@lifi/perps-sdk-provider-lighter 17.2.2 → 18.0.0

package/src/LighterProvider.ts

@@ -75,7 +75,10 @@ import {
 } from './constants.js'
 import { lighterDepositFlow } from './depositFlow.js'
 import { createAuthToken } from './signers/createAuthToken.js'
-import { LighterKeyStore } from './signers/LighterKeyStore.js'
+import {
+  type LighterApiKey,
+  LighterKeyStore,
+} from './signers/LighterKeyStore.js'
 import { LighterReadOnlyTokenManager } from './signers/LighterReadOnlyTokenManager.js'
 import { LighterSigner } from './signers/LighterSigner.js'
 import {
@@ -103,9 +106,8 @@ import {
 import {
   LIGHTER_RETRY_DEFAULTS,
   LighterApiClient,
-  LighterAuthRejectedError,
+  LighterTokenRevokedError,
 } from './utils/apiClient.js'
-import { fetchAppliedReferralCode } from './utils/appliedReferralCode.js'
 import { isAssetMarginEnabled } from './utils/assetCollateral.js'
 import {
   classifyAndMapOrders,
@@ -311,11 +313,6 @@ export const createLighterProvider = (
   })
   const keyStore = new LighterKeyStore(storage, providerKey)
   const apiKeyFreshness = createLighterApiKeyFreshness()
-  const readOnlyTokenManager = new LighterReadOnlyTokenManager({
-    storage,
-    providerKey,
-    lighterApiUrl: restUrl,
-  })
   const tokenLifetimeSeconds = options.tokenLifetimeSeconds ?? 60 * 60
   const tokenRenewBufferSeconds = options.tokenRenewBufferSeconds ?? 60
   const standardTokenByAddress: Map<string, CachedStandardToken> = new Map()
@@ -326,6 +323,7 @@ export const createLighterProvider = (
   const readOnlyCreationInFlight: Map<string, Promise<string>> = new Map()
   const readOnlyCreationBackoff: Map<string, ReadOnlyCreationBackoff> =
     new Map()
+  const rateLimitHold = { untilMs: 0 }
 
   const apiClient = (opts?: SDKRequestOptions): LighterApiClient => {
     const client = requireClient()
@@ -337,9 +335,17 @@ export const createLighterProvider = (
         providerKey
       ),
       fetchImpl: client.config.fetch,
+      rateLimitHold,
     })
   }
 
+  const readOnlyTokenManager = new LighterReadOnlyTokenManager({
+    storage,
+    providerKey,
+    lighterApiUrl: restUrl,
+    fetchImpl: (input, init) => apiClient().request(input, init),
+  })
+
   const getStandardAuthToken = async (
     address: Address,
     apiKeyPrivateKey: string,
@@ -385,7 +391,8 @@ export const createLighterProvider = (
    */
   const resolveAuthToken = async (
     opts: SDKRequestOptions | undefined,
-    address?: Address
+    address?: Address,
+    knownApiKey?: LighterApiKey
   ): Promise<string | undefined> => {
     if (opts?.lighterAuthToken !== undefined) {
       return opts.lighterAuthToken
@@ -396,7 +403,7 @@ export const createLighterProvider = (
     if (address === undefined) {
       return undefined
     }
-    const apiKey = await keyStore.get(address)
+    const apiKey = knownApiKey ?? (await keyStore.get(address))
     if (apiKey === null) {
       return undefined
     }
@@ -468,27 +475,60 @@ export const createLighterProvider = (
     return attempt
   }
 
-  const evictResolvedTokens = async (address: Address): Promise<void> => {
-    const cacheKey = address.toLowerCase()
-    readOnlyCreationBackoff.delete(cacheKey)
-    // The cached standard token may itself be the revoked credential — it
-    // rides reads during the creation-failure fallback and authorises
-    // read-only token creation — so a revocation must re-sign it too.
-    standardTokenByAddress.delete(cacheKey)
+  const replaceRevokedReadOnlyToken = async (
+    address: Address,
+    revokedToken: string
+  ): Promise<string | undefined> => {
     const apiKey = await keyStore.get(address)
-    if (apiKey !== null) {
-      await readOnlyTokenManager.remove(address, apiKey.accountIndex)
+    if (apiKey === null) {
+      return undefined
+    }
+    const flightKey = address.toLowerCase()
+    const activeFlight = readOnlyCreationInFlight.get(flightKey)
+    if (activeFlight !== undefined) {
+      return activeFlight
+    }
+    const current = await readOnlyTokenManager.get(address, apiKey.accountIndex)
+    if (current !== undefined && current.token !== revokedToken) {
+      return current.token
+    }
+    const inFlightAfterRead = readOnlyCreationInFlight.get(flightKey)
+    if (inFlightAfterRead !== undefined) {
+      return inFlightAfterRead
+    }
+    const attempt = (async (): Promise<string> => {
+      const standardToken = await getStandardAuthToken(
+        address,
+        apiKey.apiKeyPrivateKey,
+        {
+          apiKeyIndex: apiKey.apiKeyIndex,
+          accountIndex: apiKey.accountIndex,
+        }
+      )
+      const { token } = await readOnlyTokenManager.replaceRevoked(
+        standardToken,
+        {
+          address,
+          accountIndex: apiKey.accountIndex,
+          expirySeconds:
+            Math.floor(Date.now() / 1000) +
+            DEFAULT_READ_ONLY_TOKEN_LIFETIME_SECONDS,
+          scope: 'all',
+        }
+      )
+      readOnlyCreationBackoff.delete(flightKey)
+      return token.token
+    })()
+    readOnlyCreationInFlight.set(flightKey, attempt)
+    try {
+      return await attempt
+    } finally {
+      if (readOnlyCreationInFlight.get(flightKey) === attempt) {
+        readOnlyCreationInFlight.delete(flightKey)
+      }
     }
   }
 
-  /**
-   * Run an auth-gated read; if Lighter rejects the token (revoked server-side —
-   * invisible to `checkSetup`, since the read-only token is a client-only
-   * concern), evict the SDK-resolved credentials (stored read-only token and
-   * cached standard token) and retry once with freshly resolved ones. Only
-   * self-heals tokens the SDK itself resolved — a caller-supplied
-   * `lighterAuthToken`/`authToken` source is the caller's to fix.
-   */
   const retryOnRevoked = async <T>(
     opts: SDKRequestOptions | undefined,
     address: Address,
@@ -500,11 +540,10 @@ export const createLighterProvider = (
     } catch (err) {
       const sdkOwnsToken =
         opts?.lighterAuthToken === undefined && authTokenSource === undefined
-      if (!(err instanceof LighterAuthRejectedError) || !sdkOwnsToken) {
+      if (!(err instanceof LighterTokenRevokedError) || !sdkOwnsToken) {
         throw err
       }
-      await evictResolvedTokens(address)
-      const fresh = await resolveAuthToken(opts, address)
+      const fresh = await replaceRevokedReadOnlyToken(address, token)
       if (fresh === undefined || fresh === token) {
         throw err
       }
@@ -512,38 +551,6 @@ export const createLighterProvider = (
     }
   }
 
-  /**
-   * Degrade an auth-gated `getAccount` read to `undefined` when Lighter
-   * rejects an SDK-owned token even after `retryOnRevoked` re-resolved it —
-   * the signature of a stale local API key (the venue's slot was
-   * re-registered elsewhere). `getAccount` must resolve in that state so
-   * `apiKeyRegistered: false` can render the REGISTER_API_KEY gate, which is
-   * the only recovery. A caller-supplied token stays the caller's to fix, so
-   * its rejection propagates, as does every other error class.
-   */
-  const degradeOnAuthRejection = async <T>(
-    opts: SDKRequestOptions | undefined,
-    endpoint: string,
-    read: Promise<T>
-  ): Promise<T | undefined> => {
-    try {
-      return await read
-    } catch (err) {
-      const sdkOwnsToken =
-        opts?.lighterAuthToken === undefined && authTokenSource === undefined
-      if (err instanceof LighterAuthRejectedError && sdkOwnsToken) {
-        console.warn(
-          `[lighter] ${endpoint} rejected the auth token after re-resolution; ` +
-            'degrading the read — the stored API key no longer matches the ' +
-            'registered key, and the REGISTER_API_KEY gate will surface it.',
-          err
-        )
-        return undefined
-      }
-      throw err
-    }
-  }
-
   const fetchAccountLimits = (
     client: LighterApiClient,
     accountIndex: number,
@@ -702,86 +709,46 @@ export const createLighterProvider = (
       opts?: SDKRequestOptions
     ): Promise<AccountResponse> {
       const client = apiClient(opts)
-      const [account, token] = await Promise.all([
-        fetchDetailedAccount(client, params.address),
-        resolveAuthToken(opts, params.address),
-      ])
-
-      const registry = getMarketRegistry(requireClient(), providerKey)
-      const assetRegistry = getAssetRegistry(requireClient(), providerKey)
-      // Shared promise: the referral read below awaits this instance's runtime
-      // metadata off the same `/providers` fetch — no second request.
-      const providersPromise = getProviders(requireClient())
-      // Shared promise: the registered-key read names the slot off the local
-      // record, and the config readout reports the record — one storage read.
-      const localKeyPromise = keyStore.get(params.address)
-      const [
-        { providers },
-        ,
-        ,
-        registeredKey,
-        limitsResult,
-        localKey,
-        storedReadOnlyToken,
-        appliedReferralCode,
-      ] = await Promise.all([
-        providersPromise,
-        registry.sync(),
-        assetRegistry.sync(),
-        // The local record names the only slot worth reading: no record means
-        // nothing to compare the registered key against, so the read is skipped.
-        localKeyPromise.then((key) =>
-          key === null
-            ? undefined
-            : fetchRegisteredApiKey(client, account.index, key.apiKeyIndex)
-        ),
-        // No token is a legitimate unauthenticated read → undefined → zero fee
-        // tier. A generic fetch error is NOT: it must propagate, never be
-        // coerced to a fabricated 0%/0% fee tier. One carve-out: a token the
-        // venue rejects even after re-resolution (stale local API key) degrades
-        // to undefined, so the REGISTER_API_KEY gate can render the recovery.
-        token === undefined
+      const accountPromise = fetchDetailedAccount(client, params.address)
+      const localKey = await keyStore.get(params.address)
+      const registeredKeyPromise =
+        localKey === null
           ? Promise.resolve(undefined)
-          : degradeOnAuthRejection(
-              opts,
-              '/api/v1/accountLimits',
-              retryOnRevoked(opts, params.address, token, (t) =>
-                fetchAccountLimits(client, account.index, t)
-              )
-            ),
-        localKeyPromise,
-        readOnlyTokenManager.get(params.address, account.index),
-        // The expected code is backend-owned runtime metadata on this
-        // instance's own provider descriptor (keyed by `providerKey`, so the
-        // RH instance never compares against mainnet attribution). Metadata
-        // without a code, or no token to authenticate the read → undefined →
-        // `referralPresent: false`. The read stays SDK-direct: the token only
-        // ever goes to Lighter, never to the LI.FI backend.
-        token === undefined
-          ? Promise.resolve(undefined)
-          : providersPromise.then((response) =>
-              response.providers.find((p) => p.key === providerKey)
-                ?.referralCode
-                ? degradeOnAuthRejection(
-                    opts,
-                    '/api/v1/referral/userReferrals',
-                    retryOnRevoked(opts, params.address, token, (t) =>
-                      fetchAppliedReferralCode(client, params.address, t)
-                    )
-                  )
-                : undefined
-            ),
+          : fetchRegisteredApiKey(
+              client,
+              localKey.accountIndex,
+              localKey.apiKeyIndex
+            )
+      const [account, registeredKey] = await Promise.all([
+        accountPromise,
+        registeredKeyPromise,
       ])
 
-      // REGISTER_API_KEY is satisfied only when the locally-held keypair
-      // matches the key registered on-chain at this slot — existence alone is
-      // insufficient (a stale/rotated local key can't sign valid auth tokens).
       const apiKeyRegistered =
         registeredKey !== undefined &&
         localKey !== null &&
         normalizeLighterPublicKey(localKey.apiKeyPublicKey) ===
           normalizeLighterPublicKey(registeredKey.public_key)
+      const token = apiKeyRegistered
+        ? await resolveAuthToken(opts, params.address, localKey)
+        : undefined
 
