@lifi/perps-sdk-provider-lighter 19.0.0 → 21.0.0

package/dist/types/utils/apiClient.d.ts

@@ -43,9 +43,12 @@ export interface LighterApiClientOptions {
  *
  * Auth-gated endpoints (accountLimits, accountActiveOrders, deposit/history,
  * withdraw/history, positionFunding, liquidations, transfer/history) take the
- * Lighter read-only token as the `auth` query parameter — NOT as an
- * `Authorization` header. This matches Lighter's OpenAPI spec and lets the
- * same call work browser-direct and from server-side proxies.
+ * Lighter read-only token in the `Authorization` header, which is the only
+ * auth channel Lighter's OpenAPI spec declares. The header makes such a read
+ * CORS-preflighted; both Lighter hosts answer the `OPTIONS` probe with
+ * `Authorization` in `Access-Control-Allow-Headers` and
+ * `Access-Control-Max-Age: 86400`, so a browser sends one preflight per day
+ * per origin.
  *
  * Lighter signals rate limits through HTTP 429 or HTTP 405. This client never
  * retries such a response. It throws `RateLimitExceeded` and holds all network
@@ -72,11 +75,7 @@ export declare class LighterApiClient {
     private assertNotRateLimited;
     private buildUrl;
     get<T>(path: string, params?: ApiParams): Promise<T>;
-    /**
-     * Auth-gated GET. The token is appended as the `auth` query parameter (per
-     * Lighter's OpenAPI spec); the `Authorization` header is intentionally NOT
-     * used — Lighter rejects it.
-     */
+    /** Auth-gated GET carrying the Lighter token in the `Authorization` header. */
     getAuthed<T>(path: string, authToken: string, params?: ApiParams): Promise<T>;
     /**
      * GET that surfaces the raw `{status, body}` pair without throwing on
@@ -87,6 +86,7 @@ export declare class LighterApiClient {
         status: number;
         data: T;
     }>;
+    private sendGet;
     /**
      * Form-encoded POST to a Lighter mutation endpoint. Single-shot — never
      * retried, since these are money/state writes whose outcome is unknown on a

package/dist/types/utils/apiClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../src/utils/apiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EACV,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AAQxB,gBAAgB;AAChB,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;AAejE;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;CAAG;AAE3D;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;CAAG;AAU3D,gBAAgB;AAChB,eAAO,MAAM,sBAAsB,EAAE,mBAgBpC,CAAA;AAsBD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,gBAAgB;AAChB,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;gBAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB;IAqB9D;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIxE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAK5B,OAAO,CAAC,QAAQ;IAaV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D;;;;OAIG;IACG,SAAS,CAAC,CAAC,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAc,GACrB,OAAO,CAAC,CAAC,CAAC;IAqBb;;;;OAIG;IACG,aAAa,CAAC,CAAC,EACnB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;IAiBvC;;;;;OAKG;IACG,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;YAgBzB,UAAU;IAMxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;CAejB"}
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../src/utils/apiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EACV,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AAQxB,gBAAgB;AAChB,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;AAejE;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;CAAG;AAE3D;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;CAAG;AAwB3D,gBAAgB;AAChB,eAAO,MAAM,sBAAsB,EAAE,mBAgBpC,CAAA;AAsBD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,gBAAgB;AAChB,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,aAAa,CAAC,EAAE,oBAAoB,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;gBAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB;IAqB9D;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIxE,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,oBAAoB;IAK5B,OAAO,CAAC,QAAQ;IAaV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1D,+EAA+E;IACzE,SAAS,CAAC,CAAC,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAc,GACrB,OAAO,CAAC,CAAC,CAAC;IAoBb;;;;OAIG;IACG,aAAa,CAAC,CAAC,EACnB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,GACjB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;YAIzB,OAAO;IAqBrB;;;;;OAKG;IACG,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC;YAgBzB,UAAU;IAMxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;CAejB"}

package/dist/types/utils/fetchDetailedAccount.d.ts

@@ -1,11 +1,12 @@
 import type { Address } from 'viem';
-import type { LtDetailedAccount } from '../types/index.js';
+import type { LtAccount } from '../types/index.js';
 import type { LighterApiClient } from './apiClient.js';
 /**
  * Look up the Lighter account for an L1 address via `/api/v1/account`,
  * discriminating Lighter's account-not-found body code from generic failures.
+ * The returned account carries real arrays for `positions` and `assets`.
  *
  * @public
  */
-export declare const fetchDetailedAccount: (client: LighterApiClient, address: Address) => Promise<LtDetailedAccount>;
+export declare const fetchDetailedAccount: (client: LighterApiClient, address: Address) => Promise<LtAccount>;
 //# sourceMappingURL=fetchDetailedAccount.d.ts.map

package/dist/types/utils/fetchDetailedAccount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchDetailedAccount.d.ts","sourceRoot":"","sources":["../../../src/utils/fetchDetailedAccount.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,gBAAgB,EACxB,SAAS,OAAO,KACf,OAAO,CAAC,iBAAiB,CA6B3B,CAAA"}
+{"version":3,"file":"fetchDetailedAccount.d.ts","sourceRoot":"","sources":["../../../src/utils/fetchDetailedAccount.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,SAAS,EAAqB,MAAM,mBAAmB,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGtD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,gBAAgB,EACxB,SAAS,OAAO,KACf,OAAO,CAAC,SAAS,CAkCnB,CAAA"}

package/dist/types/utils/ohlcvInterval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ohlcvInterval.d.ts","sourceRoot":"","sources":["../../../src/utils/ohlcvInterval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAsBtD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,aAAa,KAAG,MAUrD,CAAA"}
+{"version":3,"file":"ohlcvInterval.d.ts","sourceRoot":"","sources":["../../../src/utils/ohlcvInterval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAqBtD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,aAAa,KAAG,MAUrD,CAAA"}

package/dist/types/utils/wireList.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Read a Lighter wire list member. Lighter serializes an empty list as JSON
+ * `null` rather than `[]`, so every list the SDK reads off a REST body passes
+ * through this at the response boundary and every mapper downstream works on a
+ * real array.
+ *
+ * @internal
+ */
+export declare const wireList: <T>(value: T[] | null | undefined) => T[];
+//# sourceMappingURL=wireList.d.ts.map

package/dist/types/utils/wireList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireList.d.ts","sourceRoot":"","sources":["../../../src/utils/wireList.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,SAAS,KAAG,CAAC,EAAiB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifi/perps-sdk-provider-lighter",
-  "version": "19.0.0",
+  "version": "21.0.0",
   "description": "Lighter provider plugin for @lifi/perps-sdk",
   "homepage": "https://github.com/lifinance/perps-sdk",
   "bugs": {
@@ -44,10 +44,10 @@
   "dependencies": {
     "big.js": "^7.0.1",
     "viem": "^2.55.18",
-    "@lifi/perps-types": "^12.0.0"
+    "@lifi/perps-types": "^12.0.1"
   },
   "peerDependencies": {
-    "@lifi/perps-sdk": "^11.0.0"
+    "@lifi/perps-sdk": "^12.1.0"
   },
   "publishConfig": {
     "access": "public"

package/src/LighterProvider.ts

@@ -86,15 +86,21 @@ import {
   lighterSignActions,
 } from './signers/signActions.js'
 import type {
+  LtAccount,
   LtAccountLimits,
+  LtDepositHistoryItem,
   LtDepositHistoryResponse,
-  LtDetailedAccount,
   LtDetailedAccountPosition,
+  LtLiquidation,
   LtLiquidationsResponse,
+  LtOrder,
   LtOrdersResponse,
+  LtPositionFunding,
   LtPositionFundingsResponse,
   LtTradesResponse,
+  LtTransfer,
   LtTransferHistoryResponse,
+  LtWithdrawHistoryItem,
   LtWithdrawHistoryResponse,
 } from './types/index.js'
 import { LT_MARGIN_MODE_CROSS, LT_MARGIN_MODE_ISOLATED } from './types/index.js'
@@ -132,6 +138,7 @@ import {
   fetchRegisteredApiKey,
   normalizeLighterPublicKey,
 } from './utils/registeredApiKey.js'
+import { wireList } from './utils/wireList.js'
 
