melaya 0.1.2 → 0.2.0

data/lib/melaya/accounts.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Accounts API — GDPR data export, API key management, and profile updates.
+  #
+  # Maps to /api/v1/private/accounts/* and /api/v1/private/keys/*.
+  #
+  # Note: credit balance endpoints live in BillingAPI to keep billing concerns
+  # co-located. Key listing is in AccountAPI (trading plane) for backward
+  # compatibility; this module covers the write/management side.
+  class AccountsAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # POST /api/v1/private/accounts/export
+    # GDPR Art 15/20 data export; returns JSON blob of all user data.
+    def export_data
+      @http.post("/api/v1/private/accounts/export")
+    end
+
+    # DELETE /api/v1/private/keys/:keyId
+    # Remove a stored CEX API key.
+    # @param key_id [String]
+    def remove_key(key_id)
+      @http.delete("/api/v1/private/keys/#{enc(key_id)}")
+    end
+
+    # PATCH /api/v1/private/accounts/profile
+    # Update user display name, avatar, or settings.
+    # @param body [Hash]
+    def update_profile(body = {})
+      @http.patch("/api/v1/private/accounts/profile", body)
+    end
+
+    private
+
+    def enc(s)
+      URI.encode_www_form_component(s.to_s)
+    end
+  end
+end

data/lib/melaya/assistant.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Assistant API — get and save the caller's onboarding / persona profile.
+  #
+  # The profile is stored envelope-encrypted (service=assistant_profile) and
+  # used to personalise the in-app assistant experience.
+  #
+  # Maps to /api/v1/private/assistant/profile.
+  #
+  # @example
+  #   profile = melaya.assistant.get_profile
+  #   melaya.assistant.set_profile(name: "Antoine", goals: ["grow my trading edge"])
+  class AssistantAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # GET /api/v1/private/assistant/profile
+    # Get the caller's assistant onboarding profile.
+    def get_profile
+      @http.get("/api/v1/private/assistant/profile")
+    end
+
+    # PUT /api/v1/private/assistant/profile
+    # Save the caller's assistant onboarding profile.
+    # @param name [String, nil]
+    # @param goals [Array<String>, nil]
+    # @param context [String, nil]
+    # @param preferences [Hash, nil]
+    # @param extra [Hash] any additional profile fields
+    def set_profile(name: nil, goals: nil, context: nil, preferences: nil, **extra)
+      profile = extra.transform_keys(&:to_s)
+      profile["name"]        = name        unless name.nil?
+      profile["goals"]       = goals       unless goals.nil?
+      profile["context"]     = context     unless context.nil?
+      profile["preferences"] = preferences unless preferences.nil?
+      @http.put("/api/v1/private/assistant/profile", profile)
+    end
+  end
+end

data/lib/melaya/auth.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Auth API — login, MFA, registration, password management, and session tokens.
+  #
+  # Most endpoints are public (no Bearer token needed for login/register).
+  # However, the SDK HttpClient always sends the mk_* API key which is fine —
+  # the server simply ignores it for public routes.
+  #
+  # Maps to /api/v1/private/auth/* and /api/v1/auth/*.
+  class AuthAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # POST /api/v1/private/auth/login
+    # Password + username login; returns session JWT + optional MFA challenge token.
+    # @param username [String]
+    # @param password [String]
+    def login(username:, password:)
+      @http.post("/api/v1/private/auth/login",
+        "username" => username,
+        "password" => password)
+    end
+
+    # POST /api/v1/private/auth/mfa/verify
+    # Resolve MFA challenge after login.
+    # @param challenge_token [String]
+    # @param code [String] TOTP or recovery code
+    def verify_mfa(challenge_token:, code:)
+      @http.post("/api/v1/private/auth/mfa/verify",
+        "challengeToken" => challenge_token,
+        "code"           => code)
+    end
+
+    # POST /api/v1/private/auth/register
+    # Create a new user account; sends email verification.
+    def register(username:, email:, password:)
+      @http.post("/api/v1/private/auth/register",
+        "username" => username,
+        "email"    => email,
+        "password" => password)
+    end
+
+    # POST /api/v1/private/auth/verify-signup
+    # Confirm email address from signup link token.
+    # @param token [String]
+    def verify_signup(token:)
+      @http.post("/api/v1/private/auth/verify-signup", "token" => token)
+    end
+
+    # POST /api/v1/private/auth/resend-verification
+    # Re-send email verification message.
+    # @param email [String]
+    def resend_verification(email:)
+      @http.post("/api/v1/private/auth/resend-verification", "email" => email)
+    end
+
+    # GET /api/v1/private/auth/me
+    # Return current authenticated user profile.
+    def me
+      @http.get("/api/v1/private/auth/me")
+    end
+
+    # GET /api/v1/private/auth/check
+    # Lightweight session validity check; returns ok: true.
+    def check
+      @http.get("/api/v1/private/auth/check")
+    end
+
+    # POST /api/v1/private/auth/change-password
+    # Change password (current + new).
+    # @param current_password [String]
+    # @param new_password [String]
+    def change_password(current_password:, new_password:)
+      @http.post("/api/v1/private/auth/change-password",
+        "currentPassword" => current_password,
+        "newPassword"     => new_password)
+    end
+
+    # POST /api/v1/private/auth/forgot-password
+    # Initiate password reset flow; sends email with reset token.
+    # @param email [String]
+    def forgot_password(email:)
+      @http.post("/api/v1/private/auth/forgot-password", "email" => email)
+    end
+
+    # POST /api/v1/private/auth/reset-password
+    # Complete password reset using token from email.
+    # @param token [String]
+    # @param new_password [String]
+    def reset_password(token:, new_password:)
+      @http.post("/api/v1/private/auth/reset-password",
+        "token"       => token,
+        "newPassword" => new_password)
+    end
+
+    # POST /api/v1/private/auth/mobile-handoff
+    # Create a short-lived handoff token for mobile app deep-link auth.
+    def mobile_handoff
+      @http.post("/api/v1/private/auth/mobile-handoff")
+    end
+
+    # GET /api/v1/private/auth/permissions
+    # Return caller's permission flags (capabilities, tier, feature gates).
+    def permissions
+      @http.get("/api/v1/private/auth/permissions")
+    end
+
+    # POST /api/v1/private/auth/refresh
+    # Rotate session JWT (sliding expiry); returns new token.
+    def refresh
+      @http.post("/api/v1/private/auth/refresh")
+    end
+
+    # ── MFA ───────────────────────────────────────────────────────────────────
+
+    # GET /api/v1/private/mfa/status
+    # Return MFA enrollment status for the caller.
+    def mfa_status
+      @http.get("/api/v1/private/mfa/status")
+    end
+
+    # POST /api/v1/private/mfa/setup
+    # Initiate TOTP setup; returns QR/secret.
+    def mfa_setup
+      @http.post("/api/v1/private/mfa/setup")
+    end
+
+    # POST /api/v1/private/mfa/confirm
+    # Confirm TOTP setup with first valid code; activates MFA.
+    # @param code [String]
+    def mfa_confirm(code:)
+      @http.post("/api/v1/private/mfa/confirm", "code" => code)
+    end
+  end
+end

data/lib/melaya/backtest.rb

@@ -1,101 +1,139 @@
-# frozen_string_literal: true
-
-module Melaya
-  # Backtest API — run strategies against historical data on the Rust engine.
-  #
-  # Start a single run or a parameter sweep (grid / random), poll the job,
-  # then pull metrics, the equity curve, and the trade list. All backtests run
-  # natively on Melaya's in-house engine — no per-venue SDK in the loop.
-  #
-  # Maps to https://api.melaya.org/api/v1/private/backtest/* on the private plane.
-  class BacktestAPI
-    def initialize(http)
-      @http = http
-    end
-
-    # Start a backtest. +mode+ defaults to a single run; pass "grid_sweep" /
-    # "random_sweep" with +param_ranges+ to fan out a parameter search.
-    # Returns a hash with "job_id" (and optionally "count").
-    #
-    # @param body [Hash] see BacktestStart type in the reference SDKs
-    def start(body)
-      @http.post("/api/v1/private/backtest/start", body)
-    end
-
-    # Job status + progress (+status+, +progress_pct+, ...).
-    # @param job_id [String]
-    def job(job_id)
-      @http.get("/api/v1/private/backtest/jobs/#{job_id}")
-    end
-
-    # Metrics, equity curve, and OHLCV for a completed job.
-    # @param job_id [String]
-    def results(job_id)
-      @http.get("/api/v1/private/backtest/results/#{job_id}")["result"]
-    end
-
-    # The trade list for a completed job (default 500, max 5000 per call).
-    # @param job_id [String]
-    # @param limit [Integer, nil]
-    # @param offset [Integer, nil]
-    def trades(job_id, limit: nil, offset: nil)
-      @http.get("/api/v1/private/backtest/trades/#{job_id}",
-        "limit" => limit, "offset" => offset
-      )["trades"]
-    end
-
-    # Ranked children of a sweep parent (default objective: sharpe DESC).
-    # @param parent_id [String]
-    # @param objective [String, nil]
-    # @param limit [Integer, nil]
-    def sweep(parent_id, objective: nil, limit: nil)
-      @http.get("/api/v1/private/backtest/sweep/#{parent_id}",
-        "objective" => objective, "limit" => limit
-      )
-    end
-
-    # Your backtest jobs, newest first.
-    # @param limit [Integer, nil]
-    # @param offset [Integer, nil]
-    def list(limit: nil, offset: nil)
-      @http.get("/api/v1/private/backtest",
-        "limit" => limit, "offset" => offset
-      ).dig("data", "jobs")
-    end
-
-    # Your favorited backtest jobs (Forge tier and above).
-    # @param limit [Integer, nil]
-    # @param offset [Integer, nil]
-    def favorites(limit: nil, offset: nil)
-      @http.get("/api/v1/private/backtest/favorites",
-        "limit" => limit, "offset" => offset
-      ).dig("data", "jobs")
-    end
-
-    # Earliest funding-rate timestamp available for an exchange+symbol (ms, or nil).
-    # @param exchange [String]
-    # @param symbol [String]
-    def funding_range(exchange:, symbol:)
-      @http.get("/api/v1/private/backtest/funding-range",
-        "exchange" => exchange, "symbol" => symbol
-      )["earliest_ms"]
-    end
-
-    # Cancel an in-flight job.
-    # @param job_id [String]
-    def cancel(job_id)
-      @http.post("/api/v1/private/backtest/#{job_id}/cancel")
-    end
-
-    # Soft-delete a single job.
-    # @param job_id [String]
-    def delete(job_id)
-      @http.delete("/api/v1/private/backtest/#{job_id}")
-    end
-
-    # Soft-delete every non-favorited job. Returns a hash with "deleted" count.
-    def delete_all
-      @http.delete("/api/v1/private/backtest")
-    end
-  end
-end
+# frozen_string_literal: true
+
+module Melaya
+  # Backtest API — run strategies against historical data on the Rust engine.
+  #
+  # Start a single run or a parameter sweep (grid / random), poll the job,
+  # then pull metrics, the equity curve, and the trade list. All backtests run
+  # natively on Melaya's in-house engine — no per-venue SDK in the loop.
+  #
+  # Maps to https://api.melaya.org/api/v1/private/backtest/* on the private plane.
+  class BacktestAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # Start a backtest. +mode+ defaults to a single run; pass "grid_sweep" /
+    # "random_sweep" with +param_ranges+ to fan out a parameter search.
+    # Returns a hash with "job_id" (and optionally "count").
+    #
+    # @param body [Hash] see BacktestStart type in the reference SDKs
+    def start(body)
+      @http.post("/api/v1/private/backtest/start", body)
+    end
+
+    # Job status + progress (+status+, +progress_pct+, ...).
+    # @param job_id [String]
+    def job(job_id)
+      @http.get("/api/v1/private/backtest/jobs/#{job_id}")
+    end
+
+    # Metrics, equity curve, and OHLCV for a completed job.
+    # @param job_id [String]
+    def results(job_id)
+      @http.get("/api/v1/private/backtest/results/#{job_id}")["result"]
+    end
+
+    # The trade list for a completed job (default 500, max 5000 per call).
+    # @param job_id [String]
+    # @param limit [Integer, nil]
+    # @param offset [Integer, nil]
+    def trades(job_id, limit: nil, offset: nil)
+      @http.get("/api/v1/private/backtest/trades/#{job_id}",
+        "limit" => limit, "offset" => offset
+      )["trades"]
+    end
+
+    # Ranked children of a sweep parent (default objective: sharpe DESC).
+    # @param parent_id [String]
+    # @param objective [String, nil]
+    # @param limit [Integer, nil]
+    def sweep(parent_id, objective: nil, limit: nil)
+      @http.get("/api/v1/private/backtest/sweep/#{parent_id}",
+        "objective" => objective, "limit" => limit
+      )
+    end
+
+    # Your backtest jobs, newest first.
+    # @param limit [Integer, nil]
+    # @param offset [Integer, nil]
+    def list(limit: nil, offset: nil)
+      @http.get("/api/v1/private/backtest",
+        "limit" => limit, "offset" => offset
+      ).dig("data", "jobs")
+    end
+
+    # Your favorited backtest jobs (Forge tier and above).
+    # @param limit [Integer, nil]
+    # @param offset [Integer, nil]
+    def favorites(limit: nil, offset: nil)
+      @http.get("/api/v1/private/backtest/favorites",
+        "limit" => limit, "offset" => offset
+      ).dig("data", "jobs")
+    end
+
+    # Earliest funding-rate timestamp available for an exchange+symbol (ms, or nil).
+    # @param exchange [String]
+    # @param symbol [String]
+    def funding_range(exchange:, symbol:)
+      @http.get("/api/v1/private/backtest/funding-range",
+        "exchange" => exchange, "symbol" => symbol
+      )["earliest_ms"]
+    end
+
+    # Cancel an in-flight job.
+    # @param job_id [String]
+    def cancel(job_id)
+      @http.post("/api/v1/private/backtest/#{job_id}/cancel")
+    end
+
+    # Soft-delete a single job.
+    # @param job_id [String]
+    def delete(job_id)
+      @http.delete("/api/v1/private/backtest/#{job_id}")
+    end
+
+    # Soft-delete every non-favorited job. Returns a hash with "deleted" count.
+    def delete_all
+      @http.delete("/api/v1/private/backtest")
+    end
+
+    # ── Parameter sweep optimizer (restRoutes.ts /api/v1/private/backtest/optimize) ──
+
+    # POST /api/v1/private/backtest/optimize
+    # Start a parameter sweep optimization (genetic/grid) over a strategy config.
+    # @param body [Hash] strategy config + param ranges + objective
+    def optimize_start(body)
+      @http.post("/api/v1/private/backtest/optimize", body)
+    end
+
+    # GET /api/v1/private/backtest/optimize
+    # List optimization sweep runs.
+    # @param params [Hash]
+    def optimize_list(params = {})
+      @http.get("/api/v1/private/backtest/optimize", params)
+    end
+
+    # GET /api/v1/private/backtest/optimize/:optRunId/status
+    # Get the status/progress of an optimization sweep run.
+    # @param opt_run_id [String]
+    def optimize_status(opt_run_id)
+      @http.get("/api/v1/private/backtest/optimize/#{URI.encode_www_form_component(opt_run_id.to_s)}/status")
+    end
+
+    # POST /api/v1/private/backtest/optimize/:optRunId/cancel
+    # Cancel an in-progress optimization sweep.
+    # @param opt_run_id [String]
+    def optimize_cancel(opt_run_id)
+      @http.post("/api/v1/private/backtest/optimize/#{URI.encode_www_form_component(opt_run_id.to_s)}/cancel")
+    end
+
+    # POST /api/v1/private/backtest/optimize/:optRunId/apply
+    # Apply best params from a completed optimization sweep to a strategy.
+    # @param opt_run_id [String]
+    # @param body [Hash]
+    def optimize_apply(opt_run_id, body = {})
+      @http.post("/api/v1/private/backtest/optimize/#{URI.encode_www_form_component(opt_run_id.to_s)}/apply", body)
+    end
+  end
+end

data/lib/melaya/billing.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Billing API — subscription status, Stripe checkout/portal sessions,
+  # public pricing plans, and credit balances.
+  #
+  # Maps to /api/v1/private/billing/* (authenticated) and
+  # /api/v1/billing/plans (public), and /api/v1/private/accounts/* for credits.
+  class BillingAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # GET /api/v1/private/billing/subscription
+    # Get caller's current Stripe subscription status and tier.
+    def subscription
+      @http.get("/api/v1/private/billing/subscription")
+    end
+
+    # POST /api/v1/private/billing/checkout
+    # Create Stripe Checkout session for tier upgrade.
+    # Returns a URL to redirect the user to.
+    # @param price_id [String, nil] Stripe price ID
+    # @param tier [String, nil]
+    def create_checkout(price_id: nil, tier: nil)
+      body = compact("priceId" => price_id, "tier" => tier)
+      @http.post("/api/v1/private/billing/checkout", body)
+    end
+
+    # POST /api/v1/private/billing/portal
+    # Create Stripe Customer Portal session for subscription management.
+    # Returns a URL to redirect the user to.
+    def create_portal
+      @http.post("/api/v1/private/billing/portal")
+    end
+
+    # GET /api/v1/billing/plans (public)
+    # Return public pricing plan details (price IDs for forge/bastion/citadel tiers).
+    def plans
+      @http.get("/api/v1/billing/plans")
+    end
+
+    # ── Credits ───────────────────────────────────────────────────────────────
+
+    # GET /api/v1/private/accounts/credits
+    # Return current credit balance and transaction history.
+    def credits
+      @http.get("/api/v1/private/accounts/credits")
+    end
+
+    # GET /api/v1/private/accounts/credits/ai
+    # Return AI/LLM credit balance.
+    def ai_credits
+      @http.get("/api/v1/private/accounts/credits/ai")
+    end
+
+    # GET /api/v1/private/accounts/credits/portfolio-ideas
+    # Return portfolio-ideas feature credit balance.
+    def portfolio_ideas_credits
+      @http.get("/api/v1/private/accounts/credits/portfolio-ideas")
+    end
+
+    # GET /api/v1/private/accounts/credits/risk-monitoring
+    # Return risk-monitoring feature credit balance.
+    def risk_monitoring_credits
+      @http.get("/api/v1/private/accounts/credits/risk-monitoring")
+    end
+
+    private
+
+    def compact(hash)
+      hash.reject { |_, v| v.nil? }
+    end
+  end
+end

data/lib/melaya/bugs.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Bugs API — submit and track bug reports.
+  #
+  # Maps to /api/v1/private/bugs/*.
+  #
+  # @example
+  #   melaya.bugs.create(title: "UI crash", description: "...")
+  #   reports = melaya.bugs.list_mine
+  class BugsAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # POST /api/v1/private/bugs
+    # Submit a bug report (user-facing feedback form).
+    # @param title [String]
+    # @param description [String]
+    # @param extra [Hash] any additional fields
+    def create(title:, description: nil, **extra)
+      body = extra.transform_keys(&:to_s)
+      body["title"]       = title
+      body["description"] = description unless description.nil?
+      @http.post("/api/v1/private/bugs", body)
+    end
+
+    # GET /api/v1/private/bugs/mine
+    # List bug reports submitted by the caller.
+    def list_mine
+      @http.get("/api/v1/private/bugs/mine")
+    end
+
+    # GET /api/v1/private/bugs/:bugId
+    # Get a single bug report by ID.
+    # @param bug_id [String]
+    def get(bug_id)
+      @http.get("/api/v1/private/bugs/#{enc(bug_id)}")
+    end
+
+    # POST /api/v1/private/bugs/:bugId/comments
+    # Add a comment to a bug report.
+    # @param bug_id [String]
+    # @param comment [String]
+    def add_comment(bug_id, comment:)
+      @http.post("/api/v1/private/bugs/#{enc(bug_id)}/comments", "comment" => comment)
+    end
+
+    # GET /api/v1/private/bugs/notifications
+    # List unread bug-related notifications for the caller.
+    def list_notifications
+      @http.get("/api/v1/private/bugs/notifications")
+    end
+
+    # POST /api/v1/private/bugs/notifications/read
+    # Mark bug notifications as read.
+    def mark_notifications_read(body = {})
+      @http.post("/api/v1/private/bugs/notifications/read", body)
+    end
+
+    private
+
+    def enc(s)
+      URI.encode_www_form_component(s.to_s)
+    end
+  end
+end

data/lib/melaya/connectors.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Melaya
+  # Project Connectors API — manage credentials at project scope.
+  #
+  # Project-scoped connectors are isolated per project, letting separate
+  # projects use different API keys for the same service.
+  #
+  # Maps to /api/v1/private/projects/:project/connectors/*.
+  #
+  # @example
+  #   melaya.connectors.set("my-project", "openai", value: "sk-...")
+  #   services = melaya.connectors.connected_services("my-project")
+  class ConnectorsAPI
+    def initialize(http)
+      @http = http
+    end
+
+    # GET /api/v1/private/projects/:project/connectors/services
+    # List connected services for a project.
+    # @param project [String] project name
+    def connected_services(project)
+      @http.get("/api/v1/private/projects/#{enc(project)}/connectors/services")
+    end
+
+    # PUT /api/v1/private/projects/:project/connectors/:service
+    # Store a connector credential at project scope.
+    # @param project [String]
+    # @param service [String]
+    # @param value [String]
+    # @param key [String, nil]
+    # @param label [String, nil]
+    def set(project, service, value:, key: nil, label: nil)
+      body = compact("value" => value, "key" => key, "label" => label)
+      @http.put("/api/v1/private/projects/#{enc(project)}/connectors/#{enc(service)}", body)
+    end
+
+    # DELETE /api/v1/private/projects/:project/connectors/:service
+    # Delete a project-scoped connector credential.
+    # @param project [String]
+    # @param service [String]
+    def delete(project, service)
+      @http.delete("/api/v1/private/projects/#{enc(project)}/connectors/#{enc(service)}")
+    end
+
+    # POST /api/v1/private/projects/:project/connectors/env-handle
+    # Get a short-lived env-handle token for project-scoped credentials.
+    # @param project [String]
+    def env_handle(project)
+      @http.post("/api/v1/private/projects/#{enc(project)}/connectors/env-handle")
+    end
+
+    # POST /api/v1/private/projects/:project/connectors/google/oauth
+    # Start Google OAuth flow for project-scoped connector.
+    # @param project [String]
+    # @param body [Hash]
+    def google_oauth_start(project, body = {})
+      @http.post("/api/v1/private/projects/#{enc(project)}/connectors/google/oauth", body)
+    end
+
+    private
+
+    def enc(s)
+      URI.encode_www_form_component(s.to_s)
+    end
+
+    def compact(hash)
+      hash.reject { |_, v| v.nil? }
+    end
+  end
+end