+      const registry = getMarketRegistry(requireClient(), providerKey)
+      const assetRegistry = getAssetRegistry(requireClient(), providerKey)
+      const [{ providers }, , , limitsResult, storedReadOnlyToken] =
+        await Promise.all([
+          getProviders(requireClient()),
+          registry.sync(),
+          assetRegistry.sync(),
+          token === undefined
+            ? Promise.resolve(undefined)
+            : retryOnRevoked(opts, params.address, token, (resolvedToken) =>
+                fetchAccountLimits(client, account.index, resolvedToken)
+              ),
+          apiKeyRegistered
+            ? readOnlyTokenManager.get(params.address, localKey.accountIndex)
+            : Promise.resolve(undefined),
+        ])
       const positions: Position[] = mapOpenPositions(account.positions, (id) =>
         toPerpsMarketDisplay(registry.require(String(id)))
       )
@@ -868,12 +835,10 @@ export const createLighterProvider = (
         readOnlyTokenApproved: storedReadOnlyToken !== undefined,
         readOnlyTokenExpiry: storedReadOnlyToken?.expiry,
         readOnlyTokenScope: storedReadOnlyToken?.scope,
-        // True only when the authenticated `used_code` equals the backend-owned
-        // code for this instance; `appliedReferralCode` is only ever fetched
-        // when that code exists.
         referralPresent:
-          appliedReferralCode !== undefined &&
-          appliedReferralCode === instanceMeta?.referralCode,
+          apiKeyRegistered &&
+          instanceMeta?.referralCode !== undefined &&
+          localKey?.appliedReferralCode === instanceMeta.referralCode,
       }
 
       return {

package/src/accountConfig.ts

@@ -104,10 +104,8 @@ function projectLighterDescriptor(
         satisfied: config.readOnlyTokenApproved,
       }
 
-    // `SET_REFERRAL` is satisfied when LI.FI's referral code is the one applied
-    // to the account — an SDK-direct read (`getAccount` → `referralPresent`),
-    // since the applied referral is a per-user, auth-gated read. Lighter referral
-    // is mutable, so an account on another integrator's code stays gateable.
+    // `SET_REFERRAL` persists its confirmed code beside the local API key.
+    // The account read compares that marker with this instance's runtime code.
     case ActionType.SET_REFERRAL:
       return {
         type: descriptor.type,

package/src/constants.ts

@@ -228,6 +228,13 @@ const LIGHTER_CODE_ACCOUNT_NOT_FOUND = 21100
  */
 const LIGHTER_INVALID_AUTH_CODE = 20013
 
+/**
+ * Lighter body `code` for a read-only auth token revoked at the venue.
+ *
+ * @internal
+ */
+const LIGHTER_TOKEN_REVOKED_CODE = 61006
+
 /**
  * Lighter body `code` values that mean success. Lighter is inconsistent per
  * endpoint: `/api/v1/account` returns `code: 200`, most others return `code: 0`.
@@ -251,4 +258,5 @@ export {
   LIGHTER_INVALID_AUTH_CODE,
   LIGHTER_MUTATION_SUCCESS_CODE,
   LIGHTER_SUCCESS_CODES,
+  LIGHTER_TOKEN_REVOKED_CODE,
 }

package/src/signers/LighterKeyStore.ts

@@ -1,5 +1,9 @@
-import { readValidatedRecord, type StorageAdapter } from '@lifi/perps-sdk'
-import type { LighterProviderKey } from '@lifi/perps-types'
+import {
+  PerpsError,
+  readValidatedRecord,
+  type StorageAdapter,
+} from '@lifi/perps-sdk'
+import { type LighterProviderKey, PerpsErrorCode } from '@lifi/perps-types'
 import type { Address } from 'viem'
 import { LIGHTER_PROVIDER_KEY } from '../constants.js'
 
@@ -30,6 +34,8 @@ export interface LighterApiKey {
   apiKeyPrivateKey: string
   /** Corresponding public key, registered via ChangePubKey. */
   apiKeyPublicKey: string
+  /** Referral code confirmed by the standard-token SET_REFERRAL action. */
+  appliedReferralCode?: string
 }
 
 const isLighterApiKeyOf =
@@ -44,6 +50,7 @@ const isLighterApiKeyOf =
       apiKeyIndex,
       apiKeyPrivateKey,
       apiKeyPublicKey,
+      appliedReferralCode,
     } = value as Record<string, unknown>
     return (
       providerKey === owner &&
@@ -54,7 +61,10 @@ const isLighterApiKeyOf =
       typeof apiKeyPrivateKey === 'string' &&
       apiKeyPrivateKey.length > 0 &&
       typeof apiKeyPublicKey === 'string' &&
-      apiKeyPublicKey.length > 0
+      apiKeyPublicKey.length > 0 &&
+      (appliedReferralCode === undefined ||
+        (typeof appliedReferralCode === 'string' &&
+          appliedReferralCode.length > 0))
     )
   }
 
