@oomol-lab/open-connector 1.6.5 → 1.7.0

package/src/providers/drawio_mcp/runtime.js

@@ -0,0 +1,175 @@
+import { sha256Hex } from "../../core/aws-sigv4.js";
+import { looseArray, optionalInteger, optionalNumber, optionalRawString, optionalRecord, optionalString, } from "../../core/cast.js";
+import { assertPublicHttpUrl, isPrivateNetworkAccessAllowed } from "../../core/request.js";
+import { callMcpTool, listMcpTools } from "../mcp-tools.js";
+import { parseProviderJsonBodyText, providerInputError, providerResponseError, requiredInputString, } from "../provider-runtime.js";
+const hostedEndpoint = "https://mcp.draw.io/mcp";
+const defaultShapeLimit = 10;
+// The two create_diagram tool errors that judge the submitted source; anything else is a server failure.
+const sourceVerdictPrefixes = ["Could not extract draw.io XML", "Provide exactly one of"];
+const errorsHeading = "ERRORS (will cause rendering issues):\n- ";
+const warningsHeading = "WARNINGS (may cause issues):\n- ";
+export const drawioMcpActionHandlers = {
+    async create_diagram(input, options) {
+        const result = await callMcpTool({
+            ...options,
+            toolName: "create_diagram",
+            arguments: { mermaid: optionalString(input.mermaid), xml: optionalString(input.xml) },
+            transformToolResult: rejectDiagramSource,
+        });
+        const texts = readTextContent(result);
+        const editorUrl = readEditorUrl(texts);
+        if (editorUrl === undefined) {
+            throw providerResponseError("draw.io MCP create_diagram response did not include an editor link; a self-hosted server must be jgraph/drawio-mcp mcp-app-server 1.0.4 or later");
+        }
+        return { editorUrl, ...readFindings(texts) };
+    },
+    async search_shapes(input, options) {
+        const result = await callMcpTool({
+            ...options,
+            toolName: "search_shapes",
+            arguments: {
+                query: requiredInputString(input.query, "query"),
+                limit: optionalInteger(input.limit) ?? defaultShapeLimit,
+            },
+        });
+        return { shapes: readShapes(result) };
+    },
+};
+/** Resolve the MCP server a connection points at; a blank endpoint selects the hosted draw.io server. */
+export function createDrawioMcpContext(values, fetcher, signal) {
+    return {
+        endpoint: normalizeDrawioMcpEndpoint(values.mcpEndpoint),
+        service: "draw.io",
+        fetcher,
+        signal,
+        terminateSession: true,
+        maxResponseBytes: 4 * 1024 * 1024,
+        // tools/list is about 64 KB because create_diagram embeds draw.io's drawing reference in its description.
+        toolListMaxBytes: 1024 * 1024,
+        toolListMaxPages: 5,
+        toolListMaxTools: 100,
+    };
+}
+/** Confirm the endpoint serves the draw.io tools and derive a stable identity from the endpoint. */
+export async function validateDrawioMcpCredential(values, fetcher, signal) {
+    const options = createDrawioMcpContext(values, fetcher, signal);
+    const discovered = new Set((await listMcpTools(options)).map((tool) => tool.name));
+    const missing = Object.keys(drawioMcpActionHandlers).filter((toolName) => !discovered.has(toolName));
+    if (missing.length > 0) {
+        throw providerInputError(`mcpEndpoint does not serve the draw.io MCP tools: missing ${missing.join(", ")}`);
+    }
+    return {
+        profile: {
+            accountId: `drawio_mcp:mcp:${sha256Hex(options.endpoint).slice(0, 16)}`,
+            displayName: `draw.io MCP · ${new URL(options.endpoint).host}`,
+        },
+        grantedScopes: [],
+        metadata: { mcpEndpoint: options.endpoint },
+    };
+}
+function normalizeDrawioMcpEndpoint(value) {
+    const allowPrivateNetwork = isPrivateNetworkAccessAllowed();
+    const url = assertPublicHttpUrl(optionalString(value) ?? hostedEndpoint, {
+        fieldName: "mcpEndpoint",
+        createError: providerInputError,
+        allowPrivateNetwork,
+    });
+    if (url.username || url.password) {
+        throw providerInputError("mcpEndpoint must not include a username or password");
+    }
+    if (url.protocol === "http:" && !allowPrivateNetwork) {
+        throw providerInputError("mcpEndpoint must use https unless private-network access is enabled");
+    }
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+// Also drops structured content: the editor link and findings only ever arrive as text blocks,
+// which the shared result normalizer would otherwise discard in favour of structuredContent.
+function rejectDiagramSource(result) {
+    const message = "content" in result && result.isError ? readTextContent(result).join("\n") : "";
+    if (sourceVerdictPrefixes.some((prefix) => message.startsWith(prefix))) {
+        throw providerInputError(`draw.io rejected the diagram source: ${message.slice(0, 300)}`);
+    }
+    return { ...result, structuredContent: undefined };
+}
+// draw.io puts the editor link on a line of its own after the source echo, which is single-line JSON, and after
+// the XML findings, which quote attribute values from the source verbatim, line breaks included. Skipping the
+// findings and taking the last such line keeps a link written inside the submitted source from being returned instead.
+function readEditorUrl(texts) {
+    return texts
+        .filter((text) => !isFindingsText(text))
+        .flatMap((text) => text.split("\n"))
+        .findLast((line) => line.startsWith("https://") && line.includes("#create="));
+}
+// draw.io reports XML problems in one text block of "ERRORS (...):\n- item" and "WARNINGS (...):\n- item" sections.
+function isFindingsText(text) {
+    return text.startsWith("ERRORS ") || text.startsWith("WARNINGS ");
+}
+function readTextContent(result) {
+    return looseArray(optionalRecord(result)?.content).flatMap((item) => {
+        const content = optionalRecord(item);
+        const text = content?.type === "text" ? optionalRawString(content.text) : undefined;
+        return text === undefined ? [] : [text];
+    });
+}
+// Findings items quote attribute values verbatim, so blank lines and line starts can come from the source. Only
+// draw.io's exact layout splits the block: each heading is followed by the items joined with "\n- ", and a blank
+// line separates the errors section from the warnings section. The layout leaves no way to tell a quoted value from
+// that structure: a value that itself contains "\n- " still reads as two items, and one that contains the whole
+// "\n\nWARNINGS (may cause issues):\n- " separator can move items between errors and warnings. The editor link is
+// unaffected, since readEditorUrl skips the findings block as a whole.
+function readFindings(texts) {
+    const text = texts.find(isFindingsText) ?? "";
+    if (text.startsWith(warningsHeading)) {
+        return { errors: [], warnings: splitFindings(text.slice(warningsHeading.length)) };
+    }
+    if (!text.startsWith(errorsHeading)) {
+        return { errors: [], warnings: [] };
+    }
+    const body = text.slice(errorsHeading.length);
+    const separator = body.lastIndexOf(`\n\n${warningsHeading}`);
+    if (separator < 0) {
+        return { errors: splitFindings(body), warnings: [] };
+    }
+    return {
+        errors: splitFindings(body.slice(0, separator)),
+        warnings: splitFindings(body.slice(separator + 2 + warningsHeading.length)),
+    };
+}
+// draw.io never reports an empty finding, so an empty piece can only come from a quoted value that contains the
+// separator, such as one ending in "\n- ", and is dropped.
+function splitFindings(section) {
+    return section.split("\n- ").filter((item) => item !== "");
+}
+// Newer draw.io servers return structured shapes; the hosted server returns a JSON array as text.
+function readShapes(result) {
+    const structured = optionalRecord(result)?.shapes;
+    const payload = structured === undefined ? parseShapeText(readTextContent(result)[0]) : structured;
+    if (!Array.isArray(payload)) {
+        throw providerResponseError("draw.io MCP search_shapes returned an unexpected payload");
+    }
+    return payload.map(readShape);
+}
+function parseShapeText(text) {
+    if (text === undefined) {
+        throw providerResponseError("draw.io MCP search_shapes response did not include any text");
+    }
+    if (text.startsWith("No shapes found"))
+        return [];
+    return parseProviderJsonBodyText(text, {
+        emptyBody: [],
+        invalidJsonMessage: `draw.io MCP search_shapes returned an unexpected payload: ${text.slice(0, 200)}`,
+    });
+}
+function readShape(value) {
+    const shape = optionalRecord(value);
+    const style = optionalRawString(shape?.style);
+    const width = optionalNumber(shape?.w);
+    const height = optionalNumber(shape?.h);
+    if (!style || width === undefined || height === undefined) {
+        throw providerResponseError("draw.io MCP search_shapes returned a shape without a style or size");
+    }
+    return { title: optionalRawString(shape?.title) ?? "", style, width, height };
+}

