After a wallet sent a transaction, waitTx polled the public RPC straight
from the browser, which connect-src 'self' blocks (Firefox NetworkError,
reported by Marty on Activate; the activation itself landed on-chain).
New /api/tx/<hash> relays eth_getTransactionReceipt via the server's RPC
pool, so the browser only ever talks to us and the mainnet flip needs no
CSP changes. Assets v=20260905a.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
/api/my/dashboard aggregates credits, earned POL (from the chain index),
qualification count, and the referral roster (privacy-masked emails,
joined-free vs wallet-linked status, code+id referrer match). Members area
leads with four stat cards, a next-move card with a qualification progress
bar (2 and 5 buyer marks), the line roster, and a copy-ready share message
beside the invite link. Assets v=20260904j.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Coolify MySQL (instantadpay-db) via DATABASE_URL; db.js bootstraps schema
and one-time imports the volume JSON. accounts/auth/ads are dual-mode: the
MySQL path uses guarded UPDATEs for the concurrent ad-serving hot path;
without DATABASE_URL the JSON stores remain (local dev). All data functions
async; server boots through db.init. Chain index stays a file: it is a
rebuildable cache of the blockchain, which remains the money truth.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
RM Circle pattern: nine canned answers for the questions everyone asks
(pyramid, withdrawals, splits, qualification, joining, credits, safety),
OpenRouter fallback with a facts-loaded system prompt and hard no-income-
promise rules, graceful no-key fallback. Floating mint bubble widget with
linkified replies; 10/min per-IP rate limit. Assets v=20260904i.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every account gets a share code at signup; /join/<code> attributes
first-touch site-side and resolves to the referrer's CURRENT on-chain id at
the referral's buy time, so activating any time before your people buy
locks the line to you. Joining through a code emails the referrer an
activate-payouts nudge. Buy flow re-resolves the sponsor at click time.
Copy updated across home and members; assets bumped to v=20260904g.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
/contract: plain-language security review with the six design laws, honest
operator CAN/CANNOT lists, split walkthrough, oracle bridge and anti-stall
notes, testing summary, live explorer + Sourcify verified-source links
(config-driven so it follows the mainnet flip). Nav gains The contract.
All asset URLs now carry a version query so deploys bust browser caches
(the level-cycler stall). Earn-deeper checklist leads with: no withdrawal
requests, ever.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
/api/auth/email/start issues a 15-min code (60s resend guard, 6 tries);
verify creates the account passwordless (sponsor cookie first-touch) and
mints the session. UI swaps the password cards for the code flow when
config.emailAuth is on; dev mode returns the code inline. Password flow
remains until the key lands in the volume (data/sendgrid.key) or
SENDGRID_KEY env.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Aurora ground, glass panels, gradient pill CTAs, Sora display face, live
money ticker, stat band fed by chain totals (tallied in the indexer with
one-time backfill), format showcase, Branded Voice FAQ accordions. CSP
extended for Google Fonts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Spec 8b types 1-3. Spend accrues per campaign in batches; burns queue for
the engine signer (admin runs consume() on-chain, /api/admin/burns). Rates
are volume config (adrates.json), rehearsal placeholders until Marty sets
the real card. Public slots serve on the ledger page; campaign manager in
the members area.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Normal people join with email + password (sponsor attribution via cookie at
signup); the wallet only appears when buying or activating payouts, and gets
linked to the account then. Wallet-only sign-in remains for crypto-native
users. Sessions carry {email, address, memberId}.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Site copy regenerated through the bv-tester1 engine; em dashes scrubbed from
all user-visible strings. /api/my/activity serves per-member earnings,
referrals, and purchases from the chain index.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Zero-dependency Node server on the RM Circle pattern. Chain config lives in
the volume so the same code runs the Amoy dress rehearsal and mainnet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
martbost