@chainpatrol/cli 1.11.2 → 1.13.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @chainpatrol/cli
 
+## 1.13.0
+
+### Minor Changes
+
+- 2552904: Add Time to Detection: `getMetricsTimeToDetection` in the SDK,
+  `chainpatrol metrics time-to-detection` in the CLI, and the
+  `metrics_time_to_detection` MCP tool, all backed by the new
+  `POST /metrics/time-to-detection` endpoint. It reports how long threats were
+  already live before the earliest automated detection of the asset, for any
+  organization, per asset type. The clock runs from when the asset was first
+  seen live to its earliest automated detection; a human report does not stop
+  it. Each number is a minimum, published with how many blocked assets are in
+  the sample. Server-side work lives in @chainpatrol/external-trpc,
+  @chainpatrol/validation and @chainpatrol/metrics; those are private packages
+  and need no version bump.
+
+### Patch Changes
+
+- 27bb1d9: Add Tumblr to the list of supported asset types.
+- Updated dependencies [ac640ce]
+- Updated dependencies [2552904]
+- Updated dependencies [878241c]
+  - @chainpatrol/mcp@1.12.0
+  - @chainpatrol/sdk@1.12.0
+
+## 1.12.0
+
+### Minor Changes
+
+- ebce4b9: Add Pump.fun as a first-class asset type in CLI asset type discovery.
+
+### Patch Changes
+
+- 8056266: Add Glassdoor to the list of supported asset types.
+- Updated dependencies [3895c2f]
+- Updated dependencies [264c4f7]
+- Updated dependencies [7812a3b]
+- Updated dependencies [8a78f60]
+  - @chainpatrol/sdk@1.11.0
+  - @chainpatrol/mcp@1.11.0
+
 ## 1.11.2
 
 ### Patch Changes

package/dist/{chunk-TI2HK3NM.js → chunk-DY5VY6FO.js}

@@ -96,6 +96,7 @@ _chainpatrol() {
           'breakdown:Show metrics breakdown'
           'takedown-time:Show median time to takedown by asset type'
           'takedown-time-trend:Show month-over-month median time-to-takedown trend'
+          'time-to-detection:Show how long threats were live before first detection'
           'organization:Get organization metrics (official endpoint)'
         )
         _describe 'subcommand' metrics_subcommands

package/dist/{chunk-TGIVCSKT.js → chunk-XLPLTBKX.js}

@@ -4,7 +4,7 @@ import {
 import {
   installCompletions,
   uninstallCompletions
-} from "./chunk-TI2HK3NM.js";
+} from "./chunk-DY5VY6FO.js";
 
 // src/commands/setup-skill.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";

package/dist/cli.js

@@ -11,12 +11,12 @@ import {
   getBundledSkillVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-TGIVCSKT.js";
+} from "./chunk-XLPLTBKX.js";
 import {
   compareVersions,
   getCliVersion
 } from "./chunk-OKIUEBUK.js";
-import "./chunk-TI2HK3NM.js";
+import "./chunk-DY5VY6FO.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";
@@ -282,7 +282,7 @@ var HELP = {
   },
   metrics: {
     description: "Query organization metrics and breakdowns.",
-    usage: "chainpatrol metrics <summary|found|breakdown|organization>",
+    usage: "chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|time-to-detection|organization>",
     options: ["--org <slug>          Organization slug"],
     examples: [
       "chainpatrol metrics summary --org acme --this-week",
@@ -290,6 +290,7 @@ var HELP = {
       "chainpatrol metrics breakdown --org acme --by day --this-week",
       "chainpatrol metrics takedown-time --org acme --from 2025-01-01 --to 2025-02-01",
       "chainpatrol metrics takedown-time-trend --org acme --months 12",
+      "chainpatrol metrics time-to-detection --org acme --from 2025-01-01 --to 2025-02-01",
       "chainpatrol metrics organization --org acme --from 2025-01-01 --to 2025-02-01"
     ]
   },
@@ -361,6 +362,17 @@ var HELP = {
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
+  "metrics time-to-detection": {
+    description: "How long threats were already live before the earliest automated detection of the asset, for any organization, per asset type, for distinct assets this organization blocked in the range that are still blocked. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it. Every number is a minimum and comes with how many blocked assets are measured. Defaults to the trailing 3 months if no date range is given.",
+    usage: "chainpatrol metrics time-to-detection --org <slug> [--from ISO --to ISO|--this-week]",
+    options: [
+      "--org <slug>          Organization slug",
+      "--from <iso>          Start date (ISO 8601)",
+      "--to <iso>            End date (ISO 8601); a date-only value covers the whole day",
+      "--this-week           Use the current ISO week (overrides default)",
+      "--brand <ids>         Comma-separated brand IDs"
+    ]
+  },
   "metrics takedown-time-trend": {
     description: "Median time from takedown start to completion bucketed by month, over a trailing window, with the month-over-month change.",
     usage: "chainpatrol metrics takedown-time-trend --org <slug> [--months 12] [--asset-type TWITTER,URL]",
@@ -1360,7 +1372,7 @@ async function main() {
         break;
       }
       if (subcommand === "types") {
-        const { runAssetTypes } = await import("./types-KUPHV2V3.js");
+        const { runAssetTypes } = await import("./types-ZO5KKMXK.js");
         runAssetTypes({
           json: jsonMode,
           outputFormat: cliContext.outputFormat
@@ -1573,6 +1585,19 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "time-to-detection" || subcommand === "timeToDetection") {
+        const { runMetricsTimeToDetection } = await import("./time-to-detection-5L7ECKYU.js");
+        await runMetricsTimeToDetection({
+          org,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          thisWeek: cli.flags.thisWeek,
+          brandIds: parseBrandIds(),
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "takedown-time-trend" || subcommand === "takedownTimeTrend") {
         const { runMetricsTakedownTimeTrend } = await import("./takedown-time-trend-KYPA3W3U.js");
         await runMetricsTakedownTimeTrend({
@@ -1609,10 +1634,11 @@ async function main() {
         "breakdown",
         "takedown-time",
         "takedown-time-trend",
+        "time-to-detection",
         "organization"
       ]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|organization>"
+        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|time-to-detection|organization>"
       );
     }
     case "reports": {
@@ -1953,17 +1979,17 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-TVJJD6NC.js");
+      const { setupSkill } = await import("./setup-skill-RQG43DFT.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-TVJJD6NC.js");
+      const { uninstallSkill } = await import("./setup-skill-RQG43DFT.js");
       uninstallSkill({ json: jsonMode });
       break;
     }
     case "completions": {
-      const { printCompletions } = await import("./completions-7DD5E5HL.js");
+      const { printCompletions } = await import("./completions-HYTAOGE4.js");
       printCompletions(subcommand);
       break;
     }

package/dist/{completions-7DD5E5HL.js → completions-HYTAOGE4.js}

@@ -3,7 +3,7 @@ import {
   installCompletions,
   printCompletions,
   uninstallCompletions
-} from "./chunk-TI2HK3NM.js";
+} from "./chunk-DY5VY6FO.js";
 export {
   getCompletionScript,
   installCompletions,

package/dist/{setup-skill-TVJJD6NC.js → setup-skill-RQG43DFT.js}

@@ -6,9 +6,9 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-TGIVCSKT.js";
+} from "./chunk-XLPLTBKX.js";
 import "./chunk-OKIUEBUK.js";
-import "./chunk-TI2HK3NM.js";
+import "./chunk-DY5VY6FO.js";
 export {
   getBundledSkillContent,
   getBundledSkillVersion,

package/dist/time-to-detection-5L7ECKYU.js

@@ -0,0 +1,82 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-NSRQ62C4.js";
+import "./chunk-4QZ7KD2Y.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-ORAY4KMA.js";
+import "./chunk-K4RAUZSD.js";
+
+// src/commands/metrics/time-to-detection.ts
+function formatTimeToDetectionRow(row) {
+  const measured = `${row.withEvidence}/${row.blocked} measured`;
+  if (row.medianDaysAtLeast == null) {
+    return `${row.assetType}: no assets with a live date and an automated detection (${measured})`;
+  }
+  return `${row.assetType}: live at least ${row.medianDaysAtLeast.toFixed(1)}d before first detection (${measured})`;
+}
+async function runMetricsTimeToDetection(options) {
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.getMetricsTimeToDetection({
+    slug: options.org,
+    // The caller's own --from/--to go through untouched when given: the API
+    // reads a date-only value as the whole day, while `resolveDateRange` has
+    // already expanded it to a midnight timestamp, which would cut the final
+    // day off.
+    startDate: options.from ?? range.startDate,
+    endDate: options.to ?? range.endDate,
+    brandIds: options.brandIds
+  });
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  printOutput({
+    outputFormat,
+    json: { ...result, range },
+    markdown: [
+      `# Time to Detection (${options.org}) \u2014 ${range.label}`,
+      "",
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
+      "",
+      ...result.byAssetType.map((row) => `- ${formatTimeToDetectionRow(row)}`)
+    ].join("\n"),
+    csv: toCsvRows(
+      result.byAssetType.map((row) => ({
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
+        assetType: row.assetType,
+        medianDaysAtLeast: row.medianDaysAtLeast,
+        withEvidence: row.withEvidence,
+        blocked: row.blocked
+      }))
+    ),
+    human: () => {
+      console.log(`Time to detection for ${options.org} \u2014 ${range.label}`);
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
+      if (result.byAssetType.length === 0) {
+        console.log("No blocked assets in this range.");
+        return;
+      }
+      console.log(
+        "Every number is a minimum. The clock runs from when the asset was first seen live to its earliest automated detection; a human report does not stop it."
+      );
+      for (const row of result.byAssetType) {
+        console.log(formatTimeToDetectionRow(row));
+      }
+    }
+  });
+}
+export {
+  formatTimeToDetectionRow,
+  runMetricsTimeToDetection
+};

package/dist/{types-KUPHV2V3.js → types-ZO5KKMXK.js}

@@ -15,6 +15,11 @@ var ASSET_TYPES = [
     label: "Page",
     description: "A standalone web page tracked independently of its parent URL (e.g. a hosted phishing kit deployed on a shared platform)."
   },
+  {
+    type: "PUMP_FUN",
+    label: "Pump.fun",
+    description: "A Pump.fun token, creator profile, or platform page."
+  },
   {
     type: "ADDRESS",
     label: "Address",
@@ -98,6 +103,7 @@ var ASSET_TYPES = [
   },
   { type: "TEACHABLE", label: "Teachable", description: "A Teachable course or school." },
   { type: "SUBSTACK", label: "Substack", description: "A Substack publication." },
+  { type: "TUMBLR", label: "Tumblr", description: "A Tumblr blog, post, or community." },
   { type: "DEBANK", label: "Debank", description: "A Debank profile." },
   { type: "TAWK_TO", label: "Tawk.to Chat", description: "A Tawk.to live-chat widget." },
   { type: "JOTFORM", label: "Jotform", description: "A Jotform form." },
@@ -223,6 +229,11 @@ var ASSET_TYPES = [
     type: "SMARTMONEYMATCH",
     label: "SmartMoneyMatch",
     description: "A SmartMoneyMatch article or event page."
+  },
+  {
+    type: "GLASSDOOR",
+    label: "Glassdoor",
+    description: "A Glassdoor employer profile or employee review page."
   }
 ];
 var ASSET_TYPE_LABELS = Object.freeze(

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "1.11.2",
+  "version": "1.13.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [
@@ -33,8 +33,8 @@
     "lint": "npx oxlint ."
   },
   "dependencies": {
-    "@chainpatrol/mcp": "1.10.2",
-    "@chainpatrol/sdk": "1.10.0",
+    "@chainpatrol/mcp": "1.12.0",
+    "@chainpatrol/sdk": "1.12.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "ink": "^7.0.1",
     "meow": "^14.1.0",