@typecad/framework-zephyr 1.0.0-alpha.16 → 1.0.0-alpha.19

package/dist/lowering/i2s.d.ts

@@ -0,0 +1,27 @@
+import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
+import type { ZephyrChipDescriptor } from '../chips/types.js';
+/** Which i2s.* verbs the program actually uses on a controller — the init
+ *  block emits only the state those verbs reference (a write-only program
+ *  must not carry an unused rx buffer: -Werror fails the build). */
+export interface I2sUsage {
+    write: boolean;
+    read: boolean;
+    readAt: boolean;
+}
+/**
+ * Emit the per-controller I2S state: device handle, mem slab, TX/RX block
+ * buffers, and the lazy per-direction init helpers. Called from shimLines
+ * when the program uses i2s.* on this controller and the chip declares it.
+ * The once-flags live HERE (shim scope), not in the lowered call sites — a
+ * second write() statement must not reconfigure/re-start a running stream
+ * (i2s_configure is legal only before the first trigger).
+ */
+export declare function i2sInitLines(chip: ZephyrChipDescriptor, controllerIndex: number, blockBytes: number, usage: I2sUsage): string[];
+/**
+ * Resolve a HAL i2s.* op to Zephyr C++.
+ * Returns `{ code }` for write, `{ expression }` for read/readAt.
+ */
+export declare function lowerI2s(op: HALOpIR, chip: ZephyrChipDescriptor): {
+    code?: string;
+    expression?: string;
+};

package/dist/lowering/i2s.js

@@ -0,0 +1,98 @@
+// ---------------------------------------------------------------------------
+// I2S lowering — Zephyr's i2s API over the harvested controller node
+//
+// The controller is addressed by its DT nodelabel (chip.i2s, the harvested
+// i2s@ node — ESP32 I2S0/1). Each direction lazy-inits on first use (the
+// PWM discipline): configure + trigger START once, then every write/read is
+// one block. The shim owns the mem slab (2 blocks), the TX packing buffer,
+// and the RX receive buffer; blockAt/readAt index the last received block.
+// ---------------------------------------------------------------------------
+/** The C variable names for an I2S controller's state. */
+function prefix(idx) {
+    return `__tc_i2s${idx}`;
+}
+/**
+ * Emit the per-controller I2S state: device handle, mem slab, TX/RX block
+ * buffers, and the lazy per-direction init helpers. Called from shimLines
+ * when the program uses i2s.* on this controller and the chip declares it.
+ * The once-flags live HERE (shim scope), not in the lowered call sites — a
+ * second write() statement must not reconfigure/re-start a running stream
+ * (i2s_configure is legal only before the first trigger).
+ */
+export function i2sInitLines(chip, controllerIndex, blockBytes, usage) {
+    const ctrl = chip.i2s?.controllers[controllerIndex];
+    if (!ctrl)
+        return [];
+    const p = prefix(controllerIndex);
+    // readAt rides the RX engine too (its lowering lazily starts RX like read
+    // does) — a readAt-only program still references the whole engine state.
+    const needsEngine = usage.write || usage.read || usage.readAt;
+    const lines = [
+        '// CUTTLEFISH_I2S_BEGIN',
+        `static const struct device* ${p}_dev = DEVICE_DT_GET(DT_NODELABEL(${ctrl.nodeLabel}));`,
+    ];
+    if (needsEngine) {
+        lines.push(`K_MEM_SLAB_DEFINE_STATIC(${p}_slab, ${blockBytes}, 2, 4);`, `K_MEM_SLAB_DEFINE_STATIC(${p}_rxslab, ${blockBytes}, 2, 4);`, `static void ${p}_init(uint32_t hz, uint8_t channels, uint8_t bits, size_t block_bytes) {`, '    struct i2s_config cfg = { 0 };', '    cfg.word_size = bits;', '    cfg.channels = channels;', '    cfg.format = I2S_FMT_DATA_FORMAT_I2S;', '    cfg.options = 0;', '    cfg.frame_clk_freq = hz;', `    cfg.mem_slab = &${p}_slab;`, '    cfg.block_size = block_bytes;', '    cfg.timeout = 200;', `    int err = i2s_configure(${p}_dev, I2S_DIR_TX, &cfg);`, '    if (err != 0) { printk("typecad-hal i2s: tx configure failed: %d\\n", err); }', `    cfg.mem_slab = &${p}_rxslab;`, `    err = i2s_configure(${p}_dev, I2S_DIR_RX, &cfg);`, '    if (err != 0) { printk("typecad-hal i2s: rx configure failed: %d\\n", err); }', '}', `static bool ${p}_init_done = false;`);
+    }
+    if (usage.write) {
+        lines.push(`static int16_t ${p}_txbuf[${blockBytes / 2}];`, `static bool ${p}_tx_started = false;`);
+    }
+    if (usage.read || usage.readAt) {
+        lines.push(`static int16_t ${p}_rxbuf[${blockBytes / 2}];`);
+        lines.push(`static bool ${p}_rx_started = false;`);
+    }
+    lines.push('// CUTTLEFISH_I2S_END');
+    return lines;
+}
+/**
+ * Resolve a HAL i2s.* op to Zephyr C++.
+ * Returns `{ code }` for write, `{ expression }` for read/readAt.
+ */
+export function lowerI2s(op, chip) {
+    const o = op;
+    // DAC discipline: no harvested i2s@ node lowers to the honest comment.
+    if (!chip.i2s || chip.i2s.controllers.length === 0) {
+        return { code: `/* ${op.operation}: this board's chip data declares no I2S controller (no harvested i2s@ node) */` };
+    }
+    const idx = Math.min(Number(o.instance ?? 0), chip.i2s.controllers.length - 1);
+    const p = prefix(idx);
+    const hz = Number(o.hz ?? 16000);
+    const channels = Number(o.channels ?? 2);
+    const bits = Number(o.bits ?? 16);
+    const blockFrames = Number(o.blockFrames ?? 64);
+    const blockBytes = blockFrames * channels * (bits / 8);
+    switch (op.operation) {
+        case 'i2s.write': {
+            const samples = (o.samples ?? []);
+            const cap = blockFrames * channels;
+            if (samples.length > cap) {
+                throw new Error(`I2S write: one block carries at most ${cap} samples (${blockFrames} frames × ${channels} channels) — got ${samples.length}.`);
+            }
+            // Zero-pad to the full block; samples are 16-bit.
+            const writes = [];
+            for (let i = 0; i < cap; i++) {
+                const v = i < samples.length ? samples[i] : 0;
+                writes.push(`${p}_txbuf[${i}] = static_cast<int16_t>(${v});`);
+            }
+            return {
+                code: `{ if (!${p}_init_done) { ${p}_init_done = true; ${p}_init(${hz}U, ${channels}U, ${bits}U, ${blockBytes}U); } ${writes.join(' ')} int err = i2s_buf_write(${p}_dev, ${p}_txbuf, ${blockBytes}U); if (err != 0) { printk("typecad-hal i2s: write failed: %d\\n", err); } else { if (!${p}_tx_started) { ${p}_tx_started = true; err = i2s_trigger(${p}_dev, I2S_DIR_TX, I2S_TRIGGER_START); if (err != 0) { printk("typecad-hal i2s: tx start failed: %d\\n", err); } } } }`,
+            };
+        }
+        case 'i2s.read': {
+            return {
+                expression: `({ if (!${p}_init_done) { ${p}_init_done = true; ${p}_init(${hz}U, ${channels}U, ${bits}U, ${blockBytes}U); } if (!${p}_rx_started) { ${p}_rx_started = true; int err = i2s_trigger(${p}_dev, I2S_DIR_RX, I2S_TRIGGER_START); if (err != 0) { printk("typecad-hal i2s: rx start failed: %d\\n", err); } } size_t got = 0U; int err = i2s_buf_read(${p}_dev, ${p}_rxbuf, &got); if (err != 0) { printk("typecad-hal i2s: read failed: %d\\n", err); } static_cast<double>(${p}_rxbuf[0]); })`,
+            };
+        }
+        case 'i2s.read_at': {
+            // Same lazy RX start as read(): readAt indexes the last RECEIVED
+            // block, so the stream must be running — and a readAt-only program
+            // references (and therefore compiles in) the whole engine state.
+            return {
+                expression: `({ if (!${p}_init_done) { ${p}_init_done = true; ${p}_init(${hz}U, ${channels}U, ${bits}U, ${blockBytes}U); } if (!${p}_rx_started) { ${p}_rx_started = true; int err = i2s_trigger(${p}_dev, I2S_DIR_RX, I2S_TRIGGER_START); if (err != 0) { printk("typecad-hal i2s: rx start failed: %d\\n", err); } } int32_t at = static_cast<int32_t>(${o.index}); double v = 0.0; if (at >= 0 && static_cast<uint32_t>(at) < (sizeof(${p}_rxbuf) / sizeof(${p}_rxbuf[0]))) { v = static_cast<double>(${p}_rxbuf[at]); } v; })`,
+            };
+        }
+        default:
+            throw new Error(`framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
+                `Open an issue or use rawCpp() to emit it manually.`);
+    }
+}

package/dist/lowering/index.d.ts

@@ -21,7 +21,15 @@ import { lowerFs } from './fs.js';
 import { lowerSensor } from './sensor.js';
 import { lowerHwtimer, lowerCounter } from './hwtimer.js';
 import { lowerThread } from './thread.js';
-export { lowerGpio, lowerTiming, lowerAdc, lowerPwm, lowerI2c, lowerSpi, lowerUart, lowerUsb, lowerInterrupt, lowerWdt, lowerBle, lowerWifi, lowerHttp, lowerMqtt, lowerPreferences, lowerBoard, lowerRandom, lowerDac, lowerFs, lowerHwtimer, lowerCounter, lowerSensor, lowerThread, };
+import { lowerTrace } from './trace.js';
+import { lowerStrip } from './strip.js';
+import { lowerHid } from './hid.js';
+import { lowerMatrix } from './matrix.js';
+import { lowerPower } from './power.js';
+import { lowerClock } from './clock.js';
+import { lowerCan } from './can.js';
+import { lowerI2s } from './i2s.js';
+export { lowerGpio, lowerTiming, lowerAdc, lowerPwm, lowerI2c, lowerSpi, lowerUart, lowerUsb, lowerInterrupt, lowerWdt, lowerBle, lowerWifi, lowerHttp, lowerMqtt, lowerPreferences, lowerBoard, lowerRandom, lowerDac, lowerFs, lowerHwtimer, lowerCounter, lowerSensor, lowerThread, lowerTrace, lowerStrip, lowerHid, lowerMatrix, lowerPower, lowerClock, lowerCan, lowerI2s, };
 /**
  * Lower a HAL op to Zephyr C++. Returns undefined for unsupported categories
  * (mirrors lowerHalOp in framework-esp32/src/lowering/index.ts).

package/dist/lowering/index.js

@@ -38,7 +38,15 @@ import { lowerFs } from './fs.js';
 import { lowerSensor } from './sensor.js';
 import { lowerHwtimer, lowerCounter } from './hwtimer.js';
 import { lowerThread } from './thread.js';
-export { lowerGpio, lowerTiming, lowerAdc, lowerPwm, lowerI2c, lowerSpi, lowerUart, lowerUsb, lowerInterrupt, lowerWdt, lowerBle, lowerWifi, lowerHttp, lowerMqtt, lowerPreferences, lowerBoard, lowerRandom, lowerDac, lowerFs, lowerHwtimer, lowerCounter, lowerSensor, lowerThread, };
+import { lowerTrace } from './trace.js';
+import { lowerStrip } from './strip.js';
+import { lowerHid } from './hid.js';
+import { lowerMatrix } from './matrix.js';
+import { lowerPower } from './power.js';
+import { lowerClock } from './clock.js';
+import { lowerCan } from './can.js';
+import { lowerI2s } from './i2s.js';
+export { lowerGpio, lowerTiming, lowerAdc, lowerPwm, lowerI2c, lowerSpi, lowerUart, lowerUsb, lowerInterrupt, lowerWdt, lowerBle, lowerWifi, lowerHttp, lowerMqtt, lowerPreferences, lowerBoard, lowerRandom, lowerDac, lowerFs, lowerHwtimer, lowerCounter, lowerSensor, lowerThread, lowerTrace, lowerStrip, lowerHid, lowerMatrix, lowerPower, lowerClock, lowerCan, lowerI2s, };
 /**
  * Lower a HAL op to Zephyr C++. Returns undefined for unsupported categories
  * (mirrors lowerHalOp in framework-esp32/src/lowering/index.ts).
@@ -94,6 +102,22 @@ export function lowerHalOp(op) {
         return lowerSensor(op);
     if (op.operation.startsWith('thread.'))
         return lowerThread(op);
+    if (op.operation.startsWith('trace.'))
+        return lowerTrace(op);
+    if (op.operation.startsWith('strip.'))
+        return lowerStrip(op, chip);
+    if (op.operation.startsWith('hid.'))
+        return lowerHid(op, chip);
+    if (op.operation.startsWith('matrix.'))
+        return lowerMatrix(op);
+    if (op.operation.startsWith('power.'))
+        return lowerPower(op, chip);
+    if (op.operation.startsWith('clock.'))
+        return lowerClock(op);
+    if (op.operation.startsWith('can.'))
+        return lowerCan(op, chip);
+    if (op.operation.startsWith('i2s.'))
+        return lowerI2s(op, chip);
     // raw / snprintf.emit / display.* / ... — not lowered by this
     // framework. Return undefined so the transpiler falls back and the manifest
     // validator confirms the unsupported declaration.

package/dist/lowering/interrupts.js

@@ -92,6 +92,12 @@ export function collectInterruptPins(program) {
         }
     };
     visit(program);
+    // Ops resolved to text while inlining one HAL call into another never become
+    // IR nodes — they ride on ProgramIR.resolvedHalOps (see strategy.ts's
+    // visitResolvedHalOps for the full story).
+    for (const op of program?.resolvedHalOps ?? []) {
+        visit({ operation: op });
+    }
     return pins;
 }
 /**

package/dist/lowering/matrix.d.ts

@@ -0,0 +1,15 @@
+import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
+/**
+ * Emit the matrix trampoline state. Called from shimLines when the program
+ * uses matrix.* — the listener targets the synthesized tc_matrix node, the
+ * handler pointer is assigned by the on_key lowering.
+ */
+export declare function matrixInitLines(): string[];
+/**
+ * Resolve a HAL matrix.* op to Zephyr C++.
+ * Returns `{ code }` for statement ops.
+ */
+export declare function lowerMatrix(op: HALOpIR): {
+    code?: string;
+    expression?: string;
+};

package/dist/lowering/matrix.js

@@ -0,0 +1,63 @@
+// ---------------------------------------------------------------------------
+// Matrix lowering — gpio-kbd-matrix node + input-event trampoline
+//
+// The gpio-kbd-matrix driver (Zephyr input subsystem) scans the grid and
+// reports each key as ABS_X (column) + ABS_Y (row) + BTN_TOUCH (press).
+// The shim decodes the triple and calls the user's lowered callback as
+// (row, col, pressed). The overlay generator synthesizes the DT node with
+// row-gpios/col-gpios phandle arrays from the construction pad lists —
+// the lowering's comment marker carries rows/cols to the toolchain scan
+// (the pwm user-facts marker precedent).
+// ----------------------------------------------------------------------------
+/**
+ * Emit the matrix trampoline state. Called from shimLines when the program
+ * uses matrix.* — the listener targets the synthesized tc_matrix node, the
+ * handler pointer is assigned by the on_key lowering.
+ */
+export function matrixInitLines() {
+    return [
+        '// CUTTLEFISH_MATRIX_BEGIN',
+        'static void (*__tc_matrix_on_key)(double, double, bool) = NULL;',
+        'static int32_t __tc_matrix_row = -1;',
+        'static int32_t __tc_matrix_col = -1;',
+        'static void __tc_matrix_cb(struct input_event* evt, void* user_data) {',
+        '    (void)user_data;',
+        '    switch (evt->code) {',
+        '    case INPUT_ABS_X:',
+        '        __tc_matrix_col = evt->value;',
+        '        break;',
+        '    case INPUT_ABS_Y:',
+        '        __tc_matrix_row = evt->value;',
+        '        break;',
+        '    case INPUT_BTN_TOUCH:',
+        '        if (__tc_matrix_on_key != NULL && __tc_matrix_row >= 0 && __tc_matrix_col >= 0) {',
+        '            __tc_matrix_on_key(static_cast<double>(__tc_matrix_row), static_cast<double>(__tc_matrix_col), evt->value != 0);',
+        '        }',
+        '        break;',
+        '    default:',
+        '        break;',
+        '    }',
+        '}',
+        'INPUT_CALLBACK_DEFINE(DEVICE_DT_GET(DT_NODELABEL(tc_matrix)), __tc_matrix_cb, NULL);',
+        '// CUTTLEFISH_MATRIX_END',
+    ];
+}
+/**
+ * Resolve a HAL matrix.* op to Zephyr C++.
+ * Returns `{ code }` for statement ops.
+ */
+export function lowerMatrix(op) {
+    const o = op;
+    switch (op.operation) {
+        case 'matrix.on_key': {
+            // The comment marker carries the construction pad lists to the
+            // toolchain's overlay scan (the pwm user-facts precedent).
+            return {
+                code: `/* cuttlefish-matrix: rows=${o.rows} cols=${o.cols} */ __tc_matrix_on_key = ${o.handler};`,
+            };
+        }
+        default:
+            throw new Error(`framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
+                `Open an issue or use rawCpp() to emit it manually.`);
+    }
+}

package/dist/lowering/mqtt.js

@@ -13,7 +13,11 @@
 // shim getaddrinfo-resolves the broker host itself (like the HTTP shim).
 // URI scheme: mqtt:// → 1883 plain TCP, mqtts:// → 8883 TLS
 // (MQTT_TRANSPORT_SECURE + mqtt_sec_config, reusing the same mbedTLS matrix
-// the HTTP TLS path established).
+// the HTTP TLS path established). caCert pins the broker's CA — the PEM is
+// DER-decoded at emit time and registered via tls_credential_add as a
+// CA_CERTIFICATE sec tag with TLS_PEER_VERIFY_REQUIRED (verified TLS, the
+// MQTT analogue of Request's caCert); mqtts:// without a CA stays
+// encrypted-but-unverified (TLS_PEER_VERIFY_NONE).
 //
 // One client slot (HAL singleton). on_message callbacks are dispatched on the
 // poll thread.
@@ -45,6 +49,8 @@ export function mqttInitLines() {
         `// at connect time; host drives both DNS resolution and the TLS SNI/hostname.`,
         `// on_message is the user callback (set via mqtt.on_message); it fires on the`,
         `// poll thread for every incoming PUBLISH on a subscribed topic.`,
+        `// ca_der is the pinned CA (DER, user-owned from the caCert fact); nullptr`,
+        `// means mqtts:// runs encrypted-but-unverified.`,
         `typedef void (*__tc_mqtt_msg_cb_t)(const char* topic, const char* payload);`,
         `static struct {`,
         `    struct mqtt_client client;`,
@@ -55,6 +61,16 @@ export function mqttInitLines() {
         `    uint16_t port;             // 1883 / 8883 unless overridden in the URI`,
         `    char client_id[64];`,
         `    bool tls;                  // scheme == "mqtts"`,
+        `    const uint8_t* ca_der;     // pinned CA (DER), nullptr = no CA`,
+        `    size_t ca_der_len;`,
+        `    // What this shim last registered under __TC_MQTT_SEC_TAG (DER arrays`,
+        `    // are function-static, so pointer identity is stable). Zephyr's`,
+        `    // credential store never REPLACES a tag — repeats are skipped, a`,
+        `    // different CA at an occupied tag is reported, not silent.`,
+        `    const uint8_t* ca_added;`,
+        `    size_t ca_added_len;`,
+        `    bool ca_added_set;`,
+        `    sec_tag_t sec_tags[1];     // backs tls.config.sec_tag_list (static lifetime)`,
         `    volatile bool connected;`,
         `    volatile bool stop_poll;   // set by disconnect to terminate the poll thread`,
         `    __tc_mqtt_msg_cb_t on_message;`,
@@ -196,6 +212,35 @@ export function mqttInitLines() {
         `    return host_len > 0U;`,
         `}`,
         ``,
+        `// Strict IPv4 dotted-quad predicate: exactly four 0-255 groups. A`,
+        `// digit-and-dot scan would also swallow numeric-only DNS names ("123"),`,
+        `// silently skipping the TLS hostname check for them (same helper as the`,
+        `// HTTP shim).`,
+        `static bool __tc_mqtt_host_is_ipv4(const char* h) {`,
+        `    uint32_t quads = 0U;`,
+        `    uint32_t val = 0U;`,
+        `    uint32_t digits = 0U;`,
+        `    for (const char* p = h; ; p++) {`,
+        `        if (*p >= '0' && *p <= '9') {`,
+        `            val = (val * 10U) + static_cast<uint32_t>(*p - '0');`,
+        `            digits++;`,
+        `            if (digits > 3U || val > 255U) return false;`,
+        `        } else if (*p == '.') {`,
+        `            if (digits == 0U || quads >= 3U) return false;`,
+        `            quads++;`,
+        `            val = 0U;`,
+        `            digits = 0U;`,
+        `        } else if (*p == '\\0') {`,
+        `            if (digits == 0U) return false;`,
+        `            quads++;`,
+        `            break;`,
+        `        } else {`,
+        `            return false;`,
+        `        }`,
+        `    }`,
+        `    return quads == 4U;`,
+        `}`,
+        ``,
         `// ── connect ─────────────────────────────────────────────────────────────`,
         `// Parse URI → resolve broker → init client → mqtt_connect → spawn poll thread.`,
         `// Blocks until CONNACK (the poll thread isn't running yet, so we drive a few`,
@@ -244,14 +289,47 @@ export function mqttInitLines() {
         `        __tc_mqtt.client.transport.type = MQTT_TRANSPORT_SECURE;`,
         `        struct mqtt_sec_config* tls_cfg = &__tc_mqtt.client.transport.tls.config;`,
         `        (void)memset(tls_cfg, 0, sizeof(*tls_cfg));`,
-        `        // The HAL MQTT surface has no CA-pinning op (unlike HTTP's caCert), so`,
-        `        // there is no way to register a trusted CA here. Verify-NONE keeps the`,
-        `        // TLS session encrypted but skips identity verification — the strongest`,
-        `        // the current surface can express. A future mqtt.set_ca_cert op would`,
-        `        // flip this to REQUIRED + a registered sec_tag (like the HTTPS path).`,
-        `        tls_cfg->peer_verify = TLS_PEER_VERIFY_NONE;`,
+        `        if (__tc_mqtt.ca_der != nullptr) {`,
+        `            // Pinned CA (the caCert construction fact): register it as a`,
+        `            // CA_CERTIFICATE sec tag and REQUIRE peer verification — the MQTT`,
+        `            // analogue of the HTTPS caCert path. Zephyr's credential store`,
+        `            // never REPLACES a tag+type pair: re-registering the same DER`,
+        `            // (pointer identity — the arrays are function-static) is skipped`,
+        `            // silently; a DIFFERENT CA hitting an occupied tag is reported so`,
+        `            // a wrong-CA verify is never silent; any other failure keeps the`,
+        `            // tag list empty and verification required — fail closed.`,
+        `            if (!__tc_mqtt.ca_added_set || __tc_mqtt.ca_added != __tc_mqtt.ca_der`,
+        `                || __tc_mqtt.ca_added_len != __tc_mqtt.ca_der_len) {`,
+        `                int cred_rc = tls_credential_add(__TC_MQTT_SEC_TAG,`,
+        `                                                 TLS_CREDENTIAL_CA_CERTIFICATE,`,
+        `                                                 __tc_mqtt.ca_der, __tc_mqtt.ca_der_len);`,
+        `                __tc_mqtt.ca_added = __tc_mqtt.ca_der;`,
+        `                __tc_mqtt.ca_added_len = __tc_mqtt.ca_der_len;`,
+        `                __tc_mqtt.ca_added_set = true;`,
+        `                if (cred_rc == -17 /* -EEXIST */) {`,
+        `                    printk("tc-mqtt: sec tag %d already holds a CA; the first one stays active (rc=%d)\\n", __TC_MQTT_SEC_TAG, cred_rc);`,
+        `                } else if (cred_rc != 0) {`,
+        `                    printk("tc-mqtt: CA registration failed (rc=%d) - verifying against no credentials\\n", cred_rc);`,
+        `                }`,
+        `            }`,
+        `            if (__tc_mqtt.ca_added_set) {`,
+        `                __tc_mqtt.sec_tags[0] = __TC_MQTT_SEC_TAG;`,
+        `                tls_cfg->sec_tag_list = __tc_mqtt.sec_tags;`,
+        `                tls_cfg->sec_tag_count = 1U;`,
+        `            }`,
+        `            tls_cfg->peer_verify = TLS_PEER_VERIFY_REQUIRED;`,
+        `        } else {`,
+        `            // No CA pinned: the session is encrypted but the broker's identity`,
+        `            // is not verified — the strongest the no-caCert form can express.`,
+        `            tls_cfg->peer_verify = TLS_PEER_VERIFY_NONE;`,
+        `        }`,
         `        tls_cfg->cipher_list = nullptr;`,
-        `        tls_cfg->hostname = __tc_mqtt.host;`,
+        `        // mbedtls does not match IP literals against SAN entries — set the`,
+        `        // hostname (SNI + identity check) only for name hosts; IP brokers`,
+        `        // verify chain-only (same policy as the HTTPS path).`,
+        `        if (!__tc_mqtt_host_is_ipv4(__tc_mqtt.host)) {`,
+        `            tls_cfg->hostname = __tc_mqtt.host;`,
+        `        }`,
         `#else`,
         `        printk("tc-mqtt: mqtts:// requested but CONFIG_MQTT_LIB_TLS is off\\n");`,
         `        return;`,
@@ -303,6 +381,10 @@ export function mqttInitLines() {
         `    __tc_mqtt.on_message = fn;`,
         `}`,
         ``,
+        `// ca_cert is the DER-decoded PEM from the caCert construction fact`,
+        `// (user-owned static array; nullptr = no pinned CA).`,
+        `static inline void __tc_mqtt_set_ca_cert_der(const uint8_t* der, size_t len) { __tc_mqtt.ca_der = der; __tc_mqtt.ca_der_len = len; }`,
+        ``,
         `static inline void __tc_mqtt_subscribe(const char* topic) {`,
         `    static struct mqtt_topic topics[4];`,
         `    static uint16_t msg_id = 1;`,
@@ -356,6 +438,26 @@ export function lowerMqtt(op) {
     switch (op.operation) {
         case 'mqtt.connect':
             return { code: `__tc_mqtt_connect(${s(o.brokerUri)}, ${s(o.clientId)});` };
+        case 'mqtt.set_ca_cert': {
+            // PEM → DER at emit time (this tree's tf-psa-crypto mbedTLS has no PEM
+            // parser — same decode as http.set_ca_cert; tls_credential_add takes
+            // the DER directly).
+            const pem = String(o.pem ?? '').replace(/^"|"$/g, '').replace(/\\n/g, '\n');
+            if (pem.replace(/\s+/g, '') === '') {
+                // No-CA sentinel (Mqtt always emits the op from connect(); opts.caCert
+                // defaults to '') — elide silently so plain-mqtt:// carries no comment.
+                return { code: '' };
+            }
+            const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
+            const der = Buffer.from(b64, 'base64');
+            // Every X.509 DER starts with the ASN.1 SEQUENCE tag (0x30); a long
+            // but non-cert payload fails here instead of at a confusing handshake
+            // error on the target (same check as http.set_ca_cert).
+            if (der.length < 100 || der[0] !== 0x30)
+                return { code: `// tc-mqtt: caCert PEM failed to decode` };
+            const hex = [...der].map((b) => `0x${b.toString(16).padStart(2, '0')}`).join(', ');
+            return { code: `{ static const uint8_t __tc_mqtt_ca_der[] = { ${hex} }; __tc_mqtt_set_ca_cert_der(__tc_mqtt_ca_der, sizeof(__tc_mqtt_ca_der)); }` };
+        }
         case 'mqtt.on_message':
             return { code: `__tc_mqtt_set_on_message(${s(o.handler)});` };
         case 'mqtt.subscribe':

package/dist/lowering/power.d.ts

@@ -1,9 +1,10 @@
 import type { HALOpIR } from '@typecad/cuttlefish/api/shared';
+import type { ZephyrChipDescriptor } from '../chips/types.js';
 /**
  * Resolve a HAL power.* op to Zephyr C++.
- * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.
+ * Returns `{ code }` for statement ops.
  */
-export declare function lowerPower(op: HALOpIR): {
+export declare function lowerPower(op: HALOpIR, chip?: ZephyrChipDescriptor): {
     code?: string;
     expression?: string;
 };

package/dist/lowering/power.js

@@ -1,56 +1,31 @@
 // ---------------------------------------------------------------------------
-// Power lowering — Zephyr power management
+// Power lowering — sys_poweroff() for explicit soft-off entry
 //
-// Zephyr enters low-power states from the idle thread per policy. The app-facing
-// controls are pm_state_force (override policy to force a state on next idle)
-// and k_sleep (block the calling thread, allowing the system to idle into a
-// low-power state). "Deep sleep" maps to k_sleep (the SoC picks its deepest
-// allowed state); "light sleep" best-effort forces SUSPEND_TO_IDLE.
-//
-// deep_sleep_pin configures the wake GPIO as an interrupt source then k_sleeps
-// (the interrupt wakes the SoC). CPU frequency is SoC-specific (nRF52 has a
-// fixed 64 MHz HFXO with no portable dynamic scaling) and stays a documented
-// no-op. deep_sleep_pin targets gpio0 (single-controller nRF52840 case);
-// multi-controller SoC routing is a documented follow-on.
-// ---------------------------------------------------------------------------
+// Both SoC families implement the kernel's sys_poweroff(): ESP32 parks the
+// RTC domain and calls esp_deep_sleep_start(); STM32 enters standby-class
+// deep sleep. The call never returns — wake is a reset or a wake source
+// (board-specific: the Black Pill's WKUP pin is PA0; ESP32 GPIOs armed as
+// wake triggers). Statement emission continues after the call site, but
+// nothing there runs — the transpiler treats it as any other void call.
+// ----------------------------------------------------------------------------
 /**
  * Resolve a HAL power.* op to Zephyr C++.
- * Returns `{ code }` for statement ops, `{ expression }` for value-returning ops.
+ * Returns `{ code }` for statement ops.
  */
-export function lowerPower(op) {
+export function lowerPower(op, chip) {
     const o = op;
     switch (op.operation) {
-        case 'power.deep_sleep':
-            // Block for the requested duration; the idle thread + PM policy will enter
-            // the deepest state the SoC allows during the sleep.
-            return { code: `k_sleep(K_MSEC(${o.ms}));` };
-        case 'power.light_sleep':
-            // Best-effort: force a shallow suspend on the next idle. pm_state_force
-            // requires a pm_state_info; SUSPEND_TO_IDLE is a common shallow state.
-            return { code: `pm_state_force(0, &(const struct pm_state_info){ .state = PM_STATE_SUSPEND_TO_IDLE, .substate_id = 0 });` };
-        case 'power.deep_sleep_pin': {
-            // Configure the pin as a GPIO wake source (level interrupt), then k_sleep
-            // until the interrupt fires. A static gpio_callback + a no-op handler (the
-            // wake just needs the interrupt enabled; the handler does nothing). level:
-            // 1=high, 0=low. Targets gpio0 (single-controller nRF52840); multi-
-            // controller SoC routing is a documented follow-on.
-            const pin = o.pin;
-            const level = o.level;
-            const flags = level ? 'GPIO_INT_LEVEL_HIGH' : 'GPIO_INT_LEVEL_LOW';
+        case 'power.off':
+            return { code: 'sys_poweroff();' };
+        case 'power.off_for': {
+            // DAC discipline: without the RTC wake-timer fact, a timed off would
+            // sleep with no wake source — lower to a comment naming it.
+            if (!chip?.powerWakeTimer) {
+                return { code: `/* Power.offFor(${o.ms} ms): this board's SoC declares no RTC wake timer — soft-off here has no armed wake; use Power.off() */` };
+            }
+            // Arm the RTC timer (µs), then enter soft-off; wake is a reboot.
             return {
-                code: [
-                    '{',
-                    `    static struct gpio_callback __tc_wake_cb;`,
-                    `    const struct device* __dev = DEVICE_DT_GET(DT_NODELABEL(gpio0));`,
-                    `    gpio_pin_configure(__dev, ${pin}, GPIO_INPUT);`,
-                    `    gpio_init_callback(&__tc_wake_cb, [](const struct device*, struct gpio_callback*, gpio_port_pins_t) { (void)0; }, BIT(${pin}));`,
-                    `    gpio_add_callback(__dev, &__tc_wake_cb);`,
-                    `    gpio_pin_interrupt_configure(__dev, ${pin}, ${flags});`,
-                    `    k_sleep(K_FOREVER);`,
-                    `    gpio_pin_interrupt_configure(__dev, ${pin}, GPIO_INT_DISABLE);`,
-                    `    gpio_remove_callback(__dev, &__tc_wake_cb);`,
-                    '}',
-                ].join(' '),
+                code: `{ esp_sleep_enable_timer_wakeup(static_cast<uint64_t>(${o.ms}) * 1000ULL); sys_poweroff(); }`,
             };
         }
         default:

package/dist/lowering/pwm.js

@@ -140,6 +140,31 @@ export function lowerPwm(op, chip) {
             // pulse to idle — follow with setPulse/setDuty to drive the line.
             return { code: `${marker}(void)pwm_set_dt(&${v}, ${o.periodNs}, 0);` };
         }
+        // ── Servo (hal/servo.ts) — calibrated 50 Hz sugar on the same channel ──
+        // The commanded value is runtime text; the calibrated range and travel
+        // are construction literals carried on the op. Clamping and the angle→
+        // pulse mapping run in the emitted C++ — they cannot fold at transpile
+        // time. Pulse widths convert µs→ns here (×1000).
+        case 'pwm.servo_us': {
+            const minNs = Math.round(Number(o.minUs ?? 1000) * 1000);
+            const maxNs = Math.round(Number(o.maxUs ?? 2000) * 1000);
+            return {
+                code: `{ ${marker}static bool __tc_pwm_p${o.pin}_prd = false; if (!__tc_pwm_p${o.pin}_prd) { (void)pwm_set_dt(&${v}, ${o.periodNs}, 0); __tc_pwm_p${o.pin}_prd = true; } uint32_t __tc_sv_p${o.pin} = static_cast<uint32_t>(${o.us}) * 1000U; if (__tc_sv_p${o.pin} < ${minNs}U) { __tc_sv_p${o.pin} = ${minNs}U; } if (__tc_sv_p${o.pin} > ${maxNs}U) { __tc_sv_p${o.pin} = ${maxNs}U; } (void)pwm_set_pulse_dt(&${v}, __tc_sv_p${o.pin}); }`,
+            };
+        }
+        case 'pwm.servo_angle': {
+            const minNs = Math.round(Number(o.minUs ?? 1000) * 1000);
+            const maxNs = Math.round(Number(o.maxUs ?? 2000) * 1000);
+            const maxAngle = Number(o.maxAngle ?? 180) || 180;
+            return {
+                code: `{ ${marker}static bool __tc_pwm_p${o.pin}_prd = false; if (!__tc_pwm_p${o.pin}_prd) { (void)pwm_set_dt(&${v}, ${o.periodNs}, 0); __tc_pwm_p${o.pin}_prd = true; } double __tc_sv_a${o.pin} = static_cast<double>(${o.angle}); if (__tc_sv_a${o.pin} < 0.0) { __tc_sv_a${o.pin} = 0.0; } if (__tc_sv_a${o.pin} > ${maxAngle}.0) { __tc_sv_a${o.pin} = ${maxAngle}.0; } (void)pwm_set_pulse_dt(&${v}, static_cast<uint32_t>(static_cast<double>(${minNs}) + (__tc_sv_a${o.pin} * ((static_cast<double>(${maxNs}) - static_cast<double>(${minNs})) / static_cast<double>(${maxAngle}.0))))); }`,
+            };
+        }
+        case 'pwm.servo_idle': {
+            return {
+                code: `{ ${marker}static bool __tc_pwm_p${o.pin}_prd = false; if (!__tc_pwm_p${o.pin}_prd) { (void)pwm_set_dt(&${v}, ${o.periodNs}, 0); __tc_pwm_p${o.pin}_prd = true; } (void)pwm_set_pulse_dt(&${v}, 0U); }`,
+            };
+        }
         default:
             throw new Error(`framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +
                 `Open an issue or use rawCpp() to emit it manually.`);

package/dist/lowering/sensor.d.ts

@@ -17,7 +17,7 @@ export interface SensorNames {
     /** The bus port: I2C address or SPI CS pin. */
     port: number;
     /** 'i2c' | 'spi'. */
-    busKind: 'i2c' | 'spi';
+    busKind: 'i2c' | 'spi' | 'w1';
 }
 /** Derive a sensor's DT/C++ names. The scanner regexes the emitted __tc_
  *  prefix form, so the part group must stay [a-z0-9_]+ and greedy. */
@@ -26,7 +26,7 @@ export declare function sensorNames(part: string, bus: string, port: number | st
  * Emit the per-sensor state block (device handle + sensor_value scratch).
  * Called from shimLines for each distinct sensor the program's ops reference.
  */
-export declare function sensorStateLines(part: string, bus: string, port: number | string, busKind?: string, spiHz?: number | string, spiMode?: number | string, alertPin?: number | string): string[];
+export declare function sensorStateLines(part: string, bus: string, port: number | string, busKind?: string, spiHz?: number | string, spiMode?: number | string, alertPin?: number | string, resolution?: number | string): string[];
 /**
  * Resolve a HAL sensor.* op to Zephyr C++.
  * Returns `{ code }` for fetch (statement), `{ expression }` for get (value).

package/dist/lowering/sensor.js

@@ -31,14 +31,16 @@ export function sensorNames(part, bus, port, busKind = 'i2c') {
     const portNum = typeof port === 'number' ? port : parseInt(String(port));
     const stem = busKind === 'spi'
         ? `${partKey}_spi${busIndex}_cs${portNum}`
-        : `${partKey}_i2c${busIndex}_0x${portNum.toString(16)}`;
+        : busKind === 'w1'
+            ? `${partKey}_w1_p${portNum}`
+            : `${partKey}_i2c${busIndex}_0x${portNum.toString(16)}`;
     return {
         dtLabel: `tc_${stem}`,
         devVar: `__tc_sensor_${stem}_dev`,
         valVar: `__tc_sensor_${stem}_val`,
         busIndex,
         port: portNum,
-        busKind: busKind === 'spi' ? 'spi' : 'i2c',
+        busKind: busKind === 'spi' ? 'spi' : busKind === 'w1' ? 'w1' : 'i2c',
     };
 }
 /**
@@ -67,13 +69,15 @@ function requireBusKind(partKey, info, busKind) {
  * Emit the per-sensor state block (device handle + sensor_value scratch).
  * Called from shimLines for each distinct sensor the program's ops reference.
  */
-export function sensorStateLines(part, bus, port, busKind = 'i2c', spiHz = 0, spiMode = 0, alertPin = -1) {
+export function sensorStateLines(part, bus, port, busKind = 'i2c', spiHz = 0, spiMode = 0, alertPin = -1, resolution = 12) {
     const partKey = sensorPartKey(String(part));
     requireBusKind(partKey, requirePartInfo(partKey), busKind);
     const n = sensorNames(part, bus, port, busKind);
     // The config comment carries construction facts (SPI clock, mode, alert
     // GPIO) to the overlay scanner — they shape the DT node, not the C++.
-    const cfg = `// tc-sensor-cfg: ${n.dtLabel} hz=${Number(spiHz)} mode=${Number(spiMode)} alert=${Number(alertPin)}`;
+    const cfg = busKind === 'w1'
+        ? `// tc-sensor-cfg: ${n.dtLabel} res=${Number(resolution)}`
+        : `// tc-sensor-cfg: ${n.dtLabel} hz=${Number(spiHz)} mode=${Number(spiMode)} alert=${Number(alertPin)}`;
     return [
         '// CUTTLEFISH_SENSOR_BEGIN',
         `static const struct device* ${n.devVar} = DEVICE_DT_GET(DT_NODELABEL(${n.dtLabel}));`,