[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_206":207,"_208":209},"routes/_app.x.$handle.$name",{"_106":105,"_38":51,"_115":96,"_33":116,"_13":14,"_117":-5,"_11":118,"_119":120,"_121":122,"_123":124,"_125":126,"_26":-5,"_127":-5,"_128":-5,"_129":31,"_130":131,"_132":65,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":89,"_90":91,"_92":93,"_94":31},"version",52,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","0ae287fd-e771-4722-ac54-e9bcbdb7389b","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","telegram_bot.ts","latestPath","fileId","cb250206-a9d8-11f1-bfce-1607ee4eb77e","name","fileType","script","content","/* ============================================================\n TELEGRAM BOT — webhook ingestion + alert messages.\n ToS-safe path (no MTProto/user sessions): your public signal\n channel adds this bot; Telegram POSTs new messages here via\n webhook. Per-message fetch() — fully serverless-safe.\n ------------------------------------------------------------\n Requires env: TELEGRAM_BOT_TOKEN\n Optional: ADMIN_CHAT_ID (who gets alerts)\n ============================================================ */\n\nconst TG_API = \"https://api.telegram.org/bot\";\n\nexport function botToken(): string {\n const t = Deno.env.get(\"TELEGRAM_BOT_TOKEN\");\n if (!t) throw new Error(\"TELEGRAM_BOT_TOKEN not set\");\n return t;\n}\n\nexport interface TgChat { id: number; type: string; title?: string; username?: string }\nexport interface TgMessage { message_id: number; text?: string; chat: TgChat; date: number }\nexport interface TgUpdate { update_id: number; message?: TgMessage; channel_post?: TgMessage }\n\n/** Extract the message from an Update (channel posts or normal group messages). */\nexport function messageFromUpdate(u: TgUpdate): TgMessage | null {\n return (u.channel_post ?? u.message) ?? null;\n}\n\n/** POST /setWebhook so Telegram streams updates to our endpoint.\n `token` overrides the env var (used when the token is stored in the bot's settings). */\nexport async function setWebhook(url: string, opts: { dropPending?: boolean } = {}, token?: string): Promise {\n const params = new URLSearchParams({ url });\n if (opts.dropPending) params.set(\"drop_pending_updates\", \"true\");\n const r = await fetch(`${TG_API}${token ?? botToken()}/setWebhook?${params}`);\n const j = await r.json() as { ok: boolean; description?: string };\n if (!j.ok) throw new Error(`setWebhook failed: ${j.description}`);\n return true;\n}\n\n/** GET /getWebhookInfo to confirm the webhook is registered. */\nexport async function webhookInfo(): Promise {\n const r = await fetch(`${TG_API}${botToken()}/getWebhookInfo`);\n return r.json();\n}\n\n/** Send an HTML-formatted message to a chat (defaults to ADMIN_CHAT_ID). */\nexport async function sendMessage(\n text: string,\n chatId?: number | string,\n): Promise {\n const token = botToken();\n const to = String(chatId ?? Deno.env.get(\"ADMIN_CHAT_ID\") ?? \"\");\n if (!to) return false;\n const r = await fetch(`${TG_API}${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ chat_id: to, text, parse_mode: \"HTML\" }),\n });\n return r.ok;\n}\n/** Verify the bot token is valid. Returns the bot's identity. */\nexport async function getMe(token?: string): Promise {\n const r = await fetch(`${TG_API}${token ?? botToken()}/getMe`);\n return r.json();\n}\n\n/**\n * Long/short-poll updates (messages sent TO this bot). Official Bot API —\n * this is the sanctioned way to read signals that arrive at your bot.\n * `offset` = first update_id to return; Telegram filters out older ones.\n */\nexport async function getUpdates(\n opts: { offset?: number; limit?: number; timeout?: number } = {},\n token?: string,\n): Promise<{ ok: boolean; result?: any[]; description?: string }> {\n const params = new URLSearchParams();\n if (opts.offset != null) params.set(\"offset\", String(opts.offset));\n if (opts.limit != null) params.set(\"limit\", String(opts.limit));\n if (opts.timeout != null) params.set(\"timeout\", String(opts.timeout));\n const qs = params.toString();\n const r = await fetch(`${TG_API}${token ?? botToken()}/getUpdates${qs ? \"?\" + qs : \"\"}`);\n return r.json() as any;\n}\n","/* ============================================================\n TELEGRAM BOT — webhook ingestion + alert messages.\n ToS-safe path (no MTProto/user sessions): your public signal\n channel adds this bot; Telegram POSTs new messages here via\n webhook. Per-message fetch() — fully serverless-safe.\n ------------------------------------------------------------\n Requires env: TELEGRAM_BOT_TOKEN\n Optional: ADMIN_CHAT_ID (who gets alerts)\n ============================================================ */\n\nconst TG_API = \"https://api.telegram.org/bot\";\n\nexport function botToken(): string {\n const t = Deno.env.get(\"TELEGRAM_BOT_TOKEN\");\n if (!t) throw new Error(\"TELEGRAM_BOT_TOKEN not set\");\n return t;\n}\n\nexport interface TgChat { id: number; type: string; title?: string; username?: string }\nexport interface TgMessage { message_id: number; text?: string; chat: TgChat; date: number }\nexport interface TgUpdate { update_id: number; message?: TgMessage; channel_post?: TgMessage }\n\n/** Extract the message from an Update (channel posts or normal group messages). */\nexport function messageFromUpdate(u: TgUpdate): TgMessage | null {\n return (u.channel_post ?? u.message) ?? null;\n}\n\n/** POST /setWebhook so Telegram streams updates to our endpoint.\n `token` overrides the env var (used when the token is stored in the bot's settings). */\nexport async function setWebhook(url: string, opts: { dropPending?: boolean } = {}, token?: string): Promise {\n const params = new URLSearchParams({ url });\n if (opts.dropPending) params.set(\"drop_pending_updates\", \"true\");\n const r = await fetch(`${TG_API}${token ?? botToken()}/setWebhook?${params}`);\n const j = await r.json() as { ok: boolean; description?: string };\n if (!j.ok) throw new Error(`setWebhook failed: ${j.description}`);\n return true;\n}\n\n/** GET /getWebhookInfo to confirm the webhook is registered. */\nexport async function webhookInfo(): Promise {\n const r = await fetch(`${TG_API}${botToken()}/getWebhookInfo`);\n return r.json();\n}\n\n/** Send an HTML-formatted message to a chat (defaults to ADMIN_CHAT_ID). */\nexport async function sendMessage(\n text: string,\n chatId?: number | string,\n): Promise {\n const token = botToken();\n const to = String(chatId ?? Deno.env.get(\"ADMIN_CHAT_ID\") ?? \"\");\n if (!to) return false;\n const r = await fetch(`${TG_API}${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ chat_id: to, text, parse_mode: \"HTML\" }),\n });\n return r.ok;\n}\n/** Verify the bot token is valid. Returns the bot's identity. */\nexport async function getMe(token?: string): Promise {\n const r = await fetch(`${TG_API}${token ?? botToken()}/getMe`);\n return r.json();\n}\n\n/**\n * Long/short-poll updates (messages sent TO this bot). Official Bot API —\n * this is the sanctioned way to read signals that arrive at your bot.\n * `offset` = first update_id to return; Telegram filters out older ones.\n */\nexport async function getUpdates(\n opts: { offset?: number; limit?: number; timeout?: number } = {},\n token?: string,\n): Promise<{ ok: boolean; result?: any[]; description?: string }> {\n const params = new URLSearchParams();\n if (opts.offset != null) params.set(\"offset\", String(opts.offset));\n if (opts.limit != null) params.set(\"limit\", String(opts.limit));\n if (opts.timeout != null) params.set(\"timeout\", String(opts.timeout));\n const qs = params.toString();\n const r = await fetch(`${TG_API}${token ?? botToken()}/getUpdates${qs ? \"?\" + qs : \"\"}`);\n return r.json() as any;\n}\n/** Remove any active webhook so getUpdates polling can run.\n Official Bot API — webhook and polling are mutually exclusive. */\nexport async function deleteWebhook(token?: string): Promise {\n const r = await fetch(`${TG_API}${token ?? botToken()}/deleteWebhook`);\n const j = await r.json() as { ok: boolean; description?: string };\n if (!j.ok) throw new Error(`deleteWebhook failed: ${j.description}`);\n return true;\n}\n","createdAt",["D",1788694117626],"branchVersion","branchId","052f6539-63b6-428e-bd86-f7c5cd7e6c65","id","8caac29c-f32e-4f26-ab69-b12a18b3597b","gold-signal-bot",["D",1788687592224],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Telegram XAUUSD signal parse, risk-size and journal on Val Town","imageUrl","5405944a-128b-47c4-af73-76e267e46fec","pinnedFileId","f53e80aa-a9d6-11f1-bbcc-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07610-2b05-75c8-9aa5-3b4cbaeb8839","tursoName","8caac29cf32e4f26ab69b12a18b3597b","tursoHostname","8caac29cf32e4f26ab69b12a18b3597b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789472446807],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_106":105,"_114":110},"org",{"_106":105,"_107":108,"_109":110,"_19":61,"_111":112,"_113":31},"branch",{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"isOwned",111,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Goldworkspace","handle","displayName","Muiruri Muiruri Ngugi","avatar","https://lh3.googleusercontent.com/a/ACg8ocIL2QlMIcfe6TlJejp2TWNHfbtZXNrBQnQytRRElr7jGsxE1g=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_49":50,"_38":51,"_44":201,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":202,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":203,"_90":204,"_92":205,"_94":31},"tree",[184,185,186,187],"files",[184,185,186,187],"counts",{"_173":69,"_174":175,"_176":69,"_177":178,"_179":180},"contents",[137,138,139,140],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":165,"_38":166,"_36":167,"_142":-5,"_47":48,"_46":168,"_143":31,"_44":169,"_13":170,"_39":40,"_41":171,"_30":31,"_146":-5,"_33":172},{"_49":156,"_38":157,"_36":63,"_142":-5,"_47":48,"_46":158,"_143":31,"_44":159,"_13":160,"_39":161,"_41":162,"_30":31,"_146":163,"_33":164},{"_49":148,"_38":149,"_36":150,"_142":-5,"_47":48,"_46":151,"_143":65,"_44":152,"_13":69,"_39":153,"_41":154,"_30":31,"_146":-5,"_33":155},{"_49":141,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_143":65,"_44":144,"_13":145,"_39":40,"_41":43,"_30":31,"_146":-5,"_33":147},"9739a9b9-f4a1-4578-b524-c82fd42f7d19","parentId","latest",["D",1788694117626],3,"label",[34],"78b7b35d-86ff-42d2-912b-c215a0781af0","pull_updates.ts","0c6017c6-a9e6-11f1-b512-1607ee4eb77e",51,["D",1788694094017],"interval","/* ============================================================\n TELEGRAM PULLER — scheduled getUpdates reader.\n On each tick it asks Telegram (official Bot API, bot token\n only — no user session) for any messages sent to the bot,\n parses each as a signal, and feeds the engine.\n ============================================================ */\nimport { pullTelegram } from \"./main.ts\";\n\nexport default async function () {\n const res = await pullTelegram();\n console.log(\"TG_PULL\", JSON.stringify(res));\n}\n",[149],"f7c87bc0-cff6-420c-b162-7bb742cc3ee7","main.ts",50,["D",1788694088037],40,"http","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { derivConfig, executeTrade, verifyGoldSymbol } from \"./deriv_client.ts\";\nimport { getMe, getUpdates, messageFromUpdate, setWebhook } from \"./telegram_bot.ts\";\n\n/* ============================================================\n GOLD SIGNAL BOT — engine + Deriv execution + Telegram webhook\n Dashboard is plain vanilla JS (no React, no esm.sh) so it\n always renders. Server engine verified working.\n ============================================================ */\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS gold_trades (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n trace_id TEXT UNIQUE NOT NULL,\n ts TEXT NOT NULL, symbol TEXT NOT NULL DEFAULT 'XAUUSD',\n direction TEXT NOT NULL, entry REAL, stop_loss REAL, take_profit REAL,\n amount REAL, pip_distance REAL,\n status TEXT NOT NULL, contract_id TEXT, error_text TEXT, raw_signal TEXT)`);\nawait sqlite.execute(`CREATE INDEX IF NOT EXISTS idx_gold_status ON gold_trades(status)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS risk (k TEXT PRIMARY KEY, v TEXT)`);\n\nconst q = async (sql: string, args: unknown[] = []) =>\n (await sqlite.execute({ sql, args })).rows as Record[];\n\nconst SETTINGS_DEFAULTS: Record = {\n DERIV_API_TOKEN_DEMO: \"\", DERIV_API_TOKEN_REAL: \"\", DERIV_API_TOKEN: \"\",\n DERIV_APP_ID: \"1089\", TELEGRAM_BOT_TOKEN: \"\", ADMIN_CHAT_ID: \"\",\n RISK_PER_TRADE: \"1\", ACCOUNT_BALANCE: \"10000\", AUTO_TRADE: \"off\", DERIV_MODE: \"demo\",\n GOLD_SYMBOL: \"frxXAUUSD\", DERIV_TIMEOUT_MS: \"12000\",\n MAX_DAILY_TRADES: \"8\", COOLDOWN_MS: \"180000\", MAX_CONSECUTIVE_LOSSES: \"3\",\n};\n\n/** Which token trades right now: driven by DERIV_MODE (demo|real).\n Falls back to the old DERIV_API_TOKEN if the split tokens are empty. */\nasync function activeToken(): Promise {\n const mode = (await getSetting(\"DERIV_MODE\", \"demo\")).toLowerCase();\n const t = mode === \"real\"\n ? await getSetting(\"DERIV_API_TOKEN_REAL\")\n : await getSetting(\"DERIV_API_TOKEN_DEMO\");\n return t || await getSetting(\"DERIV_API_TOKEN\");\n}\nasync function activeTokenSet(): Promise<{ demoSet: boolean; realSet: boolean }> {\n return {\n demoSet: !!(await getSetting(\"DERIV_API_TOKEN_DEMO\")) || !!(await getSetting(\"DERIV_API_TOKEN\")),\n realSet: !!(await getSetting(\"DERIV_API_TOKEN_REAL\")),\n };\n}\n\nasync function getSetting(key: string, dflt: string = SETTINGS_DEFAULTS[key] ?? \"\"): Promise {\n const r = await q(\"SELECT value FROM settings WHERE key=?\", [key]);\n if (r[0] && r[0].value != null && r[0].value !== \"\") return String(r[0].value);\n return Deno.env.get(key) ?? dflt;\n}\nasync function setSetting(key: string, value: string): Promise {\n const v = String(value ?? \"\").trim();\n if (v === \"\") await sqlite.execute({ sql: \"DELETE FROM settings WHERE key=?\", args: [key] });\n else await sqlite.execute({ sql: \"INSERT INTO settings(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value\", args: [key, v] });\n}\nasync function storedKeys(): Promise {\n return (await q(\"SELECT key FROM settings\")).map((r) => String(r.key));\n}\n\n/* ---------------- Risk engine ---------------- */\nasync function readRisk(): Promise> {\n const m: Record = {};\n for (const r of await q(\"SELECT k, v FROM risk\")) m[String(r.k)] = String(r.v);\n return m;\n}\nasync function writeRisk(obj: Record): Promise {\n for (const [k, v] of Object.entries(obj)) {\n await sqlite.execute({ sql: \"INSERT INTO risk(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v=excluded.v\", args: [k, v] });\n }\n}\nconst todayUTC = () => new Date().toISOString().slice(0, 10);\nasync function riskState(): Promise> {\n const s = await readRisk();\n if (s.day !== todayUTC()) {\n const reset = { day: todayUTC(), trades: \"0\", consecutive: \"0\", halted: s.halted ?? \"false\", haltReason: s.haltReason ?? \"\" };\n await writeRisk(reset);\n return reset;\n }\n return s;\n}\nasync function riskGate(): Promise<{ ok: boolean; reason?: string }> {\n const s = await riskState();\n if (s.halted === \"true\") return { ok: false, reason: `Trading halted: ${s.haltReason || \"manual\"}` };\n const dow = new Date().getUTCDay();\n if (dow === 6 || dow === 0) return { ok: false, reason: \"Gold market closed (weekend UTC)\" };\n const max = Number(await getSetting(\"MAX_DAILY_TRADES\", \"8\")) || 8;\n if (Number(s.trades || 0) >= max) return { ok: false, reason: `Max daily trades (${max}) reached` };\n const cooldown = Number(await getSetting(\"COOLDOWN_MS\", \"180000\")) || 180000;\n if (s.lastTrade && Date.now() - Number(s.lastTrade) < cooldown) {\n const wait = Math.ceil((cooldown - (Date.now() - Number(s.lastTrade))) / 1000);\n return { ok: false, reason: `Cooldown: ${wait}s left` };\n }\n return { ok: true };\n}\nasync function recordAttempt(status: string): Promise {\n const s = await riskState();\n s.trades = String(Number(s.trades || 0) + 1);\n s.lastTrade = String(Date.now());\n if (status === \"FAILED\") {\n s.consecutive = String(Number(s.consecutive || 0) + 1);\n const maxConsec = Number(await getSetting(\"MAX_CONSECUTIVE_LOSSES\", \"3\")) || 3;\n if (Number(s.consecutive) >= maxConsec) { s.halted = \"true\"; s.haltReason = `${maxConsec} consecutive failures (circuit breaker)`; }\n } else if (status === \"LIVE\" || status === \"SIMULATED\") {\n s.consecutive = \"0\";\n }\n await writeRisk(s);\n}\n\n/* ---------------- Domain ---------------- */\ntype Dir = \"LONG\" | \"SHORT\";\ninterface GoldSignal { symbol: \"XAUUSD\"; direction: Dir; entry: number; stopLoss: number; takeProfit: number; pipDistance: number; rawText: string; }\n\nfunction parseDir(s: string): Dir | null {\n const m: Record = { long: \"LONG\", call: \"LONG\", buy: \"LONG\", up: \"LONG\", short: \"SHORT\", put: \"SHORT\", sell: \"SHORT\", down: \"SHORT\" };\n return m[s.trim().toLowerCase()] ?? null;\n}\nexport function parseGoldSignal(text: string): GoldSignal | null {\n // Multiple parse strategies so real-world channel formats are matched.\n const pats = [\n // Strict: [XAUUSD/GOLD][BUY/SELL/...][entry][SL x][TP x]\n /(XAUUSD|GOLD|XAU)\\b[\\s\\S]{0,40}?(BUY|SELL|LONG|SHORT|call|put|up|down)[:@#\\s]*[,=\\s@]?\\s*(\\d{2,5}\\.\\d{2})[\\s\\S]{0,40}?(?:SL|stop|Stop Loss)[\\s:=#]*(\\d{2,5}\\.\\d{2})[\\s\\S]{0,40}?(?:TP|target|Take Profit)[\\s:=#]*(\\d{2,5}\\.\\d{2})/i,\n // Lenient: BUY/SELL entry ... SL x ... TP x (no gold keyword prefix)\n /\\b(BUY|SELL|LONG|SHORT|call|put)\\b[^\\d\\n]{0,25}(\\d{2,5}\\.\\d{1,2})[^\\d\\n]{0,30}?(?:SL|Stop|Stop Loss)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,30}?(?:TP|Target|Take Profit|target)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b/i,\n // Entry-first: 2650.45 BUY, SL ... TP ...\n /\\b(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,20}?\\b(BUY|SELL|LONG|SHORT|call|put)\\b[^\\d\\n]{0,30}?(?:SL|Stop|Stop Loss)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,30}?(?:TP|Target|Take Profit)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b/i,\n ];\n for (const pat of pats) {\n const m = text.match(pat);\n if (!m) continue;\n // find which capture is the direction (group with 2 is direction in each pattern)\n const direction = parseDir(m[2]);\n if (!direction) continue;\n const entry = Number(m[3]), sl = Number(m[4]), tp = Number(m[5]);\n if ([entry, sl, tp].some((v) => !isFinite(v) || v < 1500 || v > 5000)) continue;\n const loseSide = direction === \"LONG\" ? sl < entry : sl > entry;\n if (!loseSide) continue;\n if (Math.abs(entry - sl) < 1.0) continue;\n return { symbol: \"XAUUSD\", direction, entry, stopLoss: sl, takeProfit: tp, pipDistance: Math.round(Math.abs(entry - sl) * 100), rawText: text };\n }\n return null;\n}\n\nasync function sizePosition(s: GoldSignal, bal: number) {\n const riskPct = Number(await getSetting(\"RISK_PER_TRADE\", \"1\")) || 1;\n let amount = bal * (riskPct / 100);\n amount = Math.min(amount, bal * 0.05);\n amount = Math.max(0.5, Math.round(amount * 100) / 100);\n return { amount, riskPct, pipDistance: s.pipDistance };\n}\n\nasync function isDuplicate(s: GoldSignal): Promise {\n const fiveMinAgo = new Date(Date.now() - 300_000).toISOString();\n const r = await q(\"SELECT COUNT(*) c FROM gold_trades WHERE symbol=? AND direction=? AND entry=? AND ts>?\", [\"XAUUSD\", s.direction, s.entry, fiveMinAgo]);\n return Number((r[0] as any)?.c ?? 0) > 0;\n}\n\nasync function processSignal(raw: string, opts: { execute: boolean } = { execute: false }): Promise> {\n const traceId = crypto.randomUUID();\n const signal = parseGoldSignal(raw);\n if (!signal) {\n await sqlite.execute({ sql: \"INSERT INTO gold_trades (trace_id, ts, symbol, status, raw_signal) VALUES (?,?,?,'REJECTED',?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", raw.slice(0, 500)] });\n return { traceId, rejected: \"Could not parse a valid XAUUSD signal.\" };\n }\n if (await isDuplicate(signal)) return { traceId, rejected: \"Duplicate signal (same direction/entry within 5 min).\" };\n const gate = await riskGate();\n if (!gate.ok) {\n await sqlite.execute({ sql: \"INSERT INTO gold_trades (trace_id, ts, symbol, status, error_text, raw_signal) VALUES (?,?,?,'REJECTED',?,?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", gate.reason ?? \"blocked\", signal.rawText] });\n return { traceId, rejected: gate.reason };\n }\n const bal = Number(await getSetting(\"ACCOUNT_BALANCE\", \"10000\")) || 10000;\n const sizing = await sizePosition(signal, bal);\n let status = \"SIMULATED\", contractId: string | null = null, errorText: string | null = null;\n if (opts.execute) {\n const token = await activeToken();\n if (token) {\n try {\n const cfg = derivConfig({ token, appId: await getSetting(\"DERIV_APP_ID\", \"1089\"), symbol: await getSetting(\"GOLD_SYMBOL\", \"frxXAUUSD\"), timeoutMs: Number(await getSetting(\"DERIV_TIMEOUT_MS\", \"12000\")) });\n const res = await executeTrade(cfg, signal, sizing.amount);\n if (res.success) { status = \"LIVE\"; contractId = res.contractId ?? null; }\n else { status = \"FAILED\"; errorText = res.error ?? \"unknown\"; }\n } catch (e: unknown) { status = \"FAILED\"; errorText = e instanceof Error ? e.message : String(e); }\n } else { status = \"FAILED\"; errorText = \"DERIV_API_TOKEN not set\"; }\n }\n await sqlite.execute({ sql: \"INSERT OR IGNORE INTO gold_trades (trace_id, ts, symbol, direction, entry, stop_loss, take_profit, amount, pip_distance, status, contract_id, error_text, raw_signal) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", signal.direction, signal.entry, signal.stopLoss, signal.takeProfit, sizing.amount, signal.pipDistance, status, contractId, errorText, signal.rawText] });\n await recordAttempt(status);\n return { traceId, signal, sizing, status, contractId, error: errorText };\n}\n\n/** Pull messages that arrived at the Telegram bot via getUpdates\n (official Bot API), parse each as a signal, and advance the offset so\n nothing is processed twice. Returns what was found + outcome. */\nexport async function pullTelegram(): Promise> {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return { ok: false, error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" };\n const offsetRaw = Number(await getSetting(\"TG_OFFSET\", \"0\")) || 0;\n try {\n const upd = await getUpdates({ offset: offsetRaw, limit: 100, timeout: 1 }, token);\n if (!upd.ok) return { ok: false, error: upd.description ?? \"getUpdates failed\" };\n const results = (upd.result ?? []) as any[];\n const processed: unknown[] = [];\n let maxId = offsetRaw;\n let withText = 0;\n for (const u of results) {\n if ((u as any).update_id >= maxId) maxId = (u as any).update_id + 1;\n const msg = messageFromUpdate(u);\n if (!msg?.text) continue;\n withText++;\n const res = await processSignal(msg.text, { execute: (await getSetting(\"AUTO_TRADE\", \"off\")) === \"live\" });\n processed.push({ update_id: u.update_id, chat: msg.chat, ...res });\n }\n if (maxId > offsetRaw) await setSetting(\"TG_OFFSET\", String(maxId));\n return { ok: true, pulled: results.length, withText, processed, nextOffset: maxId };\n } catch (e: unknown) {\n return { ok: false, error: e instanceof Error ? e.message : String(e) };\n }\n}\n\nconst rows = async (sql: string, args: unknown[] = []) => q(sql, args);\nconst json = (o: unknown, status = 200) => new Response(JSON.stringify(o), { status, headers: { \"content-type\": \"application/json\" } });\n\nasync function integrationStatus(): Promise> {\n const token = await activeToken();\n const sets = await activeTokenSet();\n return {\n derivToken: !!token,\n derivAppId: await getSetting(\"DERIV_APP_ID\", \"1089\"),\n telegramToken: !!(await getSetting(\"TELEGRAM_BOT_TOKEN\")),\n adminChat: !!(await getSetting(\"ADMIN_CHAT_ID\")),\n symbol: await getSetting(\"GOLD_SYMBOL\", \"frxXAUUSD\"),\n mode: (await getSetting(\"DERIV_MODE\", \"demo\")).toLowerCase(),\n demoSet: sets.demoSet,\n realSet: sets.realSet,\n autoTrade: await getSetting(\"AUTO_TRADE\", \"off\"),\n riskPerTrade: `${await getSetting(\"RISK_PER_TRADE\", \"1\")}%`,\n balance: Number(await getSetting(\"ACCOUNT_BALANCE\", \"10000\")),\n halted: (await riskState()).halted === \"true\",\n };\n}\n\n/* ---------------- HTTP handler ---------------- */\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.pathname === \"/tg-webhook\" && req.method === \"POST\") {\n const update = await req.json();\n const msg = messageFromUpdate(update as any);\n if (!msg?.text) return json({ ok: true });\n const result = await processSignal(msg.text, { execute: (await getSetting(\"AUTO_TRADE\", \"off\")) === \"live\" });\n return json({ ok: true, ...result });\n }\n\n if (url.pathname === \"/ingest\") {\n const raw = url.searchParams.get(\"text\") ?? \"\";\n if (!raw.trim()) return json({ error: \"Provide ?text=\" }, 400);\n return json(await processSignal(raw));\n }\n\n if (url.pathname === \"/pull\") return json(await pullTelegram());\n\n if (url.pathname === \"/getme\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n try { return json(await getMe(token)); }\n catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/trade\") {\n const raw = url.searchParams.get(\"text\") ?? \"\";\n if (!raw.trim()) return json({ error: \"Provide ?text=\" }, 400);\n return json(await processSignal(raw, { execute: true }));\n }\n\n if (url.pathname === \"/verify\") {\n const token = await activeToken();\n if (!token) return json({ error: \"No Deriv token set for the active mode — add it in Settings.\" });\n try {\n const cfg = derivConfig({ token, appId: await getSetting(\"DERIV_APP_ID\", \"1089\"), symbol: await getSetting(\"GOLD_SYMBOL\", \"frxXAUUSD\") });\n const sym = await verifyGoldSymbol(cfg);\n return json(sym ? { ok: true, symbol: sym } : { ok: false, error: `Gold symbol not found for app_id ${cfg.appId}` });\n } catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/setup-webhook\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n const endpoint = url.origin + \"/tg-webhook\";\n try { await setWebhook(endpoint, {}, token); return json({ ok: true, endpoint }); }\n catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/api/settings\") {\n if (req.method === \"POST\") {\n const body = await req.json();\n for (const [k, v] of Object.entries(body)) if (k in SETTINGS_DEFAULTS) await setSetting(k, String(v));\n const res: Record = { ok: true };\n for (const k of Object.keys(SETTINGS_DEFAULTS)) res[k] = await getSetting(k);\n return json(res);\n }\n const res: Record = { stored: await storedKeys() };\n for (const k of Object.keys(SETTINGS_DEFAULTS)) res[k] = await getSetting(k);\n return json(res);\n }\n\n if (url.pathname === \"/api/risk\") {\n const st = await riskState();\n const gate = await riskGate();\n const dow = new Date().getUTCDay();\n return json({ ...st, marketOpen: dow !== 0 && dow !== 6, gate: gate.ok ? \"open\" : \"blocked\", reason: gate.reason });\n }\n if (url.pathname === \"/halt\") { await writeRisk({ halted: \"true\", haltReason: \"manual\" }); return json({ ok: true }); }\n if (url.pathname === \"/resume\") { await writeRisk({ halted: \"false\", haltReason: \"\", consecutive: \"0\" }); return json({ ok: true }); }\n\n if (url.pathname === \"/api/recent\") return json(await rows(\"SELECT id, trace_id, ts, direction, entry, stop_loss, take_profit, amount, pip_distance, status, contract_id FROM gold_trades ORDER BY id DESC LIMIT 25\"));\n if (url.pathname === \"/api/stats\") {\n const one = async (sql: string, args: unknown[] = []) => (await q(sql, args))[0];\n const t = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status NOT IN ('REJECTED')\");\n const live = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status='LIVE'\");\n const failed = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status='FAILED'\");\n const open = await one(\"SELECT COALESCE(SUM(amount),0) o FROM gold_trades WHERE status='LIVE'\");\n return json({ total: t?.c ?? 0, live: live?.c ?? 0, failed: failed?.c ?? 0, exposure: open?.o ?? 0, integrations: await integrationStatus() });\n }\n\n return new Response(DASHBOARD, { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n}\n\n/* ---------------- Dashboard (vanilla JS, no external deps) ---------------- */\nconst DASHBOARD = `Gold Signal Bot\n\n

🥇 Gold Signal Bot

Ingest a signal

\n \n \n \n

Recent signals

#	Dir	Entry	SL	TP	Pips	Stake	Status

Status

\n \n \n \n \n

🔀 Account mode

demo

\n \n \n

Paste both tokens in ⚙️ Settings, then flip mode with one click. Real = real money.

⚙️ Settings

Armed while you sleep

Paste your Deriv demo token + app id, set Auto-trade = on, Save.
Add your Telegram bot to the signal channel, click Register webhook.
Click Verify Gold symbol once.
Let it run on demo before going near real money.

\n\n`;\n","gold-signal-live",[157],"005f8a31-7bfd-4951-8332-d1ac0b5f600f","deriv_client.ts","c787b6a2-a9d8-11f1-8e4d-1607ee4eb77e",37,["D",1788690932214],5,"/* ============================================================\n DERIV CLIENT — XAUUSD execution via Deriv WebSocket API.\n Serverless-safe: the socket is opened fresh per call,\n used for the auth → proposal → buy sequence, then closed.\n No persistent connection across invocations.\n ------------------------------------------------------------\n Requires env: DERIV_API_TOKEN, DERIV_APP_ID (default 1089 demo)\n Optional: DERIV_MODE (demo|real), DERIV_TIMEOUT_MS\n ============================================================ */\n\nexport interface DerivConfig {\n token: string;\n appId: string;\n symbol: string; // \"frxXAUUSD\"\n timeoutMs: number;\n}\n\nexport interface DerivSymbol {\n symbol: string;\n displayName: string;\n market: string;\n minDuration: number;\n minDurationUnit: string;\n}\n\nexport interface TradeRequest {\n direction: \"LONG\" | \"SHORT\";\n amount: number; // stake in USD\n duration: number; // minutes\n}\n\nexport interface TradeResult {\n success: boolean;\n contractId?: string;\n buyPrice?: number;\n payout?: number;\n longcode?: string;\n entryTick?: number; // current spot at buy\n startTime?: string;\n expiryTime?: string;\n balance?: number;\n error?: string;\n}\n\nexport function derivConfig(overrides: Partial = {}): DerivConfig {\n const token = overrides.token ?? Deno.env.get(\"DERIV_API_TOKEN\");\n if (!token) throw new Error(\"DERIV_API_TOKEN not set\");\n return {\n token,\n appId: overrides.appId ?? (Deno.env.get(\"DERIV_APP_ID\") || \"1089\"),\n symbol: overrides.symbol ?? (Deno.env.get(\"GOLD_SYMBOL\") || \"frxXAUUSD\"),\n timeoutMs: overrides.timeoutMs ?? Number(Deno.env.get(\"DERIV_TIMEOUT_MS\") || 12000),\n };\n}\n\nconst WS_URL = (appId: string) =>\n `wss://ws.derivws.com/websockets/v3?app_id=${appId}`;\n\nclass DerivConnection {\n private ws!: WebSocket;\n private reqId = 0;\n private pending = new Map void>();\n private timer!: number;\n\n static async open(cfg: DerivConfig): Promise {\n const c = new DerivConnection();\n await new Promise((resolve, reject) => {\n c.ws = new WebSocket(WS_URL(cfg.appId));\n c.ws.onopen = () => resolve();\n c.ws.onerror = (e) => reject(new Error(\"Deriv WS connect failed\"));\n c.ws.onmessage = (e) => c.onMessage(e.data);\n const guard = setTimeout(() => reject(new Error(\"Deriv WS open timeout\")), cfg.timeoutMs);\n c.ws!.addEventListener(\"open\", () => clearTimeout(guard));\n c.ws!.addEventListener(\"error\", () => clearTimeout(guard));\n });\n return c;\n }\n\n private onMessage(data: unknown): void {\n try {\n const msg = JSON.parse(String(data));\n if (msg.req_id && this.pending.has(msg.req_id)) {\n const resolve = this.pending.get(msg.req_id)!;\n this.pending.delete(msg.req_id);\n clearTimeout(this.timer);\n resolve(msg);\n }\n } catch { /* ignore */ }\n }\n\n send(type: string, payload: Record, cfg: DerivConfig): Promise {\n return new Promise((resolve, reject) => {\n const id = ++this.reqId;\n this.pending.set(id, resolve);\n this.timer = setTimeout(() => {\n this.pending.delete(id);\n reject(new Error(`${type} timeout after ${cfg.timeoutMs}ms`));\n }, cfg.timeoutMs);\n this.ws.send(JSON.stringify({ ...payload, req_id: id }));\n });\n }\n\n close(): void { try { this.ws.close(); } catch { /* ignore */ } }\n}\n\n/** Verify a gold symbol exists. Searches broadly (any symbol containing\n XAU, plus known forex gold tickers) and reports the exact symbol name\n the API returns, so a wrong ticker is easy to spot. */\nexport async function verifyGoldSymbol(cfg: DerivConfig): Promise {\n const con = await DerivConnection.open(cfg);\n try {\n const res = await con.send(\"active_symbols\", { active_symbols: \"brief\", product_type: \"basic\" }, cfg);\n if (res.error) throw new Error(res.error.message);\n const list: any[] = res.active_symbols ?? [];\n const gold = list.filter((s: any) => /\\bXAU\\b/i.test(s.symbol)).map((s: any) => ({\n symbol: s.symbol, displayName: s.display_name, market: s.market ?? \"commodity\",\n minDuration: s.minimum_duration ?? 1, minDurationUnit: s.duration_unit ?? \"m\",\n }));\n if (!gold.length) {\n throw new Error(\"No XAU symbol found. Total symbols returned: \" + list.length + \". Sample: \" + list.slice(0, 8).map((s: any) => s.symbol).join(\", \"));\n }\n return gold;\n } finally {\n con.close();\n }\n}\n\n/**\n * Open a short-lived socket, authorize, propose a Rise/Fall contract\n * on frxXAUUSD in USD, then buy at the quoted ask price.\n */\nexport async function executeTrade(\n cfg: DerivConfig,\n signal: { direction: \"LONG\" | \"SHORT\"; entry?: number },\n amount: number,\n): Promise {\n const con = await DerivConnection.open(cfg);\n try {\n const auth = await con.send(\"authorize\", { authorize: cfg.token }, cfg);\n if (auth.error) return { success: false, error: `Auth failed: ${auth.error.message}` };\n const loginid = auth.authorize?.loginid;\n\n const contractType = signal.direction === \"LONG\" ? \"CALL\" : \"PUT\";\n\n const proposalReq = {\n proposal: 1,\n amount,\n basis: \"stake\",\n contract_type: contractType,\n currency: \"USD\",\n duration: 5, // commodities require >= 5 min\n duration_unit: \"m\",\n symbol: cfg.symbol,\n };\n const proposal = await con.send(\"proposal\", proposalReq, cfg);\n if (proposal.error) return { success: false, error: `Proposal rejected: ${proposal.error.message}` };\n\n const buy = await con.send(\"buy\", { buy: proposal.proposal.id, price: proposal.proposal.ask_price }, cfg);\n if (buy.error) return { success: false, error: `Buy failed: ${buy.error.message}` };\n\n return {\n success: true,\n contractId: buy.buy.contract_id,\n buyPrice: buy.buy.buy_price,\n payout: buy.buy.payout,\n longcode: buy.buy.longcode,\n entryTick: buy.buy.spot,\n startTime: buy.buy.start_time,\n expiryTime: buy.buy.expiry_time,\n balance: auth.authorize?.balance,\n login: loginid,\n };\n } catch (e: unknown) {\n return { success: false, error: e instanceof Error ? e.message : String(e) };\n } finally {\n con.close();\n }\n}\n",[166],"pulls","branches",1,"forks","envVars",{"_181":69,"_183":69},"connections",{"_181":69,"_182":69},"count","unfilledCount","emptyCount",{"_49":165,"_38":166,"_36":167,"_142":-5,"_47":48,"_46":168,"_143":31,"_44":198,"_13":170,"_39":40,"_41":171,"_30":31,"_146":-5,"_189":199,"_33":200},{"_49":156,"_38":157,"_36":63,"_142":-5,"_47":48,"_46":158,"_143":31,"_44":195,"_13":160,"_39":161,"_41":162,"_30":31,"_146":163,"_189":196,"_33":197},{"_49":148,"_38":149,"_36":150,"_142":-5,"_47":48,"_46":151,"_143":65,"_44":192,"_13":69,"_39":153,"_41":154,"_30":31,"_146":-5,"_189":193,"_33":194},{"_49":141,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_143":65,"_44":188,"_13":145,"_39":40,"_41":43,"_30":31,"_146":-5,"_189":190,"_33":191},["D",1788694117626],"children",[],[34],["D",1788694094017],[],[149],["D",1788694088037],[],[157],["D",1788690932214],[],[166],["D",1788687592224],["D",1789472446807],{"_106":105,"_114":110},{"_106":105,"_107":108,"_109":110,"_19":61,"_111":112,"_113":31},{"_13":95,"_38":96,"_49":48,"_97":50,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":51,"_104":105},"ctx",{"_88":-5,"_134":239,"_240":241,"_242":243,"_244":31,"_245":31,"_246":31,"_247":65,"_248":-5,"_249":-7,"_250":-7,"_251":69,"_252":31,"_253":31,"_254":-5,"_255":31,"_256":31,"_257":31,"_258":-5},"ENV",{"_210":211,"_212":213,"_214":96,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v52