@tsplc/compiler 0.0.0-stage → 0.2.0

package/backends/codesys/engineering.ts

@@ -0,0 +1,88 @@
+import { resolve } from "node:path";
+import type { EmitResult } from "@tsplc/compiler/ir";
+import { buildProject, configSchema, type InstalledLibrary, resolveConfig } from "@tsplc/build";
+import type { Controller, DeviceTree } from "@tsplc/config";
+import { z } from "zod";
+import type { CodesysPlan } from "./plan.ts";
+
+export const engineeringBuildSchema = configSchema.omit({
+  sourceDir: true,
+  entry: true,
+  outDir: true,
+  task: true,
+  tasks: true,
+});
+export const engineeringSchema = z.strictObject({
+  kind: z.literal("v3.5"),
+  build: engineeringBuildSchema.optional(),
+});
+export type CodesysEngineeringBuild = z.input<typeof engineeringBuildSchema>;
+
+export function codesysBuildConfig(
+  plan: CodesysPlan,
+  bundle: Pick<EmitResult, "objects">,
+  paths: {
+    configFile: string;
+    sourceDir: string;
+    outDir: string;
+    libraries?: InstalledLibrary[];
+    deviceTree?: DeviceTree;
+    controller?: Controller;
+  },
+) {
+  const settings = plan.options.engineering.build;
+  if (!settings)
+    throw new Error(
+      "CODESYS build requires engineering.build settings (codesys installation and template). Configure them or use --emit-only.",
+    );
+  const programs = new Map(
+    plan.core.programs.map((program) => {
+      const matches = bundle.objects.filter(
+        (object) => object.id === program.id && object.kind === "program",
+      );
+      const generated = matches[0];
+      if (matches.length !== 1 || !generated)
+        throw new Error(`Generated bundle must contain one PROGRAM object for ${program.name}.`);
+      return [program.name, generated] as const;
+    }),
+  );
+  const tasks = plan.deployment.tasks.map((task) => ({
+    ...task,
+    programs: task.programs.map((name) => {
+      const program = programs.get(name);
+      if (!program)
+        throw new Error(`Task ${task.name} references a missing generated PROGRAM ${name}.`);
+      return program.name;
+    }),
+  }));
+  const first = plan.core.programs[0],
+    entry = first && programs.get(first.name);
+  if (!entry) throw new Error("CODESYS build requires a generated PROGRAM entry.");
+  const sourceDir = resolve(paths.sourceDir);
+  return resolveConfig(
+    {
+      ...settings,
+      libraryReferences: [
+        ...(settings.libraryReferences ?? []),
+        ...(Object.values(plan.http).some((endpoint) => endpoint.transport !== "opcua")
+          ? ["Net Base Services, 4.0.0.0 (CODESYS)"]
+          : []),
+        ...(Object.values(plan.http).some((endpoint) => endpoint.tls)
+          ? ["CmpX509Cert Implementation, 3.5.22.0 (System)"]
+          : []),
+      ],
+      ...(paths.libraries ? { libraries: paths.libraries } : {}),
+      ...(paths.deviceTree ? { deviceTree: paths.deviceTree } : {}),
+      ...(paths.controller ? { controller: paths.controller } : {}),
+      sourceDir,
+      entry: resolve(sourceDir, entry.sourcePath ?? `${entry.name}/declaration.st`),
+      outDir: resolve(paths.outDir),
+      tasks,
+    },
+    paths.configFile,
+  );
+}
+
+export async function buildCodesys(...arguments_: Parameters<typeof codesysBuildConfig>) {
+  return buildProject(codesysBuildConfig(...arguments_));
+}

package/backends/codesys/http.ts

@@ -0,0 +1,598 @@
+import type { CoreFunctionBlock, GeneratedObject, PlcType } from "@tsplc/compiler/ir";
+import type { HttpOptions } from "@tsplc/config";
+import type { CodesysTypes } from "./types.ts";
+
+export const opcuaServiceCapacity = 16;
+
+export interface HttpEndpoint {
+  transport?: "http" | "opcua";
+  host: string;
+  port: number;
+  authority: string;
+  path: string;
+  token: string;
+  timeoutMs: number;
+  tls: boolean;
+}
+export const resolveHttpEndpoint = (value: string, input: HttpOptions): HttpEndpoint => {
+  const url = new URL(value);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    url.hostname.includes(":")
+  )
+    throw new Error(
+      "fetch requires an HTTP(S) URL with an IPv4 address or DNS hostname, without credentials or fragment.",
+    );
+  if (
+    (url.pathname + url.search).length > 2048 ||
+    url.hostname.length > 253 ||
+    Number(url.port || (url.protocol === "https:" ? 443 : 80)) === 0
+  )
+    throw new Error("HTTP URL exceeds the native host/path limits or has an invalid port.");
+  let token = "";
+  const origins = new Set<string>();
+  for (const credential of input.credentials) {
+    const configured = process.env[credential.originEnv],
+      secret = process.env[credential.bearerTokenEnv];
+    if (!configured || !secret)
+      throw new Error(
+        `HTTP credentials require ${credential.originEnv} and ${credential.bearerTokenEnv}.`,
+      );
+    const origin = new URL(configured);
+    if (
+      !["http:", "https:"].includes(origin.protocol) ||
+      origin.username ||
+      origin.password ||
+      origin.pathname !== "/" ||
+      origin.search ||
+      origin.hash
+    )
+      throw new Error(
+        `HTTP credential origin ${credential.originEnv} must contain only a scheme, host and port.`,
+      );
+    if (origins.has(origin.origin)) throw new Error("HTTP credential origins must be unique.");
+    origins.add(origin.origin);
+    if (/[\r\n\0]/.test(secret) || secret.length > 512)
+      throw new Error(`Invalid bearer token in ${credential.bearerTokenEnv}.`);
+    if (origin.origin === url.origin) token = secret;
+  }
+  return {
+    host: url.hostname,
+    port: Number(url.port || (url.protocol === "https:" ? 443 : 80)),
+    authority: url.host,
+    path: url.pathname + url.search,
+    token,
+    timeoutMs: input.timeoutMs,
+    tls: url.protocol === "https:",
+  };
+};
+const quote = (text: string) =>
+  "'" +
+  text.replaceAll("$", "$$").replaceAll("'", "$'").replaceAll("\r", "$R").replaceAll("\n", "$N") +
+  "'";
+
+const httpLayouts = (block: CoreFunctionBlock, types: ReadonlyMap<string, PlcType>) => {
+  const request = block.inputs.find((v) => v.name === "request"),
+    response = block.outputs.find((v) => v.name === "result");
+  if (!request || !response) throw new Error("Missing HTTP record ports.");
+  const requestLayout = types.get(request.type),
+    responseLayout = types.get(response.type);
+  if (
+    requestLayout?.kind !== "record" ||
+    responseLayout?.kind !== "record" ||
+    responseLayout.fields.length === 0 ||
+    responseLayout.fields.length > 31
+  )
+    throw new Error("HTTP requires closed request/response records with 1..31 response fields.");
+  const scalarSize = (id: string): number => {
+    const type = types.get(id);
+    if (type?.kind === "string" && type.encoding === "utf8" && type.capacity <= 2048)
+      return type.capacity * 6 + 2;
+    if (type?.kind === "bool") return 5;
+    if (type?.kind === "enum")
+      return Math.max(...type.members.map((member) => member.value.length));
+    if ((type?.kind === "integer" || type?.kind === "bits") && type.bits <= 32) {
+      const signed = type.kind === "integer" && type.signed;
+      return String(signed ? -(2 ** (type.bits - 1)) : 2 ** type.bits - 1).length;
+    }
+    throw new Error(
+      "HTTP JSON supports bounded UTF-8 strings, BOOL, enums, and integers up to 32 bits.",
+    );
+  };
+  const recordSize = (record: typeof requestLayout, response: boolean) =>
+    2 +
+    record.fields.reduce((size, field) => {
+      const type = types.get(field.type);
+      const valueSize =
+        type?.kind === "array" && !response
+          ? 2 + type.length * (scalarSize(type.element) + 1)
+          : scalarSize(field.type);
+      return size + field.name.length + 4 + valueSize;
+    }, 0);
+  if (recordSize(requestLayout, false) > 2048 || recordSize(responseLayout, true) > 2048)
+    throw new Error(
+      "The worst-case HTTP JSON payload exceeds the native 2048-byte buffer; reduce record/string/array bounds.",
+    );
+  return { request, response, requestLayout, responseLayout };
+};
+export const validateHttpLayout = (
+  block: CoreFunctionBlock,
+  types: ReadonlyMap<string, PlcType>,
+): void => {
+  httpLayouts(block, types);
+};
+
+/** Native transport and typed JSON codecs; no application protocol lives here. */
+export const emitHttp = (
+  block: CoreFunctionBlock,
+  name: string,
+  fields: ReadonlyMap<string, string>,
+  types: ReadonlyMap<string, PlcType>,
+  target: CodesysTypes,
+  endpoint: HttpEndpoint,
+  network: string,
+  rpcGlobal?: string,
+): GeneratedObject => {
+  const port = (label: string) => {
+    const variable = [...block.inputs, ...block.outputs].find((v) => v.name === label);
+    if (!variable) throw new Error("Missing HTTP port " + label);
+    return fields.get(variable.id)!;
+  };
+  const { request, response, requestLayout, responseLayout } = httpLayouts(block, types);
+  const encode = (typeId: string, value: string): string => {
+    const type = types.get(typeId)!;
+    if (type.kind === "array")
+      return Array.from(
+        { length: type.length },
+        (_, i) =>
+          `${i ? "Append(',');" : ""}${encode(type.element, `${value}[${i + type.lowerBound}]`)}`,
+      ).join("\n");
+    if (type.kind === "string" && type.encoding === "utf8" && type.capacity <= 2048)
+      return `WriteString(${value});`;
+    if (type.kind === "bool")
+      return `IF ${value} THEN Append('true'); ELSE Append('false'); END_IF;`;
+    if (type.kind === "enum") return `Append(DINT_TO_STRING(TO_DINT(${value})));`;
+    if (type.kind === "bits" && type.bits <= 32)
+      return `Append(UDINT_TO_STRING(TO_UDINT(${value})));`;
+    if (type.kind === "integer" && type.bits <= 32)
+      return `Append(${target.name(typeId)}_TO_STRING(${value}));`;
+    throw new Error(
+      "HTTP JSON supports bounded UTF-8 strings, BOOL, enums, integers up to 32 bits and fixed arrays.",
+    );
+  };
+  const requestCode = requestLayout.fields
+    .map((field, i) => {
+      const type = types.get(field.type)!,
+        value = `${port("request")}.${target.field(request.type, field.name)}`;
+      return `Append(${quote((i ? "," : "") + '"' + field.name + '":')});${type.kind === "array" ? "Append('[');" : ""}${encode(field.type, value)}${type.kind === "array" ? "Append(']');" : ""}`;
+    })
+    .join("\n");
+  const responseCode = responseLayout.fields
+    .map((field, i) => {
+      const type = types.get(field.type)!,
+        value = `${port("result")}.${target.field(response.type, field.name)}`;
+      let decode: string;
+      if (type.kind === "string" && type.encoding === "utf8" && type.capacity <= 2048)
+        decode = `ReadString(); IF ByteLength(token) > ${type.capacity} THEN malformed := TRUE; ELSE ${value} := token; END_IF;`;
+      else if (type.kind === "bool")
+        decode = `IF MatchLiteral('true') THEN ${value}:=TRUE; ELSIF MatchLiteral('false') THEN ${value}:=FALSE; ELSE malformed:=TRUE;END_IF;`;
+      else if (
+        ((type.kind === "integer" || type.kind === "bits") && type.bits <= 32) ||
+        type.kind === "enum"
+      ) {
+        const signed = type.kind === "enum" || (type.kind === "integer" && type.signed),
+          bits = type.kind === "enum" ? 32 : type.bits;
+        const min = signed ? -(2 ** (bits - 1)) : 0,
+          max = signed ? 2 ** (bits - 1) - 1 : 2 ** bits - 1;
+        decode = `ReadInteger(); IF numberValue < ${min} OR numberValue > ${max} THEN malformed:=TRUE; ELSE `;
+        if (type.kind === "enum")
+          decode += `CASE numberValue OF ${type.members.map((m) => `${m.value}: ${value}:=${target.name(field.type)}.${target.field(field.type, m.name)};`).join(" ")} ELSE malformed:=TRUE; END_CASE;`;
+        else decode += `${value}:=TO_${target.name(field.type)}(numberValue);`;
+        decode += " END_IF;";
+      } else throw new Error("HTTP responses currently require flat scalar records.");
+      return `${i === 0 ? "IF" : "ELSIF"} part = ${quote(field.name)} THEN IF (seen AND SHL(DWORD#1,${i})) <> 0 THEN malformed:=TRUE; END_IF; seen:=seen OR SHL(DWORD#1,${i}); ${decode}`;
+    })
+    .join("\n");
+  const inputs = block.inputs
+    .map((v) => `${fields.get(v.id)} : ${target.name(v.type)};`)
+    .join("\n");
+  const outputs = block.outputs
+    .map((v) => `${fields.get(v.id)} : ${target.name(v.type)};`)
+    .join("\n");
+  const decodeResponse = `cursor:=1;malformed:=FALSE;seen:=0;
+SkipWhitespace();Expect(123);SkipWhitespace();
+WHILE cursor<=TO_UINT(ByteLength(payload)) AND NOT malformed DO
+ IF payload[cursor-1]=125 THEN cursor:=cursor+1;EXIT;END_IF;
+ ReadString();part:=token;SkipWhitespace();Expect(58);SkipWhitespace();
+ ${responseCode} ELSE malformed:=TRUE;END_IF;
+ SkipWhitespace();
+ IF payload[cursor-1]=44 THEN cursor:=cursor+1;SkipWhitespace();IF payload[cursor-1]=125 THEN malformed:=TRUE;END_IF;
+ ELSIF payload[cursor-1]<>125 THEN malformed:=TRUE;END_IF;
+END_WHILE;
+SkipWhitespace();
+IF malformed OR cursor<>TO_UINT(ByteLength(payload))+1 OR seen<>DWORD#${2 ** responseLayout.fields.length - 1} THEN ${port("error")}:=4;END_IF;`;
+  if (endpoint.transport === "opcua") {
+    if (!rpcGlobal) throw new Error("Missing OPC UA RPC global.");
+    const channel = (field: string, index = "slotIndex") => `${rpcGlobal}.${field}[${index}]`;
+    return {
+      id: block.id,
+      kind: "functionBlock",
+      name,
+      declaration: `FUNCTION_BLOCK ${name}
+VAR_INPUT ${inputs} END_VAR
+VAR_OUTPUT ${outputs} END_VAR
+VAR
+ timeout:TON;stage:UINT;slotIndex:UINT;candidate:UINT;
+ identity:STRING(64);epoch:STRING(32);prefix:STRING(80);
+ payload:STRING(2048);token:STRING(2048);part:STRING(2048);
+ cursor:UINT;malformed:BOOL;seen:DWORD;numberValue:LINT;tokenUsed:UINT;
+END_VAR`,
+      implementation: `IF NOT ${port("start")} OR ${port("cancel")} THEN
+ IF slotIndex>0 THEN ${channel("requestIds")}:='';${channel("requests")}:='';${channel("inUse")}:=0;END_IF;
+ slotIndex:=0;stage:=0;timeout(IN:=FALSE);${port("busy")}:=FALSE;${port("done")}:=FALSE;${port("error")}:=0;RETURN;
+END_IF;
+IF stage=0 THEN
+ FOR candidate:=1 TO ${opcuaServiceCapacity} DO
+  (* __COMPARE_AND_SWAP can fail spuriously on ARM64; retry while the slot reads free. *)
+  WHILE slotIndex=0 AND ${channel("epochs", "candidate")}<>'' AND ${channel("inUse", "candidate")}=0 DO
+   IF __COMPARE_AND_SWAP(ADR(${channel("inUse", "candidate")}),0,1) THEN slotIndex:=candidate;END_IF;
+  END_WHILE;
+  IF slotIndex>0 THEN EXIT;END_IF;
+ END_FOR;
+ IF slotIndex=0 THEN ${port("error")}:=7;stage:=90;
+ ELSE
+  ${channel("sequence")}:=${channel("sequence")}+1;
+  IF ${channel("sequence")}=0 THEN ${channel("epochs")}:='';${port("error")}:=5;stage:=90;
+  ELSE
+   epoch:=${channel("epochs")};identity:=CONCAT(CONCAT(epoch,':'),UDINT_TO_STRING(${channel("sequence")}));
+   prefix:=CONCAT(identity,'|');payload:='';malformed:=FALSE;
+   Append('{');${requestCode}Append('}');
+   IF malformed THEN ${port("error")}:=3;stage:=90;
+   ELSIF ByteLength(payload)+LEN(prefix)>2048 THEN ${port("error")}:=3;stage:=90;
+   ELSE
+    FOR candidate:=0 TO LEN(prefix)-1 DO ${channel("requests")}[candidate]:=prefix[candidate];END_FOR;
+    FOR candidate:=0 TO ByteLength(payload)-1 DO ${channel("requests")}[candidate+LEN(prefix)]:=payload[candidate];END_FOR;
+    ${channel("requests")}[ByteLength(payload)+LEN(prefix)]:=0;${channel("requestIds")}:=identity;stage:=1;
+   END_IF;
+  END_IF;
+ END_IF;
+END_IF;
+timeout(IN:=stage<90,PT:=T#${endpoint.timeoutMs}ms);
+IF timeout.Q THEN ${port("error")}:=2;stage:=90;END_IF;
+IF stage=1 THEN
+ IF ${channel("epochs")}<>epoch THEN ${port("error")}:=5;stage:=90;
+ ELSIF ${channel("replyIds")}=identity AND_THEN LEFT(${channel("replies")},LEN(prefix))=prefix THEN
+  payload:='';cursor:=LEN(prefix);
+  IF ByteLength(${channel("replies")})<cursor+4 THEN ${port("error")}:=4;
+  ELSIF ${channel("replies")}[cursor]<>48 OR ${channel("replies")}[cursor+1]<>124 THEN ${port("error")}:=5;
+  ELSE
+   FOR candidate:=cursor+2 TO ByteLength(${channel("replies")})-1 DO payload[candidate-cursor-2]:=${channel("replies")}[candidate];END_FOR;
+   payload[ByteLength(${channel("replies")})-cursor-2]:=0;
+   ${decodeResponse}
+  END_IF;
+  stage:=90;
+ END_IF;
+END_IF;
+${port("busy")}:=stage<90;
+IF stage=90 THEN
+ IF slotIndex>0 THEN ${channel("requestIds")}:='';${channel("requests")}:='';${channel("inUse")}:=0;slotIndex:=0;END_IF;
+ timeout(IN:=FALSE);${port("busy")}:=FALSE;${port("done")}:=TRUE;
+END_IF;`,
+    };
+  }
+  // Helpers are emitted as native methods under the HTTP block by the emitter.
+  return {
+    id: block.id,
+    kind: "functionBlock",
+    name,
+    declaration: `FUNCTION_BLOCK ${name}
+VAR_INPUT
+${inputs}
+END_VAR
+VAR_OUTPUT
+${outputs}
+END_VAR
+VAR
+  remoteAddress : NBS.IPv4Address;
+  remoteIP : NBS.IIPAddress := remoteAddress;
+  serverHost : STRING(255) := ${quote(endpoint.host)};
+  resolver : NBS.ResolveHostname := (itfAsyncProperty:=${network});
+  ${endpoint.tls ? `certificateVerifier : ${name}_CertificateVerifier;\n  tlsContext : NBS.TLSContext := (itfCertVerifer:=certificateVerifier,sUseCaseName:='tsPLC HTTPS',ePurpose:=NBS.PURPOSE.CLIENT_SIDE,sTLSVersion:='1.2',sHostname:=${quote(endpoint.host)},udiVerificationMode:=2);` : ""}
+  client : NBS.TCP_Client := (itfAsyncProperty:=${network},itfIPAddress:=remoteAddress,uiPort:=${endpoint.port},udiTimeOut:=${endpoint.timeoutMs * 1000}${endpoint.tls ? ",itfTLSContext:=tlsContext" : ""});
+  writer : NBS.TCP_Write;
+  reader : NBS.TCP_Read;
+  timeout : TON;
+  stage : UINT;
+  wire : STRING(8192);
+  received : STRING(8192);
+  chunk : ARRAY[0..8191] OF BYTE;
+  payload : STRING(2048);
+  token : STRING(2048);
+  part : STRING(2048);
+  used : UINT;
+  headerEnd : UINT;
+  contentLength : DINT;
+  status : UINT;
+  cursor : UINT;
+  malformed : BOOL;
+  seen : DWORD;
+  numberValue : LINT;
+  wireUsed : UINT;
+  tokenUsed : UINT;
+  index : UINT;
+END_VAR
+`,
+    implementation: `IF NOT ${port("start")} OR ${port("cancel")} THEN
+ resolver(xExecute:=FALSE,itfIPAddress:=remoteIP);client(xEnable:=FALSE); writer(xExecute:=FALSE); reader(xEnable:=FALSE); timeout(IN:=FALSE);
+ stage:=0; ${port("busy")}:=FALSE; ${port("done")}:=FALSE; ${port("error")}:=0;
+ RETURN;
+END_IF;
+IF stage=0 THEN
+ payload:=''; malformed:=FALSE; used:=0; received:='';
+ ${block.runtime?.kind === "http" && block.runtime.json ? `Append('{'); ${requestCode} Append('}');` : ""}
+ IF malformed THEN ${port("error")}:=3; stage:=90;
+ ELSE
+ wire:='';wireUsed:=0;
+ AppendWire(${quote((block.runtime?.kind === "http" ? block.runtime.method : "GET") + " " + endpoint.path + " HTTP/1.1\r\nHost: " + endpoint.authority + "\r\n" + (endpoint.token ? "Authorization: Bearer " + endpoint.token + "\r\n" : "") + (block.runtime?.kind === "http" && block.runtime.json ? "Content-Type: application/json\r\n" : "") + "Accept: application/json\r\nConnection: close\r\nContent-Length: ")});
+ AppendWire(UINT_TO_STRING(ByteLength(payload)));AppendWire('$R$N$R$N');AppendWire(payload); stage:=10;
+ END_IF;
+END_IF;
+timeout(IN:=stage<90,PT:=T#${endpoint.timeoutMs}ms);
+IF timeout.Q THEN ${port("error")}:=2; stage:=90; END_IF;
+${port("busy")}:=stage<90;
+IF stage=10 THEN
+ resolver(xExecute:=TRUE,sHostname:=serverHost,itfIPAddress:=remoteIP);
+ IF resolver.xError THEN ${port("error")}:=5;stage:=90;ELSIF resolver.xDone THEN stage:=1;END_IF;
+END_IF;
+IF stage=1 THEN
+ client(xEnable:=TRUE);
+ IF client.xError THEN ${port("error")}:=${endpoint.tls ? 6 : 5};stage:=90; ELSIF client.xActive THEN stage:=2;END_IF;
+END_IF;
+IF stage=2 THEN
+ writer(xExecute:=TRUE,itfConnection:=client.itfConnection,pData:=ADR(wire),udiSize:=UINT_TO_UDINT(wireUsed));
+ IF writer.xError THEN ${port("error")}:=5;stage:=90;ELSIF writer.xDone THEN stage:=3;END_IF;
+END_IF;
+IF stage=3 THEN
+ IF used>=8191 THEN ${port("error")}:=3;stage:=90;
+ ELSE
+ reader(xEnable:=TRUE,itfConnection:=client.itfConnection,pData:=ADR(chunk),udiSize:=8191);
+ IF reader.xError THEN ${port("error")}:=5;stage:=90;
+ ELSIF reader.xReady AND reader.udiCount>0 THEN
+ IF TO_UDINT(used)+reader.udiCount>8191 THEN ${port("error")}:=3;stage:=90;
+ ELSE
+ FOR index:=0 TO TO_UINT(reader.udiCount)-1 DO received[used+index]:=chunk[index];END_FOR;
+ used:=used+TO_UINT(reader.udiCount);received[used]:=0;
+ FindHeaders();
+ IF headerEnd=0 AND used>4096 THEN ${port("error")}:=3;stage:=90;END_IF;
+ IF headerEnd>0 THEN
+  IF headerEnd>4096 THEN ${port("error")}:=3;stage:=90;
+  ELSE
+   ReadHeaders();
+   IF malformed OR contentLength<0 OR contentLength>2048 THEN ${port("error")}:=3;stage:=90;
+   ELSIF TO_DINT(used)>=TO_DINT(headerEnd)+3+contentLength THEN
+    IF status<200 OR status>=300 THEN ${port("error")}:=10000+status;stage:=90;
+    ELSE
+     payload:='';IF contentLength>0 THEN FOR index:=0 TO TO_UINT(contentLength)-1 DO payload[index]:=received[headerEnd+3+index]; END_FOR;END_IF;payload[TO_UINT(contentLength)]:=0; ${decodeResponse}
+     stage:=90;
+    END_IF;
+   END_IF;
+  END_IF;
+ END_IF;
+ END_IF;
+ END_IF;
+ END_IF;
+END_IF;
+IF stage=90 THEN
+ resolver(xExecute:=FALSE,itfIPAddress:=remoteIP);client(xEnable:=FALSE);writer(xExecute:=FALSE);reader(xEnable:=FALSE);timeout(IN:=FALSE);
+ ${port("busy")}:=FALSE;${port("done")}:=TRUE;
+END_IF;
+`,
+  };
+};
+
+export const httpCertificateVerifier = (
+  owner: string,
+  name: string,
+  endpoint: HttpEndpoint,
+): GeneratedObject[] => {
+  if (!endpoint.tls) return [];
+  const id = `${owner}:certificateVerifier`;
+  // NBS represents certificate handles as pointers; verification keeps the native trust result.
+  const ipv4 = /^\d+\.\d+\.\d+\.\d+$/.test(endpoint.host);
+  return [
+    {
+      id,
+      kind: "functionBlock",
+      name: `${name}_CertificateVerifier`,
+      declaration: `FUNCTION_BLOCK ${name}_CertificateVerifier IMPLEMENTS NBS.ICertificateVerifier
+VAR
+  hostname:STRING(255):=${quote(endpoint.host)};
+  ${ipv4 ? `address:ARRAY[0..3] OF BYTE := [${endpoint.host.split(".").join(",")}];` : ""}
+END_VAR`,
+      implementation: "",
+    },
+    {
+      id: `${id}:VerifyCertificate`,
+      parent: id,
+      kind: "method",
+      name: "VerifyCertificate",
+      declaration: `METHOD PUBLIC VerifyCertificate : UDINT
+VAR_INPUT hCert:POINTER TO BYTE;eCurState:UDINT;END_VAR
+VAR matched:BOOL;result:UDINT;END_VAR`,
+      implementation: `VerifyCertificate:=eCurState;
+IF eCurState<>0 THEN RETURN;END_IF;
+matched:=CmpX509Cert_Implementation.${ipv4 ? "X509CertCheckIP(hCert,ADR(address),0,ADR(result))" : "X509CertCheckHost(hCert,ADR(hostname),4,ADR(result))"};
+IF result<>0 THEN VerifyCertificate:=result;ELSIF NOT matched THEN VerifyCertificate:=1;END_IF;`,
+    },
+  ];
+};
+
+export const httpMethods = (
+  owner: string,
+  transport: "http" | "opcua" = "http",
+): GeneratedObject[] => {
+  const method = (
+    name: string,
+    declaration: string,
+    implementation: string,
+    result?: string,
+  ): GeneratedObject => ({
+    id: `${owner}:${name}`,
+    parent: owner,
+    kind: "method",
+    name,
+    declaration: `METHOD PRIVATE ${name}${result ? ` : ${result}` : ""}\n${declaration}`,
+    implementation,
+  });
+  return [
+    // Standard string helpers accept STRING(255); native buffers must retain their full byte length.
+    method(
+      "ByteLength",
+      "VAR_INPUT value:STRING(8192);END_VAR\nVAR i:UINT;END_VAR",
+      "ByteLength:=0;FOR i:=0 TO 8191 DO IF value[i]=0 THEN ByteLength:=i;RETURN;END_IF;END_FOR;ByteLength:=8192;",
+      "UINT",
+    ),
+    method(
+      "Append",
+      "VAR_INPUT value : STRING(2048); END_VAR\nVAR offset:UINT;i:UINT;END_VAR",
+      `offset:=TO_UINT(ByteLength(payload));IF offset+TO_UINT(ByteLength(value))>2048 THEN malformed:=TRUE; ELSE IF ByteLength(value)>0 THEN FOR i:=0 TO TO_UINT(ByteLength(value))-1 DO payload[offset+i]:=value[i];END_FOR;END_IF;payload[offset+TO_UINT(ByteLength(value))]:=0;END_IF;`,
+    ),
+    method(
+      "AppendWire",
+      "VAR_INPUT value:STRING(8192);END_VAR\nVAR i:UINT;END_VAR",
+      `IF wireUsed+TO_UINT(ByteLength(value))>8191 THEN malformed:=TRUE;RETURN;END_IF;IF ByteLength(value)>0 THEN FOR i:=0 TO TO_UINT(ByteLength(value))-1 DO wire[wireUsed+i]:=value[i];END_FOR;END_IF;wireUsed:=wireUsed+TO_UINT(ByteLength(value));wire[wireUsed]:=0;`,
+    ),
+    method(
+      "FindHeaders",
+      "VAR i:UINT;END_VAR",
+      `headerEnd:=0;IF used<4 THEN RETURN;END_IF;
+FOR i:=0 TO used-4 DO IF received[i]=13 AND received[i+1]=10 AND received[i+2]=13 AND received[i+3]=10 THEN headerEnd:=i+1;RETURN;END_IF;END_FOR;`,
+    ),
+    method(
+      "MatchLiteral",
+      "VAR_INPUT value:STRING(8);END_VAR\nVAR i:UINT;size:UINT;END_VAR",
+      `MatchLiteral:=FALSE;size:=TO_UINT(ByteLength(value));IF cursor+size-1>TO_UINT(ByteLength(payload)) THEN RETURN;END_IF;
+FOR i:=0 TO size-1 DO IF payload[cursor-1+i]<>value[i] THEN RETURN;END_IF;END_FOR;cursor:=cursor+size;MatchLiteral:=TRUE;`,
+      "BOOL",
+    ),
+    method(
+      "ReadHeaders",
+      `VAR lineStart:UINT;lineEnd:UINT;i:UINT;j:UINT;key:STRING(64);octet:BYTE;found:BOOL;digits:UINT;END_VAR`,
+      `malformed:=FALSE;found:=FALSE;contentLength:=-1;
+IF LEFT(received,9)<>'HTTP/1.1 ' AND LEFT(received,9)<>'HTTP/1.0 ' THEN malformed:=TRUE;RETURN;END_IF;
+status:=0;FOR i:=9 TO 11 DO IF received[i]<48 OR received[i]>57 THEN malformed:=TRUE;RETURN;END_IF;status:=status*10+TO_UINT(received[i]-48);END_FOR;
+lineStart:=1;
+WHILE lineStart<headerEnd DO
+ lineEnd:=lineStart;WHILE lineEnd<headerEnd AND received[lineEnd-1]<>13 DO lineEnd:=lineEnd+1;END_WHILE;
+ key:='';j:=0;i:=lineStart;
+ WHILE i<lineEnd AND received[i-1]<>58 AND j<63 DO octet:=received[i-1];IF octet>=65 AND octet<=90 THEN octet:=octet+32;END_IF;key[j]:=octet;j:=j+1;i:=i+1;END_WHILE;key[j]:=0;
+ IF key='transfer-encoding' THEN malformed:=TRUE;RETURN;END_IF;
+ IF key='content-length' THEN
+  IF found THEN malformed:=TRUE;RETURN;END_IF;found:=TRUE;contentLength:=0;digits:=0;i:=i+1;
+  WHILE i<lineEnd AND received[i-1]=32 DO i:=i+1;END_WHILE;
+  WHILE i<lineEnd DO octet:=received[i-1];IF octet<48 OR octet>57 OR digits>=5 THEN malformed:=TRUE;RETURN;END_IF;contentLength:=contentLength*10+TO_DINT(octet-48);digits:=digits+1;i:=i+1;END_WHILE;
+  IF digits=0 THEN malformed:=TRUE;RETURN;END_IF;
+ END_IF;
+ lineStart:=lineEnd+2;
+END_WHILE;`,
+    ),
+    method(
+      "WriteString",
+      `VAR_INPUT value : STRING(2048); END_VAR\nVAR i:UINT; one:STRING(1); hex:STRING(16):='0123456789abcdef'; END_VAR`,
+      `Append('"');IF ByteLength(value)>0 THEN FOR i:=0 TO ByteLength(value)-1 DO
+ one[0]:=value[i];one[1]:=0;
+ IF value[i]=34 OR value[i]=92 THEN Append('\\');Append(one);
+ ELSIF value[i]<32 THEN Append('\\u00');one[0]:=hex[SHR(value[i],4)];Append(one);one[0]:=hex[value[i] AND 15];Append(one);
+ ELSE Append(one);END_IF;
+ END_FOR;END_IF;Append('"');`,
+    ),
+    method(
+      "SkipWhitespace",
+      "",
+      `WHILE cursor<=TO_UINT(ByteLength(payload)) DO IF payload[cursor-1]<>32 AND payload[cursor-1]<>9 AND payload[cursor-1]<>10 AND payload[cursor-1]<>13 THEN EXIT;END_IF;cursor:=cursor+1;END_WHILE;`,
+    ),
+    method(
+      "Expect",
+      "VAR_INPUT value:BYTE; END_VAR",
+      `IF cursor>TO_UINT(ByteLength(payload)) OR_ELSE payload[cursor-1]<>value THEN malformed:=TRUE;ELSE cursor:=cursor+1;END_IF;`,
+    ),
+    method(
+      "TokenByte",
+      "VAR_INPUT value:BYTE;END_VAR",
+      `IF tokenUsed>=2048 OR value=0 THEN malformed:=TRUE;RETURN;END_IF;token[tokenUsed]:=value;tokenUsed:=tokenUsed+1;token[tokenUsed]:=0;`,
+    ),
+    method(
+      "ReadHex",
+      "VAR value:UDINT;i:UINT;octet:BYTE;END_VAR",
+      `numberValue:=0;FOR i:=1 TO 4 DO
+IF cursor>TO_UINT(ByteLength(payload)) THEN malformed:=TRUE;RETURN;END_IF;
+octet:=payload[cursor-1];cursor:=cursor+1;
+IF octet>=48 AND octet<=57 THEN value:=TO_UDINT(octet-48);ELSIF octet>=65 AND octet<=70 THEN value:=TO_UDINT(octet-55);ELSIF octet>=97 AND octet<=102 THEN value:=TO_UDINT(octet-87);ELSE malformed:=TRUE;RETURN;END_IF;
+numberValue:=numberValue*16+TO_LINT(value);END_FOR;`,
+    ),
+    method(
+      "ReadString",
+      `VAR octet:BYTE;point:UDINT;high:UDINT;END_VAR`,
+      `token:='';tokenUsed:=0;Expect(34);
+WHILE cursor<=TO_UINT(ByteLength(payload)) AND NOT malformed DO
+ octet:=payload[cursor-1];cursor:=cursor+1;
+ IF octet=34 THEN ValidateUtf8();RETURN;END_IF;
+ IF octet=92 THEN
+  IF cursor>TO_UINT(ByteLength(payload)) THEN malformed:=TRUE;RETURN;END_IF;
+  octet:=payload[cursor-1];cursor:=cursor+1;
+  CASE octet OF
+  34,47,92: TokenByte(octet);
+  98:TokenByte(8);102:TokenByte(12);110:TokenByte(10);114:TokenByte(13);116:TokenByte(9);
+  117:
+   ReadHex();point:=TO_UDINT(numberValue);
+   IF point>=55296 AND point<=56319 THEN
+    high:=point;Expect(92);Expect(117);ReadHex();
+    IF numberValue<56320 OR numberValue>57343 THEN malformed:=TRUE;RETURN;END_IF;
+    point:=65536+(high-55296)*1024+TO_UDINT(numberValue)-56320;
+   ELSIF point>=56320 AND point<=57343 THEN malformed:=TRUE;RETURN;END_IF;
+   IF point<128 THEN TokenByte(TO_BYTE(point));
+   ELSIF point<2048 THEN TokenByte(TO_BYTE(192+SHR(point,6)));TokenByte(TO_BYTE(128+(point AND 63)));
+   ELSIF point<65536 THEN TokenByte(TO_BYTE(224+SHR(point,12)));TokenByte(TO_BYTE(128+(SHR(point,6) AND 63)));TokenByte(TO_BYTE(128+(point AND 63)));
+   ELSE TokenByte(TO_BYTE(240+SHR(point,18)));TokenByte(TO_BYTE(128+(SHR(point,12) AND 63)));TokenByte(TO_BYTE(128+(SHR(point,6) AND 63)));TokenByte(TO_BYTE(128+(point AND 63)));END_IF;
+  ELSE malformed:=TRUE;RETURN;
+  END_CASE;
+ ELSIF octet<32 THEN malformed:=TRUE;RETURN;ELSE TokenByte(octet);END_IF;
+END_WHILE;malformed:=TRUE;`,
+    ),
+    method(
+      "ValidateUtf8",
+      "VAR i:UINT;j:UINT;count:UINT;first:BYTE;next:BYTE;END_VAR",
+      `i:=0;
+WHILE i<tokenUsed AND NOT malformed DO
+ first:=token[i];
+ IF first<128 THEN i:=i+1;
+ ELSE
+  IF first>=194 AND first<=223 THEN count:=1;ELSIF first>=224 AND first<=239 THEN count:=2;ELSIF first>=240 AND first<=244 THEN count:=3;ELSE malformed:=TRUE;RETURN;END_IF;
+  IF i+count>=tokenUsed THEN malformed:=TRUE;RETURN;END_IF;
+  next:=token[i+1];
+  IF (first=224 AND next<160) OR (first=237 AND next>=160) OR (first=240 AND next<144) OR (first=244 AND next>=144) THEN malformed:=TRUE;RETURN;END_IF;
+  FOR j:=1 TO count DO IF token[i+j]<128 OR token[i+j]>191 THEN malformed:=TRUE;RETURN;END_IF;END_FOR;
+  i:=i+count+1;
+ END_IF;
+END_WHILE;`,
+    ),
+    method(
+      "ReadInteger",
+      "VAR negative:BOOL;digits:UINT;octet:BYTE;END_VAR",
+      `numberValue:=0;negative:=FALSE;digits:=0;
+IF payload[cursor-1]=45 THEN negative:=TRUE;cursor:=cursor+1;END_IF;
+WHILE cursor<=TO_UINT(ByteLength(payload)) DO
+ octet:=payload[cursor-1];IF octet<48 OR octet>57 THEN EXIT;END_IF;
+ IF digits>=10 THEN malformed:=TRUE;RETURN;END_IF;
+ IF digits>0 AND numberValue=0 THEN malformed:=TRUE;RETURN;END_IF;numberValue:=numberValue*10+TO_LINT(octet-48);digits:=digits+1;cursor:=cursor+1;
+END_WHILE;
+IF digits=0 THEN malformed:=TRUE;END_IF;IF negative THEN numberValue:=-numberValue;END_IF;`,
+    ),
+  ].filter(
+    (item) =>
+      transport === "http" || !["AppendWire", "FindHeaders", "ReadHeaders"].includes(item.name),
+  );
+};