@tikoci/centrs 0.1.3 → 0.1.4

package/src/transfer-fanout.ts

@@ -8,7 +8,7 @@
  *
  * Boundaries (see `commands/transfer/README.md`, `docs/CONSTITUTION.md`), shared
  * with `api`/`retrieve`/`execute` fan-out:
- *   - The CDB is loaded ONCE (`expandCdbSelection`); a cdb member is resolved with
+ *   - The CDB is loaded ONCE (`expandSelection`); a cdb member is resolved with
  *     its pre-resolved record, so `resolveCdb`'s `__default__` synthetic fallback
  *     never collides ad-hoc literals.
  *   - A `--default` / `__default__` member fails that one target deterministically
@@ -42,12 +42,12 @@ import { CentrsError, serializeCentrsError } from "./errors.ts";
 import { promptForWriteConfirmation } from "./execute.ts";
 import { plannedProtocols, type RouterOsProtocol } from "./protocols/index.ts";
 import {
-	type CdbSelectionExpansion,
-	type CdbSelectionMember,
-	type CdbSelectionResolveInput,
-	expandCdbSelection,
+	expandSelection,
 	isDefaultRecordTarget,
 	loadEnvFileDefaults,
+	type SelectionExpansion,
+	type SelectionMember,
+	type SelectionResolveInput,
 	type TargetSelection,
 } from "./resolver/index.ts";
 import { toYaml } from "./retrieve.ts";
@@ -71,6 +71,8 @@ export interface TransferSelectionSummary {
 	all: boolean;
 	default: boolean;
 	positionals: readonly string[];
+	/** quickchr machine names (`--quickchr`, repeatable; exclusive of the rest). */
+	quickchr?: readonly string[];
 }
 
 export interface TransferFanoutRequestSummary {
@@ -101,13 +103,13 @@ export type TransferFanoutErrorEnvelope =
 export interface TransferFanoutInternals {
 	expand?: (
 		selection: TargetSelection,
-		input: CdbSelectionResolveInput,
+		input: SelectionResolveInput,
 		env: Record<string, string | undefined>,
 		config?: Record<string, string | undefined>,
-	) => Promise<CdbSelectionExpansion>;
+	) => Promise<SelectionExpansion>;
 	execute?: (
 		request: TransferRequest,
-		member: CdbSelectionMember,
+		member: SelectionMember,
 	) => Promise<TransferSuccessEnvelope>;
 	sleep?: (ms: number) => Promise<void>;
 }
@@ -127,14 +129,18 @@ function summarizeSelection(
 		all: selection.all,
 		default: selection.default,
 		positionals: selection.positionals,
+		quickchr: selection.quickchr,
 	};
 }
 
-function memberLabel(member: CdbSelectionMember): string {
-	return member.kind === "cdb" ? member.resolution.identity : member.input;
+function memberLabel(member: SelectionMember): string {
+	if (member.kind === "cdb") {
+		return member.resolution.identity;
+	}
+	return member.kind === "quickchr" ? member.name : member.input;
 }
 
-function memberTargetMeta(member: CdbSelectionMember): {
+function memberTargetMeta(member: SelectionMember): {
 	input?: string;
 	identity?: string;
 	recordIndex?: number;
@@ -146,6 +152,9 @@ function memberTargetMeta(member: CdbSelectionMember): {
 			recordIndex: member.recordIndex,
 		};
 	}
+	if (member.kind === "quickchr") {
+		return { input: member.name, identity: member.name };
+	}
 	return { input: member.input };
 }
 
@@ -165,11 +174,11 @@ function sanitizeFilename(label: string): string {
 function planDownloadPaths(
 	outDir: string,
 	remote: string,
-	members: readonly CdbSelectionMember[],
-): Map<CdbSelectionMember, string> {
+	members: readonly SelectionMember[],
+): Map<SelectionMember, string> {
 	const ext = extname(basename(remote));
 	const used = new Set<string>();
-	const paths = new Map<CdbSelectionMember, string>();
+	const paths = new Map<SelectionMember, string>();
 	members.forEach((member, index) => {
 		const label = sanitizeFilename(memberLabel(member));
 		let name = `${label}${ext}`;
@@ -197,7 +206,7 @@ function planDownloadPaths(
  */
 function relabelAdhocMember(
 	envelope: TransferEnvelope,
-	member: CdbSelectionMember,
+	member: SelectionMember,
 ): TransferEnvelope {
 	if (member.kind !== "literal") {
 		return envelope;
@@ -217,7 +226,7 @@ function relabelAdhocMember(
  */
 function applyMemberMeta(
 	envelope: TransferEnvelope,
-	member: CdbSelectionMember,
+	member: SelectionMember,
 ): TransferEnvelope {
 	if (member.kind === "literal") {
 		return relabelAdhocMember(envelope, member);
@@ -268,7 +277,7 @@ export async function transferFanout(
 		});
 	}
 
-	const expand = internals.expand ?? expandCdbSelection;
+	const expand = internals.expand ?? expandSelection;
 	const expansion = await expand(
 		selection,
 		{
@@ -310,7 +319,7 @@ export async function transferFanout(
 
 	const execute =
 		internals.execute ??
-		((req: TransferRequest, member: CdbSelectionMember) =>
+		((req: TransferRequest, member: SelectionMember) =>
 			transfer(req, env, {
 				// cdb members carry their pre-resolved record (CDB loaded once);
 				// literals fall through to single-target resolution.
@@ -319,8 +328,8 @@ export async function transferFanout(
 	const sleep = internals.sleep ?? defaultFanoutSleep;
 
 	const targets = await runFanout<
-		CdbSelectionMember,
-		{ request: TransferRequest; member: CdbSelectionMember },
+		SelectionMember,
+		{ request: TransferRequest; member: SelectionMember },
 		TransferEnvelope
 	>({
 		members: expansion.targets,
@@ -339,9 +348,17 @@ export async function transferFanout(
 					context: { target: member.resolution.target },
 				});
 			}
-			const targetInput =
-				member.kind === "cdb" ? member.resolution.target : member.input;
-			const perRequest: TransferRequest = { ...request, targetInput };
+			// A quickchr member carries the machine name in `quickchr` (resolved live
+			// inside `resolveTransferRequest`, so a stopped machine is an inner
+			// per-target failure), never as a `targetInput`.
+			const perRequest: TransferRequest =
+				member.kind === "quickchr"
+					? { ...request, targetInput: undefined, quickchr: member.name }
+					: {
+							...request,
+							targetInput:
+								member.kind === "cdb" ? member.resolution.target : member.input,
+						};
 			if (downloadPaths !== undefined) {
 				perRequest.local = downloadPaths.get(member);
 			}
@@ -377,7 +394,7 @@ export async function transferFanout(
 
 async function assertFanoutWriteConfirmed(
 	request: TransferRequest,
-	expansion: CdbSelectionExpansion,
+	expansion: SelectionExpansion,
 ): Promise<void> {
 	if (request.yes) {
 		return;
@@ -407,7 +424,7 @@ interface TransferFanoutEnvelopeInput {
 	summary: FanoutSummary;
 	requestSummary: TransferFanoutRequestSummary;
 	via: RouterOsProtocol | string | null;
-	warnings: CdbSelectionExpansion["warnings"];
+	warnings: SelectionExpansion["warnings"];
 	targets: readonly TransferEnvelope[];
 }
 

package/src/transfer.ts

@@ -38,15 +38,18 @@ import {
 import type { RouterOsProtocol } from "./protocols/index.ts";
 import { SftpClient } from "./protocols/sftp.ts";
 import {
+	assertNoQuickchrOverrideConflict,
 	type CdbResolution,
 	loadEnvFileDefaults,
 	parseDuration,
+	quickchrConnection,
 	type ResolvedAuth,
 	type ResolvedSetting,
 	type ResolvedTarget,
 	resolveAuth,
 	resolveBooleanSetting,
 	resolveCdb,
+	resolveQuickchrTarget,
 	resolveStringSetting,
 	resolveTarget,
 	toCoreSource,
@@ -104,6 +107,12 @@ export const FILE_READ_CHUNK_BYTES = 32_768;
 export interface TransferRequest {
 	verb: TransferVerb;
 	targetInput?: string;
+	/**
+	 * quickchr machine name (`--quickchr <name>`): resolve host/port/auth from
+	 * the live VM descriptor instead of CDB/env (`docs/CONSTITUTION.md` →
+	 * Resolution providers). Conflicts with host/port/username/password/sshKey.
+	 */
+	quickchr?: string;
 	/** Local path (or `-` for stdin/stdout). Present for upload/download. */
 	local?: string;
 	/** RouterOS file path. Present for upload/download/remove/mkdir and copy source. */
@@ -818,19 +827,31 @@ export async function resolveTransferRequest(
 		config,
 	);
 
+	// A quickchr target is a named-live-provider: host/port/auth come from the
+	// live descriptor, bypassing CDB and the `__default__` ladder. For
+	// `--via sftp`/`scp`, `quickchrConnection` additionally gates on the SSH
+	// endpoint's batch-capable auth modes (typed error, never a password prompt).
+	let quickchrResolution: Awaited<
+		ReturnType<typeof resolveQuickchrTarget>
+	> | null = null;
+	if (request.quickchr !== undefined) {
+		assertNoQuickchrOverrideConflict(request, request.quickchr);
+		quickchrResolution = await resolveQuickchrTarget(request.quickchr);
+	}
 	// Fan-out passes the pre-resolved CDB record for a member (the CDB is loaded
-	// once in `expandCdbSelection`); single-target resolves it here.
-	const cdbResolution =
-		options.cdbResolution ??
-		(await resolveCdb(
-			{
-				targetInput: request.targetInput,
-				cdbFile: request.cdbFile,
-				cdbPassword: request.cdbPassword,
-			},
-			env,
-			config,
-		));
+	// once in `expandSelection`); single-target resolves it here.
+	const cdbResolution = quickchrResolution
+		? undefined
+		: (options.cdbResolution ??
+			(await resolveCdb(
+				{
+					targetInput: request.targetInput,
+					cdbFile: request.cdbFile,
+					cdbPassword: request.cdbPassword,
+				},
+				env,
+				config,
+			)));
 
 	const format = resolveTransferFormat(request, env, config);
 	const validate = resolveBooleanSetting(
@@ -842,15 +863,6 @@ export async function resolveTransferRequest(
 		cdbResolution?.overrides.validate,
 		config,
 	);
-	const insecure = resolveBooleanSetting(
-		request.insecure,
-		env,
-		"CENTRS_INSECURE",
-		false,
-		"insecure",
-		cdbResolution?.overrides.insecure,
-		config,
-	);
 	const timeoutMs = resolveTransferTimeout(
 		request.timeout,
 		env,
@@ -858,30 +870,59 @@ export async function resolveTransferRequest(
 		cdbResolution,
 		config,
 	);
-	const target = resolveTarget(
-		{
-			targetInput: request.targetInput,
-			host: request.host,
-			port: request.port,
-		},
-		env,
-		protocol,
-		cdbResolution,
-		config,
-	);
-	const auth = resolveAuth(
-		{
-			username: request.username,
-			password: request.password,
-			sshKey: request.sshKey,
-		},
-		env,
-		cdbResolution,
-		config,
-	);
+	const connection = quickchrResolution
+		? quickchrConnection(quickchrResolution, protocol)
+		: null;
+	// A quickchr TLS/SSH endpoint is trusted by provenance (self-signed VM cert /
+	// ephemeral host key) — `insecure` is forced with provider provenance and the
+	// provider-trust warning replaces the generic `--insecure` anomaly warning.
+	const insecure =
+		connection?.insecure === true
+			? {
+					value: true,
+					source: {
+						kind: "provider" as const,
+						key: `quickchr:${request.quickchr}`,
+					},
+				}
+			: resolveBooleanSetting(
+					request.insecure,
+					env,
+					"CENTRS_INSECURE",
+					false,
+					"insecure",
+					cdbResolution?.overrides.insecure,
+					config,
+				);
+	const target = connection
+		? connection.target
+		: resolveTarget(
+				{
+					targetInput: request.targetInput,
+					host: request.host,
+					port: request.port,
+				},
+				env,
+				protocol,
+				cdbResolution,
+				config,
+			);
+	const auth = connection
+		? connection.auth
+		: resolveAuth(
+				{
+					username: request.username,
+					password: request.password,
+					sshKey: request.sshKey,
+				},
+				env,
+				cdbResolution,
+				config,
+			);
 
 	const warnings: Warning[] = [
 		...((cdbResolution?.warnings ?? []) as readonly Warning[]),
+		...(connection?.warnings ?? []),
 	];
 	// Report the auto hop: a large upload cannot ride the REST family's 60 KB
 	// `/file/set` cap, so auto-selection moved it to sftp.
@@ -892,8 +933,10 @@ export async function resolveTransferRequest(
 				"Large upload (>60 KB) auto-selected sftp; the REST family cannot write past the 60 KB `/file/set` cap.",
 		});
 	}
-	// A self-signed-accepting run is an anomaly worth surfacing on every transport.
-	if (insecure.value) {
+	// A self-signed-accepting run is an anomaly worth surfacing on every
+	// transport — unless the trust came from the provider, whose own
+	// provider-trust warning already rides above.
+	if (insecure.value && connection?.insecure !== true) {
 		warnings.push({
 			code: "transport/insecure-trust",
 			message: