v2.0.0: Align TypeScript SDK with Rust SDK reference

18 resources, 69 endpoints matching vc-rust v2.0.0:
- Add auditors, dashboard, screening, watchlists, webhooks, exports, ai, graph
- Remove watches, notifications, enrichments, users, settings, sync
- Update companies (events, reports, fingerprint, nearby), teams (member mgmt),
  analytics (anomalies, cohorts, candidates), dossiers, changes, persons
- Base URL changed to https://api.vynco.ch (health at /health, rest at /v1/*)
- Add ConflictError (409), _requestBytes for file downloads
- ResponseMeta: add rateLimitRemaining, rateLimitReset
- Types fully aligned with Rust SDK (PagedResponse, typed analytics, etc.)
- CI: add package verification; Publish: add GitHub Release creation
- 72 tests passing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mivertowski

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18, 20, 22]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm lint
+
+      - run: pnpm test
+
+      - run: pnpm build
+
+      - name: Verify package
+        run: pnpm pack --pack-destination /tmp && ls -lh /tmp/vynco-*.tgz

.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+name: Publish
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm lint
+
+      - run: pnpm test
+
+      - run: pnpm build
+
+      - name: Publish to npm
+        run: pnpm publish --no-git-checks --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

CHANGELOG.md

@@ -1,40 +1,72 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [0.1.0] - 2026-03-17
-
-### Added
-
-- **VyncoClient** with options-based configuration (`apiKey`, `baseUrl`, `timeout`, `maxRetries`)
-- **12 resource modules** covering 45 VynCo API endpoints:
-  - `companies` — search, get by UID, count, statistics, change history, board members, dossier, relationships, hierarchy, compare
-  - `persons` — get by ID, search by name
-  - `dossiers` — generate AI company reports (summary/standard/comprehensive)
-  - `apiKeys` — list, create, revoke API keys
-  - `credits` — balance, usage breakdown, transaction history
-  - `billing` — Stripe checkout and portal sessions
-  - `webhooks` — list, create, get, update, delete, test
-  - `teams` — get current team, create team
-  - `users` — get profile, update profile, change password
-  - `settings` — get/update preferences, get/update notifications
-  - `analytics` — company stats, cantons, auditors, clustering, anomaly detection, RFM segments, cohorts, cross-tabulation
-  - `sync` — data sync status
-- **Response metadata** via `VyncoResponse<T>` wrapper exposing API headers:
-  - `X-Request-Id` — request tracing
-  - `X-Credits-Used` — credits consumed
-  - `X-Credits-Remaining` — remaining balance
-  - `X-Rate-Limit-Limit` — tier rate limit
-  - `X-Data-Source` — OGD compliance (Zefix/LINDAS)
-- **Typed error handling** with error classes mapping HTTP status codes:
-  - `AuthenticationError` (401), `InsufficientCreditsError` (402), `ForbiddenError` (403)
-  - `NotFoundError` (404), `ValidationError` (400/422), `RateLimitError` (429), `ServerError` (5xx)
-  - `NetworkError` (connection failures), `DeserializeError` (JSON parse), `TimeoutError`, `ConfigError`
-- **Automatic retry** with exponential backoff on 429 and 5xx responses
-- **Retry-After header** support for rate-limited requests
-- **Dual ESM/CJS output** with TypeScript declarations via tsup
-- **Zero runtime dependencies** — uses native `fetch` (Node.js 18+ / browsers)
-- **33 tests** with vitest and msw covering auth, error mapping, resource methods, and metadata parsing
+## 2.0.0 (2026-03-31)
+
+Major release aligning the TypeScript SDK with the Rust SDK (`vynco` v2.0.0).
+
+### Breaking Changes
+
+- **Base URL** changed from `https://api.vynco.ch/v1` to `https://api.vynco.ch` — the `/v1` prefix is now part of each endpoint path. Health check is at `/health` (no `/v1` prefix).
+- **Removed resources:** `Watches`, `Notifications`, `Enrichments`, `Users`, `Settings`, `Sync` — replaced by new equivalents or removed from the API.
+- **Removed methods:** `companies.search()` (POST), `companies.batch()`, `changes.review()`, `changes.batch()`, `changes.bySogcId()`, `persons.get()`, `persons.search()`, `persons.roles()`, `persons.connections()`, `persons.networkStats()`, `dossiers.generate()`, `dossiers.statistics()`, `analytics.velocity()`.
+- **Renamed types:** `PaginatedResponse` → `PagedResponse`, `UsageBreakdown` → `CreditUsage`, `ApiKeyInfo` → `ApiKey`, `CheckoutSessionResponse`/`PortalSessionResponse` → `SessionUrl`.
+- **Changed method signatures:** `companies.compare()` now takes `CompareRequest` object, `dossiers.create()` replaces `dossiers.generate()`, `changes.byCompany()` replaces `changes.get()`.
+- **Type changes:** `CompanyChange`, `ChangeListParams`, `ChangeStatistics`, `Company`, `CompanyStatistics`, `Team`, `CreateTeamRequest`, `CreateApiKeyRequest`, `ApiKeyCreated`, `Dossier` fields updated to match API.
+- **ResponseMeta:** Rate limit headers changed from `x-rate-limit-limit` to `x-ratelimit-limit` (no hyphen). Added `rateLimitRemaining` and `rateLimitReset`.
+
+### New Resources (8)
+
+- **`auditors`** — `history(uid)`, `tenures(params?)` — auditor appointment history and long-tenure queries.
+- **`dashboard`** — `get()` — dashboard summary data.
+- **`screening`** — `screen(request)` — sanctions and watchlist screening.
+- **`watchlists`** — `list()`, `create()`, `delete()`, `companies()`, `addCompanies()`, `removeCompany()`, `events()` — company monitoring lists with events.
+- **`webhooks`** — `list()`, `create()`, `update()`, `delete()`, `test()`, `deliveries()` — webhook subscriptions with signing secrets and delivery tracking.
+- **`exports`** — `create()`, `get()`, `download()` — bulk data export jobs with binary file downloads.
+- **`ai`** — `dossier()`, `search()`, `riskScore()` — AI-powered company intelligence, natural language search, and risk scoring.
+- **`graph`** — `get()`, `export()`, `analyze()` — corporate relationship graphs with network analysis.
+
+### New Company Methods (5)
+
+- `companies.events(uid, limit?)` — company change events (CloudEvent format)
+- `companies.reports(uid)` — financial report metadata
+- `companies.fingerprint(uid)` — extended company data profile
+- `companies.nearby(params)` — geo-proximity company search
+- `companies.relationships(uid)` — now returns typed `Relationship[]`
+
+### New Team Methods (5)
+
+- `teams.members()` — list team members
+- `teams.inviteMember(request)` — invite by email
+- `teams.updateMemberRole(id, request)` — change member role
+- `teams.removeMember(id)` — remove a member
+- `teams.billingSummary()` — team billing overview
+
+### New Analytics Methods (4)
+
+- `analytics.anomalies(request)` — anomaly detection
+- `analytics.cohorts(params?)` — cohort analysis
+- `analytics.statistics()` — company statistics
+- `analytics.candidates(params?)` — audit candidate ranking
+
+### Other Improvements
+
+- Added `ConflictError` (HTTP 409) to error mapping
+- Added `_requestBytes()` internal method for binary file downloads
+- Credits `history()` now returns typed `CreditHistory` instead of `unknown`
+- Analytics `cantons()` and `auditors()` return typed arrays instead of `AnalyticsResult`
+- GitHub Actions publish workflow now creates a GitHub Release automatically
+- CI workflow now includes package verification step
+
+## 1.0.0 (2026-03-18)
+
+Initial major release.
+
+- 16 resource modules covering 60+ API endpoints
+- Response metadata wrapper with API headers
+- Typed error handling (11 error classes)
+- Automatic retry with exponential backoff
+- Dual ESM/CJS output with zero dependencies
+
+## 0.1.0 (2026-03-17)
+
+Alpha release.

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What This Is
 
-TypeScript SDK for the VynCo API (`api.vynco.ch/v1`) — Swiss company data, analytics, credit management, and platform administration. This is the TypeScript counterpart to the Rust SDK at `../VynCorp-rust/vc-rust`. It is a superset: all Rust SDK endpoints plus additional endpoints used by VynCorpPortal.
+TypeScript SDK for the VynCo API (`api.vynco.ch`) — Swiss company data, analytics, AI intelligence, credit management, and platform administration. This is the TypeScript counterpart to the Rust SDK at `../VynCorp-rust/vc-rust`.
 
 ## Commands
 
@@ -27,32 +27,37 @@ If `pnpm` is not installed globally, prefix with `npx`: `npx pnpm build`.
 
 **Single entry point**: Everything is exported from `src/index.ts`. The public API surface is `VyncoClient` plus typed resources, errors, and data model interfaces.
 
+**Base URL**: Default is `https://api.vynco.ch`. The health endpoint is at `/health` (no `/v1` prefix). All other endpoints use `/v1/` prefix (e.g., `/v1/companies`, `/v1/credits/balance`).
+
 **Client → Resources pattern**: `VyncoClient` (in `src/client.ts`) owns the HTTP transport layer and exposes internal `_request*` methods (underscore-prefixed, not truly private — used by resource classes). Each resource class (e.g., `Companies`, `Credits`) takes a `VyncoClient` reference and calls these internal methods. Resources are instantiated in the `VyncoClient` constructor and exposed as readonly properties (`client.companies`, `client.credits`, etc.).
 
+**18 resource modules** (69 endpoints): health, companies, auditors, dashboard, screening, watchlists, webhooks, exports, ai, apiKeys, credits, billing, teams, changes, persons, analytics, dossiers, graph.
+
 **Key internal methods on VyncoClient**:
 - `_request<T>(method, path)` — GET with no body, returns `VyncoResponse<T>`
 - `_requestWithBody<T>(method, path, body)` — POST/PUT with JSON body
 - `_requestWithParams<T>(method, path, params)` — GET with query string
 - `_requestEmpty(method, path)` — DELETE, returns `ResponseMeta` only
+- `_requestBytes(method, path)` — GET returning raw bytes for file downloads (exports, graph export)
 
-**Error mapping**: HTTP status codes map to typed error classes in `src/errors.ts`. All extend `VyncoError`. The mapping lives in `#throwIfError` in `client.ts`.
+**Error mapping**: HTTP status codes map to typed error classes in `src/errors.ts`. All extend `VyncoError`. The mapping lives in `#throwIfError` in `client.ts`. Includes 409 → `ConflictError`.
 
 **Retry logic**: `#fetchWithRetry` in `client.ts` retries on 429/5xx with exponential backoff (500ms base). Respects `Retry-After` header.
 
-**Response metadata**: Every API response wraps data in `VyncoResponse<T>` which includes `ResponseMeta` parsed from `X-Request-Id`, `X-Credits-Used`, `X-Credits-Remaining`, `X-Rate-Limit-Limit`, `X-Data-Source` headers.
+**Response metadata**: Every API response wraps data in `VyncoResponse<T>` which includes `ResponseMeta` parsed from `X-Request-Id`, `X-Credits-Used`, `X-Credits-Remaining`, `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`, `X-Data-Source` headers.
 
 ## Conventions
 
 - Zero runtime dependencies — uses native `fetch` only
 - All imports use `.js` extensions (required for ESM)
 - Resource classes use `#private` fields for the client reference
 - Data model interfaces in `src/types.ts` use camelCase matching the API's JSON format
-- Endpoints returning unstable/untyped JSON use `unknown` as the return type (e.g., `credits.history()`, `companies.statistics()`, analytics endpoints)
+- All endpoints return fully typed responses — no `unknown` return types
 - Tests use `msw` (Mock Service Worker) for HTTP-level mocking via `setupServer`
 - When testing error codes, set `maxRetries: 0` to avoid retry delays
 
 ## Related Projects
 
 - **Rust SDK**: `../VynCorp-rust/vc-rust` — the reference implementation this SDK mirrors
-- **VynCorpPortal**: `../../VynCorpPortal/VynCorpPortal` — Next.js frontend that consumes this API (source of Portal-only endpoints)
+- **VynCorpPortal**: `../../VynCorpPortal/VynCorpPortal` — Next.js frontend that consumes this API
 - **ZefixMiner**: `../../ZefixMiner/EY.EW.ASU.ZefixMiner` — .NET backend that serves the API