diff --git a/examples/cyd_webserial_demo.html b/examples/cyd_webserial_demo.html new file mode 100644 index 0000000..3bf3e2a --- /dev/null +++ b/examples/cyd_webserial_demo.html @@ -0,0 +1,535 @@ + + + + + + n_signer CYD Web Serial Demo + + + +
+

n_signer CYD Web Serial Demo

+

Connect to the CYD (CH340 serial) via Web Serial, then exercise every algorithm and verb in the n_signer API. Chrome/Edge/Brave/Opera only.

+ +
+
+ + + Disconnected +
+ 

+    

+
+    

+      
+      

+        
Get Public Key (algorithm)

+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
nostr_get_public_key

+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
sign / verify

+        
+        
+        
+        
+        
+        
+        
+        
+        

+          
+          
+        

+        

+      

+
+      
+      

+        
encapsulate / decapsulate (ml-kem-768)

+        
+        
+        
+        
+        
+        
+        

+          
+          
+        

+        

+      

+
+      
+      

+        
derive_shared_secret (x25519)

+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
derive (secp256k1 HMAC-SHA256)

+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
nostr_sign_event

+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
nostr_mine_event

+        
Slow on ESP32 — uses single-threaded PoW. Keep difficulty low.

+        
+        
+        
+        
+        
+        
+        
+        
+        

+          
+        

+        

+      

+
+      
+      

+        
nostr_nip04_encrypt / decrypt

+        
+        
+        
+        
+        
+        
+        
+        
+        

+          
+          
+        

+        

+      

+
+      
+      

+        
nostr_nip44_encrypt / decrypt

+        
+        
+        
+        
+        
+        
+        
+        
+        

+          
+          
+        

+        

+      

+
+      
+      

+        
encrypt / decrypt (otp)

+        
OTP pad is derived from the mnemonic on the CYD. Offset advances monotonically.

+        
+        
+        
+        
+        
+        
+        

+          
+          
+        

+        

+      

+    

+  

+
+  
+
+
diff --git a/firmware/README.md b/firmware/README.md
index 34f5178..0401d97 100644
--- a/firmware/README.md
+++ b/firmware/README.md
@@ -53,6 +53,26 @@ WebUSB path:
 - Run `get_public_key`
 - Confirm pubkey matches CDC result
 
+## CYD (ESP32-2432S028) validation — Web Serial
+
+The CYD has no native USB; its CH340 bridge exposes a serial port. The browser
+transport is **Web Serial** (`navigator.serial`), Chromium-only. A full test
+page covering every algorithm and verb lives at
+[`examples/cyd_webserial_demo.html`](../examples/cyd_webserial_demo.html):
+
+- Open [`examples/cyd_webserial_demo.html`](../examples/cyd_webserial_demo.html) in Chrome/Edge
+- Click **Connect Web Serial**, select the CH340 port (`1a86:7523`)
+- Exercise each card: `get_public_key` (all 6 algorithms), `sign`/`verify`,
+  `encapsulate`/`decapsulate`, `derive_shared_secret`, `derive`,
+  `nostr_get_public_key`, `nostr_sign_event`, `nostr_mine_event`,
+  `nostr_nip04`/`nostr_nip44` encrypt+decrypt, and `encrypt`/`decrypt` (otp)
+- Each request shows the raw JSON-RPC request and response
+
+The CYD firmware (v0.0.2+) speaks the same algorithm-based API as the host
+([`README.md`](../README.md) §4). The OTP pad is derived from the mnemonic
+seed (no USB pad on this board); the offset advances monotonically and is
+reported in every `encrypt`/`decrypt` response.
+
 ## Linux WebUSB host setup (one-time)
 
 Chrome and Edge need permission to open the device on Linux. Install a udev rule for the firmware VID:PID and reload rules:
@@ -123,33 +143,34 @@ firmware uses a **crypto backend abstraction** ([`resources/pqclean/common/crypt
 with two implementations:
 
 - [`resources/pqclean/common/crypto_backend_openssl.c`](../resources/pqclean/common/crypto_backend_openssl.c) — host build (OpenSSL EVP)
-- [`resources/pqclean/common/crypto_backend_mbedtls.c`](../resources/pqclean/common/crypto_backend_mbedtls.c) — ESP32 firmware (mbedtls)
+- [`resources/pqclean/common/crypto_backend_mbedtls.c`](../resources/pqclean/common/crypto_backend_mbedtls.c) — ESP32 firmware (mbedtls + vendored Keccak)
 
 The mbedtls backend uses:
-- `mbedtls_sha256_ret()` for SHA-256 (ESP32-S3 hardware accelerated)
-- `mbedtls_sha512_ret()` for SHA-512 (ESP32-S3 hardware accelerated)
-- `mbedtls_md` API for SHA3-256, SHA3-512, SHAKE-128, SHAKE-256
+- `mbedtls_sha256()` for SHA-256 (ESP32 hardware accelerated where available)
+- `mbedtls_sha512()` for SHA-512 (ESP32 hardware accelerated where available)
+- A **self-contained Keccak-f[1600]** implementation (FIPS 202, public domain)
+  for SHA3-256, SHA3-512, SHAKE-128, and SHAKE-256. This is vendored directly
+  in `crypto_backend_mbedtls.c` because ESP-IDF v5.x mbedtls does not expose
+  SHAKE (and SHA3 is only available when `CONFIG_MBEDTLS_SHA3_C` is set) through
+  the `mbedtls_md` API. Carrying the Keccak core avoids any mbedtls config
+  dependency for the PQ algorithms.
 
-### Enabling SHA3/SHAKE in menuconfig
+### ed25519 / x25519 via PSA crypto
 
-mbedtls does not enable SHA3/SHAKE by default. You must enable them in
-menuconfig before building:
+ESP-IDF v5.x mbedtls removed the low-level `mbedtls_ed25519_*` functions. The
+firmware uses the **PSA Crypto API** for ed25519 sign/verify/key-derivation and
+x25519 key derivation + ECDH. Enable PSA in `sdkconfig.defaults`:
 
 ```
-Component config → mbedTLS → Hash functions → SHA-3
-Component config → mbedTLS → Hash functions → SHAKE
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED=y
 ```
 
-Or add to `sdkconfig.defaults`:
-```
-CONFIG_MBEDTLS_SHA3_C=y
-CONFIG_MBEDTLS_SHAKE_C=y
-```
+### No SHA3/SHAKE menuconfig requirement
 
-If mbedtls does not have SHAKE support, the firmware build will fail at link
-time with unresolved `mbedtls_md_info_from_type(MBEDTLS_MD_SHAKE128)`. In that
-case, either enable the config options above or patch mbedtls with a
-Keccak/SHAKE contribution.
+Because SHA3/SHAKE are provided by the vendored Keccak core (not mbedtls), you
+do **not** need to enable `CONFIG_MBEDTLS_SHA3_C` or any SHAKE config. The PQ
+algorithms build and run with the default mbedtls configuration.
 
 ### PQClean component
 
diff --git a/firmware/ble_wearable_signer/README.md b/firmware/ble_wearable_signer/README.md
new file mode 100644
index 0000000..e00714f
--- /dev/null
+++ b/firmware/ble_wearable_signer/README.md
@@ -0,0 +1,81 @@
+# n_signer BLE Wearable Signer
+
+**Status:** Concept — brainstorming. No plan yet.
+
+A small, battery-powered wearable hardware signer that communicates with a host
+over **Bluetooth Low Energy (BLE)**. The host sends JSON-RPC requests over a
+BLE GATT characteristic; the signer shows an approval prompt on a tiny display;
+the user taps a button to approve; the signed response goes back over BLE.
+
+## Concept
+
+```mermaid
+flowchart LR
+    Host[Host: phone/laptop
n_signer client] -->|BLE GATT| Signer[Wearable signer
nRF52840 + OLED]
+    Signer -->|approve/deny button| User[User]
+    Signer -->|BLE GATT response| Host
+```
+
+The signer speaks the same algorithm-based API as the host and the CYD/Teensy
+firmware ([`README.md`](../../README.md) §4). The auth envelope (kind 27235)
+protects the BLE wire — even if BLE is sniffed, an attacker can't forge
+requests without the caller's secp256k1 private key.
+
+## Why BLE
+
+- **Wearable form factor** — always with you (wristband, pendant, card)
+- **No physical connection** — no USB cable, no host-side driver, no dongle
+- **Universal host support** — phones, laptops, tablets all have BT
+- **Low power** — nRF52840 draws ~5 mA active, ~1 µA sleep
+
+## Hardware (preliminary)
+
+| Component | Candidate | Notes |
+|---|---|---|
+| MCU | **nRF52840** (Nordic) | Cortex-M4 @ 64 MHz, 1 MB flash, 256 KB RAM, BT 5.0, hardware AES/ECC, USB device, NFC-A. ~$5-8. |
+| Display | 0.96" or 1.3" SSD1306 OLED (I2C) or 1.02" e-paper | Small is fine — only shows "approve kind 1 from ?" |
+| Input | 2-3 tactile buttons (approve/deny/back) | No touch at this size |
+| Power | 200 mAh coin cell or small LiPo | Weeks of battery life |
+| Mnemonic entry | Buttons (scroll words), NFC from phone, or generate-on-device | The hard UX problem |
+
+## Security considerations
+
+- **BT stack attack surface:** BLE has a large stack (pairing, GATT, L2CAP, SMP).
+  A stack bug could allow code execution. Mitigations: use Nordic's audited
+  SoftDevice, disable unnecessary services, require LE Secure Connections pairing.
+- **Radio range (~10 m):** an attacker in the same room could potentially
+  interact with the signer. The auth envelope + approval prompt protect against
+  this, but the radio is omnidirectional.
+- **Pairing UX:** BT pairing can be frustrating. LE Secure Connections (Numeric
+  Comparison) is the most secure and user-friendly pairing method.
+
+## Open questions
+
+- **Mnemonic entry on a tiny screen:** scroll through 2048 BIP-39 words with
+  up/down buttons (like Coldcard)? Load via NFC from a phone? Generate on-device
+  and display for the user to write down?
+- **PQ crypto on nRF52840:** 256 KB RAM is enough for ML-DSA-65 (~6 KB heap)
+  but SLH-DSA-128s is heavy. May need to limit the PQ algorithm set or stream
+  the keygen.
+- **Display choice:** OLED (fast refresh, high power) vs e-paper (slow refresh,
+  zero power when static, persistent display).
+- **Form factor:** wristband? pendant? card? What's the target use case —
+  daily signing, emergency key access, or a backup signer?
+
+## Comparison to the IR air-gap signer
+
+| | BLE wearable | IR air-gap |
+|---|---|---|
+| Air-gap | Medium (radio, ~10 m, omnidirectional) | High (light, line-of-sight, ~1 m) |
+| Attack surface | Large (BT stack) | Small (no BT, dumb dongle) |
+| Host compatibility | Universal (phones, laptops) | Requires USB dongle |
+| Form factor | Wearable | Handheld (point at dongle) |
+| Throughput | ~250 KB/s (BLE 5) | ~11 KB/s (raw IR) or ~400 KB/s (IrDA) |
+| Novelty | Conventional | Novel (no hardware wallet uses IR) |
+
+## Next steps
+
+- Decide on the MCU (nRF52840 vs RP2040+BT-module)
+- Decide on mnemonic entry method
+- Decide on display (OLED vs e-paper)
+- Write a port plan (similar to [`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md))
diff --git a/firmware/cyd_esp32_2432s028/README.md b/firmware/cyd_esp32_2432s028/README.md
new file mode 100644
index 0000000..898c728
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/README.md
@@ -0,0 +1,175 @@
+# n_signer CYD Firmware (ESP32-2432S028)
+
+The **Cheap Yellow Display** (ESP32-2432S028) is a $15 ESP32-WROOM-32 board with
+a 2.8" 320×240 ILI9341 resistive-touch display, CH340 USB-UART bridge, and a
+Micro SD card slot. This firmware turns it into a hardware n_signer that speaks
+the same algorithm-based API as the host ([`README.md`](../../README.md) §4).
+
+**Firmware version:** 0.0.2 (algorithm-based API)
+
+## Hardware summary
+
+| Concern | Value |
+|---|---|
+| MCU | ESP32-WROOM-32 (classic, dual-core Xtensa, 512 KB SRAM, no PSRAM) |
+| USB-UART | CH340 (`1a86:7523`) → `/dev/ttyUSB0` |
+| Flash | 4 MB |
+| Display | 2.8" 320×240 ILI9341 (HSPI: DC=IO2, CS=IO15, SCK=IO14, MOSI=IO13, MISO=IO12, BL=IO21) |
+| Touch | XPT2046 resistive (bit-banged SPI: CLK=IO25, MOSI=IO32, CS=IO33, MISO=IO39, IRQ=IO36) |
+| SD card | Micro SD, VSPI (CS=IO5, SCK=IO18, MISO=IO19, MOSI=IO23) |
+| RGB LED | R=IO4, G=IO16, B=IO17 (active LOW) |
+| LDR | IO34 |
+| Speaker | IO26 (DAC) |
+| BOOT button | IO0 |
+| GUI | LVGL 8.3 |
+
+For the full pin map, connectors (P1/P3/CN1), and add-ons, see the upstream
+hardware docs copied to [`docs/`](docs/) — especially
+[`docs/PINS.md`](docs/PINS.md) and [`docs/SETUP.md`](docs/SETUP.md).
+
+## SD card — size limits and OTP pad storage
+
+The CYD's Micro SD slot is wired to VSPI (IO5/18/19/23). ESP-IDF drives it via
+the SDSPI host + FATFS filesystem. The proven bring-up example is
+`07_sd_card` in the `esp32_playground/cyb-esp32-2432s028/` workspace.
+
+**Size limits:**
+
+- **SDSC (≤ 2 GB):** supported.
+- **SDHC (2 GB – 32 GB):** supported — this is the recommended range. The
+  Makerfabs CYD ships with a 16 GB card, which works.
+- **SDXC (> 32 GB):** **not supported** out of the box. SDXC cards ship
+  formatted as exFAT, and ESP-IDF's FATFS does not include exFAT. An SDXC card
+  reformatted to FAT32 will work up to 32 GB; beyond that, FAT32's 32 GB limit
+  applies. For OTP pad storage, 32 GB is vastly more than enough (see below).
+
+**Recommendation:** use any **SDHC card from 4–32 GB** formatted **FAT32**.
+
+### Using the SD card for the OTP pad
+
+The current v0.0.2 firmware derives the OTP pad from the mnemonic seed via
+HKDF-SHA256 into a 1024-byte in-RAM pad (no SD card required). This keeps the
+wire contract identical to the host's `encrypt`/`decrypt` (algorithm:"otp")
+verbs but limits the pad to 1024 bytes per session.
+
+To hold a **large OTP pad** (the original n_signer host design binds a pad file
+from `--otp-pad-dir`), the SD card is the right storage. The plan:
+
+1. Format the SD card as FAT32.
+2. Place a pad file (e.g. `nsigner.pad`) on it — any size up to the card's free
+   space. A 1 GB pad gives ~1 billion one-time-pad bytes before exhaustion.
+3. The firmware mounts the SD card at boot via `esp_vfs_fat_sdmmc_mount()` on
+   the SDSPI host, opens the pad file, and reads pad bytes on demand into a
+   small ring buffer, advancing a persistent offset (stored in a small
+   `nsigner.offset` file on the SD so the offset survives power cycles).
+4. The `encrypt`/`decrypt` verbs XOR against the SD-backed pad instead of the
+   HKDF-derived in-RAM pad.
+
+This is a planned enhancement (see [`plans/cyd_algorithm_api_upgrade.md`](../../plans/cyd_algorithm_api_upgrade.md)
+§13 — the current implementation uses the mnemonic-derived pad as the embedded
+fallback). The SD card slot is confirmed working and the pin map is in
+[`docs/PINS.md`](docs/PINS.md).
+
+**Note on simultaneous display + touch + SD:** The CYD's display (HSPI), touch
+(bit-banged), and SD (VSPI) use three different SPI buses. All three can run at
+the same time — the touch is bit-banged precisely so it doesn't contend with
+the other two hardware SPI buses (see [`docs/TROUBLESHOOTING.md`](docs/TROUBLESHOOTING.md)).
+
+## Building and flashing
+
+Requires ESP-IDF v5.x (tested with v5.4.2). The classic ESP32 target uses the
+`xtensa-esp-elf` unified toolchain.
+
+```bash
+source /home/user/esp/esp-idf/export.sh
+cd firmware/cyd_esp32_2432s028
+idf.py build
+idf.py -p /dev/ttyUSB0 flash
+```
+
+If flashing fails with `Wrong boot mode detected (0x13)`, see the serial-reset
+hardware note below.
+
+## Validation — Web Serial
+
+The CYD has no native USB; the CH340 bridge exposes a serial port. The browser
+transport is **Web Serial** (`navigator.serial`), Chromium-only. A full test
+page covering every algorithm and verb lives at
+[`examples/cyd_webserial_demo.html`](../../examples/cyd_webserial_demo.html):
+
+1. Open [`examples/cyd_webserial_demo.html`](../../examples/cyd_webserial_demo.html) in Chrome/Edge.
+2. Click **Connect Web Serial**, select the CH340 port (`1a86:7523`).
+3. On the CYD touchscreen, enter or generate a mnemonic to reach the "ready" state.
+4. Exercise each card: `get_public_key` (all 6 algorithms), `sign`/`verify`,
+   `encapsulate`/`decapsulate`, `derive_shared_secret`, `derive`,
+   `nostr_get_public_key`, `nostr_sign_event`, `nostr_mine_event`,
+   `nostr_nip04`/`nostr_nip44` encrypt+decrypt, and `encrypt`/`decrypt` (otp).
+
+## API
+
+The CYD firmware speaks the same algorithm-based API as the host n_signer
+([`README.md`](../../README.md) §4). Supported verbs:
+
+| Verb | Algorithms |
+|---|---|
+| `get_public_key` | secp256k1, ed25519, x25519, ml-dsa-65, slh-dsa-128s, ml-kem-768 |
+| `sign` / `verify` | secp256k1 (schnorr/ecdsa), ed25519, ml-dsa-65, slh-dsa-128s |
+| `encapsulate` / `decapsulate` | ml-kem-768 |
+| `derive_shared_secret` | x25519 |
+| `derive` | secp256k1 (HMAC-SHA256) |
+| `encrypt` / `decrypt` | otp |
+| `nostr_get_public_key` | secp256k1 (NIP-06) |
+| `nostr_sign_event` | secp256k1 (NIP-06) |
+| `nostr_mine_event` | secp256k1 (NIP-06, single-threaded PoW) |
+| `nostr_nip04_encrypt` / `decrypt` | secp256k1 (NIP-06) |
+| `nostr_nip44_encrypt` / `decrypt` | secp256k1 (NIP-06) |
+
+All requests require an auth envelope (kind 27235). The `key_id` in every
+structured result is the first 16 hex characters of the public key, matching
+the host. Invalid `(verb, algorithm)` pairs return error `1010`.
+
+### Embedded-specific notes
+
+- **OTP pad:** derived from the mnemonic seed (HKDF-SHA256, 1024 bytes) in
+  v0.0.2. The offset advances monotonically and is reported in every
+  `encrypt`/`decrypt` response. SD-card-backed pad is a planned enhancement
+  (see above).
+- **`nostr_mine_event`:** single-threaded, hard 30 s default timeout, shows a
+  "mining…" screen. Keep difficulty low (≤ 8) on ESP32.
+- **SLH-DSA-128s:** keygen and signing take 5–30 s. The UI shows a "deriving
+  key…" / "signing…" indicator. ML-DSA-65 is much faster (~100 ms) and is the
+  recommended PQ signature algorithm for interactive use.
+
+## Crypto backend
+
+- **SHA-256 / SHA-512:** mbedtls (ESP32 hardware accelerated).
+- **SHA3 / SHAKE-128 / SHAKE-256:** vendored Keccak-f[1600] (FIPS 202) in
+  [`resources/pqclean/common/crypto_backend_mbedtls.c`](../../resources/pqclean/common/crypto_backend_mbedtls.c).
+  No `CONFIG_MBEDTLS_SHA3_C` or SHAKE menuconfig dependency.
+- **ed25519 / x25519:** PSA Crypto API (`psa_import_key`, `psa_sign_message`,
+  `psa_raw_key_agreement`, etc.) — ESP-IDF v5.x mbedtls removed the
+  `mbedtls_ed25519_*` functions. Requires `CONFIG_MBEDTLS_PSA_CRYPTO_C=y`
+  (set in [`sdkconfig.defaults`](sdkconfig.defaults)).
+- **secp256k1:** the vendored secp256k1 component (schnorr + ECDSA).
+- **PQ (ML-DSA-65, SLH-DSA-128s, ML-KEM-768):** PQClean via the
+  [`components/pqclean/`](components/pqclean/) component.
+
+## Serial-reset hardware note (CH340 auto-reset)
+
+Opening `/dev/ttyUSB0` can reset the ESP32 because the CH340's DTR/RTS lines
+are wired into the ESP32 auto-reset circuit. Symptoms: the device returns to
+the startup menu when a host app opens the serial port.
+
+**Mitigation:** add a **10 µF capacitor between EN and GND** on the CYD board
+(negative leg to GND). Typical working range is 4.7–22 µF. This also fixes the
+`Wrong boot mode detected (0x13)` flashing error. See
+[`docs/TROUBLESHOOTING.md`](docs/TROUBLESHOOTING.md) and the
+[`firmware/README.md`](../README.md) CYD section for details.
+
+## Reference documentation
+
+- [`docs/`](docs/) — upstream CYD hardware docs (PINS, SETUP, TROUBLESHOOTING, ADDONS, etc.)
+- [`plans/cyd_signer_port.md`](../../plans/cyd_signer_port.md) — original port plan (hardware comparison, architecture, UI flow)
+- [`plans/cyd_algorithm_api_upgrade.md`](../../plans/cyd_algorithm_api_upgrade.md) — v0.0.2 API upgrade plan
+- [`firmware/README.md`](../README.md) — shared firmware README (PQ crypto, mbedtls backend, feather target)
+- [`README.md`](../../README.md) §4 — the authoritative n_signer API reference
diff --git a/firmware/cyd_esp32_2432s028/docs/ADDONS.md b/firmware/cyd_esp32_2432s028/docs/ADDONS.md
new file mode 100644
index 0000000..2cdffd1
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/ADDONS.md
@@ -0,0 +1,86 @@
+# Add-Ons
+
+Here is a list of additional hardware add-ons that can add functionality to your CYD
+
+## SD Card Sniffer
+
+If you want to use the pins of the SD card for a different purpose, the easiest way to do that is with an "SD card sniffer", which basically plugs into the SD card slot and breaks out the pins. It's particularly useful for SPI devices.
+
+## Pin-out of the Sniffer board
+
+| Sniffer Board Label | ESP32 Pin | SPI Use   |
+| ------------------- | --------- | --------- |
+| DAT2                | -         | -         |
+| CD                  | IO5       | CS        |
+| CMD                 | IO23      | DI / MOSI |
+| GND                 | GND       | -         |
+| VCC                 | 3.3V      | -         |
+| CLK                 | IO18      | SCLK      |
+| DAT0                | IO19      | DO / MISO |
+| DAT1                | -         | -         |
+
+### Links
+
+- [Micro SD Card Sniffer - Aliexpress\*](https://s.click.aliexpress.com/e/_Ddwcy9h)
+
+## Nintendo Wii Nunchuck
+
+A Nunchuck controller from a Nintendo Wii is a great input device for CYD projects as they are inexpensive and, since they use i2c for communication, they only require 2 GPIO pins to connect them up.
+
+For these two pins you get:
+
+- An analog stick
+- 2 Buttons
+- An accelerometer
+
+### Hardware Required
+
+#### Nunchuck controllers
+
+Official Nintendo ones are generally better (maybe try second-hand options), but third-party ones also work fine.
+
+- [Amazon.co.uk Search\*](https://amzn.to/3nQrXcE)
+- [Amazon.com Search\*](https://amzn.to/3nRJTUd)
+- [Aliexpress (Third Party)\*](https://s.click.aliexpress.com/e/_AaQbXh)
+
+#### Nunchuck Adaptors
+
+There are many different options available for these, even the cheap ones from Aliexpress work perfectly.
+
+- [Aliexpress](https://s.click.aliexpress.com/e/_AEEtc3)
+- [My Open source one from Oshpark](https://oshpark.com/shared_projects/RcIxSx2D)
+- [Adafaruit](https://www.adafruit.com/product/4836)
+
+### Wiring
+
+The easiest way to wire this up is to use the wire that came with the CYD and the **CN1** JST connector (the one closest to the Micro SD card slot)
+
+Connect the wire to your breakout board as follows:
+
+| CYD CN1 | Adapter     | Note               |
+| ------- | ----------- | ------------------ |
+| GND     | - (AKA GND) | Black wire for me  |
+| 3.3V    | + (AKA 3V)  | Red wire for me    |
+| IO22    | d (AKA SDA) | Blue wire for me   |
+| IO27    | c (AKA SCL) | Yellow wire for me |
+
+Note: I have found pull-ups resistors are not required on SDA and SCL
+
+### Example
+
+Check out the [NunchuckTest](/Examples/InputTests/NunchuckTest) example for code how to use it.
+
+## Speakers
+
+A speaker can be attached to the display with a 1.25mm JST connector to the connector labeled "SPEAK" (or soldered)
+
+Check out the [HelloRadio](/Examples/Basics/7-HelloRadio) example for the code on how to use it.
+
+Most small 8 Ohm speakers should work. Maybe worth adding a 1.25mm JST connector to it to make it easy to add remove.
+
+### Links
+
+- [Speaker with 1.25mm JST connector (2pcs) - Aliexpress\*](https://s.click.aliexpress.com/e/_DBOJoh7) - Tested, works right out of the package.
+- [2pin 1.25mm JST connectors - Aliexpress\*](https://s.click.aliexpress.com/e/_DlbPkWH) - Not purchased by me, but should work
+
+\* = Affiliate Link - It doesn't cost you any extra but I receive a small portion of the sale.
diff --git a/firmware/cyd_esp32_2432s028/docs/MEDIA.md b/firmware/cyd_esp32_2432s028/docs/MEDIA.md
new file mode 100644
index 0000000..a4c6b64
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/MEDIA.md
@@ -0,0 +1,14 @@
+# Media and Mentions
+
+This page can document any times the CYD project was mentioned somewhere!
+
+## Videos
+
+- [Brian Lough (hey, thats me!) - Cheap and Easy to Use ESP32 Screen!](https://www.youtube.com/watch?v=0AVyvwv0agk)
+- [Talking Sasquach - Don't be Fooled!! This Cheap Yellow Display Can Do a LOT!!](https://youtu.be/PsqMCoCTgTg?feature=shared)
+- [Teaching Tech - Cheap and easy Klipper touch interface with CYD Klipper](https://youtu.be/R3o0MGYW1ZU?feature=shared)
+
+## Articles
+
+- [Hackaday.com - “Cheap Yellow Display” Builds Community Through Hardware](https://hackaday.com/2023/10/28/cheap-yellow-display-builds-community-through-hardware/)
+- [Hackster.io - Brian Lough Looks to Build a Community Around the Espressif ESP32-Powered "Cheap Yellow Display"](https://www.hackster.io/news/brian-lough-looks-to-build-a-community-around-the-espressif-esp32-powered-cheap-yellow-display-66d23972910d)
diff --git a/firmware/cyd_esp32_2432s028/docs/PINS.md b/firmware/cyd_esp32_2432s028/docs/PINS.md
new file mode 100644
index 0000000..e1d3470
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/PINS.md
@@ -0,0 +1,140 @@
+# Pins
+
+This page talks about the pins on the CYD.
+
+## Connector types
+
+The connectors are often called "1.25mm JST" but the correct name is "Molex PicoBlade".
+Chinese clones are sometimes called "mx1.25".
+
+|Connector|Type    |Note                  |
+|---      |---     |----                  |
+|[**P1**](#p1)  |4P 1.25mm Molex PicoBlade|Serial     |
+|[**P3**](#p3)  |4P 1.25mm Molex PicoBlade|GPIO       |
+|[**P4**](#p4)  |2P 1.25mm Molex PicoBlade|Speaker    |
+|[**CN1**](#cn1)|4P 1.25mm Molex PicoBlade|GPIO (I2C) |
+
+## What pins are available on the CYD?
+
+There are 3 easily accessible GPIO pins
+
+|Pin|Location|Note|
+|---|---|----|
+|IO35|**P3** Molex PicoBlade connector|Input only pin, no internal pull-ups available|
+|IO22|**P3** and **CN1** Molex PicoBlade connector||
+|IO27|**CN1** Molex PicoBlade connector||
+
+If you need more than that, you need to start taking them from something else. An SD Card sniffer like mentioned in the [Add-ons](/ADDONS.md) is probably the next easiest.
+
+After that you're probably de-soldering something!
+
+## Broken Out Pins
+
+There are three 4P 1.25mm Molex PicoBlade connectors on the board.
+
+### P3
+|Pin|Use|Note|
+|---|---|----|
+|GND|||
+|IO35||Input only pin, no internal pull-ups available|
+|IO22||Also on the **CN1** connector|
+|IO21||Used for the TFT Backlight, so not really usable|
+
+### CN1
+This is a great candidate for I2C devices
+
+|Pin|Use|Note|
+|---|---|----|
+|GND|||
+|IO22||Also on **P3** connector|
+|IO27|||
+|3.3V|||
+
+### P1
+|Pin|Use|Note|
+|---|---|----|
+|VIN|||
+|IO1(?)|TX|Maybe possible to use as a GPIO?|
+|IO3(?)|RX|Maybe possible to use as a GPIO?|
+|GND|||
+
+
+## Buttons
+
+The CYD has two buttons, reset and boot.
+
+|Pin|Use|Note|
+|---|---|----|
+|IO0|BOOT|Can be used as an input in sketches|
+
+## Speaker
+
+The speaker connector is a 2P 1.25mm Molex PicoBlade connector that is connected to the amplifier, so not usable as GPIO at the speaker connector
+
+|Pin|Use|Note|
+|---|---|----|
+|IO26|Connected to amp|`i2s_set_dac_mode(I2S_DAC_CHANNEL_LEFT_EN);`|
+
+## RGB LED
+
+If your project requires additional pins to what is available elsewhere, this might be a good candidate to sacrifice.
+
+Note: LEDs are "active low", meaning HIGH == off, LOW == on
+
+|Pin|Use|Note|
+|---|---|----|
+|IO4|Red LED||
+|IO16|Green LED||
+|IO17|Blue LED||
+
+## SD Card
+Uses the VSPI
+Pin names are predefined in SPI.h
+
+|Pin|Use|Note|
+|---|---|----|
+|IO5|SS||
+|IO18|SCK||
+|IO19|MISO||
+|IO23|MOSI||
+
+## Touch Screen
+
+|Pin|Use|Note|
+|---|---|----|
+|IO25|XPT2046_CLK||
+|IO32|XPT2046_MOSI||
+|IO33|XPT2046_CS||
+|IO36|XPT2046_IRQ||
+|IO39|XPT2046_MISO||
+
+## LDR (Light Sensor)
+
+|Pin|Use|Note|
+|---|---|----|
+|IO34|||
+
+## Display
+Uses the HSPI
+
+|Pin|Use|Note|
+|---|---|----|
+|IO2|TFT_RS|AKA: TFT_DC|
+|IO12|TFT_SDO|AKA: TFT_MISO|
+|IO13|TFT_SDI|AKA: TFT_MOSI|
+|IO14|TFT_SCK||
+|IO15|TFT_CS||
+|IO21|TFT_BL|Also on P3 connector, for some reason|
+
+## Test points
+|Pad|Use|Note|
+|---|---|----|
+|S1|GND|near USB-SERIAL|
+|S2|3.3v|for ESP32|
+|S3|5v|near USB-SERIAL|
+|S4|GND|for ESP32|
+|S5|3.3v|for TFT|
+|JP0 (pad nearest USB socket)|5v|TFT LDO|
+|JP0|3.3v|TFT LDO|
+|JP3 (pad nearest USB socket)|5v|ESP32 LDO|
+|JP3|3.3v|ESP32 LDO|
diff --git a/firmware/cyd_esp32_2432s028/docs/PROJECTS.md b/firmware/cyd_esp32_2432s028/docs/PROJECTS.md
new file mode 100644
index 0000000..c1b11e8
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/PROJECTS.md
@@ -0,0 +1,60 @@
+# Projects
+
+Because the CYD is a common platform, it makes it really useful for sharing projects. This page will be a list of projects that are available on the CYD.
+
+## Disclaimer!
+
+Projects appearing on here is not necessarily a seal of approval from me, I will not be test each project that gets added, so please install these projects at your own risk!
+
+## Projects
+
+| Name                   | Description                                                                                 | Author                                                 | Additional Hardware?                                                   | Project Page                                                       | WebFlash                                                                 |
+| ---------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------------ |
+| Spotify DIY Thing      | A device for displaying your currently playing Spotify track                                | [Brian Lough](https://github.com/witnessmenow)         |                                                                        | [Github](https://github.com/witnessmenow/Spotify-Diy-Thing)        | [WebFlash](https://witnessmenow.github.io/Spotify-Diy-Thing/)   |
+| F1 Notifier            | Displays and notifies you of the F1 session times(in your local timezone)                   | [Brian Lough](https://github.com/witnessmenow)         |                                                                        | [Github](https://github.com/witnessmenow/F1-Arduino-Notifications) | [WebFlash](https://witnessmenow.github.io/F1-Arduino-Notifications/)     |
+| Tetris with Nunchuck   | A version of Tetris using a Nintendo wii Nunchuck                                           | [Brian Lough](https://github.com/witnessmenow)         | A nunchuck and an adaptor for connecting it                            | [Code](/Examples/Projects/TetrisWithNunchuck)                      |                                                                          |
+| Galagino               | An emulator for some classic arcade games (Galaga, Donkey Kong, Pacman, Digdug and Frogger) | [Till Harbaum](https://github.com/harbaum)             | A nunchuck and an adaptor for connecting it. Speaker if you want sound | [Github](https://github.com/harbaum/galagino)                      |                                                                          |
+| ESP32-fluid-simulation | A small fluid simulation with touch input                                                   | [Kenny Peng](https://github.com/colonelwatch)          |                                                                        | [Github](https://github.com/colonelwatch/ESP32-fluid-simulation)   |                                                                          |
+| ESP32-TV               | Play Video Files on the ESP32                                                               | [atomic14](https://github.com/atomic14)                | Speaker if you want sound and possibly an IR receiver                  | [Github](https://github.com/atomic14/esp32-tv)                     |                                                                          |
+| xtouch                 | "The xtouch screen is a revolutionary addition to your BambuLab Printer"                    | [xperiments-in](https://github.com/xperiments-in) (\#) |                                                                        | [Github](https://github.com/xperiments-in/xtouch)                  | [Webflash](https://github.com/xperiments-in/xtouch#online-web-installer) |
+| CYD-Klipper            | An implementation of a wireless Klipper status display on an ESP32 + screen                 | [Sims](https://github.com/suchmememanyskill)           |                                                                        | [Github](https://github.com/suchmememanyskill/CYD-Klipper)         | [Webflash](https://suchmememanyskill.github.io/CYD-Klipper/)             |
+| DRO (for lathe / mill) | A DRO (digital readout) for your lathe or mill                                              | [Alanesq](https://github.com/alanesq)                  | It uses cheap digital caliper, requires a very basic interface         | [Github](https://github.com/alanesq/DRO)                           |                                                                          |
+| ESP32Marauder-CYD      | A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32                       | [Fr4nkFletcher](https://github.com/Fr4nkFletcher)      | GPS if you want BT/Wifi wardriving options                             | [Github](https://github.com/Fr4nkFletcher/ESP32-Marauder-Cheap-Yellow-Display)         | [Webflash](https://fr4nkfletcher.github.io/Adafruit_WebSerial_ESPTool/)             |
+| NerdMiner_v2           | A project that lets you try to solve a bitcoin block with a small piece of hardware.        | [Fr4nkFletcher](https://github.com/Fr4nkFletcher)      |                                                                        | [Github](https://github.com/Fr4nkFletcher/NerdMiner_v2-Cheap-Yellow-Display)         | [Webflash](https://fr4nkfletcher.github.io/NerdMiner_v2-Cheap-Yellow-Display/flash.html)             |
+| Tasmota                | Tasmota (with UI) on the CYD                                                                | ? (\#)                                                 |                                                                        | [Templates](https://templates.blakadder.com/sunton_ESP32-2432S028.html) | [Webflash](https://tasmota.github.io/install/)                      |
+| BAM | A game engine featuring smooth scrolling tile map, sprites in layers with pixel precision on-screen collision detection, intuitive definition of game objects and logic, decent performance, ~30 frames per second on the device | [calint](https://github.com/calint) | | [Github](https://github.com/calint/bam) | |
+|London Underground Arrivals| A highly configurable application that replicates the train arrivals boards found in [TFL](https://tfl.gov.uk/) stations. All variable data is encoded in a json file that may be updated at any time without the need to recompile the application e.g. the station to be displayed or the time to refresh data from TFL. The source code already supports 2 variants of CYD and, I hope, contains clear instructions how to handle any other variant.| [David Henry](https://github.com/mgaman) | | [Github](https://github.com/mgaman/TFL-tube-arrivals-board-ESP32-TFT-Arduino) |
+|GitHub-Stats| This Arduino project fetches and displays GitHub repository statistics such as star count, open issues, forks and notifactions on a CYD or via serial communication. Ideal for developers to monitor project metrics in real time.| [ATOMNFT](https://github.com/ATOMNFT) | | [Github](https://github.com/ATOMNFT/ESP32-CYD-Projects/tree/main/GitHub-Stats) | |
+| Midbar-Firebase-Edition | An advanced password vault that stores the encrypted data in the cloud while keeping the cryptographic keys on the edge! | [Northstrix](https://github.com/Northstrix) | PS/2 keyboard and an optional STM32F103C8T6 (if you want it to emulate the USB keyboard)  | [SourceForge](https://sourceforge.net/projects/midbar-firebase-edition/) [Github](https://github.com/Northstrix/Midbar-Firebase-Edition)
+| Electronic-Shelf-Label-Management-System | A simple device for displaying relevant product information. It gets the encrypted images via UDP. | [Northstrix](https://github.com/Northstrix)|                                                           | [SourceForge](https://sourceforge.net/projects/esl-management-system/) [Github](https://github.com/Northstrix/Electronic-Shelf-Label-Management-System)
+| ESP32-Tetris-With-Nintendo-64-Controller | Tetris for ESP32 with Nintendo 64 controller support                      | [Northstrix](https://github.com/Northstrix) | Nintendo 64 Controller and Arduino Nano                                           | [SourceForge](https://sourceforge.net/projects/esp32-tetris/) [Github](https://github.com/Northstrix/ESP32-Tetris-With-Nintendo-64-Controller)
+| Midbar ESP32 CYD       | A version of Midbar data vault tweaked specifically for the ESP32 Cheap Yellow Display.     | [Northstrix](https://github.com/Northstrix) | PS/2 Keyboard                                                                     | [SourceForge](https://sourceforge.net/projects/midbar-esp32-cyd/) [Github](https://github.com/Northstrix/Midbar-ESP32-CYD)
+| ESP32-Cheap-Yellow-Display-Electronic-Shelf-Label-with-Google-Firebase  | An ESP32 CYD-based Electronic Shelf Label that makes use of the Google Firebase and AES-256.  | [Northstrix](https://github.com/Northstrix) |                                | [SourceForge](https://sourceforge.net/projects/esp32-cyd-esl-with-firebase/)  [Github](https://github.com/Northstrix/ESP32-Cheap-Yellow-Display-Electronic-Shelf-Label-with-Google-Firebase)                                                                                                                                                                                                                         | [WebFlash](https://northstrix.github.io/ESP32-Cheap-Yellow-Display-Electronic-Shelf-Label-with-Google-Firebase/flash.html) 
!!! Format Flash area designated for SPIFFS with [ESP32 Filesystem Uploader](https://github.com/me-no-dev/arduino-esp32fs-plugin/releases/) after using the WebFlash
+| Addressable RGB LED Strip Controller (The Lantern Project)              | DIY Addressable RGB LED Strip Controller that utilizes the ESP32, ESP8266, and the WS2812 LED Strip.  | [Northstrix](https://github.com/Northstrix) | Nintendo Wii Nunchuk, WiiChuck Nunchuck Adapter (PCB Board), ESP8266, 580 Ohm resistor, WS2812 LED Strip | [SourceForge](https://sourceforge.net/projects/the-lantern-project/)          [Github](https://github.com/Northstrix/Lantern)
+| Midbar ESP32 CYD Firebase Edition                                       | A version of Midbar data vault adapted for the ESP32 CYD and WebFlash. It keeps the cryptographic keys in the ESP32 RAM and stores the ciphertexts (encrypted data) in the Google Firebase.  | [Northstrix](https://github.com/Northstrix) (Adapted for CYD2USB by [Rovel](https://github.com/Rovel))| PS2 Keyboard, PS2 Port *optional | [SourceForge](https://sourceforge.net/projects/midbar-esp32-cyd-firebase/)          [Github (CYD)](https://github.com/Northstrix/Midbar-ESP32-CYD-Firebase-Edition) [Github (CYD2USB)](https://github.com/Northstrix/Midbar-ESP32-CYD2USB-Firebase-Edition)  | [WebFlash (CYD)](https://northstrix.github.io/Midbar-ESP32-CYD-Firebase-Edition/flash) [WebFlash (CYD2USB)](https://northstrix.github.io/Midbar-ESP32-CYD2USB-Firebase-Edition/flash)
+| cydOS  (WIP) | cydOS is a GUI app that is able to manage various aspects of the CYD, like SD browsing and file mangement, on board flashing of .bin files for rapid firmware switching, on board device settings(WIP)  | [orlandobianco](https://github.com/orlandobianco) | | [Github]((https://github.com/orlandobianco/cydOS))  | |
+| ESP32 MFA Authenticator | Turn the CYD into a MFA Authenticator | [AllanOricil](https://github.com/AllanOricil) | | [Github](https://github.com/AllanOricil/esp32-mfa-authenticator)  | [Webflash](https://allanoricil.github.io/esp32-mfa-authenticator/)
+| cydWeatherStation | cyd Weather station | [gustheseventh](https://github.com/gustheseventh) (#) | | [Github](https://github.com/gustheseventh/cyd-Weather-Station)  | |
+| PhilRadio | CYD Wifi Radio project. Re-using an old radio as hardware. Exposing a webserver on local network to configure the radio stations. Persistent storage. | [mogrikid](https://github.com/mogrikid) | Required: A speaker. Recommended:  Speaker, potentiometer, 10kohm resistor, female usb port, switch | [Github](https://github.com/mogrikid/PhilRadio)
+| cydWeeWX | Simple CYD Weather Display for the open source [WeeWX](https://www.weewx.com/) weather station server. | [hcomet](https://hcomet.github.io/) | | [Github](https://github.com/hcomet/cydWeeWX)| [Webflash](https://hcomet.github.io/cydWeeWX/cydWeeWXFlash.html) |
+| CYD Stream Deck        | A customizable touch-based Bluetooth HID controller using CYD.         | [gahingwoo](https://github.com/gahingwoo)             |     | [GitHub](https://github.com/gahingwoo/cyd-stream-deck)            | [Webflash](https://gahingwoo.github.io/cyd-stream-deck/webflash/index.html)  |
+| CYD DHT22 Weather Clock | A weather and time display using CYD.       | [gahingwoo](https://github.com/gahingwoo)             | DHT22 sensor | [GitHub](https://github.com/gahingwoo/cyd-dht22-weather-clock) | |
+| ESP CYD MCP | Model Context Protocol (MCP) server implementation for the ESP32 CYD | [OfryL](https://github.com/OfryL) | | [Github](https://github.com/OfryL/esp-cyd-mcp) | |
+| Aura |  Smart weather forecast device (OpenMeteo) | [Surrey-Homeware](https://github.com/Surrey-Homeware/) (\#) | [3D printed case](https://makerworld.com/en/models/1382304-aura-smart-weather-forecast-display#profileId-1430951) | [Github](https://github.com/Surrey-Homeware/Aura) | [Webflash](https://surrey-homeware.github.io/aura-installer/) |
+| SmartEnergyMeter | An ESPHome display for Energy in the house (solar, battery, etc) | [anthony-spruyt](https://github.com/anthony-spruyt) (#) | | [Github](https://github.com/anthony-spruyt/ESPHOME-ESP32_CYD_V2-SmartEnergyMeter) | |
+| Navi Phone | Relica of the Mobile Phones used int the anime Serial Experments Lain | [Aquafrostbyte](https://github.com/AquaFrostByte) (#) | A Sd card is required, Speaker and Wifi is optional | [Github](https://github.com/AquaFrostByte/Navi-Phone) | |
+| OASMan | Open-source Air Suspension Management - Worlds first DIY Digital Air suspension controller for your car! | [gopro_2027](https://github.com/gopro2027/) | Ideally you would build the manifold and install it in your car, but if you just want to test the connection you can use an original esp32 dev board and flash the manifold code through platformio. We also have a [3d printable case](https://github.com/gopro2027/ArduinoAirSuspensionController/blob/main/3d%20Prints/other/3.2%20inch%20screen%20case/3.2%20inch%20CYD%20screen%20container%20v19%20-%20gopro_2027's%20design.stl) | [Github](https://github.com/gopro2027/ArduinoAirSuspensionController) | [Webflash](https://oasman.dev/oasman/flash/) |
+| Sonos Remote Control | Use your Sonos Speakers as Internet Radio with Station Buttons | Florian Lenz | https://github.com/SpringTideSystems | [GitHub](https://github.com/SpringTideSystems/CYD_Sonos-RemoteControl) | |
+
+(\#) = Project not added by original author
+
+## Adding a project
+
+If you have a project that you would like to add, please feel free to add it to the list!
+
+New projects should be added to bottom of the list.
+
+Some rules:
+
+- Project must be open source
+- Project must be functional - It's ok for it to not be finished, but it should do what it says!
diff --git a/firmware/cyd_esp32_2432s028/docs/README.md b/firmware/cyd_esp32_2432s028/docs/README.md
new file mode 100644
index 0000000..277a959
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/README.md
@@ -0,0 +1,114 @@
+# ESP32-Cheap-Yellow-Display
+
+There is an ESP32 with a built in 320 x 240 2.8" LCD display with a touch screen called the "ESP32-2432S028R", since this doesn't roll of the tongue, I propose it should be renamed the "Cheap Yellow Display" or CYD for short. This display is only about $15 delivered so I think it's really good value.
+
+![image](https://github.com/witnessmenow/ESP32-Cheap-Yellow-Display/assets/1562562/76c3d481-2523-4b6f-881c-2e29f9368cd0)
+
+## Features
+
+The CYD has the following features:
+
+- ESP32 (With Wifi and Bluetooth)
+- 320 x 240 LCD Display (2.8")
+- Touch Screen (Resistive)
+- USB for powering and programming
+- SD Card Slot, LED and some additional pins broken out
+
+## Who is it good for?
+
+I think it's useful for the following types of people:
+
+- **People just getting started with working hardware** - as everything is already connected, there is no soldering or additional components required
+- **People who are familiar with working with hardware, but are lazy** - (like me) Sometimes you just want to build a project without having to assemble any hardware
+- **People who aren't really looking to learn anything, but just want to build some cool things** - More about this later.
+
+## What is the purpose of this page?
+
+So this is pretty nice hardware and a cheap price, but the software instructions/support around it is pretty poor. Just a single link to a zip file on a random website.
+
+A couple of years ago I released the [ESP32 Trinity](https://github.com/witnessmenow/ESP32-Trinity), which is an open source ESP32 board for controlling Matrix panels. I think the main benefit people get out of the work I did on the Trinity is not the hardware, but the documentation, example code and ready to go projects.
+
+I'm no longer creating hardware products, but I think it would be interesting if we could create the same kind of community around this display, where people can share examples and projects made for this display.
+
+## How do I know if a display is a CYD?
+![CYD decision tree](http://www.plantuml.com/plantuml/png/RP0nJyCm48Nt_8gZNIb3fge3LD2b2q92235UamDRE7PaNuhyxxda7DGgJBs-zxtSE-yJO-IXSzKD6-e8UeVMLyQs1DJrdA6br4JRims-4fW9LiS4bY6JS-47qBTWC052QvEayyCAvA-wS-8vi01F7mS8SVevOxJeUK9zu55QzzP_Nw-exxPmz8tHJzRRsJq4cdo3Pu98oIQsCd4O6WDIbyXF4LN-JNMsYG7UNXyXUAUTLHDfqVeMJWClUfSPrY_OOyPtO_ivUPcfnoMV3iyXJh4cj_MGJd8lEleQkvQKi9TYUT_DvbukXnraIfTQURMT39Nu8kcrXInIwQYO-gCyNwgm6al-ZneTNIRqjLokqS2UV3jqxXS0)
+
+## Where to buy?
+
+Buy from wherever works out cheapest for you:
+
+- [Aliexpress\*](https://s.click.aliexpress.com/e/_DkSpIjB)
+- [Aliexpress\*](https://s.click.aliexpress.com/e/_DkcmuCh)
+- [Aliexpress](https://www.aliexpress.com/item/1005004502250619.html)
+- [Makerfabs](https://www.makerfabs.com/sunton-esp32-2-8-inch-tft-with-touch.html) - Seems to come with a 16GB SD card. Makerfabs also stock my [ESP32 Trinity](https://github.com/witnessmenow/ESP32-Trinity) (NOTE there will be import due in the EU from makerfabs)
+
+\* = Affiliate Link
+
+## Getting Started With Your CYD
+
+For details on how to get started with your CYD, please check out the [Setup and Configuration](/SETUP.md) page
+
+## Code Examples
+
+### The Basics
+
+A collection of examples demonstrating how to use the different features of the CYD, this is a good place to get started. [Check them out here.](/Examples/Basics)
+
+### Alternative Display Libraries
+
+The basics examples are based on the TFT_eSPI display library, but the CYD also works with other display libraries too. Here is some example code if you prefer to use an alternative Arduino library. [Check them out here.](/Examples/AlternativeLibraries)
+
+### ESPHome
+
+Some examples for using the CYD in ESPHome. [Check them out here.](/Examples/ESPHome)
+
+## Additional Info and Links
+
+### Discord
+
+Join the CYD discussion on [my Discord channel](https://discord.gg/nnezpvq)
+
+### 3DPrinting
+
+Some examples of 3D printed stands and cases. [Check them out here.](/3dModels)
+
+### Pin Information
+
+[This page](/PINS.md) contains information about what pins are used where, and what ones are free to use.
+
+### Add-ons
+
+[This page](/ADDONS.md) contains information about additional hardware add-ons that can add functionality to your CYD
+
+### Troubleshooting
+
+[This page](/TROUBLESHOOTING.md) contains information about how to troubleshoot your CYD device
+
+### Hardware Mods
+
+[This page](/Mods/README.md) contains information about some hardware mods that can be performed on the CYD to improve or change some of its functionality
+
+### Media and Video Mentions
+
+[This page](/MEDIA.md) lists any times the CYD project was mentioned somewhere!
+
+## License Info
+
+This project is licensed as MIT as per the [license file](/LICENSE)
+
+The one exception to this is the [OriginalDocumentation](/OriginalDocumentation/) folder, that I do not have the right to license
+
+## Other Languages
+
+Some members of the community have ported some of this information to other languages! 
+
+Please note: I can't gaurantee the accuracy of the translation, how up to date they are or the content on them in general.
+
+- [French / Française](https://github.com/usini/ESP32-Cheap-Yellow-Display-Documentation-FR)
+- [German / Deutsch](https://github.com/paelzer/ESP32-Cheap-Yellow-Display-Documentation-DE)
+
+If you would like to contribure a translation, please name the repo with the language name or code in the repo name and you can link it here.
+
+## Help Support what I do!
+
+[If you enjoy my work, please consider becoming a Github sponsor!](https://github.com/sponsors/witnessmenow/)
diff --git a/firmware/cyd_esp32_2432s028/docs/SETUP.md b/firmware/cyd_esp32_2432s028/docs/SETUP.md
new file mode 100644
index 0000000..6d6ba9a
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/SETUP.md
@@ -0,0 +1,39 @@
+# Setup and Configuration options
+
+This page will cover the basics of setting up the CYD
+
+## Hardware Setup
+
+There really is nothing to setup here, just connect the CYD to a computer using a micro USB cable (it even comes with one)
+
+## Software Setup
+
+The driver needs to be setup for uploading to the CYD, including webflashing projects. 
+
+### Driver
+
+The CYD uses the CH340 USB to UART chip. If you do not have a driver already installed for this chip you may need to install one. Check out [Sparkfun's guide for installation instruction](https://learn.sparkfun.com/tutorials/how-to-install-ch340-drivers/all)
+
+## Coding Setup
+
+Follow these instructions if you want to write new code for the CYD
+
+### Board definition
+
+You will need to have the ESP32 setup for your Arduino IDE, [instructions can be found here](https://docs.espressif.com/projects/arduino-esp32/en/latest/installing.html).
+
+You can then select basically any ESP32 board in the boards menu. (I usually use "ESP32 Dev Module", but it doesn't really matter)
+
+If you see errors uploading a sketch, try setting board upload speed to `115200`
+
+### Library Configuration
+
+The CYD can work with a selection of different libraries, but the main one this repo will focus on is [TFT_eSPI](https://github.com/Bodmer/TFT_eSPI) as it is a fairly popular library for working with these types of displays and there are lots of examples. 
+
+This can be installed from the library manager by searching for "TFT_eSPI".
+
+ > Note: After install of the library, copy the file [User_Setup.h](https://github.com/witnessmenow/ESP32-Cheap-Yellow-Display/blob/main/DisplayConfig/User_Setup.h) to the `libraries\TFT_eSPI` Arduino folder. This sets up the library for use with this display.
+
+### Examples
+
+I have provided examples for you to try out to get some ideas or inspiration. [Check them out here.](/Examples/)
diff --git a/firmware/cyd_esp32_2432s028/docs/TROUBLESHOOTING.md b/firmware/cyd_esp32_2432s028/docs/TROUBLESHOOTING.md
new file mode 100644
index 0000000..afbc2ee
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/TROUBLESHOOTING.md
@@ -0,0 +1,45 @@
+# First, Make sure it's a CYD!
+
+If you are having any issues, this is the first thing I would check! 
+
+The examples and information contained on this repo are for the **ESP32-2432S028** display only. The model number is written on the back of the display in gold writting, beside the speaker connector.
+
+# Display is not turning on
+
+If you are having issues getting the display working, the first thing I would try is [webflashing an existing project](/PROJECTS.md#projects-1). These will be known working code, and if it works correctly, it points to a software issue, not a hardware one.
+
+## If the webflash project displays something on the screen
+
+- Make sure you have put the [User_Setup.h](DisplayConfig/User_Setup.h) file in the correct location [as described here](/SETUP.md#library-configuration)
+- Pin 21 is the backlight pin, make sure you are not using it for something else in your sketch.
+
+## The webflash project doesn't display on screen
+
+- Make sure you are not connecting Pin 21 to anything. It is broken out on the connector labeled `P3`
+- Try a different USB supply and or cable
+- If nothing else worked, your CYD could be faulty. Contact the seller.
+
+# Display, Touch and SD card are not working at the same time
+
+The ESP32 offers two usable hardware SPI buses, but on the CYD each of display, touch and SD card use a different bus. To use all three devices at the same time, for one of them the SPI has to be "simulated" in software. Usually this is done for the touch device, since it doesn't require a high bandwidth. Therefor use a software SPI implementation like [XPT2046_Bitbang_Slim](https://github.com/TheNitek/XPT2046_Bitbang_Arduino_Library) and follow the [button example](https://github.com/witnessmenow/ESP32-Cheap-Yellow-Display/tree/main/Examples/Basics/8-Buttons)
+
+# Display is flickering
+
+- Try a different USB supply and or cable
+- Go through the [Display is not turning on](#display-is-not-turning-on) steps
+- If nothing else worked, your CYD could be faulty. Contact the seller.
+
+# Cannot upload
+- On Ubuntu and flavors disable or uninstall service `brltty` and make sure user is in group `dialout`
+
+# Automatic flash with esptool failed: Wrong boot mode detected (0x13)
+
+This is the well-known problem of flashing ESP32 through USB-UART converter, when DTR and RTS signals are used to switch the chip to the bootloader mode (with additional 2xNPN transistor digital protection logic). On some PC, OS, driver version it works, on another it doesn't:
+
+```
+A fatal error occurred: Failed to connect to ESP32: Wrong boot mode detected (0x13)! The chip needs to be in download mode. For troubleshooting steps visit: https://docs.espressif.com/projects/esptool/en/latest/troubleshooting.html
+```
+
+The solution is to replace a capacitor between EN (RST) and GND from 0.1uF, installed on CYD, to something in range 1uF and 10uF.
+
+**NOTE:** In schematic, this is C4, but at least on Type-C version of CYD it is C5 actually.
diff --git a/firmware/cyd_esp32_2432s028/docs/cyd.md b/firmware/cyd_esp32_2432s028/docs/cyd.md
new file mode 100644
index 0000000..f53294f
--- /dev/null
+++ b/firmware/cyd_esp32_2432s028/docs/cyd.md
@@ -0,0 +1,43 @@
+## What is a Cheap Yellow Display (CYD)?
+
+A CYD is a ESP32-2432S028, an ESP32 development board with a 2.8" display with a resistive touch screen,
+
+There are other boards with different sizes displays that look similar but **are not** a CYD. This isn't to try exclude anyone, but there so many different displays and types that it would be incredibly difficult and very confusing to support all of them.
+
+You can verify you have the correct board by checking the number on the back of the display.
+
+![image](https://github.com/witnessmenow/ESP32-Cheap-Yellow-Display/assets/1562562/d23bf84f-f34b-4814-b609-87c359d6334e)
+
+## My CYD has two USB ports
+
+The original CYD only has a micro USB port, but there is a device that is also labelled a _ESP32-2432S028_ that has two USB ports, one micro USB and one USB-C.
+
+Having an additional USB port would be a minor problem if that was the only difference, but unfortunately the display also works differently, the colours are inverted on the display.
+
+It can be fixed in a couple of ways:
+
+- Use platformio - The examples on the Github have all been updated so they can be used with platformio, and you can simply select CYD or CYD2USB and it will just work
+- Use the [CYD2USB specific User_setup.h](/DisplayConfig/CYD2USB/) that is on the repo, you can now use all the examples like normal
+- Invert the display at the code level using the `tft.invertDisplay(1);` method
+
+### The USB-C port doesn't work
+
+The USB-C port has a flaw in it, it doesn’t have the resistors on the CC lines. This means it will not work with USB-C to USB-C cables. If your computer only has USB-C ports, you can use it through a USB-C to USB-A adaptor.
+
+### The Display doesn't look as good 
+
+There seems to be a gamma issue with the CYD2USB (I don't even know what gamma is)
+
+Adding this to the code seems to help
+
+```
+tft.writecommand(ILI9341_GAMMASET); //Gamma curve selected
+tft.writedata(2);
+delay(120);
+tft.writecommand(ILI9341_GAMMASET); //Gamma curve selected
+tft.writedata(1);
+```
+
+
+
+
diff --git a/firmware/cyd_esp32_2432s028/main/key_derivation.c b/firmware/cyd_esp32_2432s028/main/key_derivation.c
index ab83383..a37c811 100644
--- a/firmware/cyd_esp32_2432s028/main/key_derivation.c
+++ b/firmware/cyd_esp32_2432s028/main/key_derivation.c
@@ -10,9 +10,9 @@
 #include "esp_log.h"
 
 #include "mbedtls/md.h"
-#include "mbedtls/ed25519.h"
 #include "mbedtls/ecp.h"
 #include "mbedtls/pk.h"
+#include "psa/crypto.h"
 
 #include "secp256k1.h"
 #include "secp256k1_extrakeys.h"
@@ -381,18 +381,33 @@ int derive_ed25519_key(const uint8_t seed[64], uint32_t index,
         return -1;
     }
 
-    /* The SLIP-0010 derived 32 bytes IS the ed25519 private key.
-     * Use mbedtls to derive the public key. */
+    /* The SLIP-0010 derived 32 bytes IS the ed25519 private key. */
     memcpy(privkey, derived_seed, 32);
 
-    /* mbedtls_ed25519_make_public: derive pub from priv */
-    /* Note: mbedtls ed25519 API may vary by version. The ESP-IDF mbedtls
-     * component provides mbedtls_ed25519_make_public (or via the PK API).
-     * We use the low-level function if available. */
-    int ret = mbedtls_ed25519_make_public((unsigned char *)pubkey, 32,
-                                           (const unsigned char *)privkey, 32);
-    if (ret != 0) {
-        ESP_LOGE(KD_TAG, "ed25519 make_public failed: %d", ret);
+    /* Derive the ed25519 public key via PSA crypto (IDF v5.x mbedtls has no
+     * mbedtls_ed25519_make_public). Import the private key, export the pub. */
+    psa_status_t status;
+    psa_key_id_t key_id = 0;
+    psa_key_attributes_t attrs = PSA_KEY_ATTRIBUTES_INIT;
+    size_t pub_len = 0;
+
+    psa_crypto_init();
+    psa_set_key_type(&attrs, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS));
+    psa_set_key_bits(&attrs, 255);
+    psa_set_key_usage_flags(&attrs, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_MESSAGE);
+    psa_set_key_algorithm(&attrs, PSA_ALG_PURE_EDDSA);
+
+    status = psa_import_key(&attrs, privkey, 32, &key_id);
+    if (status != PSA_SUCCESS) {
+        ESP_LOGE(KD_TAG, "ed25519 psa_import failed: %d", (int)status);
+        memset(derived_seed, 0, sizeof(derived_seed));
+        memset(privkey, 0, 32);
+        return -1;
+    }
+    status = psa_export_public_key(key_id, pubkey, 32, &pub_len);
+    psa_destroy_key(key_id);
+    if (status != PSA_SUCCESS || pub_len != 32) {
+        ESP_LOGE(KD_TAG, "ed25519 psa_export_public failed: %d", (int)status);
         memset(derived_seed, 0, sizeof(derived_seed));
         memset(privkey, 0, 32);
         return -1;
@@ -402,20 +417,64 @@ int derive_ed25519_key(const uint8_t seed[64], uint32_t index,
     return 0;
 }
 
+/* ed25519 sign via PSA (PureEdDSA — signs the raw message, not pre-hashed). */
 int ed25519_sign32(const uint8_t privkey[32], const uint8_t msg32[32],
                    uint8_t sig64[64]) {
-    /* mbedtls_ed25519_sign: sign a message (not pre-hashed) */
-    int ret = mbedtls_ed25519_sign((unsigned char *)sig64, 64,
-                                    (const unsigned char *)msg32, 32,
-                                    (const unsigned char *)privkey, 32,
-                                    NULL, NULL);
-    if (ret != 0) {
-        ESP_LOGE(KD_TAG, "ed25519 sign failed: %d", ret);
+    return ed25519_sign_msg(privkey, msg32, 32, sig64);
+}
+
+int ed25519_sign_msg(const uint8_t privkey[32], const uint8_t *msg, size_t msg_len,
+                     uint8_t sig64[64]) {
+    psa_status_t status;
+    psa_key_id_t key_id = 0;
+    psa_key_attributes_t attrs = PSA_KEY_ATTRIBUTES_INIT;
+    size_t sig_len = 0;
+
+    psa_crypto_init();
+    psa_set_key_type(&attrs, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_TWISTED_EDWARDS));
+    psa_set_key_bits(&attrs, 255);
+    psa_set_key_usage_flags(&attrs, PSA_KEY_USAGE_SIGN_MESSAGE);
+    psa_set_key_algorithm(&attrs, PSA_ALG_PURE_EDDSA);
+
+    status = psa_import_key(&attrs, privkey, 32, &key_id);
+    if (status != PSA_SUCCESS) {
+        ESP_LOGE(KD_TAG, "ed25519 sign psa_import failed: %d", (int)status);
+        return -1;
+    }
+    status = psa_sign_message(key_id, PSA_ALG_PURE_EDDSA,
+                              msg, msg_len, sig64, 64, &sig_len);
+    psa_destroy_key(key_id);
+    if (status != PSA_SUCCESS || sig_len != 64) {
+        ESP_LOGE(KD_TAG, "ed25519 psa_sign_message failed: %d", (int)status);
         return -1;
     }
     return 0;
 }
 
+int ed25519_verify_msg(const uint8_t *sig, size_t sig_len,
+                       const uint8_t *msg, size_t msg_len,
+                       const uint8_t pubkey[32]) {
+    psa_status_t status;
+    psa_key_id_t key_id = 0;
+    psa_key_attributes_t attrs = PSA_KEY_ATTRIBUTES_INIT;
+
+    psa_crypto_init();
+    psa_set_key_type(&attrs, PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS));
+    psa_set_key_bits(&attrs, 255);
+    psa_set_key_usage_flags(&attrs, PSA_KEY_USAGE_VERIFY_MESSAGE);
+    psa_set_key_algorithm(&attrs, PSA_ALG_PURE_EDDSA);
+
+    status = psa_import_key(&attrs, pubkey, 32, &key_id);
+    if (status != PSA_SUCCESS) {
+        ESP_LOGE(KD_TAG, "ed25519 verify psa_import failed: %d", (int)status);
+        return -1;
+    }
+    status = psa_verify_message(key_id, PSA_ALG_PURE_EDDSA,
+                                msg, msg_len, sig, sig_len);
+    psa_destroy_key(key_id);
+    return (status == PSA_SUCCESS) ? 0 : -1;
+}
+
 /* --- x25519 --- */
 
 int derive_x25519_key(const uint8_t seed[64], uint32_t index,
@@ -429,10 +488,10 @@ int derive_x25519_key(const uint8_t seed[64], uint32_t index,
         0u | BIP32_HARDENED_FLAG,
     };
     uint8_t derived_seed[32];
-    mbedtls_ecp_group grp;
-    mbedtls_mpi d;
-    mbedtls_ecp_point Q;
-    int ret;
+    psa_status_t status;
+    psa_key_id_t key_id = 0;
+    psa_key_attributes_t attrs = PSA_KEY_ATTRIBUTES_INIT;
+    size_t pub_len = 0;
 
     if (seed == NULL || privkey == NULL || pubkey == NULL) {
         return -1;
@@ -443,54 +502,30 @@ int derive_x25519_key(const uint8_t seed[64], uint32_t index,
     }
 
     /* The SLIP-0010 derived 32 bytes IS the x25519 private key.
-     * Clamp it per RFC 7748 and derive the public key via mbedtls ECDH. */
+     * PSA imports it and exports the public key (PSA handles clamping). */
     memcpy(privkey, derived_seed, 32);
     memset(derived_seed, 0, sizeof(derived_seed));
 
-    /* x25519 clamping: priv[0] &= 248, priv[31] &= 127, priv[31] |= 64 */
-    privkey[0] &= 248;
-    privkey[31] &= 127;
-    privkey[31] |= 64;
+    psa_crypto_init();
+    psa_set_key_type(&attrs, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY));
+    psa_set_key_bits(&attrs, 255);
+    psa_set_key_usage_flags(&attrs, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE);
+    psa_set_key_algorithm(&attrs, PSA_ALG_ECDH);
 
-    mbedtls_ecp_group_init(&grp);
-    mbedtls_mpi_init(&d);
-    mbedtls_ecp_point_init(&Q);
-
-    ret = mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_CURVE25519);
-    if (ret != 0) {
-        ESP_LOGE(KD_TAG, "x25519 group load failed: %d", ret);
-        goto cleanup;
+    status = psa_import_key(&attrs, privkey, 32, &key_id);
+    if (status != PSA_SUCCESS) {
+        ESP_LOGE(KD_TAG, "x25519 psa_import failed: %d", (int)status);
+        memset(privkey, 0, 32);
+        return -1;
     }
-
-    ret = mbedtls_mpi_read_binary_le(d, privkey, 32);
-    if (ret != 0) {
-        ESP_LOGE(KD_TAG, "x25519 mpi read failed: %d", ret);
-        goto cleanup;
+    status = psa_export_public_key(key_id, pubkey, 32, &pub_len);
+    psa_destroy_key(key_id);
+    if (status != PSA_SUCCESS || pub_len != 32) {
+        ESP_LOGE(KD_TAG, "x25519 psa_export_public failed: %d", (int)status);
+        memset(privkey, 0, 32);
+        return -1;
     }
-
-    ret = mbedtls_ecp_mul(&grp, &Q, d, &grp.G, NULL, NULL);
-    if (ret != 0) {
-        ESP_LOGE(KD_TAG, "x25519 ecp_mul failed: %d", ret);
-        goto cleanup;
-    }
-
-    /* Serialize the public key as raw 32 bytes (little-endian) */
-    {
-        size_t olen = 0;
-        ret = mbedtls_ecp_point_write_binary(&grp, &Q,
-                                              MBEDTLS_ECP_PF_COMPRESSED,
-                                              &olen, pubkey, 32);
-        if (ret != 0 || olen != 32) {
-            ESP_LOGE(KD_TAG, "x25519 pub serialize failed: %d", ret);
-            ret = -1;
-        }
-    }
-
-cleanup:
-    mbedtls_ecp_group_free(&grp);
-    mbedtls_mpi_free(&d);
-    mbedtls_ecp_point_free(&Q);
-    return (ret == 0) ? 0 : -1;
+    return 0;
 }
 
 /* --- ML-DSA-65 --- */
diff --git a/firmware/cyd_esp32_2432s028/main/key_derivation.h b/firmware/cyd_esp32_2432s028/main/key_derivation.h
index 7c18f15..cc9c8b4 100644
--- a/firmware/cyd_esp32_2432s028/main/key_derivation.h
+++ b/firmware/cyd_esp32_2432s028/main/key_derivation.h
@@ -17,12 +17,21 @@ int schnorr_sign32(const uint8_t privkey[32], const uint8_t msg32[32], uint8_t s
 int derive_ed25519_key(const uint8_t seed[64], uint32_t index,
                        uint8_t privkey[32], uint8_t pubkey[32]);
 
-/* Signs a 32-byte message digest with ed25519.
+/* Signs a 32-byte message digest with ed25519 (PureEdDSA, raw message).
  * sig: 64-byte ed25519 signature
  * Returns 0 on success, -1 on error. */
 int ed25519_sign32(const uint8_t privkey[32], const uint8_t msg32[32],
                    uint8_t sig64[64]);
 
+/* Signs a variable-length message with ed25519 (PureEdDSA). */
+int ed25519_sign_msg(const uint8_t privkey[32], const uint8_t *msg, size_t msg_len,
+                     uint8_t sig64[64]);
+
+/* Verifies an ed25519 signature over a variable-length message. */
+int ed25519_verify_msg(const uint8_t *sig, size_t sig_len,
+                       const uint8_t *msg, size_t msg_len,
+                       const uint8_t pubkey[32]);
+
 /* --- x25519 (age encryption / key agreement) --- */
 /* Derives an x25519 keypair from the mnemonic seed using SLIP-0010
  * all-hardened derivation: m/44'/102002'/'/0'/0'
diff --git a/firmware/cyd_esp32_2432s028/main/main.c b/firmware/cyd_esp32_2432s028/main/main.c
index 375163a..1fba4f5 100644
--- a/firmware/cyd_esp32_2432s028/main/main.c
+++ b/firmware/cyd_esp32_2432s028/main/main.c
@@ -1,6 +1,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 
@@ -8,6 +9,8 @@
 #include "freertos/FreeRTOS.h"
 #include "freertos/task.h"
 #include "mbedtls/sha256.h"
+#include "mbedtls/md.h"
+#include "psa/crypto.h"
 #include "cJSON.h"
 #include "secp256k1.h"
 #include "secp256k1_extrakeys.h"
@@ -17,6 +20,7 @@
 #include "buttons.h"
 #include "display.h"
 #include "key_derivation.h"
+#include "pq_crypto_firmware.h"
 #include "mnemonic.h"
 #include "usb_transport.h"
 #include "ui.h"
@@ -24,8 +28,9 @@
 #include "nip004.h"
 #include "nip044.h"
 #include "nostr_common.h"
+#include "utils.h"
 
-#define FIRMWARE_VERSION "0.0.1"
+#define FIRMWARE_VERSION "0.0.2"
 #ifndef GIT_HASH
 #define GIT_HASH "dev"
 #endif
@@ -60,7 +65,7 @@ static int s_nonce_next = 0;
 #define AUTH_ERR_ENVELOPE_REQUIRED 2014
 #define AUTH_ERR_REPLAY_DETECTED 2017
 
-/* Keep large buffers off the main task stack (ESP32-S3 default stack is limited). */
+/* Keep large buffers off the main task stack (ESP32 default stack is limited). */
 static char s_mnemonic[256];
 static uint8_t s_seed[64];
 static uint8_t s_privkey[32];
@@ -68,16 +73,343 @@ static uint8_t s_pubkey[32];
 static char s_npub[128];
 static uint8_t s_frame_buf[4096];
 static char s_pubkey_hex[65];
-static char s_response_buf[2048];
+/* PQ pubkeys are large (ml-dsa-65 = 1952 B -> 3904 hex + JSON wrapper).
+ * ml-kem-768 pubkey = 1184 B -> 2368 hex. ml-dsa-65 sig = 3309 B -> 6618 hex.
+ * Size for the worst case (sign result with ml-dsa-65 signature). */
+static char s_response_buf[8192];
 static char s_signed_event_buf[1600];
 
 static char s_encrypt_buf[1600];
 
+/* Static PQ key buffers (kept off the stack; zeroized after use). */
+static uint8_t s_pq_pk[FW_ML_DSA_65_PUBKEY_LEN];   /* large enough for any PQ pubkey */
+static uint8_t s_pq_sk[FW_ML_DSA_65_PRIVKEY_LEN];  /* large enough for any PQ privkey */
+static uint8_t s_pq_sig[FW_SLH_DSA_128S_SIG_LEN];  /* large enough for any PQ sig */
+static char s_pq_hex[(FW_SLH_DSA_128S_SIG_LEN * 2) + 1]; /* hex for any PQ blob */
+
+/* OTP pad state: derived from the mnemonic seed, monotonic offset. */
+static uint8_t s_otp_pad[1024];
+static size_t s_otp_pad_len = 0;
+static size_t s_otp_offset = 0;
+
+/* ---- Algorithm-based API (mirrors src/dispatcher.c) ---- */
+
+typedef enum {
+    FW_ALG_SECP256K1 = 0,
+    FW_ALG_ED25519,
+    FW_ALG_X25519,
+    FW_ALG_ML_DSA_65,
+    FW_ALG_SLH_DSA_128S,
+    FW_ALG_ML_KEM_768,
+    FW_ALG_OTP,
+    FW_ALG_UNKNOWN
+} fw_alg_t;
+
+/* Algorithm-based verb names (canonical, no legacy aliases). */
+#define VERB_SIGN              "sign"
+#define VERB_VERIFY            "verify"
+#define VERB_ENCAPSULATE       "encapsulate"
+#define VERB_DECAPSULATE       "decapsulate"
+#define VERB_DERIVE_SHARED     "derive_shared_secret"
+#define VERB_DERIVE            "derive"
+#define VERB_GET_PUBLIC_KEY    "get_public_key"
+#define VERB_ENCRYPT           "encrypt"
+#define VERB_DECRYPT           "decrypt"
+
+/* Nostr protocol verbs (secp256k1 NIP-06, nostr_index selector). */
+#define VERB_NOSTR_GET_PUBLIC_KEY  "nostr_get_public_key"
+#define VERB_NOSTR_SIGN_EVENT      "nostr_sign_event"
+#define VERB_NOSTR_MINE_EVENT      "nostr_mine_event"
+#define VERB_NOSTR_NIP04_ENCRYPT   "nostr_nip04_encrypt"
+#define VERB_NOSTR_NIP04_DECRYPT   "nostr_nip04_decrypt"
+#define VERB_NOSTR_NIP44_ENCRYPT   "nostr_nip44_encrypt"
+#define VERB_NOSTR_NIP44_DECRYPT   "nostr_nip44_decrypt"
+
+/* JSON-RPC error codes (match README.md §4.2). */
+#define ERR_INVALID_REQUEST       -32600
+#define ERR_METHOD_NOT_FOUND      -32601
+#define ERR_INVALID_PARAMS        -32602
+#define ERR_INTERNAL              -32603
+#define ERR_DENIED_BY_USER        -32000
+#define ERR_APPROVAL_TIMEOUT      -32001
+#define ERR_MINING_FAILED         1008
+#define ERR_NOT_YET_IMPLEMENTED   1009
+#define ERR_ALG_NOT_SUPPORTED     1010
+
 static int transport_init(void)
 {
     return usb_transport_init();
 }
 
+/* ---- Algorithm helpers ---- */
+
+/* Forward decl: defined later in this file. */
+static void bytes_to_hex(const uint8_t *in, size_t in_len, char *out, size_t out_len);
+
+static const char *fw_alg_name(fw_alg_t alg)
+{
+    switch (alg) {
+        case FW_ALG_SECP256K1:    return "secp256k1";
+        case FW_ALG_ED25519:      return "ed25519";
+        case FW_ALG_X25519:       return "x25519";
+        case FW_ALG_ML_DSA_65:    return "ml-dsa-65";
+        case FW_ALG_SLH_DSA_128S: return "slh-dsa-128s";
+        case FW_ALG_ML_KEM_768:   return "ml-kem-768";
+        case FW_ALG_OTP:          return "otp";
+        default:                  return "unknown";
+    }
+}
+
+static fw_alg_t fw_alg_from_name(const char *name)
+{
+    if (name == NULL) {
+        return FW_ALG_UNKNOWN;
+    }
+    if (strcmp(name, "secp256k1") == 0)    return FW_ALG_SECP256K1;
+    if (strcmp(name, "ed25519") == 0)      return FW_ALG_ED25519;
+    if (strcmp(name, "x25519") == 0)       return FW_ALG_X25519;
+    if (strcmp(name, "ml-dsa-65") == 0)    return FW_ALG_ML_DSA_65;
+    if (strcmp(name, "slh-dsa-128s") == 0) return FW_ALG_SLH_DSA_128S;
+    if (strcmp(name, "ml-kem-768") == 0)   return FW_ALG_ML_KEM_768;
+    if (strcmp(name, "otp") == 0)          return FW_ALG_OTP;
+    return FW_ALG_UNKNOWN;
+}
+
+/* Parse the trailing options object from a params array.
+ * Returns 0 on success (options may be absent -> defaults), -1 on malformed. */
+static int parse_options_from_params(cJSON *params, cJSON **out_options)
+{
+    int n;
+    cJSON *last;
+
+    if (out_options == NULL) {
+        return -1;
+    }
+    *out_options = NULL;
+
+    if (params == NULL || !cJSON_IsArray(params)) {
+        return 0;
+    }
+    n = cJSON_GetArraySize(params);
+    if (n <= 0) {
+        return 0;
+    }
+    last = cJSON_GetArrayItem(params, n - 1);
+    if (last != NULL && cJSON_IsObject(last)) {
+        *out_options = last;
+    }
+    return 0;
+}
+
+/* Parse algorithm + index from the options object.
+ * algorithm is required for algorithm-based verbs; index defaults to 0.
+ * Returns 0 on success, -1 on malformed/missing algorithm. */
+static int parse_algorithm_from_options(cJSON *options, fw_alg_t *out_alg, uint32_t *out_index)
+{
+    cJSON *alg_item;
+    cJSON *idx_item;
+    const char *alg_str;
+
+    if (out_alg == NULL || out_index == NULL) {
+        return -1;
+    }
+    *out_alg = FW_ALG_UNKNOWN;
+    *out_index = 0;
+
+    if (options == NULL || !cJSON_IsObject(options)) {
+        return -1;
+    }
+    alg_item = cJSON_GetObjectItemCaseSensitive(options, "algorithm");
+    if (!cJSON_IsString(alg_item) || alg_item->valuestring == NULL) {
+        return -1;
+    }
+    alg_str = alg_item->valuestring;
+    *out_alg = fw_alg_from_name(alg_str);
+    if (*out_alg == FW_ALG_UNKNOWN) {
+        return -1;
+    }
+
+    idx_item = cJSON_GetObjectItemCaseSensitive(options, "index");
+    if (idx_item != NULL && cJSON_IsNumber(idx_item)) {
+        if (idx_item->valueint < 0) {
+            return -1;
+        }
+        *out_index = (uint32_t)idx_item->valueint;
+    }
+    return 0;
+}
+
+/* ---- Enforcement matrix (README.md §4.3) ----
+ * Returns 0 if (verb, alg) is allowed, ERR_ALG_NOT_SUPPORTED otherwise. */
+static int enforce_alg_verb(fw_alg_t alg, const char *verb)
+{
+    if (verb == NULL) {
+        return ERR_ALG_NOT_SUPPORTED;
+    }
+
+    if (strcmp(verb, VERB_GET_PUBLIC_KEY) == 0) {
+        /* all key-deriving algorithms (otp does not derive -> excluded) */
+        if (alg == FW_ALG_SECP256K1 || alg == FW_ALG_ED25519 ||
+            alg == FW_ALG_X25519 || alg == FW_ALG_ML_DSA_65 ||
+            alg == FW_ALG_SLH_DSA_128S || alg == FW_ALG_ML_KEM_768) {
+            return 0;
+        }
+        return ERR_ALG_NOT_SUPPORTED;
+    }
+    if (strcmp(verb, VERB_SIGN) == 0 || strcmp(verb, VERB_VERIFY) == 0) {
+        if (alg == FW_ALG_SECP256K1 || alg == FW_ALG_ED25519 ||
+            alg == FW_ALG_ML_DSA_65 || alg == FW_ALG_SLH_DSA_128S) {
+            return 0;
+        }
+        return ERR_ALG_NOT_SUPPORTED;
+    }
+    if (strcmp(verb, VERB_ENCAPSULATE) == 0 || strcmp(verb, VERB_DECAPSULATE) == 0) {
+        return (alg == FW_ALG_ML_KEM_768) ? 0 : ERR_ALG_NOT_SUPPORTED;
+    }
+    if (strcmp(verb, VERB_DERIVE_SHARED) == 0) {
+        return (alg == FW_ALG_X25519) ? 0 : ERR_ALG_NOT_SUPPORTED;
+    }
+    if (strcmp(verb, VERB_DERIVE) == 0) {
+        return (alg == FW_ALG_SECP256K1) ? 0 : ERR_ALG_NOT_SUPPORTED;
+    }
+    if (strcmp(verb, VERB_ENCRYPT) == 0 || strcmp(verb, VERB_DECRYPT) == 0) {
+        return (alg == FW_ALG_OTP) ? 0 : ERR_ALG_NOT_SUPPORTED;
+    }
+    return ERR_ALG_NOT_SUPPORTED;
+}
+
+/* ---- Structured result builder ----
+ * Returns a JSON string like:
+ *   {"algorithm":"","key_id":"<16hex>","":""}
+ * key_id may be NULL/empty (omitted). Caller owns the returned string. */
+static char *build_alg_result_json(const char *alg_name, const char *key_id_16,
+                                   const char *field_name, const char *field_value)
+{
+    cJSON *obj = NULL;
+    char *out = NULL;
+
+    if (alg_name == NULL || field_name == NULL || field_value == NULL) {
+        return NULL;
+    }
+    obj = cJSON_CreateObject();
+    if (obj == NULL) {
+        return NULL;
+    }
+    cJSON_AddStringToObject(obj, "algorithm", alg_name);
+    if (key_id_16 != NULL && key_id_16[0] != '\0') {
+        cJSON_AddStringToObject(obj, "key_id", key_id_16);
+    }
+    cJSON_AddStringToObject(obj, field_name, field_value);
+    out = cJSON_PrintUnformatted(obj);
+    cJSON_Delete(obj);
+    return out;
+}
+
+/* Derive the key_id (first 16 hex chars of the pubkey) into out[17]. */
+static void derive_key_id_from_hex_pubkey(const char *pubkey_hex, char out[17])
+{
+    if (pubkey_hex == NULL || out == NULL) {
+        return;
+    }
+    if (strlen(pubkey_hex) >= 16) {
+        memcpy(out, pubkey_hex, 16);
+        out[16] = '\0';
+    } else {
+        out[0] = '\0';
+    }
+}
+
+/* ---- Unified algorithm key derivation ----
+ *
+ * Derives the keypair for (alg, index) from s_seed. For classical algorithms
+ * fills privkey[32] + pubkey[32] and pubkey_hex[65]. For PQ algorithms fills
+ * the static s_pq_pk / s_pq_sk buffers and pubkey_hex (full PQ pubkey hex).
+ *
+ * For ml-kem-768 the "privkey" concept is the PQ secret key; callers that need
+ * the privkey bytes should read s_pq_sk directly.
+ *
+ * Returns 0 on success, -1 on error. pubkey_hex_out must be large enough for
+ * the algorithm's pubkey (2*FW_ML_DSA_65_PUBKEY_LEN+1 worst case -> use s_pq_hex).
+ */
+static int derive_alg_key(fw_alg_t alg, uint32_t index,
+                          uint8_t privkey_out[32], char *pubkey_hex_out,
+                          size_t pubkey_hex_out_len)
+{
+    uint8_t pubkey32[32];
+
+    if (pubkey_hex_out == NULL || pubkey_hex_out_len < 65) {
+        return -1;
+    }
+    pubkey_hex_out[0] = '\0';
+
+    switch (alg) {
+        case FW_ALG_SECP256K1:
+            if (privkey_out == NULL) {
+                return -1;
+            }
+            if (derive_nostr_key_index(s_seed, index, privkey_out, pubkey32) != 0) {
+                return -1;
+            }
+            bytes_to_hex(pubkey32, 32, pubkey_hex_out, pubkey_hex_out_len);
+            secure_memzero(pubkey32, sizeof(pubkey32));
+            return 0;
+
+        case FW_ALG_ED25519:
+            if (privkey_out == NULL) {
+                return -1;
+            }
+            if (derive_ed25519_key(s_seed, index, privkey_out, pubkey32) != 0) {
+                return -1;
+            }
+            bytes_to_hex(pubkey32, 32, pubkey_hex_out, pubkey_hex_out_len);
+            secure_memzero(pubkey32, sizeof(pubkey32));
+            return 0;
+
+        case FW_ALG_X25519:
+            if (privkey_out == NULL) {
+                return -1;
+            }
+            if (derive_x25519_key(s_seed, index, privkey_out, pubkey32) != 0) {
+                return -1;
+            }
+            bytes_to_hex(pubkey32, 32, pubkey_hex_out, pubkey_hex_out_len);
+            secure_memzero(pubkey32, sizeof(pubkey32));
+            return 0;
+
+        case FW_ALG_ML_DSA_65:
+            if (derive_ml_dsa_65_key(s_seed, index, s_pq_pk, s_pq_sk) != 0) {
+                return -1;
+            }
+            bytes_to_hex(s_pq_pk, FW_ML_DSA_65_PUBKEY_LEN, pubkey_hex_out, pubkey_hex_out_len);
+            return 0;
+
+        case FW_ALG_SLH_DSA_128S:
+            ui_show_approval_prompt("system", 0, "deriving SLH-DSA key (slow)...", 30000);
+            if (derive_slh_dsa_128s_key(s_seed, index, s_pq_pk, s_pq_sk) != 0) {
+                return -1;
+            }
+            bytes_to_hex(s_pq_pk, FW_SLH_DSA_128S_PUBKEY_LEN, pubkey_hex_out, pubkey_hex_out_len);
+            return 0;
+
+        case FW_ALG_ML_KEM_768:
+            if (derive_ml_kem_768_key(s_seed, index, s_pq_pk, s_pq_sk) != 0) {
+                return -1;
+            }
+            bytes_to_hex(s_pq_pk, FW_ML_KEM_768_PUBKEY_LEN, pubkey_hex_out, pubkey_hex_out_len);
+            return 0;
+
+        default:
+            return -1;
+    }
+}
+
+static void zeroize_pq_keys(void)
+{
+    secure_memzero(s_pq_pk, sizeof(s_pq_pk));
+    secure_memzero(s_pq_sk, sizeof(s_pq_sk));
+    secure_memzero(s_pq_sig, sizeof(s_pq_sig));
+}
+
 static approval_decision_t wait_for_approval(uint32_t timeout_ms)
 {
     ui_approval_decision_t ui_decision = ui_wait_for_approval(timeout_ms);
@@ -750,12 +1082,1311 @@ static int apply_mnemonic_and_enter_working(const char *mnemonic)
     printf("Derived npub[0]: %s\n", s_npub);
     printf("Derived pubkey hex[0]: %s\n", s_pubkey_hex);
 
+    /* Derive the OTP pad from the mnemonic seed (no USB pad on CYD).
+     * HKDF-SHA256(salt="nsigner-otp", ikm=seed, info="otp-pad") -> 1024 bytes.
+     * The offset advances monotonically across encrypt/decrypt requests. */
+    {
+        static const uint8_t otp_salt[12] = "nsigner-otp";
+        static const uint8_t otp_info[7] = "otp-pad";
+        if (nostr_hkdf(otp_salt, sizeof(otp_salt) - 1,
+                       s_seed, sizeof(s_seed),
+                       otp_info, sizeof(otp_info) - 1,
+                       s_otp_pad, sizeof(s_otp_pad)) != 0) {
+            ESP_LOGE(TAG, "OTP pad derivation failed");
+            s_otp_pad_len = 0;
+        } else {
+            s_otp_pad_len = sizeof(s_otp_pad);
+        }
+        s_otp_offset = 0;
+    }
+
     show_idle_screen();
 
     secure_memzero(s_pubkey, sizeof(s_pubkey));
     return 0;
 }
 
+/* ---- Base64 helpers (for OTP encode/decode) ---- */
+
+static const char b64_chars[] =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static int b64_encode(const uint8_t *in, size_t in_len, char *out, size_t out_max)
+{
+    size_t i = 0;
+    size_t o = 0;
+    size_t v;
+
+    if (in == NULL || out == NULL) {
+        return -1;
+    }
+    /* 4/3 expansion + padding + nul */
+    if (out_max < ((in_len + 2) / 3) * 4 + 1) {
+        return -1;
+    }
+
+    while (i + 2 < in_len) {
+        v = ((size_t)in[i] << 16) | ((size_t)in[i + 1] << 8) | (size_t)in[i + 2];
+        out[o++] = b64_chars[(v >> 18) & 0x3f];
+        out[o++] = b64_chars[(v >> 12) & 0x3f];
+        out[o++] = b64_chars[(v >> 6) & 0x3f];
+        out[o++] = b64_chars[v & 0x3f];
+        i += 3;
+    }
+    if (i < in_len) {
+        v = (size_t)in[i] << 16;
+        if (i + 1 < in_len) {
+            v |= (size_t)in[i + 1] << 8;
+        }
+        out[o++] = b64_chars[(v >> 18) & 0x3f];
+        out[o++] = b64_chars[(v >> 12) & 0x3f];
+        out[o++] = (i + 1 < in_len) ? b64_chars[(v >> 6) & 0x3f] : '=';
+        out[o++] = '=';
+    }
+    out[o] = '\0';
+    return 0;
+}
+
+static int b64_decode(const char *in, size_t in_len, uint8_t *out, size_t out_max, size_t *out_len)
+{
+    int8_t dec[256];
+    size_t i = 0;
+    size_t o = 0;
+    int val = 0;
+    int valb = -8;
+
+    if (in == NULL || out == NULL || out_len == NULL) {
+        return -1;
+    }
+    memset(dec, -1, sizeof(dec));
+    for (i = 0; i < 64; ++i) {
+        dec[(uint8_t)b64_chars[i]] = (int8_t)i;
+    }
+
+    *out_len = 0;
+    for (i = 0; i < in_len; ++i) {
+        char c = in[i];
+        if (c == '=') {
+            break;
+        }
+        if (dec[(uint8_t)c] == -1) {
+            continue;
+        }
+        if (o >= out_max) {
+            return -1;
+        }
+        val = (val << 6) | dec[(uint8_t)c];
+        valb += 6;
+        if (valb >= 0) {
+            out[o++] = (uint8_t)((val >> valb) & 0xff);
+            valb -= 8;
+        }
+    }
+    *out_len = o;
+    return 0;
+}
+
+/* ---- x25519 ECDH shared secret via PSA crypto ---- */
+static int x25519_ecdh(const uint8_t priv[32], const uint8_t peer_pub[32],
+                       uint8_t shared_out[32])
+{
+    psa_status_t status;
+    psa_key_id_t key_id = 0;
+    psa_key_attributes_t attrs = PSA_KEY_ATTRIBUTES_INIT;
+    size_t shared_len = 0;
+
+    psa_crypto_init();
+    psa_set_key_type(&attrs, PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY));
+    psa_set_key_bits(&attrs, 255);
+    psa_set_key_usage_flags(&attrs, PSA_KEY_USAGE_DERIVE);
+    psa_set_key_algorithm(&attrs, PSA_ALG_ECDH);
+
+    status = psa_import_key(&attrs, priv, 32, &key_id);
+    if (status != PSA_SUCCESS) {
+        return -1;
+    }
+    status = psa_raw_key_agreement(PSA_ALG_ECDH, key_id, peer_pub, 32, shared_out, 32, &shared_len);
+    psa_destroy_key(key_id);
+    if (status != PSA_SUCCESS || shared_len != 32) {
+        return -1;
+    }
+    return 0;
+}
+
+/* ---- secp256k1 ECDSA sign/verify (scheme:"ecdsa") ---- */
+static int secp256k1_ecdsa_sign32(const uint8_t privkey[32], const uint8_t msg32[32],
+                                  uint8_t sig_out[64])
+{
+    secp256k1_context *ctx = NULL;
+    secp256k1_ecdsa_signature sig;
+    int rc = -1;
+
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
+    if (ctx == NULL) {
+        return -1;
+    }
+    if (!secp256k1_ecdsa_sign(ctx, &sig, msg32, privkey, NULL, NULL)) {
+        goto done;
+    }
+    secp256k1_ecdsa_signature_serialize_compact(ctx, sig_out, &sig);
+    rc = 0;
+done:
+    secp256k1_context_destroy(ctx);
+    return rc;
+}
+
+static int secp256k1_ecdsa_verify32(const uint8_t msg32[32], const uint8_t sig64[64],
+                                    const uint8_t pubkey32[32])
+{
+    secp256k1_context *ctx = NULL;
+    secp256k1_ecdsa_signature sig;
+    secp256k1_pubkey pub;
+    int rc = -1;
+
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
+    if (ctx == NULL) {
+        return -1;
+    }
+    if (!secp256k1_ecdsa_signature_parse_compact(ctx, &sig, sig64)) {
+        goto done;
+    }
+    if (!secp256k1_ec_pubkey_parse(ctx, &pub, pubkey32, 33)) {
+        /* try 33-byte compressed first; fall back to 32-byte x-only via tweak */
+        goto done;
+    }
+    rc = secp256k1_ecdsa_verify(ctx, &sig, msg32, &pub) ? 0 : -1;
+done:
+    secp256k1_context_destroy(ctx);
+    return rc;
+}
+
+/* Derive a 33-byte compressed secp256k1 pubkey from a 32-byte private key. */
+static int secp256k1_priv_to_compressed_pub(const uint8_t priv[32], uint8_t pub33[33])
+{
+    secp256k1_context *ctx = NULL;
+    secp256k1_pubkey pub;
+    size_t olen = 33;
+    int rc = -1;
+
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
+    if (ctx == NULL) {
+        return -1;
+    }
+    if (!secp256k1_ec_pubkey_create(ctx, &pub, priv)) {
+        goto done;
+    }
+    if (!secp256k1_ec_pubkey_serialize(ctx, pub33, &olen, &pub, SECP256K1_EC_COMPRESSED)) {
+        goto done;
+    }
+    rc = 0;
+done:
+    secp256k1_context_destroy(ctx);
+    return rc;
+}
+
+/* ed25519 sign/verify are provided by key_derivation.{c,h} (PSA crypto). */
+
+/* ---- Request handler: fills s_response_buf for the given parsed request ----
+ *
+ * req        : parsed JSON-RPC request object (caller frees)
+ * method     : the "method" string
+ * id_token   : raw JSON "id" token for the response (e.g. "\"1\"" or "null")
+ * caller_hex : 64-hex caller pubkey from the auth envelope (or "anon")
+ */
+static void handle_request(cJSON *req, const char *method, const char *id_token,
+                           const char *caller_hex)
+{
+    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
+    char key_id[17];
+
+    /* ===================== Nostr verbs (secp256k1 NIP-06) ===================== */
+
+    if (strcmp(method, VERB_NOSTR_GET_PUBLIC_KEY) == 0) {
+        uint32_t nostr_index = 0;
+        uint8_t req_privkey[32];
+        char req_pubkey_hex[65];
+        cJSON *options = NULL;
+        const char *fmt = NULL;
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
+
+        if (!cJSON_IsArray(params) ||
+            parse_nostr_index_from_params(params, &nostr_index) != 0 ||
+            derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+        } else {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, "nostr_get_public_key");
+            if (d == APPROVAL_ONCE || d == APPROVAL_ALWAYS) {
+                ui_add_event("nostr_get_public_key", caller_hex, "approved");
+                parse_options_from_params(params, &options);
+                if (options != NULL) {
+                    cJSON *f = cJSON_GetObjectItemCaseSensitive(options, "format");
+                    if (cJSON_IsString(f)) {
+                        fmt = f->valuestring;
+                    }
+                }
+                if (fmt != NULL && strcmp(fmt, "structured") == 0) {
+                    derive_key_id_from_hex_pubkey(req_pubkey_hex, key_id);
+                    char *res = build_alg_result_json("secp256k1", key_id, "public_key", req_pubkey_hex);
+                    if (res != NULL) {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                                 "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res);
+                        cJSON_free(res);
+                    } else {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                                 "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"internal error\"}}",
+                                 id_token, ERR_INTERNAL);
+                    }
+                } else {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":\"%s\"}", id_token, req_pubkey_hex);
+                }
+            } else if (d == APPROVAL_DENY) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"denied by user\"}}",
+                         id_token, ERR_DENIED_BY_USER);
+            } else {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"approval timeout\"}}",
+                         id_token, ERR_APPROVAL_TIMEOUT);
+            }
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        return;
+    }
+
+    if (strcmp(method, VERB_NOSTR_SIGN_EVENT) == 0) {
+        cJSON *event_in = NULL;
+        uint32_t nostr_index = 0;
+        uint8_t req_privkey[32];
+        char req_pubkey_hex[65];
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
+
+        if (cJSON_IsArray(params) && cJSON_GetArraySize(params) > 0) {
+            event_in = cJSON_GetArrayItem(params, 0);
+        }
+        if (event_in != NULL && cJSON_IsObject(event_in) &&
+            parse_nostr_index_from_params(params, &nostr_index) == 0 &&
+            derive_request_key(nostr_index, req_privkey, req_pubkey_hex) == 0) {
+            approval_decision_t d = APPROVAL_ALWAYS;
+            int event_kind = 1;
+            char event_extra[32];
+            const cJSON *kind_item = cJSON_GetObjectItemCaseSensitive(event_in, "kind");
+
+            if (cJSON_IsNumber(kind_item)) {
+                event_kind = kind_item->valueint;
+            }
+            if (!s_always_allow_sign) {
+                show_approval_prompt_with_caller(event_in, caller_hex);
+                d = wait_for_approval(APPROVAL_TIMEOUT_MS);
+                if (d == APPROVAL_ALWAYS) {
+                    s_always_allow_sign = true;
+                }
+            }
+            if ((d == APPROVAL_ONCE || d == APPROVAL_ALWAYS) &&
+                build_signed_event_json(event_in, req_pubkey_hex, req_privkey,
+                                        s_signed_event_buf, sizeof(s_signed_event_buf)) == 0) {
+                snprintf(event_extra, sizeof(event_extra), "kind:%d", event_kind);
+                ui_add_event("nostr_sign_event", caller_hex, event_extra);
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, s_signed_event_buf);
+            } else if (d == APPROVAL_DENY) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"denied by user\"}}",
+                         id_token, ERR_DENIED_BY_USER);
+            } else if (d == APPROVAL_TIMEOUT) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"approval timeout\"}}",
+                         id_token, ERR_APPROVAL_TIMEOUT);
+            } else {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"internal error\"}}",
+                         id_token, ERR_INTERNAL);
+            }
+        } else {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        return;
+    }
+
+    if (strcmp(method, VERB_NOSTR_MINE_EVENT) == 0) {
+        cJSON *event_in = NULL;
+        uint32_t nostr_index = 0;
+        uint8_t req_privkey[32];
+        char req_pubkey_hex[65];
+        cJSON *options = NULL;
+        int difficulty = 4;
+        int timeout_sec = 30;
+        uint32_t nonce = 0;
+        int64_t deadline_ms;
+        int mined = 0;
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
+
+        if (cJSON_IsArray(params) && cJSON_GetArraySize(params) > 0) {
+            event_in = cJSON_GetArrayItem(params, 0);
+        }
+        parse_options_from_params(params, &options);
+        if (options != NULL) {
+            cJSON *d_item = cJSON_GetObjectItemCaseSensitive(options, "difficulty");
+            cJSON *t_item = cJSON_GetObjectItemCaseSensitive(options, "timeout_sec");
+            if (cJSON_IsNumber(d_item) && d_item->valueint > 0) {
+                difficulty = d_item->valueint;
+            }
+            if (cJSON_IsNumber(t_item) && t_item->valueint > 0) {
+                timeout_sec = t_item->valueint;
+            }
+        }
+
+        if (event_in == NULL || !cJSON_IsObject(event_in) ||
+            parse_nostr_index_from_params(params, &nostr_index) != 0 ||
+            derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            secure_memzero(req_privkey, sizeof(req_privkey));
+            return;
+        }
+
+        {
+            approval_decision_t d = APPROVAL_ALWAYS;
+            if (!s_always_allow_sign) {
+                show_approval_prompt_with_caller(event_in, caller_hex);
+                d = wait_for_approval(APPROVAL_TIMEOUT_MS);
+                if (d == APPROVAL_ALWAYS) {
+                    s_always_allow_sign = true;
+                }
+            }
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                secure_memzero(req_privkey, sizeof(req_privkey));
+                return;
+            }
+        }
+
+        ui_show_approval_prompt(caller_hex, 0, "mining event...", (uint32_t)timeout_sec * 1000);
+        deadline_ms = (int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) + (int64_t)timeout_sec * 1000;
+
+        /* Iterate nonce in a "nonce" tag until the event id has `difficulty`
+         * leading zero bits. Single-threaded. */
+        while ((int64_t)(xTaskGetTickCount() * portTICK_PERIOD_MS) < deadline_ms) {
+            cJSON *tags_item = cJSON_GetObjectItemCaseSensitive(event_in, "tags");
+            cJSON *nonce_tag = NULL;
+            cJSON *ser_arr = NULL;
+            char *ser_json = NULL;
+            uint8_t id32[32];
+            char id_hex[65];
+            int leading_zeros = 0;
+
+            /* Ensure a nonce tag exists as the last tag. */
+            if (cJSON_IsArray(tags_item)) {
+                int tn = cJSON_GetArraySize(tags_item);
+                if (tn > 0) {
+                    cJSON *last = cJSON_GetArrayItem(tags_item, tn - 1);
+                    if (cJSON_IsArray(last) && cJSON_GetArraySize(last) >= 1) {
+                        cJSON *k0 = cJSON_GetArrayItem(last, 0);
+                        if (cJSON_IsString(k0) && strcmp(k0->valuestring, "nonce") == 0) {
+                            nonce_tag = last;
+                        }
+                    }
+                }
+            }
+            if (nonce_tag == NULL) {
+                if (!cJSON_IsArray(tags_item)) {
+                    cJSON_AddItemToObject(event_in, "tags", (tags_item = cJSON_CreateArray()));
+                }
+                nonce_tag = cJSON_CreateArray();
+                cJSON_AddItemToArray(tags_item, nonce_tag);
+            }
+            /* (re)build nonce tag: ["nonce", "", ""] */
+            while (cJSON_GetArraySize(nonce_tag) > 0) {
+                cJSON_DeleteItemFromArray(nonce_tag, cJSON_GetArraySize(nonce_tag) - 1);
+            }
+            cJSON_AddItemToArray(nonce_tag, cJSON_CreateString("nonce"));
+            {
+                char nonce_str[16];
+                snprintf(nonce_str, sizeof(nonce_str), "%u", (unsigned int)nonce);
+                cJSON_AddItemToArray(nonce_tag, cJSON_CreateString(nonce_str));
+            }
+            {
+                char diff_str[16];
+                snprintf(diff_str, sizeof(diff_str), "%d", difficulty);
+                cJSON_AddItemToArray(nonce_tag, cJSON_CreateString(diff_str));
+            }
+
+            ser_arr = cJSON_CreateArray();
+            cJSON_AddItemToArray(ser_arr, cJSON_CreateNumber(0));
+            cJSON_AddItemToArray(ser_arr, cJSON_CreateString(req_pubkey_hex));
+            {
+                const cJSON *c = cJSON_GetObjectItemCaseSensitive(event_in, "created_at");
+                cJSON_AddItemToArray(ser_arr, cJSON_IsNumber(c) ? cJSON_Duplicate(c, 1) : cJSON_CreateNumber(0));
+            }
+            {
+                const cJSON *k = cJSON_GetObjectItemCaseSensitive(event_in, "kind");
+                cJSON_AddItemToArray(ser_arr, cJSON_IsNumber(k) ? cJSON_Duplicate(k, 1) : cJSON_CreateNumber(1));
+            }
+            {
+                const cJSON *t = cJSON_GetObjectItemCaseSensitive(event_in, "tags");
+                cJSON_AddItemToArray(ser_arr, cJSON_IsArray(t) ? cJSON_Duplicate(t, 1) : cJSON_CreateArray());
+            }
+            {
+                const cJSON *ct = cJSON_GetObjectItemCaseSensitive(event_in, "content");
+                cJSON_AddItemToArray(ser_arr, cJSON_IsString(ct) ? cJSON_CreateString(ct->valuestring) : cJSON_CreateString(""));
+            }
+            ser_json = cJSON_PrintUnformatted(ser_arr);
+            if (ser_json != NULL) {
+                sha256_bytes((const uint8_t *)ser_json, strlen(ser_json), id32);
+                /* count leading zero bits */
+                for (int b = 0; b < 32 && leading_zeros < difficulty; ++b) {
+                    uint8_t byte = id32[b];
+                    if (byte == 0) {
+                        leading_zeros += 8;
+                        continue;
+                    }
+                    while ((byte & 0x80) == 0) {
+                        leading_zeros++;
+                        byte <<= 1;
+                    }
+                    break;
+                }
+                if (leading_zeros >= difficulty) {
+                    bytes_to_hex(id32, 32, id_hex, sizeof(id_hex));
+                    if (build_signed_event_json(event_in, req_pubkey_hex, req_privkey,
+                                                s_signed_event_buf, sizeof(s_signed_event_buf)) == 0) {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                                 "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, s_signed_event_buf);
+                        ui_add_event("nostr_mine_event", caller_hex, "mined");
+                        mined = 1;
+                    }
+                }
+            }
+            if (ser_arr) cJSON_Delete(ser_arr);
+            if (ser_json) cJSON_free(ser_json);
+            if (mined) {
+                break;
+            }
+            nonce++;
+            if ((nonce & 0xff) == 0) {
+                ui_pump();
+                vTaskDelay(pdMS_TO_TICKS(1));
+            }
+        }
+
+        if (!mined) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"mining failed (timeout)\"}}",
+                     id_token, ERR_MINING_FAILED);
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        return;
+    }
+
+    /* nip04 / nip44 encrypt + decrypt share the same param shape. */
+    if (strcmp(method, VERB_NOSTR_NIP04_ENCRYPT) == 0 ||
+        strcmp(method, VERB_NOSTR_NIP04_DECRYPT) == 0 ||
+        strcmp(method, VERB_NOSTR_NIP44_ENCRYPT) == 0 ||
+        strcmp(method, VERB_NOSTR_NIP44_DECRYPT) == 0) {
+        const char *peer_hex = NULL;
+        const char *message = NULL;
+        uint32_t nostr_index = 0;
+        uint8_t peer_pubkey[32];
+        uint8_t req_privkey[32];
+        char req_pubkey_hex[65];
+        int is_nip44 = (method[7] == '4'); /* nostr_nip44... vs nostr_nip04... */
+        int is_encrypt = (strstr(method, "encrypt") != NULL);
+        int rc = -1;
+
+        memset(peer_pubkey, 0, sizeof(peer_pubkey));
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
+        memset(s_encrypt_buf, 0, sizeof(s_encrypt_buf));
+
+        if (parse_peer_and_message_params(params, &peer_hex, &message, &nostr_index) != 0 ||
+            hex_to_bytes(peer_hex, peer_pubkey, sizeof(peer_pubkey)) != 0 ||
+            derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+        } else {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d == APPROVAL_ONCE || d == APPROVAL_ALWAYS) {
+                ui_add_event(method, caller_hex, "approved");
+                if (is_nip44) {
+                    rc = is_encrypt
+                        ? nostr_nip44_encrypt(req_privkey, peer_pubkey, message, s_encrypt_buf, sizeof(s_encrypt_buf))
+                        : nostr_nip44_decrypt(req_privkey, peer_pubkey, message, s_encrypt_buf, sizeof(s_encrypt_buf));
+                } else {
+                    rc = is_encrypt
+                        ? nostr_nip04_encrypt(req_privkey, peer_pubkey, message, s_encrypt_buf, sizeof(s_encrypt_buf))
+                        : nostr_nip04_decrypt(req_privkey, peer_pubkey, message, s_encrypt_buf, sizeof(s_encrypt_buf));
+                }
+                if (rc != NOSTR_SUCCESS) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s failed\"}}",
+                             id_token, ERR_INTERNAL, method);
+                } else {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":\"%s\"}", id_token, s_encrypt_buf);
+                }
+            } else if (d == APPROVAL_DENY) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"denied by user\"}}",
+                         id_token, ERR_DENIED_BY_USER);
+            } else {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"approval timeout\"}}",
+                         id_token, ERR_APPROVAL_TIMEOUT);
+            }
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        secure_memzero(peer_pubkey, sizeof(peer_pubkey));
+        return;
+    }
+
+    /* ===================== Algorithm-based verbs ===================== */
+
+    /* get_public_key (algorithm-based) */
+    if (strcmp(method, VERB_GET_PUBLIC_KEY) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        uint8_t req_privkey[32];
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, "get_public_key");
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                zeroize_pq_keys();
+                secure_memzero(req_privkey, sizeof(req_privkey));
+                return;
+            }
+            ui_add_event("get_public_key", caller_hex, fw_alg_name(alg));
+            if (derive_alg_key(alg, index, req_privkey, s_pq_hex, sizeof(s_pq_hex)) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"key derivation failed\"}}",
+                         id_token, ERR_INTERNAL);
+            } else {
+                derive_key_id_from_hex_pubkey(s_pq_hex, key_id);
+                char *res = build_alg_result_json(fw_alg_name(alg), key_id, "public_key", s_pq_hex);
+                if (res != NULL) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res);
+                    cJSON_free(res);
+                } else {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"internal error\"}}",
+                             id_token, ERR_INTERNAL);
+                }
+            }
+        }
+        zeroize_pq_keys();
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        return;
+    }
+
+    /* sign + verify */
+    if (strcmp(method, VERB_SIGN) == 0 || strcmp(method, VERB_VERIFY) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        uint8_t req_privkey[32];
+        const char *msg_hex = NULL;
+        const char *sig_hex = NULL;
+        cJSON *msg_item = NULL;
+        cJSON *sig_item = NULL;
+        const char *scheme = "schnorr";
+        int is_verify = (strcmp(method, VERB_VERIFY) == 0);
+        uint8_t *msg_bytes = NULL;
+        size_t msg_len = 0;
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        if (!cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        msg_item = cJSON_GetArrayItem(params, 0);
+        if (!cJSON_IsString(msg_item) || msg_item->valuestring == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        msg_hex = msg_item->valuestring;
+        if (is_verify) {
+            sig_item = cJSON_GetArrayItem(params, 1);
+            if (!cJSON_IsString(sig_item) || sig_item->valuestring == NULL) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                         id_token, ERR_INVALID_PARAMS);
+                return;
+            }
+            sig_hex = sig_item->valuestring;
+        }
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+        if (alg == FW_ALG_SECP256K1 && options != NULL) {
+            cJSON *s = cJSON_GetObjectItemCaseSensitive(options, "scheme");
+            if (cJSON_IsString(s) && s->valuestring != NULL) {
+                scheme = s->valuestring;
+            }
+        }
+
+        /* decode message hex */
+        msg_len = strlen(msg_hex) / 2;
+        if (msg_len == 0 || strlen(msg_hex) % 2 != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        msg_bytes = (uint8_t *)malloc(msg_len);
+        if (msg_bytes == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"internal error\"}}",
+                     id_token, ERR_INTERNAL);
+            return;
+        }
+        if (hex_to_bytes(msg_hex, msg_bytes, msg_len) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            free(msg_bytes);
+            return;
+        }
+
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                free(msg_bytes);
+                zeroize_pq_keys();
+                secure_memzero(req_privkey, sizeof(req_privkey));
+                return;
+            }
+            ui_add_event(method, caller_hex, fw_alg_name(alg));
+
+            if (derive_alg_key(alg, index, req_privkey, s_pq_hex, sizeof(s_pq_hex)) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"key derivation failed\"}}",
+                         id_token, ERR_INTERNAL);
+            } else {
+                derive_key_id_from_hex_pubkey(s_pq_hex, key_id);
+                if (!is_verify) {
+                    /* ---- sign ---- */
+                    if (alg == FW_ALG_SECP256K1) {
+                        uint8_t msg32[32];
+                        uint8_t sig64[64];
+                        if (strcmp(scheme, "ecdsa") == 0) {
+                            sha256_bytes(msg_bytes, msg_len, msg32);
+                            if (secp256k1_ecdsa_sign32(req_privkey, msg32, sig64) == 0) {
+                                bytes_to_hex(sig64, 64, s_pq_hex, sizeof(s_pq_hex));
+                                char *res = build_alg_result_json("secp256k1", key_id, "signature", s_pq_hex);
+                                if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                                secure_memzero(msg32, sizeof(msg32));
+                                secure_memzero(sig64, sizeof(sig64));
+                            } else {
+                                snprintf(s_response_buf, sizeof(s_response_buf),
+                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"sign failed\"}}",
+                                    id_token, ERR_INTERNAL);
+                            }
+                        } else {
+                            /* schnorr: sign the 32-byte message directly (BIP-340) */
+                            if (msg_len == 32 && schnorr_sign32(req_privkey, msg_bytes, sig64) == 0) {
+                                bytes_to_hex(sig64, 64, s_pq_hex, sizeof(s_pq_hex));
+                                char *res = build_alg_result_json("secp256k1", key_id, "signature", s_pq_hex);
+                                if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                                secure_memzero(sig64, sizeof(sig64));
+                            } else {
+                                snprintf(s_response_buf, sizeof(s_response_buf),
+                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"schnorr sign requires 32-byte message\"}}",
+                                    id_token, ERR_INVALID_PARAMS);
+                            }
+                        }
+                    } else if (alg == FW_ALG_ED25519) {
+                        uint8_t sig64[64];
+                        /* ed25519 signs the raw message (PureEdDSA, variable length) */
+                        if (ed25519_sign_msg(req_privkey, msg_bytes, msg_len, sig64) == 0) {
+                            bytes_to_hex(sig64, 64, s_pq_hex, sizeof(s_pq_hex));
+                            char *res = build_alg_result_json("ed25519", key_id, "signature", s_pq_hex);
+                            if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                            secure_memzero(sig64, sizeof(sig64));
+                        } else {
+                            snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"ed25519 sign failed\"}}",
+                                id_token, ERR_INTERNAL);
+                        }
+                    } else if (alg == FW_ALG_ML_DSA_65) {
+                        size_t siglen = 0;
+                        if (fw_pq_ml_dsa_65_sign(s_pq_sig, &siglen, msg_bytes, msg_len, s_pq_sk) == 0) {
+                            bytes_to_hex(s_pq_sig, siglen, s_pq_hex, sizeof(s_pq_hex));
+                            char *res = build_alg_result_json("ml-dsa-65", key_id, "signature", s_pq_hex);
+                            if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                        } else {
+                            snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"ml-dsa-65 sign failed\"}}",
+                                id_token, ERR_INTERNAL);
+                        }
+                    } else if (alg == FW_ALG_SLH_DSA_128S) {
+                        size_t siglen = 0;
+                        ui_show_approval_prompt(caller_hex, 0, "SLH-DSA signing (slow)...", 60000);
+                        if (fw_pq_slh_dsa_128s_sign(s_pq_sig, &siglen, msg_bytes, msg_len, s_pq_sk) == 0) {
+                            bytes_to_hex(s_pq_sig, siglen, s_pq_hex, sizeof(s_pq_hex));
+                            char *res = build_alg_result_json("slh-dsa-128s", key_id, "signature", s_pq_hex);
+                            if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                        } else {
+                            snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"slh-dsa-128s sign failed\"}}",
+                                id_token, ERR_INTERNAL);
+                        }
+                    }
+                } else {
+                    /* ---- verify ---- */
+                    size_t sig_len = strlen(sig_hex) / 2;
+                    if (sig_len == 0 || strlen(sig_hex) % 2 != 0 ||
+                        sig_len > sizeof(s_pq_sig)) {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                            id_token, ERR_INVALID_PARAMS);
+                    } else if (hex_to_bytes(sig_hex, s_pq_sig, sig_len) != 0) {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                            id_token, ERR_INVALID_PARAMS);
+                    } else {
+                        int valid = 0;
+                        if (alg == FW_ALG_SECP256K1) {
+                            uint8_t msg32[32];
+                            if (strcmp(scheme, "ecdsa") == 0) {
+                                sha256_bytes(msg_bytes, msg_len, msg32);
+                                /* need compressed pubkey for ecdsa verify */
+                                uint8_t pub33[33];
+                                if (secp256k1_priv_to_compressed_pub(req_privkey, pub33) == 0 &&
+                                    secp256k1_ecdsa_verify32(msg32, s_pq_sig, pub33) == 0) {
+                                    valid = 1;
+                                }
+                                secure_memzero(pub33, sizeof(pub33));
+                                secure_memzero(msg32, sizeof(msg32));
+                            } else {
+                                /* schnorr verify against x-only pubkey (s_pq_hex holds x-only) */
+                                secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY);
+                                secp256k1_xonly_pubkey xonly;
+                                uint8_t pub32[32];
+                                if (ctx != NULL && hex_to_bytes(s_pq_hex, pub32, 32) == 0 &&
+                                    secp256k1_xonly_pubkey_parse(ctx, &xonly, pub32) &&
+                                    secp256k1_schnorrsig_verify(ctx, s_pq_sig, msg_bytes, msg_len, &xonly)) {
+                                    valid = 1;
+                                }
+                                if (ctx) secp256k1_context_destroy(ctx);
+                                secure_memzero(pub32, sizeof(pub32));
+                            }
+                        } else if (alg == FW_ALG_ED25519) {
+                            /* mbedtls ed25519 verify: sign/verify raw message */
+                            /* re-derive pubkey already in s_pq_hex; parse and verify */
+                            uint8_t pub32[32];
+                            if (hex_to_bytes(s_pq_hex, pub32, 32) == 0) {
+                                valid = (ed25519_verify_msg(s_pq_sig, sig_len, msg_bytes, msg_len, pub32) == 0);
+                            }
+                            secure_memzero(pub32, sizeof(pub32));
+                        } else if (alg == FW_ALG_ML_DSA_65) {
+                            valid = (fw_pq_ml_dsa_65_verify(s_pq_sig, sig_len, msg_bytes, msg_len, s_pq_pk) == 0);
+                        } else if (alg == FW_ALG_SLH_DSA_128S) {
+                            valid = (fw_pq_slh_dsa_128s_verify(s_pq_sig, sig_len, msg_bytes, msg_len, s_pq_pk) == 0);
+                        }
+                        if (valid) {
+                            char *res = build_alg_result_json(fw_alg_name(alg), NULL, "valid", "true");
+                            if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                        } else {
+                            char *res = build_alg_result_json(fw_alg_name(alg), NULL, "valid", "false");
+                            if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+                        }
+                    }
+                }
+            }
+        }
+        free(msg_bytes);
+        zeroize_pq_keys();
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        return;
+    }
+
+    /* encapsulate / decapsulate (ml-kem-768) */
+    if (strcmp(method, VERB_ENCAPSULATE) == 0 || strcmp(method, VERB_DECAPSULATE) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        const char *peer_hex = NULL;
+        const char *ct_hex = NULL;
+        cJSON *arg0 = NULL;
+        int is_decaps = (strcmp(method, VERB_DECAPSULATE) == 0);
+        uint8_t peer_pk[FW_ML_KEM_768_PUBKEY_LEN];
+        uint8_t ct[FW_ML_KEM_768_CIPHERTEXT_LEN];
+        uint8_t ss[FW_ML_KEM_768_SHARED_SECRET_LEN];
+
+        if (!cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        arg0 = cJSON_GetArrayItem(params, 0);
+        if (!cJSON_IsString(arg0) || arg0->valuestring == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                return;
+            }
+            ui_add_event(method, caller_hex, "ml-kem-768");
+
+            if (!is_decaps) {
+                /* encapsulate: arg0 = peer pubkey hex */
+                peer_hex = arg0->valuestring;
+                if (hex_to_bytes(peer_hex, peer_pk, sizeof(peer_pk)) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                        id_token, ERR_INVALID_PARAMS);
+                    return;
+                }
+                if (fw_pq_ml_kem_768_encaps(ct, ss, peer_pk) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"encapsulate failed\"}}",
+                        id_token, ERR_INTERNAL);
+                    return;
+                }
+                {
+                    char ct_hex_buf[FW_ML_KEM_768_CIPHERTEXT_LEN * 2 + 1];
+                    char ss_hex_buf[FW_ML_KEM_768_SHARED_SECRET_LEN * 2 + 1];
+                    cJSON *obj = cJSON_CreateObject();
+                    char *out = NULL;
+                    bytes_to_hex(ct, sizeof(ct), ct_hex_buf, sizeof(ct_hex_buf));
+                    bytes_to_hex(ss, sizeof(ss), ss_hex_buf, sizeof(ss_hex_buf));
+                    cJSON_AddStringToObject(obj, "ciphertext", ct_hex_buf);
+                    cJSON_AddStringToObject(obj, "shared_secret", ss_hex_buf);
+                    cJSON_AddStringToObject(obj, "algorithm", "ml-kem-768");
+                    out = cJSON_PrintUnformatted(obj);
+                    if (out) { snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, out); cJSON_free(out); }
+                    cJSON_Delete(obj);
+                }
+            } else {
+                /* decapsulate: arg0 = ciphertext hex; derive our keypair */
+                ct_hex = arg0->valuestring;
+                if (hex_to_bytes(ct_hex, ct, sizeof(ct)) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                        id_token, ERR_INVALID_PARAMS);
+                    return;
+                }
+                if (derive_alg_key(alg, index, NULL, s_pq_hex, sizeof(s_pq_hex)) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"key derivation failed\"}}",
+                        id_token, ERR_INTERNAL);
+                    return;
+                }
+                if (fw_pq_ml_kem_768_decaps(ss, ct, s_pq_sk) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"decapsulate failed\"}}",
+                        id_token, ERR_INTERNAL);
+                } else {
+                    char ss_hex_buf[FW_ML_KEM_768_SHARED_SECRET_LEN * 2 + 1];
+                    cJSON *obj = cJSON_CreateObject();
+                    char *out = NULL;
+                    bytes_to_hex(ss, sizeof(ss), ss_hex_buf, sizeof(ss_hex_buf));
+                    cJSON_AddStringToObject(obj, "shared_secret", ss_hex_buf);
+                    cJSON_AddStringToObject(obj, "algorithm", "ml-kem-768");
+                    out = cJSON_PrintUnformatted(obj);
+                    if (out) { snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, out); cJSON_free(out); }
+                    cJSON_Delete(obj);
+                }
+            }
+        }
+        zeroize_pq_keys();
+        secure_memzero(peer_pk, sizeof(peer_pk));
+        secure_memzero(ct, sizeof(ct));
+        secure_memzero(ss, sizeof(ss));
+        return;
+    }
+
+    /* derive_shared_secret (x25519) */
+    if (strcmp(method, VERB_DERIVE_SHARED) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        const char *peer_hex = NULL;
+        cJSON *arg0 = NULL;
+        uint8_t req_privkey[32];
+        uint8_t peer_pub[32];
+        uint8_t shared[32];
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(peer_pub, 0, sizeof(peer_pub));
+        memset(shared, 0, sizeof(shared));
+
+        if (!cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        arg0 = cJSON_GetArrayItem(params, 0);
+        if (!cJSON_IsString(arg0) || arg0->valuestring == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        peer_hex = arg0->valuestring;
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+        if (hex_to_bytes(peer_hex, peer_pub, 32) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                secure_memzero(req_privkey, sizeof(req_privkey));
+                secure_memzero(peer_pub, sizeof(peer_pub));
+                return;
+            }
+            ui_add_event(method, caller_hex, "x25519");
+            if (derive_alg_key(alg, index, req_privkey, s_pq_hex, sizeof(s_pq_hex)) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"key derivation failed\"}}",
+                     id_token, ERR_INTERNAL);
+            } else if (x25519_ecdh(req_privkey, peer_pub, shared) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"ecdh failed\"}}",
+                     id_token, ERR_INTERNAL);
+            } else {
+                char ss_hex[65];
+                cJSON *obj = cJSON_CreateObject();
+                char *out = NULL;
+                bytes_to_hex(shared, 32, ss_hex, sizeof(ss_hex));
+                cJSON_AddStringToObject(obj, "shared_secret", ss_hex);
+                cJSON_AddStringToObject(obj, "algorithm", "x25519");
+                out = cJSON_PrintUnformatted(obj);
+                if (out) { snprintf(s_response_buf, sizeof(s_response_buf),
+                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, out); cJSON_free(out); }
+                cJSON_Delete(obj);
+            }
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        secure_memzero(peer_pub, sizeof(peer_pub));
+        secure_memzero(shared, sizeof(shared));
+        return;
+    }
+
+    /* derive (secp256k1 HMAC-SHA256) */
+    if (strcmp(method, VERB_DERIVE) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        const char *data_str = NULL;
+        cJSON *arg0 = NULL;
+        uint8_t req_privkey[32];
+        uint8_t mac[32];
+        char mac_hex[65];
+        cJSON *idx_item = NULL;
+
+        memset(req_privkey, 0, sizeof(req_privkey));
+        memset(mac, 0, sizeof(mac));
+
+        if (!cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        arg0 = cJSON_GetArrayItem(params, 0);
+        if (!cJSON_IsString(arg0) || arg0->valuestring == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        data_str = arg0->valuestring;
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+        /* index is required for derive (no default) */
+        if (options == NULL ||
+            (idx_item = cJSON_GetObjectItemCaseSensitive(options, "index")) == NULL ||
+            !cJSON_IsNumber(idx_item)) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"missing_index\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                secure_memzero(req_privkey, sizeof(req_privkey));
+                return;
+            }
+            ui_add_event(method, caller_hex, "derive");
+            if (derive_alg_key(alg, index, req_privkey, s_pq_hex, sizeof(s_pq_hex)) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"key derivation failed\"}}",
+                     id_token, ERR_INTERNAL);
+            } else if (nostr_hmac_sha256(req_privkey, 32,
+                                         (const unsigned char *)data_str, strlen(data_str),
+                                         mac) != 0) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"hmac failed\"}}",
+                     id_token, ERR_INTERNAL);
+            } else {
+                derive_key_id_from_hex_pubkey(s_pq_hex, key_id);
+                bytes_to_hex(mac, 32, mac_hex, sizeof(mac_hex));
+                char *res = build_alg_result_json("secp256k1", key_id, "digest", mac_hex);
+                if (res) { snprintf(s_response_buf, sizeof(s_response_buf),
+                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, res); cJSON_free(res); }
+            }
+        }
+        secure_memzero(req_privkey, sizeof(req_privkey));
+        secure_memzero(mac, sizeof(mac));
+        return;
+    }
+
+    /* encrypt / decrypt (otp) */
+    if (strcmp(method, VERB_ENCRYPT) == 0 || strcmp(method, VERB_DECRYPT) == 0) {
+        cJSON *options = NULL;
+        fw_alg_t alg;
+        uint32_t index = 0;
+        const char *payload = NULL;
+        cJSON *arg0 = NULL;
+        /* OTP encrypt and decrypt are the same XOR operation against the pad;
+         * the verb name is carried through for the UI event only. */
+        (void)method;
+        const char *encoding = "ascii"; /* parsed for API compatibility */
+        (void)encoding;
+
+        if (!cJSON_IsArray(params) || cJSON_GetArraySize(params) < 1) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        arg0 = cJSON_GetArrayItem(params, 0);
+        if (!cJSON_IsString(arg0) || arg0->valuestring == NULL) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        payload = arg0->valuestring;
+        parse_options_from_params(params, &options);
+        if (parse_algorithm_from_options(options, &alg, &index) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid params\"}}",
+                     id_token, ERR_INVALID_PARAMS);
+            return;
+        }
+        if (enforce_alg_verb(alg, method) != 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"algorithm_not_supported_for_verb\"}}",
+                     id_token, ERR_ALG_NOT_SUPPORTED);
+            return;
+        }
+        if (options != NULL) {
+            cJSON *e = cJSON_GetObjectItemCaseSensitive(options, "encoding");
+            if (cJSON_IsString(e) && e->valuestring != NULL) {
+                encoding = e->valuestring;
+            }
+        }
+        if (s_otp_pad_len == 0) {
+            snprintf(s_response_buf, sizeof(s_response_buf),
+                     "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"otp pad not initialized\"}}",
+                     id_token, ERR_INTERNAL);
+            return;
+        }
+
+        {
+            approval_decision_t d = prompt_non_sign_approval(caller_hex, 27235, method);
+            if (d != APPROVAL_ONCE && d != APPROVAL_ALWAYS) {
+                snprintf(s_response_buf, sizeof(s_response_buf),
+                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
+                         id_token,
+                         (d == APPROVAL_DENY) ? ERR_DENIED_BY_USER : ERR_APPROVAL_TIMEOUT,
+                         (d == APPROVAL_DENY) ? "denied by user" : "approval timeout");
+                return;
+            }
+            ui_add_event(method, caller_hex, "otp");
+
+            /* For encrypt: payload is base64 plaintext (ascii) or base64 (binary).
+             * For decrypt: payload is the ciphertext (base64 of the XOR output).
+             * We decode base64, XOR with the pad at the current offset, advance
+             * the offset, and re-encode. */
+            {
+                uint8_t buf[1024];
+                size_t buf_len = 0;
+                size_t need = 0;
+                size_t i;
+
+                if (b64_decode(payload, strlen(payload), buf, sizeof(buf), &buf_len) != 0) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"invalid base64\"}}",
+                        id_token, ERR_INVALID_PARAMS);
+                    return;
+                }
+                need = buf_len;
+                if (s_otp_offset + need > s_otp_pad_len) {
+                    snprintf(s_response_buf, sizeof(s_response_buf),
+                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"otp pad exhausted\"}}",
+                        id_token, ERR_INTERNAL);
+                    return;
+                }
+                for (i = 0; i < buf_len; ++i) {
+                    buf[i] ^= s_otp_pad[s_otp_offset + i];
+                }
+                s_otp_offset += buf_len;
+
+                {
+                    char out_b64[1400];
+                    if (b64_encode(buf, buf_len, out_b64, sizeof(out_b64)) != 0) {
+                        snprintf(s_response_buf, sizeof(s_response_buf),
+                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"internal error\"}}",
+                            id_token, ERR_INTERNAL);
+                    } else {
+                        cJSON *obj = cJSON_CreateObject();
+                        char *out = NULL;
+                        cJSON_AddStringToObject(obj, "result", out_b64);
+                        cJSON_AddStringToObject(obj, "algorithm", "otp");
+                        {
+                            char off_str[24];
+                            snprintf(off_str, sizeof(off_str), "%u", (unsigned)s_otp_offset);
+                            cJSON_AddStringToObject(obj, "pad_offset", off_str);
+                        }
+                        out = cJSON_PrintUnformatted(obj);
+                        if (out) { snprintf(s_response_buf, sizeof(s_response_buf),
+                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}", id_token, out); cJSON_free(out); }
+                        cJSON_Delete(obj);
+                    }
+                }
+                secure_memzero(buf, sizeof(buf));
+            }
+        }
+        return;
+    }
+
+    /* Unknown verb */
+    snprintf(s_response_buf, sizeof(s_response_buf),
+             "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"method not found\"}}",
+             id_token, ERR_METHOD_NOT_FOUND);
+}
+
 static void run_signing_loop(void)
 {
     uint32_t rx_frames = 0;
@@ -833,406 +2464,9 @@ static void run_signing_loop(void)
                         sizeof(s_response_buf),
                         "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":%d,\"message\":\"%s\"}}",
                         id_token, auth_rc, msg);
-                } else if (strcmp(method, "get_public_key") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    uint32_t nostr_index = 0;
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-
-                    if (!cJSON_IsArray(params) ||
-                        parse_nostr_index_from_params(params, &nostr_index) != 0 ||
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    } else {
-                        approval_decision_t decision = prompt_non_sign_approval(caller_pubkey_hex, 27235, "get_public_key");
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            ui_add_event("get_public_key", caller_pubkey_hex, "approved");
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":\"%s\"}",
-                                id_token,
-                                req_pubkey_hex);
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        }
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                } else if (strcmp(method, "sign_event") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    cJSON *event_in = NULL;
-                    uint32_t nostr_index = 0;
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-
-                    if (cJSON_IsArray(params) && cJSON_GetArraySize(params) > 0) {
-                        event_in = cJSON_GetArrayItem(params, 0);
-                    }
-
-                    if (event_in != NULL && cJSON_IsObject(event_in) &&
-                        parse_nostr_index_from_params(params, &nostr_index) == 0 &&
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) == 0) {
-                        approval_decision_t decision = APPROVAL_ALWAYS;
-                        int event_kind = 1;
-                        char event_extra[32];
-                        const cJSON *kind_item = cJSON_GetObjectItemCaseSensitive(event_in, "kind");
-
-                        if (cJSON_IsNumber(kind_item)) {
-                            event_kind = kind_item->valueint;
-                        }
-
-                        if (!s_always_allow_sign) {
-                            show_approval_prompt_with_caller(event_in, caller_pubkey_hex);
-                            decision = wait_for_approval(APPROVAL_TIMEOUT_MS);
-                            if (decision == APPROVAL_ALWAYS) {
-                                s_always_allow_sign = true;
-                            }
-                        }
-
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            snprintf(event_extra, sizeof(event_extra), "kind:%d", event_kind);
-                            ui_add_event("sign_event", caller_pubkey_hex, event_extra);
-                        }
-
-                        if ((decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) &&
-                            build_signed_event_json(event_in, req_pubkey_hex, req_privkey, s_signed_event_buf, sizeof(s_signed_event_buf)) == 0) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":%s}",
-                                id_token,
-                                s_signed_event_buf);
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else if (decision == APPROVAL_TIMEOUT) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"internal error\"}}",
-                                id_token);
-                        }
-                    } else {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                } else if (strcmp(method, "nip04_encrypt") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    const char *peer_hex = NULL;
-                    const char *plaintext = NULL;
-                    uint32_t nostr_index = 0;
-                    uint8_t peer_pubkey[32];
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(peer_pubkey, 0, sizeof(peer_pubkey));
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-                    memset(s_encrypt_buf, 0, sizeof(s_encrypt_buf));
-
-                    if (parse_peer_and_message_params(params, &peer_hex, &plaintext, &nostr_index) != 0 ||
-                        hex_to_bytes(peer_hex, peer_pubkey, sizeof(peer_pubkey)) != 0 ||
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    } else {
-                        approval_decision_t decision = prompt_non_sign_approval(caller_pubkey_hex, 27235, "nip04_encrypt");
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            ui_add_event("nip04_encrypt", caller_pubkey_hex, "approved");
-                            if (nostr_nip04_encrypt(req_privkey, peer_pubkey, plaintext,
-                                                    s_encrypt_buf, sizeof(s_encrypt_buf)) != NOSTR_SUCCESS) {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"nip04 encryption failed\"}}",
-                                    id_token);
-                            } else {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":\"%s\"}",
-                                    id_token,
-                                    s_encrypt_buf);
-                            }
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        }
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                    secure_memzero(peer_pubkey, sizeof(peer_pubkey));
-                } else if (strcmp(method, "nip44_encrypt") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    const char *peer_hex = NULL;
-                    const char *plaintext = NULL;
-                    uint32_t nostr_index = 0;
-                    uint8_t peer_pubkey[32];
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(peer_pubkey, 0, sizeof(peer_pubkey));
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-                    memset(s_encrypt_buf, 0, sizeof(s_encrypt_buf));
-
-                    if (parse_peer_and_message_params(params, &peer_hex, &plaintext, &nostr_index) != 0 ||
-                        hex_to_bytes(peer_hex, peer_pubkey, sizeof(peer_pubkey)) != 0 ||
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    } else {
-                        approval_decision_t decision = prompt_non_sign_approval(caller_pubkey_hex, 27235, "nip44_encrypt");
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            ui_add_event("nip44_encrypt", caller_pubkey_hex, "approved");
-                            if (nostr_nip44_encrypt(req_privkey, peer_pubkey, plaintext,
-                                                    s_encrypt_buf, sizeof(s_encrypt_buf)) != NOSTR_SUCCESS) {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"nip44 encryption failed\"}}",
-                                    id_token);
-                            } else {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"result\":\"%s\"}",
-                                    id_token,
-                                    s_encrypt_buf);
-                            }
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        }
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                    secure_memzero(peer_pubkey, sizeof(peer_pubkey));
-                } else if (strcmp(method, "nip04_decrypt") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    const char *peer_hex = NULL;
-                    const char *ciphertext = NULL;
-                    uint32_t nostr_index = 0;
-                    uint8_t peer_pubkey[32];
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(peer_pubkey, 0, sizeof(peer_pubkey));
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-                    memset(s_encrypt_buf, 0, sizeof(s_encrypt_buf));
-
-                    if (parse_peer_and_message_params(params, &peer_hex, &ciphertext, &nostr_index) != 0 ||
-                        hex_to_bytes(peer_hex, peer_pubkey, sizeof(peer_pubkey)) != 0 ||
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    } else {
-                        approval_decision_t decision = prompt_non_sign_approval(caller_pubkey_hex, 27235, "nip04_decrypt");
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            ui_add_event("nip04_decrypt", caller_pubkey_hex, "approved");
-                            if (nostr_nip04_decrypt(req_privkey, peer_pubkey, ciphertext,
-                                                    s_encrypt_buf, sizeof(s_encrypt_buf)) != NOSTR_SUCCESS) {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"nip04 decryption failed\"}}",
-                                    id_token);
-                            } else {
-                                cJSON *resp_obj = cJSON_CreateObject();
-                                if (resp_obj == NULL) {
-                                    snprintf(
-                                        s_response_buf,
-                                        sizeof(s_response_buf),
-                                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"internal error\"}}",
-                                        id_token);
-                                } else {
-                                    cJSON_AddStringToObject(resp_obj, "jsonrpc", "2.0");
-                                    cJSON_AddRawToObject(resp_obj, "id", id_token);
-                                    cJSON_AddStringToObject(resp_obj, "result", s_encrypt_buf);
-                                    {
-                                        char *resp_json = cJSON_PrintUnformatted(resp_obj);
-                                        if (resp_json != NULL && strlen(resp_json) < sizeof(s_response_buf)) {
-                                            memcpy(s_response_buf, resp_json, strlen(resp_json) + 1);
-                                        } else {
-                                            snprintf(
-                                                s_response_buf,
-                                                sizeof(s_response_buf),
-                                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"internal error\"}}",
-                                                id_token);
-                                        }
-                                        if (resp_json != NULL) {
-                                            cJSON_free(resp_json);
-                                        }
-                                    }
-                                    cJSON_Delete(resp_obj);
-                                }
-                            }
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        }
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                    secure_memzero(peer_pubkey, sizeof(peer_pubkey));
-                } else if (strcmp(method, "nip44_decrypt") == 0) {
-                    cJSON *params = cJSON_GetObjectItemCaseSensitive(req, "params");
-                    const char *peer_hex = NULL;
-                    const char *ciphertext = NULL;
-                    uint32_t nostr_index = 0;
-                    uint8_t peer_pubkey[32];
-                    uint8_t req_privkey[32];
-                    char req_pubkey_hex[65];
-
-                    memset(peer_pubkey, 0, sizeof(peer_pubkey));
-                    memset(req_privkey, 0, sizeof(req_privkey));
-                    memset(req_pubkey_hex, 0, sizeof(req_pubkey_hex));
-                    memset(s_encrypt_buf, 0, sizeof(s_encrypt_buf));
-
-                    if (parse_peer_and_message_params(params, &peer_hex, &ciphertext, &nostr_index) != 0 ||
-                        hex_to_bytes(peer_hex, peer_pubkey, sizeof(peer_pubkey)) != 0 ||
-                        derive_request_key(nostr_index, req_privkey, req_pubkey_hex) != 0) {
-                        snprintf(
-                            s_response_buf,
-                            sizeof(s_response_buf),
-                            "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32602,\"message\":\"invalid params\"}}",
-                            id_token);
-                    } else {
-                        approval_decision_t decision = prompt_non_sign_approval(caller_pubkey_hex, 27235, "nip44_decrypt");
-                        if (decision == APPROVAL_ONCE || decision == APPROVAL_ALWAYS) {
-                            ui_add_event("nip44_decrypt", caller_pubkey_hex, "approved");
-                            if (nostr_nip44_decrypt(req_privkey, peer_pubkey, ciphertext,
-                                                    s_encrypt_buf, sizeof(s_encrypt_buf)) != NOSTR_SUCCESS) {
-                                snprintf(
-                                    s_response_buf,
-                                    sizeof(s_response_buf),
-                                    "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"nip44 decryption failed\"}}",
-                                    id_token);
-                            } else {
-                                cJSON *resp_obj = cJSON_CreateObject();
-                                if (resp_obj == NULL) {
-                                    snprintf(
-                                        s_response_buf,
-                                        sizeof(s_response_buf),
-                                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"internal error\"}}",
-                                        id_token);
-                                } else {
-                                    cJSON_AddStringToObject(resp_obj, "jsonrpc", "2.0");
-                                    cJSON_AddRawToObject(resp_obj, "id", id_token);
-                                    cJSON_AddStringToObject(resp_obj, "result", s_encrypt_buf);
-                                    {
-                                        char *resp_json = cJSON_PrintUnformatted(resp_obj);
-                                        if (resp_json != NULL && strlen(resp_json) < sizeof(s_response_buf)) {
-                                            memcpy(s_response_buf, resp_json, strlen(resp_json) + 1);
-                                        } else {
-                                            snprintf(
-                                                s_response_buf,
-                                                sizeof(s_response_buf),
-                                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32603,\"message\":\"internal error\"}}",
-                                                id_token);
-                                        }
-                                        if (resp_json != NULL) {
-                                            cJSON_free(resp_json);
-                                        }
-                                    }
-                                    cJSON_Delete(resp_obj);
-                                }
-                            }
-                        } else if (decision == APPROVAL_DENY) {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32000,\"message\":\"denied by user\"}}",
-                                id_token);
-                        } else {
-                            snprintf(
-                                s_response_buf,
-                                sizeof(s_response_buf),
-                                "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32001,\"message\":\"approval timeout\"}}",
-                                id_token);
-                        }
-                    }
-
-                    secure_memzero(req_privkey, sizeof(req_privkey));
-                    secure_memzero(peer_pubkey, sizeof(peer_pubkey));
                 } else {
-                    snprintf(
-                        s_response_buf,
-                        sizeof(s_response_buf),
-                        "{\"jsonrpc\":\"2.0\",\"id\":%s,\"error\":{\"code\":-32601,\"message\":\"method not found\"}}",
-                        id_token);
+                    /* Algorithm-based + Nostr verb dispatch (see handle_request). */
+                    handle_request(req, method, id_token, caller_pubkey_hex);
                 }
             }
 
diff --git a/firmware/cyd_esp32_2432s028/sdkconfig.defaults b/firmware/cyd_esp32_2432s028/sdkconfig.defaults
index cfb501e..e3cddbf 100644
--- a/firmware/cyd_esp32_2432s028/sdkconfig.defaults
+++ b/firmware/cyd_esp32_2432s028/sdkconfig.defaults
@@ -8,3 +8,8 @@ CONFIG_PARTITION_TABLE_FILENAME="partitions.csv"
 CONFIG_FREERTOS_HZ=1000
 CONFIG_ESP_MAIN_TASK_STACK_SIZE=16384
 CONFIG_COMPILER_OPTIMIZATION_SIZE=y
+
+# PSA crypto for ed25519 sign/verify (IDF v5.x mbedtls has no mbedtls_ed25519_*).
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+# Curve25519 / Ed25519 ECP domain parameter (already enabled, kept for clarity).
+CONFIG_MBEDTLS_ECP_DP_CURVE25519_ENABLED=y
diff --git a/firmware/fpga_signer/README.md b/firmware/fpga_signer/README.md
new file mode 100644
index 0000000..87ac512
--- /dev/null
+++ b/firmware/fpga_signer/README.md
@@ -0,0 +1,192 @@
+# n_signer FPGA Signing Core
+
+**Status:** Concept — brainstorming. No plan yet.
+
+An FPGA-based secp256k1 signing core that provides the **maximum physical
+security** possible for Nostr signing: constant-time crypto (no instruction
+timing leakage), key material in FPGA fabric (no bus access to the key), and no
+firmware (no malware injection surface). The FPGA is a **signing oracle** — a
+small, auditable hardware module that does one thing (secp256k1 schnorr/ECDSA
+signing) with side-channel resistance that software on an MCU cannot match.
+
+## The secure element gap
+
+Commercial secure elements (NXP JCOP, Infineon, Microchip ATECC) support NIST
+curves (P-256, P-384) and RSA, but **not secp256k1** — the smart card industry
+standardized on NIST curves, and secp256k1 was treated as a "Bitcoin curve"
+that didn't get hardware support. This is why every Nostr/Bitcoin hardware
+wallet (Coldcard, Ledger, Trezor, Keystone) uses a **general-purpose MCU**
+running software secp256k1, not a secure element.
+
+An FPGA fills this gap: it gives us **hardware-level secp256k1** without relying
+on a secure element vendor to support the curve. We write the secp256k1 core
+ourselves in Verilog, with full control over the timing, the key storage, and
+the side-channel resistance.
+
+## Why an FPGA
+
+| Property | MCU (software) | FPGA (hardware) |
+|---|---|---|
+| Timing leakage | Branch prediction, cache, instruction timing | **None** — fixed datapath, every op takes the same cycles |
+| Key storage | RAM (accessible via bus/debug) | **FPGA fabric / BRAM** (no external bus access) |
+| Firmware attacks | OS, USB stack, BT stack = injection surface | **No firmware** — bitstream is the entire program |
+| Debug access | JTAG/SWD can read RAM | **No debug path to key** if not routed |
+| Auditability | Large codebase (thousands of lines of C) | **Small Verilog core** (~2000 lines, auditable) |
+| PQ crypto | Yes (software) | No (too complex for FPGA) |
+
+## Architecture: hybrid FPGA + MCU
+
+The practical design is a **two-chip hybrid**: the FPGA is the signing oracle,
+the MCU handles the protocol/UI/transport. The MCU sends a message hash + key
+index to the FPGA over SPI; the FPGA signs with the key in fabric; the FPGA
+returns the 64-byte signature. The private key never leaves the FPGA.
+
+```mermaid
+flowchart TD
+    subgraph Host_Side
+        Host[Host: laptop/phone
n_signer client]
+    end
+    subgraph Signer_Device
+        MCU[MCU: RP2040 or nRF52840
protocol + UI + transport
PQ crypto in software]
+        FPGA[FPGA: iCE40-UP5K
secp256k1 signing core
ed25519 signing core
SHA-256/512 cores
key in BRAM]
+        Display[OLED / e-paper display]
+        Buttons[approve / deny buttons]
+    end
+    Host -->|USB / IR / NFC / BLE| MCU
+    MCU -->|SPI: msg_hash + key_index| FPGA
+    FPGA -->|SPI: 64-byte signature| MCU
+    MCU --> Display
+    Buttons --> MCU
+    MCU -->|response| Host
+```
+
+### Division of labor
+
+| Function | Chip | Notes |
+|---|---|---|
+| Transport (USB/IR/NFC/BLE) | MCU | Ported from CYD/Teensy firmware |
+| JSON-RPC dispatch | MCU | Ported from `handle_request()` |
+| Auth envelope verify | MCU | secp256k1 schnorr verify (software) |
+| Approval UI (display + buttons) | MCU | Ported from CYD UI |
+| Mnemonic entry | MCU | BIP-39 wordlist + entry UI |
+| BIP-32 / SLIP-0010 key derivation | **FPGA** | SHA-512 HMAC core + derivation FSM |
+| secp256k1 schnorr sign | **FPGA** | Constant-time scalar multiply + schnorr |
+| secp256k1 ECDSA sign | **FPGA** | Same scalar multiply + RFC 6979 nonce |
+| ed25519 sign | **FPGA** | Curve25519 arithmetic core |
+| x25519 ECDH | **FPGA** | Same curve as ed25519 |
+| SHA-256 | **FPGA** | Hardware core (~1000 LUTs) |
+| SHA-512 | **FPGA** | Hardware core (~2000 LUTs) — needed for BIP-32 |
+| HMAC-SHA-256 | **FPGA** | SHA-256 core + FSM — for the `derive` verb |
+| NIP-04 / NIP-44 encryption | MCU | AES + ChaCha20 in software |
+| ML-DSA-65 / SLH-DSA-128s / ML-KEM-768 | MCU | PQClean in software (too complex for FPGA) |
+| nostr_mine_event (PoW) | MCU | SHA-256 hash loop in software (or offload to FPGA) |
+
+### Key storage in the FPGA
+
+The mnemonic seed (64 bytes) is loaded into the FPGA's BRAM at boot (sent by
+the MCU after the user enters the mnemonic). The FPGA derives secp256k1/ed25519/
+x25519 keys on demand using its SHA-512 + modular arithmetic cores. The derived
+private keys live in FPGA registers/BRAM and are **never readable from the SPI
+interface** — the SPI interface only accepts "sign this hash with key index N"
+commands and returns signatures. There is no "read key" command.
+
+This is the key security property: **the private key is physically unreachable
+from any external interface.** On an MCU, the key is in RAM and can be read via
+JTAG/SWD or a firmware exploit. On the FPGA, the key is in fabric and there is
+no path to it.
+
+## FPGA board options
+
+| Board | FPGA | LUTs | Toolchain | Price | Notes |
+|---|---|---|---|---|---|
+| **iCE40-UP5K** (e.g. iCEBreaker, Fomu) | iCE40UP5K | 5,300 | **Yosys + nextpnr** (open-source) | ~$15-20 | Best DIY choice. Open-source toolchain, DSP blocks, 128 KB BRAM, SPI flash. |
+| **Gowin Tang Nano 9K** | GW1NR-9 | 8,640 | Yosys + nextpnr (open-source) | ~$8 | Cheapest. Newer open-source support. |
+| **Lattice ECP5** (OrangeCrab, ULX3S) | LFE5U-12F / 25F / 45F | 12K-45K | Yosys + nextpnr (open-source) | ~$30-50 | More room. Supports **bitstream encryption** (important for production). |
+| **Xilinx Artix-7** (Arty A7) | XC7A35T | 33,280 | Vivado (proprietary) | ~$100 | Professional. Overkill for a signer. |
+
+**Recommendation: Lattice iCE40-UP5K for prototyping, ECP5 for production.**
+The iCE40 has the most mature open-source toolchain (Yosys + nextpnr) and is
+cheap. The ECP5 adds bitstream encryption (prevents bitstream cloning) for a
+production device.
+
+## The secp256k1 core (the hard part)
+
+The secp256k1 signing core is the main development effort. It needs:
+
+1. **256-bit modular arithmetic** over the secp256k1 prime field (p = 2²⁵⁶ - 2³² - 977):
+   - Modular add, subtract, multiply (Montgomery multiplication for performance)
+   - Modular inversion (Fermat's little theorem: a^(p-2) mod p, or extended Euclidean)
+2. **Point operations** on the secp256k1 curve (y² = x³ + 7):
+   - Point addition (Jacobian coordinates)
+   - Point doubling
+   - Scalar multiplication (constant-time double-and-add, no conditional branches)
+3. **Schnorr sign** (BIP-340):
+   - Deterministic nonce: k = HMAC-SHA256(d, x) where d is the key, x is the message hash
+   - R = k·G (point multiplication)
+   - e = tagged hash(R.x || P || m) (SHA-256)
+   - s = (k + e·x) mod n (scalar multiply + modular add)
+   - Signature = (R.x, s)
+4. **ECDSA sign** (for the `scheme:"ecdsa"` option):
+   - RFC 6979 deterministic nonce: k = HMAC-SHA256(x, m) with rejection sampling
+   - R = k·G
+   - r = R.x mod n
+   - s = k⁻¹ · (m + r·x) mod n
+   - Signature = (r, s)
+
+**Estimated size:** ~2000-5000 LUTs for the modular arithmetic + point
+multiplication + schnorr/ECDSA FSM. Fits comfortably in an iCE40-UP5K (5,300
+LUTs) alongside the SHA-256/512 cores and the SPI interface.
+
+**Estimated sign time:** ~1-5 ms at 12 MHz (iCE40-UP5K typical clock). The
+bottleneck is the 256-bit modular multiplication (~0.5-2 ms per multiply, ~256
+multiplies per scalar multiplication). This is **much faster than software**
+(the CYD's software schnorr sign takes ~10-50 ms).
+
+## Open questions
+
+- **Pure FPGA vs hybrid?** A pure-FPGA signer (no MCU) would implement the
+  entire dispatch + transport + UI in Verilog. This is extremely secure but
+  very hard to build (JSON parsing in Verilog is painful). The hybrid (FPGA
+  signing oracle + MCU protocol) is practical and still gives the key-isolation
+  benefit. **Lean toward hybrid.**
+- **Which MCU?** RP2040 (cheap, no WiFi) or nRF52840 (low power, NFC, BLE)?
+  This determines the transport options (USB, IR, NFC, BLE).
+- **Bitstream security:** iCE40 doesn't support bitstream encryption. If an
+  attacker reads the SPI flash, they get the bitstream (but not the key — the
+  key is loaded at runtime by the MCU, not stored in the bitstream). For
+  production, use ECP5 with bitstream encryption.
+- **Key loading:** the MCU sends the mnemonic seed to the FPGA at boot over
+  SPI. Is this SPI transfer vulnerable to sniffing? It happens once, at boot,
+  inside the device. If the device is physically sealed, the SPI bus is not
+  accessible. For higher security, the FPGA could derive the key from the
+  mnemonic internally (the MCU sends the mnemonic string, the FPGA does
+  PBKDF2-HMAC-SHA512 + BIP-32 derivation in hardware).
+- **ed25519 core:** worth implementing, or secp256k1-only? ed25519 is the same
+  field size (256-bit) but a different curve (Curve25519 vs secp256k1). The
+  modular arithmetic is similar but the curve operations differ. Adding
+  ed25519 roughly doubles the core size.
+- **Open-source secp256k1 FPGA cores:** are there existing Verilog secp256k1
+  cores we can reuse or adapt? (There are Bitcoin mining cores, but those do
+  double-SHA256, not ECDSA. Academic ECDSA-on-FPGA papers exist but the code
+  is rarely open-sourced. We'd likely write the core from scratch.)
+
+## Comparison to the other concepts
+
+| | FPGA signer (hybrid) | MCU-only (CYD/Teensy) | Secure element |
+|---|---|---|---|
+| secp256k1 side-channel resistance | **Best** (constant-time, key in fabric) | Medium (software, timing leakage) | N/A (no secp256k1 support) |
+| Key isolation | **Best** (no bus access to key) | Low (RAM, JTAG/SWD accessible) | Best (tamper-resistant) |
+| Firmware attack surface | **Minimal** (no firmware on FPGA) | Large (OS, USB, BT stacks) | Minimal (fixed function) |
+| PQ crypto | On MCU (software) | On MCU (software) | N/A |
+| Development effort | **High** (Verilog secp256k1 core) | Low (port existing C code) | High (NDA + Java Card) |
+| Cost | ~$15 FPGA + ~$4 MCU = ~$20 | ~$4-27 (MCU only) | ~$3-5 (chip only) |
+| Auditability | **High** (small Verilog core, open toolchain) | Medium (large C codebase) | Low (proprietary, NDA) |
+
+## Next steps
+
+- Decide: hybrid (FPGA + MCU) vs pure FPGA
+- Decide: iCE40-UP5K (prototype) vs ECP5 (production)
+- Decide: secp256k1-only vs secp256k1 + ed25519
+- Survey existing open-source secp256k1 / ECDSA FPGA cores
+- Write a Verilog secp256k1 modular arithmetic core (the foundation)
+- Write a plan (similar to [`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md))
diff --git a/firmware/ir_airgap_signer/README.md b/firmware/ir_airgap_signer/README.md
new file mode 100644
index 0000000..3f5a6a3
--- /dev/null
+++ b/firmware/ir_airgap_signer/README.md
@@ -0,0 +1,149 @@
+# n_signer IR Air-Gap Signer
+
+**Status:** Concept — brainstorming. No plan yet.
+
+A hardware signer that communicates with the host via **infrared light** —
+line-of-sight, short-range, physically directional. The signer never touches
+the host electrically: no wire, no radio, no shared ground. The only channel
+is modulated light through air. A small **USB receiver dongle** on the host
+decodes the IR signal and presents it as a CDC-ACM serial port.
+
+This is the strongest air-gap model in the n_signer family: the signer is
+electrically isolated from the host, and the receiver dongle is a dumb
+IR-to-serial bridge with no crypto, no keys, and ~200 lines of auditable
+firmware.
+
+## Concept
+
+```mermaid
+flowchart LR
+    Host[Host: laptop
n_signer client] -->|USB CDC| Dongle[USB IR receiver dongle
RP2040 + IR receiver]
+    Dongle -->|IR light
line-of-sight| Signer[IR signer
RP2040 + OLED + buttons]
+    Signer -->|approve/deny button| User[User]
+    Signer -->|IR light response| Dongle
+    Dongle -->|USB CDC| Host
+```
+
+The signer speaks the same algorithm-based API as the host and the CYD/Teensy
+firmware ([`README.md`](../../README.md) §4). The auth envelope (kind 27235)
+protects the IR wire. The receiver dongle is a transparent byte pipe — it has
+no knowledge of the protocol, no keys, and no state beyond the IR-to-USB
+bridge.
+
+## Why IR
+
+- **True air-gap** — the signer is electrically isolated from the host. No wire,
+  no radio, no shared ground. Host-side malware cannot reach the signer's
+  firmware through the communication channel.
+- **Line-of-sight required** — you point the signer at the receiver. An attacker
+  would need to be in the same room, in the line of sight, with their own IR
+  transmitter. Much smaller attack surface than BT (which broadcasts
+  omnidirectionally to ~10 m).
+- **Dumb dongle** — the USB receiver is a simple IR-to-serial bridge. ~200
+  lines of firmware, no crypto, no keys, fully auditable in an afternoon. If
+  compromised, it can only MITM the IR stream (which is already protected by the
+  auth envelope).
+- **No BT stack** — much smaller firmware attack surface on the signer. No
+  pairing, no GATT, no L2CAP, no SMP.
+- **Novel** — no hardware wallet uses IR for host communication. It's a
+  creative solution to the air-gap problem that avoids both the wire (USB) and
+  the radio (BT/NFC) attack surfaces.
+
+## Hardware (preliminary)
+
+### Signer
+
+| Component | Candidate | Notes |
+|---|---|---|
+| MCU | **RP2040** (Raspberry Pi Pico) | $4, Cortex-M0+ @ 133 MHz, 264 KB SRAM, no WiFi/BT (perfect for air-gap). Enough RAM for secp256k1 + ed25519. ML-DSA-65 fits (~6 KB heap). |
+| | or **nRF52840** | If you want NFC for mnemonic loading + lower power. |
+| IR transceiver | **38 kHz IR LED + TSOP38238** (raw async, 115200 baud, ~$1) | Simplest. ~11 KB/s. Fine for Nostr events (~500 bytes). Slow for PQ sigs (3-8 KB → 0.3-0.7 s). |
+| | or **TFBS4711 IrDA module** (~$2, up to 4 Mbps) | Faster (~400 KB/s) but harder to source + more complex protocol. |
+| Display | 0.96" SSD1306 OLED (I2C, ~$2) or 1.54" e-paper | Small is fine — shows "approve kind 1 from ?" |
+| Input | 2-3 tactile buttons (approve/deny/back) | |
+| Power | Coin cell or small LiPo | RP2040 + OLED + IR = very low power |
+
+### USB receiver dongle
+
+| Component | Candidate | Notes |
+|---|---|---|
+| MCU | **RP2040** (Pico) or **ATmega32U4** (Arduino Micro) | $4-8. Native USB device. |
+| IR receiver | Matching TSOP38238 or IrDA module | Must match the signer's IR modulation. |
+| USB | Native USB CDC-ACM | Presents as `/dev/ttyACM0` to the host. |
+| Firmware | ~200 lines | Read IR → write USB CDC; read USB CDC → transmit IR. A dumb pipe. No crypto, no keys, no state. |
+
+## Throughput
+
+| IR mode | Baud | Throughput | sign_event (500 B req + 600 B resp) | ML-DSA-65 sign (3.3 KB sig) |
+|---|---|---|---|---|
+| Raw 38 kHz async | 115200 | ~11 KB/s | ~100 ms | ~300 ms |
+| Raw 38 kHz async | 230400 | ~23 KB/s | ~50 ms | ~150 ms |
+| IrDA | 4 Mbps | ~400 KB/s | ~3 ms | ~8 ms |
+
+**Recommendation:** start with raw 38 kHz IR at 115200 baud (simplest, cheapest,
+works with any IR LED + TSOP receiver). Upgrade to 230400 or IrDA if PQ
+signature throughput is a bottleneck.
+
+## Protocol
+
+The IR link is **half-duplex** — the signer and receiver take turns
+transmitting. The protocol is simple:
+
+1. Host sends JSON-RPC request → USB CDC → dongle transmits IR.
+2. Signer receives IR, parses the request, shows approval prompt.
+3. User approves/denies.
+4. Signer transmits IR response → dongle → USB CDC → host.
+
+The 4-byte big-endian length-prefix framing (same as the CYD/feather) works
+over IR as-is. The auth envelope protects against MITM on the IR stream.
+
+## Security model
+
+- **Electrical isolation:** the signer has no electrical connection to the host.
+  The IR link is a one-way-at-a-time optical channel.
+- **Line-of-sight:** an attacker must be in the same room, in the line of sight,
+  with their own IR transmitter. The auth envelope + approval prompt protect
+  against a MITM even if the attacker intercepts the IR stream.
+- **Dumb dongle:** the USB receiver has no crypto, no keys, no protocol
+  knowledge. It's a byte pipe. If compromised, it can only MITM the IR stream
+  (already protected by the auth envelope). The dongle's firmware is small
+  enough to audit in an afternoon.
+- **No radio:** no BT, no WiFi, no NFC (unless you add NFC for mnemonic loading).
+  The signer emits no RF — only modulated IR light when actively transmitting.
+
+## Open questions
+
+- **IR modulation:** raw 38 kHz async (simplest) vs IrDA (faster, more complex)?
+- **Mnemonic entry:** buttons (scroll BIP-39 words) vs NFC from phone vs
+  generate-on-device? On a 0.96" OLED, scrolling 2048 words is tedious but
+  secure.
+- **PQ crypto on RP2040:** 264 KB SRAM is enough for ML-DSA-65 but SLH-DSA-128s
+  is tight. May need to limit the PQ algorithm set.
+- **Dongle design:** separate RP2040 Pico, or integrate the IR receiver into a
+  custom PCB with a USB-A plug for a compact dongle?
+- **Range:** raw IR with an IR LED + TSOP38238 reaches ~1-2 m line-of-sight.
+  Enough for "point at the dongle on your desk" but not across a room.
+- **Bidirectional IR:** the signer needs both an IR LED (transmit) and a TSOP
+  receiver (receive). Two modules, or an IrDA transceiver module that does both?
+
+## Comparison to the BLE wearable signer
+
+| | IR air-gap | BLE wearable |
+|---|---|---|
+| Air-gap | **High (light, line-of-sight, ~1 m)** | Medium (radio, ~10 m, omnidirectional) |
+| Attack surface | **Small (no BT, dumb dongle)** | Large (BT stack) |
+| Host compatibility | Requires USB dongle | Universal (phones, laptops) |
+| Form factor | Handheld (point at dongle) | Wearable |
+| Throughput | ~11 KB/s (raw IR) or ~400 KB/s (IrDA) | ~250 KB/s (BLE 5) |
+| Novelty | **Novel (no hardware wallet uses IR)** | Conventional |
+| Cost | ~$10 signer + ~$8 dongle | ~$10-15 (nRF52840 + OLED) |
+
+## Next steps
+
+- Decide on IR modulation (raw 38 kHz vs IrDA)
+- Decide on MCU (RP2040 vs nRF52840)
+- Decide on mnemonic entry method
+- Decide on display (OLED vs e-paper)
+- Prototype the IR link: two RP2040 Picos + IR LEDs + TSOP38238, bidirectional
+  byte pipe at 115200 baud
+- Write a port plan (similar to [`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md))
diff --git a/firmware/nfc_card_signer/README.md b/firmware/nfc_card_signer/README.md
new file mode 100644
index 0000000..547c7af
--- /dev/null
+++ b/firmware/nfc_card_signer/README.md
@@ -0,0 +1,192 @@
+# n_signer NFC Card / Ring Signer
+
+**Status:** Concept — open-ended brainstorming. No plan yet.
+
+A contactless signer in a **card or ring form factor** that is powered and
+communicates via **NFC (13.56 MHz)**. You place it on a reader (USB NFC reader
+or a phone); the reader's RF field powers the device and exchanges data. No
+battery, no wire, no radio beyond the 4 cm NFC zone.
+
+This directory also explores **passive RFID/NFC tag ideas** that don't do
+signing on-device — they store keys or seed material that a host reads and uses.
+
+---
+
+## Concept A: NFC-powered active signer (card with display + button)
+
+```mermaid
+flowchart LR
+    Host[Host: laptop/phone
n_signer client] -->|USB or built-in NFC| Reader[NFC reader
ACR122U or phone]
+    Reader -->|13.56 MHz RF field
powers + communicates| Card[Signer card
nRF52840 + e-paper + button]
+    Card -->|NFC response| Reader
+    Reader -->|USB| Host
+```
+
+The card has a tiny e-paper display + one button. The reader powers the card;
+the card shows the approval prompt on its own display; the user presses the
+button to approve; the card signs and sends the response over NFC. The card
+does not trust the reader for display — it shows what it's signing.
+
+### Hardware (preliminary)
+
+| Component | Candidate | Notes |
+|---|---|---|
+| MCU | **nRF52840** (WLCSP) | Cortex-M4, NFC-A tag mode built in, secp256k1/ed25519 in software. Needs a thin-film battery (not fully passive). |
+| | or **NXP JCOP 4** (Java Card) | Fully passive, hardware secp256k1, tamper-resistant. Requires NDA + Java Card applet. Not DIY. |
+| Display | 1.1" e-paper segment display | Shows "approve kind 1? caller: ". Zero power when static. |
+| Input | One capacitive touch button | Press to approve, timeout = deny. |
+| Power | Thin-film battery (like payment cards with displays) + NFC harvesting | |
+| Antenna | Etched into flex PCB around card perimeter | Standard smart card manufacturing. |
+
+### Security
+
+- **Attack radius ~4 cm** — an attacker must touch your card with their reader.
+- **No emissions when not on a reader** — the card is invisible to remote attackers.
+- **Self-contained approval** — the card's display shows what it's signing. The reader can't lie.
+- **Physical possession = authorization** — same model as a payment card.
+
+### Build difficulty
+
+- **DIY prototype:** nRF52840 dev board + wire-wound NFC antenna + ACR122U reader + small OLED. Prove NFC-powered signing works.
+- **Production:** custom flex PCB + etched antenna + thin battery + e-paper segment. Standard smart card manufacturing, but not DIY.
+
+---
+
+## Concept B: NFC ring (tap-to-sign, no display)
+
+A ring with an NFC tag + MCU inside. No display, no button. You tap it on a
+reader; the reader displays the approval prompt; you tap again to confirm
+(two-tap protocol) or the ring signs immediately (single-tap, trusts the reader).
+
+### Hardware
+
+| Component | Candidate | Notes |
+|---|---|---|
+| MCU | Secure element (JCOP / Infineon) or nRF52840 (WLCSP) | Must be tiny (2×3 mm package). |
+| Power | **Fully passive** (harvested from reader) if using a secure element. nRF52840 needs a battery. |
+| Antenna | Coil wound into the ring body | Custom manufacturing. |
+| Display | **None** | No room. |
+| Input | **None** | Pure tap-to-sign. |
+
+### Security
+
+- **Two-tap protocol:** tap to receive the request, reader displays it, tap again to sign. Forces deliberate action but still trusts the reader's display.
+- **Single-tap:** anyone who taps your ring with a reader can sign. Only safe if the ring is always in your physical possession and the reader is trusted.
+- **No display = reader-trusted approval.** Weaker than Concept A but much more portable.
+
+### Build difficulty
+
+- **Very hard** — custom antenna winding, tiny chip placement, ring-form-factor PCB. Not DIY without specialized equipment.
+
+---
+
+## Concept C: Passive NFC tag that stores keys (no on-device signing)
+
+This is a fundamentally different idea: the tag **does not sign anything**. It
+stores key material (a mnemonic seed, a private key, or a derived key) that a
+host reads over NFC and uses to sign. The tag is a **portable key storage
+device**, not a signer.
+
+### How it would work
+
+1. The user taps the tag on a phone or USB NFC reader.
+2. The host reads the stored key material over NFC (ISO 14443 / NDEF).
+3. The host uses the key material to sign (the host runs the n_signer crypto).
+4. The tag is just storage — it has no MCU, no crypto, no battery.
+
+### What the tag stores (options)
+
+| Storage model | What's on the tag | Security | Notes |
+|---|---|---|---|
+| **Encrypted seed** | The mnemonic seed, encrypted with a passphrase (BIP-39 password). The host decrypts after the user types the passphrase. | Medium — if the tag is stolen, the attacker needs the passphrase. | Like an encrypted paper backup, but in NFC form. |
+| **Raw private key** | The secp256k1 private key (32 bytes), stored in the tag's EEPROM. | **Low** — anyone who reads the tag has the key. Only safe if the tag is PIN-protected (needs a secure element, not a dumb tag). | Like storing a private key on a USB stick. |
+| **NDEF URI** | A URI like `nostr:npub1...` (just the public key). The host uses it to identify which key to use (the actual private key is elsewhere). | High (it's just a pubkey) | Not a signer — just an identity token. |
+| **Shamir shard** | One share of a Shamir's Secret Sharing split of the seed. The tag holds 1 of N shares; you need M tags to reconstruct. | **High** — a single tag is useless. | Like a metal seed backup but in NFC form. Multiple tags = multiple shares. |
+| **HD wallet derivation path** | Just the derivation path + a reference to a master seed stored elsewhere. The tag tells the host *which* key to derive. | Medium | The tag is a pointer, not the key itself. |
+
+### Hardware
+
+| Component | Candidate | Notes |
+|---|---|---|
+| **NTAG215** (NXP) | 504 bytes user memory, no crypto, ~$0.10 | The cheapest option. Stores an encrypted seed or NDEF URI. No MCU. |
+| **NTAG424 DNA** (NXP) | 4 KB, AES-128, tamper detection, ~$0.50 | Has crypto — can do authenticated read (the host must present a key to read the data). Better security. |
+| **MIFARE DESFire EV3** | 32 KB, AES, secure applets, ~$1 | Smart card chip. Can store encrypted key material with PIN/mutual auth. |
+| **Java Card (JCOP)** | Full smart card, runs applets, ~$3-5 | Could run a "key storage" applet that only releases the seed after a PIN is verified on the host. |
+
+### Security analysis
+
+The **passive tag as key storage** is the weakest signer model (the host does
+the signing, so a compromised host can steal the key), but it has interesting
+niche uses:
+
+- **Encrypted seed backup:** an NTAG215 storing an encrypted seed is a
+  convenient portable backup — tap your phone to read it, type the passphrase
+  to decrypt. More convenient than a metal plate, less secure than a hardware
+  signer.
+- **Shamir shard carrier:** each tag holds one SSS share. You need M of N tags
+  to reconstruct the seed. Distribute the tags to different locations/people.
+  A single stolen tag is useless. This is a **key-recovery** tool, not a signer.
+- **Identity token:** an NDEF URI tag with your npub. Tap to share your Nostr
+  identity with a phone. Not a signer — just a business card for Nostr.
+- **PIN-protected key release:** a DESFire or JCOP tag that only releases the
+  seed after the host verifies a PIN. The host never sees the key until the PIN
+  is correct. Better than a raw tag, but the host still gets the key after the
+  PIN — so a compromised host can still steal it.
+
+### The fundamental limitation
+
+A passive tag that stores keys **cannot protect the key from a compromised
+host**. Once the host reads the key, the host has it. This is the same problem
+as storing a private key in a file — the OS can steal it. The only way to
+protect the key from the host is to **never release the raw key** — which means
+the tag must do the signing itself (Concept A or B), or the tag must participate
+in a protocol where the host sends a hash to sign and the tag returns a
+signature (which requires an MCU + crypto = not a passive tag).
+
+**The one exception:** a **secure element** (JCOP / Infineon) can do
+"sign inside, never release the key." The host sends the message hash; the
+secure element signs it internally and returns the signature. The private key
+never leaves the chip. This is how smart card signing works (e.g. FIDO2 keys,
+PIV cards). But this is Concept A (active signer), not a passive tag.
+
+---
+
+## Open questions (all concepts)
+
+- **Is the goal a signer (does crypto on-device) or a key carrier (stores keys for a host to use)?**
+  - Signer → Concept A (card with display) or B (ring). The key never leaves the device.
+  - Key carrier → Concept C (passive tag). The host gets the key. Simpler but less secure.
+- **Form factor:** card (credit card size, room for display) vs ring (tiny, no display)?
+- **Power:** passive (secure element, no battery) vs semi-passive (nRF52840 + thin battery)?
+- **Approval model:** on-device display (secure, needs a screen) vs reader display (trusts the reader, no screen needed) vs two-tap (medium security, no screen)?
+- **Host reader:** USB NFC reader (ACR122U, ~$15) vs phone NFC (universal, no dongle)?
+- **MCU/toolchain:** nRF52840 + C (DIY-friendly) vs JCOP + Java Card (production, NDA)?
+- **Could a passive tag + a host-side n_signer be a useful "portable encrypted seed backup" even if it's not a signer?** (Yes — for key recovery / Shamir shard distribution.)
+
+---
+
+## Comparison across all three concepts (NFC, BLE, IR)
+
+| | NFC card (A) | NFC ring (B) | NFC tag (C) | BLE wearable | IR air-gap |
+|---|---|---|---|---|---|
+| Does signing on-device? | **Yes** | **Yes** | No (host signs) | Yes | Yes |
+| Key leaves device? | **No** | **No** | Yes (host reads it) | No | No |
+| Power | Reader + thin battery | Reader (passive) or battery | **Reader (passive)** | Battery | Battery |
+| Display | Tiny e-paper | None | None | Tiny OLED | Tiny OLED/e-paper |
+| Approval | On-card display + button | Reader display (two-tap) | N/A (host decides) | On-device display + buttons | On-device display + buttons |
+| Attack radius | ~4 cm | ~4 cm | ~4 cm | ~10 m | ~1 m (line-of-sight) |
+| Host needs | NFC reader or phone NFC | NFC reader or phone NFC | NFC reader or phone NFC | BT (universal) | USB IR dongle |
+| Form factor | Card | Ring | Tag/card/sticker | Wristband/pendant | Handheld |
+| Build difficulty | Hard (flex PCB) | Very hard (custom ring) | **Easy (off-the-shelf tag)** | Moderate | Moderate |
+| Best for | Daily signing | Quick tap-to-sign | Key backup / recovery | Wearable daily use | High-security air-gap |
+
+---
+
+## Next steps
+
+- Decide: signer (A/B) vs key carrier (C) vs both
+- Decide: card vs ring vs tag
+- Decide: DIY prototype (nRF52840 + ACR122U) vs production (secure element)
+- Explore the Shamir-shard-on-NFC-tags idea as a key-recovery tool
+- Explore the encrypted-seed-on-NTAG215 idea as a portable backup
+- Write a plan for the chosen direction
diff --git a/firmware/teensy41/README.md b/firmware/teensy41/README.md
new file mode 100644
index 0000000..d8000a6
--- /dev/null
+++ b/firmware/teensy41/README.md
@@ -0,0 +1,60 @@
+# n_signer Teensy 4.1 Firmware
+
+**Status:** Planned — not yet implemented. See
+[`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md).
+
+The **Teensy 4.1** (NXP i.MX RT1062, Cortex-M7 @ 600 MHz) is the high-capacity
+OTP pad target. Its built-in SD slot supports **1 TB SDXC cards (exFAT)** via
+PJRC's SdFat library, making it the ideal hardware signer for large one-time-pad
+storage.
+
+## Why the Teensy 4.1
+
+| Concern | Teensy 4.1 | CYD (ESP32) | Feather S3 TFT (ESP32-S3) |
+|---|---|---|---|
+| MCU | 600 MHz Cortex-M7 | 240 MHz Xtensa LX6 | 240 MHz Xtensa LX7 |
+| SRAM | 1 MB + 16 MB PSRAM | 512 KB (no PSRAM) | 512 KB + quad PSRAM |
+| SD slot | **4-bit SDMMC, exFAT, up to 2 TB** | 1-bit SDSPI, FAT32, up to 32 GB | — |
+| USB | Hi-Speed (480 Mbps) device + host | CH340 UART only | Full-Speed USB |
+| WiFi | **None** | Yes (unused) | Yes (unused) |
+| Ethernet | 10/100 PHY (optional) | — | — |
+| PQ crypto speed | ~1-2 s SLH-DSA-128s | 5-30 s SLH-DSA-128s | 5-30 s SLH-DSA-128s |
+
+## SD card size support
+
+| Card type | Size | Works? |
+|---|---|---|
+| SDSC | ≤ 2 GB | Yes (FAT16/32) |
+| SDHC | 2 – 32 GB | Yes (FAT32) |
+| **SDXC** | **32 GB – 2 TB** | **Yes (exFAT via SdFat)** |
+| SDUC | 2 – 128 TB | No |
+
+**1 TB SDXC cards work** — SdFat has native exFAT support, and the Teensy's
+4-bit SDMMC bus runs at ~20-40 MB/s. No reformatting needed.
+
+## Display + touch
+
+**4.0" ST7796S 480×320 SPI TFT with XPT2046 resistive touch** (Hosyond or
+equivalent, ~$12-15). Specs: 4-wire SPI, RGB 65K, 3.3V~5V (works at the Teensy's
+3.3V logic), XPT2046 resistive touch, includes touch pen + on-module SD slot.
+
+Resistive touch is the right choice for a hardware signer (deliberate physical
+activation, stylus-compatible, simple driver). The XPT2046 driver ports from
+the CYD's [`touch.c`](../cyd_esp32_2432s028/main/touch.c) with 480×320
+resolution constants. The ST7796S display driver is new code (different init
+sequence than the CYD's ILI9341).
+
+Wiring: TFT SPI on pins 11/12/13, CS=10, DC=9, RESET=8, BL=22; touch shares
+the SPI bus with T_CS=7, T_IRQ=6. See
+[`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md) for the
+full pin table.
+
+## Build (planned)
+
+```bash
+# Arduino CLI / Teensyduino
+arduino-cli compile --fqbn teensy:avr:teensy41 firmware/teensy41
+arduino-cli upload -p /dev/ttyACM0 --fqbn teensy:avr:teensy41 firmware/teensy41
+```
+
+See the port plan: [`plans/teensy41_signer_port.md`](../../plans/teensy41_signer_port.md).
diff --git a/plans/cyd_algorithm_api_upgrade.md b/plans/cyd_algorithm_api_upgrade.md
new file mode 100644
index 0000000..43c0c21
--- /dev/null
+++ b/plans/cyd_algorithm_api_upgrade.md
@@ -0,0 +1,306 @@
+# Plan: Bring `firmware/cyd_esp32_2432s028` Up to Date with the Algorithm-Based API
+
+## Context
+
+The main project ([`src/dispatcher.c`](../src/dispatcher.c)) has fully migrated to the
+algorithm-based API documented in [`README.md`](../README.md) §4. The migration is marked
+COMPLETED in [`plans/legacy_verb_aliases.md`](../plans/legacy_verb_aliases.md): legacy verb
+names are gone from the wire protocol, implementation, tests, clients, and docs.
+
+The CYD firmware at [`firmware/cyd_esp32_2432s028/main/main.c`](../firmware/cyd_esp32_2432s028/main/main.c)
+was **not** updated and still speaks the **legacy verb API**:
+
+| Firmware verb (current) | Main-project verb (target) |
+|--------------------------|----------------------------|
+| `get_public_key` (+ `nostr_index`) | split → `get_public_key` (+ `algorithm`) **and** `nostr_get_public_key` (+ `nostr_index`) |
+| `sign_event` | `nostr_sign_event` |
+| `nip04_encrypt` / `nip04_decrypt` | `nostr_nip04_encrypt` / `nostr_nip04_decrypt` |
+| `nip44_encrypt` / `nip44_decrypt` | `nostr_nip44_encrypt` / `nostr_nip44_decrypt` |
+| _(missing)_ | `sign`, `verify`, `encapsulate`, `decapsulate`, `derive_shared_secret`, `derive`, `encrypt`/`decrypt` (otp), `nostr_mine_event` |
+
+### Good news: the crypto primitives already exist
+
+The firmware already has every underlying primitive needed — only the **dispatch layer**
+in [`main.c`](../firmware/cyd_esp32_2432s028/main/main.c) is stale:
+
+- [`key_derivation.h`](../firmware/cyd_esp32_2432s028/main/key_derivation.h): `derive_nostr_key_index`, `derive_ed25519_key`, `derive_x25519_key`, `derive_ml_dsa_65_key`, `derive_slh_dsa_128s_key`, `derive_ml_kem_768_key`, `schnorr_sign32`, `ed25519_sign32`
+- [`pq_crypto_firmware.h`](../firmware/cyd_esp32_2432s028/main/pq_crypto_firmware.h): `fw_pq_ml_dsa_65_sign/verify`, `fw_pq_slh_dsa_128s_sign/verify`, `fw_pq_ml_kem_768_encaps/decaps`
+- [`nostr_core_lib`](../resources/nostr_core_lib) nip004/nip044 already linked for the Nostr verbs
+
+### `key_id` convention
+
+The main project defines `key_id` as the **first 16 hex characters of the public key**
+(see [`src/dispatcher.c`](../src/dispatcher.c) ~line 1788). The firmware must match this
+so clients can correlate keys across targets.
+
+## Scope
+
+**Target:** [`firmware/cyd_esp32_2432s028`](../firmware/cyd_esp32_2432s028) only.
+The feather_s3_tft firmware is explicitly out of scope for this pass (it has the same gap
+but will be handled separately).
+
+## Architecture: dispatch flow after upgrade
+
+```mermaid
+flowchart TD
+    A[recv frame] --> B[parse JSON-RPC]
+    B --> C{auth envelope}
+    C -->|fail| Z[auth error]
+    C -->|ok| D{method}
+    D -->|nostr_*| E[Nostr verb branch
secp256k1 NIP-06
nostr_index selector]
+    D -->|alg verb| F[Algorithm verb branch
algorithm + index selector]
+    E --> G[derive_request_key
nostr_index]
+    F --> H{algorithm}
+    H -->|secp256k1| H1[derive_nostr_key_index]
+    H -->|ed25519| H2[derive_ed25519_key]
+    H -->|x25519| H3[derive_x25519_key]
+    H -->|ml-dsa-65| H4[derive_ml_dsa_65_key]
+    H -->|slh-dsa-128s| H5[derive_slh_dsa_128s_key]
+    H -->|ml-kem-768| H6[derive_ml_kem_768_key]
+    H -->|otp| H7[bound pad]
+    G --> I[enforcement matrix check]
+    H1 --> I
+    H2 --> I
+    H3 --> I
+    H4 --> I
+    H5 --> I
+    H6 --> I
+    H7 --> I
+    I -->|reject 1010| Z
+    I -->|ok| J[approval prompt]
+    J --> K[execute verb]
+    K --> L[structured result JSON
algorithm + key_id + field]
+```
+
+## Implementation Steps
+
+### 1. Add algorithm-name parsing helpers (`main.c`)
+
+Add a small enum + parser mirroring the main project's algorithm set:
+
+```c
+typedef enum {
+    FW_ALG_SECP256K1 = 0,
+    FW_ALG_ED25519,
+    FW_ALG_X25519,
+    FW_ALG_ML_DSA_65,
+    FW_ALG_SLH_DSA_128S,
+    FW_ALG_ML_KEM_768,
+    FW_ALG_OTP,
+    FW_ALG_UNKNOWN
+} fw_alg_t;
+```
+
+- `parse_algorithm_from_options(cJSON *options, fw_alg_t *out_alg, uint32_t *out_index)`
+  — reads `algorithm` (string) and `index` (number, default 0) from the trailing options
+  object in `params`.
+- `fw_alg_name(fw_alg_t)` → canonical string (`"secp256k1"`, `"ed25519"`, …) for response
+  JSON.
+- Keep the existing `parse_nostr_index_from_params()` for the `nostr_*` verbs.
+
+### 2. Add a unified algorithm-key derivation + `key_id` helper
+
+Add `derive_alg_key(fw_alg_t alg, uint32_t index, ...)` that dispatches to the right
+`derive_*_key` function and produces:
+- the raw private key bytes (when applicable),
+- the public key hex,
+- the `key_id` (first 16 hex chars of the public key).
+
+PQ algorithms have large key buffers (ml-dsa-65 sk = 4032 B, ml-kem-768 sk = 2400 B).
+Allocate these as **static** buffers (not on the stack) and `secure_memzero` after use,
+matching the existing `s_privkey`/`s_pubkey` pattern. SLH-DSA-128s keygen is slow
+(5–30 s) — log a warning and show a "deriving key…" UI screen before calling it.
+
+### 3. Add a structured-result builder
+
+Add `build_alg_result_json(const char *alg_name, const char *key_id_16hex, const char *field_name, const char *field_value)` → returns a JSON string like
+`{"algorithm":"ed25519","key_id":"<16hex>","public_key":""}`. This mirrors
+[`build_alg_result_json`](../src/dispatcher.c:861) in the main dispatcher.
+
+### 4. Add the enforcement matrix
+
+Add `enforce_alg_verb(fw_alg_t alg, const char *verb)` returning 0 / `1010`, matching
+[`README.md`](../README.md) §4.3 enforcement matrix:
+
+| Verb | Valid algorithms |
+|------|------------------|
+| `sign` / `verify` | secp256k1, ed25519, ml-dsa-65, slh-dsa-128s |
+| `encapsulate` / `decapsulate` | ml-kem-768 |
+| `derive_shared_secret` | x25519 |
+| `derive` | secp256k1 |
+| `encrypt` / `decrypt` | otp |
+| `get_public_key` | all key-deriving algorithms |
+
+Reject any unlisted pair with
+`{"error":{"code":1010,"message":"algorithm_not_supported_for_verb"}}`.
+
+### 5. Rename the Nostr verbs (in-place, no compat shim)
+
+In the dispatch `if/else if` chain in [`main.c`](../firmware/cyd_esp32_2432s028/main/main.c)
+~lines 836–1230:
+
+- `get_public_key` (nostr_index branch) → `nostr_get_public_key`
+- `sign_event` → `nostr_sign_event`
+- `nip04_encrypt` → `nostr_nip04_encrypt`
+- `nip04_decrypt` → `nostr_nip04_decrypt`
+- `nip44_encrypt` → `nostr_nip44_encrypt`
+- `nip44_decrypt` → `nostr_nip44_decrypt`
+
+The `nostr_get_public_key` verb should also honor the `format` option
+(`"structured"` → `{"algorithm":"secp256k1","public_key":"","key_id":"<16hex>"}`,
+default → bare 64-hex pubkey string), matching the main project.
+
+### 6. Add the algorithm-based `get_public_key` verb
+
+`get_public_key` with `algorithm` + `index` → derive the key, return structured JSON:
+`{"algorithm":"","public_key":"","key_id":"<16hex>"}`. For PQ algorithms the
+`public_key` is the full PQClean pubkey hex (1952 B for ml-dsa-65, 1184 B for ml-kem-768,
+32 B for slh-dsa-128s) — ensure `s_response_buf` (currently 2048 B) is large enough, or
+emit via `cJSON_PrintUnformatted` into a larger static buffer.
+
+### 7. Add `sign` and `verify` (algorithm-based)
+
+- `sign`: params `[, {algorithm, index, scheme?}]`. `scheme` is
+  secp256k1-only (`"schnorr"` default / `"ecdsa"`). For ed25519 use `ed25519_sign32`
+  (note: ed25519 signs the raw 32-byte message, not a pre-hash — match main project
+  behavior). For ml-dsa-65 / slh-dsa-128s use `fw_pq_*_sign`. Response:
+  `{"algorithm":"","key_id":"<16hex>","signature":""}`.
+- `verify`: params `[, , {algorithm, index, scheme?}]`.
+  Derive the signer's own pubkey and verify against it. Response:
+  `{"valid":true,"algorithm":""}`.
+
+### 8. Add `encapsulate` / `decapsulate` (ml-kem-768)
+
+- `encapsulate`: params `[, {algorithm:"ml-kem-768"}]` →
+  `fw_pq_ml_kem_768_encaps` →
+  `{"ciphertext":"","shared_secret":"","algorithm":"ml-kem-768"}`.
+- `decapsulate`: params `[, {algorithm:"ml-kem-768", index}]` → derive
+  kem keypair, `fw_pq_ml_kem_768_decaps` →
+  `{"shared_secret":"","algorithm":"ml-kem-768"}`.
+
+### 9. Add `derive_shared_secret` (x25519)
+
+params `[, {algorithm:"x25519", index}]` → derive x25519 keypair,
+compute X25519 ECDH via mbedtls →
+`{"shared_secret":"","algorithm":"x25519"}`.
+
+### 10. Add `derive` (secp256k1 HMAC-SHA256)
+
+params `[, {algorithm:"secp256k1", index}]` (`index` **required**) → derive
+secp256k1 privkey, compute `HMAC-SHA256(privkey, data)` via mbedtls →
+`{"algorithm":"secp256k1","key_id":"<16hex>","digest":"<64hex>"}`. See
+[`plans/derive_hmac.md`](../plans/derive_hmac.md) for the spec.
+
+### 11. Add `nostr_mine_event` (PoW)
+
+params `[, {nostr_index, difficulty, timeout_sec, threads?}]`. Reuse
+`build_signed_event_json` but iterate nonce in the event's `tags` until the leading-zero
+bits of the event id meet `difficulty`. ESP32 is slow — cap `threads` at 1 and enforce a
+firm `timeout_sec` (default 30). Show a "mining…" UI screen. If timeout, return error
+`1008 mining_failed`. This mirrors [`src/miner.c`](../src/miner.c).
+
+### 12. Add `encrypt` / `decrypt` (otp)
+
+The main project binds a pad from `--otp-pad-dir` + `--otp-pad` (a USB file). The CYD has
+no filesystem pad source. **Decision: derive the OTP pad from the mnemonic seed** via a
+SHAKE-256 / HKDF expansion keyed on `algorithm:"otp"` so the pad is deterministic per
+mnemonic and advances monotonically across requests (offset stored in a static variable,
+reported in every response). This keeps the wire contract identical (`encrypt`/`decrypt`
+with `algorithm:"otp"`, `encoding:"ascii"|""binary""`) while fitting the embedded
+constraint. Document this divergence in [`firmware/README.md`](../firmware/README.md).
+
+### 13. Bump `FIRMWARE_VERSION` and update `firmware/README.md`
+
+- `FIRMWARE_VERSION` "0.0.1" → "0.0.2" (algorithm-based API).
+- Document the new verb table, the OTP pad-derivation divergence, and the SLH-DSA-128s
+  latency warning.
+
+### 14. Update CYD-targeting examples / clients
+
+Audit and update any example or client that speaks to the CYD over UART/Web-Serial and
+uses legacy verb names:
+- [`examples/feather_get_public_key.py`](../examples/feather_get_public_key.py) and
+  [`examples/feather_sign_event.py`](../examples/feather_sign_event.py) (feather-targeting
+  but the wire protocol is shared — note in README they need `nostr_` prefixes for CYD
+  after this change; leave feather examples alone since feather is out of scope, but add a
+  CYD-specific example pair if none exists).
+- [`client/`](../client/) demos already use the new verbs (per
+  [`plans/legacy_verb_aliases.md`](../plans/legacy_verb_aliases.md)) — verify no CYD-specific
+  legacy calls remain.
+
+### 15. Add a CYD Web Serial test page covering all algorithms
+
+The existing [`examples/feather_webusb_demo.html`](../examples/feather_webusb_demo.html) is
+**WebUSB-only** (feather's native USB) and uses the **legacy verbs**. The CYD's CH340
+bridge (`1a86:7523`) is not a WebUSB device — it exposes a serial port, so the browser
+transport is **Web Serial** (`navigator.serial`), Chromium-only.
+
+Create [`examples/cyd_webserial_demo.html`](../examples/cyd_webserial_demo.html) — a
+single-file, dependency-light test page that:
+
+**Transport:**
+- `navigator.serial.requestPort()` → `port.open({ baudRate: 115200 })` (matches
+  [`uart_transport.c`](../firmware/cyd_esp32_2432s028/main/uart_transport.c) UART_BAUD_RATE).
+- Same 4-byte big-endian length-prefix frame format as the feather demo
+  ([`be32()`](../examples/feather_webusb_demo.html:256), read loop reassembling frames).
+- Read via a `ReadableStream` reader + length-prefix reassembly (Web Serial is stream-based,
+  not packet-based like WebUSB `transferIn`).
+- Same auth-envelope construction (kind 27235, `nsigner_method` / `nsigner_body_hash` tags,
+  schnorr sign with a demo caller key) — reuse the
+  [`buildAuth()`](../examples/feather_webusb_demo.html:279) logic verbatim.
+
+**UI sections (one card per verb family, all algorithms):**
+1. **Connect** — Connect Web Serial button + status.
+2. **Get Public Key** — algorithm dropdown (`secp256k1`, `ed25519`, `x25519`, `ml-dsa-65`,
+   `slh-dsa-128s`, `ml-kem-768`) + index → `get_public_key`. Also a `nostr_get_public_key`
+   card with `nostr_index` + `format` (bare / structured) toggle.
+3. **Sign / Verify** — algorithm dropdown (sig algs only) + index + `scheme` (schnorr/ecdsa,
+   secp256k1-only) + message hex → `sign`; then `verify` with the returned signature.
+4. **KEM (ml-kem-768)** — `encapsulate` with a peer pubkey (or self-pubkey from
+   `get_public_key`) → ciphertext + shared secret; `decapsulate` with that ciphertext →
+   shared secret (confirm match).
+5. **X25519** — `derive_shared_secret` with peer pubkey.
+6. **Derive (HMAC)** — `derive` with data string + index → 64-hex digest.
+7. **Nostr Sign Event** — `nostr_sign_event` (kind 1) with `nostr_index`.
+8. **Nostr Mine Event** — `nostr_mine_event` with difficulty + timeout (low default, e.g.
+   difficulty 4) — warn it's slow on ESP32.
+9. **NIP-04 / NIP-44** — `nostr_nip04_encrypt`/`decrypt`, `nostr_nip44_encrypt`/`decrypt`
+   with `nostr_index`.
+10. **OTP** — `encrypt` / `decrypt` with `algorithm:"otp"`, `encoding` toggle
+    (ascii/binary), base64 plaintext.
+
+Each card shows the raw JSON-RPC request and response in a `
` so the wire format is
+visible. Reuse the feather demo's CSS (dark theme, cards, `.mono` log) for consistency.
+
+**Link it from [`firmware/README.md`](../firmware/README.md)** in the CYD section (the
+"Quick validation" / Web Serial path), since the current README only points at the
+feather WebUSB demo.
+
+### 16. Verification
+
+- `idf.py build` in [`firmware/cyd_esp32_2432s028`](../firmware/cyd_esp32_2432s028) compiles
+  clean.
+- Flash to the connected CYD board (CH340 on `/dev/ttyUSB0`) and smoke-test each verb:
+  - Primary path: open [`examples/cyd_webserial_demo.html`](../examples/cyd_webserial_demo.html)
+    in Chrome/Edge, connect via Web Serial, exercise every card.
+  - Secondary path: a small Python script over `/dev/ttyUSB0` for headless confirmation.
+  - Cover: `get_public_key` (each algorithm), `sign`/`verify` (each sig alg),
+    `encapsulate`/`decapsulate`, `derive_shared_secret`, `derive`,
+    `nostr_get_public_key`, `nostr_sign_event`, `nostr_nip04_encrypt`/`decrypt`,
+    `nostr_nip44_encrypt`/`decrypt`, `nostr_mine_event` (low difficulty),
+    `encrypt`/`decrypt` (otp).
+  - Confirm `key_id` matches the first 16 hex of the returned pubkey for every alg.
+  - Confirm an invalid `(verb, algorithm)` pair returns code 1010.
+- `grep -rn "sign_event\|nip04_encrypt\|nip04_decrypt\|nip44_encrypt\|nip44_decrypt"
+  firmware/cyd_esp32_2432s028/` returns no matches (legacy names gone).
+
+## Open questions / decisions baked in
+
+- **OTP pad source:** derived from mnemonic (no USB pad on CYD). Documented divergence.
+- **`nostr_mine_event`:** implemented, single-threaded, hard 30 s default timeout, with a
+  "mining…" UI screen. Not stubbed — the main project has it and the user asked to bring
+  the firmware up to date.
+- **No legacy-verb compat shim:** matches the main project's policy
+  ([`plans/legacy_verb_aliases.md`](../plans/legacy_verb_aliases.md) — "No backward-
+  compatibility shim is needed").
+- **feather_s3_tft not touched** in this pass.
diff --git a/plans/teensy41_signer_port.md b/plans/teensy41_signer_port.md
new file mode 100644
index 0000000..84c8d82
--- /dev/null
+++ b/plans/teensy41_signer_port.md
@@ -0,0 +1,248 @@
+# Plan: Port n_signer to Teensy 4.1 with SDXC 1 TB exFAT OTP Pad
+
+## Goal
+
+Port the n_signer hardware signer to the **Teensy 4.1** (NXP i.MX RT1062,
+Cortex-M7 @ 600 MHz), using its built-in SD slot to hold a **1 TB SDXC exFAT
+one-time-pad file**. The Teensy 4.1 is the high-capacity-OTP target; the CYD
+(classic ESP32) remains the cheap/low-power option with the mnemonic-derived
+stream pad.
+
+The on-the-wire protocol is identical to the host and the CYD/feather firmware
+([`README.md`](../README.md) §4 — the algorithm-based API). The auth envelope,
+verb set, enforcement matrix, `key_id` convention, and structured-result JSON
+are all unchanged.
+
+## Why the Teensy 4.1
+
+| Concern | Teensy 4.1 | CYD (ESP32) |
+|---|---|---|
+| MCU | 600 MHz Cortex-M7 | 240 MHz Xtensa LX6 |
+| SRAM | 1 MB + 16 MB PSRAM (on-board) | 512 KB, no PSRAM |
+| SD slot | **4-bit SDMMC, exFAT via SdFat, up to 2 TB** | 1-bit SDSPI, FAT32, up to 32 GB |
+| SD speed | ~20-40 MB/s | ~2 MB/s |
+| USB | Hi-Speed (480 Mbps) device + host | CH340 UART only |
+| WiFi | **None** | Yes (unused) |
+| PQ crypto | ~1-2 s SLH-DSA-128s | 5-30 s SLH-DSA-128s |
+| Display | Add SPI ILI9341 (same panel as CYD) | Built-in 2.8" ILI9341 + touch |
+
+The decisive factor is the **SD slot**: PJRC's [SdFat](https://github.com/greiman/SdFat)
+library has native exFAT support, so a 1 TB SDXC card (which ships formatted
+exFAT) mounts and reads/writes directly — no reformatting, no exFAT driver
+work. The 4-bit SDMMC bus is fast enough (~20-40 MB/s) for pad reads with
+arbitrary seeks.
+
+## Hardware
+
+### Board
+- **Teensy 4.1** (PJRC) — $27. Has 8 MB flash, 16 MB external QSPI, 16 MB PSRAM
+  (soldered), 1 MB internal SRAM, native USB Hi-Speed, built-in SD slot, 10/100
+  Ethernet PHY, no WiFi/BT.
+
+### Display + touch (add-on)
+- **4.0" ST7796S 480×320 with XPT2046 resistive touch** (Hosyond or equivalent,
+  ~$12-15). Specs: 4-wire SPI, RGB 65K, 3.3V~5V (works at Teensy's 3.3V logic),
+  XPT2046 resistive touch, includes touch pen + SD card slot on the module.
+  SPI wiring to the Teensy 4.1:
+  - TFT: MOSI=pin 11, SCK=pin 13, MISO=pin 12, CS=pin 10, DC=pin 9,
+    RESET=pin 8, BL=pin 22 (PWM via analogWrite)
+  - Touch (XPT2046, shared SPI bus): T_CS=pin 7, T_IRQ=pin 6,
+    T_CLK=pin 13, T_MOSI=pin 11, T_MISO=pin 12
+  - Power: VCC=3.3V, GND=GND
+- The ST7796S controller needs a different init sequence than the CYD's
+  ILI9341, and the resolution is 480×320 (not 320×240). The XPT2046 touch
+  driver ports from [`firmware/cyd_esp32_2432s028/main/touch.c`](../firmware/cyd_esp32_2432s028/main/touch.c)
+  with new resolution constants.
+- The module's on-board SD card slot is a bonus (backup pad / offset file),
+  but the 1 TB pad uses the Teensy's built-in SD slot (4-bit SDMMC, faster).
+
+### SD card
+- **1 TB microSDXC** (exFAT, ~$60-80) in the Teensy's built-in slot.
+- The pad file (`/pad.bin`) + offset file (`/pad.offset`) live on this card.
+
+### USB transport
+- The Teensy's native USB port (device mode) exposes a **CDC-ACM serial** +
+  optional **WebUSB vendor** interface (TinyUSB composite), same framing as the
+  feather/CYD (4-byte big-endian length prefix + JSON-RPC payload).
+- The host sees `/dev/ttyACM0` (Linux) or `COMx` (Windows).
+
+## Target directory layout
+
+```
+firmware/teensy41/
+├── README.md                  (created)
+├── teensy41_signer.ino        (Arduino entry, or main.cpp for PlatformIO)
+├── src/
+│   ├── main.cpp               (app loop: UI → transport → dispatch)
+│   ├── dispatch.cpp           (verb dispatch — ported from cyd main.c handle_request)
+│   ├── dispatch.h
+│   ├── key_derivation.cpp     (BIP-39 → seed → secp256k1/ed25519/x25519/PQ keys)
+│   ├── key_derivation.h
+│   ├── pq_crypto.cpp          (PQClean wrappers: ml-dsa-65, slh-dsa-128s, ml-kem-768)
+│   ├── pq_crypto.h
+│   ├── otp_pad_sd.cpp         (SDXC exFAT pad: mount, read, offset persistence)
+│   ├── otp_pad_sd.h
+│   ├── transport.cpp          (USB CDC + length-prefix framing)
+│   ├── transport.h
+│   ├── display.cpp            (ILI9341 driver — ported from cyd ili9341.c)
+│   ├── display.h
+│   ├── touch.cpp              (XPT2046 driver — ported from cyd touch.c)
+│   ├── touch.h
+│   ├── ui.cpp                 (LVGL or hand-rolled UI — ported from cyd ui.c)
+│   ├── ui.h
+│   ├── secure_mem.cpp         (zeroize helpers)
+│   ├── secure_mem.h
+│   ├── bech32.cpp             (npub encoding)
+│   ├── bech32.h
+│   ├── mnemonic.cpp           (BIP-39 wordlist + validation)
+│   ├── mnemonic.h
+│   └── mnemonic_wordlist.h
+├── lib/
+│   ├── secp256k1/             (libsecp256k1, built for ARM Cortex-M7)
+│   ├── pqclean/               (PQClean ML-DSA-65, SLH-DSA-128s, ML-KEM-768)
+│   ├── nostr_core_lib/        (symlink/copy of resources/nostr_core_lib)
+│   └── SdFat/                 (PJRC SdFat with exFAT — via Arduino Library Manager)
+└── platformio.ini             (or Arduino project config)
+```
+
+## Architecture
+
+```mermaid
+flowchart TD
+    USB[Host USB CDC] --> Frame[transport.cpp
length-prefix framing]
+    Frame --> Auth[auth envelope verify
secp256k1 schnorr]
+    Auth -->|ok| Disp[dispatch.cpp
handle_request]
+    Auth -->|fail| Err[auth error]
+    Disp -->|nostr_*| NIP[Nostr verbs
secp256k1 NIP-06]
+    Disp -->|alg verb| Alg[Algorithm verbs
algorithm + index]
+    Alg -->|otp| OTP[otp_pad_sd.cpp
SDXC exFAT pad]
+    Alg -->|secp256k1/ed25519/x25519/PQ| KD[key_derivation.cpp]
+    OTP --> SD[(1 TB SDXC
exFAT
/pad.bin + /pad.offset)]
+    KD --> UI[ui.cpp
approval prompt
ILI9341 + XPT2046]
+    UI -->|approve| Exec[execute verb]
+    Exec --> Resp[structured JSON result]
+    Resp --> Frame
+```
+
+## Implementation phases
+
+### Phase 1: Board bring-up (display + touch + SD)
+
+1. **Toolchain:** Arduino CLI + Teensyduino (simplest), or PlatformIO with the
+   `teensy` platform. Verify `Blink` + `HelloSerial` compile and flash.
+2. **ILI9341 display:** port [`firmware/cyd_esp32_2432s028/main/ili9341.c`](../firmware/cyd_esp32_2432s028/main/ili9341.c)
+   to Teensy GPIO + SPI (use `SPI.beginTransaction` for 40 MHz HSPI). Exit
+   criterion: fill screen + draw text.
+3. **XPT2046 touch:** port [`firmware/cyd_esp32_2432s028/main/touch.c`](../firmware/cyd_esp32_2432s028/main/touch.c).
+   Exit criterion: read touch coordinates, map to 320×240.
+4. **SD card + exFAT:** install SdFat via Arduino Library Manager. Mount a 1 TB
+   SDXC card (exFAT), write + read a test file. Exit criterion:
+   `sd.begin(SdioConfig(FIFO_SDIO))` succeeds on a 1 TB card, `file.open`
+   + `file.write` + `file.read` round-trips.
+
+### Phase 2: Crypto stack port
+
+1. **secp256k1:** build `libsecp256k1` for ARM Cortex-M7 (no ASM, pure C with
+   `USE_NUM_NONE` / `USE_FIELD_INV_BUILTIN`). Verify schnorr sign/verify +
+   ECDSA sign/verify against known test vectors.
+2. **ed25519 / x25519:** use a portable ed25519 (e.g. the ref10 impl or
+   `crypto_mbedtls` if mbedtls is available for Teensy — alternatively
+   [`micro-ecc`](https://github.com/kmackay/micro-ecc) + a portable ed25519).
+   Verify against the host's test vectors.
+3. **PQClean:** compile `resources/pqclean/` (ML-DSA-65, SLH-DSA-128s,
+   ML-KEM-768) for Cortex-M7. The `crypto_backend` abstraction needs a Teensy
+   backend (`crypto_backend_sdfat.c` or reuse the vendored Keccak from
+   [`resources/pqclean/common/crypto_backend_mbedtls.c`](../resources/pqclean/common/crypto_backend_mbedtls.c)
+   — the Keccak core is portable C). SHA-256/512 via SdFat's built-in or a
+   portable impl. Verify keygen + sign + verify against the host.
+4. **nostr_core_lib:** compile [`resources/nostr_core_lib/`](../resources/nostr_core_lib/)
+   (nip004, nip044, nostr_common, utils, crypto) for Cortex-M7. This is
+   portable C and should compile as-is.
+
+### Phase 3: Key derivation + mnemonic
+
+1. Port [`firmware/cyd_esp32_2432s028/main/key_derivation.c`](../firmware/cyd_esp32_2432s028/main/key_derivation.c)
+   (BIP-32/SLIP-0010 derivation for all 6 algorithms). Replace mbedtls/PSA
+   calls with the portable crypto from Phase 2.
+2. Port [`firmware/cyd_esp32_2432s028/main/mnemonic.c`](../firmware/cyd_esp32_2432s028/main/mnemonic.c)
+   (BIP-39 wordlist + validation + mnemonic_to_seed via PBKDF2-HMAC-SHA512).
+3. Port [`firmware/cyd_esp32_2432s028/main/bech32.c`](../firmware/cyd_esp32_2432s028/main/bech32.c)
+   (npub encoding).
+
+### Phase 4: OTP pad from SDXC (the key feature)
+
+1. **`otp_pad_sd.cpp`:**
+   - `otp_pad_init()`: mount the SD card via `sd.begin(SdioConfig(FIFO_SDIO))`,
+     open `/pad.bin` for reading, open `/pad.offset` for the persistent offset.
+     Read the offset file on boot; if absent, start at 0.
+   - `otp_pad_read(buf, len)`: seek to the current offset in `/pad.bin`, read
+     `len` bytes, advance the offset. If the offset + len exceeds the file
+     size, return an error (pad exhausted).
+   - `otp_pad_persist_offset()`: write the current offset to `/pad.offset`
+     after each `encrypt`/`decrypt` call (or batch: persist every N calls to
+     reduce SD wear).
+   - `otp_pad_zeroize()`: close files, zeroize in-RAM state.
+2. **Wire into the `encrypt`/`decrypt` verbs:** replace the CYD's
+   HKDF-derived in-RAM pad with `otp_pad_read()`. The wire contract is
+   unchanged (`encrypt`/`decrypt` with `algorithm:"otp"`, base64 payload,
+   `pad_offset` in the response).
+3. **UI:** show "reading pad from SD…" during the read (the SD read is fast
+   but the user should see activity). Show the pad offset + remaining bytes on
+   the idle screen.
+
+### Phase 5: Transport + dispatch + UI
+
+1. **Transport (`transport.cpp`):** TinyUSB CDC-ACM + 4-byte length-prefix
+   framing (same as [`firmware/cyd_esp32_2432s028/main/uart_transport.c`](../firmware/cyd_esp32_2432s028/main/uart_transport.c)).
+   Optionally add a WebUSB vendor interface for browser transport (the Teensy's
+   Hi-Speed USB makes this fast).
+2. **Dispatch (`dispatch.cpp`):** port `handle_request()` from
+   [`firmware/cyd_esp32_2432s028/main/main.c`](../firmware/cyd_esp32_2432s028/main/main.c)
+   — the entire verb dispatch (all nostr_* + algorithm-based verbs, enforcement
+   matrix, structured results, auth envelope verify). This is the bulk of the
+   logic and ports nearly verbatim (only the crypto backend calls change).
+3. **UI (`ui.cpp`):** port [`firmware/cyd_esp32_2432s028/main/ui.c`](../firmware/cyd_esp32_2432s028/main/ui.c)
+   (LVGL 8.3 or hand-rolled). The UI screens are: startup menu → generate
+   mnemonic → confirm mnemonic → enter mnemonic → idle (show npub + pad offset)
+   → approval prompt. The Teensy's 600 MHz M7 makes LVGL snappy.
+
+### Phase 6: Integration + testing
+
+1. **End-to-end smoke test:** load a mnemonic, exercise every verb over USB
+   CDC with a Python script or the Web Serial test page
+   ([`examples/cyd_webserial_demo.html`](../examples/cyd_webserial_demo.html)
+   works for any CDC device).
+2. **OTP pad test:** place a known pad file on the 1 TB SDXC card, run
+   `encrypt` + `decrypt` round-trips, verify the XOR is correct and the offset
+   advances + persists across power cycles.
+3. **Cross-board parity:** same mnemonic on the Teensy 4.1 and the CYD → same
+   npub, same secp256k1/ed25519/x25519/PQ public keys, same signatures.
+4. **Performance:** measure SLH-DSA-128s sign time (expect ~1-2 s vs 5-30 s on
+   ESP32), ML-DSA-65 sign time (expect ~50 ms), SD pad read throughput.
+
+## Open questions / decisions
+
+- **UI framework:** LVGL 8.3 (heavier, proven on CYD) vs hand-rolled (lighter,
+  faster to port, no external dep). The Teensy has enough RAM for LVGL. **Lean
+  toward LVGL** for consistency with the CYD.
+- **ed25519/x25519 impl:** mbedtls is available for Teensy via the
+  `mbedtls` Arduino library, but PSA crypto is not. Options: (a) mbedtls
+  ed25519 (if the Arduino mbedtls has it), (b) a portable ed25519 like
+  [`orlp/ed25519`](https://github.com/orlp/ed25519) + micro-ecc for x25519,
+  (c) libsodium for Teensy. **Investigate (a) first, fall back to (b).**
+- **Toolchain:** Arduino CLI + Teensyduino (simplest, SdFat + USB stack
+  included) vs PlatformIO (better dependency management, CI-friendly). **Lean
+  toward Arduino CLI** for the initial port, migrate to PlatformIO later.
+- **Offset persistence frequency:** writing `/pad.offset` to SD after every
+  `encrypt`/`decrypt` is safe but wears the SD. **Batch: persist every 16
+  calls, and also on idle timeout.** If power is lost, at most 16 pad bytes are
+  reused (acceptable for a signing device, not for a high-volume OTP channel).
+
+## Verification
+
+- `arduino-cli compile` (or `pio run`) builds clean for `teensy:avr:teensy41`.
+- Flash to the Teensy 4.1, load a mnemonic, exercise every verb over USB CDC.
+- 1 TB SDXC card mounts, `/pad.bin` reads at >20 MB/s, offset persists across
+  power cycles.
+- Same mnemonic → same keys as the CYD and the host n_signer.
+- SLH-DSA-128s signs in <3 s (vs 5-30 s on ESP32).
diff --git a/src/main.c b/src/main.c
index ac8b47e..b306ae3 100644
--- a/src/main.c
+++ b/src/main.c
@@ -761,9 +761,9 @@ int socket_name_random(char *out, size_t out_len);
 
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
-#define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 58
-#define NSIGNER_VERSION "v0.0.58"
+#define NSIGNER_VERSION_MINOR 1
+#define NSIGNER_VERSION_PATCH 0
+#define NSIGNER_VERSION "v0.1.0"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */