bharosa 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 0.3.3
+
+Default both clients to https://api.bharosa.finance. Explicit base URL overrides remain supported. Existing clients using the app origin remain compatible. No analytics changes.
+
 # Changelog
 
 ## 0.3.2 — 30 October 2026

package/README.md

@@ -2,14 +2,14 @@
 
 A TypeScript client for Bharosa accounts, investors, portfolios, and mutual funds. Use one resource interface from TypeScript, ESM, or CommonJS, with no runtime dependencies.
 
-**SDK version:** `bharosa@0.3.2`. Both clients use the production API at `https://app.bharosa.finance` by default. Account access and credentials are still required; installing the SDK does not grant access.
+**SDK version:** `bharosa@0.3.3`. Both clients use the production API at `https://api.bharosa.finance` by default. Account access and credentials are still required; installing the SDK does not grant access.
 
 ## Start here
 
 Use Node.js 22.12+ in a supported LTS release. Install the published SDK in your backend application:
 
 ```sh
-npm install bharosa@0.3.2 --ignore-scripts
+npm install bharosa@0.3.3 --ignore-scripts
 ```
 
 Source contributors can build and pack a local archive using the commands in CONTRIBUTING.md.
@@ -119,8 +119,8 @@ After installing the archive, run `node node_modules/bharosa/examples/offline-sm
 
 ### Registered-app monthly data
 
-Available in SDK 0.3.0 and activated at `https://app.bharosa.finance`. Server applications can use `new BharosaMarket({apiKey})` with an owner-issued `market_key` scoped only to `market:read`. `client.schemes.nav(id,{asOf:'2026-08-01'})`, `schemes.expenseRatio`, `funds.portfolio` and `funds.holdings` use account-independent monthly snapshot routes. These keys cannot read private accounts or portfolios and require no investor OAuth token. Keep secrets server-side; never bundle them into browser code. Existing account-key and delegated-user clients remain unchanged. The production control-plane environment is `production`. General third-party OAuth provisioning is separate and is not enabled by this feature.
+Available in SDK 0.3.0 and activated at `https://api.bharosa.finance`. Server applications can use `new BharosaMarket({apiKey})` with an owner-issued `market_key` scoped only to `market:read`. `client.schemes.nav(id,{asOf:'2026-08-01'})`, `schemes.expenseRatio`, `funds.portfolio` and `funds.holdings` use account-independent monthly snapshot routes. These keys cannot read private accounts or portfolios and require no investor OAuth token. Keep secrets server-side; never bundle them into browser code. Existing account-key and delegated-user clients remain unchanged. The production control-plane environment is `production`. General third-party OAuth provisioning is separate and is not enabled by this feature.
 
 ### Optional API origin override
 
-Set `baseUrl` only for another deployment or tests. Omitted or `undefined` uses `https://app.bharosa.finance`; invalid explicit values fail validation and never fall back. Overrides must be HTTPS origins without credentials, paths, queries or fragments. Local HTTP also requires `allowLocalhostHttp: true`. The SDK does not read `BHAROSA_API_BASE_URL` automatically.
+Set `baseUrl` only for another deployment or tests. Omitted or `undefined` uses `https://api.bharosa.finance`; invalid explicit values fail validation and never fall back. Overrides must be HTTPS origins without credentials, paths, queries or fragments. Local HTTP also requires `allowLocalhostHttp: true`. The SDK does not read `BHAROSA_API_BASE_URL` automatically.

package/dist/client-types.d.cts

@@ -17,7 +17,7 @@ export interface BharosaTransport {
     send(url: string, request: RequestInit): Promise<Response>;
 }
 interface BharosaBaseConfig {
-    /** Defaults to https://app.bharosa.finance. Explicit overrides must be valid origins. */
+    /** Defaults to https://api.bharosa.finance. Explicit overrides must be valid origins. */
     readonly baseUrl?: string;
     readonly account: string;
     readonly allowLocalhostHttp?: boolean;

package/dist/client-types.d.ts

@@ -17,7 +17,7 @@ export interface BharosaTransport {
     send(url: string, request: RequestInit): Promise<Response>;
 }
 interface BharosaBaseConfig {
-    /** Defaults to https://app.bharosa.finance. Explicit overrides must be valid origins. */
+    /** Defaults to https://api.bharosa.finance. Explicit overrides must be valid origins. */
     readonly baseUrl?: string;
     readonly account: string;
     readonly allowLocalhostHttp?: boolean;

package/dist/index.d.cts

@@ -16,7 +16,7 @@ export declare class Bharosa implements T.ClientSurface {
     constructor(config: T.BharosaConfig);
 }
 export interface BharosaMarketConfig {
-    /** Defaults to https://app.bharosa.finance. */
+    /** Defaults to https://api.bharosa.finance. */
     baseUrl?: string;
     apiKey: string;
     allowLocalhostHttp?: boolean;

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export declare class Bharosa implements T.ClientSurface {
     constructor(config: T.BharosaConfig);
 }
 export interface BharosaMarketConfig {
-    /** Defaults to https://app.bharosa.finance. */
+    /** Defaults to https://api.bharosa.finance. */
     baseUrl?: string;
     apiKey: string;
     allowLocalhostHttp?: boolean;

package/dist/transport.cjs

@@ -156,7 +156,7 @@ function createTransport(config, marketOnly = false) {
     ]);
     check(config.allowLocalhostHttp === undefined ||
         typeof config.allowLocalhostHttp === "boolean");
-    const base = origin(config.baseUrl === undefined ? "https://app.bharosa.finance" : config.baseUrl, config.allowLocalhostHttp);
+    const base = origin(config.baseUrl === undefined ? "https://api.bharosa.finance" : config.baseUrl, config.allowLocalhostHttp);
     check((0, validate_cjs_1.valid)(operations.retrieve_account.parameters[0].schema, config.account));
     const account = config.account;
     let headers, secrets;

package/docs/getting-started.md

@@ -4,12 +4,12 @@
 
 Use Node.js 22.12 or later in a supported LTS release. The SDK supports ESM and CommonJS. Key-based authentication is server-only; keep credentials in your backend or server that handles browser sessions. Browser applications can supply a generic transport whose private host implementation manages sessions, origin restrictions and CSRF. Bun and Deno are unsupported.
 
-Obtain your authorized account ID and account key. Bharosa and BharosaMarket default to the production origin `https://app.bharosa.finance`; no API URL environment variable is required. The SDK neither provisions accounts nor runs an OAuth consent flow.
+Obtain your authorized account ID and account key. Bharosa and BharosaMarket default to the production origin `https://api.bharosa.finance`; no API URL environment variable is required. The SDK neither provisions accounts nor runs an OAuth consent flow.
 
 ## Install
 
 ```sh
-npm install bharosa@0.3.2 --ignore-scripts
+npm install bharosa@0.3.3 --ignore-scripts
 ```
 
 Source contributors can build and pack a local archive as described in CONTRIBUTING.md.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bharosa",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "private": false,
   "description": "Typed Bharosa resource SDK with server credentials or caller-owned transport.",
   "license": "MIT",