@scriptmasterlabs/mcp-x402 2.0.0

package/services/backtest_service.py

@@ -0,0 +1,176 @@
+"""
+Backtest microservice — wraps backtester-mcp + yfinance
+POST /backtest  { ticker, strategy_signals, lookback_days, fees, slippage }
+POST /validate  { ticker, lookback_days, train_ratio }  — walk-forward split
+GET  /health
+"""
+
+from __future__ import annotations
+import os
+import json
+import numpy as np
+from datetime import datetime, timedelta
+from typing import Any
+
+from flask import Flask, request, jsonify
+import backtester_mcp as bt
+
+# yfinance is the free price source — no API key required
+try:
+    import yfinance as yf
+    YF_AVAILABLE = True
+except ImportError:
+    YF_AVAILABLE = False
+
+app = Flask(__name__)
+
+# ── helpers ──────────────────────────────────────────────────────────────────
+
+def _fetch_prices(ticker: str, days: int) -> np.ndarray:
+    if not YF_AVAILABLE:
+        raise RuntimeError("yfinance not installed")
+    end = datetime.utcnow()
+    start = end - timedelta(days=days + 30)  # buffer for weekends/holidays
+    df = yf.download(ticker, start=start.strftime("%Y-%m-%d"),
+                     end=end.strftime("%Y-%m-%d"), progress=False, auto_adjust=True)
+    if df.empty:
+        raise ValueError(f"No price data for {ticker}")
+    return df["Close"].dropna().values[-days:]
+
+
+def _momentum_signals(prices: np.ndarray, window: int = 10, threshold: float = 0.001) -> np.ndarray:
+    """Default long-only momentum signal for validation."""
+    returns = np.diff(np.log(prices))
+    mom = np.convolve(returns, np.ones(window) / window, mode="same")
+    signals = np.zeros(len(prices))
+    signals[1:] = np.where(mom[:-1] > threshold, 1, 0)
+    return signals
+
+
+def _run_backtest(prices: np.ndarray, signals: np.ndarray,
+                  fees: float, slippage: float) -> dict[str, Any]:
+    result = bt.backtest(prices, signals, fees=fees, slippage=slippage)
+    m = result.metrics
+    return {
+        "sharpe": round(m["sharpe"], 3),
+        "sortino": round(m["sortino"], 3),
+        "cagr": round(m["cagr"], 4),
+        "total_return": round(m["total_return"], 4),
+        "max_drawdown": round(m["max_drawdown"], 4),
+        "max_drawdown_duration_days": int(m["max_drawdown_duration"]),
+        "win_rate": round(m["win_rate"], 4),
+        "profit_factor": round(m["profit_factor"], 3),
+        "calmar": round(m["calmar"], 3),
+        "volatility": round(m["volatility"], 4),
+        "num_trades": int(m["num_trades"]),
+    }
+
+
+# ── routes ───────────────────────────────────────────────────────────────────
+
+@app.get("/health")
+def health():
+    return jsonify({
+        "status": "ok",
+        "engine": f"backtester-mcp v{bt.__version__}",
+        "yfinance": YF_AVAILABLE,
+        "timestamp": datetime.utcnow().isoformat() + "Z",
+    })
+
+
+@app.post("/backtest")
+def backtest():
+    body = request.get_json(force=True)
+    ticker: str = body.get("ticker", "").upper()
+    custom_signals: list | None = body.get("signals")  # optional float array
+    lookback: int = int(body.get("lookback_days", 252))
+    fees: float = float(body.get("fees", 0.001))
