@chainpatrol/cli 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @chainpatrol/cli
 
+## 0.15.0
+
+### Minor Changes
+
+- e24afdc: `GET /organization/metrics` (and the matching `chainpatrol metrics
+organization --slugs` CLI flag) now accept a list of org slugs and
+  return a single rolled-up response: `metrics` becomes the sum across
+  the queried orgs, `perOrg` holds the per-org breakdown, and a new
+  `averages` field provides `perDay` (total / windowDays) plus
+  `perOrgPerDay` (total / numOrgs / windowDays) so callers don't have
+  to do the math themselves. The single-org form is unchanged on the
+  wire except for the new `averages.perDay` and `scope: { mode, orgs }`
+  additions, and `averages.perOrgPerDay` is `null` for single-org
+  callers.
+
+  Lets an agent answer "how many threats did we take down across all
+  clients in the last 7 days?" — or "what's our average takedowns per
+  customer per day this month?" — in **one** HTTP call with one
+  `--include`-narrowed Prisma aggregate per org (run server-side with
+  bounded concurrency), instead of the N-round-trip fan-out that was
+  previously the only path. `slugs` is capped at 50 per call, mutually
+  exclusive with `organizationSlug`, and disallowed with `brandSlug`.
+
+  Auth: org-scoped API keys remain single-org and are rejected if
+  `slugs` contains any foreign org; user API keys (which inherit the
+  owning user's memberships) and Bearer sessions can pass any orgs
+  the principal has access to. Staff users can query any org, as
+  before.
+
+  The CLI's `metrics organization` command picks up a `--slugs`
+  flag, prints totals + per-day / per-org-per-day averages + a
+  per-org breakdown in human/markdown/csv output, and surfaces a
+  `scope` and `averages` block in the JSON envelope.
+
 ## 0.14.0
 
 ### Minor Changes

package/dist/{breakdown-K5Q6TDKE.js → breakdown-27PMFEWQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-NJH7BUIM.js → check-M5U2CSWK.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-BIKTBRER.js → chunk-FOTFWUOX.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/{chunk-6X5BFFXA.js → chunk-QGKR7EPH.js}

@@ -727,24 +727,81 @@ did we file last month?"). It is the lowest-effort way to make a
 metrics call cheap enough to run repeatedly. Pair it with an explicit
 date window for the best behavior.
 
-#### "Across all orgs" via an API key \u2014 what's actually possible
-
-A ChainPatrol API key is scoped to a single organization. The
-\`/organization/metrics\` endpoint derives the org from the key, so
-**there is no way to fetch metrics for multiple orgs with one API key**.
-If the user asks for "averages across all orgs":
-
-1. If they're authenticated with a user session, list accessible orgs
-   first (\`chainpatrol --json orgs list\`) and then call
-   \`metrics organization\` once per org **serially** (concurrent
-   fan-out across many orgs is what triggers 503/throttling on the
-   metrics endpoint).
-2. If they're using a single API key, explain that the key only
-   covers one org \u2014 they need either session auth or one key per
-   org, not a loop with the same key.
-3. Whatever window you choose, **make it explicit** in your reply
-   ("last 3 months", "last 7 days", etc) \u2014 never report an average
-   without naming the window it was computed over.
+#### \`--slugs\` \u2014 multi-org rollups in one call (use this for "across all customers/clients")
+
+When the user asks for a total or an average **across more than one
+org** \u2014 e.g. "how many takedowns did we complete across all clients
+in the last 7 days?", "average reports per org per day this month",
+"top 5 customers by new threats" \u2014 reach for \`--slugs\` instead of
+looping. The server fans out the per-org aggregates internally,
+sums into totals, computes per-day and per-org-per-day averages,
+and returns a per-org breakdown in a **single HTTP round trip**:
+
+\`\`\`bash
+# Total takedowns completed across three customers, last 7 days
+chainpatrol --json metrics organization \\
+  --slugs acme,beta,gamma \\
+  --include takedownsCompleted \\
+  --from 2026-05-12 --to 2026-05-19
+\`\`\`
+
+The response shape switches to multi-org:
+
+\`\`\`json
+{
+  "scope": { "mode": "multi", "orgs": ["acme", "beta", "gamma"] },
+  "metrics":   { "takedownsCompleted": 117, ... },       // sum across orgs
+  "averages": {
+    "perDay":       { "takedownsCompleted": 16.71, ... },  // total / windowDays
+    "perOrgPerDay": { "takedownsCompleted": 5.57, ... },   // total / numOrgs / windowDays
+    "windowDays": 7
+  },
+  "perOrg": { "acme": { "metrics": { ... } }, "beta": { ... }, "gamma": { ... } }
+}
+\`\`\`
+
+To answer **"across all of our customers"**, list the orgs first:
+
+\`\`\`bash
+chainpatrol --json orgs list --subscription-status ACTIVE  # \u2190 get slugs
+chainpatrol --json metrics organization \\
+  --slugs <comma-list of all the slugs from above> \\
+  --include takedownsCompleted \\
+  --from 2026-05-12 --to 2026-05-19
+\`\`\`
+
+The endpoint caps \`slugs\` at 50 per call; if you need more, split
+the list and sum the totals client-side. **Do not loop \`metrics
+organization\` once per org** when \`--slugs\` will do \u2014 N HTTP
+round-trips is what made the old code 503.
+
+Always pair \`--slugs\` with \`--include\` to narrow the metric set to
+what the user actually asked about. "How many takedowns did we
+complete?" \u2192 \`--include takedownsCompleted\`; "average reports per
+day per customer?" \u2192 \`--include reports\`. Skipping \`--include\` runs
+~11 aggregates per org which is rarely necessary.
+
+#### Auth: which credential can use \`--slugs\`
+
+- **Org-scoped API key** (the most common production key): can only
+  query its own org. If \`--slugs\` contains anything else the server
+  returns 403. Use the \`--org\` form (or omit both) instead.
+- **User API key**: inherits the user's org memberships, so it can
+  query any org the user is a member of (or any org for staff
+  users). This is the credential you want for cross-org rollups
+  from automated agents.
+- **Session auth** (Bearer token, e.g. \`chainpatrol login\`): same
+  membership rules as the user. Staff users can query any org.
+
+#### Reporting numbers to the user
+
+Whatever window and scope you choose, **make both explicit in your
+reply** \u2014 say "averaged across 12 customers over the last 3 months"
+or "summed across all paying orgs for the last 7 days." The same
+prompt phrased slightly differently can pick a different window or
+org set, and the response already echoes
+\`scope.mode\` / \`scope.orgs\` / \`averages.windowDays\` /
+\`range.label\` so you don't have to guess.
 
 ### \`presets list | run\` \u2014 Packaged workflows for common jobs
 

package/dist/{chunk-YZEMTNCX.js → chunk-UZDSNWGL.js}

@@ -278,6 +278,7 @@ function createApiClient(options) {
     getOrganizationMetrics(input) {
       return requestGet("/organization/metrics", {
         organizationSlug: input.organizationSlug,
+        slugs: input.slugs,
         brandSlug: input.brandSlug,
         startDate: parseIsoDateString(input.startDate),
         endDate: parseIsoDateString(input.endDate),

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-6X5BFFXA.js";
+} from "./chunk-QGKR7EPH.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -263,11 +263,12 @@ var HELP = {
     ]
   },
   "metrics organization": {
-    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with both API key auth (org derived from key) and session auth (pass --org). Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates the caller doesn't need \u2014 fields not included come back as null.",
-    usage: "chainpatrol metrics organization [--org <slug>] [--from ISO --to ISO|--this-week] [--include <list>]",
+    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with org-scoped API keys (org derived from key, single-org only), user API keys (inherits user permissions, multi-org allowed), and session auth. Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates the caller doesn't need; use --slugs to query several orgs in one call and get totals + per-org breakdown + per-day / per-org-per-day averages. Fields not included come back as null.",
+    usage: "chainpatrol metrics organization [--org <slug>|--slugs <list>] [--from ISO --to ISO|--this-week] [--include <list>]",
     options: [
-      "--org <slug>          Organization slug (omit when using an API key)",
-      "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag)",
+      "--org <slug>          Single organization slug (omit when using an org-scoped API key). Mutually exclusive with --slugs.",
+      "--slugs <list>        Comma list of org slugs (max 50). Response includes totals across these orgs and a per-org breakdown plus per-day / per-org-per-day averages. Not allowed for org-scoped API keys with foreign slugs.",
+      "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag; only valid with a single org)",
       "--from <iso>          Start date (ISO 8601, e.g. 2026-01-01)",
       "--to <iso>            End date (ISO 8601)",
       "--this-week           Use the current ISO week (overrides default)",
@@ -277,6 +278,7 @@ var HELP = {
       "chainpatrol metrics organization --org acme                                           # defaults to last 3 months, all metrics",
       "chainpatrol metrics organization --org acme --include takedownsFiled,takedownsCompleted",
       "chainpatrol metrics organization --org acme --from 2026-01-01 --to 2026-02-01",
+      "chainpatrol metrics organization --slugs acme,beta,gamma --include takedownsCompleted --from 2026-05-12 --to 2026-05-19   # 7-day takedown total + per-day / per-org-per-day averages",
       "CHAINPATROL_API_KEY=... chainpatrol metrics organization --json --include reports"
     ]
   },
@@ -861,6 +863,7 @@ ${getTopLevelHelp()}
     thisWeek: { type: "boolean", default: false },
     by: { type: "string" },
     include: { type: "string" },
+    slugs: { type: "string" },
     brand: { type: "string" },
     enable: { type: "boolean", default: false },
     disable: { type: "boolean", default: false },
@@ -1034,12 +1037,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-QC6X25LI.js");
+    const { listConfigsJson } = await import("./list-json-X6QHIRE5.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-B5KLEFHA.js");
+  const { default: ConfigsList } = await import("./list-ZTMCEG56.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1139,7 +1142,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-NJH7BUIM.js");
+        const { runAssetCheck } = await import("./check-M5U2CSWK.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1149,7 +1152,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-5TMGSHFC.js");
+        const { runAssetList } = await import("./list-VOWXWXHY.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1170,7 +1173,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-PFYP6PNW.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-FORGIJWP.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1185,7 +1188,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-TPG47SYS.js");
+        const { runDetectionsValidate } = await import("./validate-I3YHZDZR.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1200,7 +1203,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-ZOLDE24A.js");
+        const { runDetectionsDrift } = await import("./drift-T4AF6Y3X.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1214,7 +1217,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-VHFXOCGS.js");
+        const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1228,7 +1231,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-AHWEE3YZ.js");
+        const { runDetectionsList } = await import("./list-RMD4NKVB.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1257,7 +1260,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-VHFXOCGS.js");
+          const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1275,7 +1278,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-ON67NMXA.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-YMPRYXKZ.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1308,10 +1311,12 @@ async function main() {
     }
     case "metrics": {
       if (subcommand === "organization" || subcommand === "org") {
-        const org2 = await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-VSQQAGBS.js");
+        const slugs = parseCsvList(cli.flags.slugs);
+        const org2 = slugs && slugs.length > 0 ? void 0 : await tryResolveOrg();
+        const { runMetricsOrganization } = await import("./organization-HD6LRAZP.js");
         await runMetricsOrganization({
           org: org2,
+          slugs,
           brandSlug: cli.flags.brandSlug,
