@typecad/framework-zephyr 1.0.0-alpha.16 → 1.0.0-alpha.19

package/src/lowering/http.ts

@@ -8,11 +8,14 @@
 // (IPPROTO_TCP or IPPROTO_TLS_1_2 for https) → setsockopt TLS sec tags /
 // hostname / peer-verify → connect() → http_client_req → accumulate body.
 //
-// One request slot at a time (embedded-friendly): factory/reset → setters →
-// begin (inside send) → perform. Setters may run before begin and must survive
-// it (req.timeout(ms); req.send()); options are cleared by __tc_http_reset
-// when a new request starts (Http.get/post/…). Response body is heap-capped
-// (default 8 KB), NUL-terminated, valid until the next begin/perform/reset.
+// One request slot at a time (embedded-friendly): send() lowers
+// reset+begin (method/url) FIRST, then the fact setters (timeout/max_body/
+// body/tls), then perform — the reset-before-setters protocol; header()
+// pairs recorded on the request instance are re-staged by begin (after its
+// reset) so call-site header emissions and send() loops both survive.
+// Options are cleared by __tc_http_reset when a new request starts; response
+// body is heap-capped (default 8 KB, opts.maxBody), NUL-terminated, valid
+// until the next begin/perform/reset.
 //
 // TLS: https selects IPPROTO_TLS_1_2 + NET_SOCKETS_SOCKOPT_TLS (which selects
 // mbedTLS in Kconfig). insecure() sets TLS_PEER_VERIFY_NONE; caCert(pem)
@@ -59,7 +62,7 @@ export function httpInitLines(): string[] {
     `    char scheme[8];          // "http" or "https"`,
     `    char host[128];`,
     `    uint16_t port;           // 80 / 443 unless overridden in the url`,
-    `    char path[256];          // resource path beginning with '/'`,
+    `    char path[384];          // resource path beginning with '/'`,
     `    enum http_method method;`,
     `    int32_t timeout_ms;`,
     `    size_t max_body;`,
@@ -68,6 +71,13 @@ export function httpInitLines(): string[] {
     `    bool insecure;`,
     `    const uint8_t* ca_der;    // DER, user-owned; nullptr = no pinned CA`,
     `    size_t ca_der_len;`,
+    `    // What this shim last registered under __TC_HTTP_SEC_TAG (the DER arrays`,
+    `    // are function-static, so pointer identity is stable). Zephyr's`,
+    `    // credential store never REPLACES a tag — repeats are skipped silently,`,
+    `    // a different CA arriving at an occupied tag is reported, not hidden.`,
+    `    const uint8_t* ca_added;`,
+    `    size_t ca_added_len;`,
+    `    bool ca_added_set;`,
     `    const char* hdr_name[__TC_HTTP_MAX_HEADERS];`,
     `    const char* hdr_value[__TC_HTTP_MAX_HEADERS];`,
     `    int32_t hdr_count;`,
@@ -84,15 +94,25 @@ export function httpInitLines(): string[] {
     `    // is still reading → EBADMSG (-77) on chunked/larger responses.`,
     `    uint8_t recvbuf[1024];`,
     `    int64_t content_length;  // -1 = unknown`,
+    `    // Response headers: captured as raw "Name: Value\\r\\n" lines by the`,
+    `    // http_parser on_header_field/on_header_value hooks (req.http_cb) and`,
+    `    // scanned by __tc_http_response_header(). hdr_parse_name is the name`,
+    `    // fragment accumulator; hdr_stage tracks name(0)/value(1) parsing.`,
+    `    char resp_headers[768];`,
+    `    size_t resp_headers_len;`,
+    `    char hdr_parse_name[64];`,
+    `    size_t hdr_parse_name_len;`,
+    `    uint8_t hdr_stage;        // 0 = accumulating name, 1 = accumulating value`,
     `    char resp_header[128];   // scratch for response_header()`,
     `    // staged header fields for http_client_req: a NULL-terminated list of`,
     `    // "Name: Value\\r\\n" strings built from hdr_name/hdr_value at perform.`,
     `    const char* hdr_fields[__TC_HTTP_MAX_HEADERS + 1];`,
-    `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][64];`,
+    `    char hdr_field_buf[__TC_HTTP_MAX_HEADERS][128];`,
     `    // async completion signal (memory barrier between worker and poller)`,
     `    struct k_sem done_sem;`,
     `    bool sem_inited;`,
     `    struct k_work perform_work;`,
+    `    bool work_inited;`,
     `} __tc_http;`,
     ``,
     `// ── URL parser ──────────────────────────────────────────────────────────`,
@@ -119,6 +139,13 @@ export function httpInitLines(): string[] {
     `        __tc_http.host[host_len++] = *p++;`,
