feat: foreign flow (idx stocks flow, get_foreign_flow)

`idx stocks flow SYMBOL` shows what foreign investors bought and sold of a
stock, session by session, from IDX's own daily trading summary: foreign
buy, sell and net volume, net value at the session's average price, and
the share of value traded outside the regular board, with range totals.
Latest 10 sessions by default (--days, at most 60) or --from/--to. The MCP
server exposes it as get_foreign_flow.

- api/idx: pure parser for GetStockSummary (rows dated another session
  are dropped) and a provider over curl-impersonate's profile fallback
  with a 30 s limit; Cloudflare passes only some fingerprints.
- flow: each session is cached whole by date, so other stocks' flows for
  the same sessions need no request. Weekends are never requested.
- Idx::idx_code is shared by broker and flow for the .JK-only check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

crates/idx-core/src/api/idx/mod.rs

@@ -0,0 +1,73 @@
+//! IDX's own site: the daily trading summary of every listed stock.
+//!
+//! `GET https://www.idx.co.id/primary/TradingSummary/GetStockSummary`
+//! `?length=9999&start=0&date=YYYYMMDD` answers JSON with one row per stock:
+//! prices, volume and value, foreign buy and sell volume, and non-regular
+//! (negotiated and cash) volume and value. A day without trading has no
+//! rows. Cloudflare in front of the site rejects some TLS fingerprints, so
+//! the request goes through curl-impersonate's profile fallback.
+
+mod parse;
+
+use chrono::NaiveDate;
+pub use parse::parse_stock_summary;
+
+use super::TradingSummaryProvider;
+use crate::curl_impersonate;
+use crate::error::IdxError;
+use crate::flow::types::StockDay;
+
+const STOCK_SUMMARY_URL: &str = "https://www.idx.co.id/primary/TradingSummary/GetStockSummary";
+const USER_AGENT: &str = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15";
+/// One session's summary is about 650 KB; it must not hold a command or an
+/// MCP call for long.
+const MAX_TIME_SECS: &str = "30";
+
+pub fn stock_summary_url(date: NaiveDate) -> String {
+    format!(
+        "{STOCK_SUMMARY_URL}?length=9999&start=0&date={}",
+        date.format("%Y%m%d")
+    )
+}
+
+/// A Cloudflare challenge page is not the JSON asked for: try the next
+/// profile.
+fn accept_json(body: &[u8]) -> Result<(), IdxError> {
+    match body.iter().find(|byte| !byte.is_ascii_whitespace()) {
+        Some(b'{') => Ok(()),
+        _ => Err(IdxError::Http(
+            "IDX stock summary: answered a challenge page instead of JSON (HTTP 403)".to_string(),
+        )),
+    }
+}
+
+pub struct IdxSiteProvider;
+
+impl TradingSummaryProvider for IdxSiteProvider {
+    fn stock_summary(&self, date: NaiveDate) -> Result<Vec<StockDay>, IdxError> {
+        let args: Vec<String> = [
+            "--silent",
+            "--show-error",
+            "--location",
+            "--fail",
+            "--compressed",
+            "--max-time",
+            MAX_TIME_SECS,
+            "--header",
+            &format!("User-Agent: {USER_AGENT}"),
+            "--header",
+            "Accept: application/json,text/plain,*/*",
+            "--header",
+            "Referer: https://www.idx.co.id/id/data-pasar/ringkasan-perdagangan/ringkasan-saham/",
+            &stock_summary_url(date),
+        ]
+        .iter()
+        .map(|arg| arg.to_string())
+        .collect();
+        let output =
+            curl_impersonate::run_owned_with_fallback("IDX stock summary", &args, &accept_json)?;
+        let body = String::from_utf8(output.stdout)
+            .map_err(|e| IdxError::Http(format!("IDX stock summary: not UTF-8: {e}")))?;
+        parse_stock_summary(&body, date)
+    }
+}

crates/idx-core/src/api/idx/parse.rs

@@ -0,0 +1,114 @@
+//! Pure parser for IDX's `GetStockSummary` JSON, tested against
+//! `tests/fixtures/idx_stocksummary_*.json`.
+
+use chrono::NaiveDate;
+use serde::Deserialize;
+
+use crate::error::IdxError;
+use crate::flow::types::StockDay;
+
+#[derive(Deserialize)]
+struct StockSummaryResponse {
+    data: Vec<StockSummaryRawRow>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct StockSummaryRawRow {
+    date: String,
+    stock_code: String,
+    previous: Option<f64>,
+    high: Option<f64>,
+    low: Option<f64>,
+    close: Option<f64>,
+    volume: Option<f64>,
+    value: Option<f64>,
+    frequency: Option<f64>,
+    foreign_buy: Option<f64>,
+    foreign_sell: Option<f64>,
+    non_regular_volume: Option<f64>,
+    non_regular_value: Option<f64>,
+}
+
+fn whole(value: Option<f64>) -> Option<i64> {
+    value
+        .filter(|value| value.is_finite())
+        .map(|value| value.round() as i64)
+}
+
+/// The rows of one session. A day without trading (weekend, holiday) is
+/// empty; rows dated other than `date` are dropped, so another session's
+/// figures never pass as this one's.
+pub fn parse_stock_summary(raw: &str, date: NaiveDate) -> Result<Vec<StockDay>, IdxError> {
+    let response: StockSummaryResponse = serde_json::from_str(raw)
+        .map_err(|e| IdxError::ParseError(format!("idx stock summary: {e}")))?;
+    Ok(response
+        .data
+        .into_iter()
+        .filter(|row| {
+            row.date
+                .get(..10)
+                .and_then(|day| NaiveDate::parse_from_str(day, "%Y-%m-%d").ok())
+                == Some(date)
+        })
+        .map(|row| StockDay {
+            code: row.stock_code.trim().to_ascii_uppercase(),
+            date,
+            previous: whole(row.previous),
+            high: whole(row.high),
+            low: whole(row.low),
+            close: whole(row.close),
+            volume: whole(row.volume),
+            value: whole(row.value),
+            frequency: whole(row.frequency),
+            foreign_buy: whole(row.foreign_buy),
+            foreign_sell: whole(row.foreign_sell),
+            non_regular_volume: whole(row.non_regular_volume),
+            non_regular_value: whole(row.non_regular_value),
+        })
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DAY: &str = include_str!("../../../tests/fixtures/idx_stocksummary_20261016.json");
+    const SATURDAY: &str = include_str!("../../../tests/fixtures/idx_stocksummary_20261017.json");
+
+    fn date(y: i32, m: u32, d: u32) -> NaiveDate {
+        NaiveDate::from_ymd_opt(y, m, d).unwrap()
+    }
+
+    #[test]
+    fn test_parse_stock_summary_reads_foreign_and_non_regular_figures() {
+        let rows = parse_stock_summary(DAY, date(2026, 10, 16)).unwrap();
+        let bbca = rows.iter().find(|row| row.code == "BBCA").unwrap();
+        assert_eq!((bbca.previous, bbca.close), (Some(6075), Some(5175)));
+        assert_eq!(bbca.volume, Some(1_241_098_200));
+        assert_eq!(bbca.value, Some(6_474_934_315_000));
+        assert_eq!(
+            (bbca.foreign_buy, bbca.foreign_sell),
+            (Some(309_392_800), Some(757_227_900))
+        );
+        assert_eq!(bbca.non_regular_value, Some(100_183_151_475));
+    }
+
+    #[test]
+    fn test_parse_stock_summary_keeps_only_the_requested_session() {
+        assert!(
+            parse_stock_summary(SATURDAY, date(2026, 10, 17))
+                .unwrap()
+                .is_empty()
+        );
+        assert!(
+            parse_stock_summary(DAY, date(2026, 10, 15))
+                .unwrap()
+                .is_empty()
+        );
+        assert!(matches!(
+            parse_stock_summary("<html>Just a moment...</html>", date(2026, 10, 16)),
+            Err(IdxError::ParseError(_))
+        ));
+    }
+}

crates/idx-core/src/api/mock.rs

@@ -3,7 +3,8 @@
 
 use super::types::{Bar, Fundamentals, Interval, Period, Quote};
 use super::{
-    BrokerSummaryProvider, FundamentalsProvider, HistoryProvider, QuoteProvider, ipot, msn, yahoo,
+    BrokerSummaryProvider, FundamentalsProvider, HistoryProvider, QuoteProvider,
+    TradingSummaryProvider, idx, ipot, msn, yahoo,
 };
 use crate::broker::types::{BrokerBoard, BrokerInvestor, BrokerQuery};
 use crate::config::ProviderKind;
@@ -164,3 +165,26 @@ impl BrokerSummaryProvider for MockBrokerProvider {
         ipot::summary_from_html(code, &html)
     }
 }
+
+/// Trading summaries from `tests/fixtures/idx_stocksummary_<date>.json`; a
+/// date without a fixture had no trading.
+pub struct MockTradingSummaryProvider;
+
+impl TradingSummaryProvider for MockTradingSummaryProvider {
+    fn stock_summary(
+        &self,
+        date: chrono::NaiveDate,
+    ) -> Result<Vec<crate::flow::types::StockDay>, IdxError> {
+        if std::env::var("IDX_MOCK_ERROR").is_ok() {
+            return Err(IdxError::ProviderUnavailable);
+        }
+        let path = format!(
+            "tests/fixtures/idx_stocksummary_{}.json",
+            date.format("%Y%m%d")
+        );
+        match std::fs::read_to_string(path) {
+            Ok(raw) => idx::parse_stock_summary(&raw, date),
+            Err(_) => Ok(Vec::new()),
+        }
+    }
+}

crates/idx-core/src/api/mod.rs

@@ -1,3 +1,4 @@
+pub mod idx;
 pub mod ipot;
 #[cfg(feature = "testing")]
 pub mod mock;
@@ -54,6 +55,15 @@ pub trait BrokerSummaryProvider {
     ) -> Result<ipot::BrokerSummaryRaw, IdxError>;
 }
 
+/// Every stock's trading summary for one session (IDX's own site).
+pub trait TradingSummaryProvider {
+    /// Empty for a day without trading.
+    fn stock_summary(
+        &self,
+        date: chrono::NaiveDate,
+    ) -> Result<Vec<crate::flow::types::StockDay>, IdxError>;
+}
+
 pub trait FundamentalsProvider {
     fn fundamentals(&self, symbol: &str) -> Result<Fundamentals, IdxError>;
 }
@@ -279,6 +289,14 @@ pub fn broker_provider() -> Box<dyn BrokerSummaryProvider> {
     Box::new(ipot::IpotProvider::new())
 }
 
+pub fn trading_summary_provider() -> Box<dyn TradingSummaryProvider> {
+    #[cfg(feature = "testing")]
+    if mock::enabled() {
+        return Box::new(mock::MockTradingSummaryProvider);
+    }
+    Box::new(idx::IdxSiteProvider)
+}
+
 /// Today in WIB, the date IDX trades on.
 pub(crate) fn today_wib() -> chrono::NaiveDate {
     #[cfg(feature = "testing")]