@raintree-technology/perps 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-02-26
+
+### Added
+- Added `perps setup decibel-key` for guided Decibel API key onboarding with:
+  - Geomi key-capture guidance in interactive mode
+  - live token validation against Decibel REST
+  - optional account-overview validation
+  - encrypted local vault persistence by default
+  - optional env-file export for CI/shell workflows
+- Added encrypted vault helpers for single-secret lifecycle management:
+  - `saveSecretToCredentialVault`
+  - `getLatestCredentialVaultSecret`
+- Added release-ready Decibel onboarding docs covering mainnet startup, automation boundaries, and CI-safe non-interactive flows.
+
+### Changed
+- Updated Decibel default endpoints and package addresses for current Aptos mainnet/testnet deployment values.
+- `loadConfig` now falls back to encrypted-vault Decibel bearer token when `DECIBEL_API_BEARER_TOKEN` is not set in environment.
+- `setup wizard` now consumes vault-stored Decibel bearer token fallback during auth bootstrap.
+- `asset book` now passes resolved exchange credentials and transport URLs into adapter connect flow for cleaner Decibel startup behavior.
+
+### Fixed
+- Updated Decibel on-chain function routing to `dex_accounts_entry::*` entrypoints for order placement/cancel/config calls.
+- Hardened Decibel WebSocket shutdown path to avoid close-time crashes when sockets are still in `CONNECTING` state.
+- Clarified Decibel auth/trading error messages to point users directly to Geomi API key source and required env/vault values.
+
+### Tests
+- Expanded Decibel coverage for:
+  - vault secret persistence/read-back
+  - `setup decibel-key` interactive and non-interactive flows
+  - config vault-fallback credential resolution
+  - Decibel websocket feed and simple orderbook command behavior.
+
+## [0.1.1] - 2026-02-25
+
+### Fixed
+- Restored Node 18 CI compatibility by deferring `@inquirer/prompts` loading to runtime and using shared prompt wrappers in arb commands
+- Added a Node 18-safe `globalThis.crypto` fallback for onboarding key generation paths
+- Updated README command-surface tests to strip inline shell comments before execution
+
+### Added
+- Exchange onboarding guides under `docs/exchanges/*` and README links to those guides
+
 ### Security
 - Replaced `elliptic` and `keccak256` with `@noble/curves` and `@noble/hashes` in Orderly adapter (CVE-2025-14505, CVE-2026-2739)
 - Removed `@types/elliptic` dev dependency
@@ -29,5 +71,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Risk management: limits, drawdown, position sizing
 - Execution journal and safety checks
 
-[Unreleased]: https://github.com/raintree-technology/perps/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/raintree-technology/perps/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/raintree-technology/perps/releases/tag/v0.1.2
+[0.1.1]: https://github.com/raintree-technology/perps/releases/tag/v0.1.1
 [0.1.0]: https://github.com/raintree-technology/perps/releases/tag/v0.1.0

package/README.md

@@ -57,7 +57,7 @@ perps data ccxt binanceusdm fetchTicker --args '["BTC/USDT:USDT"]' --json
 Credentials are handled with care:
 
 - **Testnet by default** — mainnet requires explicit `--mainnet` flag or `*_NETWORK=mainnet` env var
-- **Encrypted at rest** — `perps setup wizard` stores keys in an AES-256-GCM encrypted local vault (`~/.perp/`)
+- **Encrypted at rest** — setup flows (including `perps setup wizard` and `perps setup decibel-key`) store secrets in an AES-256-GCM local vault (`~/.perp/`)
 - **Owner-only permissions** — all credential files are `chmod 600`, directories `chmod 700`
 - **Env vars supported** — standard `HYPERLIQUID_PRIVATE_KEY`, `AEVO_SIGNING_KEY`, etc. for CI/automation
 - **No telemetry, no phoning home** — your keys and trades stay on your machine
@@ -87,6 +87,10 @@ All five adapters implement the same `PerpDEXAdapter` interface — swap `Hyperl
 # Recommended: interactive wizard
 perps setup wizard
 
+# Decibel key helper: guide + validate + store in encrypted vault (env export optional)
+perps setup decibel-key
+perps setup decibel-key --env-file .env.local
+
 # Or set env vars directly
 export HYPERLIQUID_PRIVATE_KEY="0x..."
 ```
@@ -98,7 +102,7 @@ export HYPERLIQUID_PRIVATE_KEY="0x..."
 |----------|-------|---------|
 | Hyperliquid | `HYPERLIQUID_WALLET_ADDRESS` | `HYPERLIQUID_PRIVATE_KEY` |
 | Aevo | `AEVO_API_KEY` + `AEVO_API_SECRET` | + `AEVO_SIGNING_KEY` |
-| Decibel | `DECIBEL_API_WALLET_ADDRESS` + `DECIBEL_API_BEARER_TOKEN` | + `DECIBEL_API_WALLET_PRIVATE_KEY` |
+| Decibel | Market data: `DECIBEL_API_BEARER_TOKEN`; account reads: + `DECIBEL_API_WALLET_ADDRESS` | + `DECIBEL_API_WALLET_PRIVATE_KEY` |
 | Orderly | `ORDERLY_ACCOUNT_ID` + `ORDERLY_KEY` + `ORDERLY_SECRET` | + `ORDERLY_TRADING_SECRET` |
 | Paradex | `PARADEX_ACCOUNT_ADDRESS` + `PARADEX_PRIVATE_KEY` | same |
 
@@ -125,6 +129,7 @@ perps signal --help           # Trade signals
 perps replay --help           # Execution replay
 perps data --help             # Raw exchange data (ccxt, pmxt)
 perps setup --help            # Onboarding wizard
+perps setup decibel-key --help # Decibel bearer key bootstrap + vault storage
 perps config --help           # Settings (show, get, set)
 perps doctor                  # Health check
 ```

package/dist/adapters/decibel/order-manager.js

@@ -27,7 +27,7 @@ export class DecibelOrderManager {
         const chainSize = formatSize(sizeUnits, market);
         const isBuy = side === "buy";
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::place_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::place_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [
                 this.subaccountAddress,
@@ -68,7 +68,7 @@ export class DecibelOrderManager {
     }
     async cancelOrder(orderId, marketAddr) {
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::cancel_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::cancel_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, orderId, marketAddr],
         };
@@ -85,7 +85,7 @@ export class DecibelOrderManager {
     }
     async cancelAllOrders(marketAddr) {
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::cancel_bulk_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::cancel_bulk_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, marketAddr],
         };
@@ -103,7 +103,7 @@ export class DecibelOrderManager {
     async configureUserSettingsForMarket(marketAddr, isCross, userLeverageBps) {
         const leverageBps = Math.max(1, Math.round(userLeverageBps));
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::configure_user_settings_for_market`,
+            function: `${this.packageAddress}::dex_accounts_entry::configure_user_settings_for_market`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, marketAddr, isCross, leverageBps],
         };

package/dist/adapters/decibel/rest-client.js

@@ -112,7 +112,7 @@ export class DecibelRestClient {
         };
         if (requiresAuth) {
             if (!this.bearerToken) {
-                throw new Error(`Decibel endpoint '${path}' requires DECIBEL_API_BEARER_TOKEN`);
+                throw new Error(`Decibel endpoint '${path}' requires DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).`);
             }
             headers.Authorization = `Bearer ${this.bearerToken}`;
         }

package/dist/adapters/decibel/ws-feed.js

@@ -41,9 +41,21 @@ export class DecibelWsFeed extends EventEmitter {
         this.shouldReconnect = false;
         this.clearReconnectTimer();
         this.stopPing();
-        this.ws?.removeAllListeners();
-        this.ws?.close();
+        const ws = this.ws;
         this.ws = null;
+        if (!ws) {
+            return;
+        }
+        // Closing a CONNECTING socket can emit an error from ws; keep a no-op handler
+        // so shutdown does not crash the process.
+        if (ws.readyState === WebSocket.CONNECTING) {
+            ws.once("error", () => { });
+            ws.terminate();
+            return;
+        }
+        if (ws.readyState === WebSocket.OPEN) {
+            ws.close();
+        }
     }
     isConnected() {
         return this.ws?.readyState === WebSocket.OPEN;

package/dist/adapters/decibel.js

@@ -14,13 +14,13 @@ const DECIBEL_DEFAULTS = {
         fullnodeUrl: "https://api.testnet.aptoslabs.com/v1",
         restUrl: "https://api.testnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.testnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0x95254fcb0816b9f3ec71aa4de5f5f7f8f3efeef9239f0d705a4cd3fe2f452de3",
+        packageAddress: "0x952535c3049e52f195f26798c2f1340d7dd5100edbe0f464e520a974d16fbe9f",
     },
     mainnet: {
         fullnodeUrl: "https://api.mainnet.aptoslabs.com/v1",
         restUrl: "https://api.mainnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.mainnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0xb8a5788314451ce4d2fbbad32e1bad88d4184b73943b7fe5166eab93cf1a5a95",
+        packageAddress: "0x50ead22afd6ffd9769e3b3d6e0e64a2a350d68e8b102c4e72e33d0b8cfdfdb06",
     },
 };
 export class DecibelAdapter {
@@ -809,15 +809,15 @@ export class DecibelAdapter {
     }
     ensureAccountReadAuth() {
         if (!this.accountAddress) {
-            throw new Error("Decibel account reads require account address (set DECIBEL_API_WALLET_ADDRESS or subaccount).");
+            throw new Error("Decibel account reads require account address (set DECIBEL_API_WALLET_ADDRESS or DECIBEL_SUBACCOUNT_ADDRESS).");
         }
         if (!this.config?.credentials?.apiBearerToken) {
-            throw new Error("Decibel account reads require DECIBEL_API_BEARER_TOKEN.");
+            throw new Error("Decibel account reads require DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).");
         }
     }
     ensureOrderManager() {
         if (!this.orderManager) {
-            throw new Error("Decibel trading requires private key + package settings + subaccount (DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN).");
+            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN, and package/network settings.");
         }
     }
     requireMarket(symbol) {

package/dist/commands/arb/basis-execute.js

@@ -3,9 +3,9 @@
  * Execute basis trades (cash-and-carry arbitrage) on a single exchange
  */
 import { createHash } from "node:crypto";
-import { confirm } from "@inquirer/prompts";
 import { getContext, getOutputOptions, getSelectedExchange } from "../../cli/program.js";
 import { output, outputError } from "../../cli/output.js";
+import { confirm } from "../../lib/prompts.js";
 import { getExchangeAdapterById } from "../../lib/exchange.js";
 import { DEFAULT_ARB_SIZE_USD } from "../../lib/constants.js";
 import { validateAsset, validateSize } from "../../lib/validate.js";
@@ -178,10 +178,7 @@ export function registerArbBasisExecuteCommand(arb) {
                     return;
                 }
                 if (!opts.yes) {
-                    const confirmed = await confirm({
-                        message: "Execute this basis trade?",
-                        default: false,
-                    });
+                    const confirmed = await confirm("Execute this basis trade?", false);
                     if (!confirmed) {
                         if (isJson) {
                             emitJson({

package/dist/commands/arb/execute.js

@@ -2,9 +2,9 @@
  * Arb Execute Command
  * Execute delta-neutral funding arbitrage across exchanges
  */
-import { confirm } from "@inquirer/prompts";
 import { getContext, getOutputOptions } from "../../cli/program.js";
 import { output, outputError } from "../../cli/output.js";
+import { confirm } from "../../lib/prompts.js";
 import { getExchangeAdapterById } from "../../lib/exchange.js";
 import { getLatestFundingRates } from "../../lib/db/funding-history.js";
 import { getExchangeIdByName, DEFAULT_ARB_SIZE_USD } from "../../lib/constants.js";
@@ -196,10 +196,7 @@ export function registerArbExecuteCommand(arb) {
                     return;
                 }
                 if (!opts.yes) {
-                    const confirmed = await confirm({
-                        message: "Execute this arbitrage trade?",
-                        default: false,
-                    });
+                    const confirmed = await confirm("Execute this arbitrage trade?", false);
                     if (!confirmed) {
                         if (isJson) {
                             emitJson({

package/dist/commands/asset/book-simple.js

@@ -1,9 +1,10 @@
 /**
  * Simple order book command using the adapter interface
  */
-import { getContext, getOutputOptions } from "../../cli/program.js";
+import { getContext, getOutputOptions, getSelectedExchange } from "../../cli/program.js";
 import { output, outputError } from "../../cli/output.js";
 import { getExchangeAdapter } from "../../lib/exchange.js";
+import { getExchangeCredentials } from "../../lib/config.js";
 export function registerBookSimpleCommand(asset) {
     asset
         .command("book <symbol>")
@@ -12,12 +13,19 @@ export function registerBookSimpleCommand(asset) {
         .action(async function (symbol) {
         const ctx = getContext(this);
         const outputOpts = getOutputOptions(this);
+        const exchangeId = getSelectedExchange(this);
         const opts = this.opts();
         const depth = parseInt(opts.depth, 10);
         const adapter = getExchangeAdapter();
         let connected = false;
         try {
-            await adapter.connect({ testnet: ctx.config.testnet });
+            const credentials = getExchangeCredentials(ctx.config, exchangeId);
+            await adapter.connect({
+                testnet: ctx.config.testnet,
+                rpcUrl: credentials.fullnodeUrl,
+                wsUrl: credentials.wsUrl,
+                credentials,
+            });
             connected = true;
             // Normalize symbol (accept BTC, BTC-PERP, btc, etc.)
             let market = symbol.toUpperCase();

package/dist/commands/markets/ls-simple.js

@@ -6,6 +6,7 @@
 import { output, outputError } from "../../cli/output.js";
 import { getContext, getOutputOptions, getVerbose } from "../../cli/program.js";
 import { getAvailableExchanges, getExchangeAdapter, getExchangeAdapterById, } from "../../lib/exchange.js";
+import { getExchangeCredentials } from "../../lib/config.js";
 import { pLimit } from "../../lib/rate-limit.js";
 export function registerMarketsLsSimpleCommand(markets) {
     markets
@@ -38,7 +39,8 @@ async function handleSingleExchange(ctx, outputOpts, opts, limit = 0) {
     const adapter = getExchangeAdapter();
     let connected = false;
     try {
-        await adapter.connect({ testnet: ctx.config.testnet });
+        const credentials = getExchangeCredentials(ctx.config, adapter.info.id);
+        await adapter.connect({ testnet: ctx.config.testnet, credentials });
         connected = true;
         const markets = await adapter.getMarkets();
         let filtered = markets;
@@ -88,7 +90,8 @@ async function fetchAllExchangeMarkets(ctx) {
     const connectedAdapters = [];
     const tasks = exchangeIds.map((id) => async () => {
         const adapter = getExchangeAdapterById(id);
-        await adapter.connect({ testnet: ctx.config.testnet });
+        const credentials = getExchangeCredentials(ctx.config, id);
+        await adapter.connect({ testnet: ctx.config.testnet, credentials });
         connectedAdapters.push(adapter);
         const markets = await adapter.getMarkets();
         return { id, name: adapter.info.name, markets };

package/dist/commands/setup/index.js

@@ -1,14 +1,81 @@
-import { existsSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { getOutputOptions } from "../../cli/program.js";
 import { output, outputError, outputSuccess } from "../../cli/output.js";
 import { withJsonContract } from "../../lib/contracts.js";
 import { createAccount, getAccountByAliasForExchange, } from "../../lib/db/index.js";
 import { privateKeyToAccount } from "viem/accounts";
-import { getCredentialVaultSummary, saveOnboardingProfileToVault, } from "../../lib/credential-vault.js";
+import { getCredentialVaultSummary, getLatestCredentialVaultSecret, saveSecretToCredentialVault, saveOnboardingProfileToVault, } from "../../lib/credential-vault.js";
 import { ALL_SETUP_CHAINS, ALL_SETUP_EXCHANGES, buildOnboardingEnvFile, parseSetupChains, parseSetupExchanges, parseSetupMode, resolveExchangesFromChains, runOnboardingStateMachine, } from "../../lib/onboarding.js";
-import { confirm, multiSelect, select } from "../../lib/prompts.js";
+import { confirm, multiSelect, pressEnterOrEsc, prompt, select } from "../../lib/prompts.js";
 import { hardenPrivateFile, PRIVATE_FILE_MODE } from "../../lib/fs-security.js";
+import { FetchError, fetchWithTimeout } from "../../lib/fetch.js";
+const DECIBEL_REST_DEFAULTS = {
+    mainnet: "https://api.mainnet.aptoslabs.com/decibel",
+    testnet: "https://api.testnet.aptoslabs.com/decibel",
+};
+function normalizeText(value) {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function normalizeNetwork(value) {
+    const normalized = normalizeText(value)?.toLowerCase();
+    if (normalized === "testnet")
+        return "testnet";
+    return "mainnet";
+}
+function resolveDecibelNetwork(opts, command) {
+    if (opts.network) {
+        return normalizeNetwork(opts.network);
+    }
+    const globalOpts = command.optsWithGlobals();
+    if (globalOpts.mainnet)
+        return "mainnet";
+    if (globalOpts.testnet)
+        return "testnet";
+    return normalizeNetwork(process.env.DECIBEL_NETWORK);
+}
+function resolveDecibelRestUrl(opts, command) {
+    const explicit = normalizeText(opts.restUrl) ?? normalizeText(process.env.DECIBEL_REST_URL);
+    if (explicit) {
+        return explicit.replace(/\/+$/, "");
+    }
+    return DECIBEL_REST_DEFAULTS[resolveDecibelNetwork(opts, command)];
+}
+function openExternalUrl(url) {
+    const platform = process.platform;
+    if (platform === "darwin") {
+        execFileSync("open", [url], { stdio: "ignore" });
+        return;
+    }
+    if (platform === "win32") {
+        execFileSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
+        return;
+    }
+    execFileSync("xdg-open", [url], { stdio: "ignore" });
+}
+function upsertEnvVar(content, key, value) {
+    const lines = content.split(/\r?\n/);
+    const matcher = new RegExp(`^\\s*#?\\s*${key}=`);
+    let replaced = false;
+    const next = lines.map((line) => {
+        if (matcher.test(line)) {
+            replaced = true;
+            return `${key}=${value}`;
+        }
+        return line;
+    });
+    if (!replaced) {
+        if (next.length > 0 && next[next.length - 1].trim() !== "") {
+            next.push("");
+        }
+        next.push(`${key}=${value}`);
+    }
+    return `${next.join("\n").replace(/\n+$/, "")}\n`;
+}
 const MODE_DESCRIPTIONS = {
     "mainnet-data": "No credentials. Use real mainnet data immediately.",
     "testnet-execution": "Force selected exchanges to testnet for all commands.",
@@ -37,8 +104,11 @@ function normalizeAuthOptions(opts) {
     const orderlyChainId = opts.orderlyChainId ??
         process.env.ORDERLY_CHAIN_ID ??
         process.env.ORDERLY_TESTNET_FAUCET_CHAIN_ID;
+    const vaultDecibelBearer = getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN");
     return {
-        decibelBearerToken: opts.decibelBearerToken ?? process.env.DECIBEL_API_BEARER_TOKEN,
+        decibelBearerToken: opts.decibelBearerToken ??
+            process.env.DECIBEL_API_BEARER_TOKEN ??
+            vaultDecibelBearer,
         aevoApiKey: opts.aevoApiKey ?? process.env.AEVO_API_KEY,
         aevoApiSecret: opts.aevoApiSecret ?? process.env.AEVO_API_SECRET,
         aevoAccountPrivateKey: (opts.aevoAccountPrivateKey ??
@@ -302,6 +372,224 @@ function printWizardSummary(args) {
 }
 export function registerSetupCommands(program) {
     const setup = program.command("setup").description("Onboarding and environment setup");
+    setup
+        .command("decibel-key")
+        .description("Bootstrap a Decibel Client API key flow, validate it, and store it in the encrypted vault")
+        .option("--token <token>", "Decibel Client API key secret (overrides DECIBEL_API_BEARER_TOKEN)")
+        .option("--wallet-address <address>", "Account address to check with account_overview")
+        .option("--subaccount-address <address>", "Subaccount address to check with account_overview")
+        .option("--network <network>", "Decibel network (mainnet or testnet)")
+        .option("--rest-url <url>", "Decibel REST URL override")
+        .option("--env-file <path>", "Write/update DECIBEL_API_BEARER_TOKEN in this env file")
+        .option("--no-vault", "Skip encrypted vault persistence for DECIBEL_API_BEARER_TOKEN")
+        .option("--no-open-browser", "Do not open Geomi/API keys pages automatically")
+        .option("--require-account", "Fail if account_overview check fails")
+        .option("--yes", "Skip interactive confirmations")
+        .action(async function () {
+        const outputOpts = getOutputOptions(this);
+        const opts = this.opts();
+        const hasInteractiveTty = process.stdin.isTTY && process.stdout.isTTY;
+        const assumeDefaults = Boolean(opts.yes) || !hasInteractiveTty;
+        const network = resolveDecibelNetwork(opts, this);
+        const restUrl = resolveDecibelRestUrl(opts, this);
+        const persistToVault = opts.vault ?? true;
+        try {
+            const vaultToken = normalizeText(getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN"));
+            let tokenSource = "interactive";
+            let token = normalizeText(opts.token);
+            if (token) {
+                tokenSource = "cli";
+            }
+            else {
+                token = normalizeText(process.env.DECIBEL_API_BEARER_TOKEN);
+                if (token) {
+                    tokenSource = "env";
+                }
+                else if (vaultToken) {
+                    token = vaultToken;
+                    tokenSource = "vault";
+                }
+            }
+            const usedInteractiveCapture = !token;
+            if (!token) {
+                if (!hasInteractiveTty) {
+                    throw new Error("No Decibel API key found. Pass --token, set DECIBEL_API_BEARER_TOKEN, or run once interactively to store it in the encrypted vault.");
+                }
+                console.log("Decibel key generation is currently handled in Geomi (web UI).");
+                if (opts.openBrowser ?? true) {
+                    let shouldOpen = true;
+                    if (!assumeDefaults) {
+                        shouldOpen = await pressEnterOrEsc("Press Enter to open Decibel + Geomi API keys pages (or Esc to skip)");
+                    }
+                    if (shouldOpen) {
+                        try {
+                            openExternalUrl("https://app.decibel.trade");
+                            openExternalUrl("https://app.decibel.trade/geomi");
+                        }
+                        catch {
+                            // Fall through with manual links.
+                        }
+                    }
+                }
+                console.log("");
+                console.log("Create/copy your Key Secret from Geomi -> API Keys, then paste it below.");
+                token = normalizeText(await prompt("Paste DECIBEL_API_BEARER_TOKEN (Key Secret):"));
+                if (!token) {
+                    throw new Error("No Decibel API key provided.");
+                }
+                tokenSource = "interactive";
+            }
+            const headers = {
+                Authorization: `Bearer ${token}`,
+                Origin: "https://app.decibel.trade",
+            };
+            const marketsUrl = new URL("api/v1/markets", `${restUrl.replace(/\/+$/, "")}/`).toString();
+            const markets = await fetchWithTimeout(marketsUrl, {
+                headers,
+                retries: 0,
+            });
+            const marketCount = Array.isArray(markets) ? markets.length : 0;
+            if (marketCount === 0) {
+                throw new Error("Decibel token validated but returned no markets.");
+            }
+            const accountAddress = normalizeText(opts.subaccountAddress) ??
+                normalizeText(opts.walletAddress) ??
+                normalizeText(process.env.DECIBEL_SUBACCOUNT_ADDRESS) ??
+                normalizeText(process.env.DECIBEL_API_WALLET_ADDRESS);
+            let accountCheck;
+            if (accountAddress) {
+                const accountUrl = new URL("api/v1/account_overview", `${restUrl.replace(/\/+$/, "")}/`);
+                accountUrl.searchParams.set("account", accountAddress);
+                try {
+                    await fetchWithTimeout(accountUrl.toString(), {
+                        headers,
+                        retries: 0,
+                    });
+                    accountCheck = {
+                        status: "ok",
+                        detail: `account_overview succeeded for ${accountAddress}`,
+                    };
+                }
+                catch (err) {
+                    const detail = err instanceof Error ? err.message : String(err);
+                    accountCheck = {
+                        status: "failed",
+                        detail: `account_overview failed for ${accountAddress}: ${detail}`,
+                    };
+                    if (opts.requireAccount) {
+                        throw new Error(accountCheck.detail);
+                    }
+                }
+            }
+            else {
+                accountCheck = {
+                    status: "skipped",
+                    detail: "No DECIBEL_API_WALLET_ADDRESS/DECIBEL_SUBACCOUNT_ADDRESS provided.",
+                };
+            }
+            let vaultRef;
+            let vaultStatus = "disabled";
+            let vaultPath;
+            if (persistToVault) {
+                vaultPath = getCredentialVaultSummary().path;
+                if (vaultToken === token) {
+                    vaultStatus = "unchanged";
+                }
+                else {
+                    vaultRef = saveSecretToCredentialVault("DECIBEL_API_BEARER_TOKEN", token, {
+                        mode: "setup.decibel-key",
+                        exchange: "decibel",
+                    });
+                    vaultStatus = "stored";
+                    vaultPath = vaultRef.path;
+                }
+            }
+            let envFilePath;
+            if (opts.envFile) {
+                envFilePath = resolve(opts.envFile.trim());
+                const existing = existsSync(envFilePath) ? readFileSync(envFilePath, "utf8") : "";
+                const updated = upsertEnvVar(existing, "DECIBEL_API_BEARER_TOKEN", token);
+                writeFileSync(envFilePath, updated, { mode: PRIVATE_FILE_MODE });
+                hardenPrivateFile(envFilePath);
+            }
+            const nextSteps = envFilePath
+                ? [
+                    `source ${envFilePath}`,
+                    "perps markets ls -e decibel",
+                    "perps asset book BTC-PERP -e decibel",
+                ]
+                : persistToVault
+                    ? [
+                        "perps markets ls -e decibel",
+                        "perps asset book BTC-PERP -e decibel",
+                    ]
+                    : [
+                        "Export DECIBEL_API_BEARER_TOKEN in your shell (or re-run without --no-vault).",
+                        "perps markets ls -e decibel",
+                        "perps asset book BTC-PERP -e decibel",
+                    ];
+            const payload = withJsonContract("setup.decibel_key.result", {
+                network,
+                restUrl,
+                tokenSource,
+                tokenCapturedInteractively: usedInteractiveCapture,
+                tokenValidated: true,
+                marketCount,
+                accountCheck,
+                vault: {
+                    enabled: persistToVault,
+                    status: vaultStatus,
+                    id: vaultRef?.id,
+                    path: vaultPath,
+                },
+                envFile: envFilePath,
+                envVar: "DECIBEL_API_BEARER_TOKEN",
+                nextSteps,
+            });
+            if (outputOpts.json) {
+                output(payload, outputOpts);
+                return;
+            }
+            outputSuccess("Decibel API key validated successfully.");
+            console.log("");
+            console.log(`Network:          ${network}`);
+            console.log(`REST URL:         ${restUrl}`);
+            console.log(`Markets checked:  ${marketCount}`);
+            console.log(`Token source:     ${tokenSource}`);
+            if (accountCheck) {
+                console.log(`Account check:    [${accountCheck.status}] ${accountCheck.detail}`);
+            }
+            if (persistToVault && vaultPath) {
+                if (vaultStatus === "stored" && vaultRef) {
+                    console.log(`Vault:            stored ${vaultRef.id} (${vaultPath})`);
+                }
+                else {
+                    console.log(`Vault:            unchanged (${vaultPath})`);
+                }
+            }
+            else {
+                console.log("Vault:            skipped (--no-vault)");
+            }
+            if (envFilePath) {
+                console.log(`Env file:         ${envFilePath}`);
+            }
+            console.log("");
+            console.log("Next steps:");
+            for (const [index, step] of nextSteps.entries()) {
+                console.log(`${index + 1}) ${step}`);
+            }
+            console.log("");
+        }
+        catch (err) {
+            const message = err instanceof FetchError
+                ? `Decibel key bootstrap failed: ${err.message}`
+                : err instanceof Error
+                    ? err.message
+                    : String(err);
+            outputError(message);
+            process.exit(1);
+        }
+    });
     setup
         .command("wizard")
         .description("Interactive setup for mainnet data defaults and testnet onboarding")

package/dist/lib/config.js

@@ -1,5 +1,6 @@
 import { privateKeyToAccount } from "viem/accounts";
 import { getDefaultAccountForExchange } from "./db/index.js";
+import { getLatestCredentialVaultSecret } from "./credential-vault.js";
 import { parseEnv } from "./schema.js";
 import { recordTelemetryMetric } from "./telemetry.js";
 const DECIBEL_NETWORK_DEFAULTS = {
@@ -7,13 +8,13 @@ const DECIBEL_NETWORK_DEFAULTS = {
         fullnodeUrl: "https://api.testnet.aptoslabs.com/v1",
         restUrl: "https://api.testnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.testnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0x95254fcb0816b9f3ec71aa4de5f5f7f8f3efeef9239f0d705a4cd3fe2f452de3",
+        packageAddress: "0x952535c3049e52f195f26798c2f1340d7dd5100edbe0f464e520a974d16fbe9f",
     },
     mainnet: {
         fullnodeUrl: "https://api.mainnet.aptoslabs.com/v1",
         restUrl: "https://api.mainnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.mainnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0xb8a5788314451ce4d2fbbad32e1bad88d4184b73943b7fe5166eab93cf1a5a95",
+        packageAddress: "0x50ead22afd6ffd9769e3b3d6e0e64a2a350d68e8b102c4e72e33d0b8cfdfdb06",
     },
 };
 const ORDERLY_DEFAULTS = {
@@ -84,10 +85,14 @@ function resolveHyperliquidSettings(testnet, env) {
 function resolveDecibelSettings(testnet, env) {
     const network = resolveExchangeNetwork(testnet, env.DECIBEL_NETWORK);
     const defaults = DECIBEL_NETWORK_DEFAULTS[network];
+    const envBearerToken = env.DECIBEL_API_BEARER_TOKEN;
+    const vaultBearerToken = envBearerToken
+        ? undefined
+        : getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN");
     const credentials = {
         apiWalletPrivateKey: env.DECIBEL_API_WALLET_PRIVATE_KEY,
         apiWalletAddress: env.DECIBEL_API_WALLET_ADDRESS,
-        apiBearerToken: env.DECIBEL_API_BEARER_TOKEN,
+        apiBearerToken: envBearerToken ?? vaultBearerToken,
         subaccountAddress: env.DECIBEL_SUBACCOUNT_ADDRESS,
     };
     const hasAnyCredentials = !!credentials.apiWalletPrivateKey ||
@@ -291,7 +296,7 @@ export function getExchangeCredentials(config, exchangeId, requirement = {}) {
         if (requirement.requireReadAccess &&
             (!credentials.apiBearerToken || !credentials.accountAddress)) {
             recordAuth("read", "failed");
-            throw new Error("Decibel authenticated reads require DECIBEL_API_WALLET_ADDRESS + DECIBEL_API_BEARER_TOKEN.");
+            throw new Error("Decibel authenticated reads require DECIBEL_API_WALLET_ADDRESS + DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).");
         }
         if (requirement.requireReadAccess) {
             recordAuth("read", "success");
@@ -302,7 +307,7 @@ export function getExchangeCredentials(config, exchangeId, requirement = {}) {
                 !credentials.apiBearerToken ||
                 !credentials.packageAddress)) {
             recordAuth("trade", "failed");
-            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN, and package/network settings.");
+            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, and DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys), plus package/network settings.");
         }
         if (requirement.requireTrading) {
             recordAuth("trade", "success");

package/dist/lib/credential-vault.d.ts

@@ -20,3 +20,11 @@ export declare function getCredentialVaultSummary(): {
     entries: number;
     updatedAt?: string;
 };
+export declare function getLatestCredentialVaultSecret(secretKey: string): string | undefined;
+export declare function saveSecretToCredentialVault(secretKey: string, secretValue: string, options?: {
+    mode?: string;
+    exchange?: string;
+}): {
+    id: string;
+    path: string;
+};

package/dist/lib/credential-vault.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { CREDENTIAL_VAULT_PATH } from "./paths.js";
-import { encryptSecret } from "./secrets.js";
+import { decryptSecret, encryptSecret } from "./secrets.js";
 import { ensurePrivateDir, hardenPrivateFile, PRIVATE_FILE_MODE } from "./fs-security.js";
 const VAULT_SCHEMA_VERSION = 1;
 function createVault() {
@@ -78,6 +78,25 @@ function buildId(profile) {
     const suffix = Math.random().toString(36).slice(2, 8);
     return `onb-${day}-${suffix}`;
 }
+function buildSecretId(now) {
+    const day = now.toISOString().slice(0, 10).replace(/-/g, "");
+    const suffix = Math.random().toString(36).slice(2, 8);
+    return `sec-${day}-${suffix}`;
+}
+function normalizeSecretKey(secretKey) {
+    const normalized = secretKey.trim().toUpperCase();
+    if (!/^[A-Z0-9_]+$/.test(normalized)) {
+        throw new Error(`Invalid vault secret key '${secretKey}'`);
+    }
+    return normalized;
+}
+function normalizeSecretValue(secretValue) {
+    const normalized = secretValue.trim();
+    if (!normalized) {
+        throw new Error("Vault secret value cannot be empty");
+    }
+    return normalized;
+}
 export function saveOnboardingProfileToVault(profile) {
     const vault = readVault();
     const id = buildId(profile);
@@ -107,3 +126,44 @@ export function getCredentialVaultSummary() {
         updatedAt: vault.updatedAt,
     };
 }
+export function getLatestCredentialVaultSecret(secretKey) {
+    const normalizedKey = normalizeSecretKey(secretKey);
+    const vault = readVault();
+    for (const entry of vault.entries) {
+        const encryptedValue = entry?.encrypted?.[normalizedKey];
+        if (typeof encryptedValue !== "string" || encryptedValue.trim().length === 0) {
+            continue;
+        }
+        try {
+            const plaintext = decryptSecret(encryptedValue).trim();
+            if (plaintext.length > 0) {
+                return plaintext;
+            }
+        }
+        catch {
+            // Skip malformed entries and continue searching older entries.
+        }
+    }
+    return undefined;
+}
+export function saveSecretToCredentialVault(secretKey, secretValue, options = {}) {
+    const key = normalizeSecretKey(secretKey);
+    const value = normalizeSecretValue(secretValue);
+    const now = new Date();
+    const vault = readVault();
+    const id = buildSecretId(now);
+    const entry = {
+        id,
+        createdAt: now.toISOString(),
+        mode: options.mode ?? "manual_secret",
+        exchanges: options.exchange ? [options.exchange] : [],
+        wallets: {},
+        encrypted: {
+            [key]: encryptSecret(value),
+        },
+    };
+    vault.entries.unshift(entry);
+    vault.updatedAt = now.toISOString();
+    writeVault(vault);
+    return { id, path: CREDENTIAL_VAULT_PATH };
+}

package/dist/lib/onboarding.js

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { randomBytes, webcrypto } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { Ed25519Account, Ed25519PrivateKey } from "@aptos-labs/ts-sdk";
@@ -40,6 +40,10 @@ const AEVO_TESTNET_CHAIN_ID = 11155111;
 const PARADEX_TESTNET_API = "https://api.testnet.paradex.trade/v1";
 const SECONDS_PER_DAY = 86_400;
 const MILLISECONDS_PER_DAY = 86_400_000;
+// Node 18 may not expose globalThis.crypto in every runtime context.
+if (!globalThis.crypto) {
+    globalThis.crypto = webcrypto;
+}
 function dedupe(values, order) {
     const set = new Set(values);
     return order.filter((item) => set.has(item));
@@ -608,7 +612,7 @@ export async function bootstrapOnboardingAuth(profile, options = {}) {
                 exchange: "decibel",
                 service: "decibel auth",
                 status: "ok",
-                detail: "using DECIBEL_API_BEARER_TOKEN",
+                detail: "using DECIBEL_API_BEARER_TOKEN (Client API key secret)",
             });
         }
         else {
@@ -616,7 +620,7 @@ export async function bootstrapOnboardingAuth(profile, options = {}) {
                 exchange: "decibel",
                 service: "decibel auth",
                 status: "manual",
-                detail: "still requires DECIBEL_API_BEARER_TOKEN",
+                detail: "still requires DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys)",
             });
         }
     }
@@ -833,7 +837,7 @@ const ONBOARDING_PROVIDERS = {
         manualAuthFollowUp: {
             exchange: "decibel",
             env: ["DECIBEL_API_BEARER_TOKEN"],
-            detail: "Set a Decibel bearer token for authenticated reads/trading after wallet generation.",
+            detail: "Create a key in app.decibel.trade -> Geomi -> API Keys, copy the Key Secret, and set DECIBEL_API_BEARER_TOKEN.",
         },
         fundingTask: ({ profile, options }) => requestAptosFaucet({
             aptosAddress: profile.wallets.aptosAddress,

package/dist/lib/prompts.js

@@ -1,9 +1,16 @@
-import { input, select as inquirerSelect, confirm as inquirerConfirm, checkbox, } from "@inquirer/prompts";
 import { inquirerTheme, highlighter } from "./ui-tokens.js";
+let promptsModule = null;
+async function loadPrompts() {
+    if (promptsModule)
+        return promptsModule;
+    promptsModule = await import("@inquirer/prompts");
+    return promptsModule;
+}
 /**
  * Prompt for text input
  */
 export async function prompt(question) {
+    const { input } = await loadPrompts();
     const answer = await input({
         message: question,
         theme: inquirerTheme,
@@ -14,6 +21,7 @@ export async function prompt(question) {
  * Prompt for selection from a list of options with arrow key navigation
  */
 export async function select(question, options) {
+    const { select: inquirerSelect } = await loadPrompts();
     const result = await inquirerSelect({
         message: question,
         choices: options.map((opt) => ({
@@ -29,6 +37,7 @@ export async function select(question, options) {
  * Prompt for multiple selections with checkboxes
  */
 export async function multiSelect(question, options) {
+    const { checkbox } = await loadPrompts();
     const results = await checkbox({
         message: question,
         choices: options.map((opt) => ({
@@ -44,6 +53,7 @@ export async function multiSelect(question, options) {
  * Prompt for yes/no confirmation
  */
 export async function confirm(question, defaultValue = false) {
+    const { confirm: inquirerConfirm } = await loadPrompts();
     return inquirerConfirm({
         message: question,
         default: defaultValue,
@@ -54,6 +64,7 @@ export async function confirm(question, defaultValue = false) {
  * Wait for user to press Enter
  */
 export async function waitForEnter(message = "Press Enter to continue...") {
+    const { input } = await loadPrompts();
     await input({
         message,
         theme: {

package/dist/lib/schema.d.ts

@@ -60,80 +60,80 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     EXECUTION_TAKE_PROFIT_PCT: number;
     EXECUTION_SPREAD_OFFSET_PCT: number;
     OPERATOR_HEARTBEAT_INTERVAL_MS: number;
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     PERPS_ALLOW_UNTRUSTED_ENDPOINTS?: "0" | "1" | "true" | "false" | undefined;
     PERPS_BLOCKED_EXCHANGES?: string | undefined;
     PERPS_BLOCKED_MARKETS?: string | undefined;
     PERPS_BLOCKED_MARKET_PATTERNS?: string | undefined;
     PERPS_REPUTATION_BLOCKLIST_FILE?: string | undefined;
 }, {
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     RISK_MAX_POSITION_SIZE_USD?: number | undefined;
     RISK_MAX_TOTAL_EXPOSURE_USD?: number | undefined;
     RISK_MAX_LEVERAGE?: number | undefined;
@@ -160,80 +160,80 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     EXECUTION_TAKE_PROFIT_PCT: number;
     EXECUTION_SPREAD_OFFSET_PCT: number;
     OPERATOR_HEARTBEAT_INTERVAL_MS: number;
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     PERPS_ALLOW_UNTRUSTED_ENDPOINTS?: "0" | "1" | "true" | "false" | undefined;
     PERPS_BLOCKED_EXCHANGES?: string | undefined;
     PERPS_BLOCKED_MARKETS?: string | undefined;
     PERPS_BLOCKED_MARKET_PATTERNS?: string | undefined;
     PERPS_REPUTATION_BLOCKLIST_FILE?: string | undefined;
 }, {
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     RISK_MAX_POSITION_SIZE_USD?: number | undefined;
     RISK_MAX_TOTAL_EXPOSURE_USD?: number | undefined;
     RISK_MAX_LEVERAGE?: number | undefined;

package/dist/lib/schema.js

@@ -34,9 +34,23 @@ const secureWsUrl = z
     message: "must use wss:// (ws:// allowed only for localhost)",
 });
 const EXCHANGE_URL_HOST_ALLOWLIST = {
-    DECIBEL_REST_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
-    DECIBEL_WS_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
-    DECIBEL_FULLNODE_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
+    DECIBEL_REST_URL: [
+        "api.decibel.trade",
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
+    DECIBEL_WS_URL: [
+        "api.decibel.trade",
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
+    DECIBEL_FULLNODE_URL: [
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
     AEVO_REST_URL: ["api-testnet.aevo.xyz", "api.aevo.xyz"],
     ORDERLY_REST_URL: ["testnet-api.orderly.org", "api-evm.orderly.org"],
     PARADEX_REST_URL: ["api.testnet.paradex.trade", "api.prod.paradex.trade"],
@@ -118,13 +132,6 @@ export const envSchema = z
             message: "required when DECIBEL_API_WALLET_PRIVATE_KEY is set",
         });
     }
-    if (env.DECIBEL_API_BEARER_TOKEN && !env.DECIBEL_API_WALLET_ADDRESS) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["DECIBEL_API_WALLET_ADDRESS"],
-            message: "required when DECIBEL_API_BEARER_TOKEN is set",
-        });
-    }
     const aevoCredentialValues = [env.AEVO_API_KEY, env.AEVO_API_SECRET];
     const aevoCredentialCount = aevoCredentialValues.filter(Boolean).length;
     if (aevoCredentialCount === 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raintree-technology/perps",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Universal CLI for perpetual DEXes",
   "author": "Raintree Technology (https://raintree.technology)",
   "contributors": [