@augustdigital/sdk 8.20.1 → 8.21.0

package/lib/adapters/solana/index.d.ts

@@ -7,7 +7,7 @@ import * as SolanaConstants from './constants';
 import * as SolanaGetters from './getters';
 import * as SolanaActions from './vault.actions';
 import type { AnchorProvider, web3 } from '@coral-xyz/anchor';
-import { Connection, PublicKey, type Transaction } from '@solana/web3.js';
+import { type Commitment, Connection, PublicKey, type Transaction } from '@solana/web3.js';
 import type { ISolanaNetwork, ISolanaRpcEndpoint } from './types';
 import type { SendTransactionOptions } from '@solana/wallet-adapter-base';
 export declare const Solana: {
@@ -61,11 +61,11 @@ export declare const Solana: {
         fetchUserTokenBalance: ({ connection, publicKey, depositMint, }: {
             publicKey: PublicKey | string;
             depositMint?: PublicKey | string;
-        } & import("./types").ISolanaConnectionOptions) => Promise<any>;
+        } & import("./types").ISolanaConnectionOptions) => Promise<string>;
         fetchUserShareBalance: ({ connection, publicKey, shareMint, }: {
             publicKey: PublicKey | string;
             shareMint?: PublicKey | string;
-        } & import("./types").ISolanaConnectionOptions) => Promise<any>;
+        } & import("./types").ISolanaConnectionOptions) => Promise<number>;
         fetchUserShareBalanceRaw: ({ connection, publicKey, shareMint, }: {
             publicKey: PublicKey | string;
             shareMint?: PublicKey | string;
@@ -119,7 +119,23 @@ declare class SolanaAdapter {
     private _network;
     private _connection;
     private _provider;
-    constructor(endpoint: ISolanaRpcEndpoint, network?: ISolanaNetwork);
+    /**
+     * @param commitment - Commitment for every read this adapter makes *and* for
+     *   the confirmation of every write, so the two always describe the same
+     *   chain state — the vault handlers take it from this same `Connection`.
+     *
+     *   Defaults to `'finalized'`, which is what this adapter has always used in
+     *   practice: it previously passed no commitment at all, so both reads and
+     *   confirmations fell through to the RPC's own `'finalized'` default. The
+     *   default is stated explicitly now rather than inherited, but it is
+     *   unchanged.
+     *
+     *   Pass `'confirmed'` for a markedly faster round trip — seconds rather
+     *   than tens of seconds — accepting that the state you act on can still, in
+     *   principle, be rolled back. Also settable as the `commitment` field of
+     *   the `solana` config passed to `AugustSDK`.
+     */
+    constructor(endpoint: ISolanaRpcEndpoint, network?: ISolanaNetwork, commitment?: Commitment);
     get endpoint(): `https://${string}`;
     get network(): ISolanaNetwork;
     get connection(): web3.Connection;
@@ -171,8 +187,8 @@ declare class SolanaAdapter {
         image: string;
     }>;
     getTokenSymbol(mintAddress: string | PublicKey): Promise<string>;
-    fetchUserTokenBalance(publicKey: PublicKey | string, depositMint: PublicKey | string): Promise<any>;
-    fetchUserShareBalance(publicKey: PublicKey | string, shareMint: PublicKey | string): Promise<any>;
+    fetchUserTokenBalance(publicKey: PublicKey | string, depositMint: PublicKey | string): Promise<string>;
+    fetchUserShareBalance(publicKey: PublicKey | string, shareMint: PublicKey | string): Promise<number>;
     /**
      * BigInt-safe variant of {@link fetchUserShareBalance}. Returns the raw u64
      * `amount` (as a base-units string) plus the mint's `decimals` (or `null`
@@ -212,13 +228,31 @@ declare class SolanaAdapter {
     /**
      * Deposit funds into a Solana August vault.
      * @param depositAmount  `bigint` (raw on-chain units) or `number` (UI amount).
+     * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+     *   Share-account creation is now prepended to the deposit instruction, so
+     *   the SDK sends no second transaction and never invokes this callback —
+     *   signing goes through the provider's wallet.
+     *
+     *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+     *   `vaultAddress`, so removing it shifts your vault address into this slot
+     *   and leaves `vaultAddress` undefined — which silently falls back to the
+     *   legacy single-vault PDA derivation and targets a different vault.
      */
-    vaultDeposit(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, depositAmount: number | bigint, sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
+    vaultDeposit(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, depositAmount: number | bigint, sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
     /**
      * Redeem vault shares from a Solana August vault.
      * @param redeemShares  `bigint` (raw share units) or `number` (UI amount).
+     * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+     *   Payout- and fee-recipient-account creation is now prepended to the redeem
+     *   instruction, so the SDK sends no second transaction and never invokes
+     *   this callback — signing goes through the provider's wallet.
+     *
+     *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+     *   `vaultAddress`, so removing it shifts your vault address into this slot
+     *   and leaves `vaultAddress` undefined — which silently falls back to the
+     *   legacy single-vault PDA derivation and targets a different vault.
      */
-    vaultRedeem(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, redeemShares: number | bigint, sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
+    vaultRedeem(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, redeemShares: number | bigint, sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
     /**
      * Canonical program id for a program type on this adapter's network.
      *

package/lib/adapters/solana/index.js

@@ -68,10 +68,29 @@ class SolanaAdapter {
     _network;
     _connection;
     _provider;
-    constructor(endpoint, network = utils_1.SolanaUtils.fallbackNetwork) {
+    /**
+     * @param commitment - Commitment for every read this adapter makes *and* for
+     *   the confirmation of every write, so the two always describe the same
+     *   chain state — the vault handlers take it from this same `Connection`.
+     *
+     *   Defaults to `'finalized'`, which is what this adapter has always used in
+     *   practice: it previously passed no commitment at all, so both reads and
+     *   confirmations fell through to the RPC's own `'finalized'` default. The
+     *   default is stated explicitly now rather than inherited, but it is
+     *   unchanged.
+     *
+     *   Pass `'confirmed'` for a markedly faster round trip — seconds rather
+     *   than tens of seconds — accepting that the state you act on can still, in
+     *   principle, be rolled back. Also settable as the `commitment` field of
+     *   the `solana` config passed to `AugustSDK`.
+     */
+    constructor(endpoint, network = utils_1.SolanaUtils.fallbackNetwork, commitment = 'finalized') {
         this._endpoint = endpoint;
         this._network = network;
-        const connection = new web3_js_1.Connection(endpoint);
+        // Explicit rather than inherited: left unset, web3.js omits the parameter
+        // and the RPC applies its own default, which is the same 'finalized' —
+        // but then nothing ties it to the commitment writes confirm at.
+        const connection = new web3_js_1.Connection(endpoint, commitment);
         this._connection = connection;
         this._provider = utils_1.SolanaUtils.getReadOnlyProvider({
             network: this._network,
@@ -238,6 +257,15 @@ class SolanaAdapter {
     /**
      * Deposit funds into a Solana August vault.
      * @param depositAmount  `bigint` (raw on-chain units) or `number` (UI amount).
+     * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+     *   Share-account creation is now prepended to the deposit instruction, so
+     *   the SDK sends no second transaction and never invokes this callback —
+     *   signing goes through the provider's wallet.
+     *
+     *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+     *   `vaultAddress`, so removing it shifts your vault address into this slot
+     *   and leaves `vaultAddress` undefined — which silently falls back to the
+     *   legacy single-vault PDA derivation and targets a different vault.
      */
     async vaultDeposit(vaultProgramId, idl, publicKey, depositAmount, sendTransaction, vaultAddress) {
         return await (0, vault_actions_1.handleSolanaDeposit)({
@@ -255,6 +283,15 @@ class SolanaAdapter {
     /**
      * Redeem vault shares from a Solana August vault.
      * @param redeemShares  `bigint` (raw share units) or `number` (UI amount).
+     * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+     *   Payout- and fee-recipient-account creation is now prepended to the redeem
+     *   instruction, so the SDK sends no second transaction and never invokes
+     *   this callback — signing goes through the provider's wallet.
+     *
+     *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+     *   `vaultAddress`, so removing it shifts your vault address into this slot
+     *   and leaves `vaultAddress` undefined — which silently falls back to the
+     *   legacy single-vault PDA derivation and targets a different vault.
      */
     async vaultRedeem(vaultProgramId, idl, publicKey, redeemShares, sendTransaction, vaultAddress) {
         return await (0, vault_actions_1.handleSolanaRedeem)({

package/lib/adapters/solana/utils.d.ts

@@ -1,5 +1,5 @@
 import { AnchorProvider, BN, Program, type web3 } from '@coral-xyz/anchor';
-import { PublicKey, type Transaction } from '@solana/web3.js';
+import { PublicKey, type ParsedAccountData, type Transaction } from '@solana/web3.js';
 import type { ISolanaConnectionOptions, ISolanaVaultState } from './types';
 declare function getExplorerLink({ signature, type, network, }: {
     signature: string;
@@ -58,14 +58,65 @@ declare function getToken({ mintAddress, endpoint, connection, }: {
 declare function getTokenSymbol({ endpoint, mintAddress, }: {
     mintAddress: string | PublicKey;
 } & ISolanaConnectionOptions): Promise<string | null>;
+/**
+ * A wallet's token account of record for one mint: the account holding the
+ * largest balance.
+ *
+ * **This is the single selection rule for the whole Solana adapter.** Reads
+ * (balances shown in a UI) and writes (the account a transfer actually names)
+ * must agree on which account represents the user, or the two describe
+ * different money: a balance read from account A while a deposit mints into
+ * account B looks, to the user, like a successful transaction that never
+ * arrived. Every reader in this file and both vault handlers call this, so the
+ * rule cannot drift.
+ *
+ * Largest-balance rather than "the first account the RPC returned":
+ * `getParsedTokenAccountsByOwner` guarantees no ordering, so taking `[0]` can
+ * select an empty leftover while the user's funds sit in a sibling account —
+ * which fails on-chain as an insufficient-funds revert *after* they sign.
+ *
+ * **Spendable accounts win over frozen ones**, regardless of balance: a token
+ * issuer can freeze an account, and neither a transfer out of nor a transfer
+ * into a frozen account can succeed. Picking the richest account outright would
+ * hand a frozen one to the program and revert with SPL `0x11` after the user
+ * signs, while a perfectly usable sibling sat next to it. When *every* account
+ * is frozen the richest frozen one is still returned, flagged — a reader should
+ * show that balance, because the user does own it, and a writer should refuse
+ * before asking for a signature.
+ *
+ * Internal to the adapter: exported for `vault.actions.ts`, deliberately not
+ * re-exported on `SolanaUtils`. It takes a raw RPC response shape, which is not
+ * a contract worth freezing on the public surface.
+ *
+ * @param accounts - The `.value` array from `getParsedTokenAccountsByOwner`.
+ * @returns The selected account with its raw balance, decimals, the RPC's own
+ *   `uiAmount`, and whether it is frozen — or `undefined` when the wallet owns
+ *   no account for the mint.
+ * @throws AugustSDKError when an account's balance cannot be read. An
+ *   unreadable balance is *unknown*, not zero — scoring it zero would silently
+ *   demote a funded account below a dust one and reinstate the `[0]` behaviour
+ *   this function exists to prevent.
+ */
+export declare function selectRichestTokenAccount(accounts: {
+    pubkey: PublicKey;
+    account: {
+        data: ParsedAccountData | Buffer;
+    };
+}[]): {
+    pubkey: PublicKey;
+    amount: bigint;
+    decimals: number | null;
+    uiAmount: number | null;
+    frozen: boolean;
+} | undefined;
 declare function fetchUserTokenBalance({ connection, publicKey, depositMint, }: {
     publicKey: PublicKey | string;
     depositMint?: PublicKey | string;
-} & ISolanaConnectionOptions): Promise<any>;
+} & ISolanaConnectionOptions): Promise<string>;
 declare function fetchUserShareBalance({ connection, publicKey, shareMint, }: {
     publicKey: PublicKey | string;
     shareMint?: PublicKey | string;
-} & ISolanaConnectionOptions): Promise<any>;
+} & ISolanaConnectionOptions): Promise<number>;
 /**
  * Same on-chain lookup as `fetchUserShareBalance`, but returns the raw u64
  * `amount` string and the mint's `decimals` — or `null` when the scale can't

package/lib/adapters/solana/utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SolanaUtils = exports.isSolanaAddress = void 0;
+exports.selectRichestTokenAccount = selectRichestTokenAccount;
 exports.uiAmountToRawBn = uiAmountToRawBn;
 const anchor_1 = require("@coral-xyz/anchor");
 const web3_js_1 = require("@solana/web3.js");
@@ -103,7 +104,11 @@ function getProvider({ connection, publicKey, signTransaction, }) {
             const signedTransactions = await Promise.all(txs.map(async (tx) => signTransaction(tx)));
             return signedTransactions;
         },
-    }, { commitment: 'confirmed' });
+    }, 
+    // Inherited from the connection, not hard-coded: a caller who configured
+    // the adapter for 'finalized' must not have writes issued through
+    // `getProgram(...).methods…rpc()` confirm at something weaker.
+    { commitment: connection.commitment ?? 'finalized' });
 }
 // Read-only provider for data fetching without wallet connection
 function getReadOnlyProvider({ connection }) {
@@ -117,8 +122,10 @@ function getReadOnlyProvider({ connection }) {
             throw new core_1.AugustValidationError('INVALID_INPUT', 'Cannot sign transactions with read-only provider');
         },
     };
+    // See `getProvider` — the connection is the single source of truth for
+    // commitment, so reads through this provider match reads made directly.
     return new anchor_1.AnchorProvider(connection, dummyWallet, {
-        commitment: 'confirmed',
+        commitment: connection.commitment ?? 'finalized',
     });
 }
 // ============================================================================
@@ -440,6 +447,87 @@ async function getTokenSymbol({ endpoint, mintAddress, }) {
         return null;
     }
 }
+/**
+ * A wallet's token account of record for one mint: the account holding the
+ * largest balance.
+ *
+ * **This is the single selection rule for the whole Solana adapter.** Reads
+ * (balances shown in a UI) and writes (the account a transfer actually names)
+ * must agree on which account represents the user, or the two describe
+ * different money: a balance read from account A while a deposit mints into
+ * account B looks, to the user, like a successful transaction that never
+ * arrived. Every reader in this file and both vault handlers call this, so the
+ * rule cannot drift.
+ *
+ * Largest-balance rather than "the first account the RPC returned":
+ * `getParsedTokenAccountsByOwner` guarantees no ordering, so taking `[0]` can
+ * select an empty leftover while the user's funds sit in a sibling account —
+ * which fails on-chain as an insufficient-funds revert *after* they sign.
+ *
+ * **Spendable accounts win over frozen ones**, regardless of balance: a token
+ * issuer can freeze an account, and neither a transfer out of nor a transfer
+ * into a frozen account can succeed. Picking the richest account outright would
+ * hand a frozen one to the program and revert with SPL `0x11` after the user
+ * signs, while a perfectly usable sibling sat next to it. When *every* account
+ * is frozen the richest frozen one is still returned, flagged — a reader should
+ * show that balance, because the user does own it, and a writer should refuse
+ * before asking for a signature.
+ *
+ * Internal to the adapter: exported for `vault.actions.ts`, deliberately not
+ * re-exported on `SolanaUtils`. It takes a raw RPC response shape, which is not
+ * a contract worth freezing on the public surface.
+ *
+ * @param accounts - The `.value` array from `getParsedTokenAccountsByOwner`.
+ * @returns The selected account with its raw balance, decimals, the RPC's own
+ *   `uiAmount`, and whether it is frozen — or `undefined` when the wallet owns
+ *   no account for the mint.
+ * @throws AugustSDKError when an account's balance cannot be read. An
+ *   unreadable balance is *unknown*, not zero — scoring it zero would silently
+ *   demote a funded account below a dust one and reinstate the `[0]` behaviour
+ *   this function exists to prevent.
+ */
+function selectRichestTokenAccount(accounts) {
+    const parsed = accounts.map((entry) => {
+        const info = entry.account.data?.parsed?.info;
+        const tokenAmount = info?.tokenAmount;
+        const raw = tokenAmount?.amount;
+        // A u64 string is the only shape the RPC promises here. Anything else
+        // (a base64 `data` the node could not jsonParse, a reshaping proxy) means
+        // we do not know this balance.
+        if (typeof raw !== 'string' || !/^\d+$/.test(raw)) {
+            throw new core_1.AugustSDKError('UNKNOWN', `Could not read the balance of token account ${entry.pubkey.toBase58()}. ` +
+                'The RPC returned an unrecognized response; please retry or switch RPC.', {
+                context: {
+                    account: entry.pubkey.toBase58(),
+                    rawAmount: String(raw),
+                },
+            });
+        }
+        return {
+            pubkey: entry.pubkey,
+            amount: BigInt(raw),
+            decimals: typeof tokenAmount?.decimals === 'number' ? tokenAmount.decimals : null,
+            // Passed through from the RPC rather than recomputed from `amount`, so
+            // the lossy float these legacy readers return is not made lossier.
+            uiAmount: typeof tokenAmount?.uiAmount === 'number' ? tokenAmount.uiAmount : null,
+            frozen: info?.state === 'frozen',
+        };
+    });
+    const richest = (candidates) => candidates.reduce((best, candidate) => {
+        if (!best)
+            return candidate;
+        if (candidate.amount !== best.amount)
+            return candidate.amount > best.amount ? candidate : best;
+        // Equal balances: break the tie on the address. Falling back to "whichever
+        // the RPC listed first" would leave exactly the ordering dependence this
+        // function exists to remove — harmless while the balances match, but it
+        // means two calls can name different accounts for the same wallet.
+        return candidate.pubkey.toBase58() < best.pubkey.toBase58()
+            ? candidate
+            : best;
+    }, undefined);
+    return richest(parsed.filter((a) => !a.frozen)) ?? richest(parsed);
+}
 async function fetchUserTokenBalance({ connection, publicKey, depositMint, }) {
     if (!publicKey || !depositMint)
         return '0';
@@ -449,12 +537,9 @@ async function fetchUserTokenBalance({ connection, publicKey, depositMint, }) {
         const tokenAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
             mint: _depositMint,
         });
-        if (tokenAccounts.value.length > 0) {
-            const balance = tokenAccounts?.value?.[0]?.account.data.parsed.info.tokenAmount
-                .uiAmount;
-            return balance?.toString() || '0';
-        }
-        return '0';
+        // Same rule the write path uses — see `selectRichestTokenAccount`.
+        const richest = selectRichestTokenAccount(tokenAccounts.value);
+        return richest?.uiAmount?.toString() || '0';
     }
     catch (e) {
         const error = e;
@@ -473,12 +558,9 @@ async function fetchUserShareBalance({ connection, publicKey, shareMint, }) {
         const shareAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
             mint: _shareMint,
         });
-        if (shareAccounts.value.length > 0) {
-            const balance = shareAccounts?.value?.[0]?.account.data.parsed.info.tokenAmount
-                .uiAmount;
-            return balance ?? 0;
-        }
-        return 0;
+        // Same rule the write path uses — see `selectRichestTokenAccount`.
+        const richest = selectRichestTokenAccount(shareAccounts.value);
+        return richest?.uiAmount ?? 0;
     }
     catch (e) {
         const error = e;
@@ -519,12 +601,13 @@ async function fetchUserShareBalanceRaw({ connection, publicKey, shareMint, }) {
         const shareAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
             mint: _shareMint,
         });
-        const tokenAmount = shareAccounts?.value?.[0]?.account?.data?.parsed?.info?.tokenAmount;
-        if (!tokenAmount)
+        // Same rule the write path uses — see `selectRichestTokenAccount`.
+        const richest = selectRichestTokenAccount(shareAccounts?.value ?? []);
+        if (!richest)
             return { amount: '0', decimals: null };
         return {
-            amount: String(tokenAmount.amount ?? '0'),
-            decimals: typeof tokenAmount.decimals === 'number' ? tokenAmount.decimals : null,
+            amount: richest.amount.toString(),
+            decimals: richest.decimals,
         };
     }
     catch (e) {

package/lib/adapters/solana/vault.actions.d.ts

@@ -1,5 +1,5 @@
 import { type web3 } from '@coral-xyz/anchor';
-import { type Connection, PublicKey, Transaction } from '@solana/web3.js';
+import { type Connection, PublicKey, type Transaction } from '@solana/web3.js';
 import type { ISolanaConnectionOptions } from './types';
 import type { SendTransactionOptions } from '@solana/wallet-adapter-base';
 /**
@@ -26,18 +26,33 @@ export declare function describeSolanaError(e: unknown): string;
  * @param depositAmount  `bigint` is treated as raw on-chain units (preferred
  *   — no JS-float round-trip). `number` is treated as a UI amount and
  *   scaled by the deposit mint's decimals via {@link uiAmountToRawBn}.
- * @throws AugustValidationError on missing wallet/programId or invalid amount.
+ * @throws AugustValidationError on missing wallet/programId or invalid amount,
+ *   or when the wallet's deposit-mint balance is below `depositAmount`.
+ * @throws AugustSDKError when a candidate token account's balance cannot be
+ *   read, or wrapping any downstream failure (`cause` preserved).
+ * @remarks **Side effects.** Submits exactly one transaction, signed by the
+ *   provider's wallet. When the wallet has no share account, that transaction
+ *   also creates one, and `publicKey` pays its rent — roughly 0.00204 SOL,
+ *   non-refundable while the account stays open — on top of the network fee.
+ *   Callers should ensure the wallet holds enough SOL for both before
+ *   prompting the user to sign.
  * @remarks The on-chain `deposit` instruction has no `min_shares_out`
  *   parameter; slippage cannot be enforced on-chain until the program ships
  *   that argument.
  */
-export declare function handleSolanaDeposit({ provider, connection, network, vaultProgramId, vaultAddress, depositAmount, publicKey, sendTransaction, idl, }: {
+export declare function handleSolanaDeposit({ provider, connection, network, vaultProgramId, vaultAddress, depositAmount, publicKey, idl, }: {
     vaultProgramId: PublicKey | string;
     vaultAddress?: PublicKey | string;
     idl: any;
     publicKey: PublicKey | string;
     depositAmount: number | bigint;
-    sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
+    /**
+     * @deprecated Accepted and ignored. Share-account creation is now prepended
+     * to the deposit instruction, so there is no longer a second transaction to
+     * send. Kept so existing callers keep compiling; will be removed in the next
+     * major.
+     */
+    sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
 } & ISolanaConnectionOptions): Promise<any>;
 /**
  * Redeem vault shares back into the underlying mint on a Solana August vault.
@@ -45,13 +60,28 @@ export declare function handleSolanaDeposit({ provider, connection, network, vau
  * @param redeemShares  `bigint` is treated as raw share-token units;
  *   `number` is treated as a UI amount. See {@link handleSolanaDeposit} for
  *   the same caveat about the missing on-chain slippage guard.
- * @throws AugustValidationError on missing wallet/programId or invalid amount.
+ * @throws AugustValidationError on missing wallet/programId or invalid amount,
+ *   or when the wallet holds fewer shares than `redeemShares`.
+ * @throws AugustSDKError when a candidate token account's balance cannot be
+ *   read, or wrapping any downstream failure (`cause` preserved).
+ * @remarks **Side effects.** Submits exactly one transaction, signed by the
+ *   provider's wallet. That transaction also creates the payout account when
+ *   the wallet has none, and the vault's fee-recipient account when *it* has
+ *   none — `publicKey` pays rent for both, roughly 0.00204 SOL each and
+ *   non-refundable, on top of the network fee. Callers should ensure the
+ *   wallet holds enough SOL for all of it before prompting the user to sign.
  */
-export declare function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, sendTransaction, idl, }: {
+export declare function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, idl, }: {
     idl: any;
     vaultProgramId: PublicKey | string;
     vaultAddress?: PublicKey | string;
     publicKey: PublicKey | string;
     redeemShares: number | bigint;
-    sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
+    /**
+     * @deprecated Accepted and ignored. Payout- and fee-recipient-account
+     * creation is now prepended to the redeem instruction, so there is no longer
+     * a second transaction to send. Kept so existing callers keep compiling;
+     * will be removed in the next major.
+     */
+    sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
 } & ISolanaConnectionOptions): Promise<any>;

package/lib/adapters/solana/vault.actions.js

@@ -49,18 +49,114 @@ function describeSolanaError(e) {
         ? str
         : REASONLESS_SOLANA_ERROR;
 }
+/**
+ * Pick which token account to hand the vault program for a given mint, and
+ * describe how to create it when the user has none.
+ *
+ * The vault program constrains these accounts by `token::mint` +
+ * `token::authority` (not `associated_token::…`), so any account the signer
+ * owns qualifies. We therefore keep an existing account when there is one —
+ * that is where the user's balance already lives — and fall back to the
+ * associated token account otherwise.
+ *
+ * Two deliberate choices:
+ *
+ * - **The create is returned, not sent.** Prepended to the deposit/redeem via
+ *   `.preInstructions()` it is atomic with the transfer, so there is no window
+ *   in which the vault instruction can reference an account that has not
+ *   landed. Sent as its own transaction — as this module used to — it raced
+ *   its own confirmation. Observed in production (AUGUST-7221, 2026-08-11):
+ *   a deposit failed with `Simulation failed … Logs: []` while the share-ATA
+ *   create was still in flight, then succeeded 17s later on retry. The empty
+ *   log array means the transaction never reached program execution, so there
+ *   was nothing on-chain to debug from.
+ * - **Idempotent.** `createAssociatedTokenAccountIdempotentInstruction` is a
+ *   no-op when the account already exists, so a concurrent create — another
+ *   tab, a wallet's auto-provisioning — cannot turn into an
+ *   `SystemError::AccountAlreadyInUse` ("already in use") failure between our
+ *   read and our submit.
+ *
+ * Which account wins when several exist is decided by
+ * {@link selectRichestTokenAccount} — the same rule every balance *read* in
+ * this adapter uses, so the account a UI reports and the account a transfer
+ * names are never different accounts.
+ *
+ * Classic SPL Token only: the ATA is derived under `TOKEN_PROGRAM_ID`, matching
+ * the `tokenProgram` both handlers pass, even though the program's
+ * `TokenInterface` would also accept Token-2022.
+ *
+ * @param owner - Wallet that owns the account and pays rent for any creation.
+ * @throws AugustSDKError when a candidate account's balance cannot be read
+ *   (propagated from the shared selector), and `TokenOwnerOffCurveError` when
+ *   `owner` is off-curve and an ATA has to be derived.
+ */
+async function resolveUserTokenAccount({ connection, owner, mint, }) {
+    const existing = await connection.getParsedTokenAccountsByOwner(owner, {
+        mint,
+    });
+    const richest = (0, utils_1.selectRichestTokenAccount)(existing.value);
+    if (richest)
+        return {
+            address: richest.pubkey,
+            balance: richest.amount,
+            frozen: richest.frozen,
+        };
+    const ata = await (0, spl_token_1.getAssociatedTokenAddress)(mint, owner);
+    return {
+        address: ata,
+        balance: BigInt(0),
+        frozen: false,
+        createIx: (0, spl_token_1.createAssociatedTokenAccountIdempotentInstruction)(owner, // payer
+        ata, // associated token account
+        owner, // owner
+        mint),
+    };
+}
+/**
+ * Resolve the two token accounts a vault instruction needs, concurrently.
+ *
+ * The lookups are independent, so running them in sequence doubles the
+ * round-trip latency on the hot path for no benefit — both results are needed
+ * before anything is submitted either way.
+ *
+ * Rejections are surfaced in argument order rather than in whichever order the
+ * RPC happened to fail, so the error a user sees does not depend on network
+ * timing. `Promise.all` would reject with whichever call failed *first*, which
+ * on a malformed RPC response (both lookups throwing) would name a different
+ * account run to run.
+ *
+ * @param mints - `[first, second]`; the returned tuple matches this order.
+ */
+async function resolveUserTokenAccountPair({ connection, owner, mints, }) {
+    const settled = await Promise.allSettled(mints.map((mint) => resolveUserTokenAccount({ connection, owner, mint })));
+    const resolved = settled.map((outcome) => {
+        if (outcome.status === 'rejected')
+            throw outcome.reason;
+        return outcome.value;
+    });
+    return [resolved[0], resolved[1]];
+}
 /**
  * Deposit funds into a Solana August vault and mint share tokens.
  *
  * @param depositAmount  `bigint` is treated as raw on-chain units (preferred
  *   — no JS-float round-trip). `number` is treated as a UI amount and
  *   scaled by the deposit mint's decimals via {@link uiAmountToRawBn}.
- * @throws AugustValidationError on missing wallet/programId or invalid amount.
+ * @throws AugustValidationError on missing wallet/programId or invalid amount,
+ *   or when the wallet's deposit-mint balance is below `depositAmount`.
+ * @throws AugustSDKError when a candidate token account's balance cannot be
+ *   read, or wrapping any downstream failure (`cause` preserved).
+ * @remarks **Side effects.** Submits exactly one transaction, signed by the
+ *   provider's wallet. When the wallet has no share account, that transaction
+ *   also creates one, and `publicKey` pays its rent — roughly 0.00204 SOL,
+ *   non-refundable while the account stays open — on top of the network fee.
+ *   Callers should ensure the wallet holds enough SOL for both before
+ *   prompting the user to sign.
  * @remarks The on-chain `deposit` instruction has no `min_shares_out`
  *   parameter; slippage cannot be enforced on-chain until the program ships
  *   that argument.
  */
-async function handleSolanaDeposit({ provider, connection, network = constants_1.fallbackNetwork, vaultProgramId, vaultAddress, depositAmount, publicKey, sendTransaction, idl, }) {
+async function handleSolanaDeposit({ provider, connection, network = constants_1.fallbackNetwork, vaultProgramId, vaultAddress, depositAmount, publicKey, idl, }) {
     try {
         if (!publicKey)
             throw new core_1.AugustValidationError('INVALID_INPUT', 'handleSolanaDeposit: wallet not connected');
@@ -119,50 +215,70 @@ async function handleSolanaDeposit({ provider, connection, network = constants_1
             }
             depositAmountRaw = (0, utils_1.uiAmountToRawBn)(depositAmount, decimals);
         }
-        // Find user's token accounts
-        const userTokenAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
-            mint: _depositMint,
-        });
-        core_1.Logger.log.info('handleSolanaDeposit', 'User token accounts', userTokenAccounts);
-        const userShareAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
-            mint: shareMintAddr,
+        // Re-check *after* scaling. The guard above tests the caller's number, but
+        // a positive UI amount below one raw unit (1e-7 into a 6-decimal mint)
+        // truncates to zero here. Zero would then pass the balance gate below
+        // (`0n < 0n` is false) and submit a no-op transfer — from an account that
+        // may not even exist, since a zero balance is also what an absent account
+        // reports.
+        if (depositAmountRaw.lten(0)) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', `Deposit amount is too small: ${depositAmount} is below one raw unit ` +
+                `of a ${decimals}-decimal mint.`);
+        }
+        // Match whatever this connection *reads* at. A `Connection` built without
+        // a commitment omits the parameter, so its reads take the RPC's default —
+        // `finalized`. Confirming writes at `confirmed` there would put reads
+        // behind writes again, which is the mismatch this whole change removes.
+        // `SolanaAdapter` always sets one explicitly, so this fallback only
+        // applies to callers reaching these handlers directly via `Solana.actions`.
+        const txCommitment = connection.commitment ?? 'finalized';
+        // `depositAccount` funds the transfer; `shareAccount` receives the minted
+        // shares. Independent lookups, so they run concurrently — but the guards
+        // below stay in a fixed order so the first problem a user hits is always
+        // reported the same way.
+        const [depositAccount, shareAccount] = await resolveUserTokenAccountPair({
+            connection,
+            owner: _publicKey,
+            mints: [_depositMint, shareMintAddr],
         });
-        core_1.Logger.log.info('handleSolanaDeposit', 'User share accounts', userShareAccounts);
-        if (userTokenAccounts.value.length === 0) {
-            throw new core_1.AugustValidationError('INVALID_INPUT', 'No token account found for deposit mint. Please create a token account first.');
+        // Gate on the balance, not on whether an account exists: an empty leftover
+        // account is a real state, and letting it through only trades this error
+        // for an insufficient-funds revert the user pays a signature to discover.
+        // The balance is already in hand from the lookup, so this costs no extra
+        // RPC.
+        if (depositAccount.frozen) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', 'Your token account for the deposit mint is frozen by the token issuer, ' +
+                'so the deposit cannot be transferred out of it.');
         }
-        let senderShareAccount;
-        if (userShareAccounts.value.length === 0) {
-            core_1.Logger.log.info('handleSolanaDeposit', 'Creating share account');
-            // Create share account if it doesn't exist
-            senderShareAccount = await (0, spl_token_1.getAssociatedTokenAddress)(shareMintAddr, _publicKey);
-            core_1.Logger.log.info('handleSolanaDeposit', 'Sender share account', senderShareAccount.toBase58());
-            // Create the associated token account
-            const createAtaIx = (0, spl_token_1.createAssociatedTokenAccountInstruction)(_publicKey, // payer
-            senderShareAccount, // associated token account
-            _publicKey, // owner
-            shareMintAddr);
-            core_1.Logger.log.info('handleSolanaDeposit', 'Create ATA Ix', createAtaIx.programId.toBase58());
-            const transaction = new web3_js_1.Transaction().add(createAtaIx);
-            const signature = await sendTransaction(transaction, connection);
-            core_1.Logger.log.info('handleSolanaDeposit', 'Created share account:', signature.toString());
+        if (depositAccount.balance < BigInt(depositAmountRaw.toString())) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', `Insufficient balance to deposit: this wallet holds ${depositAccount.balance} ` +
+                `raw units of the deposit mint, and the deposit requires ${depositAmountRaw.toString()}.`);
         }
-        else {
-            senderShareAccount = userShareAccounts.value[0]?.pubkey;
+        const senderTokenAccount = depositAccount.address;
+        // A missing share account is routine — every first-time depositor starts
+        // here, as does anyone whose account was closed after redeeming their full
+        // balance — so it is created inline rather than rejecting the deposit.
+        // Minting into a *frozen* one fails just as transferring out of one does,
+        // so this destination needs the same guard as the funding account above.
+        if (shareAccount.frozen) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', 'Your share account is frozen by the token issuer, so it cannot ' +
+                'receive the shares this deposit would mint.');
         }
-        const senderTokenAccount = userTokenAccounts.value[0]?.pubkey;
-        core_1.Logger.log.info('handleSolanaDeposit', 'Sender token account', senderTokenAccount);
+        const senderShareAccount = shareAccount.address;
+        const preInstructions = shareAccount.createIx
+            ? [shareAccount.createIx]
+            : [];
+        core_1.Logger.log.info('handleSolanaDeposit', 'Sender token account', senderTokenAccount.toBase58());
+        core_1.Logger.log.info('handleSolanaDeposit', shareAccount.createIx
+            ? 'Sender share account (created in this tx)'
+            : 'Sender share account (existing)', senderShareAccount.toBase58());
         core_1.Logger.log.info('handleSolanaDeposit', '\n\nDeposit TX Params:\n');
         core_1.Logger.log.info('handleSolanaDeposit', 'Program', depositAmountRaw);
         core_1.Logger.log.info('handleSolanaDeposit', 'Vault state PDA', vaultStatePda.toBase58());
         core_1.Logger.log.info('handleSolanaDeposit', 'Vault token ATA PDA', vaultTokenAtaPda.toBase58());
-        core_1.Logger.log.info('handleSolanaDeposit', 'Sender token account', senderTokenAccount?.toBase58());
-        core_1.Logger.log.info('handleSolanaDeposit', 'Sender share account', senderShareAccount?.toBase58());
         core_1.Logger.log.info('handleSolanaDeposit', 'Share mint', shareMintAddr.toBase58());
         core_1.Logger.log.info('handleSolanaDeposit', 'Deposit mint', _depositMint?.toBase58());
         core_1.Logger.log.info('handleSolanaDeposit', 'Signer', _publicKey.toBase58());
-        // Get a fresh blockhash to avoid "Blockhash not found" errors
-        const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
         // TODO(slippage): pass `min_shares_out` here when the program ships it.
         const tx = await program.methods
             .deposit(depositAmountRaw)
@@ -172,21 +288,25 @@ async function handleSolanaDeposit({ provider, connection, network = constants_1
             senderTokenAccount,
             senderShareAccount,
             shareMint: shareMintAddr,
-            depositMint: depositMint,
-            signer: publicKey,
+            depositMint: _depositMint,
+            signer: _publicKey,
             tokenProgram: spl_token_1.TOKEN_PROGRAM_ID,
         })
+            .preInstructions(preInstructions)
+            // `.rpc()` builds, signs, submits and confirms in one step. The extra
+            // `getLatestBlockhash` + `confirmTransaction` this module used to run
+            // afterwards re-confirmed an already-confirmed signature against a
+            // blockhash the transaction never carried.
+            //
+            // Commitment is taken from the same `Connection` every read in this
+            // adapter uses, so a caller who asks for 'finalized' gets it on both
+            // sides rather than finalized reads racing confirmed writes.
             .rpc({
             skipPreflight: false,
-            preflightCommitment: 'confirmed',
+            preflightCommitment: txCommitment,
+            commitment: txCommitment,
         });
         core_1.Logger.log.info('handleSolanaDeposit', 'Deposit successful:', tx);
-        // Wait for confirmation with the blockhash we used
-        await connection.confirmTransaction({
-            signature: tx,
-            blockhash,
-            lastValidBlockHeight,
-        }, 'confirmed');
         return tx;
     }
     catch (e) {
@@ -216,9 +336,18 @@ async function handleSolanaDeposit({ provider, connection, network = constants_1
  * @param redeemShares  `bigint` is treated as raw share-token units;
  *   `number` is treated as a UI amount. See {@link handleSolanaDeposit} for
  *   the same caveat about the missing on-chain slippage guard.
- * @throws AugustValidationError on missing wallet/programId or invalid amount.
+ * @throws AugustValidationError on missing wallet/programId or invalid amount,
+ *   or when the wallet holds fewer shares than `redeemShares`.
+ * @throws AugustSDKError when a candidate token account's balance cannot be
+ *   read, or wrapping any downstream failure (`cause` preserved).
+ * @remarks **Side effects.** Submits exactly one transaction, signed by the
+ *   provider's wallet. That transaction also creates the payout account when
+ *   the wallet has none, and the vault's fee-recipient account when *it* has
+ *   none — `publicKey` pays rent for both, roughly 0.00204 SOL each and
+ *   non-refundable, on top of the network fee. Callers should ensure the
+ *   wallet holds enough SOL for all of it before prompting the user to sign.
  */
-async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, sendTransaction, idl, }) {
+async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, idl, }) {
     try {
         if (!publicKey)
             throw new core_1.AugustValidationError('INVALID_INPUT', 'handleSolanaRedeem: wallet not connected');
