@tikoci/centrs 0.1.3 → 0.1.4

package/docs/CONSTITUTION.md

@@ -37,21 +37,29 @@ re-validate-server-side. Validation is not optional polish.
   attribute inspection. The path syntax (commas, no leading slash, last token
   is the verb) is part of the validator contract.
 - `execute` and other CLI-shaped calls validate with `:put [:parse "..."]` plus
-  a semantic gate. **How `:parse` surfaces an error is transport-specific**
-  (grounded on CHR 7.23.1): `:parse` *does* reject an unknown attribute
-  (`bad parameter <name>`) and malformed CLI (`syntax error`), but over REST that
-  text rides the **HTTP-200 `ret` value** (no error status), and over the
-  **native API** `:put [:parse]` returns an opaque `*NN` handle that reveals
-  nothing at all. centrs's REST/native syntax gate runs `:parse` but does not
-  read the `ret`, so for those transports the unknown-attribute catch comes from
-  the separate **`/console/inspect`** semantic gate (or the server's own
-  write re-validation); the `:parse` round-trip there mainly backstops transport
-  errors and the local quote preflight. Over **mac-telnet** the interactive
-  console *prints* the `:parse` result, so centrs reads it and a single console
-  `:parse` covers both syntax and the unknown-attribute (semantic) gate — no
-  `/console/inspect` table needed. In every case a clean parse is necessary, not
-  sufficient on its own; semantic validation is a distinct, transport-appropriate
-  step (`/console/inspect`, the console `:parse` text, or server re-validation).
+  a semantic gate. Grounded on CHR 7.23.3 (GH#230), **`:parse` never throws** —
+  it returns a script value whose printed form carries the verdict. For a bare
+  menu path a clean parse prints `(evl /canonical/path)` with abbreviations
+  expanded; for script-shaped input (e.g. `:put …`, `:global …`, `where …`) the
+  accepted return echoes the script body and may contain arbitrary text such as
+  `expected`. Rejection forms are `(evl bad parameter <name> (line N column M)
+  /path)`, `(<%% bad command name <name> (line N column M) …)`, and the
+  line-anchored `expected … (line N column M)` (spellings: `expected end of
+  command`, `expected command name`, `expected input value`) / `syntax error
+  (line N column M)`. That text rides the **HTTP-200 `ret` value** (REST,
+  `as-string`), the native `as-string` `ret`, and the console's printed output
+  alike — so a single `:put [:parse ...]` covers both the syntax and the
+  **unknown-attribute** gate on every transport. centrs sends `as-string` and now
+  reads the `ret`/printed value (the previous gate ignored it, so it rejected
+  nothing). Because the accepted return echoes the body, the matcher must anchor
+  on the diagnostic shape (the `(<%%` wrapper, or a trailing `(line N column M)`)
+  and never on a bare English word — `expected` is also a real
+  `/ip/firewall/connection` field name.
+  That unknown-attribute check is **name-level only**: `:parse` does not validate
+  parameter *values* (`/ip/address/add address=not-an-ip` parses clean). So a
+  clean parse is necessary, not sufficient, and value-type plus the remaining
+  semantic validation stay distinct steps — `/console/inspect` or the server's
+  own re-validation on the write round-trip.
 - **Peer-measurement commands (`btest`) are exempt from this gate** — they issue
   no RouterOS command, so they validate *option-grammar* + the **EC-SRP5** auth
   exchange instead (the envelope, identity-resolution, and friendly-error
@@ -260,6 +268,43 @@ falls in `--near`'s radius **or** `--bbox`.
 by a distinct `--new-group` flag on `devices add`/`set`, so record selection and
 field-setting never collide on one flag.
 
+#### Resolution providers
+
+Target resolution has **two independent axes**, and centrs keeps them separate so
+the resolver is generalized **once**, not per source (the umbrella plan is #174):
+
+- **Axis A — selection** ("which devices"): the target-selection grammar above.
+- **Axis B — connection-fact origin** ("where host/port/auth for a member come
+  from"): what a resolved member yields. Today: a **CDB record** or an ad-hoc
+  **literal** (+ the `__default__` ladder). Tomorrow: a live descriptor or an
+  inventory entry.
+
+Sources fall into two kinds, and the distinction is normative:
+
+- **Selector-source** — participates in the Axis-A grammar. **CDB** (now), and
+  **TikTOML** next (#137). Multiple selector-sources union into one selection;
+  the split-brain precedence between them is #137's problem, not resolved here.
+- **Named-live-provider** — addressed *only* by an explicit named flag, **never**
+  matched by a selector; fanned out by repeating the flag. Because it owns an
+  **ephemeral** endpoint it also **bypasses** the settings/`__default__` ladder and
+  **conflicts** with `--host`/`--port`/`--username`/`--password`/`--ssh-key`. These
+  are properties of *live/ephemeral* providers, not of any one provider. **quickchr**
+  (`--quickchr <name>`, #134) is the first. A named-live-provider selection is
+  **exclusive** (v1): mixing it with `<router>` positionals or selector flags is
+  `usage/conflicting-flags` — one flag stays single-target, repeating it fans
+  out. Relaxing exclusivity later is additive.
+
+Connection facts resolve into one neutral **per-service endpoint map**
+(`src/resolver/service-endpoint.ts`: `via → ServiceEndpoint`, each carrying
+availability, host, port, TLS, auth, and provenance). A **selector-source** is the
+*degenerate single-endpoint* case — one record materialized lazily once `--via` is
+known. A **named-live-provider** populates the map directly, since it genuinely
+exposes different facts per transport. Providers must **not** be flattened to a
+single host/port: that shape is the contract quickchr's descriptor and TikTOML's
+`services` block both map onto, and flattening it forces exactly the re-plumb #174
+exists to prevent. A `--via` whose service key a provider does not supply is a
+typed unsupported-provider error, never a silent fallback.
+
 ### MCP surface: the CDB is the allowlist
 
 The MCP frontend (`commands/mcp/`) is an adapter over this core, not a new set of
@@ -440,3 +485,9 @@ canonicalization only, never the structured-mode predicate. The gate contract,
 its pinning test, and the parser-vendoring preconditions are documented in
 `commands/execute/README.md` and the `canonicalizeExecuteCommand` doc-comment
 (`src/execute.ts`).
+
+Richer schema-free analysis must distinguish **ambiguous** (multiple plausible
+readings) from **unknown** (no safe reading) and abstain in both cases rather than
+inventing a command, path, symbol class, or transport mapping. These explain-only
+verdicts never widen or reinterpret the execution gate's `mode` or `writeShaped`
+decision.

package/docs/MATRIX.md

@@ -31,6 +31,7 @@ A cell advances only with the matching evidence in the same change.
 | devices  | —             | —             | —             | —             | —             | —             | —             | —                |
 | discover | —             | —             | —             | —             | —             | `CHR-passed`  | —             | —                |
 | check    | `designed`    | `designed`    | `designed`    | `designed`    | `not-started` | `not-started` | `not-started` | `not-started`    |
+| explain  | `designed`    | `designed`    | —             | —             | —             | —             | —             | —                |
 | settings | —             | —             | —             | —             | —             | —             | —             | —                |
 
 ## Status pointers
@@ -59,6 +60,42 @@ section short enough that the grid remains the status surface.
   `winbox-terminal` stay `not-started`. Its per-host fan-out is the machinery the
   IP-scan discovery (#149) will iterate; the L2-default timing evidence (#136) is
   recorded in the README before the cells advance past `designed`.
+- `explain` is `designed` (`commands/explain/README.md`): the explain →
+  validate → run knowledge tier — canonical structure, LSP-like
+  spans/diagnostics, transport classification (api-able vs execute, `curl`
+  rendering), and live schema/completion facts. Its offline mode is the
+  canonicalizer only and opens no protocol connection (evidence is
+  unit/fixture tests); the
+  live probes (`/console/inspect` + `:parse`) ride rest-api/native-api, so
+  those two cells are `designed`. The surface was decided in the 2026-07-19
+  design round (#90) and the spec is **ratified** on the phase-0 grounding
+  lab (#185, ratification PR #187). Phase 0.5 has since promoted the ratified
+  lab logic into the library — `src/explain/{segment,blocks,coordinates,defects,
+  pathresolve,verbsplit,write,symbols,menus,verbs,args,values,brace-slots}.ts`
+  with frozen fixtures under `test/fixtures/explain/` — and phase 1 has composed
+  them into one analysis and envelope in `src/explain.ts` (`explainCommand` /
+  `explainEnvelope`, #202a). **`centrs explain '<input>'` is a real command as
+  of #202b** (`src/cli/explain.ts`), and #202c adds statement argument reading,
+  the closed Q8 transport classifier, equivalent centrs invocations, and
+  opt-in `--curl`. All offline examples, including 1, 2, 6 and 23, run green in
+  `test/unit/explain.test.ts`. The row nonetheless stays `designed`: offline
+  mode occupies no protocol cell, and the two `designed` cells are the live
+  `/console/inspect` + `:parse` probes, which are phase 2. The live grammar
+  (`explain <router> '<input>'`) is parsed and refused with
+  `usage/not-implemented` rather than degraded to an offline run. Cells advance
+  only when the live probes land and their examples run green per the done rule.
+  `src/explain/menus.ts` and `src/explain/catalog.ts` are the **generated**
+  files in that set — the RouterOS menu-vs-command table (#207, from pinned
+  restraml typed trees) and the path catalog (#228, those trees unioned with
+  MikroTik's published CLI Reference, carrying kind, per-entry provenance and
+  the published applicability gate). Regenerate with `bun run explain:menus` /
+  `bun run explain:catalog`; both are drift-checked in QA. They keep the offline
+  analyzer offline; do not hand-edit them. The catalog's **command axis is read**
+  by `pathresolve.ts`, `verbsplit.ts` and `write.ts` (#228 step 2); #235 also
+  reads its menu/settings kind, unioned with `menus.ts` behind
+  `src/explain/is-known-menu.ts`, for both a context-applied relative bare path
+  and an absolute one. Both changes are inside the offline canonicalizer, so
+  this grid is unchanged by them.
 - `transfer / ssh` means the SFTP-backed transfer method. Deferred file-transfer
   methods such as `scp`, `fetch`, and `ftp` are tracked in
   `commands/transfer/README.md`; `fetch` is not a grid column.
@@ -95,7 +132,7 @@ core and carry their own state, tracked here:
 | Surface | State | Spec | Notes |
 | ------- | ----- | ---- | ----- |
 | ts-api | `CHR-passed` | `src/index.ts` | Root TypeScript library surface; everything else adapts it. |
-| cli | `coded` | `src/cli/` | `retrieve`/`execute`/`transfer`/`terminal`/`devices`/`discover`/`btest` wired. |
+| cli | `coded` | `src/cli/` | Every command in `cliCommands` (`src/cli.ts`) is wired: `retrieve`/`execute`/`api`/`transfer`/`terminal`/`explain`/`devices`/`discover`/`btest`/`mcp`/`settings`, plus the `upload`/`download` shortcuts. |
 | mcp | `CHR-passed` | `commands/mcp/` | Scoped-verb stdio MCP server; details in `commands/mcp/README.md` and `test/integration/mcp.test.ts`. |
 | tui | `not-started` | `src/tui.ts` | Stub. |
 | proxy | `not-started` | `src/webproxy.ts` | Stub. |

package/docs/errors/README.md

@@ -47,6 +47,9 @@ Codes are slash-namespaced `family/slug`. The families and where they originate:
 - `input/*` — malformed caller input (paths, MACs, arguments).
 - `internal/*` — centrs bugs / unreachable states.
 - `mndp/*` — MNDP wire codec and listener (`src/data/mndp.ts`).
+- `quickchr/*` — the quickchr named-live-provider (`--quickchr <name>`): optional
+  package availability, descriptor version support, and machine lookup/liveness
+  (`src/resolver/quickchr-provider.ts`).
 - `routeros/*` — RouterOS-surfaced faults mapped by the grounded vocabulary in
   `src/core/routeros-errors.ts` (REST `detail` and native-api `!trap`, identical
   on CHR 7.23).

package/docs/errors/quickchr/machine-not-found.md

@@ -0,0 +1,22 @@
+# `quickchr/machine-not-found`
+
+No quickchr machine is registered under the name passed to `--quickchr <name>`.
+
+## Typical trigger
+
+The name does not match any machine quickchr knows about — a typo, a machine
+that was never created, or one that has been removed. centrs raises this both
+when `QuickCHR.get(name)` returns nothing and when the descriptor call reports
+quickchr's own `MACHINE_NOT_FOUND`.
+
+## Fix
+
+- List the registered machines with `quickchr list` and pass an existing name.
+- Create/start the machine first if it does not exist yet (`quickchr start
+  <name>`).
+- Names are exact — check for typos and case.
+
+If the machine exists but is not running, you will see
+[`quickchr/machine-stopped`](./machine-stopped.md) instead.
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers.

package/docs/errors/quickchr/machine-stopped.md

@@ -0,0 +1,20 @@
+# `quickchr/machine-stopped`
+
+The named quickchr machine exists but is not running, so it has no live
+connection facts (host, forwarded ports, credentials) for centrs to dial.
+
+## Typical trigger
+
+`--quickchr <name>` named a real machine, but its VM is stopped. quickchr only
+knows the forwarded loopback ports and running-state auth while the machine is
+up, so a stopped machine cannot yield a `ServiceEndpointMap`.
+
+## Fix
+
+- Start it: `quickchr start <name>`, then retry `--quickchr <name>`.
+- Confirm state with `quickchr list` / `quickchr inspect <name>`.
+
+This is a per-target failure: in a fan-out over several `--quickchr` targets,
+one stopped machine fails only its own row, not the whole run.
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers.

package/docs/errors/quickchr/package-unavailable.md

@@ -0,0 +1,27 @@
+# `quickchr/package-unavailable`
+
+The optional `@tikoci/quickchr` package is not installed, so a `--quickchr
+<name>` target cannot be resolved into connection facts.
+
+## Typical trigger
+
+You passed `--quickchr <name>` (or otherwise resolved a quickchr target) in an
+install that does not have `@tikoci/quickchr`. centrs declares it as an
+**optional dependency** and loads it through a runtime import, so a normal
+install without it works for every non-quickchr path and only fails here.
+
+## Fix
+
+- Install the package: `bun add @tikoci/quickchr` (0.4.5+ — 0.4.4 introduced
+  the descriptor v1 API but advertises dead TLS endpoints on a stock CHR;
+  see quickchr#95).
+- Or bypass quickchr entirely and target the device directly with `--host`
+  (plus `--username`/`--password`/`--ssh-key` or a CDB record).
+
+This code is raised **only** when the module is genuinely not found. An
+installed package that throws while loading reports
+[`quickchr/unsupported`](./unsupported.md) instead, so the two are never
+confused.
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers for
+the named-live-provider contract.

