panorama-super-cli 0.2.1__tar.gz → 0.2.2__tar.gz

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/.github/workflows/docs.yml

@@ -23,9 +23,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -36,7 +36,7 @@ jobs:
         run: uv run mkdocs build --strict
       - name: Upload Pages artifact
         if: github.ref_type == 'tag'
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -49,4 +49,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/.github/workflows/lint.yml

@@ -9,9 +9,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -28,9 +28,9 @@ jobs:
   agents-md-fresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
     # no-environment form.
     steps:
       - name: Checkout (full history for changelog notes)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -40,7 +40,7 @@ jobs:
           echo "Tag $GITHUB_REF_NAME ($GITHUB_SHA) is on main."
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
 

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/.github/workflows/test.yml

@@ -14,9 +14,9 @@ jobs:
         os: [ubuntu-latest, macos-latest]
         python: ["3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/CHANGELOG.md

@@ -7,6 +7,25 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.2.2 — 2026-06-04
+
+### Fixed
+
+- **Repoint-before-delete no longer skipped silently.** A merge or rename whose
+  only safe repoint is a reference the appliers can't express as a flat member
+  rewrite — a NAT source/destination *translation* field, or a rule edit with no
+  rulebase — is now refused with a `blocker` (exit 6) on both the offline and
+  live paths, naming the object and the unmappable referrer. Previously the edit
+  was dropped while the delete/rename still ran, leaving a dangling reference.
+  Advisory unmappable edits with no accompanying teardown still pass with a
+  warning. (#28)
+- **`psc` with no arguments (and unknown commands) print help, not a traceback.**
+  Typer 0.16+ vendors its own Click, so the exceptions the entry point raised
+  were not the `click.*` the wrapper caught and escaped as a traceback ending in
+  `NoArgsIsHelpError`. The wrapper now handles both the vendored and the real
+  Click hierarchies, resolving the module defensively so psc still imports on
+  older Typer. No-args/`--help` exit 0; usage errors exit 2. (#31)
+
 ## v0.2.1 — 2026-06-04
 
 ### Added

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.2.1
+Version: 0.2.2
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/psc/cli/app.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+from types import ModuleType
 
 import click
 import typer
@@ -15,6 +16,28 @@ from psc.config.loader import load_config
 from psc.output.errors import PscError
 from psc.output.format import OutputFormat
 
+
+def _click_exception_module() -> ModuleType:
+    """The Click `exceptions` module whose flavour matches what `app(...)` raises.
+
+    Typer >=0.16 vendors its own Click under `typer._click`, so the exceptions
+    `app(standalone_mode=False)` raises are not subclasses of the real `click.*`
+    (issue #31). Older Typer has no `typer._click` at all — importing it at
+    module top level would crash psc on *import*, breaking every command, which
+    is strictly worse than the bug we're fixing. Resolve defensively: prefer the
+    vendored module, fall back to the real Click (which older Typer raises).
+    """
+    try:
+        from typer._click import exceptions as vendored  # noqa: PLC0415 — conditional
+    except ImportError:
+        from click import exceptions as real  # noqa: PLC0415 — fallback for older Typer
+
+        return real
+    return vendored
+
+
+_typer_click_exc = _click_exception_module()
+
 app = typer.Typer(
     add_completion=True,
     no_args_is_help=True,
@@ -125,18 +148,27 @@ def _emit_error(err: PscError) -> None:
 
 
 def main() -> None:
+    # Typer 0.26 vendors its own Click (`typer._click`), so the exceptions
+    # `app(standalone_mode=False)` raises are NOT subclasses of the real
+    # `click.*`. Catch both flavours, or a no-args/`--help`/bad-command run
+    # escapes uncaught and prints a traceback instead of help (#31).
     try:
         app(standalone_mode=False)
     except PscError as err:
         _emit_error(err)
         raise SystemExit(err.exit_code) from None
-    except click.UsageError as err:
-        err.show()
-        raise SystemExit(2) from None
-    except (click.exceptions.Abort, KeyboardInterrupt):
+    except (KeyboardInterrupt, click.exceptions.Abort, _typer_click_exc.Abort):
         Console(stderr=True).print("aborted")
         raise SystemExit(130) from None
-    except click.exceptions.Exit as err:
+    except (click.exceptions.Exit, _typer_click_exc.Exit) as err:
+        raise SystemExit(err.exit_code) from None
+    except (click.ClickException, _typer_click_exc.ClickException) as err:
+        # `no_args_is_help` (and `--help`) already printed the help text; the
+        # raise is just a stop signal, so exit 0 rather than rendering it as an
+        # error. Genuine usage errors still print and exit non-zero.
+        if err.__class__.__name__ == "NoArgsIsHelpError":
+            raise SystemExit(0) from None
+        err.show()
         raise SystemExit(err.exit_code) from None
 
 

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/psc/core/changeset.py

@@ -125,3 +125,56 @@ class ChangeSet(BaseModel):
         out += [r.summary for r in self.renames]
         out += [d.summary for d in self.deletes]
         return out
+
+
+def reference_edit_is_mappable(edit: ReferenceEdit) -> bool:
+    """Whether both appliers can express `edit` as a flat member-field rewrite.
+
+    The single source of truth behind `apply_xml._referrer_field_element` and
+    `apply_live._referrer_field_xpath`: a member field they know how to address
+    (a group's `static`/`members`, a security-rule field, a NAT src/dst list).
+    A NAT *translation* field is nested with no flat list, and a rule edit with
+    no `rulebase` can't be located — both are unmappable, and an applier silently
+    skips them. The planner uses this to refuse such a skip when the same plan
+    tears the target down, instead of leaving a dangling reference (#28).
+    """
+    kind = edit.referrer_kind
+    if kind in ("address-group", "service-group"):
+        return True
+    if kind == "security-rule":
+        return edit.rulebase is not None
+    if kind == "nat-rule":
+        return edit.rulebase is not None and edit.field in ("source", "destination")
+    return False
+
+
+def gate_unmappable_reference_edits(cs: ChangeSet) -> None:
+    """Promote unsafe unmappable reference edits to blockers, in place.
+
+    An unmappable edit (see `reference_edit_is_mappable`) is silently skipped at
+    apply time. If the plan also deletes or renames an object, that skip drops
+    the repoint that kept the teardown safe — a dangling reference, the exact
+    failure repoint-before-delete exists to prevent. Make it a hard blocker. With
+    no teardown the edit is advisory only, so it stays a warning.
+
+    Clearing the ops is the planner's job (a blocked plan carries zero ops); this
+    only classifies.
+    """
+    unmappable = [e for e in cs.reference_edits if not reference_edit_is_mappable(e)]
+    if not unmappable:
+        return
+    torn_down = [d.name for d in cs.deletes] + [r.old_name for r in cs.renames]
+    for e in unmappable:
+        referrer = f"{e.referrer_kind} '{e.referrer_name}'@{e.referrer_location} {e.field}"
+        if torn_down:
+            targets = ", ".join(f"'{t}'" for t in torn_down)
+            cs.blockers.append(
+                f"cannot repoint {referrer} automatically (no flat member list to rewrite); "
+                f"removing/renaming {targets} would leave a dangling reference — edit that "
+                "field manually, then re-run"
+            )
+        else:
+            cs.warnings.append(
+                f"{referrer} can't be repointed automatically (no flat member list); "
+                "review and edit it by hand"
+            )

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/psc/core/dedup.py

@@ -14,7 +14,13 @@ from __future__ import annotations
 
 from pydantic import BaseModel, Field
 
-from psc.core.changeset import ChangeSet, ObjectDelete, ObjectKind, ReferenceEdit
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectDelete,
+    ObjectKind,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+)
 from psc.core.models import Location, Snapshot
 from psc.core.normalize import normalize_address, service_key
 from psc.core.refs import Reference, ReferenceGraph
@@ -155,23 +161,18 @@ def plan_merge(
             cs.warnings.append(
                 f"{ref.referrer_kind} '{ref.referrer_name}' {ref.field} would be emptied"
             )
-        if ref.field in ("source-translation", "destination-translation"):
-            # psc cannot safely rewrite NAT translation fields offline (the XML
-            # path is nested and renderer-flagged), so deleting `drop` would
-            # leave a dangling translation reference. Refuse rather than warn.
-            cs.blockers.append(
-                f"NAT rule '{ref.referrer_name}' references '{drop.name}' in "
-                f"{ref.field}; psc can't safely rewrite NAT translation offline — "
-                "edit that field manually, then re-run the merge"
-            )
+
+    cs.deletes.append(ObjectDelete(kind=ObjectKind.ADDRESS, name=drop.name, location=drop.location))
+    # Refuse any repoint the appliers would silently skip (e.g. a NAT translation
+    # field) now that the delete is in the plan — a skipped repoint + delete is a
+    # dangling reference. Mirrors `plan_rename`; offline and live share the gate.
+    gate_unmappable_reference_edits(cs)
 
     if cs.blockers:
         # Invariant: a blocked plan carries zero ops, so no consumer can execute
         # a partial rewrite by iterating ops without checking `is_blocked`.
         cs.reference_edits.clear()
-        return cs
-
-    cs.deletes.append(ObjectDelete(kind=ObjectKind.ADDRESS, name=drop.name, location=drop.location))
+        cs.deletes.clear()
     return cs
 
 

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/psc/core/naming.py

@@ -15,7 +15,13 @@ import re
 
 from pydantic import BaseModel
 
-from psc.core.changeset import ChangeSet, ObjectKind, ObjectRename, ReferenceEdit
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectKind,
+    ObjectRename,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+)
 from psc.core.dedup import field_members
 from psc.core.models import Address, AddressType, Location, Service, Snapshot
 from psc.core.refs import ReferenceGraph
@@ -182,4 +188,12 @@ def plan_rename(
     cs.renames.append(
         ObjectRename(kind=kind, location=location_name, old_name=old_name, new_name=new_name)
     )
+    # Refuse any repoint the appliers would silently skip (e.g. a NAT translation
+    # field): skipping it while renaming the object away leaves a dangling
+    # reference. Shared gate keeps offline and live identical (#28).
+    gate_unmappable_reference_edits(cs)
+    if cs.blockers:
+        # Invariant: a blocked plan carries zero ops (see `plan_merge`).
+        cs.reference_edits.clear()
+        cs.renames.clear()
     return cs

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "panorama-super-cli"
-version = "0.2.1"
+version = "0.2.2"
 description = "Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely."
 readme = "README.md"
 requires-python = ">=3.12"

panorama_super_cli-0.2.2/tests/test_changeset.py

@@ -0,0 +1,172 @@
+"""Tests for the shared unmappable-reference gate (issue #28).
+
+The gate is the single source of truth for "can both appliers express this
+reference edit as a flat member rewrite?" When the answer is no *and* the same
+plan tears the target down (delete/rename), the silently-skipped repoint would
+leave a dangling reference — so it must become a hard blocker, not a warning.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from psc.core.apply_live import plan_xapi_ops
+from psc.core.apply_xml import apply_changeset
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectDelete,
+    ObjectKind,
+    ObjectRename,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+    reference_edit_is_mappable,
+)
+from psc.core.models import Snapshot
+from psc.core.naming import plan_rename
+from psc.core.refs import ReferenceGraph
+from psc.output.errors import ErrorType, PscError
+
+
+def _edit(**kw: object) -> ReferenceEdit:
+    base: dict[str, object] = {
+        "referrer_kind": "address-group",
+        "referrer_name": "g",
+        "referrer_location": "shared",
+        "field": "static",
+    }
+    base.update(kw)
+    return ReferenceEdit(**base)  # type: ignore[arg-type]
+
+
+def test_flat_member_fields_are_mappable() -> None:
+    assert reference_edit_is_mappable(_edit(referrer_kind="address-group", field="static"))
+    assert reference_edit_is_mappable(_edit(referrer_kind="service-group", field="members"))
+
+
+def test_rule_field_is_mappable_only_with_rulebase() -> None:
+    assert reference_edit_is_mappable(
+        _edit(referrer_kind="security-rule", field="destination", rulebase="pre")
+    )
+    assert reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source", rulebase="pre")
+    )
+    # trigger 2: a rule edit with no rulebase can't be addressed by either applier
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="security-rule", field="destination", rulebase=None)
+    )
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source", rulebase=None)
+    )
+
+
+def test_nat_translation_and_nonmember_fields_are_unmappable() -> None:
+    # trigger 1: NAT translation fields are nested, not flat member lists
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source-translation", rulebase="pre")
+    )
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="destination-translation", rulebase="pre")
+    )
+    # a nat-rule `service` is a scalar, not a member list either
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="service", rulebase="pre")
+    )
+
+
+def test_gate_blocks_unmappable_edit_when_plan_deletes_target() -> None:
+    cs = ChangeSet(
+        title="merge",
+        reference_edits=[
+            _edit(
+                referrer_kind="nat-rule",
+                referrer_name="nat-web",
+                referrer_location="shared",
+                field="source-translation",
+                rulebase="pre",
+            )
+        ],
+        deletes=[ObjectDelete(kind=ObjectKind.ADDRESS, name="net-10", location="shared")],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert cs.is_blocked
+    blocker = " ".join(cs.blockers)
+    assert "net-10" in blocker  # names the torn-down object
+    assert "nat-web" in blocker  # names the unmappable referrer
+    assert "source-translation" in blocker
+
+
+def test_gate_blocks_unmappable_edit_when_plan_renames_target() -> None:
+    cs = ChangeSet(
+        title="rename",
+        reference_edits=[
+            _edit(
+                referrer_kind="security-rule",
+                referrer_name="r1",
+                referrer_location="shared",
+                field="destination",
+                rulebase=None,
+            )
+        ],
+        renames=[
+            ObjectRename(
+                kind=ObjectKind.ADDRESS, location="shared", old_name="net-10", new_name="N-10"
+            )
+        ],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert cs.is_blocked
+    assert any("net-10" in b and "r1" in b for b in cs.blockers)
+
+
+def test_gate_warns_but_passes_when_no_teardown() -> None:
+    cs = ChangeSet(
+        title="advisory",
+        reference_edits=[
+            _edit(
+                referrer_kind="nat-rule",
+                referrer_name="nat-web",
+                referrer_location="shared",
+                field="source-translation",
+                rulebase="pre",
+            )
+        ],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert not cs.is_blocked
+    assert any("nat-web" in w for w in cs.warnings)
+
+
+def test_gate_noop_when_all_edits_mappable() -> None:
+    cs = ChangeSet(
+        title="clean",
+        reference_edits=[_edit(referrer_kind="address-group", field="static")],
+        deletes=[ObjectDelete(kind=ObjectKind.ADDRESS, name="a", location="shared")],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert not cs.is_blocked
+    assert not cs.warnings
+
+
+def test_engine_blocked_plan_refused_on_both_paths(snapshot: Snapshot, fixture_path: Path) -> None:
+    """The gate-produced blocker is honored identically offline and live: both
+    appliers refuse with CONFLICT (exit 6) before mutating anything (#28)."""
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_rename(
+        snapshot,
+        graph,
+        kind=ObjectKind.ADDRESS,
+        location_name="shared",
+        old_name="net-10",
+        new_name="N-10.0.0.0_24",
+    )
+    assert cs.is_blocked
+
+    with pytest.raises(PscError) as offline:
+        apply_changeset(fixture_path.read_text(), cs)
+    assert offline.value.error_type is ErrorType.CONFLICT
+
+    with pytest.raises(PscError) as live:
+        plan_xapi_ops(cs)
+    assert live.value.error_type is ErrorType.CONFLICT

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/tests/test_cli.py

@@ -1,11 +1,17 @@
 from __future__ import annotations
 
+import builtins
 import json
 import os
 import subprocess
 import sys
 from pathlib import Path
 
+import click
+import pytest
+
+from psc.cli import app
+
 FIXTURE = Path(__file__).parent / "fixtures" / "panorama-config.xml"
 
 
@@ -120,3 +126,47 @@ def test_no_source_errors_config() -> None:
     cp = run("-o", "json", "find", "ip", "10.0.0.10")
     assert cp.returncode == 9
     assert json.loads(cp.stdout)["type"] == "config"
+
+
+def test_no_args_prints_help_without_traceback() -> None:
+    # Typer's no_args_is_help raises a *vendored* click NoArgsIsHelpError that
+    # the main() wrapper (standalone_mode=False) must swallow cleanly (#31).
+    cp = run()
+    combined = cp.stdout + cp.stderr
+    assert cp.returncode == 0
+    assert "Usage:" in combined
+    assert "Traceback" not in combined
+    assert "NoArgsIsHelpError" not in combined
+
+
+def test_unknown_command_usage_error_exit_2() -> None:
+    cp = run("no-such-command")
+    combined = cp.stdout + cp.stderr
+    assert cp.returncode == 2
+    assert "Traceback" not in combined
+    assert "No such command" in combined
+
+
+def test_click_exception_module_resolves_with_required_attrs() -> None:
+    # main() reads ClickException/Exit/Abort off the resolved module, so it must
+    # expose them whichever Typer flavour is installed.
+    mod = app._click_exception_module()
+    for attr in ("ClickException", "Exit", "Abort"):
+        assert hasattr(mod, attr)
+
+
+def test_click_exception_module_falls_back_when_typer_unvendored(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Older Typer (<0.16) has no `typer._click`; a top-level import of it would
+    # crash psc at import time — worse than #31. Resolution must degrade to the
+    # real Click instead of raising.
+    real_import = builtins.__import__
+
+    def fake_import(name: str, *args: object, **kwargs: object) -> object:
+        if name.startswith("typer._click"):
+            raise ImportError("simulated Typer without vendored Click")
+        return real_import(name, *args, **kwargs)  # type: ignore[arg-type]
+
+    monkeypatch.setattr(builtins, "__import__", fake_import)
+    assert app._click_exception_module() is click.exceptions

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/tests/test_dedup.py

@@ -72,3 +72,22 @@ def test_merge_missing_object_blocks(snapshot: Snapshot) -> None:
         drop=ObjectRef(name="web-primary", location="shared"),
     )
     assert cs.is_blocked
+
+
+def test_merge_blocks_when_repoint_hits_nat_translation(snapshot: Snapshot) -> None:
+    """net-10 is referenced by nat-web's source-translation, which has no flat
+    member list — repointing it away can't be expressed offline or live, so a
+    merge that would delete net-10 must be blocked, not silently skipped (#28).
+    """
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_merge(
+        snapshot,
+        graph,
+        keep=ObjectRef(name="h-web1", location="shared"),
+        drop=ObjectRef(name="net-10", location="shared"),
+        allow_value_change=True,
+    )
+    assert cs.is_blocked
+    assert any("net-10" in b and "nat-web" in b for b in cs.blockers)
+    # a blocked plan carries zero executable ops
+    assert cs.op_count == 0

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/tests/test_naming.py

@@ -64,6 +64,25 @@ def test_rename_blocks_on_existing_name(snapshot: Snapshot) -> None:
     assert cs.is_blocked
 
 
+def test_rename_blocks_when_repoint_hits_nat_translation(snapshot: Snapshot) -> None:
+    """net-10 is referenced by nat-web's source-translation (a nested field with
+    no flat member list). The rename can repoint the security-rule destination
+    but not the translation field — so applying it would delete the old name out
+    from under a dangling reference. Block it (#28)."""
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_rename(
+        snapshot,
+        graph,
+        kind=ObjectKind.ADDRESS,
+        location_name="shared",
+        old_name="net-10",
+        new_name="N-10.0.0.0_24",
+    )
+    assert cs.is_blocked
+    assert any("net-10" in b and "nat-web" in b for b in cs.blockers)
+    assert cs.op_count == 0
+
+
 def test_rename_blocks_shared_dg_shadow() -> None:
     # Renaming a shared object to a name a DG already defines is refused.
     snap = Snapshot(

{panorama_super_cli-0.2.1 → panorama_super_cli-0.2.2}/uv.lock

@@ -694,7 +694,7 @@ wheels = [
 
 [[package]]
 name = "panorama-super-cli"
-version = "0.2.1"
+version = "0.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "click" },