@augustdigital/sdk 8.21.1 → 8.24.0

package/lib/core/analytics/sentry.js

@@ -384,12 +384,16 @@ function initializeSentry(config, environment, walletAddress, apiKey, appName) {
             ? config.tracesSampleRate
             : 0.1; // Phase 2 default — verified partners can opt into 1.0 explicitly
         const tracesSampleRate = Math.max(0, Math.min(1, rawSampleRate));
+        // Hoisted so `release`, `august.sdk_version`, and the deprecated
+        // `sdk.version` are provably the same value rather than three separate
+        // reads of `./version`.
+        const sdkVersion = getSDKVersion();
         sdk.init({
             dsn: constants_1.SENTRY_DSN,
             tracesSampleRate,
             enableTracing: true,
             environment: environment.toLowerCase(),
-            release: `august-sdk@${getSDKVersion()}`,
+            release: `august-sdk@${sdkVersion}`,
             sendDefaultPii: true,
             // SDK errors route through Logger.setSentrySink → captureException directly,
             // so captureConsoleIntegration is redundant here. Omitting it also prevents
@@ -445,7 +449,27 @@ function initializeSentry(config, environment, walletAddress, apiKey, appName) {
         updateUser(walletAddress, environment);
         // Set global SDK tags
         safeSetTag('sdk', 'august-digital');
-        safeSetTag('sdk.version', getSDKVersion());
+        // `august.sdk_version` is the queryable dimension for "which SDK build is
+        // this partner on" — the question that decides whether an error is a live
+        // defect or an already-shipped fix the consumer hasn't picked up.
+        //
+        // It exists because `sdk.version` (set below, kept for back-compat) is a
+        // RESERVED Sentry field: Sentry populates it with the version of its own
+        // client (`@sentry/core`). The custom tag is still stored, but a bare
+        // `sdk.version` in Discover resolves to Sentry's value, so the natural
+        // query silently answers the wrong question — uniform across every
+        // consumer, which makes it look like a working answer. Reaching the real
+        // value requires `tags[sdk.version]`, which nobody remembers to type.
+        //
+        // Both are low-cardinality version strings, so carrying the pair costs
+        // nothing against the tag budget (CLAUDE.md §8.4).
+        safeSetTag('august.sdk_version', sdkVersion);
+        /**
+         * @deprecated Shadowed by Sentry's reserved `sdk.version` field. Query
+         * `august.sdk_version` instead. Retained so existing saved queries,
+         * dashboards, and alert rules keep resolving; remove in the next major.
+         */
+        safeSetTag('sdk.version', sdkVersion);
         safeSetTag('sdk.runtime', (0, sentry_runtime_1.getSentryRuntime)());
         // `app.name` is the dimension we filter on in Sentry to attribute
         // events to a specific consuming application — see SDK quickstart docs.

package/lib/core/analytics/version.d.ts

@@ -3,4 +3,4 @@
  * Generated during publish from package.json version
  * This file is gitignored and created at publish time
  */
-export declare const SDK_VERSION = "8.21.1";
+export declare const SDK_VERSION = "8.24.0";

package/lib/core/analytics/version.js

@@ -6,5 +6,5 @@ exports.SDK_VERSION = void 0;
  * Generated during publish from package.json version
  * This file is gitignored and created at publish time
  */
-exports.SDK_VERSION = '8.21.1';
+exports.SDK_VERSION = '8.24.0';
 //# sourceMappingURL=version.js.map

package/lib/core/attribution.d.ts

@@ -42,10 +42,15 @@ export interface IAttributionConfig {
     /**
      * EVM chain IDs to attribute. Omit to attribute writes on every EVM chain
      * (the suffix is inert on chains without an ERC-8021 indexer and costs
-     * ~16 gas per non-zero byte). When set, writes on other chains are sent
-     * without the suffix; call sites that cannot determine their chain ID
-     * append the suffix regardless, since over-attribution is harmless and
-     * under-attribution loses data.
+     * ~16 gas per non-zero byte). When set, gating is fail-closed: writes on
+     * other chains — and writes whose chain ID cannot be determined — are sent
+     * without the suffix.
+     *
+     * Over-attribution is not harmless. The suffix makes calldata longer than
+     * the ABI encoding of the call, which breaks clear-signing on hardware
+     * wallets: a Ledger rejects an over-long ERC-20 `approve` with
+     * `EthAppCommandError: Invalid data 6a80`, so an unattributed chain that
+     * receives the suffix anyway cannot be transacted on from a Ledger at all.
      */
     chains?: number[];
 }
@@ -83,13 +88,23 @@ export declare function buildAttributionSuffix(codes: string[]): string;
  *   init, not on the first write.
  */
 export declare function setAttribution(config: IAttributionConfig | null): void;
+/**
+ * Whether attribution is configured at all, independent of any chain gate.
+ *
+ * Call sites that need to know whether to resolve a chain ID before asking
+ * for the suffix use this; {@link getAttributionSuffix} applies the gate.
+ *
+ * @returns `true` when builder codes are configured.
+ */
+export declare function isAttributionEnabled(): boolean;
 /**
  * Return the active ERC-8021 suffix for a write on the given chain, or
- * `undefined` when attribution is off or the chain is excluded.
+ * `undefined` when attribution is off or the chain is not attributed.
  *
  * @param chainId EVM chain ID of the transaction, when the call site knows
- *   it. When omitted and a `chains` restriction is configured, the suffix is
- *   returned anyway (over-attribution is harmless; see
+ *   it. When a `chains` restriction is configured, gating is fail-closed: an
+ *   omitted chain ID yields no suffix, since a suffix on an unattributed
+ *   chain buys nothing and breaks hardware-wallet clear-signing (see
  *   {@link IAttributionConfig.chains}).
  * @returns `0x`-prefixed hex suffix, or `undefined` when nothing should be
  *   appended.
@@ -99,7 +114,8 @@ export declare function getAttributionSuffix(chainId?: number): string | undefin
  * Append the active attribution suffix to calldata.
  *
  * No-ops (returns `data` unchanged) when attribution is off, the chain is
- * excluded, `data` is empty/absent (plain value transfers are never
+ * not attributed (including an unknown chain under a `chains` restriction),
+ * `data` is empty/absent (plain value transfers are never
  * attributed), or `data` already ends with the ERC-8021 marker (guards
  * against double-appending when an upstream layer — e.g. a wagmi config
  * `dataSuffix` — already attributed the transaction).

