@typecad/framework-zephyr 1.0.0-alpha.15 → 1.0.0-alpha.18

package/src/lowering/http.ts

@@ -8,11 +8,14 @@
 // (IPPROTO_TCP or IPPROTO_TLS_1_2 for https) → setsockopt TLS sec tags /
 // hostname / peer-verify → connect() → http_client_req → accumulate body.
 //
-// One request slot at a time (embedded-friendly): factory/reset → setters →
-// begin (inside send) → perform. Setters may run before begin and must survive
-// it (req.timeout(ms); req.send()); options are cleared by __tc_http_reset
-// when a new request starts (Http.get/post/…). Response body is heap-capped
-// (default 8 KB), NUL-terminated, valid until the next begin/perform/reset.
+// One request slot at a time (embedded-friendly): send() lowers
+// reset+begin (method/url) FIRST, then the fact setters (timeout/max_body/
+// body/tls), then perform — the reset-before-setters protocol; header()
+// pairs recorded on the request instance are re-staged by begin (after its
+// reset) so call-site header emissions and send() loops both survive.
+// Options are cleared by __tc_http_reset when a new request starts; response
+// body is heap-capped (default 8 KB, opts.maxBody), NUL-terminated, valid
+// until the next begin/perform/reset.
 //
 // TLS: https selects IPPROTO_TLS_1_2 + NET_SOCKETS_SOCKOPT_TLS (which selects
 // mbedTLS in Kconfig). insecure() sets TLS_PEER_VERIFY_NONE; caCert(pem)
@@ -59,7 +62,7 @@ export function httpInitLines(): string[] {
     `    char scheme[8];          // "http" or "https"`,
     `    char host[128];`,
     `    uint16_t port;           // 80 / 443 unless overridden in the url`,
-    `    char path[256];          // resource path beginning with '/'`,
+    `    char path[384];          // resource path beginning with '/'`,
     `    enum http_method method;`,
     `    int32_t timeout_ms;`,
     `    size_t max_body;`,
@@ -68,6 +71,13 @@ export function httpInitLines(): string[] {
     `    bool insecure;`,
     `    const uint8_t* ca_der;    // DER, user-owned; nullptr = no pinned CA`,
     `    size_t ca_der_len;`,
+    `    // What this shim last registered under __TC_HTTP_SEC_TAG (the DER arrays`,
+    `    // are function-static, so pointer identity is stable). Zephyr's`,
+    `    // credential store never REPLACES a tag — repeats are skipped silently,`,
+    `    // a different CA arriving at an occupied tag is reported, not hidden.`,
+    `    const uint8_t* ca_added;`,
+    `    size_t ca_added_len;`,
+    `    bool ca_added_set;`,
     `    const char* hdr_name[__TC_HTTP_MAX_HEADERS];`,
     `    const char* hdr_value[__TC_HTTP_MAX_HEADERS];`,
     `    int32_t hdr_count;`,
@@ -84,15 +94,25 @@ export function httpInitLines(): string[] {
     `    // is still reading → EBADMSG (-77) on chunked/larger responses.`,
     `    uint8_t recvbuf[1024];`,
     `    int64_t content_length;  // -1 = unknown`,
+    `    // Response headers: captured as raw "Name: Value\\r\\n" lines by the`,
+    `    // http_parser on_header_field/on_header_value hooks (req.http_cb) and`,
+    `    // scanned by __tc_http_response_header(). hdr_parse_name is the name`,
+    `    // fragment accumulator; hdr_stage tracks name(0)/value(1) parsing.`,
+    `    char resp_headers[768];`,
+    `    size_t resp_headers_len;`,
+    `    char hdr_parse_name[64];`,
+    `    size_t hdr_parse_name_len;`,
+    `    uint8_t hdr_stage;        // 0 = accumulating name, 1 = accumulating value`,
     `    char resp_header[128];   // scratch for response_header()`,
     `    // staged header fields for http_client_req: a NULL-terminated list of`,
     `    // "Name: Value\\r\\n" strings built from hdr_name/hdr_value at perform.`,
     `    const char* hdr_fields[__TC_HTTP_MAX_HEADERS + 1];`,
-    `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][64];`,
+    `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][128];`,
     `    // async completion signal (memory barrier between worker and poller)`,
     `    struct k_sem done_sem;`,
     `    bool sem_inited;`,
     `    struct k_work perform_work;`,
+    `    bool work_inited;`,
     `} __tc_http;`,
     ``,
     `// ── URL parser ──────────────────────────────────────────────────────────`,
@@ -119,6 +139,13 @@ export function httpInitLines(): string[] {
     `        __tc_http.host[host_len++] = *p++;`,
     `    }`,
     `    __tc_http.host[host_len] = '\\0';`,
+    `    // A host that filled the buffer means the URL is not what the user`,
+    `    // typed — a silently truncated host resolves the wrong server. Refuse.`,
+    `    if (host_len == (sizeof(__tc_http.host) - 1U) && *p != '\\0' && *p != ':' && *p != '/') {`,
+    `        printk("tc-http: host longer than %u bytes - refused\\n",`,
+    `               static_cast<unsigned int>(sizeof(__tc_http.host) - 1U));`,
+    `        return false;`,
+    `    }`,
     `    // optional :port`,
     `    if (*p == ':') {`,
     `        p++;`,
@@ -136,6 +163,13 @@ export function httpInitLines(): string[] {
     `        while (*p != '\\0' && path_len < (sizeof(__tc_http.path) - 1U)) {`,
     `            __tc_http.path[path_len++] = *p++;`,
     `        }`,
+    `        // Same honesty rule as the host: a truncated path (long query`,
+    `        // string) requests the wrong resource — refuse instead of misfetch.`,
+    `        if (path_len == (sizeof(__tc_http.path) - 1U) && *p != '\\0') {`,
+    `            printk("tc-http: path longer than %u bytes - refused\\n",`,
+    `                   static_cast<unsigned int>(sizeof(__tc_http.path) - 1U));`,
+    `            return false;`,
+    `        }`,
     `        __tc_http.path[path_len] = '\\0';`,
     `    } else {`,
     `        __tc_http.path[0] = '/';`,
@@ -144,6 +178,53 @@ export function httpInitLines(): string[] {
     `    return host_len > 0U;`,
     `}`,
     ``,
+    `// ── response-header capture (http_parser hooks via req.http_cb) ─────────`,
+    `// The client's internal parser settings forward on_header_field/`,
+    `// on_header_value fragments here while keeping their own status + body`,
+    `// handling. Fragments accumulate into raw "Name: Value\\r\\n" lines in`,
+    `// resp_headers (bounded — overflow drops the rest of the block, and`,
+    `// lookups of the dropped headers return ""). __tc_http_hdr_finish closes`,
+    `// the last line after http_client_req returns.`,
+    `static void __tc_http_hdr_append(const char* at, size_t len) {`,
+    `    size_t room = sizeof(__tc_http.resp_headers) - __tc_http.resp_headers_len;`,
+    `    size_t n = (len < room) ? len : room;`,
+    `    (void)memcpy(__tc_http.resp_headers + __tc_http.resp_headers_len, at, n);`,
+    `    __tc_http.resp_headers_len += n;`,
+    `}`,
+    ``,
+    `static int __tc_http_on_hdr_field(struct http_parser* parser, const char* at, size_t len) {`,
+    `    (void)parser;`,
+    `    if (__tc_http.hdr_stage == 1U) {`,
+    `        __tc_http_hdr_append("\\r\\n", 2U);`,
+    `        __tc_http.hdr_stage = 0U;`,
+    `        __tc_http.hdr_parse_name_len = 0U;`,
+    `    }`,
+    `    size_t room = sizeof(__tc_http.hdr_parse_name) - 1U - __tc_http.hdr_parse_name_len;`,
+    `    size_t n = (len < room) ? len : room;`,
+    `    (void)memcpy(__tc_http.hdr_parse_name + __tc_http.hdr_parse_name_len, at, n);`,
+    `    __tc_http.hdr_parse_name_len += n;`,
+    `    return 0;`,
+    `}`,
+    ``,
+    `static int __tc_http_on_hdr_value(struct http_parser* parser, const char* at, size_t len) {`,
+    `    (void)parser;`,
+    `    if (__tc_http.hdr_stage == 0U) {`,
+    `        __tc_http_hdr_append(__tc_http.hdr_parse_name, __tc_http.hdr_parse_name_len);`,
+    `        __tc_http_hdr_append(": ", 2U);`,
+    `        __tc_http.hdr_stage = 1U;`,
+    `    }`,
+    `    __tc_http_hdr_append(at, len);`,
+    `    return 0;`,
+    `}`,
+    ``,
+    `static void __tc_http_hdr_finish(void) {`,
+    `    if (__tc_http.hdr_stage == 1U) {`,
+    `        __tc_http_hdr_append("\\r\\n", 2U);`,
+    `    }`,
+    `    __tc_http.hdr_stage = 0U;`,
+    `    __tc_http.hdr_parse_name_len = 0U;`,
+    `}`,
+    ``,
     `// ── response callback ───────────────────────────────────────────────────`,
     `// http_response_cb_t: accumulate each body fragment into resp up to max_body,`,
     `// and capture the status code + content length from the first response.`,
@@ -167,6 +248,34 @@ export function httpInitLines(): string[] {
     `    return 0;`,
     `}`,
     ``,
+    `// Strict IPv4 dotted-quad predicate: exactly four 0-255 groups. A`,
+    `// digit-and-dot scan would also swallow numeric-only DNS names ("123"),`,
+    `// silently skipping the TLS hostname check for them.`,
+    `static bool __tc_http_host_is_ipv4(const char* h) {`,
+    `    uint32_t quads = 0U;`,
+    `    uint32_t val = 0U;`,
+    `    uint32_t digits = 0U;`,
+    `    for (const char* p = h; ; p++) {`,
+    `        if (*p >= '0' && *p <= '9') {`,
+    `            val = (val * 10U) + static_cast<uint32_t>(*p - '0');`,
+    `            digits++;`,
+    `            if (digits > 3U || val > 255U) return false;`,
+    `        } else if (*p == '.') {`,
+    `            if (digits == 0U || quads >= 3U) return false;`,
+    `            quads++;`,
+    `            val = 0U;`,
+    `            digits = 0U;`,
+    `        } else if (*p == '\\0') {`,
+    `            if (digits == 0U) return false;`,
+    `            quads++;`,
+    `            break;`,
+    `        } else {`,
+    `            return false;`,
+    `        }`,
+    `    }`,
+    `    return quads == 4U;`,
+    `}`,
+    ``,
     `// ── socket connect ──────────────────────────────────────────────────────`,
     `// zsock_getaddrinfo → zsock_socket(TCP | TLS_1_2) → TLS sockopts →`,
     `// zsock_connect. Uses the zsock_* (native Zephyr socket) API directly rather`,
@@ -201,24 +310,47 @@ export function httpInitLines(): string[] {
     `#if defined(CONFIG_NET_SOCKETS_SOCKOPT_TLS)`,
     `        int sock_tls = zsock_socket(res->ai_family, res->ai_socktype, IPPROTO_TLS_1_2);`,
     `        if (sock_tls >= 0) {`,
-            `            // Register the pinned CA as the active sec tag. tls_credential_add`,
-    `            // is idempotent-enough for the single-slot model: a duplicate tag`,
-    `            // is an error we ignore, and the most recently added cert wins.`,
+            `            // Register the pinned CA as the active sec tag. Zephyr's`,
+    `            // credential store never REPLACES a tag+type pair: a duplicate`,
+    `            // add fails and the FIRST cert stays active. Re-registering the`,
+    `            // same DER (pointer identity — the arrays are function-static)`,
+    `            // is skipped silently; a DIFFERENT CA hitting an occupied tag`,
+    `            // is reported so a wrong-CA verify is never silent. Any other`,
+    `            // failure skips the tag list: verification stays required with`,
+    `            // no credentials, so the handshake fails closed, not open.`,
     `            if (__tc_http.ca_der != nullptr) {`,
-    `                int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
-    `                                         TLS_CREDENTIAL_CA_CERTIFICATE,`,
-    `                                         __tc_http.ca_der, __tc_http.ca_der_len);`,
-    `                sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
-    `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
-    `                (void)cred_rc;`,
+    `                if (!__tc_http.ca_added_set || __tc_http.ca_added != __tc_http.ca_der`,
+    `                    || __tc_http.ca_added_len != __tc_http.ca_der_len) {`,
+    `                    int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
+    `                                             TLS_CREDENTIAL_CA_CERTIFICATE,`,
+    `                                             __tc_http.ca_der, __tc_http.ca_der_len);`,
+    `                    if (cred_rc == 0) {`,
+    `                        __tc_http.ca_added = __tc_http.ca_der;`,
+    `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+    `                        __tc_http.ca_added_set = true;`,
+    `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                    } else if (cred_rc == -17 /* -EEXIST */) {`,
+    `                        printk("tc-http: sec tag %d already holds a CA; the first one stays active (add rc=%d)\\n", __TC_HTTP_SEC_TAG, cred_rc);`,
+    `                        __tc_http.ca_added = __tc_http.ca_der;`,
+    `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+    `                        __tc_http.ca_added_set = true;`,
+    `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                    } else {`,
+    `                        printk("tc-http: CA registration failed (rc=%d) - verifying against no credentials\\n", cred_rc);`,
+    `                    }`,
+    `                } else {`,
+    `                    sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                    (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                }`,
     `            }`,
     `            // Hostname SNI + verification. insecure() disables verification;`,
     `            // the default (no caCert, no insecure) leaves verification required`,
     `            // with no sec tag, so the handshake fails safely until a CA is set.`,
     `            // mbedtls does not match IP literals against SAN entries —`,
     `            // skip the hostname check for IP hosts (chain-only verify).`,
-    `            bool host_is_ip = true; for (const char* p3 = __tc_http.host; *p3 != 0; p3++) { if (!((*p3 >= '0' && *p3 <= '9') || *p3 == '.')) { host_is_ip = false; break; } }`,
-    `            if (!host_is_ip) {`,
+    `            if (!__tc_http_host_is_ipv4(__tc_http.host)) {`,
     `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_HOSTNAME, __tc_http.host, strlen(__tc_http.host) + 1U);`,
     `            }`,
     `            int32_t verify = __tc_http.insecure ? TLS_PEER_VERIFY_NONE : TLS_PEER_VERIFY_REQUIRED;`,
@@ -248,8 +380,29 @@ export function httpInitLines(): string[] {
     `    return sock;`,
     `}`,
     ``,
-    `/** Clear request options + response; called when Http.get/post/… starts a new request. */`,
-    `static inline void __tc_http_reset(void) {`,
+    `/** Block until an async perform has finished (single-slot contract: a new`,
+    ` *  request may not clear state the workqueue is still writing). Bounded at`,
+    ` *  20 s — longer than any sane timeout_ms; past that it reports and the`,
+    ` *  caller proceeds without clearing (the in-flight response stays intact).`,
+    ` *  Cheap no-op when the async path was never used. */`,
+    `static void __tc_http_wait_async_idle(void) {`,
+    `    if (!__tc_http.work_inited) return;`,
+    `    int32_t waited = 0;`,
+    `    while (k_work_is_pending(&__tc_http.perform_work)) {`,
+    `        if (waited >= 20000) {`,
+    `            printk("tc-http: async request still busy after 20s\\n");`,
+    `            return;`,
+    `        }`,
+    `        k_msleep(10);`,
+    `        waited += 10;`,
+    `    }`,
+    `}`,
+    ``,
+    `/** Clear request options + response. Rides the head of every request (the`,
+    ` *  begin op from send()): reset FIRST, then this request's fact setters —`,
+    ` *  so nothing a previous request staged can leak into this one. */`,
+    `static void __tc_http_reset(void) {`,
+    `    __tc_http_wait_async_idle();`,
     `    if (__tc_http.resp != nullptr) { delete[] __tc_http.resp; __tc_http.resp = nullptr; }`,
     `    __tc_http.timeout_ms = 15000;`,
     `    __tc_http.max_body = __TC_HTTP_DEFAULT_MAX_BODY;`,
@@ -264,12 +417,24 @@ export function httpInitLines(): string[] {
     `    __tc_http.ok = false;`,
     `    __tc_http.resp_len = 0;`,
     `    __tc_http.content_length = -1;`,
+    `    __tc_http.resp_headers_len = 0;`,
+    `    __tc_http.hdr_parse_name_len = 0;`,
+    `    __tc_http.hdr_stage = 0U;`,
     `    __tc_http.resp_header[0] = '\\0';`,
     `    __tc_http.url[0] = '\\0';`,
     `}`,
     ``,
     `/** Stage the request. Setters (timeout/max_body/body/tls/headers) survive begin. */`,
     `static inline void __tc_http_begin(enum http_method method, const char* url) {`,
+    `    if (strlen(url) >= sizeof(__tc_http.url)) {`,
+    `        // A silently truncated URL fetches the wrong resource — refuse; the`,
+    `        // empty url makes perform's parse fail loudly ("bad url").`,
+    `        printk("tc-http: url longer than %u bytes - refused\\n",`,
+    `               static_cast<unsigned int>(sizeof(__tc_http.url) - 1U));`,
+    `        __tc_http.url[0] = '\\0';`,
+    `        __tc_http.method = method;`,
+    `        return;`,
+    `    }`,
     `    (void)strncpy(__tc_http.url, url, sizeof(__tc_http.url) - 1U);`,
     `    __tc_http.url[sizeof(__tc_http.url) - 1U] = '\\0';`,
     `    __tc_http.method = method;`,
@@ -280,6 +445,9 @@ export function httpInitLines(): string[] {
     `    __tc_http.ok = false;`,
     `    __tc_http.resp_len = 0;`,
     `    __tc_http.content_length = -1;`,
+    `    __tc_http.resp_headers_len = 0;`,
+    `    __tc_http.hdr_parse_name_len = 0;`,
+    `    __tc_http.hdr_stage = 0U;`,
     `    __tc_http.resp_header[0] = '\\0';`,
     `}`,
     ``,
@@ -331,15 +499,34 @@ export function httpInitLines(): string[] {
     `    int sock = __tc_http_open_socket();`,
     `    if (sock < 0) { __tc_http.done = true; return; }`,
     `    // Build the NULL-terminated header-fields list from staged headers.`,
+    `    // Format capped 2 bytes short of the buffer so the CRLF can ALWAYS be`,
+    `    // appended — a truncated value stays a syntactically valid header line`,
+    `    // instead of swallowing the next one (snprintk alone can cut the \\r\\n).`,
     `    for (int32_t i = 0; i < __tc_http.hdr_count && i < __TC_HTTP_MAX_HEADERS; i++) {`,
-    `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]),`,
-    `                       "%s: %s\\r\\n", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+    `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]) - 2U,`,
+    `                       "%s: %s", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+    `        size_t flen = strlen(__tc_http.hdr_field_buf[i]);`,
+    `        __tc_http.hdr_field_buf[i][flen] = '\\r';`,
+    `        __tc_http.hdr_field_buf[i][flen + 1U] = '\\n';`,
+    `        __tc_http.hdr_field_buf[i][flen + 2U] = '\\0';`,
     `        __tc_http.hdr_fields[i] = __tc_http.hdr_field_buf[i];`,
     `    }`,
     `    __tc_http.hdr_fields[(__tc_http.hdr_count < __TC_HTTP_MAX_HEADERS)`,
     `                         ? __tc_http.hdr_count : __TC_HTTP_MAX_HEADERS] = nullptr;`,
+    `    // Response-header capture: the client's internal parser hooks forward`,
+    `    // to these settings (on_header_field/on_header_value) while keeping`,
+    `    // their own status/body handling — no interference with the body path.`,
+    `    static struct http_parser_settings __tc_http_parse_settings;`,
+    `    static bool __tc_http_parse_settings_inited;`,
+    `    if (!__tc_http_parse_settings_inited) {`,
+    `        http_parser_settings_init(&__tc_http_parse_settings);`,
+    `        __tc_http_parse_settings.on_header_field = __tc_http_on_hdr_field;`,
+    `        __tc_http_parse_settings.on_header_value = __tc_http_on_hdr_value;`,
+    `        __tc_http_parse_settings_inited = true;`,
+    `    }`,
     `    struct http_request req = { 0 };`,
     `    req.method = __tc_http.method;`,
+    `    req.http_cb = &__tc_http_parse_settings;`,
     `    req.url = __tc_http.path;`,
     `    req.host = __tc_http.host;`,
     `    req.protocol = "HTTP/1.1";`,
@@ -352,6 +539,7 @@ export function httpInitLines(): string[] {
     `        req.payload_len = static_cast<size_t>(__tc_http.body_len);`,
     `    }`,
     `    int sent = http_client_req(sock, &req, __tc_http.timeout_ms, nullptr);`,
+    `    __tc_http_hdr_finish();`,
     `    // The response callback (__tc_http_resp_cb) captures the status, but Zephyr's`,
     `    // parser aborts on 5xx responses (on_headers_complete returns 1 for status`,
     `    // >= 500, which http_parser treats as an error → http_client_req returns`,
@@ -395,12 +583,23 @@ export function httpInitLines(): string[] {
     `        k_sem_init(&__tc_http.done_sem, 0, 1);`,
     `        __tc_http.sem_inited = true;`,
     `    }`,
+    `    // Init the work item ONCE — re-initializing a queued/running item is`,
+    `    // undefined in Zephyr, and the busy check below makes the single-slot`,
+    `    // contract explicit instead of corrupting the in-flight request.`,
+    `    if (!__tc_http.work_inited) {`,
+    `        k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
+    `        __tc_http.work_inited = true;`,
+    `    }`,
+    `    if (k_work_is_pending(&__tc_http.perform_work)) {`,
+    `        printk("tc-http: previous async request still in flight - send refused\\n");`,
+    `        __tc_http.done = true;`,
+    `        return;`,
+    `    }`,
     `    __tc_http.done = false;`,
     `    // Drain any completion signal left from a previous request (e.g. the`,
     `    // prior done() saw the volatile flag before taking the sem), so the first`,
     `    // poll of this request doesn't fire on a stale signal.`,
     `    (void)k_sem_take(&__tc_http.done_sem, K_NO_WAIT);`,
-    `    k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
     `    (void)k_work_submit(&__tc_http.perform_work);`,
     `}`,
     ``,
@@ -423,13 +622,39 @@ export function httpInitLines(): string[] {
     `    return static_cast<int32_t>(__tc_http.content_length);`,
     `}`,
     ``,
-    `// Response-header lookup. The Zephyr http_client_req surface does not expose`,
-    `// arbitrary response headers via the recv buffer; this returns the last`,
-    `// header captured by the response callback path. With no per-header hook`,
-    `// it returns "" until a richer parser setting is wired (http_cb).`,
+    `// Response-header lookup over the block captured by the parser hooks.`,
+    `// ASCII-case-insensitive name match at a line start; returns the value`,
+    `// ("" when absent or when the block was truncated past it).`,
+    `static inline char __tc_http_ascii_lower(char c) {`,
+    `    return (c >= 'A' && c <= 'Z') ? static_cast<char>(c + 32) : c;`,
+    `}`,
+    ``,
     `static inline const char* __tc_http_response_header(const char* name) {`,
-    `    (void)name;`,
     `    __tc_http.resp_header[0] = '\\0';`,
+    `    const char* block = __tc_http.resp_headers;`,
+    `    const char* end = block + __tc_http.resp_headers_len;`,
+    `    const char* line = block;`,
+    `    while (line < end) {`,
+    `        const char* eol = line;`,
+    `        while (eol < end && *eol != '\\r' && *eol != '\\n') { eol++; }`,
+    `        const char* c = line;`,
+    `        const char* n = name;`,
+    `        while (c < eol && *n != '\\0' && __tc_http_ascii_lower(*c) == __tc_http_ascii_lower(*n)) {`,
+    `            c++;`,
+    `            n++;`,
+    `        }`,
+    `        if (*n == '\\0' && c < eol && *c == ':') {`,
+    `            c++;`,
+    `            if (c < eol && *c == ' ') { c++; }`,
+    `            size_t vlen = static_cast<size_t>(eol - c);`,
+    `            if (vlen >= sizeof(__tc_http.resp_header)) { vlen = sizeof(__tc_http.resp_header) - 1U; }`,
+    `            (void)memcpy(__tc_http.resp_header, c, vlen);`,
+    `            __tc_http.resp_header[vlen] = '\\0';`,
+    `            break;`,
+    `        }`,
+    `        line = eol;`,
+    `        while (line < end && (*line == '\\r' || *line == '\\n')) { line++; }`,
+    `    }`,
     `    return __tc_http.resp_header;`,
     `}`,
     `// CUTTLEFISH_HTTP_END`,
@@ -458,9 +683,13 @@ export function lowerHttp(op: HALOpIR): { code?: string; expression?: string } {
     case 'http.begin': {
       const methodName = String(o.method).replace(/^["']|["']$/g, '').toUpperCase();
       const method = METHOD_MAP[methodName] ?? 'HTTP_GET';
-      // Fresh shim state per request — the reset used to ride the deleted
-      // factory op (http.reset); construction now owns it.
-      return { code: `__tc_http_reset(); __tc_http_begin(${method}, ${s(o.url)});` };
+      // Fresh shim state per request, THEN this request's header() pairs:
+      // the reset must precede them (the call-site emissions ran before
+      // send() and are wiped by the reset — re-staging here also keeps
+      // headers alive across send() loops).
+      const pairs = Array.isArray(o.headers) ? (o.headers as string[][]) : [];
+      const staged = pairs.length > 0 ? `${pairs.map(([n, v]) => `__tc_http_set_header(${s(n)}, ${s(v)});`).join(' ')} ` : '';
+      return { code: `__tc_http_reset(); ${staged}__tc_http_begin(${method}, ${s(o.url)});` };
     }
     case 'http.set_header':
       return { code: `__tc_http_set_header(${s(o.name)}, ${s(o.value)});` };
@@ -486,7 +715,10 @@ export function lowerHttp(op: HALOpIR): { code?: string; expression?: string } {
       }
       const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
       const der = Buffer.from(b64, 'base64');
-      if (der.length < 100) return { code: `// tc-http: caCert PEM failed to decode` };
+      // Every X.509 DER starts with the ASN.1 SEQUENCE tag (0x30); a long
+      // but non-cert payload fails here instead of at a confusing handshake
+      // error on the target.
+      if (der.length < 100 || der[0] !== 0x30) return { code: `// tc-http: caCert PEM failed to decode` };
       const hex = [...der].map((b) => `0x${b.toString(16).padStart(2, '0')}`).join(', ');
       return { code: `{ static const uint8_t __tc_ca_der[] = { ${hex} }; __tc_http_set_ca_cert_der(__tc_ca_der, sizeof(__tc_ca_der)); }` };
     }

package/src/lowering/i2c.ts

@@ -43,15 +43,6 @@ function speedForHz(hz: number): string {
   return 'I2C_SPEED_HIGH';
 }
 
-/**
- * The (void) comma expression begin/end lower to — a no-op that references
- * the controller's whole state block (device + transaction buffers) so a
- * program calling only begin() stays -Werror clean (-Wunused-variable).
- */
-function i2cKeepAlive(p: string): string {
-  return `(void)${p}_dev;`;
-}
-
 /** The thin-device bus-speed preamble: apply the construction hz once
  *  (i2c_configure with Zephyr's I2C_SPEED_SET tier mapping), or '' when the
  *  target constructed without hz. Guarded per controller, so the cost after

package/src/lowering/interrupts.ts

@@ -116,6 +116,12 @@ export function collectInterruptPins(program: unknown): Set<number> {
     }
   };
   visit(program);
+  // Ops resolved to text while inlining one HAL call into another never become
+  // IR nodes — they ride on ProgramIR.resolvedHalOps (see strategy.ts's
+  // visitResolvedHalOps for the full story).
+  for (const op of (program as { resolvedHalOps?: unknown[] })?.resolvedHalOps ?? []) {
+    visit({ operation: op });
+  }
   return pins;
 }
 

package/src/lowering/mqtt.ts

@@ -13,7 +13,11 @@
 // shim getaddrinfo-resolves the broker host itself (like the HTTP shim).
 // URI scheme: mqtt:// → 1883 plain TCP, mqtts:// → 8883 TLS
 // (MQTT_TRANSPORT_SECURE + mqtt_sec_config, reusing the same mbedTLS matrix
-// the HTTP TLS path established).
+// the HTTP TLS path established). caCert pins the broker's CA — the PEM is
+// DER-decoded at emit time and registered via tls_credential_add as a
+// CA_CERTIFICATE sec tag with TLS_PEER_VERIFY_REQUIRED (verified TLS, the
+// MQTT analogue of Request's caCert); mqtts:// without a CA stays
+// encrypted-but-unverified (TLS_PEER_VERIFY_NONE).
 //
 // One client slot (HAL singleton). on_message callbacks are dispatched on the
 // poll thread.
@@ -49,6 +53,8 @@ export function mqttInitLines(): string[] {
     `// at connect time; host drives both DNS resolution and the TLS SNI/hostname.`,
     `// on_message is the user callback (set via mqtt.on_message); it fires on the`,
     `// poll thread for every incoming PUBLISH on a subscribed topic.`,
+    `// ca_der is the pinned CA (DER, user-owned from the caCert fact); nullptr`,
+    `// means mqtts:// runs encrypted-but-unverified.`,
     `typedef void (*__tc_mqtt_msg_cb_t)(const char* topic, const char* payload);`,
     `static struct {`,
     `    struct mqtt_client client;`,
@@ -59,6 +65,16 @@ export function mqttInitLines(): string[] {
     `    uint16_t port;             // 1883 / 8883 unless overridden in the URI`,
     `    char client_id[64];`,
     `    bool tls;                  // scheme == "mqtts"`,
+    `    const uint8_t* ca_der;     // pinned CA (DER), nullptr = no CA`,
+    `    size_t ca_der_len;`,
+    `    // What this shim last registered under __TC_MQTT_SEC_TAG (DER arrays`,
+    `    // are function-static, so pointer identity is stable). Zephyr's`,
+    `    // credential store never REPLACES a tag — repeats are skipped, a`,
+    `    // different CA at an occupied tag is reported, not silent.`,
+    `    const uint8_t* ca_added;`,
+    `    size_t ca_added_len;`,
+    `    bool ca_added_set;`,
+    `    sec_tag_t sec_tags[1];     // backs tls.config.sec_tag_list (static lifetime)`,
     `    volatile bool connected;`,
     `    volatile bool stop_poll;   // set by disconnect to terminate the poll thread`,
     `    __tc_mqtt_msg_cb_t on_message;`,
@@ -200,6 +216,35 @@ export function mqttInitLines(): string[] {
     `    return host_len > 0U;`,
     `}`,
     ``,
+    `// Strict IPv4 dotted-quad predicate: exactly four 0-255 groups. A`,
+    `// digit-and-dot scan would also swallow numeric-only DNS names ("123"),`,
+    `// silently skipping the TLS hostname check for them (same helper as the`,
+    `// HTTP shim).`,
+    `static bool __tc_mqtt_host_is_ipv4(const char* h) {`,
+    `    uint32_t quads = 0U;`,
+    `    uint32_t val = 0U;`,
+    `    uint32_t digits = 0U;`,
+    `    for (const char* p = h; ; p++) {`,
+    `        if (*p >= '0' && *p <= '9') {`,
+    `            val = (val * 10U) + static_cast<uint32_t>(*p - '0');`,
+    `            digits++;`,
+    `            if (digits > 3U || val > 255U) return false;`,
+    `        } else if (*p == '.') {`,
+    `            if (digits == 0U || quads >= 3U) return false;`,
+    `            quads++;`,
+    `            val = 0U;`,
+    `            digits = 0U;`,
+    `        } else if (*p == '\\0') {`,
+    `            if (digits == 0U) return false;`,
+    `            quads++;`,
+    `            break;`,
+    `        } else {`,
+    `            return false;`,
+    `        }`,
+    `    }`,
+    `    return quads == 4U;`,
+    `}`,
+    ``,
     `// ── connect ─────────────────────────────────────────────────────────────`,
     `// Parse URI → resolve broker → init client → mqtt_connect → spawn poll thread.`,
     `// Blocks until CONNACK (the poll thread isn't running yet, so we drive a few`,
@@ -248,14 +293,47 @@ export function mqttInitLines(): string[] {
     `        __tc_mqtt.client.transport.type = MQTT_TRANSPORT_SECURE;`,
     `        struct mqtt_sec_config* tls_cfg = &__tc_mqtt.client.transport.tls.config;`,
     `        (void)memset(tls_cfg, 0, sizeof(*tls_cfg));`,
-    `        // The HAL MQTT surface has no CA-pinning op (unlike HTTP's caCert), so`,
-    `        // there is no way to register a trusted CA here. Verify-NONE keeps the`,
-    `        // TLS session encrypted but skips identity verification — the strongest`,
-    `        // the current surface can express. A future mqtt.set_ca_cert op would`,
-    `        // flip this to REQUIRED + a registered sec_tag (like the HTTPS path).`,
-    `        tls_cfg->peer_verify = TLS_PEER_VERIFY_NONE;`,
+    `        if (__tc_mqtt.ca_der != nullptr) {`,
+    `            // Pinned CA (the caCert construction fact): register it as a`,
+    `            // CA_CERTIFICATE sec tag and REQUIRE peer verification — the MQTT`,
+    `            // analogue of the HTTPS caCert path. Zephyr's credential store`,
+    `            // never REPLACES a tag+type pair: re-registering the same DER`,
+    `            // (pointer identity — the arrays are function-static) is skipped`,
+    `            // silently; a DIFFERENT CA hitting an occupied tag is reported so`,
+    `            // a wrong-CA verify is never silent; any other failure keeps the`,
+    `            // tag list empty and verification required — fail closed.`,
+    `            if (!__tc_mqtt.ca_added_set || __tc_mqtt.ca_added != __tc_mqtt.ca_der`,
+    `                || __tc_mqtt.ca_added_len != __tc_mqtt.ca_der_len) {`,
+    `                int cred_rc = tls_credential_add(__TC_MQTT_SEC_TAG,`,
+    `                                                 TLS_CREDENTIAL_CA_CERTIFICATE,`,
+    `                                                 __tc_mqtt.ca_der, __tc_mqtt.ca_der_len);`,
+    `                __tc_mqtt.ca_added = __tc_mqtt.ca_der;`,
+    `                __tc_mqtt.ca_added_len = __tc_mqtt.ca_der_len;`,
+    `                __tc_mqtt.ca_added_set = true;`,
+    `                if (cred_rc == -17 /* -EEXIST */) {`,
+    `                    printk("tc-mqtt: sec tag %d already holds a CA; the first one stays active (rc=%d)\\n", __TC_MQTT_SEC_TAG, cred_rc);`,
+    `                } else if (cred_rc != 0) {`,
+    `                    printk("tc-mqtt: CA registration failed (rc=%d) - verifying against no credentials\\n", cred_rc);`,
+    `                }`,
+    `            }`,
+    `            if (__tc_mqtt.ca_added_set) {`,
+    `                __tc_mqtt.sec_tags[0] = __TC_MQTT_SEC_TAG;`,
+    `                tls_cfg->sec_tag_list = __tc_mqtt.sec_tags;`,
+    `                tls_cfg->sec_tag_count = 1U;`,
+    `            }`,
+    `            tls_cfg->peer_verify = TLS_PEER_VERIFY_REQUIRED;`,
+    `        } else {`,
+    `            // No CA pinned: the session is encrypted but the broker's identity`,
+    `            // is not verified — the strongest the no-caCert form can express.`,
+    `            tls_cfg->peer_verify = TLS_PEER_VERIFY_NONE;`,
+    `        }`,
     `        tls_cfg->cipher_list = nullptr;`,
-    `        tls_cfg->hostname = __tc_mqtt.host;`,
+    `        // mbedtls does not match IP literals against SAN entries — set the`,
+    `        // hostname (SNI + identity check) only for name hosts; IP brokers`,
+    `        // verify chain-only (same policy as the HTTPS path).`,
+    `        if (!__tc_mqtt_host_is_ipv4(__tc_mqtt.host)) {`,
+    `            tls_cfg->hostname = __tc_mqtt.host;`,
+    `        }`,
     `#else`,
     `        printk("tc-mqtt: mqtts:// requested but CONFIG_MQTT_LIB_TLS is off\\n");`,
     `        return;`,
@@ -307,6 +385,10 @@ export function mqttInitLines(): string[] {
     `    __tc_mqtt.on_message = fn;`,
     `}`,
     ``,
+    `// ca_cert is the DER-decoded PEM from the caCert construction fact`,
+    `// (user-owned static array; nullptr = no pinned CA).`,
+    `static inline void __tc_mqtt_set_ca_cert_der(const uint8_t* der, size_t len) { __tc_mqtt.ca_der = der; __tc_mqtt.ca_der_len = len; }`,
+    ``,
     `static inline void __tc_mqtt_subscribe(const char* topic) {`,
     `    static struct mqtt_topic topics[4];`,
     `    static uint16_t msg_id = 1;`,
@@ -361,6 +443,25 @@ export function lowerMqtt(op: HALOpIR): { code?: string; expression?: string } {
   switch (op.operation) {
     case 'mqtt.connect':
       return { code: `__tc_mqtt_connect(${s(o.brokerUri)}, ${s(o.clientId)});` };
+    case 'mqtt.set_ca_cert': {
+      // PEM → DER at emit time (this tree's tf-psa-crypto mbedTLS has no PEM
+      // parser — same decode as http.set_ca_cert; tls_credential_add takes
+      // the DER directly).
+      const pem = String(o.pem ?? '').replace(/^"|"$/g, '').replace(/\\n/g, '\n');
+      if (pem.replace(/\s+/g, '') === '') {
+        // No-CA sentinel (Mqtt always emits the op from connect(); opts.caCert
+        // defaults to '') — elide silently so plain-mqtt:// carries no comment.
+        return { code: '' };
+      }
+      const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
+      const der = Buffer.from(b64, 'base64');
+      // Every X.509 DER starts with the ASN.1 SEQUENCE tag (0x30); a long
+      // but non-cert payload fails here instead of at a confusing handshake
+      // error on the target (same check as http.set_ca_cert).
+      if (der.length < 100 || der[0] !== 0x30) return { code: `// tc-mqtt: caCert PEM failed to decode` };
+      const hex = [...der].map((b) => `0x${b.toString(16).padStart(2, '0')}`).join(', ');
+      return { code: `{ static const uint8_t __tc_mqtt_ca_der[] = { ${hex} }; __tc_mqtt_set_ca_cert_der(__tc_mqtt_ca_der, sizeof(__tc_mqtt_ca_der)); }` };
+    }
     case 'mqtt.on_message':
       return { code: `__tc_mqtt_set_on_message(${s(o.handler)});` };
     case 'mqtt.subscribe':