@chainpatrol/cli 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @chainpatrol/cli
 
+## 0.21.0
+
+### Minor Changes
+
+- b3e77eb: `orgs list` and `orgs get` now surface each organization's "Obligatory
+  Organization Admin Approval" state (`Organization.requiresCustomerReview`)
+  alongside its per-asset-type scope. The new response field is
+  `obligatoryAdminApproval: { active, assetTypes }` — an empty `assetTypes`
+  list with `active: true` means approval applies to every asset type
+  (matches the in-app UI's behaviour when no narrowing has been configured).
+
+  `orgs list` also accepts three new filters that compose with the
+  existing ones via AND:
+
+  - `--obligatory-approval-active` / `--obligatory-approval-inactive` —
+    filter on the toggle itself.
+  - `--obligatory-approval-asset-type <csv>` — return only orgs whose
+    approval scope covers every listed asset type (an org's empty
+    per-asset-type list still counts as "all types"). Passing this flag
+    implies the feature is on, so it can't be combined with
+    `--obligatory-approval-inactive`.
+
+  Server-side work in `@chainpatrol/external-trpc` and `@chainpatrol/validation`
+  extends the `/user/orgs` and `/user/orgs/{slug}` schemas accordingly; both
+  are private packages and don't need version bumps.
+
 ## 0.20.0
 
 ### Minor Changes

package/dist/{chunk-3LJTWYT6.js → chunk-4N2YKTJ5.js}

@@ -199,6 +199,12 @@ description: |
   "fetch org details", "org info",
   "orgs with takedowns off", "automation off across orgs",
   "which customers have X enabled", "service toggles by org",
+  "obligatory admin approval", "obligatory organization admin approval",
+  "obligatory approval", "admin approval enabled", "admin approval orgs",
+  "requires customer review", "requires admin approval",
+  "orgs that require admin approval", "orgs requiring approval",
+  "which orgs require approval for twitter", "approval scope",
+  "admin approval asset types", "approval per asset type",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
   "check this asset", "asset check", "lookup asset status",
   "what is ARCHIVE_ORG", "what does PAGE mean", "list asset types",
@@ -656,14 +662,17 @@ Guide. Key signals in the response:
 
 Use \`--all\` to snapshot every org you have access to instead of a single slug.
 
-### \`orgs list\` \u2014 List organizations with subscription status and service toggles
+### \`orgs list\` \u2014 List organizations with subscription status, service toggles, and admin-approval scope
 
 Returns every organization the caller can see, with each org's
-subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`) and
-which services are active. Use it to answer questions like "which
-customers have takedowns enabled but automation off?" or "which prospects
-don't have detection turned on yet?" \u2014 filters compose with AND and are
-applied server-side, so one call returns the final list.
+subscription status (\`PROSPECT\`, \`TRIAL\`, \`ACTIVE\`, \`INTEGRATION\`),
+which services are active, and the per-org "Obligatory Organization
+Admin Approval" toggle (with its asset-type scope). Use it to answer
+questions like "which customers have takedowns enabled but automation
+off?", "which prospects don't have detection turned on yet?", or "which
+orgs require admin approval before adding Twitter assets to the
+blocklist?" \u2014 filters compose with AND and are applied server-side, so
+one call returns the final list.
 
 \`\`\`bash
 chainpatrol --json orgs list \\
@@ -686,6 +695,34 @@ misleading filters like "reporting.automated=true" that don't mean
 anything. \`detection\` and \`darkWebMonitoring\` have always been
 single-flag services.
 
+#### Obligatory Organization Admin Approval
+
+Each org also has a separate "Obligatory Organization Admin Approval"
+toggle (\`Organization.requiresCustomerReview\` in the schema, surfaced
+on the Services settings page in the app) that gates customer-side
+review of proposals ChainPatrol staff have already approved before
+they're added to the blocklist. It is NOT one of the operational
+services above \u2014 it is an org-policy toggle with its own per-asset-type
+scope.
+
+Each org's response includes:
+
+\`\`\`json
+{
+  "obligatoryAdminApproval": {
+    "active": true,
+    "assetTypes": ["TWITTER", "URL"]
+  }
+}
+\`\`\`
+
+- \`active=true\` + empty \`assetTypes\` means approval applies to
+  **all** asset types \u2014 the org has not narrowed the scope.
+- \`active=true\` + a non-empty \`assetTypes\` list means approval is
+  required only for those asset types.
+- \`active=false\` means no approval is required; \`assetTypes\` is
+  always empty in that case.
+
 So per-org JSON looks like:
 
 \`\`\`json
@@ -697,7 +734,8 @@ So per-org JSON looks like:
     "takedowns":         { "active": true, "automated": false },
     "detection":         { "active": true },
     "darkWebMonitoring": { "active": false }
-  }
+  },
+  "obligatoryAdminApproval": { "active": true, "assetTypes": ["TWITTER"] }
 }
 \`\`\`
 
@@ -706,7 +744,7 @@ explain that the flag exists in the DB but has no operational effect and
 isn't exposed by the public API \u2014 only \`takedowns.automated\` carries a
 real meaning.
 
-Filter flags (all optional, all comma-separated lists):
+Filter flags (all optional, all comma-separated lists where noted):
 
 - \`--query <text>\` partial name match (substring, case-insensitive)
 - \`--subscription-status <list>\` one or more of \`PROSPECT\`, \`TRIAL\`,
@@ -719,6 +757,16 @@ Filter flags (all optional, all comma-separated lists):
   meaningful automation toggle. Passing any other service name errors out.
 - \`--service-manual <list>\` services whose automation must be OFF.
   Same restriction \u2014 only \`takedowns\`.
+- \`--obligatory-approval-active\` \u2014 only orgs with admin approval on
+- \`--obligatory-approval-inactive\` \u2014 only orgs with admin approval off
+- \`--obligatory-approval-asset-type <list>\` \u2014 only orgs whose admin
+  approval scope covers EVERY listed asset type. The match treats an
+  org's empty per-asset-type list as "applies to all asset types", so a
+  fully-broad org matches every value passed here. Passing this flag
+  implies the feature is on, so it can't be combined with
+  \`--obligatory-approval-inactive\`. Use the canonical asset-type enum
+  names (\`TWITTER\`, \`URL\`, \`PAGE\`, \u2026); run \`chainpatrol asset types\`
+  to see them all.
 
 Service names: \`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\`,
 \`detection\`, \`darkWebMonitoring\`.
@@ -727,16 +775,36 @@ Customers see only orgs they're a member of. Staff/superuser sessions see
 every matching org. The response is the same in both cases; visibility is
 enforced server-side.
 
+#### Use case: finding which orgs require admin approval for an asset type
+
+When a user asks "which orgs require admin approval before blocking
+Twitter assets?", reach straight for the filter \u2014 no client-side
+post-processing needed:
+
+\`\`\`bash
+chainpatrol --json orgs list --obligatory-approval-asset-type TWITTER
+\`\`\`
+
+To audit just the broad opt-ins ("which orgs require approval for
+everything?"), filter on the toggle and inspect \`assetTypes\` in the
+output \u2014 an empty array means "all":
+
+\`\`\`bash
+chainpatrol --json orgs list --obligatory-approval-active \\
+  | jq '.organizations[] | select(.obligatoryAdminApproval.assetTypes | length == 0) | .slug'
+\`\`\`
+
 ### \`orgs get\` \u2014 Get a single organization by slug
 
 Look up one organization the caller has access to. Returns the same per-org
 shape as a single row from \`orgs list\` \u2014 \`active\` for every service,
 plus \`automated\` on \`takedowns\` only (see the note above on why other
-services don't expose an automation flag). Anything you could read from
-\`orgs list\` you can also read here without paging or filtering. Use it
-when the user names a specific customer ("show me acme's setup", "is
-takedowns automation on for morpho?") and you don't need the rest of the
-catalogue.
+services don't expose an automation flag), plus \`obligatoryAdminApproval\`
+(\`active\` + \`assetTypes\`). Anything you could read from \`orgs list\` you
+can also read here without paging or filtering. Use it when the user
+names a specific customer ("show me acme's setup", "is takedowns
+automation on for morpho?", "does this org require admin approval for
+Twitter?") and you don't need the rest of the catalogue.
 
 \`\`\`bash
 chainpatrol orgs get <slug>

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-3LJTWYT6.js";
+} from "./chunk-4N2YKTJ5.js";
 import "./chunk-6VTWWGNV.js";
 import {
   DateTime
@@ -916,6 +916,9 @@ ${getTopLevelHelp()}
     serviceInactive: { type: "string" },
     serviceAutomated: { type: "string" },
     serviceManual: { type: "string" },
+    obligatoryApprovalActive: { type: "boolean" },
+    obligatoryApprovalInactive: { type: "boolean" },
+    obligatoryApprovalAssetType: { type: "string" },
     query: { type: "string" },
     assetType: { type: "string" },
     takedownStatus: { type: "string" },
@@ -1558,7 +1561,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-QXA6GLCV.js");
+        const { runOrgsList } = await import("./list-MHICJ2TK.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1566,6 +1569,9 @@ async function main() {
           serviceInactive: cli.flags.serviceInactive,
           serviceAutomated: cli.flags.serviceAutomated,
           serviceManual: cli.flags.serviceManual,
+          obligatoryApprovalActive: cli.flags.obligatoryApprovalActive,
+          obligatoryApprovalInactive: cli.flags.obligatoryApprovalInactive,
+          obligatoryApprovalAssetType: cli.flags.obligatoryApprovalAssetType,
           json: jsonMode,
           outputFormat: cliContext.outputFormat
         });
@@ -1574,7 +1580,7 @@ async function main() {
       if (subcommand === "get") {
         const positionalSlug = action;
         const slug = positionalSlug ?? await tryResolveOrg();
-        const { runOrgsGet } = await import("./get-K7VHV5X2.js");
+        const { runOrgsGet } = await import("./get-XN752KSL.js");
         await runOrgsGet({
           slug,
           json: jsonMode,
@@ -1705,12 +1711,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-A36WQLMU.js");
+      const { setupSkill } = await import("./setup-skill-UEOROLCF.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-A36WQLMU.js");
+      const { uninstallSkill } = await import("./setup-skill-UEOROLCF.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{get-K7VHV5X2.js → get-XN752KSL.js}

@@ -26,6 +26,11 @@ function summarizeServices(org) {
   if (org.services.darkWebMonitoring.active) parts.push("darkWebMonitoring");
   return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
 }
+function summarizeObligatoryAdminApproval(org) {
+  if (!org.obligatoryAdminApproval.active) return "off";
+  const types = org.obligatoryAdminApproval.assetTypes;
+  return types.length === 0 ? "on (all asset types)" : `on (${types.join(", ")})`;
+}
 async function runOrgsGet(options) {
   const slug = options.slug?.trim();
   if (!slug) {
@@ -45,7 +50,8 @@ async function runOrgsGet(options) {
       `# ${organization.name} (\`${organization.slug}\`)`,
       "",
       `- Subscription status: ${organization.subscriptionStatus}`,
-      `- Services: ${summarizeServices(organization)}`
+      `- Services: ${summarizeServices(organization)}`,
+      `- Obligatory admin approval: ${summarizeObligatoryAdminApproval(organization)}`
     ].join("\n"),
     csv: toCsvRows([
       {
@@ -59,13 +65,20 @@ async function runOrgsGet(options) {
         // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: organization.services.takedowns.automated,
         detectionActive: organization.services.detection.active,
-        darkWebMonitoringActive: organization.services.darkWebMonitoring.active
+        darkWebMonitoringActive: organization.services.darkWebMonitoring.active,
+        obligatoryAdminApprovalActive: organization.obligatoryAdminApproval.active,
+        // Empty list + active=true means "applies to all asset types" — read
+        // the active column alongside this one to interpret.
+        obligatoryAdminApprovalAssetTypes: organization.obligatoryAdminApproval.assetTypes.join("|")
       }
     ]),
     human: () => {
       console.log(`${organization.name}  (slug: ${organization.slug})`);
       console.log(`  subscriptionStatus: ${organization.subscriptionStatus}`);
       console.log(`  services: ${summarizeServices(organization)}`);
+      console.log(
+        `  obligatoryAdminApproval: ${summarizeObligatoryAdminApproval(organization)}`
+      );
     }
   });
 }

package/dist/{list-QXA6GLCV.js → list-MHICJ2TK.js}

@@ -128,13 +128,41 @@ function summarizeServices(org) {
   }
   return parts.length > 0 ? parts.join(" ") : "(no services enabled)";
 }
+function summarizeObligatoryAdminApproval(org) {
+  if (!org.obligatoryAdminApproval.active) return "off";
+  const types = org.obligatoryAdminApproval.assetTypes;
+  return types.length === 0 ? "on (all asset types)" : `on (${types.join(", ")})`;
+}
+function buildObligatoryAdminApprovalFilter(options) {
+  if (options.obligatoryApprovalActive && options.obligatoryApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --obligatory-approval-active and --obligatory-approval-inactive can't both be passed.",
+      ExitCode.USAGE
+    );
+  }
+  const assetTypeStrings = splitCsv(options.obligatoryApprovalAssetType).map(
+    (value) => value.toUpperCase()
+  );
+  if (assetTypeStrings.length > 0 && options.obligatoryApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --obligatory-approval-asset-type implies the feature is on, so it can't be combined with --obligatory-approval-inactive.",
+      ExitCode.USAGE
+    );
+  }
+  const filter = {};
+  if (options.obligatoryApprovalActive) filter.active = true;
+  if (options.obligatoryApprovalInactive) filter.active = false;
+  if (assetTypeStrings.length > 0) filter.assetTypes = assetTypeStrings;
+  return Object.keys(filter).length > 0 ? filter : void 0;
+}
 async function runOrgsList(options) {
   const client = options.apiClient ?? createApiClient();
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
   const input = {
     query: options.query ?? "",
     subscriptionStatus: parseSubscriptionStatuses(options.subscriptionStatus),
-    services: buildServicesFilter(options)
+    services: buildServicesFilter(options),
+    obligatoryAdminApproval: buildObligatoryAdminApprovalFilter(options)
   };
   const result = await client.getUserOrgs(input);
   const organizations = result.organizations;
@@ -145,7 +173,7 @@ async function runOrgsList(options) {
       `# Organizations (${organizations.length})`,
       "",
       ...organizations.map(
-        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 ${summarizeServices(org)}`
+        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 ${summarizeServices(org)} \u2014 admin-approval: ${summarizeObligatoryAdminApproval(org)}`
       )
     ].join("\n"),
     csv: toCsvRows(
@@ -160,7 +188,12 @@ async function runOrgsList(options) {
         // `takedowns` is the only service with a meaningful automation flag.
         takedownsAutomated: org.services.takedowns.automated,
         detectionActive: org.services.detection.active,
-        darkWebMonitoringActive: org.services.darkWebMonitoring.active
+        darkWebMonitoringActive: org.services.darkWebMonitoring.active,
+        obligatoryAdminApprovalActive: org.obligatoryAdminApproval.active,
+        // Empty list + active means "applies to all asset types"; we keep
+        // the cell empty in CSV so spreadsheets render it as the natural
+        // "no narrowing" value — pair it with the active column.
+        obligatoryAdminApprovalAssetTypes: org.obligatoryAdminApproval.assetTypes.join("|")
       }))
     ),
     human: () => {
@@ -173,7 +206,7 @@ async function runOrgsList(options) {
       const nameWidth = Math.max(...organizations.map((org) => org.name.length), 4);
       for (const org of organizations) {
         console.log(
-          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${summarizeServices(org)}`
+          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${summarizeServices(org)}  admin-approval=${summarizeObligatoryAdminApproval(org)}`
         );
       }
     }

package/dist/{setup-skill-A36WQLMU.js → setup-skill-UEOROLCF.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-3LJTWYT6.js";
+} from "./chunk-4N2YKTJ5.js";
 import "./chunk-6VTWWGNV.js";
 export {
   getBundledSkillContent,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [