panorama-super-cli 0.2.6__tar.gz → 0.3.0__tar.gz

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/CHANGELOG.md

@@ -7,6 +7,30 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.3.0 — 2026-06-04
+
+### Added
+
+- **Where-used across every object-referencing rulebase** (#2). The reference
+  graph previously covered only `security` and `nat`; it now also scans PBF,
+  decryption, authentication, QoS, application-override, DoS, SD-WAN,
+  tunnel-inspect, and network-packet-broker. `refs used`/`unused`/`dangling`
+  and the merge/rename repointing all account for them, so an object referenced
+  only by, say, a QoS or PBF rule is no longer reported unused (and can no
+  longer be deleted out from under a live rule). A PBF forwarding next-hop that
+  names an address object is shown in where-used and **blocks** a merge/rename
+  that would strand it (it has no flat member list to rewrite — edit it by hand,
+  then re-run). The `referrer_kind` in the output (`qos-rule`, `pbf-rule`, …)
+  names the exact rulebase.
+
+### Fixed
+
+- **Tag rename/merge no longer wipes a rule's other tags** (#2). `field_members`
+  read the wrong attribute name for a rule's `tag` field, so renaming or merging
+  a tag referenced by a security rule rewrote the rule's tag list to an empty (or
+  single-entry) value, destroying its co-tags. All rule kinds now resolve the
+  field uniformly.
+
 ## v0.2.6 — 2026-06-04
 
 ### Added

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.2.6
+Version: 0.3.0
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/docs/getting-started/concepts.md

@@ -5,9 +5,11 @@ A small mental model goes a long way.
 ## Snapshot
 
 `psc` reads a config into an immutable **snapshot**: every address, address
-group, service, service group, tag, security rule, and NAT rule it understands,
-across `shared` and every device-group. Read commands query the snapshot; they
-never mutate it.
+group, service, service group, tag, and rule it understands — security, NAT,
+and the nine other rulebases that reference objects (PBF, decryption,
+authentication, QoS, application-override, DoS, SD-WAN, tunnel-inspect,
+network-packet-broker) — across `shared` and every device-group. Read commands
+query the snapshot; they never mutate it.
 
 ## Locations and inheritance
 
@@ -38,9 +40,11 @@ it. A change-set with **blockers** is unsafe and is refused — even with
 
 ## Reference graph
 
-The **reference graph** answers "who points at this object?" across groups,
-security rules, and NAT (match *and* translation fields). It powers where-used,
-unused detection, and the safe repointing that merge and rename rely on.
+The **reference graph** answers "who points at this object?" across groups and
+every object-referencing rulebase — security, NAT (match *and* translation
+fields), and PBF, decryption, authentication, QoS, application-override, DoS,
+SD-WAN, tunnel-inspect, and network-packet-broker. It powers where-used, unused
+detection, and the safe repointing that merge and rename rely on.
 
 ## Sources
 

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/docs/guides/duplicates-and-merging.md

@@ -58,7 +58,11 @@ Every reference the [reference graph](references-and-audit.md) knows about:
 
 - static address-group membership,
 - security rule `source` / `destination`,
-- NAT rule `source` / `destination` (translation fields are flagged for review).
+- NAT rule `source` / `destination` (translation fields are flagged for review),
+- every other rulebase's `source` / `destination` / `service` / `tag` (PBF,
+  decryption, authentication, QoS, application-override, DoS, SD-WAN,
+  tunnel-inspect, network-packet-broker). A PBF next-hop object has no flat
+  member list, so a merge that would strand it is **blocked** for manual review.
 
 References are rewritten **before** the object is deleted, and duplicate members
 are collapsed (a group that listed both names ends up with just the survivor).

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/docs/guides/references-and-audit.md

@@ -13,7 +13,10 @@ psc -c panorama.xml refs used h-web1
 ```
 
 Lists every reference that *resolves* to that object — group memberships,
-security rule `source`/`destination`, NAT `source`/`destination`/translation.
+security rule `source`/`destination`, NAT `source`/`destination`/translation,
+and the `source`/`destination`/`service`/`tag` fields of every other rulebase
+(PBF, decryption, authentication, QoS, application-override, DoS, SD-WAN,
+tunnel-inspect, network-packet-broker), plus a PBF forwarding next-hop object.
 
 If a name is ambiguous (exists in multiple kinds/locations), pass `--kind` and
 `--location`:
@@ -59,7 +62,10 @@ if `refs dangling` finds anything).
 psc -c panorama.xml --strict refs dangling || echo "config has dangling refs"
 ```
 
-!!! note "v0.2"
-    The reference graph currently covers address-groups, service-groups,
-    security rules, and NAT. Other rulebases (PBF, decryption, authentication,
-    QoS, …) are planned.
+!!! note "Rulebase coverage"
+    The reference graph covers address-groups, service-groups, and **every**
+    object-referencing rulebase: security, NAT, PBF, decryption, authentication,
+    QoS, application-override, DoS, SD-WAN, tunnel-inspect, and
+    network-packet-broker. A PBF forwarding next-hop that names an address
+    object is shown in where-used and blocks a merge/rename that would strand it
+    (it has no flat member list to rewrite — edit it by hand, then re-run).

panorama_super_cli-0.3.0/docs/superpowers/specs/2026-06-04-where-used-all-rulebases-design.md

@@ -0,0 +1,227 @@
+# where-used across ALL rulebases — design (issue #2)
+
+## Problem
+
+`psc`'s reference graph only scans two rulebases: `security` and `nat`. PAN-OS
+carries object references in **nine more** rulebases — PBF, decryption,
+authentication, QoS, application-override, DoS, SD-WAN, tunnel-inspect, and
+network-packet-broker. Until these are scanned:
+
+- **`unused` lies.** An address referenced *only* by a QoS or PBF rule is
+  reported as unused — and could then be deleted. `reachable_targets()` seeds
+  only from `security-rule`/`nat-rule` references, so every other rulebase is
+  invisible to reachability.
+- **`merge`/`rename`/`delete` are unsafe.** They repoint *known* references
+  before removing an object. A reference in an unscanned rulebase is silently
+  left dangling — the exact failure repoint-before-delete exists to prevent.
+- **`where-used` is incomplete** as a delete/rename pre-flight.
+
+Scope decisions (confirmed with the user):
+
+1. **All nine** object-referencing rulebases, not just the seven in the issue
+   (tunnel-inspect + network-packet-broker added — the registry makes them
+   nearly free, and omitting them leaves the same safety hole the issue exists
+   to close).
+2. **PBF nexthop** address-object references are modelled as a *review-gated*
+   reference: shown in `where-used`, but a hard **blocker** on merge/rename
+   (the appliers can't rewrite a nested single-value field), exactly like NAT
+   translation fields.
+3. **Additive** model: `SecurityRule`/`NatRule` are left untouched (zero
+   regression risk on the safety-critical paths). One new generic `PolicyRule`
+   + a tiny rulebase registry covers the nine new rulebases.
+4. **Reference surface** per rulebase: address objects in `source`/`destination`,
+   service objects in `service`, and rule `tag`s. Applications, zones, profiles,
+   URL categories, and schedules are out of scope (none are psc-managed object
+   kinds).
+
+## Key insight
+
+`referrer_kind` is always `"{rule_type}-rule"`, and the XML container tag, the
+`set` keyword, and the live xpath segment are all just `rule_type`:
+`security-rule → security`, `pbf-rule → pbf`, even `nat-rule → nat`. So a single
+helper — `rule_container(referrer_kind) -> str | None` — collapses the four
+hardcoded switch sites (`setcmd`, `apply_xml`, `apply_live`,
+`changeset.reference_edit_is_mappable`) into table-driven code. Adding the
+twelfth rulebase later becomes a one-line registry entry.
+
+## Architecture
+
+A new `psc/core/rulebases.py` is the single source of truth for *which*
+rulebases carry references and *which* of their fields are flat (repointable)
+vs nested (review-gated). Everything else consults it.
+
+```
+parse.py ──► PolicyRule (new model) ──► Snapshot.policy_rules
+                                              │
+refs.py._walk ──────────────────────────────►│  emits References (addr/svc/tag + pbf nexthop)
+refs.py._rule_seeded_targets ────────────────►│  seeds reachability from ALL rulebases  ← unused fix
+                                              │
+dedup.field_members ─────────────────────────►│  resolves current member list for any *-rule
+changeset.reference_edit_is_mappable ─────────►│  uses rule_container() + FLAT_RULE_FIELDS
+setcmd / apply_xml / apply_live ─────────────►│  build path from rule_container()
+```
+
+### New module: `psc/core/rulebases.py`
+
+```python
+# rule_type value == XML container tag == `set` keyword == xpath segment.
+POLICY_RULE_TYPES = (
+    "pbf", "decryption", "authentication", "qos", "application-override",
+    "dos", "sdwan", "tunnel-inspect", "network-packet-broker",
+)
+# Every referrer_kind that maps to a `{rb}-rulebase/{container}/rules` entry.
+_RULE_CONTAINERS = {"security", "nat", *POLICY_RULE_TYPES}
+# Flat <member> fields an applier can rewrite in place.
+FLAT_RULE_FIELDS = frozenset({"source", "destination", "service", "tag"})
+
+def rule_container(referrer_kind: str) -> str | None:
+    """'pbf-rule' -> 'pbf'; None if not a rulebase referrer (group/object)."""
+```
+
+`FLAT_RULE_FIELDS` deliberately excludes `application`/`source-user` (never
+emitted as object reference-edits) and PBF `nexthop` (nested → review-gated).
+NAT keeps its existing `field in ("source","destination")` narrowing in the
+appliers, since its translation fields are nested.
+
+### New model: `psc/core/models.py`
+
+```python
+class RuleType(str, Enum):
+    PBF = "pbf"; DECRYPTION = "decryption"; AUTHENTICATION = "authentication"
+    QOS = "qos"; APPLICATION_OVERRIDE = "application-override"; DOS = "dos"
+    SDWAN = "sdwan"; TUNNEL_INSPECT = "tunnel-inspect"
+    NETWORK_PACKET_BROKER = "network-packet-broker"
+
+class PolicyRule(BaseModel):
+    """Reference surface of a 'security-shaped' rulebase (no NAT translation).
+
+    One model for nine rulebases: they share source/destination (address),
+    an optional service list, rule tags, and — for PBF only — a forwarding
+    nexthop address object. Mirrors SecurityRule's 'only the reference surface'
+    philosophy; application/source-user are omitted because they name no
+    psc-managed object.
+    """
+    name: str
+    location: Location = SHARED
+    rulebase: Rulebase = Rulebase.PRE
+    rule_type: RuleType
+    source: list[str] = Field(default_factory=lambda: ["any"])
+    destination: list[str] = Field(default_factory=lambda: ["any"])
+    service: list[str] = Field(default_factory=list)   # empty for app-override
+    nexthop: str | None = None                          # PBF forwarding object
+    disabled: bool = False
+    tags: list[str] = Field(default_factory=list)
+
+    @property
+    def referrer_kind(self) -> str: return f"{self.rule_type.value}-rule"
+    @property
+    def key(self) -> tuple[str, str, str, str]:
+        return (self.location.name, self.rule_type.value, self.rulebase.value, self.name)
+```
+
+`Snapshot` gains `policy_rules: list[PolicyRule] = Field(default_factory=list)`.
+
+### Parsing: `psc/core/parse.py`
+
+`_collect` already loops `(pre-rulebase, post-rulebase)`. Add one call per
+rulebase tag:
+
+```python
+for rt in RuleType:                       # drives off the registry
+    snap.policy_rules.extend(_parse_policy_rules(rb_el, loc, rt))
+```
+
+`_parse_policy_rules` finds `./{rt.value}/rules/entry` and reads `source`,
+`destination`, `service`, `tag` with the existing `_members` helper (absent →
+empty, so app-override naturally has no service). For PBF it additionally reads
+`action/forward/nexthop/fqdn` (the object-capable nexthop variant; a literal
+`ip-address` nexthop is *not* an object and is ignored).
+
+### Reference walk: `psc/core/refs.py`
+
+- `_walk` gains one loop over `snap.policy_rules` emitting `source`/`destination`
+  (address), `service` (service), `tag` (tag), and — when `rule_type is PBF and
+  nexthop` — a `nexthop` (address) reference.
+- `_rule_seeded_targets`: replace the `referrer_kind in ("security-rule",
+  "nat-rule")` test with `rule_container(referrer_kind) is not None`. **This is
+  the `unused` safety fix** — reachability now seeds from every rulebase.
+- `dangling()`: exclude `field == "nexthop"` unresolved refs. A PBF nexthop is
+  often a literal FQDN/IP, not an object; flagging those as dangling would be
+  noise. (When it *does* resolve to an object, it appears in `where_used` and is
+  gated on merge/rename — the safety win is preserved.)
+
+### Repoint resolution: `psc/core/dedup.py::field_members`
+
+Add an `elif rule_container(ref.referrer_kind) ...` branch that looks the rule
+up in `snap.policy_rules` by `(rule_type, name, location, rulebase)` and returns
+`getattr(rule, field)`. The existing security/nat branches stay.
+
+### Safety gate + appliers (the four switch sites)
+
+All four now compute the container via `rule_container()`:
+
+- **`changeset.reference_edit_is_mappable`**: `address-group`/`service-group` →
+  True; else `container = rule_container(kind)`; None or no `rulebase` → False;
+  `nat` → `field in (source,destination)`; otherwise `field in FLAT_RULE_FIELDS`.
+  PBF `nexthop` (not in the set) → False → `gate_unmappable_reference_edits`
+  promotes it to a blocker when a delete/rename is present. **No new gating code
+  is needed — the existing gate already does the right thing** once
+  `reference_edit_is_mappable` returns False for nexthop.
+- **`apply_xml._referrer_field_element`**, **`apply_live._referrer_field_xpath`**,
+  **`setcmd._referrer_path`**: groups unchanged; rules build
+  `{rb}-rulebase/{container}/rules/entry/{field}` (XML / xpath) or
+  `{scope} {rb}-rulebase {container} rules {name} {field}` (set) from
+  `rule_container()`. NAT translation + PBF nexthop fall through to the existing
+  `None`/`# REVIEW` path.
+
+The security and NAT behaviours are byte-for-byte identical (container values
+`security`/`nat`), so the existing applier/setcmd/round-trip tests are the
+regression guard.
+
+### CLI / output
+
+No changes. `refs_cmds` passes `referrer_kind` through as a string, so the new
+kinds (`pbf-rule`, `qos-rule`, …) surface in `where-used`/`dangling` tables
+automatically with distinct, self-describing labels.
+
+## Testing (TDD — failing test first)
+
+New fixture `tests/fixtures/all-rulebases.xml`: one rule per new rulebase across
+`shared` + a device-group, pre and post, referencing shared and DG-local
+addresses/services/tags, plus a PBF rule whose nexthop names an address object.
+
+- **test_parse**: all nine rule_types parsed; fields correct; app-override has
+  empty service; PBF nexthop captured.
+- **test_refs**: `where_used` on an address used only by a QoS rule finds it;
+  `unused` does **not** report an address used only by a DoS/PBF/SD-WAN rule
+  (seeding fix); a bad service name in a decryption rule shows in `dangling`;
+  a PBF nexthop object shows in `where_used`; an unresolved nexthop does **not**
+  show in `dangling`.
+- **test_dedup**: merging an address referenced by SD-WAN + authentication rules
+  repoints both before delete; merging an address that is a PBF nexthop →
+  **blocker** (review-gated), zero ops.
+- **test_naming**: renaming an address referenced by a tunnel-inspect rule
+  repoints it.
+- **test_apply_xml**: reference edit into a decryption/QoS rule rewrites the
+  member list and round-trips.
+- **test_live_apply**: xpath for a network-packet-broker rule field is correct;
+  a PBF nexthop edit is skipped (`None`), not mis-addressed.
+- **test_setcmd**: `set`/`delete` lines for an SD-WAN reference edit; PBF nexthop
+  edit renders `# REVIEW`.
+
+## Docs to update
+
+- `docs/getting-started/concepts.md` (reference-graph coverage sentence).
+- `docs/guides/references-and-audit.md` (lines 16, 63-64 — drop the "other
+  rulebases not yet covered" note).
+- `docs/guides/duplicates-and-merging.md` (the repointed-fields list).
+- `skills/panorama-super-cli/SKILL.md` (refs coverage).
+- `refs.py` / `models.py` module docstrings.
+
+## Out of scope / follow-ups
+
+- Applications, zones, profiles, URL categories, schedules as reference kinds
+  (would need new object models).
+- Live read-modify-write for in-place updates (pre-existing limitation).
+- Literal-IP PBF nexthop (only the object-capable `fqdn` variant is modelled).
+```

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.2.6"
+__version__ = "0.3.0"

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/apply_live.py

@@ -23,7 +23,8 @@ from typing import Literal
 
 from pydantic import BaseModel
 
-from psc.core.changeset import ChangeSet, ObjectUpsert, ReferenceEdit
+from psc.core.changeset import ChangeSet, ObjectUpsert, ReferenceEdit, reference_edit_is_mappable
+from psc.core.rulebases import rule_container
 from psc.output.errors import ErrorType, PscError
 
 # The device entry under which Panorama keeps its device-groups. Fixed on
@@ -84,11 +85,10 @@ def _referrer_field_xpath(edit: ReferenceEdit) -> tuple[str, str] | None:
         return f"{base}/address-group/entry[@name='{name}']/static", "static"
     if edit.referrer_kind == "service-group":
         return f"{base}/service-group/entry[@name='{name}']/members", "members"
-    if edit.referrer_kind == "security-rule" and rb:
-        path = f"{base}/{rb}-rulebase/security/rules/entry[@name='{name}']/{edit.field}"
-        return path, edit.field
-    if edit.referrer_kind == "nat-rule" and rb and edit.field in ("source", "destination"):
-        path = f"{base}/{rb}-rulebase/nat/rules/entry[@name='{name}']/{edit.field}"
+    if reference_edit_is_mappable(edit):
+        # Any rulebase flat member field: container derives from referrer_kind.
+        container = rule_container(edit.referrer_kind)
+        path = f"{base}/{rb}-rulebase/{container}/rules/entry[@name='{name}']/{edit.field}"
         return path, edit.field
     return None
 

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/apply_xml.py

@@ -17,7 +17,8 @@ import xml.etree.ElementTree as ET
 
 from defusedxml.ElementTree import fromstring as _safe_fromstring
 
-from psc.core.changeset import ChangeSet, ObjectUpsert, ReferenceEdit
+from psc.core.changeset import ChangeSet, ObjectUpsert, ReferenceEdit, reference_edit_is_mappable
+from psc.core.rulebases import rule_container
 from psc.output.errors import ErrorType, PscError
 
 
@@ -68,15 +69,13 @@ def _referrer_field_element(scope: ET.Element, edit: ReferenceEdit) -> ET.Elemen
     elif edit.referrer_kind == "service-group":
         entry = _find_named(scope.find("service-group"), "entry", name)
         leaf = "members"
-    elif edit.referrer_kind == "security-rule" and edit.rulebase:
-        entry = _find_named(scope.find(f"./{edit.rulebase}-rulebase/security/rules"), "entry", name)
-        leaf = edit.field
-    elif (
-        edit.referrer_kind == "nat-rule"
-        and edit.rulebase
-        and edit.field in ("source", "destination")
-    ):
-        entry = _find_named(scope.find(f"./{edit.rulebase}-rulebase/nat/rules"), "entry", name)
+    elif reference_edit_is_mappable(edit):
+        # Any rulebase whose field is a flat member list: container == the
+        # tag derived from referrer_kind (security/nat/pbf/qos/…).
+        container = rule_container(edit.referrer_kind)
+        entry = _find_named(
+            scope.find(f"./{edit.rulebase}-rulebase/{container}/rules"), "entry", name
+        )
         leaf = edit.field
     else:
         return None

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/changeset.py

@@ -17,6 +17,8 @@ from enum import Enum
 
 from pydantic import BaseModel, Field
 
+from psc.core.rulebases import FLAT_RULE_FIELDS, rule_container
+
 
 class ObjectKind(str, Enum):
     ADDRESS = "address"
@@ -132,20 +134,25 @@ def reference_edit_is_mappable(edit: ReferenceEdit) -> bool:
 
     The single source of truth behind `apply_xml._referrer_field_element` and
     `apply_live._referrer_field_xpath`: a member field they know how to address
-    (a group's `static`/`members`, a security-rule field, a NAT src/dst list).
-    A NAT *translation* field is nested with no flat list, and a rule edit with
-    no `rulebase` can't be located — both are unmappable, and an applier silently
-    skips them. The planner uses this to refuse such a skip when the same plan
-    tears the target down, instead of leaving a dangling reference (#28).
+    (a group's `static`/`members`, a security-rule field, a NAT src/dst list, or
+    any other rulebase's source/destination/service/tag — see
+    `psc.core.rulebases`). A NAT *translation* field and a PBF `nexthop` are
+    nested with no flat list, and a rule edit with no `rulebase` can't be
+    located — all unmappable, and an applier silently skips them. The planner
+    uses this to refuse such a skip when the same plan tears the target down,
+    instead of leaving a dangling reference (#28).
     """
     kind = edit.referrer_kind
     if kind in ("address-group", "service-group"):
         return True
-    if kind == "security-rule":
-        return edit.rulebase is not None
-    if kind == "nat-rule":
-        return edit.rulebase is not None and edit.field in ("source", "destination")
-    return False
+    container = rule_container(kind)
+    if container is None or edit.rulebase is None:
+        return False
+    if container == "nat":
+        # NAT keeps only flat match fields; its translation fields are nested.
+        return edit.field in ("source", "destination")
+    # security + every policy rulebase: the shared flat member fields.
+    return edit.field in FLAT_RULE_FIELDS
 
 
 def gate_unmappable_reference_edits(cs: ChangeSet) -> None:

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/dedup.py

@@ -24,6 +24,7 @@ from psc.core.changeset import (
 from psc.core.models import Location, Snapshot
 from psc.core.normalize import normalize_address, service_key
 from psc.core.refs import Reference, ReferenceGraph
+from psc.core.rulebases import rule_container
 
 
 class ObjectRef(BaseModel):
@@ -188,6 +189,23 @@ def plan_merge(
     return cs
 
 
+def _field_attr(field: str) -> str:
+    """The model attribute holding a reference field's member list.
+
+    The reference `field` is the PAN-OS *element* name (`tag`, `source`,
+    `destination-translation`); the model attribute is its Python form. The one
+    irregular case is `tag` → `tags` — getting this wrong returns an empty list,
+    so a tag rename/merge would wipe the field instead of rewriting one member.
+    """
+    return "tags" if field == "tag" else field.replace("-", "_")
+
+
+def _attr_as_members(obj: object, field: str) -> list[str]:
+    """Read a rule's reference field as a member list (a scalar wraps to one)."""
+    val = getattr(obj, _field_attr(field), [])
+    return list(val) if isinstance(val, list) else [val]
+
+
 def field_members(snapshot: Snapshot, ref: Reference) -> list[str]:
     """Current member list of the field a reference points at."""
     loc = ref.referrer_location
@@ -202,7 +220,7 @@ def field_members(snapshot: Snapshot, ref: Reference) -> list[str]:
                 and r.location == loc
                 and (ref.rulebase is None or r.rulebase == ref.rulebase)
             ):
-                return list(getattr(r, ref.field.replace("-", "_"), []))
+                return _attr_as_members(r, ref.field)
     elif ref.referrer_kind == "nat-rule":
         for n in snapshot.nat_rules:
             if (
@@ -210,7 +228,14 @@ def field_members(snapshot: Snapshot, ref: Reference) -> list[str]:
                 and n.location == loc
                 and (ref.rulebase is None or n.rulebase == ref.rulebase)
             ):
-                attr = ref.field.replace("-", "_")
-                val = getattr(n, attr, [])
-                return list(val) if isinstance(val, list) else [val]
+                return _attr_as_members(n, ref.field)
+    elif rule_container(ref.referrer_kind) is not None:
+        for p in snapshot.policy_rules:
+            if (
+                p.referrer_kind == ref.referrer_kind
+                and p.name == ref.referrer_name
+                and p.location == loc
+                and (ref.rulebase is None or p.rulebase == ref.rulebase)
+            ):
+                return _attr_as_members(p, ref.field)
     return [ref.target_name]

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/models.py

@@ -32,6 +32,24 @@ class Rulebase(str, Enum):
     POST = "post"
 
 
+class RuleType(str, Enum):
+    """The "security-shaped" rulebases beyond `security`/`nat` that carry object
+    references. Each value is also the PAN-OS XML container tag / `set` keyword
+    (see `psc.core.rulebases`), so the reference graph and the appliers stay
+    table-driven rather than hard-coding one branch per rulebase.
+    """
+
+    PBF = "pbf"
+    DECRYPTION = "decryption"
+    AUTHENTICATION = "authentication"
+    QOS = "qos"
+    APPLICATION_OVERRIDE = "application-override"
+    DOS = "dos"
+    SDWAN = "sdwan"
+    TUNNEL_INSPECT = "tunnel-inspect"
+    NETWORK_PACKET_BROKER = "network-packet-broker"
+
+
 class Location(BaseModel):
     """Where an object lives: Panorama `shared`, or a named device-group.
 
@@ -184,6 +202,46 @@ class NatRule(BaseModel):
         return (self.location.name, self.rulebase.value, self.name)
 
 
+class PolicyRule(BaseModel):
+    """The object-reference surface of one "security-shaped" rulebase rule.
+
+    A single model spans the nine rulebases in `RuleType` (PBF, decryption,
+    authentication, QoS, application-override, DoS, SD-WAN, tunnel-inspect,
+    network-packet-broker): they all reference addresses in `source`/
+    `destination`, an optional `service` list, and carry rule `tags`. PBF adds a
+    forwarding `nexthop` that can name an address object. Like `SecurityRule`,
+    this models only the reference surface — `application`/`source-user` are
+    omitted because they name no psc-managed object.
+
+    `SecurityRule`/`NatRule` predate this model and stay separate (NAT's nested
+    translation fields don't fit); `rule_type` is what distinguishes the rest.
+    """
+
+    name: str
+    location: Location = SHARED
+    rulebase: Rulebase = Rulebase.PRE
+    rule_type: RuleType
+    source: list[str] = Field(default_factory=lambda: ["any"])
+    destination: list[str] = Field(default_factory=lambda: ["any"])
+    service: list[str] = Field(default_factory=list)
+    """Empty when the rulebase has no service field (e.g. application-override)."""
+    nexthop: str | None = None
+    """PBF forwarding next-hop address object, if the rule names one."""
+    disabled: bool = False
+    tags: list[str] = Field(default_factory=list)
+
+    @property
+    def referrer_kind(self) -> str:
+        """`"qos-rule"`, `"pbf-rule"`, … — the edge label in the reference graph
+        and the key the appliers resolve back to a container via
+        `rulebases.rule_container`."""
+        return f"{self.rule_type.value}-rule"
+
+    @property
+    def key(self) -> tuple[str, str, str, str]:
+        return (self.location.name, self.rule_type.value, self.rulebase.value, self.name)
+
+
 class Snapshot(BaseModel):
     """An immutable point-in-time view of the parts of a Panorama config
     `psc` understands. Built by the XML parser or the live client; consumed
@@ -198,6 +256,8 @@ class Snapshot(BaseModel):
     tags: list[Tag] = Field(default_factory=list)
     security_rules: list[SecurityRule] = Field(default_factory=list)
     nat_rules: list[NatRule] = Field(default_factory=list)
+    policy_rules: list[PolicyRule] = Field(default_factory=list)
+    """Rules from the nine non-security/nat rulebases (see `RuleType`)."""
     device_groups: list[str] = Field(default_factory=list)
     device_group_parents: dict[str, str] = Field(default_factory=dict)
     """Child device-group name → its parent device-group name. A device-group

{panorama_super_cli-0.2.6 → panorama_super_cli-0.3.0}/psc/core/parse.py

@@ -24,7 +24,9 @@ from psc.core.models import (
     AddressType,
     Location,
     NatRule,
+    PolicyRule,
     Rulebase,
+    RuleType,
     SecurityRule,
     Service,
     ServiceGroup,
@@ -224,6 +226,40 @@ def _parse_nat_rules(parent: ET.Element, loc: Location, rb: Rulebase) -> list[Na
     return out
 
 
+def _parse_policy_rules(parent: ET.Element, loc: Location, rb: Rulebase) -> list[PolicyRule]:
+    """Parse every "security-shaped" rulebase under one `<*-rulebase>` element.
+
+    Drives off `RuleType` (whose values are the container tags), so a new
+    rulebase needs only a new enum member. Reads the shared reference surface
+    (source/destination/service/tag); `service` stays empty when the rulebase
+    omits it (application-override). PBF additionally captures an object-named
+    forwarding next-hop (`action/forward/nexthop/fqdn`); a literal `ip-address`
+    next-hop names no object and is skipped.
+    """
+    out: list[PolicyRule] = []
+    for rt in RuleType:
+        for entry in parent.findall(f"./{rt.value}/rules/entry"):
+            name = entry.get("name")
+            if not name:
+                continue
+            nexthop = _text(entry, "action/forward/nexthop/fqdn") if rt is RuleType.PBF else None
+            out.append(
+                PolicyRule(
+                    name=name,
+                    location=loc,
+                    rulebase=rb,
+                    rule_type=rt,
+                    source=_member_list_or_any(entry, "source"),
+                    destination=_member_list_or_any(entry, "destination"),
+                    service=_members(entry, "service"),
+                    nexthop=nexthop,
+                    disabled=_text(entry, "disabled") == "yes",
+                    tags=_members(entry, "tag"),
+                )
+            )
+    return out
+
+
 def _collect(snap: Snapshot, parent: ET.Element, loc: Location) -> None:
     snap.addresses.extend(_parse_addresses(parent, loc))
     snap.address_groups.extend(_parse_address_groups(parent, loc))
@@ -235,6 +271,7 @@ def _collect(snap: Snapshot, parent: ET.Element, loc: Location) -> None:
         if rb_el is not None:
             snap.security_rules.extend(_parse_security_rules(rb_el, loc, rb))
             snap.nat_rules.extend(_parse_nat_rules(rb_el, loc, rb))
+            snap.policy_rules.extend(_parse_policy_rules(rb_el, loc, rb))
 
 
 def _find_config_root(root: ET.Element) -> ET.Element: