clean

fundle
Merge remote-tracking branch 'origin/dev' into wasm_extensions
2026-02-25 22:24:22 +00:00 · 2026-02-25 22:08:00 +00:00 · 2026-02-25 21:30:24 +00:00 · 2026-02-25 21:05:28 +00:00 · 2026-02-25 16:20:26 +00:00 · 2026-02-25 16:11:14 +00:00
235 changed files with 31781 additions and 31491 deletions
@@ -7,20 +7,14 @@
 # They are NOT managed by the Admin UI and are not stored in the database.

 # === First Install Token ===
-# If set the user is required to enter this token on the /first_install page
+# if set the user is required to enter this token on the /first_install page
 # FIRST_INSTALL_TOKEN="myaccesstoken"

-# === Security ===
-# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
-AUTH_HTTPS_ONLY=true
-
 # === Logging and Development ===

 DEBUG=False
 DEBUG_DATABASE=False
 BUNDLE_ASSETS=True
-# add `?profiler=true` to the url to enable the profiler for that request
-PROFILER=False

 # logging into LNBITS_DATA_FOLDER/logs/
 ENABLE_LOG_TO_FILE=true
@@ -30,10 +24,6 @@ LOG_ROTATION="100 MB"
 LOG_RETENTION="3 months"
 # for database cleanup commands
 # CLEANUP_WALLETS_DAYS=90
-# Hard limit for total created users. Set to 0 to disable the limit.
-# LNBITS_MAX_USERS=0
-# Hard limit for total installed extensions. Set to 0 to disable the limit.
-# LNBITS_MAX_EXTENSIONS=0

 # === Admin Settings ===

@@ -80,6 +70,7 @@ FORWARDED_ALLOW_IPS="*"
 # Inside this directory the `extensions` and `upgrades` sub-directories will be created.
 # LNBITS_EXTENSIONS_PATH="/path/to/some/dir"

+
 # ID of the super user. The user ID must exist.
 # SUPER_USER=""

@@ -104,7 +95,7 @@ AUTH_SECRET_KEY=""
 ######################################

 AUTH_TOKEN_EXPIRE_MINUTES=525600
-# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth, oidc-auth
+# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
 AUTH_ALLOWED_METHODS="user-id-only, username-password"
 # Set this flag if HTTP is used for OAuth
 # OAUTHLIB_INSECURE_TRANSPORT="1"
@@ -119,8 +110,6 @@ LNBITS_SITE_TAGLINE="Open Source Lightning Payments Platform"
 LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
-# Toggle the background styling on burger menus / drawers
-# LNBITS_DEFAULT_BURGER_MENU_BACKGROUND=true
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

 ######################################
@@ -203,14 +192,7 @@ BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
 # HEXSTRING instead of path also possible
 BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"

-# SparkL2Wallet (external sidecar: https://github.com/lnbits/spark_sidecar)
-SPARK_L2_NETWORK=MAINNET
-SPARK_L2_EXTERNAL_ENDPOINT=http://127.0.0.1:8765
-SPARK_L2_EXTERNAL_API_KEY=
-# optional tuning
-# SPARK_L2_PAY_WAIT_MS=4000
-# SPARK_L2_PAY_POLL_MS=500
-# SPARK_L2_STREAM_KEEPALIVE_MS=15000
+# TODO: add Spark

 # StrikeWallet
 STRIKE_API_ENDPOINT=https://api.strike.me/v1
@@ -283,50 +265,6 @@ KEYCLOAK_DISCOVERY_URL=""
 KEYCLOAK_CLIENT_CUSTOM_ORG=""
 KEYCLOAK_CLIENT_CUSTOM_ICON=""

-# OIDC OAuth Config
-# Generic OIDC provider configuration
-# Make sure that the redirect URI in your OIDC provider is set to: https://{domain}/api/v1/auth/oidc/token
-# Required scopes: openid, email, profile
-# The discovery URL must be accessible from your LNbits server
-# Always use HTTPS in production environments
-# The CUSTOM_ORG and CUSTOM_ICON settings allow you to customize the login button
-# For example: "Login via Zitadel" with the Zitadel logo
-OIDC_DISCOVERY_URL=""
-OIDC_CLIENT_ID=""
-OIDC_CLIENT_SECRET=""
-OIDC_CLIENT_CUSTOM_ORG=""
-OIDC_CLIENT_CUSTOM_ICON=""
-
-# Example OIDC configurations for various providers:
-#
-# ZITADEL:
-# OIDC_DISCOVERY_URL=https://login.yourdomain.de/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-zitadel-client-id@project-id
-# OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Zitadel
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/zitadel.png
-#
-# AUTHENTIK:
-# OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/lnbits/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authentik-client-id
-# OIDC_CLIENT_SECRET=your-authentik-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authentik
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authentik.png
-#
-# AUTHELIA:
-# OIDC_DISCOVERY_URL=https://auth.yourdomain.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-authelia-client-id
-# OIDC_CLIENT_SECRET=your-authelia-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Authelia
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/authelia.png
-#
-# OKTA:
-# OIDC_DISCOVERY_URL=https://your-domain.okta.com/.well-known/openid-configuration
-# OIDC_CLIENT_ID=your-okta-client-id
-# OIDC_CLIENT_SECRET=your-okta-client-secret
-# OIDC_CLIENT_CUSTOM_ORG=Okta
-# OIDC_CLIENT_CUSTOM_ICON=/static/images/okta.png
-

 ######################################

@@ -382,12 +320,10 @@ LNBITS_SERVICE_FEE=0.0
 # disable fees for internal transactions
 # LNBITS_SERVICE_FEE_IGNORE_INTERNAL=true

-# The minimum fee reserved per payment (millisats)
+# value in millisats
 LNBITS_RESERVE_FEE_MIN=2000
-# The percentage of the payment amount to reserve for routing fees (percent)
+# value in percent
 LNBITS_RESERVE_FEE_PERCENT=1.0
-# The default time to wait to for status response from the funding source when paying an invoice
-LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS=5

 # limit the maximum balance for each wallet
 # throw an error if the wallet attempts to create a new invoice
@@ -69,10 +69,7 @@ jobs:
            --onefile \
            --name lnbits \
            --hidden-import=embit \
-            --hidden-import=bitstring.bitstore_bitarray \
            --collect-all embit \
-            --collect-all bitstring \
-            --collect-all bitarray \
            --collect-all lnbits \
            --collect-all sqlalchemy \
            --collect-all breez_sdk \
@@ -1,33 +0,0 @@
-name: bundle
-on:
-  workflow_call:
-
-jobs:
-  bundle:
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || github.event.pull_request.head.sha }}
-      - uses: lnbits/lnbits/.github/actions/prepare@dev
-        with:
-          python-version: "3.10"
-          node-version: "24.x"
-          npm: true
-      - name: Build and commit bundle (same-repo PR)
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        run: |
-          make bundle
-          git config user.name "alan"
-          git config user.email "alan@lnbits.com"
-          git add lnbits/static
-          if git diff --cached --quiet; then
-            exit 0
-          fi
-          git commit -m "chore: make bundle [skip ci]"
-          git push
-      - name: Check bundle is up-to-date (fork PR)
-        if: github.event.pull_request.head.repo.full_name != github.repository
-        run: make checkbundle
@@ -1,9 +1,14 @@
 name: LNbits CI
 on:
+  push:
+    branches:
+      - main
+      - dev
  pull_request:


 jobs:
+
  lint:
    uses: ./.github/workflows/lint.yml

@@ -11,7 +16,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -25,7 +30,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -39,7 +44,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
@@ -53,7 +58,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.10", "3.12"]
+        python-version: ["3.10", "3.11", "3.12"]
    uses: ./.github/workflows/migration.yml
    with:
      python-version: ${{ matrix.python-version }}
@@ -69,7 +74,7 @@ jobs:
    uses: ./.github/workflows/regtest.yml
    strategy:
      matrix:
-        python-version: ["3.12"]
+        python-version: ["3.10"]
        backend-wallet-class:
          - BoltzWallet
          - LndRestWallet
@@ -89,11 +94,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.12"]
+        python-version: ["3.10"]
    uses: ./.github/workflows/jmeter.yml
    with:
      python-version: ${{ matrix.python-version }}
-
-  bundle:
-    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, regtest, jmeter ]
-    uses: ./.github/workflows/bundle.yml
@@ -22,7 +22,6 @@ jobs:
      - name: run LNbits
        env:
          LNBITS_ADMIN_UI: true
-          AUTH_HTTPS_ONLY: false
          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
        run: |
@@ -6,30 +6,53 @@ jobs:

  black:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkblack
+      python-version: ${{ matrix.python-version }}

  ruff:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkruff
+      python-version: ${{ matrix.python-version }}

  mypy:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: mypy
+      python-version: ${{ matrix.python-version }}

  pyright:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: pyright
+      python-version: ${{ matrix.python-version }}
      npm: true

+
  prettier:
    uses: ./.github/workflows/make.yml
    with:
      make: checkprettier
      npm: true

+  bundle:
+    uses: ./.github/workflows/make.yml
+    with:
+      make: checkbundle
+      npm: true
+
  poetry:
    uses: ./.github/workflows/poetry.yml
@@ -14,7 +14,7 @@ on:
      python-version:
        description: "python version"
        type: string
-        default: "3.12"
+        default: "3.10"

 jobs:
  make:
@@ -22,7 +22,7 @@ jobs:
    strategy:
      matrix:
        os-version: ["ubuntu-24.04"]
-        node-version: ["24.x"]
+        node-version: ["18.x"]
    runs-on: ${{ matrix.os-version }}
    steps:
      - uses: actions/checkout@v4
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -66,7 +66,6 @@ jobs:
          BOLTZ_MNEMONIC: abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
          LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
          LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
-          LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS: ${{ inputs.backend-wallet-class == 'CoreLightningRestWallet' && 60 || 5 }}
          ECLAIR_PASS: lnbits
          PYTHONUNBUFFERED: 1
          DEBUG: true
@@ -33,7 +33,6 @@ jobs:

  docker:
    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
    uses: ./.github/workflows/docker.yml
    with:
      tag: ${{ github.ref_name }}
@@ -41,16 +40,6 @@ jobs:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

-  docker-latest-rc:
-    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
-    uses: ./.github/workflows/docker.yml
-    with:
-      tag: latest-rc
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-
  pypi:
    if: github.repository == 'lnbits/lnbits'
    runs-on: ubuntu-24.04
@@ -52,16 +52,6 @@ jobs:
      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

-  docker-latest-rc:
-    if: github.repository == 'lnbits/lnbits'
-    needs: [ release ]
-    uses: ./.github/workflows/docker.yml
-    with:
-      tag: latest-rc
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-
  pypi:
    if: github.repository == 'lnbits/lnbits'
    runs-on: ubuntu-24.04
@@ -8,7 +8,7 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.12"
+        default: "3.10"
        type: string
      os-version:
        default: "ubuntu-24.04"
@@ -6,7 +6,6 @@ __pycache__
 *$py.class
 .mypy_cache
 .vscode
-.codex
 *-lock.json
 .python-version

@@ -1 +0,0 @@
-min-release-age=7
@@ -14,11 +14,11 @@ repos:
      - id: mixed-line-ending
      - id: check-case-conflict
  - repo: https://github.com/psf/black
-    rev: 26.3.1
+    rev: 25.1.0
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.10
+    rev: v0.12.10
    hooks:
      - id: ruff
        args: [ --fix, --exit-non-zero-on-fix ]
@@ -1,60 +0,0 @@
-# AGENTS.md - AI Coding Agent Guide for LNbits
-
-This file guides AI coding agents working on LNbits. Keep changes small, verified, and aligned with existing project patterns.
-
-## Core Behavior
-
- Think before coding. State material assumptions. Ask when ambiguity affects correctness, security, payments, wallets, or data migrations.
- Prefer the simplest implementation that solves the request.
- Make surgical changes. Every changed line should trace back to the task.
- Do not refactor, reformat, rename, or clean adjacent code unless required.
- Remove only dead code or imports created by your own changes.
- Define success criteria for non-trivial work and verify them before reporting done.
-
-## LNbits Architecture
-
- Keep core lean. Prefer/assess extensions for non-core features.
- Preserve compatibility with existing extensions and wallet backends.
- Follow existing patterns in `lnbits/core`, `lnbits/wallets`, `lnbits/extensions`, and frontend code.
- Use existing CRUD, services, settings, and migration patterns.
- Do not edit generated files, bundled vendor files, or unrelated extension code.
-
-## Security-Sensitive Areas
-
-Be extra cautious with payments, wallet balances, admin routes, keys, LNURL, Bolt11, funding sources, migrations, and authentication.
-
-Do not expose raw stack traces or sensitive values. Do not add synchronous blocking work in hot async paths without justification.
-
-## Commands and Verification
-
-Read `Makefile` before running project commands.
-
-Use Makefile targets instead of hand-written commands when available:
-
- `make check` for full checks.
- `make test-unit` for unit tests.
- `make test-api` for API tests.
- `make test-wallets` for wallet tests.
- `make checkbundle` when bundled frontend assets may be affected.
- `make format` only when formatting is intended.
-
-Do not run `make test` by default. Use the targeted tests available in the Makefile that are related to the work done, unless the user explicitly asks for broader test coverage.
-
-## Dependencies
-
-Do not add dependencies without approval. If approved, update the correct project files and explain why the dependency is necessary.
-
-## Maintenance
-
-LNbits maintainers own this file. They should update it when the development workflow, architecture, or verification commands materially change.
-
-Do not edit, commit, push, or include changes to this file in a PR as part of normal feature work unless the user explicitly asks for `AGENTS.md` changes.
-
-## Reporting
-
-When finished, report:
-
- Summary of what changed.
- Files touched.
- Makefile targets or checks run.
- Anything not verified and why.
@@ -43,4 +43,4 @@ ENV LNBITS_HOST="0.0.0.0"

 EXPOSE 5000

-CMD ["sh", "-c", "uv --offline run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
+CMD ["sh", "-c", "uv run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
@@ -66,7 +66,6 @@ test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	rm -rf ./tests/data \
 	uv run pytest tests/regtest

 test-migration:
@@ -1,12 +1,12 @@
 <a href="https://lnbits.com" target="_blank" rel="noopener noreferrer">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/logos/lnbits-full-inverse.svg">
-    <img src="docs/logos/lnbits-full.svg" alt="LNbits" style="width:300px">
+    <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png">
+    <img src="https://i.imgur.com/fyKPgVT.png" alt="LNbits" style="width:300px">
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)  
-<img alt="lnbits_head" src="docs/assets/header.jpg" />  
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [![hardware: LNBitsShop](https://img.shields.io/badge/hardware-LNBitsShop-7C3AED)](https://shop.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)  
+<img width="2000" height="203" alt="lnbits_head" src="https://github.com/user-attachments/assets/77669718-ac10-43c7-ae95-6ce236c77401" />  
 [![tip-hero](https://img.shields.io/badge/TipJar-LNBits%20Hero-9b5cff?labelColor=6b7280&logo=lightning&logoColor=white)](https://demo.lnbits.com/tipjar/DwaUiE4kBX6mUW6pj3X5Kg)

 # LNbits — The most powerful Bitcoin & Lightning toolkit
@@ -46,7 +46,7 @@ Get yourself familiar and test on our demo server [demo.lnbits.com](https://demo

 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.

-<img alt="lnbits_wallet" src="docs/assets/wallet.jpg" />
+<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">

 ## LNbits extension universe

@@ -54,25 +54,25 @@ Extend YOUR LNbits to meet YOUR needs.

 All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.

-<img alt="lnbits_extensions" src="docs/assets/extensions.jpg" />
+<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">

 ## LNbits API

 LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.

-<img alt="lnbits_api" src="docs/assets/api.jpg" />
+<img src="https://i.imgur.com/V742sb9.png" style="width:800px">

 ## LNbits node manager

 LNbits comes packaged with a light node management UI, to make running your node that much easier.

-<img alt="lnbits_api" src="docs/assets/lightning_node.jpg" />
+<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">

-## LNbits merchant tools
+## LNbits across all your devices

-The LNbits stack can process both bitcoin and fiat payments, making it a turnkey, all-in-one solution for merchants. With orders and inventory shared across extensions, and built-in notifications for Nostr, Telegram, and email, LNbits keeps everything in sync, freeing merchants to focus on their business.
+As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.

-<img alt="lnbits_merchants" src="docs/assets/merchants_small.webp" />
+<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">

 ## Powered by LNbits

@@ -18,7 +18,7 @@ RUN uv sync --all-extras
 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"
 ENV LNBITS_BACKEND_WALLET_CLASS="BoltzWallet"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
+ENV FUNDING_SOURCE_MAX_RETRIES=10

 # Boltzd
 ENV BOLTZ_CLIENT_ENDPOINT="127.0.0.1:9002"
@@ -26,10 +26,8 @@ password = "boltz"
  host = "0.0.0.0"
  port = 9005

-[swap]
-deferredClaimSymbols = ["BTC", "L-BTC"]
-
 [[pairs]]
+isLegacy = true
 base = "BTC"
 quote = "BTC"
 rate = 1
@@ -46,6 +44,7 @@ minSwapAmount = 50_000
  swapTaproot = 10080

 [[pairs]]
+isLegacy = true
 base = "L-BTC"
 quote = "BTC"
 fee = 0.25
@@ -84,7 +83,6 @@ maxZeroConfAmount = 0
  zmqpubrawblock = "tcp://bitcoind:29001"
  port = 18_443
  cookie = "/root/.bitcoin/regtest/.cookie"
-  feeFloor = 0.2

  wallet = "lnbits"

@@ -103,7 +101,6 @@ maxSwapAmount = 40_294_967
 minSwapAmount = 10_000
 maxZeroConfAmount = 40_294_967

-
  [liquid.chain]
  host = "elementsd"
  port = 18884
@@ -28,7 +28,7 @@ services:
      - lnd-2
      - boltz-postgres
    restart: always
-    image: boltz/boltz:v3.12.1
+    image: boltz/boltz:latest
    ports:
      - 9000:9000
    entrypoint: "sh -c 'sleep 30; /boltz-backend/bin/boltzd'"
@@ -2,17 +2,15 @@ ARG LNBITS_TAG=latest

 FROM lnbits/lnbits:${LNBITS_TAG}

-RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
-
 RUN apt-get update && apt-get -y upgrade
-RUN apt-get install -y ca-certificates curl gnupg netcat-openbsd git nodejs
+RUN apt-get install -y netcat-openbsd npm nodejs git

 RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 ENV PATH="/root/.local/bin:$PATH"

 # install sparksidecar
 RUN git clone https://github.com/lnbits/spark_sidecar
-RUN cd spark_sidecar && npm ci
+RUN cd spark_sidecar && npm install

 # Reinstall dependencies for lnbits just in case (needed for CMD usage)
 RUN uv sync --all-extras
@@ -21,16 +19,13 @@ RUN uv sync --all-extras
 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"
 ENV LNBITS_BACKEND_WALLET_CLASS="SparkL2Wallet"
-ENV LNBITS_RESERVE_FEE_MIN="20000"
-ENV LNBITS_RESERVE_FEE_PERCENT="1"
-ENV LNBITS_FUNDING_SOURCE_PAY_INVOICE_WAIT_SECONDS="20"
-ENV FUNDING_SOURCE_MAX_RETRIES="10"
+ENV FUNDING_SOURCE_MAX_RETRIES=10

 # spark sidecar
+ENV SPARK_MNEMONIC="bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom bottom"
 ENV SPARK_NETWORK="MAINNET"
 ENV SPARK_SIDECAR_PORT="8765"
 ENV SPARK_PAY_WAIT_MS="20000"
-ENV SPARK_MULTIPLICITY="3"

 EXPOSE 5000

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNBits Admin UI

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend Wallet Comparison Table

@@ -49,7 +50,7 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **Blink**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; focuses on mobile integrations.                                       |
 | **ZBD**                        | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Gaming-focused payment platform.                                                           |
 | **Spark (CLN)**                | Self-custodial           | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | Web interface for CLN; requires Spark server setup.                                        |
-| **Spark (L2)**                 | Self-custodial           | ❌                  | Medium                         | ❌                        | High              | Automatic                | Easy              | Low                    | Minimal fees                                 | Medium          | Runs via Spark sidecar; seed-based self-custody.                                           |
+| **Spark (L2)**                 | Self-custodial           | ❌                  | Medium                         | ❌                        | Medium            | Automatic                | Easy              | Low                    | Minimal fees                                 | Medium          | Runs via Spark sidecar; seed-based self-custody.                                           |
 | **Cliche Wallet**              | Self-custodial           | ❌                  | Medium                         | ❌                        | Medium            | Manual                   | Moderate          | Moderate               | Minimal fees                                 | Medium          | Lightweight wallet; suitable for embedded systems.                                         |
 | **Strike**                     | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
 | **LNPay**                      | Custodial                | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                                            |
@@ -59,7 +60,7 @@ Below is a side-by-side comparison of Lightning funding sources you can use with

 ## Spark (L2)

-Spark L2 uses a local Node.js sidecar to expose an HTTP API that LNbits can use as a funding source. It is self-custodial and secured by a standard mnemonic seed. Sidecar repo `https://github.com/lnbits/spark_sidecar`.
+Spark L2 uses a local Node.js sidecar to expose an HTTP API that LNbits can use as a funding source. It is self-custodial and secured by a standard mnemonic seed. You can let LNbits run the sidecar internally or run your own instance (see `https://github.com/lnbits/spark_sidecar`).

 ### Notes for readers

@@ -11,7 +11,7 @@ nav_order: 1
  </picture>
 </a>

-![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+![phase: stable](https://img.shields.io/badge/phase-stable-2EA043) ![License: MIT](https://img.shields.io/badge/License-MIT-blue) ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow) [![explore: LNbits extensions](https://img.shields.io/badge/explore-LNbits%20extensions-10B981)](https://extensions.lnbits.com/) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) <img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">

 # Basic installation

@@ -51,7 +51,7 @@ nav_order: 1
 sudo apt-get install jq libfuse2
 wget $(curl -s https://api.github.com/repos/lnbits/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
 chmod +x LNbits-latest.AppImage
-LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 AUTH_HTTPS_ONLY=false ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
 ```

 - LNbits will create a folder for DB and extension files **in the same directory** as the AppImage.
@@ -285,7 +285,10 @@ but you can also set the env variables or pass command line arguments:

 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true AUTH_HTTPS_ONLY=false ./result/bin/lnbits --port 9000 --host 0.0.0.0
+LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0
+
+# Once you have created a user, you can set as the super_user
+SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
 ```

 > ![NOTE](https://img.shields.io/badge/NOTE-3b82f6?labelColor=494949)
@@ -1,139 +0,0 @@
-# Generic OIDC Authentication Configuration
-
-This document explains how to configure generic OIDC authentication for LNbits, which allows integration with various OIDC-compliant authentication providers such as Zitadel, Authentik, and others.
-
-## Overview
-
-The generic OIDC provider (`oidc`) complements the existing Keycloak provider and allows you to integrate any OIDC-compliant authentication service. You can customize the login button with your own organization name and icon.
-
-## Configuration
-
-Add the following environment variables to your `.env` file or system environment:
-
-### Required Settings
-
-```bash
-# Enable OIDC authentication
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-
-# OIDC Discovery URL (well-known endpoint)
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-
-# Client credentials from your OIDC provider
-LNBITS_OIDC_CLIENT_ID=your-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-client-secret
-```
-
-### Optional Settings - Customize the Login Button
-
-You can customize how the OIDC login button appears to your users:
-
-```bash
-# Custom organization name (displayed on the login button)
-# Example: "Login via Zitadel" or "Login via Authentik"
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-
-# Custom icon URL (displayed on the login button)
-# Can be a full URL or a path to a local image
-LNBITS_OIDC_CLIENT_CUSTOM_ICON=https://zitadel.com/favicon.svg
-```
-
-If not set, the button will display "Login via OIDC" with a generic lock icon.
-
-## Zitadel Configuration Example
-
-For Zitadel, configure as follows:
-
-1. Create a new application in Zitadel
-2. Choose "Web" application type
-3. Configure the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Save the Client ID and Client Secret
-5. Use these environment variables:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://your-oidc-provider-domain/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-zitadel-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-zitadel-client-secret
-# Customize the button to show "Login via Zitadel" with Zitadel's logo
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Zitadel"
-LNBITS_OIDC_CLIENT_CUSTOM_ICON="https://zitadel.com/favicon.svg"
-```
-
-**Result**: The login page will display a button with the text "Login via Zitadel" and the Zitadel logo.
-
-## Authentik Configuration Example
-
-For Authentik:
-
-1. Create a new OAuth2/OpenID Provider
-2. Set the redirect URI: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-3. Configure scopes: `openid`, `email`, `profile`
-4. Get the Client ID and Client Secret
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=oidc-auth
-LNBITS_OIDC_DISCOVERY_URL=https://authentik.yourdomain.com/application/o/your-app/.well-known/openid-configuration
-LNBITS_OIDC_CLIENT_ID=your-authentik-client-id
-LNBITS_OIDC_CLIENT_SECRET=your-authentik-client-secret
-LNBITS_OIDC_CLIENT_CUSTOM_ORG="Authentik"
-```
-
-## Multiple Auth Methods
-
-You can enable multiple authentication methods simultaneously:
-
-```bash
-LNBITS_AUTH_ALLOWED_METHODS=username-password,oidc-auth,keycloak-auth
-```
-
-## Discovery Endpoint Requirements
-
-Your OIDC provider must expose a standard discovery endpoint (`.well-known/openid-configuration`) that includes:
-
- `authorization_endpoint`
- `token_endpoint`
- `userinfo_endpoint`
- `jwks_uri` (JSON Web Key Set)
-
-The OIDC implementation will automatically fetch these endpoints from the discovery URL.
-
-## User Mapping
-
-The OIDC provider maps user information from the OIDC userinfo endpoint:
-
- `sub` → User ID
- `email` → Email address
- `given_name` → First name
- `family_name` → Last name
- `name` or `preferred_username` → Display name
- `picture` → Profile picture URL
-
-## Troubleshooting
-
-### Authentication fails
-
-1. Verify the discovery URL is accessible
-2. Check that Client ID and Client Secret are correct
-3. Ensure redirect URI in your OIDC provider matches: `https://your-lnbits-domain/api/v1/auth/oidc/token`
-4. Check LNbits logs for detailed error messages
-
-### User info not populated
-
-Some OIDC providers may use different claim names. If user information is not correctly populated, check your provider's userinfo endpoint response format and adjust the provider class if needed.
-
-## Security Considerations
-
- Always use HTTPS in production
- Keep client secrets secure and never commit them to version control
- Use environment variables or secure configuration management
- Regularly rotate client secrets
- Review OIDC provider's security best practices
-
-## Implementation Details
-
-The OIDC provider is implemented in `lnbits/core/models/sso/oidc.py` and extends the `fastapi_sso` library's `SSOBase` class. It uses the standard OpenID Connect flow with:
-
- Scopes: `openid`, `email`, `profile`
- Response type: `code` (authorization code flow)
- Discovery document for automatic endpoint resolution
@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Super User (SU)

@@ -14,6 +14,7 @@ nav_order: 1
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # LNbits Roles: A Quick Overview

@@ -14,6 +14,7 @@ nav_order: 3
 ![phase: stable](https://img.shields.io/badge/phase-stable-2EA043)
 ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-yellow)
 [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits)
+[<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)

 # Backend wallets

@@ -40,8 +41,8 @@ A backend wallet is selected and configured entirely through LNbits environment
 | [CoreLightning](#corelightning)                 | [LND (gRPC)](#lnd-grpc)               | [Blink](#blink)                                   |
 | [CoreLightning REST](#corelightning-rest)       | [LNbits](#lnbits)                     | [Alby](#alby)                                     |
 | [Spark (Core Lightning)](#spark-core-lightning) | [LNPay](#lnpay)                       | [Boltz](#boltz)                                   |
-| [Spark L2](#spark-l2)                           | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
-| [Cliche Wallet](#cliche-wallet)                 |                                       |                                                   |
+| [Spark (L2)](#spark-l2)                         |                                       |                                                   |
+| [Cliche Wallet](#cliche-wallet)                 | [ZBD](#zbd)                           | [Phoenixd](#phoenixd)                             |
 | [Breez SDK](#breez-sdk)                         | [Breez Liquid SDK](#breez-liquid-sdk) | [Nostr Wallet Connect](#nostr-wallet-connect-nwc) |
 | [Strike](#strike)                               | [Eclair (ACINQ)](#eclair-acinq)       | [LN.tips](#lntips)                                |
 | [Fake Wallet](#fake-wallet)                     |                                       |                                                   |
@@ -127,18 +128,32 @@ Old REST interface using [RTL c-lightning-REST](https://github.com/Ride-The-Ligh
 - `SPARK_URL`: `http://10.147.17.230:9737/rpc`
 - `SPARK_TOKEN`: `secret_access_key`

-## Spark L2
+## Spark (L2)

-Self-custodial funding source using the [Spark L2](https://docs.spark.money/start/overview) network. Requires a Node.js [sidecar](https://github.com/lnbits/spark_sidecar) that bridges lnbits talking to Spark. Works in addition with any Spark-compatible seed (Wallet of Satoshi, BuhoGO, BlitzWallet).
-If the sidecar is started with a `mnemonic` then that mnemonic will be used. Otherwhise if a mnemonic is set for the `Spark L2` LNbits funding source then that mnemonic will be used.
+Spark L2 is a self-custodial funding source that uses a small Node.js sidecar to talk to the Spark network and expose an HTTP API. You can let LNbits run the sidecar internally, or run it yourself and point LNbits at it.

-### Optional tuning
+**Required env vars**

- `SPARK_L2_PAY_WAIT_MS`: `4000` _(payment timeout in ms)_
- `SPARK_L2_PAY_POLL_MS`: `500` _(polling interval in ms)_
- `SPARK_L2_STREAM_KEEPALIVE_MS`: `15000` _(SSE keepalive in ms)_
+- `LNBITS_BACKEND_WALLET_CLASS`: `SparkL2Wallet`

-### Example: run the sidecar
+**Internal sidecar (LNbits-managed)**
+
+- `SPARK_L2_INTERNAL_SIDECAR_VERSION`: `0.1.1`
+- `SPARK_L2_MNEMONIC`: `...` (optional; auto-generated if blank)
+- `SPARK_L2_NETWORK`: `MAINNET`
+
+Optional tuning:
+
+- `SPARK_L2_PAY_WAIT_MS`: `4000`
+- `SPARK_L2_PAY_POLL_MS`: `500`
+- `SPARK_L2_STREAM_KEEPALIVE_MS`: `15000`
+
+**External sidecar**
+
+- `SPARK_L2_EXTERNAL_ENDPOINT`: `http://127.0.0.1:8765`
+- `SPARK_L2_EXTERNAL_API_KEY`: `...` (if your sidecar requires auth)
+
+Example: run the sidecar manually (external mode)

 ```bash
 git clone https://github.com/lnbits/spark_sidecar.git
@@ -152,7 +167,7 @@ SPARK_PAY_WAIT_MS=20000 \
 node server.mjs
 ```

-For testing, you can generate a 12-word mnemonic at https://iancoleman.io/bip39/. Store it securely — it controls your funds. Then select Spark (L2) as the funding source in LNbits.
+For testing, you can generate a 12-word mnemonic at `https://iancoleman.io/bip39/`. Store it securely — it controls your funds. Then select **Spark (L2)** as the funding source in LNbits.

 ## LND (REST)

@@ -1,6 +1,7 @@
 import asyncio
 import glob
 import importlib
+import json
 import os
 import shutil
 import sys
@@ -35,12 +36,14 @@ from lnbits.core.tasks import (
    purge_audit_data,
    run_by_the_minute_tasks,
    wait_for_audit_data,
-    wait_for_paid_invoices,
    wait_notification_messages,
 )
+from lnbits.core.tasks import (
+    wait_for_paid_invoices as wait_for_paid_invoices_core,
+)
+from lnbits.core.wasm.extension_host import register_wasm_ext_routes
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
-from lnbits.llms_txt import create_llms_txt_route
 from lnbits.settings import settings
 from lnbits.tasks import (
    cancel_all_tasks,
@@ -66,7 +69,6 @@ from .middleware import (
    InstalledExtensionMiddleware,
    add_first_install_middleware,
    add_ip_block_middleware,
-    add_profiler_middleware,
    add_ratelimit_middleware,
 )
 from .tasks import internal_invoice_listener, invoice_listener, run_interval
@@ -103,9 +105,6 @@ async def startup(app: FastAPI):
    # register core routes
    init_core_routers(app)

-    # register llms.txt endpoint for AI agents
-    create_llms_txt_route(app)
-
    # initialize tasks
    register_async_tasks()

@@ -201,9 +200,6 @@ def create_app() -> FastAPI:

    register_exception_handlers(app)

-    if settings.profiler:
-        add_profiler_middleware(app)
-
    return app


@@ -427,6 +423,8 @@ def register_new_ratelimiter(app: FastAPI) -> Callable:

 def register_ext_tasks(ext: Extension) -> None:
    """Register extension async tasks."""
+    if ext.extension_type == "wasm":
+        return
    ext_module = importlib.import_module(ext.module_name)

    if hasattr(ext_module, f"{ext.code}_start"):
@@ -436,6 +434,12 @@ def register_ext_tasks(ext: Extension) -> None:

 def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    """Register FastAPI routes for extension."""
+    if ext.extension_type != "wasm":
+        ext.extension_type = _load_extension_type(ext.code) or ext.extension_type
+    if ext.extension_type == "wasm":
+        settings.activate_extension_paths(ext.code, ext.upgrade_hash, [])
+        register_wasm_ext_routes(app, ext)
+        return
    ext_module = importlib.import_module(ext.module_name)

    ext_route = getattr(ext_module, f"{ext.code}_ext")
@@ -461,6 +465,20 @@ def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    app.include_router(router=ext_route, prefix=prefix)


+def _load_extension_type(ext_id: str) -> str | None:
+    try:
+        conf_path = Path(
+            settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
+        )
+        if not conf_path.is_file():
+            return None
+        with open(conf_path, "r+") as json_file:
+            config_json = json.load(json_file)
+        return config_json.get("extension_type")
+    except Exception:
+        return None
+
+
 async def check_and_register_extensions(app: FastAPI) -> None:
    await check_installed_extensions(app)
    for ext in await get_valid_extensions(False):
@@ -476,12 +494,7 @@ def register_async_tasks() -> None:
    create_permanent_task(wait_for_audit_data)
    create_permanent_task(wait_notification_messages)

-    create_permanent_task(
-        run_interval(
-            settings.lnbits_funding_source_pending_interval_seconds,
-            check_pending_payments,
-        )
-    )
+    create_permanent_task(run_interval(30 * 60, check_pending_payments))
    create_permanent_task(invoice_listener)
    create_permanent_task(internal_invoice_listener)
    create_permanent_task(cache.invalidate_forever)
@@ -489,7 +502,7 @@ def register_async_tasks() -> None:
    # core invoice listener
    invoice_queue: asyncio.Queue = asyncio.Queue()
    register_invoice_listener(invoice_queue, "core")
-    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))
+    create_permanent_task(lambda: wait_for_paid_invoices_core(invoice_queue))

    create_permanent_task(run_by_the_minute_tasks)
    create_permanent_task(purge_audit_data)
@@ -12,7 +12,6 @@ from .extensions import (
    drop_extension_db,
    get_installed_extension,
    get_installed_extensions,
-    get_installed_extensions_count,
    get_user_active_extensions_ids,
    get_user_extension,
    get_user_extensions,
@@ -59,7 +58,6 @@ from .users import (
    get_account_by_username,
    get_account_by_username_or_email,
    get_accounts,
-    get_accounts_count,
    get_user,
    get_user_access_control_lists,
    get_user_from_account,
@@ -119,13 +117,11 @@ __all__ = [
    "get_account_by_username",
    "get_account_by_username_or_email",
    "get_accounts",
-    "get_accounts_count",
    "get_admin_settings",
    "get_db_version",
    "get_db_versions",
    "get_installed_extension",
    "get_installed_extensions",
-    "get_installed_extensions_count",
    "get_latest_payments_by_extension",
    "get_payment",
    "get_payments",
@@ -1,3 +1,5 @@
+import re
+
 from lnbits.core.db import db
 from lnbits.core.models.extensions import (
    InstallableExtension,
@@ -49,7 +51,8 @@ async def drop_extension_db(ext_id: str, conn: Connection | None = None) -> None
    )
    # Check that 'ext_id' is a valid extension id and not a malicious string
    if not row:
-        raise Exception(f"Extension '{ext_id}' db version cannot be found")
+        if not re.fullmatch(r"[a-zA-Z_][a-zA-Z0-9_]*", ext_id):
+            raise Exception(f"Extension '{ext_id}' db version cannot be found")

    is_file_based_db = await Database.clean_ext_db_files(ext_id)
    if is_file_based_db:
@@ -90,13 +93,6 @@ async def get_installed_extensions(
    return all_extensions


-async def get_installed_extensions_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM installed_extensions"
-    )
-    return int(row["count"]) if row else 0
-
-
 async def get_user_extension(
    user_id: str, extension: str, conn: Connection | None = None
 ) -> UserExtension | None:
@@ -149,12 +149,14 @@ async def get_payments_paginated(  # noqa: C901
            f"(status = '{PaymentState.SUCCESS}' OR status = '{PaymentState.PENDING}')"
        )
    elif complete:
-        clause.append(f"""
+        clause.append(
+            f"""
            (
                status = '{PaymentState.SUCCESS}'
                OR (amount < 0 AND status = '{PaymentState.PENDING}')
            )
-            """)
+            """
+        )
    elif pending:
        clause.append(f"status = '{PaymentState.PENDING}'")
    elif failed:
@@ -292,7 +294,6 @@ async def create_payment(
        tag=extra.get("tag", None),
        extra=extra,
        labels=data.labels or [],
-        external_id=data.external_id,
    )

    await (conn or db).insert("apipayments", payment)
@@ -306,7 +307,7 @@ async def update_payment_checking_id(
    await (conn or db).execute(
        f"""
            UPDATE apipayments
-            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder("now")}
+            SET checking_id = :new_id, updated_at = {db.timestamp_placeholder('now')}
            WHERE checking_id = :old_id
        """,  # noqa: S608
        {
@@ -321,15 +322,13 @@ async def update_payment(
    payment: Payment,
    new_checking_id: str | None = None,
    conn: Connection | None = None,
-) -> Payment:
+) -> None:
    payment.updated_at = datetime.now(timezone.utc)
    await (conn or db).update(
        "apipayments", payment, "WHERE checking_id = :checking_id"
    )
    if new_checking_id and new_checking_id != payment.checking_id:
        await update_payment_checking_id(payment.checking_id, new_checking_id, conn)
-        payment.checking_id = new_checking_id
-    return payment


 async def get_payments_history(
@@ -347,12 +346,14 @@ async def get_payments_history(
        "wallet_id": wallet_id,
    }
    # count outgoing payments if they are still pending
-    where = [f"""
+    where = [
+        f"""
        wallet_id = :wallet_id AND (
            status = '{PaymentState.SUCCESS}'
            OR (amount < 0 AND status = '{PaymentState.PENDING}')
        )
-        """]
+        """
+    ]
    clause = filters.where(where)
    transactions: list[dict] = await db.fetchall(
        # This query is safe from SQL injection:
@@ -401,6 +402,7 @@ async def get_payment_count_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentCountStat]:
+
    if not filters:
        filters = Filters()
    extra_stmts = []
@@ -433,6 +435,7 @@ async def get_daily_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
+
    if not filters:
        filters = Filters()

@@ -482,6 +485,7 @@ async def get_wallets_stats(
    user_id: str | None = None,
    conn: Connection | None = None,
 ) -> list[PaymentWalletStats]:
+
    if not filters:
        filters = Filters()

@@ -105,8 +105,7 @@ async def get_settings_field(
    )
    if not row:
        return None
-    value = json.loads(row["value"]) if row["value"] else None
-    return SettingsField(id=row["id"], value=value, tag=row["tag"])
+    return SettingsField(id=row["id"], value=json.loads(row["value"]), tag=row["tag"])


 async def set_settings_field(id_: str, value: Any | None, tag: str | None = "core"):
@@ -4,12 +4,7 @@ from typing import Any
 from uuid import uuid4

 from lnbits.core.crud.extensions import get_user_active_extensions_ids
-from lnbits.core.crud.wallets import (
-    clear_wallet_cache,
-    create_wallet,
-    get_standalone_wallet,
-    get_wallets,
-)
+from lnbits.core.crud.wallets import clear_wallet_cache, create_wallet, get_wallets
 from lnbits.core.db import db
 from lnbits.core.models import UserAcls
 from lnbits.db import Connection, Filters, Page
@@ -37,13 +32,6 @@ async def create_account(
    return account


-async def get_accounts_count(conn: Connection | None = None) -> int:
-    row: dict | None = await (conn or db).fetchone(
-        "SELECT COUNT(*) as count FROM accounts"
-    )
-    return int(row["count"]) if row else 0
-
-
 async def update_account(account: Account, conn: Connection | None = None) -> Account:
    account.updated_at = datetime.now(timezone.utc)
    await (conn or db).update("accounts", account)
@@ -64,22 +52,17 @@ async def get_accounts(
 ) -> Page[AccountOverview]:
    where_clauses = []
    values: dict[str, Any] = {}
-    filters = filters or Filters()

-    wallet_filter = filters.get_filter_by_field("wallet_id")
-
-    if wallet_filter and wallet_filter.values:
-        wallet_id_value = next(iter(wallet_filter.values.values()), None)
-        wallet = (
-            await get_standalone_wallet(wallet_id_value, deleted=None, conn=conn)
-            if wallet_id_value
-            else None
-        )
-        if not wallet:
-            return Page(data=[], total=0)
-        where_clauses.append("accounts.id = :account_id")
-        values = {**values, "account_id": wallet.user}
-        filters.remove_filter_by_field("wallet_id")
+    # Make wallet filter explicit
+    wallet_filter = (
+        next((f for f in filters.filters if f.field == "wallet_id"), None)
+        if filters
+        else None
+    )
+    if filters and wallet_filter and wallet_filter.values:
+        where_clauses.append("wallets.id = :wallet_id")
+        values = {**values, "wallet_id": next(iter(wallet_filter.values.values()))}
+        filters.filters = [f for f in filters.filters if f.field != "wallet_id"]

    return await (conn or db).fetch_page(
        """
@@ -22,6 +22,8 @@ from lnbits.settings import settings
 async def migrate_extension_database(
    ext: InstallableExtension, current_version: DbVersion | None = None
 ):
+    if _is_wasm_extension(ext):
+        return

    try:
        ext_migrations = importlib.import_module(f"{ext.module_name}.migrations")
@@ -58,6 +60,34 @@ async def run_migration(
                        await update_migration_version(conn, db_name, version)


+def _is_wasm_extension(ext: InstallableExtension) -> bool:
+    if ext.meta and ext.meta.extension_type == "wasm":
+        return True
+
+    try:
+        import json
+        from pathlib import Path
+
+        candidate_dirs = [
+            Path(ext.ext_dir),
+            Path(settings.lnbits_extensions_path, "extensions", ext.id),
+            Path(settings.lnbits_path, "extensions", ext.id),
+            Path.cwd() / "extensions" / ext.id,
+        ]
+        for base in candidate_dirs:
+            conf_path = Path(base, "config.json")
+            if not conf_path.is_file():
+                continue
+            with open(conf_path, "r+") as json_file:
+                config_json = json.load(json_file)
+            if config_json.get("extension_type") == "wasm":
+                return True
+    except Exception as exc:
+        logger.debug(f"Failed to load extension config for '{ext.id}': {exc!s}")
+
+    return False
+
+
 def to_valid_user_id(user_id: str) -> UUID:
    if len(user_id) < 32:
        raise ValueError("User ID must have at least 128 bits")
@@ -10,26 +10,31 @@ from lnbits.db import Connection


 async def m000_create_migrations_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
    CREATE TABLE IF NOT EXISTS dbversions (
        db TEXT PRIMARY KEY,
        version INT NOT NULL
    )
-    """)
+    """
+    )


 async def m001_initial(db: Connection):
    """
    Initial LNbits tables.
    """
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS accounts (
            id TEXT PRIMARY KEY,
            email TEXT,
            pass TEXT
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS extensions (
            "user" TEXT NOT NULL,
            extension TEXT NOT NULL,
@@ -37,8 +42,10 @@ async def m001_initial(db: Connection):

            UNIQUE ("user", extension)
        );
-    """)
-    await db.execute("""
+    """
+    )
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS wallets (
            id TEXT PRIMARY KEY,
            name TEXT NOT NULL,
@@ -46,8 +53,10 @@ async def m001_initial(db: Connection):
            adminkey TEXT NOT NULL,
            inkey TEXT
        );
-    """)
-    await db.execute(f"""
+    """
+    )
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS apipayments (
            payhash TEXT NOT NULL,
            amount {db.big_int} NOT NULL,
@@ -58,9 +67,11 @@ async def m001_initial(db: Connection):
            time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            UNIQUE (wallet, payhash)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -74,7 +85,8 @@ async def m001_initial(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m002_add_fields_to_apipayments(db: Connection):
@@ -137,7 +149,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
    """

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, COALESCE(SUM(s), 0) AS balance FROM (
            SELECT wallet, SUM(amount) AS s  -- incoming
@@ -151,7 +164,8 @@ async def m004_ensure_fees_are_always_negative(db: Connection):
            GROUP BY wallet
        )x
        GROUP BY wallet;
-    """)
+    """
+    )


 async def m005_balance_check_balance_notify(db: Connection):
@@ -160,7 +174,8 @@ async def m005_balance_check_balance_notify(db: Connection):
    LNbits wallet and of balanceNotify URLs supplied by users to empty their wallets.
    """

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_check (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          service TEXT NOT NULL,
@@ -168,16 +183,19 @@ async def m005_balance_check_balance_notify(db: Connection):

          UNIQUE(wallet, service)
        );
-    """)
+    """
+    )

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS balance_notify (
          wallet TEXT NOT NULL REFERENCES wallets (id),
          url TEXT NOT NULL,

          UNIQUE(wallet, url)
        );
-    """)
+    """
+    )


 async def m006_add_invoice_expiry_to_apipayments(db: Connection):
@@ -244,16 +262,19 @@ async def m007_set_invoice_expiries(db: Connection):


 async def m008_create_admin_settings_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS settings (
            super_user TEXT,
            editable_settings TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m009_create_tinyurl_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS tiny_url (
          id TEXT PRIMARY KEY,
          url TEXT,
@@ -261,11 +282,13 @@ async def m009_create_tinyurl_table(db: Connection):
          wallet TEXT,
          time TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-    """)
+    """
+    )


 async def m010_create_installed_extensions_table(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS installed_extensions (
            id TEXT PRIMARY KEY,
            version TEXT NOT NULL,
@@ -276,7 +299,8 @@ async def m010_create_installed_extensions_table(db: Connection):
            active BOOLEAN DEFAULT false,
            meta TEXT NOT NULL DEFAULT '{}'
        );
-    """)
+    """
+    )


 async def m011_optimize_balances_view(db: Connection):
@@ -285,19 +309,23 @@ async def m011_optimize_balances_view(db: Connection):
    over the payments table instead of 2.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT wallet, SUM(amount - abs(fee)) AS balance
        FROM apipayments
        WHERE (pending = false AND amount > 0) OR amount < 0
        GROUP BY wallet
-    """)
+    """
+    )


 async def m012_add_currency_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN currency TEXT
-        """)
+        """
+    )


 async def m013_add_deleted_to_wallets(db: Connection):
@@ -317,13 +345,15 @@ async def m014_set_deleted_wallets(db: Connection):
    Sets deleted column to wallets.
    """
    try:
-        result = await db.execute("""
+        result = await db.execute(
+            """
            SELECT *
            FROM wallets
            WHERE user LIKE 'del:%'
            AND adminkey LIKE 'del:%'
            AND inkey LIKE 'del:%'
-            """)
+            """
+        )
        rows = result.mappings().all()

        for row in rows:
@@ -356,7 +386,8 @@ async def m014_set_deleted_wallets(db: Connection):


 async def m015_create_push_notification_subscriptions_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS webpush_subscriptions (
            endpoint TEXT NOT NULL,
            "user" TEXT NOT NULL,
@@ -365,7 +396,8 @@ async def m015_create_push_notification_subscriptions_table(db: Connection):
            timestamp TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
            PRIMARY KEY (endpoint, "user")
        );
-    """)
+    """
+    )


 async def m016_add_username_column_to_accounts(db: Connection):
@@ -452,7 +484,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
    Make deleted wallets not show up in the balances view.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -462,7 +495,8 @@ async def m018_balances_view_exclude_deleted(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY wallet
-    """)
+    """
+    )


 async def m019_balances_view_based_on_wallets(db: Connection):
@@ -471,7 +505,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
    Important for querying whole lnbits balances.
    """
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -481,7 +516,8 @@ async def m019_balances_view_based_on_wallets(db: Connection):
              AND ((apipayments.pending = false AND apipayments.amount > 0)
              OR apipayments.amount < 0)
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m020_add_column_column_to_user_extensions(db: Connection):
@@ -500,7 +536,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
    await db.execute("UPDATE apipayments SET status = 'success' WHERE NOT pending")

    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -512,7 +549,8 @@ async def m021_add_success_failed_to_apipayments(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet
-    """)
+    """
+    )


 async def m022_add_pubkey_to_accounts(db: Connection):
@@ -543,7 +581,8 @@ async def m024_drop_pending(db: Connection):

 async def m025_refresh_view(db: Connection):
    await db.execute("DROP VIEW balances")
-    await db.execute("""
+    await db.execute(
+        """
        CREATE VIEW balances AS
        SELECT apipayments.wallet_id,
               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
@@ -555,7 +594,8 @@ async def m025_refresh_view(db: Connection):
            OR (apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)
        )
        GROUP BY apipayments.wallet_id
-    """)
+    """
+    )


 async def m026_update_payment_table(db: Connection):
@@ -618,7 +658,8 @@ async def m027_update_apipayments_data(db: Connection):

 async def m028_update_settings(db: Connection):

-    await db.execute("""
+    await db.execute(
+        """
        CREATE TABLE IF NOT EXISTS system_settings (
            id TEXT PRIMARY KEY,
            value TEXT,
@@ -626,7 +667,8 @@ async def m028_update_settings(db: Connection):

            UNIQUE (id, tag)
        );
-    """)
+    """
+    )

    async def _insert_key_value(id_: str, value: Any):
        await db.execute(
@@ -649,7 +691,8 @@ async def m028_update_settings(db: Connection):


 async def m029_create_audit_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS audit (
            component TEXT,
            ip_address TEXT,
@@ -663,13 +706,16 @@ async def m029_create_audit_table(db: Connection):
            delete_at TIMESTAMP,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m030_add_user_api_tokens_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE accounts ADD COLUMN access_control_list TEXT
-        """)
+        """
+    )


 async def m031_add_color_and_icon_to_wallets(db: Connection):
@@ -692,25 +738,32 @@ async def m033_update_payment_table(db: Connection):


 async def m034_add_stored_paylinks_to_wallet(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN stored_paylinks TEXT
-        """)
+        """
+    )


 async def m035_add_wallet_type_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN wallet_type TEXT DEFAULT 'lightning'
-        """)
+        """
+    )


 async def m036_add_shared_wallet_column(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE wallets ADD COLUMN shared_wallet_id TEXT
-        """)
+        """
+    )


 async def m037_create_assets_table(db: Connection):
-    await db.execute(f"""
+    await db.execute(
+        f"""
        CREATE TABLE IF NOT EXISTS assets (
            id TEXT PRIMARY KEY,
            user_id TEXT NOT NULL,
@@ -723,13 +776,16 @@ async def m037_create_assets_table(db: Connection):
            data {db.blob} NOT NULL,
            created_at TIMESTAMP NOT NULL DEFAULT {db.timestamp_now}
        );
-        """)
+        """
+    )


 async def m038_add_labels_for_payments(db: Connection):
-    await db.execute("""
+    await db.execute(
+        """
        ALTER TABLE apipayments ADD COLUMN labels TEXT
-        """)
+        """
+    )


 async def m039_index_payments(db: Connection):
@@ -748,9 +804,11 @@ async def m039_index_payments(db: Connection):
    ]
    for index in indexes:
        logger.debug(f"Creating index idx_payments_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_payments_{index} ON apipayments ({index});
-            """)
+            """
+        )


 async def m040_index_wallets(db: Connection):
@@ -767,9 +825,11 @@ async def m040_index_wallets(db: Connection):

    for index in indexes:
        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_wallets_{index} ON wallets ("{index}");
-            """)
+            """
+        )


 async def m042_index_accounts(db: Connection):
@@ -783,9 +843,11 @@ async def m042_index_accounts(db: Connection):

    for index in indexes:
        logger.debug(f"Creating index idx_wallets_{index}...")
-        await db.execute(f"""
+        await db.execute(
+            f"""
            CREATE INDEX IF NOT EXISTS idx_accounts_{index} ON accounts ("{index}");
-            """)
+            """
+        )


 async def m043_add_ui_customization_to_accounts(db: Connection):
@@ -802,16 +864,3 @@ async def m044_add_activated_to_accounts(db: Connection):
    Used for account activation status.
    """
    await db.execute("ALTER TABLE accounts ADD COLUMN activated BOOLEAN DEFAULT true")
-
-
-async def m045_add_external_id_to_payments(db: Connection):
-    """
-    Adds external_id column to apipayments.
-    Used for external payment references.
-    """
-    await db.execute("ALTER TABLE apipayments ADD COLUMN external_id TEXT")
-    logger.debug("Creating index idx_payments_external_id...")
-    await db.execute("""
-        CREATE INDEX IF NOT EXISTS idx_payments_external_id
-        ON apipayments (external_id);
-        """)
@@ -25,7 +25,6 @@ from .payments import (
    PaymentState,
    PaymentWalletStats,
    SettleInvoice,
-    UpdatePaymentExtra,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -91,7 +90,6 @@ __all__ = [
    "SimpleStatus",
    "TinyURL",
    "UpdateBalance",
-    "UpdatePaymentExtra",
    "UpdateSuperuserPassword",
    "UpdateUser",
    "UpdateUserPassword",
@@ -55,10 +55,9 @@ class GitHubRelease(BaseModel):


 class Manifest(BaseModel):
+    featured: list[str] = []
    extensions: list[ExplicitRelease] = []
    repos: list[GitHubRelease] = []
-    featured: list[str] = []
-    categories: dict[str, list[str]] = {}


 class GitHubRepoRelease(BaseModel):
@@ -84,6 +83,11 @@ class ExtensionConfig(BaseModel):
    warning: str | None = ""
    min_lnbits_version: str | None
    max_lnbits_version: str | None
+    permissions: list[ExtensionPermission] = []
+    extension_type: str | None = "python"
+    public_kv_keys: list[str] = []
+    public_wasm_functions: list[str] = []
+    payment_tags: list[str] = []

    def is_version_compatible(self) -> bool:
        return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)
@@ -116,6 +120,20 @@ class PayToEnableInfo(BaseModel):
 class UserExtensionInfo(BaseModel):
    paid_to_enable: bool | None = False
    payment_hash_to_enable: str | None = None
+    granted_permissions: list[str] | None = None
+    granted_payment_tags: list[str] | None = None
+
+
+class ExtensionPermission(BaseModel):
+    id: str
+    label: str
+    description: str
+    dangerous: bool | None = False
+
+
+class ExtensionPermissionsGrant(BaseModel):
+    permissions: list[str] = []
+    payment_tags: list[str] = []


 class UserExtension(BaseModel):
@@ -148,6 +166,10 @@ class Extension(BaseModel):
    short_description: str | None = None
    tile: str | None = None
    upgrade_hash: str | None = ""
+    extension_type: str | None = None
+    public_kv_keys: list[str] = []
+    public_wasm_functions: list[str] = []
+    payment_tags: list[str] = []

    @property
    def module_name(self) -> str:
@@ -171,6 +193,12 @@ class Extension(BaseModel):
            short_description=ext_info.short_description,
            tile=ext_info.icon,
            upgrade_hash=ext_info.hash if ext_info.ext_upgrade_dir.is_dir() else "",
+            extension_type=ext_info.meta.extension_type if ext_info.meta else None,
+            public_kv_keys=ext_info.meta.public_kv_keys if ext_info.meta else [],
+            public_wasm_functions=(
+                ext_info.meta.public_wasm_functions if ext_info.meta else []
+            ),
+            payment_tags=ext_info.meta.payment_tags if ext_info.meta else [],
        )


@@ -309,6 +337,7 @@ class ExtensionRelease(BaseModel):

    @classmethod
    async def fetch_release_details(cls, details_link: str) -> dict | None:
+
        try:
            async with httpx.AsyncClient() as client:
                resp = await client.get(details_link)
@@ -331,9 +360,13 @@ class ExtensionMeta(BaseModel):
    pay_to_enable: PayToEnableInfo | None = None
    payments: list[ReleasePaymentInfo] = []
    dependencies: list[str] = []
+    permissions: list[ExtensionPermission] = []
+    extension_type: str | None = "python"
+    public_kv_keys: list[str] = []
+    public_wasm_functions: list[str] = []
+    payment_tags: list[str] = []
    archive: str | None = None
    featured: bool = False
-    categories: list[str] = []
    paid_features: str | None = None
    has_paid_release: bool = False
    has_free_release: bool = False
@@ -455,6 +488,14 @@ class InstallableExtension(BaseModel):

            self.name = config_json.get("name")
            self.short_description = config_json.get("short_description")
+            if self.meta:
+                self.meta.permissions = config_json.get("permissions", [])
+                self.meta.extension_type = config_json.get("extension_type", "python")
+                self.meta.public_kv_keys = config_json.get("public_kv_keys", [])
+                self.meta.public_wasm_functions = config_json.get(
+                    "public_wasm_functions", []
+                )
+                self.meta.payment_tags = config_json.get("payment_tags", [])

            if (
                self.meta
@@ -573,6 +614,11 @@ class InstallableExtension(BaseModel):
                    latest_release=ExtensionRelease.from_github_release(
                        source_repo, latest_release
                    ),
+                    permissions=config.permissions,
+                    extension_type=config.extension_type,
+                    public_kv_keys=config.public_kv_keys,
+                    public_wasm_functions=config.public_wasm_functions,
+                    payment_tags=config.payment_tags,
                ),
            )
        except Exception as e:
@@ -618,7 +664,14 @@ class InstallableExtension(BaseModel):
                            source_repo=f"{conf_path}",
                            min_lnbits_version=config_json.get("min_lnbits_version"),
                            max_lnbits_version=config_json.get("max_lnbits_version"),
-                        )
+                        ),
+                        permissions=config_json.get("permissions", []),
+                        extension_type=config_json.get("extension_type", "python"),
+                        public_kv_keys=config_json.get("public_kv_keys", []),
+                        public_wasm_functions=config_json.get(
+                            "public_wasm_functions", []
+                        ),
+                        payment_tags=config_json.get("payment_tags", []),
                    ),
                )

@@ -681,11 +734,6 @@ class InstallableExtension(BaseModel):

                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]

@@ -701,11 +749,6 @@ class InstallableExtension(BaseModel):
                    ext.check_release_updates(release)
                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
-                    meta.categories = [
-                        category
-                        for category, ext_ids in manifest.categories.items()
-                        if ext.id in ext_ids
-                    ]
                    ext.meta = meta
                    extension_list += [ext]
            except Exception as e:
@@ -852,3 +895,6 @@ def icon_to_github_url(source_repo: str, path: str | None) -> str:
    _, _, *rest = path.split("/")
    tail = "/".join(rest)
    return f"https://github.com/{source_repo}/raw/main/{tail}"
+
+
+ExtensionConfig.update_forward_refs(ExtensionPermission=ExtensionPermission)
@@ -13,7 +13,6 @@ from lnbits.db import FilterModel
 from lnbits.fiat.base import (
    FiatPaymentStatus,
 )
-from lnbits.helpers import is_valid_external_id
 from lnbits.utils.exchange_rates import allowed_currencies
 from lnbits.wallets.base import (
    PaymentStatus,
@@ -35,11 +34,6 @@ class PaymentExtra(BaseModel):
    lnurl_response: str | None = None


-class UpdatePaymentExtra(BaseModel):
-    payment_hash: str
-    extra: dict = Field(default_factory=dict)
-
-
 class PayInvoice(BaseModel):
    payment_request: str
    description: str | None = None
@@ -59,11 +53,6 @@ class CreatePayment(BaseModel):
    webhook: str | None = None
    fee: int = 0
    labels: list[str] | None = None
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)


 class Payment(BaseModel):
@@ -88,11 +77,6 @@ class Payment(BaseModel):
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    labels: list[str] = []
    extra: dict = {}
-    external_id: str | None = None
-
-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)

    def __init__(self, **data):
        super().__init__(**data)
@@ -140,18 +124,22 @@ class Payment(BaseModel):
        )

    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_status(self) -> PaymentStatus:
+    async def check_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> PaymentStatus:
        logger.warning("payment.check_status() is deprecated.")
        from lnbits.core.services.payments import check_payment_status

-        return await check_payment_status(self)
+        return await check_payment_status(self, skip_internal_payment_notifications)

    # DEPRECATED: in v1.5.0, use service check_payment_status instead
-    async def check_fiat_status(self) -> FiatPaymentStatus:
+    async def check_fiat_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> FiatPaymentStatus:
        logger.warning("payment.check_fiat_status() is deprecated.")
        from lnbits.core.services.fiat_providers import check_fiat_status

-        return await check_fiat_status(self)
+        return await check_fiat_status(self, skip_internal_payment_notifications)


 class PaymentFilters(FilterModel):
@@ -163,7 +151,6 @@ class PaymentFilters(FilterModel):
        "status",
        "time",
        "labels",
-        "external_id",
    ]

    __sort_fields__ = [
@@ -174,13 +161,11 @@ class PaymentFilters(FilterModel):
        "memo",
        "time",
        "tag",
-        "external_id",
    ]

    status: str | None
    tag: str | None
    checking_id: str | None
-    external_id: str | None
    amount: int
    fee: int
    memo: str | None
@@ -264,7 +249,6 @@ class CreateInvoice(BaseModel):
    lnurl_withdraw: LnurlWithdrawResponse | None = None
    fiat_provider: str | None = None
    labels: list[str] = []
-    external_id: str | None = Query(default=None, max_length=256)

    @validator("payment_hash")
    def check_hex(cls, v):
@@ -279,10 +263,6 @@ class CreateInvoice(BaseModel):
            raise ValueError("The provided unit is not supported")
        return v

-    @validator("external_id")
-    def validate_external_id(cls, external_id):
-        return _validate_external_id(external_id)
-

 class PaymentsStatusCount(BaseModel):
    incoming: int = 0
@@ -321,12 +301,3 @@ class CancelInvoice(BaseModel):

 class UpdatePaymentLabels(BaseModel):
    labels: list[str] = []
-
-
-def _validate_external_id(external_id: str | None) -> str | None:
-    if external_id and not is_valid_external_id(external_id):
-        raise ValueError(
-            "Invalid external id. Max length is 256 characters. "
-            "Space and newlines are not allowed."
-        )
-    return external_id
@@ -1 +0,0 @@
-"""SSO authentication providers for LNbits"""
@@ -1,36 +0,0 @@
-"""Generic OIDC SSO Login Helper"""
-
-from typing import Optional
-
-import httpx
-from fastapi_sso.sso.base import DiscoveryDocument, OpenID, SSOBase
-
-
-class OidcSSO(SSOBase):
-    """Class providing login via Generic OIDC OAuth (e.g., Zitadel, Authentik, etc.)"""
-
-    provider = "oidc"
-    scope = ["openid", "email", "profile"]
-    discovery_url = ""
-
-    async def openid_from_response(
-        self, response: dict, session: Optional["httpx.AsyncClient"] = None
-    ) -> OpenID:
-        """Return OpenID from user information provided by OIDC provider"""
-        return OpenID(
-            email=response.get("email", ""),
-            provider=self.provider,
-            id=response.get("sub"),
-            first_name=response.get("given_name"),
-            last_name=response.get("family_name"),
-            display_name=response.get("name") or response.get("preferred_username"),
-            picture=response.get("picture"),
-        )
-
-    async def get_discovery_document(self) -> DiscoveryDocument:
-        """Get document containing handy urls"""
-        async with httpx.AsyncClient() as session:
-            response = await session.get(self.discovery_url)
-            content = response.json()
-
-            return content
@@ -1,6 +1,4 @@
-from datetime import datetime, timezone
-
-from pydantic import BaseModel, Field
+from pydantic import BaseModel


 class TinyURL(BaseModel):
@@ -8,4 +6,4 @@ class TinyURL(BaseModel):
    url: str
    endless: bool
    wallet: str
-    time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    time: float
@@ -1,9 +1,7 @@
 import base64
 import io
-from urllib.parse import quote
 from uuid import uuid4

-import filetype
 from fastapi import UploadFile
 from loguru import logger
 from PIL import Image
@@ -12,48 +10,11 @@ from lnbits.core.crud.assets import create_asset, get_user_assets_count
 from lnbits.core.models.assets import Asset
 from lnbits.settings import settings

-IMAGE_MIME_TYPE_ALIASES = {
-    "heic": "image/heic",
-    "heics": "image/heics",
-    "heif": "image/heif",
-    "image/jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "jpg": "image/jpeg",
-    "png": "image/png",
-}
-PIL_IMAGE_FORMAT_MIME_TYPES = {
-    "JPEG": "image/jpeg",
-    "PNG": "image/png",
-}
-INLINE_ASSET_MIME_TYPES = {
-    "image/heic",
-    "image/heics",
-    "image/heif",
-    "image/jpeg",
-    "image/png",
-}
-ASSET_SECURITY_HEADERS = {
-    "X-Content-Type-Options": "nosniff",
-    "Content-Security-Policy": (
-        "sandbox; default-src 'none'; script-src 'none'; "
-        "object-src 'none'; base-uri 'none'"
-    ),
-}
-THUMBNAIL_FORMAT_MIME_TYPES = {
-    "jpg": "image/jpeg",
-    "jpeg": "image/jpeg",
-    "png": "image/png",
-}
-

 async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) -> Asset:
    if not file.content_type:
        raise ValueError("File must have a content type.")
-
-    content_type = normalize_asset_mime_type(file.content_type)
-    filename = file.filename or "unnamed"
-
-    if content_type not in allowed_asset_mime_types():
+    if file.content_type.lower() not in settings.lnbits_assets_allowed_mime_types:
        raise ValueError(f"File type '{file.content_type}' not allowed.")

    if not settings.is_unlimited_assets_user(user_id):
@@ -69,26 +30,14 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
            f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
        )

-    stored_mime_type = detect_image_mime_type(contents)
-    if stored_mime_type != content_type:
-        logger.warning(
-            "Image MIME type mismatch: declared={}, detected={}",
-            content_type,
-            stored_mime_type,
-        )
-        raise ValueError(
-            "Image file content does not match declared file type. "
-            f"Declared: '{content_type}', detected: '{stored_mime_type}'."
-        )
-
    thumb_buffer = thumbnail_from_bytes(contents)

    asset = Asset(
        id=uuid4().hex,
        user_id=user_id,
-        mime_type=stored_mime_type,
+        mime_type=file.content_type,
        is_public=is_public,
-        name=filename,
+        name=file.filename or "unnamed",
        size_bytes=len(contents),
        thumbnail_base64=(
            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
@@ -102,79 +51,6 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
    return asset


-def normalize_asset_mime_type(content_type: str) -> str:
-    content_type = content_type.split(";", 1)[0].strip().lower()
-    return IMAGE_MIME_TYPE_ALIASES.get(content_type, content_type)
-
-
-def normalize_media_type(media_type: str) -> str:
-    return media_type.split(";", 1)[0].strip().lower() or "application/octet-stream"
-
-
-def thumbnail_media_type() -> str:
-    thumbnail_format = (settings.lnbits_asset_thumbnail_format or "png").strip().lower()
-    return THUMBNAIL_FORMAT_MIME_TYPES.get(thumbnail_format, "application/octet-stream")
-
-
-def content_disposition(disposition: str, filename: str) -> str:
-    safe_filename = filename or "unnamed"
-    quoted_filename = quote(safe_filename, safe="")
-    if quoted_filename == safe_filename:
-        return f'{disposition}; filename="{safe_filename}"'
-    return f"{disposition}; filename*=utf-8''{quoted_filename}"
-
-
-def allowed_asset_mime_types() -> set[str]:
-    return {
-        mime_type
-        for mime_type in (
-            normalize_asset_mime_type(mime_type)
-            for mime_type in settings.lnbits_assets_allowed_mime_types
-        )
-        if mime_type.startswith("image/")
-    }
-
-
-def detect_image_mime_type(contents: bytes) -> str:
-    kind = filetype.guess(contents)
-    mime_type = normalize_asset_mime_type(kind.mime) if kind else None
-
-    if mime_type and mime_type in PIL_IMAGE_FORMAT_MIME_TYPES.values():
-        verify_pil_image(contents, mime_type)
-        return mime_type
-
-    if mime_type and mime_type.startswith("image/"):
-        return mime_type
-
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if not mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-    return mime_type
-
-
-def verify_pil_image(contents: bytes, mime_type: str) -> None:
-    try:
-        with Image.open(io.BytesIO(contents)) as image:
-            image.verify()
-            detected_mime_type = PIL_IMAGE_FORMAT_MIME_TYPES.get(image.format or "")
-    except Exception as exc:
-        raise ValueError(
-            "Image file content does not match declared file type."
-        ) from exc
-
-    if detected_mime_type != mime_type:
-        raise ValueError("Image file content does not match declared file type.")
-
-
 def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
    try:
        image = Image.open(io.BytesIO(contents))
@@ -9,15 +9,19 @@ from lnbits.core.crud import (
    delete_installed_extension,
    get_db_version,
    get_installed_extension,
-    get_installed_extensions_count,
    update_installed_extension_state,
+    update_migration_version,
 )
 from lnbits.core.crud.extensions import (
    get_installed_extensions,
    update_installed_extension,
 )
 from lnbits.core.helpers import migrate_extension_database
-from lnbits.db import Connection
+from lnbits.core.wasm.extension_host import (
+    clear_schedules_for_extension,
+    clear_tag_watches_for_extension,
+)
+from lnbits.db import COCKROACH, POSTGRES, Connection, Database
 from lnbits.settings import settings

 from ..models.extensions import Extension, ExtensionMeta, InstallableExtension
@@ -39,8 +43,6 @@ async def install_extension(
    if installed_ext and installed_ext.meta:
        ext_info.meta.payments = installed_ext.meta.payments

-    await check_extensions_limit(installed_ext)
-
    if not skip_download:
        await ext_info.download_archive()

@@ -56,6 +58,9 @@ async def install_extension(
    else:
        await update_installed_extension(ext_info)

+    if ext_info.meta and ext_info.meta.extension_type == "wasm":
+        await update_migration_version(None, ext_info.id, 0)
+
    extension = Extension.from_installable_ext(ext_info)
    if extension.is_upgrade_extension:
        # call stop while the old routes are still active
@@ -66,15 +71,6 @@ async def install_extension(
    return extension


-async def check_extensions_limit(installed_ext: InstallableExtension | None = None):
-    if settings.lnbits_max_extensions == 0 or installed_ext:
-        return
-
-    extensions_count = await get_installed_extensions_count()
-    if extensions_count >= settings.lnbits_max_extensions:
-        raise ValueError("Max amount of extensions have been installed")
-
-
 async def uninstall_extension(ext_id: str):
    await stop_extension_background_work(ext_id)

@@ -82,10 +78,26 @@ async def uninstall_extension(ext_id: str):

    extension = await get_installed_extension(ext_id)
    if extension:
+        if extension.meta and extension.meta.extension_type == "wasm":
+            await clear_tag_watches_for_extension(ext_id)
+            await clear_schedules_for_extension(ext_id)
+            await _purge_wasm_extension_db(ext_id)
        extension.clean_extension_files()
    await delete_installed_extension(ext_id=ext_id)


+async def _purge_wasm_extension_db(ext_id: str) -> None:
+    cleaned = await Database.clean_ext_db_files(ext_id)
+    if cleaned:
+        return
+    try:
+        db = Database(f"ext_{ext_id}")
+        if db.type in {POSTGRES, COCKROACH}:
+            await db.execute(f"DROP SCHEMA IF EXISTS {ext_id} CASCADE")
+    except Exception as exc:
+        logger.warning(f"Failed to drop WASM extension schema for '{ext_id}': {exc}")
+
+
 async def activate_extension(ext: Extension):
    core_app_extra.register_new_ext_routes(ext)
    await update_installed_extension_state(ext_id=ext.code, active=True)
@@ -95,6 +107,10 @@ async def activate_extension(ext: Extension):
 async def deactivate_extension(ext_id: str):
    settings.deactivate_extension_paths(ext_id)
    await update_installed_extension_state(ext_id=ext_id, active=False)
+    extension = await get_installed_extension(ext_id)
+    if extension and extension.meta and extension.meta.extension_type == "wasm":
+        await clear_tag_watches_for_extension(ext_id)
+        await clear_schedules_for_extension(ext_id)
    await stop_extension_background_work(ext_id)


@@ -103,6 +119,9 @@ async def stop_extension_background_work(ext_id: str) -> bool:
    Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
    Extension must expose a `myextension_stop()` function if it is starting tasks.
    """
+    installed = await get_installed_extension(ext_id)
+    if installed and installed.meta and installed.meta.extension_type == "wasm":
+        return True
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -135,6 +154,9 @@ async def start_extension_background_work(ext_id: str) -> bool:
    Extension CAN expose a `myextension_start()` function if it is starting tasks.
    Extension MUST expose a `myextension_stop()` in that case.
    """
+    installed = await get_installed_extension(ext_id)
+    if installed and installed.meta and installed.meta.extension_type == "wasm":
+        return True
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)

@@ -2,13 +2,12 @@ import hashlib
 import hmac
 import json
 import time
-from base64 import b64encode

 import httpx
 from loguru import logger

 from lnbits.core.crud import get_wallet
-from lnbits.core.crud.payments import create_payment, update_payment
+from lnbits.core.crud.payments import create_payment
 from lnbits.core.models import CreatePayment, Payment, PaymentState
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.db import Connection
@@ -36,7 +35,9 @@ async def handle_fiat_payment_confirmation(
        logger.warning(e)


-async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
+async def check_fiat_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> FiatPaymentStatus:
    if not payment.is_internal:
        return FiatPaymentPendingStatus()
    if payment.success:
@@ -56,11 +57,10 @@ async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
        return FiatPaymentPendingStatus()
    fiat_status = await fiat_provider.get_invoice_status(checking_id)

-    if fiat_status.success:
-        payment.status = PaymentState.SUCCESS.value
-        await update_payment(payment)
-        await handle_fiat_payment_confirmation(payment)
+    if skip_internal_payment_notifications:
+        return fiat_status

+    if fiat_status.success:
        # notify receivers asynchronously
        from lnbits.tasks import internal_invoice_queue

@@ -169,82 +169,6 @@ async def verify_paypal_webhook(headers, payload: bytes):
        raise ValueError("PayPal webhook cannot be verified.") from exc


-def check_square_signature(
-    payload: bytes,
-    sig_header: str | None,
-    secret: str | None,
-    notification_url: str | None,
-):
-    if not sig_header:
-        logger.warning("Square signature header is missing.")
-        raise ValueError("Square signature header is missing.")
-
-    if not secret:
-        logger.warning("Square webhook signature key is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    if not notification_url:
-        logger.warning("Square webhook notification URL is not set.")
-        raise ValueError("Square webhook cannot be verified.")
-
-    signed_payload = notification_url.encode() + payload
-    computed_signature = b64encode(
-        hmac.new(
-            key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-        ).digest()
-    ).decode()
-
-    if hmac.compare_digest(computed_signature, sig_header) is not True:
-        logger.warning("Square signature verification failed.")
-        raise ValueError("Square signature verification failed.")
-
-
-def check_revolut_signature(
-    payload: bytes,
-    sig_header: str | None,
-    timestamp_header: str | None,
-    secret: str | None,
-    tolerance_seconds=300,
-):
-    if not sig_header:
-        logger.warning("Revolut signature header is missing.")
-        raise ValueError("Revolut signature header is missing.")
-
-    if not timestamp_header:
-        logger.warning("Revolut timestamp header is missing.")
-        raise ValueError("Revolut timestamp header is missing.")
-
-    if not secret:
-        logger.warning("Revolut webhook signing secret is not set.")
-        raise ValueError("Revolut webhook cannot be verified.")
-
-    try:
-        timestamp = int(timestamp_header)
-    except ValueError as exc:
-        logger.warning("Invalid Revolut timestamp.")
-        raise ValueError("Invalid Revolut timestamp.") from exc
-
-    timestamp_seconds = timestamp / 1000 if timestamp > 9999999999 else timestamp
-
-    if abs(time.time() - timestamp_seconds) > tolerance_seconds:
-        logger.warning("Timestamp outside tolerance.")
-        raise ValueError("Timestamp outside tolerance." f"Timestamp: {timestamp}")
-
-    signed_payload = b"v1." + timestamp_header.encode() + b"." + payload
-    digest = hmac.new(
-        key=secret.encode(), msg=signed_payload, digestmod=hashlib.sha256
-    ).hexdigest()
-    expected_signature = f"v1={digest}"
-
-    provided_signatures = [sig.strip() for sig in sig_header.split(",") if sig.strip()]
-    if not any(
-        hmac.compare_digest(expected_signature, provided)
-        for provided in provided_signatures
-    ):
-        logger.warning("Revolut signature verification failed.")
-        raise ValueError("Revolut signature verification failed.")
-
-
 async def test_connection(provider: str) -> SimpleStatus:
    """
    Test the connection to Stripe by checking if the API key is valid.
@@ -74,7 +74,7 @@ async def send_admin_notification(
    message: str,
    message_type: str | None = None,
 ) -> None:
-    return await send_notification_in_background(
+    return await send_notification(
        settings.lnbits_telegram_notifications_chat_id,
        settings.lnbits_nostr_notifications_identifiers,
        settings.lnbits_email_notifications_to_emails,
@@ -97,7 +97,7 @@ async def send_user_notification(
        if user_notifications.nostr_identifier
        else []
    )
-    return await send_notification_in_background(
+    return await send_notification(
        user_notifications.telegram_chat_id,
        nostr_identifiers,
        email_address,
@@ -222,20 +222,12 @@ async def send_email(
    msg["Subject"] = subject
    msg.attach(MIMEText(message, "plain"))
    username = username if len(username) > 0 else from_email
-
-    def _send() -> bool:
-        with smtplib.SMTP(server, port) as smtp_server:
-            smtp_server.starttls()
-            smtp_server.login(username, password)
-            smtp_server.sendmail(from_email, to_emails, msg.as_string())
+    with smtplib.SMTP(server, port) as smtp_server:
+        smtp_server.starttls()
+        smtp_server.login(username, password)
+        smtp_server.sendmail(from_email, to_emails, msg.as_string())
        return True

-    try:
-        return await asyncio.to_thread(_send)
-    except Exception as e:
-        logger.warning(f"Sending Email failed. {e!s}")
-        return False
-

 async def dispatch_webhook(payment: Payment):
    """
@@ -302,27 +294,6 @@ def send_payment_notification_in_background(wallet: Wallet, payment: Payment):
        logger.warning(f"Error sending payment notification: {e}")


-async def send_notification_in_background(
-    telegram_chat_id: str | None,
-    nostr_identifiers: list[str] | None,
-    email_addresses: list[str] | None,
-    message: str,
-    message_type: str | None = None,
-):
-    try:
-        create_task(
-            send_notification(
-                telegram_chat_id,
-                nostr_identifiers,
-                email_addresses,
-                message,
-                message_type,
-            )
-        )
-    except Exception as e:
-        logger.warning(f"Error sending notification in background: {e}")
-
-
 async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
    # TODO: websocket message should be a clean payment model
    # await websocket_manager.send(wallet.inkey, payment.json())
@@ -342,6 +313,11 @@ async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
        payment.payment_hash,
        json.dumps({"pending": payment.pending, "status": payment.status}),
    )
+    if payment.tag and not payment.is_out:
+        await websocket_manager.send(
+            f"tag:{wallet.id}:{payment.tag}",
+            payment.json(),
+        )


 async def send_chat_payment_notification(wallet: Wallet, payment: Payment):
@@ -19,6 +19,7 @@ from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
+from lnbits.tasks import create_task, internal_invoice_queue_put
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
@@ -63,7 +64,6 @@ async def pay_invoice(
    description: str = "",
    tag: str = "",
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if settings.lnbits_only_allow_incoming_payments:
@@ -97,7 +97,6 @@ async def pay_invoice(
            memo=description or invoice.description or "",
            extra=extra,
            labels=labels,
-            external_id=external_id,
        )

    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
@@ -170,15 +169,15 @@ async def create_fiat_invoice(

    internal_payment.fiat_provider = fiat_provider_name
    internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
-    # TODO: move to payment
+    # todo: move to payent
    internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
    new_checking_id = (
        f"fiat_{fiat_provider_name}_"
        f"{fiat_invoice.checking_id or internal_payment.checking_id}"
    )
-    internal_payment = await update_payment(
-        internal_payment, new_checking_id, conn=conn
-    )
+    await update_payment(internal_payment, new_checking_id, conn=conn)
+    internal_payment.checking_id = new_checking_id
+
    return internal_payment


@@ -218,7 +217,6 @@ async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
            internal=data.internal,
            payment_hash=data.payment_hash,
            labels=data.labels,
-            external_id=data.external_id,
            conn=conn,
        )

@@ -260,7 +258,6 @@ async def create_invoice(
    internal: bool | None = False,
    payment_hash: str | None = None,
    labels: list[str] | None = None,
-    external_id: str | None = None,
    conn: Connection | None = None,
 ) -> Payment:
    if not amount > 0:
@@ -345,7 +342,6 @@ async def create_invoice(
        webhook=webhook,
        fee=invoice_response.fee_msat or 0,
        labels=labels,
-        external_id=external_id,
    )

    payment = await create_payment(
@@ -373,7 +369,7 @@ async def update_pending_payment(
    status = await check_payment_status(payment)
    if status.failed:
        payment.status = PaymentState.FAILED
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment, conn=conn)
    elif status.success:
        payment = await update_payment_success_status(payment, status, conn=conn)
    return payment
@@ -513,8 +509,6 @@ async def update_wallet_balance(
        )
        payment.status = PaymentState.SUCCESS
        await update_payment(payment, conn=conn)
-        from lnbits.tasks import internal_invoice_queue_put
-
        await internal_invoice_queue_put(payment.checking_id)


@@ -629,14 +623,18 @@ async def check_transaction_status(
    return await check_payment_status(payment)


-async def check_payment_status(payment: Payment) -> PaymentStatus:
+async def check_payment_status(
+    payment: Payment, skip_internal_payment_notifications: bool | None = False
+) -> PaymentStatus:
    if payment.is_internal:
        if payment.success:
            return PaymentSuccessStatus()
        if payment.failed:
            return PaymentFailedStatus()
        if payment.is_in and payment.fiat_provider:
-            fiat_status = await check_fiat_status(payment)
+            fiat_status = await check_fiat_status(
+                payment, skip_internal_payment_notifications
+            )
            return PaymentStatus(paid=fiat_status.paid)
        return PaymentPendingStatus()
    funding_source = get_funding_source()
@@ -778,14 +776,9 @@ async def _pay_internal_invoice(
    await update_payment(internal_payment, conn=conn)
    logger.success(f"internal payment successful {internal_payment.checking_id}")

-    await _send_payment_notification_in_background(
-        wallet.id, payment, conn=conn
-    )  # notify the sender
-    await _send_payment_notification_in_background(
-        internal_payment.wallet_id, internal_payment, conn=conn
-    )  # notify the receiver
+    await _send_payment_notification_in_background(wallet.id, payment, conn=conn)

-    # notify receiver asynchronously (extension listeners)
+    # notify receiver asynchronously
    from lnbits.tasks import internal_invoice_queue

    logger.debug(f"enqueuing internal invoice {internal_payment.checking_id}")
@@ -826,8 +819,6 @@ async def _pay_external_invoice(

    fee_reserve_msat = fee_reserve(amount_msat, internal=False)

-    from lnbits.tasks import create_task
-
    task = create_task(
        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
    )
@@ -876,7 +867,7 @@ async def update_payment_success_status(
        payment.status = PaymentState.SUCCESS
        payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
        payment.preimage = payment.preimage or status.preimage
-        payment = await update_payment(payment, conn=conn)
+        await update_payment(payment, conn=conn)
    return payment


@@ -1077,31 +1068,3 @@ async def _send_payment_notification_in_background(
    if not wallet:
        raise PaymentError(f"Could not fetch wallet '{wallet_id}'.", status="failed")
    send_payment_notification_in_background(wallet, payment)
-
-
-async def update_invoice_from_paid_invoices_stream(checking_id: str) -> Payment | None:
-    """
-    Takes a checking_id of an incoming payment from paid_invoices_stream()
-    Checks its status, updates its status and returns it.
-    returns None if no incoming payment was found or the status is not successful
-    """
-    payment = await get_standalone_payment(checking_id, incoming=True)
-    if not payment:
-        logger.warning(f"No incoming payment found for '{checking_id}'.")
-        return None
-
-    status = await check_payment_status(payment)
-
-    if not status.success:
-        logger.error(
-            "Unexpected status response from paid_invoices_stream. Skipping update."
-        )
-        return None
-
-    payment.fee = status.fee_msat or payment.fee
-    # only overwrite preimage if status.preimage provides it
-    payment.preimage = status.preimage or payment.preimage
-    payment.status = PaymentState.SUCCESS
-    payment = await update_payment(payment)
-
-    return payment
@@ -23,7 +23,6 @@ from ..crud import (
    get_account_by_email,
    get_account_by_pubkey,
    get_account_by_username,
-    get_accounts_count,
    get_super_settings,
    get_user_extensions,
    get_user_from_account,
@@ -56,8 +55,6 @@ async def create_user_account_no_ckeck(
    conn: Connection | None = None,
 ) -> User:
    async with db.reuse_conn(conn) if conn else db.connect() as conn:
-        await check_users_limit(conn)
-
        if account:
            account.validate_fields()
            if account.username and await get_account_by_username(
@@ -98,15 +95,6 @@ async def create_user_account_no_ckeck(
    return user


-async def check_users_limit(conn: Connection | None = None):
-    if settings.lnbits_max_users == 0:
-        return
-
-    users_count = await get_accounts_count(conn=conn)
-    if users_count >= settings.lnbits_max_users:
-        raise ValueError("Max amount of users have been created")
-
-
 async def update_user_account(account: Account) -> Account:
    account.validate_fields()

@@ -185,12 +173,6 @@ async def check_admin_settings():
        if account and account.extra and account.extra.provider == "env":
            settings.first_install = True

-        if settings.has_first_install_token_changed():
-            logger.warning("First install token is changed. Resetting admin settings.")
-            new_settings = await init_admin_settings()
-            settings.super_user = new_settings.super_user
-            settings.first_install = True
-
        logger.success(
            "✔️ Admin UI is enabled. run `uv run lnbits-cli superuser` "
            "to get the superuser."
@@ -25,7 +25,6 @@ from lnbits.core.services.notifications import (
 )
 from lnbits.db import Filters
 from lnbits.settings import settings
-from lnbits.utils.cache import cache
 from lnbits.utils.exchange_rates import btc_rates

 audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()
@@ -156,11 +155,6 @@ async def collect_exchange_rates_data() -> None:
                    rates_values = [r[1] for r in rates]
                    lnbits_rate = sum(rates_values) / len(rates_values)
                    rates.append(("LNbits", lnbits_rate))
-                    cache.set(
-                        f"btc-price-{currency}",
-                        lnbits_rate,
-                        expiry=settings.lnbits_exchange_rate_cache_seconds,
-                    )
                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
            except Exception as ex:
                logger.warning(ex)
@@ -0,0 +1,3 @@
+{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
+%} {% block scripts %} {{ window_vars(user) }} {% endblock %} {% block page %}{%
+endblock %}
@@ -0,0 +1,3 @@
+{% extends "public.html" %} {% from "macros.jinja" import window_vars with
+context %} {% block scripts %} {{ window_vars() }} {% endblock %} {% block page
+%} {% endblock %}
@@ -16,14 +16,7 @@ from lnbits.core.crud.assets import (
 from lnbits.core.models.assets import AssetFilters, AssetInfo, AssetUpdate
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.users import AccountId
-from lnbits.core.services.assets import (
-    ASSET_SECURITY_HEADERS,
-    INLINE_ASSET_MIME_TYPES,
-    content_disposition,
-    create_user_asset,
-    normalize_media_type,
-    thumbnail_media_type,
-)
+from lnbits.core.services.assets import create_user_asset
 from lnbits.db import Filters, Page
 from lnbits.decorators import (
    check_account_id_exists,
@@ -82,7 +75,11 @@ async def api_get_asset_data(
    if not asset:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(asset.data, asset.mime_type, asset.name)
+    return Response(
+        content=asset.data,
+        media_type=asset.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset.name}"'},
+    )


@asset_router.get(
@@ -104,14 +101,14 @@ async def api_get_asset_thumbnail(
    if not asset_info:
        raise HTTPException(HTTPStatus.NOT_FOUND, "Asset not found.")

-    return asset_response(
+    return Response(
        content=(
            base64.b64decode(asset_info.thumbnail_base64)
            if asset_info.thumbnail_base64
            else b""
        ),
-        media_type=thumbnail_media_type(),
-        filename=asset_info.name,
+        media_type=asset_info.mime_type,
+        headers={"Content-Disposition": f'inline; filename="{asset_info.name}"'},
    )


@@ -175,16 +172,3 @@ async def api_delete_asset(

    await delete_user_asset(account_id.id, asset_id)
    return SimpleStatus(success=True, message="Asset deleted successfully.")
-
-
-def asset_response(content: bytes, media_type: str, filename: str) -> Response:
-    media_type = normalize_media_type(media_type)
-    disposition = "inline" if media_type in INLINE_ASSET_MIME_TYPES else "attachment"
-    return Response(
-        content=content,
-        media_type=media_type,
-        headers={
-            **ASSET_SECURITY_HEADERS,
-            "Content-Disposition": content_disposition(disposition, filename),
-        },
-    )
@@ -12,7 +12,6 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.crud.users import (
    get_user_access_control_lists,
    update_user_access_control_list,
@@ -36,7 +35,6 @@ from lnbits.decorators import (
    check_account_exists,
    check_admin,
    check_user_exists,
-    optional_user_id,
 )
 from lnbits.helpers import (
    create_access_token,
@@ -156,20 +154,9 @@ async def impersonate_user(

    max_age = settings.auth_token_expire_minutes * 60
    response.set_cookie(
-        "admin_access_token",
-        cookie_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_impersonated",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "admin_access_token", cookie_access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_impersonated", "true", max_age=max_age)
    return response


@@ -190,12 +177,7 @@ async def stop_impersonate_user(
    )
    max_age = settings.auth_token_expire_minutes * 60
    response.set_cookie(
-        "cookie_access_token",
-        admin_access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", admin_access_token, httponly=True, max_age=max_age
    )
    response.delete_cookie("admin_access_token")
    response.delete_cookie("is_access_token_expired")
@@ -321,10 +303,7 @@ async def api_delete_user_api_token(

@auth_router.get("/{provider}", description="SSO Provider")
 async def login_with_sso_provider(
-    request: Request,
-    provider: str,
-    user_id: str | None,
-    auth_user_id: str | None = Depends(optional_user_id),
+    request: Request, provider: str, user_id: str | None = None
 ):
    provider_sso = _new_sso(provider)
    if not provider_sso:
@@ -332,8 +311,6 @@ async def login_with_sso_provider(
            HTTPStatus.FORBIDDEN,
            f"Login by '{provider}' not allowed.",
        )
-    if user_id and user_id != auth_user_id:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "User ID mismatch.")

    provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
    with provider_sso:
@@ -354,11 +331,7 @@ async def handle_oauth_token(request: Request, provider: str) -> RedirectRespons
        userinfo = await provider_sso.verify_and_process(request)
        if not userinfo:
            raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid user info.")
-        if provider_sso.state is None or provider_sso.state == "null":
-            user_id = None
-        else:
-            user_id = decrypt_internal_message(provider_sso.state)
-
+        user_id = decrypt_internal_message(provider_sso.state)
    request.session.pop("user", None)
    return await _handle_sso_login(userinfo, user_id)

@@ -559,13 +532,6 @@ async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
    account.hash_password(data.password)
    await update_account(account)
    settings.first_install = False
-
-    # only confrm it after the super user has been successfully updated
-    if settings.first_install_token:
-        settings.first_install_token_confirmed = data.first_install_token
-        await set_settings_field(
-            "first_install_token_confirmed", data.first_install_token
-        )
    return _auth_success_response(account.username, account.id, account.email)


@@ -594,7 +560,7 @@ async def _handle_sso_login(userinfo: OpenID, verified_user_id: str | None = Non
            id=uuid4().hex, email=email, extra=UserExtra(email_verified=True)
        )
        await create_user_account(account)
-    return _auth_redirect_response(redirect_path, account.id, email)
+    return _auth_redirect_response(redirect_path, email)


 def _auth_success_response(
@@ -609,20 +575,9 @@ def _auth_success_response(
    max_age = settings.auth_token_expire_minutes * 60
    response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")

    return response
@@ -639,28 +594,15 @@ def _auth_api_token_response(
    )


-def _auth_redirect_response(path: str, user_id: str, email: str) -> RedirectResponse:
-    payload = AccessTokenPayload(
-        usr=user_id, sub="", email=email, auth_time=int(time())
-    )
+def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
+    payload = AccessTokenPayload(sub="" or "", email=email, auth_time=int(time()))
    access_token = create_access_token(data=payload.dict())
    max_age = settings.auth_token_expire_minutes * 60
    response = RedirectResponse(path)
    response.set_cookie(
-        "cookie_access_token",
-        access_token,
-        httponly=True,
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
-    )
-    response.set_cookie(
-        "is_lnbits_user_authorized",
-        "true",
-        secure=settings.auth_https_only,
-        samesite="lax",
-        max_age=max_age,
+        "cookie_access_token", access_token, httponly=True, max_age=max_age
    )
+    response.set_cookie("is_lnbits_user_authorized", "true", max_age=max_age)
    response.delete_cookie("is_access_token_expired")
    return response

@@ -680,10 +622,7 @@ def _new_sso(provider: str) -> SSOBase | None:

        sso_provider_class = _find_auth_provider_class(provider)
        sso_provider = sso_provider_class(
-            client_id,
-            client_secret,
-            None,
-            allow_insecure_http=not settings.auth_https_only,
+            client_id, client_secret, None, allow_insecure_http=True
        )
        if (
            discovery_url
@@ -4,30 +4,17 @@ from fastapi import APIRouter, Request
 from loguru import logger

 from lnbits.core.crud.payments import (
-    get_payments,
    get_standalone_payment,
-    update_payment,
 )
-from lnbits.core.models import Payment, PaymentFilters
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.payments import CreateInvoice
 from lnbits.core.services.fiat_providers import (
    check_fiat_status,
-    check_revolut_signature,
-    check_square_signature,
    check_stripe_signature,
    verify_paypal_webhook,
 )
-from lnbits.core.services.payments import (
-    create_fiat_invoice,
-    create_wallet_invoice,
-    service_fee_fiat,
-)
-from lnbits.db import Filter, Filters
-from lnbits.fiat import get_fiat_provider
+from lnbits.core.services.payments import create_fiat_invoice
 from lnbits.fiat.base import FiatSubscriptionPaymentOptions
-from lnbits.fiat.revolut import RevolutWallet
-from lnbits.fiat.square import SquareWallet
 from lnbits.settings import settings

 callback_router = APIRouter(prefix="/api/v1/callback", tags=["callback"])
@@ -63,41 +50,6 @@ async def api_generic_webhook_handler(
            message=f"Callback received successfully from '{provider_name}'.",
        )

-    if provider_name.lower() == "square":
-        payload = await request.body()
-        sig_header = request.headers.get("x-square-hmacsha256-signature")
-        check_square_signature(
-            payload,
-            sig_header,
-            settings.square_webhook_signature_key,
-            settings.square_payment_webhook_url,
-        )
-        event = await request.json()
-        await handle_square_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
-    if provider_name.lower() == "revolut":
-        payload = await request.body()
-        sig_header = request.headers.get("Revolut-Signature")
-        timestamp_header = request.headers.get("Revolut-Request-Timestamp")
-        check_revolut_signature(
-            payload,
-            sig_header,
-            timestamp_header,
-            settings.revolut_webhook_signing_secret,
-        )
-        event = await request.json()
-        await handle_revolut_event(event)
-
-        return SimpleStatus(
-            success=True,
-            message=f"Callback received successfully from '{provider_name}'.",
-        )
-
    return SimpleStatus(
        success=False,
        message=f"Unknown fiat provider '{provider_name}'.",
@@ -328,382 +280,3 @@ def _deserialize_paypal_metadata(custom_id: str) -> FiatSubscriptionPaymentOptio
    except (json.JSONDecodeError, IndexError) as e:
        logger.warning(f"Failed to deserialize PayPal metadata: {e}")
        return FiatSubscriptionPaymentOptions()
-
-
-async def handle_square_event(event: dict):
-    event_id = event.get("event_id") or event.get("id", "")
-    event_type = event.get("type", "")
-    logger.info(f"Handling Square event: '{event_id}'. Type: '{event_type}'.")
-
-    if event_type == "payment.updated":
-        await _handle_square_payment_event(event)
-        return
-
-    if event_type == "invoice.payment_made":
-        await _handle_square_invoice_payment_made(event)
-        return
-
-    logger.warning(f"Unhandled Square event type: '{event_type}'.")
-
-
-async def handle_revolut_event(event: dict):
-    event_type = event.get("event", "")
-    order_id = event.get("order_id")
-    logger.info(f"Handling Revolut event: '{event_type}'. Order ID: '{order_id}'.")
-
-    if event_type in ["ORDER_AUTHORISED", "ORDER_COMPLETED"]:
-        if not order_id:
-            logger.warning("Revolut event missing order_id.")
-            return
-
-        payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-        if payment:
-            await check_fiat_status(payment)
-            return
-
-        if event_type == "ORDER_COMPLETED":
-            logger.warning(f"No payment found for Revolut order: '{order_id}'.")
-            await _handle_revolut_subscription_order_paid(order_id)
-            return
-
-        logger.info(f"Ignoring Revolut authorised order without payment: '{order_id}'.")
-        return
-
-    if event_type == "SUBSCRIPTION_INITIATED":
-        logger.info("Revolut subscription initiated event received.")
-        return
-
-    if event_type in [
-        "SUBSCRIPTION_CANCELLED",
-        "SUBSCRIPTION_FINISHED",
-        "SUBSCRIPTION_OVERDUE",
-    ]:
-        logger.info(f"Revolut subscription lifecycle event received: '{event_type}'.")
-        return
-
-    logger.warning(f"Unhandled Revolut event type: '{event_type}'.")
-
-
-async def _get_revolut_provider() -> RevolutWallet | None:
-    fiat_provider = await get_fiat_provider("revolut")
-    if not isinstance(fiat_provider, RevolutWallet):
-        logger.warning("Revolut fiat provider is not configured.")
-        return None
-    return fiat_provider
-
-
-async def _handle_revolut_subscription(
-    subscription: dict,
-    fiat_provider: RevolutWallet,
-    order_id: str | None = None,
-    order: dict | None = None,
-):
-    subscription_id = subscription.get("id")
-    if not subscription_id:
-        logger.warning("Revolut subscription missing id.")
-        return
-
-    reference = fiat_provider.deserialize_subscription_reference(
-        subscription.get("external_reference")
-    )
-    if not reference:
-        logger.warning("Revolut subscription event missing LNbits metadata.")
-        return
-
-    if not order_id:
-        cycle_id = subscription.get("current_cycle_id")
-        if not cycle_id:
-            logger.warning("Revolut subscription missing current_cycle_id.")
-            return
-
-        cycle = await fiat_provider.get_subscription_cycle(subscription_id, cycle_id)
-        order_id = cycle.get("order_id")
-        if not order_id:
-            logger.warning("Revolut subscription cycle missing order_id.")
-            return
-
-    existing_payment = await get_standalone_payment(f"fiat_revolut_order_{order_id}")
-    if existing_payment:
-        if existing_payment.external_id != subscription_id:
-            existing_payment.external_id = subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    if not order:
-        order = await fiat_provider.get_order(order_id)
-    amount_minor = order.get("amount")
-    currency = (order.get("currency") or "").upper()
-    if amount_minor is None or not currency:
-        raise ValueError("Revolut subscription order missing amount or currency.")
-
-    extra = {
-        **(reference.extra or {}),
-        "subscription_request_id": subscription_id,
-        "fiat_method": "subscription",
-        "tag": reference.tag,
-        "subscription": {
-            "checking_id": f"order_{order_id}",
-            "payment_request": order.get("checkout_url") or "",
-        },
-    }
-    lnbits_payment = await _create_revolut_subscription_payment(
-        wallet_id=reference.wallet_id,
-        amount_minor=amount_minor,
-        currency=currency,
-        memo=reference.memo or "",
-        extra=extra,
-        order_id=order_id,
-        payment_request=order.get("checkout_url") or "",
-        subscription_id=subscription_id,
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_revolut_subscription_order_paid(order_id: str):
-    fiat_provider = await _get_revolut_provider()
-    if not fiat_provider:
-        return
-
-    order = await fiat_provider.get_order(order_id)
-    order_type = (order.get("type") or "").lower()
-    order_state = (order.get("state") or "").upper()
-    if order_type != "payment" or order_state != "COMPLETED":
-        logger.warning(f"Revolut order is not a completed payment: '{order_id}'.")
-        return
-
-    channel_data = order.get("channel_data") or {}
-    subscription_id = channel_data.get("subscription_id")
-    if not subscription_id:
-        logger.warning(f"Revolut order missing subscription_id: '{order_id}'.")
-        return
-
-    subscription = await fiat_provider.get_subscription(subscription_id)
-    if subscription.get("state") != "active":
-        logger.warning(f"Revolut subscription is not active: '{subscription_id}'.")
-        return
-
-    await _handle_revolut_subscription(
-        subscription, fiat_provider, order_id=order_id, order=order
-    )
-
-
-async def _create_revolut_subscription_payment(
-    wallet_id: str,
-    amount_minor: int,
-    currency: str,
-    memo: str,
-    extra: dict,
-    order_id: str,
-    payment_request: str,
-    subscription_id: str,
-) -> Payment:
-    amount = RevolutWallet.minor_units_to_amount(amount_minor, currency)
-    payment = await create_wallet_invoice(
-        wallet_id,
-        CreateInvoice(
-            unit=currency,
-            amount=amount,
-            memo=memo,
-            extra=extra,
-            internal=True,
-            external_id=subscription_id,
-        ),
-    )
-    payment.fee = -abs(service_fee_fiat(payment.msat, "revolut"))
-    payment.fiat_provider = "revolut"
-    payment.extra["fiat_checking_id"] = f"order_{order_id}"
-    payment.extra["fiat_payment_request"] = payment_request
-    checking_id = f"fiat_revolut_order_{order_id}"
-    await update_payment(payment, checking_id)
-    payment.checking_id = checking_id
-    return payment
-
-
-async def _handle_square_payment_event(event: dict):
-    payment = _square_extract_payment(event)
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if payment_options.wallet_id:
-        if not _square_payment_is_completed(payment):
-            logger.debug("Square subscription payment is not completed yet.")
-            return
-        await _handle_square_subscription_payment(payment, payment_options)
-        return
-
-    order_id = payment.get("order_id")
-    if not order_id:
-        logger.warning("Square payment event missing order_id.")
-        return
-
-    lnbits_payment = await get_standalone_payment(f"fiat_square_order_{order_id}")
-    if not lnbits_payment:
-        logger.warning(f"No payment found for Square order: '{order_id}'.")
-        return
-
-    await check_fiat_status(lnbits_payment)
-
-
-async def _handle_square_invoice_payment_made(event: dict):
-    invoice = event.get("data", {}).get("object", {}).get("invoice") or {}
-    order_id = invoice.get("order_id")
-    if not order_id:
-        logger.warning("Square invoice.payment_made event missing order_id.")
-        return
-    subscription_id = invoice.get("subscription_id")
-
-    fiat_provider = await get_fiat_provider("square")
-    if not isinstance(fiat_provider, SquareWallet):
-        logger.warning("Square fiat provider is not configured.")
-        return
-
-    payment = await fiat_provider.get_payment_for_order(order_id)
-    if not payment:
-        logger.warning(f"No Square payment found for invoice order: '{order_id}'.")
-        return
-
-    payment_options = _deserialize_square_metadata(_square_payment_note(payment))
-    if not payment_options.wallet_id:
-        payment_id = payment.get("id")
-        stored_payment = (
-            await get_standalone_payment(f"fiat_square_payment_{payment_id}")
-            if payment_id
-            else None
-        )
-        if not stored_payment and subscription_id:
-            stored_payments = await get_payments(
-                filters=Filters(
-                    filters=[
-                        Filter.parse_query(
-                            "external_id", [subscription_id], PaymentFilters
-                        )
-                    ],
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                    limit=1,
-                )
-            )
-            stored_payment = stored_payments[0] if stored_payments else None
-        if stored_payment:
-            payment_options = _square_payment_options_from_payment(stored_payment)
-        else:
-            logger.warning("Square subscription payment missing LNbits metadata.")
-            return
-
-    await _handle_square_subscription_payment(
-        payment,
-        payment_options,
-        invoice.get("public_url") or "",
-        square_subscription_id=subscription_id,
-    )
-
-
-async def _handle_square_subscription_payment(
-    payment: dict,
-    payment_options: FiatSubscriptionPaymentOptions,
-    payment_request: str = "",
-    square_subscription_id: str | None = None,
-):
-    amount_money = payment.get("amount_money") or {}
-    amount = amount_money.get("amount")
-    currency = (amount_money.get("currency") or "").upper()
-    payment_id = payment.get("id")
-    if amount is None or not currency or not payment_id:
-        raise ValueError("Square subscription payment event missing payment amount.")
-    wallet_id = payment_options.wallet_id
-    if not wallet_id:
-        raise ValueError("Square subscription payment event missing wallet_id.")
-
-    checking_id = f"payment_{payment_id}"
-    existing_payment = await get_standalone_payment(f"fiat_square_{checking_id}")
-    if existing_payment:
-        if (
-            square_subscription_id
-            and existing_payment.external_id != square_subscription_id
-        ):
-            existing_payment.external_id = square_subscription_id
-            await update_payment(existing_payment)
-        await check_fiat_status(existing_payment)
-        return
-
-    square_subscription_id = square_subscription_id or (
-        payment_options.extra or {}
-    ).get("square_subscription_id")
-    extra = {
-        **(payment_options.extra or {}),
-        "subscription_request_id": payment_options.subscription_request_id,
-        "fiat_method": "subscription",
-        "tag": payment_options.tag,
-        "subscription": {
-            "checking_id": checking_id,
-            "payment_request": payment_request,
-        },
-    }
-
-    lnbits_payment = await create_fiat_invoice(
-        wallet_id=wallet_id,
-        invoice_data=CreateInvoice(
-            unit=currency,
-            amount=amount / 100,
-            memo=payment_options.memo or "",
-            extra=extra,
-            fiat_provider="square",
-            external_id=square_subscription_id,
-        ),
-    )
-
-    await check_fiat_status(lnbits_payment)
-
-
-def _square_payment_options_from_payment(
-    payment: Payment,
-) -> FiatSubscriptionPaymentOptions:
-    extra = payment.extra or {}
-    return FiatSubscriptionPaymentOptions(
-        wallet_id=payment.wallet_id,
-        tag=extra.get("tag") or payment.tag,
-        subscription_request_id=extra.get("subscription_request_id"),
-        extra=extra,
-        memo=payment.memo,
-    )
-
-
-def _square_extract_payment(event: dict) -> dict:
-    event_object = event.get("data", {}).get("object", {})
-    return event_object.get("payment") or event_object
-
-
-def _square_payment_is_completed(payment: dict) -> bool:
-    return (payment.get("status") or "").upper() == "COMPLETED"
-
-
-def _square_payment_note(payment: dict) -> str:
-    return payment.get("note") or payment.get("payment_note") or ""
-
-
-def _deserialize_square_metadata(custom_id: str) -> FiatSubscriptionPaymentOptions:
-    try:
-        meta = json.loads(custom_id)
-        if not isinstance(meta, list):
-            return FiatSubscriptionPaymentOptions()
-        wallet_id = meta[0] if len(meta) > 0 else None
-        tag = meta[1] if len(meta) > 1 else None
-        subscription_request_id = meta[2] if len(meta) > 2 else None
-        extra_link = meta[3] if len(meta) > 3 else None
-        memo = meta[4] if len(meta) > 4 else None
-
-        extra = {
-            "link": extra_link,
-            "subscription_request_id": subscription_request_id,
-        }
-
-        return FiatSubscriptionPaymentOptions(
-            wallet_id=wallet_id,
-            tag=tag,
-            subscription_request_id=subscription_request_id,
-            extra=extra,
-            memo=memo,
-        )
-    except (json.JSONDecodeError, IndexError, TypeError):
-        return FiatSubscriptionPaymentOptions()
@@ -1,12 +1,15 @@
+import json
 import sys
 import traceback
 from http import HTTPStatus
+from pathlib import Path

 import httpx
 from bolt11 import decode as bolt11_decode
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Body, Depends, HTTPException
 from fastapi.requests import Request
 from loguru import logger
+from starlette.routing import Match

 from lnbits.core.crud.extensions import get_user_extensions
 from lnbits.core.crud.wallets import get_wallets_ids
@@ -20,6 +23,8 @@ from lnbits.core.models.extensions import (
    Extension,
    ExtensionConfig,
    ExtensionMeta,
+    ExtensionPermission,
+    ExtensionPermissionsGrant,
    ExtensionRelease,
    ExtensionReview,
    ExtensionReviewPaymentRequest,
@@ -40,6 +45,11 @@ from lnbits.core.services.extensions import (
    install_extension,
    uninstall_extension,
 )
+from lnbits.core.wasm import WASM_HOST_MANIFEST
+from lnbits.core.wasm.extension_host import (
+    clear_schedules_for_user,
+    clear_tag_watches_for_user,
+)
 from lnbits.db import Page
 from lnbits.decorators import (
    check_account_exists,
@@ -98,16 +108,12 @@ async def api_install_extension(data: CreateExtension):
        ext_info.clean_extension_files()
        detail = (
            str(exc)
-            if isinstance(exc, (AssertionError, ValueError))
+            if isinstance(exc, AssertionError)
            else f"Failed to install extension '{ext_info.id}'."
            f"({ext_info.installed_version})."
        )
        raise HTTPException(
-            status_code=(
-                HTTPStatus.BAD_REQUEST
-                if isinstance(exc, (AssertionError, ValueError))
-                else HTTPStatus.INTERNAL_SERVER_ERROR
-            ),
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
            detail=detail,
        ) from exc

@@ -178,38 +184,146 @@ async def api_update_pay_to_enable(

@extension_router.put("/{ext_id}/enable")
 async def api_enable_extension(
-    ext_id: str, account_id: AccountId = Depends(check_account_id_exists)
+    ext_id: str,
+    request: Request,
+    account_id: AccountId = Depends(check_account_id_exists),
+    grant: ExtensionPermissionsGrant | None = Body(default=None),
 ) -> SimpleStatus:
+    await _ensure_extension_exists(ext_id)
+    logger.info(f"Enabling extension: {ext_id}.")
+
+    ext = await _get_installed_active_extension(ext_id)
+    user_ext = await _get_or_create_user_extension(account_id.id, ext_id)
+
+    required_permissions = _get_required_permissions(ext_id, ext)
+    granted_permissions = _get_granted_permissions(grant, user_ext)
+    granted_tags = _get_granted_payment_tags(grant, user_ext)
+    required_tags = _get_required_payment_tags(ext_id, ext)
+    if _is_wasm_extension(ext_id, ext):
+        _ensure_api_permissions_available(
+            request, _merge_permissions(required_permissions, granted_permissions)
+        )
+        _ensure_payment_tags_allowed(required_tags, granted_tags)
+    _ensure_permissions(required_permissions, granted_permissions)
+
+    if grant and grant.permissions:
+        await _store_granted_permissions(user_ext, granted_permissions)
+    if grant and grant.payment_tags:
+        await _store_granted_payment_tags(user_ext, granted_tags)
+
+    if account_id.is_admin_id or not ext.requires_payment:
+        await _activate_user_extension(user_ext)
+        return SimpleStatus(success=True, message=f"Extension '{ext_id}' enabled.")
+
+    return await _enable_paid_extension(ext_id, ext, user_ext)
+
+
+async def _ensure_extension_exists(ext_id: str) -> None:
    if ext_id not in [e.code for e in await get_valid_extensions()]:
        raise HTTPException(
            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' doesn't exist."
        )

-    logger.info(f"Enabling extension: {ext_id}.")
+
+async def _get_installed_active_extension(ext_id: str) -> InstallableExtension:
    ext = await get_installed_extension(ext_id)
    if not ext:
        raise ValueError(f"Extension '{ext_id}' is not installed.")
    if not ext.active:
        raise ValueError(f"Extension '{ext_id}' is not activated.")
+    return ext

-    user_ext = await get_user_extension(account_id.id, ext_id)
+
+async def _get_or_create_user_extension(user_id: str, ext_id: str) -> UserExtension:
+    user_ext = await get_user_extension(user_id, ext_id)
    if not user_ext:
-        user_ext = UserExtension(user=account_id.id, extension=ext_id, active=False)
+        user_ext = UserExtension(user=user_id, extension=ext_id, active=False)
        await create_user_extension(user_ext)
+    return user_ext

-    if account_id.is_admin_id or not ext.requires_payment:
-        user_ext.active = True
-        await update_user_extension(user_ext)
-        return SimpleStatus(success=True, message=f"Extension '{ext_id}' enabled.")

+def _get_required_permissions(ext_id: str, ext: InstallableExtension) -> list[str]:
+    permissions_source = (
+        ext.meta.permissions
+        if ext.meta and ext.meta.permissions
+        else _load_permissions_from_config(ext_id)
+    )
+    return [p.id for p in permissions_source] if permissions_source else []
+
+
+def _get_granted_permissions(
+    grant: ExtensionPermissionsGrant | None, user_ext: UserExtension
+) -> list[str]:
+    if grant and grant.permissions:
+        return grant.permissions
+    if user_ext.extra and user_ext.extra.granted_permissions:
+        return user_ext.extra.granted_permissions
+    return []
+
+
+def _get_required_payment_tags(ext_id: str, ext: InstallableExtension) -> list[str]:
+    tags_source = (
+        ext.meta.payment_tags
+        if ext.meta and ext.meta.payment_tags
+        else _load_payment_tags_from_config(ext_id)
+    )
+    return tags_source if tags_source else []
+
+
+def _get_granted_payment_tags(
+    grant: ExtensionPermissionsGrant | None, user_ext: UserExtension
+) -> list[str]:
+    if grant and grant.payment_tags:
+        return grant.payment_tags
+    if user_ext.extra and user_ext.extra.granted_payment_tags:
+        return user_ext.extra.granted_payment_tags
+    return []
+
+
+def _ensure_permissions(required: list[str], granted: list[str]) -> None:
+    if not required:
+        return
+    missing = [p for p in required if p not in granted]
+    if missing:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            "Missing required permissions to enable this extension.",
+        )
+
+
+async def _store_granted_permissions(
+    user_ext: UserExtension, granted_permissions: list[str]
+) -> None:
+    user_ext_info = user_ext.extra or UserExtensionInfo()
+    user_ext_info.granted_permissions = granted_permissions
+    user_ext.extra = user_ext_info
+    await update_user_extension(user_ext)
+
+
+async def _store_granted_payment_tags(
+    user_ext: UserExtension, granted_tags: list[str]
+) -> None:
+    user_ext_info = user_ext.extra or UserExtensionInfo()
+    user_ext_info.granted_payment_tags = granted_tags
+    user_ext.extra = user_ext_info
+    await update_user_extension(user_ext)
+
+
+async def _activate_user_extension(user_ext: UserExtension) -> None:
+    user_ext.active = True
+    await update_user_extension(user_ext)
+
+
+async def _enable_paid_extension(
+    ext_id: str, ext: InstallableExtension, user_ext: UserExtension
+) -> SimpleStatus:
    if not (user_ext.extra and user_ext.extra.payment_hash_to_enable):
        raise HTTPException(
            HTTPStatus.PAYMENT_REQUIRED, f"Extension '{ext_id}' requires payment."
        )

    if user_ext.is_paid:
-        user_ext.active = True
-        await update_user_extension(user_ext)
+        await _activate_user_extension(user_ext)
        return SimpleStatus(success=True, message=f"Paid extension '{ext_id}' enabled.")

    if not ext.meta or not ext.meta.pay_to_enable or not ext.meta.pay_to_enable.wallet:
@@ -226,9 +340,8 @@ async def api_enable_extension(
            f"Invoice generated but not paid for enabeling extension '{ext_id}'.",
        )

-    user_ext.active = True
    user_ext.extra.paid_to_enable = True
-    await update_user_extension(user_ext)
+    await _activate_user_extension(user_ext)
    return SimpleStatus(success=True, message=f"Paid extension '{ext_id}' enabled.")


@@ -247,10 +360,117 @@ async def api_disable_extension(
        )
    logger.info(f"Disabling extension: {ext_id}.")
    user_ext.active = False
+    if user_ext.extra and user_ext.extra.granted_permissions:
+        user_ext.extra.granted_permissions = []
+    if user_ext.extra and user_ext.extra.granted_payment_tags:
+        user_ext.extra.granted_payment_tags = []
    await update_user_extension(user_ext)
+    ext = await get_installed_extension(ext_id)
+    if ext and ext.meta and ext.meta.extension_type == "wasm":
+        await clear_tag_watches_for_user(ext_id, account_id.id)
+        await clear_schedules_for_user(ext_id, account_id.id)
    return SimpleStatus(success=True, message=f"Extension '{ext_id}' disabled.")


+@extension_router.put("/{ext_id}/permissions")
+async def api_update_extension_permissions(
+    ext_id: str,
+    request: Request,
+    account_id: AccountId = Depends(check_account_id_exists),
+    grant: ExtensionPermissionsGrant | None = Body(default=None),
+) -> SimpleStatus:
+    if ext_id not in [e.code for e in await get_valid_extensions()]:
+        raise HTTPException(
+            HTTPStatus.NOT_FOUND, f"Extension '{ext_id}' doesn't exist."
+        )
+
+    ext = await get_installed_extension(ext_id)
+    if not ext:
+        raise ValueError(f"Extension '{ext_id}' is not installed.")
+    if not ext.active:
+        raise ValueError(f"Extension '{ext_id}' is not activated.")
+
+    user_ext = await get_user_extension(account_id.id, ext_id)
+    if not user_ext:
+        user_ext = UserExtension(user=account_id.id, extension=ext_id, active=False)
+        await create_user_extension(user_ext)
+
+    permissions_source = (
+        ext.meta.permissions
+        if ext.meta and ext.meta.permissions
+        else _load_permissions_from_config(ext_id)
+    )
+    required_permissions = (
+        [p.id for p in permissions_source] if permissions_source else []
+    )
+    granted_permissions = grant.permissions if grant and grant.permissions else []
+    granted_tags = grant.payment_tags if grant and grant.payment_tags else []
+    if _is_wasm_extension(ext_id, ext):
+        _ensure_api_permissions_available(
+            request, _merge_permissions(required_permissions, granted_permissions)
+        )
+        _ensure_payment_tags_allowed(
+            _get_required_payment_tags(ext_id, ext), granted_tags
+        )
+
+    if required_permissions:
+        missing = [p for p in required_permissions if p not in granted_permissions]
+        if missing:
+            raise HTTPException(
+                HTTPStatus.BAD_REQUEST,
+                "Missing required permissions to save for this extension.",
+            )
+
+    user_ext_info = user_ext.extra or UserExtensionInfo()
+    user_ext_info.granted_permissions = granted_permissions
+    user_ext_info.granted_payment_tags = granted_tags
+    user_ext.extra = user_ext_info
+    await update_user_extension(user_ext)
+
+    return SimpleStatus(success=True, message=f"Permissions saved for '{ext_id}'.")
+
+
+@extension_router.get("/{ext_id}/capabilities")
+async def api_extension_capabilities(
+    ext_id: str,
+    request: Request,
+    account_id: AccountId = Depends(check_account_id_exists),
+) -> dict:
+    await _ensure_extension_exists(ext_id)
+    ext = await get_installed_extension(ext_id)
+    if not ext:
+        raise ValueError(f"Extension '{ext_id}' is not installed.")
+
+    permissions_source = (
+        ext.meta.permissions
+        if ext.meta and ext.meta.permissions
+        else _load_permissions_from_config(ext_id)
+    )
+    permissions = [p.id for p in permissions_source] if permissions_source else []
+    missing = (
+        _missing_api_permissions(request, permissions)
+        if _is_wasm_extension(ext_id, ext)
+        else []
+    )
+    payment_tags = _get_required_payment_tags(ext_id, ext)
+
+    return {
+        "ok": True,
+        "extension": ext_id,
+        "is_wasm": _is_wasm_extension(ext_id, ext),
+        "permissions": permissions,
+        "missing_permissions": missing,
+        "payment_tags": payment_tags,
+    }
+
+
+@extension_router.get("/wasm/manifest")
+async def api_wasm_manifest(
+    account_id: AccountId = Depends(check_account_id_exists),
+) -> dict:
+    return WASM_HOST_MANIFEST
+
+
@extension_router.put("/{ext_id}/activate", dependencies=[Depends(check_admin)])
 async def api_activate_extension(ext_id: str) -> SimpleStatus:
    try:
@@ -292,6 +512,7 @@ async def api_deactivate_extension(ext_id: str) -> SimpleStatus:

@extension_router.delete("/{ext_id}", dependencies=[Depends(check_admin)])
 async def api_uninstall_extension(ext_id: str) -> SimpleStatus:
+
    extension = await get_installed_extension(ext_id)
    if not extension:
        raise HTTPException(
@@ -522,6 +743,7 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
        installed_exts: list[InstallableExtension] = await get_installed_extensions(
            conn=conn
        )
+        user_exts = await get_user_extensions(account_id.id, conn=conn)
        all_ext_ids = [ext.code for ext in await get_valid_extensions(conn=conn)]
        inactive_extensions = [
            e.id for e in await get_installed_extensions(active=False, conn=conn)
@@ -529,6 +751,7 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
        db_versions = await get_db_versions(conn=conn)

    installed_exts_ids = [e.id for e in installed_exts]
+    user_exts_map = {e.extension: e for e in user_exts}

    installable_exts = await InstallableExtension.get_installable_extensions(
        post_refresh_cache=account_id.is_admin_id
@@ -557,6 +780,10 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
            e.name = installed_ext.name
            e.short_description = installed_ext.short_description
            e.icon = installed_ext.icon
+        if e.meta and not e.meta.permissions:
+            e.meta.permissions = _load_permissions_from_config(e.id)
+        if e.meta and not e.meta.payment_tags:
+            e.meta.payment_tags = _load_payment_tags_from_config(e.id)

    extension_data = [
        {
@@ -566,7 +793,6 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
            "shortDescription": ext.short_description,
            "stars": ext.stars,
            "isFeatured": ext.meta.featured if ext.meta else False,
-            "categories": ext.meta.categories if ext.meta else [],
            "dependencies": ext.meta.dependencies if ext.meta else "",
            "isInstalled": ext.id in installed_exts_ids,
            "hasDatabaseTables": next(
@@ -575,6 +801,27 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
            "isAvailable": ext.id in all_ext_ids,
            "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
            "isActive": ext.id not in inactive_extensions,
+            "permissions": (
+                [dict(p) for p in ext.meta.permissions]
+                if ext.meta and ext.meta.permissions
+                else [dict(p) for p in _load_permissions_from_config(ext.id)]
+            ),
+            "paymentTags": (
+                ext.meta.payment_tags
+                if ext.meta and ext.meta.payment_tags
+                else _load_payment_tags_from_config(ext.id)
+            ),
+            "kvSchema": _load_kv_schema_from_config(ext.id),
+            "grantedPermissions": (
+                user_ext.extra.granted_permissions
+                if (user_ext := user_exts_map.get(ext.id)) and user_ext.extra
+                else []
+            ),
+            "grantedPaymentTags": (
+                user_ext.extra.granted_payment_tags
+                if (user_ext := user_exts_map.get(ext.id)) and user_ext.extra
+                else []
+            ),
            "latestRelease": (
                dict(ext.meta.latest_release)
                if ext.meta and ext.meta.latest_release
@@ -602,6 +849,162 @@ async def extensions(account_id: AccountId = Depends(check_account_id_exists)):
    return extension_data


+def _load_permissions_from_config(ext_id: str) -> list[ExtensionPermission]:
+    try:
+        conf_path = Path(
+            settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
+        )
+        if not conf_path.is_file():
+            return []
+        with open(conf_path, "r+") as json_file:
+            config_json = json.load(json_file)
+        permissions = config_json.get("permissions", [])
+        return [ExtensionPermission(**p) for p in permissions]
+    except Exception:
+        return []
+
+
+def _load_kv_schema_from_config(ext_id: str) -> dict:
+    try:
+        conf_path = Path(
+            settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
+        )
+        if not conf_path.is_file():
+            return {}
+        with open(conf_path, "r+") as json_file:
+            config_json = json.load(json_file)
+        schema = config_json.get("kv_schema", {})
+        return schema if isinstance(schema, dict) else {}
+    except Exception:
+        return {}
+
+
+def _load_payment_tags_from_config(ext_id: str) -> list[str]:
+    try:
+        conf_path = Path(
+            settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
+        )
+        if not conf_path.is_file():
+            return []
+        with open(conf_path, "r+") as json_file:
+            config_json = json.load(json_file)
+        tags = config_json.get("payment_tags", [])
+        return tags if isinstance(tags, list) else []
+    except Exception:
+        return []
+
+
+def _merge_permissions(required: list[str], granted: list[str]) -> list[str]:
+    merged = set()
+    for perm in required or []:
+        merged.add(perm)
+    for perm in granted or []:
+        merged.add(perm)
+    return list(merged)
+
+
+def _ensure_payment_tags_allowed(required: list[str], granted: list[str]) -> None:
+    if not required and granted:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            "This extension does not declare any payment tags.",
+        )
+    if required and not granted:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            "Select at least one payment tag before enabling this extension.",
+        )
+    if not required or not granted:
+        return
+    invalid = [t for t in granted if t not in required]
+    if invalid:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            f"Invalid payment tags requested: {', '.join(invalid)}",
+        )
+
+
+def _ensure_api_permissions_available(request: Request, permissions: list[str]) -> None:
+    if not permissions:
+        return
+    missing = []
+    for perm in permissions:
+        parsed = _parse_api_permission(perm)
+        if not parsed:
+            continue
+        method, path = parsed
+        if not _route_exists(request, method, path):
+            missing.append(perm)
+    if missing:
+        raise HTTPException(
+            HTTPStatus.BAD_REQUEST,
+            f"Permissions reference missing endpoints: {', '.join(missing)}",
+        )
+
+
+def _parse_api_permission(perm: str) -> tuple[str, str] | None:
+    if not perm.startswith("api."):
+        return None
+    try:
+        method_part, path = perm.split(":", 1)
+        method = method_part.replace("api.", "").upper()
+    except ValueError:
+        return None
+    if not path.startswith("/"):
+        return None
+    return method, path
+
+
+def _missing_api_permissions(request: Request, permissions: list[str]) -> list[str]:
+    missing = []
+    for perm in permissions or []:
+        parsed = _parse_api_permission(perm)
+        if not parsed:
+            continue
+        method, path = parsed
+        if not _route_exists(request, method, path):
+            missing.append(perm)
+    return missing
+
+
+def _route_exists(request: Request, method: str, path: str) -> bool:
+    scope = {
+        "type": "http",
+        "method": method,
+        "path": path,
+        "root_path": "",
+        "headers": [],
+    }
+    for route in request.app.router.routes:
+        methods = getattr(route, "methods", None)
+        if methods and method not in methods:
+            continue
+        try:
+            match, _ = route.matches(scope)
+        except Exception as exc:
+            logger.debug(f"Route match failed for {method} {path}: {exc!s}")
+            continue
+        if match == Match.FULL:
+            return True
+    return False
+
+
+def _is_wasm_extension(ext_id: str, ext: InstallableExtension) -> bool:
+    if ext.meta and ext.meta.extension_type == "wasm":
+        return True
+    try:
+        conf_path = Path(
+            settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
+        )
+        if not conf_path.is_file():
+            return False
+        with open(conf_path, "r+") as json_file:
+            config_json = json.load(json_file)
+        return config_json.get("extension_type") == "wasm"
+    except Exception:
+        return False
+
+
@extension_router.get(
    "/reviews/tags",
    dependencies=[Depends(check_account_exists)],
@@ -2,35 +2,17 @@ from http import HTTPStatus

 from fastapi import APIRouter, Depends, HTTPException
 from loguru import logger
-from pydantic import BaseModel

-from lnbits.core.crud.settings import set_settings_field
 from lnbits.core.models.misc import SimpleStatus
 from lnbits.core.models.wallets import WalletTypeInfo
-from lnbits.core.services import update_cached_settings
 from lnbits.core.services.fiat_providers import test_connection
 from lnbits.decorators import check_admin, require_admin_key
-from lnbits.fiat import RevolutWallet, StripeWallet, get_fiat_provider
+from lnbits.fiat import StripeWallet, get_fiat_provider
 from lnbits.fiat.base import CreateFiatSubscription, FiatSubscriptionResponse

 fiat_router = APIRouter(tags=["Fiat API"], prefix="/api/v1/fiat")


-class RevolutCreateWebhook(BaseModel):
-    url: str
-    endpoint: str | None = None
-    api_secret_key: str | None = None
-    api_version: str | None = None
-
-
-class RevolutCreateWebhookResponse(BaseModel):
-    id: str | None = None
-    url: str
-    events: list[str] = []
-    signing_secret: str
-    already_exists: bool = False
-
-
@fiat_router.put(
    "/check/{provider}",
    status_code=HTTPStatus.OK,
@@ -40,54 +22,6 @@ async def api_test_fiat_provider(provider: str) -> SimpleStatus:
    return await test_connection(provider)


-@fiat_router.post(
-    "/revolut/webhook",
-    status_code=HTTPStatus.OK,
-    dependencies=[Depends(check_admin)],
-)
-async def api_create_revolut_webhook(
-    data: RevolutCreateWebhook,
-) -> RevolutCreateWebhookResponse:
-    try:
-        webhook = await RevolutWallet.create_webhook(
-            url=data.url,
-            endpoint=data.endpoint,
-            api_secret_key=data.api_secret_key,
-            api_version=data.api_version,
-        )
-    except ValueError as exc:
-        logger.warning(exc)
-        raise HTTPException(status_code=400, detail=str(exc)) from exc
-    except Exception as exc:
-        logger.warning(exc)
-        raise HTTPException(
-            status_code=500, detail="Failed to create Revolut webhook."
-        ) from exc
-
-    signing_secret = webhook.get("signing_secret")
-    webhook_url = webhook.get("url") or data.url
-    if not signing_secret:
-        raise HTTPException(
-            status_code=502, detail="Revolut returned no webhook signing secret."
-        )
-
-    updated_settings = {
-        "revolut_payment_webhook_url": webhook_url,
-        "revolut_webhook_signing_secret": signing_secret,
-    }
-    for key, value in updated_settings.items():
-        await set_settings_field(key, value)
-    update_cached_settings(updated_settings)
-
-    return RevolutCreateWebhookResponse(
-        id=webhook.get("id"),
-        url=webhook_url,
-        events=webhook.get("events") or [],
-        signing_secret=signing_secret,
-        already_exists=webhook.get("already_exists", False),
-    )
-
-
@fiat_router.post(
    "/{provider}/subscription",
    status_code=HTTPStatus.OK,
@@ -200,7 +200,7 @@ async def index(
 ) -> HTMLResponse:
    return template_renderer().TemplateResponse(
        request,
-        "base.html",
+        "index.html",
        {
            "user": user.json(),
        },
@@ -211,7 +211,7 @@ async def index(
@generic_router.get("/node/public")
@generic_router.get("/first_install", dependencies=[Depends(check_first_install)])
 async def index_public(request: Request) -> HTMLResponse:
-    return template_renderer().TemplateResponse(request, "base.html", {"public": True})
+    return template_renderer().TemplateResponse(request, "index.html", {"public": True})


@generic_router.get("/uuidv4/{hex_value}")
@@ -36,8 +36,6 @@ lnurl_router = APIRouter(tags=["LNURL"])

 async def _handle(lnurl: str) -> LnurlResponseModel:
    try:
-        if "@" in lnurl:  # lower case lightning addresses
-            lnurl = lnurl.lower()
        res = await lnurl_handle(lnurl, user_agent=settings.user_agent, timeout=5)
        if isinstance(res, LnurlErrorResponse):
            raise HTTPException(status_code=HTTPStatus.BAD_REQUEST, detail=res.reason)
@@ -34,7 +34,6 @@ from lnbits.core.models import (
    PaymentWalletStats,
    SettleInvoice,
    SimpleStatus,
-    UpdatePaymentExtra,
 )
 from lnbits.core.models.payments import UpdatePaymentLabels
 from lnbits.core.models.users import AccountId
@@ -264,7 +263,6 @@ async def api_payments_create(
            payment_request=invoice_data.bolt11,
            extra=invoice_data.extra,
            labels=invoice_data.labels,
-            external_id=invoice_data.external_id,
        )
        return payment

@@ -298,38 +296,6 @@ async def api_update_payment_labels(
    return SimpleStatus(success=True, message="Payment labels updated.")


-@payment_router.patch(
-    "/extra",
-    name="Update payment extra",
-    description="Append new extra metadata to a payment.",
-    response_model=Payment,
-)
-async def api_update_payment_extra(
-    data: UpdatePaymentExtra,
-    key_type: WalletTypeInfo = Depends(require_admin_key),
-) -> Payment:
-    payment = await get_standalone_payment(
-        data.payment_hash, wallet_id=key_type.wallet.id
-    )
-    if payment is None:
-        raise HTTPException(HTTPStatus.NOT_FOUND, "Payment does not exist.")
-    if not payment.success:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST, "Payment extra can only be updated after success."
-        )
-
-    duplicate_keys = sorted(set(payment.extra).intersection(data.extra))
-    if duplicate_keys:
-        raise HTTPException(
-            HTTPStatus.BAD_REQUEST,
-            f"Extra keys already exist: {', '.join(duplicate_keys)}.",
-        )
-
-    payment.extra.update(data.extra)
-    await update_payment(payment)
-    return payment
-
-
@payment_router.get("/fee-reserve")
 async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
    invoice_obj = bolt11.decode(invoice)
@@ -1,5 +1,7 @@
 from fastapi import APIRouter, WebSocket

+from ..crud.wallets import get_wallet_for_key
+from ..models import KeyType
 from ..services import websocket_manager

 websocket_router = APIRouter(prefix="/api/v1/ws", tags=["Websocket"])
@@ -11,6 +13,30 @@ async def websocket_connect(websocket: WebSocket, item_id: str) -> None:
    await websocket_manager.listen(conn)


+@websocket_router.websocket("/tag/{tag}")
+async def websocket_connect_tag(websocket: WebSocket, tag: str) -> None:
+    api_key = websocket.headers.get("X-API-KEY") or websocket.query_params.get(
+        "api-key"
+    )
+    if not api_key:
+        await websocket.close(code=4401)
+        return
+
+    wallet = await get_wallet_for_key(api_key)
+    if not wallet:
+        await websocket.close(code=4404)
+        return
+
+    key_type = KeyType.admin if wallet.adminkey == api_key else KeyType.invoice
+    if key_type not in {KeyType.admin, KeyType.invoice}:
+        await websocket.close(code=4403)
+        return
+
+    item_id = f"tag:{wallet.id}:{tag}"
+    conn = await websocket_manager.connect(item_id, websocket)
+    await websocket_manager.listen(conn)
+
+
@websocket_router.post("/{item_id}")
 async def websocket_update_post(item_id: str, data: str):
    try:
@@ -0,0 +1 @@
+from lnbits.extensions.wasm.wasm_host import *  # noqa: F401,F403
@@ -0,0 +1 @@
+from lnbits.extensions.wasm.wasm_host.extension_host import *  # noqa: F401,F403
@@ -0,0 +1 @@
+from lnbits.extensions.wasm.wasm_host.runner import *  # noqa: F401,F403
@@ -0,0 +1 @@
+from lnbits.extensions.wasm.wasm_host.service import *  # noqa: F401,F403
@@ -35,7 +35,7 @@ if settings.lnbits_database_url:
    else:
        if not database_uri.startswith("postgres://"):
            raise ValueError(
-                "Please use the 'postgres://...' format for the database URL."
+                "Please use the 'postgres://...' " "format for the database URL."
            )
        DB_TYPE = POSTGRES

@@ -560,9 +560,7 @@ class Filters(BaseModel, Generic[TFilterModel]):

    def pagination(self) -> str:
        stmt = ""
-        if self.limit == 0:
-            self.limit = 1000
-        self.limit = 10 if self.limit is None else self.limit
+        self.limit = self.limit or 10
        stmt += f"LIMIT {min(1000, self.limit)} "
        if self.offset:
            stmt += f"OFFSET {self.offset}"
@@ -615,12 +613,6 @@ class Filters(BaseModel, Generic[TFilterModel]):
        for page_filter in self.filters:
            page_filter.table_name = table_name

-    def get_filter_by_field(self, field: str) -> Filter[TFilterModel] | None:
-        return next((f for f in self.filters if f.field == field), None)
-
-    def remove_filter_by_field(self, field: str) -> None:
-        self.filters = [f for f in self.filters if f.field != field]
-

 class DbJsonEncoder(json.JSONEncoder):
    def default(self, o):
@@ -9,8 +9,6 @@ from lnbits.fiat.base import FiatProvider
 from lnbits.settings import settings

 from .paypal import PayPalWallet
-from .revolut import RevolutWallet
-from .square import SquareWallet
 from .stripe import StripeWallet

 fiat_module = importlib.import_module("lnbits.fiat")
@@ -19,8 +17,6 @@ fiat_module = importlib.import_module("lnbits.fiat")
 class FiatProviderType(Enum):
    stripe = "StripeWallet"
    paypal = "PayPalWallet"
-    square = "SquareWallet"
-    revolut = "RevolutWallet"


 async def get_fiat_provider(name: str) -> FiatProvider | None:
@@ -56,7 +52,5 @@ fiat_providers: dict[str, FiatProvider] = {}

 __all__ = [
    "PayPalWallet",
-    "RevolutWallet",
-    "SquareWallet",
    "StripeWallet",
 ]
@@ -95,10 +95,6 @@ class FiatSubscriptionPaymentOptions(BaseModel):
        description="Unique ID that can be used to identify the subscription request."
        "If not provided, one will be generated.",
    )
-    customer_email: str | None = Field(
-        default=None,
-        description="The customer email to use for the subscription.",
-    )
    tag: str | None = Field(
        default=None,
        description="Payments created by the recurring subscription"
@@ -131,15 +127,15 @@ class FiatSubscriptionResponse(BaseModel):


 class FiatPaymentSuccessStatus(FiatPaymentStatus):
-    paid = True  # type: ignore[reportIncompatibleVariableOverride]
+    paid = True


 class FiatPaymentFailedStatus(FiatPaymentStatus):
-    paid = False  # type: ignore[reportIncompatibleVariableOverride]
+    paid = False


 class FiatPaymentPendingStatus(FiatPaymentStatus):
-    paid = None  # type: ignore[reportIncompatibleVariableOverride]
+    paid = None


 class FiatProvider(ABC):
@@ -1,646 +0,0 @@
-import asyncio
-import ipaddress
-import json
-from collections.abc import AsyncGenerator
-from decimal import ROUND_HALF_UP, Decimal
-from typing import Any
-from urllib.parse import urlparse
-
-import httpx
-from loguru import logger
-from pydantic import BaseModel, Field, ValidationError
-
-from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
-from lnbits.settings import settings
-
-from .base import (
-    FiatInvoiceResponse,
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
-    FiatPaymentResponse,
-    FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
-    FiatProvider,
-    FiatStatusResponse,
-    FiatSubscriptionPaymentOptions,
-    FiatSubscriptionResponse,
-)
-
-
-class RevolutCheckoutOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    success_url: str | None = None
-    metadata: dict[str, Any] = Field(default_factory=dict)
-    description: str | None = None
-
-
-class RevolutCreateInvoiceOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    checkout: RevolutCheckoutOptions | None = None
-
-
-class RevolutSubscriptionReference(BaseModel):
-    wallet_id: str
-    tag: str | None = None
-    subscription_request_id: str | None = None
-    extra: dict[str, Any] | None = None
-    memo: str | None = None
-
-
-REVOLUT_WEBHOOK_EVENTS = [
-    "ORDER_AUTHORISED",
-    "ORDER_COMPLETED",
-    "SUBSCRIPTION_INITIATED",
-]
-
-ZERO_DECIMAL_CURRENCIES = {
-    "BIF",
-    "CLP",
-    "DJF",
-    "GNF",
-    "ISK",
-    "JPY",
-    "KMF",
-    "KRW",
-    "PYG",
-    "RWF",
-    "UGX",
-    "VND",
-    "VUV",
-    "XAF",
-    "XOF",
-    "XPF",
-}
-THREE_DECIMAL_CURRENCIES = {
-    "BHD",
-    "IQD",
-    "JOD",
-    "KWD",
-    "LYD",
-    "OMR",
-    "TND",
-}
-REVOLUT_CUSTOMER_LIST_LIMIT = 500
-REVOLUT_CUSTOMER_LIST_MAX_PAGES = 20
-REVOLUT_REQUEST_TIMEOUT = 30
-
-
-class RevolutWallet(FiatProvider):
-    """https://developer.revolut.com/docs/merchant"""
-
-    def __init__(self):
-        logger.debug("Initializing RevolutWallet")
-        self._settings_fields = self._settings_connection_fields()
-        if not settings.revolut_api_endpoint:
-            raise ValueError("Cannot initialize RevolutWallet: missing endpoint.")
-        if not settings.revolut_api_secret_key:
-            raise ValueError("Cannot initialize RevolutWallet: missing API secret key.")
-
-        self.endpoint = normalize_endpoint(settings.revolut_api_endpoint)
-        self.headers = {
-            "Authorization": f"Bearer {settings.revolut_api_secret_key}",
-            "Revolut-Api-Version": settings.revolut_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
-        logger.info("RevolutWallet initialized.")
-
-    async def cleanup(self):
-        try:
-            await self.client.aclose()
-        except RuntimeError as e:
-            logger.warning(f"Error closing Revolut wallet connection: {e}")
-
-    async def status(
-        self, only_check_settings: bool | None = False
-    ) -> FiatStatusResponse:
-        if only_check_settings:
-            if self._settings_fields != self._settings_connection_fields():
-                return FiatStatusResponse("Connection settings have changed.", 0)
-            return FiatStatusResponse(balance=0)
-
-        try:
-            r = await self.client.get(
-                "/api/orders",
-                params={"limit": 1},
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            _ = r.json()
-            return FiatStatusResponse(balance=0)
-        except json.JSONDecodeError:
-            return FiatStatusResponse("Server error: 'invalid json response'", 0)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
-
-    async def create_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        memo: str | None = None,
-        extra: dict[str, Any] | None = None,
-        **kwargs,
-    ) -> FiatInvoiceResponse:
-        opts = self._parse_create_opts(extra or {})
-        if opts is None:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Invalid Revolut options"
-            )
-
-        amount_minor = self.amount_to_minor_units(amount, currency)
-        checkout = opts.checkout or RevolutCheckoutOptions()
-        success_url = (
-            checkout.success_url
-            or settings.revolut_payment_success_url
-            or "https://lnbits.com"
-        )
-
-        payload = {
-            "amount": amount_minor,
-            "currency": currency.upper(),
-            "description": checkout.description or memo or "LNbits Invoice",
-            "redirect_url": success_url,
-            "metadata": {
-                **checkout.metadata,
-                "payment_hash": payment_hash,
-                "alan_action": "invoice",
-            },
-        }
-
-        try:
-            r = await self.client.post(
-                "/api/orders", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
-            )
-            r.raise_for_status()
-            data = r.json()
-            order_id = data.get("id")
-            checkout_url = data.get("checkout_url")
-            if not order_id or not checkout_url:
-                return FiatInvoiceResponse(
-                    ok=False, error_message="Server error: missing order id or url"
-                )
-            return FiatInvoiceResponse(
-                ok=True,
-                checking_id=f"order_{order_id}",
-                payment_request=checkout_url,
-            )
-        except json.JSONDecodeError:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatInvoiceResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def create_subscription(
-        self,
-        subscription_id: str,
-        quantity: int,
-        payment_options: FiatSubscriptionPaymentOptions,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        if quantity != 1:
-            return FiatSubscriptionResponse(
-                ok=False,
-                error_message="Revolut subscriptions do not support quantity.",
-            )
-
-        wallet_id = payment_options.wallet_id
-        if not wallet_id:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Wallet ID is required."
-            )
-
-        extra = payment_options.extra or {}
-        if not payment_options.subscription_request_id:
-            payment_options.subscription_request_id = urlsafe_short_hash()
-
-        reference = RevolutSubscriptionReference(
-            wallet_id=wallet_id,
-            tag=payment_options.tag,
-            subscription_request_id=payment_options.subscription_request_id,
-            extra=extra,
-            memo=payment_options.memo,
-        )
-        payload: dict[str, Any] = {
-            "plan_variation_id": subscription_id,
-            "external_reference": self._serialize_subscription_reference(reference),
-            "setup_order_redirect_url": (
-                payment_options.success_url
-                or settings.revolut_payment_success_url
-                or "https://lnbits.com"
-            ),
-        }
-        if extra.get("trial_duration"):
-            payload["trial_duration"] = extra["trial_duration"]
-
-        headers = {
-            **self.headers,
-            "Idempotency-Key": payment_options.subscription_request_id,
-        }
-
-        try:
-            customer_id, customer_error = await self._get_subscription_customer_id(
-                payment_options
-            )
-            if not customer_id:
-                return FiatSubscriptionResponse(ok=False, error_message=customer_error)
-            payload["customer_id"] = customer_id
-            r = await self.client.post(
-                "/api/subscriptions",
-                json=payload,
-                headers=headers,
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            data = r.json()
-            revolut_subscription_id = data.get("id")
-            setup_order_id = data.get("setup_order_id")
-            if not revolut_subscription_id or not setup_order_id:
-                return FiatSubscriptionResponse(
-                    ok=False,
-                    error_message=(
-                        "Server error: missing subscription id or setup order id"
-                    ),
-                )
-
-            setup_order = await self.get_order(setup_order_id)
-            checkout_url = setup_order.get("checkout_url")
-            if not checkout_url:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Server error: missing setup checkout url"
-                )
-
-            return FiatSubscriptionResponse(
-                ok=True,
-                checkout_session_url=checkout_url,
-                subscription_request_id=revolut_subscription_id,
-            )
-        except json.JSONDecodeError:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def cancel_subscription(
-        self,
-        subscription_id: str,
-        correlation_id: str,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        try:
-            subscription = await self.get_subscription(subscription_id)
-            reference = self.deserialize_subscription_reference(
-                subscription.get("external_reference")
-            )
-            if not reference or reference.wallet_id != correlation_id:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Subscription not found."
-                )
-
-            r = await self.client.post(
-                f"/api/subscriptions/{subscription_id}/cancel",
-                timeout=REVOLUT_REQUEST_TIMEOUT,
-            )
-            r.raise_for_status()
-            return FiatSubscriptionResponse(ok=True)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Unable to cancel subscription."
-            )
-
-    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
-        raise NotImplementedError("Revolut does not support paying invoices directly.")
-
-    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
-        try:
-            order_id = self._normalize_revolut_id(checking_id)
-            return self._status_from_order(await self.get_order(order_id))
-        except Exception as exc:
-            logger.debug(f"Error getting Revolut invoice status: {exc}")
-            return FiatPaymentPendingStatus()
-
-    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
-        raise NotImplementedError("Revolut does not support outgoing payments.")
-
-    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
-        logger.warning(
-            "Revolut does not support paid invoices stream. Use webhooks instead."
-        )
-        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
-        while settings.lnbits_running:
-            value = await mock_queue.get()
-            yield value
-
-    def _normalize_revolut_id(self, checking_id: str) -> str:
-        value = (
-            checking_id.replace("fiat_revolut_", "", 1)
-            if checking_id.startswith("fiat_revolut_")
-            else checking_id
-        )
-        return value.replace("order_", "", 1) if value.startswith("order_") else value
-
-    async def get_order(self, order_id: str) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/orders/{order_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def get_subscription(self, subscription_id: str) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/subscriptions/{subscription_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def get_subscription_cycle(
-        self, subscription_id: str, cycle_id: str
-    ) -> dict[str, Any]:
-        r = await self.client.get(
-            f"/api/subscriptions/{subscription_id}/cycles/{cycle_id}",
-            timeout=REVOLUT_REQUEST_TIMEOUT,
-        )
-        r.raise_for_status()
-        return r.json()
-
-    async def _get_subscription_customer_id(
-        self, payment_options: FiatSubscriptionPaymentOptions
-    ) -> tuple[str | None, str | None]:
-        if not payment_options.customer_email:
-            return (
-                None,
-                "Revolut subscriptions require customer_email.",
-            )
-
-        customer = await self._get_customer_by_email(payment_options.customer_email)
-        customer_id = customer.get("id") if customer else None
-        if customer_id:
-            return customer_id, None
-
-        customer = await self._create_customer(payment_options.customer_email)
-        customer_id = customer.get("id")
-        if not customer_id:
-            return None, "Server error: missing customer id"
-        return customer_id, None
-
-    async def _get_customer_by_email(self, email: str) -> dict[str, Any] | None:
-        page_token = None
-        for _ in range(REVOLUT_CUSTOMER_LIST_MAX_PAGES):
-            customer_page = await self._list_customers(page_token=page_token)
-            customer = _find_customer_by_email(customer_page["customers"], email)
-            if customer:
-                return customer
-
-            page_token = customer_page.get("next_page_token")
-            if not page_token:
-                return None
-        return None
-
-    async def _list_customers(self, page_token: str | None = None) -> dict[str, Any]:
-        params: dict[str, Any] = {"limit": REVOLUT_CUSTOMER_LIST_LIMIT}
-        if page_token:
-            params["page_token"] = page_token
-        r = await self.client.get(
-            "/api/customers", params=params, timeout=REVOLUT_REQUEST_TIMEOUT
-        )
-        r.raise_for_status()
-        return _extract_customer_page(r.json())
-
-    async def _create_customer(self, email: str) -> dict[str, Any]:
-        r = await self.client.post(
-            "/api/customers",
-            json={"email": email},
-            timeout=REVOLUT_REQUEST_TIMEOUT,
-        )
-        r.raise_for_status()
-        return r.json()
-
-    @classmethod
-    async def create_webhook(
-        cls,
-        url: str,
-        endpoint: str | None = None,
-        api_secret_key: str | None = None,
-        api_version: str | None = None,
-    ) -> dict[str, Any]:
-        if not url:
-            raise ValueError("Missing Revolut webhook URL.")
-        cls._validate_webhook_url(url)
-        if not endpoint and not settings.revolut_api_endpoint:
-            raise ValueError("Missing Revolut API endpoint.")
-        if not api_secret_key and not settings.revolut_api_secret_key:
-            raise ValueError("Missing Revolut API secret key.")
-
-        base_url = normalize_endpoint(endpoint or settings.revolut_api_endpoint)
-        secret_key = api_secret_key or settings.revolut_api_secret_key
-        headers = {
-            "Authorization": f"Bearer {secret_key}",
-            "Revolut-Api-Version": api_version or settings.revolut_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        payload = {"url": url, "events": REVOLUT_WEBHOOK_EVENTS}
-        async with httpx.AsyncClient(base_url=base_url, headers=headers) as client:
-            webhooks = await cls._list_webhooks(client)
-            existing = await cls._get_existing_webhook(client, webhooks, url)
-            if existing:
-                existing["already_exists"] = True
-                return existing
-
-            response = await client.post(
-                "/api/webhooks", json=payload, timeout=REVOLUT_REQUEST_TIMEOUT
-            )
-            response.raise_for_status()
-            return response.json()
-
-    @classmethod
-    async def _list_webhooks(cls, client: httpx.AsyncClient) -> list[dict[str, Any]]:
-        response = await client.get("/api/webhooks", timeout=REVOLUT_REQUEST_TIMEOUT)
-        response.raise_for_status()
-        data = response.json()
-        if isinstance(data, list):
-            return data
-        if isinstance(data, dict):
-            for field in ["webhooks", "data", "items"]:
-                if isinstance(data.get(field), list):
-                    return data[field]
-        return []
-
-    @classmethod
-    async def _get_existing_webhook(
-        cls, client: httpx.AsyncClient, webhooks: list[dict[str, Any]], url: str
-    ) -> dict[str, Any] | None:
-        for webhook in webhooks:
-            if cls._normalize_webhook_url(webhook.get("url")) != (
-                cls._normalize_webhook_url(url)
-            ):
-                continue
-
-            webhook_id = webhook.get("id")
-            if webhook_id and (
-                not webhook.get("events") or not webhook.get("signing_secret")
-            ):
-                response = await client.get(
-                    f"/api/webhooks/{webhook_id}", timeout=REVOLUT_REQUEST_TIMEOUT
-                )
-                response.raise_for_status()
-                webhook = response.json()
-
-            events = set(webhook.get("events") or [])
-            missing_events = set(REVOLUT_WEBHOOK_EVENTS) - events
-            if missing_events:
-                raise ValueError(
-                    "A Revolut webhook already exists for this URL, but it is "
-                    f"missing required events: {', '.join(sorted(missing_events))}."
-                )
-
-            if not webhook.get("signing_secret"):
-                raise ValueError(
-                    "A Revolut webhook already exists for this URL, but Revolut "
-                    "did not return a signing secret."
-                )
-
-            return webhook
-        return None
-
-    @classmethod
-    def _normalize_webhook_url(cls, url: str | None) -> str:
-        return (url or "").strip().rstrip("/")
-
-    @classmethod
-    def _validate_webhook_url(cls, url: str) -> None:
-        parsed = urlparse(url)
-        hostname = parsed.hostname
-        if parsed.scheme not in ["http", "https"] or not hostname:
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-        host = hostname.lower()
-        if host == "localhost" or host.endswith(".localhost"):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-        if host.endswith(".local") or host.endswith(".onion"):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-        try:
-            ip = ipaddress.ip_address(host)
-        except ValueError:
-            return
-
-        if (
-            ip.is_loopback
-            or ip.is_private
-            or ip.is_link_local
-            or ip.is_reserved
-            or ip.is_unspecified
-        ):
-            raise ValueError("Revolut webhook URL must be a clearnet URL.")
-
-    def _status_from_order(self, order: dict[str, Any]) -> FiatPaymentStatus:
-        status = (order.get("state") or "").upper()
-        if status == "COMPLETED":
-            return FiatPaymentSuccessStatus()
-        if status in ["CANCELLED", "FAILED"]:
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    @classmethod
-    def amount_to_minor_units(cls, amount: float | Decimal, currency: str) -> int:
-        scale = Decimal(10) ** cls.currency_exponent(currency)
-        return int((Decimal(str(amount)) * scale).quantize(Decimal("1"), ROUND_HALF_UP))
-
-    @classmethod
-    def minor_units_to_amount(cls, amount: int, currency: str) -> float:
-        scale = Decimal(10) ** cls.currency_exponent(currency)
-        return float(Decimal(amount) / scale)
-
-    @classmethod
-    def currency_exponent(cls, currency: str) -> int:
-        normalized = currency.upper()
-        if normalized in ZERO_DECIMAL_CURRENCIES:
-            return 0
-        if normalized in THREE_DECIMAL_CURRENCIES:
-            return 3
-        return 2
-
-    def _parse_create_opts(
-        self, raw_opts: dict[str, Any]
-    ) -> RevolutCreateInvoiceOptions | None:
-        try:
-            return RevolutCreateInvoiceOptions.parse_obj(raw_opts)
-        except ValidationError as e:
-            logger.warning(f"Invalid Revolut options: {e}")
-            return None
-
-    def _serialize_subscription_reference(
-        self, reference: RevolutSubscriptionReference
-    ) -> str:
-        payload = reference.dict(exclude_none=True)
-        serialized = json.dumps(payload, separators=(",", ":"))
-        if len(serialized) > 1024:
-            raise ValueError("Revolut subscription external_reference is too long.")
-        return serialized
-
-    def deserialize_subscription_reference(
-        self, external_reference: str | None
-    ) -> RevolutSubscriptionReference | None:
-        if not external_reference:
-            return None
-        try:
-            return RevolutSubscriptionReference.parse_obj(
-                json.loads(external_reference)
-            )
-        except (json.JSONDecodeError, ValidationError) as exc:
-            logger.warning(exc)
-            return None
-
-    def _settings_connection_fields(self) -> str:
-        return "-".join(
-            [
-                str(settings.revolut_api_endpoint),
-                str(settings.revolut_api_secret_key),
-                str(settings.revolut_api_version),
-                str(settings.revolut_webhook_signing_secret),
-            ]
-        )
-
-
-def _extract_customer_page(data: Any) -> dict[str, Any]:
-    if isinstance(data, list):
-        return {"customers": _filter_customer_list(data)}
-    if isinstance(data, dict):
-        for field in ["customers", "data", "items"]:
-            customers = data.get(field)
-            if isinstance(customers, list):
-                return {
-                    "customers": _filter_customer_list(customers),
-                    "next_page_token": data.get("next_page_token"),
-                }
-    return {"customers": []}
-
-
-def _filter_customer_list(customers: list[Any]) -> list[dict[str, Any]]:
-    return [customer for customer in customers if isinstance(customer, dict)]
-
-
-def _find_customer_by_email(
-    customers: list[dict[str, Any]], email: str
-) -> dict[str, Any] | None:
-    normalized_email = email.casefold()
-    for customer in customers:
-        if str(customer.get("email") or "").casefold() == normalized_email:
-            return customer
-    return None
@@ -1,620 +0,0 @@
-import asyncio
-import json
-from collections.abc import AsyncGenerator
-from typing import Any, Literal
-
-import httpx
-from loguru import logger
-from pydantic import BaseModel, Field, ValidationError
-
-from lnbits.helpers import normalize_endpoint, urlsafe_short_hash
-from lnbits.settings import settings
-
-from .base import (
-    FiatInvoiceResponse,
-    FiatPaymentFailedStatus,
-    FiatPaymentPendingStatus,
-    FiatPaymentResponse,
-    FiatPaymentStatus,
-    FiatPaymentSuccessStatus,
-    FiatProvider,
-    FiatStatusResponse,
-    FiatSubscriptionPaymentOptions,
-    FiatSubscriptionResponse,
-)
-
-FiatMethod = Literal["checkout", "subscription"]
-
-
-class SquareCheckoutOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    success_url: str | None = None
-    metadata: dict[str, str] = Field(default_factory=dict)
-    line_item_name: str | None = None
-
-
-class SquareSubscriptionOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    checking_id: str | None = None
-    payment_request: str | None = None
-
-
-class SquareCreateInvoiceOptions(BaseModel):
-    class Config:
-        extra = "ignore"
-
-    fiat_method: FiatMethod = "checkout"
-    checkout: SquareCheckoutOptions | None = None
-    subscription: SquareSubscriptionOptions | None = None
-
-
-class SquareSubscriptionCheckoutInfo(BaseModel):
-    plan_variation_id: str
-    price_money: dict[str, Any]
-
-
-class SquareWallet(FiatProvider):
-    """https://developer.squareup.com/reference/square"""
-
-    def __init__(self):
-        logger.debug("Initializing SquareWallet")
-        self._settings_fields = self._settings_connection_fields()
-        if not settings.square_api_endpoint:
-            raise ValueError("Cannot initialize SquareWallet: missing endpoint.")
-        if not settings.square_access_token:
-            raise ValueError("Cannot initialize SquareWallet: missing access token.")
-        if not settings.square_location_id:
-            raise ValueError("Cannot initialize SquareWallet: missing location ID.")
-
-        self.endpoint = normalize_endpoint(settings.square_api_endpoint)
-        self.location_id = settings.square_location_id
-        self.headers = {
-            "Authorization": f"Bearer {settings.square_access_token}",
-            "Square-Version": settings.square_api_version,
-            "Content-Type": "application/json",
-            "User-Agent": settings.user_agent,
-        }
-        self.client = httpx.AsyncClient(base_url=self.endpoint, headers=self.headers)
-        logger.info("SquareWallet initialized.")
-
-    async def cleanup(self):
-        try:
-            await self.client.aclose()
-        except RuntimeError as e:
-            logger.warning(f"Error closing Square wallet connection: {e}")
-
-    async def status(
-        self, only_check_settings: bool | None = False
-    ) -> FiatStatusResponse:
-        if only_check_settings:
-            if self._settings_fields != self._settings_connection_fields():
-                return FiatStatusResponse("Connection settings have changed.", 0)
-            return FiatStatusResponse(balance=0)
-
-        try:
-            r = await self.client.get(f"/v2/locations/{self.location_id}", timeout=15)
-            r.raise_for_status()
-            _ = r.json()
-            return FiatStatusResponse(balance=0)
-        except json.JSONDecodeError:
-            return FiatStatusResponse("Server error: 'invalid json response'", 0)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatStatusResponse(f"Unable to connect to {self.endpoint}.", 0)
-
-    async def create_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        memo: str | None = None,
-        extra: dict[str, Any] | None = None,
-        **kwargs,
-    ) -> FiatInvoiceResponse:
-        opts = self._parse_create_opts(extra or {})
-        if not opts:
-            return FiatInvoiceResponse(ok=False, error_message="Invalid Square options")
-
-        if opts.fiat_method == "subscription":
-            return self._create_subscription_invoice(opts.subscription)
-
-        return await self._create_checkout_invoice(
-            amount=amount,
-            payment_hash=payment_hash,
-            currency=currency,
-            opts=opts,
-            memo=memo,
-        )
-
-    async def create_subscription(
-        self,
-        subscription_id: str,
-        quantity: int,
-        payment_options: FiatSubscriptionPaymentOptions,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        if settings.lnbits_running:
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Subscription not supported for Square."
-            )
-        success_url = (
-            payment_options.success_url
-            or settings.square_payment_success_url
-            or "https://lnbits.com"
-        )
-
-        if not payment_options.subscription_request_id:
-            payment_options.subscription_request_id = urlsafe_short_hash()
-        payment_options.extra = payment_options.extra or {}
-        payment_options.extra["subscription_request_id"] = (
-            payment_options.subscription_request_id
-        )
-        try:
-            checkout_info = await self._get_subscription_checkout_info(subscription_id)
-            metadata = self._serialize_metadata(payment_options)
-            payload = {
-                "idempotency_key": payment_options.subscription_request_id,
-                "description": metadata,
-                "quick_pay": {
-                    "name": (payment_options.memo or "LNbits Subscription")[:255],
-                    "price_money": checkout_info.price_money,
-                    "location_id": self.location_id,
-                },
-                "checkout_options": {
-                    "redirect_url": success_url,
-                    "subscription_plan_id": checkout_info.plan_variation_id,
-                },
-                "payment_note": metadata,
-            }
-            r = await self.client.post(
-                "/v2/online-checkout/payment-links", json=payload
-            )
-            r.raise_for_status()
-            data = r.json()
-            payment_link = data.get("payment_link") or {}
-            url = payment_link.get("url")
-            if not url:
-                return FiatSubscriptionResponse(
-                    ok=False, error_message="Server error: missing url"
-                )
-            return FiatSubscriptionResponse(
-                ok=True,
-                checkout_session_url=url,
-                subscription_request_id=payment_options.subscription_request_id,
-            )
-        except json.JSONDecodeError as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    async def cancel_subscription(
-        self,
-        subscription_id: str,
-        correlation_id: str,
-        **kwargs,
-    ) -> FiatSubscriptionResponse:
-        try:
-            square_subscription_id = await self._get_square_subscription_id(
-                subscription_id, correlation_id
-            )
-            r = await self.client.post(
-                f"/v2/subscriptions/{square_subscription_id}/cancel"
-            )
-            r.raise_for_status()
-            return FiatSubscriptionResponse(ok=True)
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatSubscriptionResponse(
-                ok=False, error_message="Unable to cancel subscription."
-            )
-
-    async def pay_invoice(self, payment_request: str) -> FiatPaymentResponse:
-        raise NotImplementedError("Square does not support paying invoices directly.")
-
-    async def get_invoice_status(self, checking_id: str) -> FiatPaymentStatus:
-        try:
-            square_id = self._normalize_square_id(checking_id)
-            if square_id.startswith("payment_"):
-                payment_id = square_id.replace("payment_", "", 1)
-                return await self._get_payment_status(payment_id)
-
-            order_id = (
-                square_id.replace("order_", "", 1)
-                if square_id.startswith("order_")
-                else square_id
-            )
-            return await self._get_order_status(order_id)
-        except Exception as exc:
-            logger.debug(f"Error getting Square invoice status: {exc}")
-            return FiatPaymentPendingStatus()
-
-    async def get_payment_status(self, checking_id: str) -> FiatPaymentStatus:
-        raise NotImplementedError("Square does not support outgoing payments.")
-
-    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
-        logger.warning(
-            "Square does not support paid invoices stream. Use webhooks instead."
-        )
-        mock_queue: asyncio.Queue[str] = asyncio.Queue(0)
-        while settings.lnbits_running:
-            value = await mock_queue.get()
-            yield value
-
-    async def _get_order_status(self, order_id: str) -> FiatPaymentStatus:
-        order = await self._get_order(order_id)
-        payment_id = self._payment_id_from_order(order)
-        if payment_id:
-            return await self._get_payment_status(payment_id)
-
-        if (order.get("state") or "").upper() == "CANCELED":
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    async def _get_order(self, order_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/orders/{order_id}")
-        r.raise_for_status()
-        return r.json().get("order") or {}
-
-    async def get_payment_for_order(self, order_id: str) -> dict[str, Any] | None:
-        order = await self._get_order(order_id)
-        payment_id = self._payment_id_from_order(order)
-        if not payment_id:
-            return None
-        return await self._get_payment(payment_id)
-
-    def _payment_id_from_order(self, order: dict[str, Any]) -> str | None:
-        tenders = order.get("tenders") or []
-        for tender in tenders:
-            payment_id = tender.get("payment_id")
-            if payment_id:
-                return payment_id
-        return None
-
-    async def _get_payment_status(self, payment_id: str) -> FiatPaymentStatus:
-        return self._status_from_payment(await self._get_payment(payment_id))
-
-    async def _get_payment(self, payment_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/payments/{payment_id}")
-        r.raise_for_status()
-        return r.json().get("payment") or {}
-
-    async def _get_subscription_checkout_info(
-        self, subscription_plan_id: str
-    ) -> SquareSubscriptionCheckoutInfo:
-        catalog_object = await self._get_catalog_object(subscription_plan_id)
-        if catalog_object.get("type") == "SUBSCRIPTION_PLAN":
-            return await self._get_plan_checkout_info(catalog_object)
-
-        if catalog_object.get("type") == "SUBSCRIPTION_PLAN_VARIATION":
-            price_money = await self._get_subscription_price_money(
-                catalog_object,
-            )
-            plan_variation_id = catalog_object.get("id")
-            if not plan_variation_id:
-                raise ValueError("Square subscription plan variation is missing an ID.")
-            return SquareSubscriptionCheckoutInfo(
-                plan_variation_id=plan_variation_id,
-                price_money=price_money,
-            )
-
-        raise ValueError(
-            "Square subscription ID must be a plan ID or plan variation ID."
-        )
-
-    async def _get_plan_checkout_info(
-        self, catalog_object: dict[str, Any]
-    ) -> SquareSubscriptionCheckoutInfo:
-        plan_data = catalog_object.get("subscription_plan_data") or {}
-        plan_variations = plan_data.get("subscription_plan_variations") or []
-        eligible_item_ids = plan_data.get("eligible_item_ids") or []
-        plan_variation = next(
-            (
-                variation
-                for variation in plan_variations
-                if not variation.get("is_deleted")
-            ),
-            None,
-        )
-        if not plan_variation:
-            raise ValueError("Square subscription plan is missing a variation.")
-
-        price_money = await self._get_subscription_price_money(
-            plan_variation,
-            eligible_item_ids=eligible_item_ids,
-        )
-        plan_variation_id = plan_variation.get("id")
-        if not plan_variation_id:
-            raise ValueError("Square subscription plan variation is missing an ID.")
-
-        return SquareSubscriptionCheckoutInfo(
-            plan_variation_id=plan_variation_id,
-            price_money=price_money,
-        )
-
-    async def _get_catalog_object(self, object_id: str) -> dict[str, Any]:
-        r = await self.client.get(f"/v2/catalog/object/{object_id}")
-        r.raise_for_status()
-        return r.json().get("object") or {}
-
-    async def _get_subscription_price_money(
-        self,
-        plan_variation: dict[str, Any],
-        eligible_item_ids: list[str] | None = None,
-    ) -> dict[str, Any]:
-        variation_data = plan_variation.get("subscription_plan_variation_data") or {}
-        phases = variation_data.get("phases") or []
-        for phase in phases:
-            pricing = phase.get("pricing") or {}
-            price_money = pricing.get("price_money") or phase.get(
-                "recurring_price_money"
-            )
-            parsed_price_money = self._parse_price_money(price_money)
-            if parsed_price_money:
-                return parsed_price_money
-
-            if pricing.get("type") == "RELATIVE":
-                return await self._get_relative_subscription_price_money(
-                    eligible_item_ids or []
-                )
-
-        raise ValueError("Square subscription plan variation is missing price_money.")
-
-    async def _get_relative_subscription_price_money(
-        self, eligible_item_ids: list[str]
-    ) -> dict[str, Any]:
-        if len(eligible_item_ids) != 1:
-            raise ValueError(
-                "Square relative subscription plan must have exactly one item."
-            )
-
-        item = await self._get_catalog_object(eligible_item_ids[0])
-        item_variations: list[dict[str, Any]] = []
-        if item.get("type") == "ITEM":
-            item_variations = (item.get("item_data") or {}).get("variations") or []
-        elif item.get("type") == "ITEM_VARIATION":
-            item_variations = [item]
-
-        item_variation = next(
-            (
-                variation
-                for variation in item_variations
-                if not variation.get("is_deleted")
-            ),
-            None,
-        )
-        if not item_variation:
-            raise ValueError("Square subscription item is missing a variation.")
-
-        price_money = self._parse_price_money(
-            (item_variation.get("item_variation_data") or {}).get("price_money")
-        )
-        if price_money:
-            return price_money
-
-        raise ValueError("Square subscription item variation is missing price_money.")
-
-    def _parse_price_money(
-        self, price_money: dict[str, Any] | None
-    ) -> dict[str, Any] | None:
-        if (
-            price_money
-            and price_money.get("amount") is not None
-            and price_money.get("currency")
-        ):
-            return {
-                "amount": int(price_money["amount"]),
-                "currency": price_money["currency"].upper(),
-            }
-        return None
-
-    def _status_from_payment(self, payment: dict[str, Any]) -> FiatPaymentStatus:
-        status = (payment.get("status") or "").upper()
-        if status == "COMPLETED":
-            return FiatPaymentSuccessStatus()
-        if status in ["CANCELED", "FAILED"]:
-            return FiatPaymentFailedStatus()
-        return FiatPaymentPendingStatus()
-
-    async def _create_checkout_invoice(
-        self,
-        amount: float,
-        payment_hash: str,
-        currency: str,
-        opts: SquareCreateInvoiceOptions,
-        memo: str | None = None,
-    ) -> FiatInvoiceResponse:
-        amount_cents = int(amount * 100)
-        co = opts.checkout or SquareCheckoutOptions()
-        success_url = (
-            co.success_url
-            or settings.square_payment_success_url
-            or "https://lnbits.com"
-        )
-        line_item_name = (co.line_item_name or memo or "LNbits Invoice")[:255]
-        metadata = {
-            **co.metadata,
-            "payment_hash": payment_hash,
-            "alan_action": "invoice",
-        }
-
-        payload = {
-            "idempotency_key": payment_hash,
-            "order": {
-                "location_id": self.location_id,
-                "metadata": metadata,
-                "line_items": [
-                    {
-                        "name": line_item_name,
-                        "quantity": "1",
-                        "base_price_money": {
-                            "amount": amount_cents,
-                            "currency": currency.upper(),
-                        },
-                    }
-                ],
-            },
-            "checkout_options": {"redirect_url": success_url},
-        }
-        if memo:
-            payload["payment_note"] = memo[:500]
-
-        try:
-            r = await self.client.post(
-                "/v2/online-checkout/payment-links", json=payload
-            )
-            r.raise_for_status()
-            data = r.json()
-            payment_link = data.get("payment_link") or {}
-            order_id = payment_link.get("order_id")
-            url = payment_link.get("url")
-            if not order_id or not url:
-                return FiatInvoiceResponse(
-                    ok=False, error_message="Server error: missing order id or url"
-                )
-            return FiatInvoiceResponse(
-                ok=True,
-                checking_id=f"order_{order_id}",
-                payment_request=url,
-            )
-        except json.JSONDecodeError:
-            return FiatInvoiceResponse(
-                ok=False, error_message="Server error: invalid json response"
-            )
-        except Exception as exc:
-            logger.warning(exc)
-            return FiatInvoiceResponse(
-                ok=False, error_message=f"Unable to connect to {self.endpoint}."
-            )
-
-    def _create_subscription_invoice(
-        self, opts: SquareSubscriptionOptions | None
-    ) -> FiatInvoiceResponse:
-        term = opts or SquareSubscriptionOptions()
-        checking_id = term.checking_id or f"payment_{urlsafe_short_hash()}"
-        return FiatInvoiceResponse(
-            ok=True,
-            checking_id=checking_id,
-            payment_request=term.payment_request or "",
-        )
-
-    def _normalize_square_id(self, checking_id: str) -> str:
-        return (
-            checking_id.replace("fiat_square_", "", 1)
-            if checking_id.startswith("fiat_square_")
-            else checking_id
-        )
-
-    def _parse_create_opts(
-        self, raw_opts: dict[str, Any]
-    ) -> SquareCreateInvoiceOptions | None:
-        try:
-            return SquareCreateInvoiceOptions.parse_obj(raw_opts)
-        except ValidationError as e:
-            logger.warning(f"Invalid Square options: {e}")
-            return None
-
-    def _serialize_metadata(
-        self, payment_options: FiatSubscriptionPaymentOptions
-    ) -> str:
-        extra_link = None
-        if payment_options.extra:
-            raw_link = payment_options.extra.get("link")
-            extra_link = str(raw_link)[:200] if raw_link else None
-
-        meta = [
-            payment_options.wallet_id,
-            payment_options.tag,
-            payment_options.subscription_request_id,
-            extra_link,
-        ]
-
-        memo_limit = 493 - len(json.dumps(meta, separators=(",", ":")))
-        if memo_limit > 0 and payment_options.memo:
-            meta.append(payment_options.memo[:memo_limit])
-        else:
-            meta.append(None)
-
-        metadata = json.dumps(meta, separators=(",", ":"))
-        if len(metadata) > 500:
-            raise ValueError("Square subscription metadata is too long.")
-        return metadata
-
-    async def _get_square_subscription_id(
-        self, subscription_id: str, wallet_id: str
-    ) -> str:
-        try:
-            from lnbits.core.crud.payments import get_payments
-            from lnbits.core.models import PaymentFilters
-            from lnbits.db import Filter, Filters
-
-            payments = await get_payments(
-                wallet_id=wallet_id,
-                filters=Filters(
-                    filters=[
-                        Filter.parse_query(
-                            "external_id", [subscription_id], PaymentFilters
-                        )
-                    ],
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                    limit=1,
-                ),
-            )
-            payment = next(
-                (
-                    payment
-                    for payment in payments
-                    if payment.external_id and payment.fiat_provider == "square"
-                ),
-                None,
-            )
-            if payment and payment.external_id:
-                return payment.external_id
-
-            payments = await get_payments(
-                wallet_id=wallet_id,
-                incoming=True,
-                filters=Filters(
-                    model=PaymentFilters,
-                    sortby="created_at",
-                    direction="desc",
-                ),
-            )
-            payment = next(
-                (
-                    payment
-                    for payment in payments
-                    if payment.external_id
-                    and payment.fiat_provider == "square"
-                    and (payment.extra or {}).get("subscription_request_id")
-                    == subscription_id
-                ),
-                None,
-            )
-            if payment and payment.external_id:
-                return payment.external_id
-        except Exception as exc:
-            logger.warning(exc)
-
-        return subscription_id
-
-    def _settings_connection_fields(self) -> str:
-        return "-".join(
-            [
-                str(settings.square_api_endpoint),
-                str(settings.square_access_token),
-                str(settings.square_location_id),
-                str(settings.square_api_version),
-            ]
-        )
@@ -7,14 +7,15 @@ from typing import Any
 from urllib import request
 from urllib.parse import urlparse

+import jinja2
 import jwt
 import shortuuid
 from fastapi.routing import APIRoute
 from loguru import logger
 from packaging import version
 from pydantic.schema import field_schema
-from starlette.templating import Jinja2Templates

+from lnbits.jinja2_templating import Jinja2Templates
 from lnbits.settings import settings
 from lnbits.utils.crypto import AESCipher
 from lnbits.utils.exchange_rates import currencies
@@ -55,6 +56,7 @@ def static_url_for(static: str, path: str) -> str:
 def template_renderer(additional_folders: list | None = None) -> Jinja2Templates:
    folders = [
        "lnbits/templates",
+        "lnbits/core/templates",
        settings.extension_builder_working_dir_path.as_posix(),
    ]

@@ -64,7 +66,7 @@ def template_renderer(additional_folders: list | None = None) -> Jinja2Templates
            for f in additional_folders
        ]
        folders.extend(additional_folders)
-    t = Jinja2Templates(directory=folders)
+    t = Jinja2Templates(loader=jinja2.FileSystemLoader(folders))
    t.env.globals["static_url_for"] = static_url_for
    t.env.globals["normalize_path"] = normalize_path

@@ -0,0 +1,28 @@
+import typing
+
+from jinja2 import BaseLoader, Environment, pass_context
+from starlette.datastructures import QueryParams
+from starlette.requests import Request
+from starlette.templating import Jinja2Templates as SuperJinja2Templates
+
+
+class Jinja2Templates(SuperJinja2Templates):
+    def __init__(self, loader: BaseLoader) -> None:
+        self.env = self.get_environment(loader)
+        super().__init__(env=self.env)
+
+    def get_environment(self, loader: BaseLoader) -> Environment:
+        @pass_context
+        def url_for(context: dict, name: str, **path_params: typing.Any) -> str:
+            request: Request = context["request"]
+            return request.app.url_path_for(name, **path_params)
+
+        def url_params_update(init: QueryParams, **new: typing.Any) -> QueryParams:
+            values = dict(init)
+            values.update(new)
+            return QueryParams(**values)
+
+        env = Environment(loader=loader, autoescape=True)
+        env.globals["url_for"] = url_for
+        env.globals["url_params_update"] = url_params_update
+        return env
@@ -1,78 +0,0 @@
-"""Generate llms.txt markdown from FastAPI OpenAPI schema for AI agents."""
-
-from typing import Any
-
-from fastapi import FastAPI
-from fastapi.responses import PlainTextResponse
-
-
-def generate_llms_txt(app: FastAPI) -> str:
-    """Convert an OpenAPI schema to llms.txt markdown format."""
-    openapi_schema = app.openapi()
-    lines: list[str] = []
-
-    # H1: API Title
-    info = openapi_schema.get("info", {})
-    title = info.get("title", "API")
-    lines.append(f"# {title}")
-    lines.append("")
-
-    # Blockquote: Description
-    description = info.get("description")
-    if description:
-        for line in description.strip().split("\n"):
-            lines.append(f"> {line}")
-        lines.append("")
-
-    # Group endpoints by tag
-    paths = openapi_schema.get("paths", {})
-    endpoints_by_tag: dict[str, list[dict[str, Any]]] = {}
-
-    for path, path_item in paths.items():
-        for method in ["get", "post", "put", "patch", "delete", "head", "options"]:
-            if method not in path_item:
-                continue
-            operation = path_item[method]
-            tags = operation.get("tags", ["Endpoints"])
-            tag = tags[0] if tags else "Endpoints"
-            if tag not in endpoints_by_tag:
-                endpoints_by_tag[tag] = []
-            endpoints_by_tag[tag].append(
-                {
-                    "path": path,
-                    "method": method.upper(),
-                    "operation": operation,
-                }
-            )
-
-    # Generate sections by tag
-    for tag, endpoints in endpoints_by_tag.items():
-        lines.append(f"## {tag}")
-        lines.append("")
-        for endpoint in endpoints:
-            method = endpoint["method"]
-            path = endpoint["path"]
-            operation = endpoint["operation"]
-            summary = operation.get("summary", "")
-            if summary:
-                lines.append(f"### `{method} {path}` - {summary}")
-            else:
-                lines.append(f"### `{method} {path}`")
-            lines.append("")
-        lines.append("")
-
-    return "\n".join(lines).strip() + "\n"
-
-
-def create_llms_txt_route(app: FastAPI) -> None:
-    """Add a /llms.txt endpoint to the app."""
-
-    @app.get(
-        "/llms.txt",
-        response_class=PlainTextResponse,
-        include_in_schema=False,
-        summary="Get LLM-friendly API documentation",
-    )
-    async def get_llms_txt() -> str:
-        """Return the API documentation in llms.txt markdown format."""
-        return generate_llms_txt(app)
@@ -7,7 +7,6 @@ from typing import Any
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 from loguru import logger
-from pyinstrument import Profiler
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
 from slowapi.middleware import SlowAPIMiddleware
@@ -247,16 +246,3 @@ def add_first_install_middleware(app: FastAPI):
        ):
            return RedirectResponse("/first_install")
        return await call_next(request)
-
-
-def add_profiler_middleware(app: FastAPI):
-    @app.middleware("http")
-    async def profile_middleware(request: Request, call_next):
-        profiling = request.query_params.get("profiler", False)
-        if profiling:
-            profiler = Profiler(async_mode="enabled")
-            profiler.start()
-            _ = await call_next(request)
-            profiler.stop()
-            return HTMLResponse(profiler.output_html())
-        return await call_next(request)
@@ -76,7 +76,7 @@ class LndRestNode(Node):
        return response.json()

    def get(self, path: str, **kwargs):
-        return self.request("GET", path, timeout=30, **kwargs)
+        return self.request("GET", path, **kwargs)

    async def _get_id(self) -> str:
        info = await self.get("/v1/getinfo")
@@ -99,12 +99,11 @@ class LndRestNode(Node):
                "perm": True,
                "timeout": 30,
            },
-            timeout=30,
        )

    async def disconnect_peer(self, peer_id: str):
        try:
-            await self.request("DELETE", "/v1/peers/" + peer_id, timeout=30)
+            await self.request("DELETE", "/v1/peers/" + peer_id)
        except HTTPException as exc:
            if "unable to disconnect" in exc.detail:
                raise HTTPException(
@@ -142,7 +141,6 @@ class LndRestNode(Node):
                "local_funding_amount": local_amount,
                "push_sat": push_amount,
            },
-            timeout=30,
        )
        return ChannelPoint(
            # WHY IS THIS REVERSED?!
@@ -216,7 +214,6 @@ class LndRestNode(Node):
                # 'min_htlc_msat': <uint64>,
                # 'inbound_fee': <InboundFee>,
            },
-            timeout=30,
        )

    async def get_channel(self, channel_id: str) -> NodeChannel | None:
@@ -284,7 +284,7 @@ class ThemesSettings(LNbitsSettings):
    lnbits_custom_image: str | None = Field(default="/static/images/logos/lnbits.svg")
    lnbits_ad_space_title: str = Field(default="Supported by")
    lnbits_ad_space: str = Field(
-        default="https://shop.lnbits.com/;/static/images/bitcoin-shop-banner.png;/static/images/bitcoin-shop-banner.png,https://affil.trezor.io/aff_c?offer_id=169&aff_id=33845;/static/images/bitcoin-hardware-wallet.png;/static/images/bitcoin-hardware-wallet.png,https://firefish.io/?ref=lnbits;/static/images/firefish.png;/static/images/firefish.png"
+        default="https://shop.lnbits.com/;/static/images/bitcoin-shop-banner.png;/static/images/bitcoin-shop-banner.png,https://affil.trezor.io/aff_c?offer_id=169&aff_id=33845;/static/images/bitcoin-hardware-wallet.png;/static/images/bitcoin-hardware-wallet.png,https://firefish.io/?ref=lnbits;/static/images/firefish.png;/static/images/firefish.png,https://opensats.org/;/static/images/open-sats.png;/static/images/open-sats.png"
    )  # sneaky sneaky
    lnbits_ad_space_enabled: bool = Field(default=False)
    lnbits_allowed_currencies: list[str] = Field(default=[])
@@ -292,15 +292,14 @@ class ThemesSettings(LNbitsSettings):
    lnbits_qr_logo: str = Field(default="/static/images/favicon_qr_logo.png")
    lnbits_apple_touch_icon: str | None = Field(default=None)
    lnbits_default_reaction: str = Field(default="confettiBothSides")
-    lnbits_default_theme: str = Field(default="bitcoin")
+    lnbits_default_theme: str = Field(default="salvador")
    lnbits_default_border: str = Field(default="hard-border")
    lnbits_default_gradient: bool = Field(default=True)
    lnbits_default_bgimage: str | None = Field(default=None)
    lnbits_default_dark: bool = Field(default=True)
-    lnbits_default_card_rounded: bool = Field(default=True)
-    lnbits_default_card_gradient: bool = Field(default=True)
+    lnbits_default_card_rounded: bool = Field(default=False)
+    lnbits_default_card_gradient: bool = Field(default=False)
    lnbits_default_card_shadow: bool = Field(default=False)
-    lnbits_default_burger_menu_background: bool = Field(default=True)


 class OpsSettings(LNbitsSettings):
@@ -324,6 +323,10 @@ class AssetSettings(LNbitsSettings):
            "heic",
            "heif",
            "heics",
+            "text/plain",
+            "text/json" "text/xml",
+            "application/json",
+            "application/pdf",
        ]
    )
    lnbits_asset_thumbnail_width: int = Field(default=128, ge=0)
@@ -359,7 +362,7 @@ class FeeSettings(LNbitsSettings):


 class ExchangeProvidersSettings(LNbitsSettings):
-    lnbits_exchange_rate_cache_seconds: int = Field(default=60, ge=0)
+    lnbits_exchange_rate_cache_seconds: int = Field(default=30, ge=0)
    lnbits_exchange_history_size: int = Field(default=60, ge=0)
    lnbits_exchange_history_refresh_interval_seconds: int = Field(default=300, ge=0)

@@ -444,7 +447,6 @@ class SecuritySettings(LNbitsSettings):

    lnbits_max_outgoing_payment_amount_sats: int = Field(default=10_000_000, ge=0)
    lnbits_max_incoming_payment_amount_sats: int = Field(default=10_000_000, ge=0)
-    first_install_token_confirmed: str | None = Field(default=None)

    def is_wallet_max_balance_exceeded(self, amount):
        return (
@@ -585,8 +587,6 @@ class ZBDFundingSource(LNbitsSettings):
 class PhoenixdFundingSource(LNbitsSettings):
    phoenixd_api_endpoint: str | None = Field(default="http://localhost:9740/")
    phoenixd_api_password: str | None = Field(default=None)
-    phoenixd_data_dir: str | None = Field(default=None)
-    phoenixd_mnemonic: str | None = Field(default=None)


 class AlbyFundingSource(LNbitsSettings):
@@ -610,7 +610,6 @@ class SparkL2FundingSource(LNbitsSettings):
    spark_l2_network: str = Field(default="MAINNET")
    spark_l2_external_endpoint: str | None = Field(default="http://localhost:8765")
    spark_l2_external_api_key: str | None = Field(default=None)
-    spark_l2_mnemonic: str | None = Field(default=None)
    spark_l2_pay_wait_ms: int = Field(default=4000, ge=0)
    spark_l2_pay_poll_ms: int = Field(default=500, ge=0)
    spark_l2_stream_keepalive_ms: int = Field(default=15000, ge=0)
@@ -699,35 +698,6 @@ class PayPalFiatProvider(LNbitsSettings):
    paypal_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)


-class SquareFiatProvider(LNbitsSettings):
-    square_enabled: bool = Field(default=False)
-    square_api_endpoint: str = Field(default="https://connect.squareup.com")
-    square_access_token: str | None = Field(default=None)
-    square_location_id: str | None = Field(default=None)
-    square_api_version: str = Field(default="2026-01-22")
-    square_payment_success_url: str = Field(default="https://lnbits.com")
-    square_payment_webhook_url: str = Field(
-        default="https://your-lnbits-domain-here.com/api/v1/callback/square"
-    )
-    square_webhook_signature_key: str | None = Field(default=None)
-
-    square_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)
-
-
-class RevolutFiatProvider(LNbitsSettings):
-    revolut_enabled: bool = Field(default=False)
-    revolut_api_endpoint: str = Field(default="https://merchant.revolut.com")
-    revolut_api_secret_key: str | None = Field(default=None)
-    revolut_api_version: str = Field(default="2026-04-20")
-    revolut_payment_success_url: str = Field(default="https://lnbits.com")
-    revolut_payment_webhook_url: str = Field(
-        default="https://your-lnbits-domain-here.com/api/v1/callback/revolut"
-    )
-    revolut_webhook_signing_secret: str | None = Field(default=None)
-
-    revolut_limits: FiatProviderLimits = Field(default_factory=FiatProviderLimits)
-
-
 class LightningSettings(LNbitsSettings):
    lightning_invoice_expiry: int = Field(default=3600, gt=0)

@@ -761,16 +731,10 @@ class FundingSourcesSettings(
    # How long to wait for the payment to be confirmed before returning a pending status
    # It will not fail the payment, it will make it return pending after the timeout
    lnbits_funding_source_pay_invoice_wait_seconds: int = Field(default=5, ge=0)
-    lnbits_funding_source_pending_interval_seconds: int = Field(default=1800, ge=0)
    funding_source_max_retries: int = Field(default=4, ge=0)


-class FiatProvidersSettings(
-    StripeFiatProvider,
-    PayPalFiatProvider,
-    SquareFiatProvider,
-    RevolutFiatProvider,
-):
+class FiatProvidersSettings(StripeFiatProvider, PayPalFiatProvider):
    def is_fiat_provider_enabled(self, provider: str | None) -> bool:
        """
        Checks if a specific fiat provider is enabled.
@@ -781,10 +745,6 @@ class FiatProvidersSettings(
            return self.stripe_enabled
        if provider == "paypal":
            return self.paypal_enabled
-        if provider == "square":
-            return self.square_enabled
-        if provider == "revolut":
-            return self.revolut_enabled
        return False

    def get_fiat_providers_for_user(self, user_id: str) -> list[str]:
@@ -804,18 +764,6 @@ class FiatProvidersSettings(
        ):
            allowed_providers.append("paypal")

-        if self.square_enabled and (
-            not self.square_limits.allowed_users
-            or user_id in self.square_limits.allowed_users
-        ):
-            allowed_providers.append("square")
-
-        if self.revolut_enabled and (
-            not self.revolut_limits.allowed_users
-            or user_id in self.revolut_limits.allowed_users
-        ):
-            allowed_providers.append("revolut")
-
        return allowed_providers

    def get_fiat_provider_limits(self, provider_name: str) -> FiatProviderLimits | None:
@@ -847,7 +795,6 @@ class AuthMethods(Enum):
    google_auth = "google-auth"
    github_auth = "github-auth"
    keycloak_auth = "keycloak-auth"
-    oidc_auth = "oidc-auth"

    @classmethod
    def all(cls):
@@ -858,7 +805,6 @@ class AuthMethods(Enum):
            AuthMethods.google_auth.value,
            AuthMethods.github_auth.value,
            AuthMethods.keycloak_auth.value,
-            AuthMethods.oidc_auth.value,
        ]


@@ -904,14 +850,6 @@ class KeycloakAuthSettings(LNbitsSettings):
    keycloak_client_custom_icon: str | None = Field(default=None)


-class OidcAuthSettings(LNbitsSettings):
-    oidc_discovery_url: str = Field(default="")
-    oidc_client_id: str = Field(default="")
-    oidc_client_secret: str = Field(default="")
-    oidc_client_custom_org: str | None = Field(default=None)
-    oidc_client_custom_icon: str | None = Field(default=None)
-
-
 class AuditSettings(LNbitsSettings):
    lnbits_audit_enabled: bool = Field(default=True)

@@ -1019,7 +957,6 @@ class EditableSettings(
    GoogleAuthSettings,
    GitHubAuthSettings,
    KeycloakAuthSettings,
-    OidcAuthSettings,
 ):
    @validator(
        "lnbits_admin_users",
@@ -1047,7 +984,7 @@ class EditableSettings(


 class UpdateSettings(EditableSettings):
-    class Config(EditableSettings.Config):
+    class Config:
        extra = Extra.forbid


@@ -1055,9 +992,6 @@ class EnvSettings(LNbitsSettings):
    debug: bool = Field(default=False)
    debug_database: bool = Field(default=False)
    bundle_assets: bool = Field(default=True)
-    profiler: bool = Field(default=False)
-    # When enabled, auth cookies require HTTPS and SSO will reject insecure HTTP.
-    auth_https_only: bool = Field(default=True)
    host: str = Field(default="127.0.0.1")
    port: int = Field(default=5000, gt=0)
    forwarded_allow_ips: str = Field(default="*")
@@ -1075,20 +1009,11 @@ class EnvSettings(LNbitsSettings):

    cleanup_wallets_days: int = Field(default=90, ge=0)
    funding_source_max_retries: int = Field(default=4, ge=0)
-    lnbits_max_users: int = Field(default=0, ge=0)
-    lnbits_max_extensions: int = Field(default=0, ge=0)

    @property
    def has_default_extension_path(self) -> bool:
        return self.lnbits_extensions_path == "lnbits"

-    def has_first_install_token_changed(self) -> bool:
-        if not self.first_install_token:
-            return False
-        if not settings.first_install_token_confirmed:
-            return False
-        return self.first_install_token != settings.first_install_token_confirmed
-
    def check_auth_secret_key(self):
        if self.auth_secret_key:
            return
@@ -1198,11 +1123,11 @@ class ReadOnlySettings(


 class Settings(EditableSettings, ReadOnlySettings, TransientSettings, BaseSettings):
-    class Config(EditableSettings.Config, BaseSettings.Config):  # type: ignore[misc]
+    class Config:
        env_file = ".env"
        env_file_encoding = "utf-8"
        case_sensitive = False
-        json_loads = list_parse_fallback  # type: ignore[assignment]
+        json_loads = list_parse_fallback

    def is_user_allowed(self, user_id: str) -> bool:
        return (
@@ -1248,8 +1173,6 @@ class PublicSettings(BaseModel):
    auth_methods: list[str] = Field(alias="authMethods")
    keycloak_org: str | None = Field(alias="keycloakOrg")
    keycloak_icon: str | None = Field(alias="keycloakIcon")
-    oidc_org: str | None = Field(alias="oidcOrg")
-    oidc_icon: str | None = Field(alias="oidcIcon")
    has_holdinvoice: bool = Field(alias="hasHoldinvoice")
    has_nodemanager: bool = Field(alias="hasNodemanager")
    show_nodemanager: bool = Field(alias="showNodemanager")
@@ -1282,7 +1205,6 @@ class PublicSettings(BaseModel):
    default_card_rounded: bool = Field(alias="defaultCardRounded")
    default_card_gradient: bool = Field(alias="defaultCardGradient")
    default_card_shadow: bool = Field(alias="defaultCardShadow")
-    default_burger_menu_background: bool = Field(alias="defaultBurgerMenuBackground")
    denomination: str | None = Field()
    extensions: list[str] = Field()
    allowed_currencies: list[str] = Field(alias="allowedCurrencies")
@@ -1315,8 +1237,6 @@ class PublicSettings(BaseModel):
            authMethods=settings.auth_allowed_methods,
            keycloakOrg=settings.keycloak_client_custom_org,
            keycloakIcon=settings.keycloak_client_custom_icon,
-            oidcOrg=settings.oidc_client_custom_org,
-            oidcIcon=settings.oidc_client_custom_icon,
            hasHoldinvoice=settings.has_holdinvoice,
            hasNodemanager=settings.has_nodemanager,
            showNodemanager=settings.lnbits_node_ui and settings.has_nodemanager,
@@ -1346,7 +1266,6 @@ class PublicSettings(BaseModel):
            defaultCardRounded=settings.lnbits_default_card_rounded,
            defaultCardGradient=settings.lnbits_default_card_gradient,
            defaultCardShadow=settings.lnbits_default_card_shadow,
-            defaultBurgerMenuBackground=settings.lnbits_default_burger_menu_background,
            denomination=settings.lnbits_denomination,
            extensions=list(settings.lnbits_installed_extensions_ids),
            allowedCurrencies=settings.lnbits_allowed_currencies,
@@ -212,15 +212,12 @@ body.bg-image .q-page-container {
  backdrop-filter: none; /* Ensure the page content is not affected */
 }

-body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  --q-dark: rgba(29, 29, 29, 0.3);
-  background-color: var(--q-dark);
-}
+body.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark),
 body.body--dark .q-header,
 body.body--dark .q-drawer {
  --q-dark: rgba(29, 29, 29, 0.3);
  background-color: var(--q-dark);
-  backdrop-filter: brightness(0.8);
+  backdrop-filter: blur(6px) brightness(0.8);
 }

 body.rounded-ui .q-card,
@@ -391,18 +388,11 @@ body[data-theme=salvador].card-gradient.body--dark .q-drawer {
 }

 body.card-shadow .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  box-shadow: 0 10px 24px rgba(0, 0, 0, 0.18);
+  filter: drop-shadow(0 10px 24px rgba(0, 0, 0, 0.18));
 }

 body.card-shadow.body--dark .q-card:not(.q-dialog .q-card, .lnbits__dialog-card, .q-dialog-plugin--dark) {
-  box-shadow: 0 12px 28px rgba(0, 0, 0, 0.45);
-}
-
-body.no-burger-background .q-drawer {
-  background-color: transparent !important;
-  background-image: none !important;
-  backdrop-filter: none !important;
-  box-shadow: none !important;
+  filter: drop-shadow(0 12px 28px rgba(0, 0, 0, 0.45));
 }

 :root {
@@ -6,7 +6,6 @@ window.localisation.br = {
  funding: 'Financiamento',
  users: 'Usuários',
  audit: 'Auditoria',
-  api_watch: 'Relógio da API',
  apps: 'Aplicativos',
  channels: 'Canais',
  transactions: 'Transações',
@@ -22,17 +21,13 @@ window.localisation.br = {
  active_channels: 'Canais Ativos',
  connect_peer: 'Conectar Par',
  connect: 'Conectar',
-  reconnect: 'Reconectar',
  open_channel: 'Canal Aberto',
  open: 'Abrir',
-  clear: 'Limpar',
  close_channel: 'Fechar Canal',
  close: 'Fechar',
  restart: 'Reiniciar servidor',
-  image_library: 'Biblioteca de Imagens',
  save: 'Salvar',
  save_tooltip: 'Salvar suas alterações',
-  must_save: 'Você tem alterações não salvas',
  credit_debit: 'Crédito / Débito',
  credit_hint: 'Pressione Enter para creditar a conta',
  credit_label: '{denomination} para creditar',
@@ -51,47 +46,24 @@ window.localisation.br = {
  export_to_phone: 'Exportar para o telefone com código QR',
  export_to_phone_desc:
    'Este código QR contém a URL da sua carteira com acesso total. Você pode escaneá-lo do seu telefone para abrir sua carteira a partir dele.',
-  access_wallet_on_mobile: 'Acesso Móvel',
-  stored_paylinks: 'Links LNURL de pagamento armazenados',
  wallet: 'Carteira:',
-  wallet_name: 'Nome da carteira',
-  wallet_type: 'Tipo de carteira',
-  shared_wallet: 'Carteira Compartilhada',
-  share_wallet: 'Compartilhar Carteira',
-  update_permissions: 'Atualizar Permissões',
-  shared_wallet_id: 'ID da Carteira Compartilhada',
-  shared_wallet_desc:
-    'Você foi convidado(a) para ter acesso à carteira de outra pessoa.',
  wallets: 'Carteiras',
-  exclude_wallets: 'Excluir Carteiras',
  add_wallet: 'Adicionar nova carteira',
-  reject_wallet: 'Rejeitar carteira',
-  add_new_wallet: 'Adicionar uma nova carteira',
-  pin_wallet: 'Fixar carteira',
  delete_wallet: 'Excluir carteira',
  delete_wallet_desc:
    'Toda a carteira será excluída, os fundos serão IRRECUPERÁVEIS.',
  rename_wallet: 'Renomear carteira',
  update_name: 'Atualizar nome',
  fiat_tracking: 'Rastreamento Fiat',
-  fiat_providers: 'Provedores fiat',
-  fiat_warning_bitcoin:
-    'Provedores Fiat podem ficar nervosos com qualquer coisa relacionada ao bitcoin, portanto, evite usar a palavra "bitcoin" nos seus memorandos!',
  currency: 'Moeda',
  update_currency: 'Atualizar moeda',
  press_to_claim: 'Pressione para solicitar bitcoin',
-  claim_desc:
-    'Parece que você tem um valor resgatável de bitcoin, mas ainda não tem uma carteira. Pressione o botão abaixo para reivindicá-lo. Isso criará uma nova carteira para você.',
  donate: 'Doar',
  view_github: 'Ver no GitHub',
  voidwallet_active: 'VoidWallet está ativo! Pagamentos desabilitados',
-  voidwallet_active_user:
-    'Fonte de financiamento indisponível. Por favor, entre em contato com seu administrador para configurar.',
-  voidwallet_active_admin:
-    'Fonte de financiamento indisponível. Clique aqui para configurar.',
-  service_fee_badge: 'Taxa de serviço: {amount} % por transação',
-  service_fee_max_badge:
-    'Taxa de serviço: {amount} % por transação (máximo {max} {denom})',
+  use_with_caution: 'USE COM CAUTELA - a carteira {name} ainda está em BETA',
+  service_fee: 'Taxa de serviço: {amount} % por transação',
+  service_fee_max: 'Taxa de serviço: {amount} % por transação (máx {max} sats)',
  service_fee_tooltip:
    'Taxa de serviço cobrada pelo administrador do servidor LNbits por transação de saída',
  toggle_darkmode: 'Alternar modo escuro',
@@ -107,7 +79,6 @@ window.localisation.br = {
  create_invoice: 'Criar Fatura',
  camera_tooltip: 'Usar a câmara para escanear uma fatura / QR',
  export_csv: 'Exportar para CSV',
-  export_csv_details: 'Exportar para CSV com detalhes',
  chart_tooltip: 'Mostrar gráfico',
  pending: 'Pendente',
  copy_invoice: 'Copiar fatura',
@@ -115,27 +86,15 @@ window.localisation.br = {
  cancel: 'Cancelar',
  scan: 'Escanear',
  read: 'Ler',
-  write: 'Escrever',
  pay: 'Pagar',
  memo: 'Memo',
  date: 'Data',
-  path: 'Caminho',
-  internal_memo: 'Memorando interno (opcional)',
-  internal_memo_hint_receive:
-    'Este memorando não é mostrado ao pagador, mas é armazenado na fatura para sua referência.',
-  internal_memo_hint_pay:
-    'Este memorando não é exibido ao beneficiário, mas é armazenado no pagamento para sua referência.',
  payment_processing: 'Processando pagamento...',
-  payment_successful: 'Pagamento bem-sucedido!',
-  payment_pending: 'Pagamento pendente...',
-  payment_check: 'Cheque pagamento',
  not_enough_funds: 'Fundos insuficientes!',
  search_by_tag_memo_amount: 'Pesquisar por tag, memo, quantidade',
-  search: 'Buscar',
  invoice_waiting: 'Fatura aguardando pagamento',
  payment_received: 'Pagamento Recebido',
  payment_sent: 'Pagamento Enviado',
-  payment_failed: 'Pagamento Falhou',
  receive: 'receber',
  send: 'enviar',
  outgoing_payment_pending: 'Pagamento pendente de saída',
@@ -153,10 +112,7 @@ window.localisation.br = {
  extensions: 'Extensões',
  no_extensions: 'Você não possui nenhuma extensão instalada :(',
  created: 'Criado',
-  created_at: 'Criado em',
-  updated_at: 'Atualizado em',
  search_extensions: 'Extensões de pesquisa',
-  search_wallets: 'Pesquisar carteiras',
  extension_sources: 'Fontes de Extensão',
  ext_sources_hint: 'Repositórios de onde as extensões podem ser baixadas',
  ext_sources_label:
@@ -165,13 +121,10 @@ window.localisation.br = {
  repository: 'Repositório',
  confirm_continue: 'Você tem certeza de que deseja continuar?',
  manage_extension_details: 'Instalar/desinstalar extensão',
-  upload: 'Enviar',
  install: 'Instalar',
  uninstall: 'Desinstalar',
  drop_db: 'Remover Dados',
  enable: 'Ativar',
-  enabled: 'Habilitado',
-  disabled: 'Desativado',
  pay_to_enable: 'Pague para Habilitar',
  enable_extension_details: 'Ativar extensão para o usuário atual',
  disable: 'Desativar',
@@ -179,8 +132,6 @@ window.localisation.br = {
  installed: 'Instalado',
  activated: 'Ativado',
  deactivated: 'Desativado',
-  activate: 'Ativar',
-  deactivate: 'Desativar',
  release_notes: 'Notas de Lançamento',
  activate_extension_details:
    'Tornar a extensão disponível/indisponível para usuários',
@@ -188,33 +139,8 @@ window.localisation.br = {
  all: 'Tudo',
  only_admins_can_install:
    'Apenas contas de administrador podem instalar extensões.',
-  only_admins_can_create_extensions:
-    'Apenas contas de administrador podem criar extensões',
  admin_only: 'Apenas para Administração',
-  make_user_admin: 'Tornar usuário administrador',
-  revoke_admin: 'Revogar Admin',
  new_version: 'Nova Versão',
-  reviews_url: 'URL de Avaliações',
-  reviews_url_label: 'URL do servidor de avaliações',
-  reviews_url_hint:
-    'URL completa do PaidReviews incluindo o id das configurações (por exemplo, https://example.com/paidreviews/SETTINGS_ID)',
-  reviews_open: 'Ver avaliações',
-  reviews_leave: 'Deixe uma avaliação',
-  reviews_name: 'Seu nome',
-  reviews_comment: 'Sua avaliação',
-  reviews_rating: 'Avaliação',
-  reviews_submit: 'Enviar avaliação',
-  reviews_loading: 'Carregando avaliações...',
-  reviews_refresh: 'Atualizar avaliações',
-  reviews_error_load: 'Não foi possível carregar as avaliações',
-  reviews_url_not_configured: 'URL de avaliações não configurada',
-  reviews_pay_invoice: 'Pagar fatura',
-  reviews_invoice_paid: 'Fatura paga',
-  reviews_invoice_title: 'Pague esta fatura para enviar sua avaliação',
-  reviews_count: 'Avaliações',
-  no_reviews: 'Ainda não há avaliações',
-  extension_has_free_release: 'Tem lançamentos gratuitos',
-  extension_has_paid_release: 'Tem lançamentos pagos',
  extension_depends_on: 'Depende de:',
  extension_rating_soon: 'Avaliações estarão disponíveis em breve',
  extension_installed_version: 'Versão instalada',
@@ -229,122 +155,26 @@ window.localisation.br = {
    'Esta versão requer no mínimo a versão do LNbits',
  min_version: 'Mínimo (incluído)',
  max_version: 'Máximo (excluído)',
-  preimage: 'Pré-imagem',
-  preimage_hint: 'Pré-imagem para liquidar a fatura de retenção',
-  hold_invoice: 'Reter Fatura',
-  hold_invoice_description:
-    'Esta fatura está em espera e requer uma pré-imagem para ser liquidada.',
  payment_hash: 'Hash de pagamento',
-  invoice_cancelled: 'Fatura Cancelada',
-  invoice_settled: 'Fatura Liquidada',
-  hold_invoice_payment_hash:
-    'Hash de pagamento para fatura em espera (opcional)',
-  settle_invoice: 'Liquidar Fatura',
-  cancel_invoice: 'Cancelar Fatura',
  fee: 'Taxa',
  amount: 'Quantidade',
-  amount_limits: 'Limites de Quantia',
  amount_sats: 'Quantidade (sats)',
-  faucest_wallet: 'Carteira de Torneira',
-  faucest_wallet_desc_1:
-    'Toda vez que um pagamento for confirmado pelo provedor {provider}, os fundos serão subtraídos desta carteira.',
-  faucest_wallet_desc_2:
-    'Isso ajuda a monitorar todos os pagamentos do {provider} e seu status.',
-  faucest_wallet_desc_3:
-    'Esta carteira deve ser recarregada com a quantia de sats que o administrador está disposto a oferecer em troca da moeda fiduciária.',
-  faucest_wallet_desc_4:
-    'Se esta carteira estiver configurada, mas estiver vazia, os pagamentos de {provider} não serão processados.',
-  faucest_wallet_desc_5:
-    'Esta carteira pode eventualmente ficar com saldo negativo se pagamentos fiduciários paralelos forem feitos.',
-  faucest_wallet_id: 'ID da Carteira de Torneira (opcional)',
-  faucest_wallet_id_hint:
-    'ID da carteira a ser usado para a torneira. Será usado para enviar os fundos ao usuário.',
  tag: 'Etiqueta',
  unit: 'Unidade',
  description: 'Descrição',
  expiry: 'Validade',
  webhook: 'Webhook',
-  webhook_url: 'URL do Webhook',
-  webhook_url_hint:
-    'URL de Webhook para enviar os detalhes do pagamento. Será chamada quando o pagamento for concluído.',
-  copy_webhook_url: 'Copiar URL do webhook',
-  webhook_events_list:
-    'Os seguintes eventos devem ser suportados pelo webhook:',
-  webhook_stripe_description:
-    'No lado do Stripe, você deve configurar um webhook com um URL que aponta para o seu servidor LNbits.',
  payment_proof: 'Comprovante de pagamento',
  update: 'Atualizar',
  update_available: 'Atualização {version} disponível!',
-  funding_sources: 'Fontes de Financiamento',
  latest_update: 'Você está na versão mais recente {version}.',
  notifications: 'Notificações',
-  notifications_configure: 'Configurar Notificações',
-  notifications_nostr_config: 'Configuração do Nostr',
-  notifications_enable_nostr: 'Ativar Nostr',
-  notifications_enable_nostr_desc: 'Enviar notificações pelo Nostr',
-  notifications_nostr_private_key: 'Chave Privada Nostr',
-  notifications_nostr_private_key_desc:
-    'Chave privada (hex ou nsec) para assinar as mensagens enviadas para Nostr',
-  notifications_nostr_identifier: 'Identificador Nostr',
-  notifications_nostr_identifier_desc:
-    'Identificador Nip5 para enviar notificações para',
-  notifications_nostr_identifiers: 'Identificadores Nostr',
-  notifications_nostr_identifiers_desc:
-    'Lista de identificadores para enviar notificações.',
-  notifications_telegram_config: 'Configuração do Telegram',
-  notifications_enable_telegram: 'Ativar Telegram',
-  notifications_enable_telegram_desc: 'Enviar notificações pelo Telegram',
-  notifications_telegram_access_token: 'Token de Acesso',
-  notifications_telegram_access_token_desc: 'Token de acesso para o bot',
-  notifications_chat_id: 'ID de bate-papo do Telegram',
-  notifications_chat_id_desc:
-    'ID do chat do Telegram para enviar as notificações para',
-  notifications_excluded_wallets_desc:
-    'Não envie notificações para essas carteiras',
-  notifications_email_config: 'Configuração de Email',
-  notifications_enable_email: 'Habilitar Email',
-  notifications_enable_email_desc: 'Enviar notificações por e-mail',
-  notifications_send_test_email: 'Enviar e-mail de teste',
-  notifications_send_email: 'Enviar e-mail',
-  notifications_send_email_desc: 'Email que você enviará de',
-  notifications_send_email_username: 'Nome de usuário',
-  notifications_send_email_username_desc:
-    'Nome de usuário, usará o e-mail se não estiver definido',
-  notifications_send_email_password: 'Enviar senha de e-mail',
-  notifications_send_email_password_desc:
-    'Senha para o e-mail que você enviará de',
-  notifications_send_email_server_port: 'Enviar e-mail porta SMTP',
-  notifications_send_email_server_port_desc: 'Porta para o servidor SMTP',
-  notifications_send_email_server: 'Enviar e-mail servidor SMTP',
-  notifications_send_email_server_desc:
-    'Servidor SMTP para o e-mail de que você enviará',
-  notifications_send_to_emails: 'Emails para enviar para',
-  notifications_send_to_emails_desc:
-    'Notificações de e-mails serão enviadas para',
-  notification_settings_update: 'Configurações atualizadas',
-  notification_settings_update_desc:
-    'Notificar quando as configurações do servidor forem atualizadas',
-  notification_server_start_stop: 'Iniciar/Parar Servidor',
-  notification_server_start_stop_desc:
-    'Notificar quando o servidor tiver sido iniciado/parado',
-  notification_watchdog_limit: 'Notificação de Limite do Watchdog',
-  notification_watchdog_limit_desc:
-    'Notifique quando o limite do watchdog for alcançado (não afeta a fonte de financiamento)',
-  notification_server_status: 'Status do Servidor',
-  notification_server_status_desc:
-    'Enviar notificações regulares sobre o status do servidor (valor do intervalo em horas)',
-  notification_incoming_payment: 'Pagamentos Recebidos',
-  notification_incoming_payment_desc:
-    'Notificar quando uma carteira tiver recebido um pagamento acima do valor especificado (sats)',
-  notification_outgoing_payment: 'Pagamentos Saída',
-  notification_outgoing_payment_desc:
-    'Notificar quando uma carteira tiver enviado um pagamento acima do valor especificado (sats)',
-  notification_credit_debit: 'Crédito / Débito',
-  notification_credit_debit_desc:
-    'Notificar quando uma carteira tiver sido creditada/debitada pelo superusuário',
-  notification_balance_delta_changed: 'Mudança no Delta de Saldo',
-  notification_balance_delta_changed_desc:
-    'Notifique quando a diferença entre o saldo do nó e o saldo do LNbits tiver mudado mais do que a quantidade especificada (em sats). Defina como 0 para desativar. Isso é executado a cada minuto.',
+  no_notifications: 'Sem notificações',
+  notifications_disabled:
+    'As notificações de status do LNbits estão desativadas.',
+  enable_notifications: 'Ativar notificações',
+  enable_notifications_desc:
+    'Se ativado, ele buscará as últimas atualizações de status do LNbits, como incidentes de segurança e atualizações.',
  enable_watchdog: 'Ativar Watchdog',
  enable_watchdog_desc:
    'Se ativado, ele mudará automaticamente sua fonte de financiamento para VoidWallet se o seu saldo for inferior ao saldo do LNbits. Você precisará ativar manualmente após uma atualização.',
@@ -359,7 +189,6 @@ window.localisation.br = {
  notification_source_label:
    'URL de origem (use apenas a fonte de status oficial do LNbits e fontes de confiança)',
  more: 'mais',
-  more_count: 'Mais {count}',
  less: 'menos',
  releases: 'Lançamentos',
  watchdog: 'Cão de guarda',
@@ -371,24 +200,15 @@ window.localisation.br = {
  allow_access_hint: 'Permitir acesso por IP (substituirá os IPs bloqueados)',
  enter_ip: 'Digite o IP e pressione enter',
  rate_limiter: 'Limitador de Taxa',
-  callback_url_rules: 'Regras de URL de Retorno',
-  enter_callback_url_rule: 'Digite a regra de URL como regex e pressione enter',
-  callback_url_rule_hint:
-    'URLs de retorno de chamada (como a de LNURL) serão validados conforme estas regras. Pelo menos uma regra deve corresponder. Nenhuma regra significa que todas as URLs são permitidas.',
  wallet_limiter: 'Limitador de Carteira',
-  wallet_config: 'Configuração da Carteira',
-  wallet_charts: 'Gráficos da Carteira',
  wallet_limit_max_withdraw_per_day:
    'Retirada máxima diária da carteira em sats (0 para desativar)',
  wallet_max_ballance: 'Saldo máximo da carteira em sats (0 para desativar)',
  wallet_limit_secs_between_trans:
    'Minutos e segundos entre transações por carteira (0 para desativar)',
-  only_incoming_payments_allowed: 'Apenas pagamentos recebidos são permitidos',
-  disable_outgoing_payments: 'Desativar pagamentos de saída',
  number_of_requests: 'Número de solicitações',
  time_unit: 'Unidade de tempo',
  minute: 'minuto',
-  settings: 'Configurações',
  second: 'segundo',
  hour: 'hora',
  disable_server_log: 'Desativar Log do Servidor',
@@ -399,108 +219,49 @@ window.localisation.br = {
  login_with_user_id: 'Faça login com ID do usuário',
  or: 'ou',
  create_new_wallet: 'Criar Nova Carteira',
-  delete_all_wallets: 'Excluir Todas as Carteiras',
-  confirm_delete_all_wallets:
-    'Tem certeza de que deseja excluir TODAS as carteiras deste usuário?',
  login_to_account: 'Faça login na sua conta',
  create_account: 'Criar conta',
  account_settings: 'Configurações da Conta',
-  signin_with_oauth: 'Entrar com',
-  signin_with_oauth_or: 'ou entre com',
  signin_with_nostr: 'Continuar com Nostr',
  signin_with_google: 'Entrar com o Google',
  signin_with_github: 'Entrar com GitHub',
-  signin_with_custom_org: 'Entrar com {custom_org}',
+  signin_with_keycloak: 'Entrar com Keycloak',
  username_or_email: 'Nome de usuário ou E-mail',
  password: 'Senha',
  password_config: 'Configuração de Senha',
  password_repeat: 'Repetição de senha',
-  update_password: 'Atualizar Senha',
  change_password: 'Alterar Senha',
  update_credentials: 'Atualizar credenciais',
  update_pubkey: 'Atualizar Chave Pública',
-  nostr_pubkey_tooltip:
-    'Insira a chave pública Nostr deste usuário (valor hexadecimal)',
  set_password: 'Definir Senha',
-  set_password_tooltip: 'Defina uma senha para este usuário',
  invalid_password: 'A senha deve ter pelo menos 8 caracteres',
-  invalid_password_repeat: 'As senhas não coincidem',
-  reset_key_generated: 'Uma chave de reinicialização foi gerada.',
-  reset_key_copy:
-    'Clique em OK para copiar o URL de redefinição para sua área de transferência.',
  login: 'Entrar',
  register: 'Registrar',
  username: 'Nome de usuário',
  pubkey: 'Chave Pública',
  user_id: 'ID do Usuário',
-  id: 'ID',
  email: 'E-mail',
  first_name: 'Primeiro Nome',
  last_name: 'Sobrenome',
  picture: 'Foto',
-  user_picture_desc:
-    'URL para uma imagem a ser usada como foto de perfil. Você pode carregá-la como um ativo.',
  verify_email: 'Verifique o e-mail com',
  account: 'Conta',
  update_account: 'Atualizar Conta',
  invalid_username: 'Nome de usuário inválido',
  auth_provider: 'Provedor de Autenticação',
-  external_id: 'ID Externo',
  my_account: 'Minha Conta',
-  existing_account_question: 'Já tem uma conta?',
-  background_image: 'Imagem de Fundo',
  back: 'Voltar',
  logout: 'Sair',
  look_and_feel: 'Aparência',
-  endpoint: 'Ponto de extremidade',
-  api: 'API',
-  api_stripe: 'API',
-  api_token: 'Token de API',
-  api_tokens: 'Tokens da API',
-  access_control_list: 'Lista de Controle de Acesso',
-  access_control_list_admin_warning:
-    'Esta é uma conta de administrador. Os tokens gerados terão privilégios de administrador.',
-  new_api_acl: 'Nova Lista de Controle de Acesso',
-  api_token_id: 'Id do Token',
  toggle_gradient: 'Alternar Gradiente',
  gradient_background: 'Fundo em Degradê',
-  rounded_ui: 'Cartões e Botões Arredondados',
-  toggle_rounded_ui: 'Alternar cantos arredondados para cartões e botões',
-  card_gradient: 'Gradiente do Cartão',
-  toggle_card_gradient: 'Alternar gradiente nos cartões',
-  card_shadow: 'Sombra do Cartão',
-  toggle_card_shadow: 'Alternar sombra nas cartas',
  language: 'Idioma',
-  assets: 'Ativos',
-  max_asset_size_mb: 'Tamanho Máximo do Ativo (MB)',
-  max_asset_size_mb_desc:
-    'O tamanho máximo permitido para uploads de ativos em megabytes (pode usar valores decimais).',
-  assets_allowed_mime_types: 'Tipos MIME permitidos',
-  assets_allowed_mime_types_desc:
-    'Os tipos MIME permitidos para uploads de ativos. Nenhum valor significa que todos os uploads são permitidos.',
-  thumbnail_width: 'Largura da Miniatura',
-  thumbnail_width_desc: 'Largura da miniatura gerada em pixels.',
-  thumbnail_height: 'Altura da miniatura',
-  thumbnail_height_desc: 'Altura da miniatura gerada em pixels.',
-  thumbnail_format: 'Formato da Miniatura',
-  thumbnail_format_desc:
-    'Formato de imagem da miniatura gerada (PNG, JPEG, etc.).',
-  max_assets_per_user: 'Máximo de ativos por usuário',
-  max_assets_per_user_desc:
-    'O número máximo de ativos que um usuário pode fazer upload. Zero significa que o upload está proibido.',
-  assets_no_limit_users: 'Usuários sem Limites de Ativos',
-  assets_no_limit_users_desc:
-    'Esses usuários podem enviar um número ilimitado de ativos (com base no ID do usuário).',
  color_scheme: 'Esquema de Cores',
-  visible_wallet_count: 'Contagem de Carteiras Visíveis',
  admin_settings: 'Configurações do Administrador',
  extension_cost: 'Este lançamento requer um pagamento mínimo de {cost} sats.',
  extension_paid_sats: 'Você já pagou {paid_sats} sats.',
-  create_extension: 'Criar Extensão',
  release_details_error: 'Não é possível obter os detalhes da versão.',
  pay_from_wallet: 'Pagar com a Carteira',
-  pay_with: 'Pague com {provider}',
-  select_payment_provider: 'Selecione o provedor de pagamento',
  wallet_required: 'Carteira *',
  show_qr: 'Exibir QR',
  retry_install: 'Repetir Instalação',
@@ -513,9 +274,6 @@ window.localisation.br = {
    'A extensão {name} requer um pagamento mínimo de {amount} sats para habilitar.',
  hide_empty_wallets: 'Ocultar carteiras vazias',
  recheck: 'Verificar novamente',
-  check: 'Verificar',
-  check_connection: 'Verificar Conexão',
-  check_webhook: 'Verificar Webhook',
  contributors: 'Contribuidores',
  license: 'Licença',
  reset_key: 'Redefinir Chave',
@@ -528,7 +286,6 @@ window.localisation.br = {
  hash: 'Hash:',
  welcome_lnbits: 'Bem-vindo ao LNbits',
  setup_su_account: 'Configure a conta Superuser abaixo.',
-  first_install_token: 'Primeiro Token de Instalação',
  create_ticker_converter: 'Criar Conversor de Ticker de Moeda',
  enable_audit: 'Habilitar Auditoria',
  recommended: 'Recomendado',
@@ -569,16 +326,9 @@ window.localisation.br = {
  user_default_extensions_label: 'Extensões do usuário',
  user_default_extensions_hint:
    'Extensões que serão ativadas por padrão para os usuários.',
-  extension_builder: 'Construtor de Extensão',
-  extension_builder_manifest_url: 'URL do Manifesto do Criador de Extensões',
-  extension_builder_manifest_url_hint:
-    'URL para um arquivo JSON manifest com detalhes do extension builder',
  miscellanous: 'Diversos',
  misc_disable_extensions: 'Desativar extensões',
  misc_disable_extensions_label: 'Desativar todas as extensões',
-  misc_disable_extensions_builder: 'Habilitar Extensions Builder',
-  misc_disable_extensions_builder_label:
-    'Habilitar Extensions Builder para usuários não administradores.',
  misc_hide_api: 'Ocultar API',
  misc_hide_api_label:
    'Oculta a API de carteira, extensões podem optar por honrar',
@@ -596,33 +346,16 @@ window.localisation.br = {
  toggle_transactions_node_ui:
    'Guia de Transações (Desativar em nós grandes CLN)',
  invoice_expiry: 'Expiração da Fatura',
-  invoice_expiry_label: 'Validade da fatura',
-  routing_fee_reserve_calculations: 'Cálculos de Reserva de Taxa de Roteamento',
-  routing_fee_reserve_calculations_desc:
-    'LNbits reserva um "valor de reserva" para cada pagamento para cobrir as taxas de roteamento. A taxa de roteamento máxima passada para a fonte de financiamento é a que for maior: a <strong>reserva mínima de taxa de roteamento</strong> ou a <strong>percentagem de reserva de taxa de roteamento</strong>.',
-  millisats: 'milissats',
-  fee_reserve: 'Reserva Mínima de Taxa de Encaminhamento',
-  fee_reserve_percent: 'Porcentagem da Reserva de Taxa de Roteamento',
-  fee_reserve_min_hint:
-    'A taxa mínima reservada por pagamento.<br>Isso atua como um piso - a taxa de roteamento máxima nunca será inferior a este valor, independentemente do tamanho do pagamento.',
-  fee_reserve_percent_hint:
-    'A porcentagem do valor do pagamento a reservar para taxas de roteamento.',
-  payment_timeouts: 'Tempos de Espera de Pagamento',
-  payment_wait_time: 'Tempo de Espera do Pagamento',
-  seconds: 'segundos',
-  payment_wait_time_desc:
-    'Tempo de espera antes de marcar um pagamento de saída como pendente. Padrão: 5s; aumentar para faturas de liquidação lenta.',
-  payment_wait_time_tooltip:
-    'Controla quanto tempo o LNbits espera para uma tentativa de pagamento de saída ser confirmada antes de marcá-la como pendente. Valores mais altos ajudam ao pagar faturas de liquidação lenta (por exemplo, faturas HODL, Boltz). O pagamento será verificado novamente mais tarde e atualizado automaticamente ou manualmente.',
+  invoice_expiry_label: 'Validade da fatura (segundos)',
+  fee_reserve: 'Reserva de Taxa',
+  fee_reserve_msats: 'Taxa de reserva em msats',
+  fee_reserve_percent: 'Taxa de reserva em porcentagem',
  server_management: 'Gerenciamento de Servidor',
  base_url: 'URL base',
  base_url_label: 'URL estática/base para o servidor',
  authentication: 'Autenticação',
  auth_token_expiry_label: 'Minutos para expiração do token',
  auth_token_expiry_hint: 'Tempo em minutos até o token expirar',
-  auth_authentication_cache_label: 'Tempo de cache (minutos)',
-  auth_authentication_cache_hint:
-    'Tempo em minutos para armazenar em cache a autenticação bem-sucedida (0 para desativar)',
  auth_allowed_methods_label: 'Métodos de autorização permitidos',
  auth_allowed_methods_hint: 'Selecione métodos de autorização',
  auth_nostr_label: 'URL de Solicitação Nostr',
@@ -640,36 +373,13 @@ window.localisation.br = {
  auth_keycloak_ci_hint:
    'Certifique-se de que a URL de retorno de chamada de autorização esteja definida para https://{domain}/api/v1/auth/keycloak/token',
  auth_keycloak_cs_label: 'Segredo do Cliente Keycloak',
-  auth_keycloak_custom_org_label: 'Organização Personalizada do Keycloak',
-  auth_keycloak_custom_icon_label: 'Ícone Personalizado do Keycloak (URL)',
-  auth_oidc_label: 'URL de Descoberta do OIDC',
-  auth_oidc_ci_label: 'ID do Cliente OIDC',
-  auth_oidc_ci_hint:
-    'Certifique-se de que a URL de retorno de chamada de autorização esteja definida para https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'Segredo do Cliente OIDC',
-  auth_oidc_custom_org_label:
-    'Nome da Organização Personalizada OIDC (ex. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'Ícone Personalizado do OIDC (URL)',
-  auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
-  auth_keycloak_custom_icon_label: 'Ícone Personalizado do Keycloak (URL)',
  currency_settings: 'Configurações de Moeda',
  allowed_currencies: 'Moedas Permitidas',
  allowed_currencies_hint: 'Limite o número de moedas fiduciárias disponíveis',
  default_account_currency: 'Moeda Padrão da Conta',
  default_account_currency_hint: 'Moeda padrão para contabilidade',
-  min_incoming_payment_amount: 'Quantia Mínima de Pagamento de Entrada',
-  min_incoming_payment_amount_desc:
-    'Quantidade mínima permitida para gerar uma fatura',
-  max_incoming_payment_amount: 'Valor Máximo do Pagamento Recebido',
-  max_incoming_payment_amount_desc:
-    'Quantidade máxima permitida para gerar uma fatura',
-  max_outgoing_payment_amount: 'Valor Máximo de Pagamento de Saída',
-  max_outgoing_payment_amount_desc:
-    'Valor máximo permitido para efetuar um pagamento',
-  service_fee: 'Taxa de serviço: {amount} % por transação',
  service_fee_label: 'Taxa de serviço (%)',
  service_fee_hint: 'Taxa cobrada por tx (%)',
-  service_fee_max: 'Taxa de serviço: {amount} % por transação (máx {max} sats)',
  service_fee_max_label: 'Taxa de serviço máx (sats)',
  service_fee_max_hint: 'Taxa máxima de serviço a cobrar em (sats)',
  fee_wallet: 'Carteira de Taxas',
@@ -681,8 +391,6 @@ window.localisation.br = {
    'Desativar Taxa de Serviço para Pagamentos Internos Lightning',
  ui_management: 'Gerenciamento de UI',
  ui_site_title: 'Título do Site',
-  ui_changing_remove_lnbits_elements:
-    '(alterar removerá os elementos LNbits na página inicial e rodapé)',
  ui_site_tagline: 'Tagline do site',
  ui_elements_enable: 'Habilitar elementos na página inicial',
  ui_elements_disable: 'Desativar elementos na página inicial',
@@ -691,27 +399,11 @@ window.localisation.br = {
  ui_site_description: 'Descrição do Site',
  ui_site_description_hint: 'Use texto simples, Markdown ou HTML bruto',
  ui_default_wallet_name: 'Nome Padrão da Carteira',
-  ui_default_theme: 'Tema Padrão',
-  wallet_featured_button_label: 'Carteira Rótulo do Botão em Destaque',
-  wallet_featured_button_label_hint:
-    'Mostrar botão em destaque na página inicial da carteira',
-  wallet_featured_button_url: 'URL do Botão em Destaque',
-  wallet_featured_button_url_hint:
-    'Ao clicar, o botão abrirá este URL. Deixe em branco para ocultar o botão.',
-  wallet_featured_button_icon: 'Ícone do Botão em Destaque',
-  wallet_featured_button_icon_hint:
-    'Ícone mostrado no botão de destaque (verifique os ícones quasar)',
  lnbits_wallet: 'Carteira LNbits',
  denomination: 'Denominação',
  denomination_hint: 'O nome para o token FakeWallet',
-  denomination_error: 'A denominação deve ter 3 caracteres ou `sats`.',
  ui_qr_code_logo: 'Logo do QR Code',
  ui_qr_code_logo_hint: 'URL para imagem de logo no código QR',
-  ui_apple_touch_icon: 'Ícone de Toque da Apple',
-  ui_apple_touch_icon_hint: 'URL do ícone de toque da Apple',
-  ui_custom_image: 'Imagem Personalizada',
-  ui_custom_image_label: 'URL para imagem personalizada',
-  ui_custom_image_hint: 'Imagem exibida na página inicial/login',
  ui_custom_badge: 'Distintivo Personalizado',
  ui_custom_badge_label:
    "Distintivo Personalizado 'USE COM CUIDADO - a carteira LNbits ainda está em BETA'",
@@ -734,95 +426,14 @@ window.localisation.br = {
  admin_users_label: 'ID do Usuário',
  allowed_users: 'Usuários Permitidos',
  allowed_users_hint: 'Somente esses usuários podem usar o LNbits',
-  allowed_users_hint_feature: 'Somente estes usuários podem usar {feature}',
  allowed_users_label: 'ID do Usuário',
  allow_creation_user: 'Permitir a criação de novos usuários',
  allow_creation_user_desc:
    'Permitir a criação de novos usuários na página de índice',
-  require_user_activation: 'Requer ativação do usuário',
-  require_user_activation_desc:
-    'Novos usuários serão ativados somente após passarem por um dos métodos de confirmação. Administradores podem ativar usuários manualmente a partir do painel de administração.',
-  reusable_activation_code: 'Código de ativação reutilizável',
-  reusable_activation_code_label: 'Código de ativação reutilizável',
-  reusable_activation_code_hint:
-    'Este código de ativação pode ser usado várias vezes por diferentes usuários.',
-  one_time_activation_code: 'Códigos de ativação única',
-  one_time_activation_code_label: 'Adicionar código de ativação',
-  one_time_activation_code_hint:
-    'Lista de códigos de ativação únicos. Cada código pode ser usado apenas uma vez, depois será removido da lista.',
-  invitation_code: 'Código de Convite',
-  invitation_code_hint: 'O código de convite que você recebeu.',
-  email_confirmation_hint:
-    'Endereço de e-mail para enviar o código de confirmação.',
-  nostr_identifier: 'Identificador Nostr',
-  nostr_identifier_hint:
-    'Identificador nostr nip5 ou <npub> para enviar o código de confirmação.',
-  new_user_not_allowed: 'O registro está desativado.',
-  start_user_impersonation: 'Personificar este usuário',
-  stop_user_impersonation: 'Parar a Personificação do Usuário',
  components: 'Componentes',
  long_running_endpoints: 'Top 5 Endpoints de Longa Execução',
  http_request_methods: 'Métodos de Requisição HTTP',
  http_response_codes: 'Códigos de Resposta HTTP',
  request_details: 'Detalhes do Pedido',
-  http_request_details: 'Detalhes da Requisição HTTP',
-  payment_details: 'Detalhes do Pagamento',
-  payment_details_desc: 'Informações detalhadas sobre o pagamento',
-  payments: 'Pagamentos',
-  payment_show_internal: 'Mostrar Pagamentos Internos',
-  payment_chart_flow: 'Fluxo de Pagamento Mensal',
-  payment_chart_status: 'Status do Pagamento',
-  payment_chart_tx_per_wallet: 'Transações por Carteira (saldo/contagem)',
-  payment_details_back: 'Voltar para Pagamentos',
-  payment_chart_tags: 'Pagamentos por Tags',
-  payments_balance_in_out: 'Entradas/Saídas de Saldo',
-  payments_count_in_out: 'Contar Entrada/Saída',
-  payments_status_chart: 'Gráfico de Status',
-  payments_tag_chart: 'Gráfico de Marcadores',
-  payments_balance_chart: 'Gráfico de Saldo',
-  payments_wallets_chart: 'Gráfico de Carteiras',
-  payments_balance_in_out_chart: 'Gráfico de Entrada/Saída de Saldo',
-  payments_count_in_out_chart: 'Gráfico de Entrada/Saída',
-  reset_wallet_keys: 'Redefinir Chaves',
-  reset_wallet_keys_desc:
-    'Redefina as chaves de API para esta carteira. Isso invalidará as chaves atuais e gerará novas.',
-  view_list: 'Visualizar carteiras como lista',
-  view_column: 'Visualizar carteiras como linhas',
-  filter_payments: 'Filtrar pagamentos',
-  filter_labels: 'Rótulos de filtro',
-  filter_date: 'Filtrar por data',
-  websocket_example: 'Exemplo de Websocket',
-  client_id: 'ID do Cliente',
-  secret_key: 'Chave Secreta',
-  signing_secret: 'Segredo de Assinatura',
-  signing_secret_hint:
-    'Segredo de assinatura para o webhook. As mensagens serão assinadas com este segredo.',
-  webhook_id: 'ID do Webhook',
-  webhook_id_hint:
-    'ID do webhook do PayPal usado para verificar eventos recebidos.',
-  webhook_paypal_description:
-    'No lado do PayPal, configure um webhook apontando para o seu servidor LNbits.',
-  callback_success_url: 'URL de Sucesso de Callback',
-  callback_success_url_hint:
-    'O usuário será redirecionado para este URL após o pagamento ser bem-sucedido.',
-  connected: 'Conectado',
-  not_connected: 'Não Conectado',
-  free: 'Grátis',
-  paid: 'Pago',
-  funding_source_retries: 'Máximo de tentativas',
-  funding_source_retries_desc:
-    'Número máximo de tentativas para fontes de financiamento, antes de voltar para VoidWallet.',
-  add_label: 'Adicionar Rótulo',
-  label: 'Etiqueta',
-  labels: 'Rótulos',
-  label_filter: 'Filtro de Rótulo',
-  no_labels_defined: 'Ainda não há rótulos definidos',
-  manage_labels: 'Gerenciar Etiquetas',
-  update_label: 'Atualizar Rótulo',
-  delete_label: 'Excluir Rótulo',
-  add_remove_labels: 'Adicionar ou Remover Rótulos',
-  payment_labels_updated: 'Rótulos de pagamento atualizados',
-  color: 'Cor',
-  sort: 'Ordenar',
-  sort_by: 'Ordenar por'
+  http_request_details: 'Detalhes da Requisição HTTP'
 }
@@ -353,15 +353,6 @@ window.localisation.cn = {
  auth_keycloak_ci_hint:
    '确保授权回调URL设置为https://{domain}/api/v1/auth/keycloak/token',
  auth_keycloak_cs_label: 'Keycloak客户端密钥',
-  auth_keycloak_custom_org_label: 'Keycloak 自定义组织',
-  auth_keycloak_custom_icon_label: 'Keycloak 自定义图标 (URL)',
-  auth_oidc_label: 'OIDC 发现 URL',
-  auth_oidc_ci_label: 'OIDC 客户端 ID',
-  auth_oidc_ci_hint:
-    '确保授权回调URL设置为https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'OIDC客户端密钥',
-  auth_oidc_custom_org_label: 'OIDC 自定义组织名称（例如 Zitadel、Authentik）',
-  auth_oidc_custom_icon_label: 'OIDC 自定义图标 (URL)',
  currency_settings: '货币设置',
  allowed_currencies: '允许的货币',
  allowed_currencies_hint: '限制可用法定货币的数量',
@@ -367,16 +367,6 @@ window.localisation.cs = {
  auth_keycloak_ci_hint:
    'Ujistěte se, že je autorizace callback URL nastavena na https://{domain}/api/v1/auth/keycloak/token',
  auth_keycloak_cs_label: 'Klíč k aplikaci Keycloak tajemství',
-  auth_keycloak_custom_org_label: 'Vlastní organizace Keycloak',
-  auth_keycloak_custom_icon_label: 'Vlastní ikona Keycloak (URL)',
-  auth_oidc_label: 'URL pro zjištění OIDC',
-  auth_oidc_ci_label: 'ID klienta OIDC',
-  auth_oidc_ci_hint:
-    'Ujistěte se, že je autorizace callback URL nastavena na https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'Klíč k aplikaci OIDC tajemství',
-  auth_oidc_custom_org_label:
-    'Název vlastní organizace OIDC (např. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'Vlastní ikona OIDC (URL)',
  currency_settings: 'Nastavení měny',
  allowed_currencies: 'Povolené měny',
  allowed_currencies_hint: 'Omezte počet dostupných fiat měn',
@@ -377,16 +377,6 @@ window.localisation.de = {
  auth_keycloak_ci_hint:
    'Stellen Sie sicher, dass die Autorisierungs-Callback-URL auf https://{domain}/api/v1/auth/keycloak/token eingestellt ist.',
  auth_keycloak_cs_label: 'Keycloak-Client-Geheimnis',
-  auth_keycloak_custom_org_label: 'Keycloak Benutzerdefinierte Organisation',
-  auth_keycloak_custom_icon_label: 'Keycloak Benutzerdefiniertes Symbol (URL)',
-  auth_oidc_label: 'OIDC Discovery-URL',
-  auth_oidc_ci_label: 'OIDC-Client-ID',
-  auth_oidc_ci_hint:
-    'Stellen Sie sicher, dass die Autorisierungs-Callback-URL auf https://{domain}/api/v1/auth/oidc/token eingestellt ist.',
-  auth_oidc_cs_label: 'OIDC-Client-Geheimnis',
-  auth_oidc_custom_org_label:
-    'OIDC Benutzerdefinierter Organisationsname (z.B. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'OIDC Benutzerdefiniertes Symbol (URL)',
  currency_settings: 'Währungseinstellungen',
  allowed_currencies: 'Erlaubte Währungen',
  allowed_currencies_hint:
@@ -6,7 +6,7 @@ window.localisation.en = {
  funding: 'Funding',
  users: 'Users',
  audit: 'Audit',
-  api_watch: 'API Watch',
+  api_watch: 'Api Watch',
  apps: 'Apps',
  channels: 'Channels',
  transactions: 'Transactions',
@@ -184,7 +184,6 @@ window.localisation.en = {
  release_notes: 'Release Notes',
  activate_extension_details: 'Make extension available/unavailable for users',
  featured: 'Featured',
-  categories: 'Categories',
  all: 'All',
  only_admins_can_install: '(Only admin accounts can install extensions)',
  only_admins_can_create_extensions:
@@ -268,31 +267,16 @@ window.localisation.en = {
  webhook_events_list: 'The following events must be supported by the webhook:',
  webhook_stripe_description:
    'One the stripe side you must configure a webhook with a URL that points to your LNbits server.',
-  webhook_square_description:
-    'On the Square side configure a webhook pointing to this exact LNbits URL.',
-  square_webhook_url_hint:
-    'Must exactly match the Square notification URL. LNbits requires the /api/v1/callback/square path.',
-  access_token: 'Access Token',
-  location_id: 'Location ID',
-  square_location_id_hint:
-    'Square location ID to create payment links for. Use the endpoint to select sandbox or production.',
-  api_version: 'API Version',
  payment_proof: 'Payment Proof',
  update: 'Update',
  update_available: 'Update {version} available!',
  funding_sources: 'Funding Sources',
-  funding_source: 'Funding Source',
-  requires_server_restart:
-    'Changing these settings requires a server restart to take effect.',
-  funding_source_info: 'Select the active funding wallet',
-  phoenixd_warning:
-    "Phoenixd mnemonic is only available if phoenixd data-dir is specified and is readable by LNbits. It's not indicative of phoenixd not running. It just means LNbits cannot access the mnemonic to display it here.",
  latest_update: 'You are on the latest version {version}.',
  notifications: 'Notifications',
  notifications_configure: 'Configure Notifications',
  notifications_nostr_config: 'Nostr Configuration',
  notifications_enable_nostr: 'Enable Nostr',
-  notifications_enable_nostr_desc: 'Send notifications over Nostr',
+  notifications_enable_nostr_desc: 'Send notfications over Nostr',
  notifications_nostr_private_key: 'Nostr Private Key',
  notifications_nostr_private_key_desc:
    'Private key (hex or nsec) to sign the messages sent to Nostr',
@@ -305,7 +289,7 @@ window.localisation.en = {

  notifications_telegram_config: 'Telegram Configuration',
  notifications_enable_telegram: 'Enable Telegram',
-  notifications_enable_telegram_desc: 'Send notifications over Telegram',
+  notifications_enable_telegram_desc: 'Send notfications over Telegram',
  notifications_telegram_access_token: 'Access Token',
  notifications_telegram_access_token_desc: 'Access token for the bot',
  notifications_chat_id: 'Telegram Chat ID',
@@ -334,15 +318,15 @@ window.localisation.en = {

  notification_settings_update: 'Settings updated',
  notification_settings_update_desc:
-    'Send a notification when server settings have been updated',
+    'Notify when server settings have been updated',

  notification_server_start_stop: 'Server Start/Stop',
  notification_server_start_stop_desc:
-    'Send a notification when the server has been started/stopped',
+    'Notify when the server has been started/stopped',

  notification_watchdog_limit: 'Watchdog Limit Notification',
  notification_watchdog_limit_desc:
-    'Send a notification when the watchdog limit has been reached (does not affect the funding source)',
+    'Notify when the watchdog limit has been reached (does not affect the funding source)',

  notification_server_status: 'Server Status',
  notification_server_status_desc:
@@ -350,31 +334,29 @@ window.localisation.en = {

  notification_incoming_payment: 'Incoming Payments',
  notification_incoming_payment_desc:
-    'Send a notification when a wallet has received a payment above the specified amount (sats)',
+    'Notify when a wallet has received a payment above the specified amount (sats)',

  notification_outgoing_payment: 'Outgoing Payments',
  notification_outgoing_payment_desc:
-    'Send a notification when a wallet has sent a payment above the specified amount (sats)',
+    'Notify when a wallet has sent a payment above the specified amount (sats)',

  notification_credit_debit: 'Credit / Debit',
  notification_credit_debit_desc:
-    'Send a notification when a wallet has been credited/debited by the superuser',
+    'Notify when a wallet has been credited/debited by the superuser',

  notification_balance_delta_changed: 'Balance Delta Changed',
  notification_balance_delta_changed_desc:
-    'Send a notification when the difference between the node balance and the LNbits balance has changed by more than the specified amount (in sats). Set to 0 to disable. This runs every minute.',
+    'Notify when the difference between the node balance and the LNbits balance has changed by more than the specified amount (in sats). Set to 0 to disable. This runs every minute.',

-  watchdog_introduction:
-    "Watchdog is a feature that allows you to automatically switch the LNbits funding source to VoidWallet if your node balance is lower than the LNbits balance by a certain threshold. This can help prevent overspending and keep your node's funds safe.",
-  enable_watchdog: 'Enable Watchdog',
+  enable_watchdog: 'Enable Watchdog Switch',
  enable_watchdog_desc:
-    'You will need to re-enable this manually after an update.',
-  watchdog_interval: 'Watchdog Check Interval',
+    'If enabled it will change your funding source to VoidWallet automatically if your balance is lower than the LNbits balance. You will need to enable manually after an update.',
+  watchdog_interval: 'Watchdog Interval',
  watchdog_interval_desc:
-    'How often LNbits should check for a killswitch signal in the watchdog threshold delta value [node_balance - lnbits_balance] (in minutes).',
-  watchdog_delta: 'Watchdog Threshold Delta',
+    'How often the background task should check for a killswitch signal in the watchdog delta [node_balance - lnbits_balance] (in minutes).',
+  watchdog_delta: 'Watchdog Delta',
  watchdog_delta_desc:
-    "The LNbit's > Node balance delta threshold.  If this threshold is exceeded, the funding source is changed to VoidWallet.",
+    'Limit before killswitch changes funding source to VoidWallet [lnbits_balance - node_balance > delta]',
  status: 'Status',
  notification_source: 'Notification Source',
  notification_source_label:
@@ -385,12 +367,12 @@ window.localisation.en = {
  releases: 'Releases',
  watchdog: 'Watchdog',
  server_logs: 'Server Logs',
-  ip_blocker: 'IP Blacklist/Whitelist',
+  ip_blocker: 'IP Blocker',
  security: 'Security',
-  security_tools: 'Security Tools',
+  security_tools: 'Security tools',
  block_access_hint: 'Block access by IP',
  allow_access_hint: 'Allow access by IP (will override blocked IPs)',
-  enter_ip: 'Enter an IP address and press enter',
+  enter_ip: 'Enter IP and hit enter',
  rate_limiter: 'Rate Limiter',
  callback_url_rules: 'Callback URL Rules',
  enter_callback_url_rule: 'Enter URL rule as regex and hit enter',
@@ -404,16 +386,14 @@ window.localisation.en = {
  wallet_max_ballance: 'Wallet max balance in sats (0 to disable)',
  wallet_limit_secs_between_trans:
    'Min secs between transactions per wallet (0 to disable)',
-  only_incoming_payments_allowed: 'Allow incoming payments only',
+  only_incoming_payments_allowed: 'Only incoming payments allowed',
  disable_outgoing_payments: 'Disable outgoing payments',
-  number_of_requests: 'Number of requests to allow',
-  number_of_requests_hint:
-    'Number of requests to allow per "time unit" for the rate limiter. Set to 0 to disable.',
+  number_of_requests: 'Number of requests',
  time_unit: 'Time unit',
-  minute: 'Minute',
+  minute: 'minute',
  settings: 'Settings',
-  second: 'Second',
-  hour: 'Hour',
+  second: 'second',
+  hour: 'hour',
  disable_server_log: 'Disable Server Log',
  enable_server_log: 'Enable Server Log',
  coming_soon: 'Feature coming soon',
@@ -491,8 +471,6 @@ window.localisation.en = {
  toggle_card_gradient: 'Toggle gradient on cards',
  card_shadow: 'Card Shadow',
  toggle_card_shadow: 'Toggle shadow on cards',
-  burger_menu_background: 'Burger Menu Background',
-  toggle_burger_menu_background: 'Toggle burger menu background',
  language: 'Language',
  assets: 'Assets',
  max_asset_size_mb: 'Max Asset Size (MB)',
@@ -555,30 +533,33 @@ window.localisation.en = {
  create_ticker_converter: 'Create Currency Ticker Converter',
  enable_audit: 'Enable Audit',
  recommended: 'Recommended',
-  audit_desc: 'Log HTTP requests according to the filters specified below.',
-  audit_record_req: 'Log Request Body',
-  audit_record_warning: 'Warning!',
-  audit_record_req_warning_1: 'Sensitive data (like passwords) will be logged.',
-  audit_record_req_warning_2:
-    'The request body can be large. This can fill up your logs quickly.',
-  audit_record_use: 'Use this with caution!',
-  audit_ip: 'Log IP Address',
-  audit_ip_desc: 'Log the IP address of users making requests to LNbits.',
-  audit_path_params: 'Log Path Parameters',
-  audit_query_params: 'Log Query Parameters',
+  audit_desc: 'Record HTTP requests according with the specified filters',
+  audit_record_req: 'Record Request Body',
+  audit_record_warning: 'Warning: ',
+  audit_record_req_warning_1:
+    'confidential data (like passwords) will be logged.',
+  audit_record_req_warning_2: 'the request body can have large size.',
+  audit_record_use: 'Use it with caution.',
+  audit_ip: 'Record IP Address',
+  audit_ip_desc: 'Record the IP address of the client',
+  audit_path_params: 'Record Path Parameters',
+  audit_query_params: 'Record Query Parameters',
  audit_http_methods: 'Include HTTP Methods',
  audit_http_methods_hint:
-    'List of HTTP methods to be logged. No value means all methods will be logged.',
-  audit_http_methods_label: 'HTTP Methods to Log',
+    'List of HTTP methods to be included. Empty lists means all.',
+  audit_http_methods_label: 'HTTP Methods',
+  audit_resp_codes: 'Include HTTP Response Codes',
  audit_resp_codes_hint:
    'List of HTTP codes to be included (regex match). Empty lists means all. Eg: 4.*, 5.*',
-  audit_resp_codes_label: 'HTTP Response Codes to Log (regex)',
+  audit_resp_codes_label: 'HTTP Response code (regex)',
+  audit_paths: 'Include Paths',
  audit_paths_hint:
    'List of paths to be included (regex match). Empty list means all.',
-  audit_paths_label: 'HTTP Paths to Log (regex)',
+  audit_paths_label: 'HTTP Path (regex)',
+  audit_paths_exclude: 'Exclude Paths',
  audit_paths_exclude_hint:
    'List of paths to be excluded (regex match). Empty list means none.',
-  audit_paths_exclude_label: 'HTTP Paths to Exclude from Logging (regex)',
+  audit_paths_exclude_label: 'HTTP Path (regex)',
  exchange_providers: 'Exchange Providers',
  admin_extensions: 'Admin Extensions',
  admin_extensions_label: 'Admin extensions',
@@ -598,51 +579,41 @@ window.localisation.en = {
  misc_disable_extensions_builder_label:
    'Enable Extensions Builder for non admin users.',
  misc_hide_api: 'Hide API',
-  misc_hide_api_label: 'Hides wallet API, extensions can choose to honor',
+  misc_hide_api_label: 'Hides wallet api, extensions can choose to honor',
  wallets_management: 'Wallets Management',
-  funding_source_info: 'Funding Source Information',
-  funding_source: 'Funding source: {wallet_class}',
-  node_balance: 'Node balance: {balance} sats',
-  lnbits_balance: 'LNbits balance: {balance} sats',
-  funding_reserve_percent: 'Funding reserve percentage: {percent} %',
+  funding_source_info: 'Funding Source Info',
+  funding_source: 'Funding Source: {wallet_class}',
+  node_balance: 'Node Balance: {balance} sats',
+  lnbits_balance: 'LNbits Balance: {balance} sats',
+  funding_reserve_percent: 'Reserve Percent: {percent} %',
  node_management: 'Node Management',
  node_management_not_supported:
-    'Node management is not supported by the active funding source',
+    'Node Management not supported by active funding source',
  toggle_node_ui: 'Node UI',
  toggle_public_node_ui: 'Public Node UI',
  toggle_transactions_node_ui: 'Transactions Tab (Disable on large CLN nodes)',
  invoice_expiry: 'Invoice Expiry',
-  routing_fee_reserve_calculations: 'Routing Fee Reserve Calculations',
-  routing_fee_reserve_calculations_desc:
-    'LNbits sets aside a “reserve amount” for each payment to cover routing fees. The maximum routing fee passed to the funding source is whichever is higher: the <strong>minimum routing fee reserve</strong> or the <strong>routing fee reserve percentage</strong>.',
-  millisats: 'millisats',
-  fee_reserve: 'Minimum Routing Fee Reserve',
-  fee_reserve_percent: 'Routing Fee Reserve Percentage',
-  fee_reserve_min_hint:
-    'The minimum fee reserved per payment.<br>This acts as a floor - the maximum allowed routing fee will never be lower than this value regardless of payment size.',
-  fee_reserve_percent_hint:
-    'The percentage of the payment amount to reserve for routing fees.',
-  payment_timeouts: 'Payment Timeouts',
-  payment_wait_time: 'Payment Wait Time',
-  seconds: 'seconds',
-  payment_pending_interval: 'Check payment interval (sec)',
-  payment_pending_interval_desc: 'Interval to check pending payments',
-  payment_pending_interval_tooltip:
-    'Controls how often LNbits checks for pending payments to update their status. Higher values can reduce the load on the node and speed up the payment process, but it will take longer for pending payments to be updated.',
+  invoice_expiry_label: 'Invoice expiry (seconds)',
+  fee_reserve: 'Fee Reserve',
+  fee_reserve_percent: 'Fee Reserve Percent',
+  fee_reserve_msats: 'Reserve fee in msats',
+  reserve_fee_in_percent: 'Reserve fee in percent',
+  payment_wait_time: 'Payment Wait Time (sec)',
  payment_wait_time_desc:
    'Wait time before marking an outgoing payment as pending. Default: 5s; raise for slow-settling invoices.',
  payment_wait_time_tooltip:
    'Controls how long LNbits waits for an outgoing payment attempt to confirm before marking it as pending. Higher values help when paying slow-settling invoices (e.g., HODL invoices, Boltz). The payment will be rechecked later and updated automatically or manually.',
  server_management: 'Server Management',
-  base_url_label: 'Base URL of the server',
+  base_url: 'Base URL',
+  base_url_label: 'Static/Base url for the server',
  authentication: 'Authentication',
-  auth_token_expiry_label: 'Token expiry (minutes)',
+  auth_token_expiry_label: 'Token expire minutes',
  auth_token_expiry_hint: 'Time in minutes until the token expires',
  auth_authentication_cache_label: 'Cache time (minutes)',
  auth_authentication_cache_hint:
    'Time in minutes to cache successful authentication (0 to disable)',
  auth_allowed_methods_label: 'Allowed authorization methods',
-  auth_allowed_methods_hint: 'Select allowed authorization methods',
+  auth_allowed_methods_hint: 'Select authorization methods',
  auth_nostr_label: 'Nostr Request URL',
  auth_nostr_hint: 'Absolute URL that the clients will use to login.',
  auth_google_ci_label: 'Google Client ID',
@@ -660,37 +631,33 @@ window.localisation.en = {
  auth_keycloak_cs_label: 'Keycloak Client Secret',
  auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
  auth_keycloak_custom_icon_label: 'Keycloak Custom Icon (URL)',
-  auth_oidc_label: 'OIDC Discovery URL',
-  auth_oidc_ci_label: 'OIDC Client ID',
-  auth_oidc_ci_hint:
-    'Make sure that the authorization callback URL is set to https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'OIDC Client Secret',
-  auth_oidc_custom_org_label:
-    'OIDC Custom Organization Name (e.g., Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'OIDC Custom Icon (URL)',
  currency_settings: 'Currency Settings',
  allowed_currencies: 'Allowed Currencies',
-  allowed_currencies_hint:
-    'Set the allowed fiat currencies for the exchange features',
-  default_account_currency: 'Default Accounting Currency',
-  default_account_currency_hint:
-    'The default currency to use for accounting features.',
+  allowed_currencies_hint: 'Limit the number of available fiat currencies',
+  default_account_currency: 'Default Account Currency',
+  default_account_currency_hint: 'Default currency for accounting',
  min_incoming_payment_amount: 'Min Incoming Payment Amount',
  min_incoming_payment_amount_desc:
    'Minimum amount allowed for generating an invoice',
-  max_incoming_payment_amount: 'Maximum Incoming Payment Amount',
+  max_incoming_payment_amount: 'Max Incoming Payment Amount',
  max_incoming_payment_amount_desc:
-    'Maximum amount allowed when generating an invoice',
-  max_outgoing_payment_amount: 'Maximum Outgoing Payment Amount',
+    'Maximum amount allowed for generating an invoice',
+  max_outgoing_payment_amount: 'Max Outgoing Payment Amount',
  max_outgoing_payment_amount_desc:
-    'Maximum amount allowed when making a payment',
-  service_fees: 'Service Fees',
+    'Maximum amount allowed for making a payment',
  service_fee: 'Service Fee',
-  service_fee_label: 'Service Fee Charged Per Transaction',
-  service_fee_max_label: 'Maximum Service Fee Limit',
-  fee_wallet_label: 'Service Fee Wallet ID',
-  fee_wallet_hint: 'The ID of the wallet to which to send service funds',
-  disable_fee: 'Disable Service Fees for Internal Payments',
+  service_fee_label: 'Service fee (%)',
+  service_fee_hint: 'Fee charged per tx (%)',
+  service_fee_max: 'Service Fee Max',
+  service_fee_max_label: 'Service fee max (sats)',
+  service_fee_max_hint: 'Max service fee to charge in (sats)',
+  fee_wallet: 'Fee Wallet',
+  fee_wallet_label: 'Fee wallet (wallet ID)',
+  fee_wallet_hint: 'Wallet ID to send funds to',
+  disable_fee: 'Disable Fee',
+  disable_fee_internal: 'Disable Service Fee for Internal Payments',
+  disable_fee_internal_desc:
+    'Disable Service Fee for Internal Lightning Payments',
  ui_management: 'UI Management',
  ui_site_title: 'Site Title',
  ui_changing_remove_lnbits_elements:
@@ -703,7 +670,6 @@ window.localisation.en = {
  ui_site_description_hint: 'Use plain text, Markdown, or raw HTML',
  ui_default_wallet_name: 'Default Wallet Name',
  ui_default_theme: 'Default Theme',
-  wallet_featured_button_title: 'Wallet - Featured Button',
  wallet_featured_button_label: 'Wallet Featured Button Label',
  wallet_featured_button_label_hint:
    'Show featured button on the wallet homepage',
@@ -712,38 +678,33 @@ window.localisation.en = {
    'On click the button will open this URL. Leave empty to hide the button.',
  wallet_featured_button_icon: 'Featured Button Icon',
  wallet_featured_button_icon_hint:
-    'Icon shown on the featured button (Quasar icon name e.g. "bolt")',
+    'Icon shown on the featured button (check quasar icons)',
  lnbits_wallet: 'LNbits wallet',
  denomination: 'Denomination',
  denomination_hint: 'The name for the FakeWallet token',
  denomination_error: 'Denomination must be 3 characters, or `sats`',
  ui_qr_code_logo: 'QR Code/Favicon Logo',
-  ui_qr_code_logo_hint: 'QR code icon and favicon logo URL',
+  ui_qr_code_logo_hint: 'QR code and favicon logo url',
  ui_apple_touch_icon: 'Apple Touch Icon',
-  ui_apple_touch_icon_hint: 'Apple touch icon URL',
+  ui_apple_touch_icon_hint: 'Apple touch icon url',
  ui_custom_image: 'Custom Image',
  ui_custom_image_label: 'URL to custom image',
-  ui_custom_image_hint:
-    'This image is shown on the LNbits homepage and login screen.',
-  ui_custom_badge_title: 'Custom Badge Settings',
-  ui_custom_badge_desc: 'Show a custom badge in the header of LNbits',
-  ui_custom_badge: 'Custom Badge Text',
+  ui_custom_image_hint: 'Image showed at homepage/login',
+  ui_custom_badge: 'Custom Badge',
  ui_custom_badge_label: "Custom Badge 'USE WITH CAUTION'",
  ui_custom_badge_color_label: 'Custom Badge Color',
  themes: 'Themes',
  themes_hint: 'Choose themes available for users',
  custom_logo: 'Custom Logo',
  custom_logo_hint: 'URL to logo image',
-  ad_space_section_title: 'Advertisement Space',
-  ad_space_section_desc:
-    'Configure the advertisement space on the wallet sidebar.',
-  ad_space_title: 'Advertisement Space Title',
-  ad_space_title_hint: 'Title shown above the advertisement space',
+  ad_space_title: 'Ad Space Title',
+  ad_space_title_label: 'Supported by',
  ad_slots: 'Advertisement Slots',
  ad_slots_hint:
-    'Advertisement image filepaths in CSV format, extensions can choose to honor. Format: url;img_light_url;img_dark_url, url..',
-  ads_enabled: 'Enable Advertisement',
-  ads_disabled: 'Disabled Advertisement',
+    'Ad url and image filepaths in CSV format, extensions can choose to honor',
+  ad_slots_label: 'url;img_light_url;img_dark_url, url...',
+  ads_enabled: 'Ads Enabled',
+  ads_disabled: 'Ads Disabled',
  user_management: 'User Management',
  admin_users: 'Admin Users',
  admin_users_hint: 'Users with admin privileges',
@@ -817,8 +778,6 @@ window.localisation.en = {
  webhook_id_hint: 'PayPal webhook ID used to verify incoming events.',
  webhook_paypal_description:
    'On the PayPal side configure a webhook pointing to your LNbits server.',
-  square_webhook_signature_key_hint:
-    'Square webhook signature key used to verify incoming events.',
  callback_success_url: 'Callback Success URL',
  callback_success_url_hint:
    'The user will be redirected to this URL after the payment is successful',
@@ -379,16 +379,6 @@ window.localisation.es = {
  auth_keycloak_ci_hint:
    'Asegúrate de que la URL de devolución de llamada de autorización esté configurada en https://{domain}/api/v1/auth/keycloak/token',
  auth_keycloak_cs_label: 'Secreto del Cliente de Keycloak',
-  auth_keycloak_custom_org_label: 'Organización personalizada de Keycloak',
-  auth_keycloak_custom_icon_label: 'Icono personalizado de Keycloak (URL)',
-  auth_oidc_label: 'URL de descubrimiento de OIDC',
-  auth_oidc_ci_label: 'ID de cliente de OIDC',
-  auth_oidc_ci_hint:
-    'Asegúrate de que la URL de devolución de llamada de autorización esté configurada en https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'Secreto del Cliente de OIDC',
-  auth_oidc_custom_org_label:
-    'Nombre de organización personalizada OIDC (ej. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'Icono personalizado de OIDC (URL)',
  currency_settings: 'Configuración de moneda',
  allowed_currencies: 'Monedas permitidas',
  allowed_currencies_hint:
@@ -520,14 +520,6 @@ window.localisation.fi = {
  auth_keycloak_cs_label: 'Keycloak-asiakassalasana',
  auth_keycloak_custom_org_label: 'Valinnainen Keycloak-organisaatio',
  auth_keycloak_custom_icon_label: 'Valinnainen Keycloak-kuvake (URL)',
-  auth_oidc_label: 'OIDC-discovery-URL',
-  auth_oidc_ci_label: 'OIDC-asiakastunnus',
-  auth_oidc_ci_hint:
-    'Varmista, että valtuutuksen palautus-URL on asetettu muotoon https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'OIDC-asiakassalasana',
-  auth_oidc_custom_org_label:
-    'OIDC mukautetun organisaation nimi (esim. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'Valinnainen OIDC-kuvake (URL)',
  currency_settings: 'Valuutta-asetukset',
  allowed_currencies: 'Käytettävät valuutat',
  allowed_currencies_hint: 'Valitse käytettävissä olevat fiat-valuutat',
@@ -381,16 +381,6 @@ window.localisation.fr = {
  auth_keycloak_ci_hint:
    "Assurez-vous que l'URL de rappel d'autorisation est définie sur https://{domain}/api/v1/auth/keycloak/token",
  auth_keycloak_cs_label: 'Secret client Keycloak',
-  auth_keycloak_custom_org_label: 'Organisation personnalisée Keycloak',
-  auth_keycloak_custom_icon_label: 'Icône personnalisée Keycloak (URL)',
-  auth_oidc_label: 'URL de découverte OIDC',
-  auth_oidc_ci_label: 'ID Client OIDC',
-  auth_oidc_ci_hint:
-    "Assurez-vous que l'URL de rappel d'autorisation est définie sur https://{domain}/api/v1/auth/oidc/token",
-  auth_oidc_cs_label: 'Secret client OIDC',
-  auth_oidc_custom_org_label:
-    "Nom de l'organisation personnalisée OIDC (par ex. Zitadel, Authentik)",
-  auth_oidc_custom_icon_label: 'Icône personnalisée OIDC (URL)',
  currency_settings: 'Paramètres de devise',
  allowed_currencies: 'Devises autorisées',
  allowed_currencies_hint:
@@ -378,16 +378,6 @@ window.localisation.it = {
  auth_keycloak_ci_hint:
    "Assicurati che l'URL di callback dell'autorizzazione sia impostato su https://{domain}/api/v1/auth/keycloak/token",
  auth_keycloak_cs_label: 'Keycloak Client Secret',
-  auth_keycloak_custom_org_label: 'Organizzazione personalizzata di Keycloak',
-  auth_keycloak_custom_icon_label: 'Icona personalizzata di Keycloak (URL)',
-  auth_oidc_label: 'URL di individuazione di OIDC',
-  auth_oidc_ci_label: 'ID client di OIDC',
-  auth_oidc_ci_hint:
-    "Assicurati che l'URL di callback dell'autorizzazione sia impostato su https://{domain}/api/v1/auth/oidc/token",
-  auth_oidc_cs_label: 'OIDC Client Secret',
-  auth_oidc_custom_org_label:
-    'Nome organizzazione personalizzata OIDC (es. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'Icona personalizzata di OIDC (URL)',
  currency_settings: 'Impostazioni valuta',
  allowed_currencies: 'Valute consentite',
  allowed_currencies_hint: 'Limita il numero di valute fiat disponibili',
@@ -369,15 +369,6 @@ window.localisation.jp = {
  auth_keycloak_ci_hint:
    '認証コールバックURLが https://{domain}/api/v1/auth/keycloak/token に設定されていることを確認してください。',
  auth_keycloak_cs_label: 'キークローククライアントシークレット',
-  auth_keycloak_custom_org_label: 'Keycloak カスタム組織',
-  auth_keycloak_custom_icon_label: 'Keycloak カスタムアイコン (URL)',
-  auth_oidc_label: 'OIDC ディスカバリー URL',
-  auth_oidc_ci_label: 'OIDC クライアント ID',
-  auth_oidc_ci_hint:
-    '認証コールバックURLが https://{domain}/api/v1/auth/oidc/token に設定されていることを確認してください。',
-  auth_oidc_cs_label: 'OIDC クライアントシークレット',
-  auth_oidc_custom_org_label: 'OIDC カスタム組織名（例：Zitadel、Authentik）',
-  auth_oidc_custom_icon_label: 'OIDC カスタムアイコン (URL)',
  currency_settings: '通貨設定',
  allowed_currencies: '許可されている通貨',
  allowed_currencies_hint: '利用可能な法定通貨の数を制限する',
@@ -365,16 +365,6 @@ window.localisation.kr = {
  auth_keycloak_ci_hint:
    '승인 콜백 URL이 https://{domain}/api/v1/auth/keycloak/token으로 설정되어 있는지 확인하십시오.',
  auth_keycloak_cs_label: 'Keycloak 클라이언트 시크릿',
-  auth_keycloak_custom_org_label: 'Keycloak 사용자 정의 조직',
-  auth_keycloak_custom_icon_label: 'Keycloak 사용자 정의 아이콘 (URL)',
-  auth_oidc_label: 'OIDC 디스커버리 URL',
-  auth_oidc_ci_label: 'OIDC 클라이언트 ID',
-  auth_oidc_ci_hint:
-    '승인 콜백 URL이 https://{domain}/api/v1/auth/oidc/token으로 설정되어 있는지 확인하십시오.',
-  auth_oidc_cs_label: 'OIDC 클라이언트 시크릿',
-  auth_oidc_custom_org_label:
-    'OIDC 사용자 정의 조직 이름 (예: Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'OIDC 사용자 정의 아이콘 (URL)',
  currency_settings: '통화 설정',
  allowed_currencies: '허용되는 통화',
  allowed_currencies_hint: '사용 가능한 법정 화폐의 수를 제한하십시오.',
@@ -377,16 +377,6 @@ window.localisation.nl = {
  auth_keycloak_ci_hint:
    'Zorg ervoor dat de autorisatie callback-URL is ingesteld op https://{domain}/api/v1/auth/keycloak/token',
  auth_keycloak_cs_label: 'Keycloak Clientgeheim',
-  auth_keycloak_custom_org_label: 'Keycloak Aangepaste Organisatie',
-  auth_keycloak_custom_icon_label: 'Keycloak Aangepast Pictogram (URL)',
-  auth_oidc_label: 'OIDC Ontdekking URL',
-  auth_oidc_ci_label: 'OIDC-client-ID',
-  auth_oidc_ci_hint:
-    'Zorg ervoor dat de autorisatie callback-URL is ingesteld op https://{domain}/api/v1/auth/oidc/token',
-  auth_oidc_cs_label: 'OIDC Clientgeheim',
-  auth_oidc_custom_org_label:
-    'OIDC Aangepaste Organisatienaam (bijv. Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'OIDC Aangepast Pictogram (URL)',
  currency_settings: 'Valuta-instellingen',
  allowed_currencies: "Toegestane valuta's",
  allowed_currencies_hint: "Beperk het aantal beschikbare fiatvaluta's",
@@ -371,16 +371,6 @@ window.localisation.pi = {
  auth_keycloak_ci_hint:
    "Make sure thant th' authorization callback URL be set t' https://{domain}/api/v1/auth/keycloak/token",
  auth_keycloak_cs_label: 'Keycloak Client Secret',
-  auth_keycloak_custom_org_label: 'Keycloak Custom Organization',
-  auth_keycloak_custom_icon_label: 'Keycloak Custom Icon (URL)',
-  auth_oidc_label: 'OIDC Discovery URL',
-  auth_oidc_ci_label: 'OIDC Client ID',
-  auth_oidc_ci_hint:
-    "Make sure thant th' authorization callback URL be set t' https://{domain}/api/v1/auth/oidc/token",
-  auth_oidc_cs_label: 'OIDC Client Secret',
-  auth_oidc_custom_org_label:
-    'OIDC Custom Organization Name (e.g., Zitadel, Authentik)',
-  auth_oidc_custom_icon_label: 'OIDC Custom Icon (URL)',
  currency_settings: "Doubloon Settin's",
  allowed_currencies: "Allo'ed Doubloons",
  allowed_currencies_hint: 'Limit the number of available fiat doubloons',
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Arc	2e71830817	clean	2026-02-25 22:24:22 +00:00
Arc	0fb2334181	fundle	2026-02-25 22:08:00 +00:00
Arc	94c7796dd5	Merge remote-tracking branch 'origin/dev' into wasm_extensions	2026-02-25 21:30:24 +00:00
Arc	af4ce8da52	pull almost all out to a parent extension	2026-02-25 21:05:28 +00:00
Arc	4e8a5e050b	make	2026-02-25 16:20:26 +00:00
Arc	3fd7aae10d	tasks and docs	2026-02-25 16:11:14 +00:00
Arc	64ad19a65b	tags	2026-02-25 13:39:26 +00:00
Arc	ee6ff7179e	bug fixes	2026-02-22 01:19:19 +00:00
Arc	684dfcc9fb	for uninstalling wasm	2026-02-21 20:47:18 +00:00
Arc	a498d4a877	show keys	2026-02-21 14:48:41 +00:00
Arc	ef90c983f2	make	2026-02-21 14:10:05 +00:00
Arc	da8a82c78e	black	2026-02-21 13:48:27 +00:00
Arc	51f98e8130	added websocket listener back	2026-02-21 12:39:27 +00:00
Arc	7b4436b288	not needed	2026-02-21 11:55:31 +00:00
Arc	ec88cf483e	path proxy	2026-02-21 11:26:38 +00:00
Arc	ca215063be	uv lock	2026-02-21 09:51:10 +00:00
Arc	2674cfb5f1	whoops, forgot to add	2026-02-21 09:26:20 +00:00
Arc	26f0b69085	init	2026-02-21 09:18:13 +00:00
dni ⚡andGitHub	2069e3de8b	chore: update to v1.5.0-rc2 (#3806 )	2026-02-20 10:04:59 +01:00
Vlad StanandGitHub	800be6042f	fix: paypal subscriptions (#3797 )	2026-02-20 10:56:08 +02:00
dni ⚡andGitHub	c65d373f23	feat: restructure docker images, add sparkl2 docker image (#3794 )	2026-02-18 13:52:19 +01:00
dni ⚡andGitHub	087e095bcf	feat: hide first_install_token if is not required (#3795 )	2026-02-18 13:52:02 +01:00
dni ⚡andGitHub	027a161494	chore: update lnbits to version v1.5.0-rc1 (#3793 )	2026-02-17 12:26:50 +01:00
Arc GitHub blackcoffeexbt Vlad Stan	83ef05696e	feat: Spark L2 (#3715 ) Co-authored-by: blackcoffeexbt <87530449+blackcoffeexbt@users.noreply.github.com> Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-02-17 12:25:38 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	42962308e6	chore(deps): bump pillow from 12.1.0 to 12.1.1 (#3785 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-17 11:33:28 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Vlad Stan	783ee256a1	chore(deps): bump axios from 1.13.2 to 1.13.5 (#3786 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-02-17 11:32:58 +01:00
Arc GitHub Vlad Stan	4e805fd00e	feat: modern theme stuff like rounded corners and card gradient (#3766 ) Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-02-16 08:06:36 +01:00
dni ⚡andGitHub	f54824cc44	fix: `/first_install` new superuser may duplicate an username (#3787 )	2026-02-13 14:44:52 +00:00
ArcandGitHub	768d2cbe2a	fix: fail closed on PayPal webhook verification errors (#3769 )	2026-02-10 08:50:50 +01:00
krviandGitHub	efd36d0221	fix: use canonical values in rate limit unit select (#3753 )	2026-02-09 10:43:03 +02:00
Vlad StanandGitHub	4684939e13	fix: validation of invitation code (#3767 )	2026-02-05 18:53:01 +02:00
Vlad StanandGitHub	193ee20da4	[feat] User invitation code (#3761 )	2026-02-05 12:35:24 +02:00
Vlad StanandGitHub	2fe7ab4f83	[feat] Allow no exchange providers (#3763 )	2026-02-05 11:11:48 +01:00
dni ⚡andGitHub	10c8ca4ca1	fix: datetime in db.py added utc offset (#3762 )	2026-02-05 11:05:58 +01:00
Vlad StanandGitHub	f079762b71	fix: handle validation errors when the response is binary (#3765 )	2026-02-05 11:55:40 +02:00
Vlad StanandGitHub	2e042d2597	fix: extension paid/free label (#3764 )	2026-02-05 11:32:46 +02:00
Vlad StanandGitHub	49b57c9f0b	[feat] User activation (#3749 )	2026-02-05 11:31:47 +02:00
dni ⚡andGitHub	656c6cac5b	hotfix: websocket with old balance was sent. (#3759 )	2026-02-03 12:23:49 +01:00
Arc GitHub dni ⚡	45e773b66f	feat: FIRST_INSTALL_TOKEN to help services like Umbrel secure the first_install endpoint (#3751 ) Co-authored-by: dni ⚡ <office@dnilabs.com>	2026-01-30 11:21:52 +01:00
dni ⚡GitHub Vlad Stan	f692ac6f12	refactor: `payment.check_status()` into `check_payment_status(payment)` (#3747 ) Co-authored-by: Vlad Stan <stan.v.vlad@gmail.com>	2026-01-30 11:18:17 +01:00
dni ⚡andGitHub	78202a027b	fix: uiCustomisation JS Error (#3752 )	2026-01-30 09:27:54 +01:00
dni ⚡andGitHub	28fa0906a6	refactor: `g.settings` with a `PublicSettings` class for mapping, for reactive `WINDOW_SETTINGS` (#3644 )	2026-01-30 09:19:01 +01:00
Vlad StanandGitHub	91354f8be4	feat: wallet featured button (#3740 )	2026-01-29 10:49:19 +02:00
Vlad StanandGitHub	5f5d45e89f	[feat] persist user ui customization (#3743 )	2026-01-29 10:35:05 +02:00
dni ⚡andGitHub	52bb125a25	chore: remove `ecdsa` in favor of `coincurve` (#3746 )	2026-01-29 10:02:16 +02:00
dni ⚡andGitHub	2ca1ed897c	CI: use uv for publishing on pypi (#3745 )	2026-01-29 08:54:42 +01:00
Vlad StanandGitHub	631f4e8455	[feat] admin impersonate user (#3741 )	2026-01-28 16:59:23 +01:00
Vlad StanandGitHub	b22f88b264	fix: DB migration conflict (#3739 )	2026-01-27 08:31:38 +02:00
dni ⚡andGitHub	c08bc02930	chore: update python packages (#3707 )	2026-01-26 08:54:37 +01:00
Vlad StanandGitHub	e020a7c5a0	feat: allow text upload (#3738 )	2026-01-26 09:43:52 +02:00
Vlad StanandGitHub	d2e8914835	fix: better validation error messages (#3736 )	2026-01-21 14:28:57 +02:00
dni ⚡andGitHub	5e79ca35ab	chore: remove windowMixin from components and pages (#3632 )	2026-01-21 11:26:45 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4690d178a2	chore(deps): bump cryptography from 42.0.8 to 44.0.1 (#3735 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-21 11:02:28 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	c5825aa4c3	chore(deps): bump aiohttp from 3.12.15 to 3.13.3 (#3734 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-20 17:27:12 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	ebe0c4e3c3	chore(deps): bump urllib3 from 2.5.0 to 2.6.3 (#3733 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-20 17:26:45 +02:00
Djuri BaarsandGitHub	383bdb6312	[fix] Fix missing timezone information	2026-01-20 17:26:02 +02:00
Vlad Stan GitHub dni ⚡	a947686d79	[feat] Update extension builder for 1.4.1 (#3725 ) Co-authored-by: dni ⚡ <office@dnilabs.com>	2026-01-20 14:47:54 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	28e9d32b44	chore(deps): bump werkzeug from 3.1.3 to 3.1.5 (#3732 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-20 14:46:06 +02:00
				`@@ -1 +0,0 @@`
				`"""SSO authentication providers for LNbits"""`
				`@@ -0,0 +1 @@`
				`from lnbits.extensions.wasm.wasm_host import * # noqa: F401,F403`
				`@@ -0,0 +1 @@`
				`from lnbits.extensions.wasm.wasm_host.extension_host import * # noqa: F401,F403`
				`@@ -0,0 +1 @@`
				`from lnbits.extensions.wasm.wasm_host.runner import * # noqa: F401,F403`
				`@@ -0,0 +1 @@`
				`from lnbits.extensions.wasm.wasm_host.service import * # noqa: F401,F403`