@chainpatrol/cli 1.7.0 → 1.9.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @chainpatrol/cli
 
+## 1.9.0
+
+### Minor Changes
+
+- 9347b6a: Add `takedownsInProgress` and `takedownsCancelled` to the `/organization/metrics` endpoint, available as `--include` values and as fields on the metrics payload.
+
+### Patch Changes
+
+- Updated dependencies [9347b6a]
+  - @chainpatrol/sdk@1.9.0
+
+## 1.8.0
+
+### Minor Changes
+
+- 33ba556: Adds time-to-takedown trends: `client.getMetricsTakedownTimeTrend()` in the SDK
+  and `chainpatrol metrics takedown-time-trend --org <slug>` in the CLI, both
+  backed by the new `POST /metrics/takedown-time/trend` endpoint. Returns the
+  median time from takedown start to completion bucketed by the month a takedown
+  completed, over a trailing window of whole months, plus the month-over-month
+  change for each series. Pass `assetTypes` (max 5) to get one series per asset
+  type instead of a single pooled series.
+
+  The month-over-month comparison uses the two most recent months that actually
+  had completed takedowns, so a quiet month in between doesn't read as "no
+  change", and `direction` reads lower-is-better: `"improved"` means the median
+  fell. Months with no completed takedowns carry a `null` median rather than zero.
+
+  Server-side work lives in @chainpatrol/external-trpc, @chainpatrol/validation
+  and @chainpatrol/metrics; all three are private packages and don't need version
+  bumps. The endpoint is gated on the new `median-time-to-takedown-trends-api`
+  feature flag, separate from the flag on `POST /metrics/takedown-time`.
+
+### Patch Changes
+
+- Updated dependencies [33ba556]
+  - @chainpatrol/sdk@1.8.0
+
 ## 1.7.0
 
 ### Minor Changes

package/dist/{chunk-YMO4QK6Q.js → chunk-LE5ZOOUI.js}

@@ -1,7 +1,7 @@
 import {
   installCompletions,
   uninstallCompletions
-} from "./chunk-7BZUQSRO.js";
+} from "./chunk-TI2HK3NM.js";
 
 // src/commands/setup-skill.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, readFileSync as readFileSync3, rmSync } from "fs";

package/dist/{chunk-7BZUQSRO.js → chunk-TI2HK3NM.js}

@@ -95,6 +95,7 @@ _chainpatrol() {
           'found:Show found threats count'
           'breakdown:Show metrics breakdown'
           'takedown-time:Show median time to takedown by asset type'
+          'takedown-time-trend:Show month-over-month median time-to-takedown trend'
           'organization:Get organization metrics (official endpoint)'
         )
         _describe 'subcommand' metrics_subcommands

package/dist/cli.js

@@ -13,8 +13,8 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-YMO4QK6Q.js";
-import "./chunk-7BZUQSRO.js";
+} from "./chunk-LE5ZOOUI.js";
+import "./chunk-TI2HK3NM.js";
 import {
   DateTime
 } from "./chunk-TFCNKBRC.js";
@@ -287,6 +287,7 @@ var HELP = {
       "chainpatrol metrics found --org acme --from 2025-01-01 --to 2025-02-01",
       "chainpatrol metrics breakdown --org acme --by day --this-week",
       "chainpatrol metrics takedown-time --org acme --from 2025-01-01 --to 2025-02-01",
+      "chainpatrol metrics takedown-time-trend --org acme --months 12",
       "chainpatrol metrics organization --org acme --from 2025-01-01 --to 2025-02-01"
     ]
   },
@@ -303,7 +304,7 @@ var HELP = {
       "--from <iso>                  Start date (ISO 8601, e.g. 2026-01-01)",
       "--to <iso>                    End date (ISO 8601)",
       "--this-week                   Use the current ISO week (overrides default)",
-      "--include <list>              Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsCompleted,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
+      "--include <list>              Comma list of fields to compute: reports,newThreats,threatsWatchlisted,takedownsFiled,takedownsInProgress,takedownsCompleted,takedownsCancelled,domainThreats,twitterThreats,telegramThreats,otherThreats,blockedByType,blockedByDay (omit for all)"
     ],
     examples: [
       "chainpatrol metrics organization --org acme                                           # defaults to last 3 months",
@@ -358,6 +359,16 @@ var HELP = {
       "--brand <ids>         Comma-separated brand IDs"
     ]
   },
+  "metrics takedown-time-trend": {
+    description: "Median time from takedown start to completion bucketed by month, over a trailing window, with the month-over-month change.",
+    usage: "chainpatrol metrics takedown-time-trend --org <slug> [--months 12] [--asset-type TWITTER,URL]",
+    options: [
+      "--org <slug>          Organization slug",
+      "--months <n>          Trailing window in whole months (2-36, default 12)",
+      "--asset-type <types>  Comma-separated asset types to break the trend down by (max 5)",
+      "--brand <ids>         Comma-separated brand IDs"
+    ]
+  },
   reports: {
     description: "Create, list, and search reports from the terminal.",
     usage: "chainpatrol reports <create|list|search>",
@@ -967,6 +978,7 @@ ${getTopLevelHelp()}
     to: { type: "string" },
     thisWeek: { type: "boolean", default: false },
     by: { type: "string" },
+    months: { type: "number" },
     include: { type: "string" },
     slugs: { type: "string" },
     allMyOrgs: { type: "boolean", default: false },
@@ -1479,7 +1491,7 @@ async function main() {
         const slugs = parseCsvList(cli.flags.slugs);
         const allMyOrgs = cli.flags.allMyOrgs;
         const org2 = slugs && slugs.length > 0 || allMyOrgs ? void 0 : await tryResolveOrg();
-        const { runMetricsOrganization } = await import("./organization-YAID36GZ.js");
+        const { runMetricsOrganization } = await import("./organization-SSCPM7XN.js");
         await runMetricsOrganization({
           org: org2,
           slugs,
@@ -1536,6 +1548,18 @@ async function main() {
         });
         break;
       }
+      if (subcommand === "takedown-time-trend" || subcommand === "takedownTimeTrend") {
+        const { runMetricsTakedownTimeTrend } = await import("./takedown-time-trend-LL3ZCCSD.js");
+        await runMetricsTakedownTimeTrend({
+          org,
+          months: cli.flags.months,
+          assetTypes: parseCsvList(cli.flags.assetType),
+          brandIds: parseBrandIds(),
+          json: jsonMode,
+          outputFormat: cliContext.outputFormat
+        });
+        break;
+      }
       if (subcommand === "breakdown") {
         const by = cli.flags.by;
         if (!by || !["day", "type", "brand"].includes(by)) {
@@ -1559,10 +1583,11 @@ async function main() {
         "found",
         "breakdown",
         "takedown-time",
+        "takedown-time-trend",
         "organization"
       ]) : null;
       throw new Error(
-        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|takedown-time|organization>"
+        subcommand ? `Unknown subcommand: metrics ${subcommand}${hint ? `. Did you mean "metrics ${hint}"?` : ""}` : "Usage: chainpatrol metrics <summary|found|breakdown|takedown-time|takedown-time-trend|organization>"
       );
     }
     case "reports": {
@@ -1896,17 +1921,17 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-LP5Z3Z5T.js");
+      const { setupSkill } = await import("./setup-skill-ESJ4HIKR.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-LP5Z3Z5T.js");
+      const { uninstallSkill } = await import("./setup-skill-ESJ4HIKR.js");
       uninstallSkill({ json: jsonMode });
       break;
     }
     case "completions": {
-      const { printCompletions } = await import("./completions-3ESPMO65.js");
+      const { printCompletions } = await import("./completions-7DD5E5HL.js");
       printCompletions(subcommand);
       break;
     }

package/dist/{completions-3ESPMO65.js → completions-7DD5E5HL.js}

@@ -3,7 +3,7 @@ import {
   installCompletions,
   printCompletions,
   uninstallCompletions
-} from "./chunk-7BZUQSRO.js";
+} from "./chunk-TI2HK3NM.js";
 export {
   getCompletionScript,
   installCompletions,

package/dist/{organization-YAID36GZ.js → organization-SSCPM7XN.js}

@@ -42,7 +42,9 @@ var METRIC_LABELS = [
   ["newThreats", "New threats"],
   ["threatsWatchlisted", "Watchlisted threats"],
   ["takedownsFiled", "Takedowns filed"],
+  ["takedownsInProgress", "Takedowns in-progress"],
   ["takedownsCompleted", "Takedowns completed"],
+  ["takedownsCancelled", "Takedowns cancelled"],
   ["domainThreats", "Domain threats"],
   ["twitterThreats", "Twitter threats"],
   ["telegramThreats", "Telegram threats"],
@@ -66,10 +68,9 @@ function formatAverage(value) {
   return Number.isInteger(value) ? String(value) : value.toFixed(2);
 }
 function populatedMetricRows(metrics, format = (v) => String(v)) {
-  return METRIC_LABELS.filter(([key]) => metrics[key] !== null).map(([key, label]) => [
-    label,
-    format(metrics[key])
-  ]);
+  return METRIC_LABELS.filter(([key]) => (metrics[key] ?? null) !== null).map(
+    ([key, label]) => [label, format(metrics[key] ?? null)]
+  );
 }
 async function runMetricsOrganization(options) {
   const explicitForms = [
@@ -231,7 +232,9 @@ function buildCsvRows({
     newThreats: metrics.newThreats,
     threatsWatchlisted: metrics.threatsWatchlisted,
     takedownsFiled: metrics.takedownsFiled,
+    takedownsInProgress: metrics.takedownsInProgress,
     takedownsCompleted: metrics.takedownsCompleted,
+    takedownsCancelled: metrics.takedownsCancelled,
     domainThreats: metrics.domainThreats,
     twitterThreats: metrics.twitterThreats,
     telegramThreats: metrics.telegramThreats,

package/dist/{setup-skill-LP5Z3Z5T.js → setup-skill-ESJ4HIKR.js}

@@ -6,8 +6,8 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-YMO4QK6Q.js";
-import "./chunk-7BZUQSRO.js";
+} from "./chunk-LE5ZOOUI.js";
+import "./chunk-TI2HK3NM.js";
 export {
   getBundledSkillContent,
   getBundledSkillVersion,

package/dist/takedown-time-trend-LL3ZCCSD.js

@@ -0,0 +1,103 @@
+import {
+  printOutput,
+  toCsvRows
+} from "./chunk-VFT3TD3E.js";
+import {
+  createApiClient
+} from "./chunk-322AVMUH.js";
+import "./chunk-EGWK6SRQ.js";
+import "./chunk-U73SABXK.js";
+
+// src/commands/metrics/takedown-time-trend.ts
+function formatDuration(hours) {
+  if (hours === null) {
+    return "\u2014";
+  }
+  if (hours < 1 / 60) {
+    return `${Math.round(hours * 3600)}s`;
+  }
+  if (hours < 1) {
+    return `${Math.round(hours * 60)}m`;
+  }
+  if (hours < 24) {
+    return `${hours.toFixed(1)}h`;
+  }
+  return `${(hours / 24).toFixed(1)}d`;
+}
+function formatPercentChange(percentChange) {
+  if (percentChange === null) {
+    return "no comparable earlier month";
+  }
+  const sign = percentChange > 0 ? "+" : "";
+  return `${sign}${percentChange.toFixed(1)}%`;
+}
+async function runMetricsTakedownTimeTrend(options) {
+  const client = options.apiClient ?? createApiClient();
+  const result = await client.getMetricsTakedownTimeTrend({
+    slug: options.org,
+    months: options.months,
+    assetTypes: options.assetTypes,
+    brandIds: options.brandIds
+  });
+  const seriesLabel = (assetType) => assetType ?? "All asset types";
+  const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
+  printOutput({
+    outputFormat,
+    json: result,
+    markdown: [
+      `# Median Time to Takedown Trend (${options.org}) \u2014 last ${result.months} months`,
+      "",
+      ...result.series.flatMap((series) => [
+        `## ${seriesLabel(series.assetType)}`,
+        "",
+        `- Month over month: ${formatPercentChange(series.change.percentChange)}${series.change.direction ? ` (${series.change.direction})` : ""}`,
+        "",
+        "| Month | Median | Takedowns |",
+        "| --- | --- | --- |",
+        ...series.points.map(
+          (point) => `| ${point.period} | ${formatDuration(point.medianTakedownHours)} | ${point.count} |`
+        ),
+        ""
+      ])
+    ].join("\n"),
+    csv: toCsvRows(
+      result.series.flatMap(
+        (series) => series.points.map((point) => ({
+          assetType: series.assetType ?? "",
+          period: point.period,
+          medianTakedownMinutes: point.medianTakedownMinutes,
+          medianTakedownHours: point.medianTakedownHours,
+          medianTakedownDays: point.medianTakedownDays,
+          count: point.count,
+          percentChange: series.change.percentChange,
+          direction: series.change.direction
+        }))
+      )
+    ),
+    human: () => {
+      console.log(
+        `Median time to takedown trend for ${options.org} \u2014 last ${result.months} months`
+      );
+      for (const series of result.series) {
+        console.log("");
+        console.log(seriesLabel(series.assetType));
+        for (const point of series.points) {
+          console.log(
+            `  ${point.period}: ${formatDuration(point.medianTakedownHours)} (${point.count} takedowns)`
+          );
+        }
+        const { latest, previous, percentChange, direction } = series.change;
+        if (latest && previous && percentChange !== null) {
+          console.log(
+            `  Month over month (${previous.period} \u2192 ${latest.period}): ${formatPercentChange(percentChange)} \u2014 ${direction}`
+          );
+        } else {
+          console.log(`  Month over month: ${formatPercentChange(percentChange)}`);
+        }
+      }
+    }
+  });
+}
+export {
+  runMetricsTakedownTimeTrend
+};

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [
@@ -33,7 +33,7 @@
     "lint": "npx oxlint ."
   },
   "dependencies": {
-    "@chainpatrol/sdk": "1.7.0",
+    "@chainpatrol/sdk": "1.9.0",
     "ink": "^7.0.1",
     "meow": "^14.1.0",
     "open": "^11.0.0",