@typecad/framework-zephyr 1.0.0-alpha.16 → 1.0.0-alpha.19

package/dist/lowering/http.js

@@ -8,11 +8,14 @@
 // (IPPROTO_TCP or IPPROTO_TLS_1_2 for https) → setsockopt TLS sec tags /
 // hostname / peer-verify → connect() → http_client_req → accumulate body.
 //
-// One request slot at a time (embedded-friendly): factory/reset → setters →
-// begin (inside send) → perform. Setters may run before begin and must survive
-// it (req.timeout(ms); req.send()); options are cleared by __tc_http_reset
-// when a new request starts (Http.get/post/…). Response body is heap-capped
-// (default 8 KB), NUL-terminated, valid until the next begin/perform/reset.
+// One request slot at a time (embedded-friendly): send() lowers
+// reset+begin (method/url) FIRST, then the fact setters (timeout/max_body/
+// body/tls), then perform — the reset-before-setters protocol; header()
+// pairs recorded on the request instance are re-staged by begin (after its
+// reset) so call-site header emissions and send() loops both survive.
+// Options are cleared by __tc_http_reset when a new request starts; response
+// body is heap-capped (default 8 KB, opts.maxBody), NUL-terminated, valid
+// until the next begin/perform/reset.
 //
 // TLS: https selects IPPROTO_TLS_1_2 + NET_SOCKETS_SOCKOPT_TLS (which selects
 // mbedTLS in Kconfig). insecure() sets TLS_PEER_VERIFY_NONE; caCert(pem)
@@ -55,7 +58,7 @@ export function httpInitLines() {
         `    char scheme[8];          // "http" or "https"`,
         `    char host[128];`,
         `    uint16_t port;           // 80 / 443 unless overridden in the url`,
-        `    char path[256];          // resource path beginning with '/'`,
+        `    char path[384];          // resource path beginning with '/'`,
         `    enum http_method method;`,
         `    int32_t timeout_ms;`,
         `    size_t max_body;`,
@@ -64,6 +67,13 @@ export function httpInitLines() {
         `    bool insecure;`,
         `    const uint8_t* ca_der;    // DER, user-owned; nullptr = no pinned CA`,
         `    size_t ca_der_len;`,
+        `    // What this shim last registered under __TC_HTTP_SEC_TAG (the DER arrays`,
+        `    // are function-static, so pointer identity is stable). Zephyr's`,
+        `    // credential store never REPLACES a tag — repeats are skipped silently,`,
+        `    // a different CA arriving at an occupied tag is reported, not hidden.`,
+        `    const uint8_t* ca_added;`,
+        `    size_t ca_added_len;`,
+        `    bool ca_added_set;`,
         `    const char* hdr_name[__TC_HTTP_MAX_HEADERS];`,
         `    const char* hdr_value[__TC_HTTP_MAX_HEADERS];`,
         `    int32_t hdr_count;`,
@@ -80,15 +90,25 @@ export function httpInitLines() {
         `    // is still reading → EBADMSG (-77) on chunked/larger responses.`,
         `    uint8_t recvbuf[1024];`,
         `    int64_t content_length;  // -1 = unknown`,
+        `    // Response headers: captured as raw "Name: Value\\r\\n" lines by the`,
+        `    // http_parser on_header_field/on_header_value hooks (req.http_cb) and`,
+        `    // scanned by __tc_http_response_header(). hdr_parse_name is the name`,
+        `    // fragment accumulator; hdr_stage tracks name(0)/value(1) parsing.`,
+        `    char resp_headers[768];`,
+        `    size_t resp_headers_len;`,
+        `    char hdr_parse_name[64];`,
+        `    size_t hdr_parse_name_len;`,
+        `    uint8_t hdr_stage;        // 0 = accumulating name, 1 = accumulating value`,
         `    char resp_header[128];   // scratch for response_header()`,
         `    // staged header fields for http_client_req: a NULL-terminated list of`,
         `    // "Name: Value\\r\\n" strings built from hdr_name/hdr_value at perform.`,
         `    const char* hdr_fields[__TC_HTTP_MAX_HEADERS + 1];`,
-        `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][64];`,
+        `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][128];`,
         `    // async completion signal (memory barrier between worker and poller)`,
         `    struct k_sem done_sem;`,
         `    bool sem_inited;`,
         `    struct k_work perform_work;`,
+        `    bool work_inited;`,
         `} __tc_http;`,
         ``,
         `// ── URL parser ──────────────────────────────────────────────────────────`,
@@ -115,6 +135,13 @@ export function httpInitLines() {
         `        __tc_http.host[host_len++] = *p++;`,
         `    }`,
         `    __tc_http.host[host_len] = '\\0';`,
+        `    // A host that filled the buffer means the URL is not what the user`,
+        `    // typed — a silently truncated host resolves the wrong server. Refuse.`,
+        `    if (host_len == (sizeof(__tc_http.host) - 1U) && *p != '\\0' && *p != ':' && *p != '/') {`,
+        `        printk("tc-http: host longer than %u bytes - refused\\n",`,
+        `               static_cast<unsigned int>(sizeof(__tc_http.host) - 1U));`,
+        `        return false;`,
+        `    }`,
         `    // optional :port`,
         `    if (*p == ':') {`,
         `        p++;`,
@@ -132,6 +159,13 @@ export function httpInitLines() {
         `        while (*p != '\\0' && path_len < (sizeof(__tc_http.path) - 1U)) {`,
         `            __tc_http.path[path_len++] = *p++;`,
         `        }`,
+        `        // Same honesty rule as the host: a truncated path (long query`,
+        `        // string) requests the wrong resource — refuse instead of misfetch.`,
+        `        if (path_len == (sizeof(__tc_http.path) - 1U) && *p != '\\0') {`,
+        `            printk("tc-http: path longer than %u bytes - refused\\n",`,
+        `                   static_cast<unsigned int>(sizeof(__tc_http.path) - 1U));`,
+        `            return false;`,
+        `        }`,
         `        __tc_http.path[path_len] = '\\0';`,
         `    } else {`,
         `        __tc_http.path[0] = '/';`,
@@ -140,6 +174,53 @@ export function httpInitLines() {
         `    return host_len > 0U;`,
         `}`,
         ``,
+        `// ── response-header capture (http_parser hooks via req.http_cb) ─────────`,
+        `// The client's internal parser settings forward on_header_field/`,
+        `// on_header_value fragments here while keeping their own status + body`,
+        `// handling. Fragments accumulate into raw "Name: Value\\r\\n" lines in`,
+        `// resp_headers (bounded — overflow drops the rest of the block, and`,
+        `// lookups of the dropped headers return ""). __tc_http_hdr_finish closes`,
+        `// the last line after http_client_req returns.`,
+        `static void __tc_http_hdr_append(const char* at, size_t len) {`,
+        `    size_t room = sizeof(__tc_http.resp_headers) - __tc_http.resp_headers_len;`,
+        `    size_t n = (len < room) ? len : room;`,
+        `    (void)memcpy(__tc_http.resp_headers + __tc_http.resp_headers_len, at, n);`,
+        `    __tc_http.resp_headers_len += n;`,
+        `}`,
+        ``,
+        `static int __tc_http_on_hdr_field(struct http_parser* parser, const char* at, size_t len) {`,
+        `    (void)parser;`,
+        `    if (__tc_http.hdr_stage == 1U) {`,
+        `        __tc_http_hdr_append("\\r\\n", 2U);`,
+        `        __tc_http.hdr_stage = 0U;`,
+        `        __tc_http.hdr_parse_name_len = 0U;`,
+        `    }`,
+        `    size_t room = sizeof(__tc_http.hdr_parse_name) - 1U - __tc_http.hdr_parse_name_len;`,
+        `    size_t n = (len < room) ? len : room;`,
+        `    (void)memcpy(__tc_http.hdr_parse_name + __tc_http.hdr_parse_name_len, at, n);`,
+        `    __tc_http.hdr_parse_name_len += n;`,
+        `    return 0;`,
+        `}`,
+        ``,
+        `static int __tc_http_on_hdr_value(struct http_parser* parser, const char* at, size_t len) {`,
+        `    (void)parser;`,
+        `    if (__tc_http.hdr_stage == 0U) {`,
+        `        __tc_http_hdr_append(__tc_http.hdr_parse_name, __tc_http.hdr_parse_name_len);`,
+        `        __tc_http_hdr_append(": ", 2U);`,
+        `        __tc_http.hdr_stage = 1U;`,
+        `    }`,
+        `    __tc_http_hdr_append(at, len);`,
+        `    return 0;`,
+        `}`,
+        ``,
+        `static void __tc_http_hdr_finish(void) {`,
+        `    if (__tc_http.hdr_stage == 1U) {`,
+        `        __tc_http_hdr_append("\\r\\n", 2U);`,
+        `    }`,
+        `    __tc_http.hdr_stage = 0U;`,
+        `    __tc_http.hdr_parse_name_len = 0U;`,
+        `}`,
+        ``,
         `// ── response callback ───────────────────────────────────────────────────`,
         `// http_response_cb_t: accumulate each body fragment into resp up to max_body,`,
         `// and capture the status code + content length from the first response.`,
@@ -163,6 +244,34 @@ export function httpInitLines() {
         `    return 0;`,
         `}`,
         ``,
+        `// Strict IPv4 dotted-quad predicate: exactly four 0-255 groups. A`,
+        `// digit-and-dot scan would also swallow numeric-only DNS names ("123"),`,
+        `// silently skipping the TLS hostname check for them.`,
+        `static bool __tc_http_host_is_ipv4(const char* h) {`,
+        `    uint32_t quads = 0U;`,
+        `    uint32_t val = 0U;`,
+        `    uint32_t digits = 0U;`,
+        `    for (const char* p = h; ; p++) {`,
+        `        if (*p >= '0' && *p <= '9') {`,
+        `            val = (val * 10U) + static_cast<uint32_t>(*p - '0');`,
+        `            digits++;`,
+        `            if (digits > 3U || val > 255U) return false;`,
+        `        } else if (*p == '.') {`,
+        `            if (digits == 0U || quads >= 3U) return false;`,
+        `            quads++;`,
+        `            val = 0U;`,
+        `            digits = 0U;`,
+        `        } else if (*p == '\\0') {`,
+        `            if (digits == 0U) return false;`,
+        `            quads++;`,
+        `            break;`,
+        `        } else {`,
+        `            return false;`,
+        `        }`,
+        `    }`,
+        `    return quads == 4U;`,
+        `}`,
+        ``,
         `// ── socket connect ──────────────────────────────────────────────────────`,
         `// zsock_getaddrinfo → zsock_socket(TCP | TLS_1_2) → TLS sockopts →`,
         `// zsock_connect. Uses the zsock_* (native Zephyr socket) API directly rather`,
@@ -197,24 +306,47 @@ export function httpInitLines() {
         `#if defined(CONFIG_NET_SOCKETS_SOCKOPT_TLS)`,
         `        int sock_tls = zsock_socket(res->ai_family, res->ai_socktype, IPPROTO_TLS_1_2);`,
         `        if (sock_tls >= 0) {`,
-        `            // Register the pinned CA as the active sec tag. tls_credential_add`,
-        `            // is idempotent-enough for the single-slot model: a duplicate tag`,
-        `            // is an error we ignore, and the most recently added cert wins.`,
+        `            // Register the pinned CA as the active sec tag. Zephyr's`,
+        `            // credential store never REPLACES a tag+type pair: a duplicate`,
+        `            // add fails and the FIRST cert stays active. Re-registering the`,
+        `            // same DER (pointer identity — the arrays are function-static)`,
+        `            // is skipped silently; a DIFFERENT CA hitting an occupied tag`,
+        `            // is reported so a wrong-CA verify is never silent. Any other`,
+        `            // failure skips the tag list: verification stays required with`,
+        `            // no credentials, so the handshake fails closed, not open.`,
         `            if (__tc_http.ca_der != nullptr) {`,
-        `                int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
-        `                                         TLS_CREDENTIAL_CA_CERTIFICATE,`,
-        `                                         __tc_http.ca_der, __tc_http.ca_der_len);`,
-        `                sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
-        `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
-        `                (void)cred_rc;`,
+        `                if (!__tc_http.ca_added_set || __tc_http.ca_added != __tc_http.ca_der`,
+        `                    || __tc_http.ca_added_len != __tc_http.ca_der_len) {`,
+        `                    int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
+        `                                             TLS_CREDENTIAL_CA_CERTIFICATE,`,
+        `                                             __tc_http.ca_der, __tc_http.ca_der_len);`,
+        `                    if (cred_rc == 0) {`,
+        `                        __tc_http.ca_added = __tc_http.ca_der;`,
+        `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+        `                        __tc_http.ca_added_set = true;`,
+        `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+        `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+        `                    } else if (cred_rc == -17 /* -EEXIST */) {`,
+        `                        printk("tc-http: sec tag %d already holds a CA; the first one stays active (add rc=%d)\\n", __TC_HTTP_SEC_TAG, cred_rc);`,
+        `                        __tc_http.ca_added = __tc_http.ca_der;`,
+        `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+        `                        __tc_http.ca_added_set = true;`,
+        `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+        `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+        `                    } else {`,
+        `                        printk("tc-http: CA registration failed (rc=%d) - verifying against no credentials\\n", cred_rc);`,
+        `                    }`,
+        `                } else {`,
+        `                    sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+        `                    (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+        `                }`,
         `            }`,
         `            // Hostname SNI + verification. insecure() disables verification;`,
         `            // the default (no caCert, no insecure) leaves verification required`,
         `            // with no sec tag, so the handshake fails safely until a CA is set.`,
         `            // mbedtls does not match IP literals against SAN entries —`,
         `            // skip the hostname check for IP hosts (chain-only verify).`,
-        `            bool host_is_ip = true; for (const char* p3 = __tc_http.host; *p3 != 0; p3++) { if (!((*p3 >= '0' && *p3 <= '9') || *p3 == '.')) { host_is_ip = false; break; } }`,
-        `            if (!host_is_ip) {`,
+        `            if (!__tc_http_host_is_ipv4(__tc_http.host)) {`,
         `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_HOSTNAME, __tc_http.host, strlen(__tc_http.host) + 1U);`,
         `            }`,
         `            int32_t verify = __tc_http.insecure ? TLS_PEER_VERIFY_NONE : TLS_PEER_VERIFY_REQUIRED;`,
@@ -244,8 +376,29 @@ export function httpInitLines() {
         `    return sock;`,
         `}`,
         ``,
-        `/** Clear request options + response; called when Http.get/post/… starts a new request. */`,
-        `static inline void __tc_http_reset(void) {`,
+        `/** Block until an async perform has finished (single-slot contract: a new`,
+        ` *  request may not clear state the workqueue is still writing). Bounded at`,
+        ` *  20 s — longer than any sane timeout_ms; past that it reports and the`,
+        ` *  caller proceeds without clearing (the in-flight response stays intact).`,
+        ` *  Cheap no-op when the async path was never used. */`,
+        `static void __tc_http_wait_async_idle(void) {`,
+        `    if (!__tc_http.work_inited) return;`,
+        `    int32_t waited = 0;`,
+        `    while (k_work_is_pending(&__tc_http.perform_work)) {`,
+        `        if (waited >= 20000) {`,
+        `            printk("tc-http: async request still busy after 20s\\n");`,
+        `            return;`,
+        `        }`,
+        `        k_msleep(10);`,
+        `        waited += 10;`,
+        `    }`,
+        `}`,
+        ``,
+        `/** Clear request options + response. Rides the head of every request (the`,
+        ` *  begin op from send()): reset FIRST, then this request's fact setters —`,
+        ` *  so nothing a previous request staged can leak into this one. */`,
+        `static void __tc_http_reset(void) {`,
+        `    __tc_http_wait_async_idle();`,
         `    if (__tc_http.resp != nullptr) { delete[] __tc_http.resp; __tc_http.resp = nullptr; }`,
         `    __tc_http.timeout_ms = 15000;`,
         `    __tc_http.max_body = __TC_HTTP_DEFAULT_MAX_BODY;`,
@@ -260,12 +413,24 @@ export function httpInitLines() {
         `    __tc_http.ok = false;`,
         `    __tc_http.resp_len = 0;`,
         `    __tc_http.content_length = -1;`,
+        `    __tc_http.resp_headers_len = 0;`,
+        `    __tc_http.hdr_parse_name_len = 0;`,
+        `    __tc_http.hdr_stage = 0U;`,
         `    __tc_http.resp_header[0] = '\\0';`,
         `    __tc_http.url[0] = '\\0';`,
         `}`,
         ``,
         `/** Stage the request. Setters (timeout/max_body/body/tls/headers) survive begin. */`,
         `static inline void __tc_http_begin(enum http_method method, const char* url) {`,
+        `    if (strlen(url) >= sizeof(__tc_http.url)) {`,
+        `        // A silently truncated URL fetches the wrong resource — refuse; the`,
+        `        // empty url makes perform's parse fail loudly ("bad url").`,
+        `        printk("tc-http: url longer than %u bytes - refused\\n",`,
+        `               static_cast<unsigned int>(sizeof(__tc_http.url) - 1U));`,
+        `        __tc_http.url[0] = '\\0';`,
+        `        __tc_http.method = method;`,
+        `        return;`,
+        `    }`,
         `    (void)strncpy(__tc_http.url, url, sizeof(__tc_http.url) - 1U);`,
         `    __tc_http.url[sizeof(__tc_http.url) - 1U] = '\\0';`,
         `    __tc_http.method = method;`,
@@ -276,6 +441,9 @@ export function httpInitLines() {
         `    __tc_http.ok = false;`,
         `    __tc_http.resp_len = 0;`,
         `    __tc_http.content_length = -1;`,
+        `    __tc_http.resp_headers_len = 0;`,
+        `    __tc_http.hdr_parse_name_len = 0;`,
+        `    __tc_http.hdr_stage = 0U;`,
         `    __tc_http.resp_header[0] = '\\0';`,
         `}`,
         ``,
@@ -327,15 +495,34 @@ export function httpInitLines() {
         `    int sock = __tc_http_open_socket();`,
         `    if (sock < 0) { __tc_http.done = true; return; }`,
         `    // Build the NULL-terminated header-fields list from staged headers.`,
+        `    // Format capped 2 bytes short of the buffer so the CRLF can ALWAYS be`,
+        `    // appended — a truncated value stays a syntactically valid header line`,
+        `    // instead of swallowing the next one (snprintk alone can cut the \\r\\n).`,
         `    for (int32_t i = 0; i < __tc_http.hdr_count && i < __TC_HTTP_MAX_HEADERS; i++) {`,
-        `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]),`,
-        `                       "%s: %s\\r\\n", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+        `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]) - 2U,`,
+        `                       "%s: %s", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+        `        size_t flen = strlen(__tc_http.hdr_field_buf[i]);`,
+        `        __tc_http.hdr_field_buf[i][flen] = '\\r';`,
+        `        __tc_http.hdr_field_buf[i][flen + 1U] = '\\n';`,
+        `        __tc_http.hdr_field_buf[i][flen + 2U] = '\\0';`,
         `        __tc_http.hdr_fields[i] = __tc_http.hdr_field_buf[i];`,
         `    }`,
         `    __tc_http.hdr_fields[(__tc_http.hdr_count < __TC_HTTP_MAX_HEADERS)`,
         `                         ? __tc_http.hdr_count : __TC_HTTP_MAX_HEADERS] = nullptr;`,
+        `    // Response-header capture: the client's internal parser hooks forward`,
+        `    // to these settings (on_header_field/on_header_value) while keeping`,
+        `    // their own status/body handling — no interference with the body path.`,
+        `    static struct http_parser_settings __tc_http_parse_settings;`,
+        `    static bool __tc_http_parse_settings_inited;`,
+        `    if (!__tc_http_parse_settings_inited) {`,
+        `        http_parser_settings_init(&__tc_http_parse_settings);`,
+        `        __tc_http_parse_settings.on_header_field = __tc_http_on_hdr_field;`,
+        `        __tc_http_parse_settings.on_header_value = __tc_http_on_hdr_value;`,
+        `        __tc_http_parse_settings_inited = true;`,
+        `    }`,
         `    struct http_request req = { 0 };`,
         `    req.method = __tc_http.method;`,
+        `    req.http_cb = &__tc_http_parse_settings;`,
         `    req.url = __tc_http.path;`,
         `    req.host = __tc_http.host;`,
         `    req.protocol = "HTTP/1.1";`,
@@ -348,6 +535,7 @@ export function httpInitLines() {
         `        req.payload_len = static_cast<size_t>(__tc_http.body_len);`,
         `    }`,
         `    int sent = http_client_req(sock, &req, __tc_http.timeout_ms, nullptr);`,
+        `    __tc_http_hdr_finish();`,
         `    // The response callback (__tc_http_resp_cb) captures the status, but Zephyr's`,
         `    // parser aborts on 5xx responses (on_headers_complete returns 1 for status`,
         `    // >= 500, which http_parser treats as an error → http_client_req returns`,
@@ -391,12 +579,23 @@ export function httpInitLines() {
         `        k_sem_init(&__tc_http.done_sem, 0, 1);`,
         `        __tc_http.sem_inited = true;`,
         `    }`,
+        `    // Init the work item ONCE — re-initializing a queued/running item is`,
+        `    // undefined in Zephyr, and the busy check below makes the single-slot`,
+        `    // contract explicit instead of corrupting the in-flight request.`,
+        `    if (!__tc_http.work_inited) {`,
+        `        k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
+        `        __tc_http.work_inited = true;`,
+        `    }`,
+        `    if (k_work_is_pending(&__tc_http.perform_work)) {`,
+        `        printk("tc-http: previous async request still in flight - send refused\\n");`,
+        `        __tc_http.done = true;`,
+        `        return;`,
+        `    }`,
         `    __tc_http.done = false;`,
         `    // Drain any completion signal left from a previous request (e.g. the`,
         `    // prior done() saw the volatile flag before taking the sem), so the first`,
         `    // poll of this request doesn't fire on a stale signal.`,
         `    (void)k_sem_take(&__tc_http.done_sem, K_NO_WAIT);`,
-        `    k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
         `    (void)k_work_submit(&__tc_http.perform_work);`,
         `}`,
         ``,
@@ -419,13 +618,39 @@ export function httpInitLines() {
         `    return static_cast<int32_t>(__tc_http.content_length);`,
         `}`,
         ``,
-        `// Response-header lookup. The Zephyr http_client_req surface does not expose`,
-        `// arbitrary response headers via the recv buffer; this returns the last`,
-        `// header captured by the response callback path. With no per-header hook`,
-        `// it returns "" until a richer parser setting is wired (http_cb).`,
+        `// Response-header lookup over the block captured by the parser hooks.`,
+        `// ASCII-case-insensitive name match at a line start; returns the value`,
+        `// ("" when absent or when the block was truncated past it).`,
+        `static inline char __tc_http_ascii_lower(char c) {`,
+        `    return (c >= 'A' && c <= 'Z') ? static_cast<char>(c + 32) : c;`,
+        `}`,
+        ``,
         `static inline const char* __tc_http_response_header(const char* name) {`,
-        `    (void)name;`,
         `    __tc_http.resp_header[0] = '\\0';`,
+        `    const char* block = __tc_http.resp_headers;`,
+        `    const char* end = block + __tc_http.resp_headers_len;`,
+        `    const char* line = block;`,
+        `    while (line < end) {`,
+        `        const char* eol = line;`,
+        `        while (eol < end && *eol != '\\r' && *eol != '\\n') { eol++; }`,
+        `        const char* c = line;`,
+        `        const char* n = name;`,
+        `        while (c < eol && *n != '\\0' && __tc_http_ascii_lower(*c) == __tc_http_ascii_lower(*n)) {`,
+        `            c++;`,
+        `            n++;`,
+        `        }`,
+        `        if (*n == '\\0' && c < eol && *c == ':') {`,
+        `            c++;`,
+        `            if (c < eol && *c == ' ') { c++; }`,
+        `            size_t vlen = static_cast<size_t>(eol - c);`,
+        `            if (vlen >= sizeof(__tc_http.resp_header)) { vlen = sizeof(__tc_http.resp_header) - 1U; }`,
+        `            (void)memcpy(__tc_http.resp_header, c, vlen);`,
+        `            __tc_http.resp_header[vlen] = '\\0';`,
+        `            break;`,
+        `        }`,
+        `        line = eol;`,
+        `        while (line < end && (*line == '\\r' || *line == '\\n')) { line++; }`,
+        `    }`,
         `    return __tc_http.resp_header;`,
         `}`,
         `// CUTTLEFISH_HTTP_END`,
@@ -452,9 +677,13 @@ export function lowerHttp(op) {
         case 'http.begin': {
             const methodName = String(o.method).replace(/^["']|["']$/g, '').toUpperCase();
             const method = METHOD_MAP[methodName] ?? 'HTTP_GET';
-            // Fresh shim state per request — the reset used to ride the deleted
-            // factory op (http.reset); construction now owns it.
-            return { code: `__tc_http_reset(); __tc_http_begin(${method}, ${s(o.url)});` };
+            // Fresh shim state per request, THEN this request's header() pairs:
+            // the reset must precede them (the call-site emissions ran before
+            // send() and are wiped by the reset — re-staging here also keeps
+            // headers alive across send() loops).
+            const pairs = Array.isArray(o.headers) ? o.headers : [];
+            const staged = pairs.length > 0 ? `${pairs.map(([n, v]) => `__tc_http_set_header(${s(n)}, ${s(v)});`).join(' ')} ` : '';
+            return { code: `__tc_http_reset(); ${staged}__tc_http_begin(${method}, ${s(o.url)});` };
         }
         case 'http.set_header':
             return { code: `__tc_http_set_header(${s(o.name)}, ${s(o.value)});` };
@@ -480,7 +709,10 @@ export function lowerHttp(op) {
             }
             const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
             const der = Buffer.from(b64, 'base64');
-            if (der.length < 100)
+            // Every X.509 DER starts with the ASN.1 SEQUENCE tag (0x30); a long
+            // but non-cert payload fails here instead of at a confusing handshake
+            // error on the target.
+            if (der.length < 100 || der[0] !== 0x30)
                 return { code: `// tc-http: caCert PEM failed to decode` };
             const hex = [...der].map((b) => `0x${b.toString(16).padStart(2, '0')}`).join(', ');
             return { code: `{ static const uint8_t __tc_ca_der[] = { ${hex} }; __tc_http_set_ca_cert_der(__tc_ca_der, sizeof(__tc_ca_der)); }` };

package/dist/lowering/i2c.d.ts

@@ -5,6 +5,14 @@ import type { ZephyrChipDescriptor } from '../chips/types.js';
  * controller the program uses (gated on ctx.analysis.usesI2C).
  */
 export declare function i2cInitLines(chip: ZephyrChipDescriptor, controllerIndex: number): string[];
+/**
+ * Emit one responder's state: receive ring (UART discipline — free-running
+ * head/tail, overflow-drop), response buffer with its served position, the
+ * two handler slots, the five i2c_target callbacks, and the config the ops'
+ * registration guard passes to i2c_target_register. Called from shimLines
+ * for each constructed responder (collectI2cResponders).
+ */
+export declare function i2cResponderStateLines(chip: ZephyrChipDescriptor, controllerIndex: number, address: number, rx: number, tx: number): string[];
 /**
  * Resolve a HAL i2c.* op to Zephyr C++.
  * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.

package/dist/lowering/i2c.js

@@ -40,13 +40,105 @@ function speedForHz(hz) {
         return 'I2C_SPEED_FAST_PLUS';
     return 'I2C_SPEED_HIGH';
 }
+// ── I2C responder (hal/i2c-responder.ts) — this board as an I2C target ────
+//
+// One state block per constructed responder (bus + address), the i2c_target
+// vocabulary verbatim: the five driver callbacks behind two user-facing ones
+// (onReceive fires at STOP with the receive ring's new byte count; onRequest
+// fires at read start — the write() refill point). Registration
+// (i2c_target_register) is once-guarded at the first op, against the
+// controller handle the master-side init block emitted (__tc_i2c<N>_dev).
+/** The C symbol prefix for one responder's state. */
+function respPrefix(idx, address) {
+    return `__tc_i2cresp${idx}_a${address.toString(16)}`;
+}
+/** The once-guarded registration every responder op carries — the UART arm
+ *  discipline: the first emitted call registers the address, so the
+ *  callbacks installed early in setup make it answer from boot. An
+ *  unsupported controller prints loudly (the CAN policy: -ENOSYS from a
+ *  driver with no target mode must not be a silent empty responder). */
+function respRegisterGuard(p, idx) {
+    return `{ if (!${p}_registered) { ${p}_registered = true; int __tc_err = i2c_target_register(__tc_i2c${idx}_dev, &${p}_cfg); if (__tc_err != 0) { printk("typecad-hal i2c responder: target_register failed: %d\\n", __tc_err); } } } `;
+}
 /**
- * The (void) comma expression begin/end lower to — a no-op that references
- * the controller's whole state block (device + transaction buffers) so a
- * program calling only begin() stays -Werror clean (-Wunused-variable).
+ * Emit one responder's state: receive ring (UART discipline — free-running
+ * head/tail, overflow-drop), response buffer with its served position, the
+ * two handler slots, the five i2c_target callbacks, and the config the ops'
+ * registration guard passes to i2c_target_register. Called from shimLines
+ * for each constructed responder (collectI2cResponders).
  */
-function i2cKeepAlive(p) {
-    return `(void)${p}_dev;`;
+export function i2cResponderStateLines(chip, controllerIndex, address, rx, tx) {
+    const ctrl = chip.i2c?.controllers[controllerIndex];
+    if (!ctrl)
+        return [];
+    const p = respPrefix(controllerIndex, address);
+    return [
+        '// CUTTLEFISH_I2CRESP_BEGIN',
+        `static uint8_t ${p}_rx[${rx}];`,
+        `static volatile uint32_t ${p}_head = 0;`,
+        `static volatile uint32_t ${p}_tail = 0;`,
+        `static uint8_t ${p}_tx[${tx}];`,
+        `static volatile uint32_t ${p}_txlen = 0;`,
+        `static volatile uint32_t ${p}_txpos = 0;`,
+        `static void (*${p}_on_rx)(double) = NULL;`,
+        `static void (*${p}_on_rq)(void) = NULL;`,
+        // A controller write transaction: reset the ring, then take each byte.
+        // A byte arriving with a full ring is dropped — the embedded-honest
+        // answer (no unbounded buffering), same as the UART RX ring.
+        `static int ${p}_write_requested(struct i2c_target_config* cfg) {`,
+        '    (void)cfg;',
+        `    ${p}_head = 0;`,
+        `    ${p}_tail = 0;`,
+        '    return 0;',
+        '}',
+        `static int ${p}_write_received(struct i2c_target_config* cfg, uint8_t val) {`,
+        '    (void)cfg;',
+        `    if ((${p}_head - ${p}_tail) < ${rx}U) {`,
+        `        ${p}_rx[${p}_head % ${rx}U] = val;`,
+        `        ${p}_head++;`,
+        '    }',
+        '    return 0;',
+        '}',
+        // A controller read transaction: the user's refill point first, then the
+        // first byte. Past the buffer's end the controller reads 0xFF (the bus
+        // has no NACK for a too-long read; the value is the honest filler).
+        `static int ${p}_read_requested(struct i2c_target_config* cfg, uint8_t* val) {`,
+        '    (void)cfg;',
+        `    if (${p}_on_rq != NULL) { ${p}_on_rq(); }`,
+        `    ${p}_txpos = 1U;`,
+        `    *val = (${p}_txlen > 0U) ? ${p}_tx[0] : 0xFFU;`,
+        '    return 0;',
+        '}',
+        `static int ${p}_read_processed(struct i2c_target_config* cfg, uint8_t* val) {`,
+        '    (void)cfg;',
+        `    *val = (${p}_txpos < ${p}_txlen) ? ${p}_tx[${p}_txpos] : 0xFFU;`,
+        `    ${p}_txpos++;`,
+        '    return 0;',
+        '}',
+        // End of transaction: announce a completed controller write with the
+        // count now waiting in the ring (the Wire onReceive(len) semantic).
+        `static int ${p}_stop(struct i2c_target_config* cfg) {`,
+        '    (void)cfg;',
+        `    if ((${p}_on_rx != NULL) && (${p}_head > ${p}_tail)) {`,
+        `        ${p}_on_rx(static_cast<double>(${p}_head - ${p}_tail));`,
+        '    }',
+        '    return 0;',
+        '}',
+        `static const struct i2c_target_callbacks ${p}_cbs = {`,
+        `    .write_requested = ${p}_write_requested,`,
+        `    .read_requested = ${p}_read_requested,`,
+        `    .write_received = ${p}_write_received,`,
+        `    .read_processed = ${p}_read_processed,`,
+        `    .stop = ${p}_stop,`,
+        '};',
+        `static struct i2c_target_config ${p}_cfg = {`,
+        '    .flags = 0U,',
+        `    .address = ${address}U,`,
+        `    .callbacks = &${p}_cbs,`,
+        '};',
+        `static bool ${p}_registered = false;`,
+        '// CUTTLEFISH_I2CRESP_END',
+    ];
 }
 /** The thin-device bus-speed preamble: apply the construction hz once
  *  (i2c_configure with Zephyr's I2C_SPEED_SET tier mapping), or '' when the
@@ -99,6 +191,46 @@ export function lowerI2c(op, chip) {
             const arr = `static const uint8_t __tc_i2cw[] = { ${bytes.join(', ')} };`;
             return { code: `${pre} ${arr} (void)i2c_write(${p}_dev, __tc_i2cw, sizeof(__tc_i2cw), static_cast<uint16_t>(${o.address}));` };
         }
+        // ── I2C responder (hal/i2c-responder.ts) — target-mode ops ───────────
+        // Every op carries the once-guarded registration; the state it touches
+        // is the per-responder block i2cResponderStateLines emitted.
+        case 'i2c.resp_on_receive': {
+            const rp = respPrefix(idx, o.address);
+            return { code: `${respRegisterGuard(rp, idx)} ${rp}_on_rx = ${o.handler};` };
+        }
+        case 'i2c.resp_on_request': {
+            const rp = respPrefix(idx, o.address);
+            return { code: `${respRegisterGuard(rp, idx)} ${rp}_on_rq = ${o.handler};` };
+        }
+        case 'i2c.resp_available': {
+            const rp = respPrefix(idx, o.address);
+            return { expression: `({ ${respRegisterGuard(rp, idx)} (${rp}_head - ${rp}_tail); })` };
+        }
+        case 'i2c.resp_read': {
+            const rp = respPrefix(idx, o.address);
+            return { expression: `({ ${respRegisterGuard(rp, idx)} (${rp}_tail < ${rp}_head ? ${rp}_rx[(${rp}_tail)++ % ${o.rx}U] : -1); })` };
+        }
+        case 'i2c.resp_write': {
+            const rp = respPrefix(idx, o.address);
+            const bytes = o.bytes ?? [];
+            const isBuffer = bytes.length === 1 && typeof bytes[0] === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(bytes[0]);
+            if (isBuffer) {
+                const name = bytes[0];
+                // A named user buffer: copy its storage into the response buffer,
+                // clamped to the constructed size; the length lands last so an
+                // in-flight read never sees a torn buffer.
+                return {
+                    code: `${respRegisterGuard(rp, idx)} { ${rp}_txlen = 0U; for (uint32_t __tc_i = 0U; (__tc_i < sizeof(${name})) && (__tc_i < ${o.tx}U); ++__tc_i) { ${rp}_tx[__tc_i] = ${name}[__tc_i]; } ${rp}_txlen = (sizeof(${name}) < ${o.tx}U) ? static_cast<uint32_t>(sizeof(${name})) : ${o.tx}U; }`,
+                };
+            }
+            if (bytes.length > Number(o.tx)) {
+                throw new Error(`I2C responder write: the response buffer holds ${o.tx} bytes — got ${bytes.length}. Construct with a larger txBufferBytes.`);
+            }
+            const assigns = bytes
+                .map((b, i) => `${rp}_tx[${i}] = static_cast<uint8_t>(${b});`)
+                .join(' ');
+            return { code: `${respRegisterGuard(rp, idx)} { ${rp}_txlen = 0U; ${assigns} ${rp}_txlen = ${bytes.length}U; }` };
+        }
         default:
             throw new Error(`framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
                 `Open an issue or use rawCpp() to emit it manually.`);