@chainpatrol/cli 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @chainpatrol/cli
 
+## 0.18.0
+
+### Minor Changes
+
+- 0825606: Drop `automated` from the per-service shape of `orgs list` / `orgs get`
+  (and the matching `/user/orgs` and `/user/orgs/{slug}` public APIs) for
+  every service except `takedowns`. `automated` only ever had operational
+  meaning for takedowns — it controls whether ChainPatrol files the
+  takedown on its own. The `isAutomated*Active` columns on
+  reporting/reviewing/protection have no runtime effect, so exposing them
+  in the public API only invited misleading filters and CSV columns.
+
+  Concretely:
+
+  - API response: `services.reporting`, `services.reviewing`, and
+    `services.protection` now return `{ "active": boolean }` only.
+    `services.takedowns` still returns `{ "active": boolean, "automated":
+boolean }`. `detection` and `darkWebMonitoring` are unchanged.
+  - API services filter: same — `reporting`, `reviewing`, and
+    `protection` no longer accept an `automated` filter. Only
+    `takedowns` does.
+  - CLI: `--service-automated` / `--service-manual` now only accept
+    `takedowns`. Passing any other service name errors out with a
+    clearer message.
+  - CLI CSV output: drops the `reportingAutomated` / `reviewingAutomated`
+    / `protectionAutomated` columns. Only `takedownsAutomated` remains.
+  - Skill description and OpenAPI endpoint descriptions explain the
+    new shape.
+
+  Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation
+  supports the new shape; both are private packages and don't need
+  version bumps.
+
+## 0.17.0
+
+### Minor Changes
+
+- 27b18af: Adds `chainpatrol orgs get <slug>` for fetching a single accessible
+  organization, backed by a new public `GET /user/orgs/{slug}` endpoint.
+  Returns the same per-org shape as one row of `orgs list` (subscription
+  status + per-service active/automated flags) and reuses the same access
+  gating: org-scoped API keys must match the slug, user sessions / user-scoped
+  API keys need an active membership unless the caller is staff. The bundled
+  Claude Code skill (`/chainpatrol`) is updated to document the new command.
+  Server-side procedure + validation live in the private `@chainpatrol/external-trpc`
+  and `@chainpatrol/validation` packages and ship together with this CLI
+  release, but are not listed in the frontmatter because they are private.
+
 ## 0.16.0
 
 ### Minor Changes

package/dist/{breakdown-PQXHY2VO.js → breakdown-ETSF2BZ3.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-5B4EPWOZ.js → check-EMGFDXUO.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-JEBZIBRI.js → chunk-DPLUSURP.js}

@@ -297,6 +297,12 @@ function createApiClient(options) {
     getUserOrgs(input) {
       return request("/user/orgs", input);
     },
+    getUserOrg(input) {
+      return requestGet(
+        `/user/orgs/${encodeURIComponent(input.slug)}`,
+        {}
+      );
+    },
     listAssets(input) {
       return request("/asset/list", {
         type: input.type,

package/dist/{chunk-CJPWEWGS.js → chunk-HGAQBGGL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/{chunk-TTLGCRRR.js → chunk-MDDC4F6Q.js}

@@ -195,6 +195,8 @@ description: |
   "customer reports", "reports reported by customer", "find detection gaps",
   "org healthcheck", "organization health check", "audit my org",
   "what's wrong with org", "review org setup", "list orgs", "list organizations",
+  "get org", "get organization", "show org details", "org by slug",
+  "fetch org details", "org info",
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
@@ -624,10 +626,10 @@ Use \`--all\` to snapshot every org you have access to instead of a single slug.
 
 Returns every organization the caller can see, with each org's
 subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`) and
-which services are active and automated. Use it to answer questions like
-"which customers have takedowns enabled but automation off?" or "which
-prospects don't have detection turned on yet?" \u2014 filters compose with AND
-and are applied server-side, so one call returns the final list.
+which services are active. Use it to answer questions like "which
+customers have takedowns enabled but automation off?" or "which prospects
+don't have detection turned on yet?" \u2014 filters compose with AND and are
+applied server-side, so one call returns the final list.
 
 \`\`\`bash
 chainpatrol --json orgs list \\
@@ -636,6 +638,40 @@ chainpatrol --json orgs list \\
   --service-manual takedowns
 \`\`\`
 
+#### Per-service response shape \u2014 \`automated\` is takedowns-only
+
+Every service exposes an \`active\` boolean. **Only \`takedowns\`
+additionally exposes \`automated\`** \u2014 that is the one service where the
+manual-vs-automated distinction changes real platform behavior (whether
+ChainPatrol files the takedown on its own, or queues it for a human to
+file). \`reporting\`, \`reviewing\`, and \`protection\` have backing
+\`isAutomated*Active\` columns in the database, but those flags have no
+operational effect today, so the API deliberately omits them from both
+the response and the \`services\` filter \u2014 surfacing them would invite
+misleading filters like "reporting.automated=true" that don't mean
+anything. \`detection\` and \`darkWebMonitoring\` have always been
+single-flag services.
+
+So per-org JSON looks like:
+
+\`\`\`json
+{
+  "services": {
+    "reporting":         { "active": true },
+    "reviewing":         { "active": true },
+    "protection":        { "active": false },
+    "takedowns":         { "active": true, "automated": false },
+    "detection":         { "active": true },
+    "darkWebMonitoring": { "active": false }
+  }
+}
+\`\`\`
+
+When a user asks about "automated reporting / reviewing / protection",
+explain that the flag exists in the DB but has no operational effect and
+isn't exposed by the public API \u2014 only \`takedowns.automated\` carries a
+real meaning.
+
 Filter flags (all optional, all comma-separated lists):
 
 - \`--query <text>\` partial name match (substring, case-insensitive)
@@ -644,11 +680,11 @@ Filter flags (all optional, all comma-separated lists):
   through this filter \u2014 \`orgs list\` only ever returns live customers.
 - \`--service-active <list>\` services that must be active
 - \`--service-inactive <list>\` services that must be inactive
-- \`--service-automated <list>\` services whose automation must be ON
-  (\`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\` \u2014 the four
-  with an automation toggle)
-- \`--service-manual <list>\` services whose automation must be OFF
-  (same four)
+- \`--service-automated <list>\` services whose automation must be ON.
+  **Only \`takedowns\` is accepted** \u2014 the other services don't have a
+  meaningful automation toggle. Passing any other service name errors out.
+- \`--service-manual <list>\` services whose automation must be OFF.
+  Same restriction \u2014 only \`takedowns\`.
 
 Service names: \`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\`,
 \`detection\`, \`darkWebMonitoring\`.
@@ -657,6 +693,37 @@ Customers see only orgs they're a member of. Staff/superuser sessions see
 every matching org. The response is the same in both cases; visibility is
 enforced server-side.
 
+### \`orgs get\` \u2014 Get a single organization by slug
+
+Look up one organization the caller has access to. Returns the same per-org
+shape as a single row from \`orgs list\` \u2014 \`active\` for every service,
+plus \`automated\` on \`takedowns\` only (see the note above on why other
+services don't expose an automation flag). Anything you could read from
+\`orgs list\` you can also read here without paging or filtering. Use it
+when the user names a specific customer ("show me acme's setup", "is
+takedowns automation on for morpho?") and you don't need the rest of the
+catalogue.
+
+\`\`\`bash
+chainpatrol orgs get <slug>
+chainpatrol --json orgs get <slug>
+\`\`\`
+
+Permission rules match \`orgs list\`:
+
+- Org-scoped API keys: must match the slug \u2014 querying another org returns
+  403.
+- User sessions / user-scoped API keys: need an active OrganizationMembership
+  on the slug. Staff/superusers can read any org.
+- Soft-deleted orgs are not returned (404). A 404 also fires for orgs the
+  caller would not be authorized to see \u2014 the endpoint deliberately does
+  not distinguish "doesn't exist" from "you can't see this" beyond the
+  generic 403/404 envelope.
+
+Prefer \`orgs get\` over \`orgs list\` + client-side filter whenever the
+caller already knows the slug; it's one round-trip and side-steps the
+list filters entirely.
+
 #### Use case: finding service configuration gaps across the customer base
 
