@cdot65/prisma-airs-cli 5.9.0 → 5.9.1

package/dist/cli/index.js

@@ -51,7 +51,7 @@ function handleUnhandledRejection(reason) {
   const message = reason instanceof Error ? reason.message : String(reason);
   console.error(chalk.red(`
   Unexpected error: ${message}`));
-  console.error(chalk.dim("  Re-run with --debug to capture full API traffic.\n"));
+  console.error(chalk.dim("  Re-run with --debug to capture redacted API diagnostics.\n"));
   process.exit(1);
 }
 function installProcessGuards() {
@@ -358,7 +358,7 @@ function fail(err) {
   \u2717 Error: ${message}`));
   if (status !== void 0) {
     console.error(chalk2.red(`    HTTP ${status}`));
-    console.error(chalk2.dim("    Re-run with --debug to capture full API traffic."));
+    console.error(chalk2.dim("    Re-run with --debug to capture redacted API diagnostics."));
   }
   console.error("");
   process.exit(1);
@@ -8768,6 +8768,7 @@ var topicsView = {
 // src/cli/commands/dlp/dictionaries.ts
 import { readFile as readFile8 } from "fs/promises";
 import { basename as basename2 } from "path";
+import { AISecSDKException as AISecSDKException2, ErrorType as ErrorType3 } from "@cdot65/prisma-airs-sdk";
 
 // src/airs/dlp/dictionaries.ts
 var SdkDictionariesService = class {
@@ -8882,12 +8883,40 @@ function visibleRecords(records, includePredefined) {
 }
 
 // src/cli/commands/dlp/dictionaries.ts
+async function readMetadata(path3) {
+  const raw = await readFile8(path3, "utf-8");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new CliUsageError("Invalid JSON in dictionary metadata file");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliUsageError("Dictionary metadata must be a JSON object");
+  }
+  return value;
+}
+function dictionaryFailure(err) {
+  if (err instanceof AISecSDKException2 && err.errorType === ErrorType3.USER_REQUEST_PAYLOAD_ERROR) {
+    fail(new CliUsageError("Invalid dictionary metadata: verify required fields and value types"));
+  }
+  fail(err);
+}
+function uploadFailure(err) {
+  const error = err;
+  if ((error?.status ?? error?.statusCode) === 400 && !error?.problem?.detail && !error?.problem?.errors?.length) {
+    console.error(
+      'Dictionary upload rejected. Verify the SCM region display name (for example, --region "United States"); region codes such as GLOBAL or us-west-2 are not equivalent.'
+    );
+  }
+  dictionaryFailure(err);
+}
 async function buildMetadata(opts) {
   if (opts.metadataFile) {
-    return JSON.parse(await readFile8(opts.metadataFile, "utf-8"));
+    return await readMetadata(opts.metadataFile);
   }
   if (!opts.name || !opts.category || !opts.region || !opts.file) {
-    throw new Error("--name, --category, --region, and --file are required");
+    throw new CliUsageError("--name, --category, --region, and --file are required");
   }
   return {
     name: opts.name,
@@ -8914,7 +8943,7 @@ function register(dlp) {
       const svc = new SdkDictionariesService(await loadDlpClientOptions());
       const params = {
         size,
-        sort: opts.sort,
+        sort: opts.sort ?? ["name,asc"],
         keywords: includeKeywords ? true : void 0
       };
       const all = opts.all ? await svc.listAll({ ...params, max: Number(opts.max) }) : (await svc.list({ ...params, page })).content;
@@ -8927,11 +8956,11 @@ function register(dlp) {
       fail(err);
     }
   });
-  group.command("create").description("Create dictionary via multipart upload").option("--name <s>", "").option("--category <s>", "").option("--region <s>", "").option("--description <s>", "").option("--classification <s>", "").option("--file <path>", "Keyword file").option("--metadata-file <path>", "JSON metadata file (overrides --name/--category/...)").option("--include-keywords", "Include keywords in response").option("--output <fmt>", "Output format", "pretty").action(async (opts, command) => {
+  group.command("create").description("Create dictionary via multipart upload").option("--name <s>", "").option("--category <s>", "").option("--region <s>", 'SCM region display name, e.g. "United States"').option("--description <s>", "").option("--classification <s>", "Legacy top-level metadata field (server support unverified)").option("--file <path>", "Keyword file: TXT (one keyword per line), or CSV (header required)").option("--metadata-file <path>", "JSON metadata file (overrides --name/--category/...)").option("--include-keywords", "Include keywords in response").option("--output <fmt>", "Output format", "pretty").action(async (opts, command) => {
     try {
       const format = await resolveOutput(command, opts);
       const metadata = await buildMetadata(opts);
-      if (!opts.file) throw new Error("--file is required (multipart upload)");
+      if (!opts.file) throw new CliUsageError("--file is required (multipart upload)");
       const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService(await loadDlpClientOptions()).create({
         metadata,
@@ -8940,7 +8969,7 @@ function register(dlp) {
       });
       dlpDictionaries.renderCreated(r, format);
     } catch (err) {
-      usageError(err instanceof Error ? err.message : String(err));
+      uploadFailure(err);
     }
   });
   const getCmd = group.command("get <id>").option("--keywords", "").option("--include-keywords", "Alias for --keywords").option("--output <fmt>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (id, opts) => {
@@ -8958,11 +8987,11 @@ function register(dlp) {
   });
   group.command("replace <id>").description(
     'Full-replace via multipart upload. --file required. May return 200 (body) or 204 (re-get; falls back to "(state not echoed)" on transient failure).'
-  ).option("--name <s>", "").option("--category <s>", "").option("--region <s>", "").option("--description <s>", "").option("--classification <s>", "").option("--file <path>", "Keyword file (required)").option("--metadata-file <path>", "JSON metadata file").option("--include-keywords", "").option("--output <fmt>", "Output format", "pretty").action(async (id, opts, command) => {
+  ).option("--name <s>", "").option("--category <s>", "").option("--region <s>", 'SCM region display name, e.g. "United States"').option("--description <s>", "").option("--classification <s>", "Legacy top-level metadata field (server support unverified)").option("--file <path>", "Required: TXT (one keyword per line), or CSV (header required)").option("--metadata-file <path>", "JSON metadata file").option("--include-keywords", "").option("--output <fmt>", "Output format", "pretty").action(async (id, opts, command) => {
     try {
       const metadata = await buildMetadata(opts);
       const format = await resolveOutput(command, opts);
-      if (!opts.file) throw new Error("--file is required (multipart upload)");
+      if (!opts.file) throw new CliUsageError("--file is required (multipart upload)");
       const file = await readFile8(opts.file);
       const r = await new SdkDictionariesService(await loadDlpClientOptions()).replace(id, {
         metadata,
@@ -8975,23 +9004,34 @@ function register(dlp) {
         dlpDictionaries.renderReplaced(r, format);
       }
     } catch (err) {
-      usageError(err instanceof Error ? err.message : String(err));
+      uploadFailure(err);
     }
   });
   group.command("patch <id>").option("--body-file <path>", "").option("--set <k=v...>", "(repeatable)", (v, p = []) => [...p, v]).option("--clear <key...>", "(repeatable)", (v, p = []) => [...p, v]).option("--output <fmt>", "Output format", "pretty").action(async (id, opts, command) => {
     try {
       const format = await resolveOutput(command, opts);
       if (opts.bodyFile && (opts.set || opts.clear)) {
-        throw new Error("--body-file is mutually exclusive with --set/--clear");
+        throw new CliUsageError("--body-file is mutually exclusive with --set/--clear");
+      }
+      let body;
+      if (opts.bodyFile) {
+        body = await readMetadata(opts.bodyFile);
+      } else {
+        try {
+          body = buildMergePatch({ set: opts.set, clear: opts.clear });
+        } catch {
+          throw new CliUsageError(
+            "Invalid dictionary patch flags: use --set key=value, --clear key, or --body-file for nested fields"
+          );
+        }
       }
-      const body = opts.bodyFile ? await parseBody({ bodyFile: opts.bodyFile }) : buildMergePatch({ set: opts.set, clear: opts.clear });
       dlpDictionaries.renderPatched(
         // biome-ignore lint/suspicious/noExplicitAny: buildMergePatch returns Record<string, unknown>, cast for patch()
         await new SdkDictionariesService(await loadDlpClientOptions()).patch(id, body),
         format
       );
     } catch (err) {
-      usageError(err instanceof Error ? err.message : String(err));
+      dictionaryFailure(err);
     }
   });
   group.command("delete <id>").description("Delete a dictionary").action(async (id) => {
@@ -9108,31 +9148,70 @@ function buildFilteringProfileBody(opts) {
   if (opts.fileType?.length) body.file_type = opts.fileType;
   return body;
 }
-function buildProfileBody(opts) {
+function validateProfileType(value) {
+  if (value === "basic") {
+    throw new Error(
+      "Basic profile writes are unsupported: the API returned advanced for basic requests. Use advanced or manage basic profiles in SCM."
+    );
+  }
+  if (value !== void 0 && value !== "advanced") {
+    throw new Error("Profile type must be advanced");
+  }
+}
+function validateProfileName(name) {
+  if (typeof name !== "string" || !name.trim()) {
+    throw new Error("Profile name is required and must be a nonblank string");
+  }
+  if (name.length > 32) throw new Error("Profile name must be at most 32 characters");
+}
+function validateProfileFlags(opts) {
   if (!opts.name) throw new Error("--name is required");
-  const profileType = opts.profileType ?? "advanced";
+  validateProfileName(opts.name);
+  validateProfileType(opts.profileType);
+  if (!["and", "or", "not", "and_not", "or_not"].includes((opts.combinator ?? "or").toLowerCase())) {
+    throw new Error("--combinator must be one of and|or|not|and_not|or_not");
+  }
+  if (!["low", "medium", "high"].includes(opts.confidence ?? "high")) {
+    throw new Error("--confidence must be low|medium|high");
+  }
+}
+function buildProfileBody(opts, patterns = []) {
+  validateProfileFlags(opts);
   const body = {
     name: opts.name,
-    profile_type: profileType
+    profile_type: "advanced"
   };
   if (opts.description != null) body.description = opts.description;
   if (opts.granular != null) body.is_granular_data_profile = !!opts.granular;
   if (opts.patternId?.length) {
-    const op = (opts.combinator ?? "or").toLowerCase();
-    if (!["and", "or", "not", "and_not", "or_not"].includes(op)) {
-      throw new Error(`--combinator must be one of and|or|not|and_not|or_not (got '${op}')`);
-    }
+    const confidence = opts.confidence ?? "high";
+    const leaves = opts.patternId.map((id) => {
+      const pattern = patterns.find((item) => item.id === id);
+      if (!pattern)
+        throw new Error("Every --pattern-id must resolve before building profile rules");
+      if (pattern.confidenceLevels?.length && !pattern.confidenceLevels.includes(confidence)) {
+        throw new Error("Requested confidence is not supported by every referenced pattern");
+      }
+      return {
+        rule_item: {
+          id: pattern.id,
+          name: pattern.name,
+          version: pattern.version,
+          detection_technique: pattern.technique,
+          confidence_level: confidence,
+          supported_confidence_levels: pattern.confidenceLevels?.length ? [...pattern.confidenceLevels] : [confidence],
+          match_type: "include",
+          occurrence_operator_type: "more_than_equal_to",
+          occurrence_count: 1
+        }
+      };
+    });
     body.detection_rules = [
       {
         rule_type: "expression_tree",
         expression_tree: {
-          operator_type: op,
-          condition_pattern: opts.patternId.map((id) => ({
-            data_pattern_id: id,
-            confidence_level: opts.confidence ?? "high",
-            occurrence_operator_type: "any",
-            occurrence_count: 1
-          }))
+          operator_type: (opts.combinator ?? "or").toLowerCase(),
+          sub_expressions: leaves
         }
       }
     ];
@@ -9170,8 +9249,8 @@ function register2(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataFilteringProfilesService(await loadDlpClientOptions());
-      const all = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : void 0;
-      const r = all ? { content: all, totalElements: all.length } : await svc.list({ page, size, sort: opts.sort });
+      const all = opts.all ? await svc.listAll({ size, sort: opts.sort ?? ["name,asc"], max: Number(opts.max) }) : void 0;
+      const r = all ? { content: all, totalElements: all.length } : await svc.list({ page, size, sort: opts.sort ?? ["name,asc"] });
       dlpFilteringProfiles.renderList(r, await resolveOutput(listCmd, opts));
     } catch (err) {
       fail(err);
@@ -9341,7 +9420,7 @@ function register4(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataPatternsService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort ?? ["name,asc"], max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort ?? ["name,asc"] })).content;
       const visible = visibleRecords(result, opts.includePredefined);
       dlpPatterns.renderList(
         { content: visible, totalElements: visible.length },
@@ -9419,6 +9498,9 @@ function register4(dlp) {
   });
 }
 
+// src/cli/commands/dlp/profiles.ts
+import { AISecSDKException as AISecSDKException3, ErrorType as ErrorType4 } from "@cdot65/prisma-airs-sdk";
+
 // src/airs/dlp/data-profiles.ts
 var SdkDataProfilesService = class {
   client;
@@ -9456,7 +9538,7 @@ function listFlags3(cmd) {
   return cmd;
 }
 function writeFlags2(cmd) {
-  return cmd.option("--name <s>", "Profile name (required unless --body-file)").option("--profile-type <s>", "Profile type: basic|advanced (default: advanced)").option("--description <s>", "Description").option("--granular", "Granular data profile").option(
+  return cmd.option("--name <s>", "Profile name (required unless --body-file)").option("--profile-type <s>", "Profile type: advanced (basic writes are unsupported)").option("--description <s>", "Description").option("--granular", "Granular data profile").option(
     "--pattern-id <id>",
     "Data pattern ID to include (repeatable). Builds a simple expression_tree.",
     repeatable
@@ -9468,16 +9550,75 @@ function writeFlags2(cmd) {
     "Raw JSON body file (escape hatch; required for complex rule trees)"
   ).option("--output <fmt>", "Output format", "pretty");
 }
+function validateBodyType(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new CliUsageError("Profile body must be a JSON object");
+  }
+  try {
+    validateProfileName(body.name);
+    validateProfileType(body.profile_type);
+  } catch (error) {
+    throw new CliUsageError(error.message);
+  }
+}
+function profileFailure(error) {
+  if (error instanceof AISecSDKException3 && error.errorType === ErrorType4.USER_REQUEST_PAYLOAD_ERROR) {
+    fail(new CliUsageError("Invalid profile metadata: verify required fields and value types"));
+  }
+  fail(error);
+}
 async function resolveWriteBody2(opts) {
-  if (opts.body || opts.bodyFile) {
-    const body = await parseBody({
-      body: opts.body,
-      bodyFile: opts.bodyFile
-    });
-    if (!body) throw new Error("--body or --body-file was empty");
+  try {
+    validateProfileType(opts.profileType);
+  } catch (error) {
+    throw new CliUsageError(error.message);
+  }
+  if (opts.body !== void 0 || opts.bodyFile !== void 0) {
+    if (opts.body !== void 0 && opts.bodyFile !== void 0) {
+      throw new CliUsageError("--body and --body-file are mutually exclusive");
+    }
+    let body;
+    try {
+      body = await parseBody({ body: opts.body, bodyFile: opts.bodyFile });
+    } catch {
+      throw new CliUsageError("Cannot read profile body as JSON; verify the file and JSON syntax");
+    }
+    validateBodyType(body);
     return body;
   }
-  return buildProfileBody(opts);
+  try {
+    validateProfileFlags(opts);
+  } catch (error) {
+    throw new CliUsageError(error.message);
+  }
+  const patterns = [];
+  const ids = opts.patternId;
+  if (ids?.length) {
+    const svc = new SdkDataPatternsService(await loadDlpClientOptions());
+    for (const id of new Set(ids)) {
+      const pattern = await svc.get(id);
+      if (pattern.id !== id || !pattern.name || !pattern.detection_config?.technique || !Number.isInteger(pattern.version) || Number(pattern.version) < 1) {
+        throw new Error(
+          "Referenced pattern did not return a matching ID, name, technique, and version; no profile was written"
+        );
+      }
+      if (pattern.status !== "active") {
+        throw new Error("Referenced pattern is not active; no profile was written");
+      }
+      patterns.push({
+        id: pattern.id,
+        name: pattern.name,
+        version: pattern.version,
+        technique: pattern.detection_config.technique,
+        confidenceLevels: pattern.detection_config.supported_confidence_levels
+      });
+    }
+  }
+  try {
+    return buildProfileBody(opts, patterns);
+  } catch (error) {
+    throw new CliUsageError(error.message);
+  }
 }
 function register5(dlp) {
   const group = dlp.command("profiles").description(
@@ -9490,7 +9631,7 @@ function register5(dlp) {
     try {
       const { page, size } = resolvePageParams(listCmd, opts);
       const svc = new SdkDataProfilesService(await loadDlpClientOptions());
-      const result = opts.all ? await svc.listAll({ size, sort: opts.sort, max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort })).content;
+      const result = opts.all ? await svc.listAll({ size, sort: opts.sort ?? ["name,asc"], max: Number(opts.max) }) : (await svc.list({ page, size, sort: opts.sort ?? ["name,asc"] })).content;
       const visible = visibleRecords(result, opts.includePredefined);
       dlpProfiles.renderList(
         { content: visible, totalElements: visible.length },
@@ -9511,7 +9652,7 @@ function register5(dlp) {
           format
         );
       } catch (err) {
-        usageError(err instanceof Error ? err.message : String(err));
+        profileFailure(err);
       }
     }
   );
@@ -9536,7 +9677,7 @@ function register5(dlp) {
           format
         );
       } catch (err) {
-        usageError(err instanceof Error ? err.message : String(err));
+        profileFailure(err);
       }
     }
   );
@@ -9546,16 +9687,24 @@ function register5(dlp) {
     try {
       const format = await resolveOutput(command, opts);
       if (opts.bodyFile && (opts.set || opts.clear)) {
-        throw new Error("--body-file is mutually exclusive with --set/--clear");
+        throw new CliUsageError("--body-file is mutually exclusive with --set/--clear");
       }
-      const body = opts.bodyFile ? await parseBody({ bodyFile: opts.bodyFile }) : buildMergePatch({ set: opts.set, clear: opts.clear });
+      let body;
+      try {
+        body = opts.bodyFile ? await parseBody({ bodyFile: opts.bodyFile }) : buildMergePatch({ set: opts.set, clear: opts.clear });
+      } catch {
+        throw new CliUsageError(
+          "Invalid profile patch: verify JSON syntax and --set key=value/--clear key flags"
+        );
+      }
+      validateBodyType(body);
       dlpProfiles.renderPatched(
         // biome-ignore lint/suspicious/noExplicitAny: buildMergePatch returns Record<string, unknown>, cast for patch()
         await new SdkDataProfilesService(await loadDlpClientOptions()).patch(id, body),
         format
       );
     } catch (err) {
-      usageError(err instanceof Error ? err.message : String(err));
+      profileFailure(err);
     }
   });
   group.command("delete <id>").description("Not supported \u2014 explains the cleanup limitation and exits 2").action((id) => {
@@ -9573,7 +9722,7 @@ function register5(dlp) {
 import { randomUUID as randomUUID7 } from "crypto";
 import { readFile as readFile9, stat } from "fs/promises";
 import { extname, resolve as resolve5 } from "path";
-import { AISecSDKException as AISecSDKException2, ManagementClient } from "@cdot65/prisma-airs-sdk";
+import { AISecSDKException as AISecSDKException4, ManagementClient } from "@cdot65/prisma-airs-sdk";
 import { dump as dump6, JSON_SCHEMA, load as load2 } from "js-yaml";
 import { ZodError } from "zod";
 
@@ -9632,13 +9781,79 @@ function assertName(name) {
 async function springPages(fetch, maxPages3, label) {
   pagesLimit(maxPages3);
   const items = [];
+  const ids = /* @__PURE__ */ new Set();
+  let totalPages;
+  let totalElements;
+  let effectiveSize;
+  const inconsistent = () => {
+    throw new Error(
+      `Inventory of ${label} has inconsistent pagination metadata; retry the operation`
+    );
+  };
+  const alias = (camel, snake) => {
+    if (camel !== void 0 && snake !== void 0 && camel !== snake) inconsistent();
+    return camel ?? snake;
+  };
   for (let page = 0; page < maxPages3; page++) {
     const result = await fetch(page);
-    items.push(...result.content);
-    if (items.length > 1e4)
+    const pageSize = alias(result.pageable?.pageSize, result.pageable?.page_size);
+    const suppliedSize = alias(result.size, pageSize);
+    if (suppliedSize !== void 0 && (!Number.isSafeInteger(suppliedSize) || suppliedSize < 1 || suppliedSize > 100 || effectiveSize !== void 0 && suppliedSize !== effectiveSize))
+      inconsistent();
+    effectiveSize = suppliedSize ?? effectiveSize ?? 100;
+    const suppliedPages = alias(result.totalPages, result.total_pages);
+    const suppliedElements = alias(result.totalElements, result.total_elements);
+    if (items.length + result.content.length > 1e4)
       throw new Error(`Inventory of ${label} exceeds the 10000-record safety limit`);
-    const last = result.last ?? (result.totalPages !== void 0 ? page + 1 >= result.totalPages : result.content.length < 100);
-    if (last) return items;
+    for (const [actual, expected] of [
+      [result.number, page],
+      [result.size, effectiveSize],
+      [alias(result.numberOfElements, result.number_of_elements), result.content.length],
+      [result.first, page === 0],
+      [result.empty, result.content.length === 0],
+      [alias(result.pageable?.pageNumber, result.pageable?.page_number), page],
+      [pageSize, effectiveSize],
+      [result.pageable?.offset, page * effectiveSize]
+    ]) {
+      if (actual !== void 0 && actual !== expected) inconsistent();
+    }
+    for (const [actual, previous] of [
+      [suppliedPages, totalPages],
+      [suppliedElements, totalElements]
+    ]) {
+      if (actual !== void 0 && (!Number.isSafeInteger(actual) || actual < 0 || previous !== void 0 && actual !== previous))
+        inconsistent();
+    }
+    totalPages = suppliedPages ?? totalPages;
+    totalElements = suppliedElements ?? totalElements;
+    if (totalPages !== void 0 && totalElements !== void 0 && totalPages !== Math.ceil(totalElements / effectiveSize))
+      inconsistent();
+    if (totalPages !== void 0 && (page >= Math.max(totalPages, 1) || totalPages === 0 && result.content.length !== 0))
+      inconsistent();
+    if (totalElements !== void 0 && result.content.length !== Math.min(effectiveSize, Math.max(0, totalElements - page * effectiveSize)))
+      inconsistent();
+    for (const item of result.content) {
+      if (typeof item.id !== "string" || !item.id.trim())
+        throw new Error(
+          `Inventory of ${label} contains a missing resource ID; retry the operation`
+        );
+      if (ids.has(item.id))
+        throw new Error(
+          `Inventory of ${label} contains duplicate resource IDs; retry the operation`
+        );
+      ids.add(item.id);
+      items.push(item);
+    }
+    const expectedLast = totalPages !== void 0 ? page + 1 >= totalPages : totalElements !== void 0 ? items.length === totalElements : void 0;
+    if (result.last !== void 0 && expectedLast !== void 0 && result.last !== expectedLast)
+      inconsistent();
+    const last = result.last ?? expectedLast ?? result.content.length < effectiveSize;
+    if (totalPages !== void 0 && totalPages > 0 && (!last && result.content.length !== effectiveSize || last && result.content.length === 0))
+      inconsistent();
+    if (last) {
+      if (totalElements !== void 0 && items.length !== totalElements) inconsistent();
+      return items;
+    }
     if (!result.content.length) throw new Error(`Inventory of ${label} did not advance`);
   }
   throw new Error(`Inventory of ${label} is incomplete: increase --max-pages`);
@@ -9646,17 +9861,17 @@ async function springPages(fetch, maxPages3, label) {
 async function inventories(api, maxPages3) {
   return {
     dictionaries: await springPages(
-      (page) => api.dictionaries.list({ page, size: 100, keywords: true }),
+      (page) => api.dictionaries.list({ page, size: 100, sort: ["name,asc"], keywords: true }),
       maxPages3,
       "dictionaries"
     ),
     patterns: await springPages(
-      (page) => api.patterns.list({ page, size: 100 }),
+      (page) => api.patterns.list({ page, size: 100, sort: ["name,asc"] }),
       maxPages3,
       "data patterns"
     ),
     profiles: await springPages(
-      (page) => api.profiles.list({ page, size: 100 }),
+      (page) => api.profiles.list({ page, size: 100, sort: ["name,asc"] }),
       maxPages3,
       "data profiles"
     )
@@ -9786,12 +10001,14 @@ async function backupDlpResources(api, tsgId, options = {}) {
           if (leaf.technique === "dictionary") {
             const record = dictionaryById.get(id);
             if (!record) throw new Error(`references an unknown dictionary: ${id}`);
-            if (leaf.value.version != null)
+            if (leaf.value.version != null && leaf.value.version !== 1)
               throw new Error(`references a version-pinned dictionary: ${id}`);
             addDictionary(record);
           } else {
             const record = patternById.get(id);
             if (!record) throw new Error(`references an unknown data pattern: ${id}`);
+            if (record.detection_config?.technique !== leaf.technique)
+              throw new Error("references a data pattern with a different detection technique");
             if (RETIRED_PATTERN.has(record.status ?? "active"))
               throw new Error(`references a retired data pattern: ${record.name ?? id}`);
             if (leaf.value.version != null && record.version !== leaf.value.version)
@@ -9878,6 +10095,20 @@ function keywordSet(value) {
     return void 0;
   return [...value].sort();
 }
+function dictionaryFile(metadata, keywords) {
+  if (!keywords.length || keywords.some((word) => !word.length || /[\r\n]/.test(word)))
+    throw new Error("Dictionary contains keywords that cannot be faithfully uploaded");
+  if (/\.csv$/i.test(metadata.original_file_name)) {
+    if (keywords.some((word) => word.includes(",")))
+      throw new Error("Dictionary CSV contains unsupported multi-column keywords");
+    return `keywords
+${keywords.join("\n")}
+`;
+  }
+  if (/\.txt$/i.test(metadata.original_file_name)) return `${keywords.join("\n")}
+`;
+  throw new Error("Dictionary filename must end in .csv or .txt for a verified upload");
+}
 function dictionaryEcho(metadata, record, keywords) {
   const { original_file_name, ...projection } = metadata;
   const echo = compareEcho(projection, record);
@@ -9893,7 +10124,8 @@ function dictionaryRequest(source, name) {
     original_file_name: source.dictionary_metadata?.original_file_name ?? "keywords.txt",
     region_name: source.region_name,
     ...source.description != null ? { description: source.description } : {},
-    ...source.is_case_sensitive != null ? { is_case_sensitive: source.is_case_sensitive } : {}
+    ...source.is_case_sensitive != null ? { is_case_sensitive: source.is_case_sensitive } : {},
+    ...source.tags != null ? { tags: structuredClone(source.tags) } : {}
   };
   const parsed = DictionaryRequestSchema.safeParse(metadata);
   if (!parsed.success)
@@ -9951,6 +10183,24 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
   uniqueNames(backup.dictionaries, "dictionary");
   uniqueNames(backup.patterns, "data pattern");
   uniqueNames(backup.profiles, "data profile");
+  const sourceBindings = /* @__PURE__ */ new Map();
+  for (const [kind, records] of [
+    ["dictionary", backup.dictionaries],
+    ["pattern", backup.patterns]
+  ]) {
+    for (const record of records) {
+      if (!record.id) continue;
+      if (sourceBindings.has(record.id))
+        throw new Error("Backup contains duplicate dependency identities");
+      sourceBindings.set(record.id, {
+        id: record.id,
+        name: record.name ?? "",
+        kind,
+        technique: kind === "dictionary" ? "dictionary" : record.detection_config?.technique,
+        version: kind === "dictionary" ? 1 : record.version ?? void 0
+      });
+    }
+  }
   const unknownMapped = Object.keys(patternMap2).filter(
     (name) => !backup.patterns.some((p) => p.name === name)
   );
@@ -10004,6 +10254,7 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     if (!keywords) throw new Error(`Backup dictionary lacks keywords: ${source.name}`);
     const match = matchByName(destination.dictionaries, name, () => false, "dictionary");
     if (!match) {
+      dictionaryFile(metadata, keywords);
       dictionaryPlans.push({ sourceId: source.id, name, action: "create", metadata, keywords });
       continue;
     }
@@ -10044,6 +10295,8 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
         else missingPredefined.push({ name: source.name, candidates });
         continue;
       }
+      if (!source.detection_config?.technique || match2.detection_config?.technique !== source.detection_config.technique)
+        throw new Error(`Destination data pattern detection technique differs: ${source.name}`);
       patternPlans.push({
         sourceId: source.id,
         name: match2.name,
@@ -10056,6 +10309,8 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
       const target = patternMap2[source.name];
       const match2 = matchByName(destination.patterns, target, retired, "data pattern");
       if (!match2?.id) throw new Error(`Missing mapped destination data pattern: ${target}`);
+      if (!source.detection_config?.technique || match2.detection_config?.technique !== source.detection_config.technique)
+        throw new Error(`Mapped destination data pattern detection technique differs: ${target}`);
       patternPlans.push({
         sourceId: source.id,
         name: target,
@@ -10164,7 +10419,15 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     const missing = /* @__PURE__ */ new Set();
     for (const leaf of ruleLeaves(item.source)) {
       const id = leaf.value.id;
-      if (id != null && id !== "" && !planned.has(String(id))) missing.add(String(id));
+      if (id == null || id === "") continue;
+      if (typeof id !== "string") throw new Error("Backup contains a non-string rule reference ID");
+      const sourceBinding = sourceBindings.get(id);
+      if (sourceBinding) {
+        assertLeafBinding(leaf, sourceBinding);
+        if (leaf.value.version != null && leaf.value.version !== sourceBinding.version)
+          throw new Error("Backup rule pins an unknown source dependency version");
+      }
+      if (!planned.has(id)) missing.add(id);
     }
     if (missing.size) {
       const skippable = [...missing].filter((id) => unresolvedById.has(id));
@@ -10185,20 +10448,39 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
   }
   return plan;
 }
+function assertLeafBinding(leaf, binding) {
+  if (leaf.technique === "dictionary" !== (binding.kind === "dictionary") || leaf.technique !== binding.technique)
+    throw new Error("Data profile rule detection technique does not match its dependency");
+}
 function planBindings(plan) {
   const bindings = /* @__PURE__ */ new Map();
   for (const item of plan.dictionaries)
-    if (item.existing?.id) bindings.set(item.sourceId, { id: item.existing.id, name: item.name });
+    if (item.existing?.id)
+      bindings.set(item.sourceId, {
+        id: item.existing.id,
+        name: item.name,
+        version: 1,
+        kind: "dictionary",
+        technique: "dictionary"
+      });
   for (const item of plan.patterns)
     if (item.existing?.id)
       bindings.set(item.sourceId, {
         id: item.existing.id,
         name: item.name,
+        kind: "pattern",
+        technique: item.existing.detection_config?.technique,
         version: item.existing.version ?? void 0
       });
   return bindings;
 }
 function profileRequest(item, bindings, crossTenant, requireBindings) {
+  if (item.action === "create" && item.name.length > 32)
+    throw new Error("Data profile name exceeds the live API limit of 32 characters");
+  if (item.action === "create" && item.source.profile_type === "basic")
+    throw new Error("Data profile basic writes cannot round-trip through the API");
+  if (item.action === "create" && !item.source.detection_rules?.length)
+    throw new Error("Data profile has no exported detection rules to create");
   const detectionRules = structuredClone(item.source.detection_rules ?? []);
   const known = /* @__PURE__ */ new Set();
   let deferred = false;
@@ -10207,6 +10489,8 @@ function profileRequest(item, bindings, crossTenant, requireBindings) {
     known.add(leaf.value);
     const id = leaf.value.id;
     if (id == null || id === "") continue;
+    if (leaf.technique === "dictionary" && leaf.value.version != null && leaf.value.version !== 1)
+      throw new Error("Dictionary rule has an unsupported version pin");
     const binding = bindings.get(String(id));
     if (!binding) {
       if (requireBindings)
@@ -10216,6 +10500,7 @@ function profileRequest(item, bindings, crossTenant, requireBindings) {
       deferred = true;
       continue;
     }
+    assertLeafBinding(leaf, binding);
     leaf.value.id = binding.id;
     if (leaf.value.name != null) leaf.value.name = binding.name;
     if (leaf.value.version != null) {
@@ -10254,6 +10539,7 @@ async function restoreDlpResources(api, plan, options = {}) {
     patterns: [],
     profiles: [],
     serverAdded: [],
+    unverifiedCreates: [],
     unresolved: structuredClone(plan.unresolved ?? [])
   };
   const crossTenant = plan.sourceTsgId !== plan.destinationTsgId;
@@ -10306,21 +10592,28 @@ async function restoreDlpResources(api, plan, options = {}) {
       if (!item.metadata || !item.keywords) throw new Error("Dictionary plan is incomplete");
       const created = await api.dictionaries.create({
         metadata: item.metadata,
-        file: `${item.keywords.join("\n")}
-`,
+        file: dictionaryFile(item.metadata, item.keywords),
         includeKeywords: true
       });
       if (!created.id) throw new Error(`Restored dictionary did not verify: ${item.name}`);
+      result.unverifiedCreates.push({ kind: "dictionaries", name: item.name, id: created.id });
       const readBack = await api.dictionaries.get(created.id, { includeKeywords: true });
       const echo = dictionaryEcho(item.metadata, readBack, item.keywords);
-      if (!echo.matches || readBack.name !== item.name)
+      if (!echo.matches || readBack.id !== created.id || readBack.name !== item.name)
         throw new Error(
           `Restored dictionary did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
         );
       if (echo.serverAdded.length)
         result.serverAdded.push({ resource: `dictionary ${item.name}`, fields: echo.serverAdded });
-      bindings.set(item.sourceId, { id: created.id, name: item.name });
+      bindings.set(item.sourceId, {
+        id: created.id,
+        name: item.name,
+        version: 1,
+        kind: "dictionary",
+        technique: "dictionary"
+      });
       result.dictionaries.push({ name: item.name, action: "created", id: created.id });
+      result.unverifiedCreates.pop();
       emitItem(
         "dictionaries",
         item.name,
@@ -10348,9 +10641,10 @@ async function restoreDlpResources(api, plan, options = {}) {
       if (!item.body) throw new Error("Data pattern plan is incomplete");
       const created = await api.patterns.create(item.body);
       if (!created.id) throw new Error(`Restored data pattern did not verify: ${item.name}`);
+      result.unverifiedCreates.push({ kind: "patterns", name: item.name, id: created.id });
       const readBack = await api.patterns.get(created.id);
       const echo = compareEcho(item.body, readBack);
-      if (!echo.matches || readBack.name !== item.name || RETIRED_PATTERN.has(readBack.status ?? "active"))
+      if (!echo.matches || readBack.id !== created.id || readBack.name !== item.name || RETIRED_PATTERN.has(readBack.status ?? "active"))
         throw new Error(
           `Restored data pattern did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
         );
@@ -10362,9 +10656,12 @@ async function restoreDlpResources(api, plan, options = {}) {
       bindings.set(item.sourceId, {
         id: created.id,
         name: item.name,
+        kind: "pattern",
+        technique: readBack.detection_config?.technique,
         version: readBack.version ?? void 0
       });
       result.patterns.push({ name: item.name, action: "created", id: created.id });
+      result.unverifiedCreates.pop();
       emitItem("patterns", item.name, "created", result.patterns.length, plan.patterns.length);
     }
     if (plan.profiles.length)
@@ -10401,9 +10698,10 @@ async function restoreDlpResources(api, plan, options = {}) {
       }
       const created = await api.profiles.create(body);
       if (!created.id) throw new Error(`Restored data profile did not verify: ${item.name}`);
+      result.unverifiedCreates.push({ kind: "profiles", name: item.name, id: created.id });
       const readBack = await api.profiles.get(created.id);
       const echo = compareEcho(body, readBack);
-      if (!echo.matches || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
+      if (!echo.matches || readBack.id !== created.id || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
         throw new Error(
           `Restored data profile did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
         );
@@ -10413,6 +10711,7 @@ async function restoreDlpResources(api, plan, options = {}) {
           fields: echo.serverAdded
         });
       result.profiles.push({ name: item.name, action: "created", id: created.id });
+      result.unverifiedCreates.pop();
       emitItem("profiles", item.name, "created", result.profiles.length, plan.profiles.length);
     }
     result.complete = true;
@@ -10421,6 +10720,9 @@ async function restoreDlpResources(api, plan, options = {}) {
     result.error = Number.isInteger(status) ? `API request failed (HTTP ${status}); verify destination state before retrying` : error instanceof Error && /^(Destination|Restored|Missing|Inventory|Ambiguous|Dictionary|Data pattern|Data profile)/.test(
       error.message
     ) ? error.message : "Restore stopped; verify destination state before retrying";
+    const unverified = result.unverifiedCreates[0];
+    if (unverified)
+      result.error += `; unverified create: ${unverified.kind} ${unverified.name} (id ${unverified.id}); inspect this resource before retrying`;
   }
   return result;
 }
@@ -10470,7 +10772,7 @@ function failure(error) {
   if (error instanceof CliUsageError) usageError(error.message);
   if (error instanceof ZodError) {
     ui.error("Invalid DLP backup/request schema; content is not logged.");
-  } else if (error instanceof AISecSDKException2) {
+  } else if (error instanceof AISecSDKException4) {
     ui.error(
       `DLP transfer API request failed${error.statusCode ? ` (HTTP ${error.statusCode})` : ""}; no automatic retry was made.`
     );
@@ -10544,6 +10846,20 @@ ${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
     for (const entry of rows("unresolved"))
       blocks.push(`${entry.kind} ${entry.name}: ${entry.reason}`);
   }
+  if (rows("unverifiedCreates").length) {
+    blocks.push(heading("Created resources awaiting verification"));
+    blocks.push(
+      formatOutput(
+        rows("unverifiedCreates"),
+        [
+          { key: "kind", label: "Resource" },
+          { key: "name", label: "Name" },
+          { key: "id", label: "Created ID" }
+        ],
+        markdown ? "markdown" : "table"
+      )
+    );
+  }
   if (rows("serverAdded").length) {
     blocks.push(heading("Verified server-added fields (source omitted these)"));
     for (const item of rows("serverAdded"))
@@ -10728,6 +11044,7 @@ function register6(dlp) {
         { key: "profiles", label: "Data profiles" },
         { key: "unresolved", label: "Unresolved references" },
         { key: "serverAdded", label: "Verified server-added fields" },
+        { key: "unverifiedCreates", label: "Created resources awaiting verification" },
         { key: "dryRun", label: "Dry run" },
         { key: "complete", label: "Complete" }
       ];
@@ -10771,7 +11088,7 @@ function registerDlpCommands(runtime) {
 import { randomUUID as randomUUID8 } from "crypto";
 import { readFile as readFile10, stat as stat2 } from "fs/promises";
 import { extname as extname2, resolve as resolve6 } from "path";
-import { AISecSDKException as AISecSDKException3, ManagementClient as ManagementClient2 } from "@cdot65/prisma-airs-sdk";
+import { AISecSDKException as AISecSDKException5, ManagementClient as ManagementClient2 } from "@cdot65/prisma-airs-sdk";
 import { dump as dump7, JSON_SCHEMA as JSON_SCHEMA2, load as load3 } from "js-yaml";
 import { ZodError as ZodError2 } from "zod";
 
@@ -11492,7 +11809,7 @@ function failure2(error) {
   if (error instanceof CliUsageError) usageError(error.message);
   if (error instanceof ZodError2) {
     ui.error("Invalid profile backup/request schema; content is not logged.");
-  } else if (error instanceof AISecSDKException3) {
+  } else if (error instanceof AISecSDKException5) {
     ui.error(
       `Profile transfer API request failed${error.statusCode ? ` (HTTP ${error.statusCode})` : ""}; no automatic retry was made.`
     );
@@ -13689,12 +14006,41 @@ function buildProgram() {
   const here = dirname5(fileURLToPath(import.meta.url));
   const pkg = JSON.parse(readFileSync4(join5(here, "../../package.json"), "utf-8"));
   const program = new Command();
+  let dlpDebugBodyEnvironment;
+  const restoreDlpDebugBody = () => {
+    if (!dlpDebugBodyEnvironment) return;
+    const { previous } = dlpDebugBodyEnvironment;
+    if (previous === void 0) delete process.env.PANW_AI_SEC_DEBUG_BODY;
+    else process.env.PANW_AI_SEC_DEBUG_BODY = previous;
+    dlpDebugBodyEnvironment = void 0;
+  };
+  program.hook("postAction", restoreDlpDebugBody);
+  const parseAsync = program.parseAsync.bind(program);
+  program.parseAsync = async (...args) => {
+    try {
+      return await parseAsync(...args);
+    } finally {
+      restoreDlpDebugBody();
+    }
+  };
   program.name("airs").description(
     "CLI and library for Palo Alto Prisma AIRS \u2014 guardrail refinement, AI red teaming, model security scanning, profile audits"
-  ).version(pkg.version).option("--debug", "Log all AIRS/SCM API requests and responses to a JSONL file").option("--output <format>", "Default output format for read commands").option("--quiet", "Suppress status and decorative output (data and errors still print)");
+  ).version(pkg.version).option("--debug", "Write redacted API diagnostics to a private JSONL file").option("--output <format>", "Default output format for read commands").option("--quiet", "Suppress status and decorative output (data and errors still print)");
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
+    let ancestor = actionCommand;
+    let agentGuard = false;
+    let dlp = false;
+    while (ancestor) {
+      if (ancestor.name() === "agentguard") agentGuard = true;
+      if (ancestor.name() === "dlp" && ancestor.parent?.name() === "runtime") dlp = true;
+      ancestor = ancestor.parent;
+    }
+    if (dlp) {
+      dlpDebugBodyEnvironment = { previous: process.env.PANW_AI_SEC_DEBUG_BODY };
+      process.env.PANW_AI_SEC_DEBUG_BODY = "0";
+    }
     const profileTransfer = actionCommand.parent?.name() === "profiles" && actionCommand.parent.parent?.name() === "runtime" && ["backup", "restore"].includes(actionCommand.name());
     if (profileTransfer && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
       usageError(
@@ -13721,13 +14067,9 @@ function buildProgram() {
         `debug-api-${Date.now()}-${randomUUID12().slice(0, 8)}.jsonl`
       );
       try {
-        let ancestor = actionCommand;
-        let agentGuard = false;
-        while (ancestor) {
-          if (ancestor.name() === "agentguard") agentGuard = true;
-          ancestor = ancestor.parent;
-        }
-        installDebugLogger(logPath, { omitBodies: agentGuard });
+        installDebugLogger(logPath, {
+          omitBodies: agentGuard || dlp
+        });
       } catch {
         ui.error(
           "Cannot create the debug log in the current working directory. Run from a writable directory or omit --debug."

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.9.0",
+  "version": "5.9.1",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",
@@ -59,7 +59,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@cdot65/prisma-airs-sdk": "0.30.0",
+    "@cdot65/prisma-airs-sdk": "0.30.1",
     "@inquirer/prompts": "^8.3.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",