     `    }`,
     `    __tc_http.host[host_len] = '\\0';`,
+    `    // A host that filled the buffer means the URL is not what the user`,
+    `    // typed — a silently truncated host resolves the wrong server. Refuse.`,
+    `    if (host_len == (sizeof(__tc_http.host) - 1U) && *p != '\\0' && *p != ':' && *p != '/') {`,
+    `        printk("tc-http: host longer than %u bytes - refused\\n",`,
+    `               static_cast<unsigned int>(sizeof(__tc_http.host) - 1U));`,
+    `        return false;`,
+    `    }`,
     `    // optional :port`,
     `    if (*p == ':') {`,
     `        p++;`,
@@ -136,6 +163,13 @@ export function httpInitLines(): string[] {
     `        while (*p != '\\0' && path_len < (sizeof(__tc_http.path) - 1U)) {`,
     `            __tc_http.path[path_len++] = *p++;`,
     `        }`,
+    `        // Same honesty rule as the host: a truncated path (long query`,
+    `        // string) requests the wrong resource — refuse instead of misfetch.`,
+    `        if (path_len == (sizeof(__tc_http.path) - 1U) && *p != '\\0') {`,
+    `            printk("tc-http: path longer than %u bytes - refused\\n",`,
+    `                   static_cast<unsigned int>(sizeof(__tc_http.path) - 1U));`,
+    `            return false;`,
+    `        }`,
     `        __tc_http.path[path_len] = '\\0';`,
     `    } else {`,
     `        __tc_http.path[0] = '/';`,
@@ -144,6 +178,53 @@ export function httpInitLines(): string[] {
     `    return host_len > 0U;`,
     `}`,
     ``,
+    `// ── response-header capture (http_parser hooks via req.http_cb) ─────────`,
+    `// The client's internal parser settings forward on_header_field/`,
+    `// on_header_value fragments here while keeping their own status + body`,
+    `// handling. Fragments accumulate into raw "Name: Value\\r\\n" lines in`,
+    `// resp_headers (bounded — overflow drops the rest of the block, and`,
+    `// lookups of the dropped headers return ""). __tc_http_hdr_finish closes`,
+    `// the last line after http_client_req returns.`,
+    `static void __tc_http_hdr_append(const char* at, size_t len) {`,
+    `    size_t room = sizeof(__tc_http.resp_headers) - __tc_http.resp_headers_len;`,
+    `    size_t n = (len < room) ? len : room;`,
+    `    (void)memcpy(__tc_http.resp_headers + __tc_http.resp_headers_len, at, n);`,
+    `    __tc_http.resp_headers_len += n;`,
+    `}`,
+    ``,
+    `static int __tc_http_on_hdr_field(struct http_parser* parser, const char* at, size_t len) {`,
+    `    (void)parser;`,
+    `    if (__tc_http.hdr_stage == 1U) {`,
+    `        __tc_http_hdr_append("\\r\\n", 2U);`,
+    `        __tc_http.hdr_stage = 0U;`,
+    `        __tc_http.hdr_parse_name_len = 0U;`,
+    `    }`,
+    `    size_t room = sizeof(__tc_http.hdr_parse_name) - 1U - __tc_http.hdr_parse_name_len;`,
+    `    size_t n = (len < room) ? len : room;`,
+    `    (void)memcpy(__tc_http.hdr_parse_name + __tc_http.hdr_parse_name_len, at, n);`,
+    `    __tc_http.hdr_parse_name_len += n;`,
+    `    return 0;`,
+    `}`,
+    ``,
+    `static int __tc_http_on_hdr_value(struct http_parser* parser, const char* at, size_t len) {`,
+    `    (void)parser;`,
+    `    if (__tc_http.hdr_stage == 0U) {`,
+    `        __tc_http_hdr_append(__tc_http.hdr_parse_name, __tc_http.hdr_parse_name_len);`,
+    `        __tc_http_hdr_append(": ", 2U);`,
+    `        __tc_http.hdr_stage = 1U;`,
+    `    }`,
+    `    __tc_http_hdr_append(at, len);`,
+    `    return 0;`,
+    `}`,
+    ``,
+    `static void __tc_http_hdr_finish(void) {`,
+    `    if (__tc_http.hdr_stage == 1U) {`,
+    `        __tc_http_hdr_append("\\r\\n", 2U);`,
+    `    }`,
+    `    __tc_http.hdr_stage = 0U;`,
+    `    __tc_http.hdr_parse_name_len = 0U;`,
+    `}`,
+    ``,
     `// ── response callback ───────────────────────────────────────────────────`,
     `// http_response_cb_t: accumulate each body fragment into resp up to max_body,`,
     `// and capture the status code + content length from the first response.`,
@@ -167,6 +248,34 @@ export function httpInitLines(): string[] {
     `    return 0;`,
     `}`,
     ``,
+    `// Strict IPv4 dotted-quad predicate: exactly four 0-255 groups. A`,
+    `// digit-and-dot scan would also swallow numeric-only DNS names ("123"),`,
+    `// silently skipping the TLS hostname check for them.`,
+    `static bool __tc_http_host_is_ipv4(const char* h) {`,
+    `    uint32_t quads = 0U;`,
+    `    uint32_t val = 0U;`,
+    `    uint32_t digits = 0U;`,
+    `    for (const char* p = h; ; p++) {`,
+    `        if (*p >= '0' && *p <= '9') {`,
+    `            val = (val * 10U) + static_cast<uint32_t>(*p - '0');`,
+    `            digits++;`,
+    `            if (digits > 3U || val > 255U) return false;`,
+    `        } else if (*p == '.') {`,
+    `            if (digits == 0U || quads >= 3U) return false;`,
+    `            quads++;`,
+    `            val = 0U;`,
+    `            digits = 0U;`,
+    `        } else if (*p == '\\0') {`,
+    `            if (digits == 0U) return false;`,
+    `            quads++;`,
+    `            break;`,
+    `        } else {`,
+    `            return false;`,
+    `        }`,
+    `    }`,
+    `    return quads == 4U;`,
+    `}`,
+    ``,
     `// ── socket connect ──────────────────────────────────────────────────────`,
     `// zsock_getaddrinfo → zsock_socket(TCP | TLS_1_2) → TLS sockopts →`,
     `// zsock_connect. Uses the zsock_* (native Zephyr socket) API directly rather`,
@@ -201,24 +310,47 @@ export function httpInitLines(): string[] {
     `#if defined(CONFIG_NET_SOCKETS_SOCKOPT_TLS)`,
     `        int sock_tls = zsock_socket(res->ai_family, res->ai_socktype, IPPROTO_TLS_1_2);`,
     `        if (sock_tls >= 0) {`,
-            `            // Register the pinned CA as the active sec tag. tls_credential_add`,
-    `            // is idempotent-enough for the single-slot model: a duplicate tag`,
-    `            // is an error we ignore, and the most recently added cert wins.`,
+            `            // Register the pinned CA as the active sec tag. Zephyr's`,
+    `            // credential store never REPLACES a tag+type pair: a duplicate`,
+    `            // add fails and the FIRST cert stays active. Re-registering the`,
+    `            // same DER (pointer identity — the arrays are function-static)`,
+    `            // is skipped silently; a DIFFERENT CA hitting an occupied tag`,
+    `            // is reported so a wrong-CA verify is never silent. Any other`,
+    `            // failure skips the tag list: verification stays required with`,
+    `            // no credentials, so the handshake fails closed, not open.`,
     `            if (__tc_http.ca_der != nullptr) {`,
-    `                int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
-    `                                         TLS_CREDENTIAL_CA_CERTIFICATE,`,
-    `                                         __tc_http.ca_der, __tc_http.ca_der_len);`,
-    `                sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
-    `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
-    `                (void)cred_rc;`,
+    `                if (!__tc_http.ca_added_set || __tc_http.ca_added != __tc_http.ca_der`,
+    `                    || __tc_http.ca_added_len != __tc_http.ca_der_len) {`,
+    `                    int cred_rc = tls_credential_add(__TC_HTTP_SEC_TAG,`,
+    `                                             TLS_CREDENTIAL_CA_CERTIFICATE,`,
+    `                                             __tc_http.ca_der, __tc_http.ca_der_len);`,
+    `                    if (cred_rc == 0) {`,
+    `                        __tc_http.ca_added = __tc_http.ca_der;`,
+    `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+    `                        __tc_http.ca_added_set = true;`,
+    `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                    } else if (cred_rc == -17 /* -EEXIST */) {`,
+    `                        printk("tc-http: sec tag %d already holds a CA; the first one stays active (add rc=%d)\\n", __TC_HTTP_SEC_TAG, cred_rc);`,
+    `                        __tc_http.ca_added = __tc_http.ca_der;`,
+    `                        __tc_http.ca_added_len = __tc_http.ca_der_len;`,
+    `                        __tc_http.ca_added_set = true;`,
+    `                        sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                        (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                    } else {`,
+    `                        printk("tc-http: CA registration failed (rc=%d) - verifying against no credentials\\n", cred_rc);`,
+    `                    }`,
+    `                } else {`,
+    `                    sec_tag_t tags[1] = { __TC_HTTP_SEC_TAG };`,
+    `                    (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_SEC_TAG_LIST, tags, sizeof(tags));`,
+    `                }`,
     `            }`,
     `            // Hostname SNI + verification. insecure() disables verification;`,
     `            // the default (no caCert, no insecure) leaves verification required`,
     `            // with no sec tag, so the handshake fails safely until a CA is set.`,
     `            // mbedtls does not match IP literals against SAN entries —`,
     `            // skip the hostname check for IP hosts (chain-only verify).`,
-    `            bool host_is_ip = true; for (const char* p3 = __tc_http.host; *p3 != 0; p3++) { if (!((*p3 >= '0' && *p3 <= '9') || *p3 == '.')) { host_is_ip = false; break; } }`,
-    `            if (!host_is_ip) {`,
+    `            if (!__tc_http_host_is_ipv4(__tc_http.host)) {`,
     `                (void)zsock_setsockopt(sock_tls, SOL_TLS, TLS_HOSTNAME, __tc_http.host, strlen(__tc_http.host) + 1U);`,
     `            }`,
     `            int32_t verify = __tc_http.insecure ? TLS_PEER_VERIFY_NONE : TLS_PEER_VERIFY_REQUIRED;`,
@@ -248,8 +380,29 @@ export function httpInitLines(): string[] {
     `    return sock;`,
     `}`,
     ``,
-    `/** Clear request options + response; called when Http.get/post/… starts a new request. */`,
-    `static inline void __tc_http_reset(void) {`,
+    `/** Block until an async perform has finished (single-slot contract: a new`,
+    ` *  request may not clear state the workqueue is still writing). Bounded at`,
+    ` *  20 s — longer than any sane timeout_ms; past that it reports and the`,
+    ` *  caller proceeds without clearing (the in-flight response stays intact).`,
+    ` *  Cheap no-op when the async path was never used. */`,
+    `static void __tc_http_wait_async_idle(void) {`,
+    `    if (!__tc_http.work_inited) return;`,
+    `    int32_t waited = 0;`,
+    `    while (k_work_is_pending(&__tc_http.perform_work)) {`,
+    `        if (waited >= 20000) {`,
+    `            printk("tc-http: async request still busy after 20s\\n");`,
+    `            return;`,
+    `        }`,
+    `        k_msleep(10);`,
+    `        waited += 10;`,
+    `    }`,
+    `}`,
+    ``,
+    `/** Clear request options + response. Rides the head of every request (the`,
+    ` *  begin op from send()): reset FIRST, then this request's fact setters —`,
+    ` *  so nothing a previous request staged can leak into this one. */`,
+    `static void __tc_http_reset(void) {`,
+    `    __tc_http_wait_async_idle();`,
     `    if (__tc_http.resp != nullptr) { delete[] __tc_http.resp; __tc_http.resp = nullptr; }`,
     `    __tc_http.timeout_ms = 15000;`,
     `    __tc_http.max_body = __TC_HTTP_DEFAULT_MAX_BODY;`,
@@ -264,12 +417,24 @@ export function httpInitLines(): string[] {
     `    __tc_http.ok = false;`,
     `    __tc_http.resp_len = 0;`,
     `    __tc_http.content_length = -1;`,
+    `    __tc_http.resp_headers_len = 0;`,
+    `    __tc_http.hdr_parse_name_len = 0;`,
+    `    __tc_http.hdr_stage = 0U;`,
     `    __tc_http.resp_header[0] = '\\0';`,
     `    __tc_http.url[0] = '\\0';`,
     `}`,
     ``,
     `/** Stage the request. Setters (timeout/max_body/body/tls/headers) survive begin. */`,
     `static inline void __tc_http_begin(enum http_method method, const char* url) {`,
+    `    if (strlen(url) >= sizeof(__tc_http.url)) {`,
+    `        // A silently truncated URL fetches the wrong resource — refuse; the`,
+    `        // empty url makes perform's parse fail loudly ("bad url").`,
+    `        printk("tc-http: url longer than %u bytes - refused\\n",`,
+    `               static_cast<unsigned int>(sizeof(__tc_http.url) - 1U));`,
+    `        __tc_http.url[0] = '\\0';`,
+    `        __tc_http.method = method;`,
+    `        return;`,
+    `    }`,
     `    (void)strncpy(__tc_http.url, url, sizeof(__tc_http.url) - 1U);`,
     `    __tc_http.url[sizeof(__tc_http.url) - 1U] = '\\0';`,
     `    __tc_http.method = method;`,
@@ -280,6 +445,9 @@ export function httpInitLines(): string[] {
     `    __tc_http.ok = false;`,
     `    __tc_http.resp_len = 0;`,
     `    __tc_http.content_length = -1;`,
+    `    __tc_http.resp_headers_len = 0;`,
+    `    __tc_http.hdr_parse_name_len = 0;`,
+    `    __tc_http.hdr_stage = 0U;`,
     `    __tc_http.resp_header[0] = '\\0';`,
     `}`,
     ``,
@@ -331,15 +499,34 @@ export function httpInitLines(): string[] {
     `    int sock = __tc_http_open_socket();`,
     `    if (sock < 0) { __tc_http.done = true; return; }`,
     `    // Build the NULL-terminated header-fields list from staged headers.`,
+    `    // Format capped 2 bytes short of the buffer so the CRLF can ALWAYS be`,
+    `    // appended — a truncated value stays a syntactically valid header line`,
+    `    // instead of swallowing the next one (snprintk alone can cut the \\r\\n).`,
     `    for (int32_t i = 0; i < __tc_http.hdr_count && i < __TC_HTTP_MAX_HEADERS; i++) {`,
-    `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]),`,
-    `                       "%s: %s\\r\\n", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+    `        (void)snprintk(__tc_http.hdr_field_buf[i], sizeof(__tc_http.hdr_field_buf[i]) - 2U,`,
+    `                       "%s: %s", __tc_http.hdr_name[i], __tc_http.hdr_value[i]);`,
+    `        size_t flen = strlen(__tc_http.hdr_field_buf[i]);`,
+    `        __tc_http.hdr_field_buf[i][flen] = '\\r';`,
+    `        __tc_http.hdr_field_buf[i][flen + 1U] = '\\n';`,
+    `        __tc_http.hdr_field_buf[i][flen + 2U] = '\\0';`,
     `        __tc_http.hdr_fields[i] = __tc_http.hdr_field_buf[i];`,
     `    }`,
     `    __tc_http.hdr_fields[(__tc_http.hdr_count < __TC_HTTP_MAX_HEADERS)`,
     `                         ? __tc_http.hdr_count : __TC_HTTP_MAX_HEADERS] = nullptr;`,
+    `    // Response-header capture: the client's internal parser hooks forward`,
+    `    // to these settings (on_header_field/on_header_value) while keeping`,
+    `    // their own status/body handling — no interference with the body path.`,
+    `    static struct http_parser_settings __tc_http_parse_settings;`,
+    `    static bool __tc_http_parse_settings_inited;`,
+    `    if (!__tc_http_parse_settings_inited) {`,
+    `        http_parser_settings_init(&__tc_http_parse_settings);`,
+    `        __tc_http_parse_settings.on_header_field = __tc_http_on_hdr_field;`,
+    `        __tc_http_parse_settings.on_header_value = __tc_http_on_hdr_value;`,
+    `        __tc_http_parse_settings_inited = true;`,
+    `    }`,
     `    struct http_request req = { 0 };`,
     `    req.method = __tc_http.method;`,
+    `    req.http_cb = &__tc_http_parse_settings;`,
     `    req.url = __tc_http.path;`,
     `    req.host = __tc_http.host;`,
     `    req.protocol = "HTTP/1.1";`,
@@ -352,6 +539,7 @@ export function httpInitLines(): string[] {
     `        req.payload_len = static_cast<size_t>(__tc_http.body_len);`,
     `    }`,
     `    int sent = http_client_req(sock, &req, __tc_http.timeout_ms, nullptr);`,
+    `    __tc_http_hdr_finish();`,
     `    // The response callback (__tc_http_resp_cb) captures the status, but Zephyr's`,
     `    // parser aborts on 5xx responses (on_headers_complete returns 1 for status`,
     `    // >= 500, which http_parser treats as an error → http_client_req returns`,
@@ -395,12 +583,23 @@ export function httpInitLines(): string[] {
     `        k_sem_init(&__tc_http.done_sem, 0, 1);`,
     `        __tc_http.sem_inited = true;`,
     `    }`,
+    `    // Init the work item ONCE — re-initializing a queued/running item is`,
+    `    // undefined in Zephyr, and the busy check below makes the single-slot`,
+    `    // contract explicit instead of corrupting the in-flight request.`,
+    `    if (!__tc_http.work_inited) {`,
+    `        k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
+    `        __tc_http.work_inited = true;`,
+    `    }`,
+    `    if (k_work_is_pending(&__tc_http.perform_work)) {`,
+    `        printk("tc-http: previous async request still in flight - send refused\\n");`,
+    `        __tc_http.done = true;`,
+    `        return;`,
+    `    }`,
     `    __tc_http.done = false;`,
     `    // Drain any completion signal left from a previous request (e.g. the`,
     `    // prior done() saw the volatile flag before taking the sem), so the first`,
     `    // poll of this request doesn't fire on a stale signal.`,
     `    (void)k_sem_take(&__tc_http.done_sem, K_NO_WAIT);`,
-    `    k_work_init(&__tc_http.perform_work, __tc_http_perform_work);`,
     `    (void)k_work_submit(&__tc_http.perform_work);`,
     `}`,
     ``,
@@ -423,13 +622,39 @@ export function httpInitLines(): string[] {
     `    return static_cast<int32_t>(__tc_http.content_length);`,
     `}`,
     ``,
-    `// Response-header lookup. The Zephyr http_client_req surface does not expose`,
-    `// arbitrary response headers via the recv buffer; this returns the last`,
-    `// header captured by the response callback path. With no per-header hook`,
-    `// it returns "" until a richer parser setting is wired (http_cb).`,
+    `// Response-header lookup over the block captured by the parser hooks.`,
+    `// ASCII-case-insensitive name match at a line start; returns the value`,
+    `// ("" when absent or when the block was truncated past it).`,
+    `static inline char __tc_http_ascii_lower(char c) {`,
+    `    return (c >= 'A' && c <= 'Z') ? static_cast<char>(c + 32) : c;`,
+    `}`,
+    ``,
     `static inline const char* __tc_http_response_header(const char* name) {`,
-    `    (void)name;`,
     `    __tc_http.resp_header[0] = '\\0';`,
+    `    const char* block = __tc_http.resp_headers;`,
+    `    const char* end = block + __tc_http.resp_headers_len;`,
+    `    const char* line = block;`,
+    `    while (line < end) {`,
+    `        const char* eol = line;`,
+    `        while (eol < end && *eol != '\\r' && *eol != '\\n') { eol++; }`,
+    `        const char* c = line;`,
+    `        const char* n = name;`,
+    `        while (c < eol && *n != '\\0' && __tc_http_ascii_lower(*c) == __tc_http_ascii_lower(*n)) {`,
+    `            c++;`,
+    `            n++;`,
+    `        }`,
+    `        if (*n == '\\0' && c < eol && *c == ':') {`,
+    `            c++;`,
+    `            if (c < eol && *c == ' ') { c++; }`,
+    `            size_t vlen = static_cast<size_t>(eol - c);`,
+    `            if (vlen >= sizeof(__tc_http.resp_header)) { vlen = sizeof(__tc_http.resp_header) - 1U; }`,
+    `            (void)memcpy(__tc_http.resp_header, c, vlen);`,
+    `            __tc_http.resp_header[vlen] = '\\0';`,
+    `            break;`,
+    `        }`,
+    `        line = eol;`,
+    `        while (line < end && (*line == '\\r' || *line == '\\n')) { line++; }`,
+    `    }`,
     `    return __tc_http.resp_header;`,
     `}`,
     `// CUTTLEFISH_HTTP_END`,
@@ -458,9 +683,13 @@ export function lowerHttp(op: HALOpIR): { code?: string; expression?: string } {
     case 'http.begin': {
       const methodName = String(o.method).replace(/^["']|["']$/g, '').toUpperCase();
       const method = METHOD_MAP[methodName] ?? 'HTTP_GET';
-      // Fresh shim state per request — the reset used to ride the deleted
-      // factory op (http.reset); construction now owns it.
-      return { code: `__tc_http_reset(); __tc_http_begin(${method}, ${s(o.url)});` };
+      // Fresh shim state per request, THEN this request's header() pairs:
+      // the reset must precede them (the call-site emissions ran before
+      // send() and are wiped by the reset — re-staging here also keeps
+      // headers alive across send() loops).
+      const pairs = Array.isArray(o.headers) ? (o.headers as string[][]) : [];
+      const staged = pairs.length > 0 ? `${pairs.map(([n, v]) => `__tc_http_set_header(${s(n)}, ${s(v)});`).join(' ')} ` : '';
+      return { code: `__tc_http_reset(); ${staged}__tc_http_begin(${method}, ${s(o.url)});` };
     }
     case 'http.set_header':
       return { code: `__tc_http_set_header(${s(o.name)}, ${s(o.value)});` };
@@ -486,7 +715,10 @@ export function lowerHttp(op: HALOpIR): { code?: string; expression?: string } {
       }
       const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '');
       const der = Buffer.from(b64, 'base64');
-      if (der.length < 100) return { code: `// tc-http: caCert PEM failed to decode` };
+      // Every X.509 DER starts with the ASN.1 SEQUENCE tag (0x30); a long
+      // but non-cert payload fails here instead of at a confusing handshake
+      // error on the target.
+      if (der.length < 100 || der[0] !== 0x30) return { code: `// tc-http: caCert PEM failed to decode` };
       const hex = [...der].map((b) => `0x${b.toString(16).padStart(2, '0')}`).join(', ');
       return { code: `{ static const uint8_t __tc_ca_der[] = { ${hex} }; __tc_http_set_ca_cert_der(__tc_ca_der, sizeof(__tc_ca_der)); }` };
     }

package/src/lowering/i2c.ts

@@ -43,13 +43,107 @@ function speedForHz(hz: number): string {
   return 'I2C_SPEED_HIGH';
 }
 
+// ── I2C responder (hal/i2c-responder.ts) — this board as an I2C target ────
+//
+// One state block per constructed responder (bus + address), the i2c_target
+// vocabulary verbatim: the five driver callbacks behind two user-facing ones
+// (onReceive fires at STOP with the receive ring's new byte count; onRequest
+// fires at read start — the write() refill point). Registration
+// (i2c_target_register) is once-guarded at the first op, against the
+// controller handle the master-side init block emitted (__tc_i2c<N>_dev).
+
+/** The C symbol prefix for one responder's state. */
+function respPrefix(idx: number, address: number): string {
+  return `__tc_i2cresp${idx}_a${address.toString(16)}`;
+}
+
+/** The once-guarded registration every responder op carries — the UART arm
+ *  discipline: the first emitted call registers the address, so the
+ *  callbacks installed early in setup make it answer from boot. An
+ *  unsupported controller prints loudly (the CAN policy: -ENOSYS from a
+ *  driver with no target mode must not be a silent empty responder). */
+function respRegisterGuard(p: string, idx: number): string {
+  return `{ if (!${p}_registered) { ${p}_registered = true; int __tc_err = i2c_target_register(__tc_i2c${idx}_dev, &${p}_cfg); if (__tc_err != 0) { printk("typecad-hal i2c responder: target_register failed: %d\\n", __tc_err); } } } `;
+}
+
 /**
- * The (void) comma expression begin/end lower to — a no-op that references
- * the controller's whole state block (device + transaction buffers) so a
- * program calling only begin() stays -Werror clean (-Wunused-variable).
+ * Emit one responder's state: receive ring (UART discipline — free-running
+ * head/tail, overflow-drop), response buffer with its served position, the
+ * two handler slots, the five i2c_target callbacks, and the config the ops'
+ * registration guard passes to i2c_target_register. Called from shimLines
+ * for each constructed responder (collectI2cResponders).
  */
-function i2cKeepAlive(p: string): string {
-  return `(void)${p}_dev;`;
+export function i2cResponderStateLines(chip: ZephyrChipDescriptor, controllerIndex: number, address: number, rx: number, tx: number): string[] {
+  const ctrl = chip.i2c?.controllers[controllerIndex];
+  if (!ctrl) return [];
+  const p = respPrefix(controllerIndex, address);
+  return [
+    '// CUTTLEFISH_I2CRESP_BEGIN',
+    `static uint8_t ${p}_rx[${rx}];`,
+    `static volatile uint32_t ${p}_head = 0;`,
+    `static volatile uint32_t ${p}_tail = 0;`,
+    `static uint8_t ${p}_tx[${tx}];`,
+    `static volatile uint32_t ${p}_txlen = 0;`,
+    `static volatile uint32_t ${p}_txpos = 0;`,
+    `static void (*${p}_on_rx)(double) = NULL;`,
+    `static void (*${p}_on_rq)(void) = NULL;`,
+    // A controller write transaction: reset the ring, then take each byte.
+    // A byte arriving with a full ring is dropped — the embedded-honest
+    // answer (no unbounded buffering), same as the UART RX ring.
+    `static int ${p}_write_requested(struct i2c_target_config* cfg) {`,
+    '    (void)cfg;',
+    `    ${p}_head = 0;`,
+    `    ${p}_tail = 0;`,
+    '    return 0;',
+    '}',
+    `static int ${p}_write_received(struct i2c_target_config* cfg, uint8_t val) {`,
+    '    (void)cfg;',
+    `    if ((${p}_head - ${p}_tail) < ${rx}U) {`,
+    `        ${p}_rx[${p}_head % ${rx}U] = val;`,
+    `        ${p}_head++;`,
+    '    }',
+    '    return 0;',
+    '}',
+    // A controller read transaction: the user's refill point first, then the
+    // first byte. Past the buffer's end the controller reads 0xFF (the bus
+    // has no NACK for a too-long read; the value is the honest filler).
+    `static int ${p}_read_requested(struct i2c_target_config* cfg, uint8_t* val) {`,
+    '    (void)cfg;',
+    `    if (${p}_on_rq != NULL) { ${p}_on_rq(); }`,
+    `    ${p}_txpos = 1U;`,
+    `    *val = (${p}_txlen > 0U) ? ${p}_tx[0] : 0xFFU;`,
+    '    return 0;',
+    '}',
+    `static int ${p}_read_processed(struct i2c_target_config* cfg, uint8_t* val) {`,
+    '    (void)cfg;',
+    `    *val = (${p}_txpos < ${p}_txlen) ? ${p}_tx[${p}_txpos] : 0xFFU;`,
+    `    ${p}_txpos++;`,
+    '    return 0;',
+    '}',
+    // End of transaction: announce a completed controller write with the
+    // count now waiting in the ring (the Wire onReceive(len) semantic).
+    `static int ${p}_stop(struct i2c_target_config* cfg) {`,
+    '    (void)cfg;',
+    `    if ((${p}_on_rx != NULL) && (${p}_head > ${p}_tail)) {`,
+    `        ${p}_on_rx(static_cast<double>(${p}_head - ${p}_tail));`,
+    '    }',
+    '    return 0;',
+    '}',
+    `static const struct i2c_target_callbacks ${p}_cbs = {`,
+    `    .write_requested = ${p}_write_requested,`,
+    `    .read_requested = ${p}_read_requested,`,
+    `    .write_received = ${p}_write_received,`,
+    `    .read_processed = ${p}_read_processed,`,
+    `    .stop = ${p}_stop,`,
+    '};',
+    `static struct i2c_target_config ${p}_cfg = {`,
+    '    .flags = 0U,',
+    `    .address = ${address}U,`,
+    `    .callbacks = &${p}_cbs,`,
+    '};',
+    `static bool ${p}_registered = false;`,
+    '// CUTTLEFISH_I2CRESP_END',
+  ];
 }
 
 /** The thin-device bus-speed preamble: apply the construction hz once
@@ -107,6 +201,49 @@ export function lowerI2c(
       const arr = `static const uint8_t __tc_i2cw[] = { ${bytes.join(', ')} };`;
       return { code: `${pre} ${arr} (void)i2c_write(${p}_dev, __tc_i2cw, sizeof(__tc_i2cw), static_cast<uint16_t>(${o.address}));` };
     }
+
+    // ── I2C responder (hal/i2c-responder.ts) — target-mode ops ───────────
+    // Every op carries the once-guarded registration; the state it touches
+    // is the per-responder block i2cResponderStateLines emitted.
+    case 'i2c.resp_on_receive': {
+      const rp = respPrefix(idx, o.address);
+      return { code: `${respRegisterGuard(rp, idx)} ${rp}_on_rx = ${o.handler};` };
+    }
+    case 'i2c.resp_on_request': {
+      const rp = respPrefix(idx, o.address);
+      return { code: `${respRegisterGuard(rp, idx)} ${rp}_on_rq = ${o.handler};` };
+    }
+    case 'i2c.resp_available': {
+      const rp = respPrefix(idx, o.address);
+      return { expression: `({ ${respRegisterGuard(rp, idx)} (${rp}_head - ${rp}_tail); })` };
+    }
+    case 'i2c.resp_read': {
+      const rp = respPrefix(idx, o.address);
+      return { expression: `({ ${respRegisterGuard(rp, idx)} (${rp}_tail < ${rp}_head ? ${rp}_rx[(${rp}_tail)++ % ${o.rx}U] : -1); })` };
+    }
+    case 'i2c.resp_write': {
+      const rp = respPrefix(idx, o.address);
+      const bytes: unknown[] = o.bytes ?? [];
+      const isBuffer = bytes.length === 1 && typeof bytes[0] === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(bytes[0] as string);
+      if (isBuffer) {
+        const name = bytes[0] as string;
+        // A named user buffer: copy its storage into the response buffer,
+        // clamped to the constructed size; the length lands last so an
+        // in-flight read never sees a torn buffer.
+        return {
+          code: `${respRegisterGuard(rp, idx)} { ${rp}_txlen = 0U; for (uint32_t __tc_i = 0U; (__tc_i < sizeof(${name})) && (__tc_i < ${o.tx}U); ++__tc_i) { ${rp}_tx[__tc_i] = ${name}[__tc_i]; } ${rp}_txlen = (sizeof(${name}) < ${o.tx}U) ? static_cast<uint32_t>(sizeof(${name})) : ${o.tx}U; }`,
+        };
+      }
+      if (bytes.length > Number(o.tx)) {
+        throw new Error(
+          `I2C responder write: the response buffer holds ${o.tx} bytes — got ${bytes.length}. Construct with a larger txBufferBytes.`,
+        );
+      }
+      const assigns = bytes
+        .map((b, i) => `${rp}_tx[${i}] = static_cast<uint8_t>(${b});`)
+        .join(' ');
+      return { code: `${respRegisterGuard(rp, idx)} { ${rp}_txlen = 0U; ${assigns} ${rp}_txlen = ${bytes.length}U; }` };
+    }
     default:
       throw new Error(
         `framework-zephyr does not yet support HAL op \`${op.operation}\`. ` +