+    slippage: float = float(body.get("slippage", 0.0005))
+    window: int = int(body.get("momentum_window", 10))
+    threshold: float = float(body.get("momentum_threshold", 0.001))
+
+    if not ticker:
+        return jsonify({"error": "ticker required"}), 400
+
+    try:
+        prices = _fetch_prices(ticker, lookback)
+    except Exception as e:
+        return jsonify({"error": str(e)}), 422
+
+    if custom_signals:
+        signals = np.array(custom_signals, dtype=float)
+        if len(signals) != len(prices):
+            return jsonify({"error": f"signals length {len(signals)} != prices length {len(prices)}"}), 400
+    else:
+        signals = _momentum_signals(prices, window=window, threshold=threshold)
+
+    try:
+        metrics = _run_backtest(prices, signals, fees, slippage)
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+    verdict = "ROBUST" if metrics["sharpe"] > 1.5 and metrics["max_drawdown"] > -0.25 else \
+              "MODERATE" if metrics["sharpe"] > 0.8 else \
+              "WEAK" if metrics["sharpe"] > 0 else "OVERFITTED"
+
+    return jsonify({
+        "ticker": ticker,
+        "lookback_days": len(prices),
+        "fees": fees,
+        "slippage": slippage,
+        "metrics": metrics,
+        "verdict": verdict,
+        "engine": f"backtester-mcp v{bt.__version__}",
+    })
+
+
+@app.post("/validate")
+def walk_forward():
+    """Walk-forward OOS validation — splits data into train/test."""
+    body = request.get_json(force=True)
+    ticker: str = body.get("ticker", "").upper()
+    lookback: int = int(body.get("lookback_days", 504))
+    train_ratio: float = float(body.get("train_ratio", 0.7))
+    fees: float = float(body.get("fees", 0.001))
+    slippage: float = float(body.get("slippage", 0.0005))
+
+    if not ticker:
+        return jsonify({"error": "ticker required"}), 400
+
+    try:
+        prices = _fetch_prices(ticker, lookback)
+    except Exception as e:
+        return jsonify({"error": str(e)}), 422
+
+    split = int(len(prices) * train_ratio)
+    train_prices = prices[:split]
+    oos_prices = prices[split:]
+
+    train_signals = _momentum_signals(train_prices)
+    oos_signals = _momentum_signals(oos_prices)
+
+    try:
+        train_metrics = _run_backtest(train_prices, train_signals, fees, slippage)
+        oos_metrics = _run_backtest(oos_prices, oos_signals, fees, slippage)
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+    # Deflated Sharpe — penalize if OOS degrades significantly
+    sharpe_degradation = train_metrics["sharpe"] - oos_metrics["sharpe"]
+    oos_verdict = "PASS" if oos_metrics["sharpe"] > 0.5 and sharpe_degradation < 1.5 else "FAIL"
+
+    return jsonify({
+        "ticker": ticker,
+        "train_days": len(train_prices),
+        "oos_days": len(oos_prices),
+        "train_metrics": train_metrics,
+        "oos_metrics": oos_metrics,
+        "sharpe_degradation": round(sharpe_degradation, 3),
+        "oos_verdict": oos_verdict,
+        "engine": f"backtester-mcp v{bt.__version__}",
+    })
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("BACKTEST_PORT", 8300))
+    app.run(host="0.0.0.0", port=port, debug=False)

package/src/lib/chains/base.ts

@@ -0,0 +1,77 @@
+import { createWalletClient, createPublicClient, http, parseUnits } from 'viem';
+import { base, baseSepolia } from 'viem/chains';
+import { privateKeyToAccount } from 'viem/accounts';
+import { mnemonicToSeedSync } from 'bip39';
+import HDKey from 'hdkey';
+import { WalletManager } from '../../server/payments/wallet.js';
+import type { RouteParams } from '../../server/payments/router.js';
+
+// USDC contract on Base mainnet
+const USDC_BASE = '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913';
+// USDC contract on Base Sepolia
+const USDC_BASE_SEPOLIA = '0x036CbD53842c5426634e7929541eC2318f3dCF7e';
+
+const ERC20_TRANSFER_ABI = [
+  {
+    name: 'transfer',
+    type: 'function',
+    inputs: [
+      { name: 'to', type: 'address' },
+      { name: 'amount', type: 'uint256' },
+    ],
+    outputs: [{ name: '', type: 'bool' }],
+    stateMutability: 'nonpayable',
+  },
+] as const;
+
+export class BaseChain {
+  private static instance: BaseChain;
+  private readonly testnet: boolean;
+
+  private constructor() {
+    this.testnet = process.env['TESTNET'] === 'true';
+  }
+
+  static getInstance(): BaseChain {
+    if (!BaseChain.instance) {
+      BaseChain.instance = new BaseChain();
+    }
+    return BaseChain.instance;
+  }
+
+  async sendPayment(params: RouteParams): Promise<string> {
+    const chain = this.testnet ? baseSepolia : base;
+    const rpcUrl = this.testnet
+      ? (process.env['BASE_SEPOLIA_RPC_URL'] ?? 'https://sepolia.base.org')
+      : (process.env['BASE_RPC_URL'] ?? 'https://mainnet.base.org');
+
+    const privateKey = await this.getPrivateKey();
+    const account = privateKeyToAccount(privateKey);
+
+    const walletClient = createWalletClient({ account, chain, transport: http(rpcUrl) });
+    const publicClient = createPublicClient({ chain, transport: http(rpcUrl) });
+
+    const usdcAddress = this.testnet ? USDC_BASE_SEPOLIA : USDC_BASE;
+    const amount = parseUnits(params.amount, 6); // USDC has 6 decimals
+
+    const hash = await walletClient.writeContract({
+      address: usdcAddress,
+      abi: ERC20_TRANSFER_ABI,
+      functionName: 'transfer',
+      args: [params.to as `0x${string}`, amount],
+    });
+
+    // Wait for confirmation
+    await publicClient.waitForTransactionReceipt({ hash });
+    return hash;
+  }
+
+  private async getPrivateKey(): Promise<`0x${string}`> {
+    const mnemonic = await WalletManager.getInstance().getSeed();
+    const seed = mnemonicToSeedSync(mnemonic);
+    const hdkey = HDKey.fromMasterSeed(seed);
+    const child = hdkey.derive("m/44'/60'/0'/0/0");
+    if (!child.privateKey) throw new Error('Key derivation failed');
+    return `0x${child.privateKey.toString('hex')}`;
+  }
+}

package/src/lib/chains/solana.ts

@@ -0,0 +1,59 @@
+import {
+  Connection,
+  Keypair,
+  PublicKey,
+  Transaction,
+  sendAndConfirmTransaction,
+} from '@solana/web3.js';
+import { createTransferInstruction, getAssociatedTokenAddress } from '@solana/spl-token';
+import { mnemonicToSeedSync } from 'bip39';
+import HDKey from 'hdkey';
+import { WalletManager } from '../../server/payments/wallet.js';
+import type { RouteParams } from '../../server/payments/router.js';
+
+// USDC mint on Solana mainnet
+const USDC_MINT = new PublicKey('EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v');
+
+export class SolanaChain {
+  private static instance: SolanaChain;
+  private readonly rpcUrl: string;
+
+  private constructor() {
+    this.rpcUrl = process.env['SOLANA_RPC_URL'] ?? 'https://api.mainnet-beta.solana.com';
+  }
+
+  static getInstance(): SolanaChain {
+    if (!SolanaChain.instance) {
+      SolanaChain.instance = new SolanaChain();
+    }
+    return SolanaChain.instance;
+  }
+
+  async sendPayment(params: RouteParams): Promise<string> {
+    const connection = new Connection(this.rpcUrl, 'confirmed');
+    const payer = await this.getKeypair();
+    const destination = new PublicKey(params.to);
+
+    const fromATA = await getAssociatedTokenAddress(USDC_MINT, payer.publicKey);
+    const toATA = await getAssociatedTokenAddress(USDC_MINT, destination);
+
+    const lamports = Math.round(parseFloat(params.amount) * 1_000_000); // USDC 6 decimals
+
+    const tx = new Transaction().add(
+      createTransferInstruction(fromATA, toATA, payer.publicKey, BigInt(lamports)),
+    );
+
+    const sig = await sendAndConfirmTransaction(connection, tx, [payer]);
+    return sig;
+  }
+
+  private async getKeypair(): Promise<Keypair> {
+    const mnemonic = await WalletManager.getInstance().getSeed();
+    const seed = mnemonicToSeedSync(mnemonic);
+    const hdkey = HDKey.fromMasterSeed(seed);
+    // BIP-44 for Solana: m/44'/501'/0'/0'
+    const child = hdkey.derive("m/44'/501'/0'/0'");
+    if (!child.privateKey) throw new Error('Solana key derivation failed');
+    return Keypair.fromSeed(child.privateKey.slice(0, 32));
+  }
+}

package/src/lib/chains/xrpl.ts

@@ -0,0 +1,63 @@
+import { Client, Wallet, xrpToDrops } from 'xrpl';
+import { WalletManager } from '../../server/payments/wallet.js';
+import type { RouteParams } from '../../server/payments/router.js';
+
+export class XRPLChain {
+  private static instance: XRPLChain;
+  private readonly rpcUrl: string;
+
+  private constructor() {
+    this.rpcUrl = process.env['XRPL_RPC_URL'] ?? 'wss://xrplcluster.com';
+  }
+
+  static getInstance(): XRPLChain {
+    if (!XRPLChain.instance) {
+      XRPLChain.instance = new XRPLChain();
+    }
+    return XRPLChain.instance;
+  }
+
+  async sendPayment(params: RouteParams): Promise<string> {
+    const client = new Client(this.rpcUrl);
+    await client.connect();
+
+    try {
+      const wallet = await this.getWallet();
+
+      // RLUSD on XRPL or XRP-denominated drop equivalent
+      const tx = await client.submitAndWait(
+        {
+          TransactionType: 'Payment',
+          Account: wallet.address,
+          Destination: params.to,
+          Amount:
+            params.currency === 'RLUSD'
+              ? {
+                  currency: 'USD',
+                  issuer: process.env['RLUSD_ISSUER'] ?? 'rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh',
+                  value: params.amount,
+                }
+              : xrpToDrops(params.amount),
+        },
+        { wallet },
+      );
+
+      if (tx.result.meta && typeof tx.result.meta === 'object' && 'TransactionResult' in tx.result.meta) {
+        const meta = tx.result.meta as { TransactionResult: string };
+        if (meta.TransactionResult !== 'tesSUCCESS') {
+          throw new Error(`XRPL transaction failed: ${meta.TransactionResult}`);
+        }
+      }
+
+      const txResult = tx.result as unknown as { hash?: string };
+      return txResult.hash ?? 'unknown';
+    } finally {
+      await client.disconnect();
+    }
+  }
+
+  private async getWallet(): Promise<Wallet> {
+    const mnemonic = await WalletManager.getInstance().getSeed();
+    return Wallet.fromMnemonic(mnemonic, { mnemonicEncoding: 'bip39' });
+  }
+}

package/src/lib/credit/bureau.ts

@@ -0,0 +1,65 @@
+interface ScoreCache {
+  score: number;
+  fetchedAt: number;
+}
+
+const SCORE_CACHE_TTL = 300_000; // 5 minutes
+
+export class CreditBureau {
+  private static instance: CreditBureau;
+  private readonly cache = new Map<string, ScoreCache>();
+  private readonly baseUrl: string;
+
+  private constructor() {
+    this.baseUrl = process.env['PROOF402_URL'] ?? 'https://four02proof.onrender.com';
+  }
+
+  static getInstance(): CreditBureau {
+    if (!CreditBureau.instance) {
+      CreditBureau.instance = new CreditBureau();
+    }
+    return CreditBureau.instance;
+  }
+
+  async getScore(wallet: string): Promise<number> {
+    const now = Date.now();
+    const cached = this.cache.get(wallet);
+
+    if (cached && now - cached.fetchedAt < SCORE_CACHE_TTL) {
+      return cached.score;
+    }
+
+    try {
+      const res = await fetch(`${this.baseUrl}/v1/score/${wallet}`, {
+        signal: AbortSignal.timeout(5000),
+      });
+
+      if (res.ok) {
+        const body = (await res.json()) as { score: number };
+        this.cache.set(wallet, { score: body.score, fetchedAt: now });
+        return body.score;
+      }
+    } catch {
+      // Fall through to default
+    }
+
+    // Default score for new/unknown agents
+    const defaultScore = 300;
+    this.cache.set(wallet, { score: defaultScore, fetchedAt: now });
+    return defaultScore;
+  }
+
+  async incrementScore(wallet: string, delta: number): Promise<void> {
+    try {
+      await fetch(`${this.baseUrl}/v1/score/${wallet}/increment`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ delta }),
+      });
+      // Invalidate cache
+      this.cache.delete(wallet);
+    } catch {
+      // Non-fatal
+    }
+  }
+}

package/src/lib/sml-api/agentcard.ts

@@ -0,0 +1,40 @@
+const AGENTCARD_BASE = process.env['AGENTCARD_URL'] ?? 'https://agentcard.onrender.com';
+
+async function acGet(path: string): Promise<unknown> {
+  const res = await fetch(`${AGENTCARD_BASE}${path}`, {
+    headers: { 'Accept': 'application/json' },
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`AgentCard GET ${path}: HTTP ${res.status}`);
+  return res.json();
+}
+
+export interface AgentCardMintParams {
+  walletAddress: string;
+  name: string;
+  did?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface AgentCardVerifyParams {
+  walletAddress: string;
+  message: string;
+  signature: string;
+}
+
+async function acPost(path: string, body: unknown): Promise<unknown> {
+  const res = await fetch(`${AGENTCARD_BASE}${path}`, {
+    method: 'POST',
+    headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (!res.ok) throw new Error(`AgentCard POST ${path}: HTTP ${res.status}`);
+  return res.json();
+}
+
+export const AgentCardAPI = {
+  lookup: (walletOrDid: string) => acGet(`/v1/card/${encodeURIComponent(walletOrDid)}`),
+  verify: (params: AgentCardVerifyParams) => acPost('/v1/verify', params),
+  mint: (params: AgentCardMintParams) => acPost('/v1/mint', params),
+};

package/src/lib/sml-api/backtest.ts

@@ -0,0 +1,47 @@
+// backtester-mcp microservice client
+// Wraps the Python backtest_service.py running at BACKTEST_BASE_URL
+
+const BASE = process.env.BACKTEST_BASE_URL ?? 'http://localhost:8300';
+
+export interface BacktestParams {
+  ticker: string;
+  lookback_days?: number;
+  signals?: number[];
+  fees?: number;
+  slippage?: number;
+  momentum_window?: number;
+  momentum_threshold?: number;
+}
+
+export interface ValidateParams {
+  ticker: string;
+  lookback_days?: number;
+  train_ratio?: number;
+  fees?: number;
+  slippage?: number;
+}
+
+async function post(path: string, body: object): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: res.statusText }));
+    throw new Error((err as { error?: string }).error ?? res.statusText);
+  }
+  return res.json();
+}
+
+export const BacktestAPI = {
+  health: async (): Promise<unknown> => {
+    const res = await fetch(`${BASE}/health`, { signal: AbortSignal.timeout(5_000) });
+    return res.json();
+  },
+
+  backtest: (params: BacktestParams): Promise<unknown> => post('/backtest', params),
+
+  walkForward: (params: ValidateParams): Promise<unknown> => post('/validate', params),
+};

package/src/lib/sml-api/brokers.ts

@@ -0,0 +1,160 @@
+// Broker execution rails — Robinhood + Tradier
+// Robinhood: OAuth2 Bearer token (ROBINHOOD_ACCESS_TOKEN env)
+// Tradier:   Bearer token (TRADIER_API_KEY env, TRADIER_ENV=sandbox|production)
+
+const TRADIER_BASE = process.env.TRADIER_ENV === 'production'
+  ? 'https://api.tradier.com/v1'
+  : 'https://sandbox.tradier.com/v1';
+
+const ROBINHOOD_BASE = 'https://api.robinhood.com';
+
+// ── Shared fetch helpers ────────────────────────────────────────────────────
+
+async function tradierGet(path: string, params?: Record<string, string>): Promise<unknown> {
+  const token = process.env.TRADIER_API_KEY;
+  if (!token) throw new Error('TRADIER_API_KEY not configured');
+  const url = new URL(`${TRADIER_BASE}${path}`);
+  if (params) Object.entries(params).forEach(([k, v]) => url.searchParams.set(k, v));
+  const res = await fetch(url.toString(), {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`Tradier ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+async function tradierPost(path: string, body: Record<string, string>): Promise<unknown> {
+  const token = process.env.TRADIER_API_KEY;
+  if (!token) throw new Error('TRADIER_API_KEY not configured');
+  const res = await fetch(`${TRADIER_BASE}${path}`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      'Content-Type': 'application/x-www-form-urlencoded',
+    },
+    body: new URLSearchParams(body).toString(),
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`Tradier ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+async function robinhoodGet(path: string): Promise<unknown> {
+  const token = process.env.ROBINHOOD_ACCESS_TOKEN;
+  if (!token) throw new Error('ROBINHOOD_ACCESS_TOKEN not configured');
+  const res = await fetch(`${ROBINHOOD_BASE}${path}`, {
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`Robinhood ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+async function robinhoodPost(path: string, body: object): Promise<unknown> {
+  const token = process.env.ROBINHOOD_ACCESS_TOKEN;
+  if (!token) throw new Error('ROBINHOOD_ACCESS_TOKEN not configured');
+  const res = await fetch(`${ROBINHOOD_BASE}${path}`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(10_000),
+  });
+  if (!res.ok) throw new Error(`Robinhood ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
+// ── Tradier API ─────────────────────────────────────────────────────────────
+
+export interface TradierQuoteParams { symbols: string }
+export interface TradierOrderParams {
+  account_id: string;
+  symbol: string;
+  side: 'buy' | 'sell';
+  quantity: number;
+  type: 'market' | 'limit' | 'stop' | 'stop_limit';
+  duration: 'day' | 'gtc' | 'pre' | 'post';
+  price?: number;
+  stop?: number;
+}
+
+export const TradierAPI = {
+  quote: (params: TradierQuoteParams) =>
+    tradierGet('/markets/quotes', { symbols: params.symbols, greeks: 'false' }),
+
+  optionChain: (symbol: string, expiration: string) =>
+    tradierGet('/markets/options/chains', { symbol, expiration, greeks: 'true' }),
+
+  order: (params: TradierOrderParams) => {
+    const body: Record<string, string> = {
+      class: 'equity',
+      symbol: params.symbol,
+      side: params.side,
+      quantity: String(params.quantity),
+      type: params.type,
+      duration: params.duration,
+    };
+    if (params.price !== undefined) body.price = String(params.price);
+    if (params.stop !== undefined) body.stop = String(params.stop);
+    return tradierPost(`/accounts/${params.account_id}/orders`, body);
+  },
+
+  positions: (account_id: string) =>
+    tradierGet(`/accounts/${account_id}/positions`),
+
+  balances: (account_id: string) =>
+    tradierGet(`/accounts/${account_id}/balances`),
+
+  orderStatus: (account_id: string, order_id: string) =>
+    tradierGet(`/accounts/${account_id}/orders/${order_id}`),
+};
+
+// ── Robinhood API ────────────────────────────────────────────────────────────
+
+export interface RobinhoodOrderParams {
+  symbol: string;
+  side: 'buy' | 'sell';
+  quantity: number;
+  type: 'market' | 'limit';
+  time_in_force: 'gfd' | 'gtc' | 'ioc' | 'opg';
+  price?: number;
+}
+
+export const RobinhoodAPI = {
+  quote: async (symbol: string) => {
+    const data = await robinhoodGet(`/quotes/?symbols=${symbol}`) as { results?: unknown[] };
+    return data.results?.[0] ?? data;
+  },
+
+  instruments: async (symbol: string) => {
+    const data = await robinhoodGet(`/instruments/?symbol=${symbol}`) as { results?: { url: string }[] };
+    return data.results?.[0];
+  },
+
+  order: async (params: RobinhoodOrderParams) => {
+    const instrument = await RobinhoodAPI.instruments(params.symbol) as { url?: string } | undefined;
+    if (!instrument?.url) throw new Error(`Instrument not found: ${params.symbol}`);
+    const body: Record<string, unknown> = {
+      account: `/accounts/${process.env.ROBINHOOD_ACCOUNT_ID}/`,
+      instrument: instrument.url,
+      symbol: params.symbol,
+      side: params.side,
+      quantity: params.quantity,
+      type: params.type,
+      time_in_force: params.time_in_force,
+      trigger: 'immediate',
+    };
+    if (params.price !== undefined) body.price = String(params.price);
+    return robinhoodPost('/orders/', body);
+  },
+
+  portfolio: () => robinhoodGet('/portfolios/'),
+
+  positions: () => robinhoodGet('/positions/?nonzero=true'),
+
+  orderHistory: () => robinhoodGet('/orders/?page_size=20'),
+};