@chainpatrol/sdk 1.7.0 → 1.9.0

package/dist/index.mjs

@@ -1255,17 +1255,17 @@ var PolyDateFormatter = class {
   constructor(dt, intl, opts) {
     this.opts = opts;
     this.originalZone = void 0;
-    let z54 = void 0;
+    let z56 = void 0;
     if (this.opts.timeZone) {
       this.dt = dt;
     } else if (dt.zone.type === "fixed") {
       const gmtOffset = -1 * (dt.offset / 60);
       const offsetZ = gmtOffset >= 0 ? `Etc/GMT+${gmtOffset}` : `Etc/GMT${gmtOffset}`;
       if (dt.offset !== 0 && IANAZone.create(offsetZ).valid) {
-        z54 = offsetZ;
+        z56 = offsetZ;
         this.dt = dt;
       } else {
-        z54 = "UTC";
+        z56 = "UTC";
         this.dt = dt.offset === 0 ? dt : dt.setZone("UTC").plus({ minutes: dt.offset });
         this.originalZone = dt.zone;
       }
@@ -1273,14 +1273,14 @@ var PolyDateFormatter = class {
       this.dt = dt;
     } else if (dt.zone.type === "iana") {
       this.dt = dt;
-      z54 = dt.zone.name;
+      z56 = dt.zone.name;
     } else {
-      z54 = "UTC";
+      z56 = "UTC";
       this.dt = dt.setZone("UTC").plus({ minutes: dt.offset });
       this.originalZone = dt.zone;
     }
     const intlOpts = __spreadValues({}, this.opts);
-    intlOpts.timeZone = intlOpts.timeZone || z54;
+    intlOpts.timeZone = intlOpts.timeZone || z56;
     this.dtf = getCachedDTF(intl, intlOpts);
   }
   format() {
@@ -11430,6 +11430,50 @@ z.object({
     endDate: z.date()
   })
 });
+var DATE_ONLY_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+var utcDateSchema = (endOfDay) => z.preprocess((value) => {
+  if (typeof value !== "string") {
+    return value;
+  }
+  const parsed = DateTime.fromISO(value, { zone: "utc" });
+  if (!parsed.isValid) {
+    return new Date(Number.NaN);
+  }
+  return endOfDay && DATE_ONLY_PATTERN.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
+}, z.coerce.date());
+var funnelCountsSchema = z.object({
+  blocked: z.number().int().nonnegative().describe(
+    "Distinct assets whose earliest report for this org falls in the range and whose current status or pending status is BLOCKED"
+  )
+});
+z.object({
+  slug: z.string().min(1).describe("Organization slug"),
+  startDate: utcDateSchema(false).describe(
+    "Only include assets whose earliest report was created on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+  ),
+  endDate: utcDateSchema(true).describe(
+    "Only include assets whose earliest report was created on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+  ),
+  brandIds: z.array(z.number().int().positive()).optional().describe("Only include assets belonging to these brands")
+}).refine((input) => input.startDate.getTime() <= input.endDate.getTime(), {
+  message: "startDate must be on or before endDate",
+  path: ["startDate"]
+});
+z.object({
+  range: z.object({
+    startDate: z.date(),
+    endDate: z.date()
+  }),
+  customer: funnelCountsSchema.describe(
+    "Currently blocked assets first reported by the customer (reportedByCustomer, external reporter, or customer-role user)"
+  ),
+  chainpatrol: funnelCountsSchema.describe(
+    "Currently blocked assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed together."
+  ),
+  totals: funnelCountsSchema.describe(
+    "customer + chainpatrol. This is a first-report blocked cohort and does not equal metrics/found, which counts assets by blockedAt."
+  )
+});
 z.object({
   slug: z.string().min(1),
   startDate: z.date().optional(),
@@ -11461,8 +11505,8 @@ z.object({
     })
   )
 });
-var DATE_ONLY_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
-var utcDateSchema = (endOfDay) => z.preprocess((value) => {
+var DATE_ONLY_PATTERN2 = /^\d{4}-\d{2}-\d{2}$/;
+var utcDateSchema2 = (endOfDay) => z.preprocess((value) => {
   if (typeof value !== "string") {
     return value;
   }
@@ -11470,14 +11514,14 @@ var utcDateSchema = (endOfDay) => z.preprocess((value) => {
   if (!parsed.isValid) {
     return new Date(Number.NaN);
   }
-  return endOfDay && DATE_ONLY_PATTERN.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
+  return endOfDay && DATE_ONLY_PATTERN2.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
 }, z.coerce.date());
 z.object({
   slug: z.string().min(1).describe("Organization slug"),
-  startDate: utcDateSchema(false).optional().describe(
+  startDate: utcDateSchema2(false).optional().describe(
     "Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
   ),
-  endDate: utcDateSchema(true).optional().describe(
+  endDate: utcDateSchema2(true).optional().describe(
     "Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
   ),
   blockLabel: z.string().optional().describe(
@@ -11500,6 +11544,55 @@ z.object({
     "Median time from takedown start to completion, one entry per asset type, ascending by median"
   )
 });
+z.object({
+  slug: z.string().min(1).describe("Organization slug"),
+  months: z.number().int().min(2).max(36).default(12).describe("Size of the trailing window in whole months, including the current month"),
+  assetTypes: z.array(z.nativeEnum(AssetType)).max(5).optional().describe(
+    "Break the trend down by these asset types, one series each. Omit for a single series pooled across every asset type"
+  ),
+  blockLabel: z.string().optional().describe(
+    'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+  ),
+  brandType: z.nativeEnum(BrandType).optional().describe("Only include assets belonging to brands of this type"),
+  countryCodes: z.array(z.string().length(2)).optional().describe("Only include assets scanned from these ISO 3166-1 alpha-2 countries"),
+  brandIds: z.array(z.number().int().positive()).optional().describe("Only include assets belonging to these brands")
+});
+var MetricsTakedownTimeTrendPointSchema = z.object({
+  period: z.string().describe("Month the takedowns completed in, as a yyyy-MM key"),
+  medianTakedownMinutes: z.number().nullable().describe("Null when no takedowns completed in this month"),
+  medianTakedownHours: z.number().nullable(),
+  medianTakedownDays: z.number().nullable(),
+  count: z.number().describe("Number of completed takedowns behind the median")
+});
+var MetricsTakedownTimeTrendChangeSchema = z.object({
+  latest: MetricsTakedownTimeTrendPointSchema.nullable().describe(
+    "Most recent month in the window that had completed takedowns"
+  ),
+  previous: MetricsTakedownTimeTrendPointSchema.nullable().describe(
+    "Month with completed takedowns immediately before `latest`, skipping empty months"
+  ),
+  percentChange: z.number().nullable().describe(
+    "Change in the median from `previous` to `latest`, as a percentage. Negative means takedowns got faster. Null when there is no comparable earlier month"
+  ),
+  direction: z.enum(["improved", "worsened", "unchanged"]).nullable().describe("Sign of `percentChange`, read as lower-is-better. Null when it is null")
+});
+z.object({
+  months: z.number().describe("Size of the trailing window that was used"),
+  periods: z.array(z.string()).describe("Every yyyy-MM key in the window, oldest first"),
+  series: z.array(
+    z.object({
+      assetType: z.nativeEnum(AssetType).nullable().describe("Null for the series pooled across every asset type"),
+      points: z.array(MetricsTakedownTimeTrendPointSchema).describe(
+        "One point per month in the window, oldest first. Months with no completed takedowns carry a null median"
+      ),
+      change: MetricsTakedownTimeTrendChangeSchema.describe(
+        "Month-over-month comparison for this series"
+      )
+    })
+  ).describe(
+    "One series per requested asset type, in the order requested, or a single pooled series when no asset types were given"
+  )
+});
 z.object({
   slug: z.string().optional().describe(
     "Organization slug. Optional for organization-scoped API keys, which resolve the organization from the key itself. Required when your credentials can reach more than one organization."
@@ -11886,7 +11979,9 @@ var organizationMetricsIncludeFieldSchema = z.enum([
   "newThreats",
   "threatsWatchlisted",
   "takedownsFiled",
+  "takedownsInProgress",
   "takedownsCompleted",
+  "takedownsCancelled",
   "domainThreats",
   "twitterThreats",
   "telegramThreats",
@@ -11928,7 +12023,7 @@ z.object({
   startDate: z.coerce.date().optional(),
   endDate: z.coerce.date().optional(),
   include: z.array(organizationMetricsIncludeFieldSchema).optional().describe(
-    "Subset of metrics to compute. When omitted or empty, every metric is computed (legacy behavior). Each value in `include` costs roughly one Prisma aggregate, so narrow the list when an agent only needs a couple of numbers \u2014 this is the main lever for keeping big-org calls inside the 30s function cap. Fields not in `include` come back as `null`."
+    "Subset of metrics to compute. When omitted or empty, every metric is computed (legacy behavior). Each value in `include` costs roughly one aggregate query, so narrow the list when an agent only needs a couple of numbers \u2014 this is the main lever for keeping big-org calls inside the 30s function cap. Fields not in `include` come back as `null`. `takedownsInProgress` and `takedownsCancelled` count takedowns currently in that status whose `updatedAt` falls in the window (same windowing as `takedownsFiled`), so they reconcile with the takedowns list filtered by status over the same date range."
   )
 }).refine(
   (value) => {
@@ -11956,7 +12051,9 @@ var metricsObjectSchema = z.object({
   newThreats: metricValue,
   threatsWatchlisted: metricValue,
   takedownsFiled: metricValue,
+  takedownsInProgress: metricValue,
   takedownsCompleted: metricValue,
+  takedownsCancelled: metricValue,
   domainThreats: metricValue,
   twitterThreats: metricValue,
   telegramThreats: metricValue,
@@ -13339,20 +13436,20 @@ var convertA98ToXyz65_default = convertA98ToXyz65;
 
 // ../../node_modules/culori/src/a98/convertXyz65ToA98.js
 var gamma = (v) => Math.pow(Math.abs(v), 256 / 563) * Math.sign(v);
-var convertXyz65ToA98 = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToA98 = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = {
     mode: "a98",
     r: gamma(
-      x * 2.0415879038107465 - y * 0.5650069742788597 - 0.3447313507783297 * z54
+      x * 2.0415879038107465 - y * 0.5650069742788597 - 0.3447313507783297 * z56
     ),
     g: gamma(
-      x * -0.9692436362808798 + y * 1.8759675015077206 + 0.0415550574071756 * z54
+      x * -0.9692436362808798 + y * 1.8759675015077206 + 0.0415550574071756 * z56
     ),
     b: gamma(
-      x * 0.0134442806320312 - y * 0.1183623922310184 + 1.0151749943912058 * z54
+      x * 0.0134442806320312 - y * 0.1183623922310184 + 1.0151749943912058 * z56
     )
   };
   if (alpha !== void 0) {
@@ -13419,14 +13516,14 @@ var convertLrgbToRgb = ({ r, g, b, alpha }, mode = "rgb") => {
 var convertLrgbToRgb_default = convertLrgbToRgb;
 
 // ../../node_modules/culori/src/xyz65/convertXyz65ToRgb.js
-var convertXyz65ToRgb = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToRgb = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = convertLrgbToRgb_default({
-    r: x * 3.2409699419045226 - y * 1.537383177570094 - 0.4986107602930034 * z54,
-    g: x * -0.9692436362808796 + y * 1.8759675015077204 + 0.0415550574071756 * z54,
-    b: x * 0.0556300796969936 - y * 0.2039769588889765 + 1.0569715142428784 * z54
+    r: x * 3.2409699419045226 - y * 1.537383177570094 - 0.4986107602930034 * z56,
+    g: x * -0.9692436362808796 + y * 1.8759675015077204 + 0.0415550574071756 * z56,
+    b: x * 0.0556300796969936 - y * 0.2039769588889765 + 1.0569715142428784 * z56
   });
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -13676,13 +13773,13 @@ var convertLab65ToRgb_default = convertLab65ToRgb;
 
 // ../../node_modules/culori/src/lab65/convertXyz65ToLab65.js
 var f = (value) => value > e ? Math.cbrt(value) : (k * value + 16) / 116;
-var convertXyz65ToLab65 = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToLab65 = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let f0 = f(x / D65.X);
   let f1 = f(y / D65.Y);
-  let f22 = f(z54 / D65.Z);
+  let f22 = f(z56 / D65.Z);
   let res = {
     mode: "lab65",
     l: 116 * f1 - 16,
@@ -14339,10 +14436,10 @@ var convertItpToXyz65_default = convertItpToXyz65;
 
 // ../../node_modules/culori/src/itp/convertXyz65ToItp.js
 var toAbs = (c2 = 0) => Math.max(c2 * YW, 0);
-var convertXyz65ToItp = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToItp = ({ x, y, z: z56, alpha }) => {
   const absX = toAbs(x);
   const absY = toAbs(y);
-  const absZ = toAbs(z54);
+  const absZ = toAbs(z56);
   const l2 = transferPqEncode(
     0.3592832590121217 * absX + 0.6976051147779502 * absY - 0.0358915932320289 * absZ
   );
@@ -14400,15 +14497,15 @@ var jabPqEncode = (v) => {
   return Math.pow((C1 + C2 * vn3) / (1 + C3 * vn3), p);
 };
 var abs = (v = 0) => Math.max(v * 203, 0);
-var convertXyz65ToJab = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToJab = ({ x, y, z: z56, alpha }) => {
   x = abs(x);
   y = abs(y);
-  z54 = abs(z54);
-  let xp = 1.15 * x - 0.15 * z54;
+  z56 = abs(z56);
+  let xp = 1.15 * x - 0.15 * z56;
   let yp = 0.66 * y + 0.34 * x;
-  let l2 = jabPqEncode(0.41478972 * xp + 0.579999 * yp + 0.014648 * z54);
-  let m = jabPqEncode(-0.20151 * xp + 1.120649 * yp + 0.0531008 * z54);
-  let s2 = jabPqEncode(-0.0166008 * xp + 0.2648 * yp + 0.6684799 * z54);
+  let l2 = jabPqEncode(0.41478972 * xp + 0.579999 * yp + 0.014648 * z56);
+  let m = jabPqEncode(-0.20151 * xp + 1.120649 * yp + 0.0531008 * z56);
+  let s2 = jabPqEncode(-0.0166008 * xp + 0.2648 * yp + 0.6684799 * z56);
   let i = (l2 + m) / 2;
   let res = {
     mode: "jab",
@@ -14594,14 +14691,14 @@ var convertLabToXyz50 = ({ l: l2, a, b, alpha }) => {
 var convertLabToXyz50_default = convertLabToXyz50;
 
 // ../../node_modules/culori/src/xyz50/convertXyz50ToRgb.js
-var convertXyz50ToRgb = ({ x, y, z: z54, alpha }) => {
+var convertXyz50ToRgb = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = convertLrgbToRgb_default({
-    r: x * 3.1341359569958707 - y * 1.6173863321612538 - 0.4906619460083532 * z54,
-    g: x * -0.978795502912089 + y * 1.916254567259524 + 0.03344273116131949 * z54,
-    b: x * 0.07195537988411677 - y * 0.2289768264158322 + 1.405386058324125 * z54
+    r: x * 3.1341359569958707 - y * 1.6173863321612538 - 0.4906619460083532 * z56,
+    g: x * -0.978795502912089 + y * 1.916254567259524 + 0.03344273116131949 * z56,
+    b: x * 0.07195537988411677 - y * 0.2289768264158322 + 1.405386058324125 * z56
   });
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -14632,13 +14729,13 @@ var convertRgbToXyz50_default = convertRgbToXyz50;
 
 // ../../node_modules/culori/src/lab/convertXyz50ToLab.js
 var f2 = (value) => value > e3 ? Math.cbrt(value) : (k3 * value + 16) / 116;
-var convertXyz50ToLab = ({ x, y, z: z54, alpha }) => {
+var convertXyz50ToLab = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let f0 = f2(x / D50.X);
   let f1 = f2(y / D50.Y);
-  let f22 = f2(z54 / D50.Z);
+  let f22 = f2(z56 / D50.Z);
   let res = {
     mode: "lab",
     l: 116 * f1 - 16,
@@ -14873,18 +14970,18 @@ var convertLchuvToLuv = ({ l: l2, c: c2, h, alpha }) => {
 var convertLchuvToLuv_default = convertLchuvToLuv;
 
 // ../../node_modules/culori/src/luv/convertXyz50ToLuv.js
-var u_fn = (x, y, z54) => 4 * x / (x + 15 * y + 3 * z54);
-var v_fn = (x, y, z54) => 9 * y / (x + 15 * y + 3 * z54);
+var u_fn = (x, y, z56) => 4 * x / (x + 15 * y + 3 * z56);
+var v_fn = (x, y, z56) => 9 * y / (x + 15 * y + 3 * z56);
 var un = u_fn(D50.X, D50.Y, D50.Z);
 var vn = v_fn(D50.X, D50.Y, D50.Z);
 var l_fn = (value) => value <= e3 ? k3 * value : 116 * Math.cbrt(value) - 16;
-var convertXyz50ToLuv = ({ x, y, z: z54, alpha }) => {
+var convertXyz50ToLuv = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let l2 = l_fn(y / D50.Y);
-  let u = u_fn(x, y, z54);
-  let v = v_fn(x, y, z54);
+  let u = u_fn(x, y, z56);
+  let v = v_fn(x, y, z56);
   if (!isFinite(u) || !isFinite(v)) {
     l2 = u = v = 0;
   } else {
@@ -14905,8 +15002,8 @@ var convertXyz50ToLuv = ({ x, y, z: z54, alpha }) => {
 var convertXyz50ToLuv_default = convertXyz50ToLuv;
 
 // ../../node_modules/culori/src/luv/convertLuvToXyz50.js
-var u_fn2 = (x, y, z54) => 4 * x / (x + 15 * y + 3 * z54);
-var v_fn2 = (x, y, z54) => 9 * y / (x + 15 * y + 3 * z54);
+var u_fn2 = (x, y, z56) => 4 * x / (x + 15 * y + 3 * z56);
+var v_fn2 = (x, y, z56) => 9 * y / (x + 15 * y + 3 * z56);
 var un2 = u_fn2(D50.X, D50.Y, D50.Z);
 var vn2 = v_fn2(D50.X, D50.Y, D50.Z);
 var convertLuvToXyz50 = ({ l: l2, u, v, alpha }) => {
@@ -14920,8 +15017,8 @@ var convertLuvToXyz50 = ({ l: l2, u, v, alpha }) => {
   let vp = v / (13 * l2) + vn2;
   let y = D50.Y * (l2 <= 8 ? l2 / k3 : Math.pow((l2 + 16) / 116, 3));
   let x = y * (9 * up) / (4 * vp);
-  let z54 = y * (12 - 3 * up - 20 * vp) / (4 * vp);
-  let res = { mode: "xyz50", x, y, z: z54 };
+  let z56 = y * (12 - 3 * up - 20 * vp) / (4 * vp);
+  let res = { mode: "xyz50", x, y, z: z56 };
   if (alpha !== void 0) {
     res.alpha = alpha;
   }
@@ -15538,15 +15635,15 @@ var convertP3ToXyz65 = (rgb2) => {
 var convertP3ToXyz65_default = convertP3ToXyz65;
 
 // ../../node_modules/culori/src/p3/convertXyz65ToP3.js
-var convertXyz65ToP3 = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToP3 = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = convertLrgbToRgb_default(
     {
-      r: x * 2.4934969119414263 - y * 0.9313836179191242 - 0.402710784450717 * z54,
-      g: x * -0.8294889695615749 + y * 1.7626640603183465 + 0.0236246858419436 * z54,
-      b: x * 0.0358458302437845 - y * 0.0761723892680418 + 0.9568845240076871 * z54
+      r: x * 2.4934969119414263 - y * 0.9313836179191242 - 0.402710784450717 * z56,
+      g: x * -0.8294889695615749 + y * 1.7626640603183465 + 0.0236246858419436 * z56,
+      b: x * 0.0358458302437845 - y * 0.0761723892680418 + 0.9568845240076871 * z56
     },
     "p3"
   );
@@ -15581,19 +15678,19 @@ var gamma2 = (v) => {
   }
   return 16 * v;
 };
-var convertXyz50ToProphoto = ({ x, y, z: z54, alpha }) => {
+var convertXyz50ToProphoto = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = {
     mode: "prophoto",
     r: gamma2(
-      x * 1.3457868816471585 - y * 0.2555720873797946 - 0.0511018649755453 * z54
+      x * 1.3457868816471585 - y * 0.2555720873797946 - 0.0511018649755453 * z56
     ),
     g: gamma2(
-      x * -0.5446307051249019 + y * 1.5082477428451466 + 0.0205274474364214 * z54
+      x * -0.5446307051249019 + y * 1.5082477428451466 + 0.0205274474364214 * z56
     ),
-    b: gamma2(x * 0 + y * 0 + 1.2119675456389452 * z54)
+    b: gamma2(x * 0 + y * 0 + 1.2119675456389452 * z56)
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -15653,20 +15750,20 @@ var gamma3 = (v) => {
   }
   return 4.5 * v;
 };
-var convertXyz65ToRec2020 = ({ x, y, z: z54, alpha }) => {
+var convertXyz65ToRec2020 = ({ x, y, z: z56, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = {
     mode: "rec2020",
     r: gamma3(
-      x * 1.7166511879712683 - y * 0.3556707837763925 - 0.2533662813736599 * z54
+      x * 1.7166511879712683 - y * 0.3556707837763925 - 0.2533662813736599 * z56
     ),
     g: gamma3(
-      x * -0.6666843518324893 + y * 1.6164812366349395 + 0.0157685458139111 * z54
+      x * -0.6666843518324893 + y * 1.6164812366349395 + 0.0157685458139111 * z56
     ),
     b: gamma3(
-      x * 0.0176398574453108 - y * 0.0427706132578085 + 0.9421031212354739 * z54
+      x * 0.0176398574453108 - y * 0.0427706132578085 + 0.9421031212354739 * z56
     )
   };
   if (alpha !== void 0) {
@@ -15819,15 +15916,15 @@ var definition_default26 = definition26;
 
 // ../../node_modules/culori/src/xyz65/convertXyz65ToXyz50.js
 var convertXyz65ToXyz50 = (xyz652) => {
-  let { x, y, z: z54, alpha } = xyz652;
+  let { x, y, z: z56, alpha } = xyz652;
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = {
     mode: "xyz50",
-    x: 1.0479298208405488 * x + 0.0229467933410191 * y - 0.0501922295431356 * z54,
-    y: 0.0296278156881593 * x + 0.990434484573249 * y - 0.0170738250293851 * z54,
-    z: -0.0092430581525912 * x + 0.0150551448965779 * y + 0.7518742899580008 * z54
+    x: 1.0479298208405488 * x + 0.0229467933410191 * y - 0.0501922295431356 * z56,
+    y: 0.0296278156881593 * x + 0.990434484573249 * y - 0.0170738250293851 * z56,
+    z: -0.0092430581525912 * x + 0.0150551448965779 * y + 0.7518742899580008 * z56
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -15838,15 +15935,15 @@ var convertXyz65ToXyz50_default = convertXyz65ToXyz50;
 
 // ../../node_modules/culori/src/xyz65/convertXyz50ToXyz65.js
 var convertXyz50ToXyz65 = (xyz502) => {
-  let { x, y, z: z54, alpha } = xyz502;
+  let { x, y, z: z56, alpha } = xyz502;
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z54 === void 0) z54 = 0;
+  if (z56 === void 0) z56 = 0;
   let res = {
     mode: "xyz65",
-    x: 0.9554734527042182 * x - 0.0230985368742614 * y + 0.0632593086610217 * z54,
-    y: -0.0283697069632081 * x + 1.0099954580058226 * y + 0.021041398966943 * z54,
-    z: 0.0123140016883199 * x - 0.0205076964334779 * y + 1.3303659366080753 * z54
+    x: 0.9554734527042182 * x - 0.0230985368742614 * y + 0.0632593086610217 * z56,
+    y: -0.0283697069632081 * x + 1.0099954580058226 * y + 0.021041398966943 * z56,
+    z: 0.0123140016883199 * x - 0.0205076964334779 * y + 1.3303659366080753 * z56
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -16116,6 +16213,571 @@ z.string().optional().nullable().transform((value) => {
   }
 );
 
+// ../../internal/utils/src/industry.ts
+var Industry = {
+  // Finance
+  BANKING: "banking",
+  FINANCIAL_SERVICES: "financial_services",
+  FINTECH: "fintech",
+  PAYMENTS: "payments"};
+
+// ../../internal/validation/src/dark-web/templates.ts
+var BRAND = { kind: "brand" };
+var lit = (value) => ({ kind: "literal", value });
+var phrase = (...tokens) => ({ type: "phrase", tokens });
+var bn = (slop, ...words) => ({
+  type: "phrase",
+  tokens: [BRAND, ...words.map(lit)],
+  slop
+});
+var nb = (slop, ...words) => ({
+  type: "phrase",
+  tokens: [...words.map(lit), BRAND],
+  slop
+});
+var word = (value) => ({ type: "term", value, match: "word" });
+var prefix = (value) => ({
+  type: "term",
+  value,
+  match: "prefix"
+});
+var or = (...children) => ({
+  type: "group",
+  op: "OR",
+  children
+});
+var and = (...children) => ({
+  type: "group",
+  op: "AND",
+  children
+});
+var notOneOf = (...children) => ({
+  type: "group",
+  op: "OR",
+  children,
+  negated: true
+});
+var brandWith = (...values) => and(phrase(BRAND), or(...values.map(word)));
+var SCAN_TEMPLATES = [
+  {
+    id: "p2p-instant-transfer",
+    category: "payment-fraud",
+    title: "P2P and instant transfer abuse",
+    description: "Actors advertising instant peer-to-peer transfers into or out of the brand, a common way to move stolen funds before a hold clears.",
+    // Source rows: 1, 55. The original ("[brand]"~3) was proximity on one
+    // position, a no-op; dropped rather than ported.
+    query: and(
+      or(
+        phrase(BRAND, lit("to"), BRAND),
+        bn(2, "instant"),
+        bn(2, "anyone"),
+        bn(1, "pay"),
+        bn(3, "pay anyone"),
+        bn(2, "p2p"),
+        bn(3, "instant transfer"),
+        bn(3, "receive from anyone"),
+        bn(4, "phone number"),
+        bn(2, "member to member"),
+        nb(3, "send")
+      ),
+      notOneOf(word("rate"), word("price"))
+    )
+  },
+  {
+    id: "transfers-ach-direct-debit",
+    category: "payment-fraud",
+    title: "Transfers, ACH and direct debit",
+    description: "Discussion of pushing or pulling funds via ACH, direct debit or bill pay, including chatter about pending and settlement timing.",
+    // Source rows: 6, 8, 18, 41. Row 18 was missing an OR before "Direct Debit".
+    query: or(
+      bn(1, "transfer"),
+      nb(1, "transfer"),
+      bn(5, "ach"),
+      nb(4, "pull"),
+      nb(4, "push"),
+      bn(4, "pending"),
+      bn(4, "settle"),
+      nb(4, "link"),
+      brandWith("billpay", "acctverify"),
+      and(phrase(BRAND), or(phrase(lit("direct debit")), phrase(lit("direct deposit"))))
+    )
+  },
+  {
+    id: "wallet-linking",
+    category: "payment-fraud",
+    title: "Wallet linking and instant funding",
+    description: "Linking the brand to mobile wallets for instant funding, and 'linkable' account trading where a name match is being sold.",
+    // Source rows: 19, 44, 51
+    query: and(
+      or(
+        bn(5, "apple pay"),
+        bn(5, "apple"),
+        bn(3, "apple linkable"),
+        bn(2, "linkable"),
+        bn(2, "linkables"),
+        nb(2, "linkable"),
+        nb(2, "link"),
+        and(phrase(BRAND), phrase(lit("name match")))
+      ),
+      notOneOf(word("espn"), word("airtag"))
+    )
+  },
+  {
+    id: "card-data-exposure",
+    category: "payment-fraud",
+    title: "Card data and virtual cards",
+    description: "Brand-issued card details being traded: expiry, CVV, virtual card numbers and card activation.",
+    // Source rows: 43
+    query: and(
+      brandWith("exp", "cvv", "vcc", "debit"),
+      notOneOf(word("checking"), word("limits"))
+    )
+  },
+  {
+    id: "card-loading",
+    category: "payment-fraud",
+    title: "Card and account loading",
+    description: "'Loading' services that push stolen funds onto brand accounts or cards for a cut.",
+    // Source rows: 42
+    query: or(
+      nb(1, "loading"),
+      nb(1, "load"),
+      bn(1, "loads"),
+      bn(1, "loading"),
+      bn(3, "drop"),
+      bn(2, "cash"),
+      and(
+        phrase(BRAND),
+        or(
+          phrase(lit("loading method")),
+          phrase(lit("loading guide")),
+          phrase(lit("loading tut")),
+          phrase(lit("loading tutorial"))
+        )
+      )
+    )
+  },
+  {
+    id: "cross-platform-cashout",
+    category: "payment-fraud",
+    title: "Cross-platform cash-out",
+    description: "Moving funds from the brand into other consumer payment apps to break the trail.",
+    // Source rows: 56
+    query: and(
+      phrase(BRAND),
+      or(
+        phrase(lit("cash app")),
+        word("venmo"),
+        phrase(lit("transfer to paypal")),
+        phrase(lit("visa money transfer"))
+      )
+    )
+  },
+  {
+    id: "crypto-offramp",
+    category: "payment-fraud",
+    title: "Crypto off-ramp",
+    description: "Converting funds held at the brand into cryptocurrency through exchanges and P2P markets.",
+    // Source rows: 63
+    query: and(
+      phrase(BRAND),
+      or(
+        word("crypto"),
+        word("moonpay"),
+        word("switchere"),
+        word("kraken"),
+        word("paxful"),
+        word("noones"),
+        word("coinomi"),
+        word("coinzoom"),
+        word("bitcoin"),
+        word("btc")
+      )
+    )
+  },
+  {
+    id: "mobile-check-deposit",
+    category: "deposit-fraud",
+    title: "Mobile check deposit fraud",
+    description: "Check fraud against mobile deposit, traded under slang including 'glass', 'MCD', 'slips' and 'persy'.",
+    // Source rows: 2, 13, 35, 46
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(5, "checks"),
+      bn(5, "check"),
+      bn(5, "mobile deposit"),
+      nb(5, "mobile deposit"),
+      bn(5, "slip"),
+      bn(5, "slips"),
+      bn(5, "glass"),
+      bn(5, "md"),
+      bn(5, "mcd"),
+      bn(5, "treasury"),
+      nb(5, "treasury"),
+      bn(5, "persy"),
+      bn(5, "deposit limit"),
+      and(phrase(BRAND), or(prefix("stimm"), word("mcd"), phrase(lit("pop on"))))
+    )
+  },
+  {
+    id: "atm-abuse",
+    category: "deposit-fraud",
+    title: "ATM abuse and 'box work'",
+    description: "ATM deposit and withdrawal manipulation, including dispute-driven 'box work' against cash machines.",
+    // Source rows: 9, 47, 57, 70
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(2, "atm"),
+      bn(2, "withdrawal"),
+      and(phrase(BRAND), phrase(lit("box work"))),
+      and(
+        phrase(BRAND),
+        or(
+          phrase(lit("atm deposit")),
+          phrase(lit("atm withdrawal")),
+          phrase(lit("atm withdraw")),
+          phrase(lit("atm limit")),
+          phrase(lit("atm card")),
+          phrase(lit("cash withdrawal fee"))
+        )
+      )
+    )
+  },
+  {
+    id: "retail-cashout-network",
+    category: "deposit-fraud",
+    title: "Retail cash-out network",
+    description: "Cash-out through retail and ATM partner networks, where funds are pulled at a storefront rather than a branch.",
+    // Source rows: 30
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(5, "allpoint"),
+      bn(5, "walgreens"),
+      bn(5, "cvs"),
+      bn(5, "7-eleven"),
+      bn(5, "7eleven"),
+      bn(5, "711"),
+      bn(5, "circle k"),
+      bn(5, "target"),
+      bn(5, "visa plus alliance"),
+      bn(3, "moneypass"),
+      bn(3, "vanilladirect"),
+      bn(3, "vanilla"),
+      bn(3, "dollar general"),
+      bn(3, "dollar tree"),
+      bn(3, "safeway"),
+      bn(3, "walmart"),
+      bn(3, "speedway")
+    )
+  },
+  {
+    id: "otp-bots",
+    category: "account-takeover",
+    title: "OTP bots and 2FA bypass",
+    description: "Automated one-time-passcode interception services targeting the brand's login and step-up flows.",
+    // Source rows: 34
+    query: or(
+      bn(2, "otp"),
+      nb(1, "otp"),
+      phrase(BRAND, lit("otp bot")),
+      bn(2, "2fa"),
+      bn(2, "code"),
+      bn(2, "bypass"),
+      bn(2, "bot"),
+      bn(2, "bots")
+    )
+  },
+  {
+    id: "remote-access-tooling",
+    category: "account-takeover",
+    title: "Remote-access tooling",
+    description: "Legitimate remote-management tools named alongside the brand, the standard toolkit for support-impersonation account takeover.",
+    // Source rows: 29, 64. Truncated by the export; recoverable portion only.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("action1"),
+        phrase(lit("ammy admin")),
+        word("ammyadmin"),
+        word("anydesk"),
+        phrase(lit("any desk")),
+        word("atera"),
+        word("beanywhere"),
+        phrase(lit("chrome remote desktop")),
+        word("connectwise"),
+        word("screenconnect"),
+        word("dameware"),
+        word("domotz"),
+        word("dwservice"),
+        word("fleetdeck"),
+        word("intelliadmin"),
+        phrase(lit("itarian endpoint manager")),
+        phrase(lit("level.io")),
+        word("meshcentral"),
+        word("mremoteng"),
+        phrase(lit("n-able")),
+        word("ngrok"),
+        phrase(lit("pdq deploy")),
+        word("pulseway"),
+        word("realvnc"),
+        phrase(lit("remote utilities")),
+        word("rport")
+      )
+    )
+  },
+  {
+    id: "antidetect-kyc-evasion",
+    category: "account-takeover",
+    title: "Anti-detect and KYC evasion tooling",
+    description: "Fingerprint spoofing, residential proxies and emulators used to defeat the brand's device and identity checks.",
+    // Source row: 40. The original filtered to Telegram OR Dread; DarkOwl's
+    // `source` takes one value, so precision comes from the tooling terms.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("tlo"),
+        word("scamalytics"),
+        word("burner"),
+        prefix("prox"),
+        word("vpn"),
+        word("vps"),
+        word("antidetect"),
+        phrase(lit("anti-detect")),
+        prefix("emulat")
+      )
+    )
+  },
+  {
+    id: "brand-domains-sso",
+    category: "account-takeover",
+    title: "Brand domains and SSO endpoints",
+    description: "The brand's own domains and identity-provider endpoints appearing in credential and access chatter.",
+    // Source row: 31, as proximity not literal hostnames — the index tokenizes
+    // `chime.okta.com`, so a glued literal would never match. Row 23's
+    // "[brand] pass*"~1 is omitted: no wildcards inside a phrase.
+    query: and(
+      or(bn(2, "okta"), bn(2, "login"), bn(2, "portal"), bn(1, "bank")),
+      notOneOf(word("zendesk"))
+    )
+  },
+  {
+    id: "account-opening-abuse",
+    category: "onboarding-abuse",
+    title: "Account opening and self-registration",
+    description: "Bulk or fraudulent account creation against the brand, including 'self-reg' and 'drop' accounts opened on stolen identities.",
+    // Source rows: 5, 17, 54
+    query: or(
+      bn(5, "enroll"),
+      nb(5, "enroll"),
+      bn(5, "open"),
+      nb(5, "open"),
+      bn(5, "drop"),
+      nb(5, "drop"),
+      nb(5, "make"),
+      nb(5, "create"),
+      nb(5, "fresh"),
+      nb(5, "register"),
+      bn(5, "self-reg"),
+      bn(5, "selfreg"),
+      bn(5, "self-registered"),
+      bn(5, "self register"),
+      bn(1, "fullz")
+    )
+  },
+  {
+    id: "identity-documents",
+    category: "onboarding-abuse",
+    title: "Identity documents and fullz",
+    description: "Trade in identity packages and lookup services used to pass onboarding checks. Anchored to the brand at the root, since the source query was brand-independent.",
+    // Source row: 15. Lexicon-only, so the renderer AND-s the anchor on.
+    query: or(
+      word("fullz"),
+      phrase(lit("get pros")),
+      phrase(lit("driver's license")),
+      phrase(lit("tlo bot")),
+      phrase(lit("tlo plug")),
+      phrase(lit("need dl")),
+      phrase(lit("get id"))
+    )
+  },
+  {
+    id: "referral-bonus-abuse",
+    category: "onboarding-abuse",
+    title: "Referral and bonus abuse",
+    description: "Methods for farming the brand's referral bonuses and promotional offers, often paired with fake direct deposits.",
+    // Source rows: 48
+    query: and(
+      or(bn(3, "referral"), bn(3, "bonus"), bn(3, "promotion"), bn(3, "offer")),
+      or(
+        word("bypass"),
+        word("dd"),
+        phrase(lit("direct deposit")),
+        phrase(lit("work around")),
+        word("trick"),
+        word("method"),
+        word("glitch"),
+        word("tutorial"),
+        word("tut"),
+        word("wave"),
+        word("sauce")
+      )
+    )
+  },
+  {
+    id: "insider-recruitment",
+    category: "insider-threat",
+    title: "Insider recruitment",
+    description: "Actors seeking or advertising an employee on the inside ('inny'), the highest-severity signal in this catalog.",
+    // Source rows: 7, 38
+    query: and(
+      or(
+        bn(4, "inny"),
+        bn(4, "insider"),
+        and(
+          phrase(BRAND),
+          or(
+            word("insider"),
+            word("inny"),
+            phrase(lit("in office")),
+            word("employee"),
+            phrase(lit("i work at")),
+            phrase(lit("i am an employee")),
+            phrase(lit("i can get access")),
+            phrase(lit("i have access to")),
+            phrase(lit("employed at")),
+            word("occupation")
+          )
+        )
+      ),
+      notOneOf(phrase(lit("welcome to insider chat")))
+    )
+  },
+  {
+    id: "mule-crew-recruitment",
+    category: "insider-threat",
+    title: "Mule and cash-out crew recruitment",
+    description: "Recruitment of account holders to receive and forward funds, priced as a revenue split ('50/50', '60/40').",
+    // Source rows: 39
+    query: or(
+      bn(5, "cl"),
+      bn(5, "mule"),
+      bn(5, "tap in"),
+      bn(5, "50/50"),
+      bn(5, "60/40"),
+      bn(5, "striker")
+    )
+  },
+  {
+    id: "methods-and-tutorials",
+    category: "tradecraft",
+    title: "Methods, 'sauce' and tutorials",
+    description: "Fraud methods being taught or sold against the brand, under the usual slang: sauce, glitch, tut, wave, motion, tap in.",
+    // Source rows: 4, 21, 59
+    query: or(
+      bn(3, "sauce"),
+      bn(3, "method"),
+      bn(3, "guide"),
+      bn(3, "tut"),
+      bn(3, "tutorial"),
+      bn(4, "hack"),
+      bn(4, "glitch"),
+      bn(4, "wave"),
+      bn(4, "motion"),
+      bn(4, "walkthrough"),
+      bn(4, "walk through"),
+      bn(2, "tap in"),
+      bn(2, "tapin"),
+      nb(2, "tapn")
+    )
+  },
+  {
+    id: "hack-leak-chatter",
+    category: "tradecraft",
+    title: "Hack and leak chatter",
+    description: "Claims of having hacked, breached or leaked the brand, whether credible or not.",
+    // Source rows: 28
+    query: or(
+      bn(4, "hack"),
+      bn(4, "glitch"),
+      nb(4, "hacking"),
+      bn(4, "leak"),
+      bn(4, "leaked")
+    )
+  },
+  {
+    id: "support-impersonation",
+    category: "brand-abuse",
+    title: "Support impersonation",
+    description: "Actors impersonating the brand's support or service staff to social-engineer customers.",
+    // Source rows: 36
+    query: or(
+      bn(1, "agent"),
+      bn(1, "support"),
+      bn(1, "service"),
+      bn(1, "customer"),
+      nb(1, "impersonate"),
+      bn(1, "impersonation"),
+      bn(3, "scam"),
+      nb(1, "scam")
+    )
+  },
+  {
+    id: "social-impersonation",
+    category: "brand-abuse",
+    title: "Social account impersonation",
+    description: "The brand discussed alongside social platforms, where fake support and giveaway accounts are staged.",
+    // Source rows: 25
+    query: or(
+      bn(5, "instagram"),
+      bn(5, "insta"),
+      bn(5, "facebook"),
+      bn(5, "twitter"),
+      bn(5, "tiktok")
+    )
+  },
+  {
+    id: "vendor-supply-chain",
+    category: "data-exposure",
+    title: "Vendor and BPO supply chain",
+    description: "Outsourced support and processing vendors named alongside the brand, where a third-party breach exposes brand customer data.",
+    // Source row: 60, truncated by the export. Generic BPO/CX providers; a
+    // per-org vendor list would be materially better.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("zendesk"),
+        word("teleperformance"),
+        word("concentrix"),
+        word("taskus"),
+        word("genpact"),
+        word("ubiquity"),
+        word("hioperator"),
+        word("galileo"),
+        word("fiserv"),
+        phrase(lit("etech global"))
+      )
+    )
+  }
+];
+new Map(
+  SCAN_TEMPLATES.map((template) => [template.id, template])
+);
+
 // src/client.ts
 function trimTrailingSlashes(url) {
   return url.replace(/\/+$/, "");