@chainpatrol/cli 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # @chainpatrol/cli
 
+## 0.16.0
+
+### Minor Changes
+
+- c1af664: Add `--all-my-orgs` to `chainpatrol metrics organization` and raise
+  the `--slugs` cap from 50 → 500.
+
+  `--all-my-orgs` is the shortest path to answer "how many takedowns
+  across all clients in the last 7 days?" — no `orgs list` round-trip,
+  no client-side slug stitching. The server resolves the org set using
+  the same logic as `/user/orgs` (so an agent already familiar with
+  that filter shape can reuse it), runs the per-org metric fan-out
+  with bounded concurrency, and rolls up totals + per-day /
+  per-org-per-day averages + the per-org breakdown in one HTTP call.
+
+  Pair with `--subscription-status` and/or `--service-active` to
+  narrow to the org set the question is actually about — e.g.
+
+  ```bash
+  chainpatrol --json metrics organization \
+    --all-my-orgs \
+    --subscription-status ACTIVE \
+    --service-active takedowns \
+    --include takedownsCompleted \
+    --from 2026-05-12 --to 2026-05-19
+  ```
+
+  The `--slugs` form still works for cases where the caller wants a
+  specific named subset; both forms cap at 500 orgs per call (previously
+  50). The cap remains a backstop — `--all-my-orgs` returns a 413 with
+  a clear "narrow with filters" hint if the resolved set exceeds it.
+
+  Auth:
+
+  - Org-scoped API keys are rejected for `--all-my-orgs` (they're pinned
+    to a single org by design — the default form already covers that
+    org).
+  - User API keys (inherit owning user's memberships) and Bearer
+    sessions can use it; the resolved org set matches what `orgs list`
+    would return for the same caller.
+  - Staff users still get every active org (subject to the filters).
+
+  Response now includes `scope.resolvedFrom` (`"api-key" |
+"organizationSlug" | "slugs" | "allMyOrgs"`) so agents can see how
+  the server interpreted their request and report it accurately to the
+  end user.
+
+  Skill content is rewritten to lead with `--all-my-orgs` for cross-org
+  questions, with `--slugs` repositioned as "use this for an explicit
+  subset." Existing `--slugs` examples and the `orgs list` + `--slugs`
+  recipe are updated to call out the new single-call alternative.
+
+## 0.15.1
+
+### Patch Changes
+
+- 92df1cd: Tighten the skill content so agents stop bailing on cross-customer
+  totals.
+
+  After the multi-org `--slugs` shipped in #6555, an agent on the
+  new CLI was still answering "I can't easily get this — no `--all`
+  aggregation in the CLI" to "how many takedowns across all clients
+  in the last 7 days?", because the existing `--slugs` section was
+  buried below the per-subcommand details and the agent anchored on
+  `metrics summary` (which is single-org and has no `--slugs`).
+
+  Two changes to fix that without touching code:
+
+  1. **Frontload a decision rule.** A new "read this before picking a
+     metrics subcommand" block sits at the top of the metrics section,
+     names the cross-org phrases ("across all clients", "company-wide",
+     "total takedowns", "how many takedowns in the last N days?" with
+     no org named, etc.), points at `metrics organization --slugs`,
+     and explicitly anti-patterns the common wrong moves (routing to
+     Metabase, looping `metrics summary`, bailing with "no cross-org
+     aggregation in the CLI"). Includes a copy-and-run two-step
+     recipe (`orgs list` → `metrics organization --slugs`).
+  2. **Broaden the `Use when` trigger phrases** to cover the cross-org
+     wording explicitly: "how many takedowns", "across all
+     clients/customers/orgs/brands", "company-wide", "total/average
+     takedowns/threats/reports", "rollup across customers", etc., so
+     the skill itself loads when the user asks this kind of question.
+
+  Skill-only change; no API, handler, or response shape changes.
+
 ## 0.15.0
 
 ### Minor Changes

package/dist/{breakdown-27PMFEWQ.js → breakdown-PQXHY2VO.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-M5U2CSWK.js → check-5B4EPWOZ.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-FOTFWUOX.js → chunk-CJPWEWGS.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/{chunk-UZDSNWGL.js → chunk-JEBZIBRI.js}

@@ -279,6 +279,9 @@ function createApiClient(options) {
       return requestGet("/organization/metrics", {
         organizationSlug: input.organizationSlug,
         slugs: input.slugs,
+        allMyOrgs: input.allMyOrgs ? "true" : void 0,
+        subscriptionStatus: input.subscriptionStatus,
+        services: input.services ? JSON.stringify(input.services) : void 0,
         brandSlug: input.brandSlug,
         startDate: parseIsoDateString(input.startDate),
         endDate: parseIsoDateString(input.endDate),

package/dist/{chunk-QGKR7EPH.js → chunk-TTLGCRRR.js}

@@ -198,7 +198,13 @@ description: |
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
-  "check this asset", "asset check", "lookup asset status".
+  "check this asset", "asset check", "lookup asset status",
+  "how many takedowns", "takedowns in the last", "threats taken down",
+  "across all clients", "across all customers", "across all orgs",
+  "across all brands", "company-wide", "total takedowns", "total threats",
+  "total reports", "average takedowns", "average threats", "average per day",
+  "average per customer", "average per org", "rollup across customers",
+  "sum across orgs", "sum across customers".
 allowed-tools:
   - Bash
   - Read
@@ -661,6 +667,81 @@ and summarize patterns by service or by subscription tier.
 
 ### \`metrics summary | found | breakdown | organization\` \u2014 Org metrics for spike/drop analysis
 
+#### Decision rule \u2014 read this before picking a metrics subcommand
+
+When the user asks for a number that **spans more than one customer/org/brand**
+\u2014 phrases like "across all clients", "across all customers", "across all orgs",
+"across all brands", "company-wide", "total takedowns", "total threats",
+"average takedowns per day across customers", "rollup across customers",
+"how many takedowns in the last 7 days?" (no org named) \u2014 the answer is
+**\`chainpatrol metrics organization --all-my-orgs\`** (or \`--slugs\`
+if you want a specific subset). \`summary\`, \`found\`, and \`breakdown\`
+are single-org commands and have **no** \`--slugs\`/\`--all-my-orgs\`
+form; only \`organization\` does. The multi-org form rolls totals +
+per-day / per-org-per-day averages + a per-org breakdown server-side
+in **one** HTTP call.
+
+**Anti-patterns to avoid:**
+
+- \u274C "There's no cross-org aggregation in the CLI." There is \u2014
+  \`metrics organization --all-my-orgs\` (or \`--slugs\`). Don't bail
+  out citing the docs without trying these flags.
+- \u274C Looping \`metrics summary --org X\` once per customer to sum
+  client-side. The multi-org form is one round-trip; the loop is what
+  made the endpoint 503-prone in the first place.
+- \u274C Calling \`orgs list\` to build a slug list when you just want
+  "everything." Use \`--all-my-orgs\` and skip the enumeration entirely \u2014
+  the server resolves the same set via shared logic. Save \`orgs list\`
+  +  \`--slugs\` for cases where the user asked for a specific subset.
+- \u274C Routing the user to Metabase / the data warehouse for a question
+  the CLI can answer. Reach for Metabase only when the metric isn't
+  in the \`--include\` list (\`reports\`, \`newThreats\`,
+  \`threatsWatchlisted\`, \`takedownsFiled\`, \`takedownsCompleted\`,
+  \`domainThreats\`, \`twitterThreats\`, \`telegramThreats\`,
+  \`otherThreats\`, \`blockedByType\`, \`blockedByDay\`).
+- \u274C "Iterating 100+ orgs one-by-one isn't practical here." Right \u2014
+  that's why you don't iterate. \`--all-my-orgs\` covers up to 500
+  orgs in a single call; for larger fleets, narrow with
+  \`--subscription-status\` / \`--service-active\`, or split an
+  explicit \`--slugs\` list into batches and sum.
+
+#### Common cross-org recipe (copy and run)
+
+The shortest answer to "how many takedowns across all customers in the
+last 7 days?" is a single call \u2014 no \`orgs list\` step needed:
+
+\`\`\`bash
+chainpatrol --json metrics organization \\
+  --all-my-orgs \\
+  --subscription-status ACTIVE \\
+  --service-active takedowns \\
+  --include takedownsCompleted \\
+  --from <YYYY-MM-DD 7 days ago> --to <YYYY-MM-DD today>
+
+# Read these fields from the JSON:
+#   .scope.orgs                                    \u2190 which orgs the server resolved
+#   .metrics.takedownsCompleted                    \u2190 grand total across all orgs
+#   .averages.perDay.takedownsCompleted            \u2190 total / windowDays
+#   .averages.perOrgPerDay.takedownsCompleted      \u2190 total / numOrgs / windowDays
+#   .perOrg[slug].metrics.takedownsCompleted       \u2190 per-customer breakdown
+\`\`\`
+
+Replace \`takedownsCompleted\` with whatever metric the user asked about.
+Replace the date range with whatever window they asked about (default
+3 months if they didn't say).
+
+If the user *asked* for a specific subset of customers ("how many for
+acme, beta, gamma combined?"), use \`--slugs acme,beta,gamma\` instead
+of \`--all-my-orgs\`. \`--slugs\` accepts up to 500 entries.
+
+**Auth note for \`--all-my-orgs\`:** requires a user session or a
+user-scoped API key (it inherits your memberships). Org-scoped API
+keys are rejected \u2014 they're pinned to a single org by design. If
+\`whoami\` shows an org-scoped key, use a Bearer session instead or
+ask the user to provision a user API key.
+
+#### Single-org examples
+
 \`\`\`bash
 chainpatrol --json metrics summary      --org <slug>                                  # defaults to last 3 months
 chainpatrol --json metrics summary      --org <slug> --this-week
@@ -760,36 +841,44 @@ The response shape switches to multi-org:
 }
 \`\`\`
 
-To answer **"across all of our customers"**, list the orgs first:
+To answer **"across all of our customers"**, prefer \`--all-my-orgs\` \u2014
+it lets the server resolve the org set in one round-trip, no \`orgs
+list\` step needed:
 
 \`\`\`bash
-chainpatrol --json orgs list --subscription-status ACTIVE  # \u2190 get slugs
 chainpatrol --json metrics organization \\
-  --slugs <comma-list of all the slugs from above> \\
+  --all-my-orgs \\
+  --subscription-status ACTIVE \\
+  --service-active takedowns \\
   --include takedownsCompleted \\
   --from 2026-05-12 --to 2026-05-19
 \`\`\`
 
-The endpoint caps \`slugs\` at 50 per call; if you need more, split
-the list and sum the totals client-side. **Do not loop \`metrics
-organization\` once per org** when \`--slugs\` will do \u2014 N HTTP
-round-trips is what made the old code 503.
+Use \`--slugs <comma-list>\` only when the user asked for a *specific*
+subset of customers ("how many for acme, beta, gamma combined?"); the
+two flags are mutually exclusive. Both forms cap at 500 orgs per call;
+if a real fleet exceeds that, narrow with
+\`--subscription-status\`/\`--service-active\` filters or split an
+explicit \`--slugs\` list into batches and sum. **Do not loop
+\`metrics organization\` once per org** \u2014 N HTTP round-trips is what
+made the old code 503.
 
-Always pair \`--slugs\` with \`--include\` to narrow the metric set to
-what the user actually asked about. "How many takedowns did we
-complete?" \u2192 \`--include takedownsCompleted\`; "average reports per
-day per customer?" \u2192 \`--include reports\`. Skipping \`--include\` runs
-~11 aggregates per org which is rarely necessary.
+Always pair the multi-org form with \`--include\` to narrow the metric
+set to what the user actually asked about. "How many takedowns did
+we complete?" \u2192 \`--include takedownsCompleted\`; "average reports
+per day per customer?" \u2192 \`--include reports\`. Skipping \`--include\`
+runs ~11 aggregates per org which is rarely necessary.
 
-#### Auth: which credential can use \`--slugs\`
+#### Auth: which credential can use \`--slugs\` / \`--all-my-orgs\`
 
 - **Org-scoped API key** (the most common production key): can only
-  query its own org. If \`--slugs\` contains anything else the server
-  returns 403. Use the \`--org\` form (or omit both) instead.
+  query its own org. If \`--slugs\` contains foreign orgs the server
+  returns 403; \`--all-my-orgs\` is also rejected. Use the \`--org\`
+  form (or omit both) instead.
 - **User API key**: inherits the user's org memberships, so it can
   query any org the user is a member of (or any org for staff
-  users). This is the credential you want for cross-org rollups
-  from automated agents.
+  users) via \`--slugs\` or \`--all-my-orgs\`. This is the credential
+  you want for cross-org rollups from automated agents.
 - **Session auth** (Bearer token, e.g. \`chainpatrol login\`): same
   membership rules as the user. Staff users can query any org.
 

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-QGKR7EPH.js";
+} from "./chunk-TTLGCRRR.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -263,22 +263,25 @@ var HELP = {
     ]
   },
   "metrics organization": {
-    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with org-scoped API keys (org derived from key, single-org only), user API keys (inherits user permissions, multi-org allowed), and session auth. Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates the caller doesn't need; use --slugs to query several orgs in one call and get totals + per-org breakdown + per-day / per-org-per-day averages. Fields not included come back as null.",
-    usage: "chainpatrol metrics organization [--org <slug>|--slugs <list>] [--from ISO --to ISO|--this-week] [--include <list>]",
+    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with org-scoped API keys (single-org only), user API keys (inherits user permissions, multi-org allowed), and session auth. Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates; use --slugs OR --all-my-orgs for multi-org rollups (totals + per-day / per-org-per-day averages + per-org breakdown). Fields not included come back as null.",
+    usage: "chainpatrol metrics organization [--org <slug>|--slugs <list>|--all-my-orgs] [--from ISO --to ISO|--this-week] [--include <list>]",
     options: [
-      "--org <slug>          Single organization slug (omit when using an org-scoped API key). Mutually exclusive with --slugs.",
-      "--slugs <list>        Comma list of org slugs (max 50). Response includes totals across these orgs and a per-org breakdown plus per-day / per-org-per-day averages. Not allowed for org-scoped API keys with foreign slugs.",
-      "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag; only valid with a single org)",
-      "--from <iso>          Start date (ISO 8601, e.g. 2026-01-01)",
-      "--to <iso>            End date (ISO 8601)",
-      "--this-week           Use the current ISO week (overrides default)",
-      "--include <list>      Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsCompleted,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
+      "--org <slug>                  Single org. Mutually exclusive with --slugs and --all-my-orgs.",
+      "--slugs <list>                Comma list of org slugs (cap 500). Response is the rollup across these orgs.",
+      "--all-my-orgs                 Shortcut for 'every org I can see'. Server resolves via the same logic as `orgs list` (org-scoped API keys are rejected). Cap 500 \u2014 narrow with --subscription-status / --service-active if you have more.",
+      "--subscription-status <list>  With --all-my-orgs: only ACTIVE / TRIAL / PROSPECT / INTEGRATION (default: same set as `orgs list`).",
+      "--service-active <list>       With --all-my-orgs: only orgs with the listed service(s) active. Allowed: reporting, reviewing, protection, takedowns, detection, darkWebMonitoring.",
+      "--brand-slug <slug>           Filter by brand slug (requires brands-metrics flag; single-org only).",
+      "--from <iso>                  Start date (ISO 8601, e.g. 2026-01-01)",
+      "--to <iso>                    End date (ISO 8601)",
+      "--this-week                   Use the current ISO week (overrides default)",
+      "--include <list>              Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsCompleted,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
     ],
     examples: [
-      "chainpatrol metrics organization --org acme                                           # defaults to last 3 months, all metrics",
+      "chainpatrol metrics organization --org acme                                           # defaults to last 3 months",
       "chainpatrol metrics organization --org acme --include takedownsFiled,takedownsCompleted",
-      "chainpatrol metrics organization --org acme --from 2026-01-01 --to 2026-02-01",
-      "chainpatrol metrics organization --slugs acme,beta,gamma --include takedownsCompleted --from 2026-05-12 --to 2026-05-19   # 7-day takedown total + per-day / per-org-per-day averages",
+      "chainpatrol metrics organization --slugs acme,beta,gamma --include takedownsCompleted --from 2026-05-12 --to 2026-05-19",
+      "chainpatrol metrics organization --all-my-orgs --service-active takedowns --subscription-status ACTIVE --include takedownsCompleted --from 2026-05-12 --to 2026-05-19   # cross-customer total in one call",
       "CHAINPATROL_API_KEY=... chainpatrol metrics organization --json --include reports"
     ]
   },
@@ -864,6 +867,7 @@ ${getTopLevelHelp()}
     by: { type: "string" },
     include: { type: "string" },
     slugs: { type: "string" },
+    allMyOrgs: { type: "boolean", default: false },
     brand: { type: "string" },
     enable: { type: "boolean", default: false },
     disable: { type: "boolean", default: false },
@@ -1037,12 +1041,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-X6QHIRE5.js");
+    const { listConfigsJson } = await import("./list-json-DXPR3UEY.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-ZTMCEG56.js");
+  const { default: ConfigsList } = await import("./list-GPWZ52JD.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1142,7 +1146,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-M5U2CSWK.js");
+        const { runAssetCheck } = await import("./check-5B4EPWOZ.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1152,7 +1156,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-VOWXWXHY.js");
+        const { runAssetList } = await import("./list-G2F2IFEU.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1173,7 +1177,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-FORGIJWP.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-47MU5AZ7.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1188,7 +1192,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-I3YHZDZR.js");
+        const { runDetectionsValidate } = await import("./validate-LXE3JPET.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1203,7 +1207,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-T4AF6Y3X.js");
+        const { runDetectionsDrift } = await import("./drift-5EZK2JA5.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1217,7 +1221,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
+        const { runDetectionsRun } = await import("./run-HDEKIP4L.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1231,7 +1235,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-RMD4NKVB.js");
+        const { runDetectionsList } = await import("./list-FGDMMAPM.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1260,7 +1264,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
+          const { runDetectionsRun } = await import("./run-HDEKIP4L.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1278,7 +1282,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-YMPRYXKZ.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-6BYB7M37.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1312,11 +1316,15 @@ async function main() {
     case "metrics": {
       if (subcommand === "organization" || subcommand === "org") {
         const slugs = parseCsvList(cli.flags.slugs);
-        const org2 = slugs && slugs.length > 0 ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-HD6LRAZP.js");
+        const allMyOrgs = cli.flags.allMyOrgs;
+        const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
+        const { runMetricsOrganization } = await import("./organization-NR6JCD5I.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
+          allMyOrgs: allMyOrgs || void 0,
+          subscriptionStatus: parseCsvList(cli.flags.subscriptionStatus),
+          serviceActive: parseCsvList(cli.flags.serviceActive),
           brandSlug: cli.flags.brandSlug,
           from: cli.flags.from,
           to: cli.flags.to,
@@ -1329,7 +1337,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-NYHIQ5DP.js");
+        const { runMetricsSummary } = await import("./summary-2IXOMOIA.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1342,7 +1350,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-XEGMO6YY.js");
+        const { runMetricsFound } = await import("./found-XRJZ4SSY.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1359,7 +1367,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-27PMFEWQ.js");
+        const { runMetricsBreakdown } = await import("./breakdown-PQXHY2VO.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1380,7 +1388,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-N4TTNR6N.js");
+        const { runReportsList } = await import("./list-2JCBA3Q2.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1408,7 +1416,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-DQYNYD6G.js");
+        const { runReportsCreate } = await import("./create-Y6Z4L656.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1429,7 +1437,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-ME6KFCEV.js");
+        const { runReportsSearch } = await import("./search-PBVQ7473.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1445,7 +1453,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-XHBQMP6P.js");
+        const { runThreatsList } = await import("./list-JD4U2SBV.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1468,7 +1476,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-DVPEMSVH.js");
+        const { runTakedownsList } = await import("./list-ZIM2MR2Q.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1499,7 +1507,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-B6TQCFQ3.js");
+        const { runQueuesSnapshot } = await import("./snapshot-U53T5Q2M.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1517,7 +1525,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-COJ5BLQV.js");
+        const { runOrgsList } = await import("./list-KFFNLKZK.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1532,7 +1540,7 @@ async function main() {
       }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-63HPS2RE.js");
+          const { runOrgsAssetsList } = await import("./list-QC7DUKFD.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1548,7 +1556,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-WPXNCBT3.js");
+          const { runOrgsAssetGroupsList } = await import("./list-IA2LRT4X.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1563,7 +1571,7 @@ async function main() {
       );
     }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-6KU4LOJS.js");
+      const { runWhoami } = await import("./whoami-4XDWPKVV.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1572,7 +1580,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-OWJLAWMP.js");
+        const { runHealthchecksList } = await import("./list-AYXZG3I6.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1586,7 +1594,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-G5J77GZD.js");
+        const { runHealthchecksRun } = await import("./run-EJBBPBOR.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1604,7 +1612,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-BJMP3QEV.js");
+        const { runPresetsList } = await import("./list-WBZIULUS.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1615,7 +1623,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-BHAH7DUC.js");
+        const { runPresetsRun } = await import("./run-ANHA5JFB.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1632,12 +1640,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-ENJSVGLR.js");
+      const { setupSkill } = await import("./setup-skill-2RKWIVGS.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-ENJSVGLR.js");
+      const { uninstallSkill } = await import("./setup-skill-2RKWIVGS.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-YMPRYXKZ.js → configs-update-6BYB7M37.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-DQYNYD6G.js → create-Y6Z4L656.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-T4AF6Y3X.js → drift-5EZK2JA5.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-XEGMO6YY.js → found-XRJZ4SSY.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{healthcheck-FORGIJWP.js → healthcheck-47MU5AZ7.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-N4TTNR6N.js → list-2JCBA3Q2.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-OWJLAWMP.js → list-AYXZG3I6.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-RMD4NKVB.js → list-FGDMMAPM.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-VOWXWXHY.js → list-G2F2IFEU.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-ZTMCEG56.js → list-GPWZ52JD.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-WPXNCBT3.js → list-IA2LRT4X.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-XHBQMP6P.js → list-JD4U2SBV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-COJ5BLQV.js → list-KFFNLKZK.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-63HPS2RE.js → list-QC7DUKFD.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-BJMP3QEV.js → list-WBZIULUS.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-FOTFWUOX.js";
+} from "./chunk-CJPWEWGS.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-UZDSNWGL.js";
+import "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-DVPEMSVH.js → list-ZIM2MR2Q.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-json-X6QHIRE5.js → list-json-DXPR3UEY.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{organization-HD6LRAZP.js → organization-NR6JCD5I.js}

@@ -8,12 +8,34 @@ import {
 import {
   ORGANIZATION_METRICS_INCLUDE_FIELDS,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";
 
 // src/commands/metrics/organization.ts
+var SERVICE_KEYS = [
+  "reporting",
+  "reviewing",
+  "protection",
+  "takedowns",
+  "detection",
+  "darkWebMonitoring"
+];
+var SERVICE_KEY_SET = new Set(SERVICE_KEYS);
+function buildServicesFilter(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const filter = {};
+  for (const value of raw) {
+    if (!SERVICE_KEY_SET.has(value)) {
+      throw new Error(
+        `Unknown --service-active value: '${value}'. Allowed: ${SERVICE_KEYS.join(", ")}`
+      );
+    }
+    filter[value] = { active: true };
+  }
+  return filter;
+}
 var INCLUDE_VALUES = new Set(ORGANIZATION_METRICS_INCLUDE_FIELDS);
 var METRIC_LABELS = [
   ["reports", "Reports"],
@@ -50,8 +72,13 @@ function populatedMetricRows(metrics, format = (v) => String(v)) {
   ]);
 }
 async function runMetricsOrganization(options) {
-  if (options.org && options.slugs && options.slugs.length > 0) {
-    throw new Error("Pass either --org or --slugs, not both.");
+  const explicitForms = [
+    Boolean(options.org),
+    Boolean(options.slugs && options.slugs.length > 0),
+    Boolean(options.allMyOrgs)
+  ].filter(Boolean).length;
+  if (explicitForms > 1) {
+    throw new Error("Pass at most one of --org, --slugs, or --all-my-orgs.");
   }
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   const client = options.apiClient ?? createApiClient();
@@ -61,9 +88,13 @@ async function runMetricsOrganization(options) {
     thisWeek: options.thisWeek
   });
   const include = parseIncludeList(options.include);
+  const services = buildServicesFilter(options.serviceActive);
   const input = {
     organizationSlug: options.org,
     slugs: options.slugs && options.slugs.length > 0 ? options.slugs : void 0,
+    allMyOrgs: options.allMyOrgs || void 0,
+    subscriptionStatus: options.subscriptionStatus && options.subscriptionStatus.length > 0 ? options.subscriptionStatus : void 0,
+    services,
     brandSlug: options.brandSlug,
     startDate: range.startDate,
     endDate: range.endDate,
@@ -71,7 +102,7 @@ async function runMetricsOrganization(options) {
   };
   const result = await client.getOrganizationMetrics(input);
   const isMulti = result.scope.mode === "multi";
-  const scopeLabel = isMulti ? `${result.scope.orgs.length} orgs (${result.scope.orgs.join(", ")})` : result.scope.orgs[0] ?? options.org ?? "your organization";
+  const scopeLabel = isMulti ? `${result.scope.orgs.length} orgs${result.scope.resolvedFrom === "allMyOrgs" ? " (--all-my-orgs)" : ` (${result.scope.orgs.slice(0, 10).join(", ")}${result.scope.orgs.length > 10 ? ", \u2026" : ""})`}` : result.scope.orgs[0] ?? options.org ?? "your organization";
   const includeLabel = include ? ` (include: ${include.join(", ")})` : "";
   const totalsRows = populatedMetricRows(result.metrics);
   const perDayRows = result.averages.perDay ? populatedMetricRows(result.averages.perDay, formatAverage) : [];

package/dist/{run-BHAH7DUC.js → run-ANHA5JFB.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-FOTFWUOX.js";
+} from "./chunk-CJPWEWGS.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-UZDSNWGL.js";
+import "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-G5J77GZD.js → run-EJBBPBOR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-V7QJBNLF.js → run-HDEKIP4L.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-ME6KFCEV.js → search-PBVQ7473.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-ENJSVGLR.js → setup-skill-2RKWIVGS.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-QGKR7EPH.js";
+} from "./chunk-TTLGCRRR.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-B6TQCFQ3.js → snapshot-U53T5Q2M.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-NYHIQ5DP.js → summary-2IXOMOIA.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-I3YHZDZR.js → validate-LXE3JPET.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-6KU4LOJS.js → whoami-4XDWPKVV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-JEBZIBRI.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [