futu_mcp/handlers/

trade_write.rs

//! 交易写 handler：place / modify / cancel / reconfirm
//!
//! 本模块的函数本身不做权限检查；调用前由 tools.rs 根据 ServerState 的
//! `enable_trading` / `allow_real_trading` 做前置守卫。

use std::sync::Arc;

use anyhow::{Result, bail};
use futu_core::account_locator;
use futu_net::client::FutuClient;
use futu_trd::types::{
    ModifyOrderOp, ModifyOrderParams, OrderType, PlaceOrderParams, TrdEnv, TrdHeader, TrdMarket,
    TrdSide,
};
use serde::Serialize;

/// v1.4.105 D12 (Phase 2): pure fn — 给定 (account list, card_num) 返 matched
/// acc_id Vec. 与 daemon `TrdCache::find_acc_ids_by_card_num` 行为等价.
///
/// 4 位 → 末尾 suffix match (card_num + uni_card_num 都看)
/// 16 位 → 完整 equal match
/// 其他 → 空 Vec (caller 应已 validate; 此处容错)
///
/// 返 sorted + deduped Vec.
///
/// **v1.4.106 codex round 2 F1 case 2 (P1) fix**: 加 `caller_allowed_acc_ids`
/// snapshot 参数. caller 受限 key (`allowed_acc_ids = Some(set)`) 时, match
/// 结果先按 snapshot 交集过滤 — 不在 snapshot 中的 acc_id 视作"对该 caller 不
/// 存在", 防 enumeration via 1-match/0-match/N-match timing 差异.
///
/// `None` (full key) → 不做交集过滤 (向后兼容老 master key 行为).
/// `Some(set)` 空集 → 与 `KeyRecord` / `Limits` contract 一致，视同不限制；
/// deny-all 使用 fail-closed sentinel `{0}`。
pub(crate) fn match_card_num_in_accounts(
    accs: &[futu_trd::account::TrdAcc],
    card_num: &str,
    caller_allowed_acc_ids: Option<&std::collections::HashSet<u64>>,
) -> Vec<u64> {
    account_locator::match_card_num_in_records(accs, card_num, caller_allowed_acc_ids)
        .unwrap_or_default()
}

/// v1.4.105 D12 (Phase 2): client-side card_num → acc_id resolution via daemon
/// GetAccList RPC. 调用 [`match_card_num_in_accounts`] 做 string match.
///
/// 返 Result<u64, String> — Err 是 user-facing message (tool_err 直接 wrap).
/// - empty / non-digit / 长度非 4/16 → format error (前置 check)
/// - 0 match → "card_num not found in account list"
/// - 多 match → "card_num matched N accounts (ambiguous)"
/// - 1 match → Ok(acc_id)
///
/// **v1.4.106 codex round 2 F1 case 2 (P1) fix**: 加 `caller_allowed_acc_ids`
/// snapshot 参数. 受限 key 调用时, match 仅在 snapshot 内做 — 不在 snapshot
/// 的 acc_id 视作"对该 caller 不存在", 防 timing-based enumeration 跨 key.
///
/// **error message 设计**: 受限 key 看到的 "0 match" 不告诉用户 daemon 总
/// 账户数 (即 `accs.len()`), 改告 caller-visible 账户数 (即 snapshot size).
/// 防 daemon-level account count leak.
pub async fn resolve_card_num_via_get_acc_list(
    client: &Arc<FutuClient>,
    card_num: &str,
    caller_allowed_acc_ids: Option<&std::collections::HashSet<u64>>,
) -> std::result::Result<u64, String> {
    let trimmed = match account_locator::validate_card_num_query(card_num) {
        Ok(v) => v,
        Err(e) => {
            return Err(format!(
                "card_num 格式无效 — 必须 4 位末尾 (App 显示) 或 16 位完整, 纯数字; got len={}",
                e.len()
            ));
        }
    };
    let accs = futu_trd::account::get_acc_list_for_account_discovery(client)
        .await
        .map_err(|e| format!("get_acc_list (resolve card_num) failed: {e}"))?;
    let matches = match_card_num_in_accounts(&accs, trimmed, caller_allowed_acc_ids);
    // 受限 key 的 caller-visible 账户数 = snapshot ∩ daemon-known.
    // 用于 0-match 错误信息, 不暴露 daemon 总账户数.
    let visible_count = accs
        .iter()
        .filter(|a| account_locator::acc_id_visible_to_caller(a.acc_id, caller_allowed_acc_ids))
        .count();
    match account_locator::CardNumResolution::from_acc_ids(matches) {
        account_locator::CardNumResolution::NotFound => Err(format!(
            "card_num '{}' 找不到对应账户 (你这个 key 可见 {} 个账户). 检查 daemon 是否登录正确平台 (futunn vs moomoo) + card_num 是否正确 + key 的 allowed_acc_ids 配置",
            account_locator::redact_card_num(trimmed),
            visible_count
        )),
        account_locator::CardNumResolution::Resolved(only) => Ok(only),
        account_locator::CardNumResolution::Ambiguous(many) => Err(format!(
            "card_num '{}' 匹配 {} 个账户 (ambiguous) — 4 位 suffix 在多账户下可能碰撞. 改用 16 位完整卡号 (`futu_list_accounts` 查 card_num 字段)或直接传 acc_id",
            account_locator::redact_card_num(trimmed),
            many.len()
        )),
    }
}

/// v1.4.105 D12 (Phase 2): 解析 acc_id from (acc_id, card_num) 二选一输入.
///
/// 行为契约 (与 REST `extract_and_resolve_card_num_into_acc_id` 等价语义):
/// - acc_id != 0 + card_num=None → 用 acc_id (兼容老 client)
/// - acc_id == 0 + card_num=Some → resolve via GetAccList
/// - acc_id == 0 + card_num=None → reject (二选一必填)
/// - acc_id != 0 + card_num=Some → resolve, 校验一致 (resolved == acc_id), 不一致 reject
///
/// **v1.4.105 D12 contract-hardening 补丁** (用户审查后要求): 加 `allowed_card_nums`
/// 参数. caller key 配 `allowed_card_nums` 非空时, user 传 card_num 字符串
/// 必须 ∈ 白名单 (string-level reject before resolve). 不在 → Err (loud,
/// "你这个 key 不允许 card_num X").
///
/// 与 REST `extract_and_resolve_card_num_into_acc_id_with_resolver` 行为对称.
///
/// **v1.4.106 codex round 2 F1 case 2 (P1) fix**: 加 `caller_allowed_acc_ids`
/// snapshot 参数. 受限 key 调用时, daemon GetAccList 返回的账户列表先按
/// snapshot 交集过滤 — 不在 snapshot 的 acc_id 视作"对该 caller 不存在".
/// 防 enumeration: 受限 key 用 4-digit suffix 探测其他用户卡号时, 0-match /
/// 1-match / N-match timing 不再泄漏 daemon-level 账户存在性.
///
/// **`caller_allowed_acc_ids` 语义**:
/// - `None`: full key (master 模式 / scope 关 / KeyRecord.allowed_acc_ids None)
///   → 不做交集过滤, 行为同 v1.4.105
/// - `Some(empty)`: 与 KeyRecord / Limits contract 一致, 等价不限制
/// - `Some(non_empty_set)`: 受限 key, match 仅在 set 内做
pub async fn resolve_acc_id_with_card_num(
    client: &Arc<FutuClient>,
    acc_id: u64,
    card_num: Option<&str>,
    allowed_card_nums: Option<&[String]>,
    caller_allowed_acc_ids: Option<&std::collections::HashSet<u64>>,
) -> std::result::Result<u64, String> {
    match card_num {
        None => {
            if acc_id == 0 {
                Err(
                    "either acc_id or card_num is required — pass acc_id (call futu_list_accounts to discover) or card_num (4-digit App suffix or 16-digit full)".to_string(),
                )
            } else {
                Ok(acc_id)
            }
        }
        Some(cn) => {
            // v1.4.105 D12 contract-hardening 补丁: string-level allowed_card_nums
            // whitelist 校验 (resolve 前). 跟 REST 端 helper 行为对称, 跟
            // KeyStore::expand 路径互补 (后者 acc_id-level silent enforce).
            if let Some(allowed) = allowed_card_nums
                && !allowed.is_empty()
            {
                let trimmed = cn.trim();
                if !account_locator::card_num_allowed_by_whitelist(trimmed, allowed) {
                    return Err(
                        "card_num 不在你这个 API key 的 allowed_card_nums 白名单里. \
                         检查 keys.json 你的 key 配置, 或改用 acc_id 直接传."
                            .to_string(),
                    );
                }
            }
            let resolved =
                resolve_card_num_via_get_acc_list(client, cn, caller_allowed_acc_ids).await?;
            if acc_id == 0 || acc_id == resolved {
                Ok(resolved)
            } else {
                Err(format!(
                    "acc_id ({acc_id}) and card_num resolution ({resolved}) mismatch — pass only one or ensure they reference the same account"
                ))
            }
        }
    }
}

// ========== 枚举解析（复用只读 handler 的字符串约定） ==========

pub fn parse_trd_market(s: &str) -> Result<TrdMarket> {
    // v1.4.93/v1.4.111: 对齐 `Trd_Common.proto::TrdMarket` 官方非 fund 值。
    //
    // v1.4.102/v1.4.111 — write path 拒 fund markets:
    // fund market view-only 真机 verify 仅覆盖 read endpoint. 写路径
    // (place/modify/cancel order) 接 fund market → 风险: 用户 fund 账户当主账户
    // 下单 → backend silent 误路由 / 错误覆盖. read path 仍接 113/123 (见
    // `crates/futu-mcp/src/handlers/trade.rs::parse_trd_market`).
    let trimmed = s.trim();
    let upper = trimmed.to_ascii_uppercase();
    let m = match upper.as_str() {
        "HK" | "1" => TrdMarket::HK,
        "US" | "2" => TrdMarket::US,
        "CN" | "3" => TrdMarket::CN,
        "HKCC" | "4" => TrdMarket::HKCC,
        "FUTURES" | "5" => TrdMarket::Futures,
        "SG" | "6" => TrdMarket::SG,
        "CRYPTO" | "7" => TrdMarket::Crypto,
        "AU" | "8" => TrdMarket::AU,
        "FUTURES_SIMULATE_HK" | "FUTURESSIMULATEHK" | "10" => TrdMarket::FuturesSimulateHK,
        "FUTURES_SIMULATE_US" | "FUTURESSIMULATEUS" | "11" => TrdMarket::FuturesSimulateUS,
        "FUTURES_SIMULATE_SG" | "FUTURESSIMULATESG" | "12" => TrdMarket::FuturesSimulateSG,
        "FUTURES_SIMULATE_JP" | "FUTURESSIMULATEJP" | "13" => TrdMarket::FuturesSimulateJP,
        "JP" | "15" => TrdMarket::JP,
        "MY" | "111" => TrdMarket::MY,
        "CA" | "112" => TrdMarket::CA,
        "HKFUND" | "HK_FUND" | "113" => return bail_fund_market("HKFund"),
        "USFUND" | "US_FUND" | "123" => return bail_fund_market("USFund"),
        "SGFUND" | "SG_FUND" | "124" => return bail_fund_market("SGFund"),
        "MYFUND" | "MY_FUND" | "125" => return bail_fund_market("MYFund"),
        "JPFUND" | "JP_FUND" | "126" => return bail_fund_market("JPFund"),
        other => bail!(
            "unknown trd market {other:?} \
             (write path 接 HK|US|CN|HKCC|FUTURES|SG|CRYPTO|AU|FUTURES_SIMULATE_HK|\
             FUTURES_SIMULATE_US|FUTURES_SIMULATE_SG|FUTURES_SIMULATE_JP|JP|MY|CA \
             or official non-fund TrdMarket int). fund markets 仅 read path 支持."
        ),
    };
    Ok(m)
}

fn bail_fund_market(label: &'static str) -> Result<TrdMarket> {
    bail!(
        "trd market {label} 仅支持 view-only read endpoints \
         (positions/funds/cash-log/history-orders/history-fills); write 路径 \
         (place_order/modify_order/cancel_order) 用对应主市场, daemon 自动按 \
         持仓 broker 路由. v1.4.102 audit 26 F1 fix"
    )
}

pub fn parse_trd_env(s: &str) -> Result<TrdEnv> {
    let e = match s.trim().to_ascii_lowercase().as_str() {
        "simulate" | "sim" => TrdEnv::Simulate,
        "real" => TrdEnv::Real,
        other => bail!("unknown trd env {other:?} (real|simulate)"),
    };
    Ok(e)
}

pub fn parse_trd_side(s: &str) -> Result<TrdSide> {
    let v = match s.trim().to_ascii_uppercase().as_str() {
        "BUY" => TrdSide::Buy,
        "SELL" => TrdSide::Sell,
        "SELL_SHORT" | "SHORT" => TrdSide::SellShort,
        "BUY_BACK" | "COVER" => TrdSide::BuyBack,
        other => bail!("unknown trd side {other:?} (BUY|SELL|SELL_SHORT|BUY_BACK)"),
    };
    Ok(v)
}

pub fn parse_order_type(s: &str) -> Result<OrderType> {
    // v1.4.93 BUG-001 fix (S level ship-blocker): 17 variants 对齐
    // `Trd_Common.proto::OrderType` + MCP schema + futu-trd::types::OrderType 完整 enum.
    // v1.4.53 条件单 (Stop/StopLimit/MIT/LIT/TrailingStop*) + v1.4.85 algo
    // (TWAP/VWAP) 在 v1.4.86-90 schema-only 时挂. backend `map_order_type`
    // (futu-gateway/src/handlers/trd/place_order.rs) 已支持全 17.
    let trimmed = s.trim();
    let upper = trimmed.to_ascii_uppercase();
    let v = match upper.as_str() {
        "NORMAL" | "LIMIT" | "1" => OrderType::Normal,
        "MARKET" | "2" => OrderType::Market,
        "ABSOLUTE_LIMIT" | "ABSOLUTELIMIT" | "5" => OrderType::AbsoluteLimit,
        "AUCTION" | "6" => OrderType::Auction,
        "AUCTION_LIMIT" | "AUCTIONLIMIT" | "7" => OrderType::AuctionLimit,
        "SPECIAL_LIMIT" | "SPECIALLIMIT" | "8" => OrderType::SpecialLimit,
        "SPECIAL_LIMIT_ALL" | "SPECIALLIMITALL" | "9" => OrderType::SpecialLimitAll,
        // v1.4.53 F1 条件单 (10-15)
        "STOP" | "10" => OrderType::Stop,
        "STOP_LIMIT" | "STOP-LIMIT" | "STOPLIMIT" | "11" => OrderType::StopLimit,
        "MIT" | "MARKET_IF_TOUCHED" | "MARKETIFTOUCHED" | "12" => OrderType::MarketifTouched,
        "LIT" | "LIMIT_IF_TOUCHED" | "LIMITIFTOUCHED" | "13" => OrderType::LimitifTouched,
        "TRAIL" | "TRAILING_STOP" | "TRAILING-STOP" | "TRAILINGSTOP" | "14" => {
            OrderType::TrailingStop
        }
        "TRAIL_LIMIT" | "TRAILING_STOP_LIMIT" | "TRAILINGSTOPLIMIT" | "15" => {
            OrderType::TrailingStopLimit
        }
        // v1.4.85 algo (16-19)
        "TWAP_MARKET" | "TWAPMARKET" | "16" => OrderType::TwapMarket,
        "TWAP_LIMIT" | "TWAPLIMIT" | "17" => OrderType::TwapLimit,
        "VWAP_MARKET" | "VWAPMARKET" | "18" => OrderType::VwapMarket,
        "VWAP_LIMIT" | "VWAPLIMIT" | "19" => OrderType::VwapLimit,
        other => bail!(
            "unknown order type {other:?} \
             (NORMAL|MARKET|ABSOLUTE_LIMIT|AUCTION|AUCTION_LIMIT|\
             SPECIAL_LIMIT|SPECIAL_LIMIT_ALL|STOP|STOP_LIMIT|MIT|LIT|\
             TRAILING_STOP|TRAILING_STOP_LIMIT|TWAP_MARKET|TWAP_LIMIT|\
             VWAP_MARKET|VWAP_LIMIT \
             or int 1/2/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19 per Trd_Common.proto)"
        ),
    };
    Ok(v)
}

pub fn parse_modify_op(s: &str) -> Result<ModifyOrderOp> {
    let v = match s.trim().to_ascii_uppercase().as_str() {
        "NORMAL" | "MODIFY" => ModifyOrderOp::Normal,
        "CANCEL" => ModifyOrderOp::Cancel,
        "DISABLE" => ModifyOrderOp::Disable,
        "ENABLE" => ModifyOrderOp::Enable,
        "DELETE" => ModifyOrderOp::Delete,
        other => bail!("unknown modify op {other:?} (NORMAL|CANCEL|DISABLE|ENABLE|DELETE)"),
    };
    Ok(v)
}

fn build_header(
    env: &str,
    acc_id: u64,
    market: &str,
    jp_acc_type: Option<i32>,
) -> Result<TrdHeader> {
    Ok(TrdHeader {
        trd_env: parse_trd_env(env)?,
        acc_id,
        trd_market: parse_trd_market(market)?,
        jp_acc_type,
    })
}

// ========== place ==========

#[derive(Serialize)]
struct PlaceOut {
    order_id: u64,
    env: &'static str,
    market: String,
    acc_id: u64,
    side: String,
    order_type: String,
    code: String,
    qty: f64,
    price: Option<f64>,
}

pub struct PlaceOrderInput<'a> {
    pub env: &'a str,
    pub acc_id: u64,
    pub market: &'a str,
    pub side: &'a str,
    pub order_type: &'a str,
    pub code: &'a str,
    pub qty: f64,
    pub price: Option<f64>,
    pub jp_acc_type: Option<i32>,
    pub idempotency_key: Option<String>,
    // v1.4.53 F1 条件单
    pub stop_price: Option<f64>,
    pub trail_type: Option<i32>,
    pub trail_value: Option<f64>,
    pub trail_spread: Option<f64>,
}

pub async fn place_order(client: &Arc<FutuClient>, input: PlaceOrderInput<'_>) -> Result<String> {
    let header = build_header(input.env, input.acc_id, input.market, input.jp_acc_type)?;
    let trd_side = parse_trd_side(input.side)?;
    let ord_type = parse_order_type(input.order_type)?;

    let params = PlaceOrderParams {
        header: header.clone(),
        trd_side,
        order_type: ord_type,
        code: input.code.to_string(),
        qty: input.qty,
        price: input.price,
        adjust_price: None,
        adjust_side_and_limit: None,
        idempotency_key: input.idempotency_key,
        // v1.4.53 F1 条件单：透传 stop_price / trail_* 到 futu_trd
        aux_price: input.stop_price,
        trail_type: input.trail_type,
        trail_value: input.trail_value,
        trail_spread: input.trail_spread,
    };
    let res = futu_trd::order::place_order(client, &params).await?;

    let out = PlaceOut {
        order_id: res.order_id,
        env: match header.trd_env {
            TrdEnv::Simulate => "simulate",
            TrdEnv::Real => "real",
            _ => "unknown",
        },
        market: input.market.to_ascii_uppercase(),
        acc_id: input.acc_id,
        side: input.side.to_ascii_uppercase(),
        order_type: input.order_type.to_ascii_uppercase(),
        code: input.code.to_string(),
        qty: input.qty,
        price: input.price,
    };
    Ok(serde_json::to_string_pretty(&out)?)
}

