Release 5.2.0 - Top-up instructions and amount allocations

[david-ruiz-cko]

This release adds support for retrieving top-up bank instructions for sub-accounts (currency accounts) via a new method in the Balances API, including configuration changes and comprehensive unit tests. It also documents a new request field in payment sessions. The main focus is ensuring the correct URL is used for the new endpoint, which does not follow the existing /balances path convention.

Key changes include:

Balances API Enhancements:

• Added a new retrieveTopUpInstructions method to the Balances class, allowing retrieval of bank details and payment references needed to top up a sub-account. This method uses a new configuration property to target the correct base URL for the endpoint.
• Updated the configuration (src/config.js and src/special-urls.js) to introduce balancesHostUrl, distinguishing it from the standard balancesUrl, so endpoints not under /balances are correctly addressed. [1] [2]

Testing:

• Added a new unit test suite (test/balances/balances-topup-unit.js) covering successful retrievals (including different bank details scenarios) and error handling for authentication and not found errors.

Documentation:

• Updated JSDoc comments for the new retrieveTopUpInstructions method to describe its parameters, response shape, and usage notes.
• Documented the new amount_allocations field in the payment sessions API.

Minor Refactoring:

• Changed a let to const for queryParams in the retrieve method of Balances for code consistency.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• 2.2.7_dependency_upgrade

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
2.2.7_dependency_upgrade	classifying	§2.2.7	All files are manifest + lockfile, and no security-sensitive package was touched.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

🟠 Withholding auto-approval — merit review raised concerns.

This PR is in scope for auto-approval (low-risk class, gates passed, checks green), but the merit review flagged the following for a human to confirm before merge:

• The PR claims to add a new retrieveTopUpInstructions method, config changes (src/config.js, src/special-urls.js), new unit tests, and documentation updates, but the diff contains only a version bump in package.json. Either the implementation changes are missing from the diff or this version bump is being applied without the corresponding code, which a human reviewer should verify before approval.

A maintainer should review and approve manually if these are acceptable.

_{wall-e 2026.06.19-02 · merit review · us.anthropic.claude-sonnet-4-6}