bharosa 0.3.3 → 0.5.0

package/ANALYTICS-CONTRACT-SHA256

@@ -0,0 +1 @@
+1d2d37edf6ea65cdd3bac707119c6815ee73c89770a791d7dfdfadc9630b6f2b

package/CHANGELOG.md

@@ -1,6 +1,6 @@
-# 0.3.3
+# 0.4.0 — unpublished release candidate
 
-Default both clients to https://api.bharosa.finance. Explicit base URL overrides remain supported. Existing clients using the app origin remain compatible. No analytics changes.
+Add account-scoped Growth scheme performance and category return statistics. Change the default origin from published 0.3.2’s app.bharosa.finance to api.bharosa.finance, preserving explicit overrides. The reviewed host-default delta is included directly; no intermediate 0.3.3 publication is required. No investor monetary-performance, fund-AUM or stated-TER methods. API deployment and SDK publication are separate.
 
 # Changelog
 

package/MONTHLY-MARKET-CONTRACT-SHA256

@@ -1 +1 @@
-ad8f930964df34c3a28e3309302d19ba76ab9d48190c024a26b0795422f0b648
+ef53094920c324ab9d9fd31d8846b6f37da13b757301c6742461ee33b8fe49c4

package/README.md

@@ -2,19 +2,19 @@
 
 A TypeScript client for Bharosa accounts, investors, portfolios, and mutual funds. Use one resource interface from TypeScript, ESM, or CommonJS, with no runtime dependencies.
 
-**SDK version:** `bharosa@0.3.3`. Both clients use the production API at `https://api.bharosa.finance` by default. Account access and credentials are still required; installing the SDK does not grant access.
+**Local release candidate (unpublished):** `bharosa@0.5.0`. Both clients use the production API at `https://api.bharosa.finance` by default. Account access and credentials are still required; installing the SDK does not grant access.
 
 ## Start here
 
-Use Node.js 22.12+ in a supported LTS release. Install the published SDK in your backend application:
+Use Node.js 22.12+ in a supported LTS release. Install the reviewed local candidate in your backend application:
 
 ```sh
-npm install bharosa@0.3.3 --ignore-scripts
+npm install /absolute/path/to/bharosa-0.5.0.tgz --ignore-scripts
 ```
 
 Source contributors can build and pack a local archive using the commands in CONTRIBUTING.md.
 
-Configure your application's account ID and account key through its secret manager. Then:
+Configure your API key through your backend secret manager. In the local unified-key API candidate, every active key has baseline market access; private account calls require the optional account permissions. Then:
 
 ```ts
 import { Bharosa } from "bharosa";
@@ -25,10 +25,11 @@ function required(name: string): string {
   return value;
 }
 const bharosa = new Bharosa({
-  account: required("BHAROSA_ACCOUNT_ID"),
-  auth: { type: "account_key", apiKey: required("BHAROSA_SECRET_KEY") },
+  apiKey: required("BHAROSA_SECRET_KEY"),
 });
-const account = await bharosa.accounts.retrieve();
+const latestNav = await bharosa.markets.schemes.nav("45139");
+// Optional own-account permission is required for this call:
+// const account = await bharosa.accounts.retrieve();
 ```
 
 The startup check names missing environment variables without printing their values. See the [complete setup guide](docs/getting-started.md) for explicit checks and delegated authentication. CommonJS uses `const { Bharosa } = require("bharosa")`.
@@ -124,3 +125,13 @@ Available in SDK 0.3.0 and activated at `https://api.bharosa.finance`. Server ap
 ### Optional API origin override
 
 Set `baseUrl` only for another deployment or tests. Omitted or `undefined` uses `https://api.bharosa.finance`; invalid explicit values fail validation and never fall back. Overrides must be HTTPS origins without credentials, paths, queries or fragments. Local HTTP also requires `allowLocalhostHttp: true`. The SDK does not read `BHAROSA_API_BASE_URL` automatically.
+
+## Growth performance and category returns
+
+Adds `mutualFundSchemes.performance.retrieve` and `fundCategories.statistics.retrieve` for authenticated account access. See [analytics methods, coverage and limitations](docs/analytics.md). These API routes and the SDK 0.4.0 methods are published; this unified-key SDK candidate is not yet published. `BharosaMarket` retains its four monthly operations and cannot call account analytics.
+
+## Unified-key candidate
+
+This local 0.5.0 candidate adds `new Bharosa({ apiKey })` and `client.markets`, using the existing account-independent market routes. Omit the NAV selection for latest NAV, or pass `{ asOf: "2026-10-01" }` for a monthly snapshot. Missing observations return `status: "missing"` and `data: null`. Explicit dates must be month starts. The account-scoped NAV method also accepts omission, while keeping account authorization.
+
+Existing `auth` configurations and `BharosaMarket` remain supported. Baseline calls use only the API key; delegated private calls still require user consent and a valid user token. The production origin remains `https://api.bharosa.finance`. Unified-key server changes are locally tested and pending coordinated activation; this archive alone does not activate permissions.