neuroalpha 0.0.0-stage → 0.2.0

package/server/brokers/index.js

@@ -0,0 +1,645 @@
+import crypto from 'node:crypto';
+import { db, kvGet, kvSet, userKvGet, userKvSet, getRun } from '../db.js';
+import { encryptSecret, decryptSecret, currentUserId, runWithUser } from '../auth/index.js';
+import { notifyBrokerBatch, registerBrokerHandlers } from '../notify/index.js';
+import { getSettings, normalizeParams } from '../settings.js';
+import { latestBarTs } from '../data/moex.js';
+import { barsFromHours, BAR_INTERVAL, BAR_MS } from '../model/dataset.js';
+import { forecastNow } from '../model/forecast.js';
+import { MODELS } from '../model/models.js';
+import { blockingNews } from '../news/index.js';
+import { round, MSK, DAY } from '../util.js';
+import { hub } from '../hub.js';
+
+export const BROKER_META = [
+  { id: 'tbank', name: 'Т-Банк (T-Invest API)', accountHint: 'ID счёта (оставьте пустым для выбора первого доступного)', tokenHint: 'Токен T-Invest API (t.…)' },
+  { id: 'finam', name: 'Финам (Trade API)', accountHint: 'Код клиента (ClientId, например 123456R)', tokenHint: 'Токен Finam Trade API (CA…)' },
+  { id: 'alor', name: 'Алор (OpenAPI)', accountHint: 'Портфель Мосбиржи (например D12345)', tokenHint: 'Refresh-токен Alor OpenAPI' },
+  { id: 'bcs', name: 'БКС Мир инвестиций', accountHint: 'Номер соглашения / субсчёта (необязательно)', tokenHint: 'Refresh-токен БКС Trade API' },
+];
+
+// ---------- справочник лотов и шага цены Мосбиржи (TQBR) ----------
+const SPECS_URL = 'https://iss.moex.com/iss/engines/stock/markets/shares/boards/TQBR/securities.json?iss.meta=off&iss.only=securities,marketdata';
+export async function ensureBoardSpecs() {
+  const cached = kvGet('moexSpecs');
+  if (cached?.specs && Date.now() - cached.at < DAY) return cached.specs;
+  try {
+    const r = await fetch(SPECS_URL, { signal: AbortSignal.timeout(25000) });
+    if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    const j = await r.json();
+    const sc = j.securities.columns, mc = j.marketdata.columns;
+    const is = (k) => sc.indexOf(k), im = (k) => mc.indexOf(k);
+    const prices = new Map();
+    for (const row of j.marketdata.data) {
+      const sym = row[im('SECID')];
+      const px = Number(row[im('LAST')] || row[im('MARKETPRICE')] || row[im('LCURRENTPRICE')] || 0);
+      if (sym && px > 0) prices.set(sym, px);
+    }
+    const specs = {};
+    for (const row of j.securities.data) {
+      const sym = row[is('SECID')];
+      if (!sym) continue;
+      const lotSize = Math.max(1, Number(row[is('LOTSIZE')]) || 1);
+      const minStep = Number(row[is('MINSTEP')]) > 0 ? Number(row[is('MINSTEP')]) : 0.01;
+      const decimals = Math.max(0, Number(row[is('DECIMALS')]) || 0);
+      const prev = Number(row[is('PREVPRICE')] || row[is('PREVADMITTEDQUOTE')] || 0);
+      specs[sym] = { lotSize, minStep, decimals, lastPrice: prices.get(sym) || prev || 0 };
+    }
+    kvSet('moexSpecs', { at: Date.now(), specs });
+    return specs;
+  } catch {
+    return cached?.specs || {};
+  }
+}
+
+export function roundToStep(price, minStep = 0.01, decimals = 2) {
+  const step = minStep > 0 ? minStep : 0.01;
+  const v = Math.round(price / step) * step;
+  return Number(v.toFixed(Math.max(0, Math.min(6, decimals))));
+}
+
+export function calcLotOrder(symbol, targetSumRub, refPrice, action, offsetPct = 0.1, specs = {}) {
+  const sp = specs[symbol] || { lotSize: 1, minStep: 0.01, decimals: 2, lastPrice: 0 };
+  const basePx = refPrice > 0 ? refPrice : sp.lastPrice;
+  if (!(basePx > 0)) return null;
+  const dir = action === 'buy' || action === 'cover' ? 1 : -1;
+  const rawLimit = basePx * (1 + dir * (Number(offsetPct) || 0) / 100);
+  const limitPrice = roundToStep(rawLimit, sp.minStep, sp.decimals);
+  const lotCost = limitPrice * sp.lotSize;
+  const lots = Math.floor(targetSumRub / lotCost);
+  if (lots < 1) return null;
+  const shares = lots * sp.lotSize;
+  return {
+    symbol,
+    action,
+    lotSize: sp.lotSize,
+    lots,
+    shares,
+    refPrice: round(basePx, 4),
+    limitPrice,
+    amountRub: round(shares * limitPrice, 2),
+  };
+}
+
+// ---------- хранение счетов (с изоляцией по user_id и AES-256-GCM шифрованием токенов) ----------
+function loadRawAccounts() {
+  const list = userKvGet('brokerAccounts');
+  if (!Array.isArray(list)) return [];
+  return list.map((a) => ({ ...a, token: decryptSecret(a.token) }));
+}
+function saveRawAccounts(list) {
+  userKvSet('brokerAccounts', list.map((a) => ({ ...a, token: a.token ? encryptSecret(a.token) : '' })));
+}
+
+function publicAccount(a) {
+  const { token, ...rest } = a;
+  let baseRunLabel = null;
+  if (a.baseRunId) {
+    const r = getRun(Number(a.baseRunId));
+    if (r) baseRunLabel = `№${r.id}${r.params?._title ? ` (${r.params._title})` : ''}`;
+  }
+  return { ...rest, hasToken: Boolean(token && String(token).trim()), baseRunLabel };
+}
+
+export function brokersState() {
+  return {
+    brokers: BROKER_META,
+    accounts: loadRawAccounts().map(publicAccount),
+  };
+}
+
+export function saveBrokerAccount(input = {}) {
+  const list = loadRawAccounts();
+  const id = input.id && String(input.id).trim() ? String(input.id).trim() : `brk_${crypto.randomBytes(4).toString('hex')}`;
+  const idx = list.findIndex((x) => x.id === id);
+  const prev = idx >= 0 ? list[idx] : {};
+  const broker = BROKER_META.some((b) => b.id === input.broker) ? input.broker : (prev.broker || 'tbank');
+  const name = String(input.name ?? prev.name ?? '').trim() || BROKER_META.find((b) => b.id === broker).name;
+  const mode = ['readonly', 'confirm', 'auto'].includes(input.mode) ? input.mode : (prev.mode || 'confirm');
+  let token = prev.token || '';
+  if (input.clearToken) token = '';
+  else if (typeof input.token === 'string' && input.token.trim()) token = input.token.trim();
+
+  const next = {
+    id,
+    name,
+    broker,
+    accountId: String(input.accountId ?? prev.accountId ?? '').trim(),
+    sandbox: input.sandbox !== undefined ? Boolean(input.sandbox) : Boolean(prev.sandbox),
+    mode,
+    baseRunId: input.baseRunId !== undefined ? (Number(input.baseRunId) || null) : (prev.baseRunId || null),
+    // жёсткие предохранители (недоступны для изменения ИИ-Стратегом)
+    maxCapitalRub: Math.max(10000, Math.round(Number(input.maxCapitalRub ?? prev.maxCapitalRub ?? 100000))),
+    maxDailyDrawdownPct: Math.max(0.5, Math.min(50, Number(input.maxDailyDrawdownPct ?? prev.maxDailyDrawdownPct ?? 3))),
+    limitOffsetPct: Math.max(0, Math.min(2, Number(input.limitOffsetPct ?? prev.limitOffsetPct ?? 0.1))),
+    skipEdgeMinutes: input.skipEdgeMinutes !== undefined ? Boolean(input.skipEdgeMinutes) : (prev.skipEdgeMinutes ?? true),
+    autoSchedule: input.autoSchedule !== undefined ? Boolean(input.autoSchedule) : (prev.autoSchedule ?? true),
+    lastScheduledBarTs: prev.lastScheduledBarTs || 0,
+    haltedReason: input.resetHalt ? null : (prev.haltedReason || null),
+    token,
+    lastSync: prev.lastSync || null,
+    pendingBatch: prev.pendingBatch || null,
+  };
+  if (idx >= 0) list[idx] = next;
+  else list.push(next);
+  saveRawAccounts(list);
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+export function deleteBrokerAccount(id) {
+  const list = loadRawAccounts().filter((x) => x.id !== id);
+  saveRawAccounts(list);
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+// ---------- адаптеры REST API брокеров (Т-Банк, Финам, Алор, БКС) ----------
+const qVal = (q) => (q ? Number(q.units || 0) + Number(q.nano || 0) / 1e9 : 0);
+const tbankUidCache = new Map();
+
+async function resolveTbankInstrumentId(base, headers, symbol) {
+  if (tbankUidCache.has(symbol)) return tbankUidCache.get(symbol);
+  try {
+    const r = await fetch(`${base}/tinkoff.public.invest.api.contract.v1.InstrumentsService/ShareBy`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ idType: 'INSTRUMENT_ID_TYPE_TICKER', classCode: 'TQBR', id: symbol }),
+      signal: AbortSignal.timeout(10000),
+    });
+    if (r.ok) {
+      const j = await r.json();
+      const uid = j.instrument?.uid || j.instrument?.figi;
+      if (uid) { tbankUidCache.set(symbol, uid); return uid; }
+    }
+  } catch { /* fallback */ }
+  return `${symbol}_TQBR`;
+}
+
+async function syncTbank(acc) {
+  const base = acc.sandbox ? 'https://sandbox-invest-public-api.tinkoff.ru/rest' : 'https://invest-public-api.tinkoff.ru/rest';
+  const headers = { Authorization: `Bearer ${acc.token}`, 'Content-Type': 'application/json' };
+  let accountId = acc.accountId;
+  if (!accountId) {
+    const rAcc = await fetch(`${base}/tinkoff.public.invest.api.contract.v1.UsersService/GetAccounts`, {
+      method: 'POST', headers, body: JSON.stringify({}), signal: AbortSignal.timeout(15000),
+    });
+    if (!rAcc.ok) throw new Error(`T-Invest GetAccounts: HTTP ${rAcc.status}`);
+    const jAcc = await rAcc.json();
+    accountId = jAcc.accounts?.[0]?.id;
+    if (!accountId) throw new Error('В Т-Банке не найдено открытых счетов');
+  }
+  const rPort = await fetch(`${base}/tinkoff.public.invest.api.contract.v1.OperationsService/GetPortfolio`, {
+    method: 'POST', headers, body: JSON.stringify({ accountId, currency: 'RUB' }), signal: AbortSignal.timeout(15000),
+  });
+  if (!rPort.ok) throw new Error(`T-Invest GetPortfolio: HTTP ${rPort.status}`);
+  const p = await rPort.json();
+  const totalRub = round(qVal(p.totalAmountPortfolio), 2);
+  const positions = [];
+  let cashRub = 0;
+  for (const pos of p.positions || []) {
+    const ticker = pos.ticker || pos.figi || '';
+    if (pos.ticker && (pos.instrumentUid || pos.figi)) tbankUidCache.set(pos.ticker, pos.instrumentUid || pos.figi);
+    const qty = qVal(pos.quantity);
+    const px = qVal(pos.currentPrice);
+    if (pos.instrumentType === 'currency' && (ticker.includes('RUB') || pos.figi === 'RUB000UTSTOM')) {
+      cashRub += qty;
+      continue;
+    }
+    positions.push({ symbol: ticker, qty, price: round(px, 4), valueRub: round(qty * px, 2), pnlRub: round(qVal(pos.expectedYield), 2) });
+  }
+  return { accountId, totalRub: totalRub || cashRub, cashRub: round(cashRub, 2), positions };
+}
+
+async function syncFinam(acc) {
+  if (!acc.accountId) throw new Error('Укажите код клиента (ClientId) Финам');
+  const headers = { 'X-Api-Key': acc.token };
+  const url = `https://trade-api.finam.ru/public/api/v1/portfolio?ClientId=${encodeURIComponent(acc.accountId)}&Content.IncludeCurrencies=true&Content.IncludePositions=true`;
+  const r = await fetch(url, { headers, signal: AbortSignal.timeout(15000) });
+  if (!r.ok) throw new Error(`Финам Trade API: HTTP ${r.status}`);
+  const j = await r.json();
+  const data = j.data || j;
+  const totalRub = round(Number(data.equity || 0), 2);
+  const cashRub = round(Number((data.currencies || []).find((c) => c.name === 'RUB')?.balance || data.balance || 0), 2);
+  const positions = (data.positions || []).map((p) => ({
+    symbol: p.securityCode, qty: Number(p.balance || 0), price: round(Number(p.currentPrice || 0), 4),
+    valueRub: round(Number(p.balance || 0) * Number(p.currentPrice || 0), 2), pnlRub: round(Number(p.unrealizedProfit || 0), 2),
+  }));
+  return { accountId: acc.accountId, totalRub, cashRub, positions };
+}
+
+async function alorAccessToken(refreshToken, sandbox) {
+  const oauth = sandbox ? 'https://oauthdev.alor.ru' : 'https://oauth.alor.ru';
+  const r = await fetch(`${oauth}/refresh?token=${encodeURIComponent(refreshToken)}`, { method: 'POST', signal: AbortSignal.timeout(15000) });
+  if (!r.ok) throw new Error(`Алор OAuth: HTTP ${r.status}`);
+  const j = await r.json();
+  if (!j.AccessToken) throw new Error('Алор не вернул AccessToken');
+  return j.AccessToken;
+}
+
+async function syncAlor(acc) {
+  if (!acc.accountId) throw new Error('Укажите портфель Алор (например D12345)');
+  const jwt = await alorAccessToken(acc.token, acc.sandbox);
+  const api = acc.sandbox ? 'https://apidev.alor.ru' : 'https://api.alor.ru';
+  const headers = { Authorization: `Bearer ${jwt}` };
+  const [rSum, rPos] = await Promise.all([
+    fetch(`${api}/md/v2/Clients/MOEX/${encodeURIComponent(acc.accountId)}/summary`, { headers, signal: AbortSignal.timeout(15000) }),
+    fetch(`${api}/md/v2/Clients/MOEX/${encodeURIComponent(acc.accountId)}/positions`, { headers, signal: AbortSignal.timeout(15000) }),
+  ]);
+  if (!rSum.ok) throw new Error(`Алор summary: HTTP ${rSum.status}`);
+  const sum = await rSum.json();
+  const posList = rPos.ok ? await rPos.json() : [];
+  let cashRub = round(Number(sum.buyingPower || sum.cash || 0), 2);
+  const positions = [];
+  for (const p of Array.isArray(posList) ? posList : []) {
+    if (p.isCurrency || p.symbol === 'RUB') { cashRub = round(Number(p.qtyUnits || p.qty || cashRub), 2); continue; }
+    const qty = Number(p.qtyUnits || p.qty || 0);
+    const val = Number(p.volume || 0);
+    positions.push({ symbol: p.symbol, qty, price: qty ? round(val / qty, 4) : 0, valueRub: round(val, 2), pnlRub: round(Number(p.unrealisedPl || 0), 2) });
+  }
+  return { accountId: acc.accountId, totalRub: round(Number(sum.portfolioLiquidationValue || cashRub), 2), cashRub, positions };
+}
+
+async function bcsAccessToken(refreshToken) {
+  const body = new URLSearchParams({ client_id: 'trade-api-write', refresh_token: refreshToken, grant_type: 'refresh_token' });
+  const r = await fetch('https://be.broker.ru/trade-api-keycloak/realms/tradeapi/protocol/openid-connect/token', {
+    method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body, signal: AbortSignal.timeout(15000),
+  });
+  if (!r.ok) throw new Error(`БКС OAuth: HTTP ${r.status}`);
+  const j = await r.json();
+  if (!j.access_token) throw new Error('БКС не вернул access_token');
+  return j.access_token;
+}
+
+async function syncBcs(acc) {
+  const jwt = await bcsAccessToken(acc.token);
+  const r = await fetch('https://be.broker.ru/trade-api-bff-portfolio/api/v1/portfolio', {
+    headers: { Authorization: `Bearer ${jwt}` }, signal: AbortSignal.timeout(15000),
+  });
+  if (!r.ok) throw new Error(`БКС портфель: HTTP ${r.status}`);
+  const j = await r.json();
+  const items = j.positions || j.data || [];
+  let cashRub = 0, totalRub = 0;
+  const positions = [];
+  for (const p of Array.isArray(items) ? items : []) {
+    if (p.type === 'MONEY' || p.ticker === 'RUB') {
+      cashRub += Number(p.CurrentValue || p.balance || 0);
+      totalRub += Number(p.CurrentValue || p.balance || 0);
+      continue;
+    }
+    const qty = Number(p.quantity || p.balance || 0);
+    const px = Number(p.currentPrice || p.price || 0);
+    const val = Number(p.currentValue || qty * px || 0);
+    totalRub += val;
+    positions.push({ symbol: p.ticker || p.symbol, qty, price: round(px, 4), valueRub: round(val, 2), pnlRub: round(Number(p.unrealizedPL || 0), 2) });
+  }
+  return { accountId: acc.accountId || 'основной', totalRub: round(totalRub, 2), cashRub: round(cashRub, 2), positions };
+}
+
+export async function syncBrokerAccount(id) {
+  const list = loadRawAccounts();
+  const acc = list.find((x) => x.id === id);
+  if (!acc) throw new Error('Счёт не найден');
+  if (!acc.token) throw new Error('У счёта не задан токен API');
+  const today = new Date(Date.now() + MSK).toISOString().slice(0, 10);
+  try {
+    let data;
+    if (acc.broker === 'tbank') data = await syncTbank(acc);
+    else if (acc.broker === 'finam') data = await syncFinam(acc);
+    else if (acc.broker === 'alor') data = await syncAlor(acc);
+    else if (acc.broker === 'bcs') data = await syncBcs(acc);
+    else throw new Error(`Неизвестный брокер: ${acc.broker}`);
+    if (data.accountId && !acc.accountId) acc.accountId = data.accountId;
+    const prevDay = acc.lastSync?.day === today ? acc.lastSync.dayStartRub : data.totalRub;
+    const dayStartRub = prevDay > 0 ? prevDay : data.totalRub;
+    const ddPct = dayStartRub > 0 ? round(((dayStartRub - data.totalRub) / dayStartRub) * 100, 2) : 0;
+    if (ddPct >= acc.maxDailyDrawdownPct) {
+      acc.haltedReason = `Сработал дневной стоп по просадке: −${ddPct}% (порог ${acc.maxDailyDrawdownPct}%)`;
+    }
+    acc.lastSync = { at: Date.now(), ok: true, error: null, day: today, dayStartRub, dayDrawdownPct: ddPct, ...data };
+  } catch (e) {
+    acc.lastSync = { ...(acc.lastSync || {}), at: Date.now(), ok: false, error: e.message };
+    saveRawAccounts(list);
+    hub.emit({ type: 'brokers:update', state: brokersState() });
+    throw e;
+  }
+  saveRawAccounts(list);
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+// ---------- предохранитель времени сессии (первые и последние 10 минут торгов МСК) ----------
+function sessionEdgeWarning(now = Date.now()) {
+  const d = new Date(now + MSK);
+  const mins = d.getUTCHours() * 60 + d.getUTCMinutes();
+  // утреннее открытие основной сессии 09:50–10:10 и закрытие дневной 18:35–18:55 МСК
+  if ((mins >= 9 * 60 + 50 && mins <= 10 * 60 + 10) || (mins >= 18 * 60 + 35 && mins <= 18 * 60 + 55)) {
+    return 'Первые или последние 10 минут сессии (широкий спред в стакане)';
+  }
+  return null;
+}
+
+// ---------- формирование и исполнение пакета лимитных заявок ----------
+export async function prepareBrokerOrders(id) {
+  const list = loadRawAccounts();
+  const acc = list.find((x) => x.id === id);
+  if (!acc) throw new Error('Счёт не найден');
+  if (acc.haltedReason) throw new Error(acc.haltedReason);
+  const edgeWarn = acc.skipEdgeMinutes ? sessionEdgeWarning() : null;
+
+  const baseRun = acc.baseRunId ? getRun(Number(acc.baseRunId)) : null;
+  const params = normalizeParams(baseRun?.params || getSettings());
+  const [fc, specs] = await Promise.all([
+    forecastNow(params),
+    ensureBoardSpecs(),
+  ]);
+  const budget = Math.min(acc.maxCapitalRub, acc.lastSync?.totalRub > 0 ? acc.lastSync.totalRub : acc.maxCapitalRub);
+  const K = params.modelTopK || 3;
+  const dir = params.modelDirection || 'long';
+  const autoAdapt = params.modelAutoAdapt !== false;
+  const exitRatio = autoAdapt ? 0.75 : Number(params.modelExitRatio ?? 0.5);
+  const exitThresholdPct = round((fc.thresholdPct || 0) * exitRatio, 3);
+  const slots = dir === 'long' ? K : 2 * K;
+  const maxSlotWeight = dir === 'long' ? Math.min(0.45, Math.max(1 / K, 1.35 / K)) : (dir === 'neutral' ? Math.min(0.22, 1 / (2 * K)) : Math.min(0.30, 1.2 / (2 * K)));
+  const slotRub = autoAdapt ? budget * maxSlotWeight : budget / slots;
+  const heldMap = new Map((acc.lastSync?.positions || []).map((p) => [p.symbol, p]));
+  const rowMap = new Map((fc.rows || []).map((r) => [r.symbol, r]));
+  const quarantined = new Set(baseRun?.extra?.adaptation?.quarantined || []);
+  const nb = params.newsFilter ? blockingNews(6) : null;
+
+  const buyCands = fc.rows.filter((r) => r.signal && !quarantined.has(r.symbol) && !nb?.get(r.symbol)?.bad).sort((a, b) => b.expectedPct - a.expectedPct).slice(0, K);
+  const shortCands = dir !== 'long' ? fc.rows.filter((r) => r.shortSignal && !quarantined.has(r.symbol) && !nb?.get(r.symbol)?.good).sort((a, b) => a.expectedPct - b.expectedPct).slice(0, K) : [];
+
+  const orders = [];
+  const closing = new Set();
+  // 1) закрытие бумаг (покупок и шортов), чей прогноз ослаб ниже порога выхода exitThresholdPct
+  for (const [sym, pos] of heldMap) {
+    if (!pos.qty) continue;
+    const r = rowMap.get(sym);
+    const sp = specs[sym] || { lotSize: 1, minStep: 0.01, decimals: 2 };
+    const lots = Math.floor(Math.abs(pos.qty) / sp.lotSize);
+    if (lots < 1) continue;
+    if (pos.qty > 0) {
+      const keep = r && r.liquid && r.expectedPct > exitThresholdPct;
+      if (!keep) {
+        const limitPrice = roundToStep(pos.price * (1 - acc.limitOffsetPct / 100), sp.minStep, sp.decimals);
+        orders.push({
+          symbol: sym, action: 'sell', lotSize: sp.lotSize, lots, shares: lots * sp.lotSize,
+          refPrice: pos.price, limitPrice, amountRub: round(lots * sp.lotSize * limitPrice, 2),
+          reason: `Выход из покупки: ожидание ${r ? `${r.expectedPct > 0 ? '+' : ''}${r.expectedPct}%` : '—'} ниже порога удержания +${exitThresholdPct}%`,
+        });
+        closing.add(sym);
+      }
+    } else if (pos.qty < 0) {
+      const keep = dir !== 'long' && r && r.liquid && r.expectedPct < -exitThresholdPct;
+      if (!keep) {
+        const limitPrice = roundToStep(pos.price * (1 + acc.limitOffsetPct / 100), sp.minStep, sp.decimals);
+        orders.push({
+          symbol: sym, action: 'cover', lotSize: sp.lotSize, lots, shares: lots * sp.lotSize,
+          refPrice: pos.price, limitPrice, amountRub: round(lots * sp.lotSize * limitPrice, 2),
+          reason: `Закрытие шорта: ожидание ${r ? `${r.expectedPct > 0 ? '+' : ''}${r.expectedPct}%` : '—'} выше порога удержания −${exitThresholdPct}%`,
+        });
+        closing.add(sym);
+      }
+    }
+  }
+  const activeLongs = [...heldMap.values()].filter((p) => p.qty > 0 && !closing.has(p.symbol)).length;
+  const activeShorts = [...heldMap.values()].filter((p) => p.qty < 0 && !closing.has(p.symbol)).length;
+  const usedRub = [...heldMap.values()].filter((p) => p.qty && !closing.has(p.symbol)).reduce((s, p) => s + Math.abs(p.valueRub || 0), 0);
+  let availRub = Math.max(0, budget * 0.99 - usedRub);
+
+  // 2) вход в лучшие сигналы (с учётом лотности Мосбиржи и свободного лимита)
+  const newBuys = buyCands.filter((r) => !((heldMap.get(r.symbol)?.qty || 0) > 0 && !closing.has(r.symbol))).slice(0, Math.max(0, K - activeLongs));
+  const newShorts = shortCands.filter((r) => !((heldMap.get(r.symbol)?.qty || 0) < 0 && !closing.has(r.symbol))).slice(0, Math.max(0, K - activeShorts));
+  const totalNew = newBuys.length + newShorts.length;
+  let remNew = totalNew;
+
+  for (const r of newBuys) {
+    const rawSum = params.modelAllocMode === 'invvol' && r.weight ? slotRub * r.weight : slotRub;
+    const sum = Math.min(rawSum, availRub / Math.max(1, remNew));
+    remNew--;
+    const refPx = specs[r.symbol]?.lastPrice || 0;
+    const ord = calcLotOrder(r.symbol, sum, refPx, 'buy', acc.limitOffsetPct, specs);
+    if (ord) {
+      availRub = Math.max(0, availRub - ord.amountRub);
+      orders.push({
+        ...ord,
+        expectedPct: r.expectedPct,
+        reason: `Покупка (${MODELS[params.modelType]?.label || params.modelType}): ожидание ${r.expectedPct > 0 ? '+' : ''}${r.expectedPct}% за ${params.modelHorizon} ч`,
+      });
+    }
+  }
+  for (const r of newShorts) {
+    const rawSum = params.modelAllocMode === 'invvol' && r.weight ? slotRub * r.weight : slotRub;
+    const sum = Math.min(rawSum, availRub / Math.max(1, remNew));
+    remNew--;
+    const refPx = specs[r.symbol]?.lastPrice || 0;
+    const ord = calcLotOrder(r.symbol, sum, refPx, 'short', acc.limitOffsetPct, specs);
+    if (ord) {
+      availRub = Math.max(0, availRub - ord.amountRub);
+      orders.push({
+        ...ord,
+        expectedPct: r.expectedPct,
+        reason: `Продажа без покупки: ожидание ${r.expectedPct}% за ${params.modelHorizon} ч`,
+      });
+    }
+  }
+
+  acc.pendingBatch = {
+    id: `batch_${Date.now()}`,
+    createdAt: Date.now(),
+    bar: fc.bar,
+    budgetRub: budget,
+    edgeWarning: edgeWarn,
+    orders,
+    status: 'pending',
+    results: [],
+  };
+  saveRawAccounts(list);
+  notifyBrokerBatch(currentUserId(), acc, acc.pendingBatch).catch(() => {});
+  if (acc.mode === 'auto' && !edgeWarn && acc.token && orders.length) {
+    return executeBrokerOrders(id);
+  }
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+async function sendOrderToBroker(acc, ord) {
+  if (!acc.token) throw new Error('Не задан токен API брокера');
+  if (acc.broker === 'tbank') {
+    const base = acc.sandbox ? 'https://sandbox-invest-public-api.tinkoff.ru/rest' : 'https://invest-public-api.tinkoff.ru/rest';
+    const headers = { Authorization: `Bearer ${acc.token}`, 'Content-Type': 'application/json' };
+    const instrumentId = await resolveTbankInstrumentId(base, headers, ord.symbol);
+    const units = Math.trunc(ord.limitPrice);
+    const nano = Math.round((ord.limitPrice - units) * 1e9);
+    const body = {
+      accountId: acc.accountId,
+      instrumentId,
+      quantity: String(ord.lots),
+      price: { units: String(units), nano },
+      direction: ord.action === 'buy' || ord.action === 'cover' ? 'ORDER_DIRECTION_BUY' : 'ORDER_DIRECTION_SELL',
+      orderType: 'ORDER_TYPE_LIMIT',
+      orderId: crypto.randomUUID(),
+    };
+    const r = await fetch(`${base}/tinkoff.public.invest.api.contract.v1.OrdersService/PostOrder`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!r.ok) throw new Error(`T-Invest PostOrder HTTP ${r.status}`);
+    const j = await r.json();
+    return { ok: true, orderId: j.orderId || body.orderId };
+  }
+  if (acc.broker === 'finam') {
+    const body = {
+      clientId: acc.accountId,
+      securityBoard: 'TQBR',
+      securityCode: ord.symbol,
+      buySell: ord.action === 'buy' || ord.action === 'cover' ? 'Buy' : 'Sell',
+      quantity: ord.lots,
+      useCredit: true,
+      price: ord.limitPrice,
+      property: 'PutInQueue',
+    };
+    const r = await fetch('https://trade-api.finam.ru/public/api/v1/orders', {
+      method: 'POST',
+      headers: { 'X-Api-Key': acc.token, 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!r.ok) throw new Error(`Финам PostOrder HTTP ${r.status}`);
+    const j = await r.json();
+    return { ok: true, orderId: j.data?.transactionId || 'ok' };
+  }
+  if (acc.broker === 'alor') {
+    const jwt = await alorAccessToken(acc.token, acc.sandbox);
+    const api = acc.sandbox ? 'https://apidev.alor.ru' : 'https://api.alor.ru';
+    const body = {
+      side: ord.action === 'buy' || ord.action === 'cover' ? 'buy' : 'sell',
+      type: 'limit',
+      quantity: ord.lots,
+      price: ord.limitPrice,
+      instrument: { symbol: ord.symbol, exchange: 'MOEX', instrumentGroup: 'TQBR' },
+      user: { portfolio: acc.accountId },
+    };
+    const r = await fetch(`${api}/commandapi/warptrans/TRADE/v2/client/orders/actions/limit`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json', 'X-ALOR-REQID': crypto.randomUUID() },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!r.ok) throw new Error(`Алор PostOrder HTTP ${r.status}`);
+    const j = await r.json();
+    return { ok: true, orderId: j.orderNumber || 'ok' };
+  }
+  if (acc.broker === 'bcs') {
+    const jwt = await bcsAccessToken(acc.token);
+    const body = {
+      clientOrderId: crypto.randomUUID(),
+      side: ord.action === 'buy' || ord.action === 'cover' ? '1' : '2',
+      orderType: '2',
+      orderQuantity: ord.lots,
+      price: ord.limitPrice,
+      ticker: ord.symbol,
+      classCode: 'TQBR',
+    };
+    const r = await fetch('https://be.broker.ru/trade-api-bff-operations/api/v1/orders', {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+    });
+    if (!r.ok) throw new Error(`БКС PostOrder HTTP ${r.status}`);
+    const j = await r.json();
+    return { ok: true, orderId: j.orderId || body.clientOrderId };
+  }
+  throw new Error(`Неизвестный брокер: ${acc.broker}`);
+}
+
+export async function executeBrokerOrders(id) {
+  const list = loadRawAccounts();
+  const acc = list.find((x) => x.id === id);
+  if (!acc) throw new Error('Счёт не найден');
+  if (acc.mode === 'readonly') throw new Error('Счёт в режиме «Только чтение» — отправка заявок отключена');
+  if (acc.haltedReason) throw new Error(acc.haltedReason);
+  const batch = acc.pendingBatch;
+  if (!batch || !batch.orders?.length) throw new Error('Нет подготовленных заявок для отправки');
+  const results = [];
+  for (const ord of batch.orders) {
+    try {
+      const r = await sendOrderToBroker(acc, ord);
+      results.push({ symbol: ord.symbol, ok: true, orderId: r.orderId });
+    } catch (e) {
+      results.push({ symbol: ord.symbol, ok: false, error: e.message });
+    }
+  }
+  batch.status = results.every((r) => r.ok) ? 'executed' : 'partial';
+  batch.results = results;
+  batch.executedAt = Date.now();
+  saveRawAccounts(list);
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+export function rejectBrokerOrders(id) {
+  const list = loadRawAccounts();
+  const acc = list.find((x) => x.id === id);
+  if (!acc) throw new Error('Счёт не найден');
+  acc.pendingBatch = null;
+  saveRawAccounts(list);
+  const st = brokersState();
+  hub.emit({ type: 'brokers:update', state: st });
+  return st;
+}
+
+registerBrokerHandlers({ execute: executeBrokerOrders, reject: rejectBrokerOrders });
+
+// ---------- авто-расписание расчёта заявок по закрытию свечи (раз в горизонт прогноза) ----------
+let lastSeenBar = null;
+let schedulerBusy = false;
+
+async function tickBrokerSchedule() {
+  if (schedulerBusy) return;
+  const nowMsk = new Date(Date.now() + MSK);
+  const dow = nowMsk.getUTCDay();
+  const mins = nowMsk.getUTCHours() * 60 + nowMsk.getUTCMinutes();
+  if (dow === 0 || dow === 6 || mins < 9 * 60 + 50 || mins > 23 * 60 + 55) return;
+  schedulerBusy = true;
+  try {
+    const latest = await latestBarTs('IMOEX', BAR_INTERVAL).catch(() => null);
+    if (!latest || latest === lastSeenBar) return;
+    lastSeenBar = latest;
+    const users = db.prepare('SELECT * FROM users').all();
+    for (const u of users) {
+      await runWithUser(u, async () => {
+        const list = loadRawAccounts();
+        if (!list.length) return;
+        for (const acc of list) {
+          if (acc.autoSchedule === false || acc.haltedReason) continue;
+          const baseRun = acc.baseRunId ? getRun(Number(acc.baseRunId)) : null;
+          const params = normalizeParams(baseRun?.params || getSettings());
+          const H = barsFromHours(params.modelHorizon);
+          const stepBars = params.modelAutoAdapt !== false ? Math.max(2, Math.floor(H / 2)) : H;
+          if (latest - (acc.lastScheduledBarTs || 0) < stepBars * BAR_MS) continue;
+          acc.lastScheduledBarTs = latest;
+          saveRawAccounts(list);
+          if (acc.token) await syncBrokerAccount(acc.id).catch(() => {});
+          await prepareBrokerOrders(acc.id).catch(() => {});
+        }
+      });
+    }
+  } finally {
+    schedulerBusy = false;
+  }
+}
+
+export function startBrokerScheduler() {
+  const timer = setInterval(tickBrokerSchedule, 60000);
+  timer.unref?.();
+}