- POST /api/public/tg-webapp-auth: HMAC-verifies WebApp initData against the
companion bot token (12h freshness, timing-safe), maps chat -> member via
tg-links.json, mints a message session -> linked members land on /my/<id>
with zero login
- /app entry page (vendored telegram-web-app.js keeps CSP script-src 'self');
unlinked users get the one-time wallet-link instructions
- tg-app.js on all pages: no-op in browsers; inside the webview lazy-loads the
SDK, expands, themes header/background #071421, wires native BackButton
- Bot menu button set programmatically to open /app; /start + help mention it
- Synced chat.js canned answer + AI system prompt (Mini App facts)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New tgbot.js (raw Bot API, zero deps, private-chats only so the
group feeds are untouched): wallet-verified linking via dashboard
deep-link codes, personal payout + joined-on-your-link DMs, a
message bridge that delivers site messages natively in Telegram
with reply-to-answer routing (matrix-line permissions enforced by
the existing messages.js rules), and links/msg/help commands.
Webhook self-registers; secret derived from the token. Config key
companionBotToken overrides the feed bot token when Marty creates
a dedicated bot. Dashboard Messages panel gains Connect Telegram;
chatbot + AI prompt synced.
martbost