Vite 8 changed CJS default-import interop: with "type": "module" set,
a default import of a CJS dependency now resolves to the whole
module.exports object instead of its .default export. react-lottie is
CJS-only, so <Lottie> received an object as the element type and
crashed LottieLoading/LottieSuccess with "Element type is invalid".
Swap to the maintained, ESM-built lottie-react, aliasing it to its ES
build since its browser field points at a UMD build with the same
interop hazard. No other dependency is affected by the interop change.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: update encryption scheme for node migration files
Migration files are now encrypted with AES-CTR using a key derived via
Argon2 with a 32-byte salt, the same derivation used for encrypted
configuration values. Files created by earlier versions can still be
restored: the restore path detects the scheme by trial-decrypting the
archive header and checking for the ZIP file signature, which also
rejects an incorrect unlock password up front instead of extracting
garbage.
The migration screen now also tells users to never share their
migration file with anyone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: reword migration file warning
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: read full migration file header before detecting cipher scheme
io.ReadAtLeast can return once the smallest scheme's header is read,
which truncates the larger current-scheme header when the reader
delivers short reads (e.g. a network request body). Read the full
header and only tolerate a short read that still covers the smallest
scheme.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: extract migration files to a staging directory during restore
If extraction failed partway through, the partially populated restore
directory was left in the working directory, and the next startup would
apply the incomplete restore. Extract to a staging directory and only
move it into place after every entry has been extracted successfully.
Also reject archives that contain no files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: assert traversal-specific error in restore backup test
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* chore: add Bark terms link and exit disclosure to security page
Link Second's Terms of Service from the Bark setup security screen, note
that the hub must stay online so automatically refreshed funds do not
expire, and clarify (via tooltip) that unilateral exit is not built into
Alby Hub yet and must be executed manually with the wallet data.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: improve copy
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Replace __dirname with import.meta.dirname and use Vite's native
resolve.tsconfigPaths option instead of the vite-tsconfig-paths plugin.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The Wails request router included the full request body in its error
log entries, and the HTTP app creation handler logged the whole request
struct on failure. Log only the route, method and error instead,
matching the existing behavior of the /api/mnemonic handler, and log
only the route and method for requests in the desktop frontend.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
return_to query parameters are now parsed and only http and https URLs
are used for redirects, both in the frontend and when the createApp API
adds the connection parameters to the URL.
The production frontend build now also includes the same
Content-Security-Policy meta tag that is served as a header in http
mode, so the policy also applies where no HTTP headers are set, e.g. in
the desktop app.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: keep showing migration success page after creating migration file
After creating a node migration file the hub is halted and the Alby
OAuth token is intentionally removed, so visiting the homepage sent the
user through /start into the Alby OAuth flow. Track the halted state
in memory and redirect back to the migration success page instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: synchronize migration flag access and propagate zip close error
Make nodeMigrationFileCreated an atomic.Bool since it is written by
CreateBackup and read by GetInfo on concurrent HTTP handler goroutines,
and finalize the migration archive explicitly so a failed zip close
returns an error instead of reporting a corrupt backup as success.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: return minimal info response after migration file is created
Once a migration file is created the hub is halted and the database is
closed. GetInfo previously only worked because every config key it reads
happened to be served from the config cache; any cache miss on an
error-propagating read would fail /api/info. Return early with a minimal
response instead so the migration success page does not depend on cache
state.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Allows users running Alby Hub on postgres (e.g. Alby Cloud) to create a
migration file from Settings -> Migrate Alby Hub. The contents of the
postgres database are copied into a temporary local sqlite database
which is included in the migration file, so it can be imported into a
fresh sqlite-based hub.
- extract the db_migrate CLI copy logic into a shared db.MigrateDB
- also copy the swaps and forwards tables (previously silently dropped)
- only require VSS in the source when migrating to postgres
- show a hint on the migrate page when running on postgres
- show database storage type and VSS status on the about page
- don't log an error when removing non-existent db files before restore
Closes#2500
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: update bark onboarding and backup messaging for seed-based recovery
Since bark 0.6.0, offchain funds are recoverable from the mnemonic
alone via the seed-derived recovery mailbox. Remove the outdated
warnings that the recovery phrase is not sufficient, show the standard
recovery guidance for bark during onboarding, and expose the
seed-recovery scan result as a 'recoveryreport' custom node command so
users migrating to a new device can verify their funds were restored.
Closes#2512
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: settle bark lightning receives in the new delivering state
bark 0.6.0 added a 'delivering' receive state between preimage reveal
and settlement. The receive claim handler only treated
'preimage-revealed' and 'settled' as paid, so claimed receives were
published without a preimage and the transactions service rejected the
settlement ('no preimage in payment'), leaving paid invoices pending
forever.
Recognize all states at or past preimage reveal via a receiveIsPaid
helper (a positive allowlist, so an unknown future state degrades to
pending rather than falsely settled), only mark the transaction settled
when the preimage is present, and prefer bark's own settled_at
timestamp when available.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: replace import channels checkbox with LDK-specific warning
The 'I don't have another Alby Hub to migrate or open channels'
checkbox on the import recovery phrase screen only applied to LDK but
was required for every backend, and its claim that channel funds are
always lost is wrong when dynamic channel backups (VSS) are enabled.
Remove the checkbox and the channels bullet from the import screen and
show the caveat on the Security & Recovery page instead, only when a
mnemonic was imported and the LDK backend was chosen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: enable typing card name when choosing other card
Closes#2457
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: reset connect-card dialog form on open and show empty name validation error
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* chore: use shadcn Button for other-card option in connect dialog
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The avatar overlay made the QR code hard to scan, especially for
short lightning addresses. Without center content the QR also drops
back to a lower error correction level, improving scannability.
Fixes#2507
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: filter transactions
* fix: harden transaction filters
* refactor: use explicit nullable transaction filters with HideFailed polarity
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: set transaction filters in a dialog from wallet actions menu
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: filter transactions by search term and type
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: reject invalid transaction filters and reset page synchronously
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: parse complete minimum amount value in transactions filter dialog
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Creating a developer token in the Wails build failed with a confusing
"Unhandled route: POST /api/unlock" error, because the desktop app does
not expose an HTTP API for the token to be used against. Hide the token
creation form in the desktop build and show an explanatory message
instead.
Fixes#2471
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: refresh payment QR and status components
* fix: align payment success button spacing
* fix: invert payment QR colors in dark mode
* fix: address payment QR review feedback
* fix: flatten nested cards in payment review FixedFloat tiles
* chore: remove internal payment component review screen
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: keep QR codes dark-on-light in dark mode
Inverted QR codes are unreadable by many scanner apps (e.g. Phoenix).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: René Aaron <rene@getalby.com>
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: avoid mempool api failures during swaps by using boltz for fee and tx lookup
* fix: ensure swap payment isn't made twice on refresh
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: just in time channels with lsps2
* fix: clarify JIT receive channel fee
* fix: fees
* fix: fees 2
* fix: don't show low inbound when LSPS2 is active
* fix: remove the receive limit below the input if LSPS2 is being used
* fix: simplify
* fix: bring back fee % for outgoing
* fix: remove unneeded changes
* fix: typo
* fix: unneeded
* fix: don't show open first channel is LSPS2
* feat: clearer JIT channel fee copy on receive screen
* fix: add LSPS2 var info
* fix: don't duplicate JIT fee hint on create invoice form
* fix: make paymentDone a standard boolean
* fix: update to golang:1.26 in Dockerfile
* feat: read LSPS2 sources from channel suggestions, set minimum receive amount, update guide link
* docs: update LDK_LSPS2_ADDRESSES to be used as an override
* fix: only show minimum jit receive amount on validation error
* fix: add more detail to receive error when receiving low amounts with jit
* fix: do not use JIT when user has public channels
* feat: add option to disable JIT
* fix: isTrusted check, add jit property to event
* fix: do not require node restart for toggling JIT
* chore: simplify JIT alert
* chore: add guide link on node settings JIT description
* feat: fetch the lsp2info to have access to params like minimum/maximum payment size
* refactor: share single learn-more link across JIT fee hint branches
* fix: remove variable amount invoice support
* fix: use lsps2info for min payment size and remove channelPeerSuggestion usage of minimumChannelSize
* fix: only do amount validation according to lsps2Info values if jit is enabled in settings
* feat: add jit first payment fee alert on receive via lightning address
* fix: remove unnecessary conditional
* fix: ensure at least one sat is left over when opening JIT channel
* chore: remove hardcoded suggestions
* chore: rename JIT enabled config variable
* fix: ui checks when JIT is disabled
* fix: amount input validation message
* fix: formatting
---------
Co-authored-by: anon <anon@anon.com>
Co-authored-by: saunter <68239231+stackingsaunter@users.noreply.github.com>
Co-authored-by: fmar <fmar@fmar>
Co-authored-by: René Aaron <rene@twentyuno.net>
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* feat: pass selected provider to card topup app
The Bitcoin Card Topup app (card.albylabs.com) now supports configuration
presets selected via a `provider` query param. Pass the provider chosen on
the Cards page through to the topup app's install link so its preset is
pre-applied, simplifying setup.
Closes#2384
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: move bitcoin card topup install guide component to a new file
* chore: remove accidentally committed worktree gitlinks
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: use more general copy for card topup app install guide
* fix: remove subtree commits
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: tighten inline empty state spacing on wallet pages
* chore: refine wallet empty states
- Replace placeholder icons (drum, link) with channel-specific icons (ZapIcon for lightning, BitcoinIcon for on-chain)
- Rewrite empty-state copy with warmer, less technical phrasing
- Drop redundant CTA (Receive button already sits above)
- Add subtle bg-accent surface to anchor the transactions section
* chore(empty-state): add variant prop, drop unused button props on wallet pages
* chore(empty-state): swap muted surface from bg-accent/40 to bg-muted
* chore(transactions): allow callers to override empty-state copy and icon
App transaction lists now show app-context messaging ('No transactions yet'
+ 'Payments made through this app will appear here.' with a ReceiptIcon)
instead of the wallet-specific lightning copy.
* chore(empty-state): drop unused 'none' variant
* chore(empty-state): default showButton to false
* chore(empty-state): drop showButton prop, derive from buttonText+buttonLink
* fix(empty-state): drop nested surface in app transactions card
Add 'none' variant and use it from AppTransactionList so the empty state
no longer renders a bg-muted box inside the already-bordered Card.
* fix(app-transactions): swap ReceiptIcon for ArrowDownUpIcon
ReceiptIcon renders a dollar sign — wrong for a bitcoin app.
* chore(empty-state): default variant to 'muted', CTA placeholders opt into 'dashed'
---------
Co-authored-by: Roland Bewick <roland.bewick@gmail.com>
* fix: reduce wallet balance/transaction polling interval to 10s
The wallet dashboard polls /api/balances and /api/transactions every 3s
via SWR refreshInterval. For hubs left open in a browser tab, this produces
a high, continuous volume of identical requests around the clock with little
UX benefit, since SWR already revalidates on window focus.
Raise the interval for the balances and transactions-list hooks to 10s. The
single-transaction hook (used while waiting for a specific invoice to settle)
is intentionally left at 3s, where fast updates matter and polling is
short-lived.
* refactor: drop poll-interval comments, rationale moved to PR
* feat: reframe AI agent inspiration tab around managing the hub
Change the Node inspiration tab on the AI & Agents page to a Hub tab focused on managing Alby Hub itself (app connections, sub-wallets, budgets) rather than lightning channels. Channel/node prompts only show when the backend supports channel management.
Closes#2401
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: icon
* chore: name
* chore: remove stray .claude/worktrees gitlinks
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: René Aaron <rene@twentyuno.net>
* chore: remove Bitrefill custom app in favor of standard NWC connection
Bitrefill now supports Nostr Wallet Connect directly, so the custom
embedded iframe app is no longer needed. Remove the internal Bitrefill
screen and route, convert the app store entry to a standard NWC
connectable app, and drop the embed.bitrefill.com frame-src CSP
exceptions from both the backend header and the dev Vite config.
Closes#2283
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: update bitrefill instructions and add mobile links
* chore: remove accidentally committed .claude/worktrees gitlinks
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Renames the onboarding checklist item from "Send or receive your
first payment" to "Receive your first payment" and marks it complete
when the wallet has a spendable balance (e.g. after opening an
outbound channel) in addition to having a transaction.
