@cdot65/prisma-airs-cli 5.9.1 → 5.10.0

package/dist/cli/index.js

@@ -10178,7 +10178,8 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
   if (prefix.length > 64 || [...prefix].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
     throw new Error("Invalid --name-prefix");
   const conflict = options.onConflict ?? "error";
-  if (!["error", "verify", "skip"].includes(conflict)) throw new Error("Invalid conflict policy");
+  if (!["error", "verify", "skip", "reconcile"].includes(conflict))
+    throw new Error("Invalid conflict policy");
   const patternMap2 = options.patternMap ?? {};
   uniqueNames(backup.dictionaries, "dictionary");
   uniqueNames(backup.patterns, "data pattern");
@@ -10406,6 +10407,7 @@ async function planDlpResourcesRestore(api, input2, destinationTsgId, options =
     patterns: patternPlans,
     profiles: profilePlans,
     unresolved,
+    suffixOnConflict: conflict === "reconcile",
     maxPages: maxPages3
   };
   const bindings = planBindings(plan);
@@ -10530,6 +10532,15 @@ function assertUnchanged(current, prior, label) {
   if (canonical(current ?? null) !== canonical(prior ?? null))
     throw new Error(`Destination ${label} changed after planning`);
 }
+function defaultProfileSuffix() {
+  return Math.floor(Math.random() * 16777216).toString(16).padStart(6, "0");
+}
+function suffixedProfileName(name, suffix) {
+  const tail = `-${suffix}`;
+  const room = 32 - tail.length;
+  const base = name.length > room ? name.slice(0, room) : name;
+  return `${base}${tail}`;
+}
 async function restoreDlpResources(api, plan, options = {}) {
   const result = {
     sourceTsgId: plan.sourceTsgId,
@@ -10544,6 +10555,7 @@ async function restoreDlpResources(api, plan, options = {}) {
   };
   const crossTenant = plan.sourceTsgId !== plan.destinationTsgId;
   const emit2 = options.onProgress;
+  const suffixGenerator = options.suffixGenerator ?? defaultProfileSuffix;
   const emitItem = (stage, name, action, index, total) => emit2?.({ phase: "item", stage, name, action, index, total });
   try {
     emit2?.({ phase: "recheck" });
@@ -10696,23 +10708,39 @@ async function restoreDlpResources(api, plan, options = {}) {
         emitItem("profiles", item.name, "verified", result.profiles.length, plan.profiles.length);
         continue;
       }
-      const created = await api.profiles.create(body);
-      if (!created.id) throw new Error(`Restored data profile did not verify: ${item.name}`);
-      result.unverifiedCreates.push({ kind: "profiles", name: item.name, id: created.id });
+      let writeBody = body;
+      let finalName = item.name;
+      let created;
+      try {
+        created = await api.profiles.create(writeBody);
+      } catch (error) {
+        if (!plan.suffixOnConflict || error?.statusCode !== 409)
+          throw error;
+        finalName = suffixedProfileName(item.name, suffixGenerator());
+        writeBody = { ...body, name: finalName };
+        created = await api.profiles.create(writeBody);
+      }
+      if (!created.id) throw new Error(`Restored data profile did not verify: ${finalName}`);
+      result.unverifiedCreates.push({ kind: "profiles", name: finalName, id: created.id });
       const readBack = await api.profiles.get(created.id);
-      const echo = compareEcho(body, readBack);
-      if (!echo.matches || readBack.id !== created.id || readBack.name !== item.name || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
+      const echo = compareEcho(writeBody, readBack);
+      if (!echo.matches || readBack.id !== created.id || readBack.name !== finalName || RETIRED_PROFILE.has(readBack.profile_status ?? "active"))
         throw new Error(
-          `Restored data profile did not verify: ${item.name} (created id ${created.id}; inspect it before retrying)`
+          `Restored data profile did not verify: ${finalName} (created id ${created.id}; inspect it before retrying)`
         );
       if (echo.serverAdded.length)
         result.serverAdded.push({
-          resource: `data profile ${item.name}`,
+          resource: `data profile ${finalName}`,
           fields: echo.serverAdded
         });
-      result.profiles.push({ name: item.name, action: "created", id: created.id });
+      result.profiles.push({
+        name: finalName,
+        action: "created",
+        id: created.id,
+        ...finalName !== item.name ? { renamedFrom: item.name } : {}
+      });
       result.unverifiedCreates.pop();
-      emitItem("profiles", item.name, "created", result.profiles.length, plan.profiles.length);
+      emitItem("profiles", finalName, "created", result.profiles.length, plan.profiles.length);
     }
     result.complete = true;
   } catch (error) {
@@ -10860,6 +10888,11 @@ ${markdown ? "\n" : ""}Destination TSG: ${value.destinationTsgId}`
       )
     );
   }
+  const renamed = rows("profiles").filter((p) => p.renamedFrom);
+  if (renamed.length) {
+    blocks.push(heading("Renamed around archived-name collisions"));
+    for (const p of renamed) blocks.push(`${p.renamedFrom} -> ${p.name}`);
+  }
   if (rows("serverAdded").length) {
     blocks.push(heading("Verified server-added fields (source omitted these)"));
     for (const item of rows("serverAdded"))
@@ -10953,7 +10986,7 @@ function register6(dlp) {
     "Restore DLP resources into the selected tenant, staged dictionaries \u2192 patterns \u2192 profiles; validate all dependencies before changes"
   ).option("--dry-run", "Read and validate a restore plan without changing destination resources").option("--name-prefix <prefix>", "Prefix restored custom resource names to avoid collisions").option(
     "--on-conflict <policy>",
-    "Existing data profile names: error, verify (resume without writes) or skip. Updates are unsupported until the DLP profile write path is live-verified.",
+    "Existing data profile names: error, verify (resume without writes), skip, or reconcile (verify active duplicates, and give archived-name collisions a unique suffix). Profile update is a live server error, so a divergent active profile still fails.",
     "error"
   ).option(
     "--pattern-map <source=destination>",
@@ -10980,8 +11013,8 @@ function register6(dlp) {
     )
   ).action(async (file, opts) => {
     try {
-      if (!["error", "verify", "skip"].includes(opts.onConflict))
-        throw new CliUsageError("--on-conflict must be error, verify or skip");
+      if (!["error", "verify", "skip", "reconcile"].includes(opts.onConflict))
+        throw new CliUsageError("--on-conflict must be error, verify, skip or reconcile");
       if (opts.force && !opts.expectTsg)
         throw new CliUsageError("--force requires --expect-tsg <destination-tsg>");
       const mappings = patternMap(opts.patternMap);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cdot65/prisma-airs-cli",
   "packageManager": "pnpm@10.6.5",
-  "version": "5.9.1",
+  "version": "5.10.0",
   "description": "CLI and library for Palo Alto Prisma AIRS — guardrail refinement, AI red teaming, model security scanning, profile audits",
   "type": "module",
   "main": "dist/index.js",