🔐 Login to your Telegram account

This logs the bot in as you so it can read the Savanna channel directly.
\nRisk: running a \"userbot\" on a personal account can get it banned. Consider a spare account.

\n`;\n}\n\nexport function splitSession(s: string): string {\n return s;\n}\n",[136],"9739a9b9-f4a1-4578-b524-c82fd42f7d19","telegram_bot.ts","cb250206-a9d8-11f1-bfce-1607ee4eb77e",52,["D",1788694117626],"/* ============================================================\n TELEGRAM BOT — webhook ingestion + alert messages.\n ToS-safe path (no MTProto/user sessions): your public signal\n channel adds this bot; Telegram POSTs new messages here via\n webhook. Per-message fetch() — fully serverless-safe.\n ------------------------------------------------------------\n Requires env: TELEGRAM_BOT_TOKEN\n Optional: ADMIN_CHAT_ID (who gets alerts)\n ============================================================ */\n\nconst TG_API = \"https://api.telegram.org/bot\";\n\nexport function botToken(): string {\n const t = Deno.env.get(\"TELEGRAM_BOT_TOKEN\");\n if (!t) throw new Error(\"TELEGRAM_BOT_TOKEN not set\");\n return t;\n}\n\nexport interface TgChat { id: number; type: string; title?: string; username?: string }\nexport interface TgMessage { message_id: number; text?: string; chat: TgChat; date: number }\nexport interface TgUpdate { update_id: number; message?: TgMessage; channel_post?: TgMessage }\n\n/** Extract the message from an Update (channel posts or normal group messages). */\nexport function messageFromUpdate(u: TgUpdate): TgMessage | null {\n return (u.channel_post ?? u.message) ?? null;\n}\n\n/** POST /setWebhook so Telegram streams updates to our endpoint.\n `token` overrides the env var (used when the token is stored in the bot's settings). */\nexport async function setWebhook(url: string, opts: { dropPending?: boolean } = {}, token?: string): Promise {\n const params = new URLSearchParams({ url });\n if (opts.dropPending) params.set(\"drop_pending_updates\", \"true\");\n const r = await fetch(`${TG_API}${token ?? botToken()}/setWebhook?${params}`);\n const j = await r.json() as { ok: boolean; description?: string };\n if (!j.ok) throw new Error(`setWebhook failed: ${j.description}`);\n return true;\n}\n\n/** GET /getWebhookInfo to confirm the webhook is registered. */\nexport async function webhookInfo(): Promise {\n const r = await fetch(`${TG_API}${botToken()}/getWebhookInfo`);\n return r.json();\n}\n\n/** Send an HTML-formatted message to a chat (defaults to ADMIN_CHAT_ID). */\nexport async function sendMessage(\n text: string,\n chatId?: number | string,\n): Promise {\n const token = botToken();\n const to = String(chatId ?? Deno.env.get(\"ADMIN_CHAT_ID\") ?? \"\");\n if (!to) return false;\n const r = await fetch(`${TG_API}${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ chat_id: to, text, parse_mode: \"HTML\" }),\n });\n return r.ok;\n}\n/** Verify the bot token is valid. Returns the bot's identity. */\nexport async function getMe(token?: string): Promise {\n const r = await fetch(`${TG_API}${token ?? botToken()}/getMe`);\n return r.json();\n}\n\n/**\n * Long/short-poll updates (messages sent TO this bot). Official Bot API —\n * this is the sanctioned way to read signals that arrive at your bot.\n * `offset` = first update_id to return; Telegram filters out older ones.\n */\nexport async function getUpdates(\n opts: { offset?: number; limit?: number; timeout?: number } = {},\n token?: string,\n): Promise<{ ok: boolean; result?: any[]; description?: string }> {\n const params = new URLSearchParams();\n if (opts.offset != null) params.set(\"offset\", String(opts.offset));\n if (opts.limit != null) params.set(\"limit\", String(opts.limit));\n if (opts.timeout != null) params.set(\"timeout\", String(opts.timeout));\n const qs = params.toString();\n const r = await fetch(`${TG_API}${token ?? botToken()}/getUpdates${qs ? \"?\" + qs : \"\"}`);\n return r.json() as any;\n}\n/** Remove any active webhook so getUpdates polling can run.\n Official Bot API — webhook and polling are mutually exclusive. */\nexport async function deleteWebhook(token?: string): Promise {\n const r = await fetch(`${TG_API}${token ?? botToken()}/deleteWebhook`);\n const j = await r.json() as { ok: boolean; description?: string };\n if (!j.ok) throw new Error(`deleteWebhook failed: ${j.description}`);\n return true;\n}\n",[144],"78b7b35d-86ff-42d2-912b-c215a0781af0","pull_updates.ts","0c6017c6-a9e6-11f1-b512-1607ee4eb77e",51,["D",1788694094017],"interval","/* ============================================================\n TELEGRAM PULLER — scheduled getUpdates reader.\n On each tick it asks Telegram (official Bot API, bot token\n only — no user session) for any messages sent to the bot,\n parses each as a signal, and feeds the engine.\n ============================================================ */\nimport { pullTelegram } from \"./main.ts\";\n\nexport default async function () {\n const res = await pullTelegram();\n console.log(\"TG_PULL\", JSON.stringify(res));\n}\n",[151],"6e1c2d33-c084-486d-b002-5beccb3ff80b","main.ts",["D",1788697733439],85,"http","import { confirmPhoneLogin, htmlLogin, initLoginTables, startPhoneLogin, splitSession } from \"./telegram_login.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { derivConfig, DerivTradingNotWiredError, fetchDerivAccounts } from \"./deriv_client.ts\";\nimport { deleteWebhook, getMe, getUpdates, messageFromUpdate, setWebhook, webhookInfo } from \"./telegram_bot.ts\";\nimport { mtprotoMissing, readChatText } from \"./telegram_mtproto.ts\";\n\n/* ============================================================\n GOLD SIGNAL BOT — engine + Deriv execution + Telegram webhook\n Dashboard is plain vanilla JS (no React, no esm.sh) so it\n always renders. Server engine verified working.\n ============================================================ */\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS gold_trades (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n trace_id TEXT UNIQUE NOT NULL,\n ts TEXT NOT NULL, symbol TEXT NOT NULL DEFAULT 'XAUUSD',\n direction TEXT NOT NULL, entry REAL, stop_loss REAL, take_profit REAL,\n amount REAL, pip_distance REAL,\n status TEXT NOT NULL, contract_id TEXT, error_text TEXT, raw_signal TEXT)`);\nawait sqlite.execute(`CREATE INDEX IF NOT EXISTS idx_gold_status ON gold_trades(status)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS risk (k TEXT PRIMARY KEY, v TEXT)`);\nawait initLoginTables();\n\nconst q = async (sql: string, args: unknown[] = []) =>\n (await sqlite.execute({ sql, args })).rows as Record[];\n\nconst SETTINGS_DEFAULTS: Record = {\n DERIV_API_TOKEN: \"\", DERIV_CLIENT_ID: \"\",\n TELEGRAM_BOT_TOKEN: \"\", ADMIN_CHAT_ID: \"\",\n TG_API_ID: \"\", TG_API_HASH: \"\", TG_SOURCE: \"\",\n RISK_PER_TRADE: \"1\", ACCOUNT_BALANCE: \"10000\", AUTO_TRADE: \"off\", DERIV_MODE: \"demo\",\n GOLD_SYMBOL: \"frxXAUUSD\", DERIV_TIMEOUT_MS: \"12000\",\n MAX_DAILY_TRADES: \"8\", COOLDOWN_MS: \"180000\", MAX_CONSECUTIVE_LOSSES: \"3\",\n};\n\n/** Deriv uses ONE Personal Access Token (PAT) for the whole account.\n We always use DERIV_API_TOKEN; DERIV_CLIENT_ID is your App/Client ID. */\nasync function activeToken(): Promise {\n return await getSetting(\"DERIV_API_TOKEN\");\n}\n\nasync function getSetting(key: string, dflt: string = SETTINGS_DEFAULTS[key] ?? \"\"): Promise {\n const r = await q(\"SELECT value FROM settings WHERE key=?\", [key]);\n if (r[0] && r[0].value != null && r[0].value !== \"\") return String(r[0].value);\n return Deno.env.get(key) ?? dflt;\n}\nasync function setSetting(key: string, value: string): Promise {\n const v = String(value ?? \"\").trim();\n if (v === \"\") await sqlite.execute({ sql: \"DELETE FROM settings WHERE key=?\", args: [key] });\n else await sqlite.execute({ sql: \"INSERT INTO settings(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value\", args: [key, v] });\n}\nasync function storedKeys(): Promise {\n return (await q(\"SELECT key FROM settings\")).map((r) => String(r.key));\n}\n\n/* ---------------- Risk engine ---------------- */\nasync function readRisk(): Promise> {\n const m: Record = {};\n for (const r of await q(\"SELECT k, v FROM risk\")) m[String(r.k)] = String(r.v);\n return m;\n}\nasync function writeRisk(obj: Record): Promise {\n for (const [k, v] of Object.entries(obj)) {\n await sqlite.execute({ sql: \"INSERT INTO risk(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v=excluded.v\", args: [k, v] });\n }\n}\nconst todayUTC = () => new Date().toISOString().slice(0, 10);\nasync function riskState(): Promise> {\n const s = await readRisk();\n if (s.day !== todayUTC()) {\n const reset = { day: todayUTC(), trades: \"0\", consecutive: \"0\", halted: s.halted ?? \"false\", haltReason: s.haltReason ?? \"\" };\n await writeRisk(reset);\n return reset;\n }\n return s;\n}\nasync function riskGate(): Promise<{ ok: boolean; reason?: string }> {\n const s = await riskState();\n if (s.halted === \"true\") return { ok: false, reason: `Trading halted: ${s.haltReason || \"manual\"}` };\n const dow = new Date().getUTCDay();\n if (dow === 6 || dow === 0) return { ok: false, reason: \"Gold market closed (weekend UTC)\" };\n const max = Number(await getSetting(\"MAX_DAILY_TRADES\", \"8\")) || 8;\n if (Number(s.trades || 0) >= max) return { ok: false, reason: `Max daily trades (${max}) reached` };\n const cooldown = Number(await getSetting(\"COOLDOWN_MS\", \"180000\")) || 180000;\n if (s.lastTrade && Date.now() - Number(s.lastTrade) < cooldown) {\n const wait = Math.ceil((cooldown - (Date.now() - Number(s.lastTrade))) / 1000);\n return { ok: false, reason: `Cooldown: ${wait}s left` };\n }\n return { ok: true };\n}\nasync function recordAttempt(status: string): Promise {\n const s = await riskState();\n s.trades = String(Number(s.trades || 0) + 1);\n s.lastTrade = String(Date.now());\n if (status === \"FAILED\") {\n s.consecutive = String(Number(s.consecutive || 0) + 1);\n const maxConsec = Number(await getSetting(\"MAX_CONSECUTIVE_LOSSES\", \"3\")) || 3;\n if (Number(s.consecutive) >= maxConsec) { s.halted = \"true\"; s.haltReason = `${maxConsec} consecutive failures (circuit breaker)`; }\n } else if (status === \"LIVE\" || status === \"SIMULATED\") {\n s.consecutive = \"0\";\n }\n await writeRisk(s);\n}\n\n/* ---------------- Domain ---------------- */\ntype Dir = \"LONG\" | \"SHORT\";\ninterface GoldSignal { symbol: \"XAUUSD\"; direction: Dir; entry: number; stopLoss: number; takeProfit: number; pipDistance: number; rawText: string; }\n\nfunction parseDir(s: string): Dir | null {\n const m: Record = { long: \"LONG\", call: \"LONG\", buy: \"LONG\", up: \"LONG\", short: \"SHORT\", put: \"SHORT\", sell: \"SHORT\", down: \"SHORT\" };\n return m[s.trim().toLowerCase()] ?? null;\n}\n/** Mine a Savanna Trading Desk style alert. Fields are extracted by label so\n a \"59% confidence\" or other stray number can't break the match.\n Price -> entry, Stop -> SL, T1 -> TP. */\nfunction parseSavanna(text: string): GoldSignal | null {\n if (!/\\bSAVANNA\\b/i.test(text) && !/\\bPrice:\\s*\\$/.test(text)) return null;\n const direction = /(?:^|\\n)\\s*(?:🟢|🔴)?\\s*\\b(BUY|SELL|LONG|SHORT|call|put)\\b/i.exec(text);\n if (!direction) return null;\n const entry = /Price\\s*[:=]?\\s*\\$?\\s*([\\d,]{3,6}(?:\\.\\d{1,2})?)/i.exec(text);\n const sl = /(?:Stop|SL)\\s*[:=]?\\s*\\$?\\s*([\\d,]{3,6}(?:\\.\\d{1,2})?)/i.exec(text);\n // T1 is the near target; fall back to T2 if T1 missing.\n const tp = /T1\\s*[:=]?\\s*\\$?\\s*([\\d,]{3,6}(?:\\.\\d{1,2})?)/i.exec(text) ||\n /T2\\s*[:=]?\\s*\\$?\\s*([\\d,]{3,6}(?:\\.\\d{1,2})?)/i.exec(text);\n if (!entry || !sl || !tp) return null;\n const clean = (s: string) => Number(String(s).replace(/,/g, \"\"));\n const dir = parseDir(direction[1]);\n const entryN = clean(entry[1]), slN = clean(sl[1]), tpN = clean(tp[1]);\n if (!dir) return null;\n if ([entryN, slN, tpN].some((v) => !isFinite(v) || v < 1500 || v > 5000)) return null;\n const loseSide = dir === \"LONG\" ? slN < entryN : slN > entryN;\n if (!loseSide) return null;\n if (Math.abs(entryN - slN) < 1.0) return null;\n return { symbol: \"XAUUSD\", direction: dir, entry: entryN, stopLoss: slN, takeProfit: tpN, pipDistance: Math.round(Math.abs(entryN - slN) * 100), rawText: text };\n}\n\nexport function parseGoldSignal(text: string): GoldSignal | null {\n // Savanna Trading Desk format, e.g.:\n // 🦁 SAVANNA TRADING DESK\n // 🟢 BUY — 59% confidence\n // 💰 Price: $4429.05\n // 🔻 Support: $4428.77 🔺 Resistance: $4435.57\n // 🛑 Stop: $4428.65 🎯 T1: $4429.65 T2: $4430.05\n // Each field is mined independently (there's a \"59% confidence\" number\n // between direction and entry, so one big regex would trip on it).\n const savanna = parseSavanna(text);\n if (savanna) return savanna;\n // Each pattern declares which capture group holds direction/entry/sl/tp,\n // because they differ per format.\n const pats: { re: RegExp; dir: number; entry: number; sl: number; tp: number }[] = [\n // Strict: [XAUUSD/GOLD] [BUY/SELL/...] [entry] [SL x] [TP x]\n { re: /(XAUUSD|GOLD|XAU)\\b[\\s\\S]{0,40}?(BUY|SELL|LONG|SHORT|call|put|up|down)[:@#\\s]*[,=\\s@]?\\s*(\\d{2,5}\\.\\d{2})[\\s\\S]{0,40}?(?:SL|stop|Stop Loss)[\\s:=#]*(\\d{2,5}\\.\\d{2})[\\s\\S]{0,40}?(?:TP|target|Take Profit)[\\s:=#]*(\\d{2,5}\\.\\d{2})/i, dir: 2, entry: 3, sl: 4, tp: 5 },\n // Lenient: BUY/SELL entry ... SL x ... TP x (no gold keyword prefix)\n { re: /\\b(BUY|SELL|LONG|SHORT|call|put)\\b[^\\d\\n]{0,25}(\\d{2,5}\\.\\d{1,2})[^\\d\\n]{0,30}?(?:SL|Stop|Stop Loss)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,30}?