@lifi/perps-sdk-provider-lighter 3.0.0 → 4.0.1

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE/D,cAAc,oBAAoB,CAAA;AAClC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,YAAY,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,kCAAkC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE/D,cAAc,oBAAoB,CAAA;AAClC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,YAAY,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAChF,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,kCAAkC,CAAA"}

package/dist/types/signers/LighterSigner.d.ts

@@ -28,6 +28,11 @@ export interface ChangePubKeyResult extends LighterSignedBlob {
     messageToSign: string;
 }
 /** @public */
+export interface ApproveIntegratorResult extends LighterSignedBlob {
+    /** EIP-191 `L2ApproveIntegrator` L1 body the user's wallet must countersign to authorize the integrator approval. */
+    messageToSign: string;
+}
+/** @public */
 export interface ApiKeyPair {
     publicKey: string;
     privateKey: string;
@@ -52,8 +57,9 @@ export declare class LighterSigner {
      * `WasmBlobActionStep`. Returns the signed `{ txType, txInfo, txHash }`
      * triple the backend forwards to Lighter's `sendTx` endpoint.
      *
-     * For REGISTER_API_KEY use `signChangePubKey` instead — it returns an
-     * additional `messageToSign` the L1 wallet must countersign.
+     * For REGISTER_API_KEY use `signChangePubKey` and for APPROVE_INTEGRATOR
+     * use `signApproveIntegrator` instead — both return an additional
+     * `messageToSign` the L1 wallet must countersign.
      */
     sign(action: ActionType, wasmSignParams: Record<string, unknown>, context: LighterSignerContext): Promise<LighterSignedBlob>;
     /**
@@ -70,10 +76,19 @@ export declare class LighterSigner {
      */
     signChangePubKey(pubKeyHex: string, privateKey: string, nonce: number, apiKeyIndex: number, accountIndex: number, skipNonce?: 0 | 1): Promise<ChangePubKeyResult>;
     /**
-     * Step 2 of REGISTER_API_KEY — inject the L1 signature produced by the
-     * user's Ethereum wallet into the ChangePubKey txInfo JSON. `L1Sig` is the
-     * only field in txInfo that depends on the L1 signature; txHash does NOT
-     * include it (so we do not recompute it).
+     * Sign an APPROVE_INTEGRATOR action with the stored API key and return the
+     * signed blob alongside the EIP-191 `L2ApproveIntegrator` L1 message the
+     * user's Ethereum wallet must countersign. Unlike {@link sign}, this exposes
+     * `messageToSign`: Lighter requires `L1Sig` (injected via
+     * {@link embedL1Signature} before submission) when the integrator account
+     * belongs to a different L1 address with non-zero fee caps.
+     */
+    signApproveIntegrator(wasmSignParams: Record<string, unknown>, context: LighterSignerContext): Promise<ApproveIntegratorResult>;
+    /**
+     * Inject the L1 signature produced by the user's Ethereum wallet into a
+     * signed txInfo JSON. `L1Sig` is the only field that depends on the L1
+     * signature; txHash does NOT include it (so we do not recompute it). Shared
+     * by the REGISTER_API_KEY (ChangePubKey) and APPROVE_INTEGRATOR flows.
      */
     embedL1Signature(txInfo: string, l1Signature: string): string;
     /**

package/dist/types/signers/LighterSigner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LighterSigner.d.ts","sourceRoot":"","sources":["../../../src/signers/LighterSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAQ9C,OAAO,EAEL,KAAK,sBAAsB,EAG5B,MAAM,iBAAiB,CAAA;AAOxB,cAAc;AACd,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;IACxB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,cAAc;AACd,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,cAAc;AACd,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,cAAc;AACd,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,cAAc;AACd,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAkCD,cAAc;AACd,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;gBAE1C,MAAM,GAAE,mBAAwB;IAUtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC;IAY3C;;;;;;;;OAQG;IACG,IAAI,CACR,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;IAa7B;;;;;;;;;;;OAWG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,CAAC,GAAG,CAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAsC9B;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAa7D;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;YAiBJ,YAAY;YAOZ,YAAY;IAmB1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;CA+MjB"}
+{"version":3,"file":"LighterSigner.d.ts","sourceRoot":"","sources":["../../../src/signers/LighterSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAQ9C,OAAO,EAEL,KAAK,sBAAsB,EAG5B,MAAM,iBAAiB,CAAA;AAOxB,cAAc;AACd,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;IACxB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,cAAc;AACd,MAAM,WAAW,mBAAoB,SAAQ,sBAAsB;IACjE,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,cAAc;AACd,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,cAAc;AACd,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,cAAc;AACd,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,qHAAqH;IACrH,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,cAAc;AACd,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAkCD,cAAc;AACd,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAoB;gBAE1C,MAAM,GAAE,mBAAwB;IAUtC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC;IAY3C;;;;;;;;;OASG;IACG,IAAI,CACR,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;;;;;;OAWG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,CAAC,GAAG,CAAK,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAsC9B;;;;;;;OAOG;IACG,qBAAqB,CACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC;IA8BnC;;;;;OAKG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM;IAa7D;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,MAAM,CAAC;YAiBJ,YAAY;YAOZ,YAAY;IAmB1B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;CA+MjB"}

package/dist/types/signers/signActions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signActions.d.ts","sourceRoot":"","sources":["../../../src/signers/signActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAA8B,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOnC,OAAO,KAAK,EAAa,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,KAAK,EAAiB,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB;;qCAEiC;IACjC,SAAS,EAAE,gBAAgB,CAAA;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACvD;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EAAE,EAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAClC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAcrC;AAoND;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,eAAe,EAAE,EACxB,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAClC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA6ElC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,EAAE,EACnB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,kBAAkB,GACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsB7B"}
+{"version":3,"file":"signActions.d.ts","sourceRoot":"","sources":["../../../src/signers/signActions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAA8B,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOnC,OAAO,KAAK,EAAa,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,KAAK,EAAiB,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB;;qCAEiC;IACjC,SAAS,EAAE,gBAAgB,CAAA;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACvD;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EAAE,EAC3B,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAClC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAgBrC;AA2QD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,eAAe,EAAE,EACxB,GAAG,EAAE,kBAAkB,GAAG,SAAS,GAClC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA6ElC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,EAAE,EACnB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,kBAAkB,GACvB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsB7B"}

package/dist/types/signers/wasmLoader.d.ts

@@ -105,9 +105,13 @@ export interface LighterWasmExports {
      * 10 args: integratorAccountIndex, maxPerpsTakerFee, maxPerpsMakerFee,
      * maxSpotTakerFee, maxSpotMakerFee, approvalExpiry, skipNonce, then the
      * trailing three. Fees are uint32 ppm of `FeeTick` (1_000_000); a non-nil
-     * fee requires a non-nil integrator index.
+     * fee requires a non-nil integrator index. `messageToSign` is the EIP-191
+     * `L2ApproveIntegrator` L1 body the user's wallet must countersign — the
+     * venue rejects the tx without the resulting `L1Sig`.
      */
-    SignApproveIntegrator: (...args: unknown[]) => SignResult;
+    SignApproveIntegrator: (...args: unknown[]) => SignResult & {
+        messageToSign?: string;
+    };
     /**
      * 5 args: accountTradingMode (0 = Classic/Simple, 1 = Unified), skipNonce,
      * then the trailing three. `accountTradingMode` is validated to {0, 1} by

package/dist/types/signers/wasmLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasmLoader.d.ts","sourceRoot":"","sources":["../../../src/signers/wasmLoader.ts"],"names":[],"mappings":"AAkDA,cAAc;AACd,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC5B,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,cAAc;AACd,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,YAAY,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E;;;;;OAKG;IACH,eAAe,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB,UAAU,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD,2EAA2E;IAC3E,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAChD,iFAAiF;IACjF,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAChD;;;OAGG;IACH,kBAAkB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACtD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD;;;OAGG;IACH,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACpD;;;;;OAKG;IACH,qBAAqB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACzD;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAC3D;;;;OAIG;IACH,4BAA4B,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;CACjE;AAED,gBAAgB;AAChB,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAyFD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAK7B;AAmED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}
+{"version":3,"file":"wasmLoader.d.ts","sourceRoot":"","sources":["../../../src/signers/wasmLoader.ts"],"names":[],"mappings":"AAkDA,cAAc;AACd,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC5B,oDAAoD;IACpD,aAAa,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,cAAc;AACd,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;IACD,YAAY,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9E;;;;;OAKG;IACH,eAAe,EAAE,CACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,KACjB,UAAU,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD,2EAA2E;IAC3E,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD;;;OAGG;IACH,mBAAmB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACvD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAChD,iFAAiF;IACjF,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAChD;;;OAGG;IACH,kBAAkB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACtD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACnD;;;OAGG;IACH,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CACrB,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,UAAU,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;IAC3D;;;;OAIG;IACH,4BAA4B,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,UAAU,CAAA;CACjE;AAED,gBAAgB;AAChB,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAyFD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAK7B;AAmED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/types/websocket/LighterWsProvider.d.ts

@@ -2,14 +2,20 @@ import { type PerpsSDKClient, type ProviderGetQuoteParams, type QuoteListener, W
 import type { Subscription } from '@lifi/perps-types';
 import type { Address } from 'viem';
 /**
- * Creates a fresh Lighter auth token for the given L1 address, or returns
- * `undefined` if no API key is registered. Called both on initial subscribe
- * and on every reconnect, so it must always return a token valid for at
- * least the next few minutes.
+ * Resolves a Lighter auth token for the given L1 address, or `undefined` when
+ * no source can produce one. Called on the initial subscribe and again on
+ * every reconnect, so it must return a token still valid a few minutes out.
+ *
+ * The default resolver — the co-registered `lighterProvider` plugin's
+ * `resolveAuthToken` — satisfies that: it never yields an expired token.
+ * Stored read-only tokens past expiry are filtered out and otherwise carry a
+ * ~10-year lifetime; near-expiry standard tokens are re-created within their
+ * renew buffer; and a server-rejected token self-heals on the next resolve. A
+ * supplied override owns its own freshness.
  *
  * @public
  */
-export type LighterAuthProvider = (address: Address) => Promise<string | undefined>;
+export type LighterAuthTokenResolver = (address: Address) => Promise<string | undefined>;
 interface SubState {
     /** Raw Lighter WS channel name (e.g. `order_book/5`, `account_all_orders/42`). */
     channel: string;
@@ -27,11 +33,12 @@ export interface LighterWsProviderOptions {
     /** REST base URL for `/api/v1/account` lookups. Defaults to mainnet. */
     restUrl?: string;
     /**
-     * Async function returning a Lighter auth token for an address. Required
-     * for authenticated channels (orderUpdates, positions). Without it those
-     * subscriptions will throw at subscribe time.
+     * Override for auth-token resolution on authenticated channels
+     * (orderUpdates, positions). Defaults to the co-registered `lighterProvider`
+     * plugin's `resolveAuthToken`; supply this only for a standalone WS client
+     * with no Lighter REST plugin on the same {@link PerpsSDKClient}.
      */
-    authProvider?: LighterAuthProvider;
+    resolveAuthToken?: LighterAuthTokenResolver;
 }
 /**
  * Lighter realtime WS provider (extends {@link WsProviderBase}): subscribes to
@@ -42,7 +49,7 @@ export interface LighterWsProviderOptions {
  */
 export declare class LighterWsProvider extends WsProviderBase<SubState> {
     private readonly api;
-    private readonly authProvider;
+    private readonly resolveAuthTokenOverride;
     private readonly client;
     private readonly orderbooks;
     private marketsContext;
@@ -56,6 +63,12 @@ export declare class LighterWsProvider extends WsProviderBase<SubState> {
     private readonly accountIndexCache;
     private readonly accountIndexPromises;
     constructor(wsUrl?: string, providerKey?: string, options?: LighterWsProviderOptions, client?: PerpsSDKClient);
+    /**
+     * Auth-token resolver for gated channels: the explicit `resolveAuthToken`
+     * override if supplied, else the co-registered Lighter plugin's
+     * `resolveAuthToken`. `undefined` when neither is available.
+     */
+    private authTokenResolver;
     subscribeQuote(params: ProviderGetQuoteParams, onQuote: QuoteListener): Promise<() => void>;
     protected openChannel(sub: Subscription): Promise<() => void>;
     protected onClose(): void;
@@ -84,13 +97,18 @@ export declare class LighterWsProvider extends WsProviderBase<SubState> {
     private marketIdFromChannel;
 }
 /**
- * `WsProviderFactory` constructor for Lighter — pass to
- * `new PerpsWsClient(client, { wsProviders: { lighter: lighterWsProvider({ authProvider }) } })`.
+ * `WsProviderFactory` constructor for Lighter — register with
+ * `new PerpsWsClient(client, { wsProviders: { lighter: lighterWsProvider() } })`.
+ *
+ * Bare construction is the default path: authenticated channels resolve their
+ * auth token through the `lighterProvider()` plugin co-registered on the same
+ * {@link PerpsSDKClient}, so no wiring is needed. Pass `resolveAuthToken` only
+ * as the exception — a standalone WS client with no Lighter REST plugin on
+ * that client.
  *
- * Closes over the per-instance options (auth provider, restUrl override) so
- * `PerpsWsClient` can call the returned factory with just
- * `({ provider, wsUrl, markets })` at subscribe time. `markets` is
- * unused — Lighter advertises a single venue, no sub-DEX filtering.
+ * Closes over the per-instance options (`resolveAuthToken` override, `restUrl`)
+ * so `PerpsWsClient` can call the returned factory with just
+ * `({ provider, wsUrl, client })` at subscribe time.
  *
  * @public
  */