 const ZERO_FEE_TIER = { maker: '0', taker: '0' }
 
@@ -560,19 +567,21 @@ export const createLighterProvider = (
       account_index: accountIndex,
     })
 
-  const fetchActiveOrdersForMarket = (
+  const fetchActiveOrdersForMarket = async (
     client: LighterApiClient,
     authToken: string,
     accountIndex: number,
     marketId: number
-  ): Promise<LtOrdersResponse> =>
-    client.getAuthed<LtOrdersResponse>(
+  ): Promise<LtOrdersResponse & { orders: LtOrder[] }> => {
+    const response = await client.getAuthed<LtOrdersResponse>(
       '/api/v1/accountActiveOrders',
       authToken,
       { account_index: accountIndex, market_id: marketId }
     )
+    return { ...response, orders: wireList(response.orders) }
+  }
 
-  const deriveOrderBearingMarketIds = (account: LtDetailedAccount): number[] =>
+  const deriveOrderBearingMarketIds = (account: LtAccount): number[] =>
     account.positions
       .filter((p) => orderCountFor(p) > 0)
       .map((p) => p.market_id)
@@ -585,11 +594,15 @@ export const createLighterProvider = (
     requested: ActivityType[] | undefined,
     inputCursor: LighterActivityCursor | undefined
   ): Promise<{
-    deposits: LtDepositHistoryResponse
-    withdraws: LtWithdrawHistoryResponse
-    fundings: LtPositionFundingsResponse
-    liquidations: LtLiquidationsResponse
-    transfers: LtTransferHistoryResponse
+    deposits: LtDepositHistoryResponse & { deposits: LtDepositHistoryItem[] }
+    withdraws: LtWithdrawHistoryResponse & {
+      withdraws: LtWithdrawHistoryItem[]
+    }
+    fundings: LtPositionFundingsResponse & {
+      position_fundings: LtPositionFunding[]
+    }
+    liquidations: LtLiquidationsResponse & { liquidations: LtLiquidation[] }
+    transfers: LtTransferHistoryResponse & { transfers: LtTransfer[] }
   }> => {
     const wantsType = (t: ActivityType): boolean =>
       requested === undefined || requested.includes(t)
@@ -643,7 +656,6 @@ export const createLighterProvider = (
               token,
               {
                 account_index: accountIndex,
-                market_id: LIGHTER_ALL_MARKETS_WILDCARD,
                 limit: LIGHTER_HISTORY_PAGE_SIZE,
                 ...cursorParam('fundings'),
               }
@@ -670,7 +682,30 @@ export const createLighterProvider = (
           : Promise.resolve(empty({ code: 0, transfers: [] })),
       ])
 
-    return { deposits, withdraws, fundings, liquidations, transfers }
+    return {
+      deposits: {
+        ...deposits,
+        deposits: wireList<LtDepositHistoryItem>(deposits.deposits),
+      },
+      withdraws: {
+        ...withdraws,
+        withdraws: wireList<LtWithdrawHistoryItem>(withdraws.withdraws),
+      },
+      fundings: {
+        ...fundings,
+        position_fundings: wireList<LtPositionFunding>(
+          fundings.position_fundings
+        ),
+      },
+      liquidations: {
+        ...liquidations,
+        liquidations: wireList<LtLiquidation>(liquidations.liquidations),
+      },
+      transfers: {
+        ...transfers,
+        transfers: wireList<LtTransfer>(transfers.transfers),
+      },
+    }
   }
 
   const resolveAccountExists = async (
@@ -924,7 +959,7 @@ export const createLighterProvider = (
       if (params.market.categoryId === LIGHTER_SPOT_CATEGORY_ID) {
         return undefined
       }
-      let account: LtDetailedAccount
+      let account: LtAccount
       try {
         account = await fetchDetailedAccount(apiClient(opts), params.address)
       } catch (err) {
@@ -1117,7 +1152,9 @@ export const createLighterProvider = (
           limit: INACTIVE_ORDERS_LOOKUP_LIMIT,
         })
       )
-      const hit = inactive.orders.find(predicate as (o: unknown) => boolean)
+      const hit = wireList(inactive.orders).find(
+        predicate as (o: unknown) => boolean
+      )
       if (hit !== undefined) {
         return mapOrderDetail(hit, registry.require(String(hit.market_index)))
       }
@@ -1170,7 +1207,7 @@ export const createLighterProvider = (
       // drops only its own row instead of rejecting the whole page. The
       // registry warns once per unresolved id. A delisted market still
       // resolves, so its rows stay.
-      const items = response.trades.flatMap((t): Fill[] => {
+      const items = wireList(response.trades).flatMap((t): Fill[] => {
         const market = registry.get(String(t.market_id))
         if (market === undefined) {
           return []
@@ -1297,7 +1334,7 @@ export const createLighterProvider = (
           }
           const price = toBigOrNull(l.trade.price)
           const size = toBigOrNull(l.trade.size)
-          const marginMode = l.info.positions.find(
+          const marginMode = wireList(l.info.positions).find(
             (p) => p.market_id === l.market_id
           )?.margin_mode
           // Lighter reports the margin mode as an integer, so the venue

package/src/constants.ts

@@ -204,7 +204,7 @@ export const LIGHTER_BASE_FEE_TIER: FeeTier = { maker: '0', taker: '0' }
 
 /**
  * Wildcard `market_id` accepted by Lighter's per-market account endpoints to
- * indicate "every market". Used on `accountInactiveOrders`, `positionFunding`,
+ * indicate "every market". Used on `accountInactiveOrders` and
  * `liquidations`.
  *
  * @internal

package/src/signers/LighterReadOnlyTokenManager.ts

@@ -218,9 +218,12 @@ const isLighterReadOnlyToken = (
   >
   // Accept a record that carries no `tokenId`: rejecting one would discard a
   // usable token and force an unnecessary replacement.
+  // A token carrying a line break cannot go in the `Authorization` header, so
+  // reject the record and let the manager create a replacement.
   return (
     typeof token === 'string' &&
     token.length > 0 &&
+    !/[\r\n]/.test(token) &&
     typeof expiry === 'number' &&
     Number.isFinite(expiry) &&
     (scope === 'single' || scope === 'all') &&

package/src/types/account.ts

@@ -1,5 +1,6 @@
 // Account / balance shapes returned by Lighter's `/api/v1/account` and
 // `/api/v1/accountLimits` endpoints.
+// Lighter serializes an empty list as JSON `null`, so list members are nullable.
 
 /**
  * Per-market position row returned by Lighter's account endpoints.
@@ -35,6 +36,8 @@ export type LtAccountPosition = {
   margin_mode: number
   allocated_margin: string
   total_discount: string
+  /** Lighter bit flags recording which margin settings the account set itself. */
+  margin_set_flag?: number
 }
 
 /**
@@ -126,8 +129,8 @@ export interface LtDetailedAccount {
   account_index: number
   name: string
   description: string
-  positions: LtDetailedAccountPosition[]
-  assets: LtAccountAsset[]
+  positions: LtDetailedAccountPosition[] | null
+  assets: LtAccountAsset[] | null
   total_asset_value: string
   cross_asset_value: string
   /** Initial margin locked by cross positions; isolated positions carry
@@ -136,6 +139,17 @@ export interface LtDetailedAccount {
   approved_integrators?: LtApprovedIntegrator[]
 }
 
+/**
+ * A detailed account whose wire lists `fetchDetailedAccount` has normalized to
+ * real arrays. Every SDK read of an account works on this shape.
+ *
+ * @public
+ */
+export type LtAccount = LtDetailedAccount & {
+  positions: LtDetailedAccountPosition[]
+  assets: LtAccountAsset[]
+}
+
 /**
  * Response envelope for a detailed-account lookup. `code` is Lighter's
  * endpoint result code and `total` is the number of account rows returned.
@@ -145,7 +159,7 @@ export interface LtDetailedAccount {
 export interface LtDetailedAccountsResponse {
   code: number
   total: number
-  accounts: LtDetailedAccount[]
+  accounts: LtDetailedAccount[] | null
 }
 
 /**

package/src/types/activity.ts

@@ -1,5 +1,6 @@
 // Activity history shapes returned by Lighter's REST API
 // (deposits, withdrawals, funding payments, liquidations, transfers).
+// Lighter serializes an empty list as JSON `null`, so list members are nullable.
 
 import type { LtAccountPosition } from './account.js'
 
@@ -27,7 +28,7 @@ export interface LtDepositHistoryItem {
  */
 export interface LtDepositHistoryResponse {
   code: number
-  deposits: LtDepositHistoryItem[]
+  deposits: LtDepositHistoryItem[] | null
   cursor?: string
 }
 
@@ -56,7 +57,7 @@ export interface LtWithdrawHistoryItem {
  */
 export interface LtWithdrawHistoryResponse {
   code: number
-  withdraws: LtWithdrawHistoryItem[]
+  withdraws: LtWithdrawHistoryItem[] | null
   cursor?: string
 }
 
@@ -80,6 +81,8 @@ export interface LtPositionFunding {
   rate: string
   position_size: string
   position_side: string
+  /** Funding-fee discount Lighter applied to `change`, as a decimal string. */
+  discount?: string
 }
 
 /**
@@ -90,7 +93,7 @@ export interface LtPositionFunding {
  */
 export interface LtPositionFundingsResponse {
   code: number
-  position_fundings: LtPositionFunding[]
+  position_fundings: LtPositionFunding[] | null
   next_cursor?: string
 }
 
@@ -142,7 +145,7 @@ export type LtLiquidationPosition = Pick<
  * @public
  */
 export interface LtLiquidationInfo {
-  positions: LtLiquidationPosition[]
+  positions: LtLiquidationPosition[] | null
   risk_info_before: {
     // Lighter's OpenAPI does not require this member, so an account without
     // cross exposure may omit it.
@@ -176,7 +179,7 @@ export interface LtLiquidation {
  */
 export interface LtLiquidationsResponse {
   code: number
-  liquidations: LtLiquidation[]
+  liquidations: LtLiquidation[] | null
   next_cursor?: string
 }
 
@@ -212,6 +215,6 @@ export interface LtTransfer {
  */
 export interface LtTransferHistoryResponse {
   code: number
-  transfers: LtTransfer[]
+  transfers: LtTransfer[] | null
   cursor?: string
 }

package/src/types/fill.ts

@@ -1,4 +1,5 @@
 // Trade (fill) shapes returned by Lighter's `/api/v1/trades` endpoint.
+// Lighter serializes an empty list as JSON `null`, so list members are nullable.
 
 /**
  * Public trade/fill row returned by Lighter's `/api/v1/trades` endpoint.
@@ -54,6 +55,10 @@ export type LtTrade = {
   // older trade rows that predate the field.
   taker_initial_margin_fraction_before?: number
   maker_initial_margin_fraction_before?: number
+  /** Version of the resting ask order the trade matched against. */
+  ask_order_version?: number
+  /** Version of the resting bid order the trade matched against. */
+  bid_order_version?: number
 }
 
 /**
@@ -65,5 +70,5 @@ export type LtTrade = {
 export interface LtTradesResponse {
   code: number
   next_cursor: string
-  trades: LtTrade[]
+  trades: LtTrade[] | null
 }

package/src/types/order.ts

@@ -1,4 +1,5 @@
 // Order shapes returned by Lighter's REST API.
+// Lighter serializes an empty list as JSON `null`, so list members are nullable.
 
 /**
  * Order payload returned by Lighter's REST API. Amounts and prices are decimal
@@ -46,6 +47,8 @@ export type LtOrder = {
   timestamp: number
   created_at: number
   updated_at: number
+  /** Lighter bit flags recording the order's wire options. */
+  order_flags?: number
   /**
    * Unix timestamp in microseconds. Lighter documents no unit, and its public
    * trade rows report this member in microseconds while the sibling
@@ -63,7 +66,7 @@ export type LtOrder = {
 export interface LtOrdersResponse {
   code: number
   next_cursor: string
-  orders: LtOrder[]
+  orders: LtOrder[] | null
 }
 
 /**

package/src/utils/apiClient.ts

@@ -48,6 +48,20 @@ const isLighterAuthRejection = (status: number, data: unknown): boolean =>
 const isLighterTokenRevoked = (data: unknown): boolean =>
   lighterBodyErrorCode(data) === LIGHTER_TOKEN_REVOKED_CODE
 
+/**
+ * A CR or LF in a token would split the request when it reaches a
+ * `fetchImpl` that does not validate header values itself.
+ */
+const assertHeaderSafe = (authToken: string): string => {
+  if (/[\r\n]/.test(authToken)) {
+    throw new PerpsError(
+      PerpsErrorCode.ValidationError,
+      'Lighter auth token carries a line break and cannot go in a header'
+    )
+  }
+  return authToken
+}
+
 /** @internal */
 export const LIGHTER_RETRY_DEFAULTS: ResolvedRetryPolicy = {
   enabled: true,
@@ -115,9 +129,12 @@ export interface LighterApiClientOptions {
  *
  * Auth-gated endpoints (accountLimits, accountActiveOrders, deposit/history,
  * withdraw/history, positionFunding, liquidations, transfer/history) take the
- * Lighter read-only token as the `auth` query parameter — NOT as an
- * `Authorization` header. This matches Lighter's OpenAPI spec and lets the
- * same call work browser-direct and from server-side proxies.
+ * Lighter read-only token in the `Authorization` header, which is the only
+ * auth channel Lighter's OpenAPI spec declares. The header makes such a read
+ * CORS-preflighted; both Lighter hosts answer the `OPTIONS` probe with
+ * `Authorization` in `Access-Control-Allow-Headers` and
+ * `Access-Control-Max-Age: 86400`, so a browser sends one preflight per day
+ * per origin.
  *
  * Lighter signals rate limits through HTTP 429 or HTTP 405. This client never
  * retries such a response. It throws `RateLimitExceeded` and holds all network
@@ -198,19 +215,14 @@ export class LighterApiClient {
     return this.getChecked<T>(path, params)
   }
 
-  /**
-   * Auth-gated GET. The token is appended as the `auth` query parameter (per
-   * Lighter's OpenAPI spec); the `Authorization` header is intentionally NOT
-   * used — Lighter rejects it.
-   */
+  /** Auth-gated GET carrying the Lighter token in the `Authorization` header. */
   async getAuthed<T>(
     path: string,
     authToken: string,
     params: ApiParams = {}
   ): Promise<T> {
-    const { status, data } = await this.getWithStatus<unknown>(path, {
-      ...params,
-      auth: authToken,
+    const { status, data } = await this.sendGet<unknown>(path, params, {
+      Authorization: assertHeaderSafe(authToken),
     })
     if (isLighterTokenRevoked(data)) {
       throw new LighterTokenRevokedError(
@@ -236,12 +248,20 @@ export class LighterApiClient {
   async getWithStatus<T>(
     path: string,
     params?: ApiParams
+  ): Promise<{ status: number; data: T }> {
+    return this.sendGet<T>(path, params)
+  }
+
+  private async sendGet<T>(
+    path: string,
+    params?: ApiParams,
+    headers?: Record<string, string>
   ): Promise<{ status: number; data: T }> {
     this.assertRequestAllowed()
     const url = this.buildUrl(path, params)
     const response = await fetchWithRetry(
       url,
-      {},
+      headers === undefined ? {} : { headers },
       {
         policy: this.policy,
         fetchImpl: this.fetchWithHold,
@@ -279,7 +299,7 @@ export class LighterApiClient {
   }
 
