@tikoci/centrs 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,207 @@
+# Changelog
+
+All notable changes to this repository should be recorded here.
+
+The product evolves as a stream of changes; there are no alpha gates.
+Per-feature status is tracked in `docs/MATRIX.md`. Use this file for
+documenting cross-cutting shifts that affect contributors and consumers.
+
+## Unreleased
+
+## 0.1.0 — 2026-06-22
+
+First published pre-release (odd minor → npm `next`). `@tikoci/centrs@0.1.0`.
+
+### Added
+
+- **`btest / client` is now `CHR-passed`.** A direct centrs-client → CHR
+  `/tool/bandwidth-server` gated test (`test/integration/btest-client.test.ts`)
+  boots a CHR with a host→guest `tcp:2000` forward and runs the centrs client
+  against real RouterOS: unauthenticated TCP receive, an **EC-SRP5 client proof
+  verified by RouterOS's own server verifier**, and a wrong-password reject (CHR
+  7.23.1). This closes the last open product-grid cell — the client cell was
+  previously grounded only transitively (loopback + the server test). The
+  integration harness (`test/integration/chr.ts`) gains an `extraPorts` option for
+  arbitrary host→guest forwards. UDP client→server and TCP `connection-count > 1`
+  fan-out remain loopback/transitive (README, Open questions).
+- **CI/release rework — staged gate, definitive QA matrix, NPM publish, extended
+  sweep.** The CI surface is reconciled with the tier/versioning doctrine
+  (quickchr's `ci`/`publish`/`verify-extended` scheme as the reference).
+  `ci.yaml` is a staged push/PR gate (lint ‖ unit+coverage → **stable CHR smoke**
+  → cross-platform unit) with coverage + failing tests surfaced to job summaries
+  and artifacts. `qa.yaml` is the definitive RouterOS channel matrix (push +
+  weekly + dispatch + `workflow_call`) with **event-aware concurrency** (a new
+  main push cancels the old run; dispatches never cancel one another — including
+  an `all`-channels dispatch in a single run) and a `bun:sqlite` results store.
+  `codeql.yaml` carries security/quality scanning on its own cadence.
+  `release.yaml` publishes to npm on a `v*` tag (even/odd minor → `next`/`latest`,
+  `--provenance`, dry-run) — **requires the `NPM_TOKEN` repo secret**.
+  `verify-extended.yaml` adds a dispatch-only macOS-x86 / Windows-x86 sweep. New
+  `chr-smoke` integration test + `test:integration:smoke` script; `.coderabbit.yaml`
+  stages bot review to conserve credits.
+- **QA recency-aware channel matrix + cross-run history + must-pass gate.**
+  `qa.yaml`'s channel axis is now resolved per run by a `resolve-matrix` pre-flight
+  job (`scripts/qa-active-channels.ts`) instead of a hard-coded list: it asks
+  quickchr 0.4.2's public version/channel API (`resolveAllVersions` /
+  `selectActiveChannels`, with the suffix-aware `compareRouterOsVersion` that
+  finally orders `7.24beta2 < 7.24rc1 < 7.24`) for the channels *worth booting* —
+  the released channels (stable, long-term) always, plus any pre-release (testing,
+  development) at or ahead of stable. This closes the `testing` blind spot and
+  auto-adapts as MikroTik promotes builds, because the four channels are not
+  monotonically ordered (a stale `testing` rc is skipped; it is picked up
+  automatically once it leapfrogs stable). A new `accumulate-and-gate` job appends
+  each CHR run to a durable append-log on the `qa-history` branch (per-run
+  artifacts have finite retention, and the channel→version drift over time is
+  what a long history captures) and fails the run **only when a released
+  channel (stable, long-term) regresses** — pre-release legs are best-effort, so a
+  beta btest/EC-SRP5 flake (JG-31) is recorded but never reds main. Boundary:
+  quickchr owns recency ("what's worth booting"); centrs owns the gate ("what must
+  pass") — the must-pass policy lives once in `scripts/qa-results-db.ts`
+  (`channelPolicy` / `evaluateMustPassGate`, mirrored by the matrix
+  `continue-on-error`), with the cross-run accumulator in `scripts/qa-history.ts`.
+- **`transfer / ssh` (sftp) — SSH lands transfer-first.** SSH joins centrs as a
+  self-contained **SFTP transfer client** (`src/protocols/sftp.ts`) over the host
+  OpenSSH `sftp` subsystem — the only reliable SSH file path, since RouterOS's SSH
+  server has no exec channel / no pseudo-tty (so `execute`/`terminal` over SSH,
+  which need an interactive-shell reader, are a deliberate later pass). This
+  re-scopes the earlier "SSH lands as one unit" plan. `transfer` now routes
+  `--via sftp` (and auto-selects it for >60 KB uploads, the gap the REST `/file`
+  60 KB write cap leaves) through a new backend-agnostic `FileBackend` seam
+  (`AdapterFileBackend` for rest/native, `SftpFileBackend` for sftp). The
+  `ssh-key` (`--ssh-key` / `CENTRS_SSH_KEY` / CDB `ssh-key=`) and `insecure`
+  settings land with the transport. **Green against real CHR 7.23.1** (98
+  assertions, `test/integration/transfer.test.ts`): a key-auth sftp round-trip,
+  the >60 KB upload, list/mkdir/remove, and example 17 (chunked REST read of an
+  sftp-seeded file — the old fetch hack is gone). **CHR finding:** RouterOS's sftp
+  `ls -l` does not report a reliable byte size, so the sftp `--verify size` trusts
+  the SFTP transfer guarantee rather than re-reading a size. New error codes:
+  `transport/host-key-mismatch`, `transport/insecure-trust`,
+  `transport/auto-method`, `input/invalid-path`. On-device `copy` has no SFTP
+  primitive and stays on rest/native.
+- **Unified TLS / SSH host-key trust across every transport.** One opt-out —
+  `--insecure` (`CENTRS_INSECURE`, CDB `insecure=`) — with verify-by-default and a
+  `transport/insecure-trust` warning when it is set. REST (`fetch`) and native-api
+  (`api-ssl`) now both **verify** TLS by default (native-api previously accepted
+  any cert silently); a self-signed cert fails with `transport/tls-certificate`
+  whose remediation names `--insecure`. SSH host keys default to
+  `accept-new` trust-on-first-use; a changed key fails with
+  `transport/host-key-mismatch`. See `docs/CONSTITUTION.md`, Transport trust.
+
+- **`transfer` is `coded` for `rest-api` / `native-api`.** `src/transfer.ts` +
+  `src/cli/transfer.ts` implement the file verb — `upload`/`download`/`list`/
+  `remove`/`mkdir`/`copy` (plus top-level `upload`/`download` aliases) — over the
+  RouterOS `/file` menu, driven through the shared `ProtocolAdapter`
+  `execute`/`list` seam so REST and native share one path. Size/direction-aware
+  method selection encodes the asymmetric `/file` plumbing (writes capped at
+  60 KB via `/file/set contents`; reads scale via chunked `/file/read`), a
+  `print`-probe enforces validate-before-write (refuse-overwrite unless
+  `--force`), a leading `/` in a remote path is normalized away, and
+  `sftp`/`scp`/`fetch`/`ftp` report a defined not-implemented / gated error.
+  Unit-green via mocked `fetch` (`test/unit/transfer.test.ts`).
+  `test/integration/transfer.test.ts` is green against a real CHR 7.23.1 (98
+  assertions, after the sftp commit below also seeds example 17) — confirming the
+  `/file` `get`/`set`/`add`/`copy`/`remove` wire shapes over both REST and native
+  — covering all examples except the three deferred for harness reasons (8–10
+  stdin/stdout/default-local), so the cells stay `coded` shy of the strict
+  every-example `CHR-passed` bar. New error codes: `usage/target-exists`,
+  `transport/incomplete-transfer`, `transport/checksum-unavailable`,
+  `input/local-file-not-found`, `settings/unsafe-protocol-blocked`.
+- **`discover / mndp` is `CHR-passed`.** A real layer-2 integration test
+  (`test/integration/discover.test.ts`) boots a CHR with a second
+  `socket-connect` NIC and a host bridge (`test/integration/mndp-l2-bridge.ts`)
+  that lifts each frame's UDP/5678 payload into centrs's unmodified `discover()`
+  listener and injects MNDP refresh frames back over the link. It captures and
+  decodes a genuine RouterOS MNDP announcement (CHR 7.23.1), cross-checks
+  `identity`/`platform`/`board`/`version`/`mac` against REST, and `--save`s a
+  `macTarget`/`group=discovered` record. The `socket-connect` approach was first
+  proven against quickchr's own `examples/mndp/` guinea-pig run. The same bridge
+  (frame-injection write-back) is the L2 harness mac-telnet will reuse.
+- **Integration CHR can now boot a chosen arch + extra packages.**
+  `startIntegrationChr` reads `CENTRS_CHR_ARCH` (`arm64`/`x86`) and
+  `CENTRS_CHR_PACKAGES` (comma/space list) and threads them through quickchr
+  0.4.2's `StartOptions`; `verify-extended.yaml` gains a `packages` input that
+  installs them into the CHR (e.g. `container`) for a fuller-RouterOS sweep. The
+  arm64 path is wired on the centrs side but no arm64 job is added yet: quickchr
+  0.4.2 has an arm64 REST-POST bug (returns the prior GET's body) that breaks the
+  execute path every integration test uses, so an arm64 job would be known-red
+  until that upstream fix lands.
+
+### Fixed
+
+- **`package.json` declares its `repository` (and `homepage`/`bugs`).** Without it,
+  `npm publish --provenance` failed validation (`E422`: empty `repository.url` vs
+  the GitHub-Actions provenance source). The package now points at
+  `github.com/tikoci/centrs`, matching the signed provenance.
+- **Flaky must-pass CHR cells no longer red the release gate.** The first
+  `v0.1.0` release sweep was blocked by transient long-term failures (native-api
+  `ECONNREFUSED`, mac-telnet L2 prime-latency) — the same cells pass locally and
+  the reds hop channels run-to-run, i.e. CI timing flake, not regressions. Two
+  fixes: (1) the native-api integration test now `waitForBoot`s and retries the
+  cold connect past the boot-readiness race (the api service can lag the REST
+  endpoint), via a `withBootReadyRetry` harness helper that retries **only**
+  transient connect errors — `auth-failed` still propagates, so assertions are
+  unweakened; (2) the qa.yaml CHR sweep runs integration **per-file with one
+  retry** — a real regression fails both attempts and still gates, but a single
+  transient flake is absorbed, and per-file isolation avoids the resource
+  contention that fast-fails a later file.
+- **`windows-latest` unit tier is green.** It was perpetually red on two causes,
+  now both addressed without losing coverage: (1) Windows has no `SO_REUSEPORT`,
+  so the MNDP/btest UDP loopback binds (`reusePort: true`) threw `ENOTSUP` — a
+  capability probe (`test/unit/udp-loopback.ts`) now skips just those UDP tests on
+  such a runner (TCP + CHR integration keep the coverage), gating only on the
+  known-unsupported bind codes so real regressions still surface; (2) the
+  `ssh`/`sftp` argv tests asserted `/dev/null` where the src correctly emits `NUL`
+  on Windows, and `transfer.basename()` split on `/` only so an omitted upload
+  remote defaulted to the full `C:\…` path — it now splits on `\` too.
+
+- **`btest` bidirectional TCP server tx is now accounted.** A `direction=both`
+  TCP session reported `totalTxBytes=0` / `txAvgBps=0` on the server side even
+  though it transmitted the client's receive half (hundreds of MB): the server's
+  bulk-TX loop flushed only its rx into each interval, never its own tx. The
+  server now records both halves, so a `both` session's `data.sessions[]` and the
+  CSV/text renders carry a non-zero tx rate. Loopback-grounded
+  (`test/unit/btest-{session,command}.test.ts`); UDP `both` and single-direction
+  TCP were already correct.
+- **`btest` totals now flush the final partial interval.** The per-interval
+  accounting loops recorded totals on a tick cadence and exited without folding in
+  bytes that arrived after the last tick (or before the first, on a slow host), so
+  a short run under-reported the final fraction of a second of each direction.
+  `driveSession` now folds the remaining counter bytes into the totals on stop,
+  keeping `data.reports[]` lossless against them.
+- **`discover` default listen window is now `15s`** (was `60s` in code).
+  Lowering the window relied on the up-front refresh broadcast (sent immediately,
+  then every 5s) so responders reply within a round-trip; the per-command docs
+  already documented `15s`, but `DISCOVER_DEFAULT_TIMEOUT_MS`, the CLI help, and
+  the MCP `centrs_discover` tool description still said `60s`. They now agree.
+
+### Changed
+
+- **`release.yaml` fails closed when `NPM_TOKEN` is missing.** A guard step in the
+  publish job errors with an actionable message if `secrets.NPM_TOKEN` does not
+  reach the runner (whether a repo secret or a tikoci org secret with centrs in
+  its repository access) — so a dry-run dispatch proves it before any real
+  publish, instead of failing opaquely inside `npm publish`. The value stays
+  masked; only its presence is logged.
+- **Workflow restructure.** Replaced `docs/specs/`, `docs/WORKFLOW.md`,
+  `docs/ROADMAP.md`, `docs/ARCHITECTURE.md`, and `work/` with three durable
+  surfaces:
+  - `docs/CONSTITUTION.md` — the load-bearing rules (validation as product,
+    result envelope, error model + URL scheme, settings precedence, identity,
+    protocol selection, done = CHR-passed).
+  - `docs/MATRIX.md` — command×protocol grid; the only status surface.
+  - `commands/<name>/{README,examples}.md` — per-command design and
+    executable example list that gates "done."
+- Done definition codified in
+  `.github/instructions/done-definition.instructions.md`: a feature is done
+  when its examples are green on real CHR via `bun run test:integration`.
+  Disabling validation to make a test pass is forbidden; validation is the
+  product.
+
+### Removed
+
+- `docs/specs/S001`–`S008`, `docs/WORKFLOW.md`, `docs/ROADMAP.md`,
+  `docs/ARCHITECTURE.md`, all of `work/`, and the
+  `docs-specs-lifecycle` / `work-directory` / `integration-testing`
+  instruction files. Their durable content folded into the constitution and
+  per-command files; the rest was scaffolding for a workflow that did not
+  pay off.

package/GLOSSARY.txt

@@ -0,0 +1,420 @@
+# Project glossary and cspell dictionary
+#
+# This file is the shared source of truth for project vocabulary, short term
+# definitions, and cspell dictionary entries.
+#
+# `%term` in prompts or notes means "look up the matching entry or comment here."
+#
+# CSpell dictionary syntax supported here:
+# - `~word` => use the word only when case sensitivity is off
+# - `+word` or `word+` => allow optional compounds
+# - `-word` or `word-` => require the word to appear in a compound
+# - `!word` => explicitly forbid the word
+#
+# Correctly spelled words may still belong here when the attached comment is the
+# canonical repo-specific definition or reference for the term.
+#
+# Core tikoci references
+# %centrs: this repository and RouterOS interaction hub.
+#   https://github.com/tikoci/centrs
+# %quickchr: CHR automation and test helpers used by tikoci projects.
+#   https://github.com/tikoci/quickchr
+# %rosetta: RouterOS docs/search grounding and knowledge-base tooling.
+#   https://github.com/tikoci/rosetta
+# %restraml: RouterOS REST schema and explorer tooling.
+#   https://github.com/tikoci/restraml
+# %lsp-routeros-ts: RouterOS parser and language-server utilities.
+#   https://github.com/tikoci/lsp-routeros-ts
+# %donny: Dude/discovery grounding for RouterOS device inventories.
+#   https://github.com/tikoci/donny
+# %m2ir: protocol IR (WinBox, nova messages) + the declarative schema-as-data
+#   approach to protocol internals; consulted for heavy protocol work.
+#   https://github.com/tikoci/m2ir
+# %tikbook: RouterOS notebook/documentation vocabulary used across tikoci.
+#   See also https://github.com/tikoci/vscode-tikbook
+# %routeros-skills: reusable RouterOS agent skills.
+#   https://github.com/tikoci/routeros-skills
+# %fat-chr: larger CHR image experiments and packaging.
+#   https://github.com/tikoci/fat-chr
+# %mikropkl: MikroTik-oriented PKL experiments and schemas.
+#   https://github.com/tikoci/mikropkl
+# %tikdns: tikoci DNS tooling.
+#   https://github.com/tikoci/tikdns
+#
+# External references
+# %mac-telnet: MikroTik MAC Telnet tooling by haakonnessjoen.
+#   https://github.com/haakonnessjoen/mac-telnet
+# %netmiko: multi-vendor SSH abstraction; reference for SSH transport patterns.
+#   https://github.com/ktbyers/netmiko
+# %terraform-provider-routeros: widely-used Go RouterOS provider; reference for
+#   native-API behavior and provisioning idioms.
+#   https://github.com/terraform-routeros/terraform-provider-routeros
+# %librouteros-api: haakonnessjoen's C native-API client; cross-check for our
+#   native-api codec.
+#   https://github.com/haakonnessjoen/librouteros-api
+# %RouterOS_Tools: third-party WinBox CDB format implementation; cross-check for
+#   our CDB codec.
+#   https://github.com/jabb3rd/RouterOS_Tools
+# %Winbox_Protocol_Dissector: Wireshark dissector for the WinBox protocol
+#   (incl. RoMON proxy); grounding for future WinBox-terminal/RoMON work.
+#   https://github.com/Cisco-Talos/Winbox_Protocol_Dissector
+# %btest-opensource: open btest.exe (bandwidth-test) client; possible `check`
+#   feature grounding. https://github.com/samm-git/btest-opensource
+Addrs
+ajv
+amazonq
+amm
+AT-SPI
+awk
+axuielement
+backpressure
+bak
+bjjj
+btest.exe # Mikrotik /tool/bandwidth-test client for windows
+bunfig
+bunx
+canonicalizer
+CDB
+CDP
+centrs
+ciphertext
+cli
+cloc
+cmp
+connectionrefused
+cpus
+crossref
+cwd
+datagram
+davidanson
+DDNS
+defconf
+dogtail
+donny
+dotenv
+DSL # domain specific language
+eai
+env
+esbuild
+ETL
+eventtap
+EVP
+execa
+fanout
+fat-chr
+figcaption
+FlaUI
+frontends
+haakonnessjoen
+Hammerspoon
+HMAC
+hostfwd
+IPC # inter-process communications
+iscsi
+jabb3rd
+kbd
+KDF
+keystream
+KSA
+KVM
+LDTP
+librouteros # <https://github.com/haakonnessjoen/librouteros-api>
+LLDP
+lsp-routeros-ts
+macping
+mactelnet
+mactelnetd
+MCP
+MIB
+mikropkl
+MikroTik
+MNDP
+NAND # NAND flash memory; write-back caches file writes up to ~40s on some MikroTik boards
+netmiko # [Multi-vendor library to simplify Paramiko SSH connections to network devices](https://github.com/ktbyers/netmiko)
+netwatch
+npk # MikroTik package format
+nvme-over-tcp # supported by RouterOS **with** rose-storage.npk extra-package
+OID
+PII # Personally Identifiable Information
+POV
+PRGA
+proplist
+pywinauto
+QML
+qmljsdebugger
+quickchr
+RAML
+readcdb
+remotehub
+restraml
+romon
+ros
+rosetta
+routeros
+routeros-skills
+rsc # RouterOS script / export file extension (.rsc)
+scp
+scriptability
+scriptable
+Sikuli
+SikuliX
+skillcheck
+SNMP
+SPI
+SRP
+strawman
+subarray
+tcode
+tcodes
+TCG # QEMU Tiny Code Generator software emulation backend.
+terminal-over-winbox # [Pure Python implementation of the MikroTik WinBox terminal protocol — encrypted CLI access to RouterOS devices over TCP port 8291](https://github.com/subixonfire/winbox-terminal-protocol)
+tgz
+tikbook
+tikdns
+tikoci
+TIKOCI
+tiktui
+TLV
+traceroute
+tsc
+tzsp
+TZSP
+UDP
+UIA
+uvx
+vcs
+venv
+vite
+vitest
+viw2
+vrf
+webproxy
+WinAppDriver
+winbox
+Wireshark
+workstreams
+XCUI
+XDG
+YYYYMMDDX
+zod
+
+redactable
+specced
+TTL
+
+# MAC-Telnet and native-api protocol vocabulary
+# Wire-format terms from MikroTik MAC-Telnet (Håkon Nessjøen's reference
+# implementation) and the RouterOS binary API.
+ack
+acks
+beginauth
+clienttype
+cptype
+datagrams
+fromserver
+Håkon
+mtwei
+Nessjøen
+passsalt
+plaindata
+ptype
+seskey
+sessionstart
+
+# QEMU/host networking vocabulary (mac-telnet L2 investigation)
+BPF
+libpcap
+mcast
+netdev
+netdevs
+NIC
+SLIRP
+vmnet
+# feth: macOS fake-ethernet interface; sysfs: Linux /sys pseudo-filesystem —
+# both read by resolveEgressMac's virtual-NIC MAC fallback (src/protocols/mac-telnet.ts).
+feth
+sysfs
+
+# CI workflow shell vocabulary (.github/workflows/*.yaml step scripts)
+# pipefail: `set -eo pipefail` so a tee'd `bun test` failure isn't masked;
+# endgroup: GitHub `::endgroup::` log fold; funcs/gsub/img: coverage-parse and
+# CHR-image terms in the gate's summary + coverage-threshold steps;
+# worktree: the git worktree the qa.yaml accumulate-and-gate job uses for the
+# durable qa-history append-log branch.
+endgroup
+funcs
+gsub
+img
+pipefail
+worktree
+# HVF: macOS Hypervisor.framework (x86 CHR acceleration on Intel Macs in
+# verify-extended); choco: Chocolatey, the Windows package manager (QEMU install).
+HVF
+choco
+# CodeRabbit review bot (.coderabbit.yaml); @coderabbitai is the on-demand handle.
+coderabbit
+coderabbitai
+
+# centrs domain vocabulary
+# %identity: the device /system/identity; a centrs CDB comment *lookup key*
+#   (`identity=`) used to resolve `<router>`. Human handle, deliberately may
+#   repeat across records; collisions resolve via `identity/ambiguous` + --match.
+# %tips: top-level envelope channel `tips[]` for advice that is explicitly not an
+#   error or warning (no username set, no CDB found). Shape `{ code, message,
+#   fix? }` with `tip/*` codes. See docs/CONSTITUTION.md (Result envelope).
+# %__default__: reserved CDB record (`target=__default__`) supplying fallback
+#   creds/metadata. Precedence args → env → device record → __default__ →
+#   built-in. Core (CLI/API/MCP); never widens the MCP allowlist.
+neteng
+upsert
+upserts
+upserted
+duplicative
+passwordless
+
+# MNDP discovery vocabulary (WP-2b)
+tlvs
+noaddr
+Hac
+HnD
+EADDRINUSE
+EACCES
+ENOTSUP
+EAFNOSUPPORT
+ECONNREFUSED
+ECONNRESET
+REUSEPORT
+REUSEADDR
+# L2 bridge frame-parsing terms (test/integration/mndp-l2-bridge.ts):
+# ethertype: 16-bit EtherType field in an Ethernet frame (0x0800 = IPv4).
+ethertype
+# ihl: IPv4 Internet Header Length (low nibble of the first byte, in 32-bit words).
+ihl
+# PIIX: Intel PCI-ISA bridge chipset QEMU emulates; shows up in CHR's REST board-name.
+PIIX
+
+# Test-router and host-ARP vocabulary (centrs CLI fixes)
+# bigdude: a live test router (MAC 96:5D:80:7D:BF:59) used to ground fixes.
+bigdude
+ifscope
+macvlan
+unpadded
+
+# RouterOS CLI canonicalization vocabulary
+subshell
+disambiguator
+
+# centrs MCP surface vocabulary
+# blackhole: a RouterOS route type / bare flag used as the bench parser-truth example.
+blackhole
+readback
+creds
+# Streamable: the MCP Streamable HTTP transport.
+Streamable
+# modelcontextprotocol: npm scope of the MCP SDK (@modelcontextprotocol/sdk).
+modelcontextprotocol
+# WIP: work in progress (used for the upstream MikroTik Docusaurus docs site).
+WIP
+# adhoc: future inline host+credential targets; Phase 1 MCP uses CDB-only targets.
+adhoc
+# nonexistentattr: a deliberately invalid RouterOS attribute used to exercise the validate dual-gate.
+nonexistentattr
+# underflow: reading past the end of a buffer; the WinBox CDB codec reports it as a structured parse fault.
+underflow
+underflows
+
+# Werror: the gcc/clang -Werror "treat warnings as errors" flag, referenced by execute --strict.
+Werror
+
+# MTWEI / EC-SRP vocabulary (src/protocols/mtwei.ts, mac-telnet auth)
+# docrypto: mtwei.c's client EC-SRP proof function (mtwei_docrypto), ported to TS.
+docrypto
+# redp: REDP1 (IEEE P1363.2) random-point derivation used in the MTWEI tangle.
+redp
+keypair
+# mul: camelCase fragment from scalarMul (EC scalar multiplication).
+mul
+# weier: camelCase fragment from xWeier (a Weierstrass-form X coordinate).
+weier
+# LSB: least-significant bit (Y-parity in compressed EC point encoding).
+lsb
+# NUL: the 0x00 byte separating username and pubkey in the MTWEI offer.
+nul
+# keepalive: empty-ACK idle keepalive for a held-open MAC-Telnet session.
+keepalive
+# eths: local var for the /interface/ethernet record list in the CHR test.
+eths
+
+# MAC-Telnet interactive-console vocabulary (src/protocols/mac-telnet-console.ts)
+# DSR: ANSI Device Status Report (ESC[6n cursor-position query) the console sends.
+DSR
+# DECID: ANSI "identify terminal" escape (ESC Z) the console also sends.
+DECID
+# CSI: ANSI Control Sequence Introducer (ESC[) — the escape family we strip.
+CSI
+# SIGWINCH: terminal-resize signal; an interactive terminal re-reports its size on it.
+SIGWINCH
+# evl: RouterOS :parse renders a parsed command as "(evl ...)" on the console.
+evl
+# unconfigured: a freshly-flashed RouterOS device with no IP — the mac-telnet use case.
+unconfigured
+unwired
+
+# MAC-Telnet reliability vocabulary (MacTelnetSession.tick: retransmit + keepalive)
+# unacked: an outbound frame not yet acknowledged by the peer's byte-counter ACK.
+unacked
+# retransmittable: a frame (SESSIONSTART/DATA) the session resends until acked.
+retransmittable
+# clockless: the session keeps no real timer; tick(now) supplies time deltas.
+clockless
+# keepalives: plural of keepalive (empty-ACK idle frames).
+keepalives
+
+# btest / bandwidth-test vocabulary (commands/btest, src/protocols/btest.ts)
+# btest: MikroTik bandwidth test peer protocol (TCP/UDP 2000); /tool/bandwidth-test
+#   + /tool/bandwidth-server. centrs's "measure" capability axis.
+btest
+# goodput: application-level TCP throughput (excludes TCP/IP headers + retransmits),
+#   how RouterOS accounts the TCP bandwidth test.
+goodput
+# Weierstrass: the short-Weierstrass curve form of Curve25519 used by MikroTik
+#   EC-SRP5 (shared with mac-telnet MTWEI; see src/protocols/mtwei.ts / ec-srp5.ts).
+Weierstrass
+# ndjson: newline-delimited JSON; the stream / btest output contract (one envelope per line).
+ndjson
+# allocate-udp-ports-from: /tool/bandwidth-server base of the UDP data-port range.
+# srp5: the "5" suffix of EC-SRP5 (the MikroTik EC-SRP variant).
+srp5
+# SRV: the server-endpoint test variable in commands/btest/examples.md.
+srv
+# firewalled: blocked by a firewall (a btest connection-refused remediation).
+firewalled
+# btest reference implementations + EC-SRP5 protocol vocabulary:
+# manawenuz/btest-rs (Rust; both modes + EC-SRP5) and samm-git/btest-opensource
+# (C; no EC-SRP5) are the wire-format references; ECPESVDP-SRP-A/B name the
+# client/server EC-SRP shared-secret roles; docryptos = mtwei.c's server proof fn.
+manawenuz
+samm
+opensource
+ecsrp
+ECPESVDP
+docryptos
+keypairs
+# btest test fixtures (credentials + the "antar" username from the MITM capture).
+testuser
+testpass
+wrongpass
+antar
+swordfish
+
+# btest session layer.
+pselect
+interoperation
+Mbps
+Gbps
+Kbps
+trippable
+
+# btest integration-test fixtures.
+btestuser
+btestpass