@stable_sea/sdk 0.2.19 → 0.2.21

package/README.md

@@ -21,7 +21,7 @@ import { createStableSeaClient } from "@stable_sea/sdk";
 const client = createStableSeaClient({
   apiKey: process.env.STABLE_SEA_API_KEY!,
   baseUrl: process.env.STABLE_SEA_BASE_URL!,
-  version: "2026-10-15",
+  version: "2026-10-16",
 });
 ```
 
@@ -53,6 +53,14 @@ keys and rotations reuse that data.
 WTGXX supports standard and instant settlement. FLTTX supports standard
 settlement; instant orders are refused in both production and sandbox.
 
+Every fund order names the network it settles on, `ethereum` or `stellar`. The
+API never applies a business's default network. A BTC order settles on no network
+and must not name one. The generated `network` type is optional because BTC shares
+the request, so the server enforces both rules: a fund order without a network
+fails with `network_required`, and a BTC order with one fails with
+`network_not_applicable`. Sandbox settles on `ethereum`. Instant settlement is
+available on `ethereum` only.
+
 ## Member administration and personal actions
 
 Use `createStableSeaSessionClient` for onboarding, legal documents, your profile
@@ -92,6 +100,14 @@ automatically. See the [member guide](https://docs.stablesea.com/api/#member-ses
 for sign-in, session lifecycle and attachment retrieval, and the
 [member reference](https://docs.stablesea.com/api/member-reference/) for fields.
 
+Read the business's networks at `GET /identity/business/networks`, available to
+any member. Choose them at `POST /identity/business/networks`, which needs the
+Manage Permissions permission and takes the business from the session. Turning a
+network off is refused while the business holds funds or has pending activity
+there, and a network the business is not eligible for cannot be turned on. This
+setting decides which networks the business may use, including for API orders. It
+never supplies the network of an order, which always names its own.
+
 List members at `GET /identity/members` and manage invitations at
 `/identity/members/invites`. Creation returns invitation details, never the
 redemption token delivered to the invitee. Invitation acceptance uses the
@@ -126,6 +142,12 @@ Use the member client before issuing an API key. Signup uses the existing
 business-email/OTP flow. After account and authenticator setup, sign in and select
 your business using the same session flow as Terminal.
 
+Where the signup bot challenge is on, `GET /identity/bot_challenge_settings`
+answers `required: true`, and the screener submit and code resend refuse a
+request without a Cloudflare Turnstile `challenge_token` (`bot_challenge_required`,
+`bot_challenge_failed`). Turnstile issues tokens only to its widget on a hostname
+the site key allows.
+
 Read `/onboarding/status` and `/compliance/kyb/fields` to discover the current
 requirements and saved answers. Review registry proposals before confirming
 prefilled answers. Draft writes retain their native revision checks: send the
@@ -363,6 +385,15 @@ its first chart refresh. The document's captured financial figures remain readab
   should accept the new value, and code that keyed a Solana balance by its
   `unknown` row should expect the `solana` row instead.
 
+## October 16 API contract
+
+Update to the latest SDK before placing fund orders. `POST /v1/orders` takes a
+`network` for every fund order and refuses it for BTC, and every order read returns
+`network` (`null` for BTC). The HTTP request pin is `2026-10-16`; the retired
+`2026-10-15` pin returns `400 unsupported_api_version`. An order whose network the
+business turned off, or cannot settle on, ends `failed` with `network_not_in_use`
+or `network_not_eligible`.
+
 ## October 11 API contract
 
 Update to the latest SDK before using the revised contract. Send bank removal
@@ -370,7 +401,7 @@ with `client.DELETE("/v1/bank_accounts/{id}")`, without a body or idempotency ke
 Read bank and wallet operation `status` instead of `state`. Retrieve issued
 statement content with `GET /v1/statements/{id}`; the `/content` route is retired.
 
-The HTTP request pin is `2026-10-15`. The retired pin returns
+The HTTP request pin is `2026-10-16`. The retired pin returns
 `400 unsupported_api_version`. Existing API keys remain valid; stored key and
 thin-event/webhook versions are preserved.
 

package/dist/gen/schema.d.ts

@@ -537,7 +537,7 @@ export interface paths {
         put?: never;
         /**
          * Place an order
-         * @description Creates an order for the authenticated business and returns it as `pending`. BTC orders require both `investments:write` and `investments:btc_write` and use standard settlement. The BTC quote is indicative; execution uses the current native price and fees. Execution is asynchronous and uses the same authorization checks and trading engine as Terminal. Retrieve the order to follow it through `executing` to `filled` or `failed`.
+         * @description Creates an order for the authenticated business and returns it as `pending`. A fund order must name the `network` it settles on, `ethereum` or `stellar`; the API never applies a business's default network. A business that has turned that network off, or is not eligible for it, gets a failed order with a `failure_code` naming why. BTC orders require both `investments:write` and `investments:btc_write`, use standard settlement and settle on no network, so they must not name one. The BTC quote is indicative; execution uses the current native price and fees. Execution is asynchronous and uses the same authorization checks and trading engine as Terminal. Retrieve the order to follow it through `executing` to `filled` or `failed`.
          *
          *     Fund orders check the quoted NAV at execution. Price changes and insufficient express liquidity can cause execution to fail. The failed order includes a reason. While the quote remains valid, an express refusal can be submitted as a new standard order.
          *
@@ -655,7 +655,9 @@ export interface paths {
          * Price a trade
          * @description Returns an indicative price for BTC or a fund. Quotes have no ID and cannot be retrieved later. BTC prices use the latest unexpired native quote; reading one does not extend its expiry. Calculated BTC quote amounts are rounded to at most 18 decimal places. Actual trade amounts are determined at execution. BTC quotes include `platform_fee_usdc`, `fee_bps`, `net_usdc` and the `net_estimated_quantity` after the buy fee. `minimum_amount_usd` states the BTC order minimum. A BTC quote does not guarantee the execution price. Fund orders include the quoted NAV.
          *
-         *     `express` describes the commission, order limit, estimated quantity and settlement estimate for express settlement. These terms do not guarantee available liquidity. An express order may fail at execution; while the quote remains valid, you can submit a new standard order using the same quoted price. Standard settlement changes the commission and delivered quantity, not the quoted price.
+         *     `express` describes the commission, order limit, estimated quantity and settlement estimate for express settlement. These terms do not guarantee available liquidity. An express order may fail at execution; while the quote remains valid, you can submit a new standard order using the same quoted price. Standard settlement changes the commission and delivered quantity, not the quoted price. Express terms apply to Ethereum orders.
+         *
+         *     The price does not depend on the network an order settles on, so a quote takes none. The order names it.
          */
         get: operations["quotes.quote"];
         put?: never;
@@ -1489,7 +1491,7 @@ export interface components {
             /** @enum {string} */
             payment_rail: "onchain_ethereum" | "onchain_stellar" | "onchain_solana";
             /** @enum {string} */
-            symbol?: "USDC" | "XLM";
+            symbol?: "USDC" | "XLM" | "YLDS";
         };
         ExternalWalletHolding: {
             /** @description The quantity held, in the token's own units. Exact, never rounded, and always above zero. */
@@ -1606,7 +1608,7 @@ export interface components {
             observed_ts: string;
         };
         /** @enum {string} */
-        HTTPAPIVersion: "2026-10-15";
+        HTTPAPIVersion: "2026-10-16";
         List: {
             data: components["schemas"]["Resource"][];
             has_more: boolean;
@@ -1672,6 +1674,11 @@ export interface components {
             /** @description The order id. Stable for the life of the order and safe to store. */
             id: string;
             livemode: boolean;
+            /**
+             * @description The network the order settles on, as the request named it. Null for BTC, which settles on no network.
+             * @enum {string|null}
+             */
+            network: "ethereum" | "stellar" | null;
             /** @enum {string} */
             object: "order";
             quoted_price: string;
@@ -1691,10 +1698,15 @@ export interface components {
              * @enum {string}
              */
             direction: "buy" | "sell";
+            /**
+             * @description The network a fund order settles on. Required for a fund order and refused for BTC, which settles on no network. The API never applies a business's default network.
+             * @enum {string}
+             */
+            network?: "ethereum" | "stellar";
             /** @description The price_per_unit from GET /v1/quotes. Fund execution checks the NAV; BTC uses an indicative price and executes at the current native price. */
             quoted_price: string;
             /**
-             * @description Settlement mode. Express (instant) carries a commission the standard path does not; see the express terms on GET /v1/quotes. Express draws on a shared reserve, so an express order can be refused at execution and the order reaches a failed state naming why — re-place it as standard against the same unexpired quote.
+             * @description Settlement mode. Express (instant) carries a commission the standard path does not; see the express terms on GET /v1/quotes. Express draws on a shared reserve, so an express order can be refused at execution and the order reaches a failed state naming why — re-place it as standard against the same unexpired quote. Express settles on ethereum only.
              * @enum {string}
              */
             settlement: "standard" | "instant";

package/dist/gen/session-schema.d.ts

@@ -839,6 +839,50 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/identity/bot_challenge_settings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get bot challenge settings
+         * @description Reports whether the signup screener submit and the signup code resend require a bot-challenge token, and the public site key to render the challenge widget with. Public.
+         */
+        get: operations["identity.bot_challenge_settings.get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/identity/business/networks": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get the networks a business uses
+         * @description Returns every network with whether the business is eligible for it, whether it is in use, which is the default, what it carries, and what the business holds there. Any member of the business can read it. A network that holds funds or has pending transactions carries turn_off_blocked.
+         */
+        get: operations["identity.business.networks.get"];
+        put?: never;
+        /**
+         * Set the networks a business uses
+         * @description Replaces the networks in use and the default network for every member and API key of the business. Requires Manage Permissions. A change applies immediately, with no two-factor code; turning a network on grants no rail. Turning off a network that holds funds or has pending transactions is refused with network_holds_funds, and with network_holdings_unavailable when what it holds cannot be checked; a network the business is not eligible for with network_not_eligible, and an invalid set with invalid_networks. Saving what is already saved changes nothing and records nothing.
+         */
+        post: operations["identity.business.networks.set"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/identity/business_invites/{group_id}/step_2": {
         parameters: {
             query?: never;
@@ -1684,7 +1728,7 @@ export interface paths {
         put?: never;
         /**
          * Resend signup OTP
-         * @description Re-issues the OTP for an in-flight screener session by re-running registration step 1 for the supplied business email, minting a fresh OTP and re-delivering the email. Acknowledges the same way for an address that already has an account, which is then emailed a sign-in prompt rather than a code: this endpoint never reveals whether an address is registered.
+         * @description Re-issues the OTP for an in-flight screener session by re-running registration step 1 for the supplied business email, minting a fresh OTP and re-delivering the email. Acknowledges the same way for an address that already has an account, which is then emailed a sign-in prompt rather than a code: this endpoint never reveals whether an address is registered. While GET /identity/bot_challenge_settings answers required=true, a request without a valid challenge_token is refused (bot_challenge_required / bot_challenge_failed) before any email.
          */
         post: operations["signup.screener.resend_otp"];
         delete?: never;
@@ -1704,7 +1748,7 @@ export interface paths {
         put?: never;
         /**
          * Submit signup screener
-         * @description Validates the screener payload (business email + business name) and starts an identity registration session. Answers the same way for an address that already has an account, which is then emailed a sign-in prompt rather than a code: this endpoint never reveals whether an address is registered.
+         * @description Validates the screener payload (business email + business name) and starts an identity registration session. Answers the same way for an address that already has an account, which is then emailed a sign-in prompt rather than a code: this endpoint never reveals whether an address is registered. While GET /identity/bot_challenge_settings answers required=true, a request without a valid challenge_token is refused (bot_challenge_required / bot_challenge_failed) before any email or CRM lead.
          */
         post: operations["signup.screener.submit"];
         delete?: never;
@@ -2467,6 +2511,52 @@ export interface components {
             /** @description Required for Live keys; omitted for Test keys */
             totp_code?: string;
         };
+        SignupBotChallengeSettings: {
+            /** @description Whether POST /signup/screener/submit and POST /signup/screener/resend_otp refuse a request without a valid challenge_token. */
+            required: boolean;
+            /** @description The public site key to render the challenge widget with. Empty when required is false. */
+            site_key: string;
+        };
+        NetworksOutput: {
+            networks: components["schemas"]["NetworksNetworkItem"][] | null;
+            /** @description Whether this deployment accepts changes to the networks. */
+            writes_enabled: boolean;
+        };
+        NetworksNetworkItem: {
+            carries: components["schemas"]["NetworksCarriesView"];
+            /** @description Whether the business's saved choice includes this network, eligible or not. */
+            chosen: boolean;
+            /** @description Whether this is the default network. At most one network is the default, and it is an enabled one. */
+            default: boolean;
+            /** @description Whether the business may use this network at all, from the rollout settings. Turning a network on never grants a rail. */
+            eligible: boolean;
+            /** @description Whether the business can use this network now: chosen and eligible. */
+            enabled: boolean;
+            /** @description The amounts held on this network, formatted for display, such as 10,000.00 USDC. Empty when none, and when holdings_unavailable. */
+            held: string[] | null;
+            /** @description True when what the network holds could not be read. Held and pending_transactions are then not an answer, and the network cannot be turned off. */
+            holdings_unavailable: boolean;
+            network: components["schemas"]["IdentityNetwork"];
+            /** @description Whether a transaction is in flight on this network or a transfer approval for it is waiting. */
+            pending_transactions: boolean;
+            /** @description Why this enabled network cannot be turned off, worded for the person who sees it. Absent when it can be, and for a network that is not enabled. */
+            turn_off_blocked?: string;
+        };
+        NetworksCarriesView: {
+            /** @description Whether USDC can be received on this network. */
+            deposits: boolean;
+            /** @description Symbols of the funds that can be bought and sold with settlement on this network. BTC trades on no network and is never listed. */
+            funds: string[] | null;
+            /** @description Whether USDC can be sent on this network. */
+            withdrawals: boolean;
+        };
+        /** @enum {string} */
+        IdentityNetwork: "ethereum" | "stellar" | "solana";
+        NetworksSetNetworksInput: {
+            default_network: components["schemas"]["IdentityNetwork"];
+            /** @description The networks to use. At least one, each listed once, each one the business is eligible for. */
+            enabled_networks: components["schemas"]["IdentityNetwork"][] | null;
+        };
         IdentityInviteStep2Input: {
             session_token?: string;
         };
@@ -2915,6 +3005,8 @@ export interface components {
             Success?: boolean;
         };
         SignupResendOTPInput: {
+            /** @description The bot-challenge token the widget issued for the resend_otp action. Required while GET /identity/bot_challenge_settings answers required=true; ignored otherwise. Single use. */
+            challenge_token?: string;
             email?: string;
             otp_session_id?: string;
         };
@@ -2923,6 +3015,8 @@ export interface components {
         };
         SignupScreenerSubmitInput: {
             business_name?: string;
+            /** @description The bot-challenge token the widget issued for the signup action. Required while GET /identity/bot_challenge_settings answers required=true; ignored otherwise. Single use. */
+            challenge_token?: string;
             email?: string;
             first_name?: string;
             last_name?: string;
@@ -5839,6 +5933,142 @@ export interface operations {
             };
         };
     };
+    "identity.bot_challenge_settings.get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SignupBotChallengeSettings"];
+                };
+            };
+            /** @description Error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+        };
+    };
+    "identity.business.networks.get": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["NetworksOutput"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+        };
+    };
+    "identity.business.networks.set": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["NetworksSetNetworksInput"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["NetworksOutput"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Error response. */
+            default: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+        };
+    };
     "identity.business_invites.step2": {
         parameters: {
             query?: never;
@@ -7893,6 +8123,33 @@ export interface operations {
                     "application/json": components["schemas"]["SignupResendOTPAck"];
                 };
             };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Too Many Requests */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Service Unavailable */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
             /** @description Error response. */
             default: {
                 headers: {
@@ -7926,6 +8183,33 @@ export interface operations {
                     "application/json": components["schemas"]["SignupScreenerSubmitOutput"];
                 };
             };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Too Many Requests */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
+            /** @description Service Unavailable */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HttputilAPIError"];
+                };
+            };
             /** @description Error response. */
             default: {
                 headers: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stable_sea/sdk",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "type": "module",
   "sideEffects": false,
   "files": [