   private async getChecked<T>(path: string, params?: ApiParams): Promise<T> {
-    const { status, data } = await this.getWithStatus<unknown>(path, params)
+    const { status, data } = await this.sendGet<unknown>(path, params)
     this.assertOk(path, status, data)
     return data as T
   }

package/src/utils/fetchDetailedAccount.ts

@@ -2,22 +2,24 @@ import { PerpsError } from '@lifi/perps-sdk'
 import { PerpsErrorCode } from '@lifi/perps-types'
 import type { Address } from 'viem'
 import { LIGHTER_CODE_ACCOUNT_NOT_FOUND } from '../constants.js'
-import type { LtDetailedAccount } from '../types/index.js'
+import type { LtAccount, LtDetailedAccount } from '../types/index.js'
 import type { LighterApiClient } from './apiClient.js'
+import { wireList } from './wireList.js'
 
 /**
  * Look up the Lighter account for an L1 address via `/api/v1/account`,
  * discriminating Lighter's account-not-found body code from generic failures.
+ * The returned account carries real arrays for `positions` and `assets`.
  *
  * @public
  */
 export const fetchDetailedAccount = async (
   client: LighterApiClient,
   address: Address
-): Promise<LtDetailedAccount> => {
+): Promise<LtAccount> => {
   const { status, data } = await client.getWithStatus<{
     code: number
-    accounts?: LtDetailedAccount[]
+    accounts?: LtDetailedAccount[] | null
     message?: string
   }>('/api/v1/account', { by: 'l1_address', value: address })
 
@@ -35,12 +37,17 @@ export const fetchDetailedAccount = async (
     )
   }
 
-  const accounts = data?.accounts
-  if (accounts === undefined || accounts.length === 0) {
+  const accounts = wireList(data?.accounts)
+  const account = accounts[0]
+  if (account === undefined) {
     throw new PerpsError(
       PerpsErrorCode.AccountNotFound,
       `No Lighter account found for address: ${address}`
     )
   }
-  return accounts[0]
+  return {
+    ...account,
+    positions: wireList(account.positions),
+    assets: wireList(account.assets),
+  }
 }

package/src/utils/ohlcvInterval.ts

@@ -6,7 +6,7 @@ import { PerpsErrorCode } from '@lifi/perps-types'
  * Map our `OhlcvInterval` literal to Lighter's `resolution` enum.
  *
  * Lighter exposes only the timeframes listed below. SDK intervals without a
- * direct match (3m, 2h, 8h, 3d, 1M) raise a validation error rather than
+ * direct match (3m, 2h, 8h, 3d, 1w, 1M) raise a validation error rather than
  * silently rounding — the caller picks a supported timeframe.
  */
 const LIGHTER_SUPPORTED_INTERVALS: Partial<Record<OhlcvInterval, string>> = {
@@ -18,7 +18,6 @@ const LIGHTER_SUPPORTED_INTERVALS: Partial<Record<OhlcvInterval, string>> = {
   '4h': '4h',
   '12h': '12h',
   '1d': '1d',
-  '1w': '1w',
 }
 
 /**

package/src/utils/wireList.ts

@@ -0,0 +1,9 @@
+/**
+ * Read a Lighter wire list member. Lighter serializes an empty list as JSON
+ * `null` rather than `[]`, so every list the SDK reads off a REST body passes
+ * through this at the response boundary and every mapper downstream works on a
+ * real array.
+ *
+ * @internal
+ */
+export const wireList = <T>(value: T[] | null | undefined): T[] => value ?? []