@cdot65/prisma-airs-cli 5.8.2 → 5.8.4

package/dist/cli/index.js

@@ -9710,6 +9710,7 @@ async function backupDlpResources(api, tsgId, options = {}) {
   const kinds = options.resources ?? [...DLP_RESOURCE_KINDS];
   if (!kinds.length || kinds.some((kind) => !DLP_RESOURCE_KINDS.includes(kind)))
     throw new Error("resources must name dictionaries, patterns and/or profiles");
+  options.onProgress?.({ phase: "inventories" });
   const inventory2 = await inventories(api, maxPages3);
   tenantIdentity([...inventory2.patterns, ...inventory2.profiles]);
   const dictionaries = /* @__PURE__ */ new Map();
@@ -9879,6 +9880,20 @@ function patternRequest(source, name) {
 function portablePattern(record) {
   return PORTABLE_TECHNIQUES.has(record.detection_config?.technique ?? "") && record.detection_config?.technique !== void 0;
 }
+function normalizedName(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+function predefinedCandidates(source, records) {
+  const wanted = normalizedName(source.name ?? "");
+  const wantedTokens = new Set(wanted.split(" "));
+  return records.filter(
+    (record) => record.type === "predefined" && record.name != null && !RETIRED_PATTERN.has(record.status ?? "active") && record.detection_config?.technique === source.detection_config?.technique
+  ).map((record) => {
+    const name = normalizedName(record.name);
+    const score = name === wanted ? 3 : name.includes(wanted) || wanted.includes(name) ? 2 : name.split(" ").some((token) => wantedTokens.has(token)) ? 1 : 0;
+    return { name: record.name, score };
+  }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score || a.name.localeCompare(b.name)).slice(0, 3).map((item) => item.name);
+}
 function matchByName(records, name, retired, label) {
   const matches = records.filter((record) => record.name === name && !retired(record));
   if (matches.length > 1) throw new Error(`Ambiguous destination ${label} name: ${name}`);
@@ -9904,6 +9919,8 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
   if (unknownMapped.length)
     throw new Error(`--pattern-map names absent from the backup: ${unknownMapped.join(", ")}`);
   const crossTenant = backup.source.tsgId !== destinationTsgId;
+  const unresolved = [];
+  options.onProgress?.({ phase: "inventories" });
   const destination = await inventories(api, maxPages3);
   const sourceTenant = tenantIdentity([...backup.patterns, ...backup.profiles]);
   const destinationTenant = tenantIdentity([...destination.patterns, ...destination.profiles]);
@@ -9922,8 +9939,18 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     if (!source.id || !source.name) throw new Error("Backup dictionary lacks identity");
     if (source.type === "predefined") {
       const match2 = matchByName(destination.dictionaries, source.name, () => false, "dictionary");
-      if (!match2?.id || match2.type !== "predefined")
+      if (!match2?.id || match2.type !== "predefined") {
+        if (options.skipUnresolved) {
+          unresolved.push({
+            kind: "dictionary",
+            sourceId: source.id,
+            name: source.name,
+            reason: "missing predefined destination dictionary"
+          });
+          continue;
+        }
         throw new Error(`Missing predefined destination dictionary: ${source.name}`);
+      }
       dictionaryPlans.push({
         sourceId: source.id,
         name: source.name,
@@ -9957,18 +9984,31 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     });
   }
   const patternPlans = [];
+  const missingPredefined = [];
   for (const source of backup.patterns) {
     if (!source.id || !source.name) throw new Error("Backup data pattern lacks identity");
     const retired = (record) => RETIRED_PATTERN.has(record.status ?? "active");
     if (source.type === "predefined" && !Object.hasOwn(patternMap2, source.name)) {
-      const match2 = matchByName(destination.patterns, source.name, retired, "data pattern");
-      if (!match2?.id || match2.type !== "predefined")
-        throw new Error(
-          `Missing predefined destination data pattern: ${source.name}; bind an equivalent destination pattern with --pattern-map "${source.name}=<destination-name>"`
-        );
+      const byId = destination.patterns.find(
+        (record) => record.id === source.id && record.type === "predefined" && !retired(record) && record.detection_config?.technique === source.detection_config?.technique
+      );
+      const match2 = byId ?? matchByName(destination.patterns, source.name, retired, "data pattern");
+      if (!match2?.id || !match2.name || match2.type !== "predefined") {
+        const candidates = predefinedCandidates(source, destination.patterns);
+        if (options.skipUnresolved)
+          unresolved.push({
+            kind: "pattern",
+            sourceId: source.id,
+            name: source.name,
+            reason: "no identity or name match in the destination catalog",
+            candidates
+          });
+        else missingPredefined.push({ name: source.name, candidates });
+        continue;
+      }
       patternPlans.push({
         sourceId: source.id,
-        name: source.name,
+        name: match2.name,
         action: "resolve",
         existing: structuredClone(match2)
       });
@@ -9986,10 +10026,20 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
       });
       continue;
     }
-    if (!portablePattern(source))
+    if (!portablePattern(source)) {
+      if (options.skipUnresolved) {
+        unresolved.push({
+          kind: "pattern",
+          sourceId: source.id,
+          name: source.name,
+          reason: "tenant-bound detection technique without --pattern-map"
+        });
+        continue;
+      }
       throw new Error(
         `Data pattern uses a tenant-bound detection technique: ${source.name}; provision it in the destination and bind it with --pattern-map "${source.name}=<destination-name>"`
       );
+    }
     const name = `${prefix}${source.name}`;
     assertName(name);
     const body = patternRequest(source, name);
@@ -10012,6 +10062,12 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
       existing: structuredClone(match)
     });
   }
+  if (missingPredefined.length)
+    throw new Error(
+      `Missing predefined destination data patterns: ${missingPredefined.map(
+        (item) => `${item.name}${item.candidates.length ? ` (candidates: ${item.candidates.map((name) => `"${name}"`).join(", ")})` : " (no candidates)"}`
+      ).join("; ")}; bind each with --pattern-map "<source-name>=<destination-name>"`
+    );
   const profilePlans = [];
   for (const source of backup.profiles) {
     if (!source.name) throw new Error("Backup data profile lacks identity");
@@ -10042,6 +10098,7 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     dictionaries: dictionaryPlans,
     patterns: patternPlans,
     profiles: profilePlans,
+    unresolved,
     maxPages: maxPages3
   };
   const bindings = planBindings(plan);
@@ -10049,14 +10106,24 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     ...dictionaryPlans.map((d) => d.sourceId),
     ...patternPlans.map((p) => p.sourceId)
   ]);
+  const unresolvedById = new Map(unresolved.map((item) => [item.sourceId, item]));
   for (const item of profilePlans) {
     if (item.action === "skip") continue;
+    const missing = /* @__PURE__ */ new Set();
     for (const leaf of ruleLeaves(item.source)) {
       const id = leaf.value.id;
-      if (id != null && id !== "" && !planned.has(String(id)))
-        throw new Error(
-          `Backup data profile references a resource absent from the backup: ${item.name}`
-        );
+      if (id != null && id !== "" && !planned.has(String(id))) missing.add(String(id));
+    }
+    if (missing.size) {
+      const skippable = [...missing].filter((id) => unresolvedById.has(id));
+      if (skippable.length === missing.size) {
+        item.action = "skip";
+        item.reason = `unresolved references: ${skippable.map((id) => unresolvedById.get(id)?.name).join(", ")}`;
+        continue;
+      }
+      throw new Error(
+        `Backup data profile references a resource absent from the backup: ${item.name}`
+      );
     }
     const body = profileRequest(item, bindings, crossTenant, item.action === "verify");
     if (item.action === "verify" && body && !compareEcho(body, item.existing).matches)
@@ -10126,7 +10193,7 @@ function assertUnchanged(current, prior, label) {
   if (canonical(current ?? null) !== canonical(prior ?? null))
     throw new Error(`Destination ${label} changed after planning`);
 }
-async function restoreDlpResources(api, plan) {
+async function restoreDlpResources(api, plan, options = {}) {
   const result = {
     sourceTsgId: plan.sourceTsgId,
     destinationTsgId: plan.destinationTsgId,
@@ -10134,10 +10201,14 @@ async function restoreDlpResources(api, plan) {
     dictionaries: [],
     patterns: [],
     profiles: [],
-    serverAdded: []
+    serverAdded: [],
+    unresolved: structuredClone(plan.unresolved ?? [])
   };
   const crossTenant = plan.sourceTsgId !== plan.destinationTsgId;
+  const emit2 = options.onProgress;
+  const emitItem = (stage, name, action, index, total) => emit2?.({ phase: "item", stage, name, action, index, total });
   try {
+    emit2?.({ phase: "recheck" });
     const current = await inventories(api, plan.maxPages);
     for (const item of plan.dictionaries) {
       const match = matchByName(current.dictionaries, item.name, () => false, "dictionary");
@@ -10164,11 +10235,20 @@ async function restoreDlpResources(api, plan) {
         throw new Error(`Destination data profile changed after planning: ${item.name}`);
     }
     const bindings = planBindings(plan);
+    if (plan.dictionaries.length)
+      emit2?.({ phase: "stage", stage: "dictionaries", total: plan.dictionaries.length });
     for (const item of plan.dictionaries) {
       if (item.action !== "create") {
         const id = item.existing?.id;
         if (!id) throw new Error(`Destination dictionary has no identity: ${item.name}`);
         result.dictionaries.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        emitItem(
+          "dictionaries",
+          item.name,
+          DEPENDENCY_ACTIONS[item.action],
+          result.dictionaries.length,
+          plan.dictionaries.length
+        );
         continue;
       }
       if (!item.metadata || !item.keywords) throw new Error("Dictionary plan is incomplete");
@@ -10187,12 +10267,28 @@ async function restoreDlpResources(api, plan) {
         result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
       bindings.set(item.sourceId, { id: created.id, name: item.name });
       result.dictionaries.push({ name: item.name, action: "created", id: created.id });
+      emitItem(
+        "dictionaries",
+        item.name,
+        "created",
+        result.dictionaries.length,
+        plan.dictionaries.length
+      );
     }
+    if (plan.patterns.length)
+      emit2?.({ phase: "stage", stage: "patterns", total: plan.patterns.length });
     for (const item of plan.patterns) {
       if (item.action !== "create") {
         const id = item.existing?.id;
         if (!id) throw new Error(`Destination data pattern has no identity: ${item.name}`);
         result.patterns.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        emitItem(
+          "patterns",
+          item.name,
+          DEPENDENCY_ACTIONS[item.action],
+          result.patterns.length,
+          plan.patterns.length
+        );
         continue;
       }
       if (!item.body) throw new Error("Data pattern plan is incomplete");
@@ -10213,14 +10309,19 @@ async function restoreDlpResources(api, plan) {
         version: readBack.version ?? void 0
       });
       result.patterns.push({ name: item.name, action: "created", id: created.id });
+      emitItem("patterns", item.name, "created", result.patterns.length, plan.patterns.length);
     }
+    if (plan.profiles.length)
+      emit2?.({ phase: "stage", stage: "profiles", total: plan.profiles.length });
     for (const item of plan.profiles) {
       if (item.action === "skip") {
         result.profiles.push({
           name: item.name,
           action: "skipped",
-          id: item.existing?.id ?? void 0
+          id: item.existing?.id ?? void 0,
+          ...item.reason ? { reason: item.reason } : {}
         });
+        emitItem("profiles", item.name, "skipped", result.profiles.length, plan.profiles.length);
         continue;
       }
       const body = profileRequest(item, bindings, crossTenant, true);
@@ -10239,6 +10340,7 @@ async function restoreDlpResources(api, plan) {
           action: "verified",
           id: item.existing?.id ?? void 0
         });
+        emitItem("profiles", item.name, "verified", result.profiles.length, plan.profiles.length);
         continue;
       }
       const created = await api.profiles.create(body);
@@ -10253,6 +10355,7 @@ async function restoreDlpResources(api, plan) {
           fields: echo.serverAdded
         });
       result.profiles.push({ name: item.name, action: "created", id: created.id });
+      emitItem("profiles", item.name, "created", result.profiles.length, plan.profiles.length);
     }
     result.complete = true;
   } catch (error) {
@@ -10322,6 +10425,31 @@ function failure(error) {
   }
   process.exitCode = 1;
 }
+var STAGE_LABELS = {
+  dictionaries: "dictionaries",
+  patterns: "data patterns",
+  profiles: "data profiles"
+};
+var ITEM_LABELS = {
+  dictionaries: "dictionary",
+  patterns: "data pattern",
+  profiles: "data profile"
+};
+function progressRenderer(format) {
+  if (format !== "pretty") return void 0;
+  return (event) => {
+    if (event.phase === "inventories")
+      ui.info("Reading inventories (dictionaries, data patterns, data profiles)\u2026");
+    else if (event.phase === "recheck") ui.info("Rechecking destination state before writing\u2026");
+    else if (event.phase === "stage")
+      ui.info(`Restoring ${STAGE_LABELS[event.stage]} (${event.total})\u2026`);
+    else
+      ui.bullet(
+        `${ITEM_LABELS[event.stage]} ${event.action}: ${event.name} (${event.index}/${event.total})`,
+        event.action === "skipped" ? "skip" : "success"
+      );
+  };
+}
 function renderRestore(value, columns, format) {
   if (format !== "pretty" && format !== "table" && format !== "markdown")
     return formatOutput([value], columns, format);
@@ -10353,6 +10481,11 @@ ${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
       ) || "(none)"
     );
   }
+  if (rows("unresolved").length) {
+    blocks.push(heading("Unresolved references \u2014 dependent profiles skipped"));
+    for (const entry of rows("unresolved"))
+      blocks.push(`${entry.kind} ${entry.name}: ${entry.reason}`);
+  }
   if (rows("serverAdded").length) {
     blocks.push(heading("Verified server-added fields (source omitted these)"));
     for (const item of rows("serverAdded"))
@@ -10405,7 +10538,8 @@ function register6(dlp) {
       const { backup: data, skipped } = await backupDlpResources(api, tsgId, {
         resources: opts.resources,
         maxPages: opts.maxPages,
-        skipUnsupported: Boolean(opts.skipUnsupported)
+        skipUnsupported: Boolean(opts.skipUnsupported),
+        onProgress: progressRenderer(format)
       });
       for (const item of skipped)
         ui.warning(`Skipped unsupported data profile: ${item.profile} (${item.reason})`);
@@ -10449,9 +10583,12 @@ function register6(dlp) {
     "error"
   ).option(
     "--pattern-map <source=destination>",
-    "Bind a tenant-bound source pattern to an existing destination pattern (repeatable)",
+    "Bind a tenant-bound or predefined source pattern to an existing destination pattern (repeatable)",
     (value, prior) => [...prior, value],
     []
+  ).option(
+    "--skip-unresolved",
+    "Skip references with no destination match, and every profile depending on them; whole profiles only, each reported"
   ).option(
     "--max-pages <n>",
     "Maximum pages per inventory; incomplete inventories fail",
@@ -10496,19 +10633,34 @@ function register6(dlp) {
         throw new CliUsageError(
           "--expect-tsg does not match the selected destination tenant; no API request was made"
         );
+      const onProgress = progressRenderer(format);
       const plan = await planDlpResourcesRestore(api, data, tsgId, {
         namePrefix: opts.namePrefix,
         onConflict: opts.onConflict,
         patternMap: mappings,
-        maxPages: opts.maxPages
+        maxPages: opts.maxPages,
+        skipUnresolved: Boolean(opts.skipUnresolved),
+        onProgress
       });
+      for (const entry of plan.unresolved)
+        ui.warning(
+          `Unresolved ${entry.kind === "dictionary" ? "dictionary" : "data pattern"}: ${entry.name} (${entry.reason})${entry.candidates?.length ? `; candidates: ${entry.candidates.map((name) => `"${name}"`).join(", ")}` : ""}`
+        );
+      for (const profile of plan.profiles)
+        if (profile.reason)
+          ui.warning(`Skipping data profile: ${profile.name} (${profile.reason})`);
       const summary = {
         sourceTsgId: plan.sourceTsgId,
         destinationTsgId: plan.destinationTsgId,
         dryRun: Boolean(opts.dryRun),
         dictionaries: plan.dictionaries.map((d) => ({ name: d.name, action: d.action })),
         patterns: plan.patterns.map((p) => ({ name: p.name, action: p.action })),
-        profiles: plan.profiles.map((p) => ({ name: p.name, action: p.action }))
+        profiles: plan.profiles.map((p) => ({
+          name: p.name,
+          action: p.action,
+          ...p.reason ? { reason: p.reason } : {}
+        })),
+        unresolved: plan.unresolved.map(({ kind, name, reason }) => ({ kind, name, reason }))
       };
       const columns = [
         { key: "sourceTsgId", label: "Source TSG" },
@@ -10516,6 +10668,7 @@ function register6(dlp) {
         { key: "dictionaries", label: "Dictionaries" },
         { key: "patterns", label: "Data patterns" },
         { key: "profiles", label: "Data profiles" },
+        { key: "unresolved", label: "Unresolved references" },
         { key: "serverAdded", label: "Verified server-added fields" },
         { key: "dryRun", label: "Dry run" },
         { key: "complete", label: "Complete" }
@@ -10531,7 +10684,7 @@ function register6(dlp) {
           Boolean(opts.force),
           { action: `restore DLP resources into TSG ${tsgId}` }
         );
-      const result = await restoreDlpResources(api, plan);
+      const result = await restoreDlpResources(api, plan, { onProgress });
       console.log(renderRestore({ ...result }, columns, format));
       if (!result.complete) {
         ui.error(result.error ?? "Restore incomplete");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.8.2",
+  "version": "5.8.4",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",