@augustdigital/sdk 9.3.0 → 9.4.0

package/lib/core/fetcher.js

@@ -195,6 +195,30 @@ function buildRequestAbortSignal(options) {
         },
     };
 }
+/**
+ * Build the `AugustTimeoutError` a fetcher throws when its own timeout fired,
+ * and record it as a breadcrumb rather than a Sentry issue.
+ *
+ * Severity rationale: the error is *thrown* to the caller, so whoever owns the
+ * request decides whether it is fatal. Logging it at `error` here as well made
+ * every timeout a standalone Sentry issue even when the caller swallowed it
+ * (`Promise.allSettled` fan-outs in `getVaultAllocations` do exactly that) — a
+ * single stalled render produced 20–30 identical issues in the same second and
+ * ~40k events a week, none of them separately actionable. As a breadcrumb the
+ * timeout still rides along with whatever the caller ultimately reports, with
+ * the endpoint and elapsed budget attached.
+ *
+ * @param tag - Call-site tag (`fetchAugustPublic`, …) used as the breadcrumb label.
+ * @param relativeUrl - Endpoint path that timed out; sanitized before use.
+ * @param timeoutMs - Timeout budget that elapsed, in milliseconds.
+ * @returns The error to throw. Never throws.
+ * @internal
+ */
+function timeoutErrorFor(tag, relativeUrl, timeoutMs) {
+    const timeoutError = new errors_1.AugustTimeoutError((0, sanitize_1.sanitizeString)(`Request timeout after ${timeoutMs / 1000}s: ${relativeUrl}`), timeoutMs);
+    logger_1.Logger.log.warn(tag, { relativeUrl, timeoutMs, reason: 'request timeout' });
+    return timeoutError;
+}
 let _overrideDeprecationWarned = false;
 function warnOverrideDeprecation(callerTag) {
     if (_overrideDeprecationWarned)
@@ -250,6 +274,46 @@ const PRICE_ERROR_CACHE = new lru_cache_1.LRUCache({
  * In-flight price requests to prevent duplicate simultaneous API calls.
  */
 const PRICE_REQUESTS = new Map();
+/**
+ * In-flight `/tokenized_vault` requests, keyed by the same cache key the
+ * response is stored under.
+ *
+ * The response cache alone only de-duplicates *sequential* calls: a cold
+ * process (a fresh serverless container, a hard page load) fans out N
+ * concurrent `getVault` calls for the same vault before any of them has
+ * populated the cache, so all N hit the backend. Under load that self-inflicted
+ * stampede is what pushed `/tokenized_vault/{address}` past its timeout — the
+ * single largest source of `AugustTimeoutError` in production.
+ *
+ * Joining concurrent callers onto one promise collapses that fan-out to a
+ * single request. Entries are removed as soon as the request settles, so a
+ * failure is never cached — the next caller retries.
+ */
+const TOKENIZED_VAULT_REQUESTS = new Map();
+/**
+ * Run `factory` at most once per `key` while it is in flight, joining any
+ * concurrent caller onto the same promise.
+ *
+ * This is a de-duplication primitive, not a cache: the entry lives only for the
+ * duration of the request and is cleared on both success and failure, so errors
+ * are never shared beyond the callers that were already waiting.
+ *
+ * @param registry - Map holding the in-flight promises for this resource type.
+ * @param key - Identity of the request; callers sharing a key share a result.
+ * @param factory - Produces the promise to run when no request is in flight.
+ * @returns The shared promise for `key`.
+ * @internal
+ */
+function dedupeInFlight(registry, key, factory) {
+    const existing = registry.get(key);
+    if (existing)
+        return existing;
+    const request = factory().finally(() => {
+        registry.delete(key);
+    });
+    registry.set(key, request);
+    return request;
+}
 /**
  * Build an August backend URL, rejecting unknown server keys and any
  * `relativeUrl` that would escape the configured origin.
@@ -347,9 +411,7 @@ async function fetchAugustWithKey(apiKey, relativeUrl, options) {
             if (!timedOut()) {
                 throw err;
             }
-            const timeoutError = new errors_1.AugustTimeoutError((0, sanitize_1.sanitizeString)(`Request timeout after ${effectiveTimeoutMs / 1000}s: ${relativeUrl}`), effectiveTimeoutMs);
-            logger_1.Logger.log.error('fetchAugustWithKey', timeoutError, { relativeUrl });
-            throw timeoutError;
+            throw timeoutErrorFor('fetchAugustWithKey', relativeUrl, effectiveTimeoutMs);
         }
         throw err;
     }
@@ -402,9 +464,7 @@ async function fetchAugustPublic(relativeUrl, options) {
             if (!timedOut()) {
                 throw err;
             }
-            const timeoutError = new errors_1.AugustTimeoutError((0, sanitize_1.sanitizeString)(`Request timeout after ${effectiveTimeoutMs / 1000}s: ${relativeUrl}`), effectiveTimeoutMs);
-            logger_1.Logger.log.error('fetchAugustPublic', timeoutError, { relativeUrl });
-            throw timeoutError;
+            throw timeoutErrorFor('fetchAugustPublic', relativeUrl, effectiveTimeoutMs);
         }
         throw err;
     }
@@ -460,9 +520,7 @@ async function fetchAugustWithBearer(bearerToken, relativeUrl, options) {
             if (!timedOut()) {
                 throw err;
             }
-            const timeoutError = new errors_1.AugustTimeoutError((0, sanitize_1.sanitizeString)(`Request timeout after ${effectiveTimeoutMs / 1000}s: ${relativeUrl}`), effectiveTimeoutMs);
-            logger_1.Logger.log.error('fetchAugustWithBearer', timeoutError, { relativeUrl });
-            throw timeoutError;
+            throw timeoutErrorFor('fetchAugustWithBearer', relativeUrl, effectiveTimeoutMs);
         }
         throw err;
     }
@@ -535,24 +593,29 @@ async function fetchTokenizedVault(pool, headers, loadSubaccounts, loadSnapshots
         tokenizedVault = cachedResponse;
     }
     if (!tokenizedVault) {
-        // Build endpoint URL with optional query parameters
-        let endpoint = core_2.WEBSERVER_ENDPOINTS.public.tokenizedVault.byVaultAddress(pool);
-        const params = new URLSearchParams();
-        if (loadSubaccounts === false) {
-            params.set('load_subaccounts', 'false');
-        }
-        if (loadSnapshots === false) {
-            params.set('load_snapshots', 'false');
-        }
-        const queryString = params.toString();
-        if (queryString) {
-            endpoint += `?${queryString}`;
-        }
-        const tokenizedVaultsResponse = await fetchAugustPublic(endpoint, {
-            headers: headers,
+        // Concurrent callers for the same vault share one request; see
+        // TOKENIZED_VAULT_REQUESTS.
+        tokenizedVault = await dedupeInFlight(TOKENIZED_VAULT_REQUESTS, key, async () => {
+            // Build endpoint URL with optional query parameters
+            let endpoint = core_2.WEBSERVER_ENDPOINTS.public.tokenizedVault.byVaultAddress(pool);
+            const params = new URLSearchParams();
+            if (loadSubaccounts === false) {
+                params.set('load_subaccounts', 'false');
+            }
+            if (loadSnapshots === false) {
+                params.set('load_snapshots', 'false');
+            }
+            const queryString = params.toString();
+            if (queryString) {
+                endpoint += `?${queryString}`;
+            }
+            const tokenizedVaultsResponse = await fetchAugustPublic(endpoint, {
+                headers: headers,
+            });
+            const parsed = (await tokenizedVaultsResponse.json());
+            cache_1.CACHE.set(key, parsed, { ttl: 1000 * 60 * 10 }); // Cache for 10 minutes
+            return parsed;
         });
-        tokenizedVault = (await tokenizedVaultsResponse.json());
-        cache_1.CACHE.set(key, tokenizedVault, { ttl: 1000 * 60 * 10 }); // Cache for 10 minutes
     }
     // Filter by specific vault if address provided
     if (pool &&
@@ -585,26 +648,30 @@ async function fetchTokenizedVaults(pool, headers, loadSubaccounts, loadSnapshot
         tokenizedVaults = cachedResponse;
     }
     if (!tokenizedVaults) {
-        // Build endpoint URL with optional query parameters
-        let endpoint = core_2.WEBSERVER_ENDPOINTS.public.tokenizedVault.list;
-        const params = new URLSearchParams();
-        if (loadSubaccounts === false) {
-            params.set('load_subaccounts', 'false');
-        }
-        if (loadSnapshots === false) {
-            params.set('load_snapshots', 'false');
-        }
-        const queryString = params.toString();
-        if (queryString) {
-            endpoint += `?${queryString}`;
-        }
-        const tokenizedVaultsResponse = await fetchAugustPublic(endpoint, {
-            headers: headers,
+        // The vault list is requested by every vault page at once on a cold
+        // process; join concurrent callers onto one request.
+        tokenizedVaults = await dedupeInFlight(TOKENIZED_VAULT_REQUESTS, key, async () => {
+            // Build endpoint URL with optional query parameters
+            let endpoint = core_2.WEBSERVER_ENDPOINTS.public.tokenizedVault.list;
+            const params = new URLSearchParams();
+            if (loadSubaccounts === false) {
+                params.set('load_subaccounts', 'false');
+            }
+            if (loadSnapshots === false) {
+                params.set('load_snapshots', 'false');
+            }
+            const queryString = params.toString();
+            if (queryString) {
+                endpoint += `?${queryString}`;
+            }
+            const tokenizedVaultsResponse = await fetchAugustPublic(endpoint, {
+                headers: headers,
+            });
+            const parsed = (await tokenizedVaultsResponse.json());
+            const ttl = 1000 * 60 * 15; // 15 minute cache
+            cache_1.CACHE.set(key, parsed, { ttl });
+            return parsed;
         });
-        tokenizedVaults =
-            (await tokenizedVaultsResponse.json());
-        const ttl = 1000 * 60 * 15; // 15 minute cache
-        cache_1.CACHE.set(key, tokenizedVaults, { ttl });
     }
     // Filter by specific vault if address provided
     if (pool &&

package/lib/core/helpers/concurrency.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Concurrency helpers.
+ *
+ * Internal only — deliberately not re-exported from `core/index.ts`, so it is
+ * not part of the published API surface.
+ *
+ * Leaf module: depends on nothing inside the SDK, so it is safe to import from
+ * any layer without forming a cycle (see CLAUDE.md §9).
+ */
+/**
+ * Map over `items` running at most `limit` tasks at a time.
+ *
+ * Exists because `Promise.all` over a caller-sized array is unbounded: a vault
+ * with 40 borrowers opens 40 simultaneous connections to the same backend,
+ * which is how a slow endpoint turns into a timeout storm rather than a slow
+ * response. A small fixed window keeps latency close to the parallel case while
+ * bounding the load the SDK can put on one origin.
+ *
+ * Results preserve input order regardless of completion order. A rejected task
+ * rejects the returned promise (like `Promise.all`); callers that need
+ * per-item error isolation should catch inside `task`.
+ *
+ * @param items - Inputs to process. An empty array resolves to `[]` immediately.
+ * @param limit - Maximum tasks in flight. Values below 1 are treated as 1.
+ * @param task - Receives an item and its index; returns the value for that slot.
+ * @returns Results in the same order as `items`.
+ * @throws Whatever `task` rejects with, on the first rejection.
+ * @example
+ * ```ts
+ * // At most 5 concurrent requests, regardless of borrower count.
+ * const positions = await mapWithConcurrency(borrowers, 5, (b) =>
+ *   fetchPosition(b).catch(() => null),
+ * );
+ * ```
+ * @internal
+ */
+export declare function mapWithConcurrency<TIn, TOut>(items: readonly TIn[], limit: number, task: (item: TIn, index: number) => Promise<TOut>): Promise<TOut[]>;

package/lib/core/helpers/concurrency.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Concurrency helpers.
+ *
+ * Internal only — deliberately not re-exported from `core/index.ts`, so it is
+ * not part of the published API surface.
+ *
+ * Leaf module: depends on nothing inside the SDK, so it is safe to import from
+ * any layer without forming a cycle (see CLAUDE.md §9).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapWithConcurrency = mapWithConcurrency;
+/**
+ * Map over `items` running at most `limit` tasks at a time.
+ *
+ * Exists because `Promise.all` over a caller-sized array is unbounded: a vault
+ * with 40 borrowers opens 40 simultaneous connections to the same backend,
+ * which is how a slow endpoint turns into a timeout storm rather than a slow
+ * response. A small fixed window keeps latency close to the parallel case while
+ * bounding the load the SDK can put on one origin.
+ *
+ * Results preserve input order regardless of completion order. A rejected task
+ * rejects the returned promise (like `Promise.all`); callers that need
+ * per-item error isolation should catch inside `task`.
+ *
+ * @param items - Inputs to process. An empty array resolves to `[]` immediately.
+ * @param limit - Maximum tasks in flight. Values below 1 are treated as 1.
+ * @param task - Receives an item and its index; returns the value for that slot.
+ * @returns Results in the same order as `items`.
+ * @throws Whatever `task` rejects with, on the first rejection.
+ * @example
+ * ```ts
+ * // At most 5 concurrent requests, regardless of borrower count.
+ * const positions = await mapWithConcurrency(borrowers, 5, (b) =>
+ *   fetchPosition(b).catch(() => null),
+ * );
+ * ```
+ * @internal
+ */
+async function mapWithConcurrency(items, limit, task) {
+    if (items.length === 0)
+        return [];
+    const width = Math.max(1, Math.min(Math.floor(limit), items.length));
+    const results = new Array(items.length);
+    // Shared cursor: each worker repeatedly claims the next unclaimed index, so
+    // a slow item never blocks the workers behind it (as a fixed chunked split
+    // would).
+    let cursor = 0;
+    const worker = async () => {
+        while (cursor < items.length) {
+            const index = cursor++;
+            results[index] = await task(items[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: width }, worker));
+    return results;
+}
+//# sourceMappingURL=concurrency.js.map

package/lib/core/helpers/core.d.ts

@@ -66,3 +66,12 @@ export declare function calculateWeights<T extends Record<string, unknown>>(data
  * @returns Weighted average
  */
 export declare function calculateWeightedAverage<T extends Record<string, unknown>>(data?: T[], valueProperty?: string, weightProperty?: string): number;
+/**
+ * Coerce a caller-supplied integer (`string | bigint | number`) to a `bigint`,
+ * rejecting anything that is not a non-negative safe integer. `label` names the
+ * calling method and `noun` the field being validated, so bad input surfaces as
+ * `AugustValidationError('INVALID_INPUT')` at the SDK boundary instead of a
+ * `BigInt()` SyntaxError wrapped as `UNKNOWN`.
+ * @internal
+ */
+export declare function toRawBigInt(value: string | bigint | number, label: string, noun?: string): bigint;

package/lib/core/helpers/core.js

@@ -15,8 +15,10 @@ exports.prepareDateForDb = prepareDateForDb;
 exports.orderObjArrByDate = orderObjArrByDate;
 exports.calculateWeights = calculateWeights;
 exports.calculateWeightedAverage = calculateWeightedAverage;
+exports.toRawBigInt = toRawBigInt;
 const web3_1 = require("../constants/web3");
 const ethers_1 = require("ethers");
+const errors_1 = require("../errors");
 /**
  * Table of Contents
  * - Formatters
@@ -282,4 +284,49 @@ function calculateWeightedAverage(data, valueProperty, weightProperty) {
     const weightedAverage = weightedData.reduce((acc, item) => acc + item[valueProperty] * item.weight, 0);
     return weightedAverage;
 }
+/**
+ * Coerce a caller-supplied integer (`string | bigint | number`) to a `bigint`,
+ * rejecting anything that is not a non-negative safe integer. `label` names the
+ * calling method and `noun` the field being validated, so bad input surfaces as
+ * `AugustValidationError('INVALID_INPUT')` at the SDK boundary instead of a
+ * `BigInt()` SyntaxError wrapped as `UNKNOWN`.
+ * @internal
+ */
+function toRawBigInt(value, label, noun = 'amount') {
+    if (typeof value === 'bigint')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} must be finite, got ${value}`);
+        }
+        if (value < 0) {
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} must be non-negative, got ${value}`);
+        }
+        if (!Number.isInteger(value)) {
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} must be an integer, got ${value}`);
+        }
+        if (!Number.isSafeInteger(value)) {
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} ${value} exceeds Number.MAX_SAFE_INTEGER; pass a string or bigint to preserve precision`);
+        }
+        return BigInt(value);
+    }
+    if (typeof value === 'string') {
+        if (value.trim() === '') {
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} string must not be empty`);
+        }
+        try {
+            const parsed = BigInt(value);
+            if (parsed < 0n) {
+                throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} must be non-negative, got ${value}`);
+            }
+            return parsed;
+        }
+        catch (e) {
+            if (e instanceof errors_1.AugustValidationError)
+                throw e;
+            throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} "${value}" is not a valid integer`);
+        }
+    }
+    throw new errors_1.AugustValidationError('INVALID_INPUT', `${label}: ${noun} must be a string, bigint, or number`);
+}
 //# sourceMappingURL=core.js.map