 When the user asks something like "which customers are paying us but don't

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-TTLGCRRR.js";
+} from "./chunk-MDDC4F6Q.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -474,10 +474,11 @@ var HELP = {
     ]
   },
   orgs: {
-    description: "List organizations, their assets, and asset groups. Top-level `orgs list` lists organizations accessible to you; the nested subcommands operate on the org tied to your API key.",
-    usage: "chainpatrol orgs <list|assets list|asset-groups list>",
+    description: "List organizations, their assets, and asset groups. Top-level `orgs list` lists organizations accessible to you; `orgs get <slug>` returns details for a single accessible org; the nested subcommands operate on the org tied to your API key.",
+    usage: "chainpatrol orgs <list|get <slug>|assets list|asset-groups list>",
     examples: [
       "chainpatrol orgs list",
+      "chainpatrol orgs get acme",
       "chainpatrol orgs assets list --asset-type URL",
       "chainpatrol orgs asset-groups list"
     ]
@@ -512,15 +513,15 @@ var HELP = {
     examples: ["chainpatrol orgs asset-groups list --output csv"]
   },
   "orgs list": {
-    description: "List organizations with their subscription status and per-service active/automated flags. All filters compose with AND.",
+    description: "List organizations with their subscription status and per-service active flag (plus `automated` for takedowns only \u2014 that's the one service where manual-vs-automated changes real platform behavior). All filters compose with AND.",
     usage: "chainpatrol orgs list [filters]",
     options: [
       "--query <text>             Partial name match (substring, case-insensitive)",
       "--subscription-status <l>  Comma-separated list (PROSPECT,TRIAL,ACTIVE,INTEGRATION)",
       "--service-active <l>       Comma-separated services that must be active",
       "--service-inactive <l>     Comma-separated services that must be inactive",
-      "--service-automated <l>    Services whose automation must be ON (reporting,reviewing,protection,takedowns)",
-      "--service-manual <l>       Services whose automation must be OFF (reporting,reviewing,protection,takedowns)"
+      "--service-automated <l>    Services whose automation must be ON (only `takedowns` is accepted \u2014 the other services have no meaningful automation toggle)",
+      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)"
     ],
     examples: [
       "chainpatrol orgs list --subscription-status ACTIVE",
@@ -528,6 +529,18 @@ var HELP = {
       "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection"
     ]
   },
+  "orgs get": {
+    description: "Get a single organization by slug. Returns the same shape as one row of `orgs list` (subscription status + per-service active flag, with `automated` exposed only for takedowns \u2014 the one service where manual-vs-automated changes real platform behavior). Caller must have access: org-scoped API keys must match the slug, user sessions/keys need an active membership unless the user is staff.",
+    usage: "chainpatrol orgs get <slug>",
+    options: [
+      "--org <slug>           Use the saved default org instead of a positional argument."
+    ],
+    examples: [
+      "chainpatrol orgs get acme",
+      "chainpatrol --json orgs get acme",
+      "chainpatrol orgs get acme --output markdown"
+    ]
+  },
   healthchecks: {
     description: "Run organization healthchecks via the public API. Use `list` to see every available check (including planned ones not yet implemented on the backend) and `run` to execute one or all implemented checks.",
     usage: "chainpatrol healthchecks <list|run <id>|run --all>",
@@ -1041,12 +1054,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-DXPR3UEY.js");
+    const { listConfigsJson } = await import("./list-json-ZTS5GXNA.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-GPWZ52JD.js");
+  const { default: ConfigsList } = await import("./list-AEM2KSO4.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1146,7 +1159,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-5B4EPWOZ.js");
+        const { runAssetCheck } = await import("./check-EMGFDXUO.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1156,7 +1169,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-G2F2IFEU.js");
+        const { runAssetList } = await import("./list-2ENAEZVP.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1177,7 +1190,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-47MU5AZ7.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-J6BIZEG7.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1192,7 +1205,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-LXE3JPET.js");
+        const { runDetectionsValidate } = await import("./validate-QE2F4PYY.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1207,7 +1220,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-5EZK2JA5.js");
+        const { runDetectionsDrift } = await import("./drift-RQKTGJWB.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1221,7 +1234,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-HDEKIP4L.js");
+        const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1235,7 +1248,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-FGDMMAPM.js");
+        const { runDetectionsList } = await import("./list-LKNCICLT.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1264,7 +1277,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-HDEKIP4L.js");
+          const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1282,7 +1295,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-6BYB7M37.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-EKNLIRA6.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1318,7 +1331,7 @@ async function main() {
         const slugs = parseCsvList(cli.flags.slugs);
         const allMyOrgs = cli.flags.allMyOrgs;
         const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-NR6JCD5I.js");
+        const { runMetricsOrganization } = await import("./organization-PFPBZXJZ.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
@@ -1337,7 +1350,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-2IXOMOIA.js");
+        const { runMetricsSummary } = await import("./summary-POVQC6B7.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1350,7 +1363,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-XRJZ4SSY.js");
+        const { runMetricsFound } = await import("./found-LVYBEOS6.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1367,7 +1380,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-PQXHY2VO.js");
+        const { runMetricsBreakdown } = await import("./breakdown-ETSF2BZ3.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1388,7 +1401,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-2JCBA3Q2.js");
+        const { runReportsList } = await import("./list-44BQZHJD.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1416,7 +1429,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-Y6Z4L656.js");
+        const { runReportsCreate } = await import("./create-M4PV5VVU.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1437,7 +1450,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-PBVQ7473.js");
+        const { runReportsSearch } = await import("./search-EBXEP7XC.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1453,7 +1466,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-JD4U2SBV.js");
+        const { runThreatsList } = await import("./list-E2JVJNHV.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1476,7 +1489,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-ZIM2MR2Q.js");
+        const { runTakedownsList } = await import("./list-S5Y6GW43.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1507,7 +1520,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-U53T5Q2M.js");
+        const { runQueuesSnapshot } = await import("./snapshot-GNZMYTXT.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1525,7 +1538,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-KFFNLKZK.js");
+        const { runOrgsList } = await import("./list-XUYCZG7S.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1538,9 +1551,20 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "get") {
+        const positionalSlug = action;
+        const slug = positionalSlug ?? await tryResolveOrg();
+        const { runOrgsGet } = await import("./get-YFYSJFBC.js");
+        await runOrgsGet({
+          slug,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-QC7DUKFD.js");
+          const { runOrgsAssetsList } = await import("./list-O62BZKQ5.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1556,7 +1580,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-IA2LRT4X.js");
+          const { runOrgsAssetGroupsList } = await import("./list-O36VWTWR.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1565,13 +1589,13 @@ async function main() {
         }
         throw new Error("Usage: chainpatrol orgs asset-groups list");
       }
-      const hint = subcommand ? suggest(subcommand, ["list", "assets", "asset-groups"]) : null;
+      const hint = subcommand ? suggest(subcommand, ["list", "get", "assets", "asset-groups"]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|assets list|asset-groups list> [filters]"
+        subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|get <slug>|assets list|asset-groups list> [filters]"
       );
     }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-4XDWPKVV.js");
+      const { runWhoami } = await import("./whoami-24KUJUN4.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1580,7 +1604,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-AYXZG3I6.js");
+        const { runHealthchecksList } = await import("./list-CNF2FGLN.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1594,7 +1618,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-EJBBPBOR.js");
+        const { runHealthchecksRun } = await import("./run-R3RR6XQF.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1612,7 +1636,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-WBZIULUS.js");
+        const { runPresetsList } = await import("./list-JCJHIJM4.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1623,7 +1647,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-ANHA5JFB.js");
+        const { runPresetsRun } = await import("./run-LKPKTH3W.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1640,12 +1664,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-2RKWIVGS.js");
+      const { setupSkill } = await import("./setup-skill-Z6SBI6GC.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-2RKWIVGS.js");
+      const { uninstallSkill } = await import("./setup-skill-Z6SBI6GC.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-6BYB7M37.js → configs-update-EKNLIRA6.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-Y6Z4L656.js → create-M4PV5VVU.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-5EZK2JA5.js → drift-RQKTGJWB.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-XRJZ4SSY.js → found-LVYBEOS6.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/get-YFYSJFBC.js

@@ -0,0 +1,74 @@
+import {
+  CliExitError,
+  ExitCode
+} from "./chunk-E2LAMILJ.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-DPLUSURP.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/orgs/get.ts
+function summarizeServices(org) {
+  const parts = [];
+  if (org.services.takedowns.active) {
+    parts.push(`takedowns=${org.services.takedowns.automated ? "auto" : "manual"}`);
+  }
+  if (org.services.reporting.active) parts.push("reporting");
+  if (org.services.reviewing.active) parts.push("reviewing");
+  if (org.services.protection.active) parts.push("protection");
+  if (org.services.detection.active) parts.push("detection");
+  if (org.services.darkWebMonitoring.active) parts.push("darkWebMonitoring");
+  return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
+}
+async function runOrgsGet(options) {
+  const slug = options.slug?.trim();
+  if (!slug) {
+    throw new CliExitError(
+      "orgs get requires an organization slug. Example: chainpatrol orgs get acme",
+      ExitCode.USAGE
+    );
+  }
+  const client = options.apiClient ?? createApiClient();
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  const result = await client.getUserOrg({ slug });
+  const { organization } = result;
+  printOutput({
+    outputFormat,
+    json: result,
+    markdown: [
+      `# ${organization.name} (\`${organization.slug}\`)`,
+      "",
+      `- Subscription status: ${organization.subscriptionStatus}`,
+      `- Services: ${summarizeServices(organization)}`
+    ].join("\n"),
+    csv: toCsvRows([
+      {
+        slug: organization.slug,
+        name: organization.name,
+        subscriptionStatus: organization.subscriptionStatus,
+        reportingActive: organization.services.reporting.active,
+        reviewingActive: organization.services.reviewing.active,
+        protectionActive: organization.services.protection.active,
+        takedownsActive: organization.services.takedowns.active,
+        // `takedowns` is the only service with a meaningful automation flag.
+        takedownsAutomated: organization.services.takedowns.automated,
+        detectionActive: organization.services.detection.active,
+        darkWebMonitoringActive: organization.services.darkWebMonitoring.active
+      }
+    ]),
+    human: () => {
+      console.log(`${organization.name}  (slug: ${organization.slug})`);
+      console.log(`  subscriptionStatus: ${organization.subscriptionStatus}`);
+      console.log(`  services: ${summarizeServices(organization)}`);
+    }
+  });
+}
+export {
+  runOrgsGet
+};

package/dist/{healthcheck-47MU5AZ7.js → healthcheck-J6BIZEG7.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-G2F2IFEU.js → list-2ENAEZVP.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-2JCBA3Q2.js → list-44BQZHJD.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-GPWZ52JD.js → list-AEM2KSO4.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-AYXZG3I6.js → list-CNF2FGLN.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-JD4U2SBV.js → list-E2JVJNHV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-WBZIULUS.js → list-JCJHIJM4.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-CJPWEWGS.js";
+} from "./chunk-HGAQBGGL.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-JEBZIBRI.js";
+import "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-FGDMMAPM.js → list-LKNCICLT.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-IA2LRT4X.js → list-O36VWTWR.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-QC7DUKFD.js → list-O62BZKQ5.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-ZIM2MR2Q.js → list-S5Y6GW43.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-KFFNLKZK.js → list-XUYCZG7S.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";
@@ -20,8 +20,14 @@ var VALID_SUBSCRIPTION_STATUSES = /* @__PURE__ */ new Set([
   "ACTIVE",
   "INTEGRATION"
 ]);
-var DUAL_SERVICES = ["reporting", "reviewing", "protection", "takedowns"];
-var SINGLE_SERVICES = ["detection", "darkWebMonitoring"];
+var DUAL_SERVICES = ["takedowns"];
+var SINGLE_SERVICES = [
+  "reporting",
+  "reviewing",
+  "protection",
+  "detection",
+  "darkWebMonitoring"
+];
 var ALL_SERVICES = [...DUAL_SERVICES, ...SINGLE_SERVICES];
 function splitCsv(value) {
   if (!value) return [];
@@ -60,7 +66,7 @@ function parseServiceList(raw, flagName) {
 function requireDualService(service, flagName) {
   if (!DUAL_SERVICES.includes(service)) {
     throw new CliExitError(
-      `Service '${service}' does not have an automation toggle and can't be used with --${flagName}. Use --service-active / --service-inactive instead.`,
+      `Service '${service}' does not have a meaningful automation toggle and can't be used with --${flagName}. Only 'takedowns' supports --service-automated / --service-manual; use --service-active / --service-inactive for the others.`,
       ExitCode.USAGE
     );
   }
@@ -114,10 +120,8 @@ function buildServicesFilter(options) {
 }
 function summarizeServices(org) {
   const parts = [];
-  for (const service of DUAL_SERVICES) {
-    const entry = org.services[service];
-    if (!entry.active) continue;
-    parts.push(`${service}=${entry.automated ? "auto" : "manual"}`);
+  if (org.services.takedowns.active) {
+    parts.push(`takedowns=${org.services.takedowns.automated ? "auto" : "manual"}`);
   }
   for (const service of SINGLE_SERVICES) {
     if (org.services[service].active) parts.push(service);
@@ -150,12 +154,10 @@ async function runOrgsList(options) {
         name: org.name,
         subscriptionStatus: org.subscriptionStatus,
         reportingActive: org.services.reporting.active,
-        reportingAutomated: org.services.reporting.automated,
         reviewingActive: org.services.reviewing.active,
-        reviewingAutomated: org.services.reviewing.automated,
         protectionActive: org.services.protection.active,
-        protectionAutomated: org.services.protection.automated,
         takedownsActive: org.services.takedowns.active,
+        // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: org.services.takedowns.automated,
         detectionActive: org.services.detection.active,
         darkWebMonitoringActive: org.services.darkWebMonitoring.active

package/dist/{list-json-DXPR3UEY.js → list-json-ZTS5GXNA.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{organization-NR6JCD5I.js → organization-PFPBZXJZ.js}

@@ -8,7 +8,7 @@ import {
 import {
   ORGANIZATION_METRICS_INCLUDE_FIELDS,
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-HDEKIP4L.js → run-HS2EEOM6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-ANHA5JFB.js → run-LKPKTH3W.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-CJPWEWGS.js";
+} from "./chunk-HGAQBGGL.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-JEBZIBRI.js";
+import "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-EJBBPBOR.js → run-R3RR6XQF.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-PBVQ7473.js → search-EBXEP7XC.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-2RKWIVGS.js → setup-skill-Z6SBI6GC.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-TTLGCRRR.js";
+} from "./chunk-MDDC4F6Q.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-U53T5Q2M.js → snapshot-GNZMYTXT.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-2IXOMOIA.js → summary-POVQC6B7.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-LXE3JPET.js → validate-QE2F4PYY.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-4XDWPKVV.js → whoami-24KUJUN4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-JEBZIBRI.js";
+} from "./chunk-DPLUSURP.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [