# Phase 18 — Premium Mini App frontend

Release: `0.18.0` · Date: 2026-09-09

## Implementation

Added the Express/EJS Mini App shell, local ES-module client, shared components, responsive theme CSS, and the screens documented in [Mini App frontend](MINIAPP-FRONTEND.md). The presentation uses rounded surfaces, a gradient balance card, mobile bottom navigation, dashboard progress, and clear task/withdrawal review states.

Security-sensitive integration includes scoped SDK CSP, safe public asset serving, maintenance/ban-compatible shell delivery, raw Telegram authentication exchange, CSRF acquisition, duplicate-mutation coalescing, in-memory retry keys, exact money handling, safe rich content, and dialog/timer lifecycle cleanup.

## Validation evidence

Focused Phase 18 checks: 19 passed (12 unit, 4 local HTTP integration, 3 source-security checks).

Full project quality gate: **PASS**, using Node.js `v24.19.0` and `npm --offline --no-update-notifier run check`.

| Check                      | Result                                                                               |
| -------------------------- | ------------------------------------------------------------------------------------ |
| Automated suite            | 346 passed; 0 failed, skipped or cancelled                                           |
| ESLint                     | Passed with zero warnings                                                            |
| Prettier                   | All matched files passed                                                             |
| Environment example        | 87/87 recognized keys; passed                                                        |
| Schema                     | 22 migrations, 6 seeds, 75 tables, 249 named constraints; passed                     |
| CSS                        | Mini App and existing Admin bundles built successfully                               |
| Project manifest           | 78 directories, 444 required files, 34 scripts; passed                               |
| Prior-release preservation | No missing Phase 17 files; 208 module/database/bot/job files byte-for-byte unchanged |

The environment emits an npm `http-proxy` configuration deprecation warning; it does not fail the checks and no dependency installation or audit-network request was performed.

The local HTTP tests render the EJS shell and verify CSP, cache behavior, missing/private assets, maintenance isolation and banned-session isolation using test-only providers. They do not authenticate with a production Telegram account or run MySQL/Redis operations.

## Compatibility boundary

No new migration or seed is introduced. Existing application services, ledger/task/referral/withdrawal logic and worker/scheduler implementations are preserved. Package dependencies remain unchanged and exact-pinned. Version metadata is updated consistently to Phase 18.

This is an implementation checkpoint, not a production certification. Browser screenshots, real Telegram/device interactions, live MySQL/Redis integration, external verification callbacks and real payouts have not been exercised here. English UI labels ship in this checkpoint; locale preferences/Unicode content are supported, but translated label packs remain separate work.

## Next

Phase 19: Dynamic Admin Panel frontend. Phase 20: final operational/security hardening, staging acceptance and deployment verification.