package/lib/core/helpers/vaults.d.ts

@@ -49,7 +49,7 @@ export declare const getDefaultSubgraphUrl: (_network: string, _symbol: string)
 /**
  * Resolve whether a single fee (management or performance) is currently waived.
  *
- * Backend-driven, per AUGUST-5584. This centralizes logic that previously lived —
+ * Backend-driven. This centralizes logic that previously lived —
  * and diverged — across two upshift-app components. The resolution is deliberately
  * split between the backend and the SDK:
  *

package/lib/core/helpers/vaults.js

@@ -183,7 +183,7 @@ exports.getDefaultSubgraphUrl = getDefaultSubgraphUrl;
 /**
  * Resolve whether a single fee (management or performance) is currently waived.
  *
- * Backend-driven, per AUGUST-5584. This centralizes logic that previously lived —
+ * Backend-driven. This centralizes logic that previously lived —
  * and diverged — across two upshift-app components. The resolution is deliberately
  * split between the backend and the SDK:
  *

package/lib/core/helpers/web3.js

@@ -735,7 +735,20 @@ const getSymbol = async (provider, address, isVault = true) => {
             }
         }
         catch (e) {
-            logger_1.Logger.log.error('getSymbol', `${address}::${e}`);
+            // Recovered failure, not an incident: the caller gets `undefined` and
+            // renders without a symbol. Logging it at `error` made every transient
+            // RPC hiccup ("socket hang up", connection reset) a standalone Sentry
+            // issue — ~24k events across one grouping, none actionable — and the
+            // interpolated `${address}::${e}` message put the token address in the
+            // issue title, so each address produced its own group.
+            //
+            // As a warning it becomes a breadcrumb on whatever the caller ultimately
+            // reports, with the address and reason as structured fields.
+            logger_1.Logger.log.warn('getSymbol', {
+                address,
+                isVault,
+                reason: e instanceof Error ? e.message : String(e),
+            });
             return undefined;
         }
         finally {

package/lib/core/logger/curator-alert.d.ts

@@ -182,7 +182,7 @@ export declare function areCuratorAlertsEnabled(): boolean;
  * request/queue path — so a curator whose users' redemptions are failing has
  * no signal at all today: the failure surfaces to the user, and to August's
  * internal Sentry, and stops there. Emitting from the SDK rather than from a
- * single frontend means any integration can report one (AUGUST-7162) — subject
+ * single frontend means any integration can report one — subject
  * to the CORS caveat on {@link DEFAULT_CURATOR_ALERT_ENDPOINT}.
  *
  * **Trust model.** The endpoint is public by construction — it ships in this
@@ -210,7 +210,7 @@ export declare function areCuratorAlertsEnabled(): boolean;
  *   process; `sharesRaw` is relayed unscaled, and the receiving service scales
  *   it for display with the decimals it holds for that vault — which for an
  *   offset vault are the asset's, not the share token's, so the figure a curator
- *   sees is a magnitude rather than an exact amount (see AUGUST-6381).
+ *   sees is a magnitude rather than an exact amount.
  * @internal
  */
 export declare function reportRedeemFailure(event: IRedeemFailureEvent): void;

package/lib/core/logger/curator-alert.js

@@ -176,7 +176,7 @@ function errorSignature(error) {
  * request/queue path — so a curator whose users' redemptions are failing has
  * no signal at all today: the failure surfaces to the user, and to August's
  * internal Sentry, and stops there. Emitting from the SDK rather than from a
- * single frontend means any integration can report one (AUGUST-7162) — subject
+ * single frontend means any integration can report one — subject
  * to the CORS caveat on {@link DEFAULT_CURATOR_ALERT_ENDPOINT}.
  *
  * **Trust model.** The endpoint is public by construction — it ships in this
@@ -204,7 +204,7 @@ function errorSignature(error) {
  *   process; `sharesRaw` is relayed unscaled, and the receiving service scales
  *   it for display with the decimals it holds for that vault — which for an
  *   offset vault are the asset's, not the share token's, so the figure a curator
- *   sees is a magnitude rather than an exact amount (see AUGUST-6381).
+ *   sees is a magnitude rather than an exact amount.
  * @internal
  */
 function reportRedeemFailure(event) {

package/lib/evm/methods/crossChainVaultRegistry.d.ts

@@ -77,13 +77,12 @@ export declare function getOVaultChains(vault: IAddress): {
  * The deposit UI must not offer a spoke share destination for these vaults.
  *
  * @param vault - Vault contract address.
- * @returns `true` for vaults whose shares cannot leave the hub chain
- *   (AUGUST-6300).
+ * @returns `true` for vaults whose shares cannot leave the hub chain.
  */
 export declare function isHubOnlyReceipt(vault: IAddress): boolean;
 /**
  * Chains a user can receive the underlying asset on when withdrawing.
- * Hub-only-receipt vaults redeem to the hub chain only (AUGUST-6300); all
+ * Hub-only-receipt vaults redeem to the hub chain only; all
  * other OVault vaults can redeem to the hub or any spoke.
  *
  * @param vault - Vault contract address.

package/lib/evm/methods/crossChainVaultRegistry.js

@@ -214,15 +214,14 @@ function getOVaultChains(vault) {
  * The deposit UI must not offer a spoke share destination for these vaults.
  *
  * @param vault - Vault contract address.
- * @returns `true` for vaults whose shares cannot leave the hub chain
- *   (AUGUST-6300).
+ * @returns `true` for vaults whose shares cannot leave the hub chain.
  */
 function isHubOnlyReceipt(vault) {
     return getCrossChainVaultConfig(vault)?.hubOnlyReceipt === true;
 }
 /**
  * Chains a user can receive the underlying asset on when withdrawing.
- * Hub-only-receipt vaults redeem to the hub chain only (AUGUST-6300); all
+ * Hub-only-receipt vaults redeem to the hub chain only; all
  * other OVault vaults can redeem to the hub or any spoke.
  *
  * @param vault - Vault contract address.

package/lib/evm/types/crossChain.d.ts

@@ -89,7 +89,7 @@ export interface ICrossChainVaultConfig {
     /**
      * When `true`, the vault's receipt token cannot leave the hub chain: there
      * is no OFT/bridge for it, so minting shares on a spoke would strand the
-     * user (AUGUST-6300). Withdraw UIs must offer the hub chain only. Defaults
+     * user. Withdraw UIs must offer the hub chain only. Defaults
      * to `false` when omitted. Drives `getWithdrawDestinationChains`.
      */
     hubOnlyReceipt?: boolean;

package/lib/main.d.ts

@@ -88,10 +88,12 @@ export declare class AugustSDK extends AugustBase {
         loadSnapshots?: boolean;
     }): Promise<number>;
     /**
-     * Fetch all available vaults across configured networks.
-     * Optionally filter by chain IDs and include loan/allocation data.
-     * @param options - Configuration for filtering and enriching vault data
-     * @returns Array of vault objects with metadata and optional position data
+     * Deposit into a vault with an explicit signer. When `depositAsset` differs
+     * from the vault's underlying asset the deposit is routed through the
+     * matching adapter (native wrapper, swap router, or permit path).
+     * @param signer - ethers Signer or Wallet that sends the transaction
+     * @param options - Vault address (`target`), depositor `wallet`, `amount`, and optional `depositAsset`, `wait`, `receiver`, `slippageBps`
+     * @returns Deposit transaction hash
      */
     vaultDeposit(signer: Signer | Wallet, options: IContractWriteOptions): Promise<string>;
     /**
@@ -451,7 +453,7 @@ export declare class AugustSDK extends AugustBase {
      * Supported Vaults: cUSDO, tETH, wstETH, rsETH
      *
      * @deprecated The `hgETH30dLiquidAPY` and `hgETH7dLiquidAPY` response fields are deprecated.
-     * These fields will be removed on 2026-01-01.
+     * These fields will be removed in the next major release.
      * Use `liquidAPY30Day` and `liquidAPY7Day` fields instead.
      *
      * @param props - Vault address

package/lib/main.js

@@ -219,10 +219,12 @@ class AugustSDK extends core_1.AugustBase {
         return await this.vaults.getTotalDeposited(options);
     }
     /**
-     * Fetch all available vaults across configured networks.
-     * Optionally filter by chain IDs and include loan/allocation data.
-     * @param options - Configuration for filtering and enriching vault data
-     * @returns Array of vault objects with metadata and optional position data
+     * Deposit into a vault with an explicit signer. When `depositAsset` differs
+     * from the vault's underlying asset the deposit is routed through the
+     * matching adapter (native wrapper, swap router, or permit path).
+     * @param signer - ethers Signer or Wallet that sends the transaction
+     * @param options - Vault address (`target`), depositor `wallet`, `amount`, and optional `depositAsset`, `wait`, `receiver`, `slippageBps`
+     * @returns Deposit transaction hash
      */
     async vaultDeposit(signer, options) {
         return await this.vaults.vaultDeposit(signer, options);
@@ -524,7 +526,7 @@ class AugustSDK extends core_1.AugustBase {
      * Supported Vaults: cUSDO, tETH, wstETH, rsETH
      *
      * @deprecated The `hgETH30dLiquidAPY` and `hgETH7dLiquidAPY` response fields are deprecated.
-     * These fields will be removed on 2026-01-01.
+     * These fields will be removed in the next major release.
      * Use `liquidAPY30Day` and `liquidAPY7Day` fields instead.
      *
      * @param props - Vault address

package/lib/modules/vaults/getters.d.ts

@@ -70,9 +70,16 @@ export declare function getVaultSubaccountLoans(vault: VaultAddress | IVault, op
  *
  * @param vault - Vault address
  * @param options - RPC configuration
+ * @param tokenizedVault - Optional pre-fetched backend row for `vault`. When a
+ *   caller already holds the row (e.g. `getVault` fetched it one call earlier),
+ *   passing it skips this function's own `GET /tokenized_vault/{address}` — a
+ *   pure de-duplication of backend traffic. The row must carry the subaccount
+ *   data this function reads (`.subaccounts`, `.eoa_operators`), so it must not
+ *   have been fetched with `loadSubaccounts: false`; a row fetched that way
+ *   would silently resolve zero borrowers.
  * @returns Detailed allocation data with exposure categorization
  */
-export declare function getVaultAllocations(vault: IAddress, options: IVaultBaseOptions): Promise<IVaultAllocations>;
+export declare function getVaultAllocations(vault: IAddress, options: IVaultBaseOptions, tokenizedVault?: ITokenizedVault): Promise<IVaultAllocations>;
 export declare function getVaultAvailableRedemptions({ vault, wallet, options, prefetchedReads, }: {
     vault: IAddress;
     wallet?: IAddress;
@@ -310,7 +317,7 @@ export interface PnlHistoryConsistencyParams {
     currentPositionRaw: bigint;
 }
 /**
- * Guard against the 2026-07-09 lifetime-PnL over-inflation failure mode.
+ * Guard against lifetime-PnL over-inflation when the deposit history fails to load.
  *
  * Lifetime PnL is `currentPosition + totalWithdrawn - totalDeposited`. When the
  * deposit/withdrawal history fails to load it collapses to empty, so both
@@ -435,7 +442,7 @@ export declare function getVaultHistoricalTimeseries({ vault, nDays, options, }:
  * Supported Vaults: cUSDO, tETH, wstETH, rsETH
  *
  * @deprecated The `hgETH30dLiquidAPY` and `hgETH7dLiquidAPY` response fields are deprecated.
- * These fields will be removed on 2026-01-01.
+ * These fields will be removed in the next major release.
  * Use `liquidAPY30Day` and `liquidAPY7Day` fields instead.
  *
  * @param vault - Vault contract address