feat(tags): Add support for asset tagging

[Rutvik G (rutvik-gs)]

How to test

1. CRUD

censys tags create "$TAG" --description "cencli demo" --privacy private
censys tags list --name "$TAG"
censys tags list --order-by created_at_desc --page-size 5
censys tags get "$TAG" --asset-count
censys tags get "$TAG" -O tree
censys tags get "$TAG" -O yaml
censys tags update "$TAG" --privacy shared --description "now shared"
censys tags update "$TAG" --clear-description
censys tags get "$TAG"

2. Assign / unassign explicit assets

censys tags assign "$TAG" 8.8.8.8
censys tags assign "$TAG" 1.1.1.1 censys.io:443
echo "9.9.9.9" | censys tags assign "$TAG" --input-file -

censys tags assignments "$TAG"
censys tags assignments "$TAG" --asset-type host
censys tags assignments "$TAG" --asset 8.8.8.8
censys tags assignments "$TAG" --streaming
censys tags get "$TAG" --asset-count

censys tags unassign "$TAG" 9.9.9.9                       # single = no prompt
censys tags unassign "$TAG" 1.1.1.1 censys.io:443 --yes   # multi = prompts
censys tags assignments "$TAG"

3. Bulk assign (async job)

censys tags assign "$TAG" --query 'host.services.port: 22' --max-assets 5 --wait --yes

# submit without --wait, then copy the ID from the output into the next command
censys tags assign "$TAG" --query 'host.services.port: 443' --max-assets 5 --yes
OP=<paste-operation-id>

censys tags operations get "$TAG" "$OP" --wait
censys tags operations list "$TAG"
censys tags operations list --page-size 5                 # org-wide
censys tags operations list --type bulk_create --status succeeded --page-size 5
censys tags get "$TAG" --asset-count

4. Cancel a running job

# big enough to still be running — tags up to 2000 assets, step 5 removes them
censys tags assign "$TAG" --query 'host.services.port: 80' --max-assets 2000 --yes
BIG=<paste-operation-id>

censys tags operations cancel "$TAG" "$BIG" --yes
censys tags operations get "$TAG" "$BIG"
censys tags operations list "$TAG" --status cancelled

If the job finishes first you'll get Conflict / Tag operation not cancellable (exit 1) instead — expected, just not the happy path.

5. Bulk unassign (async job)

censys tags unassign "$TAG" --created-after 2026-07-01T00:00:00Z --wait --yes
censys tags unassign "$TAG" --all --wait --yes
censys tags assignments "$TAG"
censys tags get "$TAG" --asset-count
censys tags operations list "$TAG" --type bulk_delete

6. Guardrails — all rejected before any request

censys tags assign   "$TAG" 8.8.8.8 --query 'host.services.port: 22'
censys tags unassign "$TAG" 8.8.8.8 --all
censys tags unassign "$TAG" --all --created-before 2026-01-01T00:00:00Z
censys tags unassign "$TAG" --created-before 2020-01-01T00:00:00Z --created-after 2026-01-01T
censys tags assign   "$TAG" 8.8.8.8 --max-assets 10
censys tags unassign "$TAG" 8.8.8.8 --wait
censys tags unassign "$TAG" --all --timeout 5m
censys tags operations cancel "$TAG" not-a-uuid --yes
censys tags unassign "$TAG" --all < /dev/null

7. Rename and delete

censys tags update "$TAG" --name "$TAG-renamed"
censys tags get "$TAG-renamed"
censys tags delete "$TAG-renamed" < /dev/null      # refuses: needs --yes
censys tags delete "$TAG-renamed"                  # real prompt, answer it
censys tags list --name "$TAG-renamed"