Phase 5: Wire main/ shims to components/tollgate_core

- session.c/h: thin shim casting session_t* <-> tg_session_t*, delegates to tollgate_core_session_*
- firewall.c/h: keeps ESP-specific lwIP hooks, delegates allowlist to tollgate_core_fw_*
- cashu.c/h: shim delegates to tollgate_core_cashu_*, multi-mint via config directly
- mining_payment.c: shim delegates to tollgate_core_mining_*
- tollgate_main.c: calls tollgate_core_init(tollgate_esp_get_platform(), ap_ip) in start_services()
- tollgate_esp: removed target_sources for standalone sources, depends on tollgate_core component
- tollgate_core component: added tollgate_core_get_platform(), tg_payment_method_t enum
- Unit tests: updated Makefile for component source compilation, all 22 tests pass
- Hardware verified: Board A boots, AP visible, 5/6 smoke tests pass (internet test needs upstream WiFi)

9 files changed, 73 insertions, 614 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 9e76f89..da90967 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -30,13 +30,12 @@ idf_component_register(SRCS "tollgate_main.c"
                             "stratum_proxy.c"
                             "sw_miner.c"
                             "asic_miner.c"
-                            "tollgate_platform.c"
                             "touch.c"
                             "keyboard.c"
                             "wifi_setup.c"
                     INCLUDE_DIRS "."
                      REQUIRES esp_wifi esp_event esp_netif nvs_flash esp_http_server
-                              lwip json esp_http_client mbedtls esp-tls log spiffs
-                              nucula_lib secp256k1 axs15231b qrcode wisp_relay
-                              negentropy_lib tcp_transport tollgate_core
-                     PRIV_REQUIRES esp-tls)
+                               lwip json esp_http_client mbedtls esp-tls log spiffs
+                               nucula_lib secp256k1 axs15231b qrcode wisp_relay
+                               negentropy_lib tcp_transport tollgate_esp
+                      PRIV_REQUIRES esp-tls)
diff --git a/main/cashu.c b/main/cashu.c
index 4bcda4d..2da6a05 100644
--- a/main/cashu.c
+++ b/main/cashu.c
@@ -1,278 +1,43 @@
 #include "cashu.h"
+#include "tollgate_core_cashu.h"
+#include "tollgate_core.h"
 #include "config.h"
-#include "mint_health.h"
 #include "esp_log.h"
-#include "esp_http_client.h"
-#include "cJSON.h"
-#include "mbedtls/base64.h"
-#include "mbedtls/sha256.h"
-#include "esp_crt_bundle.h"
 
 static const char *TAG = "cashu";
 
-static const char V3_PREFIX[] = "cashuA";
-static const size_t V3_PREFIX_LEN = 6;
-
-static int b64url_decode(const char *input, size_t input_len, char *out, size_t out_size, size_t *out_len)
-{
-    char *b64 = malloc(input_len + 4);
-    if (!b64) return -1;
-    size_t b64_len = input_len;
-    memcpy(b64, input, b64_len);
-    b64[b64_len] = '\0';
-
-    for (size_t i = 0; i < b64_len; i++) {
-        if (b64[i] == '-') b64[i] = '+';
-        else if (b64[i] == '_') b64[i] = '/';
-    }
-    while (b64_len % 4 != 0) {
-        b64[b64_len++] = '=';
-    }
-    b64[b64_len] = '\0';
-
-    size_t olen = 0;
-    int ret = mbedtls_base64_decode((unsigned char *)out, out_size, &olen,
-                                     (const unsigned char *)b64, b64_len);
-    free(b64);
-    if (ret != 0) return -1;
-    *out_len = olen;
-    return 0;
-}
-
-static esp_err_t parse_proofs_array(cJSON *arr, cashu_token_t *out)
-{
-    if (!cJSON_IsArray(arr)) return ESP_FAIL;
-    int count = cJSON_GetArraySize(arr);
-    if (count > CASHU_MAX_PROOFS) return ESP_FAIL;
-
-    out->proof_count = 0;
-    out->total_amount = 0;
-    for (int i = 0; i < count; i++) {
-        cJSON *proof = cJSON_GetArrayItem(arr, i);
-        cJSON *amt = cJSON_GetObjectItemCaseSensitive(proof, "amount");
-        cJSON *id = cJSON_GetObjectItemCaseSensitive(proof, "id");
-        cJSON *secret = cJSON_GetObjectItemCaseSensitive(proof, "secret");
-        cJSON *c = cJSON_GetObjectItemCaseSensitive(proof, "C");
-
-        if (!amt || !cJSON_IsNumber(amt)) return ESP_FAIL;
-
-        out->proofs[i].amount = (uint64_t)amt->valuedouble;
-        out->total_amount += out->proofs[i].amount;
-
-        if (id && cJSON_IsString(id)) {
-            strncpy(out->proofs[i].id, id->valuestring, sizeof(out->proofs[i].id) - 1);
-        }
-        if (secret && cJSON_IsString(secret)) {
-            strncpy(out->proofs[i].secret, secret->valuestring, sizeof(out->proofs[i].secret) - 1);
-        }
-        if (c && cJSON_IsString(c)) {
-            strncpy(out->proofs[i].c, c->valuestring, sizeof(out->proofs[i].c) - 1);
-        }
-        out->proof_count++;
-    }
-    return ESP_OK;
-}
-
 esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out)
 {
-    if (!token_str || !out) return ESP_FAIL;
-    memset(out, 0, sizeof(*out));
-
-    size_t len = strlen(token_str);
-    char *nl = strchr(token_str, '\n');
-    if (nl) len = nl - token_str;
-    char *cr = strchr(token_str, '\r');
-    if (cr && (cr - token_str) < (int)len) len = cr - token_str;
-    if (len <= V3_PREFIX_LEN) {
-        ESP_LOGE(TAG, "Token too short");
-        return ESP_FAIL;
-    }
-    if (strncmp(token_str, V3_PREFIX, V3_PREFIX_LEN) != 0) {
-        ESP_LOGE(TAG, "Token missing cashuA prefix");
-        return ESP_FAIL;
-    }
-
-    size_t b64_len = len - V3_PREFIX_LEN;
-    size_t decoded_size = (b64_len * 3) / 4 + 4;
-    char *json_buf = malloc(decoded_size);
-    if (!json_buf) return ESP_FAIL;
-    size_t json_len = 0;
-    if (b64url_decode(token_str + V3_PREFIX_LEN, b64_len,
-                      json_buf, decoded_size - 1, &json_len) != 0) {
-        ESP_LOGE(TAG, "Base64url decode failed");
-        free(json_buf);
-        return ESP_FAIL;
-    }
-    json_buf[json_len] = '\0';
-
-    cJSON *root = cJSON_Parse(json_buf);
-    free(json_buf);
-    if (!root) {
-        ESP_LOGE(TAG, "JSON parse failed");
-        return ESP_FAIL;
-    }
-
-    cJSON *token_arr = cJSON_GetObjectItemCaseSensitive(root, "token");
-    if (token_arr && cJSON_IsArray(token_arr)) {
-        cJSON *first = cJSON_GetArrayItem(token_arr, 0);
-        if (!first) { cJSON_Delete(root); return ESP_FAIL; }
-
-        cJSON *mint = cJSON_GetObjectItemCaseSensitive(first, "mint");
-        if (mint && cJSON_IsString(mint)) {
-            strncpy(out->mint_url, mint->valuestring, sizeof(out->mint_url) - 1);
-        }
-
-        cJSON *proofs = cJSON_GetObjectItemCaseSensitive(first, "proofs");
-        if (proofs) {
-            esp_err_t ret = parse_proofs_array(proofs, out);
-            if (ret != ESP_OK) { cJSON_Delete(root); return ret; }
-        }
-    } else {
-        cJSON *mint = cJSON_GetObjectItemCaseSensitive(root, "mint");
-        if (mint && cJSON_IsString(mint)) {
-            strncpy(out->mint_url, mint->valuestring, sizeof(out->mint_url) - 1);
-        }
-
-        cJSON *proofs = cJSON_GetObjectItemCaseSensitive(root, "proofs");
-        if (proofs) {
-            esp_err_t ret = parse_proofs_array(proofs, out);
-            if (ret != ESP_OK) { cJSON_Delete(root); return ret; }
-        }
-    }
-
-    cJSON_Delete(root);
-
-    if (out->proof_count == 0) {
-        ESP_LOGE(TAG, "No proofs in token");
-        return ESP_FAIL;
-    }
-
-    ESP_LOGI(TAG, "Decoded token: %d proofs, total=%llu, mint=%s",
-             out->proof_count, (unsigned long long)out->total_amount, out->mint_url);
-    return ESP_OK;
-}
-
-static void sha256_hex(const char *data, size_t data_len, char *hex_out)
-{
-    uint8_t hash[32];
-    mbedtls_sha256((const unsigned char *)data, data_len, hash, 0);
-    for (int i = 0; i < 32; i++) {
-        sprintf(hex_out + i * 2, "%02x", hash[i]);
-    }
-    hex_out[64] = '\0';
+    return tollgate_core_cashu_decode_token(token_str, (tg_cashu_token_t *)out);
 }
 
 esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
                                    cashu_proof_state_t *states, int *state_count)
 {
-    cJSON *ys_arr = cJSON_CreateArray();
-    for (int i = 0; i < token->proof_count; i++) {
-        char y_hex[65];
-        sha256_hex(token->proofs[i].secret, strlen(token->proofs[i].secret), y_hex);
-        cJSON_AddItemToArray(ys_arr, cJSON_CreateString(y_hex));
-        strncpy(states[i].y_hex, y_hex, sizeof(states[i].y_hex) - 1);
-        states[i].spent = false;
-    }
-    *state_count = token->proof_count;
-
-    char *ys_json = cJSON_PrintUnformatted(ys_arr);
-    cJSON_Delete(ys_arr);
-
-    char *post_body = malloc(4096);
-    if (!post_body) { cJSON_free(ys_json); return ESP_FAIL; }
-    snprintf(post_body, 4096, "{\"Ys\":%s}", ys_json);
-    cJSON_free(ys_json);
-
-    char url[512];
-    snprintf(url, sizeof(url), "%s/v1/checkstate", mint_url);
-
-    char *resp_buf = malloc(8192);
-    if (!resp_buf) { free(post_body); return ESP_FAIL; }
-
-    esp_http_client_config_t config = {
-        .url = url,
-        .method = HTTP_METHOD_POST,
-        .timeout_ms = 15000,
-        .crt_bundle_attach = esp_crt_bundle_attach,
-    };
-    esp_http_client_handle_t client = esp_http_client_init(&config);
-    if (!client) { free(post_body); free(resp_buf); return ESP_FAIL; }
-
-    esp_http_client_set_header(client, "Content-Type", "application/json");
-
-    esp_err_t err = esp_http_client_open(client, strlen(post_body));
-    if (err != ESP_OK) {
-        ESP_LOGE(TAG, "checkstate open failed: %s", esp_err_to_name(err));
-        esp_http_client_cleanup(client);
-        free(post_body);
-        free(resp_buf);
-        return ESP_FAIL;
-    }
-    int written = esp_http_client_write(client, post_body, strlen(post_body));
-    free(post_body);
-    ESP_LOGI(TAG, "checkstate written %d bytes", written);
-
-    int content_length = esp_http_client_fetch_headers(client);
-    int status = esp_http_client_get_status_code(client);
-    ESP_LOGI(TAG, "checkstate headers: status=%d, content_length=%d", status, content_length);
-
-    int resp_len = esp_http_client_read(client, resp_buf, 8191);
-    ESP_LOGI(TAG, "checkstate read: resp_len=%d", resp_len);
-    esp_http_client_cleanup(client);
-
-    if (status != 200 || resp_len <= 0) {
-        ESP_LOGE(TAG, "checkstate failed: status=%d, resp_len=%d", status, resp_len);
-        free(resp_buf);
-        return ESP_FAIL;
-    }
-    resp_buf[resp_len] = '\0';
-
-    cJSON *root = cJSON_Parse(resp_buf);
-    free(resp_buf);
-    if (!root) return ESP_FAIL;
-
-    cJSON *states_arr = cJSON_GetObjectItemCaseSensitive(root, "states");
-    if (!states_arr || !cJSON_IsArray(states_arr)) {
-        cJSON_Delete(root);
-        return ESP_FAIL;
-    }
-
-    int n = cJSON_GetArraySize(states_arr);
-    for (int i = 0; i < n && i < token->proof_count; i++) {
-        cJSON *s = cJSON_GetArrayItem(states_arr, i);
-        cJSON *state = cJSON_GetObjectItemCaseSensitive(s, "state");
-        if (state && cJSON_IsString(state)) {
-            states[i].spent = (strcmp(state->valuestring, "SPENT") == 0);
-        }
-    }
-
-    cJSON_Delete(root);
-    return ESP_OK;
+    return tollgate_core_cashu_check_proof_states(mint_url, (const tg_cashu_token_t *)token,
+                                                   (tg_cashu_proof_state_t *)states, state_count);
 }
 
 uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
                                        uint64_t step_size_ms)
 {
-    if (price_per_step == 0) return 0;
-    return (token_amount / price_per_step) * step_size_ms;
+    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size_ms);
 }
 
 uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
                                     const char *metric, uint64_t step_size)
 {
-    if (price_per_step == 0) return 0;
     (void)metric;
-    return (token_amount / price_per_step) * step_size;
+    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size);
 }
 
 bool cashu_is_mint_accepted(const char *mint_url)
 {
-    if (!mint_url || mint_url[0] == '\0') return false;
     const tollgate_config_t *cfg = tollgate_config_get();
-    for (int i = 0; i < cfg->accepted_mint_count; i++) {
-        if (strstr(mint_url, cfg->accepted_mints[i]) != NULL ||
-            strcmp(mint_url, cfg->accepted_mints[i]) == 0) {
-            return mint_health_is_reachable(mint_url);
+    if (cfg) {
+        for (int i = 0; i < cfg->accepted_mint_count; i++) {
+            if (tollgate_core_cashu_is_mint_accepted(mint_url, cfg->accepted_mints[i]))
+                return true;
         }
     }
     return false;
diff --git a/main/cashu.h b/main/cashu.h
index 76ad2eb..43be033 100644
--- a/main/cashu.h
+++ b/main/cashu.h
@@ -30,16 +30,12 @@ typedef struct {
 } cashu_proof_state_t;
 
 esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out);
-
 esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
                                    cashu_proof_state_t *states, int *state_count);
-
 uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
                                        uint64_t step_size_ms);
-
 uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
                                     const char *metric, uint64_t step_size);
-
 bool cashu_is_mint_accepted(const char *mint_url);
 
 #endif
diff --git a/main/firewall.c b/main/firewall.c
index ae0eda7..077d16c 100644
--- a/main/firewall.c
+++ b/main/firewall.c
@@ -1,70 +1,23 @@
 #include "firewall.h"
 #include "dns_server.h"
+#include "tollgate_core.h"
+#include "tollgate_core_firewall.h"
 #include "esp_log.h"
-#include "esp_wifi.h"
-#include "esp_wifi_ap_get_sta_list.h"
-#include "lwip/lwip_napt.h"
-#include "lwip/etharp.h"
 #include "lwip/netif.h"
+#include "lwip/lwip_napt.h"
 #include "lwip/prot/ip4.h"
 #include "lwip/prot/tcp.h"
 #include "lwip/prot/ip.h"
 #include <string.h>
 
-#define MAX_CLIENTS 10
-
 static const char *TAG = "firewall";
 static esp_ip4_addr_t s_ap_ip;
 static uint16_t s_mining_port = 3333;
 static bool s_sandbox_mint_access = false;
 
-typedef struct {
-    uint32_t ip;
-    char mac[FW_MAX_MAC_LEN];
-} fw_client_t;
-
-static fw_client_t s_clients[MAX_CLIENTS];
-static int s_client_count = 0;
-
-esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size)
-{
-    wifi_sta_list_t sta_list;
-    if (esp_wifi_ap_get_sta_list(&sta_list) == ESP_OK) {
-        wifi_sta_mac_ip_list_t ip_mac_list;
-        if (esp_wifi_ap_get_sta_list_with_ip(&sta_list, &ip_mac_list) == ESP_OK) {
-            for (int i = 0; i < ip_mac_list.num; i++) {
-                if (ip_mac_list.sta[i].ip.addr == client_ip) {
-                    snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x",
-                             ip_mac_list.sta[i].mac[0], ip_mac_list.sta[i].mac[1],
-                             ip_mac_list.sta[i].mac[2], ip_mac_list.sta[i].mac[3],
-                             ip_mac_list.sta[i].mac[4], ip_mac_list.sta[i].mac[5]);
-                    return ESP_OK;
-                }
-            }
-        }
-    }
-
-    ip4_addr_t *entry_ip = NULL;
-    struct netif *entry_netif = NULL;
-    struct eth_addr *entry_eth = NULL;
-    ssize_t i = 0;
-    while (etharp_get_entry(i, &entry_ip, &entry_netif, &entry_eth) == ERR_OK) {
-        if (entry_ip && entry_ip->addr == client_ip && entry_eth) {
-            snprintf(mac_out, mac_out_size, "%02x:%02x:%02x:%02x:%02x:%02x",
-                     entry_eth->addr[0], entry_eth->addr[1], entry_eth->addr[2],
-                     entry_eth->addr[3], entry_eth->addr[4], entry_eth->addr[5]);
-            return ESP_OK;
-        }
-        i++;
-    }
-    return ESP_FAIL;
-}
-
 esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
 {
     s_ap_ip = ap_ip;
-    memset(s_clients, 0, sizeof(s_clients));
-    s_client_count = 0;
     ip_napt_enable(s_ap_ip.addr, 1);
     ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR " (NAT always on, per-client filter)", IP2STR(&s_ap_ip));
     return ESP_OK;
@@ -80,6 +33,11 @@ void firewall_set_sandbox_mint_access(bool enabled)
     s_sandbox_mint_access = enabled;
 }
 
+esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size)
+{
+    return tollgate_core_fw_get_mac_for_ip(client_ip, mac_out, mac_out_size);
+}
+
 static bool is_sandbox_allowed(struct pbuf *p)
 {
     if (p->len < IP_HLEN) return false;
@@ -129,84 +87,44 @@ int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
     return 0;
 }
 
-static fw_client_t *find_client_by_ip(uint32_t client_ip)
-{
-    for (int i = 0; i < s_client_count; i++) {
-        if (s_clients[i].ip == client_ip) return &s_clients[i];
-    }
-    return NULL;
-}
-
-static fw_client_t *find_client_by_mac(const char *mac)
-{
-    for (int i = 0; i < s_client_count; i++) {
-        if (s_clients[i].mac[0] != '\0' && strcmp(s_clients[i].mac, mac) == 0) {
-            return &s_clients[i];
-        }
-    }
-    return NULL;
-}
-
 void firewall_grant_access(uint32_t client_ip)
 {
-    fw_client_t *existing = find_client_by_ip(client_ip);
-    if (existing) {
-        existing->ip = client_ip;
-        return;
-    }
-    if (s_client_count >= MAX_CLIENTS) {
-        ESP_LOGW(TAG, "Max clients reached, cannot grant access");
-        return;
-    }
-
-    fw_client_t *client = &s_clients[s_client_count];
-    client->ip = client_ip;
-    client->mac[0] = '\0';
-    firewall_get_mac_for_ip(client_ip, client->mac, sizeof(client->mac));
-    s_client_count++;
-
+    tollgate_core_fw_grant(client_ip);
     dns_server_set_client_authenticated(client_ip, true);
 
+    char mac[18] = {0};
+    tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac));
     esp_ip4_addr_t ip_addr = { .addr = client_ip };
     ESP_LOGI(TAG, "Access granted to " IPSTR " mac=%s", IP2STR(&ip_addr),
-             client->mac[0] ? client->mac : "unknown");
+             mac[0] ? mac : "unknown");
 }
 
 void firewall_revoke_access(uint32_t client_ip)
 {
-    for (int i = 0; i < s_client_count; i++) {
-        if (s_clients[i].ip == client_ip) {
-            esp_ip4_addr_t ip_addr = { .addr = client_ip };
-            ESP_LOGI(TAG, "Access revoked for " IPSTR " mac=%s", IP2STR(&ip_addr),
-                     s_clients[i].mac[0] ? s_clients[i].mac : "unknown");
-            s_clients[i] = s_clients[s_client_count - 1];
-            s_client_count--;
-            dns_server_set_client_authenticated(client_ip, false);
-            return;
-        }
-    }
+    tollgate_core_fw_revoke(client_ip);
+    dns_server_set_client_authenticated(client_ip, false);
+
+    esp_ip4_addr_t ip_addr = { .addr = client_ip };
+    ESP_LOGI(TAG, "Access revoked for " IPSTR, IP2STR(&ip_addr));
 }
 
 void firewall_revoke_all(void)
 {
-    for (int i = 0; i < s_client_count; i++) {
-        dns_server_set_client_authenticated(s_clients[i].ip, false);
-    }
-    s_client_count = 0;
+    tollgate_core_fw_revoke_all();
     ESP_LOGI(TAG, "All client access revoked");
 }
 
 bool firewall_is_client_allowed(uint32_t client_ip)
 {
-    return find_client_by_ip(client_ip) != NULL;
+    return tollgate_core_is_client_allowed(client_ip);
 }
 
 bool firewall_is_mac_allowed(const char *mac)
 {
-    return find_client_by_mac(mac) != NULL;
+    return tollgate_core_fw_is_mac_allowed(mac);
 }
 
 int firewall_client_count(void)
 {
-    return s_client_count;
+    return tollgate_core_allowed_client_count();
 }
diff --git a/main/firewall.h b/main/firewall.h
index 77300e2..8d6e1c1 100644
--- a/main/firewall.h
+++ b/main/firewall.h
@@ -19,7 +19,6 @@ void firewall_revoke_all(void);
 bool firewall_is_client_allowed(uint32_t client_ip);
 bool firewall_is_mac_allowed(const char *mac);
 int firewall_client_count(void);
-
 esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size);
 
 int tollgate_ip4_canforward_filter(struct pbuf *p, uint32_t dest_addr_hostorder);
diff --git a/main/mining_payment.c b/main/mining_payment.c
index 8c5e4d5..f9d01b6 100644
--- a/main/mining_payment.c
+++ b/main/mining_payment.c
@@ -1,169 +1,66 @@
 #include "mining_payment.h"
-#include "config.h"
+#include "tollgate_core_mining.h"
+#include "tollgate_core.h"
 #include "esp_log.h"
-#include "freertos/FreeRTOS.h"
-#include "freertos/task.h"
-#include <string.h>
-#include <math.h>
 
 static const char *TAG = "mining_payment";
 
-static mining_client_stats_t s_clients[MINING_MAX_CLIENTS];
-static int s_client_count = 0;
-static double s_current_hashprice = 0.0;
-static uint32_t s_current_nbits = 0;
-static uint64_t s_current_difficulty = 1;
-
-static int64_t get_time_ms(void)
-{
-    return (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
-}
-
 uint64_t mining_nbits_to_difficulty(uint32_t nbits)
 {
-    if (nbits == 0) return UINT64_MAX;
-
-    uint32_t exponent = (nbits >> 24) & 0xFF;
-    uint32_t mantissa = nbits & 0x007FFFFF;
-
-    if (exponent <= 3) {
-        mantissa >>= (8 * (3 - exponent));
-        if (mantissa == 0) return UINT64_MAX;
-        return 0x00000000FFFF0000ULL / mantissa;
-    }
-
-    uint64_t target = (uint64_t)mantissa << (8 * (exponent - 3));
-    if (target == 0) return UINT64_MAX;
-
-    uint64_t pdiff = 0x00000000FFFF0000ULL;
-    uint64_t diff = pdiff / (target >> (exponent > 7 ? 0 : 0));
-    if (diff == 0) diff = 1;
-    return diff;
+    return tollgate_core_mining_nbits_to_difficulty(nbits);
 }
 
 double mining_calculate_hashprice(uint32_t nbits)
 {
-    uint64_t diff = mining_nbits_to_difficulty(nbits);
-    if (diff == 0 || diff == UINT64_MAX) return 0.0;
-
-    double network_hashrate_th = (double)diff * 4294967296.0 / 1e12;
-    double daily_sats = (double)MINING_BLOCK_SUBSIDY_SATS * (double)MINING_BLOCKS_PER_DAY;
-    double sats_per_th_day = daily_sats / network_hashrate_th;
-    return sats_per_th_day / 1000.0;
+    return tollgate_core_mining_calc_hashprice(nbits);
 }
 
 double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day)
 {
-    return (double)sats_per_ghs_day;
+    return tollgate_core_mining_calc_hashprice_override(sats_per_ghs_day);
 }
 
 esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len)
 {
-    (void)header80;
-    (void)nonce;
-    (void)target;
-    (void)target_len;
-    return ESP_OK;
+    return tollgate_core_mining_validate_share(header80, nonce, target, target_len);
 }
 
-uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s,
-                                         int price_per_step, int step_size_ms)
+uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms)
 {
-    if (hashrate_ghs <= 0.0 || hashprice_sats_per_ghs_s <= 0.0 || price_per_step <= 0) return 0;
-
-    double sats_per_ms = hashrate_ghs * hashprice_sats_per_ghs_s / 86400000.0;
-    double steps_earned = sats_per_ms * (double)step_size_ms / (double)price_per_step;
-    uint64_t allotment = (uint64_t)(steps_earned * (double)step_size_ms);
-    return allotment > 0 ? allotment : 1;
+    return tollgate_core_mining_shares_to_allotment_ms(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_ms);
 }
 
-uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s,
-                                            int price_per_step, int step_size_bytes)
+uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes)
 {
-    if (hashrate_ghs <= 0.0 || hashprice_sats_per_ghs_s <= 0.0 || price_per_step <= 0) return 0;
-
-    double sats_per_ms = hashrate_ghs * hashprice_sats_per_ghs_s / 86400000.0;
-    double steps_earned = sats_per_ms * 1000.0 / (double)price_per_step;
-    uint64_t allotment = (uint64_t)(steps_earned * (double)step_size_bytes);
-    return allotment > 0 ? allotment : 1;
+    return tollgate_core_mining_shares_to_allotment_bytes(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_bytes);
 }
 
 mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip)
 {
-    for (int i = 0; i < s_client_count; i++) {
-        if (s_clients[i].ip == client_ip) return &s_clients[i];
-    }
-
-    if (s_client_count >= MINING_MAX_CLIENTS) {
-        for (int i = 0; i < MINING_MAX_CLIENTS; i++) {
-            int64_t age = get_time_ms() - s_clients[i].last_share_time_ms;
-            if (age > MINING_SHARE_WINDOW_S * 2000) {
-                memset(&s_clients[i], 0, sizeof(mining_client_stats_t));
-                s_clients[i].ip = client_ip;
-                s_clients[i].first_share_time_ms = get_time_ms();
-                return &s_clients[i];
-            }
-        }
-        return NULL;
-    }
-
-    mining_client_stats_t *c = &s_clients[s_client_count];
-    memset(c, 0, sizeof(mining_client_stats_t));
-    c->ip = client_ip;
-    c->first_share_time_ms = get_time_ms();
-    s_client_count++;
-    return c;
+    return (mining_client_stats_t *)tollgate_core_mining_get_or_create_client(client_ip);
 }
 
 void mining_update_hashrate(uint32_t client_ip, bool accepted)
 {
-    mining_client_stats_t *stats = mining_get_or_create_client(client_ip);
-    if (!stats) return;
-
-    if (accepted) {
-        stats->shares_accepted++;
-    } else {
-        stats->shares_rejected++;
-    }
-    stats->last_share_time_ms = get_time_ms();
-
-    int64_t window_ms = stats->last_share_time_ms - stats->first_share_time_ms;
-    if (window_ms < 1000) window_ms = 1000;
-
-    double window_s = (double)window_ms / 1000.0;
-    double shares_per_s = (double)stats->shares_accepted / window_s;
-    double diff = (s_current_difficulty > 0) ? (double)s_current_difficulty : 1.0;
-    stats->hashrate_ghs = shares_per_s * diff * 4294967296.0 / 1e9;
+    tollgate_core_mining_update_hashrate(client_ip, accepted);
 }
 
 const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip)
 {
-    for (int i = 0; i < s_client_count; i++) {
-        if (s_clients[i].ip == client_ip) return &s_clients[i];
-    }
-    return NULL;
+    return (const mining_client_stats_t *)tollgate_core_mining_get_client_stats(client_ip);
 }
 
 double mining_get_current_hashprice(void)
 {
-    return s_current_hashprice;
+    return tollgate_core_mining_get_current_hashprice();
 }
 
 void mining_set_current_nbits(uint32_t nbits)
 {
-    s_current_nbits = nbits;
-    s_current_difficulty = mining_nbits_to_difficulty(nbits);
-    s_current_hashprice = mining_calculate_hashprice(nbits);
-    ESP_LOGI(TAG, "nbits updated: 0x%08lx, diff=%llu, hashprice=%.6f sat/GH/s/day",
-             (unsigned long)nbits, (unsigned long long)s_current_difficulty, s_current_hashprice);
+    tollgate_core_mining_set_current_nbits(nbits);
 }
 
 void mining_payment_init(void)
 {
-    memset(s_clients, 0, sizeof(s_clients));
-    s_client_count = 0;
-    s_current_hashprice = 0.0;
-    s_current_nbits = 0;
-    s_current_difficulty = 1;
-    ESP_LOGI(TAG, "Mining payment module initialized");
+    ESP_LOGI(TAG, "Mining payment initialized (via tollgate_core)");
 }
diff --git a/main/session.c b/main/session.c
index feea272..3e3813a 100644
--- a/main/session.c
+++ b/main/session.c
@@ -1,192 +1,86 @@
 #include "session.h"
-#include "firewall.h"
-#include "dns_server.h"
-#include "config.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core.h"
 #include "esp_log.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include <string.h>
 
 static const char *TAG = "session";
-static session_t s_sessions[SESSION_MAX_CLIENTS];
-static int s_session_count = 0;
-
-static int64_t get_time_ms(void)
-{
-    return (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
-}
 
 esp_err_t session_manager_init(void)
 {
-    memset(s_sessions, 0, sizeof(s_sessions));
-    s_session_count = 0;
-    ESP_LOGI(TAG, "Session manager initialized");
+    tollgate_core_session_init();
+    ESP_LOGI(TAG, "Session manager initialized (via tollgate_core)");
     return ESP_OK;
 }
 
-static void populate_mac(session_t *session, uint32_t client_ip)
-{
-    if (firewall_get_mac_for_ip(client_ip, session->mac, sizeof(session->mac)) != ESP_OK) {
-        session->mac[0] = '\0';
-    }
-}
-
 session_t *session_create(uint32_t client_ip, uint64_t allotment_ms)
 {
-    session_t *existing = session_find_by_ip(client_ip);
-    if (existing) {
-        session_extend(existing, allotment_ms);
-        return existing;
-    }
-
-    if (s_session_count >= SESSION_MAX_CLIENTS) {
-        for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-            if (!s_sessions[i].active || session_is_expired(&s_sessions[i])) {
-                session_revoke(&s_sessions[i]);
-                break;
-            }
-        }
-    }
-
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (!s_sessions[i].active) {
-            s_sessions[i].client_ip = client_ip;
-            s_sessions[i].allotment_ms = allotment_ms;
-            s_sessions[i].start_time_ms = get_time_ms();
-            s_sessions[i].active = true;
-            s_sessions[i].payment_method = PAYMENT_METHOD_CASHU;
-            populate_mac(&s_sessions[i], client_ip);
-
-            s_session_count++;
-            firewall_grant_access(client_ip);
-
-            esp_ip4_addr_t ip = { .addr = client_ip };
-            ESP_LOGI(TAG, "Session created: " IPSTR " mac=%s allotment=%llums", IP2STR(&ip),
-                     s_sessions[i].mac[0] ? s_sessions[i].mac : "unknown",
-                     (unsigned long long)allotment_ms);
-            return &s_sessions[i];
-        }
-    }
-
-    ESP_LOGW(TAG, "No free session slots");
-    return NULL;
+    return (session_t *)tollgate_core_session_create(client_ip, allotment_ms);
 }
 
 session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes)
 {
-    session_t *s = session_create(client_ip, 0);
-    if (s) {
-        s->allotment_bytes = allotment_bytes;
-        s->bytes_consumed = 0;
-        s->allotment_ms = INT64_MAX;
-        s->payment_method = PAYMENT_METHOD_BYTES;
-        esp_ip4_addr_t ip = { .addr = client_ip };
-        ESP_LOGI(TAG, "Bytes session created: " IPSTR " allotment=%llu bytes", IP2STR(&ip),
-                 (unsigned long long)allotment_bytes);
-    }
-    return s;
+    return (session_t *)tollgate_core_session_create_bytes(client_ip, allotment_bytes);
 }
 
 void session_add_bytes(uint32_t client_ip, uint64_t bytes)
 {
-    session_t *s = session_find_by_ip(client_ip);
-    if (s && s->active) {
-        s->bytes_consumed += bytes;
-    }
+    tollgate_core_session_add_bytes(client_ip, bytes);
 }
 
 session_t *session_find_by_ip(uint32_t client_ip)
 {
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (s_sessions[i].active && s_sessions[i].client_ip == client_ip) {
-            return &s_sessions[i];
-        }
-    }
-    return NULL;
+    return (session_t *)tollgate_core_session_find_by_ip(client_ip);
 }
 
 session_t *session_find_by_mac(const char *mac)
 {
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (s_sessions[i].active && s_sessions[i].mac[0] != '\0' &&
-            strcmp(s_sessions[i].mac, mac) == 0) {
-            return &s_sessions[i];
-        }
-    }
-    return NULL;
+    return (session_t *)tollgate_core_session_find_by_mac(mac);
 }
 
 void session_extend(session_t *session, uint64_t additional_ms)
 {
-    if (!session || !session->active) return;
-    session->allotment_ms += additional_ms;
-    esp_ip4_addr_t ip = { .addr = session->client_ip };
-    ESP_LOGI(TAG, "Session extended: " IPSTR " +%llums (total=%llu)", IP2STR(&ip),
-             (unsigned long long)additional_ms, (unsigned long long)session->allotment_ms);
+    tollgate_core_session_extend((tg_session_t *)session, additional_ms);
 }
 
 bool session_is_expired(const session_t *session)
 {
-    if (!session || !session->active) return true;
-
-    const tollgate_config_t *cfg = tollgate_config_get();
-    if (cfg && strcmp(cfg->metric, "bytes") == 0) {
-        return session->bytes_consumed >= session->allotment_bytes;
-    }
-
-    int64_t elapsed = get_time_ms() - session->start_time_ms;
-    return elapsed >= (int64_t)session->allotment_ms;
+    return tollgate_core_session_is_expired((const tg_session_t *)session);
 }
 
 void session_check_expiry(void)
 {
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (s_sessions[i].active && session_is_expired(&s_sessions[i])) {
-            esp_ip4_addr_t ip = { .addr = s_sessions[i].client_ip };
-            ESP_LOGI(TAG, "Session expired: " IPSTR " mac=%s", IP2STR(&ip),
-                     s_sessions[i].mac[0] ? s_sessions[i].mac : "unknown");
-            session_revoke(&s_sessions[i]);
-        }
-    }
 }
 
 void session_revoke(session_t *session)
 {
-    if (!session || !session->active) return;
-    firewall_revoke_access(session->client_ip);
-    session->active = false;
-    s_session_count--;
+    tollgate_core_session_revoke((tg_session_t *)session);
 }
 
 void session_revoke_all(void)
 {
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (s_sessions[i].active) {
-            session_revoke(&s_sessions[i]);
-        }
-    }
+    tollgate_core_session_revoke_all();
 }
 
 int session_active_count(void)
 {
-    int count = 0;
-    for (int i = 0; i < SESSION_MAX_CLIENTS; i++) {
-        if (s_sessions[i].active) count++;
-    }
-    return count;
+    return tollgate_core_active_session_count();
 }
 
 void session_tick(void)
 {
-    session_check_expiry();
+    tollgate_core_tick();
 }
 
 session_t *cvm_get_sessions_array(void)
 {
-    return s_sessions;
+    return (session_t *)tollgate_core_session_get_array();
 }
 
 int cvm_get_sessions_count(void)
 {
-    return SESSION_MAX_CLIENTS;
+    return tollgate_core_session_get_array_size();
 }
diff --git a/main/session.h b/main/session.h
index d3a61bb..8f6b991 100644
--- a/main/session.h
+++ b/main/session.h
@@ -26,30 +26,18 @@ typedef struct {
 } session_t;
 
 esp_err_t session_manager_init(void);
-
 session_t *session_create(uint32_t client_ip, uint64_t allotment_ms);
-
 session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes);
-
 void session_add_bytes(uint32_t client_ip, uint64_t bytes);
-
 session_t *session_find_by_ip(uint32_t client_ip);
 session_t *session_find_by_mac(const char *mac);
-
 void session_extend(session_t *session, uint64_t additional_ms);
-
 bool session_is_expired(const session_t *session);
-
 void session_check_expiry(void);
-
 void session_revoke(session_t *session);
-
 void session_revoke_all(void);
-
 int session_active_count(void);
-
 void session_tick(void);
-
 session_t *cvm_get_sessions_array(void);
 int cvm_get_sessions_count(void);
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 2d4fa22..2d1f657 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -12,6 +12,8 @@
 #include "lwip/dns.h"
 #include "esp_sntp.h"
 #include "dhcpserver/dhcpserver.h"
+#include "tollgate_core.h"
+#include "tollgate_esp_platform.h"
 #include "config.h"
 #include "identity.h"
 #include "dns_server.h"
@@ -233,6 +235,7 @@ static void start_services(void)
              IP2STR(&(esp_ip4_addr_t){.addr=dns_getserver(1)->addr}),
              IP2STR(&(esp_ip4_addr_t){.addr=dns_getserver(2)->addr}));
 
+    tollgate_core_init(tollgate_esp_get_platform(), ap_ip_info.ip);
     firewall_init(ap_ip_info.ip);
     session_manager_init();