@@ -140,6 +150,21 @@ export class LighterKeyStore {
     await this.storage.set(key, JSON.stringify(record))
   }
 
+  async markReferralApplied(
+    address: Address,
+    appliedReferralCode: string
+  ): Promise<void> {
+    const current = await this.get(address)
+    if (current === null) {
+      throw new PerpsError(
+        PerpsErrorCode.SDKError,
+        `Cannot persist the Lighter referral marker without an API key for ${address}`
+      )
+    }
+    const { providerKey: _providerKey, ...value } = current
+    await this.set(address, { ...value, appliedReferralCode })
+  }
+
   /**
    * Remove the persisted API key for an L1 address and clear its in-memory
    * cache entry.

package/src/signers/LighterReadOnlyTokenManager.ts

@@ -75,6 +75,7 @@ export type LighterTokenFetcher = (params: {
   expiry: number
   subAccountAccess: boolean
   scopes: string
+  fetchImpl?: typeof fetch
 }) => Promise<LighterCreateTokenResponse>
 
 /**
@@ -127,6 +128,7 @@ export type LighterTokenListFetcher = (params: {
   url: string
   authorization: string
   accountIndex: number
+  fetchImpl?: typeof fetch
 }) => Promise<LighterListTokensResponse>
 
 /**
@@ -139,6 +141,7 @@ export type LighterTokenRevokeFetcher = (params: {
   authorization: string
   tokenId: number
   accountIndex: number
+  fetchImpl?: typeof fetch
 }) => Promise<LighterRevokeTokenResponse>
 
 /**
@@ -165,6 +168,8 @@ export interface LighterReadOnlyTokenManagerOptions {
   listFetcher?: LighterTokenListFetcher
   /** Override the revoke POST. Defaults to a `fetch`-based implementation. */
   revokeFetcher?: LighterTokenRevokeFetcher
+  /** Transport used by the default endpoint fetchers. Defaults to `fetch`. */
+  fetchImpl?: typeof fetch
   /** Clock injection for testing expiry logic. Defaults to `Date.now`. */
   now?: () => number
 }
@@ -259,6 +264,7 @@ export class LighterReadOnlyTokenManager {
   private readonly fetcher: LighterTokenFetcher
   private readonly listFetcher: LighterTokenListFetcher
   private readonly revokeFetcher: LighterTokenRevokeFetcher
+  private readonly fetchImpl: typeof fetch | undefined
   private readonly now: () => number
   private readonly cache = new Map<string, LighterReadOnlyToken>()
 
@@ -270,6 +276,7 @@ export class LighterReadOnlyTokenManager {
     this.listFetcher = options.listFetcher ?? defaultLighterTokenListFetcher
     this.revokeFetcher =
       options.revokeFetcher ?? defaultLighterTokenRevokeFetcher
+    this.fetchImpl = options.fetchImpl
     this.now = options.now ?? (() => Date.now())
   }
 
@@ -398,10 +405,31 @@ export class LighterReadOnlyTokenManager {
     authorization: string,
     inputs: ApproveReadOnlyTokenInputs
   ): Promise<ApproveReadOnlyTokenResult> {
-    const { address, accountIndex, expirySeconds, scope } = inputs
+    await this.revokeStaleOwnTokens(
+      authorization,
+      inputs.address,
+      inputs.accountIndex
+    )
+    return this.createAndPersist(authorization, inputs)
+  }
 
-    await this.revokeStaleOwnTokens(authorization, address, accountIndex)
+  /**
+   * Replace a token that Lighter explicitly reports as revoked.
+   * The venue already revoked the row, so this path skips registry cleanup.
+   */
+  async replaceRevoked(
+    authorization: string,
+    inputs: ApproveReadOnlyTokenInputs
+  ): Promise<ApproveReadOnlyTokenResult> {
+    await this.remove(inputs.address, inputs.accountIndex)
+    return this.createAndPersist(authorization, inputs)
+  }
 
+  private async createAndPersist(
+    authorization: string,
+    inputs: ApproveReadOnlyTokenInputs
+  ): Promise<ApproveReadOnlyTokenResult> {
+    const { address, accountIndex, expirySeconds, scope } = inputs
     const response = await this.fetcher({
       url: `${this.lighterApiUrl}/api/v1/tokens/create`,
       authorization,
@@ -410,6 +438,7 @@ export class LighterReadOnlyTokenManager {
       expiry: expirySeconds,
       subAccountAccess: scope === 'all',
       scopes: 'read.*',
+      fetchImpl: this.fetchImpl,
     })
 
     const token: LighterReadOnlyToken = {
@@ -457,6 +486,7 @@ export class LighterReadOnlyTokenManager {
         url: `${this.lighterApiUrl}/api/v1/tokens`,
         authorization,
         accountIndex,
+        fetchImpl: this.fetchImpl,
       })
       const nowSeconds = Math.floor(this.now() / 1000)
       const stale = rows
@@ -476,6 +506,7 @@ export class LighterReadOnlyTokenManager {
             authorization,
             tokenId: row.token_id,
             accountIndex,
+            fetchImpl: this.fetchImpl,
           })
         } catch (err) {
           console.warn(
@@ -508,6 +539,7 @@ export const defaultLighterTokenFetcher: LighterTokenFetcher = async ({
   expiry,
   subAccountAccess,
   scopes,
+  fetchImpl,
 }) => {
   const form = new FormData()
   form.set('name', name)
@@ -516,7 +548,7 @@ export const defaultLighterTokenFetcher: LighterTokenFetcher = async ({
   form.set('sub_account_access', String(subAccountAccess))
   form.set('scopes', scopes)
 
-  const response = await fetch(url, {
+  const response = await (fetchImpl ?? fetch)(url, {
     method: 'POST',
     headers: { authorization },
     body: form,
@@ -544,10 +576,11 @@ export const defaultLighterTokenListFetcher: LighterTokenListFetcher = async ({
   url,
   authorization,
   accountIndex,
+  fetchImpl,
 }) => {
   const query = new URLSearchParams({ account_index: String(accountIndex) })
 
-  const response = await fetch(`${url}?${query.toString()}`, {
+  const response = await (fetchImpl ?? fetch)(`${url}?${query.toString()}`, {
     headers: { authorization },
   })
 
@@ -570,13 +603,13 @@ export const defaultLighterTokenListFetcher: LighterTokenListFetcher = async ({
  * @internal
  */
 export const defaultLighterTokenRevokeFetcher: LighterTokenRevokeFetcher =
-  async ({ url, authorization, tokenId, accountIndex }) => {
+  async ({ url, authorization, tokenId, accountIndex, fetchImpl }) => {
     const form = new URLSearchParams({
       token_id: String(tokenId),
       account_index: String(accountIndex),
     })
 
-    const response = await fetch(url, {
+    const response = await (fetchImpl ?? fetch)(url, {
       method: 'POST',
       headers: {
         authorization,

package/src/signers/signActions.ts

@@ -304,11 +304,14 @@ async function signRegisterApiKey(
     l1Signature
   )
 
+  // The referral marker belongs to the L1 address, not to the key slot.
+  const previousKey = await deps.keyStore.get(address)
   await deps.keyStore.set(address, {
     accountIndex,
     apiKeyIndex,
     apiKeyPrivateKey: keypair.privateKey,
     apiKeyPublicKey: keypair.publicKey,
+    appliedReferralCode: previousKey?.appliedReferralCode,
   })
 
   return {
@@ -461,12 +464,15 @@ async function executeTokenAuthMutation(
     accountIndex: apiKey.accountIndex,
   })
 
+  let appliedReferralCode: string | undefined
   if (step.wasmSignParams.kind === 'referralUse') {
     const { referral_code } = step.wasmSignParams as { referral_code?: string }
+    appliedReferralCode = referral_code
     if (
       typeof referral_code === 'string' &&
       (await isReferralAlreadyApplied(deps, address, authToken, referral_code))
     ) {
+      await deps.keyStore.markReferralApplied(address, referral_code)
       return
     }
   }
@@ -485,6 +491,10 @@ async function executeTokenAuthMutation(
       `Lighter ${step.action} rejected (code ${code ?? status})${suffix}`
     )
   }
+
+  if (appliedReferralCode !== undefined) {
+    await deps.keyStore.markReferralApplied(address, appliedReferralCode)
+  }
 }
 
 /**