package/lib/core/attribution.js

@@ -18,6 +18,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ERC8021_MARKER = void 0;
 exports.buildAttributionSuffix = buildAttributionSuffix;
 exports.setAttribution = setAttribution;
+exports.isAttributionEnabled = isAttributionEnabled;
 exports.getAttributionSuffix = getAttributionSuffix;
 exports.appendAttributionSuffix = appendAttributionSuffix;
 /**
@@ -96,13 +97,25 @@ function setAttribution(config) {
             ? config.chains
             : null;
 }
+/**
+ * Whether attribution is configured at all, independent of any chain gate.
+ *
+ * Call sites that need to know whether to resolve a chain ID before asking
+ * for the suffix use this; {@link getAttributionSuffix} applies the gate.
+ *
+ * @returns `true` when builder codes are configured.
+ */
+function isAttributionEnabled() {
+    return activeSuffix !== null;
+}
 /**
  * Return the active ERC-8021 suffix for a write on the given chain, or
- * `undefined` when attribution is off or the chain is excluded.
+ * `undefined` when attribution is off or the chain is not attributed.
  *
  * @param chainId EVM chain ID of the transaction, when the call site knows
- *   it. When omitted and a `chains` restriction is configured, the suffix is
- *   returned anyway (over-attribution is harmless; see
+ *   it. When a `chains` restriction is configured, gating is fail-closed: an
+ *   omitted chain ID yields no suffix, since a suffix on an unattributed
+ *   chain buys nothing and breaks hardware-wallet clear-signing (see
  *   {@link IAttributionConfig.chains}).
  * @returns `0x`-prefixed hex suffix, or `undefined` when nothing should be
  *   appended.
@@ -110,7 +123,9 @@ function setAttribution(config) {
 function getAttributionSuffix(chainId) {
     if (!activeSuffix)
         return undefined;
-    if (activeChains && typeof chainId === 'number') {
+    if (activeChains) {
+        if (typeof chainId !== 'number')
+            return undefined;
         if (!activeChains.includes(chainId))
             return undefined;
     }
@@ -120,7 +135,8 @@ function getAttributionSuffix(chainId) {
  * Append the active attribution suffix to calldata.
  *
  * No-ops (returns `data` unchanged) when attribution is off, the chain is
- * excluded, `data` is empty/absent (plain value transfers are never
+ * not attributed (including an unknown chain under a `chains` restriction),
+ * `data` is empty/absent (plain value transfers are never
  * attributed), or `data` already ends with the ERC-8021 marker (guards
  * against double-appending when an upstream layer — e.g. a wagmi config
  * `dataSuffix` — already attributed the transaction).

package/lib/core/constants/vaults.d.ts

@@ -69,7 +69,7 @@ export declare const NEMO_VAULT_ADDRESS = "0xa422c3018c46ba90a14acd14f96cb60616f
  * Subgraph base URL
  * @deprecated use getVaultMetadata to fetch subgraph URLs from the backend
  */
-export declare const GOLDSKY_BASE_URL = "https://api.goldsky.com/api/private/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs";
+export declare const GOLDSKY_BASE_URL = "https://api.goldsky.com/api/public/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs";
 /**
  * Subgraph URLs
  * @deprecated use getVaultMetadata to fetch subgraph URLs from the backend

package/lib/core/constants/vaults.js

@@ -131,7 +131,7 @@ exports.NEMO_VAULT_ADDRESS = '0xa422c3018c46ba90a14acd14f96cb60616f5c91b';
  * Subgraph base URL
  * @deprecated use getVaultMetadata to fetch subgraph URLs from the backend
  */
-exports.GOLDSKY_BASE_URL = 'https://api.goldsky.com/api/private/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs';
+exports.GOLDSKY_BASE_URL = 'https://api.goldsky.com/api/public/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs';
 /**
  * Subgraph URLs
  * @deprecated use getVaultMetadata to fetch subgraph URLs from the backend

package/lib/core/helpers/signer.d.ts

@@ -44,7 +44,8 @@ export type CompatibleSigner = Signer | Wallet | any;
  * already ending in the ERC-8021 marker is left untouched. When the
  * configured `chains` list requires a chain check and the transaction does
  * not carry a `chainId`, the signer's provider network is consulted (one
- * cached RPC call).
+ * cached RPC call); if that lookup fails the transaction is sent
+ * unattributed.
  *
  * @param signer Normalized ethers Signer or Wallet.
  * @returns A proxied signer with an attribution-aware `sendTransaction`.

package/lib/core/helpers/signer.js

@@ -107,7 +107,8 @@ async function normalizeSigner(signer) {
  * already ending in the ERC-8021 marker is left untouched. When the
  * configured `chains` list requires a chain check and the transaction does
  * not carry a `chainId`, the signer's provider network is consulted (one
- * cached RPC call).
+ * cached RPC call); if that lookup fails the transaction is sent
+ * unattributed.
  *
  * @param signer Normalized ethers Signer or Wallet.
  * @returns A proxied signer with an attribution-aware `sendTransaction`.
@@ -117,7 +118,7 @@ function wrapSignerWithAttribution(signer) {
         get(target, prop) {
             if (prop === 'sendTransaction') {
                 return async (tx) => {
-                    if (!(0, attribution_1.getAttributionSuffix)() || typeof tx?.data !== 'string') {
+                    if (!(0, attribution_1.isAttributionEnabled)() || typeof tx?.data !== 'string') {
                         return target.sendTransaction(tx);
                     }
                     let chainId = tx.chainId != null ? Number(tx.chainId) : undefined;
@@ -126,9 +127,10 @@ function wrapSignerWithAttribution(signer) {
                             chainId = Number((await target.provider.getNetwork()).chainId);
                         }
                         catch {
-                            // Unknown chain: fall through with chainId undefined, which
-                            // appends regardless of a `chains` restriction —
-                            // over-attribution is harmless, under-attribution loses data.
+                            // Unknown chain: fall through with chainId undefined. Under a
+                            // `chains` restriction that means no suffix — attributing a
+                            // chain we cannot identify risks breaking hardware-wallet
+                            // clear-signing for a gain we cannot confirm.
                         }
                     }
                     const data = (0, attribution_1.appendAttributionSuffix)(tx.data, chainId);

package/lib/core/helpers/web3.d.ts

@@ -95,10 +95,16 @@ export { explorerLink } from './explorer-link';
  * Fetch token decimals from contract or Solana mint.
  * Results are cached to minimize RPC calls.
  *
- * **Never throws** — a failed read logs at error level and resolves
- * `undefined`. Callers that must not silently proceed on an unknown scale (any
- * path that encodes an amount) should use {@link getDecimalsOrThrow} instead:
- * feeding `undefined` into `toNormalizedBn` silently defaults to 18 decimals.
+ * **Never throws** — a failed read resolves `undefined`. Callers that must not
+ * silently proceed on an unknown scale (any path that encodes an amount) should
+ * use {@link getDecimalsOrThrow} instead: feeding `undefined` into
+ * `toNormalizedBn` silently defaults to 18 decimals.
+ *
+ * Transient transport faults (provider rate limits, socket resets, an empty
+ * response to `decimals()`) are logged at `warn` — a breadcrumb, not a
+ * standalone Sentry issue — since the caller sees the same `undefined` either
+ * way. Everything else is logged at `error`. The read itself is **not**
+ * retried here; that is opt-in via {@link getDecimalsOrThrow}.
  *
  * @param provider Web3 provider
  * @param address Token contract address or Solana mint

package/lib/core/helpers/web3.js

@@ -395,10 +395,16 @@ async function fetchDecimals(runner, address, isVault) {
  * Fetch token decimals from contract or Solana mint.
  * Results are cached to minimize RPC calls.
  *
- * **Never throws** — a failed read logs at error level and resolves
- * `undefined`. Callers that must not silently proceed on an unknown scale (any
- * path that encodes an amount) should use {@link getDecimalsOrThrow} instead:
- * feeding `undefined` into `toNormalizedBn` silently defaults to 18 decimals.
+ * **Never throws** — a failed read resolves `undefined`. Callers that must not
+ * silently proceed on an unknown scale (any path that encodes an amount) should
+ * use {@link getDecimalsOrThrow} instead: feeding `undefined` into
+ * `toNormalizedBn` silently defaults to 18 decimals.
+ *
+ * Transient transport faults (provider rate limits, socket resets, an empty
+ * response to `decimals()`) are logged at `warn` — a breadcrumb, not a
+ * standalone Sentry issue — since the caller sees the same `undefined` either
+ * way. Everything else is logged at `error`. The read itself is **not**
+ * retried here; that is opt-in via {@link getDecimalsOrThrow}.
  *
  * @param provider Web3 provider
  * @param address Token contract address or Solana mint
@@ -422,7 +428,27 @@ const getDecimals = async (provider, address, isVault = true) => {
         return await sharedDecimalsRequest(key, () => fetchDecimals(provider, address, isVault));
     }
     catch (e) {
-        logger_1.Logger.log.error('getDecimals', `${address}::${e}`);
+        // Severity split. A provider rate-limit or socket fault is not a defect in
+        // the SDK or the caller's input — the read resolves `undefined` either way,
+        // exactly as documented, and logging it at error level made a QuickNode
+        // `50/second request limit reached` burst the fourth highest-volume issue
+        // in Sentry with nothing actionable in it. Genuine failures (a non-ERC-20
+        // at this address, a real revert) stay at error.
+        //
+        // Note this only changes the log level. The no-retry contract of this
+        // lenient reader is deliberate and unchanged — callers that must not
+        // proceed on an unknown scale use `getDecimalsOrThrow`, which retries.
+        const isTransient = (0, chain_error_1.isRetryableRpcError)(e) || (0, chain_error_1.isEmptyViewResponse)(e, DECIMALS_SELECTOR);
+        if (isTransient) {
+            logger_1.Logger.log.warn('getDecimals', {
+                address,
+                reason: 'transient RPC failure',
+                message: e instanceof Error ? e.message : String(e),
+            });
+        }
+        else {
+            logger_1.Logger.log.error('getDecimals', `${address}::${e}`);
+        }
         return undefined;
     }
 };

package/lib/core/logger/slack.d.ts

@@ -1,7 +1,40 @@
 /**
- * The default Slack webhook URL for logging errors.
+ * Environment variable holding the Slack incoming-webhook to post SDK alerts
+ * to. Accepts either the full `https://hooks.slack.com/services/T…/B…/x…` URL
+ * or the bare `T…/B…/x…` path suffix.
  */
-export declare const DEFAULT_SLACK_WEBHOOK_URL = "T04CM84GAV6/B0A2DS3ST8C/FLtOA3Jna3FN7UO4DoGxHfhG";
+export declare const SLACK_WEBHOOK_ENV_VAR = "AUGUST_SDK_SLACK_WEBHOOK_URL";
+/**
+ * Resolve the Slack webhook to alert through.
+ *
+ * Why this replaced a hardcoded constant: a webhook path is a **bearer
+ * credential** — anyone holding it can post to the channel. The previous
+ * default embedded August's own webhook as a string literal, which shipped in
+ * every published tarball and in the generated `.d.ts`, handing every consumer
+ * of the SDK write access to an internal Slack channel (CLAUDE.md §5: no
+ * secrets in client-reachable code). It also meant a consumer's alerts went to
+ * August's channel rather than their own, with no way to redirect them.
+ *
+ * Resolution order:
+ *   1. `explicit` — passed by the caller, wins outright;
+ *   2. `AUGUST_SDK_SLACK_WEBHOOK_URL` in the environment;
+ *   3. none — alerting is disabled and the call becomes a no-op.
+ *
+ * Reading the env var per call (rather than once at module load) means a
+ * consumer configuring it after import still gets alerts, and a test can set
+ * and unset it without re-importing the module.
+ *
+ * @param explicit - Caller-supplied webhook, full URL or bare path suffix.
+ * @returns The bare `T…/B…/x…` path suffix, or `''` when unconfigured.
+ */
+export declare function resolveSlackWebhookUrl(explicit?: string): string;
+/**
+ * @deprecated Was a hardcoded webhook credential baked into the published
+ * bundle. It now resolves from {@link SLACK_WEBHOOK_ENV_VAR} and is `''` when
+ * unset. Call {@link resolveSlackWebhookUrl} instead — this export exists only
+ * so existing imports keep compiling, and is removed in the next major.
+ */
+export declare const DEFAULT_SLACK_WEBHOOK_URL = "";
 declare function error(options: {
     title: string;
     error: string;

package/lib/core/logger/slack.js

@@ -1,16 +1,70 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SLACK = exports.DEFAULT_SLACK_WEBHOOK_URL = void 0;
+exports.SLACK = exports.DEFAULT_SLACK_WEBHOOK_URL = exports.SLACK_WEBHOOK_ENV_VAR = void 0;
+exports.resolveSlackWebhookUrl = resolveSlackWebhookUrl;
 const core_1 = require("../helpers/core");
 const explorer_link_1 = require("../helpers/explorer-link");
 const sanitize_1 = require("../analytics/sanitize");
+const env_1 = require("../analytics/env");
 /**
- * The default Slack webhook URL for logging errors.
+ * Environment variable holding the Slack incoming-webhook to post SDK alerts
+ * to. Accepts either the full `https://hooks.slack.com/services/T…/B…/x…` URL
+ * or the bare `T…/B…/x…` path suffix.
  */
-exports.DEFAULT_SLACK_WEBHOOK_URL = 'T04CM84GAV6/B0A2DS3ST8C/FLtOA3Jna3FN7UO4DoGxHfhG';
+exports.SLACK_WEBHOOK_ENV_VAR = 'AUGUST_SDK_SLACK_WEBHOOK_URL';
+/** `https://hooks.slack.com/services/` — stripped so both forms are accepted. */
+const SLACK_WEBHOOK_PREFIX = 'https://hooks.slack.com/services/';
+/**
+ * Resolve the Slack webhook to alert through.
+ *
+ * Why this replaced a hardcoded constant: a webhook path is a **bearer
+ * credential** — anyone holding it can post to the channel. The previous
+ * default embedded August's own webhook as a string literal, which shipped in
+ * every published tarball and in the generated `.d.ts`, handing every consumer
+ * of the SDK write access to an internal Slack channel (CLAUDE.md §5: no
+ * secrets in client-reachable code). It also meant a consumer's alerts went to
+ * August's channel rather than their own, with no way to redirect them.
+ *
+ * Resolution order:
+ *   1. `explicit` — passed by the caller, wins outright;
+ *   2. `AUGUST_SDK_SLACK_WEBHOOK_URL` in the environment;
+ *   3. none — alerting is disabled and the call becomes a no-op.
+ *
+ * Reading the env var per call (rather than once at module load) means a
+ * consumer configuring it after import still gets alerts, and a test can set
+ * and unset it without re-importing the module.
+ *
+ * @param explicit - Caller-supplied webhook, full URL or bare path suffix.
+ * @returns The bare `T…/B…/x…` path suffix, or `''` when unconfigured.
+ */
+function resolveSlackWebhookUrl(explicit) {
+    const raw = explicit?.trim() || (0, env_1.readEnv)(exports.SLACK_WEBHOOK_ENV_VAR)?.trim() || '';
+    return raw.startsWith(SLACK_WEBHOOK_PREFIX)
+        ? raw.slice(SLACK_WEBHOOK_PREFIX.length)
+        : raw;
+}
+/**
+ * @deprecated Was a hardcoded webhook credential baked into the published
+ * bundle. It now resolves from {@link SLACK_WEBHOOK_ENV_VAR} and is `''` when
+ * unset. Call {@link resolveSlackWebhookUrl} instead — this export exists only
+ * so existing imports keep compiling, and is removed in the next major.
+ */
+exports.DEFAULT_SLACK_WEBHOOK_URL = '';
+/** One-shot guard so an unconfigured webhook warns once, not per alert. */
+let warnedUnconfigured = false;
 function error(options) {
     const { title, error, poolAddress, chainId, slackWebookUrl, address } = options;
-    if (!slackWebookUrl) {
+    // Falls back to the environment so a caller that passes nothing still
+    // alerts, provided the deployment configured a webhook of its own.
+    const webhookPath = resolveSlackWebhookUrl(slackWebookUrl);
+    if (!webhookPath) {
+        // Silence here used to be the hardcoded-default's job. Say it once, so a
+        // deployment that expected alerts learns they are off instead of watching
+        // an empty channel. Never log the webhook value itself.
+        if (!warnedUnconfigured) {
+            warnedUnconfigured = true;
+            console.warn(`#Slack.error: no webhook configured — set ${exports.SLACK_WEBHOOK_ENV_VAR} to enable Slack alerts. Alerts are disabled.`);
+        }
         return;
     }
     if (!error) {
@@ -34,7 +88,7 @@ function error(options) {
         return;
     }
     (async () => {
-        const webhookUrl = `https://hooks.slack.com/services/${slackWebookUrl}`;
+        const webhookUrl = `${SLACK_WEBHOOK_PREFIX}${webhookPath}`;
         const safeError = (0, sanitize_1.sanitizeString)(String(error));
         const safeTitle = (0, sanitize_1.sanitizeString)(String(title));
         const data = {

package/lib/evm/methods/crossChainVault.d.ts

@@ -43,6 +43,10 @@ export declare function needsCrossChainApproval(tokenAddress: IAddress, spenderA
 /**
  * Execute a token approval for a cross-chain operation.
  *
+ * @param chainId Chain the approval is sent on, used to gate ERC-8021
+ *   attribution. Omitted means unattributed under a `chains` restriction —
+ *   the suffix would lengthen `approve` calldata past its ABI encoding and
+ *   break Ledger clear-signing.
  * @returns Transaction hash of the approval
  */
 export declare function approveCrossChain(tokenAddress: IAddress, spenderAddress: IAddress, amount: bigint, walletClient: {
@@ -56,7 +60,7 @@ export declare function approveCrossChain(tokenAddress: IAddress, spenderAddress
     }) => Promise<{
         status: string;
     }>;
-}): Promise<string>;
+}, chainId?: number): Promise<string>;
 /**
  * Execute a cross-chain deposit via LayerZero OVault. Validates the source
  * chain, ensures approval, estimates gas with a buffer, and waits for the

package/lib/evm/methods/crossChainVault.js

@@ -526,9 +526,13 @@ async function needsCrossChainApproval(tokenAddress, spenderAddress, walletAddre
 /**
  * Execute a token approval for a cross-chain operation.
  *
+ * @param chainId Chain the approval is sent on, used to gate ERC-8021
+ *   attribution. Omitted means unattributed under a `chains` restriction —
+ *   the suffix would lengthen `approve` calldata past its ABI encoding and
+ *   break Ledger clear-signing.
  * @returns Transaction hash of the approval
  */
-async function approveCrossChain(tokenAddress, spenderAddress, amount, walletClient, publicClient) {
+async function approveCrossChain(tokenAddress, spenderAddress, amount, walletClient, publicClient, chainId) {
     if (!walletClient.account) {
         throw new Error('Wallet not ready — please reconnect your wallet');
     }
@@ -538,7 +542,7 @@ async function approveCrossChain(tokenAddress, spenderAddress, amount, walletCli
         abi: OFT_1.ABI_CROSS_CHAIN_ERC20,
         functionName: 'approve',
         args: [spenderAddress, amount],
-        dataSuffix: (0, attribution_1.getAttributionSuffix)(),
+        dataSuffix: (0, attribution_1.getAttributionSuffix)(chainId),
     });
     const receipt = await publicClient.waitForTransactionReceipt({
         hash: hash,
@@ -595,7 +599,7 @@ async function crossChainVaultDeposit(props) {
             BigInt((0, core_1.toNormalizedBn)(props.amount, props.decimals).raw);
         const approvalNeeded = await needsCrossChainApproval(tokenAddr, spenderAddr, props.walletAddress, approvalAmount, publicClient);
         if (approvalNeeded) {
-            await approveCrossChain(tokenAddr, spenderAddr, approvalAmount, walletClient, publicClient);
+            await approveCrossChain(tokenAddr, spenderAddr, approvalAmount, walletClient, publicClient, props.userChainId);
         }
     }
     // 3. Estimate gas with buffer
@@ -678,7 +682,7 @@ async function crossChainVaultRedeem(props) {
     if (!props.skipApprovalCheck && txInputs.approval) {
         const approvalNeeded = await needsCrossChainApproval(txInputs.approval.tokenAddress, txInputs.approval.spender, props.walletAddress, txInputs.approval.amount, publicClient);
         if (approvalNeeded) {
-            await approveCrossChain(txInputs.approval.tokenAddress, txInputs.approval.spender, txInputs.approval.amount, walletClient, publicClient);
+            await approveCrossChain(txInputs.approval.tokenAddress, txInputs.approval.spender, txInputs.approval.amount, walletClient, publicClient, props.config.hubChainId);
         }
     }
     // 4. Estimate gas with buffer

