@chainpatrol/cli 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @chainpatrol/cli
 
+## 0.13.0
+
+### Minor Changes
+
+- 7cc2783: Default every `chainpatrol metrics …` subcommand
+  (`summary` / `found` / `breakdown` / `organization`) to a trailing
+  **3-month** window when no `--from`/`--to`/`--this-week` flag is
+  supplied, and echo the resolved range in every output format
+  (human, markdown, csv, json) so consumers can see exactly what
+  window the numbers describe.
+
+  Previously, omitting the date flags sent `undefined` for `startDate`
+  / `endDate`, which caused the metrics handler to fan out ~15 parallel
+  unbounded Prisma aggregates per call. On large orgs that routinely
+  exceeded the platform's 30s function cap and surfaced to agents as
+  flaky `503` responses. The new default keeps the queries bounded
+  and produces a stable, labelled result.
+
+  `--this-week` is now also wired through to `metrics summary`,
+  `metrics breakdown`, and `metrics organization` (it was already
+  supported on `metrics found`).
+
+  JSON output now includes a `range: { startDate, endDate, label }`
+  field on every metrics subcommand. The label is one of
+  `"last 3 months"` (default), `"this week"`, or
+  `"custom range (<startIso> → <endIso>)"`.
+
 ## 0.12.0
 
 ### Minor Changes

package/dist/{breakdown-KCTKQNDY.js → breakdown-B6QUGYI6.js}

@@ -1,3 +1,6 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
 import {
   printOutput,
   toCsvRows
@@ -11,21 +14,27 @@ import "./chunk-U73SABXK.js";
 
 // src/commands/metrics/breakdown.ts
 async function runMetricsBreakdown(options) {
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
   const client = options.apiClient ?? createApiClient();
   const result = await client.getMetricsBreakdown({
     slug: options.org,
     by: options.by,
-    startDate: options.from,
-    endDate: options.to,
+    startDate: range.startDate,
+    endDate: range.endDate,
     brandIds: options.brandIds
   });
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   printOutput({
     outputFormat,
-    json: result,
+    json: { ...result, range },
     markdown: [
-      `# Metrics Breakdown (${options.org})`,
+      `# Metrics Breakdown (${options.org}) \u2014 ${range.label}`,
       "",
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
       `- Grouped by: ${result.by}`,
       "",
       ...result.points.map((point) => {
@@ -40,6 +49,9 @@ async function runMetricsBreakdown(options) {
     ].join("\n"),
     csv: toCsvRows(
       result.points.map((point) => ({
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
         key: point.key,
         count: point.count,
         date: point.date ?? null,
@@ -50,7 +62,10 @@ async function runMetricsBreakdown(options) {
       }))
     ),
     human: () => {
-      console.log(`Metrics breakdown for ${options.org} by ${result.by}`);
+      console.log(
+        `Metrics breakdown for ${options.org} by ${result.by} \u2014 ${range.label}`
+      );
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
       for (const point of result.points) {
         if (result.by === "day") {
           console.log(`${point.date ?? point.key}: ${point.count}`);

package/dist/{chunk-W42ITB5J.js → chunk-BQDMAEQU.js}

@@ -659,20 +659,65 @@ takedowns?", reach for \`orgs list\` \u2014 it's the only command that exposes
 service flags across multiple orgs in one call. Run it in \`--json\` mode
 and summarize patterns by service or by subscription tier.
 
-### \`metrics summary | found | breakdown\` \u2014 Org metrics for spike/drop analysis
+### \`metrics summary | found | breakdown | organization\` \u2014 Org metrics for spike/drop analysis
 
 \`\`\`bash
-chainpatrol --json metrics summary  --org <slug> --this-week
-chainpatrol --json metrics breakdown --org <slug> --by day --this-week
-chainpatrol --json metrics found    --org <slug> --from <YYYY-MM-DD> --to <YYYY-MM-DD>
+chainpatrol --json metrics summary      --org <slug>                                  # defaults to last 3 months
+chainpatrol --json metrics summary      --org <slug> --this-week
+chainpatrol --json metrics breakdown    --org <slug> --by day --this-week
+chainpatrol --json metrics found        --org <slug> --from <YYYY-MM-DD> --to <YYYY-MM-DD>
+chainpatrol --json metrics organization --org <slug>                                  # defaults to last 3 months
 \`\`\`
 
+**Always operate on a bounded window.** When no \`--from\`/\`--to\`/\`--this-week\`
+is passed, every metrics subcommand defaults to the trailing **last 3 months**
+ending now. The default exists because unbounded org-wide aggregates over
+multi-year history routinely time out at the platform layer (Vercel's
+30s function cap), which surfaces to clients as a 503. Stick to the default,
+or pass an explicit narrower window \u2014 don't try to bypass the default by
+guessing wide \`--from\` values.
+
+The resolved range is echoed back in every output format so the user can
+see exactly what they got:
+
+- JSON: \`{ "range": { "startDate": "...", "endDate": "...", "label": "last 3 months" } }\`
+- Markdown / human: the header line includes the label, e.g.
+  \`Organization metrics for acme \u2014 last 3 months\`, followed by
+  \`Range: <startDate> \u2192 <endDate>\`.
+
+When reporting numbers to the user (especially averages and rates),
+**state the window explicitly** \u2014 say "averaged over the last 3 months"
+rather than just quoting a number, since the same prompt phrased
+differently can pick a different window.
+
 \`breakdown\` is the one you usually want for healthchecks: it returns a
 time series (by day or week) of reports, new threats, watchlisted threats,
 and takedowns filed/completed. Compare the latest period against a prior
 window to spot the **spike** or **drop** signals described in the manual
 HealthCheck Guide. \`summary\` returns a single window total; \`found\` is
-oriented around when threats were first discovered.
+oriented around when threats were first discovered; \`organization\` is
+the full customer-facing dashboard slice (reports, new threats,
+watchlisted, takedowns filed/completed, plus per-type and per-day
+breakdowns).
+
+#### "Across all orgs" via an API key \u2014 what's actually possible
+
+A ChainPatrol API key is scoped to a single organization. The
+\`/organization/metrics\` endpoint derives the org from the key, so
+**there is no way to fetch metrics for multiple orgs with one API key**.
+If the user asks for "averages across all orgs":
+
+1. If they're authenticated with a user session, list accessible orgs
+   first (\`chainpatrol --json orgs list\`) and then call
+   \`metrics organization\` once per org **serially** (concurrent
+   fan-out across many orgs is what triggers 503/throttling on the
+   metrics endpoint).
+2. If they're using a single API key, explain that the key only
+   covers one org \u2014 they need either session auth or one key per
+   org, not a loop with the same key.
+3. Whatever window you choose, **make it explicit** in your reply
+   ("last 3 months", "last 7 days", etc) \u2014 never report an average
+   without naming the window it was computed over.
 
 ### \`presets list | run\` \u2014 Packaged workflows for common jobs
 

package/dist/chunk-S37VFIZY.js

@@ -0,0 +1,66 @@
+import {
+  DateTime
+} from "./chunk-TFCNKBRC.js";
+
+// src/lib/date-range.ts
+var DEFAULT_RANGE_MONTHS = 3;
+var DEFAULT_RANGE_LABEL = `last ${DEFAULT_RANGE_MONTHS} months`;
+function customLabel(start, end) {
+  const startIso = start.toUTC().toISODate();
+  const endIso = end.toUTC().toISODate();
+  return `custom range (${startIso} \u2192 ${endIso})`;
+}
+function resolveDateRange({
+  from,
+  to,
+  thisWeek
+}) {
+  if (from && to) {
+    const start2 = DateTime.fromISO(from).toUTC();
+    const end = DateTime.fromISO(to).toUTC();
+    return {
+      startDate: start2.toISO() ?? from,
+      endDate: end.toISO() ?? to,
+      label: customLabel(start2, end)
+    };
+  }
+  if (from && !to) {
+    const now2 = DateTime.now().toUTC();
+    const start2 = DateTime.fromISO(from).toUTC();
+    return {
+      startDate: start2.toISO() ?? from,
+      endDate: now2.toISO() ?? "",
+      label: customLabel(start2, now2)
+    };
+  }
+  if (!from && to) {
+    const end = DateTime.fromISO(to).toUTC();
+    const start2 = end.minus({ days: 7 });
+    return {
+      startDate: start2.toISO() ?? "",
+      endDate: end.toISO() ?? to,
+      label: customLabel(start2, end)
+    };
+  }
+  if (thisWeek) {
+    const now2 = DateTime.now().toUTC();
+    const start2 = now2.startOf("week");
+    const end = now2.endOf("week");
+    return {
+      startDate: start2.toISO() ?? now2.minus({ days: 7 }).toISO() ?? "",
+      endDate: end.toISO() ?? now2.toISO() ?? "",
+      label: "this week"
+    };
+  }
+  const now = DateTime.now().toUTC();
+  const start = now.minus({ months: DEFAULT_RANGE_MONTHS });
+  return {
+    startDate: start.toISO() ?? "",
+    endDate: now.toISO() ?? "",
+    label: DEFAULT_RANGE_LABEL
+  };
+}
+
+export {
+  resolveDateRange
+};

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-W42ITB5J.js";
+} from "./chunk-BQDMAEQU.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -263,49 +263,52 @@ var HELP = {
     ]
   },
   "metrics organization": {
-    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with both API key auth (org derived from key) and session auth (pass --org).",
-    usage: "chainpatrol metrics organization [--org <slug>] [--from ISO --to ISO]",
+    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with both API key auth (org derived from key) and session auth (pass --org). Defaults to the trailing 3 months if no date range is given.",
+    usage: "chainpatrol metrics organization [--org <slug>] [--from ISO --to ISO|--this-week]",
     options: [
       "--org <slug>          Organization slug (omit when using an API key)",
       "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag)",
       "--from <iso>          Start date (ISO 8601, e.g. 2026-01-01)",
-      "--to <iso>            End date (ISO 8601)"
+      "--to <iso>            End date (ISO 8601)",
+      "--this-week           Use the current ISO week (overrides default)"
     ],
     examples: [
-      "chainpatrol metrics organization --org acme",
+      "chainpatrol metrics organization --org acme                       # defaults to last 3 months",
       "chainpatrol metrics organization --org acme --from 2026-01-01 --to 2026-02-01",
       "CHAINPATROL_API_KEY=... chainpatrol metrics organization --json"
     ]
   },
   "metrics summary": {
-    description: "Summary metrics for an org over a date range.",
-    usage: "chainpatrol metrics summary --org <slug> [--from ISO --to ISO]",
+    description: "Summary metrics for an org over a date range. Defaults to the trailing 3 months if no date range is given.",
+    usage: "chainpatrol metrics summary --org <slug> [--from ISO --to ISO|--this-week]",
     options: [
       "--org <slug>          Organization slug",
       "--from <iso>          Start date (ISO 8601)",
       "--to <iso>            End date (ISO 8601)",
+      "--this-week           Use the current ISO week (overrides default)",
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
   "metrics found": {
-    description: "Count of newly found threats over a date range.",
+    description: "Count of newly found threats over a date range. Defaults to the trailing 3 months if no date range is given.",
     usage: "chainpatrol metrics found --org <slug> [--from ISO --to ISO|--this-week]",
     options: [
       "--org <slug>          Organization slug",
       "--from <iso>          Start date (ISO 8601)",
       "--to <iso>            End date (ISO 8601)",
-      "--this-week           Use the current week",
+      "--this-week           Use the current ISO week (overrides default)",
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
   "metrics breakdown": {
-    description: "Threat counts grouped by axis (day, type, brand).",
-    usage: "chainpatrol metrics breakdown --org <slug> --by <day|type|brand>",
+    description: "Threat counts grouped by axis (day, type, brand). Defaults to the trailing 3 months if no date range is given.",
+    usage: "chainpatrol metrics breakdown --org <slug> --by <day|type|brand> [--from ISO --to ISO|--this-week]",
     options: [
       "--org <slug>          Organization slug",
       "--by <axis>           day|type|brand (required)",
       "--from <iso>          Start date",
       "--to <iso>            End date",
+      "--this-week           Use the current ISO week (overrides default)",
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
@@ -1303,12 +1306,13 @@ async function main() {
     case "metrics": {
       if (subcommand === "organization" || subcommand === "org") {
         const org2 = await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-IIIOSTHF.js");
+        const { runMetricsOrganization } = await import("./organization-GS5LFIWO.js");
         await runMetricsOrganization({
           org: org2,
           brandSlug: cli.flags.brandSlug,
           from: cli.flags.from,
           to: cli.flags.to,
+          thisWeek: cli.flags.thisWeek,
           json: jsonMode,
           outputFormat: cliContext.outputFormat
         });
@@ -1316,11 +1320,12 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-Y2LG6UJM.js");
+        const { runMetricsSummary } = await import("./summary-CV657J5V.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
           to: cli.flags.to,
+          thisWeek: cli.flags.thisWeek,
           brandIds: parseBrandIds(),
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1328,7 +1333,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-EVXJZGYX.js");
+        const { runMetricsFound } = await import("./found-NXAWEIEK.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1345,12 +1350,13 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-KCTKQNDY.js");
+        const { runMetricsBreakdown } = await import("./breakdown-B6QUGYI6.js");
         await runMetricsBreakdown({
           org,
           by,
           from: cli.flags.from,
           to: cli.flags.to,
+          thisWeek: cli.flags.thisWeek,
           brandIds: parseBrandIds(),
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1617,12 +1623,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-FA4STSGA.js");
+      const { setupSkill } = await import("./setup-skill-TPMTULHJ.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-FA4STSGA.js");
+      const { uninstallSkill } = await import("./setup-skill-TPMTULHJ.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/found-NXAWEIEK.js

@@ -0,0 +1,59 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-OSRFCVBT.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/metrics/found.ts
+async function runMetricsFound(options) {
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.getMetricsFound({
+    slug: options.org,
+    startDate: range.startDate,
+    endDate: range.endDate,
+    brandIds: options.brandIds
+  });
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  printOutput({
+    outputFormat,
+    json: { ...result, range },
+    markdown: [
+      `# Found Threats (${options.org}) \u2014 ${range.label}`,
+      "",
+      `- Metric: ${result.metric}`,
+      `- Found: ${result.found}`,
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`
+    ].join("\n"),
+    csv: toCsvRows([
+      {
+        rangeLabel: range.label,
+        metric: result.metric,
+        found: result.found,
+        startDate: range.startDate,
+        endDate: range.endDate
+      }
+    ]),
+    human: () => {
+      console.log(
+        `Found threats (${result.metric}) for ${options.org} \u2014 ${range.label}: ${result.found}`
+      );
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
+    }
+  });
+}
+export {
+  runMetricsFound
+};

package/dist/{organization-IIIOSTHF.js → organization-GS5LFIWO.js}

@@ -1,3 +1,6 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
 import {
   printOutput,
   toCsvRows
@@ -13,20 +16,26 @@ import "./chunk-U73SABXK.js";
 async function runMetricsOrganization(options) {
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   const client = options.apiClient ?? createApiClient();
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
   const input = {
     organizationSlug: options.org,
     brandSlug: options.brandSlug,
-    startDate: options.from,
-    endDate: options.to
+    startDate: range.startDate,
+    endDate: range.endDate
   };
   const result = await client.getOrganizationMetrics(input);
   const label = options.org ?? "your organization";
   printOutput({
     outputFormat,
-    json: result,
+    json: { ...result, range },
     markdown: [
-      `# Organization Metrics (${label})`,
+      `# Organization Metrics (${label}) \u2014 ${range.label}`,
       "",
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
       `- Reports: ${result.metrics.reports}`,
       `- New threats: ${result.metrics.newThreats}`,
       `- Watchlisted threats: ${result.metrics.threatsWatchlisted}`,
@@ -39,6 +48,9 @@ async function runMetricsOrganization(options) {
     ].join("\n"),
     csv: toCsvRows([
       {
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
         reports: result.metrics.reports,
         newThreats: result.metrics.newThreats,
         threatsWatchlisted: result.metrics.threatsWatchlisted,
@@ -51,7 +63,8 @@ async function runMetricsOrganization(options) {
       }
     ]),
     human: () => {
-      console.log(`Organization metrics for ${label}`);
+      console.log(`Organization metrics for ${label} \u2014 ${range.label}`);
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
       console.log(`Reports: ${result.metrics.reports}`);
       console.log(`New threats: ${result.metrics.newThreats}`);
       console.log(`Watchlisted threats: ${result.metrics.threatsWatchlisted}`);

package/dist/{setup-skill-FA4STSGA.js → setup-skill-TPMTULHJ.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-W42ITB5J.js";
+} from "./chunk-BQDMAEQU.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{summary-Y2LG6UJM.js → summary-CV657J5V.js}

@@ -1,3 +1,6 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
 import {
   printOutput,
   toCsvRows
@@ -11,20 +14,26 @@ import "./chunk-U73SABXK.js";
 
 // src/commands/metrics/summary.ts
 async function runMetricsSummary(options) {
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
   const client = options.apiClient ?? createApiClient();
   const result = await client.getMetricsSummary({
     slug: options.org,
-    startDate: options.from,
-    endDate: options.to,
+    startDate: range.startDate,
+    endDate: range.endDate,
     brandIds: options.brandIds
   });
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   printOutput({
     outputFormat,
-    json: result,
+    json: { ...result, range },
     markdown: [
-      `# Metrics Summary (${options.org})`,
+      `# Metrics Summary (${options.org}) \u2014 ${range.label}`,
       "",
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
       `- Reports: ${result.metrics.reports}`,
       `- New threats: ${result.metrics.newThreats}`,
       `- Watchlisted threats: ${result.metrics.threatsWatchlisted}`,
@@ -33,6 +42,9 @@ async function runMetricsSummary(options) {
     ].join("\n"),
     csv: toCsvRows([
       {
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
         reports: result.metrics.reports,
         newThreats: result.metrics.newThreats,
         threatsWatchlisted: result.metrics.threatsWatchlisted,
@@ -45,7 +57,8 @@ async function runMetricsSummary(options) {
       }
     ]),
     human: () => {
-      console.log(`Metrics summary for ${options.org}`);
+      console.log(`Metrics summary for ${options.org} \u2014 ${range.label}`);
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
       console.log(`Reports: ${result.metrics.reports}`);
       console.log(`New threats: ${result.metrics.newThreats}`);
       console.log(`Watchlisted threats: ${result.metrics.threatsWatchlisted}`);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [

package/dist/found-EVXJZGYX.js

@@ -1,95 +0,0 @@
-import {
-  printOutput,
-  toCsvRows
-} from "./chunk-VFT3TD3E.js";
-import {
-  createApiClient
-} from "./chunk-OSRFCVBT.js";
-import "./chunk-EGWK6SRQ.js";
-import {
-  DateTime
-} from "./chunk-TFCNKBRC.js";
-import "./chunk-U73SABXK.js";
-
-// src/lib/date-range.ts
-function resolveDateRange({
-  from,
-  to,
-  thisWeek
-}) {
-  if (from && to) {
-    return {
-      startDate: DateTime.fromISO(from).toUTC().toISO() ?? from,
-      endDate: DateTime.fromISO(to).toUTC().toISO() ?? to
-    };
-  }
-  if (from && !to) {
-    const now2 = DateTime.now().toUTC();
-    return {
-      startDate: DateTime.fromISO(from).toUTC().toISO() ?? from,
-      endDate: now2.toISO() ?? ""
-    };
-  }
-  if (!from && to) {
-    const end = DateTime.fromISO(to).toUTC();
-    return {
-      startDate: end.minus({ days: 7 }).toISO() ?? "",
-      endDate: end.toISO() ?? to
-    };
-  }
-  if (thisWeek) {
-    const now2 = DateTime.now().toUTC();
-    return {
-      startDate: now2.startOf("week").toISO() ?? now2.minus({ days: 7 }).toISO() ?? "",
-      endDate: now2.endOf("week").toISO() ?? now2.toISO() ?? ""
-    };
-  }
-  const now = DateTime.now().toUTC();
-  return {
-    startDate: now.minus({ days: 7 }).toISO() ?? "",
-    endDate: now.toISO() ?? ""
-  };
-}
-
-// src/commands/metrics/found.ts
-async function runMetricsFound(options) {
-  const range = resolveDateRange({
-    from: options.from,
-    to: options.to,
-    thisWeek: options.thisWeek
-  });
-  const client = options.apiClient ?? createApiClient();
-  const result = await client.getMetricsFound({
-    slug: options.org,
-    startDate: range.startDate,
-    endDate: range.endDate,
-    brandIds: options.brandIds
-  });
-  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
-  printOutput({
-    outputFormat,
-    json: result,
-    markdown: [
-      `# Found Threats (${options.org})`,
-      "",
-      `- Metric: ${result.metric}`,
-      `- Found: ${result.found}`,
-      `- Range: ${range.startDate} -> ${range.endDate}`
-    ].join("\n"),
-    csv: toCsvRows([
-      {
-        metric: result.metric,
-        found: result.found,
-        startDate: range.startDate,
-        endDate: range.endDate
-      }
-    ]),
-    human: () => {
-      console.log(`Found threats (${result.metric}) for ${options.org}: ${result.found}`);
-      console.log(`Range: ${range.startDate} -> ${range.endDate}`);
-    }
-  });
-}
-export {
-  runMetricsFound
-};