fix: separate concerns

chore: lint & bundle
users page dialogs
2026-03-19 11:13:32 +00:00 · 2026-03-19 09:59:17 +00:00 · 2026-03-19 09:54:27 +00:00 · 2026-03-19 09:54:27 +00:00 · 2026-03-19 09:54:27 +00:00 · 2026-03-19 09:54:27 +00:00
269 changed files with 31263 additions and 38776 deletions
@@ -7,20 +7,14 @@
 # They are NOT managed by the Admin UI and are not stored in the database.

 # === First Install Token ===
-# If set the user is required to enter this token on the /first_install page
+# if set the user is required to enter this token on the /first_install page
 # FIRST_INSTALL_TOKEN="myaccesstoken"

-# === Security ===
-# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
-AUTH_HTTPS_ONLY=true
-
 # === Logging and Development ===

 DEBUG=False
 DEBUG_DATABASE=False
 BUNDLE_ASSETS=True
-# add `?profiler=true` to the url to enable the profiler for that request
-PROFILER=False

 # logging into LNBITS_DATA_FOLDER/logs/
 ENABLE_LOG_TO_FILE=true
@@ -30,10 +24,6 @@ LOG_ROTATION="100 MB"
 LOG_RETENTION="3 months"
 # for database cleanup commands
 # CLEANUP_WALLETS_DAYS=90
-# Hard limit for total created users. Set to 0 to disable the limit.
-# LNBITS_MAX_USERS=0
-# Hard limit for total installed extensions. Set to 0 to disable the limit.
-# LNBITS_MAX_EXTENSIONS=0

 # === Admin Settings ===

@@ -104,7 +94,7 @@ AUTH_SECRET_KEY=""
 ######################################

 AUTH_TOKEN_EXPIRE_MINUTES=525600
-# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth, oidc-auth
+# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
 AUTH_ALLOWED_METHODS="user-id-only, username-password"
 # Set this flag if HTTP is used for OAuth
 # OAUTHLIB_INSECURE_TRANSPORT="1"
@@ -119,8 +109,6 @@ LNBITS_SITE_TAGLINE="Open Source Lightning Payments Platform"
 LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
-# Toggle the background styling on burger menus / drawers
-# LNBITS_DEFAULT_BURGER_MENU_BACKGROUND=true
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

 ######################################
@@ -283,50 +271,6 @@ KEYCLOAK_DISCOVERY_URL=""
 KEYCLOAK_CLIENT_CUSTOM_ORG=""
 KEYCLOAK_CLIENT_CUSTOM_ICON=""

-# OIDC OAuth Config
-# Generic OIDC provider configuration
-# Make sure that the redirect URI in your OIDC provider is set to: https://{domain}/api/v1/auth/oidc/token
-# Required scopes: openid, email, profile
-# The discovery URL must be accessible from your LNbits server
-# Always use HTTPS in production environments
-# The CUSTOM_ORG and CUSTOM_ICON settings allow you to customize the login button
-# For example: "Login via Zitadel" with the Zitadel logo
-OIDC_DISCOVERY_URL=""
-OIDC_CLIENT_ID=""
-OIDC_CLIENT_SECRET=""
-OIDC_CLIENT_CUSTOM_ORG=""
-OIDC_CLIENT_CUSTOM_ICON=""
-
-# Example OIDC configurations for various providers:
-#
-# ZITADEL:
-# OIDC_DISCOVERY_URL=https://login.yourdomain.de/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-zitadel-client-id@project-id
-# OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Zitadel
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/zitadel.png
-#
-# AUTHENTIK:
-# OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/lnbits/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authentik-client-id
-# OIDC_CLIENT_SECRET=your-authentik-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authentik
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authentik.png
-#
-# AUTHELIA:
-# OIDC_DISCOVERY_URL=https://auth.yourdomain.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authelia-client-id
-# OIDC_CLIENT_SECRET=your-authelia-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authelia
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authelia.png
-#
-# OKTA:
-# OIDC_DISCOVERY_URL=https://your-domain.okta.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-okta-client-id
-# OIDC_CLIENT_SECRET=your-okta-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Okta
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/okta.png
-

 ######################################

@@ -7,6 +7,10 @@ on:
        description: 'The tag name for the release'
        required: true
        type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string

  workflow_dispatch:
    inputs:
@@ -14,6 +18,10 @@ on:
        description: 'The tag name for the release'
        required: true
        type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string

 jobs:
  build-linux-package:
@@ -61,10 +69,7 @@ jobs:
            --onefile \
            --name lnbits \
            --hidden-import=embit \
-            --hidden-import=bitstring.bitstore_bitarray \
            --collect-all embit \
-            --collect-all bitstring \
-            --collect-all bitarray \
            --collect-all lnbits \
            --collect-all sqlalchemy \
            --collect-all breez_sdk \
@@ -105,6 +110,11 @@ jobs:
        shell: bash

      - name: Upload Linux Release Asset
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ inputs.upload_url }}
+          asset_path: ${{ env.APPIMAGE_NAME }}
+          asset_name: ${{ env.APPIMAGE_NAME }}
+          asset_content_type: application/octet-stream
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "${{ inputs.tag_name }}" "${{ env.APPIMAGE_NAME }}" --clobber
@@ -1,33 +0,0 @@
-name: bundle
-on:
-  workflow_call:
-
-jobs:
-  bundle:
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || github.event.pull_request.head.sha }}
-      - uses: lnbits/lnbits/.github/actions/prepare@dev
-        with:
-          python-version: "3.10"
-          node-version: "24.x"
-          npm: true
-      - name: Build and commit bundle (same-repo PR)
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        run: |
-          make bundle
-          git config user.name "alan"
-          git config user.email "alan@lnbits.com"
-          git add lnbits/static
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          git commit -m "chore: make bundle [skip ci]"
-          git push
-      - name: Check bundle is up-to-date (fork PR)
-        if: github.event.pull_request.head.repo.full_name != github.repository
-        run: make checkbundle
@@ -1,9 +1,14 @@
 name: LNbits CI
 on:
+  push:
+    branches:
+      - main
+      - dev
  pull_request:


 jobs:
+
  lint:
    uses: ./.github/workflows/lint.yml

@@ -11,7 +16,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -25,7 +30,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -39,7 +44,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -53,7 +58,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
    uses: ./.github/workflows/migration.yml
    with:
      python-version: ${{ matrix.python-version }}
@@ -69,7 +74,7 @@ jobs:
    uses: ./.github/workflows/regtest.yml
    strategy:
      matrix:
-        python-version: ["3.12"]
+        python-version: ["3.10"]
        backend-wallet-class:
          - BoltzWallet
          - LndRestWallet
@@ -89,11 +94,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.12"]
+        python-version: ["3.10"]
    uses: ./.github/workflows/jmeter.yml
    with:
      python-version: ${{ matrix.python-version }}
-
-  bundle:
-    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, regtest, jmeter ]
-    uses: ./.github/workflows/bundle.yml
@@ -22,7 +22,6 @@ jobs:
      - name: run LNbits
        env:
          LNBITS_ADMIN_UI: true
-          AUTH_HTTPS_ONLY: false
          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
        run: |
@@ -6,30 +6,53 @@ jobs:

  black:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkblack
+      python-version: ${{ matrix.python-version }}

  ruff:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkruff
+      python-version: ${{ matrix.python-version }}

  mypy:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: mypy
+      python-version: ${{ matrix.python-version }}

  pyright:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: pyright
+      python-version: ${{ matrix.python-version }}
      npm: true

+
  prettier:
    uses: ./.github/workflows/make.yml
    with:
      make: checkprettier
      npm: true

+  bundle:
+    uses: ./.github/workflows/make.yml
+    with:
+      make: checkbundle
+      npm: true
+
  poetry:
    uses: ./.github/workflows/poetry.yml
@@ -14,7 +14,7 @@ on:
      python-version:
        description: "python version"
        type: string
-        default: "3.12"
+        default: "3.10"

 jobs:
  make:
@@ -22,7 +22,7 @@ jobs:
    strategy:
      matrix:
        os-version: ["ubuntu-24.04"]
-        node-version: ["24.x"]
+        node-version: ["18.x"]
    runs-on: ${{ matrix.os-version }}
    steps:
      - uses: actions/checkout@v4
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -66,7 +66,6 @@ jobs:
          BOLTZ_MNEMONIC: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
          LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
          LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
-          LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS: ${{ inputs.backend-wallet-class == 'CoreLightningRestWallet' && 60 || 5 }}
          ECLAIR_PASS: lnbits
          PYTHONUNBUFFERED: 1
          DEBUG: true
@@ -12,6 +12,8 @@ jobs:

  release:
    runs-on: ubuntu-24.04
+    outputs:
+      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
    steps:
      - uses: actions/checkout@v4
      - name: Create github pre-release
@@ -20,6 +22,14 @@ jobs:
          tag: ${{ github.ref_name }}
        run: |
          gh release create "$tag" --prerelease --generate-notes --draft
+      - id: get_upload_url
+        name: Get upload url of Github release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref_name }}
+        run: |
+          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
+          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"

  docker:
    if: github.repository == 'lnbits/lnbits'
@@ -64,3 +74,4 @@ jobs:
    uses: ./.github/workflows/appimage.yml
    with:
      tag_name: ${{ github.ref_name }}
+      upload_url: ${{ needs.release.outputs.upload_url }}
@@ -13,6 +13,8 @@ jobs:

  release:
    runs-on: ubuntu-24.04
+    outputs:
+      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
    steps:
      - uses: actions/checkout@v4
      - name: Create github release
@@ -21,6 +23,14 @@ jobs:
          tag: ${{ github.ref_name }}
        run: |
          gh release create "$tag" --generate-notes --draft
+      - id: get_upload_url
+        name: Get upload url of Github release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref_name }}
+        run: |
+          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
+          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"

  docker:
    if: github.repository == 'lnbits/lnbits'
@@ -75,3 +85,4 @@ jobs:
    uses: ./.github/workflows/appimage.yml
    with:
      tag_name: ${{ github.ref_name }}
+      upload_url: ${{ needs.release.outputs.upload_url }}
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -6,7 +6,6 @@ __pycache__
 *$py.class
 .mypy_cache
 .vscode
-.codex
 *-lock.json
 .python-version

@@ -1 +0,0 @@
-min-release-age=7
@@ -14,11 +14,11 @@ repos:
      - id: mixed-line-ending
      - id: check-case-conflict
  - repo: https://github.com/psf/black
-    rev: 26.3.1
+    rev: 25.1.0
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.10
+    rev: v0.12.10
    hooks:
      - id: ruff
        args: [ --fix, --exit-non-zero-on-fix ]
@@ -1,60 +0,0 @@
-# AGENTS.md - AI Coding Agent Guide for LNbits
-
-This file guides AI coding agents working on LNbits. Keep changes small, verified, and aligned with existing project patterns.
-
-## Core Behavior
-
- Think before coding. State material assumptions. Ask when ambiguity affects correctness, security, payments, wallets, or data migrations.
- Prefer the simplest implementation that solves the request.
- Make surgical changes. Every changed line should trace back to the task.
- Do not refactor, reformat, rename, or clean adjacent code unless required.
- Remove only dead code or imports created by your own changes.
- Define success criteria for non-trivial work and verify them before reporting done.
-
-## LNbits Architecture
-
- Keep core lean. Prefer/assess extensions for non-core features.
- Preserve compatibility with existing extensions and wallet backends.
- Follow existing patterns in `lnbits/core`, `lnbits/wallets`, `lnbits/extensions`, and frontend code.
- Use existing CRUD, services, settings, and migration patterns.
- Do not edit generated files, bundled vendor files, or unrelated extension code.
-
-## Security-Sensitive Areas
-
-Be extra cautious with payments, wallet balances, admin routes, keys, LNURL, Bolt11, funding sources, migrations, and authentication.
-
-Do not expose raw stack traces or sensitive values. Do not add synchronous blocking work in hot async paths without justification.
-
-## Commands and Verification
-
-Read `Makefile` before running project commands.
-
-Use Makefile targets instead of hand-written commands when available:
-
- `make check` for full checks.
- `make test-unit` for unit tests.
- `make test-api` for API tests.
- `make test-wallets` for wallet tests.
- `make checkbundle` when bundled frontend assets may be affected.
- `make format` only when formatting is intended.
-
-Do not run `make test` by default. Use the targeted tests available in the Makefile that are related to the work done, unless the user explicitly asks for broader test coverage.
-
-## Dependencies
-
-Do not add dependencies without approval. If approved, update the correct project files and explain why the dependency is necessary.
-
-## Maintenance
-
-LNbits maintainers own this file. They should update it when the development workflow, architecture, or verification commands materially change.
-
-Do not edit, commit, push, or include changes to this file in a PR as part of normal feature work unless the user explicitly asks for `AGENTS.md` changes.
-
-## Reporting
-
-When finished, report:
-
- Summary of what changed.
- Files touched.
- Makefile targets or checks run.
- Anything not verified and why.
@@ -43,4 +43,4 @@ ENV LNBITS_HOST="0.0.0.0"

 EXPOSE 5000

-CMD ["sh", "-c", "uv --offline run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
+CMD ["sh", "-c", "uv run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
@@ -66,7 +66,6 @@ test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	rm -rf ./tests/data \
 	uv run pytest tests/regtest

 test-migration:
@@ -1,12 +1,12 @@
 <a href="https://lnbits.com" target="_blank" rel="noopener noreferrer">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/logos/lnbits-full-inverse.svg">
-    <img src="docs/logos/lnbits-full.svg" alt="LNbits" style="width:300px">
+    <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png">
+    <img src="https://i.imgur.com/fyKPgVT.png" alt="LNbits" style="width:300px">
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)  
-<img alt="lnbits_head" src="docs/assets/header.jpg" />  
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)  
+<img width="2000" height="203" alt="lnbits_head" src="https://github.com/user-attachments/assets/77669718-ac10-43c7-ae95-6ce236c77401" />  
 [![tip-hero](https://img.shields.io/badge/TipJar-LNBits%20Hero-9b5cff?labelColor=6b7280&logo=lightning&logoColor=white)](https://demo.lnbits.com/tipjar/DwaUiE4kBX6mUW6pj3X5Kg)

 # LNbits — The most powerful Bitcoin & Lightning toolkit
@@ -46,7 +46,7 @@ Get yourself familiar and test on our demo server [demo.lnbits.com](https://demo

 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.

-<img alt="lnbits_wallet" src="docs/assets/wallet.jpg" />
+<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">

 ## LNbits extension universe

@@ -54,25 +54,25 @@ Extend YOUR LNbits to meet YOUR needs.

 All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.

-<img alt="lnbits_extensions" src="docs/assets/extensions.jpg" />
+<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">

 ## LNbits API

 LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.

-<img alt="lnbits_api" src="docs/assets/api.jpg" />
+<img src="https://i.imgur.com/V742sb9.png" style="width:800px">

 ## LNbits node manager

 LNbits comes packaged with a light node management UI, to make running your node that much easier.

-<img alt="lnbits_api" src="docs/assets/lightning_node.jpg" />
+<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">

-## LNbits merchant tools
+## LNbits across all your devices

-The LNbits stack can process both bitcoin and fiat payments, making it a turnkey, all-in-one solution for merchants. With orders and inventory shared across extensions, and built-in notifications for Nostr, Telegram, and email, LNbits keeps everything in sync, freeing merchants to focus on their business.
+As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.

-<img alt="lnbits_merchants" src="docs/assets/merchants_small.webp" />
+<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">

 ## Powered by LNbits

@@ -18,7 +18,7 @@ RUN uv sync --all-extras
 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"
 ENV LNBITS_BACKEND_WALLET_CLASS="BoltzWallet"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
+ENV FUNDING_SOURCE_MAX_RETRIES=10

 # Boltzd
 ENV BOLTZ_CLIENT_ENDPOINT="127.0.0.1:9002"
@@ -2,17 +2,15 @@ ARG LNBITS_TAG=latest

 FROM lnbits/lnbits:${LNBITS_TAG}

-RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
-
 RUN apt-get update && apt-get -y upgrade
-RUN apt-get install -y ca-certificates curl gnupg netcat-openbsd git nodejs
+RUN apt-get install -y netcat-openbsd npm nodejs git

 RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 ENV PATH="/root/.local/bin:$PATH"

 # install sparksidecar
 RUN git clone https://github.com/lnbits/spark_sidecar
-RUN cd spark_sidecar && npm ci
+RUN cd spark_sidecar && npm install

 # Reinstall dependencies for lnbits just in case (needed for CMD usage)
 RUN uv sync --all-extras
@@ -24,7 +22,7 @@ ENV LNBITS_BACKEND_WALLET_CLASS="SparkL2Wallet"
 ENV LNBITS_RESERVE_FEE_MIN="20000"
 ENV LNBITS_RESERVE_FEE_PERCENT="1"
 ENV LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS="20"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
+ENV FUNDING_SOURCE_MAX_RETRIES=10

 # spark sidecar
 ENV SPARK_NETWORK="MAINNET"
@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNBits Admin UI

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend Wallet Comparison Table

@@ -11,7 +11,7 @@ nav_order: 1
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) <img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">

 # Basic installation

@@ -51,7 +51,7 @@ nav_order: 1
 sudo apt-get install jq libfuse2
 wget $(curl -s https://api.github.com/repos/lnbits/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
 chmod +x LNbits-latest.AppImage
-LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 AUTH_HTTPS_ONLY=false ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
 ```

 - LNbits will create a folder for DB and extension files **in the same directory** as the AppImage.
@@ -285,7 +285,10 @@ but you can also set the env variables or pass command line arguments:

 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true AUTH_HTTPS_ONLY=false ./result/bin/lnbits --port 9000 --host 0.0.0.0
+LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0
+
+# Once you have created a user, you can set as the super_user
+SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
 ```

 > ![NOTE](https://img.shields.io/badge/NOTE-3b82f6?labelColor=494949)
@@ -1,139 +0,0 @@
-# Generic OIDC Authentication Configuration
-
-This document explains how to configure generic OIDC authentication for LNbits, which allows integration with various OIDC-compliant authentication providers such as Zitadel, Authentik, and others.
-
-## Overview
-
-The generic OIDC provider (`oidc`) complements the existing Keycloak provider and allows you to integrate any OIDC-compliant authentication service. You can customize the login button with your own organization name and icon.
-
-## Configuration
-
-Add the following environment variables to your `.env` file or system environment:
-
-### Required Settings
-
-```bash
-# Enable OIDC authentication
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-
-# OIDC Discovery URL (well-known endpoint)
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-
-# Client credentials from your OIDC provider
-LNBITS_OIDC_CLIENT_ID=your-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-client-secret
-```
-
-### Optional Settings - Customize the Login Button
-
-You can customize how the OIDC login button appears to your users:
-
-```bash
-# Custom organization name (displayed on the login button)
-# Example: "Login via Zitadel" or "Login via Authentik"
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-
-# Custom icon URL (displayed on the login button)
-# Can be a full URL or a path to a local image
-LNBITS_OIDC_CLIENT_CUSTOM_ICON=https://zitadel.com/favicon.svg
-```
-
-If not set, the button will display "Login via OIDC" with a generic lock icon.
-
-## Zitadel Configuration Example
-
-For Zitadel, configure as follows:
-
-1. Create a new application in Zitadel
-2. Choose "Web" application type
-3. Configure the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Save the Client ID and Client Secret
-5. Use these environment variables:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-zitadel-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# Customize the button to show "Login via Zitadel" with Zitadel's logo
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-LNBITS_OIDC_CLIENT_CUSTOM_ICON="https://zitadel.com/favicon.svg"
-```
-
-**Result**: The login page will display a button with the text "Login via Zitadel" and the Zitadel logo.
-
-## Authentik Configuration Example
-
-For Authentik:
-
-1. Create a new OAuth2/OpenID Provider
-2. Set the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-3. Configure scopes: `openid`, `email`, `profile`
-4. Get the Client ID and Client Secret
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/your-app/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-authentik-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-authentik-client-secret
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Authentik"
-```
-
-## Multiple Auth Methods
-
-You can enable multiple authentication methods simultaneously:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=username-password,oidc-auth,keycloak-auth
-```
-
-## Discovery Endpoint Requirements
-
-Your OIDC provider must expose a standard discovery endpoint (`.well-known/openid-configuration`) that includes:
-
- `authorization_endpoint`
- `token_endpoint`
- `userinfo_endpoint`
- `jwks_uri` (JSON Web Key Set)
-
-The OIDC implementation will automatically fetch these endpoints from the discovery URL.
-
-## User Mapping
-
-The OIDC provider maps user information from the OIDC userinfo endpoint:
-
- `sub` → User ID
- `email` → Email address
- `given_name` → First name
- `family_name` → Last name
- `name` or `preferred_username` → Display name
- `picture` → Profile picture URL
-
-## Troubleshooting
-
-### Authentication fails
-
-1. Verify the discovery URL is accessible
-2. Check that Client ID and Client Secret are correct
-3. Ensure redirect URI in your OIDC provider matches: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Check LNbits logs for detailed error messages
-
-### User info not populated
-
-Some OIDC providers may use different claim names. If user information is not correctly populated, check your provider's userinfo endpoint response format and adjust the provider class if needed.
-
-## Security Considerations
-
- Always use HTTPS in production
- Keep client secrets secure and never commit them to version control
- Use environment variables or secure configuration management
- Regularly rotate client secrets
- Review OIDC provider's security best practices
-
-## Implementation Details
-
-The OIDC provider is implemented in `lnbits/core/models/sso/oidc.py` and extends the `fastapi_sso` library's `SSOBase` class. It uses the standard OpenID Connect flow with:
-
- Scopes: `openid`, `email`, `profile`
- Response type: `code` (authorization code flow)
- Discovery document for automatic endpoint resolution
@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Super User (SU)

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Roles: A Quick Overview

@@ -14,6 +14,7 @@ nav_order: 3
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend wallets

@@ -23,40 +23,29 @@ from lnbits.core.crud import (
    get_installed_extensions,
    update_installed_extension_state,
 )
-from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.extensions import create_installed_extension
 from lnbits.core.helpers import migrate_extension_database
 from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
-from lnbits.core.services.funding_source import (
-    check_balance_delta_changed,
-    check_server_balance_against_node,
-)
-from lnbits.core.services.notifications import (
-    dispatch_payment_notification,
-    enqueue_admin_notification,
-    process_next_notification,
-)
-from lnbits.core.services.payments import (
-    check_pending_payments,
-    fundingsource_invoice_producer,
-)
+from lnbits.core.services.notifications import enqueue_admin_notification
+from lnbits.core.services.payments import check_pending_payments
 from lnbits.core.tasks import (
    audit_queue,
    collect_exchange_rates_data,
-    notify_server_status,
-    process_next_audit_entry,
-    refresh_extension_cache,
-)
-from lnbits.core.wasm_ext.routes.register import register_wasm_extension
-from lnbits.core.wasm_ext.wasm.events import dispatch_wasm_invoice_paid
-from lnbits.core.wasm_ext.wasm.loader import (
-    is_wasm_extension_id,
+    purge_audit_data,
+    run_by_the_minute_tasks,
+    wait_for_audit_data,
+    wait_for_paid_invoices,
+    wait_notification_messages,
 )
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
-from lnbits.llms_txt import create_llms_txt_route
 from lnbits.settings import settings
+from lnbits.tasks import (
+    cancel_all_tasks,
+    create_permanent_task,
+    register_invoice_listener,
+)
 from lnbits.utils.cache import cache
 from lnbits.utils.logger import (
    configure_logger,
@@ -76,10 +65,9 @@ from .middleware import (
    InstalledExtensionMiddleware,
    add_first_install_middleware,
    add_ip_block_middleware,
-    add_profiler_middleware,
    add_ratelimit_middleware,
 )
-from .task_manager import task_manager
+from .tasks import internal_invoice_listener, invoice_listener, run_interval


 async def startup(app: FastAPI):
@@ -113,9 +101,6 @@ async def startup(app: FastAPI):
    # register core routes
    init_core_routers(app)

-    # register llms.txt endpoint for AI agents
-    create_llms_txt_route(app)
-
    # initialize tasks
    register_async_tasks()

@@ -143,7 +128,7 @@ async def shutdown():
    settings.lnbits_running = False

    # shutdown event
-    task_manager.cancel_all_tasks()
+    cancel_all_tasks()

    # wait a bit to allow them to finish, so that cleanup can run without problems
    await asyncio.sleep(0.1)
@@ -176,7 +161,6 @@ def create_app() -> FastAPI:

    # Allow registering new extensions routes without direct access to the `app` object
    core_app_extra.register_new_ext_routes = register_new_ext_routes(app)
-    core_app_extra.register_new_wasm_ext_routes = register_new_wasm_ext_routes(app)
    core_app_extra.register_new_ratelimiter = register_new_ratelimiter(app)

    # register static files
@@ -212,9 +196,6 @@ def create_app() -> FastAPI:

    register_exception_handlers(app)

-    if settings.profiler:
-        add_profiler_middleware(app)
-
    return app


@@ -423,13 +404,6 @@ def register_new_ext_routes(app: FastAPI) -> Callable:
    return register_new_ext_routes_fn


-def register_new_wasm_ext_routes(app: FastAPI) -> Callable:
-    def register_new_wasm_ext_routes_fn(ext_id: str):
-        register_wasm_extension(app, ext_id)
-
-    return register_new_wasm_ext_routes_fn
-
-
 def register_new_ratelimiter(app: FastAPI) -> Callable:
    def register_new_ratelimiter_fn():
        limiter = Limiter(
@@ -483,59 +457,32 @@ async def check_and_register_extensions(app: FastAPI) -> None:
    await check_installed_extensions(app)
    for ext in await get_valid_extensions(False):
        try:
-            if is_wasm_extension_id(ext.code):
-                register_wasm_extension(app, ext.code)
-                continue
            register_ext_routes(app, ext)
            register_ext_tasks(ext)
        except Exception as exc:
            logger.error(f"Could not load extension `{ext.code}`: {exc!s}")
-            await update_installed_extension_state(ext_id=ext.code, active=False)


 def register_async_tasks() -> None:

-    task_manager.init()
+    create_permanent_task(wait_for_audit_data)
+    create_permanent_task(wait_notification_messages)

-    # listen to all incoming payments and dispatch payment notifications
-    # note: should be the first in task list for a bit quicker notifications
-    task_manager.register_invoice_listener(dispatch_payment_notification, "core")
+    create_permanent_task(run_interval(30 * 60, check_pending_payments))
+    create_permanent_task(invoice_listener)
+    create_permanent_task(internal_invoice_listener)
+    create_permanent_task(cache.invalidate_forever)

-    # periodic tasks
-    task_manager.create_permanent_task(cache.invalidate_cache, interval=10)
-    task_manager.create_permanent_task(delete_expired_audit_entries, interval=60 * 60)
-    task_manager.create_permanent_task(
-        check_pending_payments,
-        interval=settings.lnbits_funding_source_pending_interval_seconds,
-    )
-    task_manager.create_permanent_task(
-        collect_exchange_rates_data,
-        interval=max(60, settings.lnbits_exchange_history_refresh_interval_seconds),
-    )
-    task_manager.create_permanent_task(check_balance_delta_changed, interval=60)
-    task_manager.create_permanent_task(
-        check_server_balance_against_node,
-        interval=60 * settings.lnbits_watchdog_interval_minutes,
-    )
-    task_manager.create_permanent_task(
-        notify_server_status,
-        interval=60 * 60 * settings.lnbits_notification_server_status_hours,
-    )
-    task_manager.create_permanent_task(refresh_extension_cache, interval=60)
+    # core invoice listener
+    invoice_queue: asyncio.Queue = asyncio.Queue()
+    register_invoice_listener(invoice_queue, "core")
+    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))

-    # permanent tasks run in a loop, will be restarted if they fail
-    task_manager.create_permanent_task(fundingsource_invoice_producer)
-    task_manager.create_permanent_task(process_next_notification)
-    task_manager.create_permanent_task(process_next_audit_entry)
-
-    async def dispatch_extension_invoice_paid(payment) -> None:
-        await dispatch_wasm_invoice_paid(payment)
-
-    core_app_extra.dispatch_extension_invoice_paid = dispatch_extension_invoice_paid
+    create_permanent_task(run_by_the_minute_tasks)
+    create_permanent_task(purge_audit_data)
+    create_permanent_task(collect_exchange_rates_data)

    # server logs for websocket
    if settings.lnbits_admin_ui:
        server_log_task = initialize_server_websocket_logger()
-        task_manager.create_permanent_task(
-            server_log_task, name="server_websocket_logger"
-        )
+        create_permanent_task(server_log_task)
@@ -12,7 +12,6 @@ from .extensions import (
    drop_extension_db,
    get_installed_extension,
    get_installed_extensions,
-    get_installed_extensions_count,
    get_user_active_extensions_ids,
    get_user_extension,
    get_user_extensions,
@@ -59,7 +58,6 @@ from .users import (
    get_account_by_username,
    get_account_by_username_or_email,
    get_accounts,
-    get_accounts_count,
    get_user,
    get_user_access_control_lists,
    get_user_from_account,
@@ -119,13 +117,11 @@ __all__ = [
    "get_account_by_username",
    "get_account_by_username_or_email",
    "get_accounts",
-    "get_accounts_count",
    "get_admin_settings",
    "get_db_version",
    "get_db_versions",
    "get_installed_extension",
    "get_installed_extensions",
-    "get_installed_extensions_count",
    "get_latest_payments_by_extension",
    "get_payment",
    "get_payments",
@@ -90,13 +90,6 @@ async def get_installed_extensions(
    return all_extensions


-async def get_installed_extensions_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM installed_extensions"
-    )
-    return int(row["count"]) if row else 0
-
-
 async def get_user_extension(
    user_id: str, extension: str, conn: Connection | None = None
 ) -> UserExtension | None:
@@ -149,12 +149,14 @@ async def get_payments_paginated(  # noqa: C901
            f"(status = '{PaymentState.SUCCESS}' OR status = '{PaymentState.PENDING}')"
        )
    elif complete:
-        clause.append(f"""
+        clause.append(
+            f"""
            (
                status = '{PaymentState.SUCCESS}'
                OR (amount < 0 AND status = '{PaymentState.PENDING}')
            )
-            """)
+            """
+        )
    elif pending:
        clause.append(f"status = '{PaymentState.PENDING}'")
    elif failed:
@@ -290,10 +292,8 @@ async def create_payment(
        webhook=data.webhook,
        fee=-abs(data.fee),
        tag=extra.get("tag", None),
-        extension=data.extension,
        extra=extra,
        labels=data.labels or [],
-        external_id=data.external_id,
    )

    await (conn or db).insert("apipayments", payment)
@@ -307,7 +307,7 @@ async def update_payment_checking_id(
    await (conn or db).execute(
        f"""
            UPDATE apipayments
-            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder("now")}
+            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder('now')}
            WHERE checking_id = :old_id
        """,  # noqa: S608
        {
@@ -322,15 +322,13 @@ async def update_payment(
    payment: Payment,
    new_checking_id: str | None = None,
    conn: Connection | None = None,
-) -> Payment:
+) -> None:
    payment.updated_at = datetime.now(timezone.utc)
    await (conn or db).update(
        "apipayments", payment, "WHERE checking_id = :checking_id"
    )
    if new_checking_id and new_checking_id != payment.checking_id:
        await update_payment_checking_id(payment.checking_id, new_checking_id, conn)
-        payment.checking_id = new_checking_id
-    return payment


 async def get_payments_history(
@@ -348,12 +346,14 @@ async def get_payments_history(
        "wallet_id": wallet_id,
    }
    # count outgoing payments if they are still pending
-    where = [f"""
+    where = [
+        f"""
        wallet_id = :wallet_id AND (
            status = '{PaymentState.SUCCESS}'
            OR (amount < 0 AND status = '{PaymentState.PENDING}')
        )
-        """]
+        """
+    ]
    clause = filters.where(where)
    transactions: list[dict] = await db.fetchall(
        # This query is safe from SQL injection:
@@ -402,6 +402,7 @@ async def get_payment_count_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentCountStat]:
+
    if not filters:
        filters = Filters()
    extra_stmts = []
@@ -434,6 +435,7 @@ async def get_daily_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
+
    if not filters:
        filters = Filters()

@@ -483,6 +485,7 @@ async def get_wallets_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentWalletStats]:
+
    if not filters:
        filters = Filters()

@@ -8,18 +8,11 @@ from lnbits.db import dict_to_model
 from lnbits.settings import (
    AdminSettings,
    EditableSettings,
-    FundingSourcesSettings,
    SettingsField,
    SuperSettings,
    settings,
 )

-RESET_PRESERVED_SETTINGS = (
-    "lnbits_webpush_pubkey",
-    "lnbits_webpush_privkey",
-    *FundingSourcesSettings.__fields__,
-)
-

 async def get_super_settings() -> SuperSettings | None:
    data = await get_settings_by_tag("core")
@@ -76,14 +69,16 @@ async def delete_admin_settings(tag: str | None = "core") -> None:


 async def reset_core_settings() -> None:
-    core_settings = await get_settings_by_tag("core") or {}
-    super_user = await get_settings_field("super_user")
-    await delete_admin_settings()
-    if super_user:
-        await set_settings_field("super_user", super_user.value)
-    for field in RESET_PRESERVED_SETTINGS:
-        if field in core_settings:
-            await set_settings_field(field, core_settings[field])
+    await db.execute(
+        """
+        DELETE FROM system_settings WHERE tag = 'core'
+        AND id NOT IN (
+            'super_user',
+            'lnbits_webpush_pubkey',
+            'lnbits_webpush_privkey'
+        )
+        """,
+    )


 async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSettings:
@@ -110,8 +105,7 @@ async def get_settings_field(
    )
    if not row:
        return None
-    value = json.loads(row["value"]) if row["value"] else None
-    return SettingsField(id=row["id"], value=value, tag=row["tag"])
+    return SettingsField(id=row["id"], value=json.loads(row["value"]), tag=row["tag"])


 async def set_settings_field(id_: str, value: Any | None, tag: str | None = "core"):
@@ -4,12 +4,7 @@ from typing import Any
 from uuid import uuid4

 from lnbits.core.crud.extensions import get_user_active_extensions_ids
-from lnbits.core.crud.wallets import (
-    clear_wallet_cache,
-    create_wallet,
-    get_standalone_wallet,
-    get_wallets,
-)
+from lnbits.core.crud.wallets import clear_wallet_cache, create_wallet, get_wallets
 from lnbits.core.db import db
 from lnbits.core.models import UserAcls
 from lnbits.db import Connection, Filters, Page
@@ -37,13 +32,6 @@ async def create_account(
    return account


-async def get_accounts_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM accounts"
-    )
-    return int(row["count"]) if row else 0
-
-
 async def update_account(account: Account, conn: Connection | None = None) -> Account:
    account.updated_at = datetime.now(timezone.utc)
    await (conn or db).update("accounts", account)
@@ -64,22 +52,17 @@ async def get_accounts(
 ) -> Page[AccountOverview]:
    where_clauses = []
    values: dict[str, Any] = {}
-    filters = filters or Filters()

-    wallet_filter = filters.get_filter_by_field("wallet_id")
-
-    if wallet_filter and wallet_filter.values:
-        wallet_id_value = next(iter(wallet_filter.values.values()), None)
-        wallet = (
-            await get_standalone_wallet(wallet_id_value, deleted=None, conn=conn)
-            if wallet_id_value
-            else None
-        )
-        if not wallet:
-            return Page(data=[], total=0)
-        where_clauses.append("accounts.id = :account_id")
-        values = {**values, "account_id": wallet.user}
-        filters.remove_filter_by_field("wallet_id")
+    # Make wallet filter explicit
+    wallet_filter = (
+        next((f for f in filters.filters if f.field == "wallet_id"), None)
+        if filters
+        else None
+    )
+    if filters and wallet_filter and wallet_filter.values:
+        where_clauses.append("wallets.id = :wallet_id")
+        values = {**values, "wallet_id": next(iter(wallet_filter.values.values()))}
+        filters.filters = [f for f in filters.filters if f.field != "wallet_id"]

    return await (conn or db).fetch_page(
        """
@@ -15,8 +15,6 @@ from lnbits.core.crud import (
 from lnbits.core.db import db as core_db
 from lnbits.core.models import DbVersion
 from lnbits.core.models.extensions import InstallableExtension
-from lnbits.core.wasm_ext.storage.crud import migrate_wasm_extension_database
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import COCKROACH, POSTGRES, SQLITE, Connection
 from lnbits.settings import settings

@@ -24,16 +22,7 @@ from lnbits.settings import settings
 async def migrate_extension_database(
    ext: InstallableExtension, current_version: DbVersion | None = None
 ):
-    if is_wasm_extension_id(ext.id):
-        await migrate_wasm_extension_database(ext, current_version)
-        return
-    else:
-        await migrate_py_extension_database(ext, current_version)

-
-async def migrate_py_extension_database(
-    ext: InstallableExtension, current_version: DbVersion | None = None
-):
    try:
        ext_migrations = importlib.import_module(f"{ext.module_name}.migrations")
        ext_db = importlib.import_module(ext.module_name).db
@@ -10,26 +10,31 @@ from lnbits.db import Connection


 async def m000_create_migrations_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
    CREATE TABLE IF NOT EXISTS dbversions (
        db TEXT PRIMARY KEY,
        version INT NOT NULL
    )
-    """)
+    """
+    )


 async def m001_initial(db: Connection):
    """
    Initial LNbits tables.
    """
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS accounts (
            id TEXT PRIMARY KEY,
            email TEXT,
            pass TEXT
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS extensions (
            "user" TEXT NOT NULL,
            extension TEXT NOT NULL,
@@ -37,8 +42,10 @@ async def m001_initial(db: Connection):

            UNIQUE ("user", extension)
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS wallets (
            id TEXT PRIMARY KEY,
            name TEXT NOT NULL,
@@ -46,8 +53,10 @@ async def m001_initial(db: Connection):
            adminkey TEXT NOT NULL,
            inkey TEXT
        );
-    """)
-    await db.execute(f"""
+    """
+    )
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS apipayments (
            payhash TEXT NOT NULL,
            amount {db.big_int} NOT NULL,
@@ -58,9 +67,11 @@ async def m001_initial(db: Connection):
            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            UNIQUE (wallet, payhash)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -74,7 +85,8 @@ async def m001_initial(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m002_add_fields_to_apipayments(db: Connection):
@@ -137,7 +149,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
    """

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -151,7 +164,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m005_balance_check_balance_notify(db: Connection):
@@ -160,7 +174,8 @@ async def m005_balance_check_balance_notify(db: Connection):
    LNbits wallet and of balanceNotify URLs supplied by users to empty their wallets.
    """

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_check (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          service TEXT NOT NULL,
@@ -168,16 +183,19 @@ async def m005_balance_check_balance_notify(db: Connection):

          UNIQUE(wallet, service)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_notify (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          url TEXT NOT NULL,

          UNIQUE(wallet, url)
        );
-    """)
+    """
+    )


 async def m006_add_invoice_expiry_to_apipayments(db: Connection):
@@ -244,16 +262,19 @@ async def m007_set_invoice_expiries(db: Connection):


 async def m008_create_admin_settings_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS settings (
            super_user TEXT,
            editable_settings TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m009_create_tinyurl_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS tiny_url (
          id TEXT PRIMARY KEY,
          url TEXT,
@@ -261,11 +282,13 @@ async def m009_create_tinyurl_table(db: Connection):
          wallet TEXT,
          time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-    """)
+    """
+    )


 async def m010_create_installed_extensions_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS installed_extensions (
            id TEXT PRIMARY KEY,
            version TEXT NOT NULL,
@@ -276,7 +299,8 @@ async def m010_create_installed_extensions_table(db: Connection):
            active BOOLEAN DEFAULT false,
            meta TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m011_optimize_balances_view(db: Connection):
@@ -285,19 +309,23 @@ async def m011_optimize_balances_view(db: Connection):
    over the payments table instead of 2.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, SUM(amount - abs(fee)) AS balance
        FROM apipayments
        WHERE (pending = false AND amount > 0) OR amount < 0
        GROUP BY wallet
-    """)
+    """
+    )


 async def m012_add_currency_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN currency TEXT
-        """)
+        """
+    )


 async def m013_add_deleted_to_wallets(db: Connection):
@@ -317,13 +345,15 @@ async def m014_set_deleted_wallets(db: Connection):
    Sets deleted column to wallets.
    """
    try:
-        result = await db.execute("""
+        result = await db.execute(
+            """
            SELECT *
            FROM wallets
            WHERE user LIKE 'del:%'
            AND adminkey LIKE 'del:%'
            AND inkey LIKE 'del:%'
-            """)
+            """
+        )
        rows = result.mappings().all()

        for row in rows:
@@ -356,7 +386,8 @@ async def m014_set_deleted_wallets(db: Connection):


 async def m015_create_push_notification_subscriptions_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS webpush_subscriptions (
            endpoint TEXT NOT NULL,
            "user" TEXT NOT NULL,
@@ -365,7 +396,8 @@ async def m015_create_push_notification_subscriptions_table(db: Connection):
            timestamp TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            PRIMARY KEY (endpoint, "user")
        );
-    """)
+    """
+    )


 async def m016_add_username_column_to_accounts(db: Connection):
@@ -452,7 +484,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
    Make deleted wallets not show up in the balances view.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -462,7 +495,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY wallet
-    """)
+    """
+    )


 async def m019_balances_view_based_on_wallets(db: Connection):
@@ -471,7 +505,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
    Important for querying whole lnbits balances.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -481,7 +516,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m020_add_column_column_to_user_extensions(db: Connection):
@@ -500,7 +536,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
    await db.execute("UPDATE apipayments SET status = 'success' WHERE NOT pending")

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -512,7 +549,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m022_add_pubkey_to_accounts(db: Connection):
@@ -543,7 +581,8 @@ async def m024_drop_pending(db: Connection):

 async def m025_refresh_view(db: Connection):
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet_id,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -555,7 +594,8 @@ async def m025_refresh_view(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet_id
-    """)
+    """
+    )


 async def m026_update_payment_table(db: Connection):
@@ -618,7 +658,8 @@ async def m027_update_apipayments_data(db: Connection):

 async def m028_update_settings(db: Connection):

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS system_settings (
            id TEXT PRIMARY KEY,
            value TEXT,
@@ -626,7 +667,8 @@ async def m028_update_settings(db: Connection):

            UNIQUE (id, tag)
        );
-    """)
+    """
+    )

    async def _insert_key_value(id_: str, value: Any):
        await db.execute(
@@ -649,7 +691,8 @@ async def m028_update_settings(db: Connection):


 async def m029_create_audit_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS audit (
            component TEXT,
            ip_address TEXT,
@@ -663,13 +706,16 @@ async def m029_create_audit_table(db: Connection):
            delete_at TIMESTAMP,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m030_add_user_api_tokens_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE accounts ADD COLUMN access_control_list TEXT
-        """)
+        """
+    )


 async def m031_add_color_and_icon_to_wallets(db: Connection):
@@ -692,25 +738,32 @@ async def m033_update_payment_table(db: Connection):


 async def m034_add_stored_paylinks_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN stored_paylinks TEXT
-        """)
+        """
+    )


 async def m035_add_wallet_type_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN wallet_type TEXT DEFAULT 'lightning'
-        """)
+        """
+    )


 async def m036_add_shared_wallet_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN shared_wallet_id TEXT
-        """)
+        """
+    )


 async def m037_create_assets_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS assets (
            id TEXT PRIMARY KEY,
            user_id TEXT NOT NULL,
@@ -723,13 +776,16 @@ async def m037_create_assets_table(db: Connection):
            data {db.blob} NOT NULL,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m038_add_labels_for_payments(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE apipayments ADD COLUMN labels TEXT
-        """)
+        """
+    )


 async def m039_index_payments(db: Connection):
@@ -748,9 +804,11 @@ async def m039_index_payments(db: Connection):
    ]
    for index in indexes:
        logger.debug(f"Creating index idx_payments_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_payments_{index} ON apipayments ({index});
-            """)
+            """
+        )


 async def m040_index_wallets(db: Connection):
@@ -767,9 +825,11 @@ async def m040_index_wallets(db: Connection):

    for index in indexes:
        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_wallets_{index} ON wallets ("{index}");
-            """)
+            """
+        )


 async def m042_index_accounts(db: Connection):
@@ -783,9 +843,11 @@ async def m042_index_accounts(db: Connection):

    for index in indexes:
        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_accounts_{index} ON accounts ("{index}");
-            """)
+            """
+        )


 async def m043_add_ui_customization_to_accounts(db: Connection):
@@ -802,25 +864,3 @@ async def m044_add_activated_to_accounts(db: Connection):
    Used for account activation status.
    """
    await db.execute("ALTER TABLE accounts ADD COLUMN activated BOOLEAN DEFAULT true")
-
-
-async def m045_add_external_id_to_payments(db: Connection):
-    """
-    Adds external_id column to apipayments.
-    Used for external payment references.
-    """
-    await db.execute("ALTER TABLE apipayments ADD COLUMN external_id TEXT")
-    logger.debug("Creating index idx_payments_external_id...")
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_payments_external_id
-        ON apipayments (external_id);
-        """)
-
-
-async def m046_add_permissions_to_installed_extensions(db: Connection):
-    """
-    Adds granted permissions to installed extensions.
-    """
-    await db.execute(
-        "ALTER TABLE installed_extensions ADD COLUMN permissions TEXT DEFAULT '[]'"
-    )
@@ -25,7 +25,6 @@ from .payments import (
    PaymentState,
    PaymentWalletStats,
    SettleInvoice,
-    UpdatePaymentExtra,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -91,7 +90,6 @@ __all__ = [
    "SimpleStatus",
    "TinyURL",
    "UpdateBalance",
-    "UpdatePaymentExtra",
    "UpdateSuperuserPassword",
    "UpdateUser",
    "UpdateUserPassword",
@@ -6,8 +6,8 @@ import json
 import os
 import shutil
 import zipfile
-from collections.abc import Mapping
-from pathlib import Path, PurePosixPath
+from asyncio.tasks import create_task
+from pathlib import Path
 from typing import Any

 import httpx
@@ -21,7 +21,6 @@ from lnbits.helpers import (
    version_parse,
 )
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
 from lnbits.utils.cache import cache


@@ -56,10 +55,9 @@ class GitHubRelease(BaseModel):


 class Manifest(BaseModel):
+    featured: list[str] = []
    extensions: list[ExplicitRelease] = []
    repos: list[GitHubRelease] = []
-    featured: list[str] = []
-    categories: dict[str, list[str]] = {}


 class GitHubRepoRelease(BaseModel):
@@ -78,21 +76,6 @@ class GitHubRepo(BaseModel):
    default_branch: str


-class ExtensionPermission(BaseModel):
-    id: str
-    label: str | None = None
-    description: str | None = None
-    policies: list[Any] | None = None
-
-    @staticmethod
-    def list_from_config(config_json: Mapping[str, Any]) -> list[ExtensionPermission]:
-        return [
-            ExtensionPermission.parse_obj(permission)
-            for permission in config_json.get("permissions") or []
-            if isinstance(permission, dict) and permission.get("id")
-        ]
-
-
 class ExtensionConfig(BaseModel):
    name: str
    short_description: str
@@ -100,8 +83,6 @@ class ExtensionConfig(BaseModel):
    warning: str | None = ""
    min_lnbits_version: str | None
    max_lnbits_version: str | None
-    extension_type: str | None = None
-    permissions: list[ExtensionPermission] = []

    def is_version_compatible(self) -> bool:
        return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)
@@ -162,7 +143,6 @@ class UserExtension(BaseModel):
 class Extension(BaseModel):
    code: str
    is_valid: bool
-    is_wasm: bool = False
    name: str | None = None
    short_description: str | None = None
    tile: str | None = None
@@ -179,8 +159,6 @@ class Extension(BaseModel):

    @property
    def is_upgrade_extension(self) -> bool:
-        if self.is_wasm:
-            return False
        return self.upgrade_hash != ""

    @classmethod
@@ -188,10 +166,9 @@ class Extension(BaseModel):
        return Extension(
            code=ext_info.id,
            is_valid=True,
-            is_wasm=ext_info.is_wasm,
            name=ext_info.name,
            short_description=ext_info.short_description,
-            tile=_extension_tile(ext_info),
+            tile=ext_info.icon,
            upgrade_hash=ext_info.hash if ext_info.ext_upgrade_dir.is_dir() else "",
        )

@@ -331,6 +308,7 @@ class ExtensionRelease(BaseModel):

    @classmethod
    async def fetch_release_details(cls, details_link: str) -> dict | None:
+
        try:
            async with httpx.AsyncClient() as client:
                resp = await client.get(details_link)
@@ -355,7 +333,6 @@ class ExtensionMeta(BaseModel):
    dependencies: list[str] = []
    archive: str | None = None
    featured: bool = False
-    categories: list[str] = []
    paid_features: str | None = None
    has_paid_release: bool = False
    has_free_release: bool = False
@@ -370,7 +347,6 @@ class InstallableExtension(BaseModel):
    icon: str | None = None
    stars: int = 0
    meta: ExtensionMeta | None = None
-    permissions: list[ExtensionPermission] = []

    @property
    def hash(self) -> str:
@@ -423,18 +399,6 @@ class InstallableExtension(BaseModel):
            return False
        return self.meta.pay_to_enable.required is True

-    @property
-    def is_wasm(self) -> bool:
-        config_path = Path(self.ext_dir, "config.json")
-        if not config_path.is_file():
-            return False
-        try:
-            with open(config_path, encoding="utf-8") as json_file:
-                config_json = json.load(json_file)
-        except Exception:
-            return False
-        return config_json.get("extension_type") == "wasm"
-
    async def download_archive(self):
        logger.info(f"Downloading extension {self.name} ({self.installed_version}).")
        ext_zip_file = self.zip_path
@@ -467,22 +431,6 @@ class InstallableExtension(BaseModel):
                os.remove(ext_zip_file)
            raise AssertionError("File hash missmatch. Will not install.")

-    def load_archive_config(self) -> dict[str, Any]:
-        if not self.zip_path.is_file():
-            return {}
-
-        try:
-            with zipfile.ZipFile(self.zip_path, "r") as archive:
-                config_name = _archive_config_name(archive.namelist())
-                if not config_name:
-                    return {}
-                with archive.open(config_name) as config_file:
-                    config = json.load(config_file)
-        except Exception as exc:
-            raise ValueError(f"Cannot read extension config for '{self.id}'.") from exc
-
-        return config if isinstance(config, dict) else {}
-
    def extract_archive(self):
        logger.info(f"Extracting extension {self.name} ({self.installed_version}).")
        Path(settings.lnbits_extensions_upgrade_path).mkdir(parents=True, exist_ok=True)
@@ -661,7 +609,6 @@ class InstallableExtension(BaseModel):
                    version=version,
                    short_description=config_json.get("short_description"),
                    icon=config_json.get("tile"),
-                    permissions=ExtensionPermission.list_from_config(config_json),
                    meta=ExtensionMeta(
                        installed_release=ExtensionRelease(
                            name=ext_id,
@@ -694,10 +641,7 @@ class InstallableExtension(BaseModel):

        if cache_value.older_than(10 * 60) or post_refresh_cache:
            # refresh cache in background if older than 10 minutes or requested
-            task_manager.create_task(
-                cls._refresh_installable_extensions_cache(),
-                "refresh_installable_extensions_cache",
-            )
+            create_task(cls._refresh_installable_extensions_cache())

        extension_list = cache_value.value  # type: ignore
        return extension_list
@@ -736,11 +680,6 @@ class InstallableExtension(BaseModel):

                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]

@@ -756,11 +695,6 @@ class InstallableExtension(BaseModel):
                    ext.check_release_updates(release)
                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]
            except Exception as e:
@@ -855,7 +789,6 @@ class CreateExtension(BaseModel):
    version: str
    cost_sats: int | None = 0
    payment_hash: str | None = None
-    permissions: list[ExtensionPermission] = []


 class ExtensionDetailsRequest(BaseModel):
@@ -908,21 +841,3 @@ def icon_to_github_url(source_repo: str, path: str | None) -> str:
    _, _, *rest = path.split("/")
    tail = "/".join(rest)
    return f"https://github.com/{source_repo}/raw/main/{tail}"
-
-
-def wasm_extension_icon_url(ext_id: str) -> str:
-    return f"/ext-assets/{ext_id}/assets/icon.png"
-
-
-def _extension_tile(ext_info: InstallableExtension) -> str | None:
-    if ext_info.is_wasm:
-        return wasm_extension_icon_url(ext_info.id)
-    return ext_info.icon
-
-
-def _archive_config_name(names: list[str]) -> str | None:
-    for name in names:
-        path = PurePosixPath(name)
-        if len(path.parts) == 2 and path.name == "config.json":
-            return name
-    return None
@@ -1,7 +1,6 @@
 from __future__ import annotations

-from collections.abc import Awaitable, Callable
-from typing import Any
+from collections.abc import Callable

 from pydantic import BaseModel

@@ -10,34 +9,9 @@ def _do_nothing(*_):
    pass


-async def _do_nothing_async(_: Any) -> None:
-    pass
-
-
 class CoreAppExtra:
    register_new_ext_routes: Callable = _do_nothing
-    register_new_wasm_ext_routes: Callable = _do_nothing
    register_new_ratelimiter: Callable
-    dispatch_extension_invoice_paid: Callable[[Any], Awaitable[None]] = (
-        _do_nothing_async
-    )
-
-    def __init__(self) -> None:
-        self.wasm_extension_registry = WasmExtensionRegistry()
-
-
-class WasmExtensionRegistry:
-    def __init__(self) -> None:
-        self._extensions: dict[str, Any] = {}
-
-    def register(self, extension: Any) -> None:
-        self._extensions[extension.id] = extension
-
-    def get(self, ext_id: str) -> Any | None:
-        return self._extensions.get(ext_id)
-
-    def list(self) -> list[Any]:
-        return list(self._extensions.values())


 class ConversionData(BaseModel):
@@ -13,7 +13,6 @@ from lnbits.db import FilterModel
 from lnbits.fiat.base import (
    FiatPaymentStatus,
 )
-from lnbits.helpers import is_valid_external_id
 from lnbits.utils.exchange_rates import allowed_currencies
 from lnbits.wallets.base import (
    PaymentStatus,
@@ -35,11 +34,6 @@ class PaymentExtra(BaseModel):
    lnurl_response: str | None = None


-class UpdatePaymentExtra(BaseModel):
-    payment_hash: str
-    extra: dict = Field(default_factory=dict)
-
-
 class PayInvoice(BaseModel):
    payment_request: str
    description: str | None = None
@@ -54,17 +48,11 @@ class CreatePayment(BaseModel):
    amount_msat: int
    memo: str
    extra: dict | None = {}
-    extension: str | None = None
    preimage: str | None = None
    expiry: datetime | None = None
    webhook: str | None = None
    fee: int = 0
    labels: list[str] | None = None
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)


 class Payment(BaseModel):
@@ -89,11 +77,6 @@ class Payment(BaseModel):
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    labels: list[str] = []
    extra: dict = {}
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)

    def __init__(self, **data):
        super().__init__(**data)
@@ -141,18 +124,22 @@ class Payment(BaseModel):
        )

    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_status(self) -> PaymentStatus:
+    async def check_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> PaymentStatus:
        logger.warning("payment.check_status() is deprecated.")
        from lnbits.core.services.payments import check_payment_status

-        return await check_payment_status(self)
+        return await check_payment_status(self, skip_internal_payment_notifications)

    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_fiat_status(self) -> FiatPaymentStatus:
+    async def check_fiat_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> FiatPaymentStatus:
        logger.warning("payment.check_fiat_status() is deprecated.")
        from lnbits.core.services.fiat_providers import check_fiat_status

-        return await check_fiat_status(self)
+        return await check_fiat_status(self, skip_internal_payment_notifications)


 class PaymentFilters(FilterModel):
@@ -164,7 +151,6 @@ class PaymentFilters(FilterModel):
        "status",
        "time",
        "labels",
-        "external_id",
    ]

    __sort_fields__ = [
@@ -175,13 +161,11 @@ class PaymentFilters(FilterModel):
        "memo",
        "time",
        "tag",
-        "external_id",
    ]

    status: str | None
    tag: str | None
    checking_id: str | None
-    external_id: str | None
    amount: int
    fee: int
    memo: str | None
@@ -260,13 +244,11 @@ class CreateInvoice(BaseModel):
    )
    expiry: int | None = None
    extra: dict | None = None
-    extension: str | None = None
    webhook: str | None = None
    bolt11: str | None = None
    lnurl_withdraw: LnurlWithdrawResponse | None = None
    fiat_provider: str | None = None
    labels: list[str] = []
-    external_id: str | None = Query(default=None, max_length=256)

    @validator("payment_hash")
    def check_hex(cls, v):
@@ -281,10 +263,6 @@ class CreateInvoice(BaseModel):
            raise ValueError("The provided unit is not supported")
        return v

-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)
-

 class PaymentsStatusCount(BaseModel):
    incoming: int = 0
@@ -323,12 +301,3 @@ class CancelInvoice(BaseModel):

 class UpdatePaymentLabels(BaseModel):
    labels: list[str] = []
-
-
-def _validate_external_id(external_id: str | None) -> str | None:
-    if external_id and not is_valid_external_id(external_id):
-        raise ValueError(
-            "Invalid external id. Max length is 256 characters. "
-            "Space and newlines are not allowed."
-        )
-    return external_id
@@ -1 +0,0 @@
-"""SSO authentication providers for LNbits"""
@@ -1,36 +0,0 @@
-"""Generic OIDC SSO Login Helper"""
-
-from typing import Optional
-
-import httpx
-from fastapi_sso.sso.base import DiscoveryDocument, OpenID, SSOBase
-
-
-class OidcSSO(SSOBase):
-    """Class providing login via Generic OIDC OAuth (e.g., Zitadel, Authentik, etc.)"""
-
-    provider = "oidc"
-    scope = ["openid", "email", "profile"]
-    discovery_url = ""
-
-    async def openid_from_response(
-        self, response: dict, session: Optional["httpx.AsyncClient"] = None
-    ) -> OpenID:
-        """Return OpenID from user information provided by OIDC provider"""
-        return OpenID(
-            email=response.get("email", ""),
-            provider=self.provider,
-            id=response.get("sub"),
-            first_name=response.get("given_name"),
-            last_name=response.get("family_name"),
-            display_name=response.get("name") or response.get("preferred_username"),
-            picture=response.get("picture"),
-        )
-
-    async def get_discovery_document(self) -> DiscoveryDocument:
-        """Get document containing handy urls"""
-        async with httpx.AsyncClient() as session:
-            response = await session.get(self.discovery_url)
-            content = response.json()
-
-            return content
@@ -1,6 +1,4 @@
-from datetime import datetime, timezone
-
-from pydantic import BaseModel, Field
+from pydantic import BaseModel


 class TinyURL(BaseModel):
@@ -8,4 +6,4 @@ class TinyURL(BaseModel):
    url: str
    endless: bool
    wallet: str
-    time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    time: float
@@ -1,9 +1,7 @@
 import base64
 import io
-from urllib.parse import quote
 from uuid import uuid4

-import filetype
 from fastapi import UploadFile
 from loguru import logger
 from PIL import Image
@@ -12,48 +10,11 @@ from lnbits.core.crud.assets import create_asset, get_user_assets_count
 from lnbits.core.models.assets import Asset
 from lnbits.settings import settings

-IMAGE_MIME_TYPE_ALIASES = {
-    "heic": "image/heic",
-    "heics": "image/heics",
-    "heif": "image/heif",
-    "image/jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "jpg": "image/jpeg",
-    "png": "image/png",
-}
-PIL_IMAGE_FORMAT_MIME_TYPES = {
-    "JPEG": "image/jpeg",
-    "PNG": "image/png",
-}
-INLINE_ASSET_MIME_TYPES = {
-    "image/heic",
-    "image/heics",
-    "image/heif",
-    "image/jpeg",
-    "image/png",
-}
-ASSET_SECURITY_HEADERS = {
-    "X-Content-Type-Options": "nosniff",
-    "Content-Security-Policy": (
-        "sandbox; default-src 'none'; script-src 'none'; "
-        "object-src 'none'; base-uri 'none'"
-    ),
-}
-THUMBNAIL_FORMAT_MIME_TYPES = {
-    "jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "png": "image/png",
-}
-

 async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) -> Asset:
    if not file.content_type:
        raise ValueError("File must have a content type.")
-
-    content_type = normalize_asset_mime_type(file.content_type)
-    filename = file.filename or "unnamed"
-
-    if content_type not in allowed_asset_mime_types():
+    if file.content_type.lower() not in settings.lnbits_assets_allowed_mime_types:
        raise ValueError(f"File type '{file.content_type}' not allowed.")

    if not settings.is_unlimited_assets_user(user_id):
@@ -69,26 +30,14 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
            f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
        )

-    stored_mime_type = detect_image_mime_type(contents)
-    if stored_mime_type != content_type:
-        logger.warning(
-            "Image MIME type mismatch: declared={}, detected={}",
-            content_type,
-            stored_mime_type,
-        )
-        raise ValueError(
-            "Image file content does not match declared file type. "
-            f"Declared: '{content_type}', detected: '{stored_mime_type}'."
-        )
-
    thumb_buffer = thumbnail_from_bytes(contents)

    asset = Asset(
        id=uuid4().hex,
        user_id=user_id,
-        mime_type=stored_mime_type,
+        mime_type=file.content_type,
        is_public=is_public,
-        name=filename,
+        name=file.filename or "unnamed",
        size_bytes=len(contents),
        thumbnail_base64=(
            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
@@ -102,79 +51,6 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
    return asset


-def normalize_asset_mime_type(content_type: str) -> str:
-    content_type = content_type.split(";", 1)[0].strip().lower()
-    return IMAGE_MIME_TYPE_ALIASES.get(content_type, content_type)
-
-
-def normalize_media_type(media_type: str) -> str:
-    return media_type.split(";", 1)[0].strip().lower() or "application/octet-stream"
-
-
-def thumbnail_media_type() -> str:
-    thumbnail_format = (settings.lnbits_asset_thumbnail_format or "png").strip().lower()
-    return THUMBNAIL_FORMAT_MIME_TYPES.get(thumbnail_format, "application/octet-stream")
-
-
-def content_disposition(disposition: str, filename: str) -> str:
-    safe_filename = filename or "unnamed"
-    quoted_filename = quote(safe_filename, safe="")
-    if quoted_filename == safe_filename:
-        return f'{disposition}; filename="{safe_filename}"'
-    return f"{disposition}; filename*=utf-8''{quoted_filename}"
-
-
-def allowed_asset_mime_types() -> set[str]:
-    return {
-        mime_type
-        for mime_type in (
-            normalize_asset_mime_type(mime_type)
-            for mime_type in settings.lnbits_assets_allowed_mime_types
-        )
-        if mime_type.startswith("image/")
-    }
-
-
-def detect_image_mime_type(contents: bytes) -> str:
-    kind = filetype.guess(contents)
-    mime_type = normalize_asset_mime_type(kind.mime) if kind else None
-
-    if mime_type and mime_type in PIL_IMAGE_FORMAT_MIME_TYPES.values():
-        verify_pil_image(contents, mime_type)
-        return mime_type
-
-    if mime_type and mime_type.startswith("image/"):
-        return mime_type
-
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if not mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-    return mime_type
-
-
-def verify_pil_image(contents: bytes, mime_type: str) -> None:
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            detected_mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if detected_mime_type != mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-
 def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
    try:
        image = Image.open(io.BytesIO(contents))
@@ -9,7 +9,6 @@ from lnbits.core.crud import (
    delete_installed_extension,
    get_db_version,
    get_installed_extension,
-    get_installed_extensions_count,
    update_installed_extension_state,
 )
 from lnbits.core.crud.extensions import (
@@ -17,23 +16,14 @@ from lnbits.core.crud.extensions import (
    update_installed_extension,
 )
 from lnbits.core.helpers import migrate_extension_database
-from lnbits.core.wasm_ext.api.permissions import validate_wasm_extension_permissions
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import Connection
 from lnbits.settings import settings

-from ..models.extensions import (
-    Extension,
-    ExtensionMeta,
-    ExtensionPermission,
-    InstallableExtension,
-)
+from ..models.extensions import Extension, ExtensionMeta, InstallableExtension


 async def install_extension(
-    ext_info: InstallableExtension,
-    skip_download: bool | None = False,
-    granted_permissions: list[ExtensionPermission] | None = None,
+    ext_info: InstallableExtension, skip_download: bool | None = False
 ) -> Extension:

    ext_info.meta = ext_info.meta or ExtensionMeta()
@@ -48,16 +38,9 @@ async def install_extension(
    if installed_ext and installed_ext.meta:
        ext_info.meta.payments = installed_ext.meta.payments

-    await check_extensions_limit(installed_ext)
-
    if not skip_download:
        await ext_info.download_archive()

-    extension_config = ext_info.load_archive_config()
-    ext_info.permissions = validate_wasm_extension_permissions(
-        ext_info, granted_permissions, extension_config
-    )
-
    ext_info.extract_archive()

    db_version = await get_db_version(ext_info.id)
@@ -75,21 +58,11 @@ async def install_extension(
        # call stop while the old routes are still active
        await stop_extension_background_work(ext_info.id)

-    if not extension.is_wasm:
-        await start_extension_background_work(ext_info.id)
+    await start_extension_background_work(ext_info.id)

    return extension


-async def check_extensions_limit(installed_ext: InstallableExtension | None = None):
-    if settings.lnbits_max_extensions == 0 or installed_ext:
-        return
-
-    extensions_count = await get_installed_extensions_count()
-    if extensions_count >= settings.lnbits_max_extensions:
-        raise ValueError("Max amount of extensions have been installed")
-
-
 async def uninstall_extension(ext_id: str):
    await stop_extension_background_work(ext_id)

@@ -102,11 +75,6 @@ async def uninstall_extension(ext_id: str):


 async def activate_extension(ext: Extension):
-    if ext.is_wasm:
-        core_app_extra.register_new_wasm_ext_routes(ext.code)
-        await update_installed_extension_state(ext_id=ext.code, active=True)
-        return
-
    core_app_extra.register_new_ext_routes(ext)
    await update_installed_extension_state(ext_id=ext.code, active=True)
    await start_extension_background_work(ext.code)
@@ -123,9 +91,6 @@ async def stop_extension_background_work(ext_id: str) -> bool:
    Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
    Extension must expose a `myextension_stop()` function if it is starting tasks.
    """
-    if is_wasm_extension_id(ext_id):
-        return True
-
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -158,9 +123,6 @@ async def start_extension_background_work(ext_id: str) -> bool:
    Extension CAN expose a `myextension_start()` function if it is starting tasks.
    Extension MUST expose a `myextension_stop()` in that case.
    """
-    if is_wasm_extension_id(ext_id):
-        return False
-
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -2,13 +2,12 @@ import hashlib
 import hmac
 import json
 import time
-from base64 import b64encode

 import httpx
 from loguru import logger

 from lnbits.core.crud import get_wallet
-from lnbits.core.crud.payments import create_payment, update_payment
+from lnbits.core.crud.payments import create_payment
 from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
@@ -20,7 +19,6 @@ from lnbits.fiat.base import (
    FiatPaymentSuccessStatus,
 )
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager


 async def handle_fiat_payment_confirmation(
@@ -37,7 +35,9 @@ async def handle_fiat_payment_confirmation(
        logger.warning(e)


-async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
+async def check_fiat_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> FiatPaymentStatus:
    if not payment.is_internal:
        return FiatPaymentPendingStatus()
    if payment.success:
@@ -57,11 +57,14 @@ async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
        return FiatPaymentPendingStatus()
    fiat_status = await fiat_provider.get_invoice_status(checking_id)

+    if skip_internal_payment_notifications:
+        return fiat_status
+
    if fiat_status.success:
-        payment.status = PaymentState.SUCCESS.value
-        await update_payment(payment)
-        await handle_fiat_payment_confirmation(payment)
-        task_manager.internal_invoice_queue.put_nowait(payment)
+        # notify receivers asynchronously
+        from lnbits.tasks import internal_invoice_queue
+
+        await internal_invoice_queue.put(payment.checking_id)

    return fiat_status

@@ -166,82 +169,6 @@ async def verify_paypal_webhook(headers, payload: bytes):
        raise ValueError("PayPal webhook cannot be verified.") from exc


-def check_square_signature(
-    payload: bytes,
-    sig_header: str | None,
-    secret: str | None,
-    notification_url: str | None,
-):
-    if not sig_header:
-        logger.warning("Square signature header is missing.")
-        raise ValueError("Square signature header is missing.")
-
-    if not secret:
-        logger.warning("Square webhook signature key is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    if not notification_url:
-        logger.warning("Square webhook notification URL is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    signed_payload = notification_url.encode() + payload
-    computed_signature = b64encode(
-        hmac.new(
-            key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-        ).digest()
-    ).decode()
-
-    if hmac.compare_digest(computed_signature, sig_header) is not True:
-        logger.warning("Square signature verification failed.")
-        raise ValueError("Square signature verification failed.")
-
-
-def check_revolut_signature(
-    payload: bytes,
-    sig_header: str | None,
-    timestamp_header: str | None,
-    secret: str | None,
-    tolerance_seconds=300,
-):
-    if not sig_header:
-        logger.warning("Revolut signature header is missing.")
-        raise ValueError("Revolut signature header is missing.")
-
-    if not timestamp_header:
-        logger.warning("Revolut timestamp header is missing.")
-        raise ValueError("Revolut timestamp header is missing.")
-
-    if not secret:
-        logger.warning("Revolut webhook signing secret is not set.")
-        raise ValueError("Revolut webhook cannot be verified.")
-
-    try:
-        timestamp = int(timestamp_header)
-    except ValueError as exc:
-        logger.warning("Invalid Revolut timestamp.")
-        raise ValueError("Invalid Revolut timestamp.") from exc
-
-    timestamp_seconds = timestamp / 1000 if timestamp > 9999999999 else timestamp
-
-    if abs(time.time() - timestamp_seconds) > tolerance_seconds:
-        logger.warning("Timestamp outside tolerance.")
-        raise ValueError("Timestamp outside tolerance." f"Timestamp: {timestamp}")
-
-    signed_payload = b"v1." + timestamp_header.encode() + b"." + payload
-    digest = hmac.new(
-        key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-    ).hexdigest()
-    expected_signature = f"v1={digest}"
-
-    provided_signatures = [sig.strip() for sig in sig_header.split(",") if sig.strip()]
-    if not any(
-        hmac.compare_digest(expected_signature, provided)
-        for provided in provided_signatures
-    ):
-        logger.warning("Revolut signature verification failed.")
-        raise ValueError("Revolut signature verification failed.")
-
-
 async def test_connection(provider: str) -> SimpleStatus:
    """
    Test the connection to Stripe by checking if the API key is valid.
@@ -66,8 +66,6 @@ async def check_server_balance_against_node():


 async def check_balance_delta_changed():
-    if settings.notification_balance_delta_threshold_sats <= 0:
-        return
    status = await get_balance_delta()
    if settings.latest_balance_delta_sats is None:
        settings.latest_balance_delta_sats = status.delta_sats
@@ -74,7 +74,7 @@ async def send_admin_notification(
    message: str,
    message_type: str | None = None,
 ) -> None:
-    return await send_notification_in_background(
+    return await send_notification(
        settings.lnbits_telegram_notifications_chat_id,
        settings.lnbits_nostr_notifications_identifiers,
        settings.lnbits_email_notifications_to_emails,
@@ -97,7 +97,7 @@ async def send_user_notification(
        if user_notifications.nostr_identifier
        else []
    )
-    return await send_notification_in_background(
+    return await send_notification(
        user_notifications.telegram_chat_id,
        nostr_identifiers,
        email_address,
@@ -222,29 +222,12 @@ async def send_email(
    msg["Subject"] = subject
    msg.attach(MIMEText(message, "plain"))
    username = username if len(username) > 0 else from_email
-
-    def _send() -> bool:
-        with smtplib.SMTP(server, port) as smtp_server:
-            smtp_server.starttls()
-            smtp_server.login(username, password)
-            smtp_server.sendmail(from_email, to_emails, msg.as_string())
+    with smtplib.SMTP(server, port) as smtp_server:
+        smtp_server.starttls()
+        smtp_server.login(username, password)
+        smtp_server.sendmail(from_email, to_emails, msg.as_string())
        return True

-    try:
-        return await asyncio.to_thread(_send)
-    except Exception as e:
-        logger.warning(f"Sending Email failed. {e!s}")
-        return False
-
-
-async def dispatch_payment_notification(payment: Payment) -> None:
-    """
-    This worker dispatches the payment notifications.
-    """
-    wallet = await get_wallet(payment.wallet_id)
-    if wallet:
-        await send_payment_notification(wallet, payment)
-

 async def dispatch_webhook(payment: Payment):
    """
@@ -311,27 +294,6 @@ def send_payment_notification_in_background(wallet: Wallet, payment: Payment):
        logger.warning(f"Error sending payment notification: {e}")


-async def send_notification_in_background(
-    telegram_chat_id: str | None,
-    nostr_identifiers: list[str] | None,
-    email_addresses: list[str] | None,
-    message: str,
-    message_type: str | None = None,
-):
-    try:
-        create_task(
-            send_notification(
-                telegram_chat_id,
-                nostr_identifiers,
-                email_addresses,
-                message,
-                message_type,
-            )
-        )
-    except Exception as e:
-        logger.warning(f"Error sending notification in background: {e}")
-
-
 async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
    # TODO: websocket message should be a clean payment model
    # await websocket_manager.send(wallet.inkey, payment.json())
@@ -19,7 +19,7 @@ from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
+from lnbits.tasks import create_task, internal_invoice_queue_put
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
@@ -64,7 +64,6 @@ async def pay_invoice(
    description: str = "",
    tag: str = "",
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if settings.lnbits_only_allow_incoming_payments:
@@ -98,7 +97,6 @@ async def pay_invoice(
            memo=description or invoice.description or "",
            extra=extra,
            labels=labels,
-            external_id=external_id,
        )

    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
@@ -171,15 +169,15 @@ async def create_fiat_invoice(

    internal_payment.fiat_provider = fiat_provider_name
    internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
-    # TODO: move to payment
+    # todo: move to payent
    internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
    new_checking_id = (
        f"fiat_{fiat_provider_name}_"
        f"{fiat_invoice.checking_id or internal_payment.checking_id}"
    )
-    internal_payment = await update_payment(
-        internal_payment, new_checking_id, conn=conn
-    )
+    await update_payment(internal_payment, new_checking_id, conn=conn)
+    internal_payment.checking_id = new_checking_id
+
    return internal_payment


@@ -215,12 +213,10 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
            unhashed_description=unhashed_description,
            expiry=data.expiry,
            extra=data.extra,
-            extension=data.extension,
            webhook=data.webhook,
            internal=data.internal,
            payment_hash=data.payment_hash,
            labels=data.labels,
-            external_id=data.external_id,
            conn=conn,
        )

@@ -261,9 +257,7 @@ async def create_invoice(
    webhook: str | None = None,
    internal: bool | None = False,
    payment_hash: str | None = None,
-    extension: str | None = None,
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if not amount > 0:
@@ -345,11 +339,9 @@ async def create_invoice(
        expiry=invoice.expiry_date,
        memo=memo,
        extra=extra,
-        extension=extension,
        webhook=webhook,
        fee=invoice_response.fee_msat or 0,
        labels=labels,
-        external_id=external_id,
    )

    payment = await create_payment(
@@ -377,7 +369,7 @@ async def update_pending_payment(
    status = await check_payment_status(payment)
    if status.failed:
        payment.status = PaymentState.FAILED
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment, conn=conn)
    elif status.success:
        payment = await update_payment_success_status(payment, status, conn=conn)
    return payment
@@ -517,7 +509,7 @@ async def update_wallet_balance(
        )
        payment.status = PaymentState.SUCCESS
        await update_payment(payment, conn=conn)
-        task_manager.internal_invoice_queue.put_nowait(payment)
+        await internal_invoice_queue_put(payment.checking_id)


 async def check_wallet_limits(
@@ -631,14 +623,18 @@ async def check_transaction_status(
    return await check_payment_status(payment)


-async def check_payment_status(payment: Payment) -> PaymentStatus:
+async def check_payment_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> PaymentStatus:
    if payment.is_internal:
        if payment.success:
            return PaymentSuccessStatus()
        if payment.failed:
            return PaymentFailedStatus()
        if payment.is_in and payment.fiat_provider:
-            fiat_status = await check_fiat_status(payment)
+            fiat_status = await check_fiat_status(
+                payment, skip_internal_payment_notifications
+            )
            return PaymentStatus(paid=fiat_status.paid)
        return PaymentPendingStatus()
    funding_source = get_funding_source()
@@ -780,16 +776,13 @@ async def _pay_internal_invoice(
    await update_payment(internal_payment, conn=conn)
    logger.success(f"internal payment successful {internal_payment.checking_id}")

-    await _send_payment_notification_in_background(
-        wallet.id, payment, conn=conn
-    )  # notify the sender
-    await _send_payment_notification_in_background(
-        internal_payment.wallet_id, internal_payment, conn=conn
-    )  # notify the receiver
+    await _send_payment_notification_in_background(wallet.id, payment, conn=conn)
+
+    # notify receiver asynchronously
+    from lnbits.tasks import internal_invoice_queue

-    # notify receiver asynchronously (extension listeners)
    logger.debug(f"enqueuing internal invoice {internal_payment.checking_id}")
-    task_manager.internal_invoice_queue.put_nowait(internal_payment)
+    await internal_invoice_queue.put(internal_payment.checking_id)

    return payment

@@ -826,15 +819,14 @@ async def _pay_external_invoice(

    fee_reserve_msat = fee_reserve(amount_msat, internal=False)

-    task = task_manager.create_task(
-        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat),
-        f"fundingsource_pay_invoice_{checking_id}",
+    task = create_task(
+        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
    )

    # make sure a hold invoice or deferred payment is not blocking the server
    wait_time = max(1, settings.lnbits_funding_source_pay_invoice_wait_seconds)
    try:
-        payment_response = await asyncio.wait_for(task.task, timeout=wait_time)
+        payment_response = await asyncio.wait_for(task, timeout=wait_time)
    except asyncio.TimeoutError:
        # return pending payment on timeout
        logger.debug(
@@ -875,7 +867,7 @@ async def update_payment_success_status(
        payment.status = PaymentState.SUCCESS
        payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
        payment.preimage = payment.preimage or status.preimage
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment, conn=conn)
    return payment


@@ -1076,46 +1068,3 @@ async def _send_payment_notification_in_background(
    if not wallet:
        raise PaymentError(f"Could not fetch wallet '{wallet_id}'.", status="failed")
    send_payment_notification_in_background(wallet, payment)
-
-
-async def update_invoice_from_paid_invoices_stream(checking_id: str) -> Payment | None:
-    """
-    Takes a checking_id of an incoming payment from paid_invoices_stream()
-    Checks its status, updates its status and returns it.
-    returns None if no incoming payment was found or the status is not successful
-    """
-    payment = await get_standalone_payment(checking_id, incoming=True)
-    if not payment:
-        logger.warning(f"No incoming payment found for '{checking_id}'.")
-        return None
-
-    status = await check_payment_status(payment)
-
-    if not status.success:
-        logger.error(
-            "Unexpected status response from paid_invoices_stream. Skipping update."
-        )
-        return None
-
-    payment.fee = status.fee_msat or payment.fee
-    # only overwrite preimage if status.preimage provides it
-    payment.preimage = status.preimage or payment.preimage
-    payment.status = PaymentState.SUCCESS
-    payment = await update_payment(payment)
-
-    return payment
-
-
-async def fundingsource_invoice_producer() -> None:
-    """
-    will collect all invoices that come directly from the backend wallet.
-
-    Called registered in the app startup sequence and run by taskmanager.
-    """
-    funding_source = get_funding_source()
-    async for checking_id in funding_source.paid_invoices_stream():
-        logger.info(f"got a payment notification {checking_id}")
-        payment = await update_invoice_from_paid_invoices_stream(checking_id)
-        if payment:
-            logger.success(f"fundingsource invoice {checking_id} settled")
-            task_manager.invoice_queue.put_nowait(payment)
@@ -23,7 +23,6 @@ from ..crud import (
    get_account_by_email,
    get_account_by_pubkey,
    get_account_by_username,
-    get_accounts_count,
    get_super_settings,
    get_user_extensions,
    get_user_from_account,
@@ -56,8 +55,6 @@ async def create_user_account_no_ckeck(
    conn: Connection | None = None,
 ) -> User:
    async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        await check_users_limit(conn)
-
        if account:
            account.validate_fields()
            if account.username and await get_account_by_username(
@@ -98,15 +95,6 @@ async def create_user_account_no_ckeck(
    return user


-async def check_users_limit(conn: Connection | None = None):
-    if settings.lnbits_max_users == 0:
-        return
-
-    users_count = await get_accounts_count(conn=conn)
-    if users_count >= settings.lnbits_max_users:
-        raise ValueError("Max amount of users have been created")
-
-
 async def update_user_account(account: Account) -> Account:
    account.validate_fields()

@@ -185,12 +173,6 @@ async def check_admin_settings():
        if account and account.extra and account.extra.provider == "env":
            settings.first_install = True

-        if settings.has_first_install_token_changed():
-            logger.warning("First install token is changed. Resetting admin settings.")
-            new_settings = await init_admin_settings()
-            settings.super_user = new_settings.super_user
-            settings.first_install = True
-
        logger.success(
            "✔️ Admin UI is enabled. run `uv run lnbits-cli superuser` "
            "to get the superuser."
@@ -2,43 +2,76 @@ import asyncio

 from loguru import logger

-from lnbits.core.crud import create_audit_entry
+from lnbits.core.crud import (
+    create_audit_entry,
+    get_wallet,
+)
+from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.payments import get_payments_status_count
 from lnbits.core.crud.users import get_accounts
 from lnbits.core.crud.wallets import get_wallets_count
 from lnbits.core.models.audit import AuditEntry
 from lnbits.core.models.extensions import InstallableExtension
 from lnbits.core.models.notifications import NotificationType
-from lnbits.core.services.funding_source import get_balance_delta
+from lnbits.core.services.funding_source import (
+    check_balance_delta_changed,
+    check_server_balance_against_node,
+    get_balance_delta,
+)
 from lnbits.core.services.notifications import (
    enqueue_admin_notification,
+    process_next_notification,
+    send_payment_notification,
 )
 from lnbits.db import Filters
 from lnbits.settings import settings
-from lnbits.utils.cache import cache
-from lnbits.utils.exchange_rates import btc_price_from_aggregator, btc_rates
+from lnbits.utils.exchange_rates import btc_rates

 audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()


-async def process_next_audit_entry() -> None:
-    """
-    Waits for audit entries to be pushed to the queue.
-    Then it inserts the entries into the DB.
-    """
-    data = await audit_queue.get()
-    await create_audit_entry(data)
+async def run_by_the_minute_tasks() -> None:
+    minute_counter = 0
+    while settings.lnbits_running:
+        status_minutes = settings.lnbits_notification_server_status_hours * 60
+
+        if settings.notification_balance_delta_threshold_sats > 0:
+            try:
+                # runs by default every minute, the delta should not change that often
+                await check_balance_delta_changed()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % settings.lnbits_watchdog_interval_minutes == 0:
+            try:
+                await check_server_balance_against_node()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % status_minutes == 0:
+            try:
+                await _notify_server_status()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % 60 == 0:
+            try:
+                # initialize the list of all extensions
+                await InstallableExtension.get_installable_extensions(
+                    post_refresh_cache=True
+                )
+            except Exception as ex:
+                logger.error(ex)
+
+        minute_counter += 1
+        await asyncio.sleep(60)


-async def refresh_extension_cache() -> None:
-    # only refreshes every 10 minutes
-    await InstallableExtension.get_installable_extensions()
-
-
-async def notify_server_status() -> None:
+async def _notify_server_status() -> None:
    accounts = await get_accounts(filters=Filters(limit=0))
    wallets_count = await get_wallets_count()
    payments = await get_payments_status_count()
+
    status = await get_balance_delta()
    values = {
        "up_time": settings.lnbits_server_up_time,
@@ -55,38 +88,76 @@ async def notify_server_status() -> None:
    enqueue_admin_notification(NotificationType.server_status, values)


+async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue) -> None:
+    """
+    This worker dispatches events to all extensions and dispatches webhooks.
+    """
+    while settings.lnbits_running:
+        payment = await invoice_paid_queue.get()
+        logger.trace("received invoice paid event")
+        # payment notification
+        wallet = await get_wallet(payment.wallet_id)
+        if wallet:
+            await send_payment_notification(wallet, payment)
+
+
+async def wait_for_audit_data() -> None:
+    """
+    Waits for audit entries to be pushed to the queue.
+    Then it inserts the entries into the DB.
+    """
+    while settings.lnbits_running:
+        data = await audit_queue.get()
+        try:
+            await create_audit_entry(data)
+        except Exception as ex:
+            logger.warning(ex)
+            await asyncio.sleep(3)
+
+
+async def wait_notification_messages() -> None:
+
+    while settings.lnbits_running:
+        try:
+            await process_next_notification()
+        except Exception as ex:
+            logger.warning("Payment notification error", ex)
+            await asyncio.sleep(3)
+
+
+async def purge_audit_data() -> None:
+    """
+    Remove audit entries which have passed their retention period.
+    """
+    while settings.lnbits_running:
+        try:
+            await delete_expired_audit_entries()
+        except Exception as ex:
+            logger.warning(ex)
+
+        # clean every hour
+        await asyncio.sleep(60 * 60)
+
+
 async def collect_exchange_rates_data() -> None:
    """
    Collect exchange rates data. Used for monitoring only.
    """
-    currency = settings.lnbits_default_accounting_currency or "USD"
-    max_history_size = settings.lnbits_exchange_history_size
-    try:
-        if (
-            settings.lnbits_price_aggregator_enabled
-            and settings.lnbits_price_aggregator_url
-        ):
-            price = await btc_price_from_aggregator(currency)
-            if price:
-                cache.set(
-                    f"btc-price-{currency}",
-                    price,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-                settings.append_exchange_rate_datapoint(
-                    {"Aggregator": price}, max_history_size
-                )
+    while settings.lnbits_running:
+        currency = settings.lnbits_default_accounting_currency or "USD"
+        max_history_size = settings.lnbits_exchange_history_size
+        sleep_time = settings.lnbits_exchange_history_refresh_interval_seconds
+
+        if sleep_time > 0:
+            try:
+                rates = await btc_rates(currency)
+                if rates:
+                    rates_values = [r[1] for r in rates]
+                    lnbits_rate = sum(rates_values) / len(rates_values)
+                    rates.append(("LNbits", lnbits_rate))
+                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
+            except Exception as ex:
+                logger.warning(ex)
        else:
-            rates = await btc_rates(currency)
-            if rates:
-                rates_values = [r[1] for r in rates]
-                lnbits_rate = sum(rates_values) / len(rates_values)
-                rates.append(("LNbits", lnbits_rate))
-                cache.set(
-                    f"btc-price-{currency}",
-                    lnbits_rate,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-            settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
-    except Exception as ex:
-        logger.warning(ex)
+            sleep_time = 60
+        await asyncio.sleep(sleep_time)
@@ -0,0 +1,3 @@
+{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
+%} {% block scripts %} {{ window_vars(user) }} {% endblock %} {% block page %}{%
+endblock %}
@@ -0,0 +1,3 @@
+{% extends "public.html" %} {% from "macros.jinja" import window_vars with
+context %} {% block scripts %} {{ window_vars() }} {% endblock %} {% block page
+%} {% endblock %}
@@ -20,7 +20,7 @@ from lnbits.core.services.settings import dict_to_settings
 from lnbits.decorators import check_admin, check_super_user
 from lnbits.server import server_restart
 from lnbits.settings import AdminSettings, Settings, UpdateSettings, settings
-from lnbits.task_manager import PublicTask, task_manager
+from lnbits.tasks import invoice_listeners

 from .. import core_app_extra
 from ..crud import get_admin_settings, reset_core_settings, update_admin_settings
@@ -44,10 +44,11 @@ async def api_auditor():
    name="Monitor",
    description="show the current listeners and other monitoring data",
    dependencies=[Depends(check_admin)],
-    response_model=list[PublicTask],
 )
-async def api_monitor() -> list[PublicTask]:
-    return task_manager.get_public_tasks()
+async def api_monitor():
+    return {
+        "invoice_listeners": list(invoice_listeners.keys()),
+    }


@admin_router.get(
@@ -16,14 +16,7 @@ from lnbits.core.crud.assets import (
 from lnbits.core.models.assets import AssetFilters, AssetInfo, AssetUpdate
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.users import AccountId
-from lnbits.core.services.assets import (
-    ASSET_SECURITY_HEADERS,
-    INLINE_ASSET_MIME_TYPES,
-    content_disposition,
-    create_user_asset,
-    normalize_media_type,
-    thumbnail_media_type,
-)
+from lnbits.core.services.assets import create_user_asset
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
    check_account_id_exists,
@@ -82,7 +75,11 @@ async def api_get_asset_data(
    if not asset:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(asset.data, asset.mime_type, asset.name)
+    return Response(
+        content=asset.data,
+        media_type=asset.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset.name}"'},
+    )


@asset_router.get(
@@ -104,14 +101,14 @@ async def api_get_asset_thumbnail(
    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(
+    return Response(
        content=(
            base64.b64decode(asset_info.thumbnail_base64)
            if asset_info.thumbnail_base64
            else b""
        ),
-        media_type=thumbnail_media_type(),
-        filename=asset_info.name,
+        media_type=asset_info.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset_info.name}"'},
    )


@@ -175,16 +172,3 @@ async def api_delete_asset(

    await delete_user_asset(account_id.id, asset_id)
    return SimpleStatus(success=True, message="Asset deleted successfully.")
-
-
-def asset_response(content: bytes, media_type: str, filename: str) -> Response:
-    media_type = normalize_media_type(media_type)
-    disposition = "inline" if media_type in INLINE_ASSET_MIME_TYPES else "attachment"
-    return Response(
-        content=content,
-        media_type=media_type,
-        headers={
-            **ASSET_SECURITY_HEADERS,
-            "Content-Disposition": content_disposition(disposition, filename),
-        },
-    )
@@ -12,7 +12,6 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.crud.users import (
    get_user_access_control_lists,
    update_user_access_control_list,
@@ -36,7 +35,6 @@ from lnbits.decorators import (
    check_account_exists,
    check_admin,
    check_user_exists,
-    optional_user_id,
 )
 from lnbits.helpers import (
    create_access_token,
@@ -156,20 +154,9 @@ async def impersonate_user(

    max_age = settings.auth_token_expire_minutes * 60
    response.set_cookie(
-        "admin_access_token",
-        cookie_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_impersonated",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "admin_access_token", cookie_access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_impersonated", "true", max_age=max_age)
    return response


@@ -190,12 +177,7 @@ async def stop_impersonate_user(
    )
    max_age = settings.auth_token_expire_minutes * 60
    response.set_cookie(
-        "cookie_access_token",
-        admin_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", admin_access_token, httponly=True, max_age=max_age
    )
    response.delete_cookie("admin_access_token")
    response.delete_cookie("is_access_token_expired")
@@ -321,10 +303,7 @@ async def api_delete_user_api_token(

@auth_router.get("/{provider}", description="SSO Provider")
 async def login_with_sso_provider(
-    request: Request,
-    provider: str,
-    user_id: str | None,
-    auth_user_id: str | None = Depends(optional_user_id),
+    request: Request, provider: str, user_id: str | None = None
 ):
    provider_sso = _new_sso(provider)
    if not provider_sso:
@@ -332,8 +311,6 @@ async def login_with_sso_provider(
            HTTPStatus.FORBIDDEN,
            f"Login by '{provider}' not allowed.",
        )
-    if user_id and user_id != auth_user_id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "User ID mismatch.")

    provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
    with provider_sso:
@@ -354,11 +331,7 @@ async def handle_oauth_token(request: Request, provider: str) -> RedirectRespons
        userinfo = await provider_sso.verify_and_process(request)
        if not userinfo:
            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid user info.")
-        if provider_sso.state is None or provider_sso.state == "null":
-            user_id = None
-        else:
-            user_id = decrypt_internal_message(provider_sso.state)
-
+        user_id = decrypt_internal_message(provider_sso.state)
    request.session.pop("user", None)
    return await _handle_sso_login(userinfo, user_id)

@@ -559,13 +532,6 @@ async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
    account.hash_password(data.password)
    await update_account(account)
    settings.first_install = False
-
-    # only confrm it after the super user has been successfully updated
-    if settings.first_install_token:
-        settings.first_install_token_confirmed = data.first_install_token
-        await set_settings_field(
-            "first_install_token_confirmed", data.first_install_token
-        )
    return _auth_success_response(account.username, account.id, account.email)


@@ -594,7 +560,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
            id=uuid4().hex, email=email, extra=UserExtra(email_verified=True)
        )
        await create_user_account(account)
-    return _auth_redirect_response(redirect_path, account.id, email)
+    return _auth_redirect_response(redirect_path, email)


 def _auth_success_response(
@@ -609,20 +575,9 @@ def _auth_success_response(
    max_age = settings.auth_token_expire_minutes * 60
    response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")

    return response
@@ -639,28 +594,15 @@ def _auth_api_token_response(
    )


-def _auth_redirect_response(path: str, user_id: str, email: str) -> RedirectResponse:
-    payload = AccessTokenPayload(
-        usr=user_id, sub="", email=email, auth_time=int(time())
-    )
+def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
+    payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time()))
    access_token = create_access_token(data=payload.dict())
    max_age = settings.auth_token_expire_minutes * 60
    response = RedirectResponse(path)
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")
    return response

@@ -680,10 +622,7 @@ def _new_sso(provider: str) -> SSOBase | None:

        sso_provider_class = _find_auth_provider_class(provider)
        sso_provider = sso_provider_class(
-            client_id,
-            client_secret,
-            None,
-            allow_insecure_http=not settings.auth_https_only,
+            client_id, client_secret, None, allow_insecure_http=True
        )
        if (
            discovery_url
@@ -4,30 +4,17 @@ from fastapi import APIRouter, Request
 from loguru import logger

 from lnbits.core.crud.payments import (
-    get_payments,
    get_standalone_payment,
-    update_payment,
 )
-from lnbits.core.models import Payment, PaymentFilters
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services.fiat_providers import (
    check_fiat_status,
-    check_revolut_signature,
-    check_square_signature,
    check_stripe_signature,
    verify_paypal_webhook,
 )
-from lnbits.core.services.payments import (
-    create_fiat_invoice,
-    create_wallet_invoice,
-    service_fee_fiat,
-)
-from lnbits.db import Filter, Filters
-from lnbits.fiat import get_fiat_provider
+from lnbits.core.services.payments import create_fiat_invoice
 from lnbits.fiat.base import FiatSubscriptionPaymentOptions
-from lnbits.fiat.revolut import RevolutWallet
-from lnbits.fiat.square import SquareWallet
 from lnbits.settings import settings

 callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
@@ -63,41 +50,6 @@ async def api_generic_webhook_handler(
            message=f"Callback received successfully from '{provider_name}'.",
        )

-    if provider_name.lower() == "square":
-        payload = await request.body()
-        sig_header = request.headers.get("x-square-hmacsha256-signature")
-        check_square_signature(
-            payload,
-            sig_header,
-            settings.square_webhook_signature_key,
-            settings.square_payment_webhook_url,
-        )
-        event = await request.json()
-        await handle_square_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
-    if provider_name.lower() == "revolut":
-        payload = await request.body()
-        sig_header = request.headers.get("Revolut-Signature")
-        timestamp_header = request.headers.get("Revolut-Request-Timestamp")
-        check_revolut_signature(
-            payload,
-            sig_header,
-            timestamp_header,
-            settings.revolut_webhook_signing_secret,
-        )
-        event = await request.json()
-        await handle_revolut_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
    return SimpleStatus(
        success=False,
        message=f"Unknown fiat provider '{provider_name}'.",
@@ -328,382 +280,3 @@ def _deserialize_paypal_metadata(custom_id: str) -> FiatSubscriptionPaymentOptio
    except (json.JSONDecodeError, IndexError) as e:
        logger.warning(f"Failed to deserialize PayPal metadata: {e}")
        return FiatSubscriptionPaymentOptions()
-
-
-async def handle_square_event(event: dict):
-    event_id = event.get("event_id") or event.get("id", "")
-    event_type = event.get("type", "")
-    logger.info(f"Handling Square event: '{event_id}'. Type: '{event_type}'.")
-
-    if event_type == "payment.updated":
-        await _handle_square_payment_event(event)
-        return
-
-    if event_type == "invoice.payment_made":
-        await _handle_square_invoice_payment_made(event)
-        return
-
-    logger.warning(f"Unhandled Square event type: '{event_type}'.")
-
-
-async def handle_revolut_event(event: dict):
-    event_type = event.get("event", "")
-    order_id = event.get("order_id")
-    logger.info(f"Handling Revolut event: '{event_type}'. Order ID: '{order_id}'.")
-
-    if event_type in ["ORDER_AUTHORISED", "ORDER_COMPLETED"]:
-        if not order_id:
-            logger.warning("Revolut event missing order_id.")
-            return
-
-        payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-        if payment:
-            await check_fiat_status(payment)
-            return
-
-        if event_type == "ORDER_COMPLETED":
-            logger.warning(f"No payment found for Revolut order: '{order_id}'.")
-            await _handle_revolut_subscription_order_paid(order_id)
-            return
-
-        logger.info(f"Ignoring Revolut authorised order without payment: '{order_id}'.")
-        return
-
-    if event_type == "SUBSCRIPTION_INITIATED":
-        logger.info("Revolut subscription initiated event received.")
-        return
-
-    if event_type in [
-        "SUBSCRIPTION_CANCELLED",
-        "SUBSCRIPTION_FINISHED",
-        "SUBSCRIPTION_OVERDUE",
-    ]:
-        logger.info(f"Revolut subscription lifecycle event received: '{event_type}'.")
-        return
-
-    logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
-
-
-async def _get_revolut_provider() -> RevolutWallet | None:
-    fiat_provider = await get_fiat_provider("revolut")
-    if not isinstance(fiat_provider, RevolutWallet):
-        logger.warning("Revolut fiat provider is not configured.")
-        return None
-    return fiat_provider
-
-
-async def _handle_revolut_subscription(
-    subscription: dict,
-    fiat_provider: RevolutWallet,
-    order_id: str | None = None,
-    order: dict | None = None,
-):
-    subscription_id = subscription.get("id")
-    if not subscription_id:
-        logger.warning("Revolut subscription missing id.")
-        return
-
-    reference = fiat_provider.deserialize_subscription_reference(
-        subscription.get("external_reference")
-    )
-    if not reference:
-        logger.warning("Revolut subscription event missing LNbits metadata.")
-        return
-
-    if not order_id:
-        cycle_id = subscription.get("current_cycle_id")
-        if not cycle_id:
-            logger.warning("Revolut subscription missing current_cycle_id.")
-            return
-
-        cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
-        order_id = cycle.get("order_id")
-        if not order_id:
-            logger.warning("Revolut subscription cycle missing order_id.")
-            return
-
-    existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-    if existing_payment:
-        if existing_payment.external_id != subscription_id:
-            existing_payment.external_id = subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    if not order:
-        order = await fiat_provider.get_order(order_id)
-    amount_minor = order.get("amount")
-    currency = (order.get("currency") or "").upper()
-    if amount_minor is None or not currency:
-        raise ValueError("Revolut subscription order missing amount or currency.")
-
-    extra = {
-        **(reference.extra or {}),
-        "subscription_request_id": subscription_id,
-        "fiat_method": "subscription",
-        "tag": reference.tag,
-        "subscription": {
-            "checking_id": f"order_{order_id}",
-            "payment_request": order.get("checkout_url") or "",
-        },
-    }
-    lnbits_payment = await _create_revolut_subscription_payment(
-        wallet_id=reference.wallet_id,
-        amount_minor=amount_minor,
-        currency=currency,
-        memo=reference.memo or "",
-        extra=extra,
-        order_id=order_id,
-        payment_request=order.get("checkout_url") or "",
-        subscription_id=subscription_id,
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_revolut_subscription_order_paid(order_id: str):
-    fiat_provider = await _get_revolut_provider()
-    if not fiat_provider:
-        return
-
-    order = await fiat_provider.get_order(order_id)
-    order_type = (order.get("type") or "").lower()
-    order_state = (order.get("state") or "").upper()
-    if order_type != "payment" or order_state != "COMPLETED":
-        logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
-        return
-
-    channel_data = order.get("channel_data") or {}
-    subscription_id = channel_data.get("subscription_id")
-    if not subscription_id:
-        logger.warning(f"Revolut order missing subscription_id: '{order_id}'.")
-        return
-
-    subscription = await fiat_provider.get_subscription(subscription_id)
-    if subscription.get("state") != "active":
-        logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
-        return
-
-    await _handle_revolut_subscription(
-        subscription, fiat_provider, order_id=order_id, order=order
-    )
-
-
-async def _create_revolut_subscription_payment(
-    wallet_id: str,
-    amount_minor: int,
-    currency: str,
-    memo: str,
-    extra: dict,
-    order_id: str,
-    payment_request: str,
-    subscription_id: str,
-) -> Payment:
-    amount = RevolutWallet.minor_units_to_amount(amount_minor, currency)
-    payment = await create_wallet_invoice(
-        wallet_id,
-        CreateInvoice(
-            unit=currency,
-            amount=amount,
-            memo=memo,
-            extra=extra,
-            internal=True,
-            external_id=subscription_id,
-        ),
-    )
-    payment.fee = -abs(service_fee_fiat(payment.msat, "revolut"))
-    payment.fiat_provider = "revolut"
-    payment.extra["fiat_checking_id"] = f"order_{order_id}"
-    payment.extra["fiat_payment_request"] = payment_request
-    checking_id = f"fiat_revolut_order_{order_id}"
-    await update_payment(payment, checking_id)
-    payment.checking_id = checking_id
-    return payment
-
-
-async def _handle_square_payment_event(event: dict):
-    payment = _square_extract_payment(event)
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if payment_options.wallet_id:
-        if not _square_payment_is_completed(payment):
-            logger.debug("Square subscription payment is not completed yet.")
-            return
-        await _handle_square_subscription_payment(payment, payment_options)
-        return
-
-    order_id = payment.get("order_id")
-    if not order_id:
-        logger.warning("Square payment event missing order_id.")
-        return
-
-    lnbits_payment = await get_standalone_payment(f"fiat_square_order_{order_id}")
-    if not lnbits_payment:
-        logger.warning(f"No payment found for Square order: '{order_id}'.")
-        return
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_square_invoice_payment_made(event: dict):
-    invoice = event.get("data", {}).get("object", {}).get("invoice") or {}
-    order_id = invoice.get("order_id")
-    if not order_id:
-        logger.warning("Square invoice.payment_made event missing order_id.")
-        return
-    subscription_id = invoice.get("subscription_id")
-
-    fiat_provider = await get_fiat_provider("square")
-    if not isinstance(fiat_provider, SquareWallet):
-        logger.warning("Square fiat provider is not configured.")
-        return
-
-    payment = await fiat_provider.get_payment_for_order(order_id)
-    if not payment:
-        logger.warning(f"No Square payment found for invoice order: '{order_id}'.")
-        return
-
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if not payment_options.wallet_id:
-        payment_id = payment.get("id")
-        stored_payment = (
-            await get_standalone_payment(f"fiat_square_payment_{payment_id}")
-            if payment_id
-            else None
-        )
-        if not stored_payment and subscription_id:
-            stored_payments = await get_payments(
-                filters=Filters(
-                    filters=[
-                        Filter.parse_query(
-                            "external_id", [subscription_id], PaymentFilters
-                        )
-                    ],
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                    limit=1,
-                )
-            )
-            stored_payment = stored_payments[0] if stored_payments else None
-        if stored_payment:
-            payment_options = _square_payment_options_from_payment(stored_payment)
-        else:
-            logger.warning("Square subscription payment missing LNbits metadata.")
-            return
-
-    await _handle_square_subscription_payment(
-        payment,
-        payment_options,
-        invoice.get("public_url") or "",
-        square_subscription_id=subscription_id,
-    )
-
-
-async def _handle_square_subscription_payment(
-    payment: dict,
-    payment_options: FiatSubscriptionPaymentOptions,
-    payment_request: str = "",
-    square_subscription_id: str | None = None,
-):
-    amount_money = payment.get("amount_money") or {}
-    amount = amount_money.get("amount")
-    currency = (amount_money.get("currency") or "").upper()
-    payment_id = payment.get("id")
-    if amount is None or not currency or not payment_id:
-        raise ValueError("Square subscription payment event missing payment amount.")
-    wallet_id = payment_options.wallet_id
-    if not wallet_id:
-        raise ValueError("Square subscription payment event missing wallet_id.")
-
-    checking_id = f"payment_{payment_id}"
-    existing_payment = await get_standalone_payment(f"fiat_square_{checking_id}")
-    if existing_payment:
-        if (
-            square_subscription_id
-            and existing_payment.external_id != square_subscription_id
-        ):
-            existing_payment.external_id = square_subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    square_subscription_id = square_subscription_id or (
-        payment_options.extra or {}
-    ).get("square_subscription_id")
-    extra = {
-        **(payment_options.extra or {}),
-        "subscription_request_id": payment_options.subscription_request_id,
-        "fiat_method": "subscription",
-        "tag": payment_options.tag,
-        "subscription": {
-            "checking_id": checking_id,
-            "payment_request": payment_request,
-        },
-    }
-
-    lnbits_payment = await create_fiat_invoice(
-        wallet_id=wallet_id,
-        invoice_data=CreateInvoice(
-            unit=currency,
-            amount=amount / 100,
-            memo=payment_options.memo or "",
-            extra=extra,
-            fiat_provider="square",
-            external_id=square_subscription_id,
-        ),
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-def _square_payment_options_from_payment(
-    payment: Payment,
-) -> FiatSubscriptionPaymentOptions:
-    extra = payment.extra or {}
-    return FiatSubscriptionPaymentOptions(
-        wallet_id=payment.wallet_id,
-        tag=extra.get("tag") or payment.tag,
-        subscription_request_id=extra.get("subscription_request_id"),
-        extra=extra,
-        memo=payment.memo,
-    )
-
-
-def _square_extract_payment(event: dict) -> dict:
-    event_object = event.get("data", {}).get("object", {})
-    return event_object.get("payment") or event_object
-
-
-def _square_payment_is_completed(payment: dict) -> bool:
-    return (payment.get("status") or "").upper() == "COMPLETED"
-
-
-def _square_payment_note(payment: dict) -> str:
-    return payment.get("note") or payment.get("payment_note") or ""
-
-
-def _deserialize_square_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
-    try:
-        meta = json.loads(custom_id)
-        if not isinstance(meta, list):
-            return FiatSubscriptionPaymentOptions()
-        wallet_id = meta[0] if len(meta) > 0 else None
-        tag = meta[1] if len(meta) > 1 else None
-        subscription_request_id = meta[2] if len(meta) > 2 else None
-        extra_link = meta[3] if len(meta) > 3 else None
-        memo = meta[4] if len(meta) > 4 else None
-
-        extra = {
-            "link": extra_link,
-            "subscription_request_id": subscription_request_id,
-        }
-
-        return FiatSubscriptionPaymentOptions(
-            wallet_id=wallet_id,
-            tag=tag,
-            subscription_request_id=subscription_request_id,
-            extra=extra,
-            memo=memo,
-        )
-    except (json.JSONDecodeError, IndexError, TypeError):
-        return FiatSubscriptionPaymentOptions()
@@ -29,7 +29,6 @@ from lnbits.core.models.extensions import (
    ReleasePaymentInfo,
    UserExtension,
    UserExtensionInfo,
-    wasm_extension_icon_url,
 )
 from lnbits.core.models.users import Account, AccountId
 from lnbits.core.services import check_transaction_status, create_invoice
@@ -41,7 +40,6 @@ from lnbits.core.services.extensions import (
    install_extension,
    uninstall_extension,
 )
-from lnbits.core.wasm_ext.api.permissions import validate_extension_permissions
 from lnbits.db import Page
 from lnbits.decorators import (
    check_account_exists,
@@ -91,9 +89,7 @@ async def api_install_extension(data: CreateExtension):
    )

    try:
-        extension = await install_extension(
-            ext_info, granted_permissions=data.permissions
-        )
+        extension = await install_extension(ext_info)

    except Exception as exc:
        logger.warning(exc)
@@ -102,16 +98,12 @@ async def api_install_extension(data: CreateExtension):
        ext_info.clean_extension_files()
        detail = (
            str(exc)
-            if isinstance(exc, (AssertionError, ValueError))
+            if isinstance(exc, AssertionError)
            else f"Failed to install extension '{ext_info.id}'."
            f"({ext_info.installed_version})."
        )
        raise HTTPException(
-            status_code=(
-                HTTPStatus.BAD_REQUEST
-                if isinstance(exc, (AssertionError, ValueError))
-                else HTTPStatus.INTERNAL_SERVER_ERROR
-            ),
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
            detail=detail,
        ) from exc

@@ -296,6 +288,7 @@ async def api_deactivate_extension(ext_id: str) -> SimpleStatus:

@extension_router.delete("/{ext_id}", dependencies=[Depends(check_admin)])
 async def api_uninstall_extension(ext_id: str) -> SimpleStatus:
+
    extension = await get_installed_extension(ext_id)
    if not extension:
        raise HTTPException(
@@ -463,19 +456,11 @@ async def get_extension_release(org: str, repo: str, tag_name: str):
        if not config:
            return {}

-        permissions = validate_extension_permissions(config.name, config.permissions)
-
        return {
            "min_lnbits_version": config.min_lnbits_version,
            "is_version_compatible": config.is_version_compatible(),
            "warning": config.warning,
-            "extension_type": config.extension_type,
-            "permissions": [dict(permission) for permission in permissions],
        }
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST, detail=str(exc)
-        ) from exc
    except Exception as exc:
        raise HTTPException(
            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
@@ -547,10 +532,9 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
    )
    installable_exts_ids = [e.id for e in installable_exts]
    installable_exts += [e for e in installed_exts if e.id not in installable_exts_ids]
-    installed_exts_by_id = {e.id: e for e in installed_exts}

    for e in installable_exts:
-        installed_ext = installed_exts_by_id.get(e.id)
+        installed_ext = next((ie for ie in installed_exts if e.id == ie.id), None)
        if installed_ext and installed_ext.meta:
            installed_release = installed_ext.meta.installed_release
            if installed_ext.meta.pay_to_enable and not account_id.is_admin_id:
@@ -571,60 +555,46 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
            e.short_description = installed_ext.short_description
            e.icon = installed_ext.icon

-    extension_data = []
-    for ext in installable_exts:
-        installed_ext = installed_exts_by_id.get(ext.id)
-        is_wasm = installed_ext.is_wasm if installed_ext else ext.is_wasm
-        icon = wasm_extension_icon_url(ext.id) if is_wasm else ext.icon
-        permissions = (
-            validate_extension_permissions(
-                installed_ext.id, installed_ext.permissions, strict=False
-            )
-            if installed_ext
-            else []
-        )
-        extension_data.append(
-            {
-                "id": ext.id,
-                "name": ext.name,
-                "icon": icon,
-                "shortDescription": ext.short_description,
-                "stars": ext.stars,
-                "isFeatured": ext.meta.featured if ext.meta else False,
-                "categories": ext.meta.categories if ext.meta else [],
-                "dependencies": ext.meta.dependencies if ext.meta else "",
-                "isInstalled": ext.id in installed_exts_ids,
-                "hasDatabaseTables": next(
-                    (True for version in db_versions if version.db == ext.id), False
-                ),
-                "isAvailable": ext.id in all_ext_ids,
-                "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
-                "isActive": ext.id not in inactive_extensions,
-                "latestRelease": (
-                    dict(ext.meta.latest_release)
-                    if ext.meta and ext.meta.latest_release
-                    else None
-                ),
-                "hasPaidRelease": ext.meta.has_paid_release if ext.meta else False,
-                "hasFreeRelease": ext.meta.has_free_release if ext.meta else False,
-                "paidFeatures": ext.meta.paid_features if ext.meta else False,
-                "installedRelease": (
-                    dict(ext.meta.installed_release)
-                    if ext.meta and ext.meta.installed_release
-                    else None
-                ),
-                "payToEnable": (
-                    dict(ext.meta.pay_to_enable)
-                    if ext.meta and ext.meta.pay_to_enable
-                    else {}
-                ),
-                "isPaymentRequired": ext.requires_payment,
-                "isWasm": is_wasm,
-                "permissions": [dict(permission) for permission in permissions],
-                "inProgress": False,
-                "selectedForUpdate": False,
-            }
-        )
+    extension_data = [
+        {
+            "id": ext.id,
+            "name": ext.name,
+            "icon": ext.icon,
+            "shortDescription": ext.short_description,
+            "stars": ext.stars,
+            "isFeatured": ext.meta.featured if ext.meta else False,
+            "dependencies": ext.meta.dependencies if ext.meta else "",
+            "isInstalled": ext.id in installed_exts_ids,
+            "hasDatabaseTables": next(
+                (True for version in db_versions if version.db == ext.id), False
+            ),
+            "isAvailable": ext.id in all_ext_ids,
+            "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
+            "isActive": ext.id not in inactive_extensions,
+            "latestRelease": (
+                dict(ext.meta.latest_release)
+                if ext.meta and ext.meta.latest_release
+                else None
+            ),
+            "hasPaidRelease": ext.meta.has_paid_release if ext.meta else False,
+            "hasFreeRelease": ext.meta.has_free_release if ext.meta else False,
+            "paidFeatures": ext.meta.paid_features if ext.meta else False,
+            "installedRelease": (
+                dict(ext.meta.installed_release)
+                if ext.meta and ext.meta.installed_release
+                else None
+            ),
+            "payToEnable": (
+                dict(ext.meta.pay_to_enable)
+                if ext.meta and ext.meta.pay_to_enable
+                else {}
+            ),
+            "isPaymentRequired": ext.requires_payment,
+            "inProgress": False,
+            "selectedForUpdate": False,
+        }
+        for ext in installable_exts
+    ]
    return extension_data


@@ -2,35 +2,17 @@ from http import HTTPStatus

 from fastapi import APIRouter, Depends, HTTPException
 from loguru import logger
-from pydantic import BaseModel

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.wallets import WalletTypeInfo
-from lnbits.core.services import update_cached_settings
 from lnbits.core.services.fiat_providers import test_connection
 from lnbits.decorators import check_admin, require_admin_key
-from lnbits.fiat import RevolutWallet, StripeWallet, get_fiat_provider
+from lnbits.fiat import StripeWallet, get_fiat_provider
 from lnbits.fiat.base import CreateFiatSubscription, FiatSubscriptionResponse

 fiat_router = APIRouter(tags=["Fiat API"], prefix="/api/v1/fiat")


-class RevolutCreateWebhook(BaseModel):
-    url: str
-    endpoint: str | None = None
-    api_secret_key: str | None = None
-    api_version: str | None = None
-
-
-class RevolutCreateWebhookResponse(BaseModel):
-    id: str | None = None
-    url: str
-    events: list[str] = []
-    signing_secret: str
-    already_exists: bool = False
-
-
@fiat_router.put(
    "/check/{provider}",
    status_code=HTTPStatus.OK,
@@ -40,54 +22,6 @@ async def api_test_fiat_provider(provider: str) -> SimpleStatus:
    return await test_connection(provider)


-@fiat_router.post(
-    "/revolut/webhook",
-    status_code=HTTPStatus.OK,
-    dependencies=[Depends(check_admin)],
-)
-async def api_create_revolut_webhook(
-    data: RevolutCreateWebhook,
-) -> RevolutCreateWebhookResponse:
-    try:
-        webhook = await RevolutWallet.create_webhook(
-            url=data.url,
-            endpoint=data.endpoint,
-            api_secret_key=data.api_secret_key,
-            api_version=data.api_version,
-        )
-    except ValueError as exc:
-        logger.warning(exc)
-        raise HTTPException(status_code=400, detail=str(exc)) from exc
-    except Exception as exc:
-        logger.warning(exc)
-        raise HTTPException(
-            status_code=500, detail="Failed to create Revolut webhook."
-        ) from exc
-
-    signing_secret = webhook.get("signing_secret")
-    webhook_url = webhook.get("url") or data.url
-    if not signing_secret:
-        raise HTTPException(
-            status_code=502, detail="Revolut returned no webhook signing secret."
-        )
-
-    updated_settings = {
-        "revolut_payment_webhook_url": webhook_url,
-        "revolut_webhook_signing_secret": signing_secret,
-    }
-    for key, value in updated_settings.items():
-        await set_settings_field(key, value)
-    update_cached_settings(updated_settings)
-
-    return RevolutCreateWebhookResponse(
-        id=webhook.get("id"),
-        url=webhook_url,
-        events=webhook.get("events") or [],
-        signing_secret=signing_secret,
-        already_exists=webhook.get("already_exists", False),
-    )
-
-
@fiat_router.post(
    "/{provider}/subscription",
    status_code=HTTPStatus.OK,
@@ -200,7 +200,7 @@ async def index(
 ) -> HTMLResponse:
    return template_renderer().TemplateResponse(
        request,
-        "base.html",
+        "index.html",
        {
            "user": user.json(),
        },
@@ -211,7 +211,7 @@ async def index(
@generic_router.get("/node/public")
@generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
+    return template_renderer().TemplateResponse(request, "index.html", {"public": True})


@generic_router.get("/uuidv4/{hex_value}")
@@ -34,7 +34,6 @@ from lnbits.core.models import (
    PaymentWalletStats,
    SettleInvoice,
    SimpleStatus,
-    UpdatePaymentExtra,
 )
 from lnbits.core.models.payments import UpdatePaymentLabels
 from lnbits.core.models.users import AccountId
@@ -264,7 +263,6 @@ async def api_payments_create(
            payment_request=invoice_data.bolt11,
            extra=invoice_data.extra,
            labels=invoice_data.labels,
-            external_id=invoice_data.external_id,
        )
        return payment

@@ -298,38 +296,6 @@ async def api_update_payment_labels(
    return SimpleStatus(success=True, message="Payment labels updated.")


-@payment_router.patch(
-    "/extra",
-    name="Update payment extra",
-    description="Append new extra metadata to a payment.",
-    response_model=Payment,
-)
-async def api_update_payment_extra(
-    data: UpdatePaymentExtra,
-    key_type: WalletTypeInfo = Depends(require_admin_key),
-) -> Payment:
-    payment = await get_standalone_payment(
-        data.payment_hash, wallet_id=key_type.wallet.id
-    )
-    if payment is None:
-        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
-    if not payment.success:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST, "Payment extra can only be updated after success."
-        )
-
-    duplicate_keys = sorted(set(payment.extra).intersection(data.extra))
-    if duplicate_keys:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            f"Extra keys already exist: {', '.join(duplicate_keys)}.",
-        )
-
-    payment.extra.update(data.extra)
-    await update_payment(payment)
-    return payment
-
-
@payment_router.get("/fee-reserve")
 async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
    invoice_obj = bolt11.decode(invoice)
@@ -1,24 +0,0 @@
-from .api.host import ExtensionHostAPI
-from .api.models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .api.registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .api.runtime import ExtensionAPIHost
-from .wasm.loader import WasmExtension
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "WasmExtension",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]
@@ -1,22 +0,0 @@
-from .host import ExtensionHostAPI
-from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .runtime import ExtensionAPIHost
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]
@@ -1,582 +0,0 @@
-from __future__ import annotations
-
-import json
-import logging
-import secrets
-import time
-from collections.abc import Iterable, Mapping
-from typing import Any
-
-from lnbits.helpers import sha256s
-
-from ..client.extensions import send_extension_api_request
-from ..storage.crud import (
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_set_row,
-)
-from .models import (
-    CreateInvoicePublicRequest,
-    CreateInvoiceRequest,
-    CreateInvoiceResponse,
-    EmptyRequest,
-    ExtensionApiRequest,
-    HttpRequest,
-    HttpResponse,
-    ListUserWalletsResponse,
-    LogRequest,
-    LogResponse,
-    NowResponse,
-    PayInvoiceRequest,
-    PayInvoiceResponse,
-    RandomIdRequest,
-    RandomIdResponse,
-    StorageDeleteRequest,
-    StorageDeleteResponse,
-    StorageGetRequest,
-    StorageGetResponse,
-    StoragePaginatedRequest,
-    StoragePaginatedResponse,
-    StorageSetRequest,
-    StorageSetResponse,
-    UserWalletSummary,
-    WalletBalanceRequest,
-    WalletBalanceResponse,
-)
-from .registry import extension_api_method
-
-logger = logging.getLogger("lnbits.extensions")
-
-
-class ExtensionHostAPI:
-    def __init__(
-        self,
-        extension_id: str,
-        permissions: Iterable[Any],
-        *,
-        user_id: str | None = None,
-        access_token: str | None = None,
-        context: str = "user",
-        owner_id: str | None = None,
-    ) -> None:
-        self.extension_id = extension_id
-        self.permissions, self.permission_policies = self._permission_data(permissions)
-        self.user_id = user_id
-        self.access_token = access_token
-        self.context = context
-        self.owner_id = sha256s(user_id) if user_id else owner_id
-        from .utils import ExtensionAPIUtils
-
-        self.utils = ExtensionAPIUtils(self.extension_id, self.permissions)
-
-    @extension_api_method(
-        method_id="storage.get",
-        namespace="storage",
-        name="Get storage row",
-        host_name="storage_get",
-        sdk_name="get",
-        description="Read one row from an extension storage table.",
-        required_permission="ext.storage.read",
-        require_auth=True,
-    )
-    async def storage_get(self, request: StorageGetRequest) -> StorageGetResponse:
-        row = await storage_get_row(
-            self.extension_id,
-            request.table,
-            request.id,
-            self._require_owner_id(),
-        )
-        return StorageGetResponse(data_json=json.dumps(row) if row else None)
-
-    @extension_api_method(
-        method_id="storage.get_public",
-        namespace="storage",
-        name="Get public storage row",
-        host_name="storage_get_public",
-        sdk_name="getPublic",
-        description="Read one public row from an extension storage table.",
-        required_permission="ext.storage.read_public",
-        require_auth=False,
-    )
-    async def storage_get_public(
-        self, request: StorageGetRequest
-    ) -> StorageGetResponse:
-        public_fields = self._public_storage_fields(request.table)
-        row = await storage_get_public_row(self.extension_id, request.table, request.id)
-        if not row:
-            return StorageGetResponse()
-        public_row = {
-            field_name: value
-            for field_name, value in row.items()
-            if field_name in public_fields
-        }
-        # todo: check public fields filtering
-        return StorageGetResponse(data_json=json.dumps(public_row))
-
-    @extension_api_method(
-        method_id="storage.set",
-        namespace="storage",
-        name="Set storage row",
-        host_name="storage_set",
-        sdk_name="set",
-        description="Create or update one row in an extension storage table.",
-        required_permission="ext.storage.write",
-        require_auth=True,
-    )
-    async def storage_set(self, request: StorageSetRequest) -> StorageSetResponse:
-        await storage_set_row(
-            self.extension_id,
-            request.table,
-            request.data,
-            self._require_owner_id(),
-        )
-        return StorageSetResponse()
-
-    @extension_api_method(
-        method_id="storage.get_paginated",
-        namespace="storage",
-        name="Get paginated storage rows",
-        host_name="storage_get_paginated",
-        sdk_name="getPaginated",
-        description="Get filtered, searched, sorted, paginated storage rows.",
-        required_permission="ext.storage.read",
-        require_auth=True,
-    )
-    async def storage_get_paginated(
-        self, request: StoragePaginatedRequest
-    ) -> StoragePaginatedResponse:
-        page = await storage_get_paginated_rows(
-            self.extension_id,
-            request.table,
-            request.filters,
-            owner_id=self._require_owner_id(),
-            search=request.search,
-            search_fields=request.search_fields,
-            sort_by=request.sort_by,
-            descending=request.descending,
-            limit=request.limit,
-            offset=request.offset,
-        )
-        return StoragePaginatedResponse(
-            rows_json=json.dumps(page["data"]),
-            total=page["total"],
-        )
-
-    @extension_api_method(
-        method_id="storage.delete",
-        namespace="storage",
-        name="Delete storage row",
-        host_name="storage_delete",
-        sdk_name="delete",
-        description="Delete one row from an extension storage table.",
-        required_permission="ext.storage.write",
-        require_auth=True,
-    )
-    async def storage_delete(
-        self, request: StorageDeleteRequest
-    ) -> StorageDeleteResponse:
-        await storage_delete_row(
-            self.extension_id,
-            request.table,
-            request.id,
-            self._require_owner_id(),
-        )
-        return StorageDeleteResponse()
-
-    @extension_api_method(
-        method_id="wallet.create_invoice",
-        namespace="wallet",
-        name="Create invoice",
-        host_name="create_invoice",
-        sdk_name="createInvoice",
-        description="Create an incoming Lightning invoice for an allowed wallet.",
-        required_permission="wallet.create_invoice",
-        require_auth=True,
-    )
-    async def wallet_create_invoice(
-        self, request: CreateInvoiceRequest
-    ) -> CreateInvoiceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-        from lnbits.core.models.payments import CreateInvoice
-        from lnbits.core.services.payments import create_payment_request
-
-        if not self.user_id:
-            raise PermissionError(
-                "Creating an invoice for this wallet requires an "
-                "authenticated user context."
-            )
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Not your wallet.")
-
-        payment = await create_payment_request(
-            request.wallet_id,
-            CreateInvoice(
-                amount=request.amount,
-                unit=request.currency,
-                memo=request.memo,
-                extra=request.extra,
-                extension=self.extension_id,
-            ),
-        )
-        return CreateInvoiceResponse(
-            payment_hash=payment.payment_hash,
-            payment_request=payment.payment_request or payment.bolt11,
-            checking_id=payment.checking_id,
-        )
-
-    @extension_api_method(
-        method_id="wallet.create_invoice_public",
-        namespace="wallet",
-        name="Create public invoice",
-        host_name="create_invoice_public",
-        sdk_name="createInvoicePublic",
-        description="Create a public incoming Lightning invoice.",
-        required_permission="wallet.create_invoice_public",
-        require_auth=False,
-    )
-    async def wallet_create_invoice_public(
-        self, request: CreateInvoicePublicRequest
-    ) -> CreateInvoiceResponse:
-        from lnbits.core.models.payments import CreateInvoice
-        from lnbits.core.services.payments import create_payment_request
-
-        row: dict[str, Any] | None = None
-        wallet_field = ""
-        for policy in self._public_invoice_wallet_sources():
-            row = await storage_get_public_row(
-                self.extension_id,
-                policy["table"],
-                request.source_id,
-            )
-            if row:
-                wallet_field = policy["wallet_field"]
-                break
-
-        if not row:
-            raise PermissionError("Public invoice source was not found.")
-
-        wallet_id = row.get(wallet_field)
-        if not isinstance(wallet_id, str) or not wallet_id:
-            raise PermissionError("Public invoice source has no valid wallet.")
-
-        payment = await create_payment_request(
-            wallet_id,
-            CreateInvoice(
-                amount=request.amount,
-                unit=request.currency,
-                memo=request.memo,
-                extra={
-                    "tag": self.extension_id,
-                    "source_id": request.source_id,
-                    f"extra_{self.extension_id}": request.extra,
-                },
-                extension=self.extension_id,
-            ),
-        )
-        return CreateInvoiceResponse(
-            payment_hash=payment.payment_hash,
-            payment_request=payment.payment_request or payment.bolt11,
-            checking_id=payment.checking_id,
-        )
-
-    @extension_api_method(
-        method_id="wallet.list_user_wallets",
-        namespace="wallet",
-        name="List user wallets",
-        host_name="list_user_wallets",
-        sdk_name="listUserWallets",
-        description="List wallets available to the authenticated extension user.",
-        required_permission="wallet.list",
-    )
-    async def wallet_list_user_wallets(
-        self, request: EmptyRequest
-    ) -> ListUserWalletsResponse:
-        if not self.user_id:
-            raise PermissionError(
-                "Listing user wallets requires an authenticated user context."
-            )
-
-        from lnbits.core.crud.wallets import get_wallets
-
-        user_wallets = await get_wallets(self.user_id)
-        if user_wallets is None:
-            raise PermissionError(
-                "Listing user wallets requires an authenticated user context."
-            )
-        return ListUserWalletsResponse(
-            wallets=[
-                UserWalletSummary(id=w.id, name=w.name, currency=w.currency)
-                for w in user_wallets
-            ]
-        )
-
-    @extension_api_method(
-        method_id="wallet.balance",
-        namespace="wallet",
-        name="Read wallet balance",
-        host_name="wallet_balance",
-        sdk_name="balance",
-        description="Read the balance of a wallet available to the user.",
-        required_permission="wallet.balance.read",
-    )
-    async def wallet_balance(
-        self, request: WalletBalanceRequest
-    ) -> WalletBalanceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-
-        if not self.user_id:
-            raise PermissionError(
-                "Reading a wallet balance requires an authenticated user context."
-            )
-
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Reading this wallet balance is not allowed.")
-
-        withdrawable_msat = max(wallet.withdrawable_balance, 0)
-        fee_reserve_msat = max(wallet.balance_msat - withdrawable_msat, 0)
-        return WalletBalanceResponse(
-            wallet_id=wallet.id,
-            name=wallet.name,
-            currency=wallet.currency,
-            balance_msat=wallet.balance_msat,
-            balance_sat=wallet.balance,
-            withdrawable_msat=withdrawable_msat,
-            withdrawable_sat=withdrawable_msat // 1000,
-            fee_reserve_msat=fee_reserve_msat,
-            fee_reserve_sat=fee_reserve_msat // 1000,
-            can_send_payments=wallet.can_send_payments,
-        )
-
-    @extension_api_method(
-        method_id="wallet.pay_invoice",
-        namespace="wallet",
-        name="Pay invoice",
-        host_name="pay_invoice",
-        sdk_name="payInvoice",
-        description="Pay a Lightning invoice from a wallet available to the user.",
-        required_permission="wallet.pay_invoice",
-    )
-    async def wallet_pay_invoice(
-        self, request: PayInvoiceRequest
-    ) -> PayInvoiceResponse:
-        from lnbits.core.crud.wallets import get_wallet
-        from lnbits.core.services.payments import pay_invoice
-        from lnbits.exceptions import PaymentError
-
-        if not self.user_id:
-            raise PermissionError(
-                "Paying an invoice requires an authenticated user context."
-            )
-
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Paying invoices from this wallet is not allowed.")
-
-        try:
-            payment = await pay_invoice(
-                wallet_id=request.wallet_id,
-                payment_request=request.payment_request,
-                max_sat=request.max_sat,
-                extra={"tag": self.extension_id, **request.extra},
-                description=request.description,
-                tag=self.extension_id,
-            )
-        except (PaymentError, ValueError) as exc:
-            return PayInvoiceResponse(ok=False, error=str(exc))
-
-        return PayInvoiceResponse(
-            ok=True,
-            checking_id=payment.checking_id,
-            payment_hash=payment.payment_hash,
-            status=payment.status,
-            amount_msat=abs(payment.amount),
-            fee_msat=abs(payment.fee),
-            pending=payment.pending,
-            success=payment.success,
-        )
-
-    @extension_api_method(
-        method_id="http.request",
-        namespace="http",
-        name="HTTP request",
-        host_name="http_request",
-        sdk_name="request",
-        description="Make an outbound HTTP request to an allowed host.",
-        required_permission="http.request",
-        require_auth=True,
-    )
-    async def http_request(self, request: HttpRequest) -> HttpResponse:
-        from ..client.http import send_extension_http_request
-
-        policies = self.permission_policies.get("http.request") or []
-        return await send_extension_http_request(self.extension_id, policies, request)
-
-    @extension_api_method(
-        method_id="extension.api.request",
-        namespace="extension",
-        name="Extension API request",
-        host_name="extension_api_request",
-        sdk_name="request",
-        description="Call an allowed installed extension API.",
-        required_permission="extension.api.request",
-        require_auth=True,
-    )
-    async def extension_api_request(self, request: ExtensionApiRequest) -> HttpResponse:
-
-        policies = self.permission_policies.get("extension.api.request") or []
-        return await send_extension_api_request(
-            self.extension_id,
-            policies,
-            self.user_id,
-            self.access_token,
-            request,
-        )
-
-    @extension_api_method(
-        method_id="system.random_id",
-        namespace="system",
-        name="Random ID",
-        host_name="random_id",
-        sdk_name="id",
-        description="Create a random extension-local identifier.",
-        require_auth=False,
-    )
-    async def system_random_id(self, request: RandomIdRequest) -> RandomIdResponse:
-        return RandomIdResponse(
-            id=f"{request.prefix}_{secrets.token_urlsafe(12).replace('-', '_')}"
-        )
-
-    @extension_api_method(
-        method_id="system.now",
-        namespace="system",
-        name="Current timestamp",
-        host_name="now",
-        sdk_name="now",
-        description="Return the current Unix timestamp.",
-        require_auth=False,
-    )
-    async def system_now(self, request: EmptyRequest) -> NowResponse:
-        return NowResponse(timestamp=int(time.time()))
-
-    @extension_api_method(
-        method_id="system.log",
-        namespace="system",
-        name="Log message",
-        host_name="log",
-        sdk_name="log",
-        description="Write a bounded message to the extension log.",
-        require_auth=False,
-    )
-    async def system_log(self, request: LogRequest) -> LogResponse:
-        log = getattr(logger, request.level)
-        log("extension:%s %s", self.extension_id, request.message)
-        return LogResponse()
-
-    @staticmethod
-    def _permission_data(
-        permissions: Iterable[Any],
-    ) -> tuple[set[str], dict[str, list[Any]]]:
-        permission_ids: set[str] = set()
-        policies: dict[str, list[Any]] = {}
-
-        for permission in permissions:
-            if isinstance(permission, str):
-                permission_ids.add(permission)
-                continue
-
-            permission_id: str | None = None
-            permission_policies: Any = None
-            if isinstance(permission, Mapping):
-                permission_id = permission.get("id")  # type: ignore[assignment]
-                permission_policies = permission.get("policies")
-            else:
-                permission_id = getattr(permission, "id", None)
-                permission_policies = getattr(permission, "policies", None)
-
-            if not permission_id:
-                continue
-            permission_ids.add(permission_id)
-            if isinstance(permission_policies, list):
-                policies[permission_id] = permission_policies
-
-        return permission_ids, policies
-
-    def _public_storage_fields(self, table: str) -> set[str]:
-        tables = self.permission_policies.get("ext.storage.read_public")
-        if not isinstance(tables, list) or not tables:
-            raise PermissionError(
-                "Public storage reads require policies for "
-                "'ext.storage.read_public'."
-            )
-
-        for table_policy in tables:
-            if not isinstance(table_policy, dict):
-                continue
-            if table_policy.get("table_name") != table:
-                continue
-            public_fields = table_policy.get("public_fields")
-            if not isinstance(public_fields, list) or not all(
-                isinstance(field, str) and field for field in public_fields
-            ):
-                raise PermissionError(
-                    f"Public storage table '{table}' has no valid public fields."
-                )
-            return set(public_fields)
-
-        raise PermissionError(f"Storage table '{table}' is not publicly readable.")
-
-    def _public_invoice_wallet_sources(self) -> list[dict[str, str]]:
-        policies = self.permission_policies.get("wallet.create_invoice_public")
-        if not isinstance(policies, list) or not policies:
-            raise PermissionError("Public invoice creation requires a policies list.")
-
-        sources: list[dict[str, str]] = []
-        for source_policy in policies:
-            if not isinstance(source_policy, dict):
-                raise PermissionError(
-                    "Public invoice creation policies must be objects."
-                )
-            table = source_policy.get("table")
-            wallet_field = source_policy.get("wallet_field")
-            if not isinstance(table, str) or not table:
-                raise PermissionError(
-                    "Public invoice creation requires a storage table policy."
-                )
-            if not isinstance(wallet_field, str) or not wallet_field:
-                raise PermissionError(
-                    "Public invoice creation requires a wallet field policy."
-                )
-            sources.append({"table": table, "wallet_field": wallet_field})
-
-        if not sources:
-            raise PermissionError(
-                "Public invoice creation requires at least one valid policy."
-            )
-        return sources
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
-            raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
-            )
-
-    def has_authenticated_context(self) -> bool:
-        return bool(self.user_id) or self.context == "event"
-
-    def _require_owner_id(self) -> str:
-        if not self.owner_id:
-            raise PermissionError("Extension API method requires an owner context.")
-        return self.owner_id
-
-    def __repr__(self) -> str:
-        return (
-            "ExtensionHostAPI("
-            f"extension_id={self.extension_id!r}, "
-            f"context={self.context!r}, "
-            f"owner_id={self.owner_id!r}"
-            ")"
-        )
@@ -1,360 +0,0 @@
-import json
-from dataclasses import dataclass
-from typing import Any, Literal
-
-from pydantic import BaseModel, Field, root_validator
-
-
-@dataclass(frozen=True)
-class ExtensionAPIMethodExport:
-    method_id: str
-    namespace: str
-    name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    required_permission: str | None = None
-    require_auth: bool = True
-
-
-@dataclass(frozen=True)
-class ExtensionAPIMethod:
-    method_id: str
-    namespace: str
-    name: str
-    python_name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    request_model: type[BaseModel]
-    response_model: type[BaseModel]
-    required_permission: str | None = None
-    require_auth: bool = True
-
-    @property
-    def sdk_qualified_name(self) -> str:
-        return f"{self.namespace}.{self.sdk_name}"
-
-
-class EmptyRequest(BaseModel):
-    pass
-
-
-class StorageGetRequest(BaseModel):
-    table: str = Field(..., min_length=1, max_length=128)
-    id: str = Field(..., min_length=1, max_length=512)
-
-
-class StorageGetResponse(BaseModel):
-    data_json: str | None = None
-
-
-class StorageSetRequest(BaseModel):
-    table: str = Field(..., min_length=1, max_length=128)
-    data: dict[str, Any] = Field(default_factory=dict)
-
-    @root_validator(pre=True)
-    def parse_data_json(cls, values: dict[str, Any]) -> dict[str, Any]:
-        data_json = values.get("data_json")
-        if data_json is not None and "data" not in values:
-            values["data"] = json.loads(data_json)
-        return values
-
-
-class StorageSetResponse(BaseModel):
-    ok: bool = True
-
-
-class StoragePaginatedRequest(BaseModel):
-    table: str = Field(..., min_length=1, max_length=128)
-    filters: dict[str, Any] = Field(default_factory=dict)
-    search: str | None = Field(None, max_length=256)
-    search_fields: list[str] = Field(default_factory=list)
-    sort_by: str | None = Field(None, min_length=1, max_length=128)
-    descending: bool = False
-    limit: int = Field(25, ge=1, le=1000)
-    offset: int = Field(0, ge=0)
-
-    @root_validator(pre=True)
-    def parse_json_fields(cls, values: dict[str, Any]) -> dict[str, Any]:
-        filters_json = values.get("filters_json")
-        if filters_json is not None and "filters" not in values:
-            values["filters"] = json.loads(filters_json)
-
-        search_fields_json = values.get("search_fields_json")
-        if search_fields_json is not None and "search_fields" not in values:
-            values["search_fields"] = json.loads(search_fields_json)
-
-        if values.get("sort_by") == "":
-            values["sort_by"] = None
-        return values
-
-
-class StoragePaginatedResponse(BaseModel):
-    rows_json: str = "[]"
-    total: int = 0
-
-
-class StorageDeleteRequest(BaseModel):
-    table: str = Field(..., min_length=1, max_length=128)
-    id: str = Field(..., min_length=1, max_length=512)
-
-
-class StorageDeleteResponse(BaseModel):
-    ok: bool = True
-
-
-class CreateInvoiceRequest(BaseModel):
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-    amount: float = Field(..., gt=0)
-    currency: str = Field("sat", min_length=1, max_length=8)
-    memo: str = Field(..., max_length=512)
-    tag: str = Field(..., min_length=1, max_length=64)
-    extra: dict[str, str] = Field(default_factory=dict)
-
-
-class CreateInvoicePublicRequest(BaseModel):
-    source_id: str = Field(
-        ...,
-        min_length=1,
-        max_length=512,
-        description="The source ID (entry id) of the wallet to create the invoice for.",
-    )
-    amount: float = Field(..., gt=0)
-    currency: str = Field(..., min_length=1, max_length=8)
-    memo: str = Field("", max_length=512)
-    extra: dict[str, Any] = Field(default_factory=dict)
-
-    @root_validator
-    def validate_extra_size(cls, values: dict[str, Any]) -> dict[str, Any]:
-        extra = values.get("extra") or {}
-        try:
-            encoded = json.dumps(extra, separators=(",", ":"))
-        except TypeError as exc:
-            raise ValueError("extra must be JSON serializable.") from exc
-        if len(encoded.encode()) > 4096:
-            raise ValueError("extra must not exceed 4096 bytes.")
-        values["extra"] = extra
-        return values
-
-
-class CreateInvoiceResponse(BaseModel):
-    payment_hash: str
-    payment_request: str
-    checking_id: str
-
-
-class UserWalletSummary(BaseModel):
-    id: str
-    name: str
-    currency: str | None = None
-
-
-class ListUserWalletsResponse(BaseModel):
-    wallets: list[UserWalletSummary] = Field(default_factory=list)
-
-
-class WalletBalanceRequest(BaseModel):
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-
-
-class WalletBalanceResponse(BaseModel):
-    wallet_id: str
-    name: str
-    currency: str | None = None
-    balance_msat: int
-    balance_sat: int
-    withdrawable_msat: int
-    withdrawable_sat: int
-    fee_reserve_msat: int
-    fee_reserve_sat: int
-    can_send_payments: bool
-
-
-class PayInvoiceRequest(BaseModel):
-    wallet_id: str = Field(..., min_length=1, max_length=128)
-    payment_request: str = Field(..., min_length=1, max_length=8192)
-    max_sat: int | None = Field(None, gt=0)
-    description: str = Field("", max_length=512)
-    extra: dict[str, str] = Field(default_factory=dict)
-
-
-class PayInvoiceResponse(BaseModel):
-    ok: bool = True
-    error: str | None = None
-    checking_id: str | None = None
-    payment_hash: str | None = None
-    status: str | None = None
-    amount_msat: int = 0
-    fee_msat: int = 0
-    pending: bool = False
-    success: bool = False
-
-
-class HttpRequest(BaseModel):
-    method: Literal["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"] = "GET"
-    url: str = Field(..., min_length=1, max_length=2048)
-    headers: dict[str, str] = Field(default_factory=dict)
-    body: str | None = Field(None, max_length=65536)
-
-    @root_validator(pre=True)
-    def normalize_method(cls, values: dict[str, Any]) -> dict[str, Any]:
-        method = values.get("method")
-        if isinstance(method, str):
-            values["method"] = method.upper()
-        return values
-
-    @root_validator
-    def validate_headers_size(cls, values: dict[str, Any]) -> dict[str, Any]:
-        headers = values.get("headers") or {}
-        if len(headers) > 32:
-            raise ValueError("headers must not contain more than 32 entries.")
-        for key, value in headers.items():
-            if len(key) > 128 or len(value) > 4096:
-                raise ValueError("headers are too large.")
-        values["headers"] = headers
-        return values
-
-
-class HttpResponse(BaseModel):
-    status_code: int
-    headers: dict[str, str] = Field(default_factory=dict)
-    body: str = ""
-
-
-class ExtensionApiRequest(BaseModel):
-    extension_id: str = Field(..., min_length=1, max_length=128)
-    method: Literal["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"] = "GET"
-    path: str = Field(..., min_length=1, max_length=2048)
-    body: str | None = Field(None, max_length=65536)
-
-    @root_validator(pre=True)
-    def normalize_method(cls, values: dict[str, Any]) -> dict[str, Any]:
-        method = values.get("method")
-        if isinstance(method, str):
-            values["method"] = method.upper()
-        return values
-
-
-class CurrencyListResponse(BaseModel):
-    currencies: list[str] = Field(default_factory=list)
-
-
-class CurrencyRateRequest(BaseModel):
-    currency: str = Field(..., min_length=1, max_length=8)
-
-
-class CurrencyRateResponse(BaseModel):
-    rate: float
-    price: float
-
-
-class CurrencyConvertRequest(BaseModel):
-    amount: float = Field(..., gt=0)
-    from_currency: str = Field(..., alias="from", min_length=1, max_length=8)
-    to: str = Field(..., min_length=1, max_length=256)
-
-    class Config:
-        allow_population_by_field_name = True
-
-
-class CurrencyConvertResponse(BaseModel):
-    amounts: list[tuple[str, float]] = Field(default_factory=list)
-
-
-class FiatToSatsRequest(BaseModel):
-    amount: float = Field(..., gt=0)
-    currency: str = Field(..., min_length=1, max_length=8)
-
-
-class FiatToSatsResponse(BaseModel):
-    amount_sat: int
-
-
-class SatsToFiatRequest(BaseModel):
-    amount: float = Field(..., gt=0)
-    currency: str = Field(..., min_length=1, max_length=8)
-
-
-class SatsToFiatResponse(BaseModel):
-    amount: float
-
-
-class ServerHealthResponse(BaseModel):
-    server_time: int
-    up_time: str
-
-
-class Bolt11Request(BaseModel):
-    bolt11: str = Field(..., min_length=1, max_length=8192)
-
-
-class DecodeInvoiceResponse(BaseModel):
-    valid: bool = True
-    payment_hash: str | None = None
-    amount_msat: int | None = None
-    expiry: int | None = None
-    expires_at: int | None = None
-    memo: str | None = None
-
-
-class ValidateInvoiceResponse(BaseModel):
-    valid: bool
-    error: str | None = None
-
-
-class InvoicePaymentHashResponse(BaseModel):
-    payment_hash: str
-
-
-class InvoiceAmountMsatResponse(BaseModel):
-    amount_msat: int | None = None
-
-
-class InvoiceExpiryResponse(BaseModel):
-    expires_at: int | None = None
-
-
-class InvoiceMemoResponse(BaseModel):
-    memo: str | None = None
-
-
-class VerifyPreimageRequest(BaseModel):
-    preimage: str = Field(..., min_length=64, max_length=64)
-    payment_hash: str = Field(..., min_length=64, max_length=64)
-
-
-class VerifyPreimageResponse(BaseModel):
-    valid: bool
-
-
-class RandomSecretAndHashRequest(BaseModel):
-    length: int = Field(32, ge=16, le=64)
-
-
-class RandomSecretAndHashResponse(BaseModel):
-    secret: str
-    hash: str
-
-
-class RandomIdRequest(BaseModel):
-    prefix: str = Field(..., min_length=1, max_length=32)
-
-
-class RandomIdResponse(BaseModel):
-    id: str
-
-
-class NowResponse(BaseModel):
-    timestamp: int
-
-
-class LogRequest(BaseModel):
-    level: Literal["debug", "info", "warning", "error"] = "info"
-    message: str = Field(..., min_length=1, max_length=2048)
-
-
-class LogResponse(BaseModel):
-    ok: bool = True
@@ -1,59 +0,0 @@
-from collections.abc import Iterable
-from typing import Any
-
-from lnbits.core.models.extensions import ExtensionPermission, InstallableExtension
-from lnbits.core.wasm_ext.api.registry import extension_api_permission_ids
-
-
-def validate_extension_permissions(
-    ext_id: str,
-    permissions: Iterable[ExtensionPermission],
-    *,
-    strict: bool = True,
-) -> list[ExtensionPermission]:
-    known_permission_ids = extension_api_permission_ids()
-    normalized_permissions: list[ExtensionPermission] = []
-    unknown_ids: list[str] = []
-
-    for permission in permissions:
-        if permission.id not in known_permission_ids:
-            unknown_ids.append(permission.id)
-            if strict:
-                continue
-        normalized_permissions.append(permission.copy(update={"label": None}))
-
-    if unknown_ids and strict:
-        raise ValueError(
-            f"Extension '{ext_id}' requests unknown permissions: "
-            + ", ".join(sorted(set(unknown_ids)))
-        )
-
-    return normalized_permissions
-
-
-def validate_wasm_extension_permissions(
-    ext_info: InstallableExtension,
-    granted_permissions: list[ExtensionPermission] | None,
-    extension_config: dict[str, Any],
-) -> list[ExtensionPermission]:
-    if extension_config.get("extension_type") != "wasm":
-        return []
-
-    requested_permissions = validate_extension_permissions(
-        ext_info.id,
-        ExtensionPermission.list_from_config(extension_config),
-    )
-    if not requested_permissions:
-        return []
-
-    if granted_permissions is None:
-        raise ValueError(f"Extension '{ext_info.id}' requires permission approval.")
-
-    requested_ids = {permission.id for permission in requested_permissions}
-    granted_ids = {permission.id for permission in granted_permissions}
-    if requested_ids != granted_ids:
-        raise ValueError(
-            f"Extension '{ext_info.id}' was not granted all requested permissions."
-        )
-
-    return requested_permissions
@@ -1,199 +0,0 @@
-from __future__ import annotations
-
-import inspect
-from collections.abc import Awaitable, Callable
-from functools import wraps
-from typing import Any, TypeVar, cast, get_type_hints
-
-from pydantic import BaseModel
-
-from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
-
-_EXTENSION_API_METHOD_ATTR = "__lnbits_extension_api_method__"
-_EXTENSION_RUNTIME_PERMISSION_IDS = {"ui.camera.scan_qr"}
-_RequestModel = TypeVar("_RequestModel", bound=BaseModel)
-_ResponseModel = TypeVar("_ResponseModel", bound=BaseModel)
-
-
-def extension_api_method(
-    *,
-    method_id: str,
-    namespace: str,
-    name: str,
-    host_name: str,
-    sdk_name: str,
-    description: str,
-    host_interface: str = "host",
-    required_permission: str | None = None,
-    require_auth: bool = True,
-) -> Callable[
-    [Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]],
-    Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-]:
-    export = ExtensionAPIMethodExport(
-        method_id=method_id,
-        namespace=namespace,
-        name=name,
-        host_interface=host_interface,
-        host_name=host_name,
-        sdk_name=sdk_name,
-        description=description,
-        required_permission=required_permission,
-        require_auth=require_auth,
-    )
-
-    def decorator(
-        function: Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-    ) -> Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]:
-        @wraps(function)
-        async def wrapper(self: Any, request: _RequestModel) -> _ResponseModel:
-            api = getattr(self, "api", self)
-            if require_auth and not api.has_authenticated_context():
-                raise PermissionError(
-                    f"Extension API method '{method_id}' requires authentication."
-                )
-            api.require_permission(required_permission)
-            return await function(self, request)
-
-        setattr(wrapper, _EXTENSION_API_METHOD_ATTR, export)
-        return wrapper
-
-    return decorator
-
-
-def list_extension_api_methods(
-    api_cls: type[Any] | None = None,
-) -> list[ExtensionAPIMethod]:
-    api_cls = _default_api_cls(api_cls)
-    methods: list[ExtensionAPIMethod] = []
-
-    for prefix, method_cls in _extension_api_method_sources(api_cls):
-        for python_name, function in inspect.getmembers(method_cls, inspect.isfunction):
-            export = getattr(function, _EXTENSION_API_METHOD_ATTR, None)
-            if not export:
-                continue
-
-            request_model, response_model = _get_method_models(function)
-            methods.append(
-                ExtensionAPIMethod(
-                    method_id=export.method_id,
-                    namespace=export.namespace,
-                    name=export.name,
-                    python_name=f"{prefix}.{python_name}" if prefix else python_name,
-                    host_interface=export.host_interface,
-                    host_name=export.host_name,
-                    sdk_name=export.sdk_name,
-                    description=export.description,
-                    request_model=request_model,
-                    response_model=response_model,
-                    required_permission=export.required_permission,
-                    require_auth=export.require_auth,
-                )
-            )
-
-    return sorted(methods, key=lambda method: method.method_id)
-
-
-def extension_api_permission_ids(api_cls: type[Any] | None = None) -> set[str]:
-    permissions = {
-        method.required_permission
-        for method in list_extension_api_methods(api_cls)
-        if method.required_permission
-    }
-    permissions.update(_EXTENSION_RUNTIME_PERMISSION_IDS)
-    return permissions
-
-
-def get_extension_api_method(
-    method_id: str,
-    api_cls: type[Any] | None = None,
-) -> ExtensionAPIMethod:
-    for method in list_extension_api_methods(api_cls):
-        if method.method_id == method_id:
-            return method
-    raise KeyError(f"Unknown extension API method '{method_id}'.")
-
-
-def extension_api_contract(api_cls: type[Any] | None = None) -> dict[str, object]:
-    return {
-        "version": 1,
-        "methods": [
-            {
-                "id": method.method_id,
-                "namespace": method.namespace,
-                "name": method.name,
-                "python_name": method.python_name,
-                "host_interface": method.host_interface,
-                "host_name": method.host_name,
-                "sdk_name": method.sdk_name,
-                "sdk_qualified_name": method.sdk_qualified_name,
-                "description": method.description,
-                "required_permission": method.required_permission,
-                "require_auth": method.require_auth,
-                "request_schema": method.request_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-                "response_schema": method.response_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-            }
-            for method in list_extension_api_methods(api_cls)
-        ],
-    }
-
-
-def _default_api_cls(api_cls: type[Any] | None) -> type[Any]:
-    if api_cls is not None:
-        return api_cls
-
-    from .host import ExtensionHostAPI
-
-    return ExtensionHostAPI
-
-
-def _extension_api_method_sources(
-    api_cls: type[Any],
-) -> list[tuple[str, type[Any]]]:
-    sources: list[tuple[str, type[Any]]] = [("", api_cls)]
-
-    from .host import ExtensionHostAPI
-
-    if issubclass(api_cls, ExtensionHostAPI):
-        from .utils import extension_api_utils_method_classes
-
-        sources.extend(extension_api_utils_method_classes().items())
-    return sources
-
-
-def _get_method_models(
-    function: Callable[..., object],
-) -> tuple[type[BaseModel], type[BaseModel]]:
-    signature = inspect.signature(function)
-    request_parameters = [
-        parameter
-        for parameter in signature.parameters.values()
-        if parameter.name != "self"
-    ]
-    if len(request_parameters) != 1:
-        raise TypeError(
-            f"Extension API method '{function.__name__}' must accept one request model."
-        )
-
-    hints = get_type_hints(function)
-    request_model = hints.get(request_parameters[0].name)
-    response_model = hints.get("return")
-
-    if not _is_pydantic_model(request_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' request must be a BaseModel."
-        )
-    if not _is_pydantic_model(response_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' response must be a BaseModel."
-        )
-
-    return cast(type[BaseModel], request_model), cast(type[BaseModel], response_model)
-
-
-def _is_pydantic_model(value: object) -> bool:
-    return isinstance(value, type) and issubclass(value, BaseModel)
@@ -1,138 +0,0 @@
-from __future__ import annotations
-
-import inspect
-import re
-from collections.abc import Awaitable, Callable, Mapping
-from typing import Any
-
-from pydantic import BaseModel
-
-from .host import ExtensionHostAPI
-from .models import ExtensionAPIMethod
-from .registry import list_extension_api_methods
-
-HostImport = Callable[..., Awaitable[dict[str, Any]]]
-
-
-class ExtensionAPIHost:
-    def __init__(
-        self,
-        api: ExtensionHostAPI,
-        *,
-        api_cls: type[ExtensionHostAPI] = ExtensionHostAPI,
-    ) -> None:
-        self.api = api
-        self.methods = list_extension_api_methods(api_cls)
-        self._methods_by_host_name = self._index_methods(self.methods)
-
-    async def invoke(
-        self,
-        host_name: str,
-        payload: Mapping[str, Any] | BaseModel | None = None,
-    ) -> dict[str, Any]:
-        method = self._require_method(host_name)
-        request = self._request_model(method, payload)
-        handler = _resolve_attr_path(self.api, method.python_name)
-        response = handler(request)
-        if inspect.isawaitable(response):
-            response = await response
-        return self._response_payload(method, response)
-
-    def imports(self) -> dict[str, HostImport]:
-        return self.imports_for_interface("host")
-
-    def import_object(self) -> dict[str, dict[str, HostImport]]:
-        interfaces = sorted({method.host_interface for method in self.methods})
-        return {
-            f"lnbits:extension/{interface}": self.imports_for_interface(interface)
-            for interface in interfaces
-        }
-
-    def imports_for_interface(self, host_interface: str) -> dict[str, HostImport]:
-        return {
-            _snake_to_camel(method.host_name): self._make_import(method)
-            for method in self.methods
-            if method.host_interface == host_interface
-        }
-
-    def _make_import(self, method: ExtensionAPIMethod) -> HostImport:
-        async def host_import(
-            payload: Mapping[str, Any] | BaseModel | None = None,
-        ) -> dict[str, Any]:
-            return await self.invoke(method.method_id, payload)
-
-        return host_import
-
-    def _require_method(self, host_name: str) -> ExtensionAPIMethod:
-        method = self._methods_by_host_name.get(host_name)
-        if not method:
-            raise KeyError(f"Unknown extension host function '{host_name}'.")
-        return method
-
-    @staticmethod
-    def _index_methods(
-        methods: list[ExtensionAPIMethod],
-    ) -> dict[str, ExtensionAPIMethod]:
-        index: dict[str, ExtensionAPIMethod] = {}
-        for method in methods:
-            for host_name in {
-                method.method_id,
-                f"{method.host_interface}:{method.host_name}",
-                method.host_name,
-                _snake_to_camel(method.host_name),
-                method.host_name.replace("_", "-"),
-            }:
-                index[host_name] = method
-        return index
-
-    @staticmethod
-    def _request_model(
-        method: ExtensionAPIMethod,
-        payload: Mapping[str, Any] | BaseModel | None,
-    ) -> BaseModel:
-        if isinstance(payload, method.request_model):
-            return payload
-        if isinstance(payload, BaseModel):
-            payload = payload.dict()
-        if payload is None:
-            payload = {}
-        if not isinstance(payload, Mapping):
-            raise TypeError(
-                f"Host function '{method.host_name}' expects an object payload."
-            )
-        data = {_to_snake(key): value for key, value in payload.items()}
-        if isinstance(data.get("extra"), list):
-            data["extra"] = dict(data["extra"])
-        if isinstance(data.get("headers"), list):
-            data["headers"] = dict(data["headers"])
-        return method.request_model.parse_obj(data)
-
-    @staticmethod
-    def _response_payload(
-        method: ExtensionAPIMethod,
-        response: Any,
-    ) -> dict[str, Any]:
-        if not isinstance(response, method.response_model):
-            response = method.response_model.parse_obj(response)
-        payload = response.dict()
-        if method.method_id in {"http.request", "extension.api.request"} and isinstance(
-            payload.get("headers"), Mapping
-        ):
-            payload["headers"] = list(payload["headers"].items())
-        return {_snake_to_camel(key): value for key, value in payload.items()}
-
-
-def _snake_to_camel(value: str) -> str:
-    head, *tail = value.split("_")
-    return head + "".join(part.capitalize() for part in tail)
-
-
-def _to_snake(value: str) -> str:
-    value = value.replace("-", "_")
-    return re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", value).lower()
-
-
-def _resolve_attr_path(value: Any, path: str) -> Any:
-    for part in path.split("."):
-        value = getattr(value, part)
-    return value
@@ -1,387 +0,0 @@
-from __future__ import annotations
-
-import time
-from collections.abc import Iterable
-from datetime import datetime
-from typing import Any
-
-from lnbits import bolt11
-from lnbits.settings import settings
-from lnbits.utils.crypto import random_secret_and_hash, verify_preimage
-from lnbits.utils.exchange_rates import (
-    allowed_currencies,
-    fiat_amount_as_satoshis,
-    get_fiat_rate_and_price_satoshis,
-    satoshis_amount_as_fiat,
-)
-
-from .models import (
-    Bolt11Request,
-    CurrencyConvertRequest,
-    CurrencyConvertResponse,
-    CurrencyListResponse,
-    CurrencyRateRequest,
-    CurrencyRateResponse,
-    DecodeInvoiceResponse,
-    EmptyRequest,
-    FiatToSatsRequest,
-    FiatToSatsResponse,
-    InvoiceAmountMsatResponse,
-    InvoiceExpiryResponse,
-    InvoiceMemoResponse,
-    InvoicePaymentHashResponse,
-    RandomSecretAndHashRequest,
-    RandomSecretAndHashResponse,
-    SatsToFiatRequest,
-    SatsToFiatResponse,
-    ServerHealthResponse,
-    ValidateInvoiceResponse,
-    VerifyPreimageRequest,
-    VerifyPreimageResponse,
-)
-from .registry import extension_api_method
-
-
-class ExtensionAPIUtils:
-    def __init__(self, extension_id: str, permissions: Iterable[str]) -> None:
-        permission_set = set(permissions)
-        self.currencies = ExtensionCurrencyUtils(extension_id, permission_set)
-        self.server = ExtensionServerUtils(extension_id, permission_set)
-        self.lightning = ExtensionLightningUtils(extension_id, permission_set)
-
-
-class _ExtensionAPIUtilsGroup:
-    def __init__(self, extension_id: str, permissions: Iterable[str]) -> None:
-        self.extension_id = extension_id
-        self.permissions = set(permissions)
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
-            raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
-            )
-
-    def has_authenticated_context(self) -> bool:
-        return False
-
-
-class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
-    @extension_api_method(
-        method_id="utils.currencies.list",
-        namespace="utils.currencies",
-        name="List currencies",
-        host_interface="utils-currencies",
-        host_name="list_currencies",
-        sdk_name="list",
-        description="List currencies supported by LNbits exchange-rate conversion.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def list(self, request: EmptyRequest) -> CurrencyListResponse:
-
-        return CurrencyListResponse(currencies=allowed_currencies())
-
-    @extension_api_method(
-        method_id="utils.currencies.rate",
-        namespace="utils.currencies",
-        name="Get currency rate",
-        host_interface="utils-currencies",
-        host_name="rate",
-        sdk_name="rate",
-        description="Get sats-per-fiat and BTC price for a currency.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def rate(self, request: CurrencyRateRequest) -> CurrencyRateResponse:
-
-        rate, price = await get_fiat_rate_and_price_satoshis(request.currency)
-        return CurrencyRateResponse(rate=rate, price=price)
-
-    @extension_api_method(
-        method_id="utils.currencies.convert",
-        namespace="utils.currencies",
-        name="Convert currency amount",
-        host_interface="utils-currencies",
-        host_name="convert",
-        sdk_name="convert",
-        description="Convert between sats, BTC, and supported fiat currencies.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def convert(self, request: CurrencyConvertRequest) -> CurrencyConvertResponse:
-
-        from_currency = request.from_currency
-        if from_currency == "sats":
-            from_currency = "sat"
-
-        amounts: list[tuple[str, float]] = []
-        if from_currency == "sat":
-            sats = int(request.amount)
-            amounts.append(("BTC", sats / 100_000_000))
-            amounts.append(("sats", sats))
-            for currency in request.to.split(","):
-                currency = currency.strip()
-                if currency:
-                    amounts.append(
-                        (
-                            currency.upper(),
-                            await satoshis_amount_as_fiat(sats, currency),
-                        )
-                    )
-        else:
-            sats = await fiat_amount_as_satoshis(request.amount, from_currency)
-            amounts.append((from_currency.upper(), request.amount))
-            amounts.append(("sats", sats))
-            amounts.append(("BTC", sats / 100_000_000))
-        return CurrencyConvertResponse(amounts=amounts)
-
-    @extension_api_method(
-        method_id="utils.currencies.fiat_to_sats",
-        namespace="utils.currencies",
-        name="Convert fiat to sats",
-        host_interface="utils-currencies",
-        host_name="fiat_to_sats",
-        sdk_name="fiatToSats",
-        description="Convert a fiat amount to sats.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def fiat_to_sats(self, request: FiatToSatsRequest) -> FiatToSatsResponse:
-
-        return FiatToSatsResponse(
-            amount_sat=await fiat_amount_as_satoshis(
-                request.amount,
-                request.currency,
-            )
-        )
-
-    @extension_api_method(
-        method_id="utils.currencies.sats_to_fiat",
-        namespace="utils.currencies",
-        name="Convert sats to fiat",
-        host_interface="utils-currencies",
-        host_name="sats_to_fiat",
-        sdk_name="satsToFiat",
-        description="Convert a sats amount to fiat.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def sats_to_fiat(self, request: SatsToFiatRequest) -> SatsToFiatResponse:
-
-        return SatsToFiatResponse(
-            amount=await satoshis_amount_as_fiat(request.amount, request.currency)
-        )
-
-
-class ExtensionServerUtils(_ExtensionAPIUtilsGroup):
-    @extension_api_method(
-        method_id="utils.server.health",
-        namespace="utils.server",
-        name="Server health",
-        host_interface="utils-server",
-        host_name="health",
-        sdk_name="health",
-        description="Return basic public LNbits server health data.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def health(self, request: EmptyRequest) -> ServerHealthResponse:
-
-        return ServerHealthResponse(
-            server_time=int(time.time()),
-            up_time=settings.lnbits_server_up_time,
-        )
-
-
-class ExtensionLightningUtils(_ExtensionAPIUtilsGroup):
-    @extension_api_method(
-        method_id="utils.lightning.decode_invoice",
-        namespace="utils.lightning",
-        name="Decode Lightning invoice",
-        host_interface="utils-lightning",
-        host_name="decode_invoice",
-        sdk_name="decodeInvoice",
-        description="Decode a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def decode_invoice(self, request: Bolt11Request) -> DecodeInvoiceResponse:
-        invoice = _decode_bolt11(request.bolt11)
-        return _decoded_invoice_response(invoice)
-
-    @extension_api_method(
-        method_id="utils.lightning.validate_invoice",
-        namespace="utils.lightning",
-        name="Validate Lightning invoice",
-        host_interface="utils-lightning",
-        host_name="validate_invoice",
-        sdk_name="validateInvoice",
-        description="Validate whether a string is a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def validate_invoice(self, request: Bolt11Request) -> ValidateInvoiceResponse:
-        try:
-            _decode_bolt11(request.bolt11)
-            return ValidateInvoiceResponse(valid=True)
-        except Exception as exc:
-            return ValidateInvoiceResponse(valid=False, error=str(exc))
-
-    @extension_api_method(
-        method_id="utils.lightning.invoice_payment_hash",
-        namespace="utils.lightning",
-        name="Get Lightning invoice payment hash",
-        host_interface="utils-lightning",
-        host_name="invoice_payment_hash",
-        sdk_name="invoicePaymentHash",
-        description="Get the payment hash from a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def invoice_payment_hash(
-        self, request: Bolt11Request
-    ) -> InvoicePaymentHashResponse:
-        return InvoicePaymentHashResponse(
-            payment_hash=str(_decode_bolt11(request.bolt11).payment_hash)
-        )
-
-    @extension_api_method(
-        method_id="utils.lightning.invoice_amount_msat",
-        namespace="utils.lightning",
-        name="Get Lightning invoice amount",
-        host_interface="utils-lightning",
-        host_name="invoice_amount_msat",
-        sdk_name="invoiceAmountMsat",
-        description="Get the amount in msat from a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def invoice_amount_msat(
-        self, request: Bolt11Request
-    ) -> InvoiceAmountMsatResponse:
-        return InvoiceAmountMsatResponse(
-            amount_msat=_invoice_amount_msat(_decode_bolt11(request.bolt11))
-        )
-
-    @extension_api_method(
-        method_id="utils.lightning.invoice_expiry",
-        namespace="utils.lightning",
-        name="Get Lightning invoice expiry",
-        host_interface="utils-lightning",
-        host_name="invoice_expiry",
-        sdk_name="invoiceExpiry",
-        description="Get the expiry timestamp from a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def invoice_expiry(self, request: Bolt11Request) -> InvoiceExpiryResponse:
-        return InvoiceExpiryResponse(
-            expires_at=_invoice_expires_at(_decode_bolt11(request.bolt11))
-        )
-
-    @extension_api_method(
-        method_id="utils.lightning.invoice_memo",
-        namespace="utils.lightning",
-        name="Get Lightning invoice memo",
-        host_interface="utils-lightning",
-        host_name="invoice_memo",
-        sdk_name="invoiceMemo",
-        description="Get the memo from a BOLT11 Lightning invoice.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def invoice_memo(self, request: Bolt11Request) -> InvoiceMemoResponse:
-        return InvoiceMemoResponse(memo=_invoice_memo(_decode_bolt11(request.bolt11)))
-
-    @extension_api_method(
-        method_id="utils.lightning.verify_preimage",
-        namespace="utils.lightning",
-        name="Verify Lightning preimage",
-        host_interface="utils-lightning",
-        host_name="verify_preimage",
-        sdk_name="verifyPreimage",
-        description="Verify that a preimage matches a payment hash.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def verify_preimage(
-        self, request: VerifyPreimageRequest
-    ) -> VerifyPreimageResponse:
-
-        return VerifyPreimageResponse(
-            valid=verify_preimage(request.preimage, request.payment_hash)
-        )
-
-    @extension_api_method(
-        method_id="utils.lightning.random_secret_and_hash",
-        namespace="utils.lightning",
-        name="Random Lightning secret and hash",
-        host_interface="utils-lightning",
-        host_name="random_secret_and_hash",
-        sdk_name="randomSecretAndHash",
-        description="Create a random secret and matching SHA256 hash.",
-        required_permission="utils.basic",
-        require_auth=False,
-    )
-    async def random_secret_and_hash(
-        self, request: RandomSecretAndHashRequest
-    ) -> RandomSecretAndHashResponse:
-
-        secret, payment_hash = random_secret_and_hash(request.length)
-        return RandomSecretAndHashResponse(secret=secret, hash=payment_hash)
-
-
-def extension_api_utils_method_classes() -> dict[str, type[_ExtensionAPIUtilsGroup]]:
-    return {
-        "utils.currencies": ExtensionCurrencyUtils,
-        "utils.server": ExtensionServerUtils,
-        "utils.lightning": ExtensionLightningUtils,
-    }
-
-
-def _decode_bolt11(payment_request: str) -> Any:
-
-    return bolt11.decode(payment_request)
-
-
-def _decoded_invoice_response(invoice: Any) -> DecodeInvoiceResponse:
-    return DecodeInvoiceResponse(
-        payment_hash=str(getattr(invoice, "payment_hash", "")) or None,
-        amount_msat=_invoice_amount_msat(invoice),
-        expiry=_invoice_expiry(invoice),
-        expires_at=_invoice_expires_at(invoice),
-        memo=_invoice_memo(invoice),
-    )
-
-
-def _invoice_amount_msat(invoice: Any) -> int | None:
-    amount_msat = getattr(invoice, "amount_msat", None)
-    if amount_msat is None:
-        return None
-    return int(amount_msat)
-
-
-def _invoice_expiry(invoice: Any) -> int | None:
-    expiry = getattr(invoice, "expiry", None)
-    if expiry is None:
-        return None
-    return int(expiry)
-
-
-def _invoice_expires_at(invoice: Any) -> int | None:
-    expiry_date = getattr(invoice, "expiry_date", None)
-    if isinstance(expiry_date, datetime):
-        return int(expiry_date.timestamp())
-
-    date = getattr(invoice, "date", None)
-    expiry = getattr(invoice, "expiry", None)
-    if isinstance(date, datetime) and expiry is not None:
-        return int(date.timestamp() + int(expiry))
-    if isinstance(date, (int, float)) and expiry is not None:
-        return int(date + int(expiry))
-    return None
-
-
-def _invoice_memo(invoice: Any) -> str | None:
-    memo = getattr(invoice, "description", None)
-    return str(memo) if memo is not None else None
@@ -1,4 +0,0 @@
-from .extensions import send_extension_api_request
-from .http import send_extension_http_request
-
-__all__ = ["send_extension_api_request", "send_extension_http_request"]
@@ -1,196 +0,0 @@
-from __future__ import annotations
-
-import posixpath
-import re
-from typing import Any
-from urllib.parse import unquote, urlsplit, urlunsplit
-
-import httpx
-
-from lnbits.core.crud.extensions import (
-    get_installed_extension,
-    get_user_active_extensions_ids,
-)
-from lnbits.settings import settings
-
-from ..api.models import ExtensionApiRequest, HttpResponse
-
-EXTENSION_API_TIMEOUT_SECONDS = 10.0
-EXTENSION_API_MAX_RESPONSE_BYTES = 262_144
-
-_READ_METHODS = {"GET", "HEAD"}
-_WRITE_METHODS = {"DELETE", "PATCH", "POST", "PUT"}
-_EXTENSION_ID_RE = re.compile(r"^[A-Za-z0-9_-]+$")
-_FORBIDDEN_RESPONSE_HEADERS = {
-    "connection",
-    "content-length",
-    "set-cookie",
-    "transfer-encoding",
-}
-
-
-async def send_extension_api_request(
-    caller_extension_id: str,
-    policies: list[Any],
-    user_id: str | None,
-    access_token: str | None,
-    request: ExtensionApiRequest,
-) -> HttpResponse:
-    if not user_id:
-        raise PermissionError("Extension API requests require authentication.")
-    if not access_token:
-        raise PermissionError("Extension API requests require an account access token.")
-
-    target_extension_id = _target_extension_id(request.extension_id)
-    access = _target_extension_access(policies, target_extension_id)
-    _require_method_access(caller_extension_id, target_extension_id, access, request)
-    await _require_enabled_extension(target_extension_id, user_id)
-
-    path = _extension_api_path(request.path)
-    body = request.body.encode() if request.body is not None else b""
-    if len(body) > 65_536:
-        raise ValueError("Extension API request body is too large.")
-
-    url = f"http://{settings.host}:{settings.port}/{target_extension_id}{path}"
-    try:
-        async with httpx.AsyncClient(
-            follow_redirects=False,
-            timeout=EXTENSION_API_TIMEOUT_SECONDS,
-            trust_env=False,
-        ) as client:
-            async with client.stream(
-                request.method,
-                url,
-                headers={"Authorization": f"Bearer {access_token}"},
-                content=body,
-            ) as response:
-                response_body = await _read_limited_response(response)
-                return HttpResponse(
-                    status_code=response.status_code,
-                    headers=_response_headers(dict(response.headers)),
-                    body=response_body.decode(response.encoding or "utf-8", "replace"),
-                )
-    except httpx.RequestError as exc:
-        raise ValueError("Extension API request failed.") from exc
-
-
-def _target_extension_id(extension_id: str) -> str:
-    target = extension_id.strip()
-    if not target or not _EXTENSION_ID_RE.match(target):
-        raise PermissionError("Extension API request has an invalid target extension.")
-    return target
-
-
-def _target_extension_access(policies: list[Any], target_extension_id: str) -> set[str]:
-    if not isinstance(policies, list) or not policies:
-        raise PermissionError(
-            "Extension API requests require a non-empty extensions policy."
-        )
-
-    for extension in policies:
-        if isinstance(extension, str):
-            extension_id = extension
-            access = ["read"]
-        elif isinstance(extension, dict):
-            raw_extension_id = extension.get("id")
-            raw_access = extension.get("access")
-            if not isinstance(raw_extension_id, str):
-                continue
-            if not isinstance(raw_access, list):
-                raise PermissionError(
-                    f"Extension API target '{target_extension_id}' "
-                    "has no access policy."
-                )
-            extension_id = raw_extension_id
-            access = raw_access
-        else:
-            continue
-
-        if extension_id != target_extension_id:
-            continue
-        clean_access = {
-            item
-            for item in access
-            if isinstance(item, str) and item in {"read", "write"}
-        }
-        if clean_access:
-            return clean_access
-        break
-
-    raise PermissionError(
-        f"Extension API target '{target_extension_id}' is not allowed."
-    )
-
-
-def _require_method_access(
-    caller_extension_id: str,
-    target_extension_id: str,
-    access: set[str],
-    request: ExtensionApiRequest,
-) -> None:
-    if request.method in _READ_METHODS:
-        required_access = "read"
-    elif request.method in _WRITE_METHODS:
-        required_access = "write"
-    else:
-        raise PermissionError("Extension API request method is not allowed.")
-
-    if required_access not in access:
-        raise PermissionError(
-            f"Extension '{caller_extension_id}' cannot {required_access} "
-            f"extension '{target_extension_id}'."
-        )
-
-
-async def _require_enabled_extension(target_extension_id: str, user_id: str) -> None:
-    extension = await get_installed_extension(target_extension_id)
-    if not extension or not extension.active:
-        raise PermissionError(
-            f"Target extension '{target_extension_id}' is not installed or enabled."
-        )
-
-    active_extensions = await get_user_active_extensions_ids(user_id)
-    if target_extension_id not in active_extensions:
-        raise PermissionError(
-            f"Target extension '{target_extension_id}' is not active for this user."
-        )
-
-
-def _extension_api_path(path: str) -> str:
-    parts = urlsplit(path)
-    if parts.scheme or parts.netloc:
-        raise PermissionError("Extension API request path must be relative.")
-    if parts.fragment:
-        raise PermissionError("Extension API request path cannot include a fragment.")
-    if not parts.path.startswith("/api/"):
-        raise PermissionError("Extension API request path must start with '/api/'.")
-
-    decoded_path = unquote(parts.path)
-    path_parts = decoded_path.split("/")
-    if any(part == ".." for part in path_parts):
-        raise PermissionError("Extension API request path cannot traverse directories.")
-
-    normalized = posixpath.normpath(decoded_path)
-    if normalized != decoded_path.rstrip("/") or not normalized.startswith("/api/"):
-        raise PermissionError("Extension API request path is invalid.")
-
-    return urlunsplit(("", "", parts.path, parts.query, ""))
-
-
-async def _read_limited_response(response: httpx.Response) -> bytes:
-    chunks: list[bytes] = []
-    size = 0
-    async for chunk in response.aiter_bytes():
-        size += len(chunk)
-        if size > EXTENSION_API_MAX_RESPONSE_BYTES:
-            raise ValueError("Extension API response is too large.")
-        chunks.append(chunk)
-    return b"".join(chunks)
-
-
-def _response_headers(headers: dict[str, str]) -> dict[str, str]:
-    return {
-        key: value
-        for key, value in headers.items()
-        if key.lower() not in _FORBIDDEN_RESPONSE_HEADERS
-    }
@@ -1,183 +0,0 @@
-from __future__ import annotations
-
-import ipaddress
-import socket
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-
-from ..api.models import HttpRequest, HttpResponse
-
-HTTP_REQUEST_TIMEOUT_SECONDS = 10.0
-HTTP_MAX_RESPONSE_BYTES = 262_144
-
-_FORBIDDEN_REQUEST_HEADERS = {
-    "connection",
-    "content-length",
-    "cookie",
-    "host",
-    "proxy-authorization",
-    "transfer-encoding",
-}
-_FORBIDDEN_RESPONSE_HEADERS = {
-    "connection",
-    "content-length",
-    "set-cookie",
-    "transfer-encoding",
-}
-
-
-async def send_extension_http_request(
-    extension_id: str,
-    policies: list[Any],
-    request: HttpRequest,
-) -> HttpResponse:
-    allowed_origins = _allowed_origins(policies)
-    origin = _request_origin(request.url)
-    if origin not in allowed_origins:
-        raise PermissionError(
-            f"Extension '{extension_id}' is not allowed to request '{origin}'."
-        )
-
-    await _reject_internal_host(request.url)
-    headers = _request_headers(request.headers)
-    body = request.body.encode() if request.body is not None else b""
-    if len(body) > 65_536:
-        raise ValueError("HTTP request body is too large.")
-
-    try:
-        async with httpx.AsyncClient(
-            follow_redirects=False,
-            timeout=HTTP_REQUEST_TIMEOUT_SECONDS,
-            trust_env=False,
-        ) as client:
-            async with client.stream(
-                request.method,
-                request.url,
-                headers=headers,
-                content=body,
-            ) as response:
-                response_body = await _read_limited_response(response)
-                return HttpResponse(
-                    status_code=response.status_code,
-                    headers=_response_headers(dict(response.headers)),
-                    body=response_body.decode(response.encoding or "utf-8", "replace"),
-                )
-    except httpx.RequestError as exc:
-        raise ValueError("HTTP request failed.") from exc
-
-
-def _allowed_origins(policies: list[Any]) -> set[str]:
-    if not isinstance(policies, list) or not policies:
-        raise PermissionError("HTTP requests require a non-empty hosts policy.")
-
-    origins: set[str] = set()
-    for policy in policies:
-        host = policy.get("host") if isinstance(policy, dict) else policy
-        if not isinstance(host, str) or not host:
-            continue
-        origins.add(_request_origin(host))
-    if not origins:
-        raise PermissionError("HTTP requests require at least one valid host.")
-    return origins
-
-
-def _request_origin(url: str) -> str:
-    parsed = urlparse(url)
-    if parsed.scheme != "https":
-        raise PermissionError("HTTP requests require https URLs.")
-    if parsed.username or parsed.password:
-        raise PermissionError("HTTP requests cannot include credentials in URLs.")
-    if not parsed.hostname:
-        raise PermissionError("HTTP requests require a hostname.")
-
-    hostname = parsed.hostname.lower()
-    port = _url_port(parsed)
-    if port is None or port == 443:
-        return f"https://{hostname}"
-    return f"https://{hostname}:{port}"
-
-
-def _url_port(parsed: Any) -> int | None:
-    try:
-        return parsed.port
-    except ValueError as exc:
-        raise PermissionError("HTTP request URL has an invalid port.") from exc
-
-
-async def _reject_internal_host(url: str) -> None:
-    parsed = urlparse(url)
-    hostname = parsed.hostname
-    if not hostname:
-        raise PermissionError("HTTP requests require a hostname.")
-    if hostname == "localhost" or hostname.endswith(".localhost"):
-        raise PermissionError("HTTP requests cannot target localhost.")
-
-    try:
-        address = ipaddress.ip_address(hostname)
-        _reject_internal_address(address)
-        return
-    except ValueError:
-        pass
-
-    for address in await _resolve_host(hostname):
-        _reject_internal_address(address)
-
-
-async def _resolve_host(
-    hostname: str,
-) -> list[ipaddress.IPv4Address | ipaddress.IPv6Address]:
-    import asyncio
-
-    def resolve() -> list[ipaddress.IPv4Address | ipaddress.IPv6Address]:
-        try:
-            infos = socket.getaddrinfo(hostname, None, type=socket.SOCK_STREAM)
-        except socket.gaierror as exc:
-            raise PermissionError("HTTP request host could not be resolved.") from exc
-
-        addresses: list[ipaddress.IPv4Address | ipaddress.IPv6Address] = []
-        for info in infos:
-            sockaddr = info[4]
-            addresses.append(ipaddress.ip_address(sockaddr[0]))
-        return addresses
-
-    return await asyncio.to_thread(resolve)
-
-
-def _reject_internal_address(
-    address: ipaddress.IPv4Address | ipaddress.IPv6Address,
-) -> None:
-    if not address.is_global:
-        raise PermissionError("HTTP requests cannot target internal network addresses.")
-
-
-def _request_headers(headers: dict[str, str]) -> dict[str, str]:
-    clean: dict[str, str] = {}
-    for key, value in headers.items():
-        header = key.strip()
-        if not header:
-            continue
-        if header.lower() in _FORBIDDEN_REQUEST_HEADERS:
-            continue
-        clean[header] = value
-    return clean
-
-
-async def _read_limited_response(response: httpx.Response) -> bytes:
-    chunks: list[bytes] = []
-    size = 0
-    async for chunk in response.aiter_bytes():
-        size += len(chunk)
-        if size > HTTP_MAX_RESPONSE_BYTES:
-            raise ValueError("HTTP response is too large.")
-        chunks.append(chunk)
-    return b"".join(chunks)
-
-
-def _response_headers(headers: dict[str, str]) -> dict[str, str]:
-    return {
-        key: value
-        for key, value in headers.items()
-        if key.lower() not in _FORBIDDEN_RESPONSE_HEADERS
-    }
@@ -1,3 +0,0 @@
-from .register import register_wasm_extension
-
-__all__ = ["register_wasm_extension"]
@@ -1,168 +0,0 @@
-from __future__ import annotations
-
-import json
-import re
-from typing import Annotated, Any
-
-from fastapi import Depends, FastAPI, HTTPException, Request
-
-from lnbits.core.models import Account
-from lnbits.decorators import check_access_token, check_account_exists
-
-from ..wasm.invoke import invoke_wasm_extension_export
-from ..wasm.loader import WasmExtension
-
-
-def register_wasm_extension_api_routes(app: FastAPI, extension: WasmExtension) -> None:
-    for route_config in extension.config.get("api_routes") or []:
-        _add_wasm_extension_api_route(app, extension, route_config)
-
-
-def _add_wasm_extension_api_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_config: dict[str, Any],
-) -> None:
-    method = _wasm_extension_api_method(extension, route_config.get("method"))
-    route_path = _wasm_extension_api_path(extension, route_config.get("path"))
-    export_name = _wasm_extension_api_export(extension, route_config.get("export"))
-    path_params = route_config.get("path_params") or {}
-    auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-
-    if _has_route(app, route_path, method):
-        return
-
-    async def invoke_wasm_api_request(
-        request: Request,
-        account: Account | None = None,
-        access_token: str | None = None,
-    ) -> dict[str, Any]:
-        try:
-            payload = await _read_api_payload(request, path_params)
-            return await invoke_wasm_extension_export(
-                extension.id,
-                export_name,
-                payload,
-                user=account,
-                access_token=access_token,
-            )
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=str(exc)) from exc
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-    async def invoke_private_wasm_extension_export(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        account: Account = Depends(check_account_exists),
-    ) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request, account, access_token)
-
-    async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request)
-
-    app.add_api_route(
-        route_path,
-        (
-            invoke_public_wasm_extension_export
-            if auth == "public"
-            else invoke_private_wasm_extension_export
-        ),
-        methods=[method],
-        name=f"{extension.id}:{method}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-async def _read_api_payload(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload = _read_api_path_params(request, path_params)
-    payload.update(_read_api_query_params(request))
-    if request.method in {"POST", "PUT", "PATCH"}:
-        payload.update(await _read_json_object(request))
-    return payload
-
-
-async def _read_json_object(request: Request) -> dict[str, Any]:
-    body = await request.body()
-    if not body:
-        return {}
-    value = json.loads(body)
-    if not isinstance(value, dict):
-        raise TypeError("WASM extension API payload must be a JSON object.")
-    return value
-
-
-def _read_api_path_params(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload: dict[str, Any] = {}
-    for key, value in request.path_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_api_query_params(request: Request) -> dict[str, Any]:
-    return {_snake_to_camel(key): value for key, value in request.query_params.items()}
-
-
-def _wasm_extension_api_export(extension: WasmExtension, export_name: Any) -> str:
-    if not isinstance(export_name, str) or not export_name:
-        raise ValueError(f"Invalid API export for WASM extension '{extension.id}'.")
-
-    for export in extension.exports:
-        if export.get("name") != export_name:
-            continue
-        if export.get("visibility") in {"public", "authenticated"}:
-            return export_name
-        raise PermissionError(f"WASM export '{export_name}' is not callable over HTTP.")
-    raise KeyError(f"WASM extension '{extension.id}' has no export '{export_name}'.")
-
-
-def _wasm_extension_api_method(extension: WasmExtension, method: Any) -> str:
-    if not isinstance(method, str):
-        raise ValueError(f"Invalid API method for WASM extension '{extension.id}'.")
-    method = method.upper()
-    if method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
-        raise ValueError(f"Unsupported API method for WASM extension '{extension.id}'.")
-    return method
-
-
-def _wasm_extension_api_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid API path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return f"/api/v1/ext/{extension.id}"
-    return f"/api/v1/ext/{extension.id}{path}"
-
-
-def _wasm_extension_route_auth(extension: WasmExtension, auth: Any) -> str:
-    if auth in {"public", "user"}:
-        return auth
-    raise ValueError(f"Invalid route auth for WASM extension '{extension.id}'.")
-
-
-def _has_route(app: FastAPI, route_path: str, method: str) -> bool:
-    for route in app.routes:
-        if getattr(route, "path", None) != route_path:
-            continue
-        methods = getattr(route, "methods", set()) or set()
-        if method in methods:
-            return True
-    return False
-
-
-def _snake_to_camel(value: str) -> str:
-    head, *tail = value.split("_")
-    return head + "".join(part.capitalize() for part in tail)
-
-
-def _path_template_pattern(path: str) -> str:
-    pattern = re.sub(r"\\{[^/{}]+\\}", r"[^/]+", re.escape(path))
-    return f"^{pattern}$"
@@ -1,139 +0,0 @@
-from __future__ import annotations
-
-import os
-from pathlib import Path
-
-from fastapi import FastAPI, HTTPException
-from fastapi.responses import FileResponse, Response
-from fastapi.staticfiles import StaticFiles
-from starlette.staticfiles import PathLike as StaticFilesPathLike
-from starlette.types import Scope
-
-from lnbits.settings import settings
-
-from ..wasm.loader import WasmExtension
-
-WASM_EXTENSION_CORE_ASSET_PREFIX = "_lnbits"
-WASM_EXTENSION_CORE_STATIC_ASSETS = {
-    "bundle.min.css": ("static/bundle.min.css", "text/css; charset=utf-8"),
-    "material-icons-v50.woff2": (
-        "static/fonts/material-icons-v50.woff2",
-        "font/woff2",
-    ),
-    "quasar.css": ("static/vendor/quasar.css", "text/css; charset=utf-8"),
-    "quasar.umd.prod.js": (
-        "static/vendor/quasar.umd.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "qrcode.vue.browser.js": (
-        "static/vendor/qrcode.vue.browser.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "vue.global.prod.js": (
-        "static/vendor/vue.global.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-}
-WASM_EXTENSION_GENERATED_CORE_ASSETS = {
-    "material-icons.css": (
-        """
-        @font-face {
-          font-family: 'Material Icons';
-          font-style: normal;
-          font-weight: 400;
-          src: url('./material-icons-v50.woff2') format('woff2');
-        }
-        """,
-        "text/css; charset=utf-8",
-    )
-}
-WASM_EXTENSION_STATIC_MIME_TYPES = {
-    ".css": "text/css; charset=utf-8",
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".jpeg": "image/jpeg",
-    ".jpg": "image/jpeg",
-    ".js": "text/javascript; charset=utf-8",
-    ".png": "image/png",
-    ".webp": "image/webp",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2",
-}
-WASM_EXTENSION_TEXT_STATIC_EXTENSIONS = {".css", ".js"}
-WASM_EXTENSION_HTML_PREFIXES = (b"<!doctype", b"<html", b"<script")
-
-
-class GuardedWasmExtensionStaticFiles(StaticFiles):
-    async def get_response(self, path: str, scope: Scope) -> Response:
-        if path.startswith(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/"):
-            return _wasm_extension_core_asset_response(path)
-        if Path(path).suffix.lower() not in WASM_EXTENSION_STATIC_MIME_TYPES:
-            raise HTTPException(status_code=404)
-        return await super().get_response(path, scope)
-
-    def file_response(
-        self,
-        full_path: StaticFilesPathLike,
-        stat_result: os.stat_result,
-        scope: Scope,
-        status_code: int = 200,
-    ) -> Response:
-        suffix = Path(full_path).suffix.lower()
-        if suffix in WASM_EXTENSION_TEXT_STATIC_EXTENSIONS:
-            _reject_html_like_wasm_static_asset(Path(full_path))
-
-        response = super().file_response(full_path, stat_result, scope, status_code)
-        response.headers["Content-Type"] = WASM_EXTENSION_STATIC_MIME_TYPES[suffix]
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-
-def mount_wasm_extension_static(app: FastAPI, extension: WasmExtension) -> None:
-    static_path = extension.root_path / "static"
-
-    mount_path = f"/ext-assets/{extension.id}"
-    if any(getattr(route, "path", None) == mount_path for route in app.routes):
-        return
-
-    app.mount(
-        mount_path,
-        GuardedWasmExtensionStaticFiles(directory=static_path, check_dir=False),
-        name=f"{extension.id}-static",
-    )
-
-
-def _reject_html_like_wasm_static_asset(path: Path) -> None:
-    with path.open("rb") as asset_file:
-        prefix = asset_file.read(512).lstrip().lower()
-    if prefix.startswith(WASM_EXTENSION_HTML_PREFIXES):
-        raise HTTPException(status_code=404)
-
-
-def _wasm_extension_core_asset_response(path: str) -> Response:
-    asset_name = path.removeprefix(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/")
-    if not asset_name or "/" in asset_name or "\\" in asset_name:
-        raise HTTPException(status_code=404)
-
-    generated_asset = WASM_EXTENSION_GENERATED_CORE_ASSETS.get(asset_name)
-    if generated_asset:
-        content, content_type = generated_asset
-        response = Response(content=content, media_type=content_type)
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-    asset_config = WASM_EXTENSION_CORE_STATIC_ASSETS.get(asset_name)
-    if not asset_config:
-        raise HTTPException(status_code=404)
-
-    relative_path, content_type = asset_config
-    asset_path = Path(settings.lnbits_path, relative_path)
-    if not asset_path.is_file():
-        raise HTTPException(status_code=404)
-
-    response = FileResponse(asset_path)
-    response.headers["Content-Type"] = content_type
-    response.headers["X-Content-Type-Options"] = "nosniff"
-    response.headers["Cache-Control"] = "no-store"
-    return response
@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from fastapi import FastAPI
-from loguru import logger
-
-from lnbits.core.db import core_app_extra
-from lnbits.settings import settings
-
-from ..wasm.component import warm_wasm_extension
-from ..wasm.loader import WasmExtension, load_wasm_extension
-from .api import register_wasm_extension_api_routes
-from .assets import mount_wasm_extension_static
-from .ui import register_wasm_extension_ui_routes
-
-
-def register_wasm_extension(app: FastAPI, ext_id: str) -> WasmExtension:
-    loaded = load_wasm_extension(ext_id)
-
-    warm_wasm_extension(loaded)
-    mount_wasm_extension_static(app, loaded)
-    register_wasm_extension_ui_routes(app, loaded)
-    register_wasm_extension_api_routes(app, loaded)
-
-    core_app_extra.wasm_extension_registry.register(loaded)
-
-    settings.activate_extension_paths(ext_id, "", [])
-    logger.info(
-        f"Loaded WASM extension '{loaded.id}' "
-        f"({loaded.module_path.stat().st_size} bytes)."
-    )
-    return loaded
@@ -1,127 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, NoReturn
-from uuid import uuid4
-
-from fastapi import HTTPException, Request
-from loguru import logger
-
-from lnbits.helpers import template_renderer
-from lnbits.utils.cache import cache
-
-from ..wasm.loader import WasmExtension
-
-WASM_FRAME_TOKEN_EXPIRY_SECONDS = 60
-
-
-def wasm_extension_wrapper_response(
-    request: Request,
-    extension: WasmExtension,
-    auth: str,
-    user_json: str | None,
-) -> Any:
-    public = auth == "public"
-    response = template_renderer().TemplateResponse(
-        request,
-        "wasm_extension.html",
-        {
-            "extension": extension,
-            "public": public,
-            "user": user_json,
-        },
-    )
-    response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
-    response.headers["X-Frame-Options"] = "SAMEORIGIN"
-    return response
-
-
-def wasm_extension_frame_csp(request: Request, extension: WasmExtension) -> str:
-    origin = str(request.base_url).rstrip("/")
-    extension_assets = f"{origin}/ext-assets/{extension.id}/"
-    return (
-        "sandbox allow-scripts; "
-        "default-src 'none'; "
-        f"script-src {extension_assets}; "
-        "script-src-attr 'none'; "
-        f"style-src {extension_assets}; "
-        "style-src-attr 'none'; "
-        f"img-src {extension_assets} data:; "
-        f"font-src {extension_assets}; "
-        "connect-src 'none'; "
-        "form-action 'none'; "
-        "object-src 'none'; "
-        "base-uri 'none'; "
-        "frame-src 'none'; "
-        "worker-src 'none'; "
-        "media-src 'none'; "
-        "manifest-src 'none'; "
-        "frame-ancestors 'self'"
-    )
-
-
-def wasm_extension_frame_url(
-    extension: WasmExtension, frame_path: str, user_id: str | None
-) -> str:
-    token = _create_wasm_extension_frame_token(extension, frame_path, user_id)
-    return f"{frame_path}?frame_token={token}"
-
-
-def consume_wasm_extension_frame_token(
-    request: Request,
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> None:
-    token = request.query_params.get("frame_token")
-    if not token:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "missing")
-
-    cache_key = _wasm_extension_frame_token_cache_key(token)
-    token_data = cache.get(cache_key)
-    if (
-        not isinstance(token_data, dict)
-        or token_data.get("extension_id") != extension.id
-        or token_data.get("frame_path") != frame_path
-    ):
-        _raise_wasm_extension_frame_not_found(
-            extension, frame_path, "unknown or expired"
-        )
-
-    token_user_id = token_data.get("user_id")
-    if token_user_id and token_user_id != user_id:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "wrong user")
-
-    cache.pop(cache_key)
-
-
-def _create_wasm_extension_frame_token(
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> str:
-    token = uuid4().hex
-    cache.set(
-        _wasm_extension_frame_token_cache_key(token),
-        {
-            "extension_id": extension.id,
-            "frame_path": frame_path,
-            "user_id": user_id,
-        },
-        expiry=WASM_FRAME_TOKEN_EXPIRY_SECONDS,
-    )
-    return token
-
-
-def _wasm_extension_frame_token_cache_key(token: str) -> str:
-    return f"wasm-frame-token:{token}"
-
-
-def _raise_wasm_extension_frame_not_found(
-    extension: WasmExtension,
-    frame_path: str,
-    reason: str,
-) -> NoReturn:
-    logger.warning(
-        f"WASM frame token {reason} for extension '{extension.id}' at '{frame_path}'."
-    )
-    raise HTTPException(status_code=404, detail="Not found")
@@ -1,368 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Annotated, Any
-
-from fastapi import Depends, FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse
-from pydantic import UUID4
-
-from lnbits.core.crud import get_installed_extension, get_user_from_account
-from lnbits.core.models import Account
-from lnbits.decorators import (
-    check_access_token,
-    check_account_exists,
-    optional_user_id,
-)
-
-from ..wasm.loader import WasmExtension
-from .api import (
-    _has_route,
-    _path_template_pattern,
-    _read_json_object,
-    _snake_to_camel,
-    _wasm_extension_api_export,
-    _wasm_extension_api_method,
-    _wasm_extension_api_path,
-    _wasm_extension_route_auth,
-)
-from .security import (
-    consume_wasm_extension_frame_token,
-    wasm_extension_frame_csp,
-    wasm_extension_frame_url,
-    wasm_extension_wrapper_response,
-)
-
-
-def register_wasm_extension_ui_routes(app: FastAPI, extension: WasmExtension) -> None:
-    _add_wasm_extension_frame_config_route(app, extension)
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        entrypoint = _wasm_extension_entrypoint(
-            extension, route_config.get("entrypoint")
-        )
-        frame_path = f"/ext-frame/{extension.id}/{route_index}"
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        _add_wasm_extension_frame_route(app, extension, frame_path, entrypoint)
-        _add_wasm_extension_wrapper_route(
-            app,
-            extension,
-            route_path,
-            auth,
-        )
-
-
-def _add_wasm_extension_frame_config_route(
-    app: FastAPI,
-    extension: WasmExtension,
-) -> None:
-    route_path = _wasm_extension_frame_config_path(extension)
-    if _has_route(app, route_path, "POST"):
-        return
-
-    async def create_wasm_extension_frame_config(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        usr: UUID4 | None = None,
-    ) -> dict[str, Any]:
-        try:
-            body = await _read_json_object(request)
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-        ui_route = _match_wasm_extension_ui_route(extension, body.get("path"))
-        auth = ui_route["auth"]
-
-        if auth == "user":
-            account = await check_account_exists(request, access_token, usr)
-            user_id: str | None = account.id
-        else:
-            user_id = await _optional_wasm_user_id(request, access_token, usr)
-
-        granted_permission_ids = await _wasm_extension_granted_permission_ids(extension)
-
-        return _wasm_extension_frame_config(
-            extension,
-            ui_route["frame_path"],
-            auth,
-            ui_route["path_params"],
-            ui_route["route_params"],
-            _read_wasm_extension_route_query(body.get("query")),
-            user_id,
-            granted_permission_ids,
-        )
-
-    app.add_api_route(
-        route_path,
-        create_wasm_extension_frame_config,
-        methods=["POST"],
-        name=f"{extension.id}:frame-config",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_wrapper_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_path: str,
-    auth: str,
-) -> None:
-    if _has_route(app, route_path, "GET"):
-        return
-
-    async def serve_private_wasm_extension_page(
-        request: Request,
-        account: Account = Depends(check_account_exists),
-    ) -> Any:
-        user = await get_user_from_account(account)
-        return wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            user.json() if user else None,
-        )
-
-    async def serve_public_wasm_extension_page(request: Request) -> Any:
-        return wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            None,
-        )
-
-    app.add_api_route(
-        route_path,
-        (
-            serve_public_wasm_extension_page
-            if auth == "public"
-            else serve_private_wasm_extension_page
-        ),
-        methods=["GET"],
-        name=f"{extension.id}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_frame_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    frame_path: str,
-    entrypoint: Path,
-) -> None:
-    if _has_route(app, frame_path, "GET"):
-        return
-
-    async def serve_wasm_extension_frame(
-        request: Request,
-        user_id: str | None = Depends(_optional_wasm_user_id),
-    ) -> FileResponse:
-        consume_wasm_extension_frame_token(request, extension, frame_path, user_id)
-        response = FileResponse(entrypoint)
-        response.headers["Content-Security-Policy"] = wasm_extension_frame_csp(
-            request, extension
-        )
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
-        response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
-        # Extension access goes through the parent bridge.
-        response.headers["Permissions-Policy"] = (
-            "camera=(), microphone=(), geolocation=(), payment=(), "
-            "clipboard-read=(), usb=()"
-        )
-        response.headers["Referrer-Policy"] = "no-referrer"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        return response
-
-    app.add_api_route(
-        frame_path,
-        serve_wasm_extension_frame,
-        methods=["GET"],
-        name=f"{extension.id}:frame:{frame_path}",
-        include_in_schema=False,
-    )
-
-
-def _wasm_extension_bridge_api_routes(
-    extension: WasmExtension,
-    public: bool,
-) -> list[dict[str, str]]:
-    routes: list[dict[str, str]] = []
-    for route_config in extension.config.get("api_routes") or []:
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        if public and auth != "public":
-            continue
-        method = _wasm_extension_api_method(extension, route_config.get("method"))
-        path = _wasm_extension_api_path(extension, route_config.get("path"))
-        _wasm_extension_api_export(extension, route_config.get("export"))
-        routes.append(
-            {
-                "method": method,
-                "path": path,
-                "pattern": _path_template_pattern(path),
-            }
-        )
-    return routes
-
-
-def _wasm_extension_frame_config_path(extension: WasmExtension) -> str:
-    return f"/api/v1/ext/{extension.id}/_ui/frame"
-
-
-def _match_wasm_extension_ui_route(
-    extension: WasmExtension,
-    path: Any,
-) -> dict[str, Any]:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise HTTPException(status_code=404, detail="Not found")
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        route_params = _path_template_params(route_path, path)
-        if route_params is None:
-            continue
-
-        return {
-            "frame_path": f"/ext-frame/{extension.id}/{route_index}",
-            "auth": _wasm_extension_route_auth(extension, route_config.get("auth")),
-            "path_params": route_config.get("path_params") or {},
-            "route_params": route_params,
-        }
-
-    raise HTTPException(status_code=404, detail="Not found")
-
-
-def _path_template_params(template: str, path: str) -> dict[str, str] | None:
-    template_parts = _path_parts(template)
-    path_parts = _path_parts(path)
-    if len(template_parts) != len(path_parts):
-        return None
-
-    params: dict[str, str] = {}
-    for template_part, path_part in zip(template_parts, path_parts, strict=False):
-        if template_part.startswith("{") and template_part.endswith("}"):
-            param_name = template_part[1:-1]
-            if not param_name:
-                return None
-            params[param_name] = path_part
-            continue
-
-        if template_part != path_part:
-            return None
-
-    return params
-
-
-def _path_parts(path: str) -> list[str]:
-    return [part for part in path.strip("/").split("/") if part]
-
-
-def _wasm_extension_frame_config(
-    extension: WasmExtension,
-    frame_path: str,
-    auth: str,
-    path_params: dict[str, str],
-    route_params: dict[str, str],
-    query: dict[str, Any],
-    user_id: str | None,
-    permissions: set[str],
-) -> dict[str, Any]:
-    public = auth == "public"
-    return {
-        "extension": {
-            "id": extension.id,
-            "name": extension.name,
-        },
-        "frameUrl": wasm_extension_frame_url(extension, frame_path, user_id),
-        "bridge": {
-            "extensionId": extension.id,
-            "public": public,
-            "routeParams": _map_wasm_extension_route_params(route_params, path_params),
-            "query": query,
-            "permissions": sorted(permissions),
-            "apiRoutes": _wasm_extension_bridge_api_routes(extension, public),
-        },
-    }
-
-
-async def _wasm_extension_granted_permission_ids(
-    extension: WasmExtension,
-) -> set[str]:
-    installed_extension = await get_installed_extension(extension.id)
-    if not installed_extension:
-        return set()
-    return {permission.id for permission in installed_extension.permissions}
-
-
-def _map_wasm_extension_route_params(
-    route_params: dict[str, str],
-    path_params: dict[str, str],
-) -> dict[str, str]:
-    payload: dict[str, str] = {}
-    for key, value in route_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_wasm_extension_route_query(query: Any) -> dict[str, Any]:
-    if not isinstance(query, dict):
-        return {}
-
-    payload: dict[str, Any] = {}
-    for key, value in query.items():
-        if value is None:
-            continue
-        payload[_snake_to_camel(str(key))] = value
-    return payload
-
-
-async def _optional_wasm_user_id(
-    request: Request,
-    access_token: Annotated[str | None, Depends(check_access_token)],
-    usr: UUID4 | None = None,
-) -> str | None:
-    try:
-        return await optional_user_id(request, access_token, usr)
-    except HTTPException:
-        return None
-
-
-def _wasm_extension_ui_route_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid route path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return "/ext"
-    return f"/ext{path}"
-
-
-def _wasm_extension_entrypoint(extension: WasmExtension, entrypoint: Any) -> Path:
-    if not isinstance(entrypoint, str) or not entrypoint:
-        raise ValueError(
-            f"Invalid route entrypoint for WASM extension '{extension.id}'."
-        )
-    if entrypoint.startswith("/"):
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be a "
-            "relative extension path."
-        )
-
-    path = (extension.root_path / entrypoint).resolve()
-    root_path = extension.root_path.resolve()
-    if path != root_path and root_path not in path.parents:
-        raise ValueError(f"Route entrypoint escapes extension root: {entrypoint}")
-
-    static_path = (extension.root_path / "static").resolve()
-    if path == static_path or static_path in path.parents:
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must not be "
-            "inside the static asset directory."
-        )
-    if path.suffix.lower() != ".html":
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be "
-            "an HTML file."
-        )
-    if not path.is_file():
-        raise FileNotFoundError(f"Route entrypoint not found: {path}")
-    return path
@@ -1,19 +0,0 @@
-from .crud import (
-    migrate_wasm_extension_database,
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_get_row_owner_id,
-    storage_set_row,
-)
-
-__all__ = [
-    "migrate_wasm_extension_database",
-    "storage_delete_row",
-    "storage_get_paginated_rows",
-    "storage_get_public_row",
-    "storage_get_row",
-    "storage_get_row_owner_id",
-    "storage_set_row",
-]
@@ -1,627 +0,0 @@
-from __future__ import annotations
-
-import json
-import re
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-from loguru import logger
-
-from lnbits.core.crud import update_migration_version
-from lnbits.core.db import db as core_db
-from lnbits.core.models import DbVersion
-from lnbits.core.models.extensions import InstallableExtension
-from lnbits.db import POSTGRES, SQLITE, Connection, Database
-from lnbits.settings import settings
-
-_MIGRATION_FILE_RE = re.compile(r"^(\d+)_.*\.json$")
-_SQL_IDENTIFIER_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
-OWNER_ID_FIELD = "__lnbits_owner_id__"
-
-
-async def storage_get_row(
-    ext_id: str,
-    table: str,
-    row_id: str,
-    owner_id: str,
-) -> dict[str, Any] | None:
-    table_schema = _load_table_schema(ext_id, table)
-    query = f"""
-        SELECT * FROM {_table_ref_for_schema(ext_id, table)}
-        WHERE id = :id AND {OWNER_ID_FIELD} = :owner_id
-    """  # noqa: S608
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        row = await conn.fetchone(query, {"id": row_id, "owner_id": owner_id})
-    return _row_from_db(table_schema, row) if row else None
-
-
-async def storage_get_public_row(
-    ext_id: str,
-    table: str,
-    row_id: str,
-) -> dict[str, Any] | None:
-    table_schema = _load_table_schema(ext_id, table)
-    query = f"""
-        SELECT * FROM {_table_ref_for_schema(ext_id, table)}
-        WHERE id = :id
-    """  # noqa: S608
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        row = await conn.fetchone(query, {"id": row_id})
-    return _row_from_db(table_schema, row) if row else None
-
-
-async def storage_get_row_owner_id(
-    ext_id: str,
-    table: str,
-    row_id: str,
-) -> str | None:
-    _load_table_schema(ext_id, table)
-    query = f"""
-        SELECT {OWNER_ID_FIELD} FROM {_table_ref_for_schema(ext_id, table)}
-        WHERE id = :id
-    """  # noqa: S608
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        row = await conn.fetchone(query, {"id": row_id})
-
-    owner_id = row[OWNER_ID_FIELD] if row else None
-    return owner_id if isinstance(owner_id, str) and owner_id else None
-
-
-async def storage_set_row(
-    ext_id: str,
-    table: str,
-    data: dict[str, Any],
-    owner_id: str,
-) -> None:
-    table_schema = _load_table_schema(ext_id, table)
-    clean_data = _data_to_db(table_schema, data, require_id=True)
-    clean_data[OWNER_ID_FIELD] = owner_id
-    columns = list(clean_data.keys())
-    placeholders = [f":{column}" for column in columns]
-    updates = [
-        f"{column} = excluded.{column}"
-        for column in columns
-        if column not in ("id", OWNER_ID_FIELD)
-    ]
-    conflict_sql = (
-        "DO UPDATE SET "
-        + ", ".join(updates)
-        + f" WHERE {OWNER_ID_FIELD} = :{OWNER_ID_FIELD}"
-        if updates
-        else "DO NOTHING"
-    )
-    query = f"""
-        INSERT INTO {_table_ref_for_schema(ext_id, table)}
-            ({", ".join(columns)})
-        VALUES
-            ({", ".join(placeholders)})
-        ON CONFLICT (id) {conflict_sql}
-    """  # noqa: S608
-
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        await conn.execute(query, clean_data)
-
-
-async def storage_get_paginated_rows(
-    ext_id: str,
-    table: str,
-    filters: dict[str, Any],
-    *,
-    owner_id: str,
-    search: str | None,
-    search_fields: list[str],
-    sort_by: str | None,
-    descending: bool,
-    limit: int,
-    offset: int,
-) -> dict[str, Any]:
-    table_schema = _load_table_schema(ext_id, table)
-    where_sql, values = _where_sql(table_schema, filters, search, search_fields)
-    where_sql = _append_owner_where_sql(where_sql)
-    values[OWNER_ID_FIELD] = owner_id
-    order_sql = _order_sql(table_schema, sort_by, descending)
-    count_values = dict(values)
-    values.update({"limit": min(limit, 1000), "offset": offset})
-
-    table_ref = _table_ref_for_schema(ext_id, table)
-    rows_query = f"""
-        SELECT * FROM {table_ref}
-        {where_sql}
-        {order_sql}
-        LIMIT :limit
-        OFFSET :offset
-    """  # noqa: S608
-    count_query = f"""
-        SELECT COUNT(*) AS count FROM {table_ref}
-        {where_sql}
-    """  # noqa: S608
-
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        rows = await conn.fetchall(rows_query, values)
-        count_row = await conn.fetchone(count_query, count_values)
-
-    return {
-        "data": [_row_from_db(table_schema, row) for row in rows],
-        "total": int(count_row["count"]) if count_row else 0,
-    }
-
-
-async def storage_delete_row(
-    ext_id: str,
-    table: str,
-    row_id: str,
-    owner_id: str,
-) -> None:
-    _load_table_schema(ext_id, table)
-    query = f"""
-        DELETE FROM {_table_ref_for_schema(ext_id, table)}
-        WHERE id = :id AND {OWNER_ID_FIELD} = :owner_id
-    """  # noqa: S608
-    async with Database(f"ext_{ext_id}").connect() as conn:
-        await conn.execute(query, {"id": row_id, "owner_id": owner_id})
-
-
-async def migrate_wasm_extension_database(
-    ext: InstallableExtension,
-    current_version: DbVersion | None = None,
-) -> None:
-    migrations_dir = ext.ext_dir / "storage" / "migrations"
-    migration_files = _migration_files(migrations_dir)
-    if not migration_files:
-        logger.debug(f"No storage migrations for WASM extension '{ext.id}'.")
-        return
-
-    ext_db = Database(f"ext_{ext.id}")
-    async with ext_db.connect() as conn:
-        for version, path in migration_files:
-            if current_version and version <= current_version.version:
-                continue
-            logger.debug(f"running WASM storage migration {ext.id}.{version}")
-            print(f"running migration {ext.id}.{version}")
-            await _run_storage_migration(conn, path)
-            await _update_wasm_migration_version(conn, ext.id, version)
-
-
-def _migration_files(migrations_dir: Path) -> list[tuple[int, Path]]:
-    if not migrations_dir.is_dir():
-        return []
-
-    files: list[tuple[int, Path]] = []
-    for path in migrations_dir.glob("*.json"):
-        match = _MIGRATION_FILE_RE.match(path.name)
-        if not match:
-            raise ValueError(f"Invalid WASM storage migration filename: {path.name}")
-        files.append((int(match.group(1)), path))
-    return sorted(files)
-
-
-async def _run_storage_migration(db: Connection, path: Path) -> None:
-    migration = _load_json(path)
-    operations = migration.get("operations")
-    if not isinstance(operations, list):
-        raise ValueError(f"WASM storage migration '{path}' has no operations list.")
-
-    for operation in operations:
-        if not isinstance(operation, dict):
-            raise ValueError(f"WASM storage migration '{path}' has invalid operation.")
-        sql = _operation_sql(db, operation)
-        await db.execute(sql)
-
-
-def _operation_sql(db: Connection, operation: dict[str, Any]) -> str:
-    op = operation.get("op")
-    if op == "create_table":
-        return _create_table_sql(db, operation)
-    if op == "add_field":
-        return _add_field_sql(db, operation)
-    if op == "create_index":
-        return _create_index_sql(db, operation)
-    raise ValueError(f"Unsupported WASM storage migration operation: {op}")
-
-
-def _create_table_sql(db: Connection, operation: dict[str, Any]) -> str:
-    table = _require_identifier(operation, "table")
-    fields = _require_fields(operation)
-    if not any(field.get("name") == "id" for field in fields):
-        raise ValueError(f"WASM storage table '{table}' must define an id field.")
-    if any(field.get("name") == OWNER_ID_FIELD for field in fields):
-        raise ValueError(
-            f"WASM storage table '{table}' defines reserved field '{OWNER_ID_FIELD}'."
-        )
-
-    columns = [
-        _column_sql(db, field, primary_key=field.get("name") == "id")
-        for field in fields
-    ]
-    columns.append(f"{OWNER_ID_FIELD} TEXT NOT NULL")
-    return f"""
-        CREATE TABLE IF NOT EXISTS {_table_ref(db, table)} (
-            {", ".join(columns)}
-        );
-    """
-
-
-def _add_field_sql(db: Connection, operation: dict[str, Any]) -> str:
-    table = _require_identifier(operation, "table")
-    field = _field_from_add_field_operation(operation)
-    if field["name"] == OWNER_ID_FIELD:
-        raise ValueError(
-            f"WASM storage table '{table}' cannot add reserved field "
-            f"'{OWNER_ID_FIELD}'."
-        )
-    return f"""
-        ALTER TABLE {_table_ref(db, table)}
-        ADD COLUMN {_column_sql(db, field)};
-    """
-
-
-def _create_index_sql(db: Connection, operation: dict[str, Any]) -> str:
-    table = _require_identifier(operation, "table")
-    name = _require_identifier(operation, "name")
-    field = _require_identifier(operation, "field")
-    if field == OWNER_ID_FIELD:
-        raise ValueError(
-            f"WASM storage table '{table}' cannot index reserved field "
-            f"'{OWNER_ID_FIELD}'."
-        )
-
-    if db.type == SQLITE and db.schema:
-        return f"""
-            CREATE INDEX IF NOT EXISTS {_schema_ref(db, name)}
-            ON {table} ({field});
-        """
-
-    return f"""
-        CREATE INDEX IF NOT EXISTS {name}
-        ON {_table_ref(db, table)} ({field});
-    """
-
-
-def _column_sql(
-    db: Connection,
-    field: dict[str, Any],
-    *,
-    primary_key: bool = False,
-) -> str:
-    name = _require_identifier(field, "name")
-    column_type = _field_type_sql(db, field)
-    parts = [name, column_type]
-
-    if primary_key:
-        parts.append("PRIMARY KEY")
-    elif not field.get("nullable", False):
-        parts.append("NOT NULL")
-
-    if "default" in field:
-        parts.append(f"DEFAULT {_default_sql(field['default'])}")
-
-    return " ".join(parts)
-
-
-def _field_type_sql(db: Connection, field: dict[str, Any]) -> str:
-    if field.get("list") is True:
-        return "TEXT"
-
-    field_type = field.get("type")
-    if field_type == "string":
-        return "TEXT"
-    if field_type == "integer":
-        return db.big_int
-    if field_type == "number":
-        return "DOUBLE PRECISION" if db.type == POSTGRES else "REAL"
-    if field_type == "boolean":
-        return "BOOLEAN"
-    if field_type == "datetime":
-        return "TIMESTAMP"
-    raise ValueError(f"Unsupported WASM storage field type: {field_type}")
-
-
-def _load_table_schema(ext_id: str, table: str) -> dict[str, Any]:
-    schema = _load_storage_schema(ext_id)
-    tables = schema.get("tables")
-    if not isinstance(tables, dict):
-        raise ValueError(f"WASM extension '{ext_id}' has no storage tables schema.")
-
-    _require_identifier({"table": table}, "table")
-    table_schema = tables.get(table)
-    if not isinstance(table_schema, dict):
-        raise ValueError(f"WASM extension '{ext_id}' has no storage table '{table}'.")
-
-    fields = table_schema.get("fields")
-    if not isinstance(fields, list) or not fields:
-        raise ValueError(f"WASM storage table '{table}' has no fields schema.")
-
-    for field in fields:
-        if not isinstance(field, dict):
-            raise ValueError(f"WASM storage table '{table}' has invalid field schema.")
-        _require_identifier(field, "name")
-        if field["name"] == OWNER_ID_FIELD:
-            raise ValueError(
-                f"WASM storage table '{table}' defines reserved field "
-                f"'{OWNER_ID_FIELD}'."
-            )
-    return table_schema
-
-
-def _load_storage_schema(ext_id: str) -> dict[str, Any]:
-    schema_path = (
-        Path(settings.lnbits_extensions_path)
-        / "extensions"
-        / ext_id
-        / "storage"
-        / "schema.json"
-    )
-    if not schema_path.is_file():
-        raise ValueError(f"WASM extension '{ext_id}' has no storage schema.")
-    return _load_json(schema_path)
-
-
-def _data_to_db(
-    table_schema: dict[str, Any],
-    data: dict[str, Any],
-    *,
-    require_id: bool,
-) -> dict[str, Any]:
-    if not isinstance(data, dict):
-        raise ValueError("WASM storage row data must be an object.")
-    if require_id and not data.get("id"):
-        raise ValueError("WASM storage row data must include an id.")
-    _reject_reserved_owner_field(data, "row")
-
-    fields = _fields_by_name(table_schema)
-    unknown_fields = sorted(set(data) - set(fields))
-    if unknown_fields:
-        raise ValueError(
-            "WASM storage row has unknown fields: " + ", ".join(unknown_fields)
-        )
-
-    return {
-        field_name: _value_to_db(fields[field_name], value)
-        for field_name, value in data.items()
-    }
-
-
-def _filters_to_db(
-    table_schema: dict[str, Any],
-    filters: dict[str, Any],
-) -> dict[str, Any]:
-    if not isinstance(filters, dict):
-        raise ValueError("WASM storage filters must be an object.")
-    _reject_reserved_owner_field(filters, "filters")
-
-    fields = _fields_by_name(table_schema)
-    unknown_fields = sorted(set(filters) - set(fields))
-    if unknown_fields:
-        raise ValueError(
-            "WASM storage filters have unknown fields: " + ", ".join(unknown_fields)
-        )
-
-    return {
-        field_name: _value_to_db(fields[field_name], value)
-        for field_name, value in filters.items()
-    }
-
-
-def _where_sql(
-    table_schema: dict[str, Any],
-    filters: dict[str, Any],
-    search: str | None,
-    search_fields: list[str],
-) -> tuple[str, dict[str, Any]]:
-    clean_filters = _filters_to_db(table_schema, filters)
-    clauses = [f"{field} = :filter_{field}" for field in clean_filters]
-    values = {f"filter_{field}": value for field, value in clean_filters.items()}
-
-    clean_search = search.strip().lower() if search else ""
-    if clean_search:
-        fields = _fields_by_name(table_schema)
-        invalid_fields = sorted(set(search_fields) - set(fields))
-        if invalid_fields:
-            raise ValueError(
-                "WASM storage search has unknown fields: " + ", ".join(invalid_fields)
-            )
-        if search_fields:
-            search_clause = " OR ".join(
-                f"LOWER(CAST({field} AS TEXT)) LIKE :search" for field in search_fields
-            )
-            clauses.append(f"({search_clause})")
-            values["search"] = f"%{clean_search}%"
-
-    return ("WHERE " + " AND ".join(clauses), values) if clauses else ("", values)
-
-
-def _append_owner_where_sql(where_sql: str) -> str:
-    owner_clause = f"{OWNER_ID_FIELD} = :{OWNER_ID_FIELD}"
-    if where_sql:
-        return f"{where_sql} AND {owner_clause}"
-    return f"WHERE {owner_clause}"
-
-
-def _order_sql(
-    table_schema: dict[str, Any],
-    sort_by: str | None,
-    descending: bool,
-) -> str:
-    if not sort_by:
-        return ""
-    fields = _fields_by_name(table_schema)
-    if sort_by not in fields:
-        raise ValueError(f"WASM storage sort field is unknown: {sort_by}")
-    direction = "DESC" if descending else "ASC"
-    return f"ORDER BY {sort_by} {direction}"
-
-
-def _row_from_db(
-    table_schema: dict[str, Any],
-    row: dict[str, Any],
-) -> dict[str, Any]:
-    fields = _fields_by_name(table_schema)
-    return {
-        field_name: _value_from_db(fields[field_name], value)
-        for field_name, value in dict(row).items()
-        if field_name in fields
-    }
-
-
-def _fields_by_name(table_schema: dict[str, Any]) -> dict[str, dict[str, Any]]:
-    fields = table_schema.get("fields")
-    if not isinstance(fields, list):
-        raise ValueError("WASM storage table schema fields must be a list.")
-    return {field["name"]: field for field in fields}
-
-
-def _reject_reserved_owner_field(data: dict[str, Any], value_name: str) -> None:
-    if OWNER_ID_FIELD in data:
-        raise ValueError(f"WASM storage {value_name} includes a reserved owner field.")
-
-
-def _value_to_db(field: dict[str, Any], value: Any) -> Any:  # noqa: C901
-    if value is None:
-        if field.get("nullable", False):
-            return None
-        raise ValueError(f"WASM storage field '{field['name']}' cannot be null.")
-
-    if field.get("list") is True:
-        if not isinstance(value, list):
-            raise ValueError(f"WASM storage field '{field['name']}' must be a list.")
-        return json.dumps(value)
-
-    field_type = field.get("type")
-    if field_type == "string":
-        if not isinstance(value, str):
-            raise ValueError(f"WASM storage field '{field['name']}' must be a string.")
-        return value
-    if field_type == "integer":
-        if isinstance(value, bool) or not isinstance(value, int):
-            raise ValueError(
-                f"WASM storage field '{field['name']}' must be an integer."
-            )
-        return value
-    if field_type == "number":
-        if isinstance(value, bool) or not isinstance(value, int | float):
-            raise ValueError(f"WASM storage field '{field['name']}' must be a number.")
-        return value
-    if field_type == "boolean":
-        if not isinstance(value, bool):
-            raise ValueError(f"WASM storage field '{field['name']}' must be a boolean.")
-        return value
-    if field_type == "datetime":
-        if isinstance(value, int | float):
-            return datetime.fromtimestamp(value, tz=timezone.utc)
-        if isinstance(value, datetime):
-            return value
-        raise ValueError(
-            f"WASM storage field '{field['name']}' must be a Unix timestamp."
-        )
-    raise ValueError(f"Unsupported WASM storage field type: {field_type}")
-
-
-def _value_from_db(field: dict[str, Any], value: Any) -> Any:
-    if value is None:
-        return None
-
-    if field.get("list") is True:
-        if isinstance(value, str):
-            return json.loads(value)
-        return value
-
-    field_type = field.get("type")
-    if field_type == "boolean":
-        return bool(value)
-    if field_type == "datetime":
-        if isinstance(value, datetime):
-            return int(value.replace(tzinfo=timezone.utc).timestamp())
-        if isinstance(value, int | float):
-            return int(value)
-        if isinstance(value, str):
-            try:
-                return int(datetime.fromisoformat(value).timestamp())
-            except ValueError:
-                return value
-    return value
-
-
-def _default_sql(value: Any) -> str:
-    if value is None:
-        return "NULL"
-    if isinstance(value, bool):
-        return "true" if value else "false"
-    if isinstance(value, int | float):
-        return str(value)
-    if isinstance(value, str):
-        return _quote_sql_string(value)
-    if isinstance(value, list | dict):
-        return _quote_sql_string(json.dumps(value))
-    raise ValueError(f"Unsupported WASM storage default value: {value}")
-
-
-def _field_from_add_field_operation(operation: dict[str, Any]) -> dict[str, Any]:
-    field = {
-        "name": operation.get("field"),
-        "type": operation.get("type"),
-    }
-    for key in ("default", "list", "nullable"):
-        if key in operation:
-            field[key] = operation[key]
-    return field
-
-
-def _require_fields(operation: dict[str, Any]) -> list[dict[str, Any]]:
-    fields = operation.get("fields")
-    if not isinstance(fields, list) or not fields:
-        raise ValueError("WASM storage create_table operation requires fields.")
-    if not all(isinstance(field, dict) for field in fields):
-        raise ValueError("WASM storage fields must be objects.")
-    return fields
-
-
-def _require_identifier(data: dict[str, Any], key: str) -> str:
-    value = data.get(key)
-    if not isinstance(value, str) or not _SQL_IDENTIFIER_RE.match(value):
-        raise ValueError(f"Invalid WASM storage SQL identifier for '{key}': {value}")
-    return value
-
-
-def _table_ref(db: Connection, table: str) -> str:
-    if db.schema:
-        return f"{_schema_ref(db, table)}"
-    return table
-
-
-def _table_ref_for_schema(ext_id: str, table: str) -> str:
-    _require_identifier({"schema": ext_id}, "schema")
-    _require_identifier({"table": table}, "table")
-    return f"{ext_id}.{table}"
-
-
-def _schema_ref(db: Connection, name: str) -> str:
-    if not db.schema:
-        return name
-    if not _SQL_IDENTIFIER_RE.match(db.schema):
-        raise ValueError(f"Invalid WASM extension storage schema: {db.schema}")
-    return f"{db.schema}.{name}"
-
-
-def _quote_sql_string(value: str) -> str:
-    return "'" + value.replace("'", "''") + "'"
-
-
-def _load_json(path: Path) -> dict[str, Any]:
-    with open(path, encoding="utf-8") as json_file:
-        data = json.load(json_file)
-    if not isinstance(data, dict):
-        raise ValueError(f"WASM storage migration '{path}' must be a JSON object.")
-    return data
-
-
-async def _update_wasm_migration_version(
-    db: Connection,
-    ext_id: str,
-    version: int,
-) -> None:
-    if db.schema is None:
-        await update_migration_version(db, ext_id, version)
-    else:
-        async with core_db.connect() as conn:
-            await update_migration_version(conn, ext_id, version)
@@ -1,13 +0,0 @@
-from .component import warm_wasm_extension
-from .events import dispatch_wasm_invoice_paid
-from .invoke import invoke_wasm_extension_export
-from .loader import WasmExtension, is_wasm_extension_dir, is_wasm_extension_id
-
-__all__ = [
-    "WasmExtension",
-    "dispatch_wasm_invoice_paid",
-    "invoke_wasm_extension_export",
-    "is_wasm_extension_dir",
-    "is_wasm_extension_id",
-    "warm_wasm_extension",
-]
@@ -1,39 +0,0 @@
-from __future__ import annotations
-
-from functools import lru_cache
-from typing import Any
-
-from wasmtime import Config, Engine
-
-from .loader import WasmExtension
-
-
-def warm_wasm_extension(extension: WasmExtension) -> None:
-    _wasm_component(extension)
-
-
-@lru_cache(maxsize=1)
-def _wasm_engine() -> Any:
-    config = Config()
-    config.wasm_component_model = True
-    return Engine(config)
-
-
-def _wasm_component(extension: WasmExtension) -> Any:
-    stat = extension.module_path.stat()
-    return _cached_wasm_component(
-        str(extension.module_path),
-        stat.st_mtime_ns,
-        stat.st_size,
-    )
-
-
-@lru_cache(maxsize=32)
-def _cached_wasm_component(
-    module_path: str,
-    mtime_ns: int,
-    size: int,
-) -> Any:
-    from wasmtime import component
-
-    return component.Component.from_file(_wasm_engine(), module_path)
@@ -1,122 +0,0 @@
-import json
-from typing import Any
-
-from loguru import logger
-
-from lnbits.core.db import core_app_extra
-from lnbits.core.wasm_ext.storage.crud import storage_get_row_owner_id
-from lnbits.core.wasm_ext.wasm.invoke import invoke_wasm_extension_export
-
-
-async def dispatch_wasm_invoice_paid(payment: Any) -> None:
-    extension_id = _payment_extension_id(payment)
-    if not extension_id:
-        return
-
-    extension = core_app_extra.wasm_extension_registry.get(extension_id)
-    if not extension:
-        return
-
-    export_name = _wasm_invoice_paid_export(extension.config)
-    if not export_name:
-        return
-
-    if not _is_wasm_event_export(extension, export_name):
-        logger.warning(
-            f"WASM extension '{extension.id}' declares invalid onInvoicePaid "
-            f"export '{export_name}'."
-        )
-        return
-
-    try:
-        await invoke_wasm_extension_export(
-            extension.id,
-            export_name,
-            _wasm_invoice_paid_payload(payment),
-            context="event",
-            owner_id=await _wasm_invoice_paid_owner_id(extension, payment),
-        )
-    except Exception as exc:
-        logger.warning(
-            f"WASM extension '{extension.id}' failed to handle paid invoice "
-            f"'{payment.payment_hash}': {exc!s}"
-        )
-
-
-def _payment_extension_id(payment: Any) -> str | None:
-    if isinstance(payment.extension, str) and payment.extension:
-        return payment.extension
-
-    extra = payment.extra or {}
-    tag = extra.get("tag") or payment.tag
-    return tag if isinstance(tag, str) and tag else None
-
-
-async def _wasm_invoice_paid_owner_id(extension: Any, payment: Any) -> str | None:
-    source_id = _payment_source_id(payment)
-    source_tables = _wasm_public_invoice_source_tables(extension.config)
-    if not source_id or not source_tables:
-        return None
-
-    for source_table in source_tables:
-        owner_id = await storage_get_row_owner_id(extension.id, source_table, source_id)
-        if owner_id:
-            return owner_id
-    return None
-
-
-def _payment_source_id(payment: Any) -> str | None:
-    extra = payment.extra or {}
-    source_id = extra.get("source_id")
-    return source_id if isinstance(source_id, str) and source_id else None
-
-
-def _wasm_public_invoice_source_tables(config: dict[str, Any]) -> list[str]:
-    permissions = config.get("permissions") or []
-    for permission in permissions:
-        if not isinstance(permission, dict):
-            continue
-        if permission.get("id") != "wallet.create_invoice_public":
-            continue
-        policies = permission.get("policies")
-        if not isinstance(policies, list):
-            return []
-        return [
-            source_policy["table"]
-            for source_policy in policies
-            if isinstance(source_policy, dict)
-            and isinstance(source_policy.get("table"), str)
-            and source_policy["table"]
-        ]
-    return []
-
-
-def _wasm_invoice_paid_export(config: dict[str, Any]) -> str | None:
-    events = config.get("events") or {}
-    export_name = events.get("onInvoicePaid")
-    return export_name if isinstance(export_name, str) and export_name else None
-
-
-def _is_wasm_event_export(extension: Any, export_name: str) -> bool:
-    for export in extension.exports:
-        if export.get("name") == export_name:
-            return export.get("visibility") == "event"
-    return False
-
-
-def _wasm_invoice_paid_payload(payment: Any) -> dict[str, Any]:
-    return {
-        "checkingId": payment.checking_id,
-        "paymentHash": payment.payment_hash,
-        "walletId": payment.wallet_id,
-        "amount": payment.amount,
-        "fee": payment.fee,
-        "bolt11": payment.bolt11,
-        "memo": payment.memo,
-        "pending": payment.pending,
-        "status": payment.status,
-        "tag": payment.tag,
-        "extension": payment.extension,
-        "extra": payment.extra or {},
-        "payment": json.loads(payment.json()),
-    }
@@ -1,94 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import re
-from collections.abc import Mapping
-from typing import Any
-
-from wasmtime import component
-
-from ..api.models import EmptyRequest
-from ..api.registry import list_extension_api_methods
-from ..api.runtime import ExtensionAPIHost
-
-
-def add_extension_host_imports(
-    linker: Any,
-    api_host: ExtensionAPIHost,
-    event_loop: asyncio.AbstractEventLoop,
-) -> None:
-    with linker.root() as root:
-        methods_by_interface: dict[str, list[Any]] = {}
-        for method in list_extension_api_methods():
-            methods_by_interface.setdefault(method.host_interface, []).append(method)
-
-        for host_interface, methods in methods_by_interface.items():
-            with root.add_instance(f"lnbits:extension/{host_interface}") as host:
-                for method in methods:
-                    host.add_func(
-                        method.host_name.replace("_", "-"),
-                        _make_host_import(
-                            api_host,
-                            method.method_id,
-                            method.request_model is EmptyRequest,
-                            event_loop,
-                        ),
-                    )
-
-
-def _make_host_import(
-    api_host: ExtensionAPIHost,
-    host_name: str,
-    empty_request: bool,
-    event_loop: asyncio.AbstractEventLoop,
-) -> Any:
-    if empty_request:
-
-        def empty_host_import(_store: Any) -> Any:
-            future = asyncio.run_coroutine_threadsafe(
-                api_host.invoke(host_name), event_loop
-            )
-            response = future.result()
-            return _dict_to_component_record(response)
-
-        return empty_host_import
-
-    def host_import(_store: Any, request: Any = None) -> Any:
-        payload = _component_payload_to_dict(request)
-        future = asyncio.run_coroutine_threadsafe(
-            api_host.invoke(host_name, payload), event_loop
-        )
-        response = future.result()
-        return _dict_to_component_record(response)
-
-    return host_import
-
-
-def _component_payload_to_dict(value: Any) -> dict[str, Any]:
-    if value is None:
-        return {}
-    if hasattr(value, "__dict__"):
-        return dict(value.__dict__)
-    if isinstance(value, Mapping):
-        return dict(value)
-    raise TypeError("WASM host function payload must be a record.")
-
-
-def _dict_to_component_record(value: Mapping[str, Any]) -> Any:
-
-    record = component.Record()
-    for key, item in value.items():
-        setattr(record, _camel_to_kebab(key), _to_component_value(item))
-    return record
-
-
-def _to_component_value(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        return _dict_to_component_record(value)
-    if isinstance(value, list):
-        return [_to_component_value(item) for item in value]
-    return value
-
-
-def _camel_to_kebab(value: str) -> str:
-    return re.sub(r"([a-z0-9])([A-Z])", r"\1-\2", value).replace("_", "-").lower()
@@ -1,120 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import json
-from collections.abc import Mapping
-from typing import Any
-
-from wasmtime import Store, WasiConfig, component
-
-from lnbits.core.crud.extensions import get_installed_extension
-from lnbits.core.db import core_app_extra
-
-from ..api.host import ExtensionHostAPI
-from ..api.runtime import ExtensionAPIHost
-from .component import _wasm_component, _wasm_engine
-from .host import add_extension_host_imports
-from .loader import WasmExtension
-
-
-async def invoke_wasm_extension_export(
-    ext_id: str,
-    export_name: str,
-    payload: Mapping[str, Any] | None = None,
-    *,
-    user: Any | None = None,
-    access_token: str | None = None,
-    context: str = "user",
-    owner_id: str | None = None,
-) -> dict[str, Any]:
-    extension = _get_registered_extension(ext_id)
-    permissions = await _extension_permissions(extension)
-    api = ExtensionHostAPI(
-        extension.id,
-        permissions,
-        user_id=_user_id(user),
-        access_token=access_token,
-        context=context,
-        owner_id=owner_id,
-    )
-    event_loop = asyncio.get_running_loop()
-
-    return await asyncio.to_thread(
-        _invoke_wasm_extension_export_sync,
-        extension,
-        export_name,
-        payload or {},
-        api,
-        event_loop,
-    )
-
-
-def _invoke_wasm_extension_export_sync(
-    extension: WasmExtension,
-    export_name: str,
-    payload: Mapping[str, Any],
-    api: ExtensionHostAPI,
-    event_loop: asyncio.AbstractEventLoop,
-) -> dict[str, Any]:
-
-    engine = _wasm_engine()
-    store = Store(engine)
-    store.set_wasi(WasiConfig())
-
-    linker = component.Linker(engine)
-    linker.add_wasip2()
-    add_extension_host_imports(linker, ExtensionAPIHost(api), event_loop)
-
-    wasm_component = _wasm_component(extension)
-    instance = linker.instantiate(store, wasm_component)
-    function = instance.get_func(store, export_name)
-    if not function:
-        raise KeyError(
-            f"WASM extension '{extension.id}' has no export '{export_name}'."
-        )
-
-    result = function(store, json.dumps(payload))
-    function.post_return(store)
-    return _parse_wasm_export_result(extension, result)
-
-
-def _parse_wasm_export_result(extension: WasmExtension, value: Any) -> dict[str, Any]:
-    if isinstance(value, bytes):
-        value = value.decode()
-    if not isinstance(value, str):
-        return {"ok": True, "data": value}
-
-    max_response_bytes = (
-        (extension.config.get("wasm") or {})
-        .get("resource_limits", {})
-        .get("max_response_bytes")
-    )
-    if isinstance(max_response_bytes, int):
-        response_size = len(value.encode())
-        if response_size > max_response_bytes:
-            raise ValueError(
-                f"WASM extension response is too large: {response_size} bytes."
-            )
-
-    parsed = json.loads(value)
-    if isinstance(parsed, dict):
-        return parsed
-    return {"ok": True, "data": parsed}
-
-
-def _get_registered_extension(ext_id: str) -> WasmExtension:
-    extension = core_app_extra.wasm_extension_registry.get(ext_id)
-    if extension:
-        return extension
-    raise RuntimeError(f"WASM extension '{ext_id}' is not registered.")
-
-
-async def _extension_permissions(extension: WasmExtension) -> list[Any]:
-    installed_extension = await get_installed_extension(extension.id)
-    if not installed_extension:
-        return []
-    return installed_extension.permissions
-
-
-def _user_id(user: Any | None) -> str | None:
-    return getattr(user, "id", None) if user else None
@@ -1,100 +0,0 @@
-from __future__ import annotations
-
-import json
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any
-
-from lnbits.settings import settings
-
-
-@dataclass(frozen=True)
-class WasmExtension:
-    id: str
-    name: str
-    version: str
-    root_path: Path
-    module_path: Path
-    wit_path: Path | None
-    world: str
-    host_api: str
-    exports: list[dict[str, Any]]
-    config: dict[str, Any]
-
-
-def is_wasm_extension_id(ext_id: str) -> bool:
-    config = load_wasm_extension_config(ext_id)
-    return bool(config and config.get("extension_type") == "wasm")
-
-
-def is_wasm_extension_dir(ext_dir: Path) -> bool:
-    config = _load_json(ext_dir / "config.json")
-    return bool(config and config.get("extension_type") == "wasm")
-
-
-def load_wasm_extension_config(ext_id: str) -> dict[str, Any] | None:
-    ext_dir = Path(settings.lnbits_extensions_path, "extensions", ext_id)
-    return _load_json(ext_dir / "config.json")
-
-
-def load_wasm_extension(ext_id: str) -> WasmExtension:
-    ext_dir = Path(settings.lnbits_extensions_path, "extensions", ext_id)
-    config = load_wasm_extension_config(ext_id)
-    if not config:
-        raise FileNotFoundError(f"Missing WASM extension config for '{ext_id}'.")
-    if config.get("extension_type") != "wasm":
-        raise ValueError(f"Extension '{ext_id}' is not a WASM extension.")
-
-    wasm_config = config.get("wasm") or {}
-    module_path = _extension_path(ext_dir, wasm_config.get("module"))
-    wit_path = _optional_extension_path(ext_dir, wasm_config.get("wit"))
-    _check_wasm_module(module_path)
-    if wit_path and not wit_path.is_file():
-        raise FileNotFoundError(f"WIT file not found: {wit_path}")
-
-    return WasmExtension(
-        id=config.get("id") or ext_id,
-        name=config.get("name") or ext_id,
-        version=config.get("version") or "0.0",
-        root_path=ext_dir,
-        module_path=module_path,
-        wit_path=wit_path,
-        world=wasm_config.get("world") or "",
-        host_api=wasm_config.get("host_api") or "lnbits.core.wasm_ext.ExtensionHostAPI",
-        exports=wasm_config.get("exports") or [],
-        config=config,
-    )
-
-
-def _load_json(path: Path) -> dict[str, Any] | None:
-    if not path.is_file():
-        return None
-    with path.open("r", encoding="utf-8") as config_file:
-        value = json.load(config_file)
-    if not isinstance(value, dict):
-        raise ValueError(f"Expected JSON object in '{path}'.")
-    return value
-
-
-def _extension_path(ext_dir: Path, value: Any) -> Path:
-    if not isinstance(value, str) or not value:
-        raise ValueError(f"Missing relative path for extension '{ext_dir.name}'.")
-    path = (ext_dir / value).resolve()
-    if ext_dir.resolve() not in path.parents:
-        raise ValueError(f"Extension path escapes extension root: {value}")
-    return path
-
-
-def _optional_extension_path(ext_dir: Path, value: Any) -> Path | None:
-    if value is None:
-        return None
-    return _extension_path(ext_dir, value)
-
-
-def _check_wasm_module(path: Path) -> None:
-    if not path.is_file():
-        raise FileNotFoundError(f"WASM module not found: {path}")
-    with path.open("rb") as wasm_file:
-        magic = wasm_file.read(4)
-    if magic != b"\0asm":
-        raise ValueError(f"Invalid WASM module: {path}")
@@ -35,7 +35,7 @@ if settings.lnbits_database_url:
    else:
        if not database_uri.startswith("postgres://"):
            raise ValueError(
-                "Please use the 'postgres://...' format for the database URL."
+                "Please use the 'postgres://...' " "format for the database URL."
            )
        DB_TYPE = POSTGRES

@@ -560,9 +560,7 @@ class Filters(BaseModel, Generic[TFilterModel]):

    def pagination(self) -> str:
        stmt = ""
-        if self.limit == 0:
-            self.limit = 1000
-        self.limit = 10 if self.limit is None else self.limit
+        self.limit = self.limit or 10
        stmt += f"LIMIT {min(1000, self.limit)} "
        if self.offset:
            stmt += f"OFFSET {self.offset}"
@@ -615,12 +613,6 @@ class Filters(BaseModel, Generic[TFilterModel]):
        for page_filter in self.filters:
            page_filter.table_name = table_name

-    def get_filter_by_field(self, field: str) -> Filter[TFilterModel] | None:
-        return next((f for f in self.filters if f.field == field), None)
-
-    def remove_filter_by_field(self, field: str) -> None:
-        self.filters = [f for f in self.filters if f.field != field]
-

 class DbJsonEncoder(json.JSONEncoder):
    def default(self, o):
@@ -448,7 +448,7 @@ async def _check_user_access(r: Request, user_id: str, conn: Connection | None =
 async def _check_user_extension_access(
    user_id: str, path: str, conn: Connection | None = None
 ):
-    ext_id = _extension_id_from_request_path(path)
+    ext_id = path_segments(path)[0]
    status = await check_user_extension_access(user_id, ext_id, conn=conn)
    if not status.success:
        raise HTTPException(
@@ -457,15 +457,6 @@ async def _check_user_extension_access(
        )


-def _extension_id_from_request_path(path: str) -> str:
-    segments = path_segments(path)
-    if len(segments) >= 2 and segments[0] == "ext":
-        return segments[1]
-    if len(segments) >= 4 and segments[:3] == ["api", "v1", "ext"]:
-        return segments[3]
-    return segments[0]
-
-
 async def _get_account_from_token(
    access_token: str, path: str, method: str, conn: Connection | None = None
 ) -> Account | None:
@@ -9,8 +9,6 @@ from lnbits.fiat.base import FiatProvider
 from lnbits.settings import settings

 from .paypal import PayPalWallet
-from .revolut import RevolutWallet
-from .square import SquareWallet
 from .stripe import StripeWallet

 fiat_module = importlib.import_module("lnbits.fiat")
@@ -19,8 +17,6 @@ fiat_module = importlib.import_module("lnbits.fiat")
 class FiatProviderType(Enum):
    stripe = "StripeWallet"
    paypal = "PayPalWallet"
-    square = "SquareWallet"
-    revolut = "RevolutWallet"


 async def get_fiat_provider(name: str) -> FiatProvider | None:
@@ -56,7 +52,5 @@ fiat_providers: dict[str, FiatProvider] = {}

 __all__ = [
    "PayPalWallet",
-    "RevolutWallet",
-    "SquareWallet",
    "StripeWallet",
 ]
@@ -95,10 +95,6 @@ class FiatSubscriptionPaymentOptions(BaseModel):
        description="Unique ID that can be used to identify the subscription request."
        "If not provided, one will be generated.",
    )
-    customer_email: str | None = Field(
-        default=None,
-        description="The customer email to use for the subscription.",
-    )
    tag: str | None = Field(
        default=None,
        description="Payments created by the recurring subscription"
@@ -131,15 +127,15 @@ class FiatSubscriptionResponse(BaseModel):


 class FiatPaymentSuccessStatus(FiatPaymentStatus):
-    paid = True  # type: ignore[reportIncompatibleVariableOverride]
+    paid = True


 class FiatPaymentFailedStatus(FiatPaymentStatus):
-    paid = False  # type: ignore[reportIncompatibleVariableOverride]
+    paid = False


 class FiatPaymentPendingStatus(FiatPaymentStatus):
-    paid = None  # type: ignore[reportIncompatibleVariableOverride]
+    paid = None


 class FiatProvider(ABC):
@@ -1,646 +0,0 @@
-import asyncio
-import ipaddress
-import json
-from collections.abc import AsyncGenerator
-from decimal import ROUND_HALF_UP, Decimal
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-from loguru import logger
-from pydantic import BaseModel, Field, ValidationError
-
-from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
-from lnbits.settings import settings
-
-from .base import (
-    FiatInvoiceResponse,
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
-    FiatPaymentResponse,
-    FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
-    FiatProvider,
-    FiatStatusResponse,
-    FiatSubscriptionPaymentOptions,
-    FiatSubscriptionResponse,
-)
-
-
-class RevolutCheckoutOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    success_url: str | None = None
-    metadata: dict[str, Any] = Field(default_factory=dict)
-    description: str | None = None
-
-
-class RevolutCreateInvoiceOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    checkout: RevolutCheckoutOptions | None = None
-
-
-class RevolutSubscriptionReference(BaseModel):
-    wallet_id: str
-    tag: str | None = None
-    subscription_request_id: str | None = None
-    extra: dict[str, Any] | None = None
-    memo: str | None = None
-
-
-REVOLUT_WEBHOOK_EVENTS = [
-    "ORDER_AUTHORISED",
-    "ORDER_COMPLETED",
-    "SUBSCRIPTION_INITIATED",
-]
-
-ZERO_DECIMAL_CURRENCIES = {
-    "BIF",
-    "CLP",
-    "DJF",
-    "GNF",
-    "ISK",
-    "JPY",
-    "KMF",
-    "KRW",
-    "PYG",
-    "RWF",
-    "UGX",
-    "VND",
-    "VUV",
-    "XAF",
-    "XOF",
-    "XPF",
-}
-THREE_DECIMAL_CURRENCIES = {
-    "BHD",
-    "IQD",
-    "JOD",
-    "KWD",
-    "LYD",
-    "OMR",
-    "TND",
-}
-REVOLUT_CUSTOMER_LIST_LIMIT = 500
-REVOLUT_CUSTOMER_LIST_MAX_PAGES = 20
-REVOLUT_REQUEST_TIMEOUT = 30
-
-
-class RevolutWallet(FiatProvider):
-    """https://developer.revolut.com/docs/merchant"""
-
-    def __init__(self):
-        logger.debug("Initializing RevolutWallet")
-        self._settings_fields = self._settings_connection_fields()
-        if not settings.revolut_api_endpoint:
-            raise ValueError("Cannot initialize RevolutWallet: missing endpoint.")
-        if not settings.revolut_api_secret_key:
-            raise ValueError("Cannot initialize RevolutWallet: missing API secret key.")
-
-        self.endpoint = normalize_endpoint(settings.revolut_api_endpoint)
-        self.headers = {
-            "Authorization": f"Bearer {settings.revolut_api_secret_key}",
-            "Revolut-Api-Version": settings.revolut_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
-        logger.info("RevolutWallet initialized.")
-
-    async def cleanup(self):
-        try:
-            await self.client.aclose()
-        except RuntimeError as e:
-            logger.warning(f"Error closing Revolut wallet connection: {e}")
-
-    async def status(
-        self, only_check_settings: bool | None = False
-    ) -> FiatStatusResponse:
-        if only_check_settings:
-            if self._settings_fields != self._settings_connection_fields():
-                return FiatStatusResponse("Connection settings have changed.", 0)
-            return FiatStatusResponse(balance=0)
-
-        try:
-            r = await self.client.get(
-                "/api/orders",
-                params={"limit": 1},
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            _ = r.json()
-            return FiatStatusResponse(balance=0)
-        except json.JSONDecodeError:
-            return FiatStatusResponse("Server error: 'invalid json response'", 0)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
-
-    async def create_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        memo: str | None = None,
-        extra: dict[str, Any] | None = None,
-        **kwargs,
-    ) -> FiatInvoiceResponse:
-        opts = self._parse_create_opts(extra or {})
-        if opts is None:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Invalid Revolut options"
-            )
-
-        amount_minor = self.amount_to_minor_units(amount, currency)
-        checkout = opts.checkout or RevolutCheckoutOptions()
-        success_url = (
-            checkout.success_url
-            or settings.revolut_payment_success_url
-            or "https://lnbits.com"
-        )
-
-        payload = {
-            "amount": amount_minor,
-            "currency": currency.upper(),
-            "description": checkout.description or memo or "LNbits Invoice",
-            "redirect_url": success_url,
-            "metadata": {
-                **checkout.metadata,
-                "payment_hash": payment_hash,
-                "alan_action": "invoice",
-            },
-        }
-
-        try:
-            r = await self.client.post(
-                "/api/orders", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
-            )
-            r.raise_for_status()
-            data = r.json()
-            order_id = data.get("id")
-            checkout_url = data.get("checkout_url")
-            if not order_id or not checkout_url:
-                return FiatInvoiceResponse(
-                    ok=False, error_message="Server error: missing order id or url"
-                )
-            return FiatInvoiceResponse(
-                ok=True,
-                checking_id=f"order_{order_id}",
-                payment_request=checkout_url,
-            )
-        except json.JSONDecodeError:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatInvoiceResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def create_subscription(
-        self,
-        subscription_id: str,
-        quantity: int,
-        payment_options: FiatSubscriptionPaymentOptions,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        if quantity != 1:
-            return FiatSubscriptionResponse(
-                ok=False,
-                error_message="Revolut subscriptions do not support quantity.",
-            )
-
-        wallet_id = payment_options.wallet_id
-        if not wallet_id:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Wallet ID is required."
-            )
-
-        extra = payment_options.extra or {}
-        if not payment_options.subscription_request_id:
-            payment_options.subscription_request_id = urlsafe_short_hash()
-
-        reference = RevolutSubscriptionReference(
-            wallet_id=wallet_id,
-            tag=payment_options.tag,
-            subscription_request_id=payment_options.subscription_request_id,
-            extra=extra,
-            memo=payment_options.memo,
-        )
-        payload: dict[str, Any] = {
-            "plan_variation_id": subscription_id,
-            "external_reference": self._serialize_subscription_reference(reference),
-            "setup_order_redirect_url": (
-                payment_options.success_url
-                or settings.revolut_payment_success_url
-                or "https://lnbits.com"
-            ),
-        }
-        if extra.get("trial_duration"):
-            payload["trial_duration"] = extra["trial_duration"]
-
-        headers = {
-            **self.headers,
-            "Idempotency-Key": payment_options.subscription_request_id,
-        }
-
-        try:
-            customer_id, customer_error = await self._get_subscription_customer_id(
-                payment_options
-            )
-            if not customer_id:
-                return FiatSubscriptionResponse(ok=False, error_message=customer_error)
-            payload["customer_id"] = customer_id
-            r = await self.client.post(
-                "/api/subscriptions",
-                json=payload,
-                headers=headers,
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            data = r.json()
-            revolut_subscription_id = data.get("id")
-            setup_order_id = data.get("setup_order_id")
-            if not revolut_subscription_id or not setup_order_id:
-                return FiatSubscriptionResponse(
-                    ok=False,
-                    error_message=(
-                        "Server error: missing subscription id or setup order id"
-                    ),
-                )
-
-            setup_order = await self.get_order(setup_order_id)
-            checkout_url = setup_order.get("checkout_url")
-            if not checkout_url:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Server error: missing setup checkout url"
-                )
-
-            return FiatSubscriptionResponse(
-                ok=True,
-                checkout_session_url=checkout_url,
-                subscription_request_id=revolut_subscription_id,
-            )
-        except json.JSONDecodeError:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def cancel_subscription(
-        self,
-        subscription_id: str,
-        correlation_id: str,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        try:
-            subscription = await self.get_subscription(subscription_id)
-            reference = self.deserialize_subscription_reference(
-                subscription.get("external_reference")
-            )
-            if not reference or reference.wallet_id != correlation_id:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Subscription not found."
-                )
-
-            r = await self.client.post(
-                f"/api/subscriptions/{subscription_id}/cancel",
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            return FiatSubscriptionResponse(ok=True)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Unable to cancel subscription."
-            )
-
-    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
-        raise NotImplementedError("Revolut does not support paying invoices directly.")
-
-    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
-        try:
-            order_id = self._normalize_revolut_id(checking_id)
-            return self._status_from_order(await self.get_order(order_id))
-        except Exception as exc:
-            logger.debug(f"Error getting Revolut invoice status: {exc}")
-            return FiatPaymentPendingStatus()
-
-    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
-        raise NotImplementedError("Revolut does not support outgoing payments.")
-
-    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
-        logger.warning(
-            "Revolut does not support paid invoices stream. Use webhooks instead."
-        )
-        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
-        while settings.lnbits_running:
-            value = await mock_queue.get()
-            yield value
-
-    def _normalize_revolut_id(self, checking_id: str) -> str:
-        value = (
-            checking_id.replace("fiat_revolut_", "", 1)
-            if checking_id.startswith("fiat_revolut_")
-            else checking_id
-        )
-        return value.replace("order_", "", 1) if value.startswith("order_") else value
-
-    async def get_order(self, order_id: str) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/orders/{order_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def get_subscription(self, subscription_id: str) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/subscriptions/{subscription_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def get_subscription_cycle(
-        self, subscription_id: str, cycle_id: str
-    ) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/subscriptions/{subscription_id}/cycles/{cycle_id}",
-            timeout=REVOLUT_REQUEST_TIMEOUT,
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def _get_subscription_customer_id(
-        self, payment_options: FiatSubscriptionPaymentOptions
-    ) -> tuple[str | None, str | None]:
-        if not payment_options.customer_email:
-            return (
-                None,
-                "Revolut subscriptions require customer_email.",
-            )
-
-        customer = await self._get_customer_by_email(payment_options.customer_email)
-        customer_id = customer.get("id") if customer else None
-        if customer_id:
-            return customer_id, None
-
-        customer = await self._create_customer(payment_options.customer_email)
-        customer_id = customer.get("id")
-        if not customer_id:
-            return None, "Server error: missing customer id"
-        return customer_id, None
-
-    async def _get_customer_by_email(self, email: str) -> dict[str, Any] | None:
-        page_token = None
-        for _ in range(REVOLUT_CUSTOMER_LIST_MAX_PAGES):
-            customer_page = await self._list_customers(page_token=page_token)
-            customer = _find_customer_by_email(customer_page["customers"], email)
-            if customer:
-                return customer
-
-            page_token = customer_page.get("next_page_token")
-            if not page_token:
-                return None
-        return None
-
-    async def _list_customers(self, page_token: str | None = None) -> dict[str, Any]:
-        params: dict[str, Any] = {"limit": REVOLUT_CUSTOMER_LIST_LIMIT}
-        if page_token:
-            params["page_token"] = page_token
-        r = await self.client.get(
-            "/api/customers", params=params, timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return _extract_customer_page(r.json())
-
-    async def _create_customer(self, email: str) -> dict[str, Any]:
-        r = await self.client.post(
-            "/api/customers",
-            json={"email": email},
-            timeout=REVOLUT_REQUEST_TIMEOUT,
-        )
-        r.raise_for_status()
-        return r.json()
-
-    @classmethod
-    async def create_webhook(
-        cls,
-        url: str,
-        endpoint: str | None = None,
-        api_secret_key: str | None = None,
-        api_version: str | None = None,
-    ) -> dict[str, Any]:
-        if not url:
-            raise ValueError("Missing Revolut webhook URL.")
-        cls._validate_webhook_url(url)
-        if not endpoint and not settings.revolut_api_endpoint:
-            raise ValueError("Missing Revolut API endpoint.")
-        if not api_secret_key and not settings.revolut_api_secret_key:
-            raise ValueError("Missing Revolut API secret key.")
-
-        base_url = normalize_endpoint(endpoint or settings.revolut_api_endpoint)
-        secret_key = api_secret_key or settings.revolut_api_secret_key
-        headers = {
-            "Authorization": f"Bearer {secret_key}",
-            "Revolut-Api-Version": api_version or settings.revolut_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        payload = {"url": url, "events": REVOLUT_WEBHOOK_EVENTS}
-        async with httpx.AsyncClient(base_url=base_url, headers=headers) as client:
-            webhooks = await cls._list_webhooks(client)
-            existing = await cls._get_existing_webhook(client, webhooks, url)
-            if existing:
-                existing["already_exists"] = True
-                return existing
-
-            response = await client.post(
-                "/api/webhooks", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
-            )
-            response.raise_for_status()
-            return response.json()
-
-    @classmethod
-    async def _list_webhooks(cls, client: httpx.AsyncClient) -> list[dict[str, Any]]:
-        response = await client.get("/api/webhooks", timeout=REVOLUT_REQUEST_TIMEOUT)
-        response.raise_for_status()
-        data = response.json()
-        if isinstance(data, list):
-            return data
-        if isinstance(data, dict):
-            for field in ["webhooks", "data", "items"]:
-                if isinstance(data.get(field), list):
-                    return data[field]
-        return []
-
-    @classmethod
-    async def _get_existing_webhook(
-        cls, client: httpx.AsyncClient, webhooks: list[dict[str, Any]], url: str
-    ) -> dict[str, Any] | None:
-        for webhook in webhooks:
-            if cls._normalize_webhook_url(webhook.get("url")) != (
-                cls._normalize_webhook_url(url)
-            ):
-                continue
-
-            webhook_id = webhook.get("id")
-            if webhook_id and (
-                not webhook.get("events") or not webhook.get("signing_secret")
-            ):
-                response = await client.get(
-                    f"/api/webhooks/{webhook_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-                )
-                response.raise_for_status()
-                webhook = response.json()
-
-            events = set(webhook.get("events") or [])
-            missing_events = set(REVOLUT_WEBHOOK_EVENTS) - events
-            if missing_events:
-                raise ValueError(
-                    "A Revolut webhook already exists for this URL, but it is "
-                    f"missing required events: {', '.join(sorted(missing_events))}."
-                )
-
-            if not webhook.get("signing_secret"):
-                raise ValueError(
-                    "A Revolut webhook already exists for this URL, but Revolut "
-                    "did not return a signing secret."
-                )
-
-            return webhook
-        return None
-
-    @classmethod
-    def _normalize_webhook_url(cls, url: str | None) -> str:
-        return (url or "").strip().rstrip("/")
-
-    @classmethod
-    def _validate_webhook_url(cls, url: str) -> None:
-        parsed = urlparse(url)
-        hostname = parsed.hostname
-        if parsed.scheme not in ["http", "https"] or not hostname:
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-        host = hostname.lower()
-        if host == "localhost" or host.endswith(".localhost"):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-        if host.endswith(".local") or host.endswith(".onion"):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-        try:
-            ip = ipaddress.ip_address(host)
-        except ValueError:
-            return
-
-        if (
-            ip.is_loopback
-            or ip.is_private
-            or ip.is_link_local
-            or ip.is_reserved
-            or ip.is_unspecified
-        ):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-    def _status_from_order(self, order: dict[str, Any]) -> FiatPaymentStatus:
-        status = (order.get("state") or "").upper()
-        if status == "COMPLETED":
-            return FiatPaymentSuccessStatus()
-        if status in ["CANCELLED", "FAILED"]:
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    @classmethod
-    def amount_to_minor_units(cls, amount: float | Decimal, currency: str) -> int:
-        scale = Decimal(10) ** cls.currency_exponent(currency)
-        return int((Decimal(str(amount)) * scale).quantize(Decimal("1"), ROUND_HALF_UP))
-
-    @classmethod
-    def minor_units_to_amount(cls, amount: int, currency: str) -> float:
-        scale = Decimal(10) ** cls.currency_exponent(currency)
-        return float(Decimal(amount) / scale)
-
-    @classmethod
-    def currency_exponent(cls, currency: str) -> int:
-        normalized = currency.upper()
-        if normalized in ZERO_DECIMAL_CURRENCIES:
-            return 0
-        if normalized in THREE_DECIMAL_CURRENCIES:
-            return 3
-        return 2
-
-    def _parse_create_opts(
-        self, raw_opts: dict[str, Any]
-    ) -> RevolutCreateInvoiceOptions | None:
-        try:
-            return RevolutCreateInvoiceOptions.parse_obj(raw_opts)
-        except ValidationError as e:
-            logger.warning(f"Invalid Revolut options: {e}")
-            return None
-
-    def _serialize_subscription_reference(
-        self, reference: RevolutSubscriptionReference
-    ) -> str:
-        payload = reference.dict(exclude_none=True)
-        serialized = json.dumps(payload, separators=(",", ":"))
-        if len(serialized) > 1024:
-            raise ValueError("Revolut subscription external_reference is too long.")
-        return serialized
-
-    def deserialize_subscription_reference(
-        self, external_reference: str | None
-    ) -> RevolutSubscriptionReference | None:
-        if not external_reference:
-            return None
-        try:
-            return RevolutSubscriptionReference.parse_obj(
-                json.loads(external_reference)
-            )
-        except (json.JSONDecodeError, ValidationError) as exc:
-            logger.warning(exc)
-            return None
-
-    def _settings_connection_fields(self) -> str:
-        return "-".join(
-            [
-                str(settings.revolut_api_endpoint),
-                str(settings.revolut_api_secret_key),
-                str(settings.revolut_api_version),
-                str(settings.revolut_webhook_signing_secret),
-            ]
-        )
-
-
-def _extract_customer_page(data: Any) -> dict[str, Any]:
-    if isinstance(data, list):
-        return {"customers": _filter_customer_list(data)}
-    if isinstance(data, dict):
-        for field in ["customers", "data", "items"]:
-            customers = data.get(field)
-            if isinstance(customers, list):
-                return {
-                    "customers": _filter_customer_list(customers),
-                    "next_page_token": data.get("next_page_token"),
-                }
-    return {"customers": []}
-
-
-def _filter_customer_list(customers: list[Any]) -> list[dict[str, Any]]:
-    return [customer for customer in customers if isinstance(customer, dict)]
-
-
-def _find_customer_by_email(
-    customers: list[dict[str, Any]], email: str
-) -> dict[str, Any] | None:
-    normalized_email = email.casefold()
-    for customer in customers:
-        if str(customer.get("email") or "").casefold() == normalized_email:
-            return customer
-    return None
@@ -1,620 +0,0 @@
-import asyncio
-import json
-from collections.abc import AsyncGenerator
-from typing import Any, Literal
-
-import httpx
-from loguru import logger
-from pydantic import BaseModel, Field, ValidationError
-
-from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
-from lnbits.settings import settings
-
-from .base import (
-    FiatInvoiceResponse,
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
-    FiatPaymentResponse,
-    FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
-    FiatProvider,
-    FiatStatusResponse,
-    FiatSubscriptionPaymentOptions,
-    FiatSubscriptionResponse,
-)
-
-FiatMethod = Literal["checkout", "subscription"]
-
-
-class SquareCheckoutOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    success_url: str | None = None
-    metadata: dict[str, str] = Field(default_factory=dict)
-    line_item_name: str | None = None
-
-
-class SquareSubscriptionOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    checking_id: str | None = None
-    payment_request: str | None = None
-
-
-class SquareCreateInvoiceOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    fiat_method: FiatMethod = "checkout"
-    checkout: SquareCheckoutOptions | None = None
-    subscription: SquareSubscriptionOptions | None = None
-
-
-class SquareSubscriptionCheckoutInfo(BaseModel):
-    plan_variation_id: str
-    price_money: dict[str, Any]
-
-
-class SquareWallet(FiatProvider):
-    """https://developer.squareup.com/reference/square"""
-
-    def __init__(self):
-        logger.debug("Initializing SquareWallet")
-        self._settings_fields = self._settings_connection_fields()
-        if not settings.square_api_endpoint:
-            raise ValueError("Cannot initialize SquareWallet: missing endpoint.")
-        if not settings.square_access_token:
-            raise ValueError("Cannot initialize SquareWallet: missing access token.")
-        if not settings.square_location_id:
-            raise ValueError("Cannot initialize SquareWallet: missing location ID.")
-
-        self.endpoint = normalize_endpoint(settings.square_api_endpoint)
-        self.location_id = settings.square_location_id
-        self.headers = {
-            "Authorization": f"Bearer {settings.square_access_token}",
-            "Square-Version": settings.square_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
-        logger.info("SquareWallet initialized.")
-
-    async def cleanup(self):
-        try:
-            await self.client.aclose()
-        except RuntimeError as e:
-            logger.warning(f"Error closing Square wallet connection: {e}")
-
-    async def status(
-        self, only_check_settings: bool | None = False
-    ) -> FiatStatusResponse:
-        if only_check_settings:
-            if self._settings_fields != self._settings_connection_fields():
-                return FiatStatusResponse("Connection settings have changed.", 0)
-            return FiatStatusResponse(balance=0)
-
-        try:
-            r = await self.client.get(f"/v2/locations/{self.location_id}", timeout=15)
-            r.raise_for_status()
-            _ = r.json()
-            return FiatStatusResponse(balance=0)
-        except json.JSONDecodeError:
-            return FiatStatusResponse("Server error: 'invalid json response'", 0)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
-
-    async def create_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        memo: str | None = None,
-        extra: dict[str, Any] | None = None,
-        **kwargs,
-    ) -> FiatInvoiceResponse:
-        opts = self._parse_create_opts(extra or {})
-        if not opts:
-            return FiatInvoiceResponse(ok=False, error_message="Invalid Square options")
-
-        if opts.fiat_method == "subscription":
-            return self._create_subscription_invoice(opts.subscription)
-
-        return await self._create_checkout_invoice(
-            amount=amount,
-            payment_hash=payment_hash,
-            currency=currency,
-            opts=opts,
-            memo=memo,
-        )
-
-    async def create_subscription(
-        self,
-        subscription_id: str,
-        quantity: int,
-        payment_options: FiatSubscriptionPaymentOptions,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        if settings.lnbits_running:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Subscription not supported for Square."
-            )
-        success_url = (
-            payment_options.success_url
-            or settings.square_payment_success_url
-            or "https://lnbits.com"
-        )
-
-        if not payment_options.subscription_request_id:
-            payment_options.subscription_request_id = urlsafe_short_hash()
-        payment_options.extra = payment_options.extra or {}
-        payment_options.extra["subscription_request_id"] = (
-            payment_options.subscription_request_id
-        )
-        try:
-            checkout_info = await self._get_subscription_checkout_info(subscription_id)
-            metadata = self._serialize_metadata(payment_options)
-            payload = {
-                "idempotency_key": payment_options.subscription_request_id,
-                "description": metadata,
-                "quick_pay": {
-                    "name": (payment_options.memo or "LNbits Subscription")[:255],
-                    "price_money": checkout_info.price_money,
-                    "location_id": self.location_id,
-                },
-                "checkout_options": {
-                    "redirect_url": success_url,
-                    "subscription_plan_id": checkout_info.plan_variation_id,
-                },
-                "payment_note": metadata,
-            }
-            r = await self.client.post(
-                "/v2/online-checkout/payment-links", json=payload
-            )
-            r.raise_for_status()
-            data = r.json()
-            payment_link = data.get("payment_link") or {}
-            url = payment_link.get("url")
-            if not url:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Server error: missing url"
-                )
-            return FiatSubscriptionResponse(
-                ok=True,
-                checkout_session_url=url,
-                subscription_request_id=payment_options.subscription_request_id,
-            )
-        except json.JSONDecodeError as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def cancel_subscription(
-        self,
-        subscription_id: str,
-        correlation_id: str,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        try:
-            square_subscription_id = await self._get_square_subscription_id(
-                subscription_id, correlation_id
-            )
-            r = await self.client.post(
-                f"/v2/subscriptions/{square_subscription_id}/cancel"
-            )
-            r.raise_for_status()
-            return FiatSubscriptionResponse(ok=True)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Unable to cancel subscription."
-            )
-
-    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
-        raise NotImplementedError("Square does not support paying invoices directly.")
-
-    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
-        try:
-            square_id = self._normalize_square_id(checking_id)
-            if square_id.startswith("payment_"):
-                payment_id = square_id.replace("payment_", "", 1)
-                return await self._get_payment_status(payment_id)
-
-            order_id = (
-                square_id.replace("order_", "", 1)
-                if square_id.startswith("order_")
-                else square_id
-            )
-            return await self._get_order_status(order_id)
-        except Exception as exc:
-            logger.debug(f"Error getting Square invoice status: {exc}")
-            return FiatPaymentPendingStatus()
-
-    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
-        raise NotImplementedError("Square does not support outgoing payments.")
-
-    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
-        logger.warning(
-            "Square does not support paid invoices stream. Use webhooks instead."
-        )
-        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
-        while settings.lnbits_running:
-            value = await mock_queue.get()
-            yield value
-
-    async def _get_order_status(self, order_id: str) -> FiatPaymentStatus:
-        order = await self._get_order(order_id)
-        payment_id = self._payment_id_from_order(order)
-        if payment_id:
-            return await self._get_payment_status(payment_id)
-
-        if (order.get("state") or "").upper() == "CANCELED":
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    async def _get_order(self, order_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/orders/{order_id}")
-        r.raise_for_status()
-        return r.json().get("order") or {}
-
-    async def get_payment_for_order(self, order_id: str) -> dict[str, Any] | None:
-        order = await self._get_order(order_id)
-        payment_id = self._payment_id_from_order(order)
-        if not payment_id:
-            return None
-        return await self._get_payment(payment_id)
-
-    def _payment_id_from_order(self, order: dict[str, Any]) -> str | None:
-        tenders = order.get("tenders") or []
-        for tender in tenders:
-            payment_id = tender.get("payment_id")
-            if payment_id:
-                return payment_id
-        return None
-
-    async def _get_payment_status(self, payment_id: str) -> FiatPaymentStatus:
-        return self._status_from_payment(await self._get_payment(payment_id))
-
-    async def _get_payment(self, payment_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/payments/{payment_id}")
-        r.raise_for_status()
-        return r.json().get("payment") or {}
-
-    async def _get_subscription_checkout_info(
-        self, subscription_plan_id: str
-    ) -> SquareSubscriptionCheckoutInfo:
-        catalog_object = await self._get_catalog_object(subscription_plan_id)
-        if catalog_object.get("type") == "SUBSCRIPTION_PLAN":
-            return await self._get_plan_checkout_info(catalog_object)
-
-        if catalog_object.get("type") == "SUBSCRIPTION_PLAN_VARIATION":
-            price_money = await self._get_subscription_price_money(
-                catalog_object,
-            )
-            plan_variation_id = catalog_object.get("id")
-            if not plan_variation_id:
-                raise ValueError("Square subscription plan variation is missing an ID.")
-            return SquareSubscriptionCheckoutInfo(
-                plan_variation_id=plan_variation_id,
-                price_money=price_money,
-            )
-
-        raise ValueError(
-            "Square subscription ID must be a plan ID or plan variation ID."
-        )
-
-    async def _get_plan_checkout_info(
-        self, catalog_object: dict[str, Any]
-    ) -> SquareSubscriptionCheckoutInfo:
-        plan_data = catalog_object.get("subscription_plan_data") or {}
-        plan_variations = plan_data.get("subscription_plan_variations") or []
-        eligible_item_ids = plan_data.get("eligible_item_ids") or []
-        plan_variation = next(
-            (
-                variation
-                for variation in plan_variations
-                if not variation.get("is_deleted")
-            ),
-            None,
-        )
-        if not plan_variation:
-            raise ValueError("Square subscription plan is missing a variation.")
-
-        price_money = await self._get_subscription_price_money(
-            plan_variation,
-            eligible_item_ids=eligible_item_ids,
-        )
-        plan_variation_id = plan_variation.get("id")
-        if not plan_variation_id:
-            raise ValueError("Square subscription plan variation is missing an ID.")
-
-        return SquareSubscriptionCheckoutInfo(
-            plan_variation_id=plan_variation_id,
-            price_money=price_money,
-        )
-
-    async def _get_catalog_object(self, object_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/catalog/object/{object_id}")
-        r.raise_for_status()
-        return r.json().get("object") or {}
-
-    async def _get_subscription_price_money(
-        self,
-        plan_variation: dict[str, Any],
-        eligible_item_ids: list[str] | None = None,
-    ) -> dict[str, Any]:
-        variation_data = plan_variation.get("subscription_plan_variation_data") or {}
-        phases = variation_data.get("phases") or []
-        for phase in phases:
-            pricing = phase.get("pricing") or {}
-            price_money = pricing.get("price_money") or phase.get(
-                "recurring_price_money"
-            )
-            parsed_price_money = self._parse_price_money(price_money)
-            if parsed_price_money:
-                return parsed_price_money
-
-            if pricing.get("type") == "RELATIVE":
-                return await self._get_relative_subscription_price_money(
-                    eligible_item_ids or []
-                )
-
-        raise ValueError("Square subscription plan variation is missing price_money.")
-
-    async def _get_relative_subscription_price_money(
-        self, eligible_item_ids: list[str]
-    ) -> dict[str, Any]:
-        if len(eligible_item_ids) != 1:
-            raise ValueError(
-                "Square relative subscription plan must have exactly one item."
-            )
-
-        item = await self._get_catalog_object(eligible_item_ids[0])
-        item_variations: list[dict[str, Any]] = []
-        if item.get("type") == "ITEM":
-            item_variations = (item.get("item_data") or {}).get("variations") or []
-        elif item.get("type") == "ITEM_VARIATION":
-            item_variations = [item]
-
-        item_variation = next(
-            (
-                variation
-                for variation in item_variations
-                if not variation.get("is_deleted")
-            ),
-            None,
-        )
-        if not item_variation:
-            raise ValueError("Square subscription item is missing a variation.")
-
-        price_money = self._parse_price_money(
-            (item_variation.get("item_variation_data") or {}).get("price_money")
-        )
-        if price_money:
-            return price_money
-
-        raise ValueError("Square subscription item variation is missing price_money.")
-
-    def _parse_price_money(
-        self, price_money: dict[str, Any] | None
-    ) -> dict[str, Any] | None:
-        if (
-            price_money
-            and price_money.get("amount") is not None
-            and price_money.get("currency")
-        ):
-            return {
-                "amount": int(price_money["amount"]),
-                "currency": price_money["currency"].upper(),
-            }
-        return None
-
-    def _status_from_payment(self, payment: dict[str, Any]) -> FiatPaymentStatus:
-        status = (payment.get("status") or "").upper()
-        if status == "COMPLETED":
-            return FiatPaymentSuccessStatus()
-        if status in ["CANCELED", "FAILED"]:
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    async def _create_checkout_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        opts: SquareCreateInvoiceOptions,
-        memo: str | None = None,
-    ) -> FiatInvoiceResponse:
-        amount_cents = int(amount * 100)
-        co = opts.checkout or SquareCheckoutOptions()
-        success_url = (
-            co.success_url
-            or settings.square_payment_success_url
-            or "https://lnbits.com"
-        )
-        line_item_name = (co.line_item_name or memo or "LNbits Invoice")[:255]
-        metadata = {
-            **co.metadata,
-            "payment_hash": payment_hash,
-            "alan_action": "invoice",
-        }
-
-        payload = {
-            "idempotency_key": payment_hash,
-            "order": {
-                "location_id": self.location_id,
-                "metadata": metadata,
-                "line_items": [
-                    {
-                        "name": line_item_name,
-                        "quantity": "1",
-                        "base_price_money": {
-                            "amount": amount_cents,
-                            "currency": currency.upper(),
-                        },
-                    }
-                ],
-            },
-            "checkout_options": {"redirect_url": success_url},
-        }
-        if memo:
-            payload["payment_note"] = memo[:500]
-
-        try:
-            r = await self.client.post(
-                "/v2/online-checkout/payment-links", json=payload
-            )
-            r.raise_for_status()
-            data = r.json()
-            payment_link = data.get("payment_link") or {}
-            order_id = payment_link.get("order_id")
-            url = payment_link.get("url")
-            if not order_id or not url:
-                return FiatInvoiceResponse(
-                    ok=False, error_message="Server error: missing order id or url"
-                )
-            return FiatInvoiceResponse(
-                ok=True,
-                checking_id=f"order_{order_id}",
-                payment_request=url,
-            )
-        except json.JSONDecodeError:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatInvoiceResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    def _create_subscription_invoice(
-        self, opts: SquareSubscriptionOptions | None
-    ) -> FiatInvoiceResponse:
-        term = opts or SquareSubscriptionOptions()
-        checking_id = term.checking_id or f"payment_{urlsafe_short_hash()}"
-        return FiatInvoiceResponse(
-            ok=True,
-            checking_id=checking_id,
-            payment_request=term.payment_request or "",
-        )
-
-    def _normalize_square_id(self, checking_id: str) -> str:
-        return (
-            checking_id.replace("fiat_square_", "", 1)
-            if checking_id.startswith("fiat_square_")
-            else checking_id
-        )
-
-    def _parse_create_opts(
-        self, raw_opts: dict[str, Any]
-    ) -> SquareCreateInvoiceOptions | None:
-        try:
-            return SquareCreateInvoiceOptions.parse_obj(raw_opts)
-        except ValidationError as e:
-            logger.warning(f"Invalid Square options: {e}")
-            return None
-
-    def _serialize_metadata(
-        self, payment_options: FiatSubscriptionPaymentOptions
-    ) -> str:
-        extra_link = None
-        if payment_options.extra:
-            raw_link = payment_options.extra.get("link")
-            extra_link = str(raw_link)[:200] if raw_link else None
-
-        meta = [
-            payment_options.wallet_id,
-            payment_options.tag,
-            payment_options.subscription_request_id,
-            extra_link,
-        ]
-
-        memo_limit = 493 - len(json.dumps(meta, separators=(",", ":")))
-        if memo_limit > 0 and payment_options.memo:
-            meta.append(payment_options.memo[:memo_limit])
-        else:
-            meta.append(None)
-
-        metadata = json.dumps(meta, separators=(",", ":"))
-        if len(metadata) > 500:
-            raise ValueError("Square subscription metadata is too long.")
-        return metadata
-
-    async def _get_square_subscription_id(
-        self, subscription_id: str, wallet_id: str
-    ) -> str:
-        try:
-            from lnbits.core.crud.payments import get_payments
-            from lnbits.core.models import PaymentFilters
-            from lnbits.db import Filter, Filters
-
-            payments = await get_payments(
-                wallet_id=wallet_id,
-                filters=Filters(
-                    filters=[
-                        Filter.parse_query(
-                            "external_id", [subscription_id], PaymentFilters
-                        )
-                    ],
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                    limit=1,
-                ),
-            )
-            payment = next(
-                (
-                    payment
-                    for payment in payments
-                    if payment.external_id and payment.fiat_provider == "square"
-                ),
-                None,
-            )
-            if payment and payment.external_id:
-                return payment.external_id
-
-            payments = await get_payments(
-                wallet_id=wallet_id,
-                incoming=True,
-                filters=Filters(
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                ),
-            )
-            payment = next(
-                (
-                    payment
-                    for payment in payments
-                    if payment.external_id
-                    and payment.fiat_provider == "square"
-                    and (payment.extra or {}).get("subscription_request_id")
-                    == subscription_id
-                ),
-                None,
-            )
-            if payment and payment.external_id:
-                return payment.external_id
-        except Exception as exc:
-            logger.warning(exc)
-
-        return subscription_id
-
-    def _settings_connection_fields(self) -> str:
-        return "-".join(
-            [
-                str(settings.square_api_endpoint),
-                str(settings.square_access_token),
-                str(settings.square_location_id),
-                str(settings.square_api_version),
-            ]
-        )
@@ -55,6 +55,7 @@ def static_url_for(static: str, path: str) -> str:
 def template_renderer(additional_folders: list | None = None) -> Jinja2Templates:
    folders = [
        "lnbits/templates",
+        "lnbits/core/templates",
        settings.extension_builder_working_dir_path.as_posix(),
    ]

@@ -1,78 +0,0 @@
-"""Generate llms.txt markdown from FastAPI OpenAPI schema for AI agents."""
-
-from typing import Any
-
-from fastapi import FastAPI
-from fastapi.responses import PlainTextResponse
-
-
-def generate_llms_txt(app: FastAPI) -> str:
-    """Convert an OpenAPI schema to llms.txt markdown format."""
-    openapi_schema = app.openapi()
-    lines: list[str] = []
-
-    # H1: API Title
-    info = openapi_schema.get("info", {})
-    title = info.get("title", "API")
-    lines.append(f"# {title}")
-    lines.append("")
-
-    # Blockquote: Description
-    description = info.get("description")
-    if description:
-        for line in description.strip().split("\n"):
-            lines.append(f"> {line}")
-        lines.append("")
-
-    # Group endpoints by tag
-    paths = openapi_schema.get("paths", {})
-    endpoints_by_tag: dict[str, list[dict[str, Any]]] = {}
-
-    for path, path_item in paths.items():
-        for method in ["get", "post", "put", "patch", "delete", "head", "options"]:
-            if method not in path_item:
-                continue
-            operation = path_item[method]
-            tags = operation.get("tags", ["Endpoints"])
-            tag = tags[0] if tags else "Endpoints"
-            if tag not in endpoints_by_tag:
-                endpoints_by_tag[tag] = []
-            endpoints_by_tag[tag].append(
-                {
-                    "path": path,
-                    "method": method.upper(),
-                    "operation": operation,
-                }
-            )
-
-    # Generate sections by tag
-    for tag, endpoints in endpoints_by_tag.items():
-        lines.append(f"## {tag}")
-        lines.append("")
-        for endpoint in endpoints:
-            method = endpoint["method"]
-            path = endpoint["path"]
-            operation = endpoint["operation"]
-            summary = operation.get("summary", "")
-            if summary:
-                lines.append(f"### `{method} {path}` - {summary}")
-            else:
-                lines.append(f"### `{method} {path}`")
-            lines.append("")
-        lines.append("")
-
-    return "\n".join(lines).strip() + "\n"
-
-
-def create_llms_txt_route(app: FastAPI) -> None:
-    """Add a /llms.txt endpoint to the app."""
-
-    @app.get(
-        "/llms.txt",
-        response_class=PlainTextResponse,
-        include_in_schema=False,
-        summary="Get LLM-friendly API documentation",
-    )
-    async def get_llms_txt() -> str:
-        """Return the API documentation in llms.txt markdown format."""
-        return generate_llms_txt(app)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tiago Vasconcelos	9a9e638c1e	fix: separate concerns	2026-03-19 11:13:32 +00:00
Tiago Vasconcelos	59a2fefbf3	chore: lint & bundle	2026-03-19 09:59:17 +00:00
Tiago Vasconcelos	4725eb95c9	users page dialogs	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	a5aaced420	node page dialogs	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	87a6514b62	some extensions dialogs some need a bit more work	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	32c893027d	audit detail dialog	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	751598e0f8	remove margin in title	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	e11ccd9757	account dialogs	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	7e344de10e	funding sources qr	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	08fdeedffc	exchange ticker dialog	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	73ba9d94a5	wallet icon dialog	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	1640e23f75	new wallet dialog	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	9145c13435	qr scanner dialog	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	41048b8cc7	icon prop takes real estate	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	b46e2c549d	hodl invoice	2026-03-19 09:54:27 +00:00
Tiago Vasconcelos	b382ccfdf3	add optional secondary action button	2026-03-19 09:53:22 +00:00
Tiago Vasconcelos	1687972d89	payment details	2026-03-19 09:53:22 +00:00
Tiago Vasconcelos	d621a6f81f	.	2026-03-19 09:48:45 +00:00
Tiago Vasconcelos	b9d00d900e	prettier	2026-03-19 09:48:45 +00:00
Tiago Vasconcelos	0f06b7ba52	chore: bundle	2026-03-19 09:48:45 +00:00
Tiago Vasconcelos	220ece6027	fix mixed bindings	2026-03-19 09:47:57 +00:00
Tiago Vasconcelos	1663845468	remove action slot	2026-03-19 09:47:57 +00:00
Tiago Vasconcelos	5b7d1e63b5	test fixes	2026-03-19 09:47:57 +00:00
Tiago Vasconcelos	5bd8bf2f56	init	2026-03-19 09:47:57 +00:00
				`@@ -1 +0,0 @@`
				`"""SSO authentication providers for LNbits"""`