// ========== modify ==========

#[derive(Serialize)]
struct ModifyOut {
    order_id: u64,
    op: String,
    env: &'static str,
    qty: Option<f64>,
    price: Option<f64>,
}

pub struct ModifyOrderInput<'a> {
    pub env: &'a str,
    pub acc_id: u64,
    pub market: &'a str,
    pub order_id: &'a str,
    pub op: &'a str,
    pub qty: Option<f64>,
    pub price: Option<f64>,
    pub jp_acc_type: Option<i32>,
    pub idempotency_key: Option<String>,
}

struct ResolvedOrderIdArg {
    order_id: u64,
    order_id_ex: Option<String>,
}

fn resolve_order_id_arg(raw: &str) -> Result<ResolvedOrderIdArg> {
    let trimmed = raw.trim();
    if trimmed.is_empty() {
        bail!("order_id must not be empty");
    }

    // C++ APIServer_Trd_ModifyOrder.cpp hashes orderIDEx into orderID before
    // local lookup/validation; clients may pass either numeric orderID or FU/FH
    // orderIDEx.
    if trimmed.bytes().all(|b| b.is_ascii_digit()) {
        return Ok(ResolvedOrderIdArg {
            order_id: trimmed.parse::<u64>()?,
            order_id_ex: None,
        });
    }

    Ok(ResolvedOrderIdArg {
        order_id: 0,
        order_id_ex: Some(trimmed.to_string()),
    })
}

fn parse_numeric_order_id_arg(raw: &str, field: &str) -> Result<u64> {
    let trimmed = raw.trim();
    if trimmed.is_empty() {
        bail!("{field} must not be empty");
    }
    if !trimmed.bytes().all(|b| b.is_ascii_digit()) {
        bail!(
            "{field} for futu_reconfirm_order must be numeric FTAPI order_id; \
             orderIDEx is not supported by Trd_ReconfirmOrder"
        );
    }
    Ok(trimmed.parse::<u64>()?)
}

pub async fn modify_order(client: &Arc<FutuClient>, input: ModifyOrderInput<'_>) -> Result<String> {
    let header = build_header(input.env, input.acc_id, input.market, input.jp_acc_type)?;
    let mop = parse_modify_op(input.op)?;
    let resolved_order_id = resolve_order_id_arg(input.order_id)?;

    let params = ModifyOrderParams {
        header: header.clone(),
        order_id: resolved_order_id.order_id,
        order_id_ex: resolved_order_id.order_id_ex,
        modify_order_op: mop,
        qty: input.qty,
        price: input.price,
        for_all: None,
        idempotency_key: input.idempotency_key,
    };
    let returned_id = futu_trd::order::modify_order(client, &params).await?;

    let out = ModifyOut {
        order_id: returned_id,
        op: input.op.to_ascii_uppercase(),
        env: match header.trd_env {
            TrdEnv::Simulate => "simulate",
            TrdEnv::Real => "real",
            _ => "unknown",
        },
        qty: input.qty,
        price: input.price,
    };
    Ok(serde_json::to_string_pretty(&out)?)
}

// ========== cancel ==========

#[derive(Serialize)]
struct CancelOut {
    order_id: u64,
    op: &'static str,
    env: &'static str,
}

pub async fn cancel_order(
    client: &Arc<FutuClient>,
    env: &str,
    acc_id: u64,
    market: &str,
    order_id: &str,
    jp_acc_type: Option<i32>,
    idempotency_key: Option<String>,
) -> Result<String> {
    let header = build_header(env, acc_id, market, jp_acc_type)?;
    let resolved_order_id = resolve_order_id_arg(order_id)?;
    // v1.4.39: cancel_order 本质是 modify_order 的 shortcut。走 modify_order 路径
    // 以支持 idempotency_key（`futu_trd::order::cancel_order` helper 不接 key）。
    let params = ModifyOrderParams {
        header: header.clone(),
        order_id: resolved_order_id.order_id,
        order_id_ex: resolved_order_id.order_id_ex,
        modify_order_op: futu_trd::types::ModifyOrderOp::Cancel,
        qty: None,
        price: None,
        for_all: None,
        idempotency_key,
    };
    let returned_id = futu_trd::order::modify_order(client, &params).await?;
    let out = CancelOut {
        order_id: returned_id,
        op: "CANCEL",
        env: match header.trd_env {
            TrdEnv::Simulate => "simulate",
            TrdEnv::Real => "real",
            _ => "unknown",
        },
    };
    Ok(serde_json::to_string_pretty(&out)?)
}

// ========== reconfirm ==========

#[derive(Serialize)]
struct ReconfirmOut {
    order_id: u64,
    reason: i32,
    env: &'static str,
}

pub struct ReconfirmOrderInput<'a> {
    pub env: &'a str,
    pub acc_id: u64,
    pub market: &'a str,
    pub order_id: &'a str,
    pub reason: i32,
    pub jp_acc_type: Option<i32>,
}

pub async fn reconfirm_order(
    client: &Arc<FutuClient>,
    input: ReconfirmOrderInput<'_>,
) -> Result<String> {
    let header = build_header(input.env, input.acc_id, input.market, input.jp_acc_type)?;
    let order_id = parse_numeric_order_id_arg(input.order_id, "order_id")?;
    let returned_id =
        futu_trd::misc::reconfirm_order(client, &header, order_id, input.reason).await?;
    let out = ReconfirmOut {
        order_id: returned_id,
        reason: input.reason,
        env: match header.trd_env {
            TrdEnv::Simulate => "simulate",
            TrdEnv::Real => "real",
            _ => "unknown",
        },
    };
    Ok(serde_json::to_string_pretty(&out)?)
}

#[derive(Serialize)]
struct CancelAllOut {
    op: &'static str,
    env: &'static str,
    acc_id: u64,
    market: String,
}

/// 全部撤单。内部用 ModifyOrder proto 带 for_all=true + op=Cancel + order_id=0。
/// 风险提示：立即撤销该账户**指定市场**（market 空时全账户）所有 pending
/// 订单，不可恢复。
pub async fn cancel_all_order(
    client: &Arc<FutuClient>,
    env: &str,
    acc_id: u64,
    market: &str,
) -> Result<String> {
    let header = build_header(env, acc_id, market, None)?;
    let params = ModifyOrderParams {
        header: header.clone(),
        order_id: 0,
        order_id_ex: None,
        modify_order_op: ModifyOrderOp::Cancel,
        qty: None,
        price: None,
        for_all: Some(true),
        idempotency_key: None,
    };
    futu_trd::order::modify_order(client, &params).await?;
    let out = CancelAllOut {
        op: "CANCEL_ALL",
        env: match header.trd_env {
            TrdEnv::Simulate => "simulate",
            TrdEnv::Real => "real",
            _ => "unknown",
        },
        acc_id,
        market: market.to_string(),
    };
    Ok(serde_json::to_string_pretty(&out)?)
}

// ========== 环境守卫 ==========

/// 判断给定的 env 字符串是否指向真实环境。
pub fn is_real_env(env: &str) -> bool {
    matches!(env.trim().to_ascii_lowercase().as_str(), "real")
}

// ========== v1.4.93 BUG-001 Tests (runtime parser 9 + 17) ==========

#[cfg(test)]
mod tests;