net-connector 0.5.0 → 0.7.0

data/lib/net/connector/netdisco/report/files.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "text"
+
+module Net
+  module Connector
+    module Netdisco
+      class Report
+        # 示例与批次入口共享唯一摘要结构；保存结果先于终端成功提示。
+        class Files
+          def self.write(report, directory:, plan:, concurrency:)
+            destination = File.join(directory, "summary.json")
+            finalized = report.with(report_location: destination)
+            Text.write(directory: directory, report: finalized, plan: plan, concurrency: concurrency)
+            Storage::PrivateFile.write(destination, JSON.pretty_generate(finalized.summary))
+            finalized
+          rescue StandardError => error
+            location = if Storage::PrivateFile.receipt_error?(error) && error.receipt.committed? && error.receipt.path == destination
+                         destination
+                       end
+            failed = report.with_report_error(error, location: location)
+            begin
+              saved = failed.with(report_location: destination)
+              Storage::PrivateFile.write(destination, JSON.pretty_generate(saved.summary))
+              failed = saved
+            rescue StandardError
+              # JSON 仍无法保存时，返回带有已知提交位置的失败报告。
+            end
+            begin
+              Text.write(directory: directory, report: failed, plan: plan, concurrency: concurrency)
+            rescue StandardError
+              # 文本输出不能覆盖首次保存失败。
+            end
+            failed
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/netdisco/report/text.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "../../storage/private_file"
+require_relative "../report"
+
+module Net
+  module Connector
+    module Netdisco
+      class Report
+        # 将批次结果写为人类可读的文本摘要。
+        class Text
+          def self.write(directory:, report:, plan:, concurrency:)
+            summary = report.summary
+            failed = report.outcomes.reject { |item| item.success? || %i[filtered sample_limit].include?(item.status) }
+            groups = failed.group_by { |item| item.error_code || item.status }
+            lines = ["网络设备备份报告", "=" * 72,
+                     "开始时间：#{report.started_at.getlocal("+08:00").strftime("%Y-%m-%d %H:%M:%S %:z")}",
+                     "结束时间：#{report.finished_at.getlocal("+08:00").strftime("%Y-%m-%d %H:%M:%S %:z")}",
+                     "清单：#{plan.inventory.size} 台；本次：#{plan.ready.size} 台；并发：#{concurrency}",
+                     "成功：#{summary[:succeeded]}；部分成功：#{summary[:partial]}；失败：#{summary[:failed]}；跳过：#{summary[:skipped]}",
+                     "耗时：#{(report.duration_ms.to_f / 1000).round(1)} 秒；批次状态：#{summary[:status]}",
+                     "成功策略：#{report.policy}；策略通过：#{report.policy_success?}",
+                     "回调异常：#{report.callback_errors.size}；报告错误：#{report.report_error || "无"}",
+                     "状态计数：#{report.counts.map { |key, value| "#{key}=#{value}" }.join("，")}",
+                     "未完成分类：#{groups.empty? ? "无" : groups.map { |key, items| "#{key}=#{items.size}" }.join("，")}",
+                     "-" * 72, "未完成设备："]
+            lines.concat(failure_lines(failed))
+            lines << "无" if failed.empty?
+            lines << "TFTP 成功仅表示设备报告上传完成；服务器文件核验结果请查看 summary.json。" if report.mode == :tftp
+            lines += ["=" * 72, "备份目录：#{directory}", "完整明细：#{File.join(directory, "summary.json")}"]
+            Net::Connector::Storage::PrivateFile.write(File.join(directory, "summary.txt"), lines.join("\n") + "\n")
+          end
+
+          def self.failure_lines(failed)
+            failed.map do |item|
+              label = item.device.name.to_s.gsub(/[[:cntrl:]]/, " ")
+              "#{item.device.host} | #{label} | #{item.status} | #{item.error_code || "无错误码"} | #{item.duration_ms} ms"
+            end
+          end
+          private_class_method :failure_lines
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/netdisco/report.rb

@@ -9,21 +9,21 @@ module Net
       # 唯一的批量报告契约，分开呈现成功策略、清单覆盖和受控诊断。
       class Report
         extend Forwardable
-        SUCCESS = %i[backed_up reported_uploaded].freeze
-        ATTEMPTED = [*SUCCESS, :failed, :saved_with_error, :reported_with_error].freeze
-        IGNORABLE = %i[filtered sample_limit].freeze
-        private_constant :SUCCESS, :ATTEMPTED, :IGNORABLE
+        SUCCESS_STATUSES = %i[backed_up reported_uploaded].freeze
+        ATTEMPTED_STATUSES = [*SUCCESS_STATUSES, :failed, :saved_with_error, :reported_with_error].freeze
+        IGNORABLE_STATUSES = %i[filtered sample_limit].freeze
+        private_constant :SUCCESS_STATUSES, :ATTEMPTED_STATUSES, :IGNORABLE_STATUSES
 
-        attr_reader :batch, :policy, :duration_ms, :report_diagnostic
+        attr_reader :batch, :policy, :duration_ms, :report_diagnostic, :log_directory
         def_delegators :@batch, *Batch.members, :success?, :status, :counts
 
         def self.validate_policy!(policy)
-          raise ArgumentError, "success_policy must be strict or selected" unless %i[strict selected].include?(policy)
+          raise ArgumentError, "success_policy must be strict, selected or verified" unless %i[strict selected verified].include?(policy)
 
           policy
         end
 
-        def initialize(batch, policy: :strict, duration_ms: nil, report_diagnostic: nil)
+        def initialize(batch, policy: :strict, duration_ms: nil, report_diagnostic: nil, log_directory: nil)
           self.class.validate_policy!(policy)
           raise ArgumentError, "report requires a Batch" unless batch.instance_of?(Batch)
           unless duration_ms.nil? || (duration_ms.is_a?(Numeric) && duration_ms.real? && duration_ms.finite? && duration_ms >= 0)
@@ -33,6 +33,8 @@ module Net
             raise ArgumentError, "report_diagnostic must be a Diagnostic"
           end
 
+          raise ArgumentError, "verified policy requires TFTP mode" if policy == :verified && batch.mode != :tftp
+          @log_directory = log_directory&.dup&.freeze
           @batch, @policy, @duration_ms, @report_diagnostic = batch, policy, duration_ms, report_diagnostic
           freeze
         end
@@ -42,32 +44,36 @@ module Net
           return batch.success? if policy == :strict
           return false unless callback_errors.empty? && report_error.nil?
 
-          outcomes.any? { |item| SUCCESS.include?(item.status) } &&
-            outcomes.all? { |item| SUCCESS.include?(item.status) || IGNORABLE.include?(item.status) }
+          return false if policy == :verified && outcomes.any? { |outcome| outcome.success? && !server_verified?(outcome) }
+
+          outcomes.any? { |outcome| SUCCESS_STATUSES.include?(outcome.status) } &&
+            outcomes.all? { |outcome| SUCCESS_STATUSES.include?(outcome.status) || IGNORABLE_STATUSES.include?(outcome.status) }
         end
 
         def with(**attributes)
           self.class.new(batch.with(**attributes), policy: policy, duration_ms: duration_ms,
-                          report_diagnostic: report_diagnostic)
+                          report_diagnostic: report_diagnostic, log_directory: log_directory)
         end
 
         def with_report_error(error, location: nil)
           diagnostic = Diagnostic.from(error, phase: :report)
           self.class.new(batch.with(report_location: location, report_error: diagnostic.error_type),
-                          policy: policy, duration_ms: duration_ms, report_diagnostic: diagnostic)
+                          policy: policy, duration_ms: duration_ms, report_diagnostic: diagnostic, log_directory: log_directory)
         end
 
         # 手工构造的批次同样经过诊断白名单，不序列化任意异常内容。
         def summary
-          data = batch_summary
-          data.merge(
+          batch_data = batch_summary
+          batch_data.merge(
             schema_version: 2, policy: policy, policy_success: policy_success?, duration_ms: duration_ms,
-            coverage: { complete: !outcomes.empty? && outcomes.all? { |item| ATTEMPTED.include?(item.status) },
-                        attempted: outcomes.count { |item| ATTEMPTED.include?(item.status) },
-                        skipped: outcomes.count { |item| !ATTEMPTED.include?(item.status) } },
-            devices: device_summaries(data.fetch(:devices)),
+            coverage: { complete: !outcomes.empty? && outcomes.all? { |outcome| ATTEMPTED_STATUSES.include?(outcome.status) },
+                        attempted: outcomes.count { |outcome| ATTEMPTED_STATUSES.include?(outcome.status) },
+                        skipped: outcomes.count { |outcome| !ATTEMPTED_STATUSES.include?(outcome.status) } },
+            devices: device_summaries(batch_data.fetch(:devices)),
             callback_errors: callback_errors.map { |entry| { host: entry[:host], error_type: ErrorMetadata.type(entry[:error_type]) } },
             report_location: report_location, report_error: ErrorMetadata.type(report_error),
+            verification: mode == :tftp ? { verified: outcomes.count { |outcome| server_verified?(outcome) },
+                                            unverified: outcomes.count { |outcome| outcome.backup.is_a?(TftpReceipt) && !server_verified?(outcome) } } : nil,
             report_diagnostic: report_diagnostic&.to_h
           )
         end
@@ -83,28 +89,44 @@ module Net
             total: outcomes.size,
             succeeded: outcomes.count(&:success?),
             partial: outcomes.count(&:partial?),
-            failed: outcomes.count { |item| item.status == :failed },
+            failed: outcomes.count { |outcome| outcome.status == :failed },
             skipped: outcomes.count(&:skipped?),
             counts: counts,
             callback_errors: callback_errors,
-            devices: outcomes.map do |item|
-              { host: item.device.host || item.device.source_ip, name: item.device.name,
-                vendor: item.device.vendor,
-                status: item.status, path: item.backup&.path,
-                bytes: item.backup.is_a?(Backup) ? item.backup.bytes : nil,
-                sha256: item.backup.is_a?(Backup) ? item.backup.sha256 : nil,
-                change: item.backup.is_a?(Backup) ? item.backup.change : nil,
-                previous_sha256: item.backup.is_a?(Backup) ? item.backup.previous_sha256 : nil,
-                started_at: item.started_at&.iso8601, finished_at: item.finished_at&.iso8601,
-                duration_ms: item.duration_ms,
-                error_code: item.error_code, error_type: item.error_type }
+            devices: outcomes.map do |outcome|
+              { host: outcome.device.host || outcome.device.source_ip, name: outcome.device.name,
+                vendor: outcome.device.vendor,
+                status: outcome.status, path: outcome.backup&.path,
+                bytes: outcome.backup.is_a?(Backup) ? outcome.backup.bytes : nil,
+                sha256: outcome.backup.is_a?(Backup) ? outcome.backup.sha256 : nil,
+                change: outcome.backup.is_a?(Backup) ? outcome.backup.change : nil,
+                previous_sha256: outcome.backup.is_a?(Backup) ? outcome.backup.previous_sha256 : nil,
+                started_at: outcome.started_at&.iso8601, finished_at: outcome.finished_at&.iso8601,
+                duration_ms: outcome.duration_ms,
+                error_code: outcome.error_code, error_type: outcome.error_type }
             end
           }
         end
 
+        def server_verified?(outcome)
+          outcome.backup.is_a?(TftpReceipt) && outcome.backup.verification == :server_verified
+        end
+
+        def tftp_summary(outcome)
+          receipt = outcome.backup if outcome.backup.is_a?(TftpReceipt)
+          { remote_path: receipt&.path, server: receipt&.server,
+            configuration_kind: receipt&.configuration_kind, source_file: receipt&.source_file,
+            format: receipt&.format, verification: receipt&.verification,
+            server_file_verified: server_verified?(outcome), server_sha256: receipt&.server_sha256,
+            local_file: receipt&.local_path, server_archive_file: receipt&.archive_path,
+            bytes: receipt&.server_bytes, sha256: receipt&.server_sha256 }
+        end
+
         def device_summaries(entries)
-          entries.zip(outcomes).map do |entry, item|
-            diagnostic = item.diagnostic || Diagnostic.new(error_code: item.error_code, error_type: item.error_type)
+          entries.zip(outcomes).map do |entry, outcome|
+            diagnostic = outcome.diagnostic || Diagnostic.new(error_code: outcome.error_code, error_type: outcome.error_type)
+            entry = entry.merge(tftp_summary(outcome)) if mode == :tftp
+            entry[:session_log] = File.join(log_directory, "#{outcome.device.host.tr(":", "_")}.log") if log_directory && outcome.device.host && outcome.started_at
             entry.merge(error_code: diagnostic.error_code, error_type: diagnostic.error_type,
                         diagnostic: diagnostic.to_h.except(:error_code, :error_type))
           end

data/lib/net/connector/netdisco/result_store.rb

@@ -10,7 +10,7 @@ module Net
     module Netdisco
       module ResultStore
         # 每批保存一份私有 JSON 报告，通过重命名防止半写文件。
-        class Text
+        class Json
           # 以临时文件和重命名原子写入私有 JSON 报告。
           def write(batch, directory:)
             destination = File.expand_path(directory)
@@ -21,6 +21,8 @@ module Net
           end
         end
 
+        Text = Json # Compatibility with the former name of the JSON writer.
+
         # 数据库仓储由调用方提供，可使用 Active Record 或其他对象。
         # 仓储须实现 create!，本项目不负责数据库表结构。
         class Database

data/lib/net/connector/netdisco/rules.rb

@@ -109,11 +109,14 @@ module Net
           return match[:connector] if match
           return @vendor_overrides[label] if @vendor_overrides.key?(label)
 
+          # 厂商标签可能陈旧；仅在操作系统和带品牌型号同时确认时纠正。
+          return h3c_connector(os, model) if os == "comware" && model.match?(/\Ah3c\s+\S/)
+
           case label
-          when /\bh3c\b/ then (os.match?(/wireless|wlan/) || model.match?(/\A(?:wx|ac)\s*\d/)) ? :h3c_wireless : :h3c
+          when /\bh3c\b/ then h3c_connector(os, model)
           when /\bcisco\b/
             return :cisco_nxos if os.match?(/nx\s*os|nexus/) || model.match?(/\bnexus\b|\bn\s*[3579]k\b/)
-            return :cisco_ios if os.match?(/\bios\b|\bios\s*xe\b/)
+            :cisco_ios if os.match?(/\bios\b|\bios\s*xe\b/)
           when /\bradware\b/ then :radware
           when /palo\s*alto|paloalto/ then :palo_alto
           when /\bhuawei\b/ then :huawei
@@ -132,6 +135,11 @@ module Net
 
         private
 
+        def h3c_connector(os, model)
+          wireless = os.match?(/wireless|wlan/) || model.match?(/\A(?:h3c\s+)?(?:wx|ac)\s*\d/)
+          wireless ? :h3c_wireless : :h3c
+        end
+
         # 校验并标准化管理地址列表。
         def string_list(values)
           raise ArgumentError, "host lists must be Arrays" unless values.is_a?(Array)

data/lib/net/connector/netdisco/settings.rb

@@ -10,6 +10,8 @@ module Net
         DEFAULT_BACKUP_DIRECTORY = "backups"
         DEFAULT_CONCURRENCY = 4
         MAX_CONCURRENCY = 50
+        ENVIRONMENT_KEYS = %w[NETDISCO_URL NC_BACKUP_DIRECTORY NC_CONCURRENCY NC_SAMPLE_PER_VENDOR
+                              NC_PROTOCOL NC_KNOWN_HOSTS NC_HOST_KEY_POLICY NC_LOG_DIRECTORY NC_LOG_LEVEL TFTP_HOST].freeze
         DEFAULT_PAGE_SIZE = Client::DEFAULTS.fetch(:page_size)
         UNSET = Object.new.freeze
         private_constant :UNSET
@@ -18,17 +20,29 @@ module Net
           new(env: env, defaults: ConfigFile.load(path))
         end
 
+        def self.from_env(env: ENV)
+          path = env["NC_CONFIG"]
+          path && !path.empty? ? from_file(path, env: env) : new(env: env)
+        end
+
         def initialize(env: ENV, defaults: {}, overrides: {}, policy: nil, fixed: false)
           @env, @defaults, @overrides = env, defaults, overrides
           @policy, @fixed = policy, fixed
         end
 
+        # 调用入口补充运行目录等非敏感覆盖，凭据仍从同一来源读取。
+        def with_overrides(values)
+          self.class.new(env: @env, defaults: @defaults, overrides: @overrides.merge(values))
+        end
+
         # 快照自身不保留 ENV、凭据 resolver 或原 Settings 的引用，不能携带秘密进入摘要。
         def snapshot(mode: :backup)
           return @policy.validate!(mode: mode) if @policy
           return validate!(mode: mode) if @fixed
 
-          keys = mode == :export ? ["NET_CONNECTOR_BACKUP_DIRECTORY"] : non_secret_keys
+          validate_environment! unless mode == :export
+
+          keys = mode == :export ? ["NC_BACKUP_DIRECTORY"] : non_secret_keys
           values = keys.each_with_object({}) do |key, result|
             item = raw(key, UNSET)
             result[key.freeze] = item.is_a?(String) ? item.dup.freeze : item unless item.equal?(UNSET)
@@ -61,11 +75,25 @@ module Net
           self
         end
 
-        def client(policy: snapshot(mode: :inventory))
+        def client(policy: snapshot(mode: :inventory), credentials: nil)
+          if credentials && (!credentials.is_a?(Hash) || credentials.keys.sort != %i[password username] ||
+            !credentials.values.all? { |value| present?(value) })
+            raise ArgumentError, "inventory credentials require nonempty username and password"
+          end
           options = policy.client_options
+          if policy.inventory_source == :postgres
+            connection = DatabaseClient::CONNECTION_ENV.each_with_object({}) do |(key, name), values|
+              item = secret_value(name)
+              values[key] = item if item
+            end
+            connection.merge!(user: credentials[:username], password: credentials[:password]) if credentials
+            return DatabaseClient.new(connection_options: connection, **options)
+          end
           raise ArgumentError, "NETDISCO_URL is required" unless options.fetch(:url)
 
-          authentication = if (token = secret_value("NETDISCO_API_KEY"))
+          authentication = if credentials
+                             credentials
+                           elsif (token = secret_value("NETDISCO_API_KEY"))
                              { api_key: token }
                            else
                              { username: required_secret("NETDISCO_USERNAME"), password: required_secret("NETDISCO_PASSWORD") }
@@ -73,49 +101,46 @@ module Net
           Client.new(**options, **authentication)
         end
 
-        # 原生客户端和 --show-config 共享同一预算、地址与 HTTP 策略校验。
+        def inventory_source
+          source = value("NETDISCO_SOURCE") || "http"
+          raise ArgumentError, "NETDISCO_SOURCE must be http or postgres" unless %w[http postgres].include?(source)
+
+          source.to_sym
+        end
+
+        # 原生客户端和 --show-config 共享预算校验；只验证所选来源的查询设置。
         def client_options
-          options = Client::DEFAULTS.to_h do |name, default|
-            key = "NETDISCO_#{name.to_s.upcase}"
-            parsed = case name
-                     when :inventory_timeout then number(key, default)
-                     when :allow_insecure_http then boolean(key, default)
-                     else integer(key, default)
-                     end
-            [name, parsed]
-          end
-          options = Client.options(**options)
-          url = value("NETDISCO_URL")
-          Client.validate_url!(url, allow_insecure_http: options.fetch(:allow_insecure_http)) if url
-          options.merge(url: url).freeze
+          defaults = inventory_source == :postgres ? DatabaseClient::DEFAULTS : Client::DEFAULTS
+          options = client_budget_options(defaults)
+          inventory_source == :postgres ? postgres_options(options) : http_options(options)
         end
 
         def rules
-          Rules.new(include_hosts: list("NET_CONNECTOR_INCLUDE_HOSTS"),
-                    exclude_hosts: list("NET_CONNECTOR_EXCLUDE_HOSTS"),
-                    include_vendors: list("NET_CONNECTOR_INCLUDE_VENDORS"),
-                    vendor_overrides: json("NET_CONNECTOR_VENDOR_OVERRIDES", {}),
-                    host_overrides: json("NET_CONNECTOR_HOST_OVERRIDES", {}),
-                    mappings: json("NET_CONNECTOR_DEVICE_RULES", []))
+          Rules.new(include_hosts: list("NC_INCLUDE_HOSTS"),
+                    exclude_hosts: list("NC_EXCLUDE_HOSTS"),
+                    include_vendors: list("NC_INCLUDE_VENDORS"),
+                    vendor_overrides: json("NC_VENDOR_OVERRIDES", {}),
+                    host_overrides: json("NC_HOST_OVERRIDES", {}),
+                    mappings: json("NC_DEVICE_RULES", []))
         end
 
         def backup_directory
-          path = raw("NET_CONNECTOR_BACKUP_DIRECTORY", DEFAULT_BACKUP_DIRECTORY)
-          raise ArgumentError, "NET_CONNECTOR_BACKUP_DIRECTORY must be nonempty" unless present?(path)
+          path = raw("NC_BACKUP_DIRECTORY", DEFAULT_BACKUP_DIRECTORY)
+          raise ArgumentError, "NC_BACKUP_DIRECTORY must be nonempty" unless present?(path)
 
           File.expand_path(path)
         end
 
         def concurrency
-          count = integer("NET_CONNECTOR_CONCURRENCY", DEFAULT_CONCURRENCY)
-          raise ArgumentError, "NET_CONNECTOR_CONCURRENCY must be at most #{MAX_CONCURRENCY}" if count > MAX_CONCURRENCY
+          count = integer("NC_CONCURRENCY", DEFAULT_CONCURRENCY)
+          raise ArgumentError, "NC_CONCURRENCY must be at most #{MAX_CONCURRENCY}" if count > MAX_CONCURRENCY
 
           count
         end
 
         def limit_per_vendor(tftp: false)
-          count = if configured?("NET_CONNECTOR_SAMPLE_PER_VENDOR")
-                    integer("NET_CONNECTOR_SAMPLE_PER_VENDOR", 5) unless raw("NET_CONNECTOR_SAMPLE_PER_VENDOR").nil?
+          count = if configured?("NC_SAMPLE_PER_VENDOR")
+                    integer("NC_SAMPLE_PER_VENDOR", 5) unless raw("NC_SAMPLE_PER_VENDOR").nil?
                   elsif tftp
                     5
                   end
@@ -124,17 +149,17 @@ module Net
         end
 
         def tftp_source_files
-          files = { huawei: raw("NET_CONNECTOR_HUAWEI_TFTP_SOURCE_FILE", "flash:/startup.cfg") }
+          files = { huawei: raw("NC_HUAWEI_TFTP_SOURCE_FILE", "flash:/startup.cfg") }
           %i[h3c h3c_wireless].each do |vendor|
-            key = "NET_CONNECTOR_#{vendor.to_s.upcase}_TFTP_SOURCE_FILE"
+            key = "NC_#{vendor.to_s.upcase}_TFTP_SOURCE_FILE"
             files[vendor] = raw(key) if configured?(key)
           end
           files
         end
 
         def tftp_vrfs
-          mapping = json("NET_CONNECTOR_TFTP_VRFS", {})
-          raise ArgumentError, "NET_CONNECTOR_TFTP_VRFS must be a JSON object" unless mapping.is_a?(Hash)
+          mapping = json("NC_TFTP_VRFS", {})
+          raise ArgumentError, "NC_TFTP_VRFS must be a JSON object" unless mapping.is_a?(Hash)
 
           self.class.validate_vrfs!(mapping.transform_keys(&:to_sym))
         end
@@ -152,75 +177,122 @@ module Net
         def tftp_server = value("TFTP_HOST")
 
         def connection_options(vendor = nil)
-          prefix = "NET_CONNECTOR_#{vendor.to_s.upcase}_"
           configuration = Configuration.new(
-            protocol: (vendor && value(prefix + "PROTOCOL")) || value("NET_CONNECTOR_PROTOCOL") || "ssh",
-            log_level: value("NET_CONNECTOR_LOG_LEVEL") || "info", known_hosts: value("NET_CONNECTOR_KNOWN_HOSTS"),
-            host_key_policy: value("NET_CONNECTOR_HOST_KEY_POLICY") || "strict",
-            max_script_output_bytes: optional_integer("NET_CONNECTOR_MAX_SCRIPT_OUTPUT_BYTES")
+            protocol: vendor_protocols[vendor.to_s] || value("NC_PROTOCOL") || "ssh",
+            log_level: value("NC_LOG_LEVEL") || "info", known_hosts: value("NC_KNOWN_HOSTS"),
+            host_key_policy: value("NC_HOST_KEY_POLICY") || "strict",
+            max_script_output_bytes: optional_integer("NC_MAX_SCRIPT_OUTPUT_BYTES")
           )
           options = %i[protocol log_level known_hosts host_key_policy].to_h { |key| [key, configuration.public_send(key)] }
           options[:max_script_output_bytes] = configuration.max_script_output_bytes if configuration.max_script_output_bytes
           options.freeze
         end
 
+        def vendor_protocols
+          values = json("NC_VENDOR_PROTOCOLS", {})
+          unless values.is_a?(Hash) && values.all? { |vendor, protocol| Net::Connector.vendors.map(&:to_s).include?(vendor) && %w[ssh telnet].include?(protocol) }
+            raise ArgumentError, "ssh.vendor_protocols must map supported vendors to ssh or telnet"
+          end
+          values
+        end
+
         def device_credentials_for(device)
-          prefix = "NET_CONNECTOR_#{device.vendor.to_s.upcase}_"
-          username = secret_value(prefix + "USERNAME") || secret_value("NET_CONNECTOR_DEVICE_USERNAME")
+          prefix = "NC_#{device.vendor.to_s.upcase}_"
+          username = secret_value(prefix + "USERNAME") || secret_value("NC_DEVICE_USERNAME")
           return nil unless username
 
           { username: username,
-            password: secret_value(prefix + "PASSWORD") || secret_value("NET_CONNECTOR_DEVICE_PASSWORD"),
-            enable_password: secret_value(prefix + "ENABLE_PASSWORD") || secret_value("NET_CONNECTOR_ENABLE_PASSWORD") }
+            password: secret_value(prefix + "PASSWORD") || secret_value("NC_DEVICE_PASSWORD"),
+            enable_password: secret_value(prefix + "ENABLE_PASSWORD") || secret_value("NC_ENABLE_PASSWORD") }
         end
 
         def log_directory
-          path = value("NET_CONNECTOR_LOG_DIRECTORY")
+          path = value("NC_LOG_DIRECTORY")
           File.expand_path(path) if path
         end
 
         def public_config
-          snapshot(mode: :show_config).send(:config_hash)
+          snapshot(mode: :show_config).config_hash
         end
 
         def inspect = "#<#{self.class}>"
 
-        private
+        protected
 
         def config_hash
           {
-            netdisco: client_options,
+            netdisco: client_options.merge(source: inventory_source),
             backup: { directory: backup_directory, concurrency: concurrency, limit_per_vendor: limit_per_vendor },
-            inventory: { include_hosts: list("NET_CONNECTOR_INCLUDE_HOSTS"),
-                         exclude_hosts: list("NET_CONNECTOR_EXCLUDE_HOSTS"),
-                         include_vendors: list("NET_CONNECTOR_INCLUDE_VENDORS"),
-                         vendor_overrides: json("NET_CONNECTOR_VENDOR_OVERRIDES", {}),
-                         host_overrides: json("NET_CONNECTOR_HOST_OVERRIDES", {}),
-                         device_rules: json("NET_CONNECTOR_DEVICE_RULES", []) },
+            inventory: { include_hosts: list("NC_INCLUDE_HOSTS"),
+                         exclude_hosts: list("NC_EXCLUDE_HOSTS"),
+                         include_vendors: list("NC_INCLUDE_VENDORS"),
+                         vendor_overrides: json("NC_VENDOR_OVERRIDES", {}),
+                         host_overrides: json("NC_HOST_OVERRIDES", {}),
+                         device_rules: json("NC_DEVICE_RULES", []) },
             ssh: connection_options.transform_values { |item| item.is_a?(Symbol) ? item.to_s : item }.merge(
               log_directory: log_directory,
-              vendor_protocols: Net::Connector.vendors.filter_map do |vendor|
-                protocol = value("NET_CONNECTOR_#{vendor.to_s.upcase}_PROTOCOL")
-                [vendor, protocol] if protocol
-              end.to_h
+              vendor_protocols: vendor_protocols
             ),
             tftp: { server: tftp_server, vrfs: tftp_vrfs.transform_keys(&:to_s), source_files: tftp_source_files }
           }
         end
 
-        def non_secret_keys
-          keys = ConfigFile::FIELDS.values.flat_map { |section| section.values.map(&:first) }
-          keys + Net::Connector.vendors.map { |vendor| "NET_CONNECTOR_#{vendor.to_s.upcase}_PROTOCOL" }
-        end
-
         def raw(key, default = nil)
-          return @policy.send(:raw, key, default) if @policy
+          return @policy.raw(key, default) if @policy
           return @overrides.fetch(key) if @overrides.key?(key)
-          return @env.fetch(key) if @env.key?(key)
+          if @env.key?(key)
+            unless @fixed || ENVIRONMENT_KEYS.include?(key)
+              raise ArgumentError, "#{key} is no longer an environment setting; use YAML via NC_CONFIG or CLI options"
+            end
+            return @env.fetch(key)
+          end
 
           @defaults.fetch(key, default)
         end
 
+        private
+
+        def client_budget_options(defaults)
+          defaults.to_h do |name, default|
+            key = "NETDISCO_#{name.to_s.upcase}"
+            parsed = case name
+                     when :inventory_timeout then number(key, default)
+                     when :allow_insecure_http then boolean(key, default)
+                     else integer(key, default)
+                     end
+            [name, parsed]
+          end
+        end
+
+        def postgres_options(options)
+          query = value("NETDISCO_QUERY") || (raise ArgumentError, "NETDISCO_QUERY is required for postgres")
+          DatabaseClient.options(query: query, query_params: json("NETDISCO_QUERY_PARAMS", []), **options)
+        end
+
+        def http_options(options)
+          if value("NETDISCO_QUERY") || value("NETDISCO_QUERY_PARAMS")
+            raise ArgumentError, "SQL query settings require NETDISCO_SOURCE=postgres"
+          end
+          options = Client.options(**options)
+          url = value("NETDISCO_URL")
+          Client.validate_url!(url, allow_insecure_http: options.fetch(:allow_insecure_http)) if url
+          options.merge(url: url).freeze
+        end
+
+        def non_secret_keys
+          ConfigFile::FIELDS.values.flat_map { |section| section.values.map(&:first) }
+        end
+
+        def validate_environment!
+          legacy = @env.keys.find { |key| key.start_with?("NET_CONNECTOR_") }
+          raise ArgumentError, "#{legacy} has been renamed to #{legacy.sub("NET_CONNECTOR_", "NC_")}" if legacy
+
+          removed = non_secret_keys - ENVIRONMENT_KEYS
+          removed += Net::Connector.vendors.map { |vendor| "NC_#{vendor.to_s.upcase}_PROTOCOL" }
+          key = removed.find { |name| @env.key?(name) }
+          raise ArgumentError, "#{key} is no longer an environment setting; use YAML via NC_CONFIG or CLI options" if key
+        end
+
         def configured?(key) = !raw(key, UNSET).equal?(UNSET)
 
         def json(key, default)
@@ -279,6 +351,7 @@ module Net
         end
 
         def required_secret(key) = secret_value(key) || (raise ArgumentError, "#{key} is required")
+
         def present?(value) = value.is_a?(String) && !value.strip.empty?
       end
     end