@cdot65/prisma-airs-cli 5.8.5 → 5.9.0

package/dist/cli/index.js

@@ -8870,6 +8870,17 @@ async function parseBody(opts) {
   }
 }
 
+// src/cli/commands/dlp/visibility.ts
+function predefinedFlag(cmd) {
+  return cmd.option(
+    "--include-predefined",
+    "Include predefined (PANW-shipped) records; listings show only tenant-created records by default"
+  );
+}
+function visibleRecords(records, includePredefined) {
+  return includePredefined ? records : records.filter((record) => record.type !== "predefined");
+}
+
 // src/cli/commands/dlp/dictionaries.ts
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
@@ -8894,6 +8905,7 @@ function register(dlp) {
     "Starting offset \u2014 rounds down to a page boundary",
     (v) => Number.parseInt(v, 10)
   ).option("--sort <field,dir>", "(repeatable)", (v, p = []) => [...p, v]).option("--keywords", "Include keyword list in response").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml");
+  predefinedFlag(listCmd);
   registerPageAliases(listCmd, { sizeFlag: "--size", sizeKey: "size" });
   listCmd.action(async (opts) => {
     try {
@@ -8905,9 +8917,10 @@ function register(dlp) {
         sort: opts.sort,
         keywords: includeKeywords ? true : void 0
       };
-      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : void 0;
+      const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : (await svc.list({ ...params, page })).content;
+      const visible = visibleRecords(all, opts.includePredefined);
       dlpDictionaries.renderList(
-        all ? { content: all, totalElements: all.length } : await svc.list({ ...params, page }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9321,14 +9334,17 @@ async function resolveWriteBody(opts) {
 }
 function register4(dlp) {
   const group = dlp.command("patterns").description("DLP data patterns (full CRUD)");
-  const listCmd = listFlags2(group.command("list").description("List data patterns"));
+  const listCmd = predefinedFlag(
+    listFlags2(group.command("list").description("List data patterns (tenant-created by default)"))
+  );
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataPatternsService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const visible = visibleRecords(result, opts.includePredefined);
       dlpPatterns.renderList(
-        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9467,14 +9483,17 @@ function register5(dlp) {
   const group = dlp.command("profiles").description(
     "DLP data profiles. No supported DELETE; status-based retirement is not live-verified."
   );
-  const listCmd = listFlags3(group.command("list").description("List data profiles"));
+  const listCmd = predefinedFlag(
+    listFlags3(group.command("list").description("List data profiles (tenant-created by default)"))
+  );
   listCmd.action(async (opts) => {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataProfilesService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const visible = visibleRecords(result, opts.includePredefined);
       dlpProfiles.renderList(
-        result ? { content: result, totalElements: result.length } : await svc.list({ page, size, sort: opts.sort }),
+        { content: visible, totalElements: visible.length },
         await resolveOutput(listCmd, opts)
       );
     } catch (err) {
@@ -9752,6 +9771,10 @@ async function backupDlpResources(api, tsgId, options = {}) {
       if (RETIRED_PROFILE.has(profile.profile_status ?? "active")) continue;
       const name = profile.name ?? "(unnamed)";
       try {
+        if (!profile.detection_rules?.length)
+          throw new Error(
+            "has no exported detection rules (the API does not expose basic data profile content)"
+          );
         for (const leaf of ruleLeaves(profile)) {
           const id = leaf.value.id;
           if (id == null || id === "") {
@@ -9769,6 +9792,8 @@ async function backupDlpResources(api, tsgId, options = {}) {
           } else {
             const record = patternById.get(id);
             if (!record) throw new Error(`references an unknown data pattern: ${id}`);
+            if (RETIRED_PATTERN.has(record.status ?? "active"))
+              throw new Error(`references a retired data pattern: ${record.name ?? id}`);
             if (leaf.value.version != null && record.version !== leaf.value.version)
               throw new Error(
                 `references data pattern version ${leaf.value.version}, but the catalog holds version ${record.version ?? "unknown"}: ${id}`
@@ -9822,6 +9847,10 @@ function compareEcho(request, readBack) {
       differences.push(path3);
       return;
     }
+    if (path3.endsWith(".supported_confidence_levels") && Array.isArray(a) && Array.isArray(b) && a.every((level) => b.includes(level))) {
+      if (a.length !== b.length) serverAdded.push(path3);
+      return;
+    }
     if (Array.isArray(a) || Array.isArray(b)) {
       if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
         differences.push(path3);
@@ -10049,6 +10078,20 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
         `Data pattern uses a tenant-bound detection technique: ${source.name}; provision it in the destination and bind it with --pattern-map "${source.name}=<destination-name>"`
       );
     }
+    if (["regex", "weighted_regex"].includes(source.detection_config?.technique ?? "") && !(Array.isArray(source.matching_rules?.regexes) && source.matching_rules.regexes.length)) {
+      if (options.skipUnresolved) {
+        unresolved.push({
+          kind: "pattern",
+          sourceId: source.id,
+          name: source.name,
+          reason: "detection content is not exported by the API (copy of a predefined pattern)"
+        });
+        continue;
+      }
+      throw new Error(
+        `Data pattern has no exported detection content (a copy of a predefined pattern): ${source.name}; bind an equivalent with --pattern-map "${source.name}=<destination-name>" or exclude dependents with --skip-unresolved`
+      );
+    }
     const name = `${prefix}${source.name}`;
     assertName(name);
     const body = patternRequest(source, name);
@@ -10271,7 +10314,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.dictionaries.get(created.id, { includeKeywords: true });
       const echo = dictionaryEcho(item.metadata, readBack, item.keywords);
       if (!echo.matches || readBack.name !== item.name)
-        throw new Error(`Restored dictionary did not verify: ${item.name}`);
+        throw new Error(
+          `Restored dictionary did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
       bindings.set(item.sourceId, { id: created.id, name: item.name });
@@ -10306,7 +10351,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.patterns.get(created.id);
       const echo = compareEcho(item.body, readBack);
       if (!echo.matches || readBack.name !== item.name || RETIRED_PATTERN.has(readBack.status ?? "active"))
-        throw new Error(`Restored data pattern did not verify: ${item.name}`);
+        throw new Error(
+          `Restored data pattern did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({
           resource: `data pattern ${item.name}`,
@@ -10357,7 +10404,9 @@ async function restoreDlpResources(api, plan, options = {}) {
       const readBack = await api.profiles.get(created.id);
       const echo = compareEcho(body, readBack);
       if (!echo.matches || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
-        throw new Error(`Restored data profile did not verify: ${item.name}`);
+        throw new Error(
+          `Restored data profile did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+        );
       if (echo.serverAdded.length)
         result.serverAdded.push({
           resource: `data profile ${item.name}`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.8.5",
+  "version": "5.9.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",