smartxtrader 3.8.1-xm.0

package/api/telegram/webhook.js

@@ -0,0 +1,1361 @@
+const crypto = require('crypto')
+
+const BOT_TOKEN = process.env.TELEGRAM_BOT_TOKEN
+const FRONTEND_URL = process.env.SMARTANALYZER_FRONTEND_URL || 'https://smartanalizer.vercel.app'
+const FRONTEND_AUTH_PATH = process.env.SMARTANALYZER_FRONTEND_AUTH_PATH || '/auth'
+const TELEGRAM_MINI_APP_URL = process.env.TELEGRAM_MINI_APP_URL || null
+const DERIV_APP_ID = process.env.DERIV_APP_ID || process.env.DERIV_APPID || '1'
+const DERIV_OAUTH_URL = process.env.DERIV_OAUTH_URL || 'https://oauth.deriv.com/oauth2/authorize'
+const DERIV_WS_URL = process.env.DERIV_WS_URL || `wss://ws.derivws.com/websockets/v3?app_id=${DERIV_APP_ID}`
+const DERIV_TIMEOUT_MS = Number(process.env.DERIV_API_TIMEOUT_MS || 10000)
+const FRONTEND_CALLBACK_PATH = process.env.SMARTANALYZER_FRONTEND_CALLBACK_PATH || '/callback'
+const FRONTEND_DEFAULT_LOCALE = (process.env.SMARTANALYZER_DEFAULT_LOCALE || 'en').toLowerCase()
+
+const WebSocket = global.WebSocket || require('ws')
+const WS_STATE = {
+  CONNECTING: typeof WebSocket.CONNECTING === 'number' ? WebSocket.CONNECTING : 0,
+  OPEN      : typeof WebSocket.OPEN === 'number' ? WebSocket.OPEN : 1,
+}
+const {
+  loadSession,
+  deleteSession,
+} = require('../_lib/telegram_session_store')
+const {
+  checkUserSubscription,
+  hasActiveSubscription,
+  buildSubscriptionStatusMessage,
+  buildSubscriptionInlineKeyboard,
+  getSubscribeLink,
+  getPrimarySubscriptionLabel,
+} = require('../_lib/telegram_subscription')
+
+const COMMANDS = {
+  START   : '/start',
+  AUTH    : '🔐 Авторизация',
+  CHECK   : '📡 Проверка подключения',
+  CLEAR   : '🚪 Очистить авторизацию',
+  BALANCE : '💰 Баланс Deriv',
+  ACCOUNTS: '📂 Открытые счета',
+  TRADES  : '📜 Пять последних сделок',
+  SUBSCRIBE: '💳 Подписаться',
+  SUBSCRIPTION_STATUS: '📦 Проверить подписку',
+}
+
+const normalizeCommandKey = (value) => {
+  if (!value && value !== 0) {
+    return ''
+  }
+
+  return String(value)
+    .normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9\u0400-\u04ff/]+/gu, ' ')
+    .trim()
+    .replace(/\s+/g, ' ')
+}
+
+const COMMAND_ALIAS_MAP = new Map()
+
+const MAX_ACTIVE_CHAT_MESSAGES = 4
+const ACTIVE_CHAT_MESSAGES = new Map()
+
+const registerCommandAlias = (alias, command) => {
+  const key = normalizeCommandKey(alias)
+  if (!key || COMMAND_ALIAS_MAP.has(key)) {
+    return
+  }
+
+  COMMAND_ALIAS_MAP.set(key, command)
+}
+
+[
+  [COMMANDS.AUTH, COMMANDS.AUTH],
+  ['авторизация', COMMANDS.AUTH],
+  ['авторизоваться', COMMANDS.AUTH],
+  ['auth', COMMANDS.AUTH],
+  ['authorize', COMMANDS.AUTH],
+  ['authorization', COMMANDS.AUTH],
+  ['authorisation', COMMANDS.AUTH],
+  ['login', COMMANDS.AUTH],
+  ['log in', COMMANDS.AUTH],
+  ['войти', COMMANDS.AUTH],
+  ['вход', COMMANDS.AUTH],
+  ['refresh', COMMANDS.AUTH],
+  ['renew', COMMANDS.AUTH],
+
+  [COMMANDS.CHECK, COMMANDS.CHECK],
+  ['проверка подключения', COMMANDS.CHECK],
+  ['проверка', COMMANDS.CHECK],
+  ['check connection', COMMANDS.CHECK],
+  ['connection', COMMANDS.CHECK],
+  ['check', COMMANDS.CHECK],
+
+  [COMMANDS.CLEAR, COMMANDS.CLEAR],
+  ['очистить авторизацию', COMMANDS.CLEAR],
+  ['очистить', COMMANDS.CLEAR],
+  ['logout', COMMANDS.CLEAR],
+  ['log out', COMMANDS.CLEAR],
+  ['выйти', COMMANDS.CLEAR],
+  ['разлогиниться', COMMANDS.CLEAR],
+  ['reset', COMMANDS.CLEAR],
+
+  [COMMANDS.BALANCE, COMMANDS.BALANCE],
+  ['баланс', COMMANDS.BALANCE],
+  ['баланс deriv', COMMANDS.BALANCE],
+  ['balance', COMMANDS.BALANCE],
+
+  [COMMANDS.ACCOUNTS, COMMANDS.ACCOUNTS],
+  ['открытые счета', COMMANDS.ACCOUNTS],
+  ['счета', COMMANDS.ACCOUNTS],
+  ['аккаунты', COMMANDS.ACCOUNTS],
+  ['аккаунт', COMMANDS.ACCOUNTS],
+  ['accounts', COMMANDS.ACCOUNTS],
+  ['account', COMMANDS.ACCOUNTS],
+
+  [COMMANDS.TRADES, COMMANDS.TRADES],
+  ['сделки', COMMANDS.TRADES],
+  ['история', COMMANDS.TRADES],
+  ['trades', COMMANDS.TRADES],
+  ['statement', COMMANDS.TRADES],
+  ['history', COMMANDS.TRADES],
+
+  [COMMANDS.SUBSCRIBE, COMMANDS.SUBSCRIBE],
+  ['подписаться', COMMANDS.SUBSCRIBE],
+  ['подписка', COMMANDS.SUBSCRIBE],
+  ['subscribe', COMMANDS.SUBSCRIBE],
+
+  [COMMANDS.SUBSCRIPTION_STATUS, COMMANDS.SUBSCRIPTION_STATUS],
+  ['проверить подписку', COMMANDS.SUBSCRIPTION_STATUS],
+  ['проверка подписки', COMMANDS.SUBSCRIPTION_STATUS],
+  ['subscription status', COMMANDS.SUBSCRIPTION_STATUS],
+  ['status', COMMANDS.SUBSCRIPTION_STATUS],
+  ['check subscription', COMMANDS.SUBSCRIPTION_STATUS],
+].forEach(([alias, command]) => registerCommandAlias(alias, command))
+
+const resolveCommandAlias = (value) => {
+  const key = normalizeCommandKey(value)
+  if (!key) {
+    return null
+  }
+
+  return COMMAND_ALIAS_MAP.get(key) || null
+}
+
+const decodeStartPayloadJson = (value) => {
+  if (typeof value !== 'string' || !value) {
+    return null
+  }
+
+  try {
+    const normalized = value
+      .replace(/-/g, '+')
+      .replace(/_/g, '/')
+    const padding = normalized.length % 4 ? 4 - (normalized.length % 4) : 0
+    const padded = normalized + '='.repeat(padding)
+    const decoded = Buffer.from(padded, 'base64').toString('utf8')
+    const parsed = JSON.parse(decoded)
+    if (parsed && typeof parsed === 'object') {
+      return parsed
+    }
+  } catch (error) {
+    // ignore malformed payloads
+  }
+
+  return null
+}
+
+const extractStartPayload = (text) => {
+  if (typeof text !== 'string') {
+    return null
+  }
+
+  if (!text.startsWith(COMMANDS.START)) {
+    return null
+  }
+
+  const payload = text.slice(COMMANDS.START.length).trim()
+  return payload || null
+}
+
+const interpretStartPayload = (payload) => {
+  if (!payload) {
+    return null
+  }
+
+  const trimmed = payload.trim()
+  if (!trimmed) {
+    return null
+  }
+
+  const colonIndex = trimmed.indexOf(':')
+  const head = colonIndex > -1 ? trimmed.slice(0, colonIndex) : trimmed
+  const remainder = colonIndex > -1 ? trimmed.slice(colonIndex + 1).trim() : ''
+
+  const alias = resolveCommandAlias(head)
+  if (alias) {
+    return { command: alias, payload: trimmed, argument: remainder }
+  }
+
+  const aliasFull = resolveCommandAlias(trimmed)
+  if (aliasFull) {
+    return { command: aliasFull, payload: trimmed, argument: '' }
+  }
+
+  const decoded = decodeStartPayloadJson(trimmed)
+  if (decoded) {
+    const candidates = [decoded.command, decoded.action, decoded.cmd, decoded.type]
+    for (const candidate of candidates) {
+      const decodedAlias = resolveCommandAlias(candidate)
+      if (decodedAlias) {
+        return { command: decodedAlias, payload: trimmed, argument: '', data: decoded }
+      }
+    }
+
+    return { command: null, payload: trimmed, argument: '', data: decoded }
+  }
+
+  const normalized = resolveCommandAlias(remainder)
+  if (normalized) {
+    return { command: normalized, payload: trimmed, argument: remainder }
+  }
+
+  return { command: null, payload: trimmed, argument: remainder }
+}
+
+const extractCommandFromText = (text) => {
+  if (!text) {
+    return { command: null, startPayload: null }
+  }
+
+  if (text.startsWith(COMMANDS.START)) {
+    return { command: COMMANDS.START, startPayload: extractStartPayload(text) }
+  }
+
+  const alias = resolveCommandAlias(text)
+  if (alias) {
+    return { command: alias, startPayload: null }
+  }
+
+  return { command: text, startPayload: null }
+}
+
+const formatAmount = (value) => {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return value.toFixed(2)
+  }
+
+  if (typeof value === 'string') {
+    const parsed = Number.parseFloat(value)
+    if (Number.isFinite(parsed)) {
+      return parsed.toFixed(2)
+    }
+  }
+
+  return null
+}
+
+const buildReplyKeyboard = (session, subscription) => {
+  const subscriptionActive = hasActiveSubscription(subscription)
+
+  if (!subscriptionActive) {
+    return {
+      keyboard: [
+        [{ text: COMMANDS.SUBSCRIPTION_STATUS }],
+        [{ text: COMMANDS.SUBSCRIBE }],
+      ],
+      resize_keyboard        : true,
+      one_time_keyboard      : false,
+      input_field_placeholder: 'Оформите подписку, чтобы продолжить',
+    }
+  }
+
+  const keyboard = [
+    [{ text: COMMANDS.AUTH }],
+    [{ text: COMMANDS.CLEAR }],
+  ]
+
+  if (session) {
+    keyboard.push(
+      [{ text: COMMANDS.BALANCE }, { text: COMMANDS.ACCOUNTS }],
+      [{ text: COMMANDS.TRADES }],
+    )
+  }
+
+  keyboard.push([{ text: COMMANDS.SUBSCRIPTION_STATUS }])
+
+  return {
+    keyboard,
+    resize_keyboard        : true,
+    one_time_keyboard      : false,
+    input_field_placeholder: session ? 'Выберите действие' : 'Авторизуйтесь через Deriv',
+  }
+}
+
+const deleteMessage = async (chatId, messageId) => {
+  if (!chatId || !messageId) return
+
+  try {
+    await fetch(`https://api.telegram.org/bot${BOT_TOKEN}/deleteMessage`, {
+      method : 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body   : JSON.stringify({ chat_id: chatId, message_id: messageId }),
+    })
+  } catch (error) {
+    console.warn(`⚠️ Failed to delete message ${messageId} in chat ${chatId}:`, error)
+  }
+}
+
+const registerChatMessage = async (chatId, messageId) => {
+  if (!chatId || !messageId) return
+
+  const history = ACTIVE_CHAT_MESSAGES.get(chatId) || []
+  history.push(messageId)
+
+  while (history.length > MAX_ACTIVE_CHAT_MESSAGES) {
+    const outdatedMessageId = history.shift()
+    if (outdatedMessageId) {
+      await deleteMessage(chatId, outdatedMessageId)
+    }
+  }
+
+  ACTIVE_CHAT_MESSAGES.set(chatId, history)
+}
+
+const sendMessage = async (chatId, text, { replyMarkup = null, parseMode = null } = {}) => {
+  const payload = {
+    chat_id: chatId,
+    text,
+    disable_web_page_preview: true,
+  }
+
+  if (parseMode) {
+    payload.parse_mode = parseMode
+  }
+
+  if (replyMarkup) {
+    payload.reply_markup = replyMarkup
+  }
+
+  try {
+    const response = await fetch(`https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`, {
+      method : 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body   : JSON.stringify(payload),
+    })
+
+    const data = await response.json().catch(() => null)
+
+    if (data?.ok && data?.result?.message_id) {
+      await registerChatMessage(chatId, data.result.message_id)
+    }
+
+    return data?.result || null
+  } catch (error) {
+    console.error('❌ Failed to send Telegram message:', error)
+    return null
+  }
+}
+
+const safeLocale = (value) => {
+  if (typeof value !== 'string' || !value.trim()) {
+    return FRONTEND_DEFAULT_LOCALE
+  }
+
+  return value.trim().toLowerCase().split(/[_-]/)[0] || FRONTEND_DEFAULT_LOCALE
+}
+
+const normalizePath = (value) => {
+  if (!value) return '/'
+  return value.startsWith('/') ? value : `/${value}`
+}
+
+const generateIntentId = () => {
+  if (typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID()
+  }
+
+  return `tg_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`
+}
+
+const appendSessionTokens = (params, session) => {
+  if (!session) return
+
+  const accounts = Array.isArray(session.accounts) ? session.accounts : []
+
+  accounts
+    .filter(account => account && account.loginid && account.token)
+    .forEach((account, index) => {
+      const position = index + 1
+      params.set(`acct${position}`, account.loginid)
+      params.set(`token${position}`, account.token)
+      if (account.currency) {
+        params.set(`currency${position}`, account.currency)
+      }
+    })
+
+  if (session.active_loginid) {
+    params.set('active_loginid', session.active_loginid)
+  }
+
+  if (session.locale) {
+    params.set('lang', safeLocale(session.locale))
+  }
+
+  if (session.redirect_url) {
+    params.set('redirect_url', session.redirect_url)
+  }
+
+  if (session.intent_id) {
+    params.set('intent_id', session.intent_id)
+  }
+}
+
+const buildMiniAppLoginUrl = (chatId, session) => {
+  if (!TELEGRAM_MINI_APP_URL) {
+    return null
+  }
+
+  try {
+    const url = new URL(TELEGRAM_MINI_APP_URL)
+    const params = url.searchParams
+
+    if (chatId) {
+      params.set('tg_chat_id', String(chatId))
+    }
+
+    params.set('source', 'telegram_bot')
+    params.set('mode', session ? 'authorized' : 'authorize')
+
+    appendSessionTokens(params, session)
+
+    return url.toString()
+  } catch (error) {
+    console.warn('⚠️ Failed to build mini-app URL', error)
+    return null
+  }
+}
+
+const buildLoggedInUrl = (chatId, session) => {
+  if (!session) {
+    return null
+  }
+
+  try {
+    const locale = safeLocale(session.locale)
+    const path = `/${locale}${normalizePath('logged_in')}`
+    const url = new URL(path, FRONTEND_URL)
+    const params = url.searchParams
+
+    appendSessionTokens(params, session)
+
+    if (chatId) {
+      params.set('tg_chat_id', String(chatId))
+    }
+
+    params.set('from', 'telegram_bot')
+
+    return url.toString()
+  } catch (error) {
+    console.warn('⚠️ Failed to build logged_in URL', error)
+    return null
+  }
+}
+
+const buildFrontendCallbackUrl = ({ chatId, intentId, locale }) => {
+  try {
+    const normalizedLocale = safeLocale(locale)
+    const callbackPath = `/${normalizedLocale}${normalizePath(FRONTEND_CALLBACK_PATH)}`
+    const url = new URL(callbackPath, FRONTEND_URL)
+
+    if (chatId) {
+      url.searchParams.set('chat_id', String(chatId))
+      url.searchParams.set('tg_chat_id', String(chatId))
+    }
+
+    if (intentId) {
+      url.searchParams.set('intent_id', intentId)
+      url.searchParams.set('telegram_intent', intentId)
+      url.searchParams.set('tg_intent', intentId)
+    }
+
+    url.searchParams.set('source', 'telegram_bot')
+
+    return url.toString()
+  } catch (error) {
+    console.warn('⚠️ Failed to build callback URL', error)
+    return null
+  }
+}
+
+const buildDerivAuthorizeUrl = ({ chatId, locale }) => {
+  const intentId = generateIntentId()
+  const callbackUrl = buildFrontendCallbackUrl({ chatId, intentId, locale })
+
+  try {
+    const url = new URL(DERIV_OAUTH_URL)
+    url.searchParams.set('app_id', DERIV_APP_ID)
+
+    const loginLocale = safeLocale(locale)
+    if (loginLocale) {
+      url.searchParams.set('l', loginLocale)
+    }
+
+    if (callbackUrl) {
+      url.searchParams.set('redirect_uri', callbackUrl)
+    }
+
+    url.searchParams.set('state', intentId)
+
+    return { intentId, authorizeUrl: url.toString(), callbackUrl }
+  } catch (error) {
+    console.warn('⚠️ Failed to build Deriv authorize URL', error)
+    return { intentId, authorizeUrl: null, callbackUrl }
+  }
+}
+
+const buildAuthorizeInlineKeyboard = (chatId, { locale } = {}) => {
+  const inline_keyboard = []
+  const { authorizeUrl } = buildDerivAuthorizeUrl({ chatId, locale })
+  const miniAppUrl = authorizeUrl ? null : buildMiniAppLoginUrl(chatId, null)
+
+  const miniAppButtonUrl = authorizeUrl || miniAppUrl
+
+  if (miniAppButtonUrl) {
+    inline_keyboard.push([{ text: 'Открыть мини-приложение', web_app: { url: miniAppButtonUrl } }])
+  }
+
+  return inline_keyboard.length ? { inline_keyboard } : null
+}
+
+const buildAuthorizedAccessKeyboard = (chatId, session) => {
+  if (!session) {
+    return null
+  }
+
+  const inline_keyboard = []
+  const miniAppUrl = buildMiniAppLoginUrl(chatId, session)
+  const loggedInUrl = buildLoggedInUrl(chatId, session)
+
+  if (miniAppUrl) {
+    inline_keyboard.push([{ text: 'Открыть мини-приложение', web_app: { url: miniAppUrl } }])
+  }
+
+  if (loggedInUrl) {
+    inline_keyboard.push([{ text: 'Открыть SmartAnalizer', url: loggedInUrl }])
+  }
+
+  return inline_keyboard.length ? { inline_keyboard } : null
+}
+
+const sendAuthorizedAccessLinks = async (chatId, subscription, session, message) => {
+  if (!hasActiveSubscription(subscription) || !session) {
+    return
+  }
+
+  const inlineKeyboard = buildAuthorizedAccessKeyboard(chatId, session)
+  if (!inlineKeyboard?.inline_keyboard?.length) {
+    return
+  }
+
+  await sendMessage(chatId,
+    message || 'Используйте кнопки ниже, чтобы открыть SmartAnalizer.',
+    { replyMarkup: inlineKeyboard })
+}
+
+const getSessionForReply = (session, subscription) => (hasActiveSubscription(subscription) ? session : null)
+
+const sendSubscriptionRequired = async (chatId, subscription, { intro = null } = {}) => {
+  const parts = []
+  if (intro) {
+    parts.push(intro)
+  }
+
+  const subscribeLink = subscription?.subscribeLink || getSubscribeLink()
+  const channelLabel = getPrimarySubscriptionLabel()
+  const subscribeInstruction = subscribeLink
+    ? `Подпишитесь на канал ${channelLabel}: ${subscribeLink}`
+    : `Подпишитесь на канал ${channelLabel} и повторите проверку.`
+
+  if (subscription?.ok) {
+    parts.push('Для доступа к SmartAnalizer требуется активная подписка.')
+    parts.push(`${subscribeInstruction} После подписки нажмите «📦 Проверить подписку».`)
+  } else if (subscription?.message) {
+    parts.push(subscription.message)
+    parts.push(`${subscribeInstruction} После подписки повторите проверку.`)
+  } else {
+    parts.push('Не удалось проверить подписку. Попробуйте позже или обратитесь в поддержку.')
+    parts.push(subscribeInstruction)
+  }
+
+  const message = parts.filter(Boolean).join('\n\n')
+  await sendMessage(chatId,
+    message || 'Для продолжения требуется активная подписка на SmartAnalizer.',
+    { replyMarkup: buildReplyKeyboard(null, subscription) })
+
+  const inlineKeyboard = buildSubscriptionInlineKeyboard(subscription)
+  if (inlineKeyboard) {
+    const followUp = subscription?.ok
+      ? 'Нажмите кнопку ниже, чтобы перейти в канал и оформить подписку. После подписки используйте «📦 Проверить подписку». '
+      : 'Если проблема сохраняется, попробуйте ещё раз позже или обратитесь в поддержку.'
+
+    await sendMessage(chatId,
+      followUp,
+      { replyMarkup: inlineKeyboard })
+  }
+}
+
+const ensureSubscriptionOrNotify = async (chatId, subscription, intro) => {
+  if (hasActiveSubscription(subscription)) {
+    return true
+  }
+
+  await sendSubscriptionRequired(chatId, subscription, { intro })
+  return false
+}
+
+const getSessionSafe = async (chatId) => {
+  try {
+    const session = await loadSession(chatId)
+    return { session }
+  } catch (error) {
+    console.error('❌ Failed to load Telegram session:', error)
+    return { session: null, error }
+  }
+}
+
+const resolveSessionForIds = async (ids) => {
+  const uniqueIds = Array.from(new Set(
+    ids
+      .filter(id => id !== undefined && id !== null)
+      .map(id => String(id))
+      .filter(id => id.length > 0),
+  ))
+
+  for (const id of uniqueIds) {
+    const { session, error } = await getSessionSafe(id)
+    if (error) {
+      return { session: null, sessionError: error, identifiers: uniqueIds }
+    }
+    if (session) {
+      return { session, sessionError: null, identifiers: uniqueIds, resolvedId: id }
+    }
+  }
+
+  return { session: null, sessionError: null, identifiers: uniqueIds, resolvedId: null }
+}
+
+const deleteSessionSafe = async (chatId) => {
+  try {
+    const deleted = await deleteSession(chatId)
+    return { ok: true, deleted }
+  } catch (error) {
+    console.error('❌ Failed to delete Telegram session:', error)
+    return { ok: false, error }
+  }
+}
+
+const pickPrimaryAccount = (session) => {
+  if (!session || !Array.isArray(session.accounts) || !session.accounts.length) {
+    return null
+  }
+
+  if (session.active_loginid) {
+    const byActive = session.accounts.find(account => account.loginid === session.active_loginid)
+    if (byActive) {
+      return byActive
+    }
+  }
+
+  return session.accounts[0]
+}
+
+const formatTimestampUtc = (value) => {
+  if (!value) {
+    return null
+  }
+
+  const date = new Date(Number(value))
+  if (!Number.isFinite(date.getTime())) {
+    return null
+  }
+
+  return date.toISOString().replace('T', ' ').replace(/\.\d+Z$/, ' UTC')
+}
+
+const getMiniAppPreferences = (session) => {
+  if (!session || !session.chart || typeof session.chart !== 'object') {
+    return null
+  }
+
+  const keys = Object.keys(session.chart)
+  if (!keys.length) {
+    return null
+  }
+
+  return session.chart
+}
+
+const formatGranularity = (value) => {
+  const numeric = Number(value)
+  if (!Number.isFinite(numeric) || numeric < 0) {
+    return null
+  }
+
+  if (numeric === 0) {
+    return 'тики'
+  }
+
+  const DAY_SECONDS = 24 * 60 * 60
+  const HOUR_SECONDS = 60 * 60
+  const MINUTE_SECONDS = 60
+
+  if (numeric % DAY_SECONDS === 0) {
+    const days = numeric / DAY_SECONDS
+    return `${days} д`
+  }
+
+  if (numeric % HOUR_SECONDS === 0) {
+    const hours = numeric / HOUR_SECONDS
+    return `${hours} ч`
+  }
+
+  if (numeric % MINUTE_SECONDS === 0) {
+    const minutes = numeric / MINUTE_SECONDS
+    return `${minutes} мин`
+  }
+
+  return `${numeric} с`
+}
+
+const describeMiniAppStatus = (session) => {
+  const preferences = getMiniAppPreferences(session)
+  if (!preferences) {
+    return null
+  }
+
+  const details = []
+
+  const theme = session?.ui_theme || preferences.theme
+  if (theme) {
+    details.push(`тема ${theme}`)
+  }
+
+  const chartType = preferences.chart_type
+  if (chartType) {
+    details.push(`тип ${chartType}`)
+  }
+
+  const layout = preferences.layout && typeof preferences.layout === 'object'
+    ? preferences.layout
+    : null
+
+  if (layout) {
+    const symbol = layout.active_symbol || layout.symbol
+    if (symbol) {
+      details.push(`символ ${symbol}`)
+    }
+
+    const granularity = formatGranularity(layout.granularity)
+    if (granularity) {
+      details.push(`таймфрейм ${granularity}`)
+    }
+  }
+
+  const style = preferences.style && typeof preferences.style === 'object'
+    ? preferences.style
+    : null
+
+  if (style?.key) {
+    details.push(`стиль ${style.key}`)
+  }
+
+  if (!details.length) {
+    return '📊 Мини-приложение SmartAnalizer активно.'
+  }
+
+  return `📊 Мини-приложение активно (${details.join(', ')}).`
+}
+
+const checkDerivConnection = async (account) => {
+  if (!account || !account.token) {
+    return { ok: false, error: new Error('Токен авторизации не найден.') }
+  }
+
+  try {
+    await withDerivRequest(account.token, { ping: 1 }, 'ping')
+    return { ok: true }
+  } catch (error) {
+    return { ok: false, error }
+  }
+}
+
+const withDerivRequest = (token, payload, expectedType) => new Promise((resolve, reject) => {
+  if (!token) {
+    reject(new Error('Token is missing'))
+    return
+  }
+
+  const ws = new WebSocket(DERIV_WS_URL)
+  let isAuthorized = false
+  const timeout = setTimeout(() => {
+    cleanup()
+    reject(new Error('Deriv API timeout'))
+  }, DERIV_TIMEOUT_MS)
+
+  const cleanup = () => {
+    clearTimeout(timeout)
+    if (ws.readyState === WS_STATE.OPEN || ws.readyState === WS_STATE.CONNECTING) {
+      try { ws.close() } catch (err) {
+        // ignore errors on close
+      }
+    }
+  }
+
+  ws.on('open', () => {
+    ws.send(JSON.stringify({ authorize: token }))
+  })
+
+  ws.on('error', (error) => {
+    cleanup()
+    reject(error)
+  })
+
+  ws.on('close', () => {
+    clearTimeout(timeout)
+  })
+
+  ws.on('message', (raw) => {
+    let message
+    try {
+      message = JSON.parse(raw)
+    } catch (error) {
+      console.warn('⚠️ Failed to parse Deriv message', error)
+      return
+    }
+
+    if (message.error) {
+      cleanup()
+      reject(new Error(message.error.message || 'Deriv API error'))
+      return
+    }
+
+    if (!isAuthorized) {
+      if (message.msg_type === 'authorize') {
+        isAuthorized = true
+        ws.send(JSON.stringify(payload))
+      }
+      return
+    }
+
+    if (!expectedType || message.msg_type === expectedType) {
+      cleanup()
+      resolve(message)
+    }
+  })
+})
+
+const handleStart = async (chatId, session, sessionError, subscription) => {
+  if (!hasActiveSubscription(subscription)) {
+    await sendSubscriptionRequired(chatId, subscription, {
+      intro: '👋 Добро пожаловать в SmartAnalizer! Для продолжения активируйте подписку.',
+    })
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось получить данные авторизации. Попробуйте позже или обратитесь в поддержку.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (session) {
+    const activeAccount = pickPrimaryAccount(session)
+    const accountInfo = activeAccount
+      ? `Активный аккаунт Deriv: ${activeAccount.loginid}`
+      : 'Авторизация выполнена.'
+    await sendMessage(chatId,
+      `✅ Бот SmartAnalizer готов к работе!\n${accountInfo}`,
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    await sendAuthorizedAccessLinks(chatId, subscription, session,
+      '➡️ Откройте авторизованный SmartAnalizer через кнопки ниже.')
+  } else {
+    await sendMessage(chatId,
+      '👋 Добро пожаловать в SmartAnalizer!\nДля начала авторизуйтесь через Deriv.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+
+    const inlineKeyboard = buildAuthorizeInlineKeyboard(chatId, { locale: subscription?.locale })
+    if (inlineKeyboard) {
+      await sendMessage(chatId,
+        '🔐 Нажмите кнопку ниже, чтобы открыть страницу авторизации Deriv.',
+        { replyMarkup: inlineKeyboard })
+    }
+  }
+}
+
+const handleAuthorization = async (chatId, session, sessionError, subscription) => {
+  const allowed = await ensureSubscriptionOrNotify(chatId, subscription,
+    '🔐 Авторизация доступна только при активной подписке.')
+  if (!allowed) {
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось проверить текущий статус авторизации. Попробуйте позже.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (session) {
+    const activeAccount = pickPrimaryAccount(session)
+    const accountText = activeAccount ? `Аккаунт ${activeAccount.loginid} уже авторизован.` : 'Авторизация уже выполнена.'
+    await sendMessage(chatId,
+      `✅ ${accountText}\nЕсли требуется сменить аккаунт, выполните авторизацию в мини-приложении снова.`,
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    await sendAuthorizedAccessLinks(chatId, subscription, session,
+      '➡️ Используйте кнопки ниже, чтобы открыть авторизованный SmartAnalizer.')
+    return
+  }
+
+  await sendMessage(chatId,
+    '🔐 Для авторизации откройте страницу Deriv и выполните вход в аккаунт.',
+    { replyMarkup: buildReplyKeyboard(null, subscription) })
+
+  const inlineKeyboard = buildAuthorizeInlineKeyboard(chatId)
+  if (inlineKeyboard) {
+    await sendMessage(chatId,
+      '⬇️ Нажмите кнопку ниже, чтобы перейти к авторизации Deriv.',
+      { replyMarkup: inlineKeyboard })
+  }
+}
+
+const handleConnectionCheck = async (chatId, session, sessionError, subscription) => {
+  const allowed = await ensureSubscriptionOrNotify(chatId, subscription,
+    '📡 Проверка подключения доступна только при активной подписке.')
+  if (!allowed) {
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось проверить подключение к Deriv. Попробуйте позже.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (!session) {
+    await sendMessage(chatId,
+      '❌ Авторизация отсутствует. Нажмите «🔐 Авторизация», чтобы связать аккаунт Deriv.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+    return
+  }
+
+  const activeAccount = pickPrimaryAccount(session)
+  const accountInfo = activeAccount ? `Аккаунт: ${activeAccount.loginid}` : 'Аккаунт: не выбран.'
+  const miniAppReady = Boolean(getMiniAppPreferences(session))
+  const miniAppStatus = describeMiniAppStatus(session)
+  const { ok: connectionOk, error: connectionError } = await checkDerivConnection(activeAccount)
+
+  const lines = []
+  if (connectionOk) {
+    lines.push('✅ Авторизация активна и подключение к Deriv подтверждено.')
+  } else if (miniAppReady) {
+    lines.push('✅ Авторизация выполнена, мини-приложение SmartAnalizer уже активно.')
+    if (connectionError) {
+      console.warn('⚠️ Deriv connection check failed:', connectionError)
+      lines.push(`⚠️ Не удалось подтвердить подключение к Deriv со стороны бота: ${connectionError.message || 'неизвестная ошибка.'}`)
+      lines.push('Если мини-приложение продолжает работать, дополнительная авторизация не требуется.')
+    } else {
+      lines.push('⚠️ Не удалось подтвердить подключение к Deriv со стороны бота.')
+    }
+  } else if (connectionError) {
+    console.warn('⚠️ Deriv connection check failed:', connectionError)
+    lines.push(`⚠️ Авторизация найдена, но не удалось подтвердить подключение к Deriv: ${connectionError.message || 'неизвестная ошибка.'}`)
+    lines.push('Попробуйте заново авторизоваться через «🔐 Авторизация», чтобы восстановить подключение.')
+  } else {
+    lines.push('⚠️ Авторизация найдена, но не удалось подтвердить подключение к Deriv.')
+    lines.push('Попробуйте заново авторизоваться через «🔐 Авторизация», чтобы восстановить подключение.')
+  }
+
+  lines.push(accountInfo)
+
+  if (miniAppStatus) {
+    lines.push(miniAppStatus)
+  }
+
+  const expiresAtText = formatTimestampUtc(session.expires_at)
+  if (expiresAtText) {
+    lines.push(`⏳ Сессия действует до ${expiresAtText}.`)
+  }
+
+  await sendMessage(chatId,
+    lines.join('\n'),
+    { replyMarkup: buildReplyKeyboard(getSessionForReply((connectionOk || miniAppReady) ? session : null, subscription), subscription) })
+
+  if (connectionOk || miniAppReady) {
+    await sendAuthorizedAccessLinks(chatId, subscription, session,
+      '➡️ Используйте кнопки ниже, чтобы открыть авторизованный SmartAnalizer.')
+  }
+}
+
+const handleClearAuthorization = async (chatId, identifiers = [], subscription) => {
+  const targets = Array.from(new Set([
+    ...identifiers,
+    chatId !== undefined && chatId !== null ? String(chatId) : null,
+  ].filter(Boolean)))
+
+  if (!targets.length) {
+    await sendMessage(chatId,
+      'ℹ️ Активной авторизации не найдено.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+    return
+  }
+
+  let deleted = false
+  let hadError = false
+
+  for (const id of targets) {
+    const result = await deleteSessionSafe(id)
+    if (!result.ok) {
+      hadError = true
+      continue
+    }
+    deleted = deleted || Boolean(result.deleted)
+  }
+
+  if (hadError && !deleted) {
+    await sendMessage(chatId,
+      '❌ Не удалось очистить авторизацию. Попробуйте ещё раз позже.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+    return
+  }
+
+  if (deleted) {
+    await sendMessage(chatId,
+      '🔓 Авторизация удалена. Нажмите «🔐 Авторизация», чтобы подключить Deriv снова.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+  } else {
+    await sendMessage(chatId,
+      'ℹ️ Активной авторизации не найдено.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+  }
+}
+
+const handleBalance = async (chatId, session, sessionError, subscription) => {
+  const allowed = await ensureSubscriptionOrNotify(chatId, subscription,
+    '💰 Просмотр баланса доступен только при активной подписке.')
+  if (!allowed) {
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось получить данные для проверки баланса. Попробуйте позже.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (!session) {
+    await sendMessage(chatId,
+      '❌ Баланс недоступен. Выполните авторизацию через Deriv.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+    return
+  }
+
+  const account = pickPrimaryAccount(session)
+  if (!account) {
+    await sendMessage(chatId,
+      '❌ Не удалось определить аккаунт Deriv. Выполните авторизацию повторно.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  try {
+    const response = await withDerivRequest(account.token, { balance: 1 }, 'balance')
+    const balanceData = response?.balance
+    const amountValue = formatAmount(balanceData?.balance)
+    const amount = amountValue !== null ? amountValue : 'недоступен'
+    const currency = balanceData?.currency || account.currency || ''
+    await sendMessage(chatId,
+      `💰 Баланс аккаунта ${account.loginid}: ${amount} ${currency}`.trim(),
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+  } catch (error) {
+    console.error('❌ Failed to fetch Deriv balance:', error)
+    await sendMessage(chatId,
+      `❌ Не удалось получить баланс: ${error.message || 'неизвестная ошибка'}`,
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+  }
+}
+
+const handleAccounts = async (chatId, session, sessionError, subscription) => {
+  const allowed = await ensureSubscriptionOrNotify(chatId, subscription,
+    '📂 Просмотр связанных аккаунтов доступен только при активной подписке.')
+  if (!allowed) {
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось загрузить список аккаунтов. Попробуйте позже.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (!session || !Array.isArray(session.accounts) || !session.accounts.length) {
+    await sendMessage(chatId,
+      '❌ Аккаунты не найдены. Выполните авторизацию через Deriv.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  const lines = session.accounts.map((account, index) => {
+    const parts = [`${index + 1}. ${account.loginid}`]
+    if (account.currency) parts.push(`валюта: ${account.currency}`)
+    if (account.is_virtual) parts.push('демо')
+    else parts.push('реальный')
+    if (account.account_type) parts.push(`тип: ${account.account_type}`)
+    return parts.join(' — ')
+  })
+
+  await sendMessage(chatId,
+    `📂 Связанные аккаунты Deriv:\n${lines.join('\n')}`,
+    { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+}
+ 
+const formatStatementLine = (transaction) => {
+  const date = transaction?.transaction_time
+    ? new Date(transaction.transaction_time * 1000).toLocaleString('ru-RU')
+    : 'время неизвестно'
+  const action = transaction?.action_type || 'операция'
+  const amountValue = formatAmount(transaction?.amount)
+  const amount = amountValue !== null
+    ? `${amountValue} ${transaction?.currency || ''}`.trim()
+    : 'сумма неизвестна'
+  const description = transaction?.description || ''
+
+  return [`• ${action}`, `сумма: ${amount}`, description ? `описание: ${description}` : null, `время: ${date}`]
+    .filter(Boolean)
+    .join('\n')
+}
+
+const handleTrades = async (chatId, session, sessionError, subscription) => {
+  const allowed = await ensureSubscriptionOrNotify(chatId, subscription,
+    '📜 История сделок доступна только при активной подписке.')
+  if (!allowed) {
+    return
+  }
+
+  if (sessionError) {
+    await sendMessage(chatId,
+      '⚠️ Не удалось получить историю сделок. Попробуйте позже.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  if (!session) {
+    await sendMessage(chatId,
+      '❌ История сделок недоступна. Выполните авторизацию через Deriv.',
+      { replyMarkup: buildReplyKeyboard(null, subscription) })
+    return
+  }
+
+  const account = pickPrimaryAccount(session)
+  if (!account) {
+    await sendMessage(chatId,
+      '❌ Не удалось определить аккаунт Deriv для запроса истории.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  try {
+    const response = await withDerivRequest(account.token, { statement: 1, limit: 5, description: 1 }, 'statement')
+    const transactions = response?.statement?.transactions
+    if (!Array.isArray(transactions) || !transactions.length) {
+      await sendMessage(chatId,
+        'ℹ️ За последние операции ничего не найдено.',
+        { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+      return
+    }
+
+    const lines = transactions.map(formatStatementLine)
+    await sendMessage(chatId,
+      `📜 Последние сделки аккаунта ${account.loginid}:\n\n${lines.join('\n\n')}`,
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+  } catch (error) {
+    console.error('❌ Failed to fetch Deriv statement:', error)
+    await sendMessage(chatId,
+      `❌ Не удалось получить историю сделок: ${error.message || 'неизвестная ошибка'}`,
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+  }
+
+  await sendSubscriptionRequired(chatId, subscription, {
+    intro: '🔔 Для доступа к возможностям SmartAnalizer необходимо оформить подписку.',
+  })
+}
+
+const handleSubscriptionCheckCommand = async (chatId, userId, session, subscription) => {
+  const latestStatus = await checkUserSubscription({ userId, forceRefresh: true })
+  const message = buildSubscriptionStatusMessage(latestStatus)
+  const replySession = getSessionForReply(session, latestStatus)
+
+  await sendMessage(chatId,
+    message,
+    { replyMarkup: buildReplyKeyboard(replySession, latestStatus) })
+
+  if (!hasActiveSubscription(latestStatus)) {
+    const inlineKeyboard = buildSubscriptionInlineKeyboard(latestStatus)
+    if (inlineKeyboard) {
+      await sendMessage(chatId,
+        'После оформления подписки нажмите «📦 Проверить подписку», чтобы обновить статус.',
+        { replyMarkup: inlineKeyboard })
+    }
+  }
+}
+
+const handleSubscribe = async (chatId, session, subscription) => {
+  if (hasActiveSubscription(subscription)) {
+    await sendMessage(chatId,
+      '✅ Подписка уже активна. Используйте команды ниже для работы.',
+      { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+    return
+  }
+
+  await sendSubscriptionRequired(chatId, subscription, {
+    intro: '🔔 Для доступа к возможностям SmartAnalizer необходимо оформить подписку.',
+  })
+}
+
+const handleUnknown = async (chatId, session, subscription, { originalText = null } = {}) => {
+  let reference = originalText
+  if (typeof reference === 'string' && reference.length > 120) {
+    reference = `${reference.slice(0, 117)}…`
+  }
+
+  const details = reference
+    ? `Команда «${reference}» не распознана.`
+    : 'Команда не распознана.'
+
+  await sendMessage(chatId,
+    `⚙️ ${details} Используйте меню, чтобы выбрать действие.`,
+    { replyMarkup: buildReplyKeyboard(getSessionForReply(session, subscription), subscription) })
+}
+
+const executeCommand = async (command, {
+  chatId,
+  session,
+  sessionError,
+  subscription,
+  sessionIdentifiers,
+  userId,
+  originalText = null,
+} = {}) => {
+  if (!command || !chatId) {
+    return
+  }
+
+  switch (command) {
+    case COMMANDS.START:
+      await handleStart(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.AUTH:
+      await handleAuthorization(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.CHECK:
+      await handleConnectionCheck(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.CLEAR:
+      await handleClearAuthorization(chatId, sessionIdentifiers, subscription)
+      break
+    case COMMANDS.BALANCE:
+      await handleBalance(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.ACCOUNTS:
+      await handleAccounts(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.TRADES:
+      await handleTrades(chatId, session, sessionError, subscription)
+      break
+    case COMMANDS.SUBSCRIPTION_STATUS:
+      await handleSubscriptionCheckCommand(chatId, userId || chatId, session, subscription)
+      break
+    case COMMANDS.SUBSCRIBE:
+      await handleSubscribe(chatId, session, subscription)
+      break
+    default:
+      await handleUnknown(chatId, session, subscription, { originalText })
+      break
+  }
+}
+
+const processStartFollowUp = async (startPayload, context) => {
+  if (!startPayload) {
+    return
+  }
+
+  const info = interpretStartPayload(startPayload)
+  if (!info || !info.command || info.command === COMMANDS.START) {
+    return
+  }
+
+  await executeCommand(info.command, {
+    ...context,
+    originalText: info.payload || startPayload,
+  })
+}
+
+export default async function webhookHandler(req, res) {
+  try {
+    if (req.method !== 'POST') {
+      return res.status(405).json({ ok: false, error: 'Method Not Allowed' })
+    }
+
+    const body = req.body
+
+    if (!body || !body.message) {
+      console.log('⚠️ Empty Telegram payload:', body)
+      return res.status(200).json({ ok: true })
+    }
+
+    const chatId = body.message.chat?.id
+    const userId = body.message.from?.id
+    const text = body.message.text?.trim() || ''
+
+    if (!chatId || !text) {
+      console.log('⚠️ Unsupported Telegram message:', body.message)
+      return res.status(200).json({ ok: true })
+    }
+
+    console.log(`📩 Message from ${chatId}: ${text}`)
+
+    const { command, startPayload } = extractCommandFromText(text)
+    const { session, sessionError, identifiers: sessionIdentifiers } = await resolveSessionForIds([chatId, userId])
+    const subscription = await checkUserSubscription({
+      userId       : userId || chatId,
+      forceRefresh : command === COMMANDS.START,
+    })
+
+    const context = {
+      chatId,
+      session,
+      sessionError,
+      subscription,
+      sessionIdentifiers,
+      userId,
+      originalText: text,
+    }
+
+    await executeCommand(command, context)
+
+    if (command === COMMANDS.START && startPayload) {
+      await processStartFollowUp(startPayload, { ...context, originalText: startPayload })
+    }
+
+    return res.status(200).json({ ok: true })
+
+  } catch (err) {
+    console.error('❌ Telegram webhook error:', err)
+    return res.status(500).json({ ok: false, error: String(err) })
+  }
+}