package/src/providers/fastmoss_mcp/executors.js

@@ -25,7 +25,7 @@ export const proxy = defineProviderProxy({
     baseUrl: origin,
     auth: { type: "api_key_query", name: "api_key" },
     skipDnsValidation: true,
-    redirect: "error",
+    redirect: "manual",
     allowedEndpoint(value) {
         const url = new URL(value, origin);
         return (url.origin === origin &&
@@ -57,7 +57,7 @@ function connectionInput(key, fetcher, signal) {
         service: "FastMoss",
         fetcher,
         signal,
-        redirect: "error",
+        redirect: "manual",
         terminateSession: true,
         maxResponseBytes: 16 * 1024 * 1024,
     };

package/src/providers/finchina/executors.js

@@ -98,7 +98,7 @@ function mcpInput(apiKey, fetcher, signal) {
         service: "FinChina",
         headers: { "x-api-key": apiKey },
         fetcher,
-        redirect: "error",
+        redirect: "manual",
         terminateSession: true,
     };
 }

package/src/providers/framejet/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/framejet/executors.js

@@ -0,0 +1,19 @@
+import { defineApiKeyProviderExecutors, defineProviderProxy } from "../provider-runtime.js";
+import { framejetActionHandlers, framejetApiBaseUrl, framejetCaptureTimeoutMs, readFramejetError, validateFramejetApiKey, } from "./runtime.js";
+const service = "framejet";
+export const executors = defineApiKeyProviderExecutors(service, framejetActionHandlers, {
+    skipDnsValidation: true,
+});
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl: framejetApiBaseUrl,
+    auth: { type: "api_key_header", name: "X-Api-Key" },
+    readError: readFramejetError,
+    skipDnsValidation: true,
+    timeoutMs: framejetCaptureTimeoutMs,
+});
+export const credentialValidators = {
+    apiKey(input, { fetcher, signal }) {
+        return validateFramejetApiKey(input.apiKey, fetcher, signal);
+    },
+};

package/src/providers/framejet/runtime.d.ts

@@ -0,0 +1,16 @@
+import type { CredentialValidationResult } from "../../core/types.ts";
+import type { ApiKeyProviderContext, ProviderActionHandlers, ProviderFetch } from "../provider-runtime.ts";
+import { ProviderRequestError } from "../provider-runtime.ts";
+export declare const framejetApiBaseUrl = "https://framejet.dev";
+export declare const framejetCaptureTimeoutMs = 90000;
+type FramejetActionHandler = (input: Record<string, unknown>, context: ApiKeyProviderContext) => Promise<unknown>;
+export declare const framejetActionHandlers: ProviderActionHandlers<"framejet", FramejetActionHandler>;
+/**
+ * Check a key against GET /v1/me, which does not spend a screenshot.
+ */
+export declare function validateFramejetApiKey(apiKey: string, fetcher: ProviderFetch, signal?: AbortSignal): Promise<CredentialValidationResult>;
+/**
+ * Map a failed Framejet response for both actions and the proxy, so a spent quota reads the same on either path.
+ */
+export declare function readFramejetError(response: Response): Promise<ProviderRequestError>;
+export {};

package/src/providers/framejet/runtime.js

@@ -0,0 +1,148 @@
+import { createHmac } from "node:crypto";
+import { optionalIntegerOrNull, optionalRecord, optionalString } from "../../core/cast.js";
+import { readBoundedResponseBytes } from "../../core/request.js";
+import { providerInputError, providerResponseError, providerUserAgent, readProviderErrorTextBody, ProviderRequestError, requiredInputString, requiredResponseRecord, runProviderRequest, } from "../provider-runtime.js";
+export const framejetApiBaseUrl = "https://framejet.dev";
+// A capture may wait for slow pages, page steps and goal mode, so it gets more than the default budget.
+// The proxy shares this budget, since GET /v1/take is the capture endpoint on both paths.
+export const framejetCaptureTimeoutMs = 90_000;
+const framejetCaptureParams = ["format", "full_page", "width", "height", "dpr", "clean", "delay", "actions"];
+// Framejet caps each value at 200 characters, which the schema enforces, and the joined list at 1000.
+const framejetMaxValuesLength = 1000;
+export const framejetActionHandlers = {
+    take_screenshot(input, context) {
+        return takeFramejetScreenshot(input, context);
+    },
+    create_signed_url(input, context) {
+        return createFramejetSignedUrl(input, context);
+    },
+};
+/**
+ * Check a key against GET /v1/me, which does not spend a screenshot.
+ */
+export async function validateFramejetApiKey(apiKey, fetcher, signal) {
+    const key = requiredInputString(apiKey, "apiKey");
+    await runProviderRequest({ signal, label: "Framejet" }, async (requestSignal) => {
+        const response = await fetcher(new URL("/v1/me", framejetApiBaseUrl), {
+            headers: framejetHeaders(key),
+            signal: requestSignal,
+        });
+        if (!response.ok) {
+            const error = await readFramejetError(response);
+            // A rejected key is a field error on the connect form, not a reconnect prompt.
+            throw response.status === 401 || response.status === 403 ? providerInputError(error.message) : error;
+        }
+    });
+    return {
+        profile: {
+            accountId: "api_key",
+            displayName: "Framejet API Key",
+        },
+        grantedScopes: [],
+        metadata: {
+            apiBaseUrl: framejetApiBaseUrl,
+            validationEndpoint: "/v1/me",
+        },
+    };
+}
+async function takeFramejetScreenshot(input, context) {
+    const transitFiles = context.transitFiles;
+    if (!transitFiles) {
+        throw new ProviderRequestError(500, "take_screenshot requires transit file storage");
+    }
+    const query = buildFramejetQuery(input, ["goal", "values", "cache"]);
+    if ([...(query.get("values") ?? "")].length > framejetMaxValuesLength) {
+        throw providerInputError(`values must total at most ${framejetMaxValuesLength} characters, including the | separators`);
+    }
+    const url = new URL("/v1/take", framejetApiBaseUrl);
+    url.search = query.toString();
+    return runProviderRequest({ signal: context.signal, label: "Framejet", timeoutMs: framejetCaptureTimeoutMs }, async (signal) => {
+        const response = await context.fetcher(url, { headers: framejetHeaders(context.apiKey), signal });
+        if (!response.ok) {
+            throw await readFramejetError(response);
+        }
+        const bytes = await readBoundedResponseBytes(response, {
+            maxBytes: transitFiles.maxBytes,
+            fieldName: "Framejet screenshot",
+            createError: (message) => new ProviderRequestError(413, message),
+        });
+        const mimeType = response.headers.get("content-type")?.split(";")[0]?.trim() || "image/png";
+        const name = mimeType === "image/jpeg" ? "framejet-screenshot.jpg" : "framejet-screenshot.png";
+        const upload = await transitFiles.create(new File([Uint8Array.from(bytes)], name, { type: mimeType }));
+        return {
+            file: {
+                fileId: upload.fileId,
+                downloadUrl: upload.downloadUrl,
+                sizeBytes: upload.sizeBytes,
+                name: upload.name,
+                mimeType: upload.mimeType,
+            },
+            cache: response.headers.get("x-framejet-cache") === "HIT" ? "HIT" : "MISS",
+            remaining: optionalIntegerOrNull(response.headers.get("x-framejet-remaining")),
+        };
+    });
+}
+async function createFramejetSignedUrl(input, context) {
+    const signingKey = await runProviderRequest({ signal: context.signal, label: "Framejet" }, async (signal) => {
+        const response = await context.fetcher(new URL("/v1/signing-key", framejetApiBaseUrl), {
+            headers: framejetHeaders(context.apiKey),
+            signal,
+        });
+        if (!response.ok) {
+            throw await readFramejetError(response);
+        }
+        return requiredResponseRecord(await response.json(), "Framejet signing key response");
+    });
+    const keyId = optionalString(signingKey.key_id);
+    const secret = optionalString(signingKey.signing_secret);
+    if (!keyId || !secret) {
+        throw providerResponseError("Framejet signing key response is missing key_id or signing_secret");
+    }
+    const query = buildFramejetQuery(input, []);
+    query.set("key_id", keyId);
+    if (typeof input.expires_in === "number") {
+        query.set("expires", String(Math.floor(Date.now() / 1000) + input.expires_in));
+    }
+    // Framejet verifies the exact bytes before "&sig=", so sign the query string exactly as it is sent.
+    const signed = query.toString();
+    const sig = createHmac("sha256", secret).update(signed).digest("hex");
+    return { signed_url: `${framejetApiBaseUrl}/v1/take?${signed}&sig=${sig}` };
+}
+function buildFramejetQuery(input, extraParams) {
+    const query = new URLSearchParams({ url: requiredInputString(input.url, "url") });
+    for (const name of [...framejetCaptureParams, ...extraParams]) {
+        const raw = input[name];
+        const value = Array.isArray(raw) ? raw.join("|") : raw;
+        if (value === undefined || value === null || value === "") {
+            continue;
+        }
+        query.set(name, String(value));
+    }
+    return query;
+}
+function framejetHeaders(apiKey) {
+    return {
+        "user-agent": providerUserAgent,
+        "x-api-key": apiKey,
+    };
+}
+/**
+ * Map a failed Framejet response for both actions and the proxy, so a spent quota reads the same on either path.
+ */
+export async function readFramejetError(response) {
+    const text = (await readProviderErrorTextBody(response, "Framejet error response")).trim();
+    let payload;
+    try {
+        payload = optionalRecord(JSON.parse(text));
+    }
+    catch {
+        payload = undefined;
+    }
+    const message = optionalString(payload?.error) ?? (text || `Framejet request failed with status ${response.status}`);
+    const code = optionalString(payload?.code);
+    const fullMessage = code ? `${message} (${code})` : message;
+    // 402 is Framejet's monthly quota; every other status maps through the shared convention.
+    return response.status === 402
+        ? new ProviderRequestError(402, fullMessage, payload, "insufficient_credit")
+        : new ProviderRequestError(response.status, fullMessage, payload);
+}

package/src/providers/futunn/actions.d.ts

@@ -0,0 +1,2 @@
+import type { ActionDefinition } from "../../core/types.ts";
+export declare const futunnActions: ActionDefinition[];

package/src/providers/futunn/actions.js

@@ -0,0 +1,152 @@
+import { s } from "../../core/json-schema.js";
+import { defineProviderAction } from "../../core/provider-definition.js";
+import { futunnResearchActions } from "./actions.research.js";
+import { futunnTradingActions } from "./actions.trading.js";
+const symbol = s.nonEmptyString("Security code with market prefix, for example US.AAPL or HK.00700.");
+const accountId = s.nonEmptyString("Trading account ID returned by list_accounts, kept as a decimal string.", {
+    pattern: "^[0-9]+$",
+});
+const date = s.string("Date in YYYY-MM-DD format in the market timezone.", { format: "date" });
+const snapshot = s.looseObject("Market snapshot with additional category-specific fields.", {
+    code: symbol,
+    last_price: s.number("Latest traded price."),
+    update_time: s.integer("Quote update timestamp in milliseconds."),
+    volume: s.number("Trading volume in shares or contracts."),
+});
+const bar = s.looseObject("Historical candlestick with additional provider fields.", {
+    time_key: s.integer("Candlestick timestamp in milliseconds."),
+    open: s.number("Opening price."),
+    close: s.number("Closing price."),
+    high: s.number("Highest price."),
+    low: s.number("Lowest price."),
+    volume: s.number("Trading volume before applying volumePrecision."),
+});
+const tradingDay = s.looseObject("Trading day and session details.", {
+    time: date,
+    trade_date_type: s.string("Session type, such as WHOLE or MORNING."),
+    trade_second: s.integer("Total trading seconds in the session."),
+});
+const position = s.looseObject("Position details with additional provider fields.", {
+    code: symbol,
+    stock_name: s.string("Security name."),
+    qty: s.string("Position quantity as a decimal string."),
+    cost_price: s.string("Position cost price as a decimal string."),
+    cost_price_valid: s.boolean("Whether the cost price is valid."),
+    pl_val: s.string("Profit or loss as a decimal string."),
+    pl_val_valid: s.boolean("Whether the profit or loss value is valid."),
+});
+const quoteScope = ["quote:read"];
+const tradeScope = ["trade:read"];
+export const futunnActions = [
+    ...futunnResearchActions,
+    ...futunnTradingActions,
+    defineProviderAction("futunn", {
+        name: "get_market_snapshot",
+        operationType: "read",
+        description: "Get real-time market snapshots and valuation metrics for up to 400 securities.",
+        requiredScopes: quoteScope,
+        inputSchema: s.requiredObject("Securities to query.", {
+            symbols: s.array("Security codes to query.", symbol, { minItems: 1, maxItems: 400 }),
+        }),
+        outputSchema: s.requiredObject("Market snapshot results.", {
+            snapshots: s.array("Market snapshots with prices, volume, valuation and category-specific fields.", snapshot),
+        }),
+    }),
+    defineProviderAction("futunn", {
+        name: "get_history_kline",
+        operationType: "read",
+        description: "Get a page of historical candlesticks, retaining the next-page timestamp and volume precision.",
+        requiredScopes: quoteScope,
+        inputSchema: s.object("Historical candlestick query.", {
+            symbol,
+            start: date,
+            end: s.nonEmptyString("End date in YYYY-MM-DD format, or the previous nextTime converted to a string for pagination."),
+            ktype: s.withEnum(s.integer("Candlestick interval: 1=1min, 2=day, 3=week, 4=month, 5=year, 6=5min, 7=15min, 8=30min, 9=60min. Default 2."), [1, 2, 3, 4, 5, 6, 7, 8, 9]),
+            autype: s.withEnum(s.integer("Price adjustment: 0=none, 1=forward (default), 2=backward."), [0, 1, 2]),
+            num: s.integer("Number of bars requested; default and maximum 370.", {
+                minimum: 1,
+                maximum: 370,
+            }),
+            extendedTime: s.withEnum(s.integer("Extended session: 0=default, 1=US pre/after market, 2=US overnight."), [0, 1, 2]),
+        }, { optional: ["start", "ktype", "autype", "num", "extendedTime"] }),
+        outputSchema: s.requiredObject("Historical candlesticks and pagination metadata.", {
+            bars: s.array("Historical candlesticks in upstream order.", bar),
+            nextTime: s.nullable(s.integer("Next page end timestamp in milliseconds, or null when absent.")),
+            volumePrecision: s.nullable(s.integer("Divide bar volumes by 10 to this power; null when the provider omits precision.")),
+        }),
+    }),
+    defineProviderAction("futunn", {
+        name: "list_trading_days",
+        operationType: "read",
+        description: "List trading days for a market within an inclusive date range.",
+        requiredScopes: quoteScope,
+        inputSchema: s.requiredObject("Market and date range.", {
+            market: s.stringEnum("Market to query.", [
+                "HK",
+                "US",
+                "SH",
+                "SZ",
+                "BJ",
+                "SG",
+                "JP",
+                "KR",
+                "CA",
+                "AU",
+                "JP_FUTURE",
+                "SG_FUTURE",
+            ]),
+            start: date,
+            end: date,
+        }),
+        outputSchema: s.requiredObject("Trading calendar results.", {
+            tradingDays: s.array("Trading dates with session type and trading seconds.", tradingDay),
+        }),
+    }),
+    defineProviderAction("futunn", {
+        name: "list_accounts",
+        operationType: "read",
+        description: "List trading accounts authorized by the connected user.",
+        requiredScopes: tradeScope,
+        inputSchema: s.requiredObject("Authorized account query.", {}),
+        outputSchema: s.requiredObject("Authorized trading accounts.", {
+            accounts: s.array("Authorized accounts; numeric account_id values are returned as lossless decimal strings.", s.looseObject("Authorized account details.", {
+                account_id: s.string("Trading account ID as a lossless decimal string."),
+                security_firm: s.string("Broker identifier."),
+                acc_type: s.string("Account type, such as cash or margin."),
+            })),
+        }),
+    }),
+    defineProviderAction("futunn", {
+        name: "get_account_funds",
+        operationType: "read",
+        description: "Get account assets, cash, buying power and margin balances in the requested currency.",
+        requiredScopes: tradeScope,
+        inputSchema: s.requiredObject("Account funds query.", {
+            accountId,
+            currency: s.nonEmptyString("Display currency, for example USD or HKD; ignored by account types that do not support conversion."),
+        }),
+        outputSchema: s.requiredObject("Account fund balances.", {
+            funds: s.looseObject("Account balances; monetary amounts retain upstream decimal strings.", {
+                total_assets: s.string("Total net assets."),
+                cash: s.string("Cash balance."),
+                power: s.string("Maximum buying power."),
+                currency: s.string("Display currency."),
+            }),
+        }),
+    }),
+    defineProviderAction("futunn", {
+        name: "list_positions",
+        operationType: "read",
+        description: "List account positions, optionally filtered by security code and profit/loss ratio.",
+        requiredScopes: tradeScope,
+        inputSchema: s.object("Account position query.", {
+            accountId,
+            code: symbol,
+            plRatioMin: s.string("Minimum profit/loss percentage as a decimal string, for example 10."),
+            plRatioMax: s.string("Maximum profit/loss percentage as a decimal string, for example 20."),
+        }, { optional: ["code", "plRatioMin", "plRatioMax"] }),
+        outputSchema: s.requiredObject("Account position results.", {
+            positions: s.array("Positions with upstream quantities, prices and profit/loss decimal strings.", position),
+        }),
+    }),
+];

package/src/providers/futunn/actions.research.d.ts

@@ -0,0 +1,2 @@
+import type { ActionDefinition } from "../../core/types.ts";
+export declare const futunnResearchActions: readonly ActionDefinition[];