@chainpatrol/cli 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # @chainpatrol/cli
 
+## 0.19.0
+
+### Minor Changes
+
+- 477a431: Add proper brand support across metrics and listings so agents can run a
+  real "trend search" on an org.
+
+  ## New: list brands for an org
+
+  `GET /organization/brands` (CLI: `chainpatrol brands list`) returns every
+  brand belonging to the caller's org — both parent / product brands
+  (`type: ORGANIZATION`) and individual / employee brands (`type:
+INDIVIDUAL`) — in one call. Soft-deleted brands are excluded. Use
+  `--type INDIVIDUAL` to filter to employee brands only. The endpoint is
+  org-scoped via auth, no extra args.
+
+  ## Fixed: brand filter actually applies on metrics
+
+  Two server-side bugs the trend-search docs ran into:
+
+  1. `GET /organization/metrics` with `brandSlug` was filtering the scalar
+     metrics (`reports`, `newThreats`, `takedownsFiled`, ...) but **not**
+     `blockedByType` / `blockedByDay`, which silently returned org-wide
+     totals. A caller drilling into a single brand would see "this brand
+     is being attacked on YouTube" when YouTube was really just an
+     org-wide trend.
+  2. `POST /metrics/breakdown` with `by: "brand"` was ignoring the
+     `brandIds` input filter — `getThreatsBlockedPerBrand()` always
+     returned every brand. The function now accepts `brandIds` and the
+     handler passes the input through.
+
+  Both are now wired through correctly. `metrics organization
+--brand-slug <slug> --include blockedByType,blockedByDay` returns
+  real brand-scoped time series, and `metrics breakdown --by brand
+--brand <id>` actually narrows to the requested brand(s).
+
+  ## Skill: full trend-search guide
+
+  Documents three trend signals the agent can answer from existing
+  commands, with concrete current-vs-baseline recipes:
+
+  1. Spike in a specific asset type (`metrics breakdown --by type`).
+  2. Spike in overall threat volume (`metrics breakdown --by day` +
+     `metrics organization`).
+  3. Spike on a specific sub-brand (`brands list` → join → `metrics
+breakdown --by brand` → `metrics organization --brand-slug`).
+     Employee vs. product distinction now comes straight from the brand
+     roster.
+
+  Server-side procedures + validation schemas live in the private
+  `@chainpatrol/external-trpc`, `@chainpatrol/validation`, and
+  `@chainpatrol/metrics` packages and ship together with this CLI
+  release, but are not listed in the frontmatter because they are
+  private.
+
+## 0.18.0
+
+### Minor Changes
+
+- 0825606: Drop `automated` from the per-service shape of `orgs list` / `orgs get`
+  (and the matching `/user/orgs` and `/user/orgs/{slug}` public APIs) for
+  every service except `takedowns`. `automated` only ever had operational
+  meaning for takedowns — it controls whether ChainPatrol files the
+  takedown on its own. The `isAutomated*Active` columns on
+  reporting/reviewing/protection have no runtime effect, so exposing them
+  in the public API only invited misleading filters and CSV columns.
+
+  Concretely:
+
+  - API response: `services.reporting`, `services.reviewing`, and
+    `services.protection` now return `{ "active": boolean }` only.
+    `services.takedowns` still returns `{ "active": boolean, "automated":
+boolean }`. `detection` and `darkWebMonitoring` are unchanged.
+  - API services filter: same — `reporting`, `reviewing`, and
+    `protection` no longer accept an `automated` filter. Only
+    `takedowns` does.
+  - CLI: `--service-automated` / `--service-manual` now only accept
+    `takedowns`. Passing any other service name errors out with a
+    clearer message.
+  - CLI CSV output: drops the `reportingAutomated` / `reviewingAutomated`
+    / `protectionAutomated` columns. Only `takedownsAutomated` remains.
+  - Skill description and OpenAPI endpoint descriptions explain the
+    new shape.
+
+  Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation
+  supports the new shape; both are private packages and don't need
+  version bumps.
+
 ## 0.17.0
 
 ### Minor Changes

package/dist/{breakdown-ETSF2BZ3.js → breakdown-3LJBT3JQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-EMGFDXUO.js → check-G64UQCEL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-HGAQBGGL.js → chunk-2JZAPTY6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/{chunk-DPLUSURP.js → chunk-O7TMOF4W.js}

@@ -392,6 +392,9 @@ function createApiClient(options) {
         {}
       );
     },
+    listOrganizationBrands() {
+      return requestGet("/organization/brands", {});
+    },
     getCurrentUser() {
       return request("/user/me", {});
     },

package/dist/{chunk-75H4KTIQ.js → chunk-UDGJEN4M.js}

@@ -206,7 +206,15 @@ description: |
   "across all brands", "company-wide", "total takedowns", "total threats",
   "total reports", "average takedowns", "average threats", "average per day",
   "average per customer", "average per org", "rollup across customers",
-  "sum across orgs", "sum across customers".
+  "sum across orgs", "sum across customers",
+  "trends in org", "search for trends", "trend search", "look for trends",
+  "any trends", "trending threats", "spike in asset type",
+  "spike in threat volume", "coordinated attack", "spike check",
+  "anything unusual", "anything new for", "what's new for",
+  "employee being targeted", "spike on a sub-brand", "spike on a brand",
+  "sub-brand spike",
+  "list brands", "brands for org", "list sub-brands", "employee brands",
+  "individual brands", "brand list", "all brands in org".
 allowed-tools:
   - Bash
   - Read
@@ -626,10 +634,10 @@ Use \`--all\` to snapshot every org you have access to instead of a single slug.
 
 Returns every organization the caller can see, with each org's
 subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`) and
-which services are active and automated. Use it to answer questions like
-"which customers have takedowns enabled but automation off?" or "which
-prospects don't have detection turned on yet?" \u2014 filters compose with AND
-and are applied server-side, so one call returns the final list.
+which services are active. Use it to answer questions like "which
+customers have takedowns enabled but automation off?" or "which prospects
+don't have detection turned on yet?" \u2014 filters compose with AND and are
+applied server-side, so one call returns the final list.
 
 \`\`\`bash
 chainpatrol --json orgs list \\
@@ -638,6 +646,40 @@ chainpatrol --json orgs list \\
   --service-manual takedowns
 \`\`\`
 
+#### Per-service response shape \u2014 \`automated\` is takedowns-only
+
+Every service exposes an \`active\` boolean. **Only \`takedowns\`
+additionally exposes \`automated\`** \u2014 that is the one service where the
+manual-vs-automated distinction changes real platform behavior (whether
+ChainPatrol files the takedown on its own, or queues it for a human to
+file). \`reporting\`, \`reviewing\`, and \`protection\` have backing
+\`isAutomated*Active\` columns in the database, but those flags have no
+operational effect today, so the API deliberately omits them from both
+the response and the \`services\` filter \u2014 surfacing them would invite
+misleading filters like "reporting.automated=true" that don't mean
+anything. \`detection\` and \`darkWebMonitoring\` have always been
+single-flag services.
+
+So per-org JSON looks like:
+
+\`\`\`json
+{
+  "services": {
+    "reporting":         { "active": true },
+    "reviewing":         { "active": true },
+    "protection":        { "active": false },
+    "takedowns":         { "active": true, "automated": false },
+    "detection":         { "active": true },
+    "darkWebMonitoring": { "active": false }
+  }
+}
+\`\`\`
+
+When a user asks about "automated reporting / reviewing / protection",
+explain that the flag exists in the DB but has no operational effect and
+isn't exposed by the public API \u2014 only \`takedowns.automated\` carries a
+real meaning.
+
 Filter flags (all optional, all comma-separated lists):
 
 - \`--query <text>\` partial name match (substring, case-insensitive)
@@ -646,11 +688,11 @@ Filter flags (all optional, all comma-separated lists):
   through this filter \u2014 \`orgs list\` only ever returns live customers.
 - \`--service-active <list>\` services that must be active
 - \`--service-inactive <list>\` services that must be inactive
-- \`--service-automated <list>\` services whose automation must be ON
-  (\`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\` \u2014 the four
-  with an automation toggle)
-- \`--service-manual <list>\` services whose automation must be OFF
-  (same four)
+- \`--service-automated <list>\` services whose automation must be ON.
+  **Only \`takedowns\` is accepted** \u2014 the other services don't have a
+  meaningful automation toggle. Passing any other service name errors out.
+- \`--service-manual <list>\` services whose automation must be OFF.
+  Same restriction \u2014 only \`takedowns\`.
 
 Service names: \`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\`,
 \`detection\`, \`darkWebMonitoring\`.
@@ -662,11 +704,13 @@ enforced server-side.
 ### \`orgs get\` \u2014 Get a single organization by slug
 
 Look up one organization the caller has access to. Returns the same per-org
-shape as a single row from \`orgs list\` (subscription status + per-service
-active/automated flags), so anything you could read from \`orgs list\` you
-can also read here without paging or filtering. Use it when the user names
-a specific customer ("show me acme's setup", "is takedowns automation on
-for morpho?") and you don't need the rest of the catalogue.
+shape as a single row from \`orgs list\` \u2014 \`active\` for every service,
+plus \`automated\` on \`takedowns\` only (see the note above on why other
+services don't expose an automation flag). Anything you could read from
+\`orgs list\` you can also read here without paging or filtering. Use it
+when the user names a specific customer ("show me acme's setup", "is
+takedowns automation on for morpho?") and you don't need the rest of the
+catalogue.
 
 \`\`\`bash
 chainpatrol orgs get <slug>
@@ -696,6 +740,36 @@ takedowns?", reach for \`orgs list\` \u2014 it's the only command that exposes
 service flags across multiple orgs in one call. Run it in \`--json\` mode
 and summarize patterns by service or by subscription tier.
 
+### \`brands list\` \u2014 List the brands (sub-brands) belonging to an org
+
+Returns every brand for the org the caller is authenticated as, both
+parent / product brands (\`type: "ORGANIZATION"\`) and individual /
+employee brands (\`type: "INDIVIDUAL"\`). Soft-deleted brands are excluded.
+The endpoint is org-scoped and inferred from auth \u2014 there's no \`--org\`
+flag \u2014 so org-scoped API keys, user API keys, and user sessions all work
+without extra arguments.
+
+\`\`\`bash
+chainpatrol brands list                          # all brands
+chainpatrol brands list --type INDIVIDUAL        # employee / person brands only
+chainpatrol brands list --type ORGANIZATION      # product / parent brands only
+chainpatrol --json brands list                   # machine-readable
+\`\`\`
+
+Each entry has \`{ id, slug, name, type, description, brandGroupId, createdAt }\`.
+Use this when you need to:
+
+- Distinguish employee vs. product brands ahead of time \u2014 e.g. while
+  running a trend search and you want to highlight which spiking
+  sub-brands are employees so the user gets a direct heads-up to the
+  person involved.
+- Resolve a brand name the user mentions to its \`slug\` for use with
+  \`metrics organization --brand-slug <slug>\` or as a \`brandId\` for
+  \`takedowns list --brand <id>\`.
+- Audit a customer's setup \u2014 "how many employee brands does this org
+  protect?" or "are there brands the org set up but never wired into a
+  detection config?"
+
 ### \`metrics summary | found | breakdown | organization\` \u2014 Org metrics for spike/drop analysis
 
 #### Decision rule \u2014 read this before picking a metrics subcommand
@@ -1380,6 +1454,190 @@ Until a dedicated probe command exists:
 In both cases, if liveness looks miscalibrated for a class of assets,
 notify ChainPatrol engineering \u2014 the checker likely needs a tuning pass for
 that platform.
+
+## Organization Trend Search Guide
+
+Trend search asks "what's changed recently for this org?" \u2014 the answer can
+surface coordinated attacks, new attack channels, or campaigns targeting
+specific people, **before** they show up as a healthcheck failure. Unlike
+the HealthCheck Guide above (which grades single signals against
+thresholds), trend search compares a recent window to a baseline window
+and flags ratios, not absolute counts. A trend is interesting even when
+the pipeline is keeping up with it \u2014 the user usually wants to know.
+
+When the user asks something like:
+
+- "are there any trends in org X?"
+- "search for trends in <org>"
+- "anything unusual happening with <org> lately?"
+- "any spikes for <org>?"
+- "what's new for <org> this week?"
+- "is anyone targeting <org>'s employees more than usual?"
+- "are we seeing more YouTube/Telegram/etc. threats for <org>?"
+
+\u2026run the three trend checks below in parallel (single message, multiple
+Bash calls) and surface anything where the current rate is \u2265 2\xD7 the
+baseline AND clears a small absolute floor.
+
+### How to compute "current vs. baseline" rates
+
+Pick two non-overlapping windows: a **current** window the user cares about
+(default last 7 days) and a **baseline** window ending where the current
+one starts (default the prior ~90 days, i.e. \`current_start - 90d\` \u2192
+\`current_start - 1d\`). For any breakdown bucket, compute:
+
+\`\`\`
+current_per_day  = current_count  / current_window_days
+baseline_per_day = baseline_count / baseline_window_days
+ratio            = current_per_day / max(baseline_per_day, epsilon)
+\`\`\`
+
+Flag a bucket if \`ratio >= 2\` AND \`current_count >= 5\`. The floor
+suppresses noise on orgs with near-zero baseline activity (a single new
+YouTube report jumping the rate from 0 to 1/day shouldn't trigger). If
+the user gives a different window ("last 3 days", "this month"), adjust
+both windows proportionally and keep the same ratio threshold.
+
+### Trend 1 \u2014 Spike in a specific asset type
+
+A sudden jump in threats on a platform the org doesn't usually see
+traffic on ("normally you don't get targeted on YouTube much, but now
+there's a spike there") is worth flagging \u2014 it usually means an attacker
+has discovered a new channel that works for them. Even when the absolute
+number is small, the *ratio* against the org's normal mix is what
+matters.
+
+Use \`metrics breakdown --by type\` over both windows:
+
+\`\`\`bash
+# Current window \u2014 last 7 days, broken out by asset type
+chainpatrol --json metrics breakdown --org <slug> --by type \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+
+# Baseline window \u2014 prior ~90 days ending where the current window starts
+chainpatrol --json metrics breakdown --org <slug> --by type \\
+  --from <YYYY-MM-DD 97d ago> --to <YYYY-MM-DD 8d ago>
+\`\`\`
+
+Each entry in \`.points\` has \`{ type, count }\`. Join the two windows on
+\`type\`, apply the ratio rule above, and report each flagged type.
+
+Cross-reference any flagged type with \`configs list --org <slug>\` \u2014 if
+the spike is on Twitter / X but \`twitter_post_search\` is disabled, the
+detection source for that channel isn't even running for this org and
+the spike is being caught by something else (likely customer reports);
+suggest turning it on.
+
+### Trend 2 \u2014 Spike in overall threat volume
+
+A sharp rise in total threats across the org \u2014 regardless of type or
+brand \u2014 usually means a coordinated attack or campaign is underway. This
+isn't a healthcheck (reviewing and takedowns may be keeping up just
+fine), but the security team still wants to know so they can warn
+customers / employees / partners.
+
+\`\`\`bash
+# Daily volume for the last ~6 weeks \u2014 enough to eyeball a baseline AND
+# see the spike on the right edge of the series.
+chainpatrol --json metrics breakdown --org <slug> --by day \\
+  --from <YYYY-MM-DD 42d ago> --to <YYYY-MM-DD today>
+\`\`\`
+
+Read \`.points\` (one entry per day). Take the trailing 7-day average and
+compare against the prior ~5 weeks (the same 2\xD7 / floor rule). For round
+totals to quote to the user, also pull:
+
+\`\`\`bash
+# Two calls \u2014 current and baseline windows \u2014 using --include to skip
+# the per-type / per-day series and keep the call cheap.
+chainpatrol --json metrics organization --org <slug> \\
+  --include reports,newThreats,threatsWatchlisted \\
+  --from <current_from> --to <current_to>
+
+chainpatrol --json metrics organization --org <slug> \\
+  --include reports,newThreats,threatsWatchlisted \\
+  --from <baseline_from> --to <baseline_to>
+\`\`\`
+
+When volume spikes broadly, also skim \`reports list --reported-by-customer\`
+for the same window \u2014 a wave of customer reports often arrives a few hours
+ahead of automated detection on a real coordinated push.
+
+### Trend 3 \u2014 Spike on a specific sub-brand (especially employee brands)
+
+Sub-brands the org has set up for individual people \u2014 employees,
+executives, public figures \u2014 are high-signal targets. A sudden spike on
+one usually means an attacker is impersonating that person specifically,
+which is materially different from a generic phishing wave and usually
+warrants a direct heads-up to the person involved. In the database these
+are \`Brand\` rows with \`type: INDIVIDUAL\` (vs. \`ORGANIZATION\` for
+product / parent brands).
+
+**Step 1: Pull the brand roster** so you can label each spike as
+"employee" or "product" without asking the user.
+
+\`\`\`bash
+chainpatrol --json brands list
+\`\`\`
+
+Build a map of \`slug \u2192 type\` from the response so the next step's
+findings can be tagged \`(employee)\` or \`(product)\` automatically.
+
+**Step 2: Run the breakdown over both windows.**
+
+\`\`\`bash
+# Current window \u2014 last 7 days, broken out by sub-brand
+chainpatrol --json metrics breakdown --org <slug> --by brand \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+
+# Baseline window \u2014 prior ~90 days
+chainpatrol --json metrics breakdown --org <slug> --by brand \\
+  --from <YYYY-MM-DD 97d ago> --to <YYYY-MM-DD 8d ago>
+\`\`\`
+
+Each entry in \`.points\` has \`{ brandId, brandSlug, brandName, count }\`.
+Apply the ratio rule, join against the \`slug \u2192 type\` map from Step 1,
+and report each spiking sub-brand by name plus its type.
+
+**Step 3: Drill into the flagged brand** with \`metrics organization
+--brand-slug <slug>\` for a per-day / per-type breakdown scoped to that
+brand only. The server applies the brand filter to the scalar metrics
+(\`newThreats\`, \`takedownsFiled\`, etc.) AND to \`blockedByType\` /
+\`blockedByDay\`, so the time series and per-asset-type counts are real
+brand-only data:
+
+\`\`\`bash
+chainpatrol --json metrics organization --org <slug> \\
+  --brand-slug <brand-slug> \\
+  --include newThreats,blockedByType,blockedByDay \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+\`\`\`
+
+If multiple \`INDIVIDUAL\` brands are spiking at the same time, treat that
+as a stronger signal than a single one \u2014 likely a campaign targeting the
+company's people rather than a single impersonation. Prioritize those
+findings over single-brand spikes when summarizing.
+
+### Reporting trend findings
+
+Report each spiking bucket as its own finding with: the trend it falls
+under (asset type / overall volume / sub-brand), the current vs. baseline
+rate (e.g. "youtube: 12/day last 7d vs. 1.2/day prior 90d, \xD710
+baseline"), and a one-line follow-up:
+
+- Asset-type spike \u2192 check \`configs list\` for the matching detection
+  source and turn it on if it's off.
+- Overall-volume spike \u2192 flag a possible coordinated campaign; suggest
+  the security team look at the recent \`reports list\` for shared
+  infrastructure (sender, registrar, hosting).
+- Sub-brand spike \u2192 look up \`type\` via \`brands list\`; if
+  \`INDIVIDUAL\`, suggest a direct heads-up to that person; if
+  \`ORGANIZATION\`, suggest a product-team alert.
+
+If none of the three trends fire above the 2\xD7 / floor thresholds, say so
+explicitly ("no significant trends in the last 7 days vs. the prior 90")
+rather than dumping every breakdown number \u2014 the absence is the
+finding.
 `;
 }
 function getBundledSkillVersion() {

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-75H4KTIQ.js";
+} from "./chunk-UDGJEN4M.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -513,15 +513,15 @@ var HELP = {
     examples: ["chainpatrol orgs asset-groups list --output csv"]
   },
   "orgs list": {
-    description: "List organizations with their subscription status and per-service active/automated flags. All filters compose with AND.",
+    description: "List organizations with their subscription status and per-service active flag (plus `automated` for takedowns only \u2014 that's the one service where manual-vs-automated changes real platform behavior). All filters compose with AND.",
     usage: "chainpatrol orgs list [filters]",
     options: [
       "--query <text>             Partial name match (substring, case-insensitive)",
       "--subscription-status <l>  Comma-separated list (PROSPECT,TRIAL,ACTIVE,INTEGRATION)",
       "--service-active <l>       Comma-separated services that must be active",
       "--service-inactive <l>     Comma-separated services that must be inactive",
-      "--service-automated <l>    Services whose automation must be ON (reporting,reviewing,protection,takedowns)",
-      "--service-manual <l>       Services whose automation must be OFF (reporting,reviewing,protection,takedowns)"
+      "--service-automated <l>    Services whose automation must be ON (only `takedowns` is accepted \u2014 the other services have no meaningful automation toggle)",
+      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)"
     ],
     examples: [
       "chainpatrol orgs list --subscription-status ACTIVE",
@@ -530,7 +530,7 @@ var HELP = {
     ]
   },
   "orgs get": {
-    description: "Get a single organization by slug. Returns the same shape as one row of `orgs list` (subscription status + per-service active/automated flags). Caller must have access: org-scoped API keys must match the slug, user sessions/keys need an active membership unless the user is staff.",
+    description: "Get a single organization by slug. Returns the same shape as one row of `orgs list` (subscription status + per-service active flag, with `automated` exposed only for takedowns \u2014 the one service where manual-vs-automated changes real platform behavior). Caller must have access: org-scoped API keys must match the slug, user sessions/keys need an active membership unless the user is staff.",
     usage: "chainpatrol orgs get <slug>",
     options: [
       "--org <slug>           Use the saved default org instead of a positional argument."
@@ -819,6 +819,7 @@ var COMMANDS = [
   "takedowns",
   "threats",
   "orgs",
+  "brands",
   "presets",
   "setup",
   "uninstall",
@@ -1054,12 +1055,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-ZTS5GXNA.js");
+    const { listConfigsJson } = await import("./list-json-B5L5PXKH.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-AEM2KSO4.js");
+  const { default: ConfigsList } = await import("./list-X4Z3CPO7.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1159,7 +1160,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-EMGFDXUO.js");
+        const { runAssetCheck } = await import("./check-G64UQCEL.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1169,7 +1170,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-2ENAEZVP.js");
+        const { runAssetList } = await import("./list-XSIXAHOG.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1190,7 +1191,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-J6BIZEG7.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-QNLFKAXM.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1205,7 +1206,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-QE2F4PYY.js");
+        const { runDetectionsValidate } = await import("./validate-UYKOMUEI.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1220,7 +1221,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-RQKTGJWB.js");
+        const { runDetectionsDrift } = await import("./drift-SHPMEJDU.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1234,7 +1235,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
+        const { runDetectionsRun } = await import("./run-RV6P2OCD.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1248,7 +1249,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-LKNCICLT.js");
+        const { runDetectionsList } = await import("./list-SWHKM5R6.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1277,7 +1278,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
+          const { runDetectionsRun } = await import("./run-RV6P2OCD.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1295,7 +1296,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-EKNLIRA6.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-MVX7Q5NW.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1331,7 +1332,7 @@ async function main() {
         const slugs = parseCsvList(cli.flags.slugs);
         const allMyOrgs = cli.flags.allMyOrgs;
         const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-PFPBZXJZ.js");
+        const { runMetricsOrganization } = await import("./organization-SOMHMGTM.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
@@ -1350,7 +1351,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-POVQC6B7.js");
+        const { runMetricsSummary } = await import("./summary-LF53KXRR.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1363,7 +1364,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-LVYBEOS6.js");
+        const { runMetricsFound } = await import("./found-OPL4HWOW.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1380,7 +1381,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-ETSF2BZ3.js");
+        const { runMetricsBreakdown } = await import("./breakdown-3LJBT3JQ.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1401,7 +1402,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-44BQZHJD.js");
+        const { runReportsList } = await import("./list-WPPNX7G3.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1429,7 +1430,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-M4PV5VVU.js");
+        const { runReportsCreate } = await import("./create-ANCO4FXB.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1450,7 +1451,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-EBXEP7XC.js");
+        const { runReportsSearch } = await import("./search-FQUR75WR.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1466,7 +1467,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-E2JVJNHV.js");
+        const { runThreatsList } = await import("./list-Q5PRMAN5.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1489,7 +1490,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-S5Y6GW43.js");
+        const { runTakedownsList } = await import("./list-FWXQUOCP.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1520,7 +1521,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-GNZMYTXT.js");
+        const { runQueuesSnapshot } = await import("./snapshot-2GDJMN3L.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1538,7 +1539,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-OEJV4UNQ.js");
+        const { runOrgsList } = await import("./list-QXA6GLCV.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1554,7 +1555,7 @@ async function main() {
       if (subcommand === "get") {
         const positionalSlug = action;
         const slug = positionalSlug ?? await tryResolveOrg();
-        const { runOrgsGet } = await import("./get-BPTWCJ6H.js");
+        const { runOrgsGet } = await import("./get-K7VHV5X2.js");
         await runOrgsGet({
           slug,
           json: jsonMode,
@@ -1564,7 +1565,7 @@ async function main() {
       }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-O62BZKQ5.js");
+          const { runOrgsAssetsList } = await import("./list-QHEFB4KE.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1580,7 +1581,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-O36VWTWR.js");
+          const { runOrgsAssetGroupsList } = await import("./list-FVFF4VW3.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1594,8 +1595,29 @@ async function main() {
         subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|get <slug>|assets list|asset-groups list> [filters]"
       );
     }
+    case "brands": {
+      if (subcommand === "list") {
+        const rawType = cli.flags.type?.toUpperCase();
+        if (rawType && rawType !== "ORGANIZATION" && rawType !== "INDIVIDUAL") {
+          throw new Error(
+            "brands list --type must be ORGANIZATION or INDIVIDUAL (case-insensitive)."
+          );
+        }
+        const { runBrandsList } = await import("./list-4VKMEKZS.js");
+        await runBrandsList({
+          type: rawType,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["list"]) : null;
+      throw new Error(
+        subcommand ? `Unknown subcommand: brands ${subcommand}${hint ? `. Did you mean "brands ${hint}"?` : ""}` : "Usage: chainpatrol brands list [--type ORGANIZATION|INDIVIDUAL]"
+      );
+    }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-24KUJUN4.js");
+      const { runWhoami } = await import("./whoami-OYOG63BX.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1604,7 +1626,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-CNF2FGLN.js");
+        const { runHealthchecksList } = await import("./list-AQ7E23T3.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1618,7 +1640,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-R3RR6XQF.js");
+        const { runHealthchecksRun } = await import("./run-J5TQ2YC2.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1636,7 +1658,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-JCJHIJM4.js");
+        const { runPresetsList } = await import("./list-FJBWSGTD.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1647,7 +1669,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-LKPKTH3W.js");
+        const { runPresetsRun } = await import("./run-YAAMSWKK.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1664,12 +1686,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-RPVW2CCQ.js");
+      const { setupSkill } = await import("./setup-skill-F7437RT3.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-RPVW2CCQ.js");
+      const { uninstallSkill } = await import("./setup-skill-F7437RT3.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-EKNLIRA6.js → configs-update-MVX7Q5NW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-M4PV5VVU.js → create-ANCO4FXB.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-RQKTGJWB.js → drift-SHPMEJDU.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-LVYBEOS6.js → found-OPL4HWOW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{get-BPTWCJ6H.js → get-K7VHV5X2.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";
@@ -16,11 +16,12 @@ import "./chunk-U73SABXK.js";
 // src/commands/orgs/get.ts
 function summarizeServices(org) {
   const parts = [];
-  for (const service of ["reporting", "reviewing", "protection", "takedowns"]) {
-    const entry = org.services[service];
-    if (!entry.active) continue;
-    parts.push(`${service}=${entry.automated ? "auto" : "manual"}`);
+  if (org.services.takedowns.active) {
+    parts.push(`takedowns=${org.services.takedowns.automated ? "auto" : "manual"}`);
   }
+  if (org.services.reporting.active) parts.push("reporting");
+  if (org.services.reviewing.active) parts.push("reviewing");
+  if (org.services.protection.active) parts.push("protection");
   if (org.services.detection.active) parts.push("detection");
   if (org.services.darkWebMonitoring.active) parts.push("darkWebMonitoring");
   return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
@@ -52,12 +53,10 @@ async function runOrgsGet(options) {
         name: organization.name,
         subscriptionStatus: organization.subscriptionStatus,
         reportingActive: organization.services.reporting.active,
-        reportingAutomated: organization.services.reporting.automated,
         reviewingActive: organization.services.reviewing.active,
-        reviewingAutomated: organization.services.reviewing.automated,
         protectionActive: organization.services.protection.active,
-        protectionAutomated: organization.services.protection.automated,
         takedownsActive: organization.services.takedowns.active,
+        // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: organization.services.takedowns.automated,
         detectionActive: organization.services.detection.active,
         darkWebMonitoringActive: organization.services.darkWebMonitoring.active

package/dist/{healthcheck-J6BIZEG7.js → healthcheck-QNLFKAXM.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/list-4VKMEKZS.js

@@ -0,0 +1,64 @@
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-O7TMOF4W.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/brands/list.ts
+function toRow(brand) {
+  return {
+    id: brand.id,
+    slug: brand.slug,
+    name: brand.name,
+    type: brand.type,
+    description: brand.description ?? "",
+    brandGroupId: brand.brandGroupId,
+    createdAt: brand.createdAt
+  };
+}
+async function runBrandsList(options) {
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.listOrganizationBrands();
+  const brands = options.type ? result.brands.filter((brand) => brand.type === options.type) : result.brands;
+  const rows = brands.map(toRow);
+  printOutput({
+    outputFormat,
+    json: options.type ? { ...result, brands } : result,
+    markdown: [
+      "# Organization brands",
+      "",
+      `- Returned: ${brands.length}${options.type ? ` (filtered to type=${options.type})` : ""}`,
+      "",
+      ...rows.map(
+        (row) => `- #${row.id} ${row.name} (slug=${row.slug}, type=${row.type}${row.brandGroupId !== null ? `, groupId=${row.brandGroupId}` : ""})`
+      )
+    ].join("\n"),
+    csv: toCsvRows(rows),
+    human: () => {
+      if (brands.length === 0) {
+        console.log(
+          options.type ? `No brands of type ${options.type} found.` : "No brands found."
+        );
+        return;
+      }
+      console.log(
+        `Organization brands \u2014 returned ${brands.length}${options.type ? ` (type=${options.type})` : ""}`
+      );
+      for (const row of rows) {
+        const group = row.brandGroupId !== null ? ` groupId=${row.brandGroupId}` : "";
+        console.log(
+          `#${row.id} ${row.name} (slug=${row.slug}, type=${row.type}${group})`
+        );
+      }
+    }
+  });
+}
+export {
+  runBrandsList
+};

package/dist/{list-CNF2FGLN.js → list-AQ7E23T3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-JCJHIJM4.js → list-FJBWSGTD.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-HGAQBGGL.js";
+} from "./chunk-2JZAPTY6.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-DPLUSURP.js";
+import "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-O36VWTWR.js → list-FVFF4VW3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-S5Y6GW43.js → list-FWXQUOCP.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-E2JVJNHV.js → list-Q5PRMAN5.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-O62BZKQ5.js → list-QHEFB4KE.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-OEJV4UNQ.js → list-QXA6GLCV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";
@@ -20,8 +20,14 @@ var VALID_SUBSCRIPTION_STATUSES = /* @__PURE__ */ new Set([
   "ACTIVE",
   "INTEGRATION"
 ]);
-var DUAL_SERVICES = ["reporting", "reviewing", "protection", "takedowns"];
-var SINGLE_SERVICES = ["detection", "darkWebMonitoring"];
+var DUAL_SERVICES = ["takedowns"];
+var SINGLE_SERVICES = [
+  "reporting",
+  "reviewing",
+  "protection",
+  "detection",
+  "darkWebMonitoring"
+];
 var ALL_SERVICES = [...DUAL_SERVICES, ...SINGLE_SERVICES];
 function splitCsv(value) {
   if (!value) return [];
@@ -60,7 +66,7 @@ function parseServiceList(raw, flagName) {
 function requireDualService(service, flagName) {
   if (!DUAL_SERVICES.includes(service)) {
     throw new CliExitError(
-      `Service '${service}' does not have an automation toggle and can't be used with --${flagName}. Use --service-active / --service-inactive instead.`,
+      `Service '${service}' does not have a meaningful automation toggle and can't be used with --${flagName}. Only 'takedowns' supports --service-automated / --service-manual; use --service-active / --service-inactive for the others.`,
       ExitCode.USAGE
     );
   }
@@ -114,10 +120,8 @@ function buildServicesFilter(options) {
 }
 function summarizeServices(org) {
   const parts = [];
-  for (const service of DUAL_SERVICES) {
-    const entry = org.services[service];
-    if (!entry.active) continue;
-    parts.push(`${service}=${entry.automated ? "auto" : "manual"}`);
+  if (org.services.takedowns.active) {
+    parts.push(`takedowns=${org.services.takedowns.automated ? "auto" : "manual"}`);
   }
   for (const service of SINGLE_SERVICES) {
     if (org.services[service].active) parts.push(service);
@@ -150,12 +154,10 @@ async function runOrgsList(options) {
         name: org.name,
         subscriptionStatus: org.subscriptionStatus,
         reportingActive: org.services.reporting.active,
-        reportingAutomated: org.services.reporting.automated,
         reviewingActive: org.services.reviewing.active,
-        reviewingAutomated: org.services.reviewing.automated,
         protectionActive: org.services.protection.active,
-        protectionAutomated: org.services.protection.automated,
         takedownsActive: org.services.takedowns.active,
+        // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: org.services.takedowns.automated,
         detectionActive: org.services.detection.active,
         darkWebMonitoringActive: org.services.darkWebMonitoring.active

package/dist/{list-LKNCICLT.js → list-SWHKM5R6.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-44BQZHJD.js → list-WPPNX7G3.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-AEM2KSO4.js → list-X4Z3CPO7.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-2ENAEZVP.js → list-XSIXAHOG.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-json-ZTS5GXNA.js → list-json-B5L5PXKH.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{organization-PFPBZXJZ.js → organization-SOMHMGTM.js}

@@ -8,7 +8,7 @@ import {
 import {
   ORGANIZATION_METRICS_INCLUDE_FIELDS,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-R3RR6XQF.js → run-J5TQ2YC2.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-HS2EEOM6.js → run-RV6P2OCD.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-LKPKTH3W.js → run-YAAMSWKK.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-HGAQBGGL.js";
+} from "./chunk-2JZAPTY6.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-DPLUSURP.js";
+import "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-EBXEP7XC.js → search-FQUR75WR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-RPVW2CCQ.js → setup-skill-F7437RT3.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-75H4KTIQ.js";
+} from "./chunk-UDGJEN4M.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-GNZMYTXT.js → snapshot-2GDJMN3L.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-POVQC6B7.js → summary-LF53KXRR.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-QE2F4PYY.js → validate-UYKOMUEI.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-24KUJUN4.js → whoami-OYOG63BX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [