- POST /api/public/tg-webapp-auth: HMAC-verifies WebApp initData against the
companion bot token (12h freshness, timing-safe), maps chat -> member via
tg-links.json, mints a message session -> linked members land on /my/<id>
with zero login
- /app entry page (vendored telegram-web-app.js keeps CSP script-src 'self');
unlinked users get the one-time wallet-link instructions
- tg-app.js on all pages: no-op in browsers; inside the webview lazy-loads the
SDK, expands, themes header/background #071421, wires native BackButton
- Bot menu button set programmatically to open /app; /start + help mention it
- Synced chat.js canned answer + AI system prompt (Mini App facts)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Floating translate button (bottom-left) on every member-facing page
lazy-loads the Google Translate element; language choice persists
across pages via the googtrans cookie. CSP extended for Google's
translate hosts only. Chatbot now replies in the member's language
and a canned answer points at the button.
- added "Promo Tools" to the footer-links on every page
- added a Promo Tools button in the /my dashboard "Share this position" card
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Public promo is now RM-Circle-only; the Crypto Team Build Network is learned
after joining, not surfaced to prospects.
- nav brand "Crypto Team Build" -> "RM Circle" (subtitle "Premium Team Build")
- all <title>, og:site_name, twitter meta, footers, disclaimers, 404, chatbot
system prompt + canned answers, config siteName/supportLabel swept
- removed "a project of the Crypto Team Build Network" framing from prose
- banners regenerated: eyebrow now "The RM Circle · Polygon" (was Crypto Team Build)
- og-card.jpg regenerated (was "CRYPTO TEAM BUILD NETWORK PRESENTS")
- roadmap.webp already RM-Circle branded (no change needed)
- social posts/swipes: #CryptoTeamBuild -> #RMCircle, "crypto team build" -> "RM Circle team build"
Videos still reference old branding (VO + embedded site screenshot) — rebuilt next.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Domain migration go-forward: replaced every hardcoded rmcircle.saasy.top
across public/*.html (canonical, og:url, og:image, twitter tags),
chat.js (chatbot answer URLs + linkify self-link matcher), my.js, and
server.js (member-page OG injection, unsubUrl, chat system prompt) with
rmcircle.team. Old domain still serves everything; canonical now points
search engines + social previews at the new primary domain.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Visual explainer of the two income streams: entry rewards you keep, and
the depth-matched upgrade ladder (each layer pays you once, at the one
level matching its depth) as an SVG flow diagram. Route + CSS added;
linked from training body and all footers. Educational, on-chain-factual
framing with disclaimer link.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- /disclaimer: independent-resource, affiliate, earnings, risk, and
not-advice disclosures; linked from all footers.
- Self-service alerts: members opt in with their email on /my/:id to get
"you've been paid" + "upgrade needed" emails for their own position
(same watcher as the owner alerts, extended). Signed unsubscribe link
(/unsubscribe?id=&t=HMAC), on-chain-registration check, rate-limited,
masked-email status, confirmation email.
- Admin login: timing-safe compare + per-IP lockout (8 fails -> 15 min,
escalating). Previously unlimited/brute-forceable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
martbost