@@ -276,21 +405,48 @@ async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultA
             }
             redeemSharesRaw = (0, utils_1.uiAmountToRawBn)(redeemShares, shareDecimals);
         }
-        // Find user's token accounts
-        const userTokenAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
-            mint: _depositMint,
-        });
-        const userShareAccounts = await connection.getParsedTokenAccountsByOwner(_publicKey, {
-            mint: shareMintAddr,
+        // See `handleSolanaDeposit` — a positive UI amount can truncate to zero,
+        // which would pass the share-balance gate below and burn nothing.
+        if (redeemSharesRaw.lten(0)) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', `Redemption amount is too small: ${redeemShares} is below one raw unit ` +
+                `of a ${shareDecimals}-decimal share mint.`);
+        }
+        // Match whatever this connection *reads* at. A `Connection` built without
+        // a commitment omits the parameter, so its reads take the RPC's default —
+        // `finalized`. Confirming writes at `confirmed` there would put reads
+        // behind writes again, which is the mismatch this whole change removes.
+        // `SolanaAdapter` always sets one explicitly, so this fallback only
+        // applies to callers reaching these handlers directly via `Solana.actions`.
+        const txCommitment = connection.commitment ?? 'finalized';
+        // `shareAccount` is burned from; `payoutAccount` receives the underlying.
+        // Independent lookups, so they run concurrently — guards stay ordered.
+        const [shareAccount, payoutAccount] = await resolveUserTokenAccountPair({
+            connection,
+            owner: _publicKey,
+            mints: [shareMintAddr, _depositMint],
         });
-        if (userTokenAccounts.value.length === 0) {
-            throw new core_1.AugustValidationError('INVALID_INPUT', 'No token account found for deposit mint. Please create a token account first.');
+        // Gated on balance for the same reason as the deposit's funding account.
+        if (shareAccount.frozen) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', 'Your share account is frozen by the token issuer, so these shares ' +
+                'cannot be redeemed.');
+        }
+        if (shareAccount.balance < BigInt(redeemSharesRaw.toString())) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', `Insufficient shares to redeem: this wallet holds ${shareAccount.balance} ` +
+                `raw share units, and the redemption requires ${redeemSharesRaw.toString()}.`);
         }
-        if (userShareAccounts.value.length === 0) {
-            throw new core_1.AugustValidationError('INVALID_INPUT', 'No share account found. You need to deposit first to get shares before you can redeem.');
+        const senderShareAccount = shareAccount.address;
+        // Redeeming is precisely how a holder first receives the deposit mint, so
+        // requiring the payout account to pre-exist (as this module used to) left
+        // shares unredeemable through this SDK for everyone who acquired them any
+        // way other than depositing from this same wallet — a transfer, an
+        // airdrop, a market buy — as well as any depositor who later closed their
+        // deposit-mint account. A frozen account cannot receive either, so the
+        // payout would revert.
+        if (payoutAccount.frozen) {
+            throw new core_1.AugustValidationError('INVALID_INPUT', 'Your token account for the deposit mint is frozen by the token issuer, ' +
+                'so it cannot receive the redemption proceeds.');
         }
-        const senderTokenAccount = userTokenAccounts?.value[0]?.pubkey;
-        const senderShareAccount = userShareAccounts?.value[0]?.pubkey;
+        const senderTokenAccount = payoutAccount.address;
         // Get the fee recipient from vault state
         const readOnlyProvider = utils_1.SolanaUtils.getReadOnlyProvider({ connection });
         const readOnlyProgram = utils_1.SolanaUtils.getProgram({
@@ -301,22 +457,20 @@ async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultA
         const vaultStateData = await readOnlyProgram.account.vaultState.fetch(vaultStatePda);
         // Get the fee recipient's token account
         const feeRecipientTokenAccount = await (0, spl_token_1.getAssociatedTokenAddress)(_depositMint, vaultStateData.feeRecipient);
-        // Check if the fee recipient token account exists, if not create it
-        const feeRecipientAccountInfo = await connection.getAccountInfo(feeRecipientTokenAccount);
-        if (!feeRecipientAccountInfo) {
-            const createFeeRecipientAtaIx = (0, spl_token_1.createAssociatedTokenAccountInstruction)(_publicKey, // payer (user pays for the account creation)
+        // Every account this handler might have to create is created in the same
+        // transaction that uses it. The fee recipient's ATA is created
+        // unconditionally: the idempotent instruction is a no-op when the account
+        // already exists (costing the user nothing), which buys us one fewer RPC
+        // round trip and removes the read-then-create window entirely. The user
+        // pays the rent when it is genuinely absent, as before.
+        const preInstructions = [
+            (0, spl_token_1.createAssociatedTokenAccountIdempotentInstruction)(_publicKey, // payer (user pays for the account creation)
             feeRecipientTokenAccount, // associated token account
             vaultStateData.feeRecipient, // owner (the actual fee recipient)
-            _depositMint);
-            const createAccountTx = new web3_js_1.Transaction().add(createFeeRecipientAtaIx);
-            const createAccountSignature = await sendTransaction(createAccountTx, connection);
-            core_1.Logger.log.info('handleSolanaRedeem', 'Fee recipient token account created:', createAccountSignature);
-            // Wait a moment for the account to be created
-            await new Promise((resolve) => setTimeout(resolve, 1000));
-        }
-        else {
-            core_1.Logger.log.info('handleSolanaRedeem', 'Fee recipient token account already exists');
-        }
+            _depositMint),
+        ];
+        if (payoutAccount.createIx)
+            preInstructions.push(payoutAccount.createIx);
         core_1.Logger.log.info('handleSolanaRedeem', '\n\nRedeem TX Params:\n');
         core_1.Logger.log.info('handleSolanaRedeem', 'Redeem shares (UI):', redeemShares);
         core_1.Logger.log.info('handleSolanaRedeem', 'Redeem shares (raw):', redeemSharesRaw);
@@ -329,8 +483,6 @@ async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultA
         core_1.Logger.log.info('handleSolanaRedeem', 'Share mint:', shareMintAddr.toBase58());
         core_1.Logger.log.info('handleSolanaRedeem', 'Deposit mint:', _depositMint?.toBase58());
         core_1.Logger.log.info('handleSolanaRedeem', 'Signer:', _publicKey.toBase58());
-        // Get a fresh blockhash to avoid "Blockhash not found" errors
-        const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash('confirmed');
         const tx = await program.methods
             .redeem(redeemSharesRaw)
             .accounts({
@@ -344,17 +496,15 @@ async function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultA
             signer: _publicKey,
             tokenProgram: spl_token_1.TOKEN_PROGRAM_ID,
         })
+            .preInstructions(preInstructions)
+            // See `handleSolanaDeposit` for why `.rpc()` owns the confirmation and
+            // why the commitment comes from the connection.
             .rpc({
             skipPreflight: false,
-            preflightCommitment: 'confirmed',
+            preflightCommitment: txCommitment,
+            commitment: txCommitment,
         });
         core_1.Logger.log.info('handleSolanaRedeem', 'Redeem successful:', tx);
-        // Wait for confirmation with the blockhash we used
-        await connection.confirmTransaction({
-            signature: tx,
-            blockhash,
-            lastValidBlockHeight,
-        }, 'confirmed');
         return tx;
     }
     catch (e) {

package/lib/core/analytics/version.d.ts

@@ -3,4 +3,4 @@
  * Generated during publish from package.json version
  * This file is gitignored and created at publish time
  */
-export declare const SDK_VERSION = "8.20.1";
+export declare const SDK_VERSION = "8.21.0";

package/lib/core/analytics/version.js

@@ -6,5 +6,5 @@ exports.SDK_VERSION = void 0;
  * Generated during publish from package.json version
  * This file is gitignored and created at publish time
  */
-exports.SDK_VERSION = '8.20.1';
+exports.SDK_VERSION = '8.21.0';
 //# sourceMappingURL=version.js.map

package/lib/main.js

@@ -90,21 +90,27 @@ class AugustSDK extends core_1.AugustBase {
                 return {
                     rpcUrl: baseConfig.solana.rpcUrl,
                     network: baseConfig.solana.network,
+                    commitment: baseConfig.solana.commitment,
                 };
             }
             const legacyRpcUrl = baseConfig.providers?.[core_1.SPECIAL_CHAINS.solana.chainId];
             if (legacyRpcUrl) {
+                // No commitment here: `ISolanaConfig` requires `rpcUrl` + `network`, so
+                // a commitment-only `solana` object alongside this legacy path is not
+                // expressible in TypeScript. Set `solana: { rpcUrl, network,
+                // commitment }` to configure it.
                 return {
                     rpcUrl: legacyRpcUrl,
                     network: legacyRpcUrl.includes('devnet')
                         ? 'devnet'
                         : 'mainnet-beta',
+                    commitment: undefined,
                 };
             }
             return null;
         })();
         if (solanaConfig) {
-            this.solana = new solana_1.default(solanaConfig.rpcUrl, solanaConfig.network);
+            this.solana = new solana_1.default(solanaConfig.rpcUrl, solanaConfig.network, solanaConfig.commitment);
             (0, analytics_1.instrumentClass)(this.solana, () => core_1.SPECIAL_CHAINS.solana.chainId);
         }
         this.sui = new sui_1.default();

package/lib/sdk.d.ts

@@ -2,6 +2,7 @@ import type { Abi } from 'abitype';
 import type { AbiParametersToPrimitiveTypes } from 'abitype';
 import type { AnchorProvider } from '@coral-xyz/anchor';
 import type { BaseContract } from 'ethers';
+import { Commitment } from '@solana/web3.js';
 import { Connection } from '@solana/web3.js';
 import type { ContractTransaction } from 'ethers';
 import type { ContractTransactionResponse } from 'ethers';
@@ -19436,18 +19437,33 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                        * @param depositAmount  `bigint` is treated as raw on-chain units (preferred
                        *   — no JS-float round-trip). `number` is treated as a UI amount and
                        *   scaled by the deposit mint's decimals via {@link uiAmountToRawBn}.
-                       * @throws AugustValidationError on missing wallet/programId or invalid amount.
+                       * @throws AugustValidationError on missing wallet/programId or invalid amount,
+                       *   or when the wallet's deposit-mint balance is below `depositAmount`.
+                       * @throws AugustSDKError when a candidate token account's balance cannot be
+                       *   read, or wrapping any downstream failure (`cause` preserved).
+                       * @remarks **Side effects.** Submits exactly one transaction, signed by the
+                       *   provider's wallet. When the wallet has no share account, that transaction
+                       *   also creates one, and `publicKey` pays its rent — roughly 0.00204 SOL,
+                       *   non-refundable while the account stays open — on top of the network fee.
+                       *   Callers should ensure the wallet holds enough SOL for both before
+                       *   prompting the user to sign.
                        * @remarks The on-chain `deposit` instruction has no `min_shares_out`
                        *   parameter; slippage cannot be enforced on-chain until the program ships
                        *   that argument.
                        */
-                      declare function handleSolanaDeposit({ provider, connection, network, vaultProgramId, vaultAddress, depositAmount, publicKey, sendTransaction, idl, }: {
+                      declare function handleSolanaDeposit({ provider, connection, network, vaultProgramId, vaultAddress, depositAmount, publicKey, idl, }: {
                           vaultProgramId: PublicKey | string;
                           vaultAddress?: PublicKey | string;
                           idl: any;
                           publicKey: PublicKey | string;
                           depositAmount: number | bigint;
-                          sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
+                          /**
+                           * @deprecated Accepted and ignored. Share-account creation is now prepended
+                           * to the deposit instruction, so there is no longer a second transaction to
+                           * send. Kept so existing callers keep compiling; will be removed in the next
+                           * major.
+                           */
+                          sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
                       } & ISolanaConnectionOptions): Promise<any>;
 
                       /**
@@ -19456,15 +19472,30 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                        * @param redeemShares  `bigint` is treated as raw share-token units;
                        *   `number` is treated as a UI amount. See {@link handleSolanaDeposit} for
                        *   the same caveat about the missing on-chain slippage guard.
-                       * @throws AugustValidationError on missing wallet/programId or invalid amount.
+                       * @throws AugustValidationError on missing wallet/programId or invalid amount,
+                       *   or when the wallet holds fewer shares than `redeemShares`.
+                       * @throws AugustSDKError when a candidate token account's balance cannot be
+                       *   read, or wrapping any downstream failure (`cause` preserved).
+                       * @remarks **Side effects.** Submits exactly one transaction, signed by the
+                       *   provider's wallet. That transaction also creates the payout account when
+                       *   the wallet has none, and the vault's fee-recipient account when *it* has
+                       *   none — `publicKey` pays rent for both, roughly 0.00204 SOL each and
+                       *   non-refundable, on top of the network fee. Callers should ensure the
+                       *   wallet holds enough SOL for all of it before prompting the user to sign.
                        */
-                      declare function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, sendTransaction, idl, }: {
+                      declare function handleSolanaRedeem({ provider, connection, vaultProgramId, vaultAddress, publicKey, redeemShares, idl, }: {
                           idl: any;
                           vaultProgramId: PublicKey | string;
                           vaultAddress?: PublicKey | string;
                           publicKey: PublicKey | string;
                           redeemShares: number | bigint;
-                          sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
+                          /**
+                           * @deprecated Accepted and ignored. Payout- and fee-recipient-account
+                           * creation is now prepended to the redeem instruction, so there is no longer
+                           * a second transaction to send. Kept so existing callers keep compiling;
+                           * will be removed in the next major.
+                           */
+                          sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>;
                       } & ISolanaConnectionOptions): Promise<any>;
 
                       /**
@@ -21229,6 +21260,20 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                       export declare interface ISolanaConfig {
                           rpcUrl: string;
                           network: ISolanaNetwork;
+                          /**
+                           * Commitment for every Solana read *and* for the confirmation of every
+                           * Solana write, so the two always describe the same chain state.
+                           *
+                           * Defaults to `'finalized'` — unchanged from the commitment the SDK has
+                           * always inherited from the RPC. Pass `'confirmed'` for a markedly faster
+                           * round trip (seconds rather than tens of seconds), accepting that the state
+                           * you act on can still, in principle, be rolled back.
+                           *
+                           * Only read from this object. Configuring Solana through the legacy
+                           * `providers` map instead leaves the commitment at its default, since this
+                           * type requires `rpcUrl` and `network` alongside it.
+                           */
+                          commitment?: Commitment;
                       }
 
                       declare interface ISolanaConnectionOptions {
@@ -25100,11 +25145,11 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                                fetchUserTokenBalance: ({ connection, publicKey, depositMint, }: {
                                    publicKey: PublicKey | string;
                                    depositMint?: PublicKey | string;
-                               } & ISolanaConnectionOptions) => Promise<any>;
+                               } & ISolanaConnectionOptions) => Promise<string>;
                                fetchUserShareBalance: ({ connection, publicKey, shareMint, }: {
                                    publicKey: PublicKey | string;
                                    shareMint?: PublicKey | string;
-                               } & ISolanaConnectionOptions) => Promise<any>;
+                               } & ISolanaConnectionOptions) => Promise<number>;
                                fetchUserShareBalanceRaw: ({ connection, publicKey, shareMint, }: {
                                    publicKey: PublicKey | string;
                                    shareMint?: PublicKey | string;
@@ -25167,7 +25212,23 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                            private _network;
                            private _connection;
                            private _provider;
-                           constructor(endpoint: ISolanaRpcEndpoint, network?: ISolanaNetwork_2);
+                           /**
+                            * @param commitment - Commitment for every read this adapter makes *and* for
+                            *   the confirmation of every write, so the two always describe the same
+                            *   chain state — the vault handlers take it from this same `Connection`.
+                            *
+                            *   Defaults to `'finalized'`, which is what this adapter has always used in
+                            *   practice: it previously passed no commitment at all, so both reads and
+                            *   confirmations fell through to the RPC's own `'finalized'` default. The
+                            *   default is stated explicitly now rather than inherited, but it is
+                            *   unchanged.
+                            *
+                            *   Pass `'confirmed'` for a markedly faster round trip — seconds rather
+                            *   than tens of seconds — accepting that the state you act on can still, in
+                            *   principle, be rolled back. Also settable as the `commitment` field of
+                            *   the `solana` config passed to `AugustSDK`.
+                            */
+                           constructor(endpoint: ISolanaRpcEndpoint, network?: ISolanaNetwork_2, commitment?: Commitment);
                            get endpoint(): `https://${string}`;
                            get network(): ISolanaNetwork_2;
                            get connection(): web3.Connection;
@@ -25219,8 +25280,8 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                                 image: string;
                             }>;
                             getTokenSymbol(mintAddress: string | PublicKey): Promise<string>;
-                            fetchUserTokenBalance(publicKey: PublicKey | string, depositMint: PublicKey | string): Promise<any>;
-                            fetchUserShareBalance(publicKey: PublicKey | string, shareMint: PublicKey | string): Promise<any>;
+                            fetchUserTokenBalance(publicKey: PublicKey | string, depositMint: PublicKey | string): Promise<string>;
+                            fetchUserShareBalance(publicKey: PublicKey | string, shareMint: PublicKey | string): Promise<number>;
                             /**
                              * BigInt-safe variant of {@link fetchUserShareBalance}. Returns the raw u64
                              * `amount` (as a base-units string) plus the mint's `decimals` (or `null`
@@ -25260,13 +25321,31 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                             /**
                              * Deposit funds into a Solana August vault.
                              * @param depositAmount  `bigint` (raw on-chain units) or `number` (UI amount).
+                             * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+                             *   Share-account creation is now prepended to the deposit instruction, so
+                             *   the SDK sends no second transaction and never invokes this callback —
+                             *   signing goes through the provider's wallet.
+                             *
+                             *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+                             *   `vaultAddress`, so removing it shifts your vault address into this slot
+                             *   and leaves `vaultAddress` undefined — which silently falls back to the
+                             *   legacy single-vault PDA derivation and targets a different vault.
                              */
-                            vaultDeposit(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, depositAmount: number | bigint, sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
+                            vaultDeposit(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, depositAmount: number | bigint, sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
                             /**
                              * Redeem vault shares from a Solana August vault.
                              * @param redeemShares  `bigint` (raw share units) or `number` (UI amount).
+                             * @param sendTransaction - **Ignored; scheduled for removal (AUGUST-7221).**
+                             *   Payout- and fee-recipient-account creation is now prepended to the redeem
+                             *   instruction, so the SDK sends no second transaction and never invokes
+                             *   this callback — signing goes through the provider's wallet.
+                             *
+                             *   **Pass `undefined` here; do not delete the argument.** It sits *before*
+                             *   `vaultAddress`, so removing it shifts your vault address into this slot
+                             *   and leaves `vaultAddress` undefined — which silently falls back to the
+                             *   legacy single-vault PDA derivation and targets a different vault.
                              */
-                            vaultRedeem(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, redeemShares: number | bigint, sendTransaction: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
+                            vaultRedeem(vaultProgramId: PublicKey | string, idl: any, publicKey: PublicKey | string, redeemShares: number | bigint, sendTransaction?: (transaction: Transaction | web3.VersionedTransaction, connection: Connection, options?: SendTransactionOptions) => Promise<web3.TransactionSignature>, vaultAddress?: PublicKey | string): Promise<any>;
                             /**
                              * Canonical program id for a program type on this adapter's network.
                              *

package/lib/types/web3.d.ts

@@ -1,3 +1,4 @@
+import type { Commitment } from '@solana/web3.js';
 import type { Signer, Provider } from 'ethers';
 export type IAddress = `0x${string}`;
 /**
@@ -33,6 +34,20 @@ export type IStellarNetwork = 'mainnet' | 'testnet';
 export interface ISolanaConfig {
     rpcUrl: string;
     network: ISolanaNetwork;
+    /**
+     * Commitment for every Solana read *and* for the confirmation of every
+     * Solana write, so the two always describe the same chain state.
+     *
+     * Defaults to `'finalized'` — unchanged from the commitment the SDK has
+     * always inherited from the RPC. Pass `'confirmed'` for a markedly faster
+     * round trip (seconds rather than tens of seconds), accepting that the state
+     * you act on can still, in principle, be rolled back.
+     *
+     * Only read from this object. Configuring Solana through the legacy
+     * `providers` map instead leaves the commitment at its default, since this
+     * type requires `rpcUrl` and `network` alongside it.
+     */
+    commitment?: Commitment;
 }
 /**
  * Stellar-specific configuration for `new AugustSDK({ stellar })`. All

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augustdigital/sdk",
-  "version": "8.20.1",
+  "version": "8.21.0",
   "main": "lib/index.js",
   "types": "lib/sdk.d.ts",
   "keywords": [