(?:TP|Target|Take Profit|target)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b/i, dir: 1, entry: 2, sl: 3, tp: 4 },\n // Entry-first: 2650.45 BUY, SL ... TP ...\n { re: /\\b(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,20}?\\b(BUY|SELL|LONG|SHORT|call|put)\\b[^\\d\\n]{0,30}?(?:SL|Stop|Stop Loss)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b[^\\d\\n]{0,30}?(?:TP|Target|Take Profit)\\b[\\s:=#]*(\\d{2,5}\\.\\d{1,2})\\b/i, dir: 2, entry: 1, sl: 3, tp: 4 },\n ];\n for (const p of pats) {\n const m = text.match(p.re);\n if (!m) continue;\n const direction = parseDir(m[p.dir]);\n if (!direction) continue;\n const entry = Number(m[p.entry]), sl = Number(m[p.sl]), tp = Number(m[p.tp]);\n if ([entry, sl, tp].some((v) => !isFinite(v) || v < 1500 || v > 5000)) continue;\n const loseSide = direction === \"LONG\" ? sl < entry : sl > entry;\n if (!loseSide) continue;\n if (Math.abs(entry - sl) < 1.0) continue;\n return { symbol: \"XAUUSD\", direction, entry, stopLoss: sl, takeProfit: tp, pipDistance: Math.round(Math.abs(entry - sl) * 100), rawText: text };\n }\n return null;\n}\n\nasync function sizePosition(s: GoldSignal, bal: number) {\n const riskPct = Number(await getSetting(\"RISK_PER_TRADE\", \"1\")) || 1;\n let amount = bal * (riskPct / 100);\n amount = Math.min(amount, bal * 0.05);\n amount = Math.max(0.5, Math.round(amount * 100) / 100);\n return { amount, riskPct, pipDistance: s.pipDistance };\n}\n\nasync function isDuplicate(s: GoldSignal): Promise {\n const fiveMinAgo = new Date(Date.now() - 300_000).toISOString();\n const r = await q(\"SELECT COUNT(*) c FROM gold_trades WHERE symbol=? AND direction=? AND entry=? AND ts>?\", [\"XAUUSD\", s.direction, s.entry, fiveMinAgo]);\n return Number((r[0] as any)?.c ?? 0) > 0;\n}\n\nasync function processSignal(raw: string, opts: { execute: boolean } = { execute: false }): Promise> {\n const traceId = crypto.randomUUID();\n const signal = parseGoldSignal(raw);\n if (!signal) {\n await sqlite.execute({ sql: \"INSERT INTO gold_trades (trace_id, ts, symbol, direction, status, raw_signal) VALUES (?,?,?,?,'REJECTED',?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", \"\", raw.slice(0, 500)] });\n return { traceId, rejected: \"Could not parse a valid XAUUSD signal.\" };\n }\n if (await isDuplicate(signal)) return { traceId, rejected: \"Duplicate signal (same direction/entry within 5 min).\" };\n const gate = await riskGate();\n if (!gate.ok) {\n await sqlite.execute({ sql: \"INSERT INTO gold_trades (trace_id, ts, symbol, direction, status, error_text, raw_signal) VALUES (?,?,?,?,'REJECTED',?,?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", signal.direction, gate.reason ?? \"blocked\", signal.rawText] });\n return { traceId, rejected: gate.reason };\n }\n const bal = Number(await getSetting(\"ACCOUNT_BALANCE\", \"10000\")) || 10000;\n const sizing = await sizePosition(signal, bal);\n let status = \"SIMULATED\", contractId: string | null = null, errorText: string | null = null;\n if (opts.execute) {\n // Honest: live trade execution on the new Deriv API (OTP websocket flow)\n // is not wired up yet. Refuse rather than pretend to place a contract.\n status = \"FAILED\";\n errorText = \"Live trading is not wired to the new Deriv API yet. The balance dashboard is live; signal execution needs the OTP websocket flow.\";\n }\n await sqlite.execute({ sql: \"INSERT OR IGNORE INTO gold_trades (trace_id, ts, symbol, direction, entry, stop_loss, take_profit, amount, pip_distance, status, contract_id, error_text, raw_signal) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)\", args: [traceId, new Date().toISOString(), \"XAUUSD\", signal.direction, signal.entry, signal.stopLoss, signal.takeProfit, sizing.amount, signal.pipDistance, status, contractId, errorText, signal.rawText] });\n await recordAttempt(status);\n return { traceId, signal, sizing, status, contractId, error: errorText };\n}\n\n/** Pull messages that arrived at the Telegram bot via getUpdates\n (official Bot API), parse each as a signal, and advance the offset so\n nothing is processed twice. Returns what was found + outcome. */\nexport async function pullTelegram(): Promise> {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return { ok: false, error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" };\n const offsetRaw = Number(await getSetting(\"TG_OFFSET\", \"0\")) || 0;\n try {\n const upd = await getUpdates({ offset: offsetRaw, limit: 100, timeout: 1 }, token);\n if (!upd.ok) return { ok: false, error: upd.description ?? \"getUpdates failed\" };\n const results = (upd.result ?? []) as any[];\n const processed: unknown[] = [];\n let maxId = offsetRaw;\n let withText = 0;\n for (const u of results) {\n if ((u as any).update_id >= maxId) maxId = (u as any).update_id + 1;\n const msg = messageFromUpdate(u);\n if (!msg?.text) continue;\n withText++;\n const res = await processSignal(msg.text, { execute: (await getSetting(\"AUTO_TRADE\", \"off\")) === \"live\" });\n processed.push({ update_id: u.update_id, chat: msg.chat, raw: msg.text.slice(0, 600), ...res });\n }\n if (maxId > offsetRaw) await setSetting(\"TG_OFFSET\", String(maxId));\n return { ok: true, pulled: results.length, withText, processed, nextOffset: maxId };\n } catch (e: unknown) {\n return { ok: false, error: e instanceof Error ? e.message : String(e) };\n }\n}\n\nconst rows = async (sql: string, args: unknown[] = []) => q(sql, args);\nconst json = (o: unknown, status = 200) => new Response(JSON.stringify(o), { status, headers: { \"content-type\": \"application/json\" } });\n\nasync function integrationStatus(): Promise> {\n const token = await activeToken();\n return {\n derivToken: !!token,\n derivClientId: await getSetting(\"DERIV_CLIENT_ID\"),\n telegramToken: !!(await getSetting(\"TELEGRAM_BOT_TOKEN\")),\n adminChat: !!(await getSetting(\"ADMIN_CHAT_ID\")),\n symbol: await getSetting(\"GOLD_SYMBOL\", \"frxXAUUSD\"),\n mode: (await getSetting(\"DERIV_MODE\", \"demo\")).toLowerCase(),\n autoTrade: await getSetting(\"AUTO_TRADE\", \"off\"),\n riskPerTrade: `${await getSetting(\"RISK_PER_TRADE\", \"1\")}%`,\n haltMarker: (await riskState()).halted,\n };\n}\n\n/* ---------------- Deriv account balances (new API, one PAT) ----------------\n `GET /trading/v1/options/accounts` returns ALL of your options accounts\n (demo + real) in one authenticated REST call. This is Deriv's real model:\n one PAT inside the whole account, and we show every balance. */\nasync function accountBalances(): Promise> {\n const mode = (await getSetting(\"DERIV_MODE\", \"demo\")).toLowerCase();\n const token = await activeToken();\n if (!token) {\n return { ok: false, error: \"DERIV_API_TOKEN (PAT) not set\", accounts: [], mode, at: new Date().toISOString() };\n }\n try {\n const cfg = derivConfig({\n token,\n clientId: (await getSetting(\"DERIV_CLIENT_ID\")) || (await getSetting(\"DERIV_APP_ID\")),\n timeoutMs: Number(await getSetting(\"DERIV_TIMEOUT_MS\", \"12000\")),\n });\n const accounts = await fetchDerivAccounts(cfg);\n return { ok: true, mode, accounts, at: new Date().toISOString() };\n } catch (e: unknown) {\n return { ok: false, error: e instanceof Error ? e.message : String(e), accounts: [], mode, at: new Date().toISOString() };\n }\n}\n\n/* ---------------- HTTP handler ---------------- */\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.pathname === \"/tg-webhook\" && req.method === \"POST\") {\n const update = await req.json();\n const msg = messageFromUpdate(update as any);\n if (!msg?.text) return json({ ok: true });\n const result = await processSignal(msg.text, { execute: (await getSetting(\"AUTO_TRADE\", \"off\")) === \"live\" });\n return json({ ok: true, ...result });\n }\n\n if (url.pathname === \"/ingest\") {\n const raw = url.searchParams.get(\"text\") ?? \"\";\n if (!raw.trim()) return json({ error: \"Provide ?text=\" }, 400);\n return json(await processSignal(raw));\n }\n\n if (url.pathname === \"/pull\") return json(await pullTelegram());\n\n if (url.pathname === \"/deletewebhook\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n try { await deleteWebhook(token); return json({ ok: true, note: \"Webhook removed. getUpdates polling is now active.\" }); }\n catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/getme\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n try { return json(await getMe(token)); }\n catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/webhookinfo\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n try {\n const r = await fetch(`https://api.telegram.org/bot${token}/getWebhookInfo`);\n const w = await r.json();\n const url2 = (w as any)?.result?.url || \"\";\n return json({ ok: !!url2, url: url2, pending: (w as any)?.result?.pending_update_count || 0, webhook: w });\n } catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/trade\") {\n const raw = url.searchParams.get(\"text\") ?? \"\";\n if (!raw.trim()) return json({ error: \"Provide ?text=\" }, 400);\n return json(await processSignal(raw, { execute: true }));\n }\n\n if (url.pathname === \"/verify\") {\n const raw = url.searchParams.get(\"text\") ?? \"\";\n if (!raw.trim()) return json({ error: \"Provide ?text=\" }, 400);\n return json(await processSignal(raw)); // simulate (live trading not wired yet)\n }\n\n if (url.pathname === \"/tg-login\") {\n if (req.method === \"GET\") {\n return new Response(htmlLogin(url.origin), { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n }\n // POST: either { phone } to start, or { phone, code } to confirm.\n try {\n const body = await req.json().catch(() => ({}));\n const phone = String((body as any)?.phone || \"\").trim();\n if (!phone) return json({ ok: false, error: \"Provide phone.\" });\n const code = String((body as any)?.code || \"\").trim();\n if (!code) {\n const started = await startPhoneLogin(phone);\n return json({ sent: true, ...started });\n }\n const confirmed = await confirmPhoneLogin(phone, code);\n if (confirmed.ok && confirmed.session) {\n await setSetting(\"TG_MT_PROTO_SESSION\", confirmed.session);\n return json({ ok: true, sessionSaved: true });\n }\n return json({ ok: false, error: confirmed.error ?? \"Login failed.\" });\n } catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/tg-scan\") {\n const missing = await mtprotoMissing();\n if (missing) return json({ ok: false, error: missing });\n const sender = (await getSetting(\"TG_SOURCE\")) || url.searchParams.get(\"source\") || \"\";\n if (!sender) return json({ ok: false, error: \"TG_SOURCE not set. Set it to your telegram bot username, e.g. @YourSignalsBot.\" });\n try {\n const fetched = await readChatText(sender, 25);\n const processed = [];\n for (const m of fetched.messages) {\n const res = await processSignal(m.text, { execute: (await getSetting(\"AUTO_TRADE\", \"off\")) === \"live\" });\n processed.push({ id: m.id, date: new Date(m.date).toISOString(), ...res });\n }\n return json({ ok: true, source: sender, title: fetched.title, pulled: fetched.messages.length, processed });\n } catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/setup-webhook\") {\n const token = await getSetting(\"TELEGRAM_BOT_TOKEN\");\n if (!token) return json({ error: \"TELEGRAM_BOT_TOKEN not set — add it in Settings.\" });\n const endpoint = url.origin + \"/tg-webhook\";\n try { await setWebhook(endpoint, {}, token); return json({ ok: true, endpoint }); }\n catch (e: unknown) { return json({ ok: false, error: e instanceof Error ? e.message : String(e) }); }\n }\n\n if (url.pathname === \"/api/settings\") {\n if (req.method === \"POST\") {\n const body = await req.json();\n for (const [k, v] of Object.entries(body)) if (k in SETTINGS_DEFAULTS) await setSetting(k, String(v));\n const res: Record = { ok: true };\n for (const k of Object.keys(SETTINGS_DEFAULTS)) res[k] = await getSetting(k);\n return json(res);\n }\n const res: Record = { stored: await storedKeys() };\n for (const k of Object.keys(SETTINGS_DEFAULTS)) res[k] = await getSetting(k);\n return json(res);\n }\n\n if (url.pathname === \"/api/risk\") {\n const st = await riskState();\n const gate = await riskGate();\n const dow = new Date().getUTCDay();\n return json({ ...st, marketOpen: dow !== 0 && dow !== 6, gate: gate.ok ? \"open\" : \"blocked\", reason: gate.reason });\n }\n if (url.pathname === \"/halt\") { await writeRisk({ halted: \"true\", haltReason: \"manual\" }); return json({ ok: true }); }\n if (url.pathname === \"/resume\") { await writeRisk({ halted: \"false\", haltReason: \"\", consecutive: \"0\" }); return json({ ok: true }); }\n\n if (url.pathname === \"/api/balance\") return json(await accountBalances());\n if (url.pathname === \"/api/recent\") return json(await rows(\"SELECT id, trace_id, ts, direction, entry, stop_loss, take_profit, amount, pip_distance, status, contract_id FROM gold_trades ORDER BY id DESC LIMIT 25\"));\n if (url.pathname === \"/api/stats\") {\n const one = async (sql: string, args: unknown[] = []) => (await q(sql, args))[0];\n const t = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status NOT IN ('REJECTED')\");\n const live = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status='LIVE'\");\n const failed = await one(\"SELECT COUNT(*) c FROM gold_trades WHERE status='FAILED'\");\n const open = await one(\"SELECT COALESCE(SUM(amount),0) o FROM gold_trades WHERE status='LIVE'\");\n return json({ total: t?.c ?? 0, live: live?.c ?? 0, failed: failed?.c ?? 0, exposure: open?.o ?? 0, integrations: await integrationStatus() });\n }\n\n return new Response(DASHBOARD, { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n}\n\n/* ---------------- Dashboard (vanilla JS, no external deps) ---------------- */\nconst DASHBOARD = `Gold Signal Bot\n\n

🥇 Gold Signal Bot

💳 Deriv account balances

Loading live balance from Deriv…

\n \n

\n\n

Ingest a signal

\n \n \n \n

Recent signals

#	Dir	Entry	SL	TP	Pips	Stake	Status

Status

\n \n \n \n \n

🔀 Account mode

demo

\n \n \n

One Deriv API key authorizes your whole account. DERIV_MODE just tells the bot which environment to trade; the balance shown is whatever account your key is bound to.

⚙️ Settings

🔐 Telegram login (read your bot)

\n Your Telegram phone (you, not the bot)\n \n Code sent to you (after step 1)\n \n \n \n

\n \n

Armed while you sleep

Paste your Deriv demo token + app id, set Auto-trade = on, Save.
Add your Telegram bot to the signal channel, click Register webhook.
Click Verify Gold symbol once.
Let it run on demo before going near real money.

\n\n`;\n","gold-signal-live",[159],"39db2e75-75c5-4b71-b247-80e448fdfe78","deriv_client.ts","c787b6a2-a9d8-11f1-8e4d-1607ee4eb77e",74,["D",1788696432199],9,"/* ============================================================\n DERIV CLIENT — XAUUSD via Deriv's NEW API (PAT + Client ID).\n\n Deriv's modern API uses:\n - DERIV_API_TOKEN = a Personal Access Token (starts with `pat_`)\n - DERIV_CLIENT_ID = your App/Client ID (UUID) registered on\n developers.deriv.com (listed under \"Deriv-App-ID\")\n ONE token authorizes your whole account. Balances for BOTH the\n demo and real accounts come from a single REST call:\n GET https://api.derivws.com/trading/v1/options/accounts\n\n Serverless-safe: plain fetch(), no persistent connection for reads.\n ============================================================ */\n\nexport interface DerivConfig {\n token: string; // PAT, e.g. \"pat_...\"\n clientId: string; // App/Client ID (UUID) from developers.deriv.com\n symbol: string; // underlying, e.g. \"frxXAUUSD\"\n timeoutMs: number;\n}\n\nexport interface DerivAccount {\n accountId: string;\n balance: number;\n currency: string;\n accountType: \"demo\" | \"real\";\n status?: string;\n group?: string;\n virtual: boolean; // true when accountType === \"demo\"\n}\n\nexport function derivConfig(overrides: Partial = {}): DerivConfig {\n const token = overrides.token ?? Deno.env.get(\"DERIV_API_TOKEN\");\n if (!token) throw new Error(\"DERIV_API_TOKEN not set\");\n return {\n token,\n clientId: overrides.clientId ??\n (Deno.env.get(\"DERIV_CLIENT_ID\") || Deno.env.get(\"DERIV_APP_ID\") || \"\"),\n symbol: overrides.symbol ?? (Deno.env.get(\"GOLD_SYMBOL\") || \"frxXAUUSD\"),\n timeoutMs: overrides.timeoutMs ?? Number(Deno.env.get(\"DERIV_TIMEOUT_MS\") || 12000),\n };\n}\n\nconst REST_BASE = \"https://api.derivws.com\";\n\n/** List every options trading account your PAT can see (demo AND real),\n with their live balances — all in one REST call. This is Deriv's real\n \"one API key, entire account\" model. */\nexport async function fetchDerivAccounts(cfg: DerivConfig): Promise {\n if (!cfg.clientId) {\n throw new Error(\n \"DERIV_CLIENT_ID not set. Your token is a PAT; paste the App/Client ID (a UUID) \" +\n \"from your developers.deriv.com application into Settings → DERIV_CLIENT_ID.\"\n );\n }\n if (!/^pat_/.test(cfg.token)) {\n throw new Error(\n \"DERIV_API_TOKEN should be a Personal Access Token starting with 'pat_'. \" +\n \"Got: \" + cfg.token.slice(0, 6) + \"…\"\n );\n }\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), cfg.timeoutMs);\n try {\n const res = await fetch(`${REST_BASE}/trading/v1/options/accounts`, {\n method: \"GET\",\n signal: controller.signal,\n headers: {\n Authorization: `Bearer ${cfg.token}`,\n \"Deriv-App-ID\": cfg.clientId,\n \"Content-Type\": \"application/json\",\n },\n });\n const body = await res.json().catch(() => ({}));\n if (!res.ok) {\n const code = (body as any)?.error?.code ?? (body as any)?.code ?? res.status;\n const msg = (body as any)?.error?.message ?? (body as any)?.message ?? `HTTP ${res.status}`;\n throw new Error(`Deriv API ${code}: ${msg}`);\n }\n const data = (body as any)?.data;\n const rows = Array.isArray(data) ? data : data ? [data] : [];\n return rows.map((r: any): DerivAccount => ({\n accountId: r.account_id ?? \"\",\n balance: Number(r.balance ?? 0),\n currency: r.currency ?? \"USD\",\n accountType: r.account_type === \"real\" ? \"real\" : \"demo\",\n status: r.status ?? \"active\",\n group: r.group,\n virtual: r.account_type !== \"real\",\n }));\n } finally {\n clearTimeout(timer);\n }\n}\n\n/* ============================================================\n Lift/Trade on the new API (NOT yet implemented honestly).\n\n Real trading on the new Deriv API requires:\n 1. POST /trading/v1/options/accounts/{accountId}/otp\n (header Bearer PAT + Deriv-App-ID) → returns { data: { url } }\n 2. connect to that wss URL (e.g. .../ws/real?otp=...)\n 3. send proposal → subscribe → buy over that socket.\n\n Until that socket flow is wired up for XAUUSD contracts, we refuse\n to trade rather than pretend. These helpers make the limitation\n explicit so the dashboard is never fake.\n ============================================================ */\n\nexport class DerivTradingNotWiredError extends Error {}\n",[167],"pulls","branches",1,"forks","envVars",{"_182":42,"_184":42},"connections",{"_182":42,"_183":42},"count","unfilledCount","emptyCount",{"_18":166,"_20":167,"_119":168,"_121":-5,"_122":71,"_123":169,"_125":38,"_22":207,"_68":171,"_128":129,"_130":172,"_132":26,"_133":-5,"_192":208,"_89":209},{"_18":158,"_20":159,"_119":36,"_121":-5,"_122":71,"_123":69,"_125":38,"_22":204,"_68":161,"_128":162,"_130":163,"_132":26,"_133":164,"_192":205,"_89":206},{"_18":150,"_20":151,"_119":152,"_121":-5,"_122":71,"_123":153,"_125":38,"_22":201,"_68":42,"_128":155,"_130":156,"_132":26,"_133":-5,"_192":202,"_89":203},{"_18":143,"_20":144,"_119":145,"_121":-5,"_122":71,"_123":146,"_125":38,"_22":198,"_68":127,"_128":129,"_130":148,"_132":26,"_133":-5,"_192":199,"_89":200},{"_18":135,"_20":136,"_119":137,"_121":-5,"_122":71,"_123":138,"_125":38,"_22":195,"_68":140,"_128":129,"_130":141,"_132":26,"_133":-5,"_192":196,"_89":197},{"_18":117,"_20":118,"_119":120,"_121":-5,"_122":71,"_123":124,"_125":38,"_22":191,"_68":127,"_128":129,"_130":131,"_132":26,"_133":-5,"_192":193,"_89":194},["D",1788697354688],"children",[],[118],["D",1788697386784],[],[136],["D",1788694117626],[],[144],["D",1788694094017],[],[151],["D",1788697733439],[],[159],["D",1788696432199],[],[167],["D",1788687592224],["D",1789472446807],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_108":248,"_249":250,"_251":252,"_253":26,"_254":26,"_255":26,"_256":38,"_257":-5,"_258":-7,"_259":-7,"_260":42,"_261":26,"_262":26,"_263":-5,"_264":26,"_265":26,"_266":26,"_267":-5},"ENV",{"_219":220,"_221":222,"_223":70,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]