Phase 7: eliminate shims - consumer files use component headers directly

- Deleted standalone shims: session.c/h, cashu.c/h, mining_payment.c/h, firewall.c/h
- Updated captive_portal.c, tollgate_api.c, tollgate_main.c, mcp_handler.c,
  cvm_server.c, sw_miner.c, stratum_client.c to include component headers
- Moved tollgate_ip4_canforward_filter() lwIP hook into tollgate_main.c
- Fixed all unit tests to use component API (test_cashu, test_session,
  test_mining_payment, test_stratum_proxy, test_session_payment_method,
  test_firewall_sandbox, test_mcp_handler)
- Removed deleted source files from Makefile targets
- All 21 unit tests pass, ESP-IDF build passes

16 files changed, 67 insertions, 466 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 3a8613d..1f127c0 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -2,9 +2,6 @@ idf_component_register(SRCS "tollgate_main.c"
                             "config.c"
                             "dns_server.c"
                             "captive_portal.c"
-                            "firewall.c"
-                            "cashu.c"
-                            "session.c"
                             "tollgate_api.c"
                             "identity.c"
                             "nostr_event.c"
@@ -26,7 +23,6 @@ idf_component_register(SRCS "tollgate_main.c"
                             "beacon_price.c"
                             "market.c"
                             "negentropy_adapter.c"
-                            "mining_payment.c"
                             "stratum_client.c"
                             "stratum_proxy.c"
                             "sw_miner.c"
diff --git a/main/captive_portal.c b/main/captive_portal.c
index 9a0a5ff..f95a791 100644
--- a/main/captive_portal.c
+++ b/main/captive_portal.c
@@ -1,8 +1,8 @@
 #include "captive_portal.h"
-#include "firewall.h"
-#include "session.h"
+#include "tollgate_core.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_session.h"
 #include "config.h"
-#include "mining_payment.h"
 #include "stratum_proxy.h"
 #include "esp_log.h"
 #include "esp_wifi.h"
@@ -253,7 +253,7 @@ static esp_err_t grant_access_handler(httpd_req_t *req)
 {
     uint32_t client_ip;
     if (get_client_ip(req, &client_ip) == ESP_OK) {
-        firewall_grant_access(client_ip);
+        tollgate_core_fw_grant(client_ip);
     }
     const char *resp = "{\"status\":\"granted\"}";
     httpd_resp_set_type(req, "application/json");
@@ -282,7 +282,7 @@ static esp_err_t whoami_handler(httpd_req_t *req)
     if (get_client_ip(req, &client_ip) == ESP_OK) {
         char mac[18] = {0};
         esp_ip4_addr_t ip = { .addr = client_ip };
-        if (firewall_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
+        if (tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=%s", IP2STR(&ip), mac);
         } else {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=unknown", IP2STR(&ip));
@@ -304,7 +304,7 @@ static esp_err_t usage_handler(httpd_req_t *req)
         return ESP_OK;
     }
 
-    session_t *session = session_find_by_ip(client_ip);
+    tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
     if (!session || !session->active) {
         httpd_resp_set_type(req, "text/plain");
         httpd_resp_send(req, "-1/-1", 5);
@@ -332,8 +332,8 @@ static esp_err_t usage_handler(httpd_req_t *req)
 
 static esp_err_t reset_auth_handler(httpd_req_t *req)
 {
-    session_revoke_all();
-    firewall_revoke_all();
+    tollgate_core_session_revoke_all();
+    tollgate_core_fw_revoke_all();
     const char *resp = "{\"status\":\"reset\"}";
     httpd_resp_set_type(req, "application/json");
     httpd_resp_send(req, resp, strlen(resp));
diff --git a/main/cashu.c b/main/cashu.c
deleted file mode 100644
index 2da6a05..0000000
--- a/main/cashu.c
+++ /dev/null
@@ -1,44 +0,0 @@
-#include "cashu.h"
-#include "tollgate_core_cashu.h"
-#include "tollgate_core.h"
-#include "config.h"
-#include "esp_log.h"
-
-static const char *TAG = "cashu";
-
-esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out)
-{
-    return tollgate_core_cashu_decode_token(token_str, (tg_cashu_token_t *)out);
-}
-
-esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
-                                   cashu_proof_state_t *states, int *state_count)
-{
-    return tollgate_core_cashu_check_proof_states(mint_url, (const tg_cashu_token_t *)token,
-                                                   (tg_cashu_proof_state_t *)states, state_count);
-}
-
-uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
-                                       uint64_t step_size_ms)
-{
-    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size_ms);
-}
-
-uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
-                                    const char *metric, uint64_t step_size)
-{
-    (void)metric;
-    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size);
-}
-
-bool cashu_is_mint_accepted(const char *mint_url)
-{
-    const tollgate_config_t *cfg = tollgate_config_get();
-    if (cfg) {
-        for (int i = 0; i < cfg->accepted_mint_count; i++) {
-            if (tollgate_core_cashu_is_mint_accepted(mint_url, cfg->accepted_mints[i]))
-                return true;
-        }
-    }
-    return false;
-}
diff --git a/main/cashu.h b/main/cashu.h
deleted file mode 100644
index 43be033..0000000
--- a/main/cashu.h
+++ /dev/null
@@ -1,41 +0,0 @@
-#ifndef CASHU_H
-#define CASHU_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define CASHU_MAX_PROOFS      10
-#define CASHU_MAX_SECRET_LEN  128
-#define CASHU_MAX_ID_LEN      68
-#define CASHU_MAX_C_LEN       128
-
-typedef struct {
-    uint64_t amount;
-    char id[CASHU_MAX_ID_LEN];
-    char secret[CASHU_MAX_SECRET_LEN];
-    char c[CASHU_MAX_C_LEN];
-} cashu_proof_t;
-
-typedef struct {
-    cashu_proof_t proofs[CASHU_MAX_PROOFS];
-    int proof_count;
-    char mint_url[256];
-    uint64_t total_amount;
-} cashu_token_t;
-
-typedef struct {
-    char y_hex[65];
-    bool spent;
-} cashu_proof_state_t;
-
-esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out);
-esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
-                                   cashu_proof_state_t *states, int *state_count);
-uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
-                                       uint64_t step_size_ms);
-uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
-                                    const char *metric, uint64_t step_size);
-bool cashu_is_mint_accepted(const char *mint_url);
-
-#endif
diff --git a/main/cvm_server.c b/main/cvm_server.c
index 1ac5cb6..5f59a77 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -4,7 +4,7 @@
 #include "identity.h"
 #include "nostr_event.h"
 #include "config.h"
-#include "session.h"
+#include "tollgate_core_session.h"
 #include "nucula_wallet.h"
 #include "cJSON.h"
 #include "esp_log.h"
diff --git a/main/firewall.c b/main/firewall.c
deleted file mode 100644
index 5ffdee0..0000000
--- a/main/firewall.c
+++ /dev/null
@@ -1,66 +0,0 @@
-#include "firewall.h"
-#include "tollgate_core.h"
-#include "tollgate_core_firewall.h"
-#include "esp_log.h"
-#include "lwip/prot/ip4.h"
-#include <string.h>
-
-static const char *TAG = "firewall";
-static esp_ip4_addr_t s_ap_ip;
-
-esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
-{
-    s_ap_ip = ap_ip;
-    ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR, IP2STR(&s_ap_ip));
-    return ESP_OK;
-}
-
-void firewall_set_mining_port(uint16_t port)
-{
-    tollgate_core_fw_set_sandbox_ports(port);
-}
-
-void firewall_set_sandbox_mint_access(bool enabled)
-{
-    tollgate_core_fw_set_sandbox_mint_access(enabled);
-}
-
-esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size)
-{
-    return tollgate_core_fw_get_mac_for_ip(client_ip, mac_out, mac_out_size);
-}
-
-int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
-{
-    return tollgate_core_ip4_canforward_filter(p, dest_addr_hostorder);
-}
-
-void firewall_grant_access(uint32_t client_ip)
-{
-    tollgate_core_fw_grant(client_ip);
-}
-
-void firewall_revoke_access(uint32_t client_ip)
-{
-    tollgate_core_fw_revoke(client_ip);
-}
-
-void firewall_revoke_all(void)
-{
-    tollgate_core_fw_revoke_all();
-}
-
-bool firewall_is_client_allowed(uint32_t client_ip)
-{
-    return tollgate_core_is_client_allowed(client_ip);
-}
-
-bool firewall_is_mac_allowed(const char *mac)
-{
-    return tollgate_core_fw_is_mac_allowed(mac);
-}
-
-int firewall_client_count(void)
-{
-    return tollgate_core_allowed_client_count();
-}
diff --git a/main/firewall.h b/main/firewall.h
deleted file mode 100644
index 8d6e1c1..0000000
--- a/main/firewall.h
+++ /dev/null
@@ -1,26 +0,0 @@
-#ifndef FIREWALL_H
-#define FIREWALL_H
-
-#include "esp_err.h"
-#include "esp_netif.h"
-#include <stdbool.h>
-#include <stdint.h>
-
-struct pbuf;
-
-#define FW_MAX_MAC_LEN 18
-
-esp_err_t firewall_init(esp_ip4_addr_t ap_ip);
-void firewall_set_mining_port(uint16_t port);
-void firewall_set_sandbox_mint_access(bool enabled);
-void firewall_grant_access(uint32_t client_ip);
-void firewall_revoke_access(uint32_t client_ip);
-void firewall_revoke_all(void);
-bool firewall_is_client_allowed(uint32_t client_ip);
-bool firewall_is_mac_allowed(const char *mac);
-int firewall_client_count(void);
-esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size);
-
-int tollgate_ip4_canforward_filter(struct pbuf *p, uint32_t dest_addr_hostorder);
-
-#endif
diff --git a/main/mcp_handler.c b/main/mcp_handler.c
index 93bfba9..5f5d494 100644
--- a/main/mcp_handler.c
+++ b/main/mcp_handler.c
@@ -1,7 +1,8 @@
 #include "mcp_handler.h"
 #include "config.h"
 #include "nucula_wallet.h"
-#include "session.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core.h"
 #include "cJSON.h"
 #include "lwip/ip4_addr.h"
 #include <string.h>
@@ -157,12 +158,10 @@ mcp_response_t mcp_handle_wallet_send(const char *params_json)
 mcp_response_t mcp_handle_get_sessions(void)
 {
     mcp_response_t resp = {0};
-    extern session_t *cvm_get_sessions_array(void);
-    extern int cvm_get_sessions_count(void);
 
     cJSON *arr = cJSON_CreateArray();
-    int count = cvm_get_sessions_count();
-    session_t *sessions = cvm_get_sessions_array();
+    int count = tollgate_core_session_get_array_size();
+    tg_session_t *sessions = tollgate_core_session_get_array();
 
     if (sessions && count > 0) {
         for (int i = 0; i < count; i++) {
diff --git a/main/mining_payment.c b/main/mining_payment.c
deleted file mode 100644
index f9d01b6..0000000
--- a/main/mining_payment.c
+++ /dev/null
@@ -1,66 +0,0 @@
-#include "mining_payment.h"
-#include "tollgate_core_mining.h"
-#include "tollgate_core.h"
-#include "esp_log.h"
-
-static const char *TAG = "mining_payment";
-
-uint64_t mining_nbits_to_difficulty(uint32_t nbits)
-{
-    return tollgate_core_mining_nbits_to_difficulty(nbits);
-}
-
-double mining_calculate_hashprice(uint32_t nbits)
-{
-    return tollgate_core_mining_calc_hashprice(nbits);
-}
-
-double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day)
-{
-    return tollgate_core_mining_calc_hashprice_override(sats_per_ghs_day);
-}
-
-esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len)
-{
-    return tollgate_core_mining_validate_share(header80, nonce, target, target_len);
-}
-
-uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms)
-{
-    return tollgate_core_mining_shares_to_allotment_ms(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_ms);
-}
-
-uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes)
-{
-    return tollgate_core_mining_shares_to_allotment_bytes(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_bytes);
-}
-
-mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip)
-{
-    return (mining_client_stats_t *)tollgate_core_mining_get_or_create_client(client_ip);
-}
-
-void mining_update_hashrate(uint32_t client_ip, bool accepted)
-{
-    tollgate_core_mining_update_hashrate(client_ip, accepted);
-}
-
-const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip)
-{
-    return (const mining_client_stats_t *)tollgate_core_mining_get_client_stats(client_ip);
-}
-
-double mining_get_current_hashprice(void)
-{
-    return tollgate_core_mining_get_current_hashprice();
-}
-
-void mining_set_current_nbits(uint32_t nbits)
-{
-    tollgate_core_mining_set_current_nbits(nbits);
-}
-
-void mining_payment_init(void)
-{
-    ESP_LOGI(TAG, "Mining payment initialized (via tollgate_core)");
-}
diff --git a/main/mining_payment.h b/main/mining_payment.h
deleted file mode 100644
index c5ce0f2..0000000
--- a/main/mining_payment.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef MINING_PAYMENT_H
-#define MINING_PAYMENT_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define MINING_SHARE_WINDOW_S 30
-#define MINING_BLOCK_SUBSIDY_SATS 312500000ULL
-#define MINING_BLOCKS_PER_DAY 144ULL
-#define MINING_MAX_CLIENTS 10
-
-typedef struct {
-    uint32_t ip;
-    uint64_t shares_accepted;
-    uint64_t shares_rejected;
-    int64_t first_share_time_ms;
-    int64_t last_share_time_ms;
-    double hashrate_ghs;
-} mining_client_stats_t;
-
-uint64_t mining_nbits_to_difficulty(uint32_t nbits);
-double mining_calculate_hashprice(uint32_t nbits);
-double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day);
-esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len);
-uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms);
-uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes);
-mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip);
-void mining_update_hashrate(uint32_t client_ip, bool accepted);
-const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip);
-double mining_get_current_hashprice(void);
-void mining_set_current_nbits(uint32_t nbits);
-void mining_payment_init(void);
-
-#endif
diff --git a/main/session.c b/main/session.c
deleted file mode 100644
index 3e3813a..0000000
--- a/main/session.c
+++ /dev/null
@@ -1,86 +0,0 @@
-#include "session.h"
-#include "tollgate_core_session.h"
-#include "tollgate_core_firewall.h"
-#include "tollgate_core.h"
-#include "esp_log.h"
-#include "freertos/FreeRTOS.h"
-#include "freertos/task.h"
-#include <string.h>
-
-static const char *TAG = "session";
-
-esp_err_t session_manager_init(void)
-{
-    tollgate_core_session_init();
-    ESP_LOGI(TAG, "Session manager initialized (via tollgate_core)");
-    return ESP_OK;
-}
-
-session_t *session_create(uint32_t client_ip, uint64_t allotment_ms)
-{
-    return (session_t *)tollgate_core_session_create(client_ip, allotment_ms);
-}
-
-session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes)
-{
-    return (session_t *)tollgate_core_session_create_bytes(client_ip, allotment_bytes);
-}
-
-void session_add_bytes(uint32_t client_ip, uint64_t bytes)
-{
-    tollgate_core_session_add_bytes(client_ip, bytes);
-}
-
-session_t *session_find_by_ip(uint32_t client_ip)
-{
-    return (session_t *)tollgate_core_session_find_by_ip(client_ip);
-}
-
-session_t *session_find_by_mac(const char *mac)
-{
-    return (session_t *)tollgate_core_session_find_by_mac(mac);
-}
-
-void session_extend(session_t *session, uint64_t additional_ms)
-{
-    tollgate_core_session_extend((tg_session_t *)session, additional_ms);
-}
-
-bool session_is_expired(const session_t *session)
-{
-    return tollgate_core_session_is_expired((const tg_session_t *)session);
-}
-
-void session_check_expiry(void)
-{
-}
-
-void session_revoke(session_t *session)
-{
-    tollgate_core_session_revoke((tg_session_t *)session);
-}
-
-void session_revoke_all(void)
-{
-    tollgate_core_session_revoke_all();
-}
-
-int session_active_count(void)
-{
-    return tollgate_core_active_session_count();
-}
-
-void session_tick(void)
-{
-    tollgate_core_tick();
-}
-
-session_t *cvm_get_sessions_array(void)
-{
-    return (session_t *)tollgate_core_session_get_array();
-}
-
-int cvm_get_sessions_count(void)
-{
-    return tollgate_core_session_get_array_size();
-}
diff --git a/main/session.h b/main/session.h
deleted file mode 100644
index 8f6b991..0000000
--- a/main/session.h
+++ /dev/null
@@ -1,44 +0,0 @@
-#ifndef SESSION_H
-#define SESSION_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define SESSION_MAX_CLIENTS     10
-#define SESSION_MAX_MAC_LEN     18
-
-typedef enum {
-    PAYMENT_METHOD_CASHU,
-    PAYMENT_METHOD_MINING,
-    PAYMENT_METHOD_BYTES
-} payment_method_t;
-
-typedef struct {
-    uint32_t client_ip;
-    char mac[SESSION_MAX_MAC_LEN];
-    uint64_t allotment_ms;
-    int64_t start_time_ms;
-    uint64_t allotment_bytes;
-    uint64_t bytes_consumed;
-    payment_method_t payment_method;
-    bool active;
-} session_t;
-
-esp_err_t session_manager_init(void);
-session_t *session_create(uint32_t client_ip, uint64_t allotment_ms);
-session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes);
-void session_add_bytes(uint32_t client_ip, uint64_t bytes);
-session_t *session_find_by_ip(uint32_t client_ip);
-session_t *session_find_by_mac(const char *mac);
-void session_extend(session_t *session, uint64_t additional_ms);
-bool session_is_expired(const session_t *session);
-void session_check_expiry(void);
-void session_revoke(session_t *session);
-void session_revoke_all(void);
-int session_active_count(void);
-void session_tick(void);
-session_t *cvm_get_sessions_array(void);
-int cvm_get_sessions_count(void);
-
-#endif
diff --git a/main/stratum_client.c b/main/stratum_client.c
index cf88daf..a308a5b 100644
--- a/main/stratum_client.c
+++ b/main/stratum_client.c
@@ -1,6 +1,6 @@
 #include "stratum_client.h"
 #include "stratum_proxy.h"
-#include "mining_payment.h"
+#include "tollgate_core_mining.h"
 #include "config.h"
 #include "esp_log.h"
 #include "esp_transport.h"
@@ -124,7 +124,7 @@ static void handle_mining_notify(cJSON *params)
     memset(job.target, 0xFF, 32);
     job.target_len = 32;
 
-    mining_set_current_nbits(job.nbits);
+    tollgate_core_mining_set_current_nbits(job.nbits);
     stratum_proxy_set_job(&job);
 
     ESP_LOGI(TAG, "New mining job: id=%lu, nbits=0x%08lx", (unsigned long)job.job_id, (unsigned long)job.nbits);
diff --git a/main/sw_miner.c b/main/sw_miner.c
index cdd98a0..9d7ea36 100644
--- a/main/sw_miner.c
+++ b/main/sw_miner.c
@@ -1,7 +1,7 @@
 #include "sw_miner.h"
 #include "stratum_proxy.h"
 #include "stratum_client.h"
-#include "mining_payment.h"
+#include "tollgate_core_mining.h"
 #include "config.h"
 #include "esp_log.h"
 #include "esp_random.h"
@@ -60,7 +60,7 @@ static void sw_miner_task(void *arg)
             if (memcmp(hash, local_job.target, local_job.target_len) <= 0) {
                 ESP_LOGI(TAG, "Valid share found! nonce=%08lx", (unsigned long)nonce);
                 stratum_client_submit_share(local_job.job_id, nonce, local_job.ntime, local_job.version);
-                mining_update_hashrate(0, true);
+                tollgate_core_mining_update_hashrate(0, true);
                 break;
             }
         }
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index 4e9de43..58c123c 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -1,16 +1,18 @@
 #include "tollgate_api.h"
-#include "cashu.h"
+#include "tollgate_core_cashu.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_mining.h"
+#include "tollgate_core.h"
 #include "config.h"
 #include "identity.h"
-#include "session.h"
 #include "captive_portal.h"
-#include "firewall.h"
 #include "lwip/dns.h"
 #include "esp_heap_caps.h"
 #include "nucula_wallet.h"
 #include "mint_health.h"
 #include "market.h"
-#include "mining_payment.h"
+
 #include "stratum_proxy.h"
 #include "stratum_client.h"
 #include "tls_worker.h"
@@ -226,7 +228,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
 
     ESP_LOGI(TAG, "Payment received: %d bytes", total);
 
-    cashu_token_t *token = malloc(sizeof(cashu_token_t));
+    tg_cashu_token_t *token = malloc(sizeof(tg_cashu_token_t));
     if (!token) {
         cJSON *notice = create_notice("error", "session-error", "Out of memory");
         char *json = cJSON_PrintUnformatted(notice);
@@ -237,7 +239,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         cJSON_Delete(notice);
         return ESP_OK;
     }
-    esp_err_t err = cashu_decode_token(body, token);
+    esp_err_t err = tollgate_core_cashu_decode_token(body, token);
     char *body_copy = strdup(body);
     free(body);
 
@@ -254,7 +256,17 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     }
 
     const char *mint_url = token->mint_url[0] ? token->mint_url : tollgate_config_get()->mint_url;
-    if (!cashu_is_mint_accepted(mint_url)) {
+    bool mint_accepted = false;
+    {
+        const tollgate_config_t *_cfg = tollgate_config_get();
+        for (int i = 0; i < _cfg->accepted_mint_count; i++) {
+            if (tollgate_core_cashu_is_mint_accepted(mint_url, _cfg->accepted_mints[i])) {
+                mint_accepted = true;
+                break;
+            }
+        }
+    }
+    if (!mint_accepted) {
         free(token);
         cJSON *notice = create_notice("error", "payment-error-mint-not-accepted", "Mint not accepted");
         char *json = cJSON_PrintUnformatted(notice);
@@ -266,7 +278,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
 
-    cashu_proof_state_t *states = malloc(CASHU_MAX_PROOFS * sizeof(cashu_proof_state_t));
+    tg_cashu_proof_state_t *states = malloc(TG_CASHU_MAX_PROOFS * sizeof(tg_cashu_proof_state_t));
     if (!states) {
         free(token);
         cJSON *notice = create_notice("error", "session-error", "Out of memory");
@@ -279,7 +291,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
     int state_count = 0;
-    err = cashu_check_proof_states(mint_url, token, states, &state_count);
+    err = tollgate_core_cashu_check_proof_states(mint_url, token, states, &state_count);
     ESP_LOGI(TAG, "Stack HWM after checkstate: %u", uxTaskGetStackHighWaterMark(NULL));
     if (err != ESP_OK) {
         ESP_LOGW(TAG, "Checkstate failed, proceeding without spend check (wallet swap will verify)");
@@ -304,8 +316,8 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     const tollgate_config_t *cfg = tollgate_config_get();
     bool is_bytes = (strcmp(cfg->metric, "bytes") == 0);
     uint64_t step_size = is_bytes ? (uint64_t)cfg->step_size_bytes : (uint64_t)cfg->step_size_ms;
-    uint64_t allotment = cashu_calculate_allotment(token->total_amount, cfg->price_per_step,
-                                                    cfg->metric, step_size);
+    uint64_t allotment = tollgate_core_cashu_calculate_allotment(token->total_amount, cfg->price_per_step,
+                                                    step_size);
     if (allotment == 0) {
         free(states);
         free(token);
@@ -319,11 +331,11 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
 
-    session_t *session;
+    tg_session_t *session;
     if (is_bytes) {
-        session = session_create_bytes(client_ip, allotment);
+        session = tollgate_core_session_create_bytes(client_ip, allotment);
     } else {
-        session = session_create(client_ip, allotment);
+        session = tollgate_core_session_create(client_ip, allotment);
     }
     if (!session) {
         free(states);
@@ -357,7 +369,7 @@ static esp_err_t api_get_usage(httpd_req_t *req)
     uint32_t client_ip = 0;
     get_client_ip(req, &client_ip);
 
-    session_t *session = session_find_by_ip(client_ip);
+    tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
     if (!session || !session->active) {
         httpd_resp_set_type(req, "text/plain");
         httpd_resp_send(req, "-1/-1", 5);
@@ -390,7 +402,7 @@ static esp_err_t api_get_whoami(httpd_req_t *req)
     if (get_client_ip(req, &client_ip) == ESP_OK) {
         char mac[18] = {0};
         esp_ip4_addr_t ip = { .addr = client_ip };
-        if (firewall_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
+        if (tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=%s", IP2STR(&ip), mac);
         } else {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=unknown", IP2STR(&ip));
@@ -546,7 +558,7 @@ static esp_err_t api_get_mining_job(httpd_req_t *req)
     cJSON_AddNumberToObject(root, "version", job->version);
     cJSON_AddNumberToObject(root, "nbits", job->nbits);
     cJSON_AddNumberToObject(root, "ntime", job->ntime);
-    cJSON_AddNumberToObject(root, "hashprice", mining_get_current_hashprice());
+    cJSON_AddNumberToObject(root, "hashprice", tollgate_core_mining_get_current_hashprice());
 
     char *json = cJSON_PrintUnformatted(root);
     httpd_resp_set_type(req, "application/json");
@@ -620,21 +632,21 @@ static esp_err_t api_post_mining_share(httpd_req_t *req)
     esp_err_t share_err = stratum_client_submit_share(job_id, nonce, ntime, version);
     bool accepted = (share_err == ESP_OK);
 
-    mining_update_hashrate(client_ip, accepted);
-    mining_client_stats_t *stats = mining_get_or_create_client(client_ip);
+    tollgate_core_mining_update_hashrate(client_ip, accepted);
+    tollgate_mining_client_stats_t *stats = tollgate_core_mining_get_or_create_client(client_ip);
 
     if (accepted) {
         const tollgate_config_t *cfg = tollgate_config_get();
-        double hashprice = mining_get_current_hashprice();
-        uint64_t allotment_ms = mining_shares_to_allotment_ms(
+        double hashprice = tollgate_core_mining_get_current_hashprice();
+        uint64_t allotment_ms = tollgate_core_mining_shares_to_allotment_ms(
             stats->hashrate_ghs, hashprice, cfg->price_per_step, cfg->step_size_ms);
 
-        session_t *session = session_find_by_ip(client_ip);
-        if (!session || !session->active || session->payment_method != PAYMENT_METHOD_MINING) {
-            session = session_create(client_ip, allotment_ms);
-            if (session) session->payment_method = PAYMENT_METHOD_MINING;
+        tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
+        if (!session || !session->active || session->payment_method != TG_PAYMENT_MINING) {
+            session = tollgate_core_session_create(client_ip, allotment_ms);
+            if (session) session->payment_method = TG_PAYMENT_MINING;
         } else {
-            session_extend(session, allotment_ms);
+            tollgate_core_session_extend(session, allotment_ms);
         }
     }
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 2d1f657..dc7453d 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -13,13 +13,13 @@
 #include "esp_sntp.h"
 #include "dhcpserver/dhcpserver.h"
 #include "tollgate_core.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_mining.h"
 #include "tollgate_esp_platform.h"
 #include "config.h"
 #include "identity.h"
 #include "dns_server.h"
 #include "captive_portal.h"
-#include "firewall.h"
-#include "session.h"
 #include "tollgate_api.h"
 #include "nucula_wallet.h"
 #include "wifistr.h"
@@ -37,7 +37,12 @@
 #include "stratum_proxy.h"
 #include "sw_miner.h"
 #include "asic_miner.h"
-#include "mining_payment.h"
+#include "lwip/prot/ip4.h"
+
+int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
+{
+    return tollgate_core_ip4_canforward_filter(p, dest_addr_hostorder);
+}
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -236,8 +241,6 @@ static void start_services(void)
              IP2STR(&(esp_ip4_addr_t){.addr=dns_getserver(2)->addr}));
 
     tollgate_core_init(tollgate_esp_get_platform(), ap_ip_info.ip);
-    firewall_init(ap_ip_info.ip);
-    session_manager_init();
 
     const tollgate_config_t *cfg = tollgate_config_get();
 
@@ -256,8 +259,8 @@ static void start_services(void)
     }
 
     if (cfg->mining_enabled) {
-        firewall_set_mining_port(cfg->mining_port);
-        firewall_set_sandbox_mint_access(cfg->mining_sandbox_mint_access);
+        tollgate_core_fw_set_sandbox_ports(cfg->mining_port);
+        tollgate_core_fw_set_sandbox_mint_access(cfg->mining_sandbox_mint_access);
     }
     lightning_payout_init(&cfg->payout);
 
@@ -279,7 +282,6 @@ static void start_services(void)
 
     if (cfg->mining_enabled) {
         ESP_LOGI(TAG, "Mining subsystem enabled, initializing...");
-        mining_payment_init();
         stratum_client_init();
         stratum_proxy_init(cfg->mining_port);
 
@@ -327,7 +329,7 @@ static void stop_services(void)
     sync_manager_stop(&s_sync_manager);
     local_relay_stop();
     relay_selector_destroy(&s_relay_selector);
-    firewall_revoke_all();
+    tollgate_core_fw_revoke_all();
     s_services_running = false;
     if (s_services_mutex) xSemaphoreGive(s_services_mutex);
     ESP_LOGI(TAG, "=== TollGate services stopped ===");
@@ -462,7 +464,7 @@ void app_main(void)
 
     while (1) {
         vTaskDelay(pdMS_TO_TICKS(1000));
-        session_tick();
+        tollgate_core_tick();
         tollgate_client_tick();
         lightning_payout_tick();
         market_tick();