panorama-super-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/CHANGELOG.md

@@ -7,6 +7,30 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.4.2 — 2026-06-08
+
+### Added
+
+- **`psc move <kind> <name> --from <loc> --to <loc>`** (#74) — promote an
+  object (`address`/`address-group`/`service`/`service-group`/`tag`) from a
+  device-group toward `shared`. Restricted to the safe direction: `--to` must be
+  `shared` or an *ancestor* of `--from`, where references fall through to the
+  destination with no repoint. Blocks (exit `6`) on a sibling/child/unrelated
+  destination (would orphan references), an intermediate device-group that
+  already defines the name (a shadow), the object's own dependencies
+  (members/tags) not being visible at the destination, or a collision with a
+  different-valued object already there. A collision with an identical-valued
+  object simply drops the source copy. Dry-run by default; offline `--apply`
+  round-trips through the rewritten config.
+
+## v0.4.1 — 2026-06-08
+
+### Fixed
+
+- **`psc dedup addresses|services|groups`** (#72) — the table view now draws a
+  horizontal rule between each group of duplicates, so the blocks are easy to
+  tell apart at a glance. Machine formats (json/jsonl/yaml/csv) are unchanged.
+
 ## v0.4.0 — 2026-06-05
 
 ### Added

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/docs/reference/cli.md

@@ -150,6 +150,23 @@ NAT-translation/PBF-next-hop references and DAG-filter-tag matches; orphan-rule
 deletions are warnings. See
 [Editing objects](../guides/editing-objects.md#decommission-an-address).
 
+### move
+
+```
+psc move <address|address-group|service|service-group|tag> <name>
+         --from <shared|DG> --to <shared|DG> [--apply] [--out PATH] [-of xml|set]
+```
+
+Promote one object from a device-group toward `shared` (create at the
+destination, delete at the source). `--to` must be `shared` or an *ancestor* of
+`--from` — the only direction in which references fall through to the
+destination with no repoint. Blocks (exit `6`) on a sibling/child/unrelated
+destination, an intermediate device-group that already defines the name (a
+shadow), the object's own dependencies (members/tags) not being visible at the
+destination, or a collision with a different-valued object already there. An
+identical-valued collision drops the source copy. Single object per run;
+dry-run by default.
+
 ### init
 
 ```

panorama_super_cli-0.4.2/docs/superpowers/specs/2026-06-08-move-objects-to-shared-design.md

@@ -0,0 +1,143 @@
+# move objects toward shared — design (issue #74)
+
+## Problem
+
+While cleaning a Panorama, objects are routinely stranded in a device-group
+when their natural home is `shared` (or a parent device-group that several
+siblings inherit from). Today `psc` can find, dedup, rename, audit, and
+decommission objects, but it cannot *relocate* one — the user has to delete and
+recreate by hand, which is exactly the reference-unsafe operation `psc` exists
+to make safe.
+
+A "move" is, in `ChangeSet` terms, **create-at-destination + delete-at-source**.
+The danger is identical to merge/rename: references are by *name*, resolved up
+the device-group chain (`Snapshot.ancestors`), with nearer definitions
+shadowing farther ones. A naive move can dangle references or silently change
+which object a rule matches.
+
+## Scope (confirmed with the user)
+
+1. **Direction: promote *toward* shared only.** `--to` must be `shared` or a
+   *strict ancestor* of `--from`. This is the safe-by-construction direction:
+   `shared`/an ancestor is in the chain of every location in `--from`'s subtree
+   and is *farther* than `--from`, so any reference that resolved to the object
+   at `--from` still resolves to it at the destination — **no repoint needed**.
+   A sibling / unrelated / child destination would orphan references in
+   `--from`'s scope, so it is a hard **blocker**, not supported in v1.
+2. **Collision at destination → identical-value merges, different-value blocks.**
+   Because the move only promotes *toward* shared, an identical-value collision
+   is just a **delete-source**: the destination object already holds the value,
+   so removing the source copy lets every reference in the source subtree fall
+   through (ordinary shadowing) onto the destination object — no repoint, no
+   second copy. This works uniformly for all five kinds, so v1 supports the
+   identical-value merge everywhere, not only addresses.
+   - "identical value" per kind: address → `AddressType` + normalized value;
+     service → protocol + normalized ports (`normalize.service_key`);
+     address-group → same static members (set) + same dynamic filter;
+     service-group → same members (set); tag → always mergeable (a tag carries
+     no match-affecting value; a differing colour/comment is a warning).
+   - different value → **blocker** (consolidate or rename first).
+
+   We deliberately do *not* delegate to `dedup.plan_merge`: there the source
+   object *shadows* the destination one in the source scope, so dedup's
+   "kept object visible here" check would wrongly block. The delete-source +
+   fall-through plan is both simpler and correct for the promote direction.
+3. **Dependencies must already be visible at the destination — no auto-cascade.**
+   The moved object's own downward references (a group's `static` members, an
+   object's `tags`, a service-group's members, a dynamic group's filter tags)
+   must each resolve from the destination. Any that don't → **blocker** listing
+   exactly what to move first.
+4. **Single object per invocation.** Bulk/filtered moves are a follow-up.
+5. Dry-run by default; `--apply` to commit; same `complete()` contract as every
+   other mutating command.
+
+## Key insight
+
+Because the move is restricted to *promote-toward-shared*, the create-at-dest +
+delete-at-source plan needs **zero reference edits**. Every reference that
+pointed at the object falls through, by ordinary PAN-OS shadowing, onto the new
+(farther-up) definition once the source copy is removed — *provided* nothing
+between source and destination already defines the name. That one caveat is the
+**intermediate-shadow guard**: if any device-group strictly between `--from` and
+`--to` already defines the name (same namespace), removing the source would
+re-resolve references to that intermediate instead of the destination —
+**blocker**.
+
+This is why the engine is small: the two genuinely hard cases (collision,
+shadowing) are delegated to `dedup` / handled by a single guard; the common
+case is one `ObjectUpsert` + one `ObjectDelete`.
+
+## Architecture
+
+New engine `psc/core/relocate.py` (pure, returns a `ChangeSet`) + one thin CLI
+command `psc/cli/move_cmds.py`. No new `ChangeSet` op kind, no new applier code —
+`ObjectUpsert`/`ObjectDelete` already render (`setcmd`) and apply
+(`apply_xml`/`apply_live`).
+
+### `relocate.plan_move(snapshot, graph, *, kind, name, source_name, dest_name) -> ChangeSet`
+
+Order of checks (each returns a blocked, zero-op `ChangeSet` on failure, per the
+repo invariant):
+
+1. **Existence.** Object of `kind` named `name` defined *directly* at `source`.
+   Absent → blocker.
+2. **Direction.** `dest` must be in `ancestors(source)` and `dest != source`.
+   Otherwise → blocker ("`move` only promotes toward shared…").
+3. **Intermediate-shadow guard.** No location strictly between `source` and
+   `dest` may already define `name` in the object's namespace → blocker.
+4. **Dependency gate.** Every downward dependency must `graph.resolve(...)` from
+   `dest`. Unresolved ones → blocker listing them.
+5. **Collision dispatch.**
+   - destination has no same-kind `name` → **clean promote**: build the
+     destination `ObjectUpsert` by calling the matching `crud.plan_*` with
+     `location=dest` (reuses validation + the leaf-key contract + cross-kind
+     collision check), then append `ObjectDelete` at `source`.
+   - destination has same-kind `name`, identical value → **merge by
+     delete-source**: emit only `ObjectDelete` at `source` (no upsert), with a
+     warning that references now resolve to the destination object (and a second
+     warning if cosmetic metadata — tag colour/comment — differs).
+   - destination has same-kind `name`, different value → blocker.
+   In both non-blocked cases, if destination is `shared`, add a warning naming
+   any currently-*dangling* references elsewhere that will now newly resolve to
+   the promoted object.
+6. Enforce the zero-op-when-blocked invariant.
+
+The namespace per kind mirrors `naming.plan_rename` / `refs`: address &
+address-group → `address`, service & service-group → `service`, tag → `tag`.
+
+### CLI: `psc move <kind> <name> --from <loc> --to <loc> [--apply] [--out] [-of]`
+
+`kind` is an `ObjectKind` positional (`address|address-group|service|service-group|tag`);
+`--from`/`--to` are required location strings (`shared` or a device-group name);
+dry-run by default. Wired as a single top-level command (like `decommission`),
+not a sub-app. Delegates rendering/apply to `cli/_plan.complete`.
+
+## Testing (TDD; safety-critical paths first)
+
+Engine (`tests/test_relocate.py`):
+- clean promote DG→shared: one upsert@shared (exists=False) + one delete@source;
+  no reference edits; referrers still resolve (assert via a rebuilt graph or by
+  inspecting ops).
+- promote DG→ancestor DG (nested fixture).
+- sibling/child/unrelated destination → blocked.
+- dest == source → blocked.
+- object absent at source → blocked.
+- collision, identical value → merge plan (delete source, no second copy).
+- collision, different value → blocked.
+- intermediate-shadow guard → blocked.
+- dependency not visible at dest (group member / tag) → blocked, names listed.
+- promote-to-shared revives a sibling dangling ref → warning emitted.
+
+CLI (`tests/test_cli_move.py`):
+- dry-run prints plan, exits 0, writes nothing.
+- `--apply --out` offline round-trips (object now under destination scope, gone
+  from source) using `apply_xml`.
+- blocked plan → exit 6 (`CONFLICT`), nothing written.
+- `-o set` renders create+delete lines.
+
+## Out of scope (v1)
+
+- Moving *away* from shared / to a sibling or child (would require repointing or
+  copying — deliberately blocked).
+- Auto-cascading dependencies.
+- Bulk / filtered selection.

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"

panorama_super_cli-0.4.2/psc/cli/_options.py

@@ -0,0 +1,42 @@
+"""Shared Typer Option constants and location helpers for the CLI layer.
+
+These canonical Option objects exist so the mutating commands that genuinely
+share a flag (`--apply`, `--out`, `--location`) declare it once. They are only
+reused where the flags, defaults, AND help text are byte-identical — commands
+that phrase their `--apply`/`--location`/`--out` help differently keep their own
+local Option (sharing would silently change `--help`).
+
+The two helpers collapse the shared-aware `Location` conversion duplicated
+across command modules. They live here (in `cli/`, never `core/`) because the
+"shared" sentinel string is a CLI-surface concern, not a domain-model one.
+"""
+
+from __future__ import annotations
+
+import typer
+
+from psc.core.models import Location
+
+# Canonical mutating-command flags. Shared only where help/default are identical
+# to these strings (currently `psc set` for all three; the `--out` help is also
+# shared by dedup/name/rule, whose wording matches verbatim).
+LOCATION_OPTION = typer.Option(
+    None, "--location", help="Target location (default: global --device-group, else shared)."
+)
+APPLY_OPTION = typer.Option(False, "--apply", help="Execute the change (default: dry-run).")
+OUT_OPTION = typer.Option(
+    None,
+    "--out",
+    help="Write the plan artifact (set script or rewritten config) to this file; "
+    "honoured even in a dry-run (see --output-format).",
+)
+
+
+def location_from_name(name: str) -> Location:
+    """Convert a location *name* to a `Location`, honouring the "shared" sentinel."""
+    return Location.shared() if name == "shared" else Location.dg(name)
+
+
+def optional_location(name: str | None) -> Location | None:
+    """Like `location_from_name`, but pass `None` through unchanged (no scope)."""
+    return None if name is None else location_from_name(name)

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/app.py

@@ -16,6 +16,7 @@ from psc.cli import (
     decommission_cmds,
     dedup_cmds,
     find_cmds,
+    move_cmds,
     name_cmds,
     profile_cmds,
     refs_cmds,
@@ -153,6 +154,10 @@ app.command(
     "decommission",
     help="Reference-safe teardown of address objects matching an IP/CIDR.",
 )(decommission_cmds.decommission)
+app.command(
+    "move",
+    help="Promote an object toward shared (to shared or an ancestor device-group).",
+)(move_cmds.move)
 app.command(
     "init",
     help="Interactively bootstrap a live profile (fetches an API key from a username/password).",

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/decommission_cmds.py

@@ -12,10 +12,11 @@ from pathlib import Path
 
 import typer
 
+from psc.cli._options import location_from_name
 from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core.decommission import plan_decommission
-from psc.core.models import Address, Location
+from psc.core.models import Address
 from psc.core.normalize import MatchKind
 from psc.core.refs import ReferenceGraph
 from psc.core.resolve import find_ips
@@ -86,7 +87,7 @@ def decommission(
         raise PscError("provide one or more IP/CIDR/range targets, or --file", ErrorType.VALIDATION)
 
     snap = rt.snapshot()
-    loc = _resolve_scope(scope) if scope is not None else rt.scope()
+    loc = location_from_name(scope) if scope is not None else rt.scope()
 
     results = find_ips(snap, items, loc)
     index = snap.address_index()
@@ -109,7 +110,3 @@ def decommission(
         snap, graph, matched, scope=loc, keep_groups=keep_groups, keep_rules=keep_rules
     )
     complete(rt, cs, apply=apply, out_path=out, out_format=output_format)
-
-
-def _resolve_scope(name: str) -> Location:
-    return Location.shared() if name == "shared" else Location.dg(name)

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/dedup_cmds.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import typer
 
+from psc.cli._options import OUT_OPTION, optional_location
 from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core.dedup import (
@@ -15,7 +16,6 @@ from psc.core.dedup import (
     plan_merge,
     plan_merge_group,
 )
-from psc.core.models import Location
 from psc.core.refs import ReferenceGraph
 from psc.core.source import ConfigFormat
 from psc.output.errors import ErrorType, PscError
@@ -58,6 +58,7 @@ def addresses(
         model=groups,
         rows=_dup_rows(groups),
         table_title="duplicate addresses",
+        group_by="group",
     )
 
 
@@ -69,7 +70,12 @@ def services(ctx: typer.Context) -> None:
     if rt.strict and not groups:
         raise PscError("no duplicate services", ErrorType.NOT_FOUND)
     render(
-        rt.stdout, rt.output, model=groups, rows=_dup_rows(groups), table_title="duplicate services"
+        rt.stdout,
+        rt.output,
+        model=groups,
+        rows=_dup_rows(groups),
+        table_title="duplicate services",
+        group_by="group",
     )
 
 
@@ -94,12 +100,7 @@ def groups(
     rt: Runtime = ctx.obj
     snap = rt.snapshot()
     graph = ReferenceGraph.build(snap)
-    loc_name = location or rt.device_group
-    loc = (
-        None
-        if loc_name is None
-        else (Location.shared() if loc_name == "shared" else Location.dg(loc_name))
-    )
+    loc = optional_location(location or rt.device_group)
     result = find_duplicate_groups(snap, graph, loc)
     if result.dynamic_skipped or result.unresolvable_skipped:
         rt.stderr.print(
@@ -116,6 +117,7 @@ def groups(
         model=result.buckets,
         rows=_dup_rows(result.buckets),
         table_title="duplicate address-groups",
+        group_by="group",
     )
 
 
@@ -133,12 +135,7 @@ def merge(
         False, "--allow-value-change", help="Permit merging objects with different values."
     ),
     apply: bool = typer.Option(False, "--apply", help="Execute the merge (default: dry-run)."),
-    out: str | None = typer.Option(
-        None,
-        "--out",
-        help="Write the plan artifact (set script or rewritten config) to this "
-        "file; honoured even in a dry-run (see --output-format).",
-    ),
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Collapse one address object into another, repointing every reference.
@@ -174,12 +171,7 @@ def merge_group(
     keep_location: str | None = typer.Option(None, "--keep-location"),
     remove_location: str | None = typer.Option(None, "--remove-location"),
     apply: bool = typer.Option(False, "--apply", help="Execute the merge (default: dry-run)."),
-    out: str | None = typer.Option(
-        None,
-        "--out",
-        help="Write the plan artifact (set script or rewritten config) to this "
-        "file; honoured even in a dry-run (see --output-format).",
-    ),
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Collapse one address-group into an equivalent one, repointing references.

panorama_super_cli-0.4.2/psc/cli/move_cmds.py

@@ -0,0 +1,64 @@
+"""`psc move` — promote an object toward shared, reference-safely (issue #74).
+
+A thin shell over `core.relocate.plan_move`: resolve the runtime source, build
+the reference graph, plan the promotion, and hand the `ChangeSet` to the shared
+dry-run/apply completion. All the safety logic lives in the engine.
+"""
+
+from __future__ import annotations
+
+import typer
+
+from psc.cli._plan import OUT_FORMAT_OPTION, complete
+from psc.cli.runtime import Runtime
+from psc.core.changeset import ObjectKind
+from psc.core.refs import ReferenceGraph
+from psc.core.relocate import plan_move
+from psc.core.source import ConfigFormat
+
+
+def move(
+    ctx: typer.Context,
+    kind: ObjectKind = typer.Argument(
+        ..., help="Object kind: address, address-group, service, service-group, or tag."
+    ),
+    name: str = typer.Argument(..., help="Name of the object to move."),
+    from_location: str = typer.Option(
+        ..., "--from", help="Current location: 'shared' or a device-group name."
+    ),
+    to_location: str = typer.Option(
+        ...,
+        "--to",
+        help="Destination: 'shared' or an ancestor device-group of --from. "
+        "move only promotes toward shared.",
+    ),
+    apply: bool = typer.Option(False, "--apply", help="Execute the move (default: dry-run)."),
+    out: str | None = typer.Option(
+        None,
+        "--out",
+        help="Write the plan artifact (set script or rewritten config) to this file.",
+    ),
+    output_format: ConfigFormat = OUT_FORMAT_OPTION,
+) -> None:
+    """Promote an object from a device-group toward `shared`.
+
+    A move is create-at-destination + delete-at-source. It is restricted to the
+    safe direction — `--to` must be `shared` or an *ancestor* of `--from` — so
+    references fall through to the destination without any repoint. Dry-run by
+    default; refuses (exit 6) if the move would orphan references, hit a
+    shadowing device-group between source and destination, leave the object's
+    own dependencies unresolved at the destination, or collide with a
+    different-valued object already at the destination.
+    """
+    rt: Runtime = ctx.obj
+    snap = rt.snapshot()
+    graph = ReferenceGraph.build(snap)
+    cs = plan_move(
+        snap,
+        graph,
+        kind=kind,
+        name=name,
+        source_name=from_location,
+        dest_name=to_location,
+    )
+    complete(rt, cs, apply=apply, out_path=out, out_format=output_format)

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/name_cmds.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import typer
 
+from psc.cli._options import OUT_OPTION
 from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core.changeset import ObjectKind
@@ -50,12 +51,7 @@ def rename(
     kind: ObjectKind = typer.Option(ObjectKind.ADDRESS, "--kind"),
     location: str | None = typer.Option(None, "--location"),
     apply: bool = typer.Option(False, "--apply", help="Execute the rename (default: dry-run)."),
-    out: str | None = typer.Option(
-        None,
-        "--out",
-        help="Write the plan artifact (set script or rewritten config) to this "
-        "file; honoured even in a dry-run (see --output-format).",
-    ),
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Rename one object, repointing every reference (refuses on shadow collisions)."""
@@ -73,12 +69,7 @@ def apply_scheme(
     object_name: str = typer.Option(..., "--object", help="Object to rename to its scheme name."),
     location: str | None = typer.Option(None, "--location"),
     apply: bool = typer.Option(False, "--apply", help="Execute the rename (default: dry-run)."),
-    out: str | None = typer.Option(
-        None,
-        "--out",
-        help="Write the plan artifact (set script or rewritten config) to this "
-        "file; honoured even in a dry-run (see --output-format).",
-    ),
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Rename one object to the name the configured scheme implies for its value."""

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/refs_cmds.py

@@ -4,8 +4,8 @@ from __future__ import annotations
 
 import typer
 
+from psc.cli._options import location_from_name
 from psc.cli.runtime import Runtime
-from psc.core.models import Location
 from psc.core.refs import ReferenceGraph
 from psc.core.resolve import find_object
 from psc.output.errors import ErrorType, PscError
@@ -41,7 +41,7 @@ def used(
         kind = kind or hits[0].kind
         location = location or hits[0].location
 
-    loc = Location.shared() if location == "shared" else Location.dg(location)
+    loc = location_from_name(location)
     refs = graph.where_used(kind, name, loc)
     rows = [
         {
@@ -68,10 +68,9 @@ def unused(
     graph = ReferenceGraph.build(rt.snapshot())
     targets = graph.unused(kind)
     rows = [{"kind": t.kind, "name": t.name, "location": t.location.name} for t in targets]
-    model = [{"kind": t.kind, "name": t.name, "location": t.location.name} for t in targets]
     if rt.strict and not targets:
         raise PscError(f"no unused {kind}", ErrorType.NOT_FOUND)
-    render(rt.stdout, rt.output, model=model, rows=rows, table_title=f"unused {kind}")
+    render(rt.stdout, rt.output, model=rows, rows=rows, table_title=f"unused {kind}")
     if targets:
         # `unused` only sees device-group objects + policy rulebases. Objects
         # referenced from templates/network config, NAT-rule tags, or matched

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/rule_cmds.py

@@ -4,9 +4,10 @@ from __future__ import annotations
 
 import typer
 
+from psc.cli._options import OUT_OPTION, location_from_name
 from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
-from psc.core.models import Location, Rulebase
+from psc.core.models import Rulebase
 from psc.core.rule_edit import plan_rule_member_edit
 from psc.core.source import ConfigFormat
 from psc.output.errors import ErrorType, PscError
@@ -32,12 +33,7 @@ def edit_member(
     add: str | None = typer.Option(None, "--add", help="Member to add (idempotent)."),
     remove: str | None = typer.Option(None, "--remove", help="Member to remove (idempotent)."),
     apply: bool = typer.Option(False, "--apply", help="Execute the edit (default: dry-run)."),
-    out: str | None = typer.Option(
-        None,
-        "--out",
-        help="Write the plan artifact (set script or rewritten config) to this "
-        "file; honoured even in a dry-run (see --output-format).",
-    ),
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Add or remove one member of a rule field, idempotently.
@@ -58,8 +54,7 @@ def edit_member(
             f"invalid --rulebase '{rulebase}' (choose pre or post)", ErrorType.VALIDATION
         ) from exc
 
-    loc_name = location or rt.device_group or "shared"
-    loc = Location.shared() if loc_name == "shared" else Location.dg(loc_name)
+    loc = location_from_name(location or rt.device_group or "shared")
 
     cs = plan_rule_member_edit(rt.snapshot(), rule, loc, rb, field, add=add, remove=remove)
     complete(rt, cs, apply=apply, out_path=out, out_format=output_format)

{panorama_super_cli-0.4.0 → panorama_super_cli-0.4.2}/psc/cli/set_cmds.py

@@ -16,6 +16,12 @@ from __future__ import annotations
 
 import typer
 
+from psc.cli._options import (
+    APPLY_OPTION,
+    LOCATION_OPTION,
+    OUT_OPTION,
+    location_from_name,
+)
 from psc.cli._plan import OUT_FORMAT_OPTION, complete
 from psc.cli.runtime import Runtime
 from psc.core import crud
@@ -24,21 +30,9 @@ from psc.core.source import ConfigFormat
 
 app = typer.Typer(no_args_is_help=True)
 
-_LOCATION_OPTION = typer.Option(
-    None, "--location", help="Target location (default: global --device-group, else shared)."
-)
-_APPLY_OPTION = typer.Option(False, "--apply", help="Execute the change (default: dry-run).")
-_OUT_OPTION = typer.Option(
-    None,
-    "--out",
-    help="Write the plan artifact (set script or rewritten config) to this file; "
-    "honoured even in a dry-run (see --output-format).",
-)
-
 
 def _resolve_location(rt: Runtime, location: str | None) -> Location:
-    name = location or rt.device_group or "shared"
-    return Location.shared() if name == "shared" else Location.dg(name)
+    return location_from_name(location or rt.device_group or "shared")
 
 
 @app.command("address")
@@ -51,9 +45,9 @@ def address(
     value: str = typer.Option(..., "--value", help="The address value (stored verbatim)."),
     description: str | None = typer.Option(None, "--description"),
     tag: list[str] = typer.Option([], "--tag", help="Tag name (repeatable)."),
-    location: str | None = _LOCATION_OPTION,
-    apply: bool = _APPLY_OPTION,
-    out: str | None = _OUT_OPTION,
+    location: str | None = LOCATION_OPTION,
+    apply: bool = APPLY_OPTION,
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Create or update an address object.
@@ -94,9 +88,9 @@ def address_group(
     ),
     description: str | None = typer.Option(None, "--description"),
     tag: list[str] = typer.Option([], "--tag", help="Tag name (repeatable)."),
-    location: str | None = _LOCATION_OPTION,
-    apply: bool = _APPLY_OPTION,
-    out: str | None = _OUT_OPTION,
+    location: str | None = LOCATION_OPTION,
+    apply: bool = APPLY_OPTION,
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Create or update an address-group (exactly one of --member.../--filter).
@@ -130,9 +124,9 @@ def service(
     ),
     description: str | None = typer.Option(None, "--description"),
     tag: list[str] = typer.Option([], "--tag", help="Tag name (repeatable)."),
-    location: str | None = _LOCATION_OPTION,
-    apply: bool = _APPLY_OPTION,
-    out: str | None = _OUT_OPTION,
+    location: str | None = LOCATION_OPTION,
+    apply: bool = APPLY_OPTION,
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Create or update a service object (--dest-port required; --source-port optional).
@@ -160,9 +154,9 @@ def service_group(
     name: str = typer.Option(..., "--name", help="Group name."),
     member: list[str] = typer.Option(..., "--member", help="Member name (repeatable, >=1)."),
     tag: list[str] = typer.Option([], "--tag", help="Tag name (repeatable)."),
-    location: str | None = _LOCATION_OPTION,
-    apply: bool = _APPLY_OPTION,
-    out: str | None = _OUT_OPTION,
+    location: str | None = LOCATION_OPTION,
+    apply: bool = APPLY_OPTION,
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Create or update a service-group.
@@ -187,9 +181,9 @@ def tag(
     name: str = typer.Option(..., "--name", help="Tag name (<=127 chars)."),
     color: str | None = typer.Option(None, "--color", help="color1..color42."),
     comments: str | None = typer.Option(None, "--comments"),
-    location: str | None = _LOCATION_OPTION,
-    apply: bool = _APPLY_OPTION,
-    out: str | None = _OUT_OPTION,
+    location: str | None = LOCATION_OPTION,
+    apply: bool = APPLY_OPTION,
+    out: str | None = OUT_OPTION,
     output_format: ConfigFormat = OUT_FORMAT_OPTION,
 ) -> None:
     """Create or update a tag.