v0.128.37

Added ✨

• Handle POST /auth/token refusing a valid API key without scopes: 403 now parses as
  AuthTokenError with AuthTokenErrorCode.APIKEY_WITHOUT_SCOPES. No token is minted;
  create a key with at least one scope in the web app where the deployment requires scopes.
• Discover CEX instruments and DEX pools through both instrument routes, with typed venue,
  segment and live-segment metadata. InstrumentCatalogueResponse names their response union.
• Import centralized-exchange ticker or kline history with the cex source block and fifteen
  cadence labels; retain typed ResponseError.reason and next_ recovery instructions.
• Public api.exchange.download_tickers and download_klines adapters return successful
  binary bytes for sync and async calls, including strict-status clients. Detailed calls preserve
  provisional-hour metadata, timestamp units, and retry delays.

Changed 🔄

• Clarify that a scope is a resource and an action: KeyScopes lists a resource only with
  at least one action, and {} represents no scopes. Successful authentication examples
  use the resource-to-actions map.
• Token scopes are a KeyScopes resource-to-actions map, also required on account responses.
  The API reports grants but does not yet enforce them.
• Live sources use cex / dex enums. DEX runs require one pool address and kline data;
  discover valid exchange / live-segment combinations before starting a run.
• Exchange metadata and instrument symbol are required. Unknown market values are absent
  (UNSET), never null. Instrument segment requests accept discovered protocol strings.
• Hourly downloads cover seven days. Lastra ts is microseconds with MIME type
  application/vnd.qtsurfer.lastra; Parquet remains milliseconds. Handle provisional 200,
  404 NOT_YET_AVAILABLE / NO_DATA, 400 OUTSIDE_WINDOW and retryable 503.

Fixed 🐛

• Public download adapters encode quote currencies without colliding with the URL encoder.
  Use the public api.exchange imports rather than private generated download modules.

v0.128.25

[0.128.25] — 2026-10-09

Added ✨

• StartLiveRequest.sandbox lets a strategy that already passed its sandbox trial start in
  SANDBOX again, for example to debug signals over the WebSocket connection. By default such a
  strategy starts directly in LIVE.

Changed 🔧

• Document when a live run starts in SANDBOX or LIVE, including the inherited gate verdict.

v0.128.24

[0.128.24] — 2026-10-07

Changed

• Sweep cancellation documentation now explains that CANCELLED can arrive before in-flight runs finish; keep reading until progress.pendingShards is 0 for the complete leaderboard.

v0.128.22

[0.128.22] — 2026-10-06

Added ✨

• Live-start sources use the new LiveSourceRequest model, where instruments is optional. When
  omitted (or set to ["*"]), the server can use the strategy's declared instruments; otherwise
  the run reads every instrument available on the exchange and segment. Wildcards can select one
  side of a pair, such as */USDT.

Changed 🔧

• Instrument symbols are case-insensitive and ignore surrounding spaces; malformed pairs are
  rejected when a run starts. The run's LiveSource.instruments still reports what it actually
  reads.

v0.128.17

[0.128.17] — 2026-10-05

Added ✨

• get_live_run reads an owned live run by run_id as LiveRunDetail, including monotonic
  updated_at_ms and an optional LiveRunStats snapshot.
• StartLiveRequest.stream requests the secret stream_url returned by start_live and
  get_live; rotate_live_stream and revoke_live_stream manage that URL.

v0.128.14

[0.128.14] — 2026-09-30

Added ✨

• send_live_command delivers an owner-only transient command to a running strategy and returns its command ID and effective market position. 202 means accepted; 503 guarantees it was not sent. Retries after an ambiguous network failure can create a second command because the endpoint has no idempotency key.
• Paper-trading configuration, account snapshots, and paginated equity history are available on live runs.
• Strategy and dataset listings can include deleted entries with deleted_at; account limits include max_sweep_cartesian, and live runs expose an optional stop/failure reason.

v0.126.2

[0.126.2] — 2026-09-23

• Add the generated list_live endpoint for the caller's own live runs.

v0.126.1

[0.126.1] — 2026-09-23

• Represent nullable live-signal fields correctly.

v0.115.1

[0.115.1] — 2026-09-08

Regenerated against OpenAPI spec 0.115.1 (from 0.111.2).

Added ✨

• ExecuteBacktestBody.params accepts one scalar strategy-property vector for an execution, and
  ResultMap.params echoes that vector in the result. ScalarStrategyParamValue is re-exported
  as the corresponding public scalar alias.
• DatasetWithLinks and DatasetVersion expose data_url and data_format (lastra or
  parquet) once a dataset version is ready.

Changed 🔄

• Dataset creation accepts CSV or parquet data, directly or inside a gzip/zip containing one file.
  DatasetVersion.bytes describes stored data rather than the original upload bytes.
• ResultMap.win_rate is a fraction from 0.0 to 1.0, and cagr is a ratio (for example, 0.15
  represents 15%).

v0.111.2

[0.111.2] — 2026-08-28

Regenerated against OpenAPI spec 0.111.2 (from 0.110.3).

Added ✨

• open_dataset_upload — POST /datasets/{datasetId}/uploads — returns a DatasetUploadSession for the current open upload or the next dataset version. DatasetUploadTarget names the presigned upload target shape shared by this response and DatasetCreated.

Changed 🔄

• finalize_dataset_upload now parses the documented 409 response when an upload session has already produced a version. Open a new upload session instead of reusing that upload_id.
• DatasetCreated now mirrors the immediate creation response: its upload session plus dataset_id, name, type_, and instrument. Version-derived metadata is obtained through get_dataset after its lifecycle stage has completed.