plugin-scanner 3.0.0a249__tar.gz → 3.0.0a251__tar.gz

{plugin_scanner-3.0.0a249 → plugin_scanner-3.0.0a251}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 3.0.0a249
+Version: 3.0.0a251
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Security, https://hol.org/guard/security

plugin_scanner-3.0.0a251/ci/test-suite-ratchet-baseline.json

@@ -0,0 +1,5 @@
+{
+  "maximum_collected_cases": 15568,
+  "maximum_test_source_lines": 335433,
+  "schema_version": 1
+}

plugin_scanner-3.0.0a251/docs/guard/command-cloud-extension-coverage.md

@@ -0,0 +1,31 @@
+# Cloud Command Extension Coverage
+
+Guard evaluates cloud CLI operations from the canonical parsed command model. Rules match executable and subcommand structure, remain independent of shell text examples, and feed the existing policy, approval, memory, receipt, and sync pipeline.
+
+## Matrix coverage
+
+| Extension | Matrix-reviewed operations | Existing focused operations | Safe counterparts |
+| --- | ---: | --- | --- |
+| `command.cloud.aws` | 100 | EC2 instance termination, RDS instance or cluster deletion, and EKS cluster deletion | Help, request skeleton generation, EC2 permission-only dry run, and describe operations |
+| `command.cloud.gcp` | 0 | Compute Engine instance deletion and Cloud SQL instance deletion | Help and describe operations |
+| `command.cloud.azure` | 0 | Virtual machine deletion | Help and show operations |
+
+The operation matrices are declarative, typed, count-checked, and uniqueness-checked. They preserve the existing provider rule IDs and action classes, so policy, approval, receipt, memory, and synchronization contracts remain stable.
+
+Global account, project, subscription, profile, region, output, query, configuration, impersonation, filtering, pagination, and verbosity options are normalized wherever the CLI accepts them. Reordered operation flags do not change the result. Native Windows launcher suffixes are recognized. Unknown future global options fail secure when a destructive path remains recognizable.
+
+## Security and usability boundaries
+
+- Rules match canonical command structure rather than raw words such as `delete`, `destroy`, or `terminate`.
+- Quoted examples, printed commands, and source-search patterns remain data.
+- A help or preview form suppresses only its owning rule and command segment.
+- AWS request skeletons remain safe only for documented values.
+- EC2 dry-run safety remains scoped to EC2 termination.
+- Compound commands retain later destructive matches even when an earlier segment is safe.
+- Every matrix entry is exercised through command inspection and runtime tool-action extraction.
+
+## Primary references
+
+- [AWS CLI command reference](https://docs.aws.amazon.com/cli/latest/reference/)
+- [Google Cloud CLI reference](https://cloud.google.com/sdk/gcloud/reference)
+- [Azure CLI reference](https://learn.microsoft.com/cli/azure/reference-index)

plugin_scanner-3.0.0a251/docs/guard/command-extension-operation-matrix-prd.md

@@ -0,0 +1,176 @@
+# PRD: Command Extension Operation Matrix Expansion
+
+## Status
+
+Implementation target: `release/3.0`
+
+Delivery model: four independently reviewable pull requests, each closing exactly 100 operation tasks.
+
+## Problem
+
+HOL Guard command extensions already protect a useful set of destructive operations, but the current cloud-provider rules cover only a small fraction of the destructive command surface exposed by the AWS CLI, Google Cloud CLI, and Azure CLI. A command can therefore express the same high-risk intent through a nearby service or resource command and miss the provider-specific structured rule.
+
+The gap is not a raw-string detection problem. Guard already has a canonical command parser, structured executable matchers, safe variants, policy routing, runtime approvals, receipts, memory, and synchronization. The missing layer is a validated operation matrix that feeds those existing paths without weakening false-positive controls.
+
+## Goal
+
+Expand the existing cloud command extensions by 400 validated destructive operation paths while preserving the current rule IDs, action classes, policy contracts, permission catalog, and runtime behavior.
+
+The delivered matrix contains:
+
+- 200 AWS CLI delete or terminate operations across application, identity, infrastructure, data, delivery, backup, AI, and account services.
+- 100 Google Cloud CLI delete or destroy operations across control plane, IAM, Compute Engine, GKE, serverless, data, messaging, networking, and build services.
+- 100 Azure CLI delete operations across resource management, identity, networking, compute, application hosting, databases, storage, messaging, monitoring, API management, analytics, and AI services.
+
+## Non-goals
+
+- Adding generic substring matching for words such as `delete`, `destroy`, or `terminate`.
+- Executing cloud commands during tests.
+- Validating credentials, accounts, projects, subscriptions, regions, or resource existence.
+- Creating new policy action classes or changing default policy modes.
+- Duplicating operation-specific argument validation from provider CLIs.
+- Treating quoted examples, source code, grep patterns, or printed command text as execution.
+
+## Current architecture
+
+The cloud extension uses one structured rule per provider:
+
+- `command.cloud.aws.resource-deletion`
+- `command.cloud.gcp.resource-deletion`
+- `command.cloud.azure.resource-deletion`
+
+Each rule feeds both command inspection and runtime tool-action extraction. Safe variants suppress only the owning provider rule for documented help, preview, or request-skeleton forms. The matcher layer normalizes native Windows launcher suffixes and interspersed provider-global options.
+
+This project keeps those contracts stable. New command paths are data in provider-specific operation-matrix modules, converted into existing `ExecutableMatcher` values through shared builders.
+
+## User stories
+
+1. As a developer using an agent, I want Guard to review destructive cloud commands even when the command targets a service that was not in the original small catalog.
+2. As a security administrator, I want the existing provider policy and approval controls to apply consistently across the expanded operation surface.
+3. As a developer inspecting syntax, I want `--help`, Azure `-h`, and AWS request-skeleton forms to remain non-executing and non-reviewable.
+4. As a Windows user, I want `.exe` and `.cmd` launchers to receive the same protection as native executable names.
+5. As an administrator using profiles, projects, subscriptions, regions, configurations, output flags, or future global options, I want argument placement not to bypass protection.
+6. As a maintainer, I want every operation added through a declarative matrix with exact count, uniqueness, positive, safe, compound-command, and quoted-data regression coverage.
+
+## Functional requirements
+
+### FR-1 Declarative operation matrices
+
+Provider command paths must live in typed immutable tuples. Each path must contain only canonical subcommand tokens. Builders must translate matrix entries into structured executable matchers.
+
+### FR-2 Existing rule ownership
+
+All 400 operations must remain owned by the existing provider rule IDs and action classes. This avoids permission migration, policy drift, receipt incompatibility, and catalog-identity churn.
+
+### FR-3 AWS behavior
+
+AWS operations must:
+
+- Match `aws`, `aws.exe`, and `aws.cmd`.
+- Tolerate documented global options before or within the service and operation path.
+- Fail secure when an unknown future global option precedes a recognizable destructive operation.
+- Keep `--help` and valid `--generate-cli-skeleton` values safe.
+- Keep EC2 `--dry-run` safety scoped to EC2 termination only.
+- Reject disabled or invalid safe forms when the final effective option re-enables execution.
+
+### FR-4 Google Cloud behavior
+
+Google Cloud operations must:
+
+- Match `gcloud`, `gcloud.exe`, and `gcloud.cmd`.
+- Cover stable command paths and conservative alpha and beta track forms.
+- Tolerate documented project, account, configuration, impersonation, output, filtering, pagination, verbosity, and quiet options.
+- Fail secure around unknown future global options.
+- Keep `--help` safe without hiding a later destructive shell segment.
+
+### FR-5 Azure behavior
+
+Azure operations must:
+
+- Match `az`, `az.exe`, and `az.cmd`.
+- Tolerate subscription, query, output, compact output, debug, error-only, and verbose global forms.
+- Fail secure around unknown future global options.
+- Keep both `--help` and documented `-h` safe.
+- Prevent a safe first segment from suppressing a later destructive segment.
+
+### FR-6 False-positive boundaries
+
+The implementation must not review:
+
+- A command path inside `printf`, `echo`, documentation text, or a grep pattern.
+- A provider help form owned by the expanded rule.
+- A valid AWS request-skeleton form.
+- Existing read-only describe, show, list, and inspection commands.
+
+### FR-7 Runtime parity
+
+Every positive operation fixture must reach:
+
+- `inspect_command` with status `review`.
+- The expected provider action class.
+- The expected provider rule in rule evidence.
+- The expected controlling rule.
+- Runtime `extract_sensitive_tool_action_request`.
+
+### FR-8 Delivery boundaries
+
+Each pull request must close exactly 100 checklist tasks and remain independently testable:
+
+1. AWS core and high-frequency services.
+2. Google Cloud.
+3. Azure.
+4. AWS long-tail, AI, backup, and account services.
+
+## Security invariants
+
+- Match canonical executable and argument structure, never raw command substrings.
+- A safe variant applies only to the segment and rule it actually matches.
+- Unknown options cannot shift the recognized destructive path into an allow decision.
+- Provider-global options may be interspersed without changing destructive intent.
+- Duplicated inverse or safe options are evaluated conservatively according to effective argument order.
+- Compound shell commands retain all destructive matches after safe-segment filtering.
+- No cloud credential, resource identifier, API call, or live deletion is required by tests.
+
+## Data validation
+
+AWS operation names are checked against the installed Botocore service models used by the implementation research. Google Cloud and Azure paths are checked against their current official CLI references. Matrix tests also enforce exact batch counts and uniqueness to prevent accidental omission or duplication.
+
+## Test strategy
+
+Each batch adds a focused regression suite with:
+
+- 100 base positive operation cases.
+- Safe help cases for every path.
+- AWS request-skeleton cases for every AWS path.
+- Representative global-option placement cases.
+- Native Windows launcher cases.
+- Unknown future global-option cases.
+- Disabled-safe-form adversarial cases.
+- Compound-command isolation cases.
+- Quoted-example and source-search negative cases.
+- Exact count and uniqueness assertions.
+
+Repository CI remains the final integration gate. Every pull request must also receive an independent adversarial diff review, review-thread reconciliation, and successful required checks before merge.
+
+## Observability and maintenance
+
+The provider extension metadata and coverage documentation must state that coverage is matrix-driven. Future additions should append exact operation paths, extend positive and safe fixtures, preserve existing action classes unless a materially different risk exists, and land in bounded batches with count and uniqueness assertions.
+
+## Acceptance criteria
+
+1. Exactly 400 checklist tasks are complete.
+2. The AWS matrix contains 200 unique paths.
+3. The Google Cloud matrix contains 100 unique paths.
+4. The Azure matrix contains 100 unique paths.
+5. All paths feed both inspection and runtime review through existing provider action classes.
+6. Help and AWS request-skeleton safe forms remain safe.
+7. Windows launcher and provider-global option variants are covered.
+8. Quoted examples remain data.
+9. Existing rule IDs, permissions, and policy modes remain stable.
+10. All required CI checks pass and all review threads are resolved before each merge.
+
+## Primary references
+
+- AWS CLI command reference: https://docs.aws.amazon.com/cli/latest/reference/
+- Google Cloud CLI reference: https://cloud.google.com/sdk/gcloud/reference
+- Azure CLI reference: https://learn.microsoft.com/cli/azure/reference-index

plugin_scanner-3.0.0a251/docs/guard/command-extension-operation-matrix-todo.md

@@ -0,0 +1,422 @@
+# TODO: Command Extension Operation Matrix Expansion
+
+Target branch: `release/3.0`
+
+Each numbered line is one operation task. Completion requires the exact path in the typed provider matrix plus batch-level positive, runtime, safe-form, global-option, Windows-launcher, compound-command, and quoted-data regression coverage.
+
+## Progress
+
+- Completed batches: 1/4
+- Completed operation tasks: 100/400
+
+## Batch 1: AWS core and high-frequency services
+
+- [x] 001. `aws acm delete-certificate`
+- [x] 002. `aws acm-pca delete-certificate-authority`
+- [x] 003. `aws amplify delete-app`
+- [x] 004. `aws amplify delete-backend-environment`
+- [x] 005. `aws amplify delete-branch`
+- [x] 006. `aws amplify delete-domain-association`
+- [x] 007. `aws apigateway delete-api-key`
+- [x] 008. `aws apigateway delete-authorizer`
+- [x] 009. `aws apigateway delete-base-path-mapping`
+- [x] 010. `aws apigateway delete-client-certificate`
+- [x] 011. `aws apigateway delete-deployment`
+- [x] 012. `aws apigateway delete-documentation-part`
+- [x] 013. `aws apigateway delete-documentation-version`
+- [x] 014. `aws apigateway delete-domain-name`
+- [x] 015. `aws apigateway delete-gateway-response`
+- [x] 016. `aws apigateway delete-integration`
+- [x] 017. `aws apigateway delete-integration-response`
+- [x] 018. `aws apigateway delete-method`
+- [x] 019. `aws apigateway delete-method-response`
+- [x] 020. `aws apigateway delete-model`
+- [x] 021. `aws apigateway delete-request-validator`
+- [x] 022. `aws apigateway delete-resource`
+- [x] 023. `aws apigateway delete-stage`
+- [x] 024. `aws apigateway delete-usage-plan`
+- [x] 025. `aws apigateway delete-usage-plan-key`
+- [x] 026. `aws apigateway delete-vpc-link`
+- [x] 027. `aws apigatewayv2 delete-api-mapping`
+- [x] 028. `aws apigatewayv2 delete-authorizer`
+- [x] 029. `aws apigatewayv2 delete-deployment`
+- [x] 030. `aws apigatewayv2 delete-domain-name`
+- [x] 031. `aws apigatewayv2 delete-integration`
+- [x] 032. `aws apigatewayv2 delete-integration-response`
+- [x] 033. `aws apigatewayv2 delete-model`
+- [x] 034. `aws apigatewayv2 delete-route`
+- [x] 035. `aws apigatewayv2 delete-route-response`
+- [x] 036. `aws apigatewayv2 delete-stage`
+- [x] 037. `aws apigatewayv2 delete-vpc-link`
+- [x] 038. `aws appconfig delete-application`
+- [x] 039. `aws appconfig delete-configuration-profile`
+- [x] 040. `aws appconfig delete-deployment-strategy`
+- [x] 041. `aws appconfig delete-environment`
+- [x] 042. `aws appsync delete-api-cache`
+- [x] 043. `aws appsync delete-api-key`
+- [x] 044. `aws appsync delete-data-source`
+- [x] 045. `aws appsync delete-domain-name`
+- [x] 046. `aws appsync delete-function`
+- [x] 047. `aws appsync delete-graphql-api`
+- [x] 048. `aws appsync delete-resolver`
+- [x] 049. `aws appsync delete-type`
+- [x] 050. `aws autoscaling delete-auto-scaling-group`
+- [x] 051. `aws autoscaling delete-launch-configuration`
+- [x] 052. `aws autoscaling delete-lifecycle-hook`
+- [x] 053. `aws autoscaling delete-notification-configuration`
+- [x] 054. `aws autoscaling delete-policy`
+- [x] 055. `aws autoscaling delete-scheduled-action`
+- [x] 056. `aws autoscaling delete-warm-pool`
+- [x] 057. `aws backup delete-backup-plan`
+- [x] 058. `aws backup delete-backup-selection`
+- [x] 059. `aws backup delete-backup-vault`
+- [x] 060. `aws backup delete-framework`
+- [x] 061. `aws backup delete-recovery-point`
+- [x] 062. `aws backup delete-report-plan`
+- [x] 063. `aws backup delete-restore-testing-plan`
+- [x] 064. `aws batch delete-compute-environment`
+- [x] 065. `aws batch delete-job-queue`
+- [x] 066. `aws batch delete-scheduling-policy`
+- [x] 067. `aws cloudformation delete-change-set`
+- [x] 068. `aws cloudformation delete-generated-template`
+- [x] 069. `aws cloudformation delete-stack`
+- [x] 070. `aws cloudformation delete-stack-instances`
+- [x] 071. `aws cloudformation delete-stack-set`
+- [x] 072. `aws cloudfront delete-cache-policy`
+- [x] 073. `aws cloudfront delete-cloud-front-origin-access-identity`
+- [x] 074. `aws cloudfront delete-continuous-deployment-policy`
+- [x] 075. `aws cloudfront delete-field-level-encryption-config`
+- [x] 076. `aws cloudfront delete-field-level-encryption-profile`
+- [x] 077. `aws cloudfront delete-function`
+- [x] 078. `aws cloudfront delete-key-group`
+- [x] 079. `aws cloudfront delete-origin-access-control`
+- [x] 080. `aws cloudfront delete-origin-request-policy`
+- [x] 081. `aws cloudfront delete-public-key`
+- [x] 082. `aws cloudfront delete-realtime-log-config`
+- [x] 083. `aws cloudfront delete-response-headers-policy`
+- [x] 084. `aws cloudfront delete-streaming-distribution`
+- [x] 085. `aws codebuild delete-fleet`
+- [x] 086. `aws codebuild delete-project`
+- [x] 087. `aws codebuild delete-report-group`
+- [x] 088. `aws codebuild delete-source-credentials`
+- [x] 089. `aws codecommit delete-approval-rule-template`
+- [x] 090. `aws codecommit delete-branch`
+- [x] 091. `aws codecommit delete-repository`
+- [x] 092. `aws codedeploy delete-application`
+- [x] 093. `aws codedeploy delete-deployment-config`
+- [x] 094. `aws codedeploy delete-deployment-group`
+- [x] 095. `aws codepipeline delete-custom-action-type`
+- [x] 096. `aws codepipeline delete-pipeline`
+- [x] 097. `aws codepipeline delete-webhook`
+- [x] 098. `aws cognito-identity delete-identity-pool`
+- [x] 099. `aws cognito-idp delete-group`
+- [x] 100. `aws cognito-idp delete-identity-provider`
+
+## Batch 2: Google Cloud resource deletion
+
+- [ ] 101. `gcloud projects delete`
+- [ ] 102. `gcloud resource-manager folders delete`
+- [ ] 103. `gcloud resource-manager tags keys delete`
+- [ ] 104. `gcloud resource-manager tags values delete`
+- [ ] 105. `gcloud iam service-accounts delete`
+- [ ] 106. `gcloud iam service-accounts keys delete`
+- [ ] 107. `gcloud iam roles delete`
+- [ ] 108. `gcloud compute disks delete`
+- [ ] 109. `gcloud compute snapshots delete`
+- [ ] 110. `gcloud compute images delete`
+- [ ] 111. `gcloud compute networks delete`
+- [ ] 112. `gcloud compute networks subnets delete`
+- [ ] 113. `gcloud compute firewall-rules delete`
+- [ ] 114. `gcloud compute routes delete`
+- [ ] 115. `gcloud compute addresses delete`
+- [ ] 116. `gcloud compute backend-services delete`
+- [ ] 117. `gcloud compute backend-buckets delete`
+- [ ] 118. `gcloud compute target-http-proxies delete`
+- [ ] 119. `gcloud compute target-https-proxies delete`
+- [ ] 120. `gcloud compute target-pools delete`
+- [ ] 121. `gcloud compute target-ssl-proxies delete`
+- [ ] 122. `gcloud compute target-tcp-proxies delete`
+- [ ] 123. `gcloud compute url-maps delete`
+- [ ] 124. `gcloud compute health-checks delete`
+- [ ] 125. `gcloud compute http-health-checks delete`
+- [ ] 126. `gcloud compute https-health-checks delete`
+- [ ] 127. `gcloud compute instance-templates delete`
+- [ ] 128. `gcloud compute instance-groups managed delete`
+- [ ] 129. `gcloud compute routers delete`
+- [ ] 130. `gcloud compute vpn-gateways delete`
+- [ ] 131. `gcloud compute vpn-tunnels delete`
+- [ ] 132. `gcloud compute interconnects delete`
+- [ ] 133. `gcloud compute ssl-certificates delete`
+- [ ] 134. `gcloud compute security-policies delete`
+- [ ] 135. `gcloud compute network-endpoint-groups delete`
+- [ ] 136. `gcloud compute reservations delete`
+- [ ] 137. `gcloud compute resource-policies delete`
+- [ ] 138. `gcloud compute sole-tenancy node-groups delete`
+- [ ] 139. `gcloud compute sole-tenancy node-templates delete`
+- [ ] 140. `gcloud compute interconnects attachments delete`
+- [ ] 141. `gcloud compute machine-images delete`
+- [ ] 142. `gcloud compute packet-mirrorings delete`
+- [ ] 143. `gcloud compute service-attachments delete`
+- [ ] 144. `gcloud compute instant-snapshots delete`
+- [ ] 145. `gcloud compute composite-health-checks delete`
+- [ ] 146. `gcloud container clusters delete`
+- [ ] 147. `gcloud container node-pools delete`
+- [ ] 148. `gcloud run services delete`
+- [ ] 149. `gcloud run jobs delete`
+- [ ] 150. `gcloud functions delete`
+- [ ] 151. `gcloud app services delete`
+- [ ] 152. `gcloud app versions delete`
+- [ ] 153. `gcloud artifacts repositories delete`
+- [ ] 154. `gcloud artifacts docker images delete`
+- [ ] 155. `gcloud artifacts files delete`
+- [ ] 156. `gcloud artifacts packages delete`
+- [ ] 157. `gcloud artifacts versions delete`
+- [ ] 158. `gcloud pubsub topics delete`
+- [ ] 159. `gcloud pubsub subscriptions delete`
+- [ ] 160. `gcloud pubsub schemas delete`
+- [ ] 161. `gcloud pubsub snapshots delete`
+- [ ] 162. `gcloud secrets delete`
+- [ ] 163. `gcloud secrets versions destroy`
+- [ ] 164. `gcloud scheduler jobs delete`
+- [ ] 165. `gcloud tasks queues delete`
+- [ ] 166. `gcloud tasks delete`
+- [ ] 167. `gcloud workflows delete`
+- [ ] 168. `gcloud deployment-manager deployments delete`
+- [ ] 169. `gcloud dataproc clusters delete`
+- [ ] 170. `gcloud bigtable instances delete`
+- [ ] 171. `gcloud bigtable clusters delete`
+- [ ] 172. `gcloud bigtable app-profiles delete`
+- [ ] 173. `gcloud bigtable backups delete`
+- [ ] 174. `gcloud bigtable tables delete`
+- [ ] 175. `gcloud spanner instances delete`
+- [ ] 176. `gcloud spanner databases delete`
+- [ ] 177. `gcloud spanner backups delete`
+- [ ] 178. `gcloud spanner instance-configs delete`
+- [ ] 179. `gcloud redis instances delete`
+- [ ] 180. `gcloud memcache instances delete`
+- [ ] 181. `gcloud alloydb clusters delete`
+- [ ] 182. `gcloud alloydb instances delete`
+- [ ] 183. `gcloud alloydb backups delete`
+- [ ] 184. `gcloud composer environments delete`
+- [ ] 185. `gcloud service-directory namespaces delete`
+- [ ] 186. `gcloud service-directory services delete`
+- [ ] 187. `gcloud service-directory endpoints delete`
+- [ ] 188. `gcloud network-services gateways delete`
+- [ ] 189. `gcloud network-services meshes delete`
+- [ ] 190. `gcloud network-services service-bindings delete`
+- [ ] 191. `gcloud network-services endpoint-policies delete`
+- [ ] 192. `gcloud network-services grpc-routes delete`
+- [ ] 193. `gcloud network-services http-routes delete`
+- [ ] 194. `gcloud network-services tcp-routes delete`
+- [ ] 195. `gcloud network-services tls-routes delete`
+- [ ] 196. `gcloud network-connectivity hubs delete`
+- [ ] 197. `gcloud network-connectivity spokes delete`
+- [ ] 198. `gcloud builds triggers delete`
+- [ ] 199. `gcloud builds worker-pools delete`
+- [ ] 200. `gcloud source repos delete`
+
+## Batch 3: Azure resource deletion
+
+- [ ] 201. `az group delete`
+- [ ] 202. `az deployment group delete`
+- [ ] 203. `az deployment sub delete`
+- [ ] 204. `az deployment tenant delete`
+- [ ] 205. `az deployment mg delete`
+- [ ] 206. `az deployment-scripts delete`
+- [ ] 207. `az resource delete`
+- [ ] 208. `az lock delete`
+- [ ] 209. `az role assignment delete`
+- [ ] 210. `az role definition delete`
+- [ ] 211. `az policy assignment delete`
+- [ ] 212. `az policy definition delete`
+- [ ] 213. `az policy exemption delete`
+- [ ] 214. `az identity delete`
+- [ ] 215. `az ad app delete`
+- [ ] 216. `az ad sp delete`
+- [ ] 217. `az ad user delete`
+- [ ] 218. `az ad group delete`
+- [ ] 219. `az network vnet delete`
+- [ ] 220. `az network vnet subnet delete`
+- [ ] 221. `az network nsg delete`
+- [ ] 222. `az network public-ip delete`
+- [ ] 223. `az network nic delete`
+- [ ] 224. `az network route-table delete`
+- [ ] 225. `az network vnet-gateway delete`
+- [ ] 226. `az network vpn-connection delete`
+- [ ] 227. `az network application-gateway delete`
+- [ ] 228. `az network bastion delete`
+- [ ] 229. `az network firewall delete`
+- [ ] 230. `az network private-endpoint delete`
+- [ ] 231. `az network private-link-service delete`
+- [ ] 232. `az network traffic-manager profile delete`
+- [ ] 233. `az network front-door delete`
+- [ ] 234. `az network private-dns zone delete`
+- [ ] 235. `az network watcher connection-monitor delete`
+- [ ] 236. `az network watcher flow-log delete`
+- [ ] 237. `az network watcher packet-capture delete`
+- [ ] 238. `az network cross-region-lb delete`
+- [ ] 239. `az network nat gateway delete`
+- [ ] 240. `az network local-gateway delete`
+- [ ] 241. `az network express-route delete`
+- [ ] 242. `az network express-route port delete`
+- [ ] 243. `az dns-resolver delete`
+- [ ] 244. `az aks delete`
+- [ ] 245. `az container delete`
+- [ ] 246. `az containerapp delete`
+- [ ] 247. `az acr delete`
+- [ ] 248. `az vmss delete`
+- [ ] 249. `az disk delete`
+- [ ] 250. `az disk-access delete`
+- [ ] 251. `az disk-encryption-set delete`
+- [ ] 252. `az snapshot delete`
+- [ ] 253. `az image delete`
+- [ ] 254. `az sig delete`
+- [ ] 255. `az sig image-definition delete`
+- [ ] 256. `az sig image-version delete`
+- [ ] 257. `az capacity reservation group delete`
+- [ ] 258. `az vm host group delete`
+- [ ] 259. `az vm host delete`
+- [ ] 260. `az ppg delete`
+- [ ] 261. `az webapp delete`
+- [ ] 262. `az functionapp delete`
+- [ ] 263. `az appservice plan delete`
+- [ ] 264. `az staticwebapp delete`
+- [ ] 265. `az spring app delete`
+- [ ] 266. `az spring delete`
+- [ ] 267. `az postgres flexible-server delete`
+- [ ] 268. `az mysql flexible-server delete`
+- [ ] 269. `az sql server delete`
+- [ ] 270. `az sql db delete`
+- [ ] 271. `az sql mi delete`
+- [ ] 272. `az cosmosdb delete`
+- [ ] 273. `az redis delete`
+- [ ] 274. `az managed-cassandra cluster delete`
+- [ ] 275. `az storage account delete`
+- [ ] 276. `az storage share delete`
+- [ ] 277. `az storage queue delete`
+- [ ] 278. `az storage table delete`
+- [ ] 279. `az servicebus namespace delete`
+- [ ] 280. `az servicebus queue delete`
+- [ ] 281. `az servicebus topic delete`
+- [ ] 282. `az eventhubs namespace delete`
+- [ ] 283. `az eventhubs eventhub delete`
+- [ ] 284. `az keyvault delete`
+- [ ] 285. `az keyvault key delete`
+- [ ] 286. `az keyvault secret delete`
+- [ ] 287. `az keyvault certificate delete`
+- [ ] 288. `az monitor log-analytics workspace delete`
+- [ ] 289. `az monitor diagnostic-settings delete`
+- [ ] 290. `az monitor action-group delete`
+- [ ] 291. `az monitor autoscale delete`
+- [ ] 292. `az apim api delete`
+- [ ] 293. `az apim product delete`
+- [ ] 294. `az apim subscription delete`
+- [ ] 295. `az datafactory delete`
+- [ ] 296. `az synapse workspace delete`
+- [ ] 297. `az databricks workspace delete`
+- [ ] 298. `az search service delete`
+- [ ] 299. `az cognitiveservices account delete`
+- [ ] 300. `az bot delete`
+
+## Batch 4: AWS long-tail, AI, backup, and account services
+
+- [ ] 301. `aws accessanalyzer delete-analyzer`
+- [ ] 302. `aws accessanalyzer delete-archive-rule`
+- [ ] 303. `aws accessanalyzer delete-service-linked-analyzer`
+- [ ] 304. `aws account delete-alternate-contact`
+- [ ] 305. `aws acm-pca delete-permission`
+- [ ] 306. `aws acm-pca delete-policy`
+- [ ] 307. `aws amp delete-alert-manager-definition`
+- [ ] 308. `aws amp delete-anomaly-detector`
+- [ ] 309. `aws amp delete-logging-configuration`
+- [ ] 310. `aws amp delete-query-logging-configuration`
+- [ ] 311. `aws amp delete-resource-policy`
+- [ ] 312. `aws amp delete-rule-groups-namespace`
+- [ ] 313. `aws amp delete-scraper`
+- [ ] 314. `aws amp delete-scraper-logging-configuration`
+- [ ] 315. `aws amp delete-workspace`
+- [ ] 316. `aws appconfig delete-extension`
+- [ ] 317. `aws appconfig delete-extension-association`
+- [ ] 318. `aws appconfig delete-hosted-configuration-version`
+- [ ] 319. `aws appflow delete-connector-profile`
+- [ ] 320. `aws appflow delete-flow`
+- [ ] 321. `aws apprunner delete-auto-scaling-configuration`
+- [ ] 322. `aws apprunner delete-connection`
+- [ ] 323. `aws apprunner delete-observability-configuration`
+- [ ] 324. `aws apprunner delete-service`
+- [ ] 325. `aws apprunner delete-vpc-connector`
+- [ ] 326. `aws apprunner delete-vpc-ingress-connection`
+- [ ] 327. `aws appstream delete-app-block`
+- [ ] 328. `aws appstream delete-app-block-builder`
+- [ ] 329. `aws appstream delete-application`
+- [ ] 330. `aws appstream delete-directory-config`
+- [ ] 331. `aws appstream delete-entitlement`
+- [ ] 332. `aws appstream delete-fleet`
+- [ ] 333. `aws appstream delete-image`
+- [ ] 334. `aws appstream delete-image-builder`
+- [ ] 335. `aws appstream delete-image-permissions`
+- [ ] 336. `aws appstream delete-stack`
+- [ ] 337. `aws appstream delete-theme-for-stack`
+- [ ] 338. `aws appstream delete-usage-report-subscription`
+- [ ] 339. `aws appstream delete-user`
+- [ ] 340. `aws athena delete-capacity-reservation`
+- [ ] 341. `aws athena delete-data-catalog`
+- [ ] 342. `aws athena delete-named-query`
+- [ ] 343. `aws athena delete-notebook`
+- [ ] 344. `aws athena delete-prepared-statement`
+- [ ] 345. `aws athena delete-work-group`
+- [ ] 346. `aws athena terminate-session`
+- [ ] 347. `aws auditmanager delete-assessment`
+- [ ] 348. `aws auditmanager delete-assessment-framework`
+- [ ] 349. `aws auditmanager delete-assessment-framework-share`
+- [ ] 350. `aws auditmanager delete-assessment-report`
+- [ ] 351. `aws auditmanager delete-control`
+- [ ] 352. `aws autoscaling-plans delete-scaling-plan`
+- [ ] 353. `aws backup-gateway delete-gateway`
+- [ ] 354. `aws backup-gateway delete-hypervisor`
+- [ ] 355. `aws batch delete-consumable-resource`
+- [ ] 356. `aws batch delete-quota-share`
+- [ ] 357. `aws batch delete-service-environment`
+- [ ] 358. `aws batch terminate-job`
+- [ ] 359. `aws batch terminate-service-job`
+- [ ] 360. `aws bedrock delete-custom-model`
+- [ ] 361. `aws bedrock delete-custom-model-deployment`
+- [ ] 362. `aws bedrock delete-enforced-guardrail-configuration`
+- [ ] 363. `aws bedrock delete-foundation-model-agreement`
+- [ ] 364. `aws bedrock delete-guardrail`
+- [ ] 365. `aws bedrock delete-imported-model`
+- [ ] 366. `aws bedrock delete-inference-profile`
+- [ ] 367. `aws bedrock delete-marketplace-model-endpoint`
+- [ ] 368. `aws bedrock delete-model-invocation-logging-configuration`
+- [ ] 369. `aws bedrock delete-prompt-router`
+- [ ] 370. `aws bedrock delete-provisioned-model-throughput`
+- [ ] 371. `aws bedrock delete-resource-policy`
+- [ ] 372. `aws bedrock-agent delete-agent`
+- [ ] 373. `aws bedrock-agent delete-agent-action-group`
+- [ ] 374. `aws bedrock-agent delete-agent-alias`
+- [ ] 375. `aws bedrock-agent delete-agent-version`
+- [ ] 376. `aws bedrock-agent delete-data-source`
+- [ ] 377. `aws bedrock-agent delete-flow`
+- [ ] 378. `aws bedrock-agent delete-flow-alias`
+- [ ] 379. `aws bedrock-agent delete-flow-version`
+- [ ] 380. `aws bedrock-agent delete-knowledge-base`
+- [ ] 381. `aws bedrock-agent delete-knowledge-base-documents`
+- [ ] 382. `aws bedrock-agent delete-prompt`
+- [ ] 383. `aws budgets delete-budget`
+- [ ] 384. `aws budgets delete-budget-action`
+- [ ] 385. `aws budgets delete-notification`
+- [ ] 386. `aws budgets delete-subscriber`
+- [ ] 387. `aws ce delete-anomaly-monitor`
+- [ ] 388. `aws ce delete-anomaly-subscription`
+- [ ] 389. `aws ce delete-cost-category-definition`
+- [ ] 390. `aws chime delete-account`
+- [ ] 391. `aws chime delete-events-configuration`
+- [ ] 392. `aws chime delete-phone-number`
+- [ ] 393. `aws chime delete-room`
+- [ ] 394. `aws chime delete-room-membership`
+- [ ] 395. `aws cloud9 delete-environment`
+- [ ] 396. `aws cloud9 delete-environment-membership`
+- [ ] 397. `aws cloudcontrol delete-resource`
+- [ ] 398. `aws cloudhsmv2 delete-backup`
+- [ ] 399. `aws cloudhsmv2 delete-hsm`
+- [ ] 400. `aws cloudhsmv2 delete-resource-policy`