@chainpatrol/cli 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @chainpatrol/cli
 
+## 0.19.0
+
+### Minor Changes
+
+- 477a431: Add proper brand support across metrics and listings so agents can run a
+  real "trend search" on an org.
+
+  ## New: list brands for an org
+
+  `GET /organization/brands` (CLI: `chainpatrol brands list`) returns every
+  brand belonging to the caller's org — both parent / product brands
+  (`type: ORGANIZATION`) and individual / employee brands (`type:
+INDIVIDUAL`) — in one call. Soft-deleted brands are excluded. Use
+  `--type INDIVIDUAL` to filter to employee brands only. The endpoint is
+  org-scoped via auth, no extra args.
+
+  ## Fixed: brand filter actually applies on metrics
+
+  Two server-side bugs the trend-search docs ran into:
+
+  1. `GET /organization/metrics` with `brandSlug` was filtering the scalar
+     metrics (`reports`, `newThreats`, `takedownsFiled`, ...) but **not**
+     `blockedByType` / `blockedByDay`, which silently returned org-wide
+     totals. A caller drilling into a single brand would see "this brand
+     is being attacked on YouTube" when YouTube was really just an
+     org-wide trend.
+  2. `POST /metrics/breakdown` with `by: "brand"` was ignoring the
+     `brandIds` input filter — `getThreatsBlockedPerBrand()` always
+     returned every brand. The function now accepts `brandIds` and the
+     handler passes the input through.
+
+  Both are now wired through correctly. `metrics organization
+--brand-slug <slug> --include blockedByType,blockedByDay` returns
+  real brand-scoped time series, and `metrics breakdown --by brand
+--brand <id>` actually narrows to the requested brand(s).
+
+  ## Skill: full trend-search guide
+
+  Documents three trend signals the agent can answer from existing
+  commands, with concrete current-vs-baseline recipes:
+
+  1. Spike in a specific asset type (`metrics breakdown --by type`).
+  2. Spike in overall threat volume (`metrics breakdown --by day` +
+     `metrics organization`).
+  3. Spike on a specific sub-brand (`brands list` → join → `metrics
+breakdown --by brand` → `metrics organization --brand-slug`).
+     Employee vs. product distinction now comes straight from the brand
+     roster.
+
+  Server-side procedures + validation schemas live in the private
+  `@chainpatrol/external-trpc`, `@chainpatrol/validation`, and
+  `@chainpatrol/metrics` packages and ship together with this CLI
+  release, but are not listed in the frontmatter because they are
+  private.
+
 ## 0.18.0
 
 ### Minor Changes

package/dist/{breakdown-ETSF2BZ3.js → breakdown-3LJBT3JQ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{check-EMGFDXUO.js → check-G64UQCEL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{chunk-HGAQBGGL.js → chunk-2JZAPTY6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";

package/dist/{chunk-DPLUSURP.js → chunk-O7TMOF4W.js}

@@ -392,6 +392,9 @@ function createApiClient(options) {
         {}
       );
     },
+    listOrganizationBrands() {
+      return requestGet("/organization/brands", {});
+    },
     getCurrentUser() {
       return request("/user/me", {});
     },

package/dist/{chunk-MDDC4F6Q.js → chunk-UDGJEN4M.js}

@@ -206,7 +206,15 @@ description: |
   "across all brands", "company-wide", "total takedowns", "total threats",
   "total reports", "average takedowns", "average threats", "average per day",
   "average per customer", "average per org", "rollup across customers",
-  "sum across orgs", "sum across customers".
+  "sum across orgs", "sum across customers",
+  "trends in org", "search for trends", "trend search", "look for trends",
+  "any trends", "trending threats", "spike in asset type",
+  "spike in threat volume", "coordinated attack", "spike check",
+  "anything unusual", "anything new for", "what's new for",
+  "employee being targeted", "spike on a sub-brand", "spike on a brand",
+  "sub-brand spike",
+  "list brands", "brands for org", "list sub-brands", "employee brands",
+  "individual brands", "brand list", "all brands in org".
 allowed-tools:
   - Bash
   - Read
@@ -732,6 +740,36 @@ takedowns?", reach for \`orgs list\` \u2014 it's the only command that exposes
 service flags across multiple orgs in one call. Run it in \`--json\` mode
 and summarize patterns by service or by subscription tier.
 
+### \`brands list\` \u2014 List the brands (sub-brands) belonging to an org
+
+Returns every brand for the org the caller is authenticated as, both
+parent / product brands (\`type: "ORGANIZATION"\`) and individual /
+employee brands (\`type: "INDIVIDUAL"\`). Soft-deleted brands are excluded.
+The endpoint is org-scoped and inferred from auth \u2014 there's no \`--org\`
+flag \u2014 so org-scoped API keys, user API keys, and user sessions all work
+without extra arguments.
+
+\`\`\`bash
+chainpatrol brands list                          # all brands
+chainpatrol brands list --type INDIVIDUAL        # employee / person brands only
+chainpatrol brands list --type ORGANIZATION      # product / parent brands only
+chainpatrol --json brands list                   # machine-readable
+\`\`\`
+
+Each entry has \`{ id, slug, name, type, description, brandGroupId, createdAt }\`.
+Use this when you need to:
+
+- Distinguish employee vs. product brands ahead of time \u2014 e.g. while
+  running a trend search and you want to highlight which spiking
+  sub-brands are employees so the user gets a direct heads-up to the
+  person involved.
+- Resolve a brand name the user mentions to its \`slug\` for use with
+  \`metrics organization --brand-slug <slug>\` or as a \`brandId\` for
+  \`takedowns list --brand <id>\`.
+- Audit a customer's setup \u2014 "how many employee brands does this org
+  protect?" or "are there brands the org set up but never wired into a
+  detection config?"
+
 ### \`metrics summary | found | breakdown | organization\` \u2014 Org metrics for spike/drop analysis
 
 #### Decision rule \u2014 read this before picking a metrics subcommand
@@ -1416,6 +1454,190 @@ Until a dedicated probe command exists:
 In both cases, if liveness looks miscalibrated for a class of assets,
 notify ChainPatrol engineering \u2014 the checker likely needs a tuning pass for
 that platform.
+
+## Organization Trend Search Guide
+
+Trend search asks "what's changed recently for this org?" \u2014 the answer can
+surface coordinated attacks, new attack channels, or campaigns targeting
+specific people, **before** they show up as a healthcheck failure. Unlike
+the HealthCheck Guide above (which grades single signals against
+thresholds), trend search compares a recent window to a baseline window
+and flags ratios, not absolute counts. A trend is interesting even when
+the pipeline is keeping up with it \u2014 the user usually wants to know.
+
+When the user asks something like:
+
+- "are there any trends in org X?"
+- "search for trends in <org>"
+- "anything unusual happening with <org> lately?"
+- "any spikes for <org>?"
+- "what's new for <org> this week?"
+- "is anyone targeting <org>'s employees more than usual?"
+- "are we seeing more YouTube/Telegram/etc. threats for <org>?"
+
+\u2026run the three trend checks below in parallel (single message, multiple
+Bash calls) and surface anything where the current rate is \u2265 2\xD7 the
+baseline AND clears a small absolute floor.
+
+### How to compute "current vs. baseline" rates
+
+Pick two non-overlapping windows: a **current** window the user cares about
+(default last 7 days) and a **baseline** window ending where the current
+one starts (default the prior ~90 days, i.e. \`current_start - 90d\` \u2192
+\`current_start - 1d\`). For any breakdown bucket, compute:
+
+\`\`\`
+current_per_day  = current_count  / current_window_days
+baseline_per_day = baseline_count / baseline_window_days
+ratio            = current_per_day / max(baseline_per_day, epsilon)
+\`\`\`
+
+Flag a bucket if \`ratio >= 2\` AND \`current_count >= 5\`. The floor
+suppresses noise on orgs with near-zero baseline activity (a single new
+YouTube report jumping the rate from 0 to 1/day shouldn't trigger). If
+the user gives a different window ("last 3 days", "this month"), adjust
+both windows proportionally and keep the same ratio threshold.
+
+### Trend 1 \u2014 Spike in a specific asset type
+
+A sudden jump in threats on a platform the org doesn't usually see
+traffic on ("normally you don't get targeted on YouTube much, but now
+there's a spike there") is worth flagging \u2014 it usually means an attacker
+has discovered a new channel that works for them. Even when the absolute
+number is small, the *ratio* against the org's normal mix is what
+matters.
+
+Use \`metrics breakdown --by type\` over both windows:
+
+\`\`\`bash
+# Current window \u2014 last 7 days, broken out by asset type
+chainpatrol --json metrics breakdown --org <slug> --by type \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+
+# Baseline window \u2014 prior ~90 days ending where the current window starts
+chainpatrol --json metrics breakdown --org <slug> --by type \\
+  --from <YYYY-MM-DD 97d ago> --to <YYYY-MM-DD 8d ago>
+\`\`\`
+
+Each entry in \`.points\` has \`{ type, count }\`. Join the two windows on
+\`type\`, apply the ratio rule above, and report each flagged type.
+
+Cross-reference any flagged type with \`configs list --org <slug>\` \u2014 if
+the spike is on Twitter / X but \`twitter_post_search\` is disabled, the
+detection source for that channel isn't even running for this org and
+the spike is being caught by something else (likely customer reports);
+suggest turning it on.
+
+### Trend 2 \u2014 Spike in overall threat volume
+
+A sharp rise in total threats across the org \u2014 regardless of type or
+brand \u2014 usually means a coordinated attack or campaign is underway. This
+isn't a healthcheck (reviewing and takedowns may be keeping up just
+fine), but the security team still wants to know so they can warn
+customers / employees / partners.
+
+\`\`\`bash
+# Daily volume for the last ~6 weeks \u2014 enough to eyeball a baseline AND
+# see the spike on the right edge of the series.
+chainpatrol --json metrics breakdown --org <slug> --by day \\
+  --from <YYYY-MM-DD 42d ago> --to <YYYY-MM-DD today>
+\`\`\`
+
+Read \`.points\` (one entry per day). Take the trailing 7-day average and
+compare against the prior ~5 weeks (the same 2\xD7 / floor rule). For round
+totals to quote to the user, also pull:
+
+\`\`\`bash
+# Two calls \u2014 current and baseline windows \u2014 using --include to skip
+# the per-type / per-day series and keep the call cheap.
+chainpatrol --json metrics organization --org <slug> \\
+  --include reports,newThreats,threatsWatchlisted \\
+  --from <current_from> --to <current_to>
+
+chainpatrol --json metrics organization --org <slug> \\
+  --include reports,newThreats,threatsWatchlisted \\
+  --from <baseline_from> --to <baseline_to>
+\`\`\`
+
+When volume spikes broadly, also skim \`reports list --reported-by-customer\`
+for the same window \u2014 a wave of customer reports often arrives a few hours
+ahead of automated detection on a real coordinated push.
+
+### Trend 3 \u2014 Spike on a specific sub-brand (especially employee brands)
+
+Sub-brands the org has set up for individual people \u2014 employees,
+executives, public figures \u2014 are high-signal targets. A sudden spike on
+one usually means an attacker is impersonating that person specifically,
+which is materially different from a generic phishing wave and usually
+warrants a direct heads-up to the person involved. In the database these
+are \`Brand\` rows with \`type: INDIVIDUAL\` (vs. \`ORGANIZATION\` for
+product / parent brands).
+
+**Step 1: Pull the brand roster** so you can label each spike as
+"employee" or "product" without asking the user.
+
+\`\`\`bash
+chainpatrol --json brands list
+\`\`\`
+
+Build a map of \`slug \u2192 type\` from the response so the next step's
+findings can be tagged \`(employee)\` or \`(product)\` automatically.
+
+**Step 2: Run the breakdown over both windows.**
+
+\`\`\`bash
+# Current window \u2014 last 7 days, broken out by sub-brand
+chainpatrol --json metrics breakdown --org <slug> --by brand \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+
+# Baseline window \u2014 prior ~90 days
+chainpatrol --json metrics breakdown --org <slug> --by brand \\
+  --from <YYYY-MM-DD 97d ago> --to <YYYY-MM-DD 8d ago>
+\`\`\`
+
+Each entry in \`.points\` has \`{ brandId, brandSlug, brandName, count }\`.
+Apply the ratio rule, join against the \`slug \u2192 type\` map from Step 1,
+and report each spiking sub-brand by name plus its type.
+
+**Step 3: Drill into the flagged brand** with \`metrics organization
+--brand-slug <slug>\` for a per-day / per-type breakdown scoped to that
+brand only. The server applies the brand filter to the scalar metrics
+(\`newThreats\`, \`takedownsFiled\`, etc.) AND to \`blockedByType\` /
+\`blockedByDay\`, so the time series and per-asset-type counts are real
+brand-only data:
+
+\`\`\`bash
+chainpatrol --json metrics organization --org <slug> \\
+  --brand-slug <brand-slug> \\
+  --include newThreats,blockedByType,blockedByDay \\
+  --from <YYYY-MM-DD 7d ago> --to <YYYY-MM-DD today>
+\`\`\`
+
+If multiple \`INDIVIDUAL\` brands are spiking at the same time, treat that
+as a stronger signal than a single one \u2014 likely a campaign targeting the
+company's people rather than a single impersonation. Prioritize those
+findings over single-brand spikes when summarizing.
+
+### Reporting trend findings
+
+Report each spiking bucket as its own finding with: the trend it falls
+under (asset type / overall volume / sub-brand), the current vs. baseline
+rate (e.g. "youtube: 12/day last 7d vs. 1.2/day prior 90d, \xD710
+baseline"), and a one-line follow-up:
+
+- Asset-type spike \u2192 check \`configs list\` for the matching detection
+  source and turn it on if it's off.
+- Overall-volume spike \u2192 flag a possible coordinated campaign; suggest
+  the security team look at the recent \`reports list\` for shared
+  infrastructure (sender, registrar, hosting).
+- Sub-brand spike \u2192 look up \`type\` via \`brands list\`; if
+  \`INDIVIDUAL\`, suggest a direct heads-up to that person; if
+  \`ORGANIZATION\`, suggest a product-team alert.
+
+If none of the three trends fire above the 2\xD7 / floor thresholds, say so
+explicitly ("no significant trends in the last 7 days vs. the prior 90")
+rather than dumping every breakdown number \u2014 the absence is the
+finding.
 `;
 }
 function getBundledSkillVersion() {

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-MDDC4F6Q.js";
+} from "./chunk-UDGJEN4M.js";
 import "./chunk-NQT77IB7.js";
 import {
   DateTime
@@ -819,6 +819,7 @@ var COMMANDS = [
   "takedowns",
   "threats",
   "orgs",
+  "brands",
   "presets",
   "setup",
   "uninstall",
@@ -1054,12 +1055,12 @@ function parseAttachmentUrls() {
 }
 async function handleConfigsList(org) {
   if (jsonMode) {
-    const { listConfigsJson } = await import("./list-json-ZTS5GXNA.js");
+    const { listConfigsJson } = await import("./list-json-B5L5PXKH.js");
     await listConfigsJson({ org });
     return;
   }
   const { render } = await import("ink");
-  const { default: ConfigsList } = await import("./list-AEM2KSO4.js");
+  const { default: ConfigsList } = await import("./list-X4Z3CPO7.js");
   const { default: React } = await import("react");
   render(React.createElement(ConfigsList, { org }));
 }
@@ -1159,7 +1160,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const contents = [...positionals, ...flagAssets];
-        const { runAssetCheck } = await import("./check-EMGFDXUO.js");
+        const { runAssetCheck } = await import("./check-G64UQCEL.js");
         await runAssetCheck({
           contents,
           json: jsonMode,
@@ -1169,7 +1170,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runAssetList } = await import("./list-2ENAEZVP.js");
+        const { runAssetList } = await import("./list-XSIXAHOG.js");
         await runAssetList({
           type: cli.flags.type ?? cli.flags.assetType,
           status: cli.flags.assetStatus ?? cli.flags.status,
@@ -1190,7 +1191,7 @@ async function main() {
     case "detections": {
       const org = await resolveOrg();
       if (subcommand === "healthcheck") {
-        const { runDetectionsHealthcheck } = await import("./healthcheck-J6BIZEG7.js");
+        const { runDetectionsHealthcheck } = await import("./healthcheck-QNLFKAXM.js");
         await runDetectionsHealthcheck({
           org,
           source: cli.flags.source,
@@ -1205,7 +1206,7 @@ async function main() {
         break;
       }
       if (subcommand === "validate") {
-        const { runDetectionsValidate } = await import("./validate-QE2F4PYY.js");
+        const { runDetectionsValidate } = await import("./validate-UYKOMUEI.js");
         await runDetectionsValidate({
           org,
           source: cli.flags.source,
@@ -1220,7 +1221,7 @@ async function main() {
         break;
       }
       if (subcommand === "drift") {
-        const { runDetectionsDrift } = await import("./drift-RQKTGJWB.js");
+        const { runDetectionsDrift } = await import("./drift-SHPMEJDU.js");
         await runDetectionsDrift({
           org,
           source: cli.flags.source,
@@ -1234,7 +1235,7 @@ async function main() {
         break;
       }
       if (subcommand === "run") {
-        const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
+        const { runDetectionsRun } = await import("./run-RV6P2OCD.js");
         await runDetectionsRun({
           org,
           configId: cli.flags.configId,
@@ -1248,7 +1249,7 @@ async function main() {
         break;
       }
       if (subcommand === "list") {
-        const { runDetectionsList } = await import("./list-LKNCICLT.js");
+        const { runDetectionsList } = await import("./list-SWHKM5R6.js");
         await runDetectionsList({
           org,
           cursor: cli.flags.cursor,
@@ -1277,7 +1278,7 @@ async function main() {
           break;
         }
         if (action === "run") {
-          const { runDetectionsRun } = await import("./run-HS2EEOM6.js");
+          const { runDetectionsRun } = await import("./run-RV6P2OCD.js");
           await runDetectionsRun({
             org,
             configId: cli.flags.configId,
@@ -1295,7 +1296,7 @@ async function main() {
             throw new Error("detections configs update requires --config-id");
           }
           const configPatch = getConfigPatchFromSetFlags();
-          const { runDetectionsConfigsUpdate } = await import("./configs-update-EKNLIRA6.js");
+          const { runDetectionsConfigsUpdate } = await import("./configs-update-MVX7Q5NW.js");
           await runDetectionsConfigsUpdate({
             org,
             configId: cli.flags.configId,
@@ -1331,7 +1332,7 @@ async function main() {
         const slugs = parseCsvList(cli.flags.slugs);
         const allMyOrgs = cli.flags.allMyOrgs;
         const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-PFPBZXJZ.js");
+        const { runMetricsOrganization } = await import("./organization-SOMHMGTM.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
@@ -1350,7 +1351,7 @@ async function main() {
       }
       const org = await resolveOrg();
       if (subcommand === "summary") {
-        const { runMetricsSummary } = await import("./summary-POVQC6B7.js");
+        const { runMetricsSummary } = await import("./summary-LF53KXRR.js");
         await runMetricsSummary({
           org,
           from: cli.flags.from,
@@ -1363,7 +1364,7 @@ async function main() {
         break;
       }
       if (subcommand === "found") {
-        const { runMetricsFound } = await import("./found-LVYBEOS6.js");
+        const { runMetricsFound } = await import("./found-OPL4HWOW.js");
         await runMetricsFound({
           org,
           from: cli.flags.from,
@@ -1380,7 +1381,7 @@ async function main() {
         if (!by || !["day", "type", "brand"].includes(by)) {
           throw new Error("metrics breakdown requires --by <day|type|brand>");
         }
-        const { runMetricsBreakdown } = await import("./breakdown-ETSF2BZ3.js");
+        const { runMetricsBreakdown } = await import("./breakdown-3LJBT3JQ.js");
         await runMetricsBreakdown({
           org,
           by,
@@ -1401,7 +1402,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-44BQZHJD.js");
+        const { runReportsList } = await import("./list-WPPNX7G3.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1429,7 +1430,7 @@ async function main() {
       }
       if (subcommand === "create") {
         const org = await tryResolveOrg();
-        const { runReportsCreate } = await import("./create-M4PV5VVU.js");
+        const { runReportsCreate } = await import("./create-ANCO4FXB.js");
         await runReportsCreate({
           org,
           title: cli.flags.title,
@@ -1450,7 +1451,7 @@ async function main() {
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-EBXEP7XC.js");
+        const { runReportsSearch } = await import("./search-FQUR75WR.js");
         await runReportsSearch({
           assetContents,
           reportedByCustomer: cli.flags.reportedByCustomer,
@@ -1466,7 +1467,7 @@ async function main() {
     }
     case "threats": {
       if (subcommand === "list") {
-        const { runThreatsList } = await import("./list-E2JVJNHV.js");
+        const { runThreatsList } = await import("./list-Q5PRMAN5.js");
         await runThreatsList({
           query: cli.flags.query,
           from: cli.flags.from,
@@ -1489,7 +1490,7 @@ async function main() {
     case "takedowns": {
       if (subcommand === "list") {
         const org = await tryResolveOrg();
-        const { runTakedownsList } = await import("./list-S5Y6GW43.js");
+        const { runTakedownsList } = await import("./list-FWXQUOCP.js");
         await runTakedownsList({
           org,
           query: cli.flags.query,
@@ -1520,7 +1521,7 @@ async function main() {
     }
     case "queues": {
       if (subcommand === "snapshot") {
-        const { runQueuesSnapshot } = await import("./snapshot-GNZMYTXT.js");
+        const { runQueuesSnapshot } = await import("./snapshot-2GDJMN3L.js");
         await runQueuesSnapshot({
           org: cli.flags.org,
           all: cli.flags.all,
@@ -1538,7 +1539,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-XUYCZG7S.js");
+        const { runOrgsList } = await import("./list-QXA6GLCV.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1554,7 +1555,7 @@ async function main() {
       if (subcommand === "get") {
         const positionalSlug = action;
         const slug = positionalSlug ?? await tryResolveOrg();
-        const { runOrgsGet } = await import("./get-YFYSJFBC.js");
+        const { runOrgsGet } = await import("./get-K7VHV5X2.js");
         await runOrgsGet({
           slug,
           json: jsonMode,
@@ -1564,7 +1565,7 @@ async function main() {
       }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-O62BZKQ5.js");
+          const { runOrgsAssetsList } = await import("./list-QHEFB4KE.js");
           await runOrgsAssetsList({
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
@@ -1580,7 +1581,7 @@ async function main() {
       }
       if (subcommand === "asset-groups") {
         if (action === "list") {
-          const { runOrgsAssetGroupsList } = await import("./list-O36VWTWR.js");
+          const { runOrgsAssetGroupsList } = await import("./list-FVFF4VW3.js");
           await runOrgsAssetGroupsList({
             json: jsonMode,
             outputFormat: cliContext.outputFormat
@@ -1594,8 +1595,29 @@ async function main() {
         subcommand ? `Unknown subcommand: orgs ${subcommand}${hint ? `. Did you mean "orgs ${hint}"?` : ""}` : "Usage: chainpatrol orgs <list|get <slug>|assets list|asset-groups list> [filters]"
       );
     }
+    case "brands": {
+      if (subcommand === "list") {
+        const rawType = cli.flags.type?.toUpperCase();
+        if (rawType && rawType !== "ORGANIZATION" && rawType !== "INDIVIDUAL") {
+          throw new Error(
+            "brands list --type must be ORGANIZATION or INDIVIDUAL (case-insensitive)."
+          );
+        }
+        const { runBrandsList } = await import("./list-4VKMEKZS.js");
+        await runBrandsList({
+          type: rawType,
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      const hint = subcommand ? suggest(subcommand, ["list"]) : null;
+      throw new Error(
+        subcommand ? `Unknown subcommand: brands ${subcommand}${hint ? `. Did you mean "brands ${hint}"?` : ""}` : "Usage: chainpatrol brands list [--type ORGANIZATION|INDIVIDUAL]"
+      );
+    }
     case "whoami": {
-      const { runWhoami } = await import("./whoami-24KUJUN4.js");
+      const { runWhoami } = await import("./whoami-OYOG63BX.js");
       await runWhoami({
         json: jsonMode,
         outputFormat: cliContext.outputFormat
@@ -1604,7 +1626,7 @@ async function main() {
     }
     case "healthchecks": {
       if (subcommand === "list") {
-        const { runHealthchecksList } = await import("./list-CNF2FGLN.js");
+        const { runHealthchecksList } = await import("./list-AQ7E23T3.js");
         await runHealthchecksList({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1618,7 +1640,7 @@ async function main() {
           thresholds.minResults = cli.flags.minResults;
         if (cli.flags.lookbackHours !== void 0)
           thresholds.lookbackHours = cli.flags.lookbackHours;
-        const { runHealthchecksRun } = await import("./run-R3RR6XQF.js");
+        const { runHealthchecksRun } = await import("./run-J5TQ2YC2.js");
         await runHealthchecksRun({
           org,
           id: action,
@@ -1636,7 +1658,7 @@ async function main() {
     }
     case "presets": {
       if (subcommand === "list") {
-        const { runPresetsList } = await import("./list-JCJHIJM4.js");
+        const { runPresetsList } = await import("./list-FJBWSGTD.js");
         await runPresetsList({ outputFormat: cliContext.outputFormat });
         break;
       }
@@ -1647,7 +1669,7 @@ async function main() {
           );
         }
         const org = await resolveOrg();
-        const { runPresetsRun } = await import("./run-LKPKTH3W.js");
+        const { runPresetsRun } = await import("./run-YAAMSWKK.js");
         await runPresetsRun({
           presetId: action,
           org,
@@ -1664,12 +1686,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-Z6SBI6GC.js");
+      const { setupSkill } = await import("./setup-skill-F7437RT3.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-Z6SBI6GC.js");
+      const { uninstallSkill } = await import("./setup-skill-F7437RT3.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{configs-update-EKNLIRA6.js → configs-update-MVX7Q5NW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{create-M4PV5VVU.js → create-ANCO4FXB.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{drift-RQKTGJWB.js → drift-SHPMEJDU.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{found-LVYBEOS6.js → found-OPL4HWOW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{get-YFYSJFBC.js → get-K7VHV5X2.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{healthcheck-J6BIZEG7.js → healthcheck-QNLFKAXM.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/list-4VKMEKZS.js

@@ -0,0 +1,64 @@
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-O7TMOF4W.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/brands/list.ts
+function toRow(brand) {
+  return {
+    id: brand.id,
+    slug: brand.slug,
+    name: brand.name,
+    type: brand.type,
+    description: brand.description ?? "",
+    brandGroupId: brand.brandGroupId,
+    createdAt: brand.createdAt
+  };
+}
+async function runBrandsList(options) {
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.listOrganizationBrands();
+  const brands = options.type ? result.brands.filter((brand) => brand.type === options.type) : result.brands;
+  const rows = brands.map(toRow);
+  printOutput({
+    outputFormat,
+    json: options.type ? { ...result, brands } : result,
+    markdown: [
+      "# Organization brands",
+      "",
+      `- Returned: ${brands.length}${options.type ? ` (filtered to type=${options.type})` : ""}`,
+      "",
+      ...rows.map(
+        (row) => `- #${row.id} ${row.name} (slug=${row.slug}, type=${row.type}${row.brandGroupId !== null ? `, groupId=${row.brandGroupId}` : ""})`
+      )
+    ].join("\n"),
+    csv: toCsvRows(rows),
+    human: () => {
+      if (brands.length === 0) {
+        console.log(
+          options.type ? `No brands of type ${options.type} found.` : "No brands found."
+        );
+        return;
+      }
+      console.log(
+        `Organization brands \u2014 returned ${brands.length}${options.type ? ` (type=${options.type})` : ""}`
+      );
+      for (const row of rows) {
+        const group = row.brandGroupId !== null ? ` groupId=${row.brandGroupId}` : "";
+        console.log(
+          `#${row.id} ${row.name} (slug=${row.slug}, type=${row.type}${group})`
+        );
+      }
+    }
+  });
+}
+export {
+  runBrandsList
+};

package/dist/{list-CNF2FGLN.js → list-AQ7E23T3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-JCJHIJM4.js → list-FJBWSGTD.js}

@@ -1,12 +1,12 @@
 import {
   PRESETS
-} from "./chunk-HGAQBGGL.js";
+} from "./chunk-2JZAPTY6.js";
 import "./chunk-E2LAMILJ.js";
 import {
   printOutput,
   toCsvRows
 } from "./chunk-VFT3TD3E.js";
-import "./chunk-DPLUSURP.js";
+import "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-O36VWTWR.js → list-FVFF4VW3.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-S5Y6GW43.js → list-FWXQUOCP.js}

@@ -11,7 +11,7 @@ import {
   TAKEDOWN_SORT_KEYS,
   TAKEDOWN_STATUSES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-E2JVJNHV.js → list-Q5PRMAN5.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-O62BZKQ5.js → list-QHEFB4KE.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-XUYCZG7S.js → list-QXA6GLCV.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-LKNCICLT.js → list-SWHKM5R6.js}

@@ -12,7 +12,7 @@ import {
   LIVENESS_FILTER_VALUES,
   WATCHLIST_FILTER_VALUES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-44BQZHJD.js → list-WPPNX7G3.js}

@@ -10,7 +10,7 @@ import {
   REPORT_REVIEW_DECISIONS,
   REPORT_STATUSES,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-AEM2KSO4.js → list-X4Z3CPO7.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-JCMWDZYY.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import {
   AuthCorruptedError,
   AuthExpiredError,

package/dist/{list-2ENAEZVP.js → list-XSIXAHOG.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{list-json-ZTS5GXNA.js → list-json-B5L5PXKH.js}

@@ -1,6 +1,6 @@
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{organization-PFPBZXJZ.js → organization-SOMHMGTM.js}

@@ -8,7 +8,7 @@ import {
 import {
   ORGANIZATION_METRICS_INCLUDE_FIELDS,
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-R3RR6XQF.js → run-J5TQ2YC2.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-HS2EEOM6.js → run-RV6P2OCD.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{run-LKPKTH3W.js → run-YAAMSWKK.js}

@@ -1,13 +1,13 @@
 import {
   getPresetDefinition,
   runPreset
-} from "./chunk-HGAQBGGL.js";
+} from "./chunk-2JZAPTY6.js";
 import {
   CliExitError,
   ExitCode
 } from "./chunk-E2LAMILJ.js";
 import "./chunk-VFT3TD3E.js";
-import "./chunk-DPLUSURP.js";
+import "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{search-EBXEP7XC.js → search-FQUR75WR.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{setup-skill-Z6SBI6GC.js → setup-skill-F7437RT3.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-MDDC4F6Q.js";
+} from "./chunk-UDGJEN4M.js";
 import "./chunk-NQT77IB7.js";
 export {
   getBundledSkillContent,

package/dist/{snapshot-GNZMYTXT.js → snapshot-2GDJMN3L.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{summary-POVQC6B7.js → summary-LF53KXRR.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{validate-QE2F4PYY.js → validate-UYKOMUEI.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/dist/{whoami-24KUJUN4.js → whoami-OYOG63BX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-VFT3TD3E.js";
 import {
   createApiClient
-} from "./chunk-DPLUSURP.js";
+} from "./chunk-O7TMOF4W.js";
 import "./chunk-EGWK6SRQ.js";
 import "./chunk-TFCNKBRC.js";
 import "./chunk-U73SABXK.js";

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [