panorama-super-cli 0.2.2__tar.gz → 0.2.4__tar.gz

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/CHANGELOG.md

@@ -7,6 +7,33 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.2.4 — 2026-06-04
+
+### Changed
+
+- **`psc dedup addresses` is now strict by default** (#38). Addresses are
+  grouped only when their values are byte-identical, so a host accidentally
+  written with a subnet mask (`10.1.1.50/24`) is no longer reported as a
+  duplicate of the network `10.1.1.0/24` — merging those would have silently
+  changed rule matching. Genuinely identical forms (`10.0.0.10` and
+  `10.0.0.10/32`) still group. Pass `--not-strict` for the previous
+  host-bit-masking behaviour. The `dedup merge` safety gate now compares exact
+  values too, so such a merge is blocked unless `--allow-value-change` is given.
+
+## v0.2.3 — 2026-06-04
+
+### Added
+
+- **`-of` / `--output-format xml|set` for the offline `--apply --out` artifact.**
+  Mutating commands (`dedup merge`, `name rename`, `name apply`) can now write the
+  rewritten config file as the equivalent PAN-OS `set` script instead of XML.
+  `xml` (the rewritten, `load config`-able config) stays the default, so existing
+  invocations are unchanged; `set` writes the creates/deletes/repoints that
+  achieve the same change, which is easier to read and to paste into a config
+  session or `load config partial`. This is distinct from `-o set`, which renders
+  the dry-run plan to stdout. The blocker hard-gate and repoint-before-delete
+  ordering apply to both formats; a blocked plan writes no file. (#37)
+
 ## v0.2.2 — 2026-06-04
 
 ### Fixed

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.2.2
+Version: 0.2.4
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/docs/guides/duplicates-and-merging.md

@@ -12,6 +12,27 @@ Objects are grouped by **value**, not name. `h-web1`, `web-primary`, and
 `svc-https` (both TCP/443) in another. Each row tells you the value and every
 object name + location that defines it.
 
+### Strict by default
+
+Address matching is **strict**: only byte-identical values are duplicates. A
+host accidentally written with a subnet mask — `web-server = 10.1.1.50/24` —
+is **not** reported as a duplicate of the network `internal = 10.1.1.0/24`,
+even though both mask down to the same `/24`. (`10.0.0.10` and `10.0.0.10/32`
+*are* still the same host, so they group.)
+
+Pass `--not-strict` for the looser, fringe behaviour that masks host bits and
+collapses a host-with-mask onto its network:
+
+```console
+psc -c panorama.xml dedup addresses --not-strict
+```
+
+`--not-strict` only widens what's *listed* — it grants no merge power. A pair it
+surfaces (e.g. a host and its network) has different exact values, so
+[`dedup merge`](#the-safety-gate) still refuses it unless you pass
+`--allow-value-change`. Treat `--not-strict` as a discovery aid, then decide
+case by case whether the masked-equal objects really should be merged.
+
 ## Merge two objects
 
 `dedup merge` collapses one object (`--remove`) into another (`--keep`),

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/docs/guides/output-formats.md

@@ -50,6 +50,25 @@ Member-list edits become `delete` + `set` because PAN-OS `set` on a member field
 can't safely render (NAT translation paths) appear as `# REVIEW` comments; the
 structured (`json`) plan still carries them.
 
+### `-o set` (stdout) vs `--output-format set` (the `--out` file)
+
+These are two different knobs and it's worth keeping them straight:
+
+- **`-o set`** controls what a command prints to **stdout** — use it to read or
+  pipe the plan during a dry-run.
+- **`-of` / `--output-format`** (offline mutating commands only) controls the
+  format of the **`--apply --out` file artifact**: `xml` (default) rewrites the
+  whole config to load with `load config`, while `set` writes the same PAN-OS
+  `set` script shown above to that file — easier to read and to paste into a
+  config session or `load config partial`.
+
+```console
+psc -c panorama.xml dedup merge --keep h-web1 --remove web-primary --apply --out plan.set -of set
+```
+
+`-of` only shapes the file and is ignored without `--apply`; on a live profile
+there is no file artifact, so it has no effect there.
+
 ## Errors
 
 Errors are emitted as a stable JSON envelope:

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/docs/guides/safety.md

@@ -46,6 +46,16 @@ psc -c panorama.xml dedup merge --keep a --remove b --apply --out fixed.xml
 diff <(xmllint --format panorama.xml) <(xmllint --format fixed.xml)
 ```
 
+By default the `--out` file is the rewritten config XML. Pass
+`-of/--output-format set` to instead write the equivalent PAN-OS `set` script
+(the creates/deletes/repoints that achieve the same change) — easier to read and
+to paste into a config session. The blocker gate and repoint-before-delete
+ordering apply to both formats identically; a blocked plan writes no file.
+
+```console
+psc -c panorama.xml dedup merge --keep a --remove b --apply --out plan.set -of set
+```
+
 ## Live writes
 
 Live `--apply` pushes the plan to Panorama's **candidate** config over the XML

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/docs/reference/cli.md

@@ -17,9 +17,11 @@ These are **context** options — pass them *before* the subcommand:
 | `--debug` | Verbose structured logs on stderr. |
 | `--version` | Print version and exit. |
 
-Write-execution options (`--apply`, `--out`) belong to the individual mutating
-commands and are passed *after* the command. `--apply` is the only path to a
-write; offline it requires `--out PATH` (a new file), while live it pushes to
+Write-execution options (`--apply`, `--out`, `-of/--output-format`) belong to
+the individual mutating commands and are passed *after* the command. `--apply`
+is the only path to a write; offline it requires `--out PATH` (a new file) and
+`-of xml|set` chooses what that file holds (default `xml`), while live it pushes
+to
 Panorama's candidate config and never commits. See
 [Writes and safety](../guides/safety.md).
 
@@ -38,11 +40,11 @@ object by exact name. See [Finding objects](../guides/finding-objects.md).
 ### dedup
 
 ```
-psc dedup addresses
+psc dedup addresses [--not-strict]
 psc dedup services
 psc dedup merge --keep NAME --remove NAME [--location LOC]
                [--keep-location LOC] [--remove-location LOC]
-               [--allow-value-change] [--apply] [--out PATH]
+               [--allow-value-change] [--apply] [--out PATH] [-of xml|set]
 ```
 
 Find duplicates; merge one object into another, repointing all references. See
@@ -63,8 +65,8 @@ Where-used, recursive unused, and dangling-reference audit. See
 
 ```
 psc name lint [--all]
-psc name rename --object OLD --to NEW [--kind KIND] [--location LOC] [--apply] [--out PATH]
-psc name apply  --object NAME            [--location LOC] [--apply] [--out PATH]
+psc name rename --object OLD --to NEW [--kind KIND] [--location LOC] [--apply] [--out PATH] [-of xml|set]
+psc name apply  --object NAME            [--location LOC] [--apply] [--out PATH] [-of xml|set]
 ```
 
 Opt-in naming-template lint and reference-aware rename. See

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/cli/_plan.py

@@ -7,14 +7,39 @@ refused, dry-run is the default, and `--apply` is the only path to a write.
 
 from __future__ import annotations
 
+import typer
+
 from psc.cli.runtime import Runtime
 from psc.core.changeset import ChangeSet
 from psc.core.setcmd import render_changeset
+from psc.core.source import ConfigFormat
 from psc.output.errors import ErrorType, PscError
 from psc.output.format import OutputFormat, render
 
+# Shared across every mutating command so the `--out` artifact toggle reads and
+# behaves identically wherever `complete()` is used (dedup merge, name rename,
+# name apply). Default `xml` keeps existing scripts byte-for-byte compatible.
+OUT_FORMAT_OPTION = typer.Option(
+    ConfigFormat.XML,
+    "--output-format",
+    "-of",
+    help=(
+        "Format of the offline --out artifact. 'xml' (default) rewrites the whole "
+        "config to load with `load config`; 'set' writes the equivalent PAN-OS set "
+        "script (the creates/deletes/repoints) — easier to read and to paste into a "
+        "config session. Only affects --out; ignored without --apply."
+    ),
+)
+
 
-def complete(rt: Runtime, cs: ChangeSet, *, apply: bool, out_path: str | None) -> None:
+def complete(
+    rt: Runtime,
+    cs: ChangeSet,
+    *,
+    apply: bool,
+    out_path: str | None,
+    out_format: ConfigFormat = ConfigFormat.XML,
+) -> None:
     """Render `cs` in the chosen format, then apply it iff `apply`.
 
     A blocked plan raises `CONFLICT` (exit 6) before any write. The structured
@@ -43,7 +68,7 @@ def complete(rt: Runtime, cs: ChangeSet, *, apply: bool, out_path: str | None) -
         return
 
     if apply:
-        result = rt.source().apply(cs, out_path=out_path)
+        result = rt.source().apply(cs, out_path=out_path, out_format=out_format)
         rt.stderr.print(
             f"[green]applied[/green] {result.ops} operation(s)"
             + (f" → {result.out_path}" if result.out_path else "")

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/cli/dedup_cmds.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import typer
 
-from psc.cli._plan import complete
+from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core.dedup import (
     DuplicateGroup,
@@ -14,6 +14,7 @@ from psc.core.dedup import (
     plan_merge,
 )
 from psc.core.refs import ReferenceGraph
+from psc.core.source import ConfigFormat
 from psc.output.errors import ErrorType, PscError
 from psc.output.format import render
 
@@ -29,10 +30,23 @@ def _dup_rows(groups: list[DuplicateGroup]) -> list[dict[str, object]]:
 
 
 @app.command("addresses")
-def addresses(ctx: typer.Context) -> None:
-    """List address objects that share an identical value under different names."""
+def addresses(
+    ctx: typer.Context,
+    not_strict: bool = typer.Option(
+        False,
+        "--not-strict",
+        help="Also group host objects onto their network (mask host bits). "
+        "Default: only byte-identical values are duplicates.",
+    ),
+) -> None:
+    """List address objects that share an identical value under different names.
+
+    By default this is *strict*: a host written with a subnet mask
+    (`10.1.1.50/24`) is not treated as a duplicate of the network `10.1.1.0/24`.
+    Pass `--not-strict` for the looser, host-bit-masking behaviour.
+    """
     rt: Runtime = ctx.obj
-    groups = find_duplicate_addresses(rt.snapshot())
+    groups = find_duplicate_addresses(rt.snapshot(), strict=not not_strict)
     if rt.strict and not groups:
         raise PscError("no duplicate addresses", ErrorType.NOT_FOUND)
     render(
@@ -71,8 +85,9 @@ def merge(
     ),
     apply: bool = typer.Option(False, "--apply", help="Execute the merge (default: dry-run)."),
     out: str | None = typer.Option(
-        None, "--out", help="Offline: write the rewritten config XML here."
+        None, "--out", help="Offline: write the rewritten config here (see --output-format)."
     ),
+    output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Collapse one address object into another, repointing every reference.
 
@@ -91,4 +106,4 @@ def merge(
         drop=ObjectRef(name=remove, location=remove_location or default_loc),
         allow_value_change=allow_value_change,
     )
-    complete(rt, cs, apply=apply, out_path=out)
+    complete(rt, cs, apply=apply, out_path=out, out_format=output_format)

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/cli/name_cmds.py

@@ -4,12 +4,13 @@ from __future__ import annotations
 
 import typer
 
-from psc.cli._plan import complete
+from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core.changeset import ObjectKind
 from psc.core.naming import lint as lint_engine
 from psc.core.naming import plan_rename
 from psc.core.refs import ReferenceGraph
+from psc.core.source import ConfigFormat
 from psc.output.errors import ErrorType, PscError
 from psc.output.format import render
 
@@ -49,7 +50,10 @@ def rename(
     kind: ObjectKind = typer.Option(ObjectKind.ADDRESS, "--kind"),
     location: str | None = typer.Option(None, "--location"),
     apply: bool = typer.Option(False, "--apply", help="Execute the rename (default: dry-run)."),
-    out: str | None = typer.Option(None, "--out", help="Offline: write rewritten config XML here."),
+    out: str | None = typer.Option(
+        None, "--out", help="Offline: write rewritten config here (see --output-format)."
+    ),
+    output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Rename one object, repointing every reference (refuses on shadow collisions)."""
     rt: Runtime = ctx.obj
@@ -57,7 +61,7 @@ def rename(
     snap = rt.snapshot()
     graph = ReferenceGraph.build(snap)
     cs = plan_rename(snap, graph, kind=kind, location_name=loc, old_name=object_name, new_name=to)
-    complete(rt, cs, apply=apply, out_path=out)
+    complete(rt, cs, apply=apply, out_path=out, out_format=output_format)
 
 
 @app.command("apply")
@@ -66,7 +70,10 @@ def apply_scheme(
     object_name: str = typer.Option(..., "--object", help="Object to rename to its scheme name."),
     location: str | None = typer.Option(None, "--location"),
     apply: bool = typer.Option(False, "--apply", help="Execute the rename (default: dry-run)."),
-    out: str | None = typer.Option(None, "--out", help="Offline: write rewritten config XML here."),
+    out: str | None = typer.Option(
+        None, "--out", help="Offline: write rewritten config here (see --output-format)."
+    ),
+    output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Rename one object to the name the configured scheme implies for its value."""
     rt: Runtime = ctx.obj
@@ -98,4 +105,4 @@ def apply_scheme(
     cs = plan_rename(
         snap, graph, kind=kind, location_name=loc, old_name=object_name, new_name=suggested
     )
-    complete(rt, cs, apply=apply, out_path=out)
+    complete(rt, cs, apply=apply, out_path=out, out_format=output_format)

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/core/dedup.py

@@ -45,21 +45,30 @@ class DuplicateGroup(BaseModel):
         return len(self.members)
 
 
-def find_duplicate_addresses(snapshot: Snapshot) -> list[DuplicateGroup]:
-    """Address objects sharing an identical normalized value, 2+ per bucket."""
+def find_duplicate_addresses(snapshot: Snapshot, *, strict: bool = True) -> list[DuplicateGroup]:
+    """Address objects sharing the same value, 2+ per bucket.
+
+    `strict` (default) groups only byte-identical values, so a host written with
+    a subnet mask (`10.1.1.50/24`) is *not* a duplicate of its network
+    (`10.1.1.0/24`). `strict=False` groups by masked network — the looser,
+    fringe behaviour that collapses host-with-mask onto the network.
+    """
     buckets: dict[str, list[ObjectRef]] = {}
     display: dict[str, str] = {}
     for a in snapshot.addresses:
         nv = normalize_address(a)
         if nv is None:
             continue
-        key = nv.overlaps_key()
+        key = nv.exact_key() if strict else nv.overlaps_key()
         buckets.setdefault(key, []).append(ObjectRef(name=a.name, location=a.location.name))
-        display.setdefault(key, f"{a.type.value} {nv.key}")
+        label = (nv.exact or nv.key) if strict else nv.key
+        display.setdefault(key, f"{a.type.value} {label}")
     return _to_groups("address", buckets, display)
 
 
 def find_duplicate_services(snapshot: Snapshot) -> list[DuplicateGroup]:
+    # Service dedup is already exact (protocol + normalized port lists); there
+    # is no host-bit-masking analogue, so no strict/loose distinction applies.
     buckets: dict[str, list[ObjectRef]] = {}
     display: dict[str, str] = {}
     for s in snapshot.services:
@@ -93,10 +102,13 @@ def _rewrite_members(before: list[str], drop: str, keep: str) -> list[str]:
 
 
 def _addr_value_key(snapshot: Snapshot, ref: ObjectRef) -> str | None:
+    # Exact (host-bit-preserving) key: the merge gate must treat a /24-masked
+    # host and the /24 network as *different* values, so it blocks the merge
+    # unless --allow-value-change is passed.
     for a in snapshot.addresses:
         if a.name == ref.name and a.location == ref.loc:
             nv = normalize_address(a)
-            return nv.overlaps_key() if nv else None
+            return nv.exact_key() if nv else None
     return None
 
 

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/core/normalize.py

@@ -41,11 +41,20 @@ class AddrValue:
     range: tuple[int, int] | None = None
     family: int | None = None
     fqdn: str | None = None
+    exact: str | None = None
+    """Host-bit-preserving canonical string for ip-netmask (e.g. `10.1.1.50/24`
+    stays distinct from `10.1.1.0/24`); `None` means `key` is already exact."""
 
     def overlaps_key(self) -> str:
-        """Kind-qualified key for grouping exact duplicates."""
+        """Kind-qualified key grouping by *masked network* — loose: a host
+        written with a subnet mask collapses onto its network."""
         return f"{self.kind.value}:{self.key}"
 
+    def exact_key(self) -> str:
+        """Kind-qualified key grouping only *byte-identical* values — strict:
+        host bits are preserved, so `10.1.1.50/24` != `10.1.1.0/24`."""
+        return f"{self.kind.value}:{self.exact or self.key}"
+
 
 def _as_network(value: str) -> IPNetwork | None:
     try:
@@ -54,6 +63,16 @@ def _as_network(value: str) -> IPNetwork | None:
         return None
 
 
+def _as_interface(value: str) -> ipaddress.IPv4Interface | ipaddress.IPv6Interface | None:
+    """Parse host-preserving: `10.1.1.50/24` keeps its host bits, `10.0.0.10`
+    becomes `10.0.0.10/32`. `.network` is the masked form (equals
+    `_as_network`), `str(...)` is the exact form. `None` if unparseable."""
+    try:
+        return ipaddress.ip_interface(value.strip())
+    except ValueError:
+        return None
+
+
 def _range_bounds(value: str) -> tuple[int, int, int] | None:
     """`a-b` -> (start_int, end_int, family); None if unparseable."""
     if "-" not in value:
@@ -75,10 +94,19 @@ def normalize_address(addr: Address) -> AddrValue | None:
     """
     v = addr.value.strip()
     if addr.type is AddressType.IP_NETMASK:
-        net = _as_network(v)
-        if net is None:
+        # One parse yields both keys: `.network` is the masked grouping key
+        # (loose), `str(iface)` preserves host bits for the exact key (strict).
+        iface = _as_interface(v)
+        if iface is None:
             return None
-        return AddrValue(kind=addr.type, key=str(net), network=net, family=net.version)
+        net = iface.network
+        return AddrValue(
+            kind=addr.type,
+            key=str(net),
+            network=net,
+            family=net.version,
+            exact=str(iface),
+        )
     if addr.type is AddressType.IP_RANGE:
         bounds = _range_bounds(v)
         if bounds is None:

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/psc/core/source.py

@@ -18,6 +18,7 @@ Writes are deliberately conservative:
 from __future__ import annotations
 
 import ssl
+from enum import Enum
 from pathlib import Path
 
 from pydantic import BaseModel, Field
@@ -26,9 +27,23 @@ from psc.core.apply_xml import apply_changeset
 from psc.core.changeset import ChangeSet
 from psc.core.models import Snapshot
 from psc.core.parse import parse_config
+from psc.core.setcmd import render_changeset
 from psc.output.errors import ErrorType, PscError
 
 
+class ConfigFormat(str, Enum):
+    """Format of the artifact an offline `apply` writes to `--out`.
+
+    `xml` rewrites the whole exported config (loadable with `load config`);
+    `set` emits the equivalent PAN-OS `set` script (the creations/deletes/
+    repoints that achieve the same change) — easier to read and to paste into a
+    config session or `load config partial`.
+    """
+
+    XML = "xml"
+    SET = "set"
+
+
 class ApplyResult(BaseModel):
     applied: bool
     ops: int
@@ -83,7 +98,13 @@ class OfflineSource:
         except Exception as exc:
             raise PscError(f"failed to parse {self.path}: {exc}", ErrorType.INPUT) from exc
 
-    def apply(self, cs: ChangeSet, *, out_path: str | Path | None) -> ApplyResult:
+    def apply(
+        self,
+        cs: ChangeSet,
+        *,
+        out_path: str | Path | None,
+        out_format: ConfigFormat = ConfigFormat.XML,
+    ) -> ApplyResult:
         if out_path is None:
             raise PscError(
                 "offline apply needs --out PATH (the rewritten config is never "
@@ -93,6 +114,20 @@ class OfflineSource:
         out = Path(out_path)
         if out.resolve() == self.path.resolve():
             raise PscError("--out must differ from the source config path", ErrorType.CONFIG)
+        # The blocker gate is enforced here for *every* format — the XML path
+        # relies on `apply_changeset`, but the set path renders the plan without
+        # it, so refuse before writing rather than emit a `# BLOCKED` file.
+        if cs.is_blocked:
+            raise PscError(
+                "refusing to apply a blocked plan",
+                ErrorType.CONFLICT,
+                details={"blockers": cs.blockers},
+            )
+        # Both artifacts share the same safety guards above; only the bytes differ.
+        if out_format is ConfigFormat.SET:
+            script = render_changeset(cs)
+            out.write_text("\n".join(script) + "\n", encoding="utf-8")
+            return ApplyResult(applied=True, ops=cs.op_count, out_path=str(out), set_script=script)
         new_xml = apply_changeset(self._xml, cs)
         out.write_text(new_xml, encoding="utf-8")
         return ApplyResult(applied=True, ops=cs.op_count, out_path=str(out))
@@ -221,9 +256,19 @@ class LiveSource:
     def snapshot(self) -> Snapshot:
         return parse_config(self.raw_xml())
 
-    def apply(self, cs: ChangeSet, *, out_path: str | Path | None) -> ApplyResult:
+    def apply(
+        self,
+        cs: ChangeSet,
+        *,
+        out_path: str | Path | None,
+        out_format: ConfigFormat = ConfigFormat.XML,
+    ) -> ApplyResult:
         """Push `cs` to Panorama's candidate config over the XML API.
 
+        `out_path`/`out_format` are accepted for interface parity with the
+        offline source but ignored — a live apply leaves a candidate on the
+        device, not a file, so there is no artifact to format.
+
         The plan is lowered to xpath set/edit/delete/rename ops and replayed in
         order (repoint before delete). The `blockers` gate and name-addressing
         check run *before* any device contact, so a refused plan never writes.

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "panorama-super-cli"
-version = "0.2.2"
+version = "0.2.4"
 description = "Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely."
 readme = "README.md"
 requires-python = ">=3.12"

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/skills/panorama-super-cli/SKILL.md

@@ -29,7 +29,8 @@ psc [GLOBAL OPTS] <group> <command> [ARGS] [WRITE OPTS]
 - **Global (context) options go *before* the group:** `-c/--config FILE`,
   `-p/--profile NAME`, `-o/--output FMT`, `-d/--device-group NAME`, `--strict`,
   `--debug`.
-- **Write-execution options go *after* the command:** `--apply`, `--out PATH`.
+- **Write-execution options go *after* the command:** `--apply`, `--out PATH`,
+  `-of/--output-format xml|set`.
 
 ```bash
 psc -c panorama.xml -o json find ip 10.0.0.10
@@ -39,7 +40,20 @@ psc -c panorama.xml dedup merge --keep h-web1 --remove web-primary --apply --out
 ## Pick a source
 
 - **Offline:** `-c panorama.xml` — an exported config. Read-only against the
-  device; `--apply` writes a *new* file via `--out`.
+  device; `--apply` writes a *new* file via `--out` (it never overwrites the
+  source export). Choose what that file holds with `-of/--output-format`:
+  - `xml` (default) — the whole config rewritten, loadable with `load config`.
+  - `set` — just the equivalent PAN-OS `set` script (the creates/deletes/
+    repoints that achieve the change). Easier to read and to paste into a
+    config session or `load config partial`. Use this when a human reviews the
+    change or you want a minimal, diff-like artifact; use `xml` when you need a
+    full, directly-loadable replacement config.
+
+  ```bash
+  psc -c cfg.xml dedup merge --keep a --remove b --apply --out plan.set -of set
+  ```
+  (`-of` only shapes the `--out` file; for the script on stdout in a dry-run,
+  use `-o set` instead.)
 - **Live:** `-p prod` — fetches the running config over the XML API. `--apply`
   (no `--out`) pushes the plan to Panorama's **candidate** config and never
   commits; you review and commit yourself.
@@ -64,7 +78,8 @@ like `10.0.0.0/8` would otherwise drown out the host you asked for.
 ### dedup — duplicates and merging
 
 ```bash
-psc -c cfg.xml -o json dedup addresses            # same value, different names
+psc -c cfg.xml -o json dedup addresses            # strict: byte-identical values only
+psc -c cfg.xml -o json dedup addresses --not-strict  # also mask host bits (10.1.1.50/24 ~ 10.1.1.0/24)
 psc -c cfg.xml -o json dedup services
 psc -c cfg.xml -o json dedup merge --keep h-web1 --remove web-primary   # dry-run plan
 psc -c cfg.xml dedup merge --keep h-web1 --remove web-primary --apply --out fixed.xml

{panorama_super_cli-0.2.2 → panorama_super_cli-0.2.4}/tests/test_cli.py

@@ -64,6 +64,36 @@ def test_strict_not_found_exit_5() -> None:
     assert json.loads(cp.stdout)["type"] == "not_found"
 
 
+_HOST_AND_NET_CONFIG = """<?xml version="1.0"?>
+<config version="11.0.0">
+  <shared>
+    <address>
+      <entry name="host-with-mask"><ip-netmask>10.1.1.50/24</ip-netmask></entry>
+      <entry name="real-network"><ip-netmask>10.1.1.0/24</ip-netmask></entry>
+    </address>
+  </shared>
+</config>
+"""
+
+
+def test_dedup_addresses_strict_default_finds_no_duplicates(tmp_path: Path) -> None:
+    cfg = tmp_path / "cfg.xml"
+    cfg.write_text(_HOST_AND_NET_CONFIG)
+    cp = run("-c", str(cfg), "-o", "json", "dedup", "addresses")
+    assert cp.returncode == 0
+    assert json.loads(cp.stdout) == []
+
+
+def test_dedup_addresses_not_strict_groups_host_with_network(tmp_path: Path) -> None:
+    cfg = tmp_path / "cfg.xml"
+    cfg.write_text(_HOST_AND_NET_CONFIG)
+    cp = run("-c", str(cfg), "-o", "json", "dedup", "addresses", "--not-strict")
+    assert cp.returncode == 0
+    groups = json.loads(cp.stdout)
+    assert len(groups) == 1
+    assert {m["name"] for m in groups[0]["members"]} == {"host-with-mask", "real-network"}
+
+
 def test_merge_dry_run_exit_0_writes_nothing(tmp_path: Path) -> None:
     out = tmp_path / "x.xml"
     cp = run(
@@ -122,6 +152,51 @@ def test_merge_apply_writes_out(tmp_path: Path) -> None:
     assert "web-primary" not in out.read_text(encoding="utf-8")
 
 
+def test_merge_apply_out_set_writes_set_script(tmp_path: Path) -> None:
+    out = tmp_path / "fixed.set"
+    cp = run(
+        "-c",
+        str(FIXTURE),
+        "dedup",
+        "merge",
+        "--keep",
+        "h-web1",
+        "--remove",
+        "web-primary",
+        "--apply",
+        "--out",
+        str(out),
+        "-of",
+        "set",
+    )
+    assert cp.returncode == 0
+    assert out.exists()
+    text = out.read_text(encoding="utf-8")
+    assert "delete shared address web-primary" in text
+    assert "<entry" not in text  # the --out artifact is a set script, not XML
+
+
+def test_merge_apply_out_xml_is_default(tmp_path: Path) -> None:
+    out = tmp_path / "fixed.xml"
+    cp = run(
+        "-c",
+        str(FIXTURE),
+        "dedup",
+        "merge",
+        "--keep",
+        "h-web1",
+        "--remove",
+        "web-primary",
+        "--apply",
+        "--out",
+        str(out),
+        "--output-format",
+        "xml",
+    )
+    assert cp.returncode == 0
+    assert "web-primary" not in out.read_text(encoding="utf-8")  # rewritten XML, object gone
+
+
 def test_no_source_errors_config() -> None:
     cp = run("-o", "json", "find", "ip", "10.0.0.10")
     assert cp.returncode == 9