Phase 3: on-device Cashu wallet with mbedTLS secp256k1 + SPIFFS persistence + PSRAM

- wallet.c/h: secp256k1 ECP primitives (hash_to_curve, scalar_mul, point_add)
- wallet_persist.c/h: SPIFFS persistence with threshold-based write protection
- Fee accounting for swap (input_fee_ppk from /v1/keysets)
- Keyset fetch via /v1/keysets (586 bytes vs 21KB for /v1/keys)
- Wallet API: GET /wallet, POST /wallet/swap, POST /wallet/send
- Payment proofs auto-stored to wallet + persisted on SPIFFS
- PSRAM enabled for large allocations (ESP32-S3 has 8MB)
- Wallet init deferred to dedicated task (avoids sys_evt stack overflow)
- Cashu proof ID buffer size fixed (66 hex chars, not 16)
- HTTP client: added fetch_headers() call for proper response handling
- persist_threshold_sats config parameter (default: 1 sat)

10 files changed, 999 insertions, 3 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 5650309..2eef030 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -6,6 +6,8 @@ idf_component_register(SRCS "tollgate_main.c"
                             "cashu.c"
                             "session.c"
                             "tollgate_api.c"
+                             "wallet.c"
+                            "wallet_persist.c"
                     INCLUDE_DIRS "." "${IDF_PATH}/components/lwip/include/apps"
                     REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
                              lwip json esp_http_client mbedtls esp-tls log spiffs
diff --git a/main/cashu.h b/main/cashu.h
index 17891c5..4c3d43b 100644
--- a/main/cashu.h
+++ b/main/cashu.h
@@ -7,7 +7,7 @@
 
 #define CASHU_MAX_PROOFS      10
 #define CASHU_MAX_SECRET_LEN  128
-#define CASHU_MAX_ID_LEN      16
+#define CASHU_MAX_ID_LEN      68
 #define CASHU_MAX_C_LEN       128
 
 typedef struct {
diff --git a/main/config.c b/main/config.c
index d7837bc..7e8a14c 100644
--- a/main/config.c
+++ b/main/config.c
@@ -19,6 +19,7 @@ esp_err_t tollgate_config_init(void)
     g_config.ap_max_conn = 4;
     g_config.price_per_step = 21;
     g_config.step_size_ms = 60000;
+    g_config.persist_threshold_sats = 1;
 
     esp_vfs_spiffs_conf_t conf = {
         .base_path = "/spiffs",
@@ -117,6 +118,9 @@ esp_err_t tollgate_config_init(void)
     cJSON *step = cJSON_GetObjectItem(root, "step_size_ms");
     if (step) g_config.step_size_ms = step->valueint;
 
+    cJSON *persist = cJSON_GetObjectItem(root, "persist_threshold_sats");
+    if (persist) g_config.persist_threshold_sats = (uint64_t)persist->valuedouble;
+
     cJSON_Delete(root);
     ESP_LOGI(TAG, "Config loaded: AP='%s', %d WiFi networks, price=%d sats/%dms",
              g_config.ap_ssid, g_config.network_count, g_config.price_per_step, g_config.step_size_ms);
diff --git a/main/config.h b/main/config.h
index dd3fe05..2bcd400 100644
--- a/main/config.h
+++ b/main/config.h
@@ -34,6 +34,7 @@ typedef struct {
     char lnurl_url[256];
     int price_per_step;
     int step_size_ms;
+    uint64_t persist_threshold_sats;
 
     bool unique_derived;
 } tollgate_config_t;
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index efb5cdf..e6880e0 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -3,6 +3,7 @@
 #include "config.h"
 #include "session.h"
 #include "firewall.h"
+#include "wallet.h"
 #include "esp_log.h"
 #include "cJSON.h"
 #include "lwip/sockets.h"
@@ -298,9 +299,9 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         secrets[i] = token->proofs[i].secret;
     }
     session_t *session = session_create(client_ip, allotment, secrets, secret_count);
-    free(states);
-    free(token);
     if (!session) {
+        free(states);
+        free(token);
         cJSON *notice = create_notice("error", "session-error", "Failed to create session");
         char *json = cJSON_PrintUnformatted(notice);
         httpd_resp_set_status(req, "503 Service Unavailable");
@@ -317,6 +318,21 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     httpd_resp_send(req, json, strlen(json));
     cJSON_free(json);
     cJSON_Delete(session_event);
+
+    {
+        wallet_proof_t wproofs[CASHU_MAX_PROOFS];
+        int wcount = token->proof_count > CASHU_MAX_PROOFS ? CASHU_MAX_PROOFS : token->proof_count;
+        for (int i = 0; i < wcount; i++) {
+            wproofs[i].amount = token->proofs[i].amount;
+            strncpy(wproofs[i].id, token->proofs[i].id, WALLET_KEYSET_ID_LEN - 1);
+            strncpy(wproofs[i].secret, token->proofs[i].secret, WALLET_SECRET_LEN - 1);
+            strncpy(wproofs[i].c, token->proofs[i].c, WALLET_SIG_LEN - 1);
+        }
+        wallet_add_proofs(wproofs, wcount);
+    }
+
+    free(states);
+    free(token);
     return ESP_OK;
 }
 
@@ -363,10 +379,121 @@ static esp_err_t api_get_whoami(httpd_req_t *req)
     return ESP_OK;
 }
 
+static esp_err_t api_get_wallet(httpd_req_t *req)
+{
+    wallet_t *w = wallet_get();
+    cJSON *root = cJSON_CreateObject();
+    cJSON_AddNumberToObject(root, "balance", (double)w->balance);
+    cJSON_AddNumberToObject(root, "proof_count", w->proof_count);
+    cJSON_AddNumberToObject(root, "keyset_count", w->keyset_count);
+
+    cJSON *proofs = cJSON_CreateArray();
+    for (int i = 0; i < w->proof_count; i++) {
+        cJSON *p = cJSON_CreateObject();
+        cJSON_AddNumberToObject(p, "amount", (double)w->proofs[i].amount);
+        cJSON_AddStringToObject(p, "id", w->proofs[i].id);
+        cJSON_AddItemToArray(proofs, p);
+    }
+    cJSON_AddItemToObject(root, "proofs", proofs);
+
+    char *json = cJSON_PrintUnformatted(root);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(root);
+    return ESP_OK;
+}
+
+static esp_err_t api_post_wallet_swap(httpd_req_t *req)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+
+    if (wallet_balance() == 0) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"no proofs to swap\"}", 27);
+        return ESP_OK;
+    }
+
+    wallet_print_status();
+
+    esp_err_t err = wallet_fetch_keysets(cfg->mint_url);
+    if (err != ESP_OK) {
+        httpd_resp_set_status(req, "502 Bad Gateway");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"keyset fetch failed\"}", 29);
+        return ESP_OK;
+    }
+
+    wallet_t *w = wallet_get();
+    err = wallet_swap_proofs(cfg->mint_url, 0, w->proof_count);
+    if (err != ESP_OK) {
+        httpd_resp_set_status(req, "502 Bad Gateway");
+        httpd_resp_set_type(req, "application/json");
+        httpd_resp_send(req, "{\"error\":\"swap failed\"}", 21);
+        return ESP_OK;
+    }
+
+    wallet_print_status();
+
+    cJSON *root = cJSON_CreateObject();
+    cJSON_AddNumberToObject(root, "balance", (double)wallet_balance());
+    cJSON_AddNumberToObject(root, "proof_count", wallet_get()->proof_count);
+    char *json = cJSON_PrintUnformatted(root);
+    httpd_resp_set_type(req, "application/json");
+    httpd_resp_send(req, json, strlen(json));
+    cJSON_free(json);
+    cJSON_Delete(root);
+    return ESP_OK;
+}
+
+static esp_err_t api_post_wallet_send(httpd_req_t *req)
+{
+    int content_len = req->content_len;
+    if (content_len <= 0 || content_len > 32) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_send(req, "invalid amount", 14);
+        return ESP_OK;
+    }
+
+    char body[32];
+    int total = 0;
+    while (total < content_len) {
+        int r = httpd_req_recv(req, body + total, content_len - total);
+        if (r <= 0) { httpd_resp_send_500(req); return ESP_OK; }
+        total += r;
+    }
+    body[total] = '\0';
+
+    uint64_t amount = strtoull(body, NULL, 10);
+    if (amount == 0) {
+        httpd_resp_set_status(req, "400 Bad Request");
+        httpd_resp_send(req, "invalid amount", 14);
+        return ESP_OK;
+    }
+
+    const tollgate_config_t *cfg = tollgate_config_get();
+    char token[4096];
+    esp_err_t err = wallet_send(cfg->mint_url, amount, token, sizeof(token));
+    if (err != ESP_OK) {
+        httpd_resp_set_status(req, "402 Payment Required");
+        httpd_resp_set_type(req, "text/plain");
+        httpd_resp_send(req, "insufficient balance", 20);
+        return ESP_OK;
+    }
+
+    httpd_resp_set_type(req, "text/plain");
+    httpd_resp_send(req, token, strlen(token));
+    return ESP_OK;
+}
+
 static const httpd_uri_t uri_discovery = { .uri = "/", .method = HTTP_GET, .handler = api_get_discovery };
 static const httpd_uri_t uri_payment = { .uri = "/", .method = HTTP_POST, .handler = api_post_payment };
 static const httpd_uri_t uri_usage = { .uri = "/usage", .method = HTTP_GET, .handler = api_get_usage };
 static const httpd_uri_t uri_whoami = { .uri = "/whoami", .method = HTTP_GET, .handler = api_get_whoami };
+static const httpd_uri_t uri_wallet = { .uri = "/wallet", .method = HTTP_GET, .handler = api_get_wallet };
+static const httpd_uri_t uri_wallet_swap = { .uri = "/wallet/swap", .method = HTTP_POST, .handler = api_post_wallet_swap };
+static const httpd_uri_t uri_wallet_send = { .uri = "/wallet/send", .method = HTTP_POST, .handler = api_post_wallet_send };
 
 esp_err_t tollgate_api_start(void)
 {
@@ -388,6 +515,9 @@ esp_err_t tollgate_api_start(void)
     httpd_register_uri_handler(s_api_server, &uri_payment);
     httpd_register_uri_handler(s_api_server, &uri_usage);
     httpd_register_uri_handler(s_api_server, &uri_whoami);
+    httpd_register_uri_handler(s_api_server, &uri_wallet);
+    httpd_register_uri_handler(s_api_server, &uri_wallet_swap);
+    httpd_register_uri_handler(s_api_server, &uri_wallet_send);
 
     ESP_LOGI(TAG, "TollGate API started on port 2121");
     return ESP_OK;
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 9d2c392..d4b29bc 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -16,6 +16,7 @@
 #include "firewall.h"
 #include "session.h"
 #include "tollgate_api.h"
+#include "wallet.h"
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -88,6 +89,14 @@ static void ip_event_handler(void *arg, esp_event_base_t event_base,
     }
 }
 
+static void wallet_init_task(void *pvParameters)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+    wallet_init();
+    wallet_fetch_keysets(cfg->mint_url);
+    vTaskDelete(NULL);
+}
+
 static void start_services(void)
 {
     if (s_services_mutex) xSemaphoreTake(s_services_mutex, portMAX_DELAY);
@@ -107,6 +116,8 @@ static void start_services(void)
     firewall_init(ap_ip_info.ip);
     session_manager_init();
 
+    xTaskCreate(wallet_init_task, "wallet_init", 32768, NULL, 5, NULL);
+
     const tollgate_config_t *cfg = tollgate_config_get();
     dns_server_start(ap_ip_info.ip, upstream_dns);
     captive_portal_start(cfg->ap_ip_str);
diff --git a/main/wallet.c b/main/wallet.c
new file mode 100644
index 0000000..3f65220
--- /dev/null
+++ b/main/wallet.c
@@ -0,0 +1,639 @@
+#include "wallet.h"
+#include "wallet_persist.h"
+#include "config.h"
+#include "esp_log.h"
+#include "esp_random.h"
+#include "esp_http_client.h"
+#include "esp_crt_bundle.h"
+#include "cJSON.h"
+#include "mbedtls/ecp.h"
+#include "mbedtls/bignum.h"
+#include "mbedtls/sha256.h"
+#include "mbedtls/base64.h"
+#include "freertos/FreeRTOS.h"
+#include "freertos/task.h"
+#include "freertos/semphr.h"
+#include "esp_heap_caps.h"
+#include <string.h>
+#include <stdio.h>
+
+static const char *TAG = "wallet";
+static wallet_t s_wallet;
+
+static const char DOMAIN_SEPARATOR[] = "Secp256k1_HashToCurve_Cashu_";
+
+static mbedtls_ecp_group s_grp;
+static mbedtls_mpi s_order;
+static bool s_grp_loaded = false;
+
+static esp_err_t init_ecp_group(void)
+{
+    if (s_grp_loaded) return ESP_OK;
+    mbedtls_ecp_group_init(&s_grp);
+    mbedtls_mpi_init(&s_order);
+    int ret = mbedtls_ecp_group_load(&s_grp, MBEDTLS_ECP_DP_SECP256K1);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "Failed to load secp256k1 group: -0x%x", -ret);
+        return ESP_FAIL;
+    }
+    mbedtls_mpi_copy(&s_order, &s_grp.N);
+    s_grp_loaded = true;
+    return ESP_OK;
+}
+
+static void random_bytes(uint8_t *buf, size_t len)
+{
+    esp_fill_random(buf, len);
+}
+
+static esp_err_t random_scalar(mbedtls_mpi *r)
+{
+    uint8_t buf[32];
+    random_bytes(buf, 32);
+    mbedtls_mpi_init(r);
+    int ret = mbedtls_mpi_read_binary(r, buf, 32);
+    if (ret != 0) return ESP_FAIL;
+    ret = mbedtls_mpi_mod_mpi(r, r, &s_order);
+    if (ret != 0) return ESP_FAIL;
+    if (mbedtls_mpi_cmp_int(r, 1) < 0) {
+        mbedtls_mpi_add_int(r, r, 1);
+    }
+    return ESP_OK;
+}
+
+static esp_err_t hash_to_curve(const uint8_t *msg, size_t msg_len, mbedtls_ecp_point *Y)
+{
+    uint8_t msg_hash[32];
+    size_t ds_len = strlen(DOMAIN_SEPARATOR);
+    uint8_t *hash_input = malloc(ds_len + msg_len);
+    if (!hash_input) return ESP_FAIL;
+    memcpy(hash_input, DOMAIN_SEPARATOR, ds_len);
+    memcpy(hash_input + ds_len, msg, msg_len);
+    mbedtls_sha256(hash_input, ds_len + msg_len, msg_hash, 0);
+    free(hash_input);
+
+    mbedtls_ecp_point_init(Y);
+    for (uint32_t counter = 0; counter < 256; counter++) {
+        uint8_t counter_bytes[4];
+        counter_bytes[0] = counter & 0xFF;
+        counter_bytes[1] = (counter >> 8) & 0xFF;
+        counter_bytes[2] = (counter >> 16) & 0xFF;
+        counter_bytes[3] = (counter >> 24) & 0xFF;
+
+        uint8_t to_hash[32 + 4 + 1];
+        memcpy(to_hash, msg_hash, 32);
+        memcpy(to_hash + 32, counter_bytes, 4);
+
+        uint8_t point_hash[32];
+        mbedtls_sha256(to_hash, 36, point_hash, 0);
+
+        uint8_t compressed[33];
+        compressed[0] = 0x02;
+        memcpy(compressed + 1, point_hash, 32);
+
+        int ret = mbedtls_ecp_point_read_binary(&s_grp, Y, compressed, 33);
+        if (ret == 0) {
+            ret = mbedtls_ecp_check_pubkey(&s_grp, Y);
+            if (ret == 0) return ESP_OK;
+        }
+
+        compressed[0] = 0x03;
+        ret = mbedtls_ecp_point_read_binary(&s_grp, Y, compressed, 33);
+        if (ret == 0) {
+            ret = mbedtls_ecp_check_pubkey(&s_grp, Y);
+            if (ret == 0) return ESP_OK;
+        }
+    }
+
+    ESP_LOGE(TAG, "hash_to_curve failed after 256 attempts");
+    return ESP_FAIL;
+}
+
+static esp_err_t point_add(const mbedtls_ecp_point *A, const mbedtls_ecp_point *B,
+                             mbedtls_ecp_point *R)
+{
+    mbedtls_mpi one;
+    mbedtls_mpi_init(&one);
+    mbedtls_mpi_lset(&one, 1);
+    int ret = mbedtls_ecp_muladd(&s_grp, R, &one, A, &one, B);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "point_add failed: -0x%x", -ret);
+    }
+    mbedtls_mpi_free(&one);
+    return (ret == 0) ? ESP_OK : ESP_FAIL;
+}
+
+static esp_err_t scalar_mul(const mbedtls_mpi *m, const mbedtls_ecp_point *P,
+                              mbedtls_ecp_point *R)
+{
+    int ret = mbedtls_ecp_mul(&s_grp, R, m, P, NULL, NULL);
+    if (ret != 0) {
+        ESP_LOGE(TAG, "scalar_mul failed: -0x%x", -ret);
+    }
+    return (ret == 0) ? ESP_OK : ESP_FAIL;
+}
+
+static int hex_to_bytes(const char *hex, uint8_t *bytes, size_t bytes_len)
+{
+    size_t hex_len = strlen(hex);
+    if (hex_len / 2 > bytes_len) return -1;
+    for (size_t i = 0; i < hex_len / 2; i++) {
+        unsigned int b;
+        sscanf(hex + i * 2, "%02x", &b);
+        bytes[i] = (uint8_t)b;
+    }
+    return hex_len / 2;
+}
+
+static void bytes_to_hex(const uint8_t *bytes, size_t len, char *hex)
+{
+    for (size_t i = 0; i < len; i++) {
+        sprintf(hex + i * 2, "%02x", bytes[i]);
+    }
+    hex[len * 2] = '\0';
+}
+
+esp_err_t wallet_init(void)
+{
+    memset(&s_wallet, 0, sizeof(s_wallet));
+    esp_err_t err = init_ecp_group();
+    if (err != ESP_OK) return err;
+    wallet_persist_load();
+    ESP_LOGI(TAG, "Wallet initialized (secp256k1 loaded)");
+    return ESP_OK;
+}
+
+wallet_t *wallet_get(void)
+{
+    return &s_wallet;
+}
+
+uint64_t wallet_balance(void)
+{
+    return s_wallet.balance;
+}
+
+esp_err_t wallet_add_proofs(const wallet_proof_t *proofs, int count)
+{
+    for (int i = 0; i < count; i++) {
+        if (s_wallet.proof_count >= WALLET_MAX_PROOFS) {
+            ESP_LOGW(TAG, "Wallet full, cannot add more proofs");
+            return ESP_ERR_NO_MEM;
+        }
+        memcpy(&s_wallet.proofs[s_wallet.proof_count], &proofs[i], sizeof(wallet_proof_t));
+        s_wallet.balance += proofs[i].amount;
+        s_wallet.proof_count++;
+        ESP_LOGI(TAG, "Added proof: amount=%llu, total_balance=%llu",
+                 (unsigned long long)proofs[i].amount,
+                 (unsigned long long)s_wallet.balance);
+    }
+    wallet_persist_save();
+    return ESP_OK;
+}
+
+esp_err_t wallet_remove_proof(int index)
+{
+    if (index < 0 || index >= s_wallet.proof_count) return ESP_ERR_INVALID_ARG;
+    s_wallet.balance -= s_wallet.proofs[index].amount;
+    for (int i = index; i < s_wallet.proof_count - 1; i++) {
+        memcpy(&s_wallet.proofs[i], &s_wallet.proofs[i + 1], sizeof(wallet_proof_t));
+    }
+    memset(&s_wallet.proofs[s_wallet.proof_count - 1], 0, sizeof(wallet_proof_t));
+    s_wallet.proof_count--;
+    wallet_persist_save();
+    return ESP_OK;
+}
+
+void wallet_clear(void)
+{
+    s_wallet.balance = 0;
+    s_wallet.proof_count = 0;
+    wallet_persist_save();
+}
+
+esp_err_t wallet_fetch_keysets(const char *mint_url)
+{
+    char url[512];
+    snprintf(url, sizeof(url), "%s/v1/keysets", mint_url);
+
+    char *resp_buf = malloc(8192);
+    if (!resp_buf) return ESP_ERR_NO_MEM;
+
+    esp_http_client_config_t config = {
+        .url = url,
+        .method = HTTP_METHOD_GET,
+        .timeout_ms = 10000,
+        .crt_bundle_attach = esp_crt_bundle_attach,
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    if (!client) { free(resp_buf); return ESP_FAIL; }
+
+    esp_err_t err = esp_http_client_open(client, 0);
+    if (err != ESP_OK) {
+        ESP_LOGE(TAG, "Keyset fetch open failed: %s", esp_err_to_name(err));
+        esp_http_client_cleanup(client);
+        free(resp_buf);
+        return err;
+    }
+
+    int content_length = esp_http_client_fetch_headers(client);
+    int status = esp_http_client_get_status_code(client);
+    ESP_LOGI(TAG, "Keyset fetch: status=%d content_length=%d", status, content_length);
+
+    int resp_len = esp_http_client_read(client, resp_buf, 8191);
+    ESP_LOGI(TAG, "Keyset fetch: read %d bytes", resp_len);
+    esp_http_client_cleanup(client);
+
+    if (status != 200 || resp_len <= 0) {
+        ESP_LOGE(TAG, "Keyset fetch failed: status=%d len=%d", status, resp_len);
+        free(resp_buf);
+        return ESP_FAIL;
+    }
+    resp_buf[resp_len] = '\0';
+
+    cJSON *root = cJSON_Parse(resp_buf);
+    free(resp_buf);
+    if (!root) return ESP_FAIL;
+
+    cJSON *keysets = cJSON_GetObjectItemCaseSensitive(root, "keysets");
+    if (!keysets || !cJSON_IsArray(keysets)) {
+        cJSON_Delete(root);
+        return ESP_FAIL;
+    }
+
+    s_wallet.keyset_count = 0;
+    int n = cJSON_GetArraySize(keysets);
+    for (int i = 0; i < n && i < WALLET_MAX_KEYSETS; i++) {
+        cJSON *ks = cJSON_GetArrayItem(keysets, i);
+        cJSON *id = cJSON_GetObjectItemCaseSensitive(ks, "id");
+        if (id && cJSON_IsString(id)) {
+            strncpy(s_wallet.keysets[s_wallet.keyset_count].id, id->valuestring,
+                    WALLET_KEYSET_ID_LEN - 1);
+            cJSON *fee = cJSON_GetObjectItemCaseSensitive(ks, "input_fee_ppk");
+            s_wallet.keysets[s_wallet.keyset_count].input_fee_ppk = fee ? fee->valueint : 0;
+            s_wallet.keyset_count++;
+        }
+    }
+
+    cJSON_Delete(root);
+    ESP_LOGI(TAG, "Fetched %d keysets from %s", s_wallet.keyset_count, mint_url);
+    return ESP_OK;
+}
+
+esp_err_t wallet_swap_proofs(const char *mint_url, int start_index, int count)
+{
+    ESP_LOGI(TAG, "wallet_swap_proofs called: start=%d count=%d keysets=%d proofs=%d",
+             start_index, count, s_wallet.keyset_count, s_wallet.proof_count);
+
+    if (s_wallet.keyset_count == 0) {
+        ESP_LOGE(TAG, "No keysets loaded, fetch first");
+        return ESP_FAIL;
+    }
+    if (start_index < 0 || start_index + count > s_wallet.proof_count) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    wallet_proof_t *old_proofs = &s_wallet.proofs[start_index];
+    int n = count;
+
+    uint64_t total_input = 0;
+    for (int i = 0; i < n; i++) total_input += old_proofs[i].amount;
+
+    int fee_ppk = s_wallet.keysets[0].input_fee_ppk;
+    uint64_t fee_sats = (total_input * fee_ppk + 999) / 1000;
+    uint64_t total_output = total_input - fee_sats;
+    ESP_LOGI(TAG, "Swap: total_input=%llu fee_ppk=%d fee=%llu total_output=%llu",
+             (unsigned long long)total_input, fee_ppk,
+             (unsigned long long)fee_sats, (unsigned long long)total_output);
+
+    cJSON *inputs = cJSON_CreateArray();
+    for (int i = 0; i < n; i++) {
+        cJSON *p = cJSON_CreateObject();
+        cJSON_AddNumberToObject(p, "amount", (double)old_proofs[i].amount);
+        cJSON_AddStringToObject(p, "id", old_proofs[i].id);
+        cJSON_AddStringToObject(p, "secret", old_proofs[i].secret);
+        cJSON_AddStringToObject(p, "C", old_proofs[i].c);
+        cJSON_AddItemToArray(inputs, p);
+    }
+
+    typedef struct {
+        uint8_t secret[32];
+        mbedtls_mpi r;
+        mbedtls_ecp_point Y;
+    } swap_output_t;
+
+    swap_output_t *outputs = heap_caps_malloc(n * sizeof(swap_output_t), MALLOC_CAP_SPIRAM);
+    if (!outputs) { cJSON_Delete(inputs); return ESP_ERR_NO_MEM; }
+
+    cJSON *blinded_msgs = cJSON_CreateArray();
+    for (int i = 0; i < n; i++) {
+        random_bytes(outputs[i].secret, 32);
+        mbedtls_ecp_point_init(&outputs[i].Y);
+        esp_err_t htc_ret = hash_to_curve(outputs[i].secret, 32, &outputs[i].Y);
+        if (htc_ret != ESP_OK) {
+            ESP_LOGE(TAG, "hash_to_curve failed for output %d", i);
+        }
+        mbedtls_mpi_init(&outputs[i].r);
+        random_scalar(&outputs[i].r);
+
+        mbedtls_ecp_point rG, B_;
+        mbedtls_ecp_point_init(&rG);
+        mbedtls_ecp_point_init(&B_);
+
+        esp_err_t sm_ret = scalar_mul(&outputs[i].r, &s_grp.G, &rG);
+        if (sm_ret != ESP_OK) {
+            ESP_LOGE(TAG, "scalar_mul failed for output %d", i);
+        }
+        esp_err_t pa_ret = point_add(&outputs[i].Y, &rG, &B_);
+        if (pa_ret != ESP_OK) {
+            ESP_LOGE(TAG, "point_add failed for output %d", i);
+        }
+
+        uint8_t b_bytes[33];
+        size_t olen = 0;
+        int wret = mbedtls_ecp_point_write_binary(&s_grp, &B_, MBEDTLS_ECP_PF_COMPRESSED, &olen, b_bytes, 33);
+        if (wret != 0 || olen == 0) {
+            ESP_LOGE(TAG, "Blinded point write failed: ret=-0x%x olen=%zu", -wret, olen);
+            olen = 1;
+            b_bytes[0] = 0x00;
+        }
+        char b_hex[67];
+        bytes_to_hex(b_bytes, olen, b_hex);
+
+        uint64_t out_amount = old_proofs[i].amount;
+        if (i == n - 1) {
+            uint64_t running = 0;
+            for (int j = 0; j < n - 1; j++) running += old_proofs[j].amount;
+            out_amount = total_output - running;
+        }
+
+        cJSON *bm = cJSON_CreateObject();
+        cJSON_AddNumberToObject(bm, "amount", (double)out_amount);
+        cJSON_AddStringToObject(bm, "id", s_wallet.keysets[0].id);
+        cJSON_AddStringToObject(bm, "B_", b_hex);
+        cJSON_AddItemToArray(blinded_msgs, bm);
+
+        mbedtls_ecp_point_free(&rG);
+        mbedtls_ecp_point_free(&B_);
+    }
+
+    cJSON *body = cJSON_CreateObject();
+    cJSON_AddItemToObject(body, "inputs", inputs);
+    cJSON_AddItemToObject(body, "outputs", blinded_msgs);
+    char *body_str = cJSON_PrintUnformatted(body);
+    cJSON_Delete(body);
+
+    ESP_LOGI(TAG, "Swap request body (%zu bytes): %s", strlen(body_str), body_str);
+
+    char url[512];
+    snprintf(url, sizeof(url), "%s/v1/swap", mint_url);
+
+    char *resp_buf = malloc(8192);
+    if (!resp_buf) {
+        free(body_str);
+        for (int i = 0; i < n; i++) {
+            mbedtls_mpi_free(&outputs[i].r);
+            mbedtls_ecp_point_free(&outputs[i].Y);
+        }
+        free(outputs);
+        return ESP_ERR_NO_MEM;
+    }
+
+    esp_http_client_config_t config = {
+        .url = url,
+        .method = HTTP_METHOD_POST,
+        .timeout_ms = 15000,
+        .crt_bundle_attach = esp_crt_bundle_attach,
+    };
+    esp_http_client_handle_t client = esp_http_client_init(&config);
+    if (!client) {
+        free(body_str);
+        free(resp_buf);
+        for (int i = 0; i < n; i++) {
+            mbedtls_mpi_free(&outputs[i].r);
+            mbedtls_ecp_point_free(&outputs[i].Y);
+        }
+        free(outputs);
+        return ESP_FAIL;
+    }
+
+    esp_http_client_set_header(client, "Content-Type", "application/json");
+    esp_http_client_open(client, strlen(body_str));
+    esp_http_client_write(client, body_str, strlen(body_str));
+    free(body_str);
+
+    esp_http_client_fetch_headers(client);
+    int resp_len = esp_http_client_read(client, resp_buf, 8191);
+    int status = esp_http_client_get_status_code(client);
+    esp_http_client_cleanup(client);
+
+    if (status != 200 || resp_len <= 0) {
+        if (resp_len > 0) {
+            resp_buf[resp_len] = '\0';
+            ESP_LOGE(TAG, "Swap failed: status=%d body=%s", status, resp_buf);
+        } else {
+            ESP_LOGE(TAG, "Swap failed: status=%d len=%d", status, resp_len);
+        }
+        free(resp_buf);
+        for (int i = 0; i < n; i++) {
+            mbedtls_mpi_free(&outputs[i].r);
+            mbedtls_ecp_point_free(&outputs[i].Y);
+        }
+        free(outputs);
+        return ESP_FAIL;
+    }
+    resp_buf[resp_len] = '\0';
+
+    cJSON *root = cJSON_Parse(resp_buf);
+    free(resp_buf);
+    if (!root) {
+        for (int i = 0; i < n; i++) {
+            mbedtls_mpi_free(&outputs[i].r);
+            mbedtls_ecp_point_free(&outputs[i].Y);
+        }
+        free(outputs);
+        return ESP_FAIL;
+    }
+
+    cJSON *signatures = cJSON_GetObjectItemCaseSensitive(root, "signatures");
+    if (!signatures || !cJSON_IsArray(signatures)) {
+        ESP_LOGE(TAG, "No signatures in swap response");
+        cJSON_Delete(root);
+        for (int i = 0; i < n; i++) {
+            mbedtls_mpi_free(&outputs[i].r);
+            mbedtls_ecp_point_free(&outputs[i].Y);
+        }
+        free(outputs);
+        return ESP_FAIL;
+    }
+
+    for (int i = start_index; i < start_index + n; i++) {
+        s_wallet.balance -= s_wallet.proofs[i].amount;
+    }
+
+    int sig_count = cJSON_GetArraySize(signatures);
+    for (int i = 0; i < sig_count && i < n; i++) {
+        cJSON *sig = cJSON_GetArrayItem(signatures, i);
+        cJSON *c_ = cJSON_GetObjectItemCaseSensitive(sig, "C_");
+        cJSON *amt = cJSON_GetObjectItemCaseSensitive(sig, "amount");
+        cJSON *id = cJSON_GetObjectItemCaseSensitive(sig, "id");
+
+        if (!c_ || !cJSON_IsString(c_)) continue;
+
+        uint8_t c_bytes[33];
+        int c_len = hex_to_bytes(c_->valuestring, c_bytes, 33);
+
+        mbedtls_ecp_point C_;
+        mbedtls_ecp_point_init(&C_);
+        mbedtls_ecp_point_read_binary(&s_grp, &C_, c_bytes, c_len);
+
+        char ks_id[WALLET_KEYSET_ID_LEN] = {0};
+        if (id && cJSON_IsString(id)) {
+            strncpy(ks_id, id->valuestring, WALLET_KEYSET_ID_LEN - 1);
+        }
+
+        mbedtls_mpi neg_r;
+        mbedtls_mpi_init(&neg_r);
+        mbedtls_mpi_sub_mpi(&neg_r, &s_order, &outputs[i].r);
+
+        mbedtls_ecp_point neg_rG;
+        mbedtls_ecp_point_init(&neg_rG);
+        scalar_mul(&neg_r, &s_grp.G, &neg_rG);
+
+        mbedtls_ecp_point C;
+        mbedtls_ecp_point_init(&C);
+        point_add(&C_, &neg_rG, &C);
+
+        uint8_t c_final[33];
+        size_t c_final_len;
+        mbedtls_ecp_point_write_binary(&s_grp, &C, MBEDTLS_ECP_PF_COMPRESSED,
+                                        &c_final_len, c_final, 33);
+
+        if (s_wallet.proof_count < WALLET_MAX_PROOFS) {
+            wallet_proof_t *wp = &s_wallet.proofs[s_wallet.proof_count];
+            if (amt && cJSON_IsNumber(amt)) {
+                wp->amount = (uint64_t)amt->valuedouble;
+            }
+            strncpy(wp->id, ks_id, WALLET_KEYSET_ID_LEN - 1);
+            bytes_to_hex(outputs[i].secret, 32, wp->secret);
+            bytes_to_hex(c_final, c_final_len, wp->c);
+            s_wallet.balance += wp->amount;
+            s_wallet.proof_count++;
+        }
+
+        mbedtls_mpi_free(&neg_r);
+        mbedtls_ecp_point_free(&C_);
+        mbedtls_ecp_point_free(&neg_rG);
+        mbedtls_ecp_point_free(&C);
+    }
+
+    for (int i = 0; i < n; i++) {
+        int idx = start_index;
+        for (int j = idx; j < s_wallet.proof_count - 1; j++) {
+            memcpy(&s_wallet.proofs[j], &s_wallet.proofs[j + 1], sizeof(wallet_proof_t));
+        }
+        s_wallet.proof_count--;
+    }
+
+    for (int i = 0; i < n; i++) {
+        mbedtls_mpi_free(&outputs[i].r);
+        mbedtls_ecp_point_free(&outputs[i].Y);
+    }
+    free(outputs);
+    cJSON_Delete(root);
+
+    ESP_LOGI(TAG, "Swap complete: %d proofs swapped, balance=%llu",
+             n, (unsigned long long)s_wallet.balance);
+    wallet_persist_save();
+    return ESP_OK;
+}
+
+esp_err_t wallet_create_token(char *out, size_t out_size, uint64_t amount,
+                               const char *mint_url)
+{
+    if (s_wallet.proof_count == 0 || s_wallet.balance < amount) {
+        ESP_LOGE(TAG, "Insufficient balance: have=%llu need=%llu",
+                 (unsigned long long)s_wallet.balance, (unsigned long long)amount);
+        return ESP_FAIL;
+    }
+
+    cJSON *proofs_arr = cJSON_CreateArray();
+    uint64_t remaining = amount;
+    int indices_to_remove[10];
+    int remove_count = 0;
+
+    for (int i = 0; i < s_wallet.proof_count && remaining > 0 && remove_count < 10; i++) {
+        if (s_wallet.proofs[i].amount <= remaining) {
+            cJSON *p = cJSON_CreateObject();
+            cJSON_AddNumberToObject(p, "amount", (double)s_wallet.proofs[i].amount);
+            cJSON_AddStringToObject(p, "id", s_wallet.proofs[i].id);
+            cJSON_AddStringToObject(p, "secret", s_wallet.proofs[i].secret);
+            cJSON_AddStringToObject(p, "C", s_wallet.proofs[i].c);
+            cJSON_AddItemToArray(proofs_arr, p);
+            remaining -= s_wallet.proofs[i].amount;
+            indices_to_remove[remove_count++] = i;
+        }
+    }
+
+    if (remaining > 0) {
+        cJSON_Delete(proofs_arr);
+        ESP_LOGE(TAG, "Cannot make exact amount: %llu remaining", (unsigned long long)remaining);
+        return ESP_FAIL;
+    }
+
+    cJSON *token_obj = cJSON_CreateObject();
+    cJSON *token_arr = cJSON_CreateArray();
+    cJSON *mint_proofs = cJSON_CreateObject();
+    cJSON_AddStringToObject(mint_proofs, "mint", mint_url);
+    cJSON_AddItemToObject(mint_proofs, "proofs", proofs_arr);
+    cJSON_AddItemToArray(token_arr, mint_proofs);
+    cJSON_AddItemToObject(token_obj, "token", token_arr);
+
+    char *json_str = cJSON_PrintUnformatted(token_obj);
+    cJSON_Delete(token_obj);
+
+    size_t b64_len;
+    mbedtls_base64_encode((unsigned char *)out + 6, out_size - 6, &b64_len,
+                          (const unsigned char *)json_str, strlen(json_str));
+    free(json_str);
+
+    memcpy(out, "cashuA", 6);
+    for (size_t i = 0; i < b64_len; i++) {
+        if (out[6 + i] == '+') out[6 + i] = '-';
+        else if (out[6 + i] == '/') out[6 + i] = '_';
+        else if (out[6 + i] == '=') { out[6 + i] = '\0'; break; }
+    }
+    out[6 + b64_len] = '\0';
+
+    for (int i = remove_count - 1; i >= 0; i--) {
+        s_wallet.balance -= s_wallet.proofs[indices_to_remove[i]].amount;
+        for (int j = indices_to_remove[i]; j < s_wallet.proof_count - 1; j++) {
+            memcpy(&s_wallet.proofs[j], &s_wallet.proofs[j + 1], sizeof(wallet_proof_t));
+        }
+        s_wallet.proof_count--;
+    }
+
+    ESP_LOGI(TAG, "Created token for %llu sats, remaining balance=%llu",
+             (unsigned long long)amount, (unsigned long long)s_wallet.balance);
+    wallet_persist_save();
+    return ESP_OK;
+}
+
+esp_err_t wallet_send(const char *mint_url, uint64_t amount,
+                       char *token_out, size_t token_out_size)
+{
+    return wallet_create_token(token_out, token_out_size, amount, mint_url);
+}
+
+void wallet_print_status(void)
+{
+    ESP_LOGI(TAG, "Wallet: %d proofs, balance=%llu sats, %d keysets",
+             s_wallet.proof_count,
+             (unsigned long long)s_wallet.balance,
+             s_wallet.keyset_count);
+    for (int i = 0; i < s_wallet.proof_count; i++) {
+        ESP_LOGI(TAG, "  [%d] amount=%llu id=%s", i,
+                 (unsigned long long)s_wallet.proofs[i].amount,
+                 s_wallet.proofs[i].id);
+    }
+}
diff --git a/main/wallet.h b/main/wallet.h
new file mode 100644
index 0000000..5089f93
--- /dev/null
+++ b/main/wallet.h
@@ -0,0 +1,53 @@
+#ifndef WALLET_H
+#define WALLET_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define WALLET_MAX_PROOFS 50
+#define WALLET_MAX_KEYSETS 5
+#define WALLET_KEYSET_ID_LEN 68
+#define WALLET_SECRET_LEN 65
+#define WALLET_SIG_LEN 67
+
+typedef struct {
+    uint64_t amount;
+    char id[WALLET_KEYSET_ID_LEN];
+    char secret[WALLET_SECRET_LEN];
+    char c[WALLET_SIG_LEN];
+} wallet_proof_t;
+
+typedef struct {
+    char id[WALLET_KEYSET_ID_LEN];
+    char public_key_33[67];
+    uint64_t amount;
+    int input_fee_ppk;
+} wallet_keyset_t;
+
+typedef struct {
+    wallet_proof_t proofs[WALLET_MAX_PROOFS];
+    int proof_count;
+    wallet_keyset_t keysets[WALLET_MAX_KEYSETS];
+    int keyset_count;
+    uint64_t balance;
+} wallet_t;
+
+esp_err_t wallet_init(void);
+wallet_t *wallet_get(void);
+uint64_t wallet_balance(void);
+
+esp_err_t wallet_add_proofs(const wallet_proof_t *proofs, int count);
+esp_err_t wallet_remove_proof(int index);
+void wallet_clear(void);
+
+esp_err_t wallet_fetch_keysets(const char *mint_url);
+esp_err_t wallet_swap_proofs(const char *mint_url, int start_index, int count);
+
+esp_err_t wallet_create_token(char *out, size_t out_size, uint64_t amount,
+                               const char *mint_url);
+esp_err_t wallet_send(const char *mint_url, uint64_t amount,
+                       char *token_out, size_t token_out_size);
+
+void wallet_print_status(void);
+#endif
diff --git a/main/wallet_persist.c b/main/wallet_persist.c
new file mode 100644
index 0000000..45c932f
--- /dev/null
+++ b/main/wallet_persist.c
@@ -0,0 +1,147 @@
+#include "wallet_persist.h"
+#include "wallet.h"
+#include "config.h"
+#include "esp_log.h"
+#include "cJSON.h"
+#include <string.h>
+#include <stdio.h>
+#include <unistd.h>
+
+static const char *TAG = "wallet_persist";
+static const char *WALLET_FILE = "/spiffs/wallet.json";
+
+esp_err_t wallet_persist_save(void)
+{
+    const tollgate_config_t *cfg = tollgate_config_get();
+    wallet_t *w = wallet_get();
+
+    if (w->balance < cfg->persist_threshold_sats) {
+        if (w->proof_count == 0) {
+            unlink(WALLET_FILE);
+            ESP_LOGI(TAG, "Wallet empty, removed persist file");
+        }
+        return ESP_OK;
+    }
+
+    cJSON *root = cJSON_CreateObject();
+    cJSON_AddNumberToObject(root, "balance", (double)w->balance);
+
+    cJSON *proofs = cJSON_CreateArray();
+    for (int i = 0; i < w->proof_count; i++) {
+        cJSON *p = cJSON_CreateObject();
+        cJSON_AddNumberToObject(p, "amount", (double)w->proofs[i].amount);
+        cJSON_AddStringToObject(p, "id", w->proofs[i].id);
+        cJSON_AddStringToObject(p, "secret", w->proofs[i].secret);
+        cJSON_AddStringToObject(p, "C", w->proofs[i].c);
+        cJSON_AddItemToArray(proofs, p);
+    }
+    cJSON_AddItemToObject(root, "proofs", proofs);
+
+    cJSON *keysets = cJSON_CreateArray();
+    for (int i = 0; i < w->keyset_count; i++) {
+        cJSON *ks = cJSON_CreateObject();
+        cJSON_AddStringToObject(ks, "id", w->keysets[i].id);
+        cJSON_AddItemToArray(keysets, ks);
+    }
+    cJSON_AddItemToObject(root, "keysets", keysets);
+
+    char *json_str = cJSON_PrintUnformatted(root);
+    cJSON_Delete(root);
+
+    FILE *f = fopen(WALLET_FILE, "w");
+    if (!f) {
+        ESP_LOGE(TAG, "Failed to open %s for writing", WALLET_FILE);
+        cJSON_free(json_str);
+        return ESP_FAIL;
+    }
+
+    size_t written = fwrite(json_str, 1, strlen(json_str), f);
+    fclose(f);
+    cJSON_free(json_str);
+
+    ESP_LOGI(TAG, "Wallet persisted: %d proofs, balance=%llu (%zu bytes)",
+             w->proof_count, (unsigned long long)w->balance, written);
+    return ESP_OK;
+}
+
+esp_err_t wallet_persist_load(void)
+{
+    wallet_t *w = wallet_get();
+
+    FILE *f = fopen(WALLET_FILE, "r");
+    if (!f) {
+        ESP_LOGI(TAG, "No persisted wallet found, starting fresh");
+        return ESP_OK;
+    }
+
+    fseek(f, 0, SEEK_END);
+    long fsize = ftell(f);
+    fseek(f, 0, SEEK_SET);
+
+    if (fsize <= 0 || fsize > 65536) {
+        fclose(f);
+        ESP_LOGW(TAG, "Wallet file size invalid: %ld", fsize);
+        return ESP_FAIL;
+    }
+
+    char *buf = malloc(fsize + 1);
+    if (!buf) {
+        fclose(f);
+        return ESP_ERR_NO_MEM;
+    }
+
+    fread(buf, 1, fsize, f);
+    buf[fsize] = '\0';
+    fclose(f);
+
+    cJSON *root = cJSON_Parse(buf);
+    free(buf);
+    if (!root) {
+        ESP_LOGE(TAG, "Failed to parse wallet.json");
+        return ESP_FAIL;
+    }
+
+    cJSON *balance_j = cJSON_GetObjectItemCaseSensitive(root, "balance");
+    if (balance_j && cJSON_IsNumber(balance_j)) {
+        w->balance = (uint64_t)balance_j->valuedouble;
+    }
+
+    cJSON *proofs = cJSON_GetObjectItemCaseSensitive(root, "proofs");
+    if (proofs && cJSON_IsArray(proofs)) {
+        int count = cJSON_GetArraySize(proofs);
+        if (count > WALLET_MAX_PROOFS) count = WALLET_MAX_PROOFS;
+        for (int i = 0; i < count; i++) {
+            cJSON *p = cJSON_GetArrayItem(proofs, i);
+            cJSON *amt = cJSON_GetObjectItemCaseSensitive(p, "amount");
+            cJSON *id = cJSON_GetObjectItemCaseSensitive(p, "id");
+            cJSON *secret = cJSON_GetObjectItemCaseSensitive(p, "secret");
+            cJSON *c = cJSON_GetObjectItemCaseSensitive(p, "C");
+            if (amt) w->proofs[i].amount = (uint64_t)amt->valuedouble;
+            if (id && cJSON_IsString(id))
+                strncpy(w->proofs[i].id, id->valuestring, WALLET_KEYSET_ID_LEN - 1);
+            if (secret && cJSON_IsString(secret))
+                strncpy(w->proofs[i].secret, secret->valuestring, WALLET_SECRET_LEN - 1);
+            if (c && cJSON_IsString(c))
+                strncpy(w->proofs[i].c, c->valuestring, WALLET_SIG_LEN - 1);
+            w->proof_count++;
+        }
+    }
+
+    cJSON *keysets = cJSON_GetObjectItemCaseSensitive(root, "keysets");
+    if (keysets && cJSON_IsArray(keysets)) {
+        int count = cJSON_GetArraySize(keysets);
+        if (count > WALLET_MAX_KEYSETS) count = WALLET_MAX_KEYSETS;
+        for (int i = 0; i < count; i++) {
+            cJSON *ks = cJSON_GetArrayItem(keysets, i);
+            cJSON *id = cJSON_GetObjectItemCaseSensitive(ks, "id");
+            if (id && cJSON_IsString(id))
+                strncpy(w->keysets[i].id, id->valuestring, WALLET_KEYSET_ID_LEN - 1);
+            w->keyset_count++;
+        }
+    }
+
+    cJSON_Delete(root);
+    ESP_LOGI(TAG, "Wallet loaded: %d proofs, %d keysets, balance=%llu",
+             w->proof_count, w->keyset_count, (unsigned long long)w->balance);
+    return ESP_OK;
+}
diff --git a/main/wallet_persist.h b/main/wallet_persist.h
new file mode 100644
index 0000000..4dfcbfc
--- /dev/null
+++ b/main/wallet_persist.h
@@ -0,0 +1,9 @@
+#ifndef WALLET_PERSIST_H
+#define WALLET_PERSIST_H
+
+#include "esp_err.h"
+
+esp_err_t wallet_persist_save(void);
+esp_err_t wallet_persist_load(void);
+
+#endif