package/docs/errors/quickchr/unsupported-via.md

@@ -0,0 +1,35 @@
+# `quickchr/unsupported-via`
+
+The quickchr machine resolved fine, but the chosen `--via` has no usable
+service on it. The descriptor is per-service; centrs reads exactly the
+endpoint for the chosen protocol and never falls back to another transport.
+
+## Typical trigger
+
+Any of:
+
+- The `--via` is a protocol the descriptor does not forward. quickchr v1
+  forwards `rest-api`, `native-api`, and `ssh` only — `mac-telnet`, `romon`,
+  `btest`, and `winbox-terminal` are never available on a quickchr target.
+- The service exists but quickchr marked it `available: false` (the error
+  carries the provider's `unavailableReason`).
+- `--via ssh` (or `transfer --via sftp`/`scp`): the SSH endpoint reports no
+  batch-capable auth mode (`batchModes` is empty), so a non-interactive
+  handoff is impossible. centrs fails typed here rather than prompt for a
+  password or silently pick another transport.
+
+## Fix
+
+- Pick one of the machine's live services; the error's `availableServices`
+  context lists them (typically `--via rest-api` / `--via native-api` /
+  `--via ssh`).
+- For the SSH/sftp gate, verify key-based login works from quickchr's side
+  (`quickchr ssh <name>`); once quickchr has a verified key, the descriptor
+  advertises `private-key` in `batchModes` and centrs will use it.
+- If the machine should be forwarding the service but is not, inspect it with
+  `quickchr inspect <name>`.
+- To use a transport quickchr does not forward, target the device directly
+  (`--host`/CDB record) instead of `--quickchr`.
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers for
+why a provider's missing service is a typed error, never a silent fallback.

package/docs/errors/quickchr/unsupported.md

@@ -0,0 +1,35 @@
+# `quickchr/unsupported`
+
+The installed `@tikoci/quickchr` cannot give centrs a usable descriptor: it is
+too old to expose the descriptor API, it failed to load, or it emitted a
+descriptor centrs cannot read.
+
+## Typical trigger
+
+Any of:
+
+- The installed quickchr predates the `QuickCHR.get(name).descriptor()` API
+  (before 0.4.4), so the descriptor entry point is missing.
+- The package is installed but throws while loading (a broken/partial install),
+  which is a real fault — distinct from
+  [`quickchr/package-unavailable`](./package-unavailable.md), which means "not
+  installed at all".
+- The descriptor is malformed or pre-v1: no numeric `descriptorVersion`, no
+  `services` map, or missing `name`/`version`/`arch`. centrs rejects it rather
+  than crash on a later field access or silently treat `services` as empty
+  (which would hide a provider contract violation).
+- The descriptor version is **newer** than centrs supports
+  (`descriptorVersion` > 1); a newer quickchr speaks a schema this centrs
+  predates.
+
+## Fix
+
+- Upgrade quickchr to a release that emits descriptor v1: `bun add
+  @tikoci/quickchr` (0.4.5+ — 0.4.4 has the API but a descriptor endpoint
+  bug, quickchr#95).
+- If the descriptor looks wrong, inspect the machine directly with `quickchr
+  inspect <name>` — it may be in a transient state.
+- If the descriptor is newer than centrs supports, upgrade centrs.
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers for
+the descriptor contract and the supported version boundary.

package/docs/errors/routeros/version-unsupported.md

@@ -0,0 +1,26 @@
+# `routeros/version-unsupported`
+
+The device's RouterOS version does not provide the operation this command
+needs. centrs pre-flighted the generated command against the device's known
+version (a live read, or the stored CDB `version=` fact) and refused it before
+touching the router, instead of letting the device return a raw protocol
+error.
+
+Distinct from `routeros/unsupported-capability`, where the chosen *protocol*
+cannot carry the operation at all regardless of device version.
+
+## Context fields
+
+- `capability` — stable slug of the missing operation.
+- `version` — the device version that was checked.
+- `versionSource` — `live`, `cdb-fact`, or `caller`. A `cdb-fact` version is
+  stale-by-nature; it was recorded by `discover --save` or `devices --check`.
+- `supported` — the version windows where RouterOS provides the operation
+  (inclusive `min`, optional exclusive `maxExclusive` for backport windows).
+
+## Fix
+
+Upgrade RouterOS to one of the versions listed in `supported`. If the device
+was already upgraded and the check used a stale stored fact
+(`versionSource: "cdb-fact"`), refresh the record's `version=` comment fact
+and retry.

package/docs/errors/transport/provider-trust.md

@@ -0,0 +1,29 @@
+# `transport/provider-trust`
+
+A warning (not an error): the target came from a named-live-provider
+(`--quickchr <name>`), and centrs relaxed peer verification to use its
+endpoint.
+
+## Why this happens
+
+quickchr's descriptor prefers the VM's TLS forwards (`https` / `api-ssl`),
+whose certificate is the CHR's own self-signed one, and its SSH endpoint's
+host key is regenerated per VM. The descriptor carries no trust material, so
+strict verification would reject every quickchr target and force `--insecure`
+ceremony onto every lab call.
+
+Instead, centrs treats the endpoint as **trusted by provenance**: quickchr
+vouches for a loopback-forwarded port (`127.0.0.1:<port>`) of a VM the user
+owns, so peer verification is relaxed for exactly that connection — with
+`provider` provenance on `meta.settings.insecure` and this warning on the
+envelope, never silently.
+
+## When to care
+
+- If this warning appears on a target you did **not** select with
+  `--quickchr`, that is a bug — report it.
+- The relaxation never applies to CDB, literal, or env-resolved targets;
+  those still require an explicit `--insecure` (which raises
+  [`transport/insecure-trust`](./insecure-trust.md) instead).
+
+See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) → Resolution providers.

package/docs/errors/usage/stdin-ignored.md

@@ -0,0 +1,28 @@
+# `usage/stdin-ignored`
+
+stdin was redirected but the input came from the positional argument, so
+anything piped in was not analyzed.
+
+This is a **warning**, not an error: the analysis ran and its result is exactly
+what the arguments asked for. What the warning reports is that a second possible
+input source was present and lost.
+
+## Fix
+
+Name the source you meant:
+
+```bash
+cat script.rsc | centrs explain --file -  # analyze stdin
+centrs explain '/ip/route print'          # analyze the positional
+```
+
+The live form spells the same thing (`… | centrs explain edge1 --file -`) and is
+already parsed, but it is refused with
+[`usage/not-implemented`](not-implemented.md) until the phase-2 live probes
+land — so it is not a fix you can apply today.
+
+`explain` reads ambient stdin only when no positional could be the input, so a
+positional always wins. It cannot check whether the pipe actually carries bytes
+without consuming fd 0, which is why the collision is reported rather than
+resolved. See [`commands/explain/README.md`](https://github.com/tikoci/centrs/blob/main/commands/explain/README.md)
+for the positional grammar.

package/docs/errors/validation/unknown-attribute.md

@@ -1,9 +1,42 @@
 # `validation/unknown-attribute`
 
-An attribute is not valid for the path/verb per /console/inspect.
+An attribute or argument is not valid for the requested RouterOS operation.
+The validator rejects the request before RouterOS executes it.
+
+## Context keys
+
+Context keys vary by validation mechanism. Callers must not assume every key
+below is present on every `validation/unknown-attribute` rejection.
+
+| Key | Type | Notes |
+| --- | ---- | ----- |
+| `parameter` | `string` | First offending name. Present on retrieve and inspect-gated rejections, and on console `:parse` when RouterOS reports `bad parameter <name>`. |
+| `requestedAttributes` | `string[]` | Full requested name list. Retrieve and inspect-gated API/execute validation only. |
+| `availableAttributes` | `string[]` | Names exposed for the path/verb. Retrieve and inspect-gated API/execute validation only. |
+| `path` | `string` | Slash-prefixed RouterOS path (for example `/ip/address`). Retrieve and inspect-gated API/execute validation only. |
+| `verb` | `string` | Verb when applicable (`print`, `add`, `set`, …). Inspect-gated API/execute validation only; retrieve is path-only. |
+| `validationSource` | `string` | Validation provenance. Inspect-gated API/execute and console `:parse` only; retrieve does not currently emit it. |
+| `command` | `string` | Original CLI command. Console `:parse` only. |
+| `detail` | `string` | Raw RouterOS parse diagnostic. Console `:parse` only. |
+
+Console `:parse` may also put RouterOS' byte location in the top-level
+`error.position` field. On older RouterOS versions, an unknown name can produce
+only a generic syntax diagnostic; that is reported as `validation/syntax`
+because no parameter identity is available.
+
+Provenance:
+
+- `src/api.ts:988,1033` — REST/native `validateApiRequest` (print vs add/set branches)
+- `src/execute.ts:742` — REST `validateRestExecute`
+- `src/retrieve.ts:233` — REST `retrieve` attribute projection
+- `src/protocols/mac-telnet-console.ts:674` — console `:parse` (`bad parameter <name>`) over mac-telnet/ssh
+- `src/core/routeros-errors.ts:128` — `!trap`/`detail` `unknown parameter <name>` (routeros/unknown-attribute sibling)
 
 ## Fix
 
-See [`docs/CONSTITUTION.md`](../../CONSTITUTION.md) for the centrs error
-contract. This stub will be expanded with the typical trigger and remediation
-for `validation/unknown-attribute`.
+For `retrieve` and inspect-gated API/execute validation, check the name against
+`/console/inspect`; `retrieve --list-attributes` lists the available properties.
+For console `:parse`, compare `context.parameter` with the RouterOS parameters
+for `context.command`; `context.detail` preserves the device's raw diagnostic.
+Use `--validate=false` only when intentionally probing an undocumented RouterOS
+edge.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tikoci/centrs",
-	"version": "0.1.3",
+	"version": "0.1.4",
 	"main": "src/index.ts",
 	"module": "src/index.ts",
 	"repository": {
@@ -9,11 +9,11 @@
 	},
 	"homepage": "https://github.com/tikoci/centrs#readme",
 	"bugs": "https://github.com/tikoci/centrs/issues",
-	"packageManager": "bun@1.3.13",
+	"packageManager": "bun@1.3.14",
+	"license": "MIT",
 	"devDependencies": {
-		"@biomejs/biome": "2.5.2",
+		"@biomejs/biome": "2.5.7",
 		"@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
-		"@tikoci/quickchr": "^0.4.2",
 		"@types/bun": "^1.3.13",
 		"cloc": "^2.6.0-cloc",
 		"cspell": "^10.0.0",
@@ -22,7 +22,9 @@
 		"secretlint": "^13.0.2",
 		"typedoc": "^0.28.19"
 	},
-	"optionalDependencies": {},
+	"optionalDependencies": {
+		"@tikoci/quickchr": "^0.4.7"
+	},
 	"peerDependencies": {
 		"typescript": "^6.0.3"
 	},
@@ -45,22 +47,24 @@
 	"files": [
 		"src/",
 		"commands/",
+		"docs/CLI.md",
 		"docs/CONSTITUTION.md",
 		"docs/MATRIX.md",
 		"docs/errors/",
 		"README.md",
 		"CHANGELOG.md",
 		"SECURITY.md",
+		"LICENSE",
 		"GLOSSARY.txt"
 	],
 	"scripts": {
-		"ci": "bun run lint && bun run test && bun run build",
-		"git:pre-commit": "bun run lint",
+		"ci": "bun run lint:ci && bun run test && bun run build",
+		"git:pre-commit": "bun run lint:git:commit",
 		"git:pre-push": "bun run lint:git:push",
 		"lint": "bun run lint:biome && bun run lint:typecheck",
-		"lint:git:commit": "bun run lint",
-		"lint:git:push": "bun run lint:ci && bun run test && bun run build",
-		"lint:ci": "bun run lint && bun run lint:markdownlint && bun run lint:cspell && bun run lint:secretlint",
+		"lint:git:commit": "bun run lint:biome",
+		"lint:git:push": "bun run lint:ci",
+		"lint:ci": "bun run lint && bun run docs:cli:check && bun run explain:value-census:readme:check && bun run explain:token-census:readme:check && bun run explain:operator-readme:check && bun run lint:markdownlint && bun run lint:cspell && bun run lint:secretlint",
 		"lint:cspell": "cspell lint . --gitignore",
 		"lint:cspell:all": "cspell lint . --no-gitignore",
 		"lint:markdownlint": "markdownlint-cli2 \"**/*.md\" \"!.scratch/**\"",
@@ -82,9 +86,40 @@
 		"test:ci": "bun test --coverage",
 		"test:all": "bun run test:ci",
 		"check:agent": "bun run scripts/agent-check.ts",
+		"corpus:fetch": "bun run scripts/corpus-fetch.ts",
 		"build": "bun build src/index.ts src/cli.ts src/mcp.ts src/tui.ts src/webproxy.ts src/protocols/index.ts --outdir dist --target bun",
 		"build:doc:api": "typedoc --out docs/api src/index.ts",
+		"docs:cli": "bun run scripts/gen-cli-docs.ts",
+		"docs:cli:check": "bun run scripts/gen-cli-docs.ts --check",
 		"docs:errors": "bun run scripts/gen-error-pages.ts",
+		"explain:catalog": "bun run scripts/gen-explain-catalog.ts",
+		"explain:catalog:check": "bun run scripts/gen-explain-catalog.ts --check",
+		"explain:corpus-census": "bun run scripts/explain-corpus-census.ts",
+		"explain:highlight-slice": "bun run scripts/explain-highlight-slice.ts",
+		"explain:menus": "bun run scripts/gen-explain-menus.ts",
+		"explain:operator-census": "bun run scripts/explain-operator-census.ts",
+		"explain:operator-census:check": "bun run scripts/explain-operator-census.ts --check",
+		"explain:operator-readme": "bun run scripts/explain-operator-slice.ts --readme",
+		"explain:operator-readme:check": "bun run scripts/explain-operator-slice.ts --readme --check",
+		"explain:operator-slice": "bun run scripts/explain-operator-slice.ts",
+		"explain:probe:brace-slots": "bun run scripts/probes/explain-brace-slot-sweep.ts",
+		"explain:probe:escapes": "bun run scripts/probes/explain-escape-sweep.ts",
+		"explain:probe:highlight-recapture": "bun run scripts/probes/explain-highlight-recapture.ts",
+		"explain:probe:operators": "bun run scripts/probes/explain-operator-sweep.ts",
+		"explain:probe:symbol-anchors": "bun run scripts/probes/explain-symbol-anchors.ts",
+		"explain:probe:symbol-arms-score": "bun run scripts/probes/explain-symbol-arms-score.ts",
+		"explain:probe:symbol-bad-sigil-replay": "bun run scripts/probes/explain-symbol-bad-sigil-replay.ts",
+		"explain:probe:symbol-classes-replay": "bun run scripts/probes/explain-symbol-classes-replay.ts",
+		"explain:probe:version-floors": "bun run scripts/probes/explain-version-floors.ts",
+		"explain:menus:check": "bun run scripts/gen-explain-menus.ts --check",
+		"explain:value-census": "bun run scripts/explain-value-census.ts",
+		"explain:value-census:check": "bun run scripts/explain-value-census.ts --check",
+		"explain:value-census:readme": "bun run scripts/explain-value-census.ts --readme",
+		"explain:value-census:readme:check": "bun run scripts/explain-value-census.ts --readme --check",
+		"explain:token-census": "bun run scripts/explain-token-census.ts",
+		"explain:token-census:check": "bun run scripts/explain-token-census.ts --check",
+		"explain:token-census:readme": "bun run scripts/explain-token-census.ts --readme",
+		"explain:token-census:readme:check": "bun run scripts/explain-token-census.ts --readme --check",
 		"security": "bun run lint:secretlint && bun run lint:markdownlint"
 	},
 	"type": "module",