G.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-IA4CSOIY.js");
+  const { default: ConfigsList } = await import("./list-IYJBKE2F.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -884,7 +1133,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-7QDINQPT.js");
+        const { runAssetCheck } = await import("./check-P5JJJNEX.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -893,15 +1142,29 @@ async function main() {
         });
         break;
       }
-      const hint = subcommand ? suggest(subcommand, ["check"]) : null;
+      if (subcommand === "list") {
+        const { runAssetList } = await import("./list-PBAXQSL5.js");
+        await runAssetList({
+          type: cli.flags.type ?? cli.flags.assetType,
+          status: cli.flags.assetStatus ?? cli.flags.status,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          perPage: cli.flags.perPage ?? cli.flags.limit,
+          nextPage: cli.flags.nextPage,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["check", "list"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: asset ${subcommand}${hint ? `. Did you mean "asset ${hint}"?` : ""}` : "Usage: chainpatrol asset check <content> [<content> ...]"
+        subcommand ? `Unknown subcommand: asset ${subcommand}${hint ? `. Did you mean "asset ${hint}"?` : ""}` : "Usage: chainpatrol asset <check|list>"
       );
     }
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-C3AIMUJT.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-HZYEIIOR.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -916,7 +1179,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-5DVPSXJP.js");
+        const { runDetectionsValidate } = await import("./validate-SM5DD7I2.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -931,7 +1194,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-Q3VG3XG3.js");
+        const { runDetectionsDrift } = await import("./drift-T74V2C3J.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -945,7 +1208,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-YTWNQD5X.js");
+        const { runDetectionsRun } = await import("./run-MSO6IXEV.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -958,13 +1221,37 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "list") {
+        const { runDetectionsList } = await import("./list-QUFY4IP7.js");
+        await runDetectionsList({
+          org,
+          cursor: cli.flags.cursor,
+          limit: cli.flags.limit,
+          query: cli.flags.search ?? cli.flags.query,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          sources: parseCsvList(cli.flags.source),
+          confidence: parseCsvList(cli.flags.confidence),
+          assetStatus: parseCsvList(cli.flags.assetStatus),
+          assetType: parseCsvList(cli.flags.assetType),
+          brandIds: parseBrandIds(),
+          liveness: parseCsvList(cli.flags.liveness),
+          watchlist: parseCsvList(cli.flags.watchlist),
+          reported: parseCsvList(cli.flags.reported),
+          countryCodes: parseCsvList(cli.flags.countryCode),
+          onlyDeleted: cli.flags.onlyDeleted,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "configs") {
         if (action === "list") {
           await handleConfigsList(org);
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-YTWNQD5X.js");
+          const { runDetectionsRun } = await import("./run-MSO6IXEV.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -982,7 +1269,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-2IOSKZH5.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-3ZVXGADV.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1001,15 +1288,35 @@ async function main() {
           break;
         }
       }
-      const hint = subcommand ? suggest(subcommand, ["healthcheck", "validate", "drift", "run", "configs"]) : null;
+      const hint = subcommand ? suggest(subcommand, [
+        "healthcheck",
+        "validate",
+        "drift",
+        "run",
+        "list",
+        "configs"
+      ]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: detections ${subcommand}${hint ? `. Did you mean "detections ${hint}"?` : ""}` : "Usage: chainpatrol detections <healthcheck|validate|drift|run|configs>"
+        subcommand ? `Unknown subcommand: detections ${subcommand}${hint ? `. Did you mean "detections ${hint}"?` : ""}` : "Usage: chainpatrol detections <healthcheck|validate|drift|run|list|configs>"
       );
     }
     case "metrics": {
+      if (subcommand === "organization" || subcommand === "org") {
+        const org2 = await tryResolveOrg();
+        const { runMetricsOrganization } = await import("./organization-IIIOSTHF.js");
+        await runMetricsOrganization({
+          org: org2,
+          brandSlug: cli.flags.brandSlug,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-NQDZQEOD.js");
+        const { runMetricsSummary } = await import("./summary-Y2LG6UJM.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1021,7 +1328,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-22B7RZT5.js");
+        const { runMetricsFound } = await import("./found-EVXJZGYX.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1038,7 +1345,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-63FAOVL7.js");
+        const { runMetricsBreakdown } = await import("./breakdown-KCTKQNDY.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1050,22 +1357,34 @@ async function main() {
         });
         break;
       }
-      const hint = subcommand ? suggest(subcommand, ["summary", "found", "breakdown"]) : null;
+      const hint = subcommand ? suggest(subcommand, ["summary", "found", "breakdown", "organization"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown>"
+        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|organization>"
       );
     }
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-AYHDFSQG.js");
+        const { runReportsList } = await import("./list-ZFPML3ZR.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
           cursor: cli.flags.cursor,
           status: cli.flags.status,
           searchQuery: cli.flags.search,
+          reporterQuery: cli.flags.reporterQuery,
           reportedByCustomer: cli.flags.reportedByCustomer,
+          excludeAutomation: cli.flags.excludeAutomation,
+          onlyRejected: cli.flags.onlyRejected,
+          reviewStatuses: parseCsvList(cli.flags.reviewStatus),
+          assetTypes: parseCsvList(cli.flags.assetType),
+          brandIds: parseBrandIds(),
+          countryCodes: parseCsvList(cli.flags.countryCode),
+          reviewedByUserId: cli.flags.reviewedByUserId,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          updatedFrom: cli.flags.updatedFrom,
+          updatedTo: cli.flags.updatedTo,
           json: jsonMode,
           outputFormat: cliContext.outputFormat,
           explain: cliContext.explain
@@ -1074,7 +1393,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-EWS3SFCH.js");
+        const { runReportsCreate } = await import("./create-DFH2G7RH.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1091,14 +1410,81 @@ async function main() {
         });
         break;
       }
-      const hint = subcommand ? suggest(subcommand, ["create", "list"]) : null;
+      if (subcommand === "search") {
+        const positionals = cli.input.slice(2);
+        const flagAssets = parseAssetInputs();
+        const assetContents = [...positionals, ...flagAssets];
+        const { runReportsSearch } = await import("./search-WPSKQGUS.js");
+        await runReportsSearch({
+          assetContents,
+          reportedByCustomer: cli.flags.reportedByCustomer,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["create", "list", "search"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: reports ${subcommand}${hint ? `. Did you mean "reports ${hint}"?` : ""}` : "Usage: chainpatrol reports <create|list>"
+        subcommand ? `Unknown subcommand: reports ${subcommand}${hint ? `. Did you mean "reports ${hint}"?` : ""}` : "Usage: chainpatrol reports <create|list|search>"
+      );
+    }
+    case "threats": {
+      if (subcommand === "list") {
+        const { runThreatsList } = await import("./list-YCT6DYDI.js");
+        await runThreatsList({
+          query: cli.flags.query,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          assetType: parseCsvList(cli.flags.assetType),
+          sortBy: cli.flags.sortBy,
+          sortDirection: cli.flags.sortDirection,
+          perPage: cli.flags.perPage ?? cli.flags.limit,
+          nextPage: cli.flags.nextPage,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["list"]) : null;
+      throw new Error(
+        subcommand ? `Unknown subcommand: threats ${subcommand}${hint ? `. Did you mean "threats ${hint}"?` : ""}` : "Usage: chainpatrol threats list [filters]"
+      );
+    }
+    case "takedowns": {
+      if (subcommand === "list") {
+        const org = await tryResolveOrg();
+        const { runTakedownsList } = await import("./list-WJQT2XLE.js");
+        await runTakedownsList({
+          org,
+          query: cli.flags.query,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          assetType: parseCsvList(cli.flags.assetType),
+          takedownStatus: parseCsvList(cli.flags.takedownStatus),
+          livenessStatus: parseCsvList(cli.flags.livenessStatus),
+          brandIds: parseBrandIds(),
+          assigneeIds: parseIntList(cli.flags.assignee, "assignee"),
+          startedFrom: cli.flags.startedFrom,
+          startedTo: cli.flags.startedTo,
+          hideAutomatedTakedowns: cli.flags.hideAutomatedTakedowns,
+          hideAutomatedLivenessChecks: cli.flags.hideAutomatedLivenessChecks,
+          sortBy: cli.flags.sortBy,
+          sortDirection: cli.flags.sortDirection,
+          perPage: cli.flags.perPage ?? cli.flags.limit,
+          nextPage: cli.flags.nextPage,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["list"]) : null;
+      throw new Error(
+        subcommand ? `Unknown subcommand: takedowns ${subcommand}${hint ? `. Did you mean "takedowns ${hint}"?` : ""}` : "Usage: chainpatrol takedowns list [--org <slug>] [filters]"
       );
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-C5MZWJTW.js");
+        const { runQueuesSnapshot } = await import("./snapshot-ZWAHEG64.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1116,7 +1502,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-SDBLGBVW.js");
+        const { runOrgsList } = await import("./list-YRJPN4PI.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1129,14 +1515,49 @@ async function main() {
         });
         break;
       }
-      const hint = subcommand ? suggest(subcommand, ["list"]) : null;
+      if (subcommand === "assets") {
+        if (action === "list") {
+          const { runOrgsAssetsList } = await import("./list-EIVPGMWJ.js");
+          await runOrgsAssetsList({
+            type: cli.flags.type ?? cli.flags.assetType,
+            groupId: cli.flags.groupId,
+            query: cli.flags.query ?? cli.flags.search,
+            perPage: cli.flags.perPage ?? cli.flags.limit,
+            nextPage: cli.flags.nextPage,
+            json: jsonMode,
+            outputFormat: cliContext.outputFormat
+          });
+          break;
+        }
+        throw new Error("Usage: chainpatrol orgs assets list [filters]");
+      }
+      if (subcommand === "asset-groups") {
+        if (action === "list") {
+          const { runOrgsAssetGroupsList } = await import("./list-I7SBGA52.js");
+          await runOrgsAssetGroupsList({
+            json: jsonMode,
+            outputFormat: cliContext.outputFormat
+          });
+          break;
+        }
+        throw new Error("Usage: chainpatrol orgs asset-groups list");
+      }
+      const hint = subcommand ? suggest(subcommand, ["list", "assets", "asset-groups"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs list [--subscription-status <list>] [--service-active <list>] [--service-automated <list>] ..."
+        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|assets list|asset-groups list> [filters]"
       );
     }
+    case "whoami": {
+      const { runWhoami } = await import("./whoami-DH5HVLFN.js");
+      await runWhoami({
+        json: jsonMode,
+        outputFormat: cliContext.outputFormat
+      });
+      break;
+    }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-DNRWKM5O.js");
+        const { runHealthchecksList } = await import("./list-23QQYAV5.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1150,7 +1571,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-AQMJRFGL.js");
+        const { runHealthchecksRun } = await import("./run-CJGN6TX4.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1168,7 +1589,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-HFWSMLGJ.js");
+        const { runPresetsList } = await import("./list-WX5G3IOF.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1179,7 +1600,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-WJGHJPXN.js");
+        const { runPresetsRun } = await import("./run-BHEXWBAS.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1196,17 +1617,17 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-BLJLRCXL.js");
+      const { setupSkill } = await import("./setup-skill-FA4STSGA.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-BLJLRCXL.js");
+      const { uninstallSkill } = await import("./setup-skill-FA4STSGA.js");
       uninstallSkill({ json: jsonMode });
       break;
     }
     case "completions": {
-      const { printCompletions } = await import("./completions-D6SOLU2D.js");
+      const { printCompletions } = await import("./completions-6C6KG5DH.js");
       printCompletions(subcommand);
       break;
     }