package/lib/modules/vaults/getters.js

@@ -68,6 +68,7 @@ const abis_1 = require("../../abis");
 const types_1 = require("../../types");
 const core_1 = require("../../core");
 const ethers_1 = require("ethers");
+const cache_1 = require("../../core/cache");
 const utils_1 = require("./utils");
 const subgraph_1 = require("../../services/subgraph");
 const vaults_1 = require("../../services/subgraph/vaults");
@@ -356,8 +357,30 @@ async function getVaultSubaccountLoans(vault, options) {
  * HTTP statuses that mean "no such record for this subaccount", not "something
  * broke". The backend returns 404 for a subaccount with no CeFi/OTC position,
  * which is the normal case for most vault borrowers.
+ *
+ * `400` is here for the same reason. The CeFi and OTC endpoints answer `400`
+ * for a borrower they do not track — a well-formed, checksummed EVM address
+ * that simply has no record on that side — and every `getVaultAllocations`
+ * call re-asks for the same untracked borrowers on every render. In Sentry
+ * that produced ~2.7k `AugustServerError: Request failed: 400` events across
+ * two issues in two days, all from the same handful of borrowers, none of them
+ * actionable. Both fetches are strictly best-effort enrichment: the vault's
+ * allocations are returned either way, so a `400` here can never mean the
+ * caller's request was malformed.
+ *
+ * This demotes the *log severity* only — nothing about the response handling
+ * changes, and any other status (401, 5xx, transport failures) is still an
+ * error-level Sentry issue.
+ *
+ * **Maintainer note on the `400` entry specifically.** Unlike `204`/`404`, a
+ * `400` is semantically "the client sent something wrong", so this demotion is
+ * safe only for as long as these two endpoints use `400` to mean "unknown
+ * borrower". If either ever starts returning `400` for a genuinely malformed
+ * request — a real defect in how the SDK builds the URL or body — this set
+ * would silence it. Should that contract change, drop `400` from here and let
+ * the backend distinguish the two cases with a status of its own.
  */
-const EXPECTED_SUBACCOUNT_FETCH_STATUSES = new Set([204, 404]);
+const EXPECTED_SUBACCOUNT_FETCH_STATUSES = new Set([204, 400, 404]);
 /**
  * Log a per-subaccount enrichment fetch failure at the right severity.
  *
@@ -628,6 +651,87 @@ function subgraphAmountToBigInt(value) {
         return BigInt(0);
     }
 }
+/**
+ * Read `lagDuration()` off a vault, tolerating vaults that do not implement it.
+ *
+ * Why this exists: `getVaultAvailableRedemptions` binds every vault — v1 and
+ * v2 — to `ABI_LENDING_POOL_V2` because that ABI carries the superset of
+ * methods the scan needs. `lagDuration()` is not in that superset for every
+ * deployed pool. Calling it on a pool without the function reaches the
+ * fallback-less contract, which returns empty calldata, and ethers reports it
+ * as `missing revert data (action="call", data=null, …, code=CALL_EXCEPTION)`.
+ * That threw out of the whole redemption scan and became the single
+ * highest-volume error in production Sentry (~5.5k events over two days from
+ * three server deployments), while also returning an empty redemption list to
+ * every caller for the affected vaults.
+ *
+ * A missing `lagDuration()` means "this pool has no claim lag", which is what
+ * `0` encodes — the same value the v1 branch of the caller assumes.
+ *
+ * The empty response is **retried before it is believed**, because a provider
+ * that truncates an `eth_call` produces the identical shape: falling straight
+ * to `0` for a vault that really does have a lag would shift every computed
+ * claimable date. Only after the retries agree is the function treated as
+ * absent. A genuine revert carrying revert data still propagates, so real
+ * breakage stays loud.
+ *
+ * **The absence is memoized, the value is not.** Paying the retry budget (3
+ * `eth_call`s plus ~750ms of backoff) on every call for a vault that will never
+ * implement `lagDuration()` would trade an error flood for a latency and
+ * RPC-volume regression on exactly the vaults this path targets — a dashboard
+ * re-rendering redemptions pays it per render (CLAUDE.md §4.1, §4.2). Whether a
+ * deployed pool implements the function is fixed by its bytecode, so a
+ * confirmed absence is cacheable forever; the lag *value* is operator-settable
+ * and is deliberately never cached.
+ *
+ * Caveat on "fixed by its bytecode": an **upgradeable proxy** could gain a
+ * `lagDuration()` in a later implementation, and a process holding the memo
+ * would keep answering `0` for it. Bounded, not unbounded — `CACHE` carries a
+ * 24h TTL and `allowStale: true`, which serves an expired entry exactly once
+ * before evicting it, so the vault is re-read on the following call. Vaults
+ * behind an upgradeable proxy that add the function mid-process therefore
+ * misreport a zero lag for at most that window. Accepted deliberately: no
+ * deployed pool does this today, and the alternative is re-paying the retry
+ * budget forever for the vaults this path exists to serve.
+ *
+ * @param vaultContract - Anything exposing the vault's `lagDuration()` view;
+ *   structurally typed so both `ethers.Contract` and the ABI-typed contract
+ *   returned by `createContract` satisfy it.
+ * @param vault - Vault address, for the breadcrumb only.
+ * @param scope - Cache scope for the absence memo — the RPC endpoint the read
+ *   went through. Scoping by endpoint (rather than globally by address) keeps
+ *   the same address on two chains in separate entries.
+ * @returns The lag in seconds, or `0` when the vault has no `lagDuration()`.
+ * @throws The original error for any failure that is not an empty response.
+ */
+async function readLagDuration(vaultContract, vault, scope) {
+    const absenceKey = `lag-absent-${scope}-${vault.toLowerCase()}`;
+    // A vault proven not to implement the function cannot start implementing it.
+    if (cache_1.CACHE.get(absenceKey) === true)
+        return 0;
+    try {
+        return Number(await (0, core_1.retryOnTransientRpc)('getVaultAvailableRedemptions:lagDuration', () => vaultContract.lagDuration(), { vault }, (error) => (0, core_1.isRetryableRpcError)(error) ||
+            (0, core_1.isEmptyViewResponse)(error, LAG_DURATION_SELECTOR)));
+    }
+    catch (error) {
+        if (!(0, core_1.isEmptyViewResponse)(error, LAG_DURATION_SELECTOR))
+            throw error;
+        // Retries agreed the response is empty — record the absence so the next
+        // call short-circuits instead of re-paying the full retry budget.
+        cache_1.CACHE.set(absenceKey, true);
+        core_1.Logger.log.warn('getVaultAvailableRedemptions', {
+            vault,
+            reason: 'vault does not implement lagDuration(); assuming no claim lag',
+        });
+        return 0;
+    }
+}
+/**
+ * `lagDuration()` — `keccak256("lagDuration()")[0..4]`. Scopes the
+ * empty-response tolerance in {@link readLagDuration} to exactly that call, so
+ * an empty response to any *other* view still surfaces as an error.
+ */
+const LAG_DURATION_SELECTOR = '0x24e86d67';
 async function getVaultAvailableRedemptions({ vault, wallet, options, prefetchedReads, }) {
     try {
         // Stellar vaults don't support on-chain redemptions yet
@@ -674,7 +778,7 @@ async function getVaultAvailableRedemptions({ vault, wallet, options, prefetched
         }
         const lagDuration = typeof prefetchedReads?.lagDuration === 'number'
             ? prefetchedReads.lagDuration
-            : Number(await vaultContract.lagDuration());
+            : await readLagDuration(vaultContract, vault, options.rpcUrl);
         const { withdrawalRequesteds, withdrawalProcesseds } = await (0, subgraph_1.getSubgraphAllWithdrawals)(vault, provider);
         // format
         const availableRedemptions = [];
@@ -954,7 +1058,13 @@ async function getVaultRedemptionHistory({ vault, wallet, lookbackBlocks, option
         const currentBlock = await provider.getBlockNumber();
         const blockSkip = (0, core_1.determineBlockSkipInternal)(chainId);
         const cutoffBlock = currentBlock - (lookbackBlocks ?? (0, core_1.determineBlockCutoff)(chainId));
-        const BATCH_SIZE = 20; // Max concurrent RPC requests per batch
+        // Max concurrent `eth_getLogs` requests per batch. Kept well under the
+        // per-second cap of the smallest provider plan we run against (QuickNode:
+        // 50/s) because this scan is not the only caller on the connection — a
+        // page rendering several vaults runs several of these concurrently. At 20
+        // the batches reliably tripped `-32007 50/second request limit reached`,
+        // which the retry below now absorbs and this ceiling mostly avoids.
+        const BATCH_SIZE = 8;
         core_1.Logger.log.info('getVaultRedemptionHistory', {
             vault,
             version,
@@ -987,7 +1097,13 @@ async function getVaultRedemptionHistory({ vault, wallet, lookbackBlocks, option
         const logs = [];
         for (let i = 0; i < ranges.length; i += BATCH_SIZE) {
             const batch = ranges.slice(i, i + BATCH_SIZE);
-            const batchResults = await Promise.allSettled(batch.map((r) => poolContract.queryFilter('WithdrawalProcessed', BigInt(r.from), BigInt(r.to))));
+            const batchResults = await Promise.allSettled(batch.map((r) => 
+            // `eth_getLogs` over a fixed block range is idempotent, so a chunk
+            // rejected by a rate limiter or a flaky socket is safe to repeat.
+            // Without this a single `-32007` burst aborted the whole scan and
+            // the caller lost the redemption history entirely — the same failure
+            // mode the throw below was added to make visible.
+            (0, core_1.retryOnTransientRpc)('getVaultRedemptionHistory:chunk', () => poolContract.queryFilter('WithdrawalProcessed', BigInt(r.from), BigInt(r.to)), { vault, fromBlock: r.from, toBlock: r.to })));
             const failed = batchResults.filter((r) => r.status === 'rejected');
             if (failed.length > 0) {
                 const firstReason = failed[0].reason;

package/lib/sdk.d.ts

@@ -15020,7 +15020,8 @@ export declare function allowance(signer: IContractRunner, options: IAllowanceOp
  * Append the active attribution suffix to calldata.
  *
  * No-ops (returns `data` unchanged) when attribution is off, the chain is
- * excluded, `data` is empty/absent (plain value transfers are never
+ * not attributed (including an unknown chain under a `chains` restriction),
+ * `data` is empty/absent (plain value transfers are never
  * attributed), or `data` already ends with the ERC-8021 marker (guards
  * against double-appending when an upstream layer — e.g. a wagmi config
  * `dataSuffix` — already attributed the transaction).
@@ -15065,6 +15066,10 @@ export declare function approve(signer: Signer | Wallet, options: IContractWrite
 /**
  * Execute a token approval for a cross-chain operation.
  *
+ * @param chainId Chain the approval is sent on, used to gate ERC-8021
+ *   attribution. Omitted means unattributed under a `chains` restriction —
+ *   the suffix would lengthen `approve` calldata past its ABI encoding and
+ *   break Ledger clear-signing.
  * @returns Transaction hash of the approval
  */
 export declare function approveCrossChain(tokenAddress: IAddress, spenderAddress: IAddress, amount: bigint, walletClient: {
@@ -15078,7 +15083,7 @@ export declare function approveCrossChain(tokenAddress: IAddress, spenderAddress
     }) => Promise<{
         status: string;
     }>;
-}): Promise<string>;
+}, chainId?: number): Promise<string>;
 
 /**
  * Discriminated union returned by {@link approve}. Lets callers tell apart
@@ -17419,9 +17424,12 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
           };
 
           /**
-           * The default Slack webhook URL for logging errors.
+           * @deprecated Was a hardcoded webhook credential baked into the published
+           * bundle. It now resolves from {@link SLACK_WEBHOOK_ENV_VAR} and is `''` when
+           * unset. Call {@link resolveSlackWebhookUrl} instead — this export exists only
+           * so existing imports keep compiling, and is removed in the next major.
            */
-          declare const DEFAULT_SLACK_WEBHOOK_URL = "T04CM84GAV6/B0A2DS3ST8C/FLtOA3Jna3FN7UO4DoGxHfhG";
+          declare const DEFAULT_SLACK_WEBHOOK_URL = "";
 
           /**
            * Deposit a native token (ETH / AVAX / etc.) into a vault via the
@@ -18274,11 +18282,12 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
 
                      /**
                       * Return the active ERC-8021 suffix for a write on the given chain, or
-                      * `undefined` when attribution is off or the chain is excluded.
+                      * `undefined` when attribution is off or the chain is not attributed.
                       *
                       * @param chainId EVM chain ID of the transaction, when the call site knows
-                      *   it. When omitted and a `chains` restriction is configured, the suffix is
-                      *   returned anyway (over-attribution is harmless; see
+                      *   it. When a `chains` restriction is configured, gating is fail-closed: an
+                      *   omitted chain ID yields no suffix, since a suffix on an unattributed
+                      *   chain buys nothing and breaks hardware-wallet clear-signing (see
                       *   {@link IAttributionConfig.chains}).
                       * @returns `0x`-prefixed hex suffix, or `undefined` when nothing should be
                       *   appended.
@@ -18323,10 +18332,16 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                       * Fetch token decimals from contract or Solana mint.
                       * Results are cached to minimize RPC calls.
                       *
-                      * **Never throws** — a failed read logs at error level and resolves
-                      * `undefined`. Callers that must not silently proceed on an unknown scale (any
-                      * path that encodes an amount) should use {@link getDecimalsOrThrow} instead:
-                      * feeding `undefined` into `toNormalizedBn` silently defaults to 18 decimals.
+                      * **Never throws** — a failed read resolves `undefined`. Callers that must not
+                      * silently proceed on an unknown scale (any path that encodes an amount) should
+                      * use {@link getDecimalsOrThrow} instead: feeding `undefined` into
+                      * `toNormalizedBn` silently defaults to 18 decimals.
+                      *
+                      * Transient transport faults (provider rate limits, socket resets, an empty
+                      * response to `decimals()`) are logged at `warn` — a breadcrumb, not a
+                      * standalone Sentry issue — since the caller sees the same `undefined` either
+                      * way. Everything else is logged at `error`. The read itself is **not**
+                      * retried here; that is opt-in via {@link getDecimalsOrThrow}.
                       *
                       * @param provider Web3 provider
                       * @param address Token contract address or Solana mint
@@ -19430,7 +19445,7 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                        * Subgraph base URL
                        * @deprecated use getVaultMetadata to fetch subgraph URLs from the backend
                        */
-                      export declare const GOLDSKY_BASE_URL = "https://api.goldsky.com/api/private/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs";
+                      export declare const GOLDSKY_BASE_URL = "https://api.goldsky.com/api/public/project_cm9g0xy3o4j6v01vd34r3hvv9/subgraphs";
 
                       /**
                        * Deposit funds into a Solana August vault and mint share tokens.
@@ -19640,10 +19655,15 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                           /**
                            * EVM chain IDs to attribute. Omit to attribute writes on every EVM chain
                            * (the suffix is inert on chains without an ERC-8021 indexer and costs
-                           * ~16 gas per non-zero byte). When set, writes on other chains are sent
-                           * without the suffix; call sites that cannot determine their chain ID
-                           * append the suffix regardless, since over-attribution is harmless and
-                           * under-attribution loses data.
+                           * ~16 gas per non-zero byte). When set, gating is fail-closed: writes on
+                           * other chains — and writes whose chain ID cannot be determined — are sent
+                           * without the suffix.
+                           *
+                           * Over-attribution is not harmless. The suffix makes calldata longer than
+                           * the ABI encoding of the call, which breaks clear-signing on hardware
+                           * wallets: a Ledger rejects an over-long ERC-20 `approve` with
+                           * `EthAppCommandError: Invalid data 6a80`, so an unattributed chain that
+                           * receives the suffix anyway cannot be transacted on from a Ledger at all.
                            */
                           chains?: number[];
                       }
@@ -21057,6 +21077,16 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                        */
                       export declare function isAnalyticsForcedOnViaEnv(): boolean;
 
+                      /**
+                       * Whether attribution is configured at all, independent of any chain gate.
+                       *
+                       * Call sites that need to know whether to resolve a chain ID before asking
+                       * for the suffix use this; {@link getAttributionSuffix} applies the gate.
+                       *
+                       * @returns `true` when builder codes are configured.
+                       */
+                      export declare function isAttributionEnabled(): boolean;
+
                       /** Type guard. Works across realms (e.g. Web Worker / VM contexts). */
                       export declare function isAugustSDKError(err: unknown): err is AugustSDKError;
 
@@ -24059,6 +24089,31 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                            */
                        export declare function resolveOriginCode(provided?: `0x${string}`): `0x${string}`;
 
+                       /**
+                        * Resolve the Slack webhook to alert through.
+                        *
+                        * Why this replaced a hardcoded constant: a webhook path is a **bearer
+                        * credential** — anyone holding it can post to the channel. The previous
+                        * default embedded August's own webhook as a string literal, which shipped in
+                        * every published tarball and in the generated `.d.ts`, handing every consumer
+                        * of the SDK write access to an internal Slack channel (CLAUDE.md §5: no
+                        * secrets in client-reachable code). It also meant a consumer's alerts went to
+                        * August's channel rather than their own, with no way to redirect them.
+                        *
+                        * Resolution order:
+                        *   1. `explicit` — passed by the caller, wins outright;
+                        *   2. `AUGUST_SDK_SLACK_WEBHOOK_URL` in the environment;
+                        *   3. none — alerting is disabled and the call becomes a no-op.
+                        *
+                        * Reading the env var per call (rather than once at module load) means a
+                        * consumer configuring it after import still gets alerts, and a test can set
+                        * and unset it without re-importing the module.
+                        *
+                        * @param explicit - Caller-supplied webhook, full URL or bare path suffix.
+                        * @returns The bare `T…/B…/x…` path suffix, or `''` when unconfigured.
+                        */
+                       declare function resolveSlackWebhookUrl(explicit?: string): string;
+
                        /* Excluded from this release type: resolveSpender */
 
                        /**
@@ -25089,12 +25144,21 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
 
                        declare namespace Slack {
                            export {
+                               resolveSlackWebhookUrl,
+                               SLACK_WEBHOOK_ENV_VAR,
                                DEFAULT_SLACK_WEBHOOK_URL,
                                SLACK
                            }
                        }
                        export { Slack }
 
+                       /**
+                        * Environment variable holding the Slack incoming-webhook to post SDK alerts
+                        * to. Accepts either the full `https://hooks.slack.com/services/T…/B…/x…` URL
+                        * or the bare `T…/B…/x…` path suffix.
+                        */
+                       declare const SLACK_WEBHOOK_ENV_VAR = "AUGUST_SDK_SLACK_WEBHOOK_URL";
+
                        export declare const Solana: {
                            utils: {
                                getExplorerLink: ({ signature, type, network, }: {
@@ -26791,7 +26855,8 @@ declare type AsArray<T> = T extends readonly unknown[] ? T : never;
                                              * already ending in the ERC-8021 marker is left untouched. When the
                                              * configured `chains` list requires a chain check and the transaction does
                                              * not carry a `chainId`, the signer's provider network is consulted (one
-                                             * cached RPC call).
+                                             * cached RPC call); if that lookup fails the transaction is sent
+                                             * unattributed.
                                              *
                                              * @param signer Normalized ethers Signer or Wallet.
                                              * @returns A proxied signer with an attribution-aware `sendTransaction`.

package/lib/services/subgraph/vaults.js

@@ -16,7 +16,7 @@ const fetcher_2 = require("../../modules/vaults/fetcher");
 /**
  * Utils
  */
-const GOLDSKY_API_KEY = 'cmd0lz6qf35lg01ty7u20aijy';
+const GOLDSKY_API_KEY = '';
 // Dedupe window for "Missing Subgraph" alerts (per pool).
 const MISSING_SUBGRAPH_ALERT_TTL_MS = 60 * 60 * 1000; // 1 hour
 /**
@@ -371,7 +371,7 @@ const TRANSFER_QUERY_PROPS = `
  * @param provider
  * @returns
  */
-async function getSubgraphWithdrawRequests(pool, provider, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL) {
+async function getSubgraphWithdrawRequests(pool, provider, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)()) {
     // setup
     let vaultSymbol = await (0, core_1.getVaultSymbol)(pool, provider);
     if (vaultSymbol === undefined) {
@@ -443,7 +443,7 @@ async function getSubgraphWithdrawRequests(pool, provider, slackWebookUrl = slac
     requests.push(...(json?.data?.withdrawalRequesteds || []));
     return requests;
 }
-async function getSubgraphWithdrawProccessed(pool, provider, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL) {
+async function getSubgraphWithdrawProccessed(pool, provider, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)()) {
     try {
         // setup
         let vaultSymbol = await (0, core_1.getVaultSymbol)(pool, provider);
@@ -526,7 +526,7 @@ async function getSubgraphWithdrawProccessed(pool, provider, slackWebookUrl = sl
  * @param provider
  * @returns
  */
-async function getSubgraphAllWithdrawals(pool, provider, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL) {
+async function getSubgraphAllWithdrawals(pool, provider, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)()) {
     let query = '';
     try {
         // setup
@@ -695,7 +695,7 @@ async function getArchivedVaultUserHistory(user, provider, pool) {
         // chronology. The backend returns rows in arbitrary order, so re-sort here.
         .sort((a, b) => Number(a.timestamp_) - Number(b.timestamp_)));
 }
-async function getSubgraphUserHistory(user, provider, pool, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL) {
+async function getSubgraphUserHistory(user, provider, pool, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)()) {
     try {
         // This path is EVM-only: it reads chain id and network from an EVM
         // JsonRpcProvider (eth_chainId / getNetwork) and queries an EVM subgraph.
@@ -847,7 +847,7 @@ async function getSubgraphUserHistory(user, provider, pool, slackWebookUrl = sla
         return [];
     }
 }
-async function getSubgraphVaultHistory(provider, pool, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL, opts = {}) {
+async function getSubgraphVaultHistory(provider, pool, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)(), opts = {}) {
     try {
         // setup
         const requests = [];
@@ -1008,7 +1008,7 @@ async function getSubgraphVaultHistory(provider, pool, slackWebookUrl = slack_1.
         return [];
     }
 }
-async function getSubgraphUserTransfers(user, provider, pool, slackWebookUrl = slack_1.DEFAULT_SLACK_WEBHOOK_URL) {
+async function getSubgraphUserTransfers(user, provider, pool, slackWebookUrl = (0, slack_1.resolveSlackWebhookUrl)()) {
     try {
         // setup
         let amountOfTransfers = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augustdigital/sdk",
-  "version": "8.21.1",
+  "version": "8.24.0",
   "main": "lib/index.js",
   "types": "lib/sdk.d.ts",
   "keywords": [
@@ -66,6 +66,7 @@
     "test:jest:watch": "jest --config jest.config.unit.js --watch",
     "test:jest:coverage": "jest --config jest.config.unit.js --coverage",
     "test:forknet": "node tests/forknet/run.mjs",
+    "test:solana-localnet": "node tests/solana-localnet/run.mjs",
     "test:solana-idl": "jest --config jest.config.idl-drift.js",
     "clean": "rm -rf ./lib",
     "format": "biome check --write .",