           from: cli.flags.from,
           to: cli.flags.to,
@@ -1324,7 +1329,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-QUCLZYX6.js");
+        const { runMetricsSummary } = await import("./summary-NYHIQ5DP.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1337,7 +1342,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-M5MX4VXK.js");
+        const { runMetricsFound } = await import("./found-XEGMO6YY.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1354,7 +1359,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-K5Q6TDKE.js");
+        const { runMetricsBreakdown } = await import("./breakdown-27PMFEWQ.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1375,7 +1380,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-FV5IYCG4.js");
+        const { runReportsList } = await import("./list-N4TTNR6N.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1403,7 +1408,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-W5S2ZPVC.js");
+        const { runReportsCreate } = await import("./create-DQYNYD6G.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1424,7 +1429,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-NOSQW75S.js");
+        const { runReportsSearch } = await import("./search-ME6KFCEV.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1440,7 +1445,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-HGYBEYOV.js");
+        const { runThreatsList } = await import("./list-XHBQMP6P.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1463,7 +1468,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-TUMVDWIZ.js");
+        const { runTakedownsList } = await import("./list-DVPEMSVH.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1494,7 +1499,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-55UV26NQ.js");
+        const { runQueuesSnapshot } = await import("./snapshot-B6TQCFQ3.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1512,7 +1517,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-ISP5JL4M.js");
+        const { runOrgsList } = await import("./list-COJ5BLQV.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1527,7 +1532,7 @@ async function main() {
       }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-Z7RJWZH5.js");
+          const { runOrgsAssetsList } = await import("./list-63HPS2RE.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1543,7 +1548,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-VP5IY2SZ.js");
+          const { runOrgsAssetGroupsList } = await import("./list-WPXNCBT3.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1558,7 +1563,7 @@ async function main() {
       );
     }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-Y3ZJGN4O.js");
+      const { runWhoami } = await import("./whoami-6KU4LOJS.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1567,7 +1572,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-GKC7PEU5.js");
+        const { runHealthchecksList } = await import("./list-OWJLAWMP.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1581,7 +1586,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-HRFJORDS.js");
+        const { runHealthchecksRun } = await import("./run-G5J77GZD.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1599,7 +1604,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-LNNIEVB4.js");
+        const { runPresetsList } = await import("./list-BJMP3QEV.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1610,7 +1615,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-KDNQIR5E.js");
+        const { runPresetsRun } = await import("./run-BHAH7DUC.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1627,12 +1632,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-Q6PCFIDE.js");
+      const { setupSkill } = await import("./setup-skill-ENJSVGLR.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-Q6PCFIDE.js");
+      const { uninstallSkill } = await import("./setup-skill-ENJSVGLR.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-ON67NMXA.js → configs-update-YMPRYXKZ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-W5S2ZPVC.js → create-DQYNYD6G.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-ZOLDE24A.js → drift-T4AF6Y3X.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-M5MX4VXK.js → found-XEGMO6YY.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{healthcheck-PFYP6PNW.js → healthcheck-FORGIJWP.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-Z7RJWZH5.js → list-63HPS2RE.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-LNNIEVB4.js → list-BJMP3QEV.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-BIKTBRER.js";
+} from "./chunk-FOTFWUOX.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-YZEMTNCX.js";
+import "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-ISP5JL4M.js → list-COJ5BLQV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-TUMVDWIZ.js → list-DVPEMSVH.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-FV5IYCG4.js → list-N4TTNR6N.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-GKC7PEU5.js → list-OWJLAWMP.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-AHWEE3YZ.js → list-RMD4NKVB.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-5TMGSHFC.js → list-VOWXWXHY.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-VP5IY2SZ.js → list-WPXNCBT3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-HGYBEYOV.js → list-XHBQMP6P.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-B5KLEFHA.js → list-ZTMCEG56.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-json-QC6X25LI.js → list-json-X6QHIRE5.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/organization-HD6LRAZP.js

@@ -0,0 +1,251 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  ORGANIZATION_METRICS_INCLUDE_FIELDS,
+  createApiClient
+} from "./chunk-UZDSNWGL.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/metrics/organization.ts
+var INCLUDE_VALUES = new Set(ORGANIZATION_METRICS_INCLUDE_FIELDS);
+var METRIC_LABELS = [
+  ["reports", "Reports"],
+  ["newThreats", "New threats"],
+  ["threatsWatchlisted", "Watchlisted threats"],
+  ["takedownsFiled", "Takedowns filed"],
+  ["takedownsCompleted", "Takedowns completed"],
+  ["domainThreats", "Domain threats"],
+  ["twitterThreats", "Twitter threats"],
+  ["telegramThreats", "Telegram threats"],
+  ["otherThreats", "Other threats"]
+];
+function parseIncludeList(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const fields = [];
+  for (const value of raw) {
+    if (!INCLUDE_VALUES.has(value)) {
+      throw new Error(
+        `Unknown --include value: '${value}'. Allowed: ${ORGANIZATION_METRICS_INCLUDE_FIELDS.join(", ")}`
+      );
+    }
+    fields.push(value);
+  }
+  return fields;
+}
+function formatAverage(value) {
+  if (value === null) return "n/a";
+  return Number.isInteger(value) ? String(value) : value.toFixed(2);
+}
+function populatedMetricRows(metrics, format = (v) => String(v)) {
+  return METRIC_LABELS.filter(([key]) => metrics[key] !== null).map(([key, label]) => [
+    label,
+    format(metrics[key])
+  ]);
+}
+async function runMetricsOrganization(options) {
+  if (options.org && options.slugs && options.slugs.length > 0) {
+    throw new Error("Pass either --org or --slugs, not both.");
+  }
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  const client = options.apiClient ?? createApiClient();
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
+  const include = parseIncludeList(options.include);
+  const input = {
+    organizationSlug: options.org,
+    slugs: options.slugs && options.slugs.length > 0 ? options.slugs : void 0,
+    brandSlug: options.brandSlug,
+    startDate: range.startDate,
+    endDate: range.endDate,
+    include
+  };
+  const result = await client.getOrganizationMetrics(input);
+  const isMulti = result.scope.mode === "multi";
+  const scopeLabel = isMulti ? `${result.scope.orgs.length} orgs (${result.scope.orgs.join(", ")})` : result.scope.orgs[0] ?? options.org ?? "your organization";
+  const includeLabel = include ? ` (include: ${include.join(", ")})` : "";
+  const totalsRows = populatedMetricRows(result.metrics);
+  const perDayRows = result.averages.perDay ? populatedMetricRows(result.averages.perDay, formatAverage) : [];
+  const perOrgPerDayRows = result.averages.perOrgPerDay ? populatedMetricRows(result.averages.perOrgPerDay, formatAverage) : [];
+  printOutput({
+    outputFormat,
+    json: { ...result, range, include: include ?? null },
+    markdown: buildMarkdown({
+      scopeLabel,
+      rangeLabel: range.label,
+      includeLabel,
+      isMulti,
+      range,
+      result,
+      totalsRows,
+      perDayRows,
+      perOrgPerDayRows
+    }),
+    csv: toCsvRows(buildCsvRows({ result, range, isMulti })),
+    human: () => {
+      const headline = isMulti ? `Multi-org metrics \u2014 ${scopeLabel} \u2014 ${range.label}${includeLabel}` : `Organization metrics for ${scopeLabel} \u2014 ${range.label}${includeLabel}`;
+      console.log(headline);
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
+      const totalsHeader = isMulti ? "Totals (sum across orgs):" : "Totals:";
+      console.log(totalsHeader);
+      for (const [name, value] of totalsRows) {
+        console.log(`  ${name}: ${value}`);
+      }
+      if (result.averages.windowDays !== null && perDayRows.length > 0) {
+        console.log("");
+        console.log(`Averages per day (window = ${result.averages.windowDays} days):`);
+        for (const [name, value] of perDayRows) {
+          console.log(`  ${name}: ${value}`);
+        }
+      }
+      if (perOrgPerDayRows.length > 0) {
+        console.log("");
+        console.log(`Averages per org per day:`);
+        for (const [name, value] of perOrgPerDayRows) {
+          console.log(`  ${name}: ${value}`);
+        }
+      }
+      if (isMulti && result.perOrg) {
+        console.log("");
+        console.log("Per-org breakdown:");
+        for (const slug of result.scope.orgs) {
+          const entry = result.perOrg[slug];
+          if (!entry) continue;
+          const rows = populatedMetricRows(entry.metrics);
+          if (rows.length === 0) continue;
+          console.log(`  ${slug}:`);
+          for (const [name, value] of rows) {
+            console.log(`    ${name}: ${value}`);
+          }
+        }
+      }
+      if (!isMulti && result.blockedByDay && result.blockedByDay.length > 0) {
+        console.log("");
+        console.log(`Blocked by day (${result.blockedByDay.length} entries):`);
+        for (const entry of result.blockedByDay) {
+          console.log(`  ${entry.date}: ${entry.count}`);
+        }
+      }
+    }
+  });
+}
+function buildMarkdown(args) {
+  const {
+    scopeLabel,
+    rangeLabel,
+    includeLabel,
+    isMulti,
+    range,
+    result,
+    totalsRows,
+    perDayRows,
+    perOrgPerDayRows
+  } = args;
+  const lines = [];
+  const heading = isMulti ? "Multi-Org Metrics" : "Organization Metrics";
+  lines.push(`# ${heading} (${scopeLabel}) \u2014 ${rangeLabel}${includeLabel}`);
+  lines.push("");
+  lines.push(`- Range: ${range.startDate} \u2192 ${range.endDate}`);
+  lines.push("");
+  lines.push(isMulti ? `## Totals (sum across orgs)` : `## Totals`);
+  for (const [name, value] of totalsRows) {
+    lines.push(`- ${name}: ${value}`);
+  }
+  if (result.averages.windowDays !== null && perDayRows.length > 0) {
+    lines.push("");
+    lines.push(`## Averages per day (window = ${result.averages.windowDays} days)`);
+    for (const [name, value] of perDayRows) {
+      lines.push(`- ${name}: ${value}`);
+    }
+  }
+  if (perOrgPerDayRows.length > 0) {
+    lines.push("");
+    lines.push(`## Averages per org per day`);
+    for (const [name, value] of perOrgPerDayRows) {
+      lines.push(`- ${name}: ${value}`);
+    }
+  }
+  if (isMulti && result.perOrg) {
+    lines.push("");
+    lines.push(`## Per-org breakdown`);
+    for (const slug of result.scope.orgs) {
+      const entry = result.perOrg[slug];
+      if (!entry) continue;
+      const rows = populatedMetricRows(entry.metrics);
+      if (rows.length === 0) continue;
+      lines.push(`### ${slug}`);
+      for (const [name, value] of rows) {
+        lines.push(`- ${name}: ${value}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function buildCsvRows({
+  result,
+  range,
+  isMulti
+}) {
+  const baseFields = (metrics) => ({
+    reports: metrics.reports,
+    newThreats: metrics.newThreats,
+    threatsWatchlisted: metrics.threatsWatchlisted,
+    takedownsFiled: metrics.takedownsFiled,
+    takedownsCompleted: metrics.takedownsCompleted,
+    domainThreats: metrics.domainThreats,
+    twitterThreats: metrics.twitterThreats,
+    telegramThreats: metrics.telegramThreats,
+    otherThreats: metrics.otherThreats
+  });
+  if (!isMulti) {
+    return [
+      {
+        scope: "single",
+        org: result.scope.orgs[0] ?? "",
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
+        windowDays: result.averages.windowDays,
+        ...baseFields(result.metrics)
+      }
+    ];
+  }
+  const rows = [];
+  rows.push({
+    scope: "totals",
+    org: "",
+    rangeLabel: range.label,
+    startDate: range.startDate,
+    endDate: range.endDate,
+    windowDays: result.averages.windowDays,
+    ...baseFields(result.metrics)
+  });
+  if (result.perOrg) {
+    for (const slug of result.scope.orgs) {
+      const entry = result.perOrg[slug];
+      if (!entry) continue;
+      rows.push({
+        scope: "per-org",
+        org: slug,
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
+        windowDays: result.averages.windowDays,
+        ...baseFields(entry.metrics)
+      });
+    }
+  }
+  return rows;
+}
+export {
+  runMetricsOrganization
+};

package/dist/{run-KDNQIR5E.js → run-BHAH7DUC.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-BIKTBRER.js";
+} from "./chunk-FOTFWUOX.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-YZEMTNCX.js";
+import "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-HRFJORDS.js → run-G5J77GZD.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-VHFXOCGS.js → run-V7QJBNLF.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-NOSQW75S.js → search-ME6KFCEV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-Q6PCFIDE.js → setup-skill-ENJSVGLR.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-6X5BFFXA.js";
+} from "./chunk-QGKR7EPH.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-55UV26NQ.js → snapshot-B6TQCFQ3.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-QUCLZYX6.js → summary-NYHIQ5DP.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-TPG47SYS.js → validate-I3YHZDZR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-Y3ZJGN4O.js → whoami-6KU4LOJS.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-YZEMTNCX.js";
+} from "./chunk-UZDSNWGL.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [

package/dist/organization-VSQQAGBS.js

@@ -1,105 +0,0 @@
-import {
-  resolveDateRange
-} from "./chunk-S37VFIZY.js";
-import {
-  printOutput,
-  toCsvRows
-} from "./chunk-VFT3TD3E.js";
-import {
-  ORGANIZATION_METRICS_INCLUDE_FIELDS,
-  createApiClient
-} from "./chunk-YZEMTNCX.js";
-import "./chunk-EGWK6SRQ.js";
-import "./chunk-TFCNKBRC.js";
-import "./chunk-U73SABXK.js";
-
-// src/commands/metrics/organization.ts
-var INCLUDE_VALUES = new Set(ORGANIZATION_METRICS_INCLUDE_FIELDS);
-function parseIncludeList(raw) {
-  if (!raw || raw.length === 0) return void 0;
-  const fields = [];
-  for (const value of raw) {
-    if (!INCLUDE_VALUES.has(value)) {
-      throw new Error(
-        `Unknown --include value: '${value}'. Allowed: ${ORGANIZATION_METRICS_INCLUDE_FIELDS.join(", ")}`
-      );
-    }
-    fields.push(value);
-  }
-  return fields;
-}
-async function runMetricsOrganization(options) {
-  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
-  const client = options.apiClient ?? createApiClient();
-  const range = resolveDateRange({
-    from: options.from,
-    to: options.to,
-    thisWeek: options.thisWeek
-  });
-  const include = parseIncludeList(options.include);
-  const input = {
-    organizationSlug: options.org,
-    brandSlug: options.brandSlug,
-    startDate: range.startDate,
-    endDate: range.endDate,
-    include
-  };
-  const result = await client.getOrganizationMetrics(input);
-  const label = options.org ?? "your organization";
-  const includeLabel = include ? ` (include: ${include.join(", ")})` : "";
-  const metricLines = [
-    ["Reports", result.metrics.reports],
-    ["New threats", result.metrics.newThreats],
-    ["Watchlisted threats", result.metrics.threatsWatchlisted],
-    ["Takedowns filed", result.metrics.takedownsFiled],
-    ["Takedowns completed", result.metrics.takedownsCompleted],
-    ["Domain threats", result.metrics.domainThreats],
-    ["Twitter threats", result.metrics.twitterThreats],
-    ["Telegram threats", result.metrics.telegramThreats],
-    ["Other threats", result.metrics.otherThreats]
-  ];
-  const populatedMetricLines = metricLines.filter(([, value]) => value !== null);
-  printOutput({
-    outputFormat,
-    json: { ...result, range, include: include ?? null },
-    markdown: [
-      `# Organization Metrics (${label}) \u2014 ${range.label}${includeLabel}`,
-      "",
-      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
-      ...populatedMetricLines.map(([name, value]) => `- ${name}: ${value}`)
-    ].join("\n"),
-    csv: toCsvRows([
-      {
-        rangeLabel: range.label,
-        startDate: range.startDate,
-        endDate: range.endDate,
-        reports: result.metrics.reports,
-        newThreats: result.metrics.newThreats,
-        threatsWatchlisted: result.metrics.threatsWatchlisted,
-        takedownsFiled: result.metrics.takedownsFiled,
-        takedownsCompleted: result.metrics.takedownsCompleted,
-        domainThreats: result.metrics.domainThreats,
-        twitterThreats: result.metrics.twitterThreats,
-        telegramThreats: result.metrics.telegramThreats,
-        otherThreats: result.metrics.otherThreats
-      }
-    ]),
-    human: () => {
-      console.log(`Organization metrics for ${label} \u2014 ${range.label}${includeLabel}`);
-      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
-      for (const [name, value] of populatedMetricLines) {
-        console.log(`${name}: ${value}`);
-      }
-      if (result.blockedByDay && result.blockedByDay.length > 0) {
-        console.log("");
-        console.log(`Blocked by day (${result.blockedByDay.length} entries):`);
-        for (const entry of result.blockedByDay) {
-          console.log(`  ${entry.date}: ${entry.count}`);
-        }
-      }
-    }
-  });
-}
-export {
-  runMetricsOrganization
-};