@chainpatrol/cli 0.21.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @chainpatrol/cli
 
+## 0.22.0
+
+### Minor Changes
+
+- e2b28a5: Expose `contactUrl` (main communication channel) on `orgs list` and `orgs get` output. Add `organization.missing-contact-url` healthcheck. Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation supports the new field and healthcheck; both are private packages and don't need version bumps.
+- b1e35f0: Surface pending Wallet Blocking / Takedown approvals on `orgs list` and `orgs get`. Each org now reports `pendingServiceApprovals` — open requests by lower-level members to enable an approval-gated service (Wallet Blocking / Takedowns) that a higher-up at the org has not yet approved. Adds `--pending-approval-active`, `--pending-approval-inactive`, and `--pending-approval-service <protection|takedowns>` filters to `orgs list` so you can track which organizations are awaiting sign-off, distinct from which have the service turned off. Server-side work in @chainpatrol/external-trpc and @chainpatrol/validation backs the new field and filters; both are private packages and don't need version bumps.
+
 ## 0.21.0
 
 ### Minor Changes

package/dist/{chunk-4N2YKTJ5.js → chunk-LKITFBIG.js}

@@ -205,6 +205,12 @@ description: |
   "orgs that require admin approval", "orgs requiring approval",
   "which orgs require approval for twitter", "approval scope",
   "admin approval asset types", "approval per asset type",
+  "pending approval", "pending approvals", "pending service approval",
+  "orgs with pending approval", "pending wallet blocking approval",
+  "pending takedown approval", "awaiting approval", "waiting for approval",
+  "is protection active approval", "wallet blocking approval",
+  "who needs to approve wallet blocking", "service change request",
+  "track orgs with pending approval", "orgs awaiting sign-off",
   "is this URL blocked", "is this domain blocked", "is this address blocked",
   "check this asset", "asset check", "lookup asset status",
   "what is ARCHIVE_ORG", "what does PAGE mean", "list asset types",
@@ -735,10 +741,48 @@ So per-org JSON looks like:
     "detection":         { "active": true },
     "darkWebMonitoring": { "active": false }
   },
-  "obligatoryAdminApproval": { "active": true, "assetTypes": ["TWITTER"] }
+  "obligatoryAdminApproval": { "active": true, "assetTypes": ["TWITTER"] },
+  "pendingServiceApprovals": [
+    {
+      "service": "protection",
+      "automated": false,
+      "serviceType": "isProtectionActive",
+      "serviceName": "Wallet Blocking",
+      "requestedAt": "2026-05-30T18:04:11.000Z"
+    }
+  ]
 }
 \`\`\`
 
+#### Pending service approvals (Wallet Blocking / Takedowns)
+
+Turning on **Wallet Blocking** (\`protection\`, the "is protection active"
+toggle) or **Takedowns** is approval-gated: when a lower-level org member
+tries to enable one, ChainPatrol records a pending request that a higher-up
+at the org \u2014 an org OWNER, or ChainPatrol staff acting as owner \u2014 must
+approve before the service actually turns on. \`pendingServiceApprovals\`
+lists those open, awaiting-sign-off requests per org.
+
+This is the answer to "which organizations have a pending approval for
+Wallet blocking or Takedown services?" \u2014 it is NOT the same as "which orgs
+have Wallet Blocking turned off". An org can have \`protection.active=false\`
+with **no** pending approval (nobody has asked) OR **with** a pending
+approval (someone asked and it's waiting on an owner). Only
+\`pendingServiceApprovals\` distinguishes the two.
+
+Each entry:
+
+- \`service\` \u2014 \`protection\` (Wallet Blocking) or \`takedowns\`, matching the
+  \`services\` keys.
+- \`automated\` \u2014 \`true\` when the request is for the automated variant
+  (e.g. "Automated Wallet Blocking").
+- \`serviceType\` \u2014 raw enum, e.g. \`isProtectionActive\`.
+- \`serviceName\` \u2014 human label, e.g. \`Wallet Blocking\`.
+- \`requestedAt\` \u2014 when the enable request was submitted (ISO 8601, UTC).
+
+An **empty array means nothing is awaiting approval** \u2014 read \`services\` for
+the current on/off state, never infer it from this field.
+
 When a user asks about "automated reporting / reviewing / protection",
 explain that the flag exists in the DB but has no operational effect and
 isn't exposed by the public API \u2014 only \`takedowns.automated\` carries a
@@ -767,6 +811,15 @@ Filter flags (all optional, all comma-separated lists where noted):
   \`--obligatory-approval-inactive\`. Use the canonical asset-type enum
   names (\`TWITTER\`, \`URL\`, \`PAGE\`, \u2026); run \`chainpatrol asset types\`
   to see them all.
+- \`--pending-approval-active\` \u2014 only orgs with at least one open
+  service-enable approval awaiting a higher-up's sign-off.
+- \`--pending-approval-inactive\` \u2014 only orgs with no pending approvals.
+- \`--pending-approval-service <list>\` \u2014 only orgs with a pending approval
+  for one of the listed services. Accepts \`protection\` (Wallet Blocking)
+  and/or \`takedowns\` \u2014 those are the only approval-gated services.
+  Matches both the manual and automated variant. Passing this flag implies
+  a pending approval exists, so it can't be combined with
+  \`--pending-approval-inactive\`.
 
 Service names: \`reporting\`, \`reviewing\`, \`protection\`, \`takedowns\`,
 \`detection\`, \`darkWebMonitoring\`.
@@ -794,17 +847,39 @@ chainpatrol --json orgs list --obligatory-approval-active \\
   | jq '.organizations[] | select(.obligatoryAdminApproval.assetTypes | length == 0) | .slug'
 \`\`\`
 
+#### Use case: tracking orgs with a pending Wallet Blocking / Takedown approval
+
+When a user asks "which organizations have a pending approval for Wallet
+blocking or Takedown services?", do NOT reach for \`--service-inactive
+protection\` \u2014 that lists orgs with the service turned OFF, which is a
+different question. Use the pending-approval filter, which surfaces
+staff-initiated enable requests still waiting on a higher-up:
+
+\`\`\`bash
+# Every org with a pending Wallet Blocking OR Takedown approval:
+chainpatrol --json orgs list --pending-approval-service protection,takedowns
+
+# Just Wallet Blocking:
+chainpatrol --json orgs list --pending-approval-service protection
+
+# Any pending approval at all, then read each org's pendingServiceApprovals:
+chainpatrol --json orgs list --pending-approval-active \\
+  | jq '.organizations[] | {slug, pending: [.pendingServiceApprovals[].serviceName]}'
+\`\`\`
+
 ### \`orgs get\` \u2014 Get a single organization by slug
 
 Look up one organization the caller has access to. Returns the same per-org
 shape as a single row from \`orgs list\` \u2014 \`active\` for every service,
 plus \`automated\` on \`takedowns\` only (see the note above on why other
 services don't expose an automation flag), plus \`obligatoryAdminApproval\`
-(\`active\` + \`assetTypes\`). Anything you could read from \`orgs list\` you
-can also read here without paging or filtering. Use it when the user
-names a specific customer ("show me acme's setup", "is takedowns
-automation on for morpho?", "does this org require admin approval for
-Twitter?") and you don't need the rest of the catalogue.
+(\`active\` + \`assetTypes\`) and \`pendingServiceApprovals\` (open Wallet
+Blocking / Takedown enable requests awaiting a higher-up's sign-off).
+Anything you could read from \`orgs list\` you can also read here without
+paging or filtering. Use it when the user names a specific customer ("show
+me acme's setup", "is takedowns automation on for morpho?", "does this org
+require admin approval for Twitter?", "is morpho waiting on a Wallet
+Blocking approval?") and you don't need the rest of the catalogue.
 
 \`\`\`bash
 chainpatrol orgs get <slug>

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   getCliVersion,
   isSkillInstalled,
   readInstalledSkillVersion
-} from "./chunk-4N2YKTJ5.js";
+} from "./chunk-LKITFBIG.js";
 import "./chunk-6VTWWGNV.js";
 import {
   DateTime
@@ -532,12 +532,16 @@ var HELP = {
       "--service-active <l>       Comma-separated services that must be active",
       "--service-inactive <l>     Comma-separated services that must be inactive",
       "--service-automated <l>    Services whose automation must be ON (only `takedowns` is accepted \u2014 the other services have no meaningful automation toggle)",
-      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)"
+      "--service-manual <l>       Services whose automation must be OFF (only `takedowns` is accepted)",
+      "--pending-approval-active     Only orgs with an open service-enable approval awaiting a higher-up's sign-off",
+      "--pending-approval-inactive   Only orgs with no pending service-enable approvals",
+      "--pending-approval-service <l> Only orgs with a pending approval for the listed service(s) \u2014 `protection` (Wallet Blocking) and/or `takedowns`"
     ],
     examples: [
       "chainpatrol orgs list --subscription-status ACTIVE",
       "chainpatrol orgs list --service-active takedowns --service-manual takedowns",
-      "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection"
+      "chainpatrol --json orgs list --subscription-status ACTIVE,TRIAL --service-active detection",
+      "chainpatrol --json orgs list --pending-approval-service protection,takedowns"
     ]
   },
   "orgs get": {
@@ -919,6 +923,9 @@ ${getTopLevelHelp()}
     obligatoryApprovalActive: { type: "boolean" },
     obligatoryApprovalInactive: { type: "boolean" },
     obligatoryApprovalAssetType: { type: "string" },
+    pendingApprovalActive: { type: "boolean" },
+    pendingApprovalInactive: { type: "boolean" },
+    pendingApprovalService: { type: "string" },
     query: { type: "string" },
     assetType: { type: "string" },
     takedownStatus: { type: "string" },
@@ -1561,7 +1568,7 @@ async function main() {
     }
     case "orgs": {
       if (subcommand === "list") {
-        const { runOrgsList } = await import("./list-MHICJ2TK.js");
+        const { runOrgsList } = await import("./list-JK4SRMPL.js");
         await runOrgsList({
           query: cli.flags.query,
           subscriptionStatus: cli.flags.subscriptionStatus,
@@ -1572,6 +1579,9 @@ async function main() {
           obligatoryApprovalActive: cli.flags.obligatoryApprovalActive,
           obligatoryApprovalInactive: cli.flags.obligatoryApprovalInactive,
           obligatoryApprovalAssetType: cli.flags.obligatoryApprovalAssetType,
+          pendingApprovalActive: cli.flags.pendingApprovalActive,
+          pendingApprovalInactive: cli.flags.pendingApprovalInactive,
+          pendingApprovalService: cli.flags.pendingApprovalService,
           json: jsonMode,
           outputFormat: cliContext.outputFormat
         });
@@ -1580,7 +1590,7 @@ async function main() {
       if (subcommand === "get") {
         const positionalSlug = action;
         const slug = positionalSlug ?? await tryResolveOrg();
-        const { runOrgsGet } = await import("./get-XN752KSL.js");
+        const { runOrgsGet } = await import("./get-GTACVCLE.js");
         await runOrgsGet({
           slug,
           json: jsonMode,
@@ -1711,12 +1721,12 @@ async function main() {
     case "setup":
     case "install":
     case "i": {
-      const { setupSkill } = await import("./setup-skill-UEOROLCF.js");
+      const { setupSkill } = await import("./setup-skill-V3HDWN7T.js");
       setupSkill({ json: jsonMode, cloud: cli.flags.cloud });
       break;
     }
     case "uninstall": {
-      const { uninstallSkill } = await import("./setup-skill-UEOROLCF.js");
+      const { uninstallSkill } = await import("./setup-skill-V3HDWN7T.js");
       uninstallSkill({ json: jsonMode });
       break;
     }

package/dist/{get-XN752KSL.js → get-GTACVCLE.js}

@@ -31,6 +31,13 @@ function summarizeObligatoryAdminApproval(org) {
   const types = org.obligatoryAdminApproval.assetTypes;
   return types.length === 0 ? "on (all asset types)" : `on (${types.join(", ")})`;
 }
+function summarizePendingApprovals(org) {
+  if (org.pendingServiceApprovals.length === 0) return "none";
+  const labels = Array.from(
+    new Set(org.pendingServiceApprovals.map((approval) => approval.serviceName))
+  );
+  return labels.join(", ");
+}
 async function runOrgsGet(options) {
   const slug = options.slug?.trim();
   if (!slug) {
@@ -49,14 +56,17 @@ async function runOrgsGet(options) {
     markdown: [
       `# ${organization.name} (\`${organization.slug}\`)`,
       "",
+      `- Contact URL: ${organization.contactUrl ?? "(not set)"}`,
       `- Subscription status: ${organization.subscriptionStatus}`,
       `- Services: ${summarizeServices(organization)}`,
-      `- Obligatory admin approval: ${summarizeObligatoryAdminApproval(organization)}`
+      `- Obligatory admin approval: ${summarizeObligatoryAdminApproval(organization)}`,
+      `- Pending service approvals: ${summarizePendingApprovals(organization)}`
     ].join("\n"),
     csv: toCsvRows([
       {
         slug: organization.slug,
         name: organization.name,
+        contactUrl: organization.contactUrl ?? "",
         subscriptionStatus: organization.subscriptionStatus,
         reportingActive: organization.services.reporting.active,
         reviewingActive: organization.services.reviewing.active,
@@ -69,16 +79,28 @@ async function runOrgsGet(options) {
         obligatoryAdminApprovalActive: organization.obligatoryAdminApproval.active,
         // Empty list + active=true means "applies to all asset types" — read
         // the active column alongside this one to interpret.
-        obligatoryAdminApprovalAssetTypes: organization.obligatoryAdminApproval.assetTypes.join("|")
+        obligatoryAdminApprovalAssetTypes: organization.obligatoryAdminApproval.assetTypes.join("|"),
+        // Pending staff requests to enable Wallet Blocking / Takedowns that a
+        // higher-up has not yet approved. Raw `serviceType` enum values,
+        // de-duplicated; an empty cell means nothing is awaiting approval.
+        pendingServiceApprovals: Array.from(
+          new Set(
+            organization.pendingServiceApprovals.map((approval) => approval.serviceType)
+          )
+        ).join("|")
       }
     ]),
     human: () => {
       console.log(`${organization.name}  (slug: ${organization.slug})`);
+      console.log(`  contactUrl: ${organization.contactUrl ?? "(not set)"}`);
       console.log(`  subscriptionStatus: ${organization.subscriptionStatus}`);
       console.log(`  services: ${summarizeServices(organization)}`);
       console.log(
         `  obligatoryAdminApproval: ${summarizeObligatoryAdminApproval(organization)}`
       );
+      console.log(
+        `  pendingServiceApprovals: ${summarizePendingApprovals(organization)}`
+      );
     }
   });
 }

package/dist/{list-MHICJ2TK.js → list-JK4SRMPL.js}

@@ -29,6 +29,7 @@ var SINGLE_SERVICES = [
   "darkWebMonitoring"
 ];
 var ALL_SERVICES = [...DUAL_SERVICES, ...SINGLE_SERVICES];
+var PENDING_APPROVAL_SERVICES = ["protection", "takedowns"];
 function splitCsv(value) {
   if (!value) return [];
   return value.split(",").map((part) => part.trim()).filter(Boolean);
@@ -155,6 +156,47 @@ function buildObligatoryAdminApprovalFilter(options) {
   if (assetTypeStrings.length > 0) filter.assetTypes = assetTypeStrings;
   return Object.keys(filter).length > 0 ? filter : void 0;
 }
+function parsePendingApprovalServices(raw) {
+  const parts = splitCsv(raw);
+  const result = [];
+  for (const part of parts) {
+    if (!PENDING_APPROVAL_SERVICES.includes(part)) {
+      throw new CliExitError(
+        `Unknown service '${part}' in --pending-approval-service. Only ${PENDING_APPROVAL_SERVICES.join(", ")} can require approval.`,
+        ExitCode.USAGE
+      );
+    }
+    result.push(part);
+  }
+  return result;
+}
+function buildPendingServiceApprovalFilter(options) {
+  if (options.pendingApprovalActive && options.pendingApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --pending-approval-active and --pending-approval-inactive can't both be passed.",
+      ExitCode.USAGE
+    );
+  }
+  const services = parsePendingApprovalServices(options.pendingApprovalService);
+  if (services.length > 0 && options.pendingApprovalInactive) {
+    throw new CliExitError(
+      "Conflicting flags: --pending-approval-service implies a pending approval exists, so it can't be combined with --pending-approval-inactive.",
+      ExitCode.USAGE
+    );
+  }
+  const filter = {};
+  if (options.pendingApprovalActive) filter.active = true;
+  if (options.pendingApprovalInactive) filter.active = false;
+  if (services.length > 0) filter.services = services;
+  return Object.keys(filter).length > 0 ? filter : void 0;
+}
+function summarizePendingApprovals(org) {
+  if (org.pendingServiceApprovals.length === 0) return "none";
+  const labels = Array.from(
+    new Set(org.pendingServiceApprovals.map((approval) => approval.serviceName))
+  );
+  return labels.join(", ");
+}
 async function runOrgsList(options) {
   const client = options.apiClient ?? createApiClient();
   const outputFormat = options.outputFormat ?? (options.json ? "json" : "human");
@@ -162,7 +204,8 @@ async function runOrgsList(options) {
     query: options.query ?? "",
     subscriptionStatus: parseSubscriptionStatuses(options.subscriptionStatus),
     services: buildServicesFilter(options),
-    obligatoryAdminApproval: buildObligatoryAdminApprovalFilter(options)
+    obligatoryAdminApproval: buildObligatoryAdminApprovalFilter(options),
+    pendingServiceApproval: buildPendingServiceApprovalFilter(options)
   };
   const result = await client.getUserOrgs(input);
   const organizations = result.organizations;
@@ -173,13 +216,14 @@ async function runOrgsList(options) {
       `# Organizations (${organizations.length})`,
       "",
       ...organizations.map(
-        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 ${summarizeServices(org)} \u2014 admin-approval: ${summarizeObligatoryAdminApproval(org)}`
+        (org) => `- \`${org.slug}\` \u2014 ${org.name} \u2014 ${org.subscriptionStatus} \u2014 contact: ${org.contactUrl ?? "(not set)"} \u2014 ${summarizeServices(org)} \u2014 admin-approval: ${summarizeObligatoryAdminApproval(org)} \u2014 pending-approval: ${summarizePendingApprovals(org)}`
       )
     ].join("\n"),
     csv: toCsvRows(
       organizations.map((org) => ({
         slug: org.slug,
         name: org.name,
+        contactUrl: org.contactUrl ?? "",
         subscriptionStatus: org.subscriptionStatus,
         reportingActive: org.services.reporting.active,
         reviewingActive: org.services.reviewing.active,
@@ -193,7 +237,14 @@ async function runOrgsList(options) {
         // Empty list + active means "applies to all asset types"; we keep
         // the cell empty in CSV so spreadsheets render it as the natural
         // "no narrowing" value — pair it with the active column.
-        obligatoryAdminApprovalAssetTypes: org.obligatoryAdminApproval.assetTypes.join("|")
+        obligatoryAdminApprovalAssetTypes: org.obligatoryAdminApproval.assetTypes.join("|"),
+        // Pending staff requests to enable Wallet Blocking / Takedowns that
+        // a higher-up has not yet approved. We emit the raw `serviceType`
+        // enum values (de-duplicated) so the column is machine-filterable;
+        // an empty cell means nothing is awaiting approval.
+        pendingServiceApprovals: Array.from(
+          new Set(org.pendingServiceApprovals.map((approval) => approval.serviceType))
+        ).join("|")
       }))
     ),
     human: () => {
@@ -205,8 +256,9 @@ async function runOrgsList(options) {
       const slugWidth = Math.max(...organizations.map((org) => org.slug.length), 4);
       const nameWidth = Math.max(...organizations.map((org) => org.name.length), 4);
       for (const org of organizations) {
+        const contact = org.contactUrl ?? "(no contact)";
         console.log(
-          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${summarizeServices(org)}  admin-approval=${summarizeObligatoryAdminApproval(org)}`
+          `  ${org.slug.padEnd(slugWidth)}  ${org.name.padEnd(nameWidth)}  ${org.subscriptionStatus.padEnd(11)}  ${contact}  ${summarizeServices(org)}  admin-approval=${summarizeObligatoryAdminApproval(org)}  pending-approval=${summarizePendingApprovals(org)}`
         );
       }
     }

package/dist/{setup-skill-UEOROLCF.js → setup-skill-V3HDWN7T.js}

@@ -6,7 +6,7 @@ import {
   readInstalledSkillVersion,
   setupSkill,
   uninstallSkill
-} from "./chunk-4N2YKTJ5.js";
+} from "./chunk-LKITFBIG.js";
 import "./chunk-6VTWWGNV.js";
 export {
   getBundledSkillContent,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [