#SecureGen for MoonBit

moon test -p zhangsan2000w-art/moonbit-securegen \
  --target wasm-gc --release --deny-warn
moon run src/cmd/securegen --target js --release -- --profile strict --length 24

#FoloToy reference application

#Firmware features

• Random: 6–30 printable ASCII characters, default length 10, letters always enabled, optional digits and symbols. Every enabled optional class is guaranteed to appear.
• Memorable: 3–6 offline words, default 4, optional capitalization, complete or four-character abbreviated words, and -, ., or _ separators.
• PIN: 4–12 decimal digits, default length 6.
• Input: UP, DOWN, and OK only. OK enters or confirms editing, toggles Boolean values, or generates. Holding UP / DOWN continuously changes a numeric value while editing. Long-pressing OK cancels an edit; outside editing it switches the theme. Long-pressing DOWN outside editing opens Settings.
• Feedback: MoonBit generates the success chime's frequencies, durations, envelope, and PCM samples; the C audio task only performs non-blocking playback. The chime can be disabled in Settings.
• BLE keyboard: pair the device named FoloPassKey with no passkey, focus a field on the host, and select Send to type the current password as a US-layout keyboard. The bonded link is encrypted, but Just Works pairing does not provide MITM authentication.
• Display: switchable 240×320 cyberpunk and blue-sky themes with a 17px, 4bpp, strongly hinted CJK subset. MoonBit view models own parameter slots, focus, layout, theme and settings state, strength color, and battery presentation policy.
• Core: generation, unbiased indexes, output postconditions, entropy and strength, state transitions, settings input policy, view models, battery policy, and sound synthesis are implemented in MoonBit.

#Reusable engine and applications

• src is the root, platform-neutral MoonBit package; its API guide covers the typed PasswordPolicy, String-returning application APIs, allocation-controlled embedded APIs, and injected random source.
• src/cmd/securegen is an independent MoonBit application using host cryptographic entropy through moonbitlang/core/env; it supports profiles, custom lengths, PINs, and batch output.
• examples/consumer is a separate MoonBit module with a versioned dependency on the root library and cross-module tests.
• src/cmd/web and examples/web form a browser consumer: MoonBit owns the credential workflow while the adapter supplies DOM access and browser cryptographic randomness.
• The AI Passport firmware is a second, real application. Its stable C ABI now delegates password, PIN, and passphrase generation to securegen while C continues to provide hardware entropy and device I/O.

#Settings and persistence

• Long-press OK on the main screen while not editing to switch between cyberpunk and blue-sky themes. Long-press DOWN to open Settings.
• Use UP / DOWN to select Theme or Sound, press OK to change the selected value, and long-press OK to return.
• Theme switches between the dark cyberpunk interface and the blue-sky, clouds, and grass interface.
• Sound enables or disables the success chime without affecting password generation.
• Theme and sound preferences and up to three BLE bond records are stored in ESP-IDF NVS. Generated passwords and password history are never persisted.
• If NVS is unavailable, the selected values still apply for the current session and the firmware logs a warning. The application does not erase the NVS partition automatically.

#MoonBit-first implementation

• Random password, PIN, and passphrase algorithms plus enabled-class guarantees;
• the RandomSource abstraction, rejection sampling, and generated-output postconditions;
• parameter policies, entropy estimates, and strength classification;
• NAVIGATION / EDITING transitions and configuration change detection;
• settings focus, button-gesture mapping, theme selection, and sound policy;
• parameter slot, coordinate, focus, editing, and value view models;
• pure policy for resolving raw CW2017 readings into a display value;
• BLE keyboard state, send eligibility, and the complete printable-ASCII to USB HID report mapping;
• success-note sequencing, attack/release envelopes, and PCM sample generation.

#Upstream and attribution

#Toolchains

• ESP-IDF 5.5.3, target esp32c3
• MoonBit with the native/C backend (moon and moonc on PATH)
• Python 3

#Test

./tools/validate.sh --static

moon check --target wasm-gc --deny-warn
MOONBIT_NEW_NATIVE=0 moon -C moonbit check --target native --deny-warn
MOONBIT_NEW_NATIVE=0 moon -C moonbit test --target native --release

moon test -p zhangsan2000w-art/moonbit-securegen \
  --target wasm-gc --release --deny-warn
moon -C examples/consumer test --target js --release --deny-warn
moon run src/cmd/securegen --target js --release -- --profile strict --length 24

#Build

./tools/validate.sh --firmware

./tools/validate.sh

build/FoloToy-AI-Passport-full.bin

PYTHON='D:/path/to/idf-python/Scripts/python.exe' ./tools/validate.sh --static

#Flash

python -m esptool --chip esp32c3 --baud 460800 \
  --before default-reset --after hard-reset \
  write-flash 0x0 build/FoloToy-AI-Passport-full.bin

#Offline word list and fonts

• The memorable mode bundles the 1,296-entry EFF Short Wordlist for Passphrases #1, attributed to the Electronic Frontier Foundation under CC BY 3.0 US. The tracked source SHA-256 is 8f5ca830b8bffb6fe39c9736c024a00a6a6411adb3f83a9be8bfeeb6e067ae69.
• Build-time code generation packs all words into one NUL-separated constant byte blob with 16-bit offsets. The table remains in Flash and is not loaded wholesale into RAM at startup.
• The Chinese LVGL glyph subset was generated from Noto Sans SC. Its OFL 1.1 notice is tracked at assets/fonts/NotoSansSC-OFL.txt. Only ASCII and V1 UI glyphs are compiled into the firmware; the current subset uses 17px, 4bpp, and strong autohinting for heavier small-screen strokes.
• The subset uses LVGL's compressed font format, so examples/folotoy-ai-passport/sdkconfig.defaults enables CONFIG_LV_USE_FONT_COMPRESSED=y. If panels and the generated password render but title, mode, and button labels are blank, rebuild from clean defaults and confirm this option is present in the generated sdkconfig.
• The vendored MoonBit runtime files retain their Apache-2.0 notice in examples/folotoy-ai-passport/components/moonbit_password/RUNTIME_LICENSE.txt. Project-authored code remains under the repository MIT license.

#API, versioning, design, and security

• Public API guide
• Semantic versioning and Mooncakes release contract
• Architecture and decision record
• Security model and limitations
• AI usage disclosure
• Official AI Passport documentation index

#Verification status