@cdot65/prisma-airs-cli 5.8.4 → 5.9.0

package/dist/cli/index.js

@@ -8870,6 +8870,17 @@ async function parseBody(opts) {
   }
 }
 
+// src/cli/commands/dlp/visibility.ts
+function predefinedFlag(cmd) {
+  return cmd.option(
+    "--include-predefined",
+    "Include predefined (PANW-shipped) records; listings show only tenant-created records by default"
+  );
+}
+function visibleRecords(records, includePredefined) {
+  return includePredefined ? records : records.filter((record) => record.type !== "predefined");
+}
+
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
@@ -8894,6 +8905,7 @@ function register(dlp) {
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
   ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
+  predefinedFlag(listCmd);
   registerPageAliases(listCmd, { sizeFlag: "--size", sizeKey: "size" });
   listCmd.action(async (opts) => {
     try {
@@ -8905,9 +8917,10 @@ function register(dlp) {
         sort: opts.sort,
         keywords: includeKeywords ? true : void 0
       };
-      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : void 0;
+      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : (await svc.list({ ...params, page })).content;
+      const visible = visibleRecords(all, opts.includePredefined);
       dlpDictionaries.renderList(
-        all ? { content: all, totalElements: all.length } : await svc.list({ ...params, page }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9321,14 +9334,17 @@ async function resolveWriteBody(opts) {
 }
 function register4(dlp) {
   const group = dlp.command("patterns").description("DLP data patterns (full CRUD)");
-  const listCmd = listFlags2(group.command("list").description("List data patterns"));
+  const listCmd = predefinedFlag(
+    listFlags2(group.command("list").description("List data patterns (tenant-created by default)"))
+  );
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataPatternsService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const visible = visibleRecords(result, opts.includePredefined);
       dlpPatterns.renderList(
-        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9467,14 +9483,17 @@ function register5(dlp) {
   const group = dlp.command("profiles").description(
     "DLP data profiles. No supported DELETE; status-based retirement is not live-verified."
   );
-  const listCmd = listFlags3(group.command("list").description("List data profiles"));
+  const listCmd = predefinedFlag(
+    listFlags3(group.command("list").description("List data profiles (tenant-created by default)"))
+  );
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataProfilesService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const visible = visibleRecords(result, opts.includePredefined);
       dlpProfiles.renderList(
-        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9719,11 +9738,19 @@ async function backupDlpResources(api, tsgId, options = {}) {
     if (!record.id) throw new Error("Inventory dictionary has no id");
     if (record.type !== "predefined" && !Array.isArray(record.keywords))
       throw new Error(`Dictionary keywords were not returned by the region: ${record.name}`);
-    dictionaries.set(record.id, structuredClone(record));
+    const stored = record.type === "predefined" ? { id: record.id, name: record.name, type: record.type } : record;
+    dictionaries.set(record.id, structuredClone(stored));
   };
   const addPattern = (record) => {
     if (!record.id) throw new Error("Inventory data pattern has no id");
-    patterns.set(record.id, structuredClone(record));
+    const stored = record.type === "predefined" ? {
+      id: record.id,
+      name: record.name,
+      type: record.type,
+      ...record.version != null ? { version: record.version } : {},
+      ...record.detection_config?.technique ? { detection_config: { technique: record.detection_config.technique } } : {}
+    } : record;
+    patterns.set(record.id, structuredClone(stored));
   };
   if (kinds.includes("dictionaries")) {
     for (const record of inventory2.dictionaries)
@@ -9744,6 +9771,10 @@ async function backupDlpResources(api, tsgId, options = {}) {
       if (RETIRED_PROFILE.has(profile.profile_status ?? "active")) continue;
       const name = profile.name ?? "(unnamed)";
       try {
+        if (!profile.detection_rules?.length)
+          throw new Error(
+            "has no exported detection rules (the API does not expose basic data profile content)"
+          );
         for (const leaf of ruleLeaves(profile)) {
           const id = leaf.value.id;
           if (id == null || id === "") {
@@ -9761,6 +9792,8 @@ async function backupDlpResources(api, tsgId, options = {}) {
           } else {
             const record = patternById.get(id);
             if (!record) throw new Error(`references an unknown data pattern: ${id}`);
+            if (RETIRED_PATTERN.has(record.status ?? "active"))
+              throw new Error(`references a retired data pattern: ${record.name ?? id}`);
             if (leaf.value.version != null && record.version !== leaf.value.version)
               throw new Error(
                 `references data pattern version ${leaf.value.version}, but the catalog holds version ${record.version ?? "unknown"}: ${id}`
@@ -9814,6 +9847,10 @@ function compareEcho(request, readBack) {
       differences.push(path3);
       return;
     }
+    if (path3.endsWith(".supported_confidence_levels") && Array.isArray(a) && Array.isArray(b) && a.every((level) => b.includes(level))) {
+      if (a.length !== b.length) serverAdded.push(path3);
+      return;
+    }
     if (Array.isArray(a) || Array.isArray(b)) {
       if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
         differences.push(path3);
@@ -9885,14 +9922,15 @@ function normalizedName(value) {
 }
 function predefinedCandidates(source, records) {
   const wanted = normalizedName(source.name ?? "");
-  const wantedTokens = new Set(wanted.split(" "));
-  return records.filter(
-    (record) => record.type === "predefined" && record.name != null && !RETIRED_PATTERN.has(record.status ?? "active") && record.detection_config?.technique === source.detection_config?.technique
-  ).map((record) => {
+  const scored = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    if (record.type !== "predefined" || record.name == null || RETIRED_PATTERN.has(record.status ?? "active") || record.detection_config?.technique !== source.detection_config?.technique)
+      continue;
     const name = normalizedName(record.name);
-    const score = name === wanted ? 3 : name.includes(wanted) || wanted.includes(name) ? 2 : name.split(" ").some((token) => wantedTokens.has(token)) ? 1 : 0;
-    return { name: record.name, score };
-  }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score || a.name.localeCompare(b.name)).slice(0, 3).map((item) => item.name);
+    const score = name === wanted ? 2 : name.includes(wanted) || wanted.includes(name) ? 1 : 0;
+    if (score > 0) scored.set(record.name, Math.max(scored.get(record.name) ?? 0, score));
+  }
+  return [...scored.entries()].sort(([aName, aScore], [bName, bScore]) => bScore - aScore || aName.localeCompare(bName)).slice(0, 3).map(([name]) => name);
 }
 function matchByName(records, name, retired, label) {
   const matches = records.filter((record) => record.name === name && !retired(record));
@@ -10040,6 +10078,20 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
         `Data pattern uses a tenant-bound detection technique: ${source.name}; provision it in the destination and bind it with --pattern-map "${source.name}=<destination-name>"`
       );
     }
+    if (["regex", "weighted_regex"].includes(source.detection_config?.technique ?? "") && !(Array.isArray(source.matching_rules?.regexes) && source.matching_rules.regexes.length)) {
+      if (options.skipUnresolved) {
+        unresolved.push({
+          kind: "pattern",
+          sourceId: source.id,
+          name: source.name,
+          reason: "detection content is not exported by the API (copy of a predefined pattern)"
+        });
+        continue;
+      }
+      throw new Error(
+        `Data pattern has no exported detection content (a copy of a predefined pattern): ${source.name}; bind an equivalent with --pattern-map "${source.name}=<destination-name>" or exclude dependents with --skip-unresolved`
+      );
+    }
     const name = `${prefix}${source.name}`;
     assertName(name);
     const body = patternRequest(source, name);
@@ -10262,7 +10314,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.dictionaries.get(created.id, { includeKeywords: true });
       const echo = dictionaryEcho(item.metadata, readBack, item.keywords);
       if (!echo.matches || readBack.name !== item.name)
-        throw new Error(`Restored dictionary did not verify: ${item.name}`);
+        throw new Error(
+          `Restored dictionary did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
       bindings.set(item.sourceId, { id: created.id, name: item.name });
@@ -10297,7 +10351,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.patterns.get(created.id);
       const echo = compareEcho(item.body, readBack);
       if (!echo.matches || readBack.name !== item.name || RETIRED_PATTERN.has(readBack.status ?? "active"))
-        throw new Error(`Restored data pattern did not verify: ${item.name}`);
+        throw new Error(
+          `Restored data pattern did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({
           resource: `data pattern ${item.name}`,
@@ -10348,7 +10404,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.profiles.get(created.id);
       const echo = compareEcho(body, readBack);
       if (!echo.matches || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
-        throw new Error(`Restored data profile did not verify: ${item.name}`);
+        throw new Error(
+          `Restored data profile did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({
           resource: `data profile ${item.name}`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.8.4",
+  "version": "5.9.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",