package/dist/types/websocket/LighterWsProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LighterWsProvider.d.ts","sourceRoot":"","sources":["../../../src/websocket/LighterWsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAIlB,cAAc,EACd,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AA0EnC;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;AAEhC,UAAU,QAAQ;IAChB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAA;CACnB;AAkBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;CACnC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,QAAQ,CAAC;IAC7D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,cAAc,CAAoC;IAE1D;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2C;IAE9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IAErD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqC;gBAGxE,KAAK,GAAE,MAA+B,EACtC,WAAW,SAAY,EACvB,OAAO,GAAE,wBAA6B,EACtC,MAAM,CAAC,EAAE,cAAc;IAsBnB,cAAc,CAClB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,IAAI,CAAC;cAkBN,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;cA4ChD,OAAO,IAAI,IAAI;cAMlB,aAAa,CAAC,EAC5B,OAAO,EACP,SAAS,EACT,OAAO,GACR,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB3B,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM;YA2B5B,cAAc;YAsFd,mBAAmB;YAqBnB,iBAAiB;IAK/B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAqB1C,OAAO,CAAC,QAAQ;IAkFhB,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,sBAAsB;IAiC9B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,YAAY;IAwBpB,OAAO,CAAC,mBAAmB;CAc5B;AAoHD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC3B,UAAU,wBAAwB,KAAG,iBAEmB,CAAA"}
+{"version":3,"file":"LighterWsProvider.d.ts","sourceRoot":"","sources":["../../../src/websocket/LighterWsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAIlB,cAAc,EACd,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AA2EnC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;AAEhC,UAAU,QAAQ;IAChB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAA;CACnB;AAkBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;CAC5C;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,QAAQ,CAAC;IAC7D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAE5B;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,cAAc,CAAoC;IAE1D;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2C;IAE9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IAErD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqC;gBAGxE,KAAK,GAAE,MAA+B,EACtC,WAAW,SAAY,EACvB,OAAO,GAAE,wBAA6B,EACtC,MAAM,CAAC,EAAE,cAAc;IAsBzB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAWnB,cAAc,CAClB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,IAAI,CAAC;cAkBN,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;cA4ChD,OAAO,IAAI,IAAI;cAMlB,aAAa,CAAC,EAC5B,OAAO,EACP,SAAS,EACT,OAAO,GACR,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3B,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM;YA2B5B,cAAc;YAsFd,mBAAmB;YAqBnB,iBAAiB;IAK/B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAqB1C,OAAO,CAAC,QAAQ;IAkFhB,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,sBAAsB;IAiC9B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,YAAY;IAwBpB,OAAO,CAAC,mBAAmB;CAc5B;AAkID;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC3B,UAAU,wBAAwB,KAAG,iBAEmB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifi/perps-sdk-provider-lighter",
-  "version": "3.0.0",
+  "version": "4.0.1",
   "description": "Lighter provider plugin for @lifi/perps-sdk",
   "homepage": "https://github.com/lifinance/perps-sdk",
   "bugs": {
@@ -46,10 +46,10 @@
   "dependencies": {
     "big.js": "^7.0.1",
     "viem": "^2.48.8",
-    "@lifi/perps-types": "^2.0.0"
+    "@lifi/perps-types": "^2.0.1"
   },
   "peerDependencies": {
-    "@lifi/perps-sdk": "^3.0.0"
+    "@lifi/perps-sdk": "^3.1.1"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -30,7 +30,7 @@ export { Lighter, lighterProvider } from './LighterProvider.js'
 export * from './signers/index.js'
 export * from './types/index.js'
 export * from './utils/index.js'
-export type { LighterAuthProvider } from './websocket/LighterWsProvider.js'
+export type { LighterAuthTokenResolver } from './websocket/LighterWsProvider.js'
 export {
   LighterWsProvider,
   type LighterWsProviderOptions,

package/src/signers/LighterSigner.ts

@@ -49,6 +49,12 @@ export interface ChangePubKeyResult extends LighterSignedBlob {
   messageToSign: string
 }
 
+/** @public */
+export interface ApproveIntegratorResult extends LighterSignedBlob {
+  /** EIP-191 `L2ApproveIntegrator` L1 body the user's wallet must countersign to authorize the integrator approval. */
+  messageToSign: string
+}
+
 /** @public */
 export interface ApiKeyPair {
   publicKey: string
@@ -133,8 +139,9 @@ export class LighterSigner {
    * `WasmBlobActionStep`. Returns the signed `{ txType, txInfo, txHash }`
    * triple the backend forwards to Lighter's `sendTx` endpoint.
    *
-   * For REGISTER_API_KEY use `signChangePubKey` instead — it returns an
-   * additional `messageToSign` the L1 wallet must countersign.
+   * For REGISTER_API_KEY use `signChangePubKey` and for APPROVE_INTEGRATOR
+   * use `signApproveIntegrator` instead — both return an additional
+   * `messageToSign` the L1 wallet must countersign.
    */
   async sign(
     action: ActionType,
@@ -147,6 +154,12 @@ export class LighterSigner {
           'must be coordinated by the caller.'
       )
     }
+    if (action === ActionType.APPROVE_INTEGRATOR) {
+      throw new Error(
+        'Use signApproveIntegrator() for APPROVE_INTEGRATOR — sign() does ' +
+          'not collect the required L1 user wallet signature.'
+      )
+    }
     const wasm = await this.ensureLoaded()
     await this.ensureClient(context)
     const result = this.dispatch(wasm, action, wasmSignParams, context)
@@ -211,10 +224,51 @@ export class LighterSigner {
   }
 
   /**
-   * Step 2 of REGISTER_API_KEY — inject the L1 signature produced by the
-   * user's Ethereum wallet into the ChangePubKey txInfo JSON. `L1Sig` is the
-   * only field in txInfo that depends on the L1 signature; txHash does NOT
-   * include it (so we do not recompute it).
+   * Sign an APPROVE_INTEGRATOR action with the stored API key and return the
+   * signed blob alongside the EIP-191 `L2ApproveIntegrator` L1 message the
+   * user's Ethereum wallet must countersign. Unlike {@link sign}, this exposes
+   * `messageToSign`: Lighter requires `L1Sig` (injected via
+   * {@link embedL1Signature} before submission) when the integrator account
+   * belongs to a different L1 address with non-zero fee caps.
+   */
+  async signApproveIntegrator(
+    wasmSignParams: Record<string, unknown>,
+    context: LighterSignerContext
+  ): Promise<ApproveIntegratorResult> {
+    const wasm = await this.ensureLoaded()
+    await this.ensureClient(context)
+    const result = this.dispatch(
+      wasm,
+      ActionType.APPROVE_INTEGRATOR,
+      wasmSignParams,
+      context
+    )
+    if (result.error) {
+      throw new Error(`Lighter SignApproveIntegrator failed: ${result.error}`)
+    }
+    if (
+      result.txType === undefined ||
+      result.txInfo === undefined ||
+      result.txHash === undefined ||
+      !result.messageToSign
+    ) {
+      throw new Error(
+        'Lighter SignApproveIntegrator returned an incomplete result'
+      )
+    }
+    return {
+      txType: result.txType,
+      txInfo: result.txInfo,
+      txHash: result.txHash,
+      messageToSign: result.messageToSign,
+    }
+  }
+
+  /**
+   * Inject the L1 signature produced by the user's Ethereum wallet into a
+   * signed txInfo JSON. `L1Sig` is the only field that depends on the L1
+   * signature; txHash does NOT include it (so we do not recompute it). Shared
+   * by the REGISTER_API_KEY (ChangePubKey) and APPROVE_INTEGRATOR flows.
    */
   embedL1Signature(txInfo: string, l1Signature: string): string {
     let parsed: Record<string, unknown>
@@ -222,7 +276,7 @@ export class LighterSigner {
       parsed = JSON.parse(txInfo) as Record<string, unknown>
     } catch (err) {
       throw new Error(
-        `Failed to parse ChangePubKey txInfo as JSON: ${(err as Error).message}`
+        `Failed to parse signed txInfo as JSON: ${(err as Error).message}`
       )
     }
     parsed.L1Sig = l1Signature
@@ -291,7 +345,7 @@ export class LighterSigner {
     action: ActionType,
     p: Record<string, unknown>,
     ctx: LighterSignerContext
-  ): SignResult {
+  ): SignResult & { messageToSign?: string } {
     const nonce = numberField(p, 'nonce')
     switch (action) {
       case ActionType.PLACE_ORDER:

package/src/signers/signActions.ts

@@ -81,6 +81,8 @@ export async function signWasmBlobActions(
   for (const step of steps) {
     if (step.action === ActionType.REGISTER_API_KEY) {
       signed.push(await signRegisterApiKey(deps, address, step, ctx))
+    } else if (step.action === ActionType.APPROVE_INTEGRATOR) {
+      signed.push(await signApproveIntegrator(deps, address, step, ctx))
     } else if (
       TOKEN_AUTH_MUTATION_KINDS.has(step.wasmSignParams.kind as string)
     ) {
@@ -196,6 +198,61 @@ async function signRegisterApiKey(
   }
 }
 
+/**
+ * APPROVE_INTEGRATOR flow:
+ *   1. Load the user's stored API key (no keypair generation).
+ *   2. Wasm-sign the `L2ApproveIntegrator` blob with that key, obtaining the
+ *      EIP-191 L1 message the wallet must countersign.
+ *   3. Have the user's L1 Ethereum wallet sign that message.
+ *   4. Inject the L1 signature into the txInfo JSON as `L1Sig`.
+ *
+ * Requires the end-user's wallet in `ctx.userWallet`: Lighter rejects the tx
+ * without the user's `L1Sig` when the integrator account belongs to a
+ * different L1 address with non-zero fee caps.
+ */
+async function signApproveIntegrator(
+  deps: LighterSignActionsDeps,
+  address: Address,
+  step: WasmBlobActionStep,
+  ctx: SignActionsContext | undefined
+): Promise<WasmBlobSignedActionStep> {
+  const walletSigner = ctx?.userWallet
+  if (!walletSigner) {
+    throw new PerpsError(
+      PerpsErrorCode.SDKError,
+      'APPROVE_INTEGRATOR requires the end-user wallet — pass `userWallet` to ' +
+        'createPerpsClient or call setUserWallet(walletClient).'
+    )
+  }
+
+  const apiKey = await requireApiKey(deps, address)
+  const signed = await deps.signer.signApproveIntegrator(step.wasmSignParams, {
+    apiKeyPrivateKey: apiKey.apiKeyPrivateKey,
+    apiKeyIndex: apiKey.apiKeyIndex,
+    accountIndex: apiKey.accountIndex,
+  })
+
+  const l1Signature = await walletSigner.signMessage({
+    account: walletSigner.account,
+    message: signed.messageToSign,
+  })
+
+  const txInfoWithL1Sig = deps.signer.embedL1Signature(
+    signed.txInfo,
+    l1Signature
+  )
+
+  return {
+    action: step.action,
+    wasmSignParams: step.wasmSignParams,
+    signedTx: {
+      txType: signed.txType,
+      txInfo: txInfoWithL1Sig,
+      txHash: signed.txHash,
+    },
+  }
+}
+
 /**
  * Execute a token-authenticated Lighter mutation (`ACCOUNT_TYPE` →
  * `/changeAccountTier`, `SET_REFERRAL` → `/referral/use`) client-side.

package/src/signers/wasmLoader.ts

@@ -163,9 +163,13 @@ export interface LighterWasmExports {
    * 10 args: integratorAccountIndex, maxPerpsTakerFee, maxPerpsMakerFee,
    * maxSpotTakerFee, maxSpotMakerFee, approvalExpiry, skipNonce, then the
    * trailing three. Fees are uint32 ppm of `FeeTick` (1_000_000); a non-nil
-   * fee requires a non-nil integrator index.
+   * fee requires a non-nil integrator index. `messageToSign` is the EIP-191
+   * `L2ApproveIntegrator` L1 body the user's wallet must countersign — the
+   * venue rejects the tx without the resulting `L1Sig`.
    */
-  SignApproveIntegrator: (...args: unknown[]) => SignResult
+  SignApproveIntegrator: (
+    ...args: unknown[]
+  ) => SignResult & { messageToSign?: string }
   /**
    * 5 args: accountTradingMode (0 = Classic/Simple, 1 = Unified), skipNonce,
    * then the trailing three. `accountTradingMode` is validated to {0, 1} by

package/src/websocket/LighterWsProvider.ts

@@ -2,6 +2,7 @@ import {
   cachePromise,
   getMarketRegistry,
   type MarketRegistry,
+  type PerpsProvider,
   type PerpsSDKClient,
   type ProviderGetQuoteParams,
   type QuoteListener,
@@ -25,6 +26,7 @@ import {
   LIGHTER_BASE_FEE_TIER,
   LIGHTER_PROVIDER_KEY,
 } from '../constants.js'
+import type { LighterPerpsProvider } from '../LighterProvider.js'
 import type {
   LtAccountPosition,
   LtOrder,
@@ -54,16 +56,16 @@ import {
 // Public channels: `marketsContext` (market_stats/all + spot_market_stats/all),
 // `marketContext` (market_stats/N or spot_market_stats/N), `orderbook`
 // (order_book/N), `trades` (trade/N).
-// Authenticated channels (require an `authProvider` option):
+// Authenticated channels (resolve an auth token per subscribe send):
 //   - orderUpdates → account_all_orders/{account_index}
 //   - fills        → account_all_trades/{account_index}
 //   - positions    → account_all_positions/{account_index}
 //
 // Auth pattern (per Lighter WS spec): the subscribe payload carries the
 // token directly — `{ type: "subscribe", channel: "...", auth: "<token>" }`.
-// Tokens are created via the Lighter WASM signer (CreateAuthToken) by the
-// caller; we re-request a fresh token on every subscribe send so reconnects
-// after the original token expires automatically pick up a new one.
+// The token is resolved per send (default: the co-registered `lighterProvider`
+// plugin's `resolveAuthToken`), so reconnects after the original token expires
+// automatically pick up a fresh one.
 //
 // account_index is resolved per-address via `/api/v1/account?by=l1_address`
 // and cached for the lifetime of the provider — Lighter's account index is
@@ -93,14 +95,20 @@ function channelNeedsMarkets(channel: Subscription['channel']): boolean {
 }
 
 /**
- * Creates a fresh Lighter auth token for the given L1 address, or returns
- * `undefined` if no API key is registered. Called both on initial subscribe
- * and on every reconnect, so it must always return a token valid for at
- * least the next few minutes.
+ * Resolves a Lighter auth token for the given L1 address, or `undefined` when
+ * no source can produce one. Called on the initial subscribe and again on
+ * every reconnect, so it must return a token still valid a few minutes out.
+ *
+ * The default resolver — the co-registered `lighterProvider` plugin's
+ * `resolveAuthToken` — satisfies that: it never yields an expired token.
+ * Stored read-only tokens past expiry are filtered out and otherwise carry a
+ * ~10-year lifetime; near-expiry standard tokens are re-created within their
+ * renew buffer; and a server-rejected token self-heals on the next resolve. A
+ * supplied override owns its own freshness.
  *
  * @public
  */
-export type LighterAuthProvider = (
+export type LighterAuthTokenResolver = (
   address: Address
 ) => Promise<string | undefined>
 
@@ -138,11 +146,12 @@ export interface LighterWsProviderOptions {
   /** REST base URL for `/api/v1/account` lookups. Defaults to mainnet. */
   restUrl?: string
   /**
-   * Async function returning a Lighter auth token for an address. Required
-   * for authenticated channels (orderUpdates, positions). Without it those
-   * subscriptions will throw at subscribe time.
+   * Override for auth-token resolution on authenticated channels
+   * (orderUpdates, positions). Defaults to the co-registered `lighterProvider`
+   * plugin's `resolveAuthToken`; supply this only for a standalone WS client
+   * with no Lighter REST plugin on the same {@link PerpsSDKClient}.
    */
-  authProvider?: LighterAuthProvider
+  resolveAuthToken?: LighterAuthTokenResolver
 }
 
 /**
@@ -154,7 +163,9 @@ export interface LighterWsProviderOptions {
  */
 export class LighterWsProvider extends WsProviderBase<SubState> {
   private readonly api: LighterApiClient
-  private readonly authProvider: LighterAuthProvider | undefined
+  private readonly resolveAuthTokenOverride:
+    | LighterAuthTokenResolver
+    | undefined
   private readonly client: PerpsSDKClient | undefined
 
   private readonly orderbooks = new Map<number, OrderbookState>()
@@ -193,11 +204,27 @@ export class LighterWsProvider extends WsProviderBase<SubState> {
         fetchImpl: client?.config.fetch,
       }
     )
-    this.authProvider = options.authProvider
+    this.resolveAuthTokenOverride = options.resolveAuthToken
     this.client = client
     this.registry = client && getMarketRegistry(client, providerKey)
   }
 
+  /**
+   * Auth-token resolver for gated channels: the explicit `resolveAuthToken`
+   * override if supplied, else the co-registered Lighter plugin's
+   * `resolveAuthToken`. `undefined` when neither is available.
+   */
+  private authTokenResolver(): LighterAuthTokenResolver | undefined {
+    if (this.resolveAuthTokenOverride !== undefined) {
+      return this.resolveAuthTokenOverride
+    }
+    const provider = this.client?.getProvider(this.providerKey)
+    if (provider !== undefined && hasAuthTokenResolver(provider)) {
+      return (address) => provider.resolveAuthToken(address)
+    }
+    return undefined
+  }
+
   async subscribeQuote(
     params: ProviderGetQuoteParams,
     onQuote: QuoteListener
@@ -279,12 +306,14 @@ export class LighterWsProvider extends WsProviderBase<SubState> {
       channel,
     }
     if (needsAuth) {
-      if (!this.authProvider || !address) {
+      const resolve = this.authTokenResolver()
+      if (!resolve || !address) {
         throw new Error(
-          `Lighter WS channel '${channel}' requires authentication but no authProvider was supplied.`
+          `Lighter WS channel '${channel}' requires authentication but no auth-token resolver was available. ` +
+            'Register `lighterProvider()` on the same client, or pass `resolveAuthToken` to `lighterWsProvider`.'
         )
       }
-      const token = await this.authProvider(address)
+      const token = await resolve(address)
       if (!token) {
         throw new Error(
           `Lighter WS channel '${channel}' requires authentication but no token was available for ${address}.`
@@ -770,6 +799,20 @@ export class LighterWsProvider extends WsProviderBase<SubState> {
   }
 }
 
+/**
+ * Narrow a co-registered {@link PerpsProvider} to the Lighter plugin that
+ * exposes `resolveAuthToken`. The base plugin contract is provider-agnostic,
+ * so the WS layer must feature-detect rather than assume the capability.
+ */
+function hasAuthTokenResolver(
+  provider: PerpsProvider
+): provider is LighterPerpsProvider {
+  return (
+    'resolveAuthToken' in provider &&
+    typeof (provider as LighterPerpsProvider).resolveAuthToken === 'function'
+  )
+}
+
 const isObject = (v: unknown): v is Record<string, unknown> =>
   typeof v === 'object' && v !== null
 
@@ -885,13 +928,18 @@ function collectAuthChannelItems<T>(
 }
 
 /**
- * `WsProviderFactory` constructor for Lighter — pass to
- * `new PerpsWsClient(client, { wsProviders: { lighter: lighterWsProvider({ authProvider }) } })`.
+ * `WsProviderFactory` constructor for Lighter — register with
+ * `new PerpsWsClient(client, { wsProviders: { lighter: lighterWsProvider() } })`.
+ *
+ * Bare construction is the default path: authenticated channels resolve their
+ * auth token through the `lighterProvider()` plugin co-registered on the same
+ * {@link PerpsSDKClient}, so no wiring is needed. Pass `resolveAuthToken` only
+ * as the exception — a standalone WS client with no Lighter REST plugin on
+ * that client.
  *
- * Closes over the per-instance options (auth provider, restUrl override) so
- * `PerpsWsClient` can call the returned factory with just
- * `({ provider, wsUrl, markets })` at subscribe time. `markets` is
- * unused — Lighter advertises a single venue, no sub-DEX filtering.
+ * Closes over the per-instance options (`resolveAuthToken` override, `restUrl`)
+ * so `PerpsWsClient` can call the returned factory with just
+ * `({ provider, wsUrl, client })` at subscribe time.
  *
  * @public
  */