@fibril/can-core 0.0.0

package/dist/index.d.ts

@@ -0,0 +1,1282 @@
+import { CanFrameTx, ITransport, Unsubscribe } from "@fibril/can-transport";
+
+//#region src/ack-tracker.d.ts
+/**
+ * In-flight ACK/NAK ledger keyed by `seq`. Mirrors the per-node `AckEntry`
+ * map in `fibril_can_bridge/include/fibril_can_bridge/node_agent.hpp` but
+ * pared down for the single-threaded TS master — no deadlines list, the
+ * caller polls via {@link sweep}.
+ */
+type AckOutcome = {
+  kind: 'acked';
+} | {
+  kind: 'naked';
+  reason: number;
+} | {
+  kind: 'timed-out';
+};
+type AckCallback = (outcome: AckOutcome) => void;
+declare class AckTracker {
+  #private;
+  constructor(now?: () => number);
+  get pendingCount(): number;
+  /** Returns false if `seq` is already tracked; the existing entry is kept. */
+  track(seq: number, deadlineMs: number, cb: AckCallback): boolean;
+  /** Idempotent — fires `acked` if `seq` is pending. */
+  onAck(seq: number): void;
+  /** Idempotent — fires `naked` with the reason if `seq` is pending. */
+  onNak(seq: number, reason: number): void;
+  /** Fire `timed-out` for every entry whose deadline elapsed by `nowMs`. */
+  sweep(nowMs?: number): void;
+  /** Drop every entry without firing callbacks. Test-only. */
+  clear(): void;
+}
+//#endregion
+//#region src/can-id.d.ts
+/**
+ * CAN ID layout (Extended) and config-plane / NAK / svc-status / node-state
+ * constants. Mirrors SPEC §3, §5, §7 and `fibril_can_runtime/include/fibril_can/fcan_protocol.h`
+ * / `fibril_can_bridge/include/fibril_can_bridge/can_id.hpp`.
+ *
+ * Extended ID layout (29 bit, §3.2):
+ *   [28:26] channel    (3 bit)
+ *   [25:19] node_id    (7 bit, 0x7F = broadcast)
+ *   [18:11] index      (8 bit, service_index / cmd_code)
+ *   [10:3]  seq        (8 bit, call_id / seq_num)
+ *   [2]     seg        (1 bit, 0=SINGLE, 1=SEGMENT)
+ *   [1:0]   reserved   (2 bit, 0)
+ *
+ * Standard ID (11 bit, §3.1) is dynamically allocated by the master and
+ * has no fixed bitfield meaning — kept here only as the wire mask.
+ */
+declare const PROTOCOL_VERSION = 1;
+declare const MAX_FRAME_PAYLOAD = 64;
+declare const CHAN_CONFIG = 0;
+declare const CHAN_SVC_REQUEST = 1;
+declare const CHAN_SVC_RESPONSE = 2;
+declare const NODE_ID_BROADCAST = 127;
+declare const STD_ID_MASK = 2047;
+declare const SVC_PARAM_SET = 253;
+declare const SVC_CANCEL = 255;
+declare const SVC_MAX_FIRST_CLASS = 252;
+declare const CMD_DISCOVER = 1;
+declare const CMD_ANNOUNCE = 2;
+declare const CMD_SCHEMA_READ = 3;
+declare const CMD_SCHEMA_DATA = 4;
+declare const CMD_HEARTBEAT = 5;
+declare const CMD_MASTER_HEARTBEAT = 7;
+declare const CMD_FRAME_DEFINE = 16;
+declare const CMD_HB_PERIOD = 19;
+declare const CMD_START = 32;
+declare const CMD_STOP = 33;
+declare const CMD_ACK = 126;
+declare const CMD_NAK = 127;
+declare const NAK_UNKNOWN_CMD = 1;
+declare const NAK_BAD_LENGTH = 2;
+declare const NAK_BAD_PARAM = 3;
+declare const NAK_NO_RESOURCE = 4;
+declare const NAK_BAD_STATE = 5;
+declare const NAK_ID_CONFLICT = 6;
+declare const NAK_INDEX_RANGE = 7;
+declare const NAK_DIR_MISMATCH = 8;
+declare const NAK_SIZE_OVERFLOW = 9;
+declare const STATE_UNPROVISIONED = 0;
+declare const STATE_PROVISIONED = 1;
+declare const STATE_RUNNING = 2;
+declare const STATE_FAULT = 3;
+declare const FAULT_NONE = 0;
+declare const FAULT_NOMEM = 1;
+declare const FAULT_INDEX_OVERFLOW = 2;
+declare const FAULT_ID_CONFLICT = 3;
+declare const DIR_TX_S2M = 0;
+declare const DIR_RX_M2S = 1;
+declare const SVC_OK = 0;
+declare const SVC_ACCEPTED = 1;
+declare const SVC_APP_ERROR = 2;
+declare const SVC_BUSY = 3;
+declare const SVC_UNAVAIL = 4;
+declare const SVC_BAD_INDEX = 5;
+declare const SVC_BAD_VALUE = 6;
+declare const SVC_BAD_LENGTH = 8;
+declare const SEG_FIRST_DATA = 61;
+declare const SEG_REST_DATA = 63;
+declare const SEG_MAX_TOTAL = 1024;
+declare const SEG_MAX_SEQ = 31;
+/** Byte offset of segment `seq` within the reassembled buffer (§7.4). */
+declare function segOffset(seq: number): number;
+/**
+ * Build a 29-bit Extended ID from its bitfields (§3.2). Inputs are masked
+ * down to their respective field widths.
+ */
+declare function makeExtId(channel: number, nodeId: number, index: number, seq: number, seg?: number): number;
+declare function extChannel(id: number): number;
+declare function extNodeId(id: number): number;
+declare function extIndex(id: number): number;
+declare function extSeq(id: number): number;
+declare function extSeg(id: number): number;
+//#endregion
+//#region src/config-plane.d.ts
+/**
+ * Config-plane wire codec. Mirrors
+ * `fibril_can_bridge/include/fibril_can_bridge/config_plane_codec.hpp`
+ * and `fibril_can_bridge/src/config_plane_codec.cpp`.
+ *
+ * All integers are little-endian. Decoders return `null` on malformed input
+ * (wrong length etc.); encoders produce CAN frames padded to the next DLC
+ * step, matching what the slave sees on the bus.
+ */
+/** ANNOUNCE payload (S→M, §5.4). */
+interface AnnounceMsg {
+  schemaHash: bigint;
+  protocolVersion: number;
+  bootId: number;
+  blobLen: number;
+  /** Length K, indexed by block-type ordinal. */
+  instanceCounts: Uint8Array;
+}
+/** HEARTBEAT payload (S→M, §5.8). */
+interface HeartbeatMsg {
+  bootId: number;
+  state: number;
+  faultSummary: number;
+}
+/** SCHEMA_DATA payload (S→M, §5.5). */
+interface SchemaDataMsg {
+  offset: number;
+  bytes: Uint8Array;
+}
+/** NAK payload (S→M, §5.9). */
+interface NakMsg {
+  cmd: number;
+  reason: number;
+}
+/** One entry inside a FRAME_DEFINE command (§5.6). */
+interface FrameDefineEntry {
+  topicIndex: number;
+  fieldBitmask: number;
+}
+declare function decodeAnnounce(data: Uint8Array): AnnounceMsg | null;
+declare function decodeHeartbeat(data: Uint8Array): HeartbeatMsg | null;
+declare function decodeSchemaData(data: Uint8Array): SchemaDataMsg | null;
+declare function decodeNak(data: Uint8Array): NakMsg | null;
+/** Broadcast DISCOVER — all nodes re-announce and clear their frame tables. */
+declare function encodeDiscover(): CanFrameTx;
+/** Targeted DISCOVER for a single node (§5.11 reprovisioning). */
+declare function encodeDiscoverTo(nodeId: number): CanFrameTx;
+/** Broadcast MASTER_HEARTBEAT (§5.11). Refreshes slave master-lost watchdogs. */
+declare function encodeMasterHeartbeat(): CanFrameTx;
+declare function encodeSchemaRead(nodeId: number, offset: number, length: number, seq: number): CanFrameTx;
+declare function encodeFrameDefine(nodeId: number, seq: number, stdId: number, periodUs: number, dir: number, entries: readonly FrameDefineEntry[]): CanFrameTx;
+declare function encodeStart(nodeId: number, seq: number): CanFrameTx;
+declare function encodeStop(nodeId: number, seq: number): CanFrameTx;
+/**
+ * Accumulator for SCHEMA_DATA chunks. The slave DLC-pads each response (§4.3)
+ * so `chunk.bytes.length` is typically larger than what the master requested;
+ * the accumulator clips against `expectedChunkLen` and the remaining blob
+ * length to drop those padding bytes (parity with
+ * `append_schema_chunk` in `fibril_can_bridge/src/config_plane_codec.cpp`).
+ *
+ * Out-of-order chunks are rejected (returns 0 from {@link append}).
+ */
+declare class SchemaAccumulator {
+  #private;
+  constructor(blobTotalLen: number);
+  get length(): number;
+  get blobTotalLen(): number;
+  get complete(): boolean;
+  bytes(): Uint8Array;
+  /**
+   * Append `chunk` if its offset matches the current accumulator length.
+   * Returns the number of bytes actually appended (0 on rejection).
+   */
+  append(chunk: SchemaDataMsg, expectedChunkLen: number): number;
+}
+//#endregion
+//#region src/scalar-codec.d.ts
+/**
+ * Scalar type enumeration and little-endian wire codecs. Mirrors
+ * `fibril_can_core/include/fibril_can_core/scalar_type.hpp` and
+ * `fibril_can_core/src/scalar_type.cpp`.
+ *
+ * Type ordinal values are part of the protobuf schema blob's enum, so they
+ * must not be renumbered.
+ */
+declare enum ScalarType {
+  Bool = 0,
+  U8 = 1,
+  I8 = 2,
+  U16 = 3,
+  I16 = 4,
+  U32 = 5,
+  I32 = 6,
+  U64 = 7,
+  I64 = 8,
+  F32 = 9,
+  F64 = 10
+}
+declare const SCALAR_NAMES: readonly string[];
+/** Wire size in bytes of one scalar element. bool is 1 byte. */
+declare function scalarSize(type: ScalarType): number;
+declare function scalarName(type: ScalarType): string | undefined;
+declare function scalarFromName(name: string): ScalarType | undefined;
+/**
+ * Pack an integer / bool value as little-endian bytes into `out` at `offset`.
+ * Writes scalarSize(type) bytes — pass a wide-enough `out`.
+ *
+ * Pass `bigint` for 64-bit types (U64/I64). `number` is accepted for
+ * everything (it is internally widened to bigint so signed callers get the
+ * same sign-extension semantics as the C++ `pack_scalar_int_le(uint64_t)`).
+ * Signed callers pass the negative number directly; the function performs the
+ * 64-bit two's-complement cast.
+ */
+declare function packScalarIntLe(type: ScalarType, value: number | bigint, out: Uint8Array, offset?: number): void;
+/** Bit-cast a float32 to its IEEE-754 little-endian representation. */
+declare function packScalarF32Le(value: number, out: Uint8Array, offset?: number): void;
+/** Bit-cast a float64 to its IEEE-754 little-endian representation. */
+declare function packScalarF64Le(value: number, out: Uint8Array, offset?: number): void;
+/**
+ * Inverse of {@link packScalarIntLe}. Returns the raw bit pattern as bigint;
+ * caller interprets sign via {@link sign-extend} helpers below.
+ */
+declare function unpackScalarIntLe(type: ScalarType, src: Uint8Array, offset?: number): bigint;
+declare function unpackScalarF32Le(src: Uint8Array, offset?: number): number;
+declare function unpackScalarF64Le(src: Uint8Array, offset?: number): number;
+/**
+ * Sign-extend a bigint that was read as an unsigned `bytes`-byte field to a
+ * signed bigint. Useful for I8/I16/I32/I64 after {@link unpackScalarIntLe}.
+ */
+declare function signExtend(bits: bigint, bytes: number): bigint;
+//#endregion
+//#region src/schema.d.ts
+declare enum Direction {
+  M2S = 0,
+  S2M = 1
+}
+interface SchemaField {
+  name: string;
+  type: ScalarType;
+  /** 0 = scalar; >0 = fixed-length array of `type`. */
+  arrayLen: number;
+  /** Per-field override of the owning topic's defaultPeriodUs; undefined = inherit. */
+  periodUsOverride?: number;
+  /** Master-side planner skips this field if false. Defaults to true. */
+  txEnabled: boolean;
+}
+interface RosMapping {
+  rosType: string;
+  rosName: string;
+  fieldMap: string[];
+}
+interface SchemaTopic {
+  name: string;
+  dir: Direction;
+  fields: SchemaField[];
+  defaultPeriodUs: number;
+  ros: RosMapping;
+}
+interface SchemaService {
+  name: string;
+  request: SchemaField[];
+  response: SchemaField[];
+  ros: RosMapping;
+}
+interface SchemaParam {
+  name: string;
+  type: ScalarType;
+  arrayLen: number;
+  /** Little-endian packed payload. Always present for default; min/max may be empty. */
+  defaultValue: Uint8Array;
+  minValue: Uint8Array;
+  maxValue: Uint8Array;
+}
+interface SchemaBlockType {
+  name: string;
+  topics: SchemaTopic[];
+  services: SchemaService[];
+  params: SchemaParam[];
+}
+interface SchemaBlockArray {
+  /** Index into NodeSchema.types (was `type_id` on the wire). */
+  blockTypeIndex: number;
+  rosNamespace: string;
+}
+interface WireLimits {
+  /** 0 = use bridge default. */
+  paramSetBatchBytes: number;
+}
+interface NodeSchema {
+  protocolVersion: number;
+  nodeName: string;
+  types: SchemaBlockType[];
+  instances: SchemaBlockArray[];
+  limits: WireLimits;
+}
+/**
+ * Parse a schema blob (proto3 binary) into the master-side IR.
+ *
+ * Throws {@link ProtoError} on malformed input or on
+ * `protocolVersion !== 1` (the only version this codec understands —
+ * mirrors C++ side's UnsupportedProtocolVersion behaviour).
+ */
+declare function decodeSchema(blob: Uint8Array): NodeSchema;
+/** Wire size in bytes for a single field (scalar or fixed array). */
+declare function fieldWireSize(field: SchemaField): number;
+//#endregion
+//#region src/dynamic-codec.d.ts
+/**
+ * Field-driven dict ⇄ Uint8Array codec. The runtime equivalent of what
+ * codegen would otherwise emit per message — encode/decode is a pure
+ * function of the field list ({@link SchemaField}[]) and the JS dict.
+ *
+ * Conventions (matches CLAUDE.md "値の表現規約"):
+ * - dict keys are the schema field name verbatim
+ * - scalar ↔ JS `number`, except U64/I64 ↔ `bigint`
+ * - bool ↔ JS `boolean`
+ * - fixed-length array (`arrayLen > 0`) ↔ regular JS array
+ *   (`number[]` / `bigint[]` / `boolean[]`) of exactly `arrayLen` elements
+ *
+ * Throws on missing / wrong-shape inputs. Decode tolerates extra trailing
+ * bytes (mirrors C++ side: the master ignores trailing slop so that future
+ * schema additions don't break older decoders).
+ */
+declare class DynamicCodecError extends Error {
+  constructor(message: string);
+}
+/** Tag union of accepted JS value shapes for one field. */
+type FieldValue = number | bigint | boolean | number[] | bigint[] | boolean[];
+/** Dict shape — string-keyed values, one entry per field. */
+type Dict = Record<string, FieldValue>;
+/**
+ * Sum the wire size of a field list. The result is the byte count that
+ * {@link encodeFields} will produce.
+ */
+declare function fieldsWireSize(fields: readonly SchemaField[]): number;
+/**
+ * Encode a dict into the canonical little-endian wire bytes for `fields`.
+ * Returns a fresh `Uint8Array`. Throws {@link DynamicCodecError} on a
+ * missing or wrong-shape field.
+ */
+declare function encodeFields(fields: readonly SchemaField[], value: Dict): Uint8Array;
+/**
+ * Decode wire bytes into a dict keyed by field name. Extra trailing bytes
+ * are ignored. Throws {@link DynamicCodecError} only if the payload is
+ * shorter than the field list demands.
+ */
+declare function decodeFields(fields: readonly SchemaField[], bytes: Uint8Array): Dict;
+//#endregion
+//#region src/numbering.d.ts
+/**
+ * Flat-numbering tables for topics, services, and parameters (§4.2).
+ *
+ * Port of `fibril_can_core/src/numbering.cpp`. Numbering is a pure function
+ * of (schema, instance-count-vector). The same tables are derived
+ * independently by codegen (with max_count for static checks), the slave
+ * runtime (with actual counts at boot) and the master (with counts from the
+ * ANNOUNCE frame) — keeping this in one place is what guarantees they agree.
+ */
+declare const SERVICE_INDEX_CANCEL = 255;
+declare const SERVICE_INDEX_PARAM_SET = 253;
+/** Maximum first-class service_index produced by numbering (inclusive). */
+declare const SERVICE_INDEX_MAX = 252;
+/** Number of available first-class service slots. */
+declare const SERVICE_INDEX_CAPACITY: number;
+declare enum NumberingError {
+  Ok = "ok",
+  ServiceIndexOverflow = "service_index overflow (>253)",
+  TopicIndexOverflow = "topic_index overflow (>65535)",
+  ParamIndexOverflow = "param_index overflow (>65535)",
+  InstanceCountMismatch = "actual_counts length != #instances",
+  BlockTypeOutOfRange = "BlockArray::blockTypeIndex out of range"
+}
+/** Concrete location of one (instance, endpoint) within a NodeSchema. */
+interface EndpointKey {
+  /** Index into NodeSchema.instances. */
+  blockArray: number;
+  /** 0..count-1 */
+  instance: number;
+  /** 0..nEndpoints(type)-1 */
+  endpoint: number;
+}
+/** Forward + inverse maps for a single endpoint kind. */
+interface NumberingTable {
+  /**
+   * size = Σ_b(actualCounts[b] × nEndpoints(types[instances[b].blockTypeIndex]));
+   * the array index IS the flat numbering.
+   */
+  byIndex: EndpointKey[];
+  /** Per-block-array base offsets (size = #blockArrays + 1; last is total). */
+  bases: number[];
+}
+interface NumberingResult {
+  topics: NumberingTable;
+  services: NumberingTable;
+  params: NumberingTable;
+  status: NumberingError;
+}
+/**
+ * Compute the three numbering tables. `actualCounts` must have the same
+ * length as `schema.instances`. The result has `status !== Ok` if input is
+ * malformed or service_index would overflow into the reserved range
+ * (§4.2 §9.4).
+ *
+ * On error the returned tables are empty but still safe to inspect.
+ */
+declare function computeNumbering(schema: NodeSchema, actualCounts: readonly number[]): NumberingResult;
+//#endregion
+//#region src/schema-index.d.ts
+/** Resolved descriptor for one S→M or M→S topic. */
+interface TopicDescriptor {
+  readonly kind: 'topic';
+  readonly path: string;
+  readonly topicIndex: number;
+  readonly dir: Direction;
+  readonly fields: readonly SchemaField[];
+  readonly defaultPeriodUs: number;
+  readonly wireSize: number;
+}
+/** Resolved descriptor for one Service. */
+interface ServiceDescriptor {
+  readonly kind: 'service';
+  readonly path: string;
+  readonly serviceIndex: number;
+  readonly requestFields: readonly SchemaField[];
+  readonly responseFields: readonly SchemaField[];
+  readonly requestWireSize: number;
+  readonly responseWireSize: number;
+}
+/** Resolved descriptor for one Param (single-field). */
+interface ParamDescriptor {
+  readonly kind: 'param';
+  readonly path: string;
+  readonly paramIndex: number;
+  readonly type: ScalarType;
+  /** 0 = scalar; >0 = fixed-length array of `type`. */
+  readonly arrayLen: number;
+  readonly wireSize: number;
+  readonly defaultValue: Uint8Array;
+  readonly minValue: Uint8Array;
+  readonly maxValue: Uint8Array;
+}
+type EndpointDescriptor = TopicDescriptor | ServiceDescriptor | ParamDescriptor;
+/**
+ * Path → descriptor index for one slave. Built once from
+ * (schema, numbering) and reused for the lifetime of a snapshot.
+ */
+declare class SchemaIndex {
+  #private;
+  constructor(schema: NodeSchema, numbering: NumberingResult, instanceCounts: readonly number[]);
+  topic(path: string): TopicDescriptor | undefined;
+  service(path: string): ServiceDescriptor | undefined;
+  param(path: string): ParamDescriptor | undefined;
+  topicByIndex(idx: number): TopicDescriptor | undefined;
+  serviceByIndex(idx: number): ServiceDescriptor | undefined;
+  paramByIndex(idx: number): ParamDescriptor | undefined;
+  /** All topic paths in numbering order. Useful for debugging / sniffer UI. */
+  topicPaths(): string[];
+  servicePaths(): string[];
+  paramPaths(): string[];
+}
+//#endregion
+//#region src/service-client.d.ts
+/** Per-call options. */
+interface ServiceCallOptions {
+  /** Pre-encoded request payload (no status byte — that's response-only). */
+  request: Uint8Array;
+  /** Override default timeout. Default 250 ms (matches bridge `service_timeout_`). */
+  timeoutMs?: number;
+  /** Cancel via AbortSignal — fires SVC_CANCEL (§7.5) to the slave. */
+  signal?: AbortSignal;
+}
+/** Resolved service response. `status === 0` (SVC_OK) is the success path. */
+interface ServiceResult {
+  status: number;
+  data: Uint8Array;
+}
+/** Throwable error union for `ServiceClient.call`. */
+declare class ServiceCallError extends Error {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class ServiceTimeoutError extends ServiceCallError {
+  constructor(message?: string);
+}
+declare class ServiceUnavailableError extends ServiceCallError {
+  constructor(message?: string);
+}
+declare class ServiceCancelledError extends ServiceCallError {
+  constructor(message?: string);
+}
+declare class NoCallSlotError extends ServiceCallError {
+  constructor(serviceIndex: number);
+}
+/**
+ * Single-slave master service-call client. Port of NodeAgent's
+ * begin_service_call / on_service_response / on_service_segment flow but
+ * Promise-based and AbortSignal-aware.
+ *
+ * One {@link ServiceClient} attaches to the transport and demuxes incoming
+ * SVC_RESPONSE frames for a single `nodeId`. NodeAgent owns one per slave
+ * and exposes it on the running snapshot.
+ */
+declare class ServiceClient {
+  #private;
+  readonly nodeId: number;
+  constructor(opts: {
+    nodeId: number;
+    transport: ITransport;
+    defaultTimeoutMs?: number;
+    now?: () => number;
+  });
+  attach(): void;
+  detach(): void;
+  /** Number of in-flight calls. Testing / introspection. */
+  get pendingCount(): number;
+  /**
+   * Sweep call deadlines and segment-reassembly TTLs. The owning agent
+   * should call this from its periodic sweep loop.
+   */
+  sweep(nowMs?: number): void;
+  /** Reject every in-flight call as Unavailable. NodeAgent calls this on lost / reprovision. */
+  failAll(reason?: string): void;
+  call(serviceIndex: number, opts: ServiceCallOptions): Promise<ServiceResult>;
+}
+//#endregion
+//#region src/typed-param.d.ts
+/**
+ * Schema-driven typed wrapper around PARAM_SET (SPEC §8.2, reserved
+ * service_index 0xFD).
+ *
+ * Per SPEC §8.1 PARAM is M→S one-way: the master holds the source of truth
+ * and re-injects defaults at provisioning time, so this wrapper exposes
+ * `.set()` only — there's no `.get()` that queries the slave. The
+ * descriptor's decoded default is available via `defaultValue()` for
+ * reference / hydration of master-side state.
+ *
+ * The wire shape for one PARAM_SET request is:
+ *   [0] count = 1
+ *   [1..2] u16 param_index (LE)
+ *   [3..]  value (scalar little-endian or fixed-array contiguous)
+ *
+ * Response is `[0] status [1..2] failed_param_index (when status != OK)`.
+ * `set()` resolves with the status code; non-OK includes `failedIndex` so
+ * the caller can correlate with a multi-param batch (single-param sets
+ * always blame this param).
+ */
+declare class ParamCodecError extends Error {
+  constructor(message: string);
+}
+interface TypedParamSetOptions {
+  timeoutMs?: number;
+  signal?: AbortSignal;
+}
+interface TypedParamSetResult {
+  /** SPEC §7.2 status (0 = SVC_OK). */
+  readonly status: number;
+  /**
+   * On `status != SVC_OK`, the slave-reported param_index that failed.
+   * For a single-param call this is always `descriptor.paramIndex` if the
+   * slave fills the field, else `null` (slave omitted the field).
+   */
+  readonly failedIndex: number | null;
+}
+/** Build a PARAM_SET request payload for a single (descriptor, value) pair. */
+declare function encodeParamSetSingle(desc: ParamDescriptor, value: unknown): Uint8Array;
+declare class TypedParam<T> {
+  #private;
+  readonly path: string;
+  readonly descriptor: ParamDescriptor;
+  constructor(client: ServiceClient, descriptor: ParamDescriptor);
+  /**
+   * Decode the schema-embedded default value (SPEC §9.1 `default`). Useful
+   * to seed the master-side persistence store. Returns `null` if the
+   * descriptor carries no default payload.
+   */
+  defaultValue(): T | null;
+  /** Send a PARAM_SET with a single entry for this param. */
+  set(value: T, opts?: TypedParamSetOptions): Promise<TypedParamSetResult>;
+}
+//#endregion
+//#region src/typed-service.d.ts
+/**
+ * Schema-driven typed wrapper around {@link ServiceClient.call}.
+ *
+ * The generic parameters are compile-time only: at runtime, encoding is
+ * driven entirely by the {@link ServiceDescriptor}'s field list. Callers
+ * supply `Req` / `Resp` interfaces matching the schema fields by name —
+ * the runtime trusts the dict layout and packs by field iteration order.
+ *
+ * Returned on success: `{ status, data }` where `status` is the SPEC §7.2
+ * service status (0 = OK) and `data` is the decoded response dict typed as
+ * `Resp`. Non-OK responses still return a `data` object — the slave is
+ * required to fill the response payload even on failure (§7.2), and the
+ * decoder will best-effort attempt it; if the body is shorter than the
+ * schema demands, `data` is `null` instead of throwing (so callers can
+ * surface the status to the user without losing the whole response).
+ */
+interface TypedServiceResult<Resp extends Dict> {
+  readonly status: number;
+  readonly data: Resp | null;
+}
+interface TypedServiceCallOptions {
+  timeoutMs?: number;
+  signal?: AbortSignal;
+}
+declare class TypedService<Req extends Dict, Resp extends Dict> {
+  #private;
+  readonly path: string;
+  readonly descriptor: ServiceDescriptor;
+  constructor(client: ServiceClient, descriptor: ServiceDescriptor);
+  /** Encode `request`, dispatch via the service plane, decode the response. */
+  call(request: Req, opts?: TypedServiceCallOptions): Promise<TypedServiceResult<Resp>>;
+}
+//#endregion
+//#region src/node-agent.d.ts
+/**
+ * One planned data-plane CAN frame, supplied by the caller (typically a
+ * frame planner — P6) and consumed by {@link NodeAgent} when it issues
+ * FRAME_DEFINE during bring-up. Mirrors `FrameSpec` in
+ * `fibril_can_bridge/include/fibril_can_bridge/frame_planner.hpp`.
+ */
+interface FramePlan {
+  stdId: number;
+  periodUs: number;
+  dir: Direction;
+  entries: readonly FrameDefineEntry[];
+}
+/**
+ * Per-bring-up context handed to a {@link FramePlanFactory} callback so the
+ * caller can branch on the specific slave being provisioned (e.g. read an
+ * external per-nodeId field-enable override map). The same factory is
+ * shared across every {@link NodeAgent} the controller spawns, so this is
+ * the only way for the factory to discriminate slaves.
+ */
+interface FramePlanContext {
+  /** The slave being provisioned (1..0x7E). */
+  readonly nodeId: number;
+}
+/**
+ * Builds the FRAME_DEFINE plan for a slave once its schema is decoded and
+ * numbered. The optional `ctx` argument carries the nodeId so callers that
+ * keep per-slave overrides (e.g. UI-controlled S→M field toggles) can fork
+ * on it without threading state through {@link NodeAgentOptions}. The
+ * 2-arg form is still accepted — extra parameters are simply ignored.
+ */
+type FramePlanFactory = ((schema: NodeSchema, numbering: NumberingResult, ctx: FramePlanContext) => readonly FramePlan[]) | readonly FramePlan[];
+/** Phase machine — public for observers. */
+type NodeProvisionState = {
+  kind: 'idle';
+} | {
+  kind: 'awaiting-announce';
+} | {
+  kind: 'schema-reading';
+  received: number;
+  total: number;
+} | {
+  kind: 'numbering';
+} | {
+  kind: 'provisioning';
+  pendingDefines: number;
+}
+/**
+ * FRAME_DEFINE completed successfully but START has been withheld by
+ * the {@link NodeAgentOptions.autoStart} gate. `startNow()` moves the
+ * agent forward. `reprovision()` / a fresh ANNOUNCE re-enter the flow
+ * from bring-up.
+ */
+| {
+  kind: 'awaiting-start';
+} | {
+  kind: 'running';
+} | {
+  kind: 'lost';
+  reason: string;
+} | {
+  kind: 'blocked';
+  reason: string;
+};
+/** Snapshot available once the slave reaches RUNNING. */
+interface NodeRunningSnapshot {
+  nodeId: number;
+  schemaHash: bigint;
+  bootId: number;
+  instanceCounts: Uint8Array;
+  blob: Uint8Array;
+  schema: NodeSchema;
+  numbering: NumberingResult;
+  framePlan: readonly FramePlan[];
+  /** std_id → topic_index map for the data plane (one entry per FRAME_DEFINE). */
+  stdIdToTopicIndex: Map<number, number>;
+  /** §7 master-side RPC client. Stays valid for the lifetime of the snapshot. */
+  services: ServiceClient;
+  /**
+   * Path → IR descriptor lookup. Drives the typed accessors below.
+   * Exposed for sniffer-style introspection (`index.topicPaths()` etc.).
+   */
+  index: SchemaIndex;
+  /**
+   * Schema-driven typed RPC wrapper. Throws if `path` is unknown. Generic
+   * `Req` / `Resp` are compile-time only — runtime encoding is driven by
+   * the schema's field list.
+   */
+  service<Req extends Dict, Resp extends Dict>(path: string): TypedService<Req, Resp>;
+  /**
+   * Schema-driven PARAM_SET wrapper. Throws if `path` is unknown.
+   * `T` is `number` for scalar params (except U64/I64 → `bigint`),
+   * `boolean` for bool, or the array form for fixed-length array params.
+   */
+  param<T = number | bigint | boolean | number[] | bigint[] | boolean[]>(path: string): TypedParam<T>;
+}
+interface NodeAgentOptions {
+  /** 1..0x7E — broadcast (0x7F) is rejected. */
+  nodeId: number;
+  /** Already open()'d transport. The agent attaches its own onFrame. */
+  transport: ITransport;
+  /** Strategy for building the FRAME_DEFINE plan. */
+  framePlan: FramePlanFactory;
+  /**
+   * Per-config-command ACK timeout in ms. Slaves must ACK within this
+   * window or the agent abandons the bring-up attempt and waits for the
+   * next ANNOUNCE. Default 250 ms (matches bridge's
+   * `bring_up_ack_timeout_`).
+   */
+  ackTimeoutMs?: number;
+  /**
+   * SCHEMA_READ chunk byte limit. SPEC §4.3 caps a single response at the
+   * SINGLE-frame payload (≤59 data bytes after the 4-byte offset header).
+   * Default 59.
+   */
+  schemaChunkSize?: number;
+  /**
+   * Multiplier on `ackTimeoutMs` used as the schema-read retry budget.
+   * Default 3 (one initial + two retries).
+   */
+  schemaReadRetries?: number;
+  /**
+   * Heartbeat-loss budget. The agent expects a HEARTBEAT every 100 ms
+   * (§14); after this much silence it transitions to `lost`. Default 350.
+   */
+  heartbeatTimeoutMs?: number;
+  /** Per-call default timeout for `services.call()`. Default `ackTimeoutMs`. */
+  serviceTimeoutMs?: number;
+  /**
+   * Gate consulted right before START is issued. When it returns `false`,
+   * the agent stops in {@link NodeProvisionState} `awaiting-start` after
+   * FRAME_DEFINE ACKs come back; the caller commits with `startNow()`.
+   * Read fresh at each decision point so callers can flip the setting at
+   * runtime without reconstructing the agent. Default `() => true`.
+   */
+  autoStart?: () => boolean;
+  /** Optional state-change observer. */
+  onState?: (state: NodeProvisionState) => void;
+  /** Optional non-fatal error observer (decode warnings, hash mismatch). */
+  onError?: (err: Error) => void;
+  /**
+   * Override for the wall clock. Tests pass a deterministic counter.
+   * Default `() => Date.now()`.
+   */
+  now?: () => number;
+}
+/**
+ * Per-slave provisioning state machine. Mirrors
+ * `fibril_can_bridge::NodeAgent` lifecycle entry points but trimmed for the
+ * single-threaded TS master — no ROS entity creation, no PARAM_SET
+ * re-injection (P5), no plan computation (P6).
+ *
+ * Lifecycle: `idle` → `awaiting-announce` → `schema-reading` (skipped if
+ * blob already cached on this agent instance) → `numbering` →
+ * `provisioning` → `running`. HEARTBEAT loss drops to `lost`; the next
+ * ANNOUNCE restarts the flow.
+ */
+declare class NodeAgent {
+  #private;
+  readonly nodeId: number;
+  constructor(opts: NodeAgentOptions);
+  /** Service-plane RPC client for this slave. Always available. */
+  get services(): ServiceClient;
+  get state(): NodeProvisionState;
+  get snapshot(): NodeRunningSnapshot | null;
+  /**
+   * Attach to the transport and wait for ANNOUNCE. Resolves immediately —
+   * progress flows via {@link state} / {@link snapshot} / `onState`. Call
+   * `stop()` to detach.
+   */
+  start(): Promise<void>;
+  /**
+   * Re-run the FRAME_DEFINE / START handshake against the live slave using
+   * the most recent ANNOUNCE + cached schema. The {@link FramePlanFactory}
+   * is invoked again — callers that key off an external mutable state
+   * (e.g. per-field TX-enable overrides) will see the latest values.
+   *
+   * The agent must have observed an ANNOUNCE already; `reprovision()`
+   * before that throws. RUNNING is required so that the slave is known to
+   * be reachable — calling during `lost` would race the heartbeat
+   * watchdog. Pending service calls are failed and the current snapshot is
+   * torn down before the new bring-up begins, mirroring what happens on a
+   * boot_id change.
+   */
+  reprovision(): Promise<void>;
+  /** Detach, send STOP if currently RUNNING, clear all in-flight state. */
+  stop(): Promise<void>;
+  /**
+   * Commit the deferred START when {@link NodeAgentOptions.autoStart}
+   * gated the previous bring-up. Only legal in `awaiting-start`; any
+   * other state throws so callers spot logic bugs instead of racing
+   * with a fresh ANNOUNCE.
+   */
+  startNow(): Promise<void>;
+}
+//#endregion
+//#region src/data-plane.d.ts
+/**
+ * Master-side decoder for S→M data-plane frames.
+ *
+ * Listens on the transport for standard-ID frames whose IDs match one of
+ * the std_ids configured in any attached slave's {@link FramePlan}. For
+ * each match, unpacks the topic entries packed into the frame's payload
+ * (in FRAME_DEFINE order) using the schema field bitmask and publishes
+ * a decoded {@link Dict} per topic to subscribers.
+ *
+ * Lifecycle:
+ *   - `new DataPlaneReceiver({ transport })` registers an `onFrame` tap.
+ *   - `attachSlave(nodeId, framePlan, schemaIndex)` claims a slave's std_ids.
+ *   - `detachSlave(nodeId)` releases them (call on RUNNING → not-RUNNING).
+ *   - `dispose()` unsubscribes and clears all state.
+ *
+ * Two slaves cannot publish on the same std_id — attaching the second
+ * throws. This mirrors the bus-level reality: identical std_ids would
+ * collide on the wire.
+ *
+ * M→S frames (master output, dir `Direction.M2S`) are skipped during
+ * attach so the receiver doesn't try to decode echo or self-loopback
+ * frames as if they were slave-published.
+ */
+interface DataPlaneReceiverOptions {
+  transport: ITransport;
+  /** Non-fatal error sink (decode errors, listener throws). */
+  onError?: (err: Error) => void;
+  /** Clock override for tests. Default `() => Date.now()`. */
+  now?: () => number;
+}
+type TopicListener = (value: Dict, tsMs: number) => void;
+interface TopicSample {
+  readonly value: Dict;
+  readonly tsMs: number;
+}
+interface TopicStats {
+  /** Frames ever decoded into this topic since the slave attached. */
+  readonly count: number;
+  /** `now()` of the most recent frame. */
+  readonly lastRxMs: number;
+  /**
+   * Rolling rate over the last few samples (Hz). 0 until at least
+   * two frames have been seen.
+   */
+  readonly ratePerSec: number;
+}
+declare class DataPlaneReceiver {
+  #private;
+  constructor(opts: DataPlaneReceiverOptions);
+  /**
+   * Claim a slave's S→M std_ids. Re-attaching the same nodeId atomically
+   * detaches the prior plan first (re-provisioning case).
+   */
+  attachSlave(nodeId: number, framePlan: readonly FramePlan[], index: SchemaIndex): void;
+  /** Release a slave's std_ids and drop its cached topic samples. */
+  detachSlave(nodeId: number): void;
+  onTopic(nodeId: number, path: string, listener: TopicListener): Unsubscribe;
+  latest(nodeId: number, path: string): TopicSample | null;
+  stats(nodeId: number, path: string): TopicStats | null;
+  /** Paths attached for this slave (in plan order). */
+  topicPathsFor(nodeId: number): string[];
+  /** Bumps on every successfully decoded entry — cheap change detector. */
+  get version(): number;
+  dispose(): void;
+}
+//#endregion
+//#region src/frame-planner.d.ts
+/**
+ * Frame planner — turns a list of "I want field X at period Y" requests into
+ * the concrete FRAME_DEFINE bodies the master ships to the slave (§6.3).
+ *
+ * Port of `fibril_can_core/src/frame_planner.cpp` — same bucketing rules:
+ *   - Group requests by (direction, period_us); never combine across either.
+ *   - Inside a bucket, bin-pack whole topics into ≤64-byte frames.
+ *   - A single topic whose declared fields exceed 64 bytes is the sole
+ *     field-split exception (`emitOversizedTopic`).
+ *
+ * Determinism is load-bearing: codegen, bridge, and this TS master must
+ * produce identical std_id assignments for the same input. Both the
+ * bucket map and the per-bucket topic map iterate in ascending key order
+ * (matching `std::map` in the C++ reference).
+ */
+interface FieldRequest {
+  topicIndex: number;
+  /** 0..15, bit position in `fieldBitmask`. */
+  fieldId: number;
+  /** Wire size of this field. */
+  sizeBytes: number;
+  /** 0 = on-trigger only. */
+  periodUs: number;
+  dir: Direction;
+}
+interface FrameSpec {
+  stdCanId: number;
+  periodUs: number;
+  dir: Direction;
+  logicalBytes: number;
+  entries: FrameDefineEntry[];
+}
+/**
+ * 11-bit Standard ID allocator with a free pool for IDs released after a
+ * grace window (§11.4.1). `next()` returns `null` on exhaustion rather
+ * than wrapping — wrapping past 0x7FF would alias on the wire.
+ */
+declare class StdIdAllocator {
+  #private;
+  next(nowMs?: number): number | null;
+  release(id: number, availableAtMs: number): void;
+  reset(start?: number): void;
+}
+/**
+ * Plan a slave's frame layout. Returns `null` if the StdIdAllocator runs
+ * out of 11-bit IDs mid-plan — the caller MUST surface that; a partial
+ * plan would silently drop fields.
+ */
+declare function planFrames(requests: readonly FieldRequest[], alloc: StdIdAllocator): FrameSpec[] | null;
+//#endregion
+//#region src/default-plan.d.ts
+/**
+ * Per-field predicate handed to {@link buildDefaultS2MRequests} (and via
+ * it, {@link defaultS2MFramePlan}) so callers can apply a runtime mask on
+ * top of the schema-declared `txEnabled`.
+ *
+ * Contract:
+ *   - Returning `false` skips the field entirely; the slave will not pack
+ *     it into any S→M frame. Returning `true` keeps it.
+ *   - Called only for S→M fields whose schema declares `txEnabled !==
+ *     false` (schema-disabled fields are filtered out unconditionally).
+ *   - `topicPath` is the same `'<expanded_ns>/<topic_name>'` string the
+ *     master uses elsewhere (mirrors {@link SchemaIndex.topicPaths}), so
+ *     UI override maps can key on the same identifier.
+ */
+type S2MFieldFilter = (info: {
+  topicPath: string;
+  topicIndex: number;
+  fieldId: number;
+  fieldName: string;
+  field: SchemaField;
+}) => boolean;
+/**
+ * Synthesize the default {@link FieldRequest} list from a decoded schema +
+ * numbering table — every S2M topic field at its declared period
+ * (`field.periodUsOverride` if present, else the owning topic's
+ * `defaultPeriodUs`), skipping `txEnabled === false` fields.
+ *
+ * Pass `filter` to layer a runtime per-field mask on top (UI toggles,
+ * per-slave overrides). Schema-disabled fields are unconditionally
+ * dropped before `filter` is consulted, so callers don't have to repeat
+ * the `txEnabled` check.
+ *
+ * This is the natural input to {@link planFrames} when the master just
+ * wants to "observe everything the slave publishes" — i.e. the
+ * sniffer-style auto-provision path.
+ */
+declare function buildDefaultS2MRequests(schema: NodeSchema, numbering: NumberingResult, filter?: S2MFieldFilter): FieldRequest[];
+/**
+ * One-line FramePlanFactory that subscribes to every S2M field at its
+ * declared period using a freshly-allocated {@link StdIdAllocator}.
+ *
+ * Pass `filter` to apply a runtime per-field mask (e.g. a UI-controlled
+ * field-tx-enable map). With no filter, every schema-enabled S→M field is
+ * subscribed.
+ *
+ * Returns `[]` when planning fails (e.g. std_id exhaustion); the caller's
+ * NodeAgent will then leave the slave in `provisioning` → `awaiting-announce`
+ * with no frames defined, which is the right outcome — partial plans would
+ * silently drop fields.
+ */
+declare function defaultS2MFramePlan(schema: NodeSchema, numbering: NumberingResult, filter?: S2MFieldFilter): FramePlan[];
+//#endregion
+//#region src/dlc.d.ts
+/**
+ * CAN FD valid payload sizes in ascending order (§4.3).
+ * Mirrors `fibril_can_core/include/fibril_can_core/packing.hpp::kCanFdDlcSteps`
+ * and `fibril_can_runtime/src/fcan_wire.c::fcan_quantize_dlc`.
+ */
+declare const FD_DLC_STEPS: readonly number[];
+/**
+ * Round `bytes` up to the next valid CAN FD payload step. Returns 64 for any
+ * input ≥ 64.
+ */
+declare function quantizeDlc(bytes: number): number;
+/**
+ * Grow `data` to the next DLC step by appending zero bytes. Returns a new
+ * Uint8Array. Never shrinks: if `data` already exceeds 64 bytes (which is
+ * a self-inconsistent frame the slave would misparse), the original is
+ * returned unchanged so the backend rejects it loudly (parity with
+ * `pad_to_dlc` in `fibril_can_bridge/src/config_plane_codec.cpp`).
+ */
+declare function padToDlc(data: Uint8Array): Uint8Array;
+//#endregion
+//#region src/master-controller.d.ts
+/**
+ * Multi-slave coordinator.
+ *
+ * One {@link MasterController} owns:
+ *   - a single transport (the bus)
+ *   - one {@link MasterHeartbeatBroadcaster} (shared across slaves)
+ *   - a single broadcast DISCOVER at start() to flush every slave's frame
+ *     table and pull fresh ANNOUNCEs onto the bus
+ *   - a `Map<nodeId, NodeAgent>` of provisioned slaves — auto-spawned on
+ *     the first ANNOUNCE / HEARTBEAT from a previously-unseen nodeId
+ *
+ * Periodic broadcast DISCOVER is intentionally NOT done. Broadcast
+ * DISCOVER is destructive (§5.11): every receiving slave clears its frame
+ * table and drops to UNPROVISIONED. Late-joining slaves are covered by
+ * their own spontaneous ANNOUNCE × 3 at boot (§5.4); the user-initiated
+ * "Discover" button (`discoverNow()`) is the escape hatch for the rare
+ * case where the master came up first and missed the burst.
+ *
+ * Provisioning per slave still goes through {@link NodeAgent}. The
+ * controller is the right place to add cross-slave concerns later (PARAM
+ * persistence, name ownership, lab-mode multiplexers) without bloating
+ * `NodeAgent`.
+ *
+ * The controller does NOT replace `NodeAgent` for single-slave embedded
+ * use cases (e.g. tests, a fixed-topology setup); it sits one layer above
+ * and is the natural entrypoint for the Web UI.
+ */
+/** Default policy hooks applied to every spawned NodeAgent. */
+interface MasterControllerOptions {
+  /** Already-open()'d transport. The controller attaches its own onFrame. */
+  transport: ITransport;
+  /** Strategy applied to every spawned NodeAgent. Required. */
+  framePlan: FramePlanFactory;
+  /** MASTER_HEARTBEAT broadcast period in ms. Default 100 (§5.11). */
+  heartbeatPeriodMs?: number;
+  /**
+   * Broadcast DISCOVER period in ms. Default 0 (disabled). Setting >0 is
+   * destructive — every periodic broadcast DISCOVER wipes every slave's
+   * frame table and forces re-provisioning, breaking S→M topic flow until
+   * each NodeAgent re-pushes its FRAME_DEFINEs. Useful only for very
+   * niche reconnect-storm scenarios; prefer `discoverNow()` for on-demand
+   * rediscovery and rely on slave spontaneous ANNOUNCE × 3 (§5.4) for
+   * normal late-join.
+   */
+  discoverPeriodMs?: number;
+  /**
+   * Send a single broadcast DISCOVER inside `start()` to flush stale
+   * slave state from a previous master session. Default true. Set false
+   * in tests that drive ANNOUNCE manually and need a quiet bus.
+   */
+  initialDiscover?: boolean;
+  /** Per-NodeAgent ACK timeout in ms. Default 250 (matches NodeAgent). */
+  ackTimeoutMs?: number;
+  /** Per-NodeAgent HEARTBEAT-loss budget in ms. Default 350. */
+  heartbeatTimeoutMs?: number;
+  /** Per-service-call default timeout in ms. Default `ackTimeoutMs`. */
+  serviceTimeoutMs?: number;
+  /**
+   * Read-through gate applied to every spawned NodeAgent right before it
+   * issues START. Callers pass a getter (not a boolean) so the flag can
+   * be flipped at runtime — see `NodeAgentOptions.autoStart`. Default
+   * `() => true`.
+   */
+  autoStart?: () => boolean;
+  /** Optional clock override (tests). Default `() => Date.now()`. */
+  now?: () => number;
+  /** Optional non-fatal error sink. */
+  onError?: (err: Error) => void;
+}
+/** Snapshot of one slave's state as observed by the controller. */
+interface ControllerSlaveSnapshot {
+  readonly nodeId: number;
+  readonly state: NodeProvisionState;
+  /** Truthy once the slave reaches RUNNING for the first time. */
+  readonly running: NodeRunningSnapshot | null;
+  /** `now()` when HEARTBEAT was last seen. null if never. */
+  readonly lastHeartbeatMs: number | null;
+  /** boot_id observed (from ANNOUNCE or HEARTBEAT). null if neither yet. */
+  readonly bootId: number | null;
+  /** schema_hash observed in ANNOUNCE. null if not yet ANNOUNCEd. */
+  readonly schemaHash: bigint | null;
+}
+type ControllerListener = (snapshots: readonly ControllerSlaveSnapshot[]) => void;
+declare class MasterController {
+  #private;
+  constructor(opts: MasterControllerOptions);
+  /**
+   * Master-side decoder for S→M topic frames. Auto-attached / detached as
+   * each slave transitions in and out of `running`. Subscribe with
+   * `dataPlane.onTopic(nodeId, path, listener)`; read latest values with
+   * `dataPlane.latest(nodeId, path)`.
+   */
+  get dataPlane(): DataPlaneReceiver;
+  /**
+   * Attach to the transport, start MASTER_HEARTBEAT, fire one initial
+   * broadcast DISCOVER to flush stale slave state from a previous master
+   * session. New slaves auto-spawn a NodeAgent on first sight.
+   */
+  start(): void;
+  /** Stop all internals, stop every NodeAgent, detach from the transport. */
+  stop(): Promise<void>;
+  /** Snapshot of all known slaves. Stable identity per call. */
+  snapshots(): ControllerSlaveSnapshot[];
+  /** Subscribe to slave-set / state-change updates. Fires on every change. */
+  onChange(cb: ControllerListener): Unsubscribe;
+  /**
+   * Access the NodeAgent for one slave, if it exists. Returns null until
+   * the slave has been observed. Useful for service / param calls from
+   * code that already knows the nodeId.
+   */
+  agent(nodeId: number): NodeAgent | null;
+  /** Issue an ad-hoc broadcast DISCOVER (between periodic firings). */
+  discoverNow(): Promise<void>;
+  /**
+   * Commit the deferred START on one slave that is parked in
+   * `awaiting-start` because the autoStart gate blocked its bring-up.
+   * Returns `false` if the slave is unknown or not currently waiting
+   * for a manual start; otherwise resolves once START has been queued
+   * on the wire (the RUNNING transition arrives later via `onChange`).
+   */
+  startNode(nodeId: number): Promise<boolean>;
+  /**
+   * Re-run the FRAME_DEFINE / START handshake for one slave so the
+   * {@link FramePlanFactory} is consulted again. Use when external state
+   * the factory closes over has changed (e.g. per-field TX-enable
+   * toggles). Returns `false` when the slave is unknown or has never
+   * ANNOUNCEd; otherwise resolves once the new bring-up has been kicked
+   * off (it does not await the next RUNNING transition — listen via
+   * {@link onChange} instead).
+   */
+  reprovision(nodeId: number): Promise<boolean>;
+}
+//#endregion
+//#region src/master-heartbeat.d.ts
+/**
+ * Broadcasts CMD_MASTER_HEARTBEAT (§5.11) on a fixed period so slaves with
+ * a `master_lost_us` watchdog configured do not silence their S→M traffic.
+ *
+ * Independent of any single {@link NodeAgent} — the heartbeat is a single
+ * bus-wide broadcast that refreshes every slave's watchdog. Construct one
+ * per transport.
+ */
+declare class MasterHeartbeatBroadcaster {
+  #private;
+  private readonly transport;
+  private readonly periodMs;
+  constructor(transport: ITransport, periodMs?: number);
+  start(): void;
+  stop(): void;
+  get running(): boolean;
+}
+//#endregion
+//#region src/proto-reader.d.ts
+declare class ProtoReader {
+  private readonly buf;
+  private readonly end;
+  private pos;
+  constructor(buf: Uint8Array, end?: number);
+  get done(): boolean;
+  get position(): number;
+  /** Read a base-128 varint as a JS number (overflows ≥ 2^53 wrap silently). */
+  readVarint(): number;
+  /** Read a length-delimited byte slice (no copy). */
+  readBytes(): Uint8Array;
+  /** Read a length-delimited UTF-8 string. */
+  readString(): string;
+  /** Read a length-delimited sub-message and return a new reader scoped to it. */
+  readMessage(): ProtoReader;
+  /**
+   * Read the next tag and return both the field number and wire type. The
+   * caller is expected to dispatch on field number; unknown fields can be
+   * passed to {@link skipValue}.
+   */
+  readTag(): {
+    field: number;
+    wire: number;
+  };
+  /** Discard the value associated with `wire`. Used to tolerate unknown fields. */
+  skipValue(wire: number): void;
+}
+declare class ProtoError extends Error {
+  constructor(message: string);
+}
+//#endregion
+//#region src/schema-hash.d.ts
+/**
+ * SHA-256 helpers for the schema blob (§5.4, §9.3).
+ *
+ * Both codegen (C++) and the bridge (C++) hash the entire schema blob with
+ * SHA-256 and pack the first 8 bytes as little-endian u64 into the ANNOUNCE
+ * frame. This module is the master-side equivalent: hash the blob we
+ * received over SCHEMA_DATA and compare with the schema_hash the slave
+ * advertised in ANNOUNCE.
+ *
+ * Uses Web Crypto (`crypto.subtle`) — available in modern browsers and Node
+ * ≥ 19 / Deno / Bun, no polyfill needed for our target environments.
+ */
+declare function sha256(bytes: Uint8Array): Promise<Uint8Array>;
+/**
+ * Compute the ANNOUNCE-shape schema hash: the first 8 bytes of SHA-256(blob),
+ * interpreted as a little-endian u64. Mirrors
+ * `fibril_can_core/sha256::hash_prefix_u64`.
+ */
+declare function schemaHashPrefix(blob: Uint8Array): Promise<bigint>;
+//#endregion
+//#region src/segmented-transfer.d.ts
+/**
+ * Build the §7.4 SVC_REQUEST frame stream for a master→slave call. Mirrors
+ * `make_svc_request_frames` in
+ * `fibril_can_bridge/include/fibril_can_bridge/svc_request.hpp`.
+ *
+ * - ≤64 byte payload → one SINGLE frame (seg=0).
+ * - Larger → seq=0 carries `[0]=0 [1..2]=total_len + ≤61B data`, subsequent
+ *   seqs carry `[0]=seq + ≤63B data`. Throws on payloads >1024B.
+ */
+declare function makeSvcRequestFrames(nodeId: number, svcIdx: number, callId: number, payload: Uint8Array): CanFrameTx[];
+/**
+ * Build §7.4 response segments. Used by mock slaves and any TS slave runtime.
+ * `channel` is the channel field (typically `CHAN_SVC_RESPONSE`); the payload
+ * is `[status, ...response]` so the caller bakes status into the buffer.
+ */
+declare function makeSvcSegmentedFrames(channel: number, nodeId: number, svcIdx: number, callId: number, payload: Uint8Array): CanFrameTx[];
+/**
+ * Bitmask of segment seqs required to reassemble a `totalLen`-byte payload.
+ * Identical formula to `expected_mask` in
+ * `fibril_can_bridge/src/node_agent.cpp` and the slave's `seg_expected_mask`.
+ */
+declare function segExpectedMask(totalLen: number): number;
+/**
+ * Per-(svc, call_id) reassembly slot. The caller drives one of these per
+ * outstanding incoming segmented transfer.
+ */
+declare class SegmentReassembler {
+  #private;
+  totalLen: number;
+  rxBitmap: number;
+  lastRxMs: number;
+  /**
+   * Ingest one seg=1 frame. `data` is the frame payload (with the seq /
+   * total_len header still attached). Returns the fully-assembled payload
+   * once every required segment has arrived; otherwise null. Returns null
+   * on protocol violations and resets the slot.
+   */
+  ingest(data: Uint8Array, nowMs: number): Uint8Array | null;
+}
+//#endregion
+//#region src/seq-allocator.d.ts
+/**
+ * Sequential u8 allocator used for the config-plane `seq` field shared by
+ * every command this master has issued to a given slave. Wraps at 256,
+ * matching `BridgeNode::alloc_seq` in
+ * `fibril_can_bridge/src/bridge_node.cpp` (the bridge wraps on the same
+ * boundary; the AckTracker indexes by the wrapped value).
+ */
+declare class SeqAllocator {
+  #private;
+  next(): number;
+  reset(): void;
+}
+//#endregion
+export { type AckCallback, type AckOutcome, AckTracker, type AnnounceMsg, CHAN_CONFIG, CHAN_SVC_REQUEST, CHAN_SVC_RESPONSE, CMD_ACK, CMD_ANNOUNCE, CMD_DISCOVER, CMD_FRAME_DEFINE, CMD_HB_PERIOD, CMD_HEARTBEAT, CMD_MASTER_HEARTBEAT, CMD_NAK, CMD_SCHEMA_DATA, CMD_SCHEMA_READ, CMD_START, CMD_STOP, type ControllerListener, type ControllerSlaveSnapshot, DIR_RX_M2S, DIR_TX_S2M, DataPlaneReceiver, type DataPlaneReceiverOptions, type Dict, Direction, DynamicCodecError, type EndpointDescriptor, type EndpointKey, FAULT_ID_CONFLICT, FAULT_INDEX_OVERFLOW, FAULT_NOMEM, FAULT_NONE, FD_DLC_STEPS, type FieldRequest, type FieldValue, type FrameDefineEntry, type FramePlan, type FramePlanContext, type FramePlanFactory, type FrameSpec, type HeartbeatMsg, MAX_FRAME_PAYLOAD, MasterController, type MasterControllerOptions, MasterHeartbeatBroadcaster, NAK_BAD_LENGTH, NAK_BAD_PARAM, NAK_BAD_STATE, NAK_DIR_MISMATCH, NAK_ID_CONFLICT, NAK_INDEX_RANGE, NAK_NO_RESOURCE, NAK_SIZE_OVERFLOW, NAK_UNKNOWN_CMD, NODE_ID_BROADCAST, type NakMsg, NoCallSlotError, NodeAgent, type NodeAgentOptions, type NodeProvisionState, type NodeRunningSnapshot, type NodeSchema, NumberingError, type NumberingResult, type NumberingTable, PROTOCOL_VERSION, ParamCodecError, type ParamDescriptor, ProtoError, ProtoReader, type RosMapping, type S2MFieldFilter, SCALAR_NAMES, SEG_FIRST_DATA, SEG_MAX_SEQ, SEG_MAX_TOTAL, SEG_REST_DATA, SERVICE_INDEX_CANCEL, SERVICE_INDEX_CAPACITY, SERVICE_INDEX_MAX, SERVICE_INDEX_PARAM_SET, STATE_FAULT, STATE_PROVISIONED, STATE_RUNNING, STATE_UNPROVISIONED, STD_ID_MASK, SVC_ACCEPTED, SVC_APP_ERROR, SVC_BAD_INDEX, SVC_BAD_LENGTH, SVC_BAD_VALUE, SVC_BUSY, SVC_CANCEL, SVC_MAX_FIRST_CLASS, SVC_OK, SVC_PARAM_SET, SVC_UNAVAIL, ScalarType, SchemaAccumulator, type SchemaBlockArray, type SchemaBlockType, type SchemaDataMsg, type SchemaField, SchemaIndex, type SchemaParam, type SchemaService, type SchemaTopic, SegmentReassembler, SeqAllocator, ServiceCallError, type ServiceCallOptions, ServiceCancelledError, ServiceClient, type ServiceDescriptor, type ServiceResult, ServiceTimeoutError, ServiceUnavailableError, StdIdAllocator, type TopicDescriptor, type TopicListener, type TopicSample, type TopicStats, TypedParam, type TypedParamSetOptions, type TypedParamSetResult, TypedService, type TypedServiceCallOptions, type TypedServiceResult, type WireLimits, buildDefaultS2MRequests, computeNumbering, decodeAnnounce, decodeFields, decodeHeartbeat, decodeNak, decodeSchema, decodeSchemaData, defaultS2MFramePlan, encodeDiscover, encodeDiscoverTo, encodeFields, encodeFrameDefine, encodeMasterHeartbeat, encodeParamSetSingle, encodeSchemaRead, encodeStart, encodeStop, extChannel, extIndex, extNodeId, extSeg, extSeq, fieldWireSize, fieldsWireSize, makeExtId, makeSvcRequestFrames, makeSvcSegmentedFrames, packScalarF32Le, packScalarF64Le, packScalarIntLe, padToDlc, planFrames, quantizeDlc, scalarFromName, scalarName, scalarSize, schemaHashPrefix, segExpectedMask, segOffset, sha256, signExtend, unpackScalarF32Le, unpackScalarF64Le, unpackScalarIntLe };
+//# sourceMappingURL=index.d.ts.map