@raintree-technology/perps 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-02-26
+
+### Added
+- Added `perps setup decibel-key` for guided Decibel API key onboarding with:
+  - Geomi key-capture guidance in interactive mode
+  - live token validation against Decibel REST
+  - optional account-overview validation
+  - encrypted local vault persistence by default
+  - optional env-file export for CI/shell workflows
+- Added encrypted vault helpers for single-secret lifecycle management:
+  - `saveSecretToCredentialVault`
+  - `getLatestCredentialVaultSecret`
+- Added release-ready Decibel onboarding docs covering mainnet startup, automation boundaries, and CI-safe non-interactive flows.
+
+### Changed
+- Updated Decibel default endpoints and package addresses for current Aptos mainnet/testnet deployment values.
+- `loadConfig` now falls back to encrypted-vault Decibel bearer token when `DECIBEL_API_BEARER_TOKEN` is not set in environment.
+- `setup wizard` now consumes vault-stored Decibel bearer token fallback during auth bootstrap.
+- `asset book` now passes resolved exchange credentials and transport URLs into adapter connect flow for cleaner Decibel startup behavior.
+
+### Fixed
+- Updated Decibel on-chain function routing to `dex_accounts_entry::*` entrypoints for order placement/cancel/config calls.
+- Hardened Decibel WebSocket shutdown path to avoid close-time crashes when sockets are still in `CONNECTING` state.
+- Clarified Decibel auth/trading error messages to point users directly to Geomi API key source and required env/vault values.
+
+### Tests
+- Expanded Decibel coverage for:
+  - vault secret persistence/read-back
+  - `setup decibel-key` interactive and non-interactive flows
+  - config vault-fallback credential resolution
+  - Decibel websocket feed and simple orderbook command behavior.
+
 ## [0.1.1] - 2026-02-25
 
 ### Fixed
@@ -39,6 +71,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Risk management: limits, drawdown, position sizing
 - Execution journal and safety checks
 
-[Unreleased]: https://github.com/raintree-technology/perps/compare/v0.1.1...HEAD
+[Unreleased]: https://github.com/raintree-technology/perps/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/raintree-technology/perps/releases/tag/v0.1.2
 [0.1.1]: https://github.com/raintree-technology/perps/releases/tag/v0.1.1
 [0.1.0]: https://github.com/raintree-technology/perps/releases/tag/v0.1.0

package/README.md

@@ -1,6 +1,6 @@
 # perps
 
-Universal CLI for perpetual DEXes — by [Raintree Technology](https://raintree.technology).
+Universal CLI for perpetual DEXes.
 
 [![CI](https://github.com/raintree-technology/perps/actions/workflows/ci.yml/badge.svg)](https://github.com/raintree-technology/perps/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@raintree-technology/perps)](https://www.npmjs.com/package/@raintree-technology/perps)
@@ -12,6 +12,22 @@ npm install -g @raintree-technology/perps
 perps --help
 ```
 
+## Install Paths
+
+Canonical install path:
+
+```bash
+npm install -g @raintree-technology/perps
+```
+
+GitHub install path (for source snapshots and pre-release testing):
+
+```bash
+npm install github:raintree-technology/perps
+```
+
+The package includes lifecycle build hooks so git installs produce runnable CLI artifacts (`dist/`) automatically.
+
 ## Supported Exchanges
 
 | Exchange | Chain | Status | Onboarding |
@@ -57,7 +73,7 @@ perps data ccxt binanceusdm fetchTicker --args '["BTC/USDT:USDT"]' --json
 Credentials are handled with care:
 
 - **Testnet by default** — mainnet requires explicit `--mainnet` flag or `*_NETWORK=mainnet` env var
-- **Encrypted at rest** — `perps setup wizard` stores keys in an AES-256-GCM encrypted local vault (`~/.perp/`)
+- **Encrypted at rest** — setup flows (including `perps setup wizard` and `perps setup decibel-key`) store secrets in an AES-256-GCM local vault (`~/.perp/`)
 - **Owner-only permissions** — all credential files are `chmod 600`, directories `chmod 700`
 - **Env vars supported** — standard `HYPERLIQUID_PRIVATE_KEY`, `AEVO_SIGNING_KEY`, etc. for CI/automation
 - **No telemetry, no phoning home** — your keys and trades stay on your machine
@@ -87,6 +103,10 @@ All five adapters implement the same `PerpDEXAdapter` interface — swap `Hyperl
 # Recommended: interactive wizard
 perps setup wizard
 
+# Decibel key helper: guide + validate + store in encrypted vault (env export optional)
+perps setup decibel-key
+perps setup decibel-key --env-file .env.local
+
 # Or set env vars directly
 export HYPERLIQUID_PRIVATE_KEY="0x..."
 ```
@@ -98,7 +118,7 @@ export HYPERLIQUID_PRIVATE_KEY="0x..."
 |----------|-------|---------|
 | Hyperliquid | `HYPERLIQUID_WALLET_ADDRESS` | `HYPERLIQUID_PRIVATE_KEY` |
 | Aevo | `AEVO_API_KEY` + `AEVO_API_SECRET` | + `AEVO_SIGNING_KEY` |
-| Decibel | `DECIBEL_API_WALLET_ADDRESS` + `DECIBEL_API_BEARER_TOKEN` | + `DECIBEL_API_WALLET_PRIVATE_KEY` |
+| Decibel | Market data: `DECIBEL_API_BEARER_TOKEN`; account reads: + `DECIBEL_API_WALLET_ADDRESS` | + `DECIBEL_API_WALLET_PRIVATE_KEY` |
 | Orderly | `ORDERLY_ACCOUNT_ID` + `ORDERLY_KEY` + `ORDERLY_SECRET` | + `ORDERLY_TRADING_SECRET` |
 | Paradex | `PARADEX_ACCOUNT_ADDRESS` + `PARADEX_PRIVATE_KEY` | same |
 
@@ -125,12 +145,25 @@ perps signal --help           # Trade signals
 perps replay --help           # Execution replay
 perps data --help             # Raw exchange data (ccxt, pmxt)
 perps setup --help            # Onboarding wizard
+perps setup decibel-key --help # Decibel bearer key bootstrap + vault storage
 perps config --help           # Settings (show, get, set)
 perps doctor                  # Health check
 ```
 
 Every command supports `--json` for machine-readable output and `--help` for usage details.
 
+Agent-friendly mode:
+
+```bash
+# Non-interactive execution
+perps setup wizard --yes --json
+
+# Machine-readable responses with schema version
+perps markets ls --json
+```
+
+JSON payloads are schema-versioned, and failures return deterministic exit codes.
+
 ## Exit Codes
 
 | Code | Meaning |
@@ -164,7 +197,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. Please read our [Code of
 
 ## Author
 
-[Raintree Technology](https://raintree.technology) ([@raintree_tech](https://x.com/raintree_tech)) — created by [Zachary Roth](https://zacharyr0th.com) ([@zacharyr0th](https://x.com/zacharyr0th))
+[Raintree Technology](https://raintree.technology)
 
 ## License
 

package/dist/adapters/decibel/order-manager.js

@@ -27,7 +27,7 @@ export class DecibelOrderManager {
         const chainSize = formatSize(sizeUnits, market);
         const isBuy = side === "buy";
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::place_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::place_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [
                 this.subaccountAddress,
@@ -68,7 +68,7 @@ export class DecibelOrderManager {
     }
     async cancelOrder(orderId, marketAddr) {
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::cancel_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::cancel_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, orderId, marketAddr],
         };
@@ -85,7 +85,7 @@ export class DecibelOrderManager {
     }
     async cancelAllOrders(marketAddr) {
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::cancel_bulk_order_to_subaccount`,
+            function: `${this.packageAddress}::dex_accounts_entry::cancel_bulk_order_to_subaccount`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, marketAddr],
         };
@@ -103,7 +103,7 @@ export class DecibelOrderManager {
     async configureUserSettingsForMarket(marketAddr, isCross, userLeverageBps) {
         const leverageBps = Math.max(1, Math.round(userLeverageBps));
         const payload = {
-            function: `${this.packageAddress}::dex_accounts::configure_user_settings_for_market`,
+            function: `${this.packageAddress}::dex_accounts_entry::configure_user_settings_for_market`,
             typeArguments: [],
             functionArguments: [this.subaccountAddress, marketAddr, isCross, leverageBps],
         };

package/dist/adapters/decibel/rest-client.js

@@ -112,7 +112,7 @@ export class DecibelRestClient {
         };
         if (requiresAuth) {
             if (!this.bearerToken) {
-                throw new Error(`Decibel endpoint '${path}' requires DECIBEL_API_BEARER_TOKEN`);
+                throw new Error(`Decibel endpoint '${path}' requires DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).`);
             }
             headers.Authorization = `Bearer ${this.bearerToken}`;
         }

package/dist/adapters/decibel/ws-feed.js

@@ -41,9 +41,21 @@ export class DecibelWsFeed extends EventEmitter {
         this.shouldReconnect = false;
         this.clearReconnectTimer();
         this.stopPing();
-        this.ws?.removeAllListeners();
-        this.ws?.close();
+        const ws = this.ws;
         this.ws = null;
+        if (!ws) {
+            return;
+        }
+        // Closing a CONNECTING socket can emit an error from ws; keep a no-op handler
+        // so shutdown does not crash the process.
+        if (ws.readyState === WebSocket.CONNECTING) {
+            ws.once("error", () => { });
+            ws.terminate();
+            return;
+        }
+        if (ws.readyState === WebSocket.OPEN) {
+            ws.close();
+        }
     }
     isConnected() {
         return this.ws?.readyState === WebSocket.OPEN;

package/dist/adapters/decibel.js

@@ -14,13 +14,13 @@ const DECIBEL_DEFAULTS = {
         fullnodeUrl: "https://api.testnet.aptoslabs.com/v1",
         restUrl: "https://api.testnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.testnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0x95254fcb0816b9f3ec71aa4de5f5f7f8f3efeef9239f0d705a4cd3fe2f452de3",
+        packageAddress: "0x952535c3049e52f195f26798c2f1340d7dd5100edbe0f464e520a974d16fbe9f",
     },
     mainnet: {
         fullnodeUrl: "https://api.mainnet.aptoslabs.com/v1",
         restUrl: "https://api.mainnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.mainnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0xb8a5788314451ce4d2fbbad32e1bad88d4184b73943b7fe5166eab93cf1a5a95",
+        packageAddress: "0x50ead22afd6ffd9769e3b3d6e0e64a2a350d68e8b102c4e72e33d0b8cfdfdb06",
     },
 };
 export class DecibelAdapter {
@@ -809,15 +809,15 @@ export class DecibelAdapter {
     }
     ensureAccountReadAuth() {
         if (!this.accountAddress) {
-            throw new Error("Decibel account reads require account address (set DECIBEL_API_WALLET_ADDRESS or subaccount).");
+            throw new Error("Decibel account reads require account address (set DECIBEL_API_WALLET_ADDRESS or DECIBEL_SUBACCOUNT_ADDRESS).");
         }
         if (!this.config?.credentials?.apiBearerToken) {
-            throw new Error("Decibel account reads require DECIBEL_API_BEARER_TOKEN.");
+            throw new Error("Decibel account reads require DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).");
         }
     }
     ensureOrderManager() {
         if (!this.orderManager) {
-            throw new Error("Decibel trading requires private key + package settings + subaccount (DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN).");
+            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN, and package/network settings.");
         }
     }
     requireMarket(symbol) {

package/dist/cli/experience.js

@@ -107,7 +107,6 @@ export function printSessionBanner(args) {
     for (const line of getPerpsAsciiMark()) {
         console.log(highlighter.brand(line));
     }
-    console.log(highlighter.dim("by Raintree Technology"));
     console.log("");
     console.log(`${highlighter.dim("mode")} ${networkTag}  ${highlighter.dim("exchange")} ${exchangeTag}`);
     console.log(`${highlighter.dim("command")} ${commandTag}  ${highlighter.dim("version")} ${highlighter.dim(`v${args.version}`)}`);

package/dist/cli/program.js

@@ -8,6 +8,8 @@ import { createContext } from "./context.js";
 import { highlighter, printCommandCompletion, printSessionBanner } from "./experience.js";
 import { commandPathFromCommand, resolveTestnetMode } from "./network-defaults.js";
 import { outputError } from "./output.js";
+import { inferExitCode } from "../lib/exit-codes.js";
+import { withJsonContract } from "../lib/contracts.js";
 const require = createRequire(import.meta.url);
 const pkg = require("../../package.json");
 const commandMeta = new WeakMap();
@@ -30,6 +32,7 @@ export function createProgram() {
         .description("Universal CLI for perpetual DEXes")
         .showSuggestionAfterError(true)
         .showHelpAfterError()
+        .exitOverride()
         .version(pkg.version)
         .option("--json", "Output in JSON format", false)
         .option("--human", "Enable human-first output UX (banner, timing, rich formatting)", false)
@@ -62,17 +65,37 @@ Examples:
             setExchange(opts.exchange);
         }
         catch (err) {
-            outputError(err instanceof Error ? err.message : String(err));
-            console.error(highlighter.dim(`Available exchanges: ${getAvailableExchanges().join(", ")}`));
-            process.exit(1);
+            const message = err instanceof Error ? err.message : String(err);
+            const exitCode = inferExitCode(err);
+            if (opts.json) {
+                console.error(JSON.stringify(withJsonContract("perps.error", {
+                    status: "error",
+                    error: { message, exitCode },
+                }), null, 2));
+            }
+            else {
+                outputError(message);
+                console.error(highlighter.dim(`Available exchanges: ${getAvailableExchanges().join(", ")}`));
+            }
+            process.exit(exitCode);
         }
         let config;
         try {
             config = loadConfig(isTestnet, opts.exchange);
         }
         catch (err) {
-            outputError(err instanceof Error ? err.message : String(err));
-            process.exit(1);
+            const message = err instanceof Error ? err.message : String(err);
+            const exitCode = inferExitCode(err);
+            if (opts.json) {
+                console.error(JSON.stringify(withJsonContract("perps.error", {
+                    status: "error",
+                    error: { message, exitCode },
+                }), null, 2));
+            }
+            else {
+                outputError(message);
+            }
+            process.exit(exitCode);
         }
         const context = createContext(config);
         // Store metadata on the root command

package/dist/commands/asset/book-simple.js

@@ -1,9 +1,10 @@
 /**
  * Simple order book command using the adapter interface
  */
-import { getContext, getOutputOptions } from "../../cli/program.js";
+import { getContext, getOutputOptions, getSelectedExchange } from "../../cli/program.js";
 import { output, outputError } from "../../cli/output.js";
 import { getExchangeAdapter } from "../../lib/exchange.js";
+import { getExchangeCredentials } from "../../lib/config.js";
 export function registerBookSimpleCommand(asset) {
     asset
         .command("book <symbol>")
@@ -12,12 +13,19 @@ export function registerBookSimpleCommand(asset) {
         .action(async function (symbol) {
         const ctx = getContext(this);
         const outputOpts = getOutputOptions(this);
+        const exchangeId = getSelectedExchange(this);
         const opts = this.opts();
         const depth = parseInt(opts.depth, 10);
         const adapter = getExchangeAdapter();
         let connected = false;
         try {
-            await adapter.connect({ testnet: ctx.config.testnet });
+            const credentials = getExchangeCredentials(ctx.config, exchangeId);
+            await adapter.connect({
+                testnet: ctx.config.testnet,
+                rpcUrl: credentials.fullnodeUrl,
+                wsUrl: credentials.wsUrl,
+                credentials,
+            });
             connected = true;
             // Normalize symbol (accept BTC, BTC-PERP, btc, etc.)
             let market = symbol.toUpperCase();

package/dist/commands/markets/ls-simple.js

@@ -6,6 +6,7 @@
 import { output, outputError } from "../../cli/output.js";
 import { getContext, getOutputOptions, getVerbose } from "../../cli/program.js";
 import { getAvailableExchanges, getExchangeAdapter, getExchangeAdapterById, } from "../../lib/exchange.js";
+import { getExchangeCredentials } from "../../lib/config.js";
 import { pLimit } from "../../lib/rate-limit.js";
 export function registerMarketsLsSimpleCommand(markets) {
     markets
@@ -38,7 +39,8 @@ async function handleSingleExchange(ctx, outputOpts, opts, limit = 0) {
     const adapter = getExchangeAdapter();
     let connected = false;
     try {
-        await adapter.connect({ testnet: ctx.config.testnet });
+        const credentials = getExchangeCredentials(ctx.config, adapter.info.id);
+        await adapter.connect({ testnet: ctx.config.testnet, credentials });
         connected = true;
         const markets = await adapter.getMarkets();
         let filtered = markets;
@@ -88,7 +90,8 @@ async function fetchAllExchangeMarkets(ctx) {
     const connectedAdapters = [];
     const tasks = exchangeIds.map((id) => async () => {
         const adapter = getExchangeAdapterById(id);
-        await adapter.connect({ testnet: ctx.config.testnet });
+        const credentials = getExchangeCredentials(ctx.config, id);
+        await adapter.connect({ testnet: ctx.config.testnet, credentials });
         connectedAdapters.push(adapter);
         const markets = await adapter.getMarkets();
         return { id, name: adapter.info.name, markets };

package/dist/commands/setup/index.js

@@ -1,14 +1,81 @@
-import { existsSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { getOutputOptions } from "../../cli/program.js";
 import { output, outputError, outputSuccess } from "../../cli/output.js";
 import { withJsonContract } from "../../lib/contracts.js";
 import { createAccount, getAccountByAliasForExchange, } from "../../lib/db/index.js";
 import { privateKeyToAccount } from "viem/accounts";
-import { getCredentialVaultSummary, saveOnboardingProfileToVault, } from "../../lib/credential-vault.js";
+import { getCredentialVaultSummary, getLatestCredentialVaultSecret, saveSecretToCredentialVault, saveOnboardingProfileToVault, } from "../../lib/credential-vault.js";
 import { ALL_SETUP_CHAINS, ALL_SETUP_EXCHANGES, buildOnboardingEnvFile, parseSetupChains, parseSetupExchanges, parseSetupMode, resolveExchangesFromChains, runOnboardingStateMachine, } from "../../lib/onboarding.js";
-import { confirm, multiSelect, select } from "../../lib/prompts.js";
+import { confirm, multiSelect, pressEnterOrEsc, prompt, select } from "../../lib/prompts.js";
 import { hardenPrivateFile, PRIVATE_FILE_MODE } from "../../lib/fs-security.js";
+import { FetchError, fetchWithTimeout } from "../../lib/fetch.js";
+const DECIBEL_REST_DEFAULTS = {
+    mainnet: "https://api.mainnet.aptoslabs.com/decibel",
+    testnet: "https://api.testnet.aptoslabs.com/decibel",
+};
+function normalizeText(value) {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function normalizeNetwork(value) {
+    const normalized = normalizeText(value)?.toLowerCase();
+    if (normalized === "testnet")
+        return "testnet";
+    return "mainnet";
+}
+function resolveDecibelNetwork(opts, command) {
+    if (opts.network) {
+        return normalizeNetwork(opts.network);
+    }
+    const globalOpts = command.optsWithGlobals();
+    if (globalOpts.mainnet)
+        return "mainnet";
+    if (globalOpts.testnet)
+        return "testnet";
+    return normalizeNetwork(process.env.DECIBEL_NETWORK);
+}
+function resolveDecibelRestUrl(opts, command) {
+    const explicit = normalizeText(opts.restUrl) ?? normalizeText(process.env.DECIBEL_REST_URL);
+    if (explicit) {
+        return explicit.replace(/\/+$/, "");
+    }
+    return DECIBEL_REST_DEFAULTS[resolveDecibelNetwork(opts, command)];
+}
+function openExternalUrl(url) {
+    const platform = process.platform;
+    if (platform === "darwin") {
+        execFileSync("open", [url], { stdio: "ignore" });
+        return;
+    }
+    if (platform === "win32") {
+        execFileSync("cmd", ["/c", "start", "", url], { stdio: "ignore" });
+        return;
+    }
+    execFileSync("xdg-open", [url], { stdio: "ignore" });
+}
+function upsertEnvVar(content, key, value) {
+    const lines = content.split(/\r?\n/);
+    const matcher = new RegExp(`^\\s*#?\\s*${key}=`);
+    let replaced = false;
+    const next = lines.map((line) => {
+        if (matcher.test(line)) {
+            replaced = true;
+            return `${key}=${value}`;
+        }
+        return line;
+    });
+    if (!replaced) {
+        if (next.length > 0 && next[next.length - 1].trim() !== "") {
+            next.push("");
+        }
+        next.push(`${key}=${value}`);
+    }
+    return `${next.join("\n").replace(/\n+$/, "")}\n`;
+}
 const MODE_DESCRIPTIONS = {
     "mainnet-data": "No credentials. Use real mainnet data immediately.",
     "testnet-execution": "Force selected exchanges to testnet for all commands.",
@@ -37,8 +104,11 @@ function normalizeAuthOptions(opts) {
     const orderlyChainId = opts.orderlyChainId ??
         process.env.ORDERLY_CHAIN_ID ??
         process.env.ORDERLY_TESTNET_FAUCET_CHAIN_ID;
+    const vaultDecibelBearer = getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN");
     return {
-        decibelBearerToken: opts.decibelBearerToken ?? process.env.DECIBEL_API_BEARER_TOKEN,
+        decibelBearerToken: opts.decibelBearerToken ??
+            process.env.DECIBEL_API_BEARER_TOKEN ??
+            vaultDecibelBearer,
         aevoApiKey: opts.aevoApiKey ?? process.env.AEVO_API_KEY,
         aevoApiSecret: opts.aevoApiSecret ?? process.env.AEVO_API_SECRET,
         aevoAccountPrivateKey: (opts.aevoAccountPrivateKey ??
@@ -302,6 +372,224 @@ function printWizardSummary(args) {
 }
 export function registerSetupCommands(program) {
     const setup = program.command("setup").description("Onboarding and environment setup");
+    setup
+        .command("decibel-key")
+        .description("Bootstrap a Decibel Client API key flow, validate it, and store it in the encrypted vault")
+        .option("--token <token>", "Decibel Client API key secret (overrides DECIBEL_API_BEARER_TOKEN)")
+        .option("--wallet-address <address>", "Account address to check with account_overview")
+        .option("--subaccount-address <address>", "Subaccount address to check with account_overview")
+        .option("--network <network>", "Decibel network (mainnet or testnet)")
+        .option("--rest-url <url>", "Decibel REST URL override")
+        .option("--env-file <path>", "Write/update DECIBEL_API_BEARER_TOKEN in this env file")
+        .option("--no-vault", "Skip encrypted vault persistence for DECIBEL_API_BEARER_TOKEN")
+        .option("--no-open-browser", "Do not open Geomi/API keys pages automatically")
+        .option("--require-account", "Fail if account_overview check fails")
+        .option("--yes", "Skip interactive confirmations")
+        .action(async function () {
+        const outputOpts = getOutputOptions(this);
+        const opts = this.opts();
+        const hasInteractiveTty = process.stdin.isTTY && process.stdout.isTTY;
+        const assumeDefaults = Boolean(opts.yes) || !hasInteractiveTty;
+        const network = resolveDecibelNetwork(opts, this);
+        const restUrl = resolveDecibelRestUrl(opts, this);
+        const persistToVault = opts.vault ?? true;
+        try {
+            const vaultToken = normalizeText(getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN"));
+            let tokenSource = "interactive";
+            let token = normalizeText(opts.token);
+            if (token) {
+                tokenSource = "cli";
+            }
+            else {
+                token = normalizeText(process.env.DECIBEL_API_BEARER_TOKEN);
+                if (token) {
+                    tokenSource = "env";
+                }
+                else if (vaultToken) {
+                    token = vaultToken;
+                    tokenSource = "vault";
+                }
+            }
+            const usedInteractiveCapture = !token;
+            if (!token) {
+                if (!hasInteractiveTty) {
+                    throw new Error("No Decibel API key found. Pass --token, set DECIBEL_API_BEARER_TOKEN, or run once interactively to store it in the encrypted vault.");
+                }
+                console.log("Decibel key generation is currently handled in Geomi (web UI).");
+                if (opts.openBrowser ?? true) {
+                    let shouldOpen = true;
+                    if (!assumeDefaults) {
+                        shouldOpen = await pressEnterOrEsc("Press Enter to open Decibel + Geomi API keys pages (or Esc to skip)");
+                    }
+                    if (shouldOpen) {
+                        try {
+                            openExternalUrl("https://app.decibel.trade");
+                            openExternalUrl("https://app.decibel.trade/geomi");
+                        }
+                        catch {
+                            // Fall through with manual links.
+                        }
+                    }
+                }
+                console.log("");
+                console.log("Create/copy your Key Secret from Geomi -> API Keys, then paste it below.");
+                token = normalizeText(await prompt("Paste DECIBEL_API_BEARER_TOKEN (Key Secret):"));
+                if (!token) {
+                    throw new Error("No Decibel API key provided.");
+                }
+                tokenSource = "interactive";
+            }
+            const headers = {
+                Authorization: `Bearer ${token}`,
+                Origin: "https://app.decibel.trade",
+            };
+            const marketsUrl = new URL("api/v1/markets", `${restUrl.replace(/\/+$/, "")}/`).toString();
+            const markets = await fetchWithTimeout(marketsUrl, {
+                headers,
+                retries: 0,
+            });
+            const marketCount = Array.isArray(markets) ? markets.length : 0;
+            if (marketCount === 0) {
+                throw new Error("Decibel token validated but returned no markets.");
+            }
+            const accountAddress = normalizeText(opts.subaccountAddress) ??
+                normalizeText(opts.walletAddress) ??
+                normalizeText(process.env.DECIBEL_SUBACCOUNT_ADDRESS) ??
+                normalizeText(process.env.DECIBEL_API_WALLET_ADDRESS);
+            let accountCheck;
+            if (accountAddress) {
+                const accountUrl = new URL("api/v1/account_overview", `${restUrl.replace(/\/+$/, "")}/`);
+                accountUrl.searchParams.set("account", accountAddress);
+                try {
+                    await fetchWithTimeout(accountUrl.toString(), {
+                        headers,
+                        retries: 0,
+                    });
+                    accountCheck = {
+                        status: "ok",
+                        detail: `account_overview succeeded for ${accountAddress}`,
+                    };
+                }
+                catch (err) {
+                    const detail = err instanceof Error ? err.message : String(err);
+                    accountCheck = {
+                        status: "failed",
+                        detail: `account_overview failed for ${accountAddress}: ${detail}`,
+                    };
+                    if (opts.requireAccount) {
+                        throw new Error(accountCheck.detail);
+                    }
+                }
+            }
+            else {
+                accountCheck = {
+                    status: "skipped",
+                    detail: "No DECIBEL_API_WALLET_ADDRESS/DECIBEL_SUBACCOUNT_ADDRESS provided.",
+                };
+            }
+            let vaultRef;
+            let vaultStatus = "disabled";
+            let vaultPath;
+            if (persistToVault) {
+                vaultPath = getCredentialVaultSummary().path;
+                if (vaultToken === token) {
+                    vaultStatus = "unchanged";
+                }
+                else {
+                    vaultRef = saveSecretToCredentialVault("DECIBEL_API_BEARER_TOKEN", token, {
+                        mode: "setup.decibel-key",
+                        exchange: "decibel",
+                    });
+                    vaultStatus = "stored";
+                    vaultPath = vaultRef.path;
+                }
+            }
+            let envFilePath;
+            if (opts.envFile) {
+                envFilePath = resolve(opts.envFile.trim());
+                const existing = existsSync(envFilePath) ? readFileSync(envFilePath, "utf8") : "";
+                const updated = upsertEnvVar(existing, "DECIBEL_API_BEARER_TOKEN", token);
+                writeFileSync(envFilePath, updated, { mode: PRIVATE_FILE_MODE });
+                hardenPrivateFile(envFilePath);
+            }
+            const nextSteps = envFilePath
+                ? [
+                    `source ${envFilePath}`,
+                    "perps markets ls -e decibel",
+                    "perps asset book BTC-PERP -e decibel",
+                ]
+                : persistToVault
+                    ? [
+                        "perps markets ls -e decibel",
+                        "perps asset book BTC-PERP -e decibel",
+                    ]
+                    : [
+                        "Export DECIBEL_API_BEARER_TOKEN in your shell (or re-run without --no-vault).",
+                        "perps markets ls -e decibel",
+                        "perps asset book BTC-PERP -e decibel",
+                    ];
+            const payload = withJsonContract("setup.decibel_key.result", {
+                network,
+                restUrl,
+                tokenSource,
+                tokenCapturedInteractively: usedInteractiveCapture,
+                tokenValidated: true,
+                marketCount,
+                accountCheck,
+                vault: {
+                    enabled: persistToVault,
+                    status: vaultStatus,
+                    id: vaultRef?.id,
+                    path: vaultPath,
+                },
+                envFile: envFilePath,
+                envVar: "DECIBEL_API_BEARER_TOKEN",
+                nextSteps,
+            });
+            if (outputOpts.json) {
+                output(payload, outputOpts);
+                return;
+            }
+            outputSuccess("Decibel API key validated successfully.");
+            console.log("");
+            console.log(`Network:          ${network}`);
+            console.log(`REST URL:         ${restUrl}`);
+            console.log(`Markets checked:  ${marketCount}`);
+            console.log(`Token source:     ${tokenSource}`);
+            if (accountCheck) {
+                console.log(`Account check:    [${accountCheck.status}] ${accountCheck.detail}`);
+            }
+            if (persistToVault && vaultPath) {
+                if (vaultStatus === "stored" && vaultRef) {
+                    console.log(`Vault:            stored ${vaultRef.id} (${vaultPath})`);
+                }
+                else {
+                    console.log(`Vault:            unchanged (${vaultPath})`);
+                }
+            }
+            else {
+                console.log("Vault:            skipped (--no-vault)");
+            }
+            if (envFilePath) {
+                console.log(`Env file:         ${envFilePath}`);
+            }
+            console.log("");
+            console.log("Next steps:");
+            for (const [index, step] of nextSteps.entries()) {
+                console.log(`${index + 1}) ${step}`);
+            }
+            console.log("");
+        }
+        catch (err) {
+            const message = err instanceof FetchError
+                ? `Decibel key bootstrap failed: ${err.message}`
+                : err instanceof Error
+                    ? err.message
+                    : String(err);
+            outputError(message);
+            process.exit(1);
+        }
+    });
     setup
         .command("wizard")
         .description("Interactive setup for mainnet data defaults and testnet onboarding")

package/dist/index.js

@@ -1,4 +1,38 @@
 #!/usr/bin/env node
 import { createProgram } from "./cli/program.js";
+import { withJsonContract } from "./lib/contracts.js";
+import { inferExitCode } from "./lib/exit-codes.js";
+const isJsonMode = process.argv.includes("--json");
 const program = createProgram();
-program.parse();
+if (isJsonMode) {
+    program.configureOutput({
+        writeOut: () => undefined,
+        writeErr: () => undefined,
+    });
+}
+try {
+    await program.parseAsync(process.argv);
+}
+catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const commanderExitCode = typeof err === "object" && err !== null && "exitCode" in err
+        ? Number(err.exitCode)
+        : Number.NaN;
+    const commanderCode = typeof err === "object" && err !== null && "code" in err
+        ? String(err.code ?? "")
+        : "";
+    const exitCode = Number.isFinite(commanderExitCode) && commanderExitCode === 0
+        ? 0
+        : commanderCode.startsWith("commander.")
+            ? inferExitCode(err)
+            : Number.isFinite(commanderExitCode)
+                ? commanderExitCode
+                : inferExitCode(err);
+    if (isJsonMode && exitCode !== 0) {
+        console.error(JSON.stringify(withJsonContract("perps.error", {
+            status: "error",
+            error: { message, exitCode },
+        }), null, 2));
+    }
+    process.exit(exitCode);
+}

package/dist/lib/config.js

@@ -1,5 +1,6 @@
 import { privateKeyToAccount } from "viem/accounts";
 import { getDefaultAccountForExchange } from "./db/index.js";
+import { getLatestCredentialVaultSecret } from "./credential-vault.js";
 import { parseEnv } from "./schema.js";
 import { recordTelemetryMetric } from "./telemetry.js";
 const DECIBEL_NETWORK_DEFAULTS = {
@@ -7,13 +8,13 @@ const DECIBEL_NETWORK_DEFAULTS = {
         fullnodeUrl: "https://api.testnet.aptoslabs.com/v1",
         restUrl: "https://api.testnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.testnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0x95254fcb0816b9f3ec71aa4de5f5f7f8f3efeef9239f0d705a4cd3fe2f452de3",
+        packageAddress: "0x952535c3049e52f195f26798c2f1340d7dd5100edbe0f464e520a974d16fbe9f",
     },
     mainnet: {
         fullnodeUrl: "https://api.mainnet.aptoslabs.com/v1",
         restUrl: "https://api.mainnet.aptoslabs.com/decibel",
         wsUrl: "wss://api.mainnet.aptoslabs.com/decibel/ws",
-        packageAddress: "0xb8a5788314451ce4d2fbbad32e1bad88d4184b73943b7fe5166eab93cf1a5a95",
+        packageAddress: "0x50ead22afd6ffd9769e3b3d6e0e64a2a350d68e8b102c4e72e33d0b8cfdfdb06",
     },
 };
 const ORDERLY_DEFAULTS = {
@@ -84,10 +85,14 @@ function resolveHyperliquidSettings(testnet, env) {
 function resolveDecibelSettings(testnet, env) {
     const network = resolveExchangeNetwork(testnet, env.DECIBEL_NETWORK);
     const defaults = DECIBEL_NETWORK_DEFAULTS[network];
+    const envBearerToken = env.DECIBEL_API_BEARER_TOKEN;
+    const vaultBearerToken = envBearerToken
+        ? undefined
+        : getLatestCredentialVaultSecret("DECIBEL_API_BEARER_TOKEN");
     const credentials = {
         apiWalletPrivateKey: env.DECIBEL_API_WALLET_PRIVATE_KEY,
         apiWalletAddress: env.DECIBEL_API_WALLET_ADDRESS,
-        apiBearerToken: env.DECIBEL_API_BEARER_TOKEN,
+        apiBearerToken: envBearerToken ?? vaultBearerToken,
         subaccountAddress: env.DECIBEL_SUBACCOUNT_ADDRESS,
     };
     const hasAnyCredentials = !!credentials.apiWalletPrivateKey ||
@@ -291,7 +296,7 @@ export function getExchangeCredentials(config, exchangeId, requirement = {}) {
         if (requirement.requireReadAccess &&
             (!credentials.apiBearerToken || !credentials.accountAddress)) {
             recordAuth("read", "failed");
-            throw new Error("Decibel authenticated reads require DECIBEL_API_WALLET_ADDRESS + DECIBEL_API_BEARER_TOKEN.");
+            throw new Error("Decibel authenticated reads require DECIBEL_API_WALLET_ADDRESS + DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys).");
         }
         if (requirement.requireReadAccess) {
             recordAuth("read", "success");
@@ -302,7 +307,7 @@ export function getExchangeCredentials(config, exchangeId, requirement = {}) {
                 !credentials.apiBearerToken ||
                 !credentials.packageAddress)) {
             recordAuth("trade", "failed");
-            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, DECIBEL_API_BEARER_TOKEN, and package/network settings.");
+            throw new Error("Decibel trading requires DECIBEL_API_WALLET_PRIVATE_KEY, DECIBEL_API_WALLET_ADDRESS, and DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys), plus package/network settings.");
         }
         if (requirement.requireTrading) {
             recordAuth("trade", "success");

package/dist/lib/credential-vault.d.ts

@@ -20,3 +20,11 @@ export declare function getCredentialVaultSummary(): {
     entries: number;
     updatedAt?: string;
 };
+export declare function getLatestCredentialVaultSecret(secretKey: string): string | undefined;
+export declare function saveSecretToCredentialVault(secretKey: string, secretValue: string, options?: {
+    mode?: string;
+    exchange?: string;
+}): {
+    id: string;
+    path: string;
+};

package/dist/lib/credential-vault.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { CREDENTIAL_VAULT_PATH } from "./paths.js";
-import { encryptSecret } from "./secrets.js";
+import { decryptSecret, encryptSecret } from "./secrets.js";
 import { ensurePrivateDir, hardenPrivateFile, PRIVATE_FILE_MODE } from "./fs-security.js";
 const VAULT_SCHEMA_VERSION = 1;
 function createVault() {
@@ -78,6 +78,25 @@ function buildId(profile) {
     const suffix = Math.random().toString(36).slice(2, 8);
     return `onb-${day}-${suffix}`;
 }
+function buildSecretId(now) {
+    const day = now.toISOString().slice(0, 10).replace(/-/g, "");
+    const suffix = Math.random().toString(36).slice(2, 8);
+    return `sec-${day}-${suffix}`;
+}
+function normalizeSecretKey(secretKey) {
+    const normalized = secretKey.trim().toUpperCase();
+    if (!/^[A-Z0-9_]+$/.test(normalized)) {
+        throw new Error(`Invalid vault secret key '${secretKey}'`);
+    }
+    return normalized;
+}
+function normalizeSecretValue(secretValue) {
+    const normalized = secretValue.trim();
+    if (!normalized) {
+        throw new Error("Vault secret value cannot be empty");
+    }
+    return normalized;
+}
 export function saveOnboardingProfileToVault(profile) {
     const vault = readVault();
     const id = buildId(profile);
@@ -107,3 +126,44 @@ export function getCredentialVaultSummary() {
         updatedAt: vault.updatedAt,
     };
 }
+export function getLatestCredentialVaultSecret(secretKey) {
+    const normalizedKey = normalizeSecretKey(secretKey);
+    const vault = readVault();
+    for (const entry of vault.entries) {
+        const encryptedValue = entry?.encrypted?.[normalizedKey];
+        if (typeof encryptedValue !== "string" || encryptedValue.trim().length === 0) {
+            continue;
+        }
+        try {
+            const plaintext = decryptSecret(encryptedValue).trim();
+            if (plaintext.length > 0) {
+                return plaintext;
+            }
+        }
+        catch {
+            // Skip malformed entries and continue searching older entries.
+        }
+    }
+    return undefined;
+}
+export function saveSecretToCredentialVault(secretKey, secretValue, options = {}) {
+    const key = normalizeSecretKey(secretKey);
+    const value = normalizeSecretValue(secretValue);
+    const now = new Date();
+    const vault = readVault();
+    const id = buildSecretId(now);
+    const entry = {
+        id,
+        createdAt: now.toISOString(),
+        mode: options.mode ?? "manual_secret",
+        exchanges: options.exchange ? [options.exchange] : [],
+        wallets: {},
+        encrypted: {
+            [key]: encryptSecret(value),
+        },
+    };
+    vault.entries.unshift(entry);
+    vault.updatedAt = now.toISOString();
+    writeVault(vault);
+    return { id, path: CREDENTIAL_VAULT_PATH };
+}

package/dist/lib/exit-codes.js

@@ -25,7 +25,11 @@ export function inferExitCode(err) {
     const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
     if (message.includes("must be") ||
         message.includes("invalid") ||
-        message.includes("use --yes with --json")) {
+        message.includes("use --yes with --json") ||
+        message.includes("unknown option") ||
+        message.includes("too many arguments") ||
+        message.includes("missing required argument") ||
+        message.includes("option argument missing")) {
         return EXIT_CODES.VALIDATION_ERROR;
     }
     if (message.includes("not configured") ||

package/dist/lib/onboarding.js

@@ -612,7 +612,7 @@ export async function bootstrapOnboardingAuth(profile, options = {}) {
                 exchange: "decibel",
                 service: "decibel auth",
                 status: "ok",
-                detail: "using DECIBEL_API_BEARER_TOKEN",
+                detail: "using DECIBEL_API_BEARER_TOKEN (Client API key secret)",
             });
         }
         else {
@@ -620,7 +620,7 @@ export async function bootstrapOnboardingAuth(profile, options = {}) {
                 exchange: "decibel",
                 service: "decibel auth",
                 status: "manual",
-                detail: "still requires DECIBEL_API_BEARER_TOKEN",
+                detail: "still requires DECIBEL_API_BEARER_TOKEN (Client API key secret from app.decibel.trade -> Geomi -> API Keys)",
             });
         }
     }
@@ -837,7 +837,7 @@ const ONBOARDING_PROVIDERS = {
         manualAuthFollowUp: {
             exchange: "decibel",
             env: ["DECIBEL_API_BEARER_TOKEN"],
-            detail: "Set a Decibel bearer token for authenticated reads/trading after wallet generation.",
+            detail: "Create a key in app.decibel.trade -> Geomi -> API Keys, copy the Key Secret, and set DECIBEL_API_BEARER_TOKEN.",
         },
         fundingTask: ({ profile, options }) => requestAptosFaucet({
             aptosAddress: profile.wallets.aptosAddress,

package/dist/lib/schema.d.ts

@@ -60,80 +60,80 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     EXECUTION_TAKE_PROFIT_PCT: number;
     EXECUTION_SPREAD_OFFSET_PCT: number;
     OPERATOR_HEARTBEAT_INTERVAL_MS: number;
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     PERPS_ALLOW_UNTRUSTED_ENDPOINTS?: "0" | "1" | "true" | "false" | undefined;
     PERPS_BLOCKED_EXCHANGES?: string | undefined;
     PERPS_BLOCKED_MARKETS?: string | undefined;
     PERPS_BLOCKED_MARKET_PATTERNS?: string | undefined;
     PERPS_REPUTATION_BLOCKLIST_FILE?: string | undefined;
 }, {
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     RISK_MAX_POSITION_SIZE_USD?: number | undefined;
     RISK_MAX_TOTAL_EXPOSURE_USD?: number | undefined;
     RISK_MAX_LEVERAGE?: number | undefined;
@@ -160,80 +160,80 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     EXECUTION_TAKE_PROFIT_PCT: number;
     EXECUTION_SPREAD_OFFSET_PCT: number;
     OPERATOR_HEARTBEAT_INTERVAL_MS: number;
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     PERPS_ALLOW_UNTRUSTED_ENDPOINTS?: "0" | "1" | "true" | "false" | undefined;
     PERPS_BLOCKED_EXCHANGES?: string | undefined;
     PERPS_BLOCKED_MARKETS?: string | undefined;
     PERPS_BLOCKED_MARKET_PATTERNS?: string | undefined;
     PERPS_REPUTATION_BLOCKLIST_FILE?: string | undefined;
 }, {
-    DECIBEL_REST_URL?: string | undefined;
-    DECIBEL_WS_URL?: string | undefined;
-    DECIBEL_FULLNODE_URL?: string | undefined;
-    AEVO_REST_URL?: string | undefined;
     ORDERLY_REST_URL?: string | undefined;
-    PARADEX_REST_URL?: string | undefined;
-    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
-    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
-    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
-    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
-    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    AEVO_REST_URL?: string | undefined;
+    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
     DECIBEL_API_BEARER_TOKEN?: string | undefined;
-    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
-    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
-    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
     AEVO_API_KEY?: string | undefined;
     AEVO_API_SECRET?: string | undefined;
-    AEVO_SIGNING_KEY?: string | undefined;
     AEVO_ACCOUNT_PRIVATE_KEY?: string | undefined;
-    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
-    ORDERLY_BROKER_ID?: string | undefined;
-    ORDERLY_CHAIN_ID?: string | undefined;
     ORDERLY_ACCOUNT_ID?: string | undefined;
     ORDERLY_KEY?: string | undefined;
     ORDERLY_SECRET?: string | undefined;
-    ORDERLY_TRADING_KEY?: string | undefined;
-    ORDERLY_TRADING_SECRET?: string | undefined;
-    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_BROKER_ID?: string | undefined;
     PARADEX_API_BEARER_TOKEN?: string | undefined;
-    PARADEX_ACCOUNT_ADDRESS?: string | undefined;
+    HYPERLIQUID_NETWORK?: "testnet" | "mainnet" | undefined;
+    DECIBEL_NETWORK?: "testnet" | "mainnet" | undefined;
+    AEVO_NETWORK?: "testnet" | "mainnet" | undefined;
+    ORDERLY_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
+    PARADEX_REST_URL?: string | undefined;
+    HYPERLIQUID_PRIVATE_KEY?: string | undefined;
+    DECIBEL_API_WALLET_PRIVATE_KEY?: string | undefined;
+    AEVO_SIGNING_KEY?: string | undefined;
+    ORDERLY_TRADING_SECRET?: string | undefined;
     PARADEX_PRIVATE_KEY?: string | undefined;
-    PARADEX_ETHEREUM_ACCOUNT?: string | undefined;
+    DECIBEL_REST_URL?: string | undefined;
+    DECIBEL_WS_URL?: string | undefined;
+    DECIBEL_FULLNODE_URL?: string | undefined;
+    HYPERLIQUID_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_API_WALLET_ADDRESS?: string | undefined;
+    DECIBEL_SUBACCOUNT_ADDRESS?: string | undefined;
+    DECIBEL_PACKAGE_ADDRESS?: string | undefined;
+    ORDERLY_CHAIN_ID?: string | undefined;
+    ORDERLY_TRADING_KEY?: string | undefined;
     PARADEX_CHAIN_ID?: string | undefined;
-    PARADEX_NETWORK?: "testnet" | "mainnet" | undefined;
     RISK_MAX_POSITION_SIZE_USD?: number | undefined;
     RISK_MAX_TOTAL_EXPOSURE_USD?: number | undefined;
     RISK_MAX_LEVERAGE?: number | undefined;

package/dist/lib/schema.js

@@ -34,9 +34,23 @@ const secureWsUrl = z
     message: "must use wss:// (ws:// allowed only for localhost)",
 });
 const EXCHANGE_URL_HOST_ALLOWLIST = {
-    DECIBEL_REST_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
-    DECIBEL_WS_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
-    DECIBEL_FULLNODE_URL: ["api.testnet.aptoslabs.com", "api.mainnet.aptoslabs.com"],
+    DECIBEL_REST_URL: [
+        "api.decibel.trade",
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
+    DECIBEL_WS_URL: [
+        "api.decibