@chainpatrol/sdk 1.8.0 → 1.10.0

package/dist/index.mjs

@@ -543,45 +543,6 @@ z.object({
   name: z.string().optional().describe("Asset name"),
   description: z.string().nullish().optional().describe("Asset description")
 });
-z.object({
-  slug: z.string(),
-  assetId: z.number(),
-  name: z.string().optional(),
-  description: z.string().optional(),
-  assetGroupId: z.number().nullable().optional(),
-  updatedByOrganizationId: z.number().optional()
-});
-z.object({
-  content: z.string().min(1, { message: "Content must be at least 3 character" }).max(1e3, { message: "Content must be less than 1000 characters" }),
-  email: z.string().email(),
-  description: z.string().optional().default("")
-});
-z.object({
-  /** Canonicalization algorithm version the client computed its prefixes with. */
-  algoVersion: z.number().int().positive(),
-  /** 4-byte (8-hex-char) prefixes that hit the client's local index. */
-  prefixes: z.array(z.string().regex(/^[0-9a-f]{8}$/)).min(1).max(200)
-}).describe("Blocklist confirm request");
-z.object({
-  /** Full 64-char SHA-256 hashes of blocked expressions, grouped by prefix. */
-  fullHashes: z.record(z.string(), z.array(z.string()))
-}).describe("Blocklist confirm response");
-z.void().describe("Blocklist version request");
-z.object({
-  /** Canonicalization algorithm version the artifacts + confirm are built with. */
-  algoVersion: z.number().int().positive(),
-  snapshot: z.object({
-    token: z.string(),
-    url: z.string().url(),
-    prefixBytes: z.number().int().positive(),
-    count: z.number().int().nonnegative()
-  }),
-  recent: z.object({
-    token: z.string(),
-    url: z.string().url(),
-    windowSeconds: z.number().int().positive()
-  })
-}).describe("Blocklist version response");
 
 // ../../node_modules/luxon/src/errors.js
 var LuxonError = class extends Error {
@@ -1255,17 +1216,17 @@ var PolyDateFormatter = class {
   constructor(dt, intl, opts) {
     this.opts = opts;
     this.originalZone = void 0;
-    let z55 = void 0;
+    let z61 = void 0;
     if (this.opts.timeZone) {
       this.dt = dt;
     } else if (dt.zone.type === "fixed") {
       const gmtOffset = -1 * (dt.offset / 60);
       const offsetZ = gmtOffset >= 0 ? `Etc/GMT+${gmtOffset}` : `Etc/GMT${gmtOffset}`;
       if (dt.offset !== 0 && IANAZone.create(offsetZ).valid) {
-        z55 = offsetZ;
+        z61 = offsetZ;
         this.dt = dt;
       } else {
-        z55 = "UTC";
+        z61 = "UTC";
         this.dt = dt.offset === 0 ? dt : dt.setZone("UTC").plus({ minutes: dt.offset });
         this.originalZone = dt.zone;
       }
@@ -1273,14 +1234,14 @@ var PolyDateFormatter = class {
       this.dt = dt;
     } else if (dt.zone.type === "iana") {
       this.dt = dt;
-      z55 = dt.zone.name;
+      z61 = dt.zone.name;
     } else {
-      z55 = "UTC";
+      z61 = "UTC";
       this.dt = dt.setZone("UTC").plus({ minutes: dt.offset });
       this.originalZone = dt.zone;
     }
     const intlOpts = __spreadValues({}, this.opts);
-    intlOpts.timeZone = intlOpts.timeZone || z55;
+    intlOpts.timeZone = intlOpts.timeZone || z61;
     this.dtf = getCachedDTF(intl, intlOpts);
   }
   format() {
@@ -6996,6 +6957,63 @@ function friendlyDateTime(dateTimeish) {
     );
   }
 }
+var MAX_ASSET_NOTE_LENGTH = 5e3;
+var assetNoteBodySchema = z.string().trim().min(1, "Note is required").max(MAX_ASSET_NOTE_LENGTH, `Note must be at most ${MAX_ASSET_NOTE_LENGTH} characters`);
+var assetNoteTimelineAtSchema = z.coerce.date().refine((value) => value.getTime() <= DateTime.now().toUTC().toMillis(), {
+  message: "Timeline date cannot be in the future"
+});
+z.object({
+  assetId: z.number().int().positive(),
+  note: assetNoteBodySchema,
+  timelineAt: assetNoteTimelineAtSchema.optional()
+});
+z.object({
+  noteId: z.number().int().positive(),
+  note: assetNoteBodySchema,
+  timelineAt: assetNoteTimelineAtSchema.nullish()
+});
+z.object({
+  noteId: z.number().int().positive()
+});
+z.object({
+  slug: z.string(),
+  assetId: z.number(),
+  name: z.string().optional(),
+  description: z.string().optional(),
+  assetGroupId: z.number().nullable().optional(),
+  updatedByOrganizationId: z.number().optional()
+});
+z.object({
+  content: z.string().min(1, { message: "Content must be at least 3 character" }).max(1e3, { message: "Content must be less than 1000 characters" }),
+  email: z.string().email(),
+  description: z.string().optional().default("")
+});
+z.object({
+  /** Canonicalization algorithm version the client computed its prefixes with. */
+  algoVersion: z.number().int().positive(),
+  /** 4-byte (8-hex-char) prefixes that hit the client's local index. */
+  prefixes: z.array(z.string().regex(/^[0-9a-f]{8}$/)).min(1).max(200)
+}).describe("Blocklist confirm request");
+z.object({
+  /** Full 64-char SHA-256 hashes of blocked expressions, grouped by prefix. */
+  fullHashes: z.record(z.string(), z.array(z.string()))
+}).describe("Blocklist confirm response");
+z.void().describe("Blocklist version request");
+z.object({
+  /** Canonicalization algorithm version the artifacts + confirm are built with. */
+  algoVersion: z.number().int().positive(),
+  snapshot: z.object({
+    token: z.string(),
+    url: z.string().url(),
+    prefixBytes: z.number().int().positive(),
+    count: z.number().int().nonnegative()
+  }),
+  recent: z.object({
+    token: z.string(),
+    url: z.string().url(),
+    windowSeconds: z.number().int().positive()
+  })
+}).describe("Blocklist version response");
 
 // ../../internal/database/src/generated/prisma/enums.ts
 var BrandType = {
@@ -11430,6 +11448,50 @@ z.object({
     endDate: z.date()
   })
 });
+var DATE_ONLY_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+var utcDateSchema = (endOfDay) => z.preprocess((value) => {
+  if (typeof value !== "string") {
+    return value;
+  }
+  const parsed = DateTime.fromISO(value, { zone: "utc" });
+  if (!parsed.isValid) {
+    return new Date(Number.NaN);
+  }
+  return endOfDay && DATE_ONLY_PATTERN.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
+}, z.coerce.date());
+var funnelCountsSchema = z.object({
+  blocked: z.number().int().nonnegative().describe(
+    "Distinct assets whose earliest report for this org falls in the range and whose current status or pending status is BLOCKED"
+  )
+});
+z.object({
+  slug: z.string().min(1).describe("Organization slug"),
+  startDate: utcDateSchema(false).describe(
+    "Only include assets whose earliest report was created on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+  ),
+  endDate: utcDateSchema(true).describe(
+    "Only include assets whose earliest report was created on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+  ),
+  brandIds: z.array(z.number().int().positive()).optional().describe("Only include assets belonging to these brands")
+}).refine((input) => input.startDate.getTime() <= input.endDate.getTime(), {
+  message: "startDate must be on or before endDate",
+  path: ["startDate"]
+});
+z.object({
+  range: z.object({
+    startDate: z.date(),
+    endDate: z.date()
+  }),
+  customer: funnelCountsSchema.describe(
+    "Currently blocked assets first reported by the customer (reportedByCustomer, external reporter, or customer-role user)"
+  ),
+  chainpatrol: funnelCountsSchema.describe(
+    "Currently blocked assets first reported by ChainPatrol staff or automation. Staff and automation are collapsed together."
+  ),
+  totals: funnelCountsSchema.describe(
+    "customer + chainpatrol. This is a first-report blocked cohort and does not equal metrics/found, which counts assets by blockedAt."
+  )
+});
 z.object({
   slug: z.string().min(1),
   startDate: z.date().optional(),
@@ -11461,8 +11523,8 @@ z.object({
     })
   )
 });
-var DATE_ONLY_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
-var utcDateSchema = (endOfDay) => z.preprocess((value) => {
+var DATE_ONLY_PATTERN2 = /^\d{4}-\d{2}-\d{2}$/;
+var utcDateSchema2 = (endOfDay) => z.preprocess((value) => {
   if (typeof value !== "string") {
     return value;
   }
@@ -11470,14 +11532,47 @@ var utcDateSchema = (endOfDay) => z.preprocess((value) => {
   if (!parsed.isValid) {
     return new Date(Number.NaN);
   }
-  return endOfDay && DATE_ONLY_PATTERN.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
+  return endOfDay && DATE_ONLY_PATTERN2.test(value) ? parsed.endOf("day").toJSDate() : parsed.toJSDate();
 }, z.coerce.date());
+
+// ../../internal/validation/src/public/metrics/takedown-success-rate.ts
+z.object({
+  slug: z.string().min(1).describe("Organization slug"),
+  startDate: utcDateSchema2(false).optional().describe(
+    "Only include takedowns first submitted to a provider on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+  ),
+  endDate: utcDateSchema2(true).optional().describe(
+    "Only include takedowns first submitted to a provider on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+  ),
+  blockLabel: z.string().optional().describe(
+    'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+  ),
+  brandType: z.nativeEnum(BrandType).optional().describe("Only include assets belonging to brands of this type"),
+  countryCodes: z.array(z.string().length(2)).optional().describe("Only include assets scanned from these ISO 3166-1 alpha-2 countries"),
+  brandIds: z.array(z.number().int().positive()).optional().describe("Only include assets belonging to these brands")
+});
+z.object({
+  byAssetType: z.array(
+    z.object({
+      assetType: z.nativeEnum(AssetType).describe("Asset type the takedowns were filed against"),
+      submitted: z.number().describe("Takedowns whose first submission to a provider fell in the range"),
+      completed: z.number().describe("Of those, how many ended in a takedown"),
+      stillOpen: z.number().describe("Of those, how many have not yet reached an outcome"),
+      successRate: z.number().describe("completed / submitted, 0-1. Still-open takedowns count against it"),
+      resolvedSuccessRate: z.number().nullable().describe(
+        "completed / (submitted - stillOpen), 0-1, or null when nothing has resolved yet. Higher than successRate whenever work is still outstanding"
+      )
+    })
+  ).describe(
+    "Takedown success rate, one entry per asset type, descending by number submitted"
+  )
+});
 z.object({
   slug: z.string().min(1).describe("Organization slug"),
-  startDate: utcDateSchema(false).optional().describe(
+  startDate: utcDateSchema2(false).optional().describe(
     "Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
   ),
-  endDate: utcDateSchema(true).optional().describe(
+  endDate: utcDateSchema2(true).optional().describe(
     "Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
   ),
   blockLabel: z.string().optional().describe(
@@ -11500,6 +11595,46 @@ z.object({
     "Median time from takedown start to completion, one entry per asset type, ascending by median"
   )
 });
+var TakedownProviderRoleSchema = z.enum([
+  "HOSTING_PROVIDER",
+  "DOMAIN_REGISTRAR",
+  "TLD_REGISTRAR"
+]);
+z.object({
+  slug: z.string().min(1).describe("Organization slug"),
+  startDate: utcDateSchema2(false).optional().describe(
+    "Only include takedowns completed on or after this date. A date-only value (YYYY-MM-DD) starts at midnight UTC"
+  ),
+  endDate: utcDateSchema2(true).optional().describe(
+    "Only include takedowns completed on or before this date. A date-only value (YYYY-MM-DD) covers the whole day in UTC; pass a full timestamp for a precise cut-off"
+  ),
+  roles: z.array(TakedownProviderRoleSchema).optional().describe(
+    "Only break down these provider roles. Omit for every role. A takedown filed against both a host and a registrar is counted once under each"
+  ),
+  blockLabel: z.string().optional().describe(
+    'Only include assets blocked with this review label, e.g. "Brand Impersonation", "Employee Impersonation" or "Targeting Org Users"'
+  ),
+  brandType: z.nativeEnum(BrandType).optional().describe("Only include assets belonging to brands of this type"),
+  countryCodes: z.array(z.string().length(2)).optional().describe("Only include assets scanned from these ISO 3166-1 alpha-2 countries"),
+  brandIds: z.array(z.number().int().positive()).optional().describe("Only include assets belonging to these brands")
+});
+z.object({
+  byProvider: z.array(
+    z.object({
+      providerId: z.number().describe("Takedown provider id"),
+      providerName: z.string().describe("Takedown provider name"),
+      role: TakedownProviderRoleSchema.describe(
+        "Which provider slot of the takedown this median is computed over"
+      ),
+      medianTakedownMinutes: z.number(),
+      medianTakedownHours: z.number(),
+      medianTakedownDays: z.number(),
+      count: z.number().describe("Number of completed takedowns behind the median")
+    })
+  ).describe(
+    "Median time from takedown start to completion, one entry per provider and role, ascending by median"
+  )
+});
 z.object({
   slug: z.string().min(1).describe("Organization slug"),
   months: z.number().int().min(2).max(36).default(12).describe("Size of the trailing window in whole months, including the current month"),
@@ -11755,6 +11890,13 @@ z.object({
   brands: z.array(brandItemSchema).describe("List of brands")
 }).describe("Successful operation");
 var FILTERABLE_SUBSCRIPTION_STATUSES = [
+  SubscriptionStatus.PROSPECT,
+  SubscriptionStatus.POC,
+  SubscriptionStatus.ACTIVE,
+  SubscriptionStatus.INTEGRATION,
+  SubscriptionStatus.INACTIVE
+];
+[
   SubscriptionStatus.PROSPECT,
   SubscriptionStatus.POC,
   SubscriptionStatus.ACTIVE,
@@ -11789,7 +11931,9 @@ var userOrgsPendingServiceApprovalFilterSchema = z.object({
 }).optional();
 z.object({
   query: z.string().default(""),
-  subscriptionStatus: z.array(UserOrgsSubscriptionStatusSchema).min(1).optional(),
+  subscriptionStatus: z.array(UserOrgsSubscriptionStatusSchema).min(1).optional().describe(
+    "Statuses to include. Defaults to the live set (PROSPECT/POC/ACTIVE/INTEGRATION); pass INACTIVE explicitly to see churned organizations."
+  ),
   services: userOrgsServicesFilterObjectSchema.optional(),
   obligatoryAdminApproval: userOrgsObligatoryAdminApprovalFilterSchema,
   pendingServiceApproval: userOrgsPendingServiceApprovalFilterSchema
@@ -11935,7 +12079,9 @@ var organizationMetricsIncludeFieldSchema = z.enum([
   "newThreats",
   "threatsWatchlisted",
   "takedownsFiled",
+  "takedownsInProgress",
   "takedownsCompleted",
+  "takedownsCancelled",
   "domainThreats",
   "twitterThreats",
   "telegramThreats",
@@ -11968,7 +12114,7 @@ z.object({
     "Shortcut for 'every org the caller is authorized to read'. Reuses the same filter logic as `/user/orgs`: org-scoped API keys are rejected (they're pinned to one org \u2014 use the default form); user API keys / Bearer sessions resolve to the user's memberships (or every active org for staff). Combine with `subscriptionStatus` and `services` to narrow (e.g. only paying customers with takedowns enabled). The resolved org set is still capped at " + String(ORGANIZATION_METRICS_MAX_SLUGS) + " and a 413 is returned if exceeded. Mutually exclusive with `organizationSlug`, `slugs`, and `brandSlug`."
   ),
   subscriptionStatus: z.array(UserOrgsSubscriptionStatusSchema).min(1).optional().describe(
-    "Only meaningful with `allMyOrgs: true`. Defaults to the same set `/user/orgs` uses (ACTIVE/POC/PROSPECT/INTEGRATION \u2014 INACTIVE is always excluded)."
+    "Only meaningful with `allMyOrgs: true`. Defaults to the same set `/user/orgs` uses (ACTIVE/POC/PROSPECT/INTEGRATION); pass INACTIVE explicitly to include churned organizations."
   ),
   services: organizationMetricsServicesFilterSchema.describe(
     "Only meaningful with `allMyOrgs: true`. Same shape as `/user/orgs`'s `services` filter \u2014 every service accepts `{ active }`, and **only `takedowns` additionally accepts `automated`** (the one service where manual-vs-automated changes real platform behavior). E.g. `{ takedowns: { active: true, automated: false } }` for 'orgs with takedowns enabled but automation off'."
@@ -11977,7 +12123,7 @@ z.object({
   startDate: z.coerce.date().optional(),
   endDate: z.coerce.date().optional(),
   include: z.array(organizationMetricsIncludeFieldSchema).optional().describe(
-    "Subset of metrics to compute. When omitted or empty, every metric is computed (legacy behavior). Each value in `include` costs roughly one Prisma aggregate, so narrow the list when an agent only needs a couple of numbers \u2014 this is the main lever for keeping big-org calls inside the 30s function cap. Fields not in `include` come back as `null`."
+    "Subset of metrics to compute. When omitted or empty, every metric is computed (legacy behavior). Each value in `include` costs roughly one aggregate query, so narrow the list when an agent only needs a couple of numbers \u2014 this is the main lever for keeping big-org calls inside the 30s function cap. Fields not in `include` come back as `null`. `takedownsInProgress` and `takedownsCancelled` count takedowns currently in that status whose `updatedAt` falls in the window (same windowing as `takedownsFiled`), so they reconcile with the takedowns list filtered by status over the same date range."
   )
 }).refine(
   (value) => {
@@ -12005,7 +12151,9 @@ var metricsObjectSchema = z.object({
   newThreats: metricValue,
   threatsWatchlisted: metricValue,
   takedownsFiled: metricValue,
+  takedownsInProgress: metricValue,
   takedownsCompleted: metricValue,
+  takedownsCancelled: metricValue,
   domainThreats: metricValue,
   twitterThreats: metricValue,
   telegramThreats: metricValue,
@@ -12623,6 +12771,74 @@ z.object({
   hiddenMetrics: z.record(z.string(), z.boolean()).default({}),
   overriddenMetrics: z.record(z.string(), z.boolean()).default({})
 });
+var ONE_PAGER_BUDGETS = {
+  headline: 60,
+  badge: 28,
+  frontLabel: 44,
+  paragraph: 480,
+  paragraphsMax: 2,
+  heroPhrase: 80,
+  heroNarrative: 300,
+  divergenceLine: 220,
+  xp01Line: 220
+};
+var onePagerFactPayloadSchema = z.object({
+  /** Raw (not defanged) asset contents the prose may reference. */
+  assetContents: z.array(z.string()),
+  /** Every numeric token (as string) the prose is allowed to contain. */
+  numbers: z.array(z.string()),
+  /** ISO dates the prose may reference. */
+  dates: z.array(z.string()),
+  platforms: z.array(z.string()),
+  groupSize: z.number(),
+  takedownCompletedAt: z.string().nullable(),
+  activeSince: z.string().nullable()
+});
+var onePagerStorySchema = z.object({
+  archetypeId: z.string(),
+  archetypeCategory: z.string(),
+  /** 1-5 = placed on the page; null = alternate available for swap. */
+  slot: z.number().int().min(1).max(5).nullable(),
+  frontLabel: z.string().max(ONE_PAGER_BUDGETS.frontLabel),
+  headline: z.string().max(ONE_PAGER_BUDGETS.headline),
+  badge: z.string().max(ONE_PAGER_BUDGETS.badge),
+  paragraphs: z.array(z.string().max(ONE_PAGER_BUDGETS.paragraph)).min(1).max(ONE_PAGER_BUDGETS.paragraphsMax),
+  /** Defanged, display-ready asset identifiers. */
+  assetList: z.array(z.string()).max(10),
+  screenshotUrls: z.array(z.string()),
+  selectedScreenshotUrls: z.array(z.string()).max(2),
+  xp01Line: z.string().max(ONE_PAGER_BUDGETS.xp01Line).nullable(),
+  factPayload: onePagerFactPayloadSchema,
+  proseSource: z.enum(["llm", "template"])
+});
+var onePagerLandscapeRowSchema = z.object({
+  platform: z.string(),
+  count: z.number(),
+  sharePct: z.number()
+});
+var onePagerFormDataObjectSchema = z.object({
+  orgName: z.string(),
+  orgSlug: z.string(),
+  periodLabel: z.string(),
+  heroStat: z.object({
+    value: z.string(),
+    phrase: z.string().max(ONE_PAGER_BUDGETS.heroPhrase)
+  }),
+  heroNarrative: z.string().max(ONE_PAGER_BUDGETS.heroNarrative),
+  metricsRows: z.array(z.object({ label: z.string(), value: z.string() })).length(4),
+  landscape: z.object({
+    rows: z.array(onePagerLandscapeRowSchema).max(8),
+    otherCount: z.number().nullable(),
+    otherPlatformsLabel: z.string().nullable(),
+    divergenceLine: z.string().max(ONE_PAGER_BUDGETS.divergenceLine).nullable()
+  }),
+  stories: z.array(onePagerStorySchema).min(1).max(6),
+  footer: z.object({ contactName: z.string(), contactLine: z.string() })
+});
+onePagerFormDataObjectSchema.refine(
+  (data) => data.stories.some((s2) => s2.slot !== null),
+  { message: "at least one story must be placed", path: ["stories"] }
+);
 z.object({
   x: z.number().min(0).max(1),
   y: z.number().min(0).max(1),
@@ -13388,20 +13604,20 @@ var convertA98ToXyz65_default = convertA98ToXyz65;
 
 // ../../node_modules/culori/src/a98/convertXyz65ToA98.js
 var gamma = (v) => Math.pow(Math.abs(v), 256 / 563) * Math.sign(v);
-var convertXyz65ToA98 = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToA98 = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = {
     mode: "a98",
     r: gamma(
-      x * 2.0415879038107465 - y * 0.5650069742788597 - 0.3447313507783297 * z55
+      x * 2.0415879038107465 - y * 0.5650069742788597 - 0.3447313507783297 * z61
     ),
     g: gamma(
-      x * -0.9692436362808798 + y * 1.8759675015077206 + 0.0415550574071756 * z55
+      x * -0.9692436362808798 + y * 1.8759675015077206 + 0.0415550574071756 * z61
     ),
     b: gamma(
-      x * 0.0134442806320312 - y * 0.1183623922310184 + 1.0151749943912058 * z55
+      x * 0.0134442806320312 - y * 0.1183623922310184 + 1.0151749943912058 * z61
     )
   };
   if (alpha !== void 0) {
@@ -13468,14 +13684,14 @@ var convertLrgbToRgb = ({ r, g, b, alpha }, mode = "rgb") => {
 var convertLrgbToRgb_default = convertLrgbToRgb;
 
 // ../../node_modules/culori/src/xyz65/convertXyz65ToRgb.js
-var convertXyz65ToRgb = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToRgb = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = convertLrgbToRgb_default({
-    r: x * 3.2409699419045226 - y * 1.537383177570094 - 0.4986107602930034 * z55,
-    g: x * -0.9692436362808796 + y * 1.8759675015077204 + 0.0415550574071756 * z55,
-    b: x * 0.0556300796969936 - y * 0.2039769588889765 + 1.0569715142428784 * z55
+    r: x * 3.2409699419045226 - y * 1.537383177570094 - 0.4986107602930034 * z61,
+    g: x * -0.9692436362808796 + y * 1.8759675015077204 + 0.0415550574071756 * z61,
+    b: x * 0.0556300796969936 - y * 0.2039769588889765 + 1.0569715142428784 * z61
   });
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -13725,13 +13941,13 @@ var convertLab65ToRgb_default = convertLab65ToRgb;
 
 // ../../node_modules/culori/src/lab65/convertXyz65ToLab65.js
 var f = (value) => value > e ? Math.cbrt(value) : (k * value + 16) / 116;
-var convertXyz65ToLab65 = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToLab65 = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let f0 = f(x / D65.X);
   let f1 = f(y / D65.Y);
-  let f22 = f(z55 / D65.Z);
+  let f22 = f(z61 / D65.Z);
   let res = {
     mode: "lab65",
     l: 116 * f1 - 16,
@@ -14388,10 +14604,10 @@ var convertItpToXyz65_default = convertItpToXyz65;
 
 // ../../node_modules/culori/src/itp/convertXyz65ToItp.js
 var toAbs = (c2 = 0) => Math.max(c2 * YW, 0);
-var convertXyz65ToItp = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToItp = ({ x, y, z: z61, alpha }) => {
   const absX = toAbs(x);
   const absY = toAbs(y);
-  const absZ = toAbs(z55);
+  const absZ = toAbs(z61);
   const l2 = transferPqEncode(
     0.3592832590121217 * absX + 0.6976051147779502 * absY - 0.0358915932320289 * absZ
   );
@@ -14449,15 +14665,15 @@ var jabPqEncode = (v) => {
   return Math.pow((C1 + C2 * vn3) / (1 + C3 * vn3), p);
 };
 var abs = (v = 0) => Math.max(v * 203, 0);
-var convertXyz65ToJab = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToJab = ({ x, y, z: z61, alpha }) => {
   x = abs(x);
   y = abs(y);
-  z55 = abs(z55);
-  let xp = 1.15 * x - 0.15 * z55;
+  z61 = abs(z61);
+  let xp = 1.15 * x - 0.15 * z61;
   let yp = 0.66 * y + 0.34 * x;
-  let l2 = jabPqEncode(0.41478972 * xp + 0.579999 * yp + 0.014648 * z55);
-  let m = jabPqEncode(-0.20151 * xp + 1.120649 * yp + 0.0531008 * z55);
-  let s2 = jabPqEncode(-0.0166008 * xp + 0.2648 * yp + 0.6684799 * z55);
+  let l2 = jabPqEncode(0.41478972 * xp + 0.579999 * yp + 0.014648 * z61);
+  let m = jabPqEncode(-0.20151 * xp + 1.120649 * yp + 0.0531008 * z61);
+  let s2 = jabPqEncode(-0.0166008 * xp + 0.2648 * yp + 0.6684799 * z61);
   let i = (l2 + m) / 2;
   let res = {
     mode: "jab",
@@ -14643,14 +14859,14 @@ var convertLabToXyz50 = ({ l: l2, a, b, alpha }) => {
 var convertLabToXyz50_default = convertLabToXyz50;
 
 // ../../node_modules/culori/src/xyz50/convertXyz50ToRgb.js
-var convertXyz50ToRgb = ({ x, y, z: z55, alpha }) => {
+var convertXyz50ToRgb = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = convertLrgbToRgb_default({
-    r: x * 3.1341359569958707 - y * 1.6173863321612538 - 0.4906619460083532 * z55,
-    g: x * -0.978795502912089 + y * 1.916254567259524 + 0.03344273116131949 * z55,
-    b: x * 0.07195537988411677 - y * 0.2289768264158322 + 1.405386058324125 * z55
+    r: x * 3.1341359569958707 - y * 1.6173863321612538 - 0.4906619460083532 * z61,
+    g: x * -0.978795502912089 + y * 1.916254567259524 + 0.03344273116131949 * z61,
+    b: x * 0.07195537988411677 - y * 0.2289768264158322 + 1.405386058324125 * z61
   });
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -14681,13 +14897,13 @@ var convertRgbToXyz50_default = convertRgbToXyz50;
 
 // ../../node_modules/culori/src/lab/convertXyz50ToLab.js
 var f2 = (value) => value > e3 ? Math.cbrt(value) : (k3 * value + 16) / 116;
-var convertXyz50ToLab = ({ x, y, z: z55, alpha }) => {
+var convertXyz50ToLab = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let f0 = f2(x / D50.X);
   let f1 = f2(y / D50.Y);
-  let f22 = f2(z55 / D50.Z);
+  let f22 = f2(z61 / D50.Z);
   let res = {
     mode: "lab",
     l: 116 * f1 - 16,
@@ -14922,18 +15138,18 @@ var convertLchuvToLuv = ({ l: l2, c: c2, h, alpha }) => {
 var convertLchuvToLuv_default = convertLchuvToLuv;
 
 // ../../node_modules/culori/src/luv/convertXyz50ToLuv.js
-var u_fn = (x, y, z55) => 4 * x / (x + 15 * y + 3 * z55);
-var v_fn = (x, y, z55) => 9 * y / (x + 15 * y + 3 * z55);
+var u_fn = (x, y, z61) => 4 * x / (x + 15 * y + 3 * z61);
+var v_fn = (x, y, z61) => 9 * y / (x + 15 * y + 3 * z61);
 var un = u_fn(D50.X, D50.Y, D50.Z);
 var vn = v_fn(D50.X, D50.Y, D50.Z);
 var l_fn = (value) => value <= e3 ? k3 * value : 116 * Math.cbrt(value) - 16;
-var convertXyz50ToLuv = ({ x, y, z: z55, alpha }) => {
+var convertXyz50ToLuv = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let l2 = l_fn(y / D50.Y);
-  let u = u_fn(x, y, z55);
-  let v = v_fn(x, y, z55);
+  let u = u_fn(x, y, z61);
+  let v = v_fn(x, y, z61);
   if (!isFinite(u) || !isFinite(v)) {
     l2 = u = v = 0;
   } else {
@@ -14954,8 +15170,8 @@ var convertXyz50ToLuv = ({ x, y, z: z55, alpha }) => {
 var convertXyz50ToLuv_default = convertXyz50ToLuv;
 
 // ../../node_modules/culori/src/luv/convertLuvToXyz50.js
-var u_fn2 = (x, y, z55) => 4 * x / (x + 15 * y + 3 * z55);
-var v_fn2 = (x, y, z55) => 9 * y / (x + 15 * y + 3 * z55);
+var u_fn2 = (x, y, z61) => 4 * x / (x + 15 * y + 3 * z61);
+var v_fn2 = (x, y, z61) => 9 * y / (x + 15 * y + 3 * z61);
 var un2 = u_fn2(D50.X, D50.Y, D50.Z);
 var vn2 = v_fn2(D50.X, D50.Y, D50.Z);
 var convertLuvToXyz50 = ({ l: l2, u, v, alpha }) => {
@@ -14969,8 +15185,8 @@ var convertLuvToXyz50 = ({ l: l2, u, v, alpha }) => {
   let vp = v / (13 * l2) + vn2;
   let y = D50.Y * (l2 <= 8 ? l2 / k3 : Math.pow((l2 + 16) / 116, 3));
   let x = y * (9 * up) / (4 * vp);
-  let z55 = y * (12 - 3 * up - 20 * vp) / (4 * vp);
-  let res = { mode: "xyz50", x, y, z: z55 };
+  let z61 = y * (12 - 3 * up - 20 * vp) / (4 * vp);
+  let res = { mode: "xyz50", x, y, z: z61 };
   if (alpha !== void 0) {
     res.alpha = alpha;
   }
@@ -15587,15 +15803,15 @@ var convertP3ToXyz65 = (rgb2) => {
 var convertP3ToXyz65_default = convertP3ToXyz65;
 
 // ../../node_modules/culori/src/p3/convertXyz65ToP3.js
-var convertXyz65ToP3 = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToP3 = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = convertLrgbToRgb_default(
     {
-      r: x * 2.4934969119414263 - y * 0.9313836179191242 - 0.402710784450717 * z55,
-      g: x * -0.8294889695615749 + y * 1.7626640603183465 + 0.0236246858419436 * z55,
-      b: x * 0.0358458302437845 - y * 0.0761723892680418 + 0.9568845240076871 * z55
+      r: x * 2.4934969119414263 - y * 0.9313836179191242 - 0.402710784450717 * z61,
+      g: x * -0.8294889695615749 + y * 1.7626640603183465 + 0.0236246858419436 * z61,
+      b: x * 0.0358458302437845 - y * 0.0761723892680418 + 0.9568845240076871 * z61
     },
     "p3"
   );
@@ -15630,19 +15846,19 @@ var gamma2 = (v) => {
   }
   return 16 * v;
 };
-var convertXyz50ToProphoto = ({ x, y, z: z55, alpha }) => {
+var convertXyz50ToProphoto = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = {
     mode: "prophoto",
     r: gamma2(
-      x * 1.3457868816471585 - y * 0.2555720873797946 - 0.0511018649755453 * z55
+      x * 1.3457868816471585 - y * 0.2555720873797946 - 0.0511018649755453 * z61
     ),
     g: gamma2(
-      x * -0.5446307051249019 + y * 1.5082477428451466 + 0.0205274474364214 * z55
+      x * -0.5446307051249019 + y * 1.5082477428451466 + 0.0205274474364214 * z61
     ),
-    b: gamma2(x * 0 + y * 0 + 1.2119675456389452 * z55)
+    b: gamma2(x * 0 + y * 0 + 1.2119675456389452 * z61)
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -15702,20 +15918,20 @@ var gamma3 = (v) => {
   }
   return 4.5 * v;
 };
-var convertXyz65ToRec2020 = ({ x, y, z: z55, alpha }) => {
+var convertXyz65ToRec2020 = ({ x, y, z: z61, alpha }) => {
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = {
     mode: "rec2020",
     r: gamma3(
-      x * 1.7166511879712683 - y * 0.3556707837763925 - 0.2533662813736599 * z55
+      x * 1.7166511879712683 - y * 0.3556707837763925 - 0.2533662813736599 * z61
     ),
     g: gamma3(
-      x * -0.6666843518324893 + y * 1.6164812366349395 + 0.0157685458139111 * z55
+      x * -0.6666843518324893 + y * 1.6164812366349395 + 0.0157685458139111 * z61
     ),
     b: gamma3(
-      x * 0.0176398574453108 - y * 0.0427706132578085 + 0.9421031212354739 * z55
+      x * 0.0176398574453108 - y * 0.0427706132578085 + 0.9421031212354739 * z61
     )
   };
   if (alpha !== void 0) {
@@ -15868,15 +16084,15 @@ var definition_default26 = definition26;
 
 // ../../node_modules/culori/src/xyz65/convertXyz65ToXyz50.js
 var convertXyz65ToXyz50 = (xyz652) => {
-  let { x, y, z: z55, alpha } = xyz652;
+  let { x, y, z: z61, alpha } = xyz652;
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = {
     mode: "xyz50",
-    x: 1.0479298208405488 * x + 0.0229467933410191 * y - 0.0501922295431356 * z55,
-    y: 0.0296278156881593 * x + 0.990434484573249 * y - 0.0170738250293851 * z55,
-    z: -0.0092430581525912 * x + 0.0150551448965779 * y + 0.7518742899580008 * z55
+    x: 1.0479298208405488 * x + 0.0229467933410191 * y - 0.0501922295431356 * z61,
+    y: 0.0296278156881593 * x + 0.990434484573249 * y - 0.0170738250293851 * z61,
+    z: -0.0092430581525912 * x + 0.0150551448965779 * y + 0.7518742899580008 * z61
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -15887,15 +16103,15 @@ var convertXyz65ToXyz50_default = convertXyz65ToXyz50;
 
 // ../../node_modules/culori/src/xyz65/convertXyz50ToXyz65.js
 var convertXyz50ToXyz65 = (xyz502) => {
-  let { x, y, z: z55, alpha } = xyz502;
+  let { x, y, z: z61, alpha } = xyz502;
   if (x === void 0) x = 0;
   if (y === void 0) y = 0;
-  if (z55 === void 0) z55 = 0;
+  if (z61 === void 0) z61 = 0;
   let res = {
     mode: "xyz65",
-    x: 0.9554734527042182 * x - 0.0230985368742614 * y + 0.0632593086610217 * z55,
-    y: -0.0283697069632081 * x + 1.0099954580058226 * y + 0.021041398966943 * z55,
-    z: 0.0123140016883199 * x - 0.0205076964334779 * y + 1.3303659366080753 * z55
+    x: 0.9554734527042182 * x - 0.0230985368742614 * y + 0.0632593086610217 * z61,
+    y: -0.0283697069632081 * x + 1.0099954580058226 * y + 0.021041398966943 * z61,
+    z: 0.0123140016883199 * x - 0.0205076964334779 * y + 1.3303659366080753 * z61
   };
   if (alpha !== void 0) {
     res.alpha = alpha;
@@ -16165,6 +16381,571 @@ z.string().optional().nullable().transform((value) => {
   }
 );
 
+// ../../internal/utils/src/industry.ts
+var Industry = {
+  // Finance
+  BANKING: "banking",
+  FINANCIAL_SERVICES: "financial_services",
+  FINTECH: "fintech",
+  PAYMENTS: "payments"};
+
+// ../../internal/validation/src/dark-web/templates.ts
+var BRAND = { kind: "brand" };
+var lit = (value) => ({ kind: "literal", value });
+var phrase = (...tokens) => ({ type: "phrase", tokens });
+var bn = (slop, ...words) => ({
+  type: "phrase",
+  tokens: [BRAND, ...words.map(lit)],
+  slop
+});
+var nb = (slop, ...words) => ({
+  type: "phrase",
+  tokens: [...words.map(lit), BRAND],
+  slop
+});
+var word = (value) => ({ type: "term", value, match: "word" });
+var prefix = (value) => ({
+  type: "term",
+  value,
+  match: "prefix"
+});
+var or = (...children) => ({
+  type: "group",
+  op: "OR",
+  children
+});
+var and = (...children) => ({
+  type: "group",
+  op: "AND",
+  children
+});
+var notOneOf = (...children) => ({
+  type: "group",
+  op: "OR",
+  children,
+  negated: true
+});
+var brandWith = (...values) => and(phrase(BRAND), or(...values.map(word)));
+var SCAN_TEMPLATES = [
+  {
+    id: "p2p-instant-transfer",
+    category: "payment-fraud",
+    title: "P2P and instant transfer abuse",
+    description: "Actors advertising instant peer-to-peer transfers into or out of the brand, a common way to move stolen funds before a hold clears.",
+    // Source rows: 1, 55. The original ("[brand]"~3) was proximity on one
+    // position, a no-op; dropped rather than ported.
+    query: and(
+      or(
+        phrase(BRAND, lit("to"), BRAND),
+        bn(2, "instant"),
+        bn(2, "anyone"),
+        bn(1, "pay"),
+        bn(3, "pay anyone"),
+        bn(2, "p2p"),
+        bn(3, "instant transfer"),
+        bn(3, "receive from anyone"),
+        bn(4, "phone number"),
+        bn(2, "member to member"),
+        nb(3, "send")
+      ),
+      notOneOf(word("rate"), word("price"))
+    )
+  },
+  {
+    id: "transfers-ach-direct-debit",
+    category: "payment-fraud",
+    title: "Transfers, ACH and direct debit",
+    description: "Discussion of pushing or pulling funds via ACH, direct debit or bill pay, including chatter about pending and settlement timing.",
+    // Source rows: 6, 8, 18, 41. Row 18 was missing an OR before "Direct Debit".
+    query: or(
+      bn(1, "transfer"),
+      nb(1, "transfer"),
+      bn(5, "ach"),
+      nb(4, "pull"),
+      nb(4, "push"),
+      bn(4, "pending"),
+      bn(4, "settle"),
+      nb(4, "link"),
+      brandWith("billpay", "acctverify"),
+      and(phrase(BRAND), or(phrase(lit("direct debit")), phrase(lit("direct deposit"))))
+    )
+  },
+  {
+    id: "wallet-linking",
+    category: "payment-fraud",
+    title: "Wallet linking and instant funding",
+    description: "Linking the brand to mobile wallets for instant funding, and 'linkable' account trading where a name match is being sold.",
+    // Source rows: 19, 44, 51
+    query: and(
+      or(
+        bn(5, "apple pay"),
+        bn(5, "apple"),
+        bn(3, "apple linkable"),
+        bn(2, "linkable"),
+        bn(2, "linkables"),
+        nb(2, "linkable"),
+        nb(2, "link"),
+        and(phrase(BRAND), phrase(lit("name match")))
+      ),
+      notOneOf(word("espn"), word("airtag"))
+    )
+  },
+  {
+    id: "card-data-exposure",
+    category: "payment-fraud",
+    title: "Card data and virtual cards",
+    description: "Brand-issued card details being traded: expiry, CVV, virtual card numbers and card activation.",
+    // Source rows: 43
+    query: and(
+      brandWith("exp", "cvv", "vcc", "debit"),
+      notOneOf(word("checking"), word("limits"))
+    )
+  },
+  {
+    id: "card-loading",
+    category: "payment-fraud",
+    title: "Card and account loading",
+    description: "'Loading' services that push stolen funds onto brand accounts or cards for a cut.",
+    // Source rows: 42
+    query: or(
+      nb(1, "loading"),
+      nb(1, "load"),
+      bn(1, "loads"),
+      bn(1, "loading"),
+      bn(3, "drop"),
+      bn(2, "cash"),
+      and(
+        phrase(BRAND),
+        or(
+          phrase(lit("loading method")),
+          phrase(lit("loading guide")),
+          phrase(lit("loading tut")),
+          phrase(lit("loading tutorial"))
+        )
+      )
+    )
+  },
+  {
+    id: "cross-platform-cashout",
+    category: "payment-fraud",
+    title: "Cross-platform cash-out",
+    description: "Moving funds from the brand into other consumer payment apps to break the trail.",
+    // Source rows: 56
+    query: and(
+      phrase(BRAND),
+      or(
+        phrase(lit("cash app")),
+        word("venmo"),
+        phrase(lit("transfer to paypal")),
+        phrase(lit("visa money transfer"))
+      )
+    )
+  },
+  {
+    id: "crypto-offramp",
+    category: "payment-fraud",
+    title: "Crypto off-ramp",
+    description: "Converting funds held at the brand into cryptocurrency through exchanges and P2P markets.",
+    // Source rows: 63
+    query: and(
+      phrase(BRAND),
+      or(
+        word("crypto"),
+        word("moonpay"),
+        word("switchere"),
+        word("kraken"),
+        word("paxful"),
+        word("noones"),
+        word("coinomi"),
+        word("coinzoom"),
+        word("bitcoin"),
+        word("btc")
+      )
+    )
+  },
+  {
+    id: "mobile-check-deposit",
+    category: "deposit-fraud",
+    title: "Mobile check deposit fraud",
+    description: "Check fraud against mobile deposit, traded under slang including 'glass', 'MCD', 'slips' and 'persy'.",
+    // Source rows: 2, 13, 35, 46
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(5, "checks"),
+      bn(5, "check"),
+      bn(5, "mobile deposit"),
+      nb(5, "mobile deposit"),
+      bn(5, "slip"),
+      bn(5, "slips"),
+      bn(5, "glass"),
+      bn(5, "md"),
+      bn(5, "mcd"),
+      bn(5, "treasury"),
+      nb(5, "treasury"),
+      bn(5, "persy"),
+      bn(5, "deposit limit"),
+      and(phrase(BRAND), or(prefix("stimm"), word("mcd"), phrase(lit("pop on"))))
+    )
+  },
+  {
+    id: "atm-abuse",
+    category: "deposit-fraud",
+    title: "ATM abuse and 'box work'",
+    description: "ATM deposit and withdrawal manipulation, including dispute-driven 'box work' against cash machines.",
+    // Source rows: 9, 47, 57, 70
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(2, "atm"),
+      bn(2, "withdrawal"),
+      and(phrase(BRAND), phrase(lit("box work"))),
+      and(
+        phrase(BRAND),
+        or(
+          phrase(lit("atm deposit")),
+          phrase(lit("atm withdrawal")),
+          phrase(lit("atm withdraw")),
+          phrase(lit("atm limit")),
+          phrase(lit("atm card")),
+          phrase(lit("cash withdrawal fee"))
+        )
+      )
+    )
+  },
+  {
+    id: "retail-cashout-network",
+    category: "deposit-fraud",
+    title: "Retail cash-out network",
+    description: "Cash-out through retail and ATM partner networks, where funds are pulled at a storefront rather than a branch.",
+    // Source rows: 30
+    industries: [
+      Industry.BANKING,
+      Industry.FINANCIAL_SERVICES,
+      Industry.FINTECH,
+      Industry.PAYMENTS
+    ],
+    query: or(
+      bn(5, "allpoint"),
+      bn(5, "walgreens"),
+      bn(5, "cvs"),
+      bn(5, "7-eleven"),
+      bn(5, "7eleven"),
+      bn(5, "711"),
+      bn(5, "circle k"),
+      bn(5, "target"),
+      bn(5, "visa plus alliance"),
+      bn(3, "moneypass"),
+      bn(3, "vanilladirect"),
+      bn(3, "vanilla"),
+      bn(3, "dollar general"),
+      bn(3, "dollar tree"),
+      bn(3, "safeway"),
+      bn(3, "walmart"),
+      bn(3, "speedway")
+    )
+  },
+  {
+    id: "otp-bots",
+    category: "account-takeover",
+    title: "OTP bots and 2FA bypass",
+    description: "Automated one-time-passcode interception services targeting the brand's login and step-up flows.",
+    // Source rows: 34
+    query: or(
+      bn(2, "otp"),
+      nb(1, "otp"),
+      phrase(BRAND, lit("otp bot")),
+      bn(2, "2fa"),
+      bn(2, "code"),
+      bn(2, "bypass"),
+      bn(2, "bot"),
+      bn(2, "bots")
+    )
+  },
+  {
+    id: "remote-access-tooling",
+    category: "account-takeover",
+    title: "Remote-access tooling",
+    description: "Legitimate remote-management tools named alongside the brand, the standard toolkit for support-impersonation account takeover.",
+    // Source rows: 29, 64. Truncated by the export; recoverable portion only.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("action1"),
+        phrase(lit("ammy admin")),
+        word("ammyadmin"),
+        word("anydesk"),
+        phrase(lit("any desk")),
+        word("atera"),
+        word("beanywhere"),
+        phrase(lit("chrome remote desktop")),
+        word("connectwise"),
+        word("screenconnect"),
+        word("dameware"),
+        word("domotz"),
+        word("dwservice"),
+        word("fleetdeck"),
+        word("intelliadmin"),
+        phrase(lit("itarian endpoint manager")),
+        phrase(lit("level.io")),
+        word("meshcentral"),
+        word("mremoteng"),
+        phrase(lit("n-able")),
+        word("ngrok"),
+        phrase(lit("pdq deploy")),
+        word("pulseway"),
+        word("realvnc"),
+        phrase(lit("remote utilities")),
+        word("rport")
+      )
+    )
+  },
+  {
+    id: "antidetect-kyc-evasion",
+    category: "account-takeover",
+    title: "Anti-detect and KYC evasion tooling",
+    description: "Fingerprint spoofing, residential proxies and emulators used to defeat the brand's device and identity checks.",
+    // Source row: 40. The original filtered to Telegram OR Dread; DarkOwl's
+    // `source` takes one value, so precision comes from the tooling terms.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("tlo"),
+        word("scamalytics"),
+        word("burner"),
+        prefix("prox"),
+        word("vpn"),
+        word("vps"),
+        word("antidetect"),
+        phrase(lit("anti-detect")),
+        prefix("emulat")
+      )
+    )
+  },
+  {
+    id: "brand-domains-sso",
+    category: "account-takeover",
+    title: "Brand domains and SSO endpoints",
+    description: "The brand's own domains and identity-provider endpoints appearing in credential and access chatter.",
+    // Source row: 31, as proximity not literal hostnames — the index tokenizes
+    // `chime.okta.com`, so a glued literal would never match. Row 23's
+    // "[brand] pass*"~1 is omitted: no wildcards inside a phrase.
+    query: and(
+      or(bn(2, "okta"), bn(2, "login"), bn(2, "portal"), bn(1, "bank")),
+      notOneOf(word("zendesk"))
+    )
+  },
+  {
+    id: "account-opening-abuse",
+    category: "onboarding-abuse",
+    title: "Account opening and self-registration",
+    description: "Bulk or fraudulent account creation against the brand, including 'self-reg' and 'drop' accounts opened on stolen identities.",
+    // Source rows: 5, 17, 54
+    query: or(
+      bn(5, "enroll"),
+      nb(5, "enroll"),
+      bn(5, "open"),
+      nb(5, "open"),
+      bn(5, "drop"),
+      nb(5, "drop"),
+      nb(5, "make"),
+      nb(5, "create"),
+      nb(5, "fresh"),
+      nb(5, "register"),
+      bn(5, "self-reg"),
+      bn(5, "selfreg"),
+      bn(5, "self-registered"),
+      bn(5, "self register"),
+      bn(1, "fullz")
+    )
+  },
+  {
+    id: "identity-documents",
+    category: "onboarding-abuse",
+    title: "Identity documents and fullz",
+    description: "Trade in identity packages and lookup services used to pass onboarding checks. Anchored to the brand at the root, since the source query was brand-independent.",
+    // Source row: 15. Lexicon-only, so the renderer AND-s the anchor on.
+    query: or(
+      word("fullz"),
+      phrase(lit("get pros")),
+      phrase(lit("driver's license")),
+      phrase(lit("tlo bot")),
+      phrase(lit("tlo plug")),
+      phrase(lit("need dl")),
+      phrase(lit("get id"))
+    )
+  },
+  {
+    id: "referral-bonus-abuse",
+    category: "onboarding-abuse",
+    title: "Referral and bonus abuse",
+    description: "Methods for farming the brand's referral bonuses and promotional offers, often paired with fake direct deposits.",
+    // Source rows: 48
+    query: and(
+      or(bn(3, "referral"), bn(3, "bonus"), bn(3, "promotion"), bn(3, "offer")),
+      or(
+        word("bypass"),
+        word("dd"),
+        phrase(lit("direct deposit")),
+        phrase(lit("work around")),
+        word("trick"),
+        word("method"),
+        word("glitch"),
+        word("tutorial"),
+        word("tut"),
+        word("wave"),
+        word("sauce")
+      )
+    )
+  },
+  {
+    id: "insider-recruitment",
+    category: "insider-threat",
+    title: "Insider recruitment",
+    description: "Actors seeking or advertising an employee on the inside ('inny'), the highest-severity signal in this catalog.",
+    // Source rows: 7, 38
+    query: and(
+      or(
+        bn(4, "inny"),
+        bn(4, "insider"),
+        and(
+          phrase(BRAND),
+          or(
+            word("insider"),
+            word("inny"),
+            phrase(lit("in office")),
+            word("employee"),
+            phrase(lit("i work at")),
+            phrase(lit("i am an employee")),
+            phrase(lit("i can get access")),
+            phrase(lit("i have access to")),
+            phrase(lit("employed at")),
+            word("occupation")
+          )
+        )
+      ),
+      notOneOf(phrase(lit("welcome to insider chat")))
+    )
+  },
+  {
+    id: "mule-crew-recruitment",
+    category: "insider-threat",
+    title: "Mule and cash-out crew recruitment",
+    description: "Recruitment of account holders to receive and forward funds, priced as a revenue split ('50/50', '60/40').",
+    // Source rows: 39
+    query: or(
+      bn(5, "cl"),
+      bn(5, "mule"),
+      bn(5, "tap in"),
+      bn(5, "50/50"),
+      bn(5, "60/40"),
+      bn(5, "striker")
+    )
+  },
+  {
+    id: "methods-and-tutorials",
+    category: "tradecraft",
+    title: "Methods, 'sauce' and tutorials",
+    description: "Fraud methods being taught or sold against the brand, under the usual slang: sauce, glitch, tut, wave, motion, tap in.",
+    // Source rows: 4, 21, 59
+    query: or(
+      bn(3, "sauce"),
+      bn(3, "method"),
+      bn(3, "guide"),
+      bn(3, "tut"),
+      bn(3, "tutorial"),
+      bn(4, "hack"),
+      bn(4, "glitch"),
+      bn(4, "wave"),
+      bn(4, "motion"),
+      bn(4, "walkthrough"),
+      bn(4, "walk through"),
+      bn(2, "tap in"),
+      bn(2, "tapin"),
+      nb(2, "tapn")
+    )
+  },
+  {
+    id: "hack-leak-chatter",
+    category: "tradecraft",
+    title: "Hack and leak chatter",
+    description: "Claims of having hacked, breached or leaked the brand, whether credible or not.",
+    // Source rows: 28
+    query: or(
+      bn(4, "hack"),
+      bn(4, "glitch"),
+      nb(4, "hacking"),
+      bn(4, "leak"),
+      bn(4, "leaked")
+    )
+  },
+  {
+    id: "support-impersonation",
+    category: "brand-abuse",
+    title: "Support impersonation",
+    description: "Actors impersonating the brand's support or service staff to social-engineer customers.",
+    // Source rows: 36
+    query: or(
+      bn(1, "agent"),
+      bn(1, "support"),
+      bn(1, "service"),
+      bn(1, "customer"),
+      nb(1, "impersonate"),
+      bn(1, "impersonation"),
+      bn(3, "scam"),
+      nb(1, "scam")
+    )
+  },
+  {
+    id: "social-impersonation",
+    category: "brand-abuse",
+    title: "Social account impersonation",
+    description: "The brand discussed alongside social platforms, where fake support and giveaway accounts are staged.",
+    // Source rows: 25
+    query: or(
+      bn(5, "instagram"),
+      bn(5, "insta"),
+      bn(5, "facebook"),
+      bn(5, "twitter"),
+      bn(5, "tiktok")
+    )
+  },
+  {
+    id: "vendor-supply-chain",
+    category: "data-exposure",
+    title: "Vendor and BPO supply chain",
+    description: "Outsourced support and processing vendors named alongside the brand, where a third-party breach exposes brand customer data.",
+    // Source row: 60, truncated by the export. Generic BPO/CX providers; a
+    // per-org vendor list would be materially better.
+    query: and(
+      phrase(BRAND),
+      or(
+        word("zendesk"),
+        word("teleperformance"),
+        word("concentrix"),
+        word("taskus"),
+        word("genpact"),
+        word("ubiquity"),
+        word("hioperator"),
+        word("galileo"),
+        word("fiserv"),
+        phrase(lit("etech global"))
+      )
+    )
+  }
+];
+new Map(
+  SCAN_TEMPLATES.map((template) => [template.id, template])
+);
+
 // src/client.ts
 function trimTrailingSlashes(url) {
   return url.replace(/\/+$/, "");