@cdot65/prisma-airs-cli 5.8.3 → 5.8.5

package/dist/cli/index.js

@@ -9710,6 +9710,7 @@ async function backupDlpResources(api, tsgId, options = {}) {
   const kinds = options.resources ?? [...DLP_RESOURCE_KINDS];
   if (!kinds.length || kinds.some((kind) => !DLP_RESOURCE_KINDS.includes(kind)))
     throw new Error("resources must name dictionaries, patterns and/or profiles");
+  options.onProgress?.({ phase: "inventories" });
   const inventory2 = await inventories(api, maxPages3);
   tenantIdentity([...inventory2.patterns, ...inventory2.profiles]);
   const dictionaries = /* @__PURE__ */ new Map();
@@ -9718,11 +9719,19 @@ async function backupDlpResources(api, tsgId, options = {}) {
     if (!record.id) throw new Error("Inventory dictionary has no id");
     if (record.type !== "predefined" && !Array.isArray(record.keywords))
       throw new Error(`Dictionary keywords were not returned by the region: ${record.name}`);
-    dictionaries.set(record.id, structuredClone(record));
+    const stored = record.type === "predefined" ? { id: record.id, name: record.name, type: record.type } : record;
+    dictionaries.set(record.id, structuredClone(stored));
   };
   const addPattern = (record) => {
     if (!record.id) throw new Error("Inventory data pattern has no id");
-    patterns.set(record.id, structuredClone(record));
+    const stored = record.type === "predefined" ? {
+      id: record.id,
+      name: record.name,
+      type: record.type,
+      ...record.version != null ? { version: record.version } : {},
+      ...record.detection_config?.technique ? { detection_config: { technique: record.detection_config.technique } } : {}
+    } : record;
+    patterns.set(record.id, structuredClone(stored));
   };
   if (kinds.includes("dictionaries")) {
     for (const record of inventory2.dictionaries)
@@ -9884,14 +9893,15 @@ function normalizedName(value) {
 }
 function predefinedCandidates(source, records) {
   const wanted = normalizedName(source.name ?? "");
-  const wantedTokens = new Set(wanted.split(" "));
-  return records.filter(
-    (record) => record.type === "predefined" && record.name != null && !RETIRED_PATTERN.has(record.status ?? "active") && record.detection_config?.technique === source.detection_config?.technique
-  ).map((record) => {
+  const scored = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    if (record.type !== "predefined" || record.name == null || RETIRED_PATTERN.has(record.status ?? "active") || record.detection_config?.technique !== source.detection_config?.technique)
+      continue;
     const name = normalizedName(record.name);
-    const score = name === wanted ? 3 : name.includes(wanted) || wanted.includes(name) ? 2 : name.split(" ").some((token) => wantedTokens.has(token)) ? 1 : 0;
-    return { name: record.name, score };
-  }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score || a.name.localeCompare(b.name)).slice(0, 3).map((item) => item.name);
+    const score = name === wanted ? 2 : name.includes(wanted) || wanted.includes(name) ? 1 : 0;
+    if (score > 0) scored.set(record.name, Math.max(scored.get(record.name) ?? 0, score));
+  }
+  return [...scored.entries()].sort(([aName, aScore], [bName, bScore]) => bScore - aScore || aName.localeCompare(bName)).slice(0, 3).map(([name]) => name);
 }
 function matchByName(records, name, retired, label) {
   const matches = records.filter((record) => record.name === name && !retired(record));
@@ -9918,6 +9928,8 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
   if (unknownMapped.length)
     throw new Error(`--pattern-map names absent from the backup: ${unknownMapped.join(", ")}`);
   const crossTenant = backup.source.tsgId !== destinationTsgId;
+  const unresolved = [];
+  options.onProgress?.({ phase: "inventories" });
   const destination = await inventories(api, maxPages3);
   const sourceTenant = tenantIdentity([...backup.patterns, ...backup.profiles]);
   const destinationTenant = tenantIdentity([...destination.patterns, ...destination.profiles]);
@@ -9936,8 +9948,18 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     if (!source.id || !source.name) throw new Error("Backup dictionary lacks identity");
     if (source.type === "predefined") {
       const match2 = matchByName(destination.dictionaries, source.name, () => false, "dictionary");
-      if (!match2?.id || match2.type !== "predefined")
+      if (!match2?.id || match2.type !== "predefined") {
+        if (options.skipUnresolved) {
+          unresolved.push({
+            kind: "dictionary",
+            sourceId: source.id,
+            name: source.name,
+            reason: "missing predefined destination dictionary"
+          });
+          continue;
+        }
         throw new Error(`Missing predefined destination dictionary: ${source.name}`);
+      }
       dictionaryPlans.push({
         sourceId: source.id,
         name: source.name,
@@ -9981,10 +10003,16 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
       );
       const match2 = byId ?? matchByName(destination.patterns, source.name, retired, "data pattern");
       if (!match2?.id || !match2.name || match2.type !== "predefined") {
-        missingPredefined.push({
-          name: source.name,
-          candidates: predefinedCandidates(source, destination.patterns)
-        });
+        const candidates = predefinedCandidates(source, destination.patterns);
+        if (options.skipUnresolved)
+          unresolved.push({
+            kind: "pattern",
+            sourceId: source.id,
+            name: source.name,
+            reason: "no identity or name match in the destination catalog",
+            candidates
+          });
+        else missingPredefined.push({ name: source.name, candidates });
         continue;
       }
       patternPlans.push({
@@ -10007,10 +10035,20 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
       });
       continue;
     }
-    if (!portablePattern(source))
+    if (!portablePattern(source)) {
+      if (options.skipUnresolved) {
+        unresolved.push({
+          kind: "pattern",
+          sourceId: source.id,
+          name: source.name,
+          reason: "tenant-bound detection technique without --pattern-map"
+        });
+        continue;
+      }
       throw new Error(
         `Data pattern uses a tenant-bound detection technique: ${source.name}; provision it in the destination and bind it with --pattern-map "${source.name}=<destination-name>"`
       );
+    }
     const name = `${prefix}${source.name}`;
     assertName(name);
     const body = patternRequest(source, name);
@@ -10069,6 +10107,7 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     dictionaries: dictionaryPlans,
     patterns: patternPlans,
     profiles: profilePlans,
+    unresolved,
     maxPages: maxPages3
   };
   const bindings = planBindings(plan);
@@ -10076,14 +10115,24 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     ...dictionaryPlans.map((d) => d.sourceId),
     ...patternPlans.map((p) => p.sourceId)
   ]);
+  const unresolvedById = new Map(unresolved.map((item) => [item.sourceId, item]));
   for (const item of profilePlans) {
     if (item.action === "skip") continue;
+    const missing = /* @__PURE__ */ new Set();
     for (const leaf of ruleLeaves(item.source)) {
       const id = leaf.value.id;
-      if (id != null && id !== "" && !planned.has(String(id)))
-        throw new Error(
-          `Backup data profile references a resource absent from the backup: ${item.name}`
-        );
+      if (id != null && id !== "" && !planned.has(String(id))) missing.add(String(id));
+    }
+    if (missing.size) {
+      const skippable = [...missing].filter((id) => unresolvedById.has(id));
+      if (skippable.length === missing.size) {
+        item.action = "skip";
+        item.reason = `unresolved references: ${skippable.map((id) => unresolvedById.get(id)?.name).join(", ")}`;
+        continue;
+      }
+      throw new Error(
+        `Backup data profile references a resource absent from the backup: ${item.name}`
+      );
     }
     const body = profileRequest(item, bindings, crossTenant, item.action === "verify");
     if (item.action === "verify" && body && !compareEcho(body, item.existing).matches)
@@ -10153,7 +10202,7 @@ function assertUnchanged(current, prior, label) {
   if (canonical(current ?? null) !== canonical(prior ?? null))
     throw new Error(`Destination ${label} changed after planning`);
 }
-async function restoreDlpResources(api, plan) {
+async function restoreDlpResources(api, plan, options = {}) {
   const result = {
     sourceTsgId: plan.sourceTsgId,
     destinationTsgId: plan.destinationTsgId,
@@ -10161,10 +10210,14 @@ async function restoreDlpResources(api, plan) {
     dictionaries: [],
     patterns: [],
     profiles: [],
-    serverAdded: []
+    serverAdded: [],
+    unresolved: structuredClone(plan.unresolved ?? [])
   };
   const crossTenant = plan.sourceTsgId !== plan.destinationTsgId;
+  const emit2 = options.onProgress;
+  const emitItem = (stage, name, action, index, total) => emit2?.({ phase: "item", stage, name, action, index, total });
   try {
+    emit2?.({ phase: "recheck" });
     const current = await inventories(api, plan.maxPages);
     for (const item of plan.dictionaries) {
       const match = matchByName(current.dictionaries, item.name, () => false, "dictionary");
@@ -10191,11 +10244,20 @@ async function restoreDlpResources(api, plan) {
         throw new Error(`Destination data profile changed after planning: ${item.name}`);
     }
     const bindings = planBindings(plan);
+    if (plan.dictionaries.length)
+      emit2?.({ phase: "stage", stage: "dictionaries", total: plan.dictionaries.length });
     for (const item of plan.dictionaries) {
       if (item.action !== "create") {
         const id = item.existing?.id;
         if (!id) throw new Error(`Destination dictionary has no identity: ${item.name}`);
         result.dictionaries.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        emitItem(
+          "dictionaries",
+          item.name,
+          DEPENDENCY_ACTIONS[item.action],
+          result.dictionaries.length,
+          plan.dictionaries.length
+        );
         continue;
       }
       if (!item.metadata || !item.keywords) throw new Error("Dictionary plan is incomplete");
@@ -10214,12 +10276,28 @@ async function restoreDlpResources(api, plan) {
         result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
       bindings.set(item.sourceId, { id: created.id, name: item.name });
       result.dictionaries.push({ name: item.name, action: "created", id: created.id });
+      emitItem(
+        "dictionaries",
+        item.name,
+        "created",
+        result.dictionaries.length,
+        plan.dictionaries.length
+      );
     }
+    if (plan.patterns.length)
+      emit2?.({ phase: "stage", stage: "patterns", total: plan.patterns.length });
     for (const item of plan.patterns) {
       if (item.action !== "create") {
         const id = item.existing?.id;
         if (!id) throw new Error(`Destination data pattern has no identity: ${item.name}`);
         result.patterns.push({ name: item.name, action: DEPENDENCY_ACTIONS[item.action], id });
+        emitItem(
+          "patterns",
+          item.name,
+          DEPENDENCY_ACTIONS[item.action],
+          result.patterns.length,
+          plan.patterns.length
+        );
         continue;
       }
       if (!item.body) throw new Error("Data pattern plan is incomplete");
@@ -10240,14 +10318,19 @@ async function restoreDlpResources(api, plan) {
         version: readBack.version ?? void 0
       });
       result.patterns.push({ name: item.name, action: "created", id: created.id });
+      emitItem("patterns", item.name, "created", result.patterns.length, plan.patterns.length);
     }
+    if (plan.profiles.length)
+      emit2?.({ phase: "stage", stage: "profiles", total: plan.profiles.length });
     for (const item of plan.profiles) {
       if (item.action === "skip") {
         result.profiles.push({
           name: item.name,
           action: "skipped",
-          id: item.existing?.id ?? void 0
+          id: item.existing?.id ?? void 0,
+          ...item.reason ? { reason: item.reason } : {}
         });
+        emitItem("profiles", item.name, "skipped", result.profiles.length, plan.profiles.length);
         continue;
       }
       const body = profileRequest(item, bindings, crossTenant, true);
@@ -10266,6 +10349,7 @@ async function restoreDlpResources(api, plan) {
           action: "verified",
           id: item.existing?.id ?? void 0
         });
+        emitItem("profiles", item.name, "verified", result.profiles.length, plan.profiles.length);
         continue;
       }
       const created = await api.profiles.create(body);
@@ -10280,6 +10364,7 @@ async function restoreDlpResources(api, plan) {
           fields: echo.serverAdded
         });
       result.profiles.push({ name: item.name, action: "created", id: created.id });
+      emitItem("profiles", item.name, "created", result.profiles.length, plan.profiles.length);
     }
     result.complete = true;
   } catch (error) {
@@ -10349,6 +10434,31 @@ function failure(error) {
   }
   process.exitCode = 1;
 }
+var STAGE_LABELS = {
+  dictionaries: "dictionaries",
+  patterns: "data patterns",
+  profiles: "data profiles"
+};
+var ITEM_LABELS = {
+  dictionaries: "dictionary",
+  patterns: "data pattern",
+  profiles: "data profile"
+};
+function progressRenderer(format) {
+  if (format !== "pretty") return void 0;
+  return (event) => {
+    if (event.phase === "inventories")
+      ui.info("Reading inventories (dictionaries, data patterns, data profiles)\u2026");
+    else if (event.phase === "recheck") ui.info("Rechecking destination state before writing\u2026");
+    else if (event.phase === "stage")
+      ui.info(`Restoring ${STAGE_LABELS[event.stage]} (${event.total})\u2026`);
+    else
+      ui.bullet(
+        `${ITEM_LABELS[event.stage]} ${event.action}: ${event.name} (${event.index}/${event.total})`,
+        event.action === "skipped" ? "skip" : "success"
+      );
+  };
+}
 function renderRestore(value, columns, format) {
   if (format !== "pretty" && format !== "table" && format !== "markdown")
     return formatOutput([value], columns, format);
@@ -10380,6 +10490,11 @@ ${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
       ) || "(none)"
     );
   }
+  if (rows("unresolved").length) {
+    blocks.push(heading("Unresolved references \u2014 dependent profiles skipped"));
+    for (const entry of rows("unresolved"))
+      blocks.push(`${entry.kind} ${entry.name}: ${entry.reason}`);
+  }
   if (rows("serverAdded").length) {
     blocks.push(heading("Verified server-added fields (source omitted these)"));
     for (const item of rows("serverAdded"))
@@ -10432,7 +10547,8 @@ function register6(dlp) {
       const { backup: data, skipped } = await backupDlpResources(api, tsgId, {
         resources: opts.resources,
         maxPages: opts.maxPages,
-        skipUnsupported: Boolean(opts.skipUnsupported)
+        skipUnsupported: Boolean(opts.skipUnsupported),
+        onProgress: progressRenderer(format)
       });
       for (const item of skipped)
         ui.warning(`Skipped unsupported data profile: ${item.profile} (${item.reason})`);
@@ -10476,9 +10592,12 @@ function register6(dlp) {
     "error"
   ).option(
     "--pattern-map <source=destination>",
-    "Bind a tenant-bound source pattern to an existing destination pattern (repeatable)",
+    "Bind a tenant-bound or predefined source pattern to an existing destination pattern (repeatable)",
     (value, prior) => [...prior, value],
     []
+  ).option(
+    "--skip-unresolved",
+    "Skip references with no destination match, and every profile depending on them; whole profiles only, each reported"
   ).option(
     "--max-pages <n>",
     "Maximum pages per inventory; incomplete inventories fail",
@@ -10523,19 +10642,34 @@ function register6(dlp) {
         throw new CliUsageError(
           "--expect-tsg does not match the selected destination tenant; no API request was made"
         );
+      const onProgress = progressRenderer(format);
       const plan = await planDlpResourcesRestore(api, data, tsgId, {
         namePrefix: opts.namePrefix,
         onConflict: opts.onConflict,
         patternMap: mappings,
-        maxPages: opts.maxPages
+        maxPages: opts.maxPages,
+        skipUnresolved: Boolean(opts.skipUnresolved),
+        onProgress
       });
+      for (const entry of plan.unresolved)
+        ui.warning(
+          `Unresolved ${entry.kind === "dictionary" ? "dictionary" : "data pattern"}: ${entry.name} (${entry.reason})${entry.candidates?.length ? `; candidates: ${entry.candidates.map((name) => `"${name}"`).join(", ")}` : ""}`
+        );
+      for (const profile of plan.profiles)
+        if (profile.reason)
+          ui.warning(`Skipping data profile: ${profile.name} (${profile.reason})`);
       const summary = {
         sourceTsgId: plan.sourceTsgId,
         destinationTsgId: plan.destinationTsgId,
         dryRun: Boolean(opts.dryRun),
         dictionaries: plan.dictionaries.map((d) => ({ name: d.name, action: d.action })),
         patterns: plan.patterns.map((p) => ({ name: p.name, action: p.action })),
-        profiles: plan.profiles.map((p) => ({ name: p.name, action: p.action }))
+        profiles: plan.profiles.map((p) => ({
+          name: p.name,
+          action: p.action,
+          ...p.reason ? { reason: p.reason } : {}
+        })),
+        unresolved: plan.unresolved.map(({ kind, name, reason }) => ({ kind, name, reason }))
       };
       const columns = [
         { key: "sourceTsgId", label: "Source TSG" },
@@ -10543,6 +10677,7 @@ function register6(dlp) {
         { key: "dictionaries", label: "Dictionaries" },
         { key: "patterns", label: "Data patterns" },
         { key: "profiles", label: "Data profiles" },
+        { key: "unresolved", label: "Unresolved references" },
         { key: "serverAdded", label: "Verified server-added fields" },
         { key: "dryRun", label: "Dry run" },
         { key: "complete", label: "Complete" }
@@ -10558,7 +10693,7 @@ function register6(dlp) {
           Boolean(opts.force),
           { action: `restore DLP resources into TSG ${tsgId}` }
         );
-      const result = await restoreDlpResources(api, plan);
+      const result = await restoreDlpResources(api, plan, { onProgress });
       console.log(renderRestore({ ...result }, columns, format));
       if (!result.complete) {
         ui.error(result.error ?? "Restore incomplete");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.8.3",
+  "version": "5.8.5",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",