@chainpatrol/cli 0.15.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,72 @@
 # @chainpatrol/cli
 
+## 0.17.0
+
+### Minor Changes
+
+- 27b18af: Adds `chainpatrol orgs get <slug>` for fetching a single accessible
+  organization, backed by a new public `GET /user/orgs/{slug}` endpoint.
+  Returns the same per-org shape as one row of `orgs list` (subscription
+  status + per-service active/automated flags) and reuses the same access
+  gating: org-scoped API keys must match the slug, user sessions / user-scoped
+  API keys need an active membership unless the caller is staff. The bundled
+  Claude Code skill (`/chainpatrol`) is updated to document the new command.
+  Server-side procedure + validation live in the private `@chainpatrol/external-trpc`
+  and `@chainpatrol/validation` packages and ship together with this CLI
+  release, but are not listed in the frontmatter because they are private.
+
+## 0.16.0
+
+### Minor Changes
+
+- c1af664: Add `--all-my-orgs` to `chainpatrol metrics organization` and raise
+  the `--slugs` cap from 50 → 500.
+
+  `--all-my-orgs` is the shortest path to answer "how many takedowns
+  across all clients in the last 7 days?" — no `orgs list` round-trip,
+  no client-side slug stitching. The server resolves the org set using
+  the same logic as `/user/orgs` (so an agent already familiar with
+  that filter shape can reuse it), runs the per-org metric fan-out
+  with bounded concurrency, and rolls up totals + per-day /
+  per-org-per-day averages + the per-org breakdown in one HTTP call.
+
+  Pair with `--subscription-status` and/or `--service-active` to
+  narrow to the org set the question is actually about — e.g.
+
+  ```bash
+  chainpatrol --json metrics organization \
+    --all-my-orgs \
+    --subscription-status ACTIVE \
+    --service-active takedowns \
+    --include takedownsCompleted \
+    --from 2026-05-12 --to 2026-05-19
+  ```
+
+  The `--slugs` form still works for cases where the caller wants a
+  specific named subset; both forms cap at 500 orgs per call (previously
+  50). The cap remains a backstop — `--all-my-orgs` returns a 413 with
+  a clear "narrow with filters" hint if the resolved set exceeds it.
+
+  Auth:
+
+  - Org-scoped API keys are rejected for `--all-my-orgs` (they're pinned
+    to a single org by design — the default form already covers that
+    org).
+  - User API keys (inherit owning user's memberships) and Bearer
+    sessions can use it; the resolved org set matches what `orgs list`
+    would return for the same caller.
+  - Staff users still get every active org (subject to the filters).
+
+  Response now includes `scope.resolvedFrom` (`"api-key" |
+"organizationSlug" | "slugs" | "allMyOrgs"`) so agents can see how
+  the server interpreted their request and report it accurately to the
+  end user.
+
+  Skill content is rewritten to lead with `--all-my-orgs` for cross-org
+  questions, with `--slugs` repositioned as "use this for an explicit
+  subset." Existing `--slugs` examples and the `orgs list` + `--slugs`
+  recipe are updated to call out the new single-call alternative.
+
 ## 0.15.1
 
 ### Patch Changes

package/dist/{breakdown-27PMFEWQ.js → breakdown-ETSF2BZ3.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-M5U2CSWK.js → check-EMGFDXUO.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-IPN6O3N4.js → chunk-75H4KTIQ.js}

@@ -195,6 +195,8 @@ description: |
   "customer reports", "reports reported by customer", "find detection gaps",
   "org healthcheck", "organization health check", "audit my org",
   "what's wrong with org", "review org setup", "list orgs", "list organizations",
+  "get org", "get organization", "show org details", "org by slug",
+  "fetch org details", "org info",
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
@@ -657,6 +659,35 @@ Customers see only orgs they're a member of. Staff/superuser sessions see
 every matching org. The response is the same in both cases; visibility is
 enforced server-side.
 
+### \`orgs get\` \u2014 Get a single organization by slug
+
+Look up one organization the caller has access to. Returns the same per-org
+shape as a single row from \`orgs list\` (subscription status + per-service
+active/automated flags), so anything you could read from \`orgs list\` you
+can also read here without paging or filtering. Use it when the user names
+a specific customer ("show me acme's setup", "is takedowns automation on
+for morpho?") and you don't need the rest of the catalogue.
+
+\`\`\`bash
+chainpatrol orgs get <slug>
+chainpatrol --json orgs get <slug>
+\`\`\`
+
+Permission rules match \`orgs list\`:
+
+- Org-scoped API keys: must match the slug \u2014 querying another org returns
+  403.
+- User sessions / user-scoped API keys: need an active OrganizationMembership
+  on the slug. Staff/superusers can read any org.
+- Soft-deleted orgs are not returned (404). A 404 also fires for orgs the
+  caller would not be authorized to see \u2014 the endpoint deliberately does
+  not distinguish "doesn't exist" from "you can't see this" beyond the
+  generic 403/404 envelope.
+
+Prefer \`orgs get\` over \`orgs list\` + client-side filter whenever the
+caller already knows the slug; it's one round-trip and side-steps the
+list filters entirely.
+
 #### Use case: finding service configuration gaps across the customer base
 
 When the user asks something like "which customers are paying us but don't
@@ -674,21 +705,25 @@ When the user asks for a number that **spans more than one customer/org/brand**
 "across all brands", "company-wide", "total takedowns", "total threats",
 "average takedowns per day across customers", "rollup across customers",
 "how many takedowns in the last 7 days?" (no org named) \u2014 the answer is
-**\`chainpatrol metrics organization --slugs <comma-list>\`**, *not*
-\`metrics summary\`. \`summary\`, \`found\`, and \`breakdown\` are
-single-org commands and have no \`--slugs\`; only \`organization\` does.
-The \`--slugs\` form rolls totals + per-day / per-org-per-day averages
-server-side in **one** HTTP call. Full recipe is in the \`--slugs\`
-section below.
+**\`chainpatrol metrics organization --all-my-orgs\`** (or \`--slugs\`
+if you want a specific subset). \`summary\`, \`found\`, and \`breakdown\`
+are single-org commands and have **no** \`--slugs\`/\`--all-my-orgs\`
+form; only \`organization\` does. The multi-org form rolls totals +
+per-day / per-org-per-day averages + a per-org breakdown server-side
+in **one** HTTP call.
 
 **Anti-patterns to avoid:**
 
-- \u274C "There's no cross-org aggregation in the CLI." There is \u2014 \`metrics
-  organization --slugs\`. Don't bail out citing the docs without
-  searching for \`--slugs\`.
+- \u274C "There's no cross-org aggregation in the CLI." There is \u2014
+  \`metrics organization --all-my-orgs\` (or \`--slugs\`). Don't bail
+  out citing the docs without trying these flags.
 - \u274C Looping \`metrics summary --org X\` once per customer to sum
-  client-side. \`--slugs\` is one round-trip; the loop is what made
-  the endpoint 503-prone in the first place.
+  client-side. The multi-org form is one round-trip; the loop is what
+  made the endpoint 503-prone in the first place.
+- \u274C Calling \`orgs list\` to build a slug list when you just want
+  "everything." Use \`--all-my-orgs\` and skip the enumeration entirely \u2014
+  the server resolves the same set via shared logic. Save \`orgs list\`
+  +  \`--slugs\` for cases where the user asked for a specific subset.
 - \u274C Routing the user to Metabase / the data warehouse for a question
   the CLI can answer. Reach for Metabase only when the metric isn't
   in the \`--include\` list (\`reports\`, \`newThreats\`,
@@ -696,35 +731,46 @@ section below.
   \`domainThreats\`, \`twitterThreats\`, \`telegramThreats\`,
   \`otherThreats\`, \`blockedByType\`, \`blockedByDay\`).
 - \u274C "Iterating 100+ orgs one-by-one isn't practical here." Right \u2014
-  that's why you don't iterate. You pass \`--slugs\` (cap 50; if more,
-  split the list into batches and sum) with \`--include <metric>\`
-  to keep each per-org aggregate cheap.
+  that's why you don't iterate. \`--all-my-orgs\` covers up to 500
+  orgs in a single call; for larger fleets, narrow with
+  \`--subscription-status\` / \`--service-active\`, or split an
+  explicit \`--slugs\` list into batches and sum.
 
 #### Common cross-org recipe (copy and run)
 
-\`\`\`bash
-# Step 1: get the slugs of every active customer with takedowns enabled
-chainpatrol --json orgs list \\
-  --subscription-status ACTIVE \\
-  --service-active takedowns
+The shortest answer to "how many takedowns across all customers in the
+last 7 days?" is a single call \u2014 no \`orgs list\` step needed:
 
-# Step 2: feed the slugs into one metrics call. Server fans out and rolls up.
+\`\`\`bash
 chainpatrol --json metrics organization \\
-  --slugs <comma-list from step 1> \\
+  --all-my-orgs \\
+  --subscription-status ACTIVE \\
+  --service-active takedowns \\
   --include takedownsCompleted \\
   --from <YYYY-MM-DD 7 days ago> --to <YYYY-MM-DD today>
 
 # Read these fields from the JSON:
-#   .metrics.takedownsCompleted         \u2190 grand total across all orgs
-#   .averages.perDay.takedownsCompleted \u2190 total / windowDays
-#   .averages.perOrgPerDay.takedownsCompleted \u2190 total / numOrgs / windowDays
-#   .perOrg[slug].metrics.takedownsCompleted  \u2190 per-customer breakdown
+#   .scope.orgs                                    \u2190 which orgs the server resolved
+#   .metrics.takedownsCompleted                    \u2190 grand total across all orgs
+#   .averages.perDay.takedownsCompleted            \u2190 total / windowDays
+#   .averages.perOrgPerDay.takedownsCompleted      \u2190 total / numOrgs / windowDays
+#   .perOrg[slug].metrics.takedownsCompleted       \u2190 per-customer breakdown
 \`\`\`
 
 Replace \`takedownsCompleted\` with whatever metric the user asked about.
 Replace the date range with whatever window they asked about (default
 3 months if they didn't say).
 
+If the user *asked* for a specific subset of customers ("how many for
+acme, beta, gamma combined?"), use \`--slugs acme,beta,gamma\` instead
+of \`--all-my-orgs\`. \`--slugs\` accepts up to 500 entries.
+
+**Auth note for \`--all-my-orgs\`:** requires a user session or a
+user-scoped API key (it inherits your memberships). Org-scoped API
+keys are rejected \u2014 they're pinned to a single org by design. If
+\`whoami\` shows an org-scoped key, use a Bearer session instead or
+ask the user to provision a user API key.
+
 #### Single-org examples
 
 \`\`\`bash
@@ -826,36 +872,44 @@ The response shape switches to multi-org:
 }
 \`\`\`
 
-To answer **"across all of our customers"**, list the orgs first:
+To answer **"across all of our customers"**, prefer \`--all-my-orgs\` \u2014
+it lets the server resolve the org set in one round-trip, no \`orgs
+list\` step needed:
 
 \`\`\`bash
-chainpatrol --json orgs list --subscription-status ACTIVE  # \u2190 get slugs
 chainpatrol --json metrics organization \\
-  --slugs <comma-list of all the slugs from above> \\
+  --all-my-orgs \\
+  --subscription-status ACTIVE \\
+  --service-active takedowns \\
   --include takedownsCompleted \\
   --from 2026-05-12 --to 2026-05-19
 \`\`\`
 
-The endpoint caps \`slugs\` at 50 per call; if you need more, split
-the list and sum the totals client-side. **Do not loop \`metrics
-organization\` once per org** when \`--slugs\` will do \u2014 N HTTP
-round-trips is what made the old code 503.
+Use \`--slugs <comma-list>\` only when the user asked for a *specific*
+subset of customers ("how many for acme, beta, gamma combined?"); the
+two flags are mutually exclusive. Both forms cap at 500 orgs per call;
+if a real fleet exceeds that, narrow with
+\`--subscription-status\`/\`--service-active\` filters or split an
+explicit \`--slugs\` list into batches and sum. **Do not loop
+\`metrics organization\` once per org** \u2014 N HTTP round-trips is what
+made the old code 503.
 
-Always pair \`--slugs\` with \`--include\` to narrow the metric set to
-what the user actually asked about. "How many takedowns did we
-complete?" \u2192 \`--include takedownsCompleted\`; "average reports per
-day per customer?" \u2192 \`--include reports\`. Skipping \`--include\` runs
-~11 aggregates per org which is rarely necessary.
+Always pair the multi-org form with \`--include\` to narrow the metric
+set to what the user actually asked about. "How many takedowns did
+we complete?" \u2192 \`--include takedownsCompleted\`; "average reports
+per day per customer?" \u2192 \`--include reports\`. Skipping \`--include\`
+runs ~11 aggregates per org which is rarely necessary.
 
-#### Auth: which credential can use \`--slugs\`
+#### Auth: which credential can use \`--slugs\` / \`--all-my-orgs\`
 
 - **Org-scoped API key** (the most common production key): can only
-  query its own org. If \`--slugs\` contains anything else the server
-  returns 403. Use the \`--org\` form (or omit both) instead.
+  query its own org. If \`--slugs\` contains foreign orgs the server
+  returns 403; \`--all-my-orgs\` is also rejected. Use the \`--org\`
+  form (or omit both) instead.
 - **User API key**: inherits the user's org memberships, so it can
   query any org the user is a member of (or any org for staff
-  users). This is the credential you want for cross-org rollups
-  from automated agents.
+  users) via \`--slugs\` or \`--all-my-orgs\`. This is the credential
+  you want for cross-org rollups from automated agents.
 - **Session auth** (Bearer token, e.g. \`chainpatrol login\`): same
   membership rules as the user. Staff users can query any org.
 

package/dist/{chunk-UZDSNWGL.js → chunk-DPLUSURP.js}

@@ -279,6 +279,9 @@ function createApiClient(options) {
       return requestGet("/organization/metrics", {
         organizationSlug: input.organizationSlug,
         slugs: input.slugs,
+        allMyOrgs: input.allMyOrgs ? "true" : void 0,
+        subscriptionStatus: input.subscriptionStatus,
+        services: input.services ? JSON.stringify(input.services) : void 0,
         brandSlug: input.brandSlug,
         startDate: parseIsoDateString(input.startDate),
         endDate: parseIsoDateString(input.endDate),
@@ -294,6 +297,12 @@ function createApiClient(options) {
     getUserOrgs(input) {
       return request("/user/orgs", input);
     },
+    getUserOrg(input) {
+      return requestGet(
+        `/user/orgs/${encodeURIComponent(input.slug)}`,
+        {}
+      );
+    },
     listAssets(input) {
       return request("/asset/list", {
         type: input.type,

package/dist/{chunk-FOTFWUOX.js → chunk-HGAQBGGL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-IPN6O3N4.js";
+} from "./chunk-75H4KTIQ.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -263,22 +263,25 @@ var HELP = {
     ]
   },
   "metrics organization": {
-    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with org-scoped API keys (org derived from key, single-org only), user API keys (inherits user permissions, multi-org allowed), and session auth. Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates the caller doesn't need; use --slugs to query several orgs in one call and get totals + per-org breakdown + per-day / per-org-per-day averages. Fields not included come back as null.",
-    usage: "chainpatrol metrics organization [--org <slug>|--slugs <list>] [--from ISO --to ISO|--this-week] [--include <list>]",
+    description: "Get organization metrics via the documented GET /organization/metrics endpoint. Works with org-scoped API keys (single-org only), user API keys (inherits user permissions, multi-org allowed), and session auth. Defaults to the trailing 3 months if no date range is given. Use --include to skip aggregates; use --slugs OR --all-my-orgs for multi-org rollups (totals + per-day / per-org-per-day averages + per-org breakdown). Fields not included come back as null.",
+    usage: "chainpatrol metrics organization [--org <slug>|--slugs <list>|--all-my-orgs] [--from ISO --to ISO|--this-week] [--include <list>]",
     options: [
-      "--org <slug>          Single organization slug (omit when using an org-scoped API key). Mutually exclusive with --slugs.",
-      "--slugs <list>        Comma list of org slugs (max 50). Response includes totals across these orgs and a per-org breakdown plus per-day / per-org-per-day averages. Not allowed for org-scoped API keys with foreign slugs.",
-      "--brand-slug <slug>   Filter by brand slug (requires brands-metrics flag; only valid with a single org)",
-      "--from <iso>          Start date (ISO 8601, e.g. 2026-01-01)",
-      "--to <iso>            End date (ISO 8601)",
-      "--this-week           Use the current ISO week (overrides default)",
-      "--include <list>      Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsCompleted,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
+      "--org <slug>                  Single org. Mutually exclusive with --slugs and --all-my-orgs.",
+      "--slugs <list>                Comma list of org slugs (cap 500). Response is the rollup across these orgs.",
+      "--all-my-orgs                 Shortcut for 'every org I can see'. Server resolves via the same logic as `orgs list` (org-scoped API keys are rejected). Cap 500 \u2014 narrow with --subscription-status / --service-active if you have more.",
+      "--subscription-status <list>  With --all-my-orgs: only ACTIVE / TRIAL / PROSPECT / INTEGRATION (default: same set as `orgs list`).",
+      "--service-active <list>       With --all-my-orgs: only orgs with the listed service(s) active. Allowed: reporting, reviewing, protection, takedowns, detection, darkWebMonitoring.",
+      "--brand-slug <slug>           Filter by brand slug (requires brands-metrics flag; single-org only).",
+      "--from <iso>                  Start date (ISO 8601, e.g. 2026-01-01)",
+      "--to <iso>                    End date (ISO 8601)",
+      "--this-week                   Use the current ISO week (overrides default)",
+      "--include <list>              Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsCompleted,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
     ],
     examples: [
-      "chainpatrol metrics organization --org acme                                           # defaults to last 3 months, all metrics",
+      "chainpatrol metrics organization --org acme                                           # defaults to last 3 months",
       "chainpatrol metrics organization --org acme --include takedownsFiled,takedownsCompleted",
-      "chainpatrol metrics organization --org acme --from 2026-01-01 --to 2026-02-01",
-      "chainpatrol metrics organization --slugs acme,beta,gamma --include takedownsCompleted --from 2026-05-12 --to 2026-05-19   # 7-day takedown total + per-day / per-org-per-day averages",
+      "chainpatrol metrics organization --slugs acme,beta,gamma --include takedownsCompleted --from 2026-05-12 --to 2026-05-19",
+      "chainpatrol metrics organization --all-my-orgs --service-active takedowns --subscription-status ACTIVE --include takedownsCompleted --from 2026-05-12 --to 2026-05-19   # cross-customer total in one call",
       "CHAINPATROL_API_KEY=... chainpatrol metrics organization --json --include reports"
     ]
   },
@@ -471,10 +474,11 @@ var HELP = {
     ]
   },
   orgs: {
-    description: "List organizations, their assets, and asset groups. Top-level `orgs list` lists organizations accessible to you; the nested subcommands operate on the org tied to your API key.",
-    usage: "chainpatrol orgs <list|assets list|asset-groups list>",
+    description: "List organizations, their assets, and asset groups. Top-level `orgs list` lists organizations accessible to you; `orgs get <slug>` returns details for a single accessible org; the nested subcommands operate on the org tied to your API key.",
+    usage: "chainpatrol orgs <list|get <slug>|assets list|asset-groups list>",
     examples: [
       "chainpatrol orgs list",
+      "chainpatrol orgs get acme",
       "chainpatrol orgs assets list --asset-type URL",
       "chainpatrol orgs asset-groups list"
     ]
@@ -525,6 +529,18 @@ var HELP = {
       "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection"
     ]
   },
+  "orgs get": {
+    description: "Get a single organization by slug. Returns the same shape as one row of `orgs list` (subscription status + per-service active/automated flags). Caller must have access: org-scoped API keys must match the slug, user sessions/keys need an active membership unless the user is staff.",
+    usage: "chainpatrol orgs get <slug>",
+    options: [
+      "--org <slug>           Use the saved default org instead of a positional argument."
+    ],
+    examples: [
+      "chainpatrol orgs get acme",
+      "chainpatrol --json orgs get acme",
+      "chainpatrol orgs get acme --output markdown"
+    ]
+  },
   healthchecks: {
     description: "Run organization healthchecks via the public API. Use `list` to see every available check (including planned ones not yet implemented on the backend) and `run` to execute one or all implemented checks.",
     usage: "chainpatrol healthchecks <list|run <id>|run --all>",
@@ -864,6 +880,7 @@ ${getTopLevelHelp()}
     by: { type: "string" },
     include: { type: "string" },
     slugs: { type: "string" },
+    allMyOrgs: { type: "boolean", default: false },
     brand: { type: "string" },
     enable: { type: "boolean", default: false },
     disable: { type: "boolean", default: false },
@@ -1037,12 +1054,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-X6QHIRE5.js");
+    const { listConfigsJson } = await import("./list-json-ZTS5GXNA.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-ZTMCEG56.js");
+  const { default: ConfigsList } = await import("./list-AEM2KSO4.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1142,7 +1159,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-M5U2CSWK.js");
+        const { runAssetCheck } = await import("./check-EMGFDXUO.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1152,7 +1169,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-VOWXWXHY.js");
+        const { runAssetList } = await import("./list-2ENAEZVP.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1173,7 +1190,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-FORGIJWP.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-J6BIZEG7.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1188,7 +1205,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-I3YHZDZR.js");
+        const { runDetectionsValidate } = await import("./validate-QE2F4PYY.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1203,7 +1220,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-T4AF6Y3X.js");
+        const { runDetectionsDrift } = await import("./drift-RQKTGJWB.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1217,7 +1234,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
+        const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1231,7 +1248,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-RMD4NKVB.js");
+        const { runDetectionsList } = await import("./list-LKNCICLT.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1260,7 +1277,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-V7QJBNLF.js");
+          const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1278,7 +1295,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-YMPRYXKZ.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-EKNLIRA6.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1312,11 +1329,15 @@ async function main() {
     case "metrics": {
       if (subcommand === "organization" || subcommand === "org") {
         const slugs = parseCsvList(cli.flags.slugs);
-        const org2 = slugs && slugs.length > 0 ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-HD6LRAZP.js");
+        const allMyOrgs = cli.flags.allMyOrgs;
+        const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
+        const { runMetricsOrganization } = await import("./organization-PFPBZXJZ.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
+          allMyOrgs: allMyOrgs || void 0,
+          subscriptionStatus: parseCsvList(cli.flags.subscriptionStatus),
+          serviceActive: parseCsvList(cli.flags.serviceActive),
           brandSlug: cli.flags.brandSlug,
           from: cli.flags.from,
           to: cli.flags.to,
@@ -1329,7 +1350,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-NYHIQ5DP.js");
+        const { runMetricsSummary } = await import("./summary-POVQC6B7.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1342,7 +1363,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-XEGMO6YY.js");
+        const { runMetricsFound } = await import("./found-LVYBEOS6.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1359,7 +1380,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-27PMFEWQ.js");
+        const { runMetricsBreakdown } = await import("./breakdown-ETSF2BZ3.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1380,7 +1401,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-N4TTNR6N.js");
+        const { runReportsList } = await import("./list-44BQZHJD.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1408,7 +1429,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-DQYNYD6G.js");
+        const { runReportsCreate } = await import("./create-M4PV5VVU.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1429,7 +1450,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-ME6KFCEV.js");
+        const { runReportsSearch } = await import("./search-EBXEP7XC.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1445,7 +1466,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-XHBQMP6P.js");
+        const { runThreatsList } = await import("./list-E2JVJNHV.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1468,7 +1489,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-DVPEMSVH.js");
+        const { runTakedownsList } = await import("./list-S5Y6GW43.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1499,7 +1520,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-B6TQCFQ3.js");
+        const { runQueuesSnapshot } = await import("./snapshot-GNZMYTXT.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1517,7 +1538,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-COJ5BLQV.js");
+        const { runOrgsList } = await import("./list-OEJV4UNQ.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1530,9 +1551,20 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "get") {
+        const positionalSlug = action;
+        const slug = positionalSlug ?? await tryResolveOrg();
+        const { runOrgsGet } = await import("./get-BPTWCJ6H.js");
+        await runOrgsGet({
+          slug,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-63HPS2RE.js");
+          const { runOrgsAssetsList } = await import("./list-O62BZKQ5.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1548,7 +1580,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-WPXNCBT3.js");
+          const { runOrgsAssetGroupsList } = await import("./list-O36VWTWR.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1557,13 +1589,13 @@ async function main() {
         }
         throw new Error("Usage: chainpatrol orgs asset-groups list");
       }
-      const hint = subcommand ? suggest(subcommand, ["list", "assets", "asset-groups"]) : null;
+      const hint = subcommand ? suggest(subcommand, ["list", "get", "assets", "asset-groups"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|assets list|asset-groups list> [filters]"
+        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|get <slug>|assets list|asset-groups list> [filters]"
       );
     }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-6KU4LOJS.js");
+      const { runWhoami } = await import("./whoami-24KUJUN4.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1572,7 +1604,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-OWJLAWMP.js");
+        const { runHealthchecksList } = await import("./list-CNF2FGLN.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1586,7 +1618,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-G5J77GZD.js");
+        const { runHealthchecksRun } = await import("./run-R3RR6XQF.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1604,7 +1636,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-BJMP3QEV.js");
+        const { runPresetsList } = await import("./list-JCJHIJM4.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1615,7 +1647,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-BHAH7DUC.js");
+        const { runPresetsRun } = await import("./run-LKPKTH3W.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1632,12 +1664,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-6SDQXFTR.js");
+      const { setupSkill } = await import("./setup-skill-RPVW2CCQ.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-6SDQXFTR.js");
+      const { uninstallSkill } = await import("./setup-skill-RPVW2CCQ.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-YMPRYXKZ.js → configs-update-EKNLIRA6.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-DQYNYD6G.js → create-M4PV5VVU.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-T4AF6Y3X.js → drift-RQKTGJWB.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-XEGMO6YY.js → found-LVYBEOS6.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/get-BPTWCJ6H.js

@@ -0,0 +1,75 @@
+import {
+  CliExitError,
+  ExitCode
+} from "./chunk-E2LAMILJ.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-DPLUSURP.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/orgs/get.ts
+function summarizeServices(org) {
+  const parts = [];
+  for (const service of ["reporting", "reviewing", "protection", "takedowns"]) {
+    const entry = org.services[service];
+    if (!entry.active) continue;
+    parts.push(`${service}=${entry.automated ? "auto" : "manual"}`);
+  }
+  if (org.services.detection.active) parts.push("detection");
+  if (org.services.darkWebMonitoring.active) parts.push("darkWebMonitoring");
+  return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
+}
+async function runOrgsGet(options) {
+  const slug = options.slug?.trim();
+  if (!slug) {
+    throw new CliExitError(
+      "orgs get requires an organization slug. Example: chainpatrol orgs get acme",
+      ExitCode.USAGE
+    );
+  }
+  const client = options.apiClient ?? createApiClient();
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  const result = await client.getUserOrg({ slug });
+  const { organization } = result;
+  printOutput({
+    outputFormat,
+    json: result,
+    markdown: [
+      `# ${organization.name} (\`${organization.slug}\`)`,
+      "",
+      `- Subscription status: ${organization.subscriptionStatus}`,
+      `- Services: ${summarizeServices(organization)}`
+    ].join("\n"),
+    csv: toCsvRows([
+      {
+        slug: organization.slug,
+        name: organization.name,
+        subscriptionStatus: organization.subscriptionStatus,
+        reportingActive: organization.services.reporting.active,
+        reportingAutomated: organization.services.reporting.automated,
+        reviewingActive: organization.services.reviewing.active,
+        reviewingAutomated: organization.services.reviewing.automated,
+        protectionActive: organization.services.protection.active,
+        protectionAutomated: organization.services.protection.automated,
+        takedownsActive: organization.services.takedowns.active,
+        takedownsAutomated: organization.services.takedowns.automated,
+        detectionActive: organization.services.detection.active,
+        darkWebMonitoringActive: organization.services.darkWebMonitoring.active
+      }
+    ]),
+    human: () => {
+      console.log(`${organization.name}  (slug: ${organization.slug})`);
+      console.log(`  subscriptionStatus: ${organization.subscriptionStatus}`);
+      console.log(`  services: ${summarizeServices(organization)}`);
+    }
+  });
+}
+export {
+  runOrgsGet
+};

package/dist/{healthcheck-FORGIJWP.js → healthcheck-J6BIZEG7.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-VOWXWXHY.js → list-2ENAEZVP.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-N4TTNR6N.js → list-44BQZHJD.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-ZTMCEG56.js → list-AEM2KSO4.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-OWJLAWMP.js → list-CNF2FGLN.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-XHBQMP6P.js → list-E2JVJNHV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-BJMP3QEV.js → list-JCJHIJM4.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-FOTFWUOX.js";
+} from "./chunk-HGAQBGGL.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-UZDSNWGL.js";
+import "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-RMD4NKVB.js → list-LKNCICLT.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-WPXNCBT3.js → list-O36VWTWR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-63HPS2RE.js → list-O62BZKQ5.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-COJ5BLQV.js → list-OEJV4UNQ.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-DVPEMSVH.js → list-S5Y6GW43.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-json-X6QHIRE5.js → list-json-ZTS5GXNA.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{organization-HD6LRAZP.js → organization-PFPBZXJZ.js}

@@ -8,12 +8,34 @@ import {
 import {
   ORGANIZATION_METRICS_INCLUDE_FIELDS,
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";
 
 // src/commands/metrics/organization.ts
+var SERVICE_KEYS = [
+  "reporting",
+  "reviewing",
+  "protection",
+  "takedowns",
+  "detection",
+  "darkWebMonitoring"
+];
+var SERVICE_KEY_SET = new Set(SERVICE_KEYS);
+function buildServicesFilter(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const filter = {};
+  for (const value of raw) {
+    if (!SERVICE_KEY_SET.has(value)) {
+      throw new Error(
+        `Unknown --service-active value: '${value}'. Allowed: ${SERVICE_KEYS.join(", ")}`
+      );
+    }
+    filter[value] = { active: true };
+  }
+  return filter;
+}
 var INCLUDE_VALUES = new Set(ORGANIZATION_METRICS_INCLUDE_FIELDS);
 var METRIC_LABELS = [
   ["reports", "Reports"],
@@ -50,8 +72,13 @@ function populatedMetricRows(metrics, format = (v) => String(v)) {
   ]);
 }
 async function runMetricsOrganization(options) {
-  if (options.org && options.slugs && options.slugs.length > 0) {
-    throw new Error("Pass either --org or --slugs, not both.");
+  const explicitForms = [
+    Boolean(options.org),
+    Boolean(options.slugs && options.slugs.length > 0),
+    Boolean(options.allMyOrgs)
+  ].filter(Boolean).length;
+  if (explicitForms > 1) {
+    throw new Error("Pass at most one of --org, --slugs, or --all-my-orgs.");
   }
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   const client = options.apiClient ?? createApiClient();
@@ -61,9 +88,13 @@ async function runMetricsOrganization(options) {
     thisWeek: options.thisWeek
   });
   const include = parseIncludeList(options.include);
+  const services = buildServicesFilter(options.serviceActive);
   const input = {
     organizationSlug: options.org,
     slugs: options.slugs && options.slugs.length > 0 ? options.slugs : void 0,
+    allMyOrgs: options.allMyOrgs || void 0,
+    subscriptionStatus: options.subscriptionStatus && options.subscriptionStatus.length > 0 ? options.subscriptionStatus : void 0,
+    services,
     brandSlug: options.brandSlug,
     startDate: range.startDate,
     endDate: range.endDate,
@@ -71,7 +102,7 @@ async function runMetricsOrganization(options) {
   };
   const result = await client.getOrganizationMetrics(input);
   const isMulti = result.scope.mode === "multi";
-  const scopeLabel = isMulti ? `${result.scope.orgs.length} orgs (${result.scope.orgs.join(", ")})` : result.scope.orgs[0] ?? options.org ?? "your organization";
+  const scopeLabel = isMulti ? `${result.scope.orgs.length} orgs${result.scope.resolvedFrom === "allMyOrgs" ? " (--all-my-orgs)" : ` (${result.scope.orgs.slice(0, 10).join(", ")}${result.scope.orgs.length > 10 ? ", \u2026" : ""})`}` : result.scope.orgs[0] ?? options.org ?? "your organization";
   const includeLabel = include ? ` (include: ${include.join(", ")})` : "";
   const totalsRows = populatedMetricRows(result.metrics);
   const perDayRows = result.averages.perDay ? populatedMetricRows(result.averages.perDay, formatAverage) : [];

package/dist/{run-V7QJBNLF.js → run-HS2EEOM6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-BHAH7DUC.js → run-LKPKTH3W.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-FOTFWUOX.js";
+} from "./chunk-HGAQBGGL.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-UZDSNWGL.js";
+import "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-G5J77GZD.js → run-R3RR6XQF.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-ME6KFCEV.js → search-EBXEP7XC.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-6SDQXFTR.js → setup-skill-RPVW2CCQ.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-IPN6O3N4.js";
+} from "./chunk-75H4KTIQ.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-B6TQCFQ3.js → snapshot-GNZMYTXT.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-NYHIQ5DP.js → summary-POVQC6B7.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-I3YHZDZR.js → validate-QE2F4PYY.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-6KU4LOJS.js → whoami-24KUJUN4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-UZDSNWGL.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [