@chainpatrol/cli 1.6.0 → 1.8.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @chainpatrol/cli
 
+## 1.8.0
+
+### Minor Changes
+
+- 33ba556: Adds time-to-takedown trends: `client.getMetricsTakedownTimeTrend()` in the SDK
+  and `chainpatrol metrics takedown-time-trend --org <slug>` in the CLI, both
+  backed by the new `POST /metrics/takedown-time/trend` endpoint. Returns the
+  median time from takedown start to completion bucketed by the month a takedown
+  completed, over a trailing window of whole months, plus the month-over-month
+  change for each series. Pass `assetTypes` (max 5) to get one series per asset
+  type instead of a single pooled series.
+
+  The month-over-month comparison uses the two most recent months that actually
+  had completed takedowns, so a quiet month in between doesn't read as "no
+  change", and `direction` reads lower-is-better: `"improved"` means the median
+  fell. Months with no completed takedowns carry a `null` median rather than zero.
+
+  Server-side work lives in @chainpatrol/external-trpc, @chainpatrol/validation
+  and @chainpatrol/metrics; all three are private packages and don't need version
+  bumps. The endpoint is gated on the new `median-time-to-takedown-trends-api`
+  feature flag, separate from the flag on `POST /metrics/takedown-time`.
+
+### Patch Changes
+
+- Updated dependencies [33ba556]
+  - @chainpatrol/sdk@1.8.0
+
+## 1.7.0
+
+### Minor Changes
+
+- 9f19c88: Adds time-to-takedown metrics: `client.getMetricsTakedownTime()` in the SDK and
+  `chainpatrol metrics takedown-time --org <slug>` in the CLI, both backed by the
+  new `POST /metrics/takedown-time` endpoint. Returns the median time from
+  takedown start to completion per asset type, over an optional date range.
+
+  Also adds `parseIsoDateEndOfDay` to `@chainpatrol/sdk/api`: a date-only bound
+  such as `2026-08-18` now covers that whole day instead of cutting off at
+  midnight UTC. Server-side work lives in @chainpatrol/external-trpc and
+  @chainpatrol/validation; both are private packages and don't need version bumps.
+
+- b037a0b: `GET /organization/assets` now accepts an optional `slug`, so callers whose
+  credentials reach more than one organization (user-scoped API keys, staff and
+  member sessions) can pick one instead of getting a flat 401. Organization-scoped
+  keys keep working unchanged when they omit it.
+
+  In the SDK, `client.listOrganizationAssets()` takes a `slug`. In the CLI,
+  `chainpatrol orgs assets list` forwards `--org <slug>` when one is set — the
+  existing no-flag invocation still resolves the org from an org-scoped key.
+
+  Server-side work lives in @chainpatrol/external-trpc and @chainpatrol/validation;
+  both are private packages and don't need version bumps.
+
+### Patch Changes
+
+- 0e5f156: Fix the install command in the CLI README. The unscoped `chainpatrol` package on npm is a
+  placeholder that points at `@chainpatrol/sdk`, so `npm install -g chainpatrol` never
+  installed the CLI — the published package is `@chainpatrol/cli`. Also link the README to
+  the new CLI documentation at https://chainpatrol.com/docs/cli.
+- Updated dependencies [f98f547]
+- Updated dependencies [9f19c88]
+- Updated dependencies [b037a0b]
+  - @chainpatrol/sdk@1.7.0
+
 ## 1.6.0
 
 ### Minor Changes

package/README.md

@@ -2,12 +2,17 @@
 
 Terminal interface for ChainPatrol threat detection.
 
+Full documentation: https://chainpatrol.com/docs/cli
+
 ## Installation
 
 ```bash
-npm install -g chainpatrol
+npm install -g @chainpatrol/cli
 ```
 
+The unscoped `chainpatrol` package on npm is a placeholder that points at
+`@chainpatrol/sdk` — it does not contain the CLI.
+
 ## Usage
 
 ```bash

package/dist/{chunk-55B34HJK.js → chunk-LE5ZOOUI.js}

@@ -1,7 +1,7 @@
 import {
   installCompletions,
   uninstallCompletions
-} from "./chunk-P5DJRDMV.js";
+} from "./chunk-TI2HK3NM.js";
 
 // src/commands/setup-skill.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";

package/dist/{chunk-P5DJRDMV.js → chunk-TI2HK3NM.js}

@@ -94,6 +94,8 @@ _chainpatrol() {
           'summary:Show metrics summary'
           'found:Show found threats count'
           'breakdown:Show metrics breakdown'
+          'takedown-time:Show median time to takedown by asset type'
+          'takedown-time-trend:Show month-over-month median time-to-takedown trend'
           'organization:Get organization metrics (official endpoint)'
         )
         _describe 'subcommand' metrics_subcommands

package/dist/cli.js

@@ -13,8 +13,8 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-55B34HJK.js";
-import "./chunk-P5DJRDMV.js";
+} from "./chunk-LE5ZOOUI.js";
+import "./chunk-TI2HK3NM.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";
@@ -286,6 +286,8 @@ var HELP = {
       "chainpatrol metrics summary --org acme --this-week",
       "chainpatrol metrics found --org acme --from 2025-01-01 --to 2025-02-01",
       "chainpatrol metrics breakdown --org acme --by day --this-week",
+      "chainpatrol metrics takedown-time --org acme --from 2025-01-01 --to 2025-02-01",
+      "chainpatrol metrics takedown-time-trend --org acme --months 12",
       "chainpatrol metrics organization --org acme --from 2025-01-01 --to 2025-02-01"
     ]
   },
@@ -346,6 +348,27 @@ var HELP = {
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
+  "metrics takedown-time": {
+    description: "Median time from takedown start to completion, per asset type. Defaults to the trailing 3 months if no date range is given.",
+    usage: "chainpatrol metrics takedown-time --org <slug> [--from ISO --to ISO|--this-week]",
+    options: [
+      "--org <slug>          Organization slug",
+      "--from <iso>          Start date (ISO 8601)",
+      "--to <iso>            End date (ISO 8601); a date-only value covers the whole day",
+      "--this-week           Use the current ISO week (overrides default)",
+      "--brand <ids>         Comma-separated brand IDs"
+    ]
+  },
+  "metrics takedown-time-trend": {
+    description: "Median time from takedown start to completion bucketed by month, over a trailing window, with the month-over-month change.",
+    usage: "chainpatrol metrics takedown-time-trend --org <slug> [--months 12] [--asset-type TWITTER,URL]",
+    options: [
+      "--org <slug>          Organization slug",
+      "--months <n>          Trailing window in whole months (2-36, default 12)",
+      "--asset-type <types>  Comma-separated asset types to break the trend down by (max 5)",
+      "--brand <ids>         Comma-separated brand IDs"
+    ]
+  },
   reports: {
     description: "Create, list, and search reports from the terminal.",
     usage: "chainpatrol reports <create|list|search>",
@@ -556,9 +579,10 @@ var HELP = {
     usage: "chainpatrol orgs assets list [filters]"
   },
   "orgs assets list": {
-    description: "List assets belonging to your organization's allowlist. Org is derived from your API key. Supports filtering by type, group, and search query.",
+    description: "List assets belonging to an organization's allowlist. Pass --org <slug> to choose one, or omit it to use the org tied to your API key. Supports filtering by type, group, and search query.",
     usage: "chainpatrol orgs assets list [filters]",
     options: [
+      "--org <slug>            Organization slug (omit for org-scoped API keys)",
       "--asset-type <type>     Filter by asset type (URL, ADDRESS, ...)",
       "--type <type>           Alias for --asset-type",
       "--group-id <n>          Filter by group ID. Use -1 for ungrouped assets only",
@@ -568,6 +592,7 @@ var HELP = {
     ],
     examples: [
       "chainpatrol orgs assets list --asset-type URL",
+      "chainpatrol orgs assets list --org acme --per-page 1000",
       "chainpatrol orgs assets list --group-id 12 --per-page 250 --output csv"
     ]
   },
@@ -953,6 +978,7 @@ ${getTopLevelHelp()}
     to: { type: "string" },
     thisWeek: { type: "boolean", default: false },
     by: { type: "string" },
+    months: { type: "number" },
     include: { type: "string" },
     slugs: { type: "string" },
     allMyOrgs: { type: "boolean", default: false },
@@ -1299,7 +1325,7 @@ async function main() {
           }
           return n;
         });
-        const { runAssetSearch } = await import("./search-W5QM2IOC.js");
+        const { runAssetSearch } = await import("./search-IWS42COG.js");
         await runAssetSearch({
           contents: contents.length > 0 ? contents : void 0,
           ids: ids.length > 0 ? ids : void 0,
@@ -1509,6 +1535,31 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "takedown-time" || subcommand === "takedownTime") {
+        const { runMetricsTakedownTime } = await import("./takedown-time-ARGVSPL6.js");
+        await runMetricsTakedownTime({
+          org,
+          from: cli.flags.from,
+          to: cli.flags.to,
+          thisWeek: cli.flags.thisWeek,
+          brandIds: parseBrandIds(),
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
+      if (subcommand === "takedown-time-trend" || subcommand === "takedownTimeTrend") {
+        const { runMetricsTakedownTimeTrend } = await import("./takedown-time-trend-LL3ZCCSD.js");
+        await runMetricsTakedownTimeTrend({
+          org,
+          months: cli.flags.months,
+          assetTypes: parseCsvList(cli.flags.assetType),
+          brandIds: parseBrandIds(),
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "breakdown") {
         const by = cli.flags.by;
         if (!by || !["day", "type", "brand"].includes(by)) {
@@ -1527,9 +1578,16 @@ async function main() {
         });
         break;
       }
-      const hint = subcommand ? suggest(subcommand, ["summary", "found", "breakdown", "organization"]) : null;
+      const hint = subcommand ? suggest(subcommand, [
+        "summary",
+        "found",
+        "breakdown",
+        "takedown-time",
+        "takedown-time-trend",
+        "organization"
+      ]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|organization>"
+        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|organization>"
       );
     }
     case "reports": {
@@ -1739,8 +1797,11 @@ async function main() {
       }
       if (subcommand === "assets") {
         if (action === "list") {
-          const { runOrgsAssetsList } = await import("./list-H6QWWXOU.js");
+          const { runOrgsAssetsList } = await import("./list-5TKOWBC4.js");
           await runOrgsAssetsList({
+            // Optional: organization-scoped API keys resolve the org from the
+            // key, so only pass a slug when one is actually available.
+            slug: await tryResolveOrg(),
             type: cli.flags.type ?? cli.flags.assetType,
             groupId: cli.flags.groupId,
             query: cli.flags.query ?? cli.flags.search,
@@ -1860,17 +1921,17 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-2KCAXU2U.js");
+      const { setupSkill } = await import("./setup-skill-ESJ4HIKR.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-2KCAXU2U.js");
+      const { uninstallSkill } = await import("./setup-skill-ESJ4HIKR.js");
       uninstallSkill({ json: jsonMode });
       break;
     }
     case "completions": {
-      const { printCompletions } = await import("./completions-FEUVEC5N.js");
+      const { printCompletions } = await import("./completions-7DD5E5HL.js");
       printCompletions(subcommand);
       break;
     }

package/dist/{completions-FEUVEC5N.js → completions-7DD5E5HL.js}

@@ -3,7 +3,7 @@ import {
   installCompletions,
   printCompletions,
   uninstallCompletions
-} from "./chunk-P5DJRDMV.js";
+} from "./chunk-TI2HK3NM.js";
 export {
   getCompletionScript,
   installCompletions,

package/dist/{list-H6QWWXOU.js → list-5TKOWBC4.js}

@@ -37,6 +37,7 @@ async function runOrgsAssetsList(options) {
   }
   const client = options.apiClient ?? createApiClient();
   const input = {
+    slug: options.slug,
     type: options.type ? options.type.toUpperCase() : void 0,
     groupId: options.groupId,
     query: options.query,

package/dist/{search-W5QM2IOC.js → search-IWS42COG.js}

@@ -105,7 +105,7 @@ async function runAssetSearch(options) {
       console.error(
         `Error searching ${contents[i]}: ${r.reason instanceof Error ? r.reason.message : String(r.reason)}`
       );
-      return { asset: null, reports: [], takedown: null, blockedBy: [] };
+      return { asset: null, reports: [], scans: [], takedown: null, blockedBy: [] };
     });
     if (errored === contents.length) {
       throw new CliExitError(

package/dist/{setup-skill-2KCAXU2U.js → setup-skill-ESJ4HIKR.js}

@@ -6,8 +6,8 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-55B34HJK.js";
-import "./chunk-P5DJRDMV.js";
+} from "./chunk-LE5ZOOUI.js";
+import "./chunk-TI2HK3NM.js";
 export {
   getBundledSkillContent,
   getBundledSkillVersion,

package/dist/takedown-time-ARGVSPL6.js

@@ -0,0 +1,87 @@
+import {
+  resolveDateRange
+} from "./chunk-S37VFIZY.js";
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-322AVMUH.js";
+import "./chunk-TFCNKBRC.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/metrics/takedown-time.ts
+function formatDuration(hours) {
+  if (hours < 1 / 60) {
+    return `${Math.round(hours * 3600)}s`;
+  }
+  if (hours < 1) {
+    return `${Math.round(hours * 60)}m`;
+  }
+  if (hours < 24) {
+    return `${hours.toFixed(1)}h`;
+  }
+  return `${(hours / 24).toFixed(1)}d`;
+}
+async function runMetricsTakedownTime(options) {
+  const range = resolveDateRange({
+    from: options.from,
+    to: options.to,
+    thisWeek: options.thisWeek
+  });
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.getMetricsTakedownTime({
+    slug: options.org,
+    // The caller's own --from/--to go through untouched when given: the API
+    // reads a date-only value as the whole day, while `resolveDateRange` has
+    // already expanded it to a midnight timestamp, which would cut the final
+    // day off.
+    startDate: options.from ?? range.startDate,
+    endDate: options.to ?? range.endDate,
+    brandIds: options.brandIds
+  });
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  printOutput({
+    outputFormat,
+    json: { ...result, range },
+    markdown: [
+      `# Median Time to Takedown (${options.org}) \u2014 ${range.label}`,
+      "",
+      `- Range: ${range.startDate} \u2192 ${range.endDate}`,
+      "",
+      ...result.byAssetType.map(
+        (row) => `- ${row.assetType}: ${formatDuration(row.medianTakedownHours)} (${row.count} takedowns)`
+      )
+    ].join("\n"),
+    csv: toCsvRows(
+      result.byAssetType.map((row) => ({
+        rangeLabel: range.label,
+        startDate: range.startDate,
+        endDate: range.endDate,
+        assetType: row.assetType,
+        medianTakedownMinutes: row.medianTakedownMinutes,
+        medianTakedownHours: row.medianTakedownHours,
+        medianTakedownDays: row.medianTakedownDays,
+        count: row.count
+      }))
+    ),
+    human: () => {
+      console.log(`Median time to takedown for ${options.org} \u2014 ${range.label}`);
+      console.log(`Range: ${range.startDate} \u2192 ${range.endDate}`);
+      if (result.byAssetType.length === 0) {
+        console.log("No completed takedowns in this range.");
+        return;
+      }
+      for (const row of result.byAssetType) {
+        console.log(
+          `${row.assetType}: ${formatDuration(row.medianTakedownHours)} (${row.count} takedowns)`
+        );
+      }
+    }
+  });
+}
+export {
+  runMetricsTakedownTime
+};

package/dist/takedown-time-trend-LL3ZCCSD.js

@@ -0,0 +1,103 @@
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-322AVMUH.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/metrics/takedown-time-trend.ts
+function formatDuration(hours) {
+  if (hours === null) {
+    return "\u2014";
+  }
+  if (hours < 1 / 60) {
+    return `${Math.round(hours * 3600)}s`;
+  }
+  if (hours < 1) {
+    return `${Math.round(hours * 60)}m`;
+  }
+  if (hours < 24) {
+    return `${hours.toFixed(1)}h`;
+  }
+  return `${(hours / 24).toFixed(1)}d`;
+}
+function formatPercentChange(percentChange) {
+  if (percentChange === null) {
+    return "no comparable earlier month";
+  }
+  const sign = percentChange > 0 ? "+" : "";
+  return `${sign}${percentChange.toFixed(1)}%`;
+}
+async function runMetricsTakedownTimeTrend(options) {
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.getMetricsTakedownTimeTrend({
+    slug: options.org,
+    months: options.months,
+    assetTypes: options.assetTypes,
+    brandIds: options.brandIds
+  });
+  const seriesLabel = (assetType) => assetType ?? "All asset types";
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  printOutput({
+    outputFormat,
+    json: result,
+    markdown: [
+      `# Median Time to Takedown Trend (${options.org}) \u2014 last ${result.months} months`,
+      "",
+      ...result.series.flatMap((series) => [
+        `## ${seriesLabel(series.assetType)}`,
+        "",
+        `- Month over month: ${formatPercentChange(series.change.percentChange)}${series.change.direction ? ` (${series.change.direction})` : ""}`,
+        "",
+        "| Month | Median | Takedowns |",
+        "| --- | --- | --- |",
+        ...series.points.map(
+          (point) => `| ${point.period} | ${formatDuration(point.medianTakedownHours)} | ${point.count} |`
+        ),
+        ""
+      ])
+    ].join("\n"),
+    csv: toCsvRows(
+      result.series.flatMap(
+        (series) => series.points.map((point) => ({
+          assetType: series.assetType ?? "",
+          period: point.period,
+          medianTakedownMinutes: point.medianTakedownMinutes,
+          medianTakedownHours: point.medianTakedownHours,
+          medianTakedownDays: point.medianTakedownDays,
+          count: point.count,
+          percentChange: series.change.percentChange,
+          direction: series.change.direction
+        }))
+      )
+    ),
+    human: () => {
+      console.log(
+        `Median time to takedown trend for ${options.org} \u2014 last ${result.months} months`
+      );
+      for (const series of result.series) {
+        console.log("");
+        console.log(seriesLabel(series.assetType));
+        for (const point of series.points) {
+          console.log(
+            `  ${point.period}: ${formatDuration(point.medianTakedownHours)} (${point.count} takedowns)`
+          );
+        }
+        const { latest, previous, percentChange, direction } = series.change;
+        if (latest && previous && percentChange !== null) {
+          console.log(
+            `  Month over month (${previous.period} \u2192 ${latest.period}): ${formatPercentChange(percentChange)} \u2014 ${direction}`
+          );
+        } else {
+          console.log(`  Month over month: ${formatPercentChange(percentChange)}`);
+        }
+      }
+    }
+  });
+}
+export {
+  runMetricsTakedownTimeTrend
+};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [
@@ -33,7 +33,7 @@
     "lint": "npx oxlint ."
   },
   "dependencies": {
-    "@chainpatrol/sdk": "1.6.0",
+    "@chainpatrol/sdk": "1.8.0",
     "ink": "^7.0.1",
     "meow": "^14.1.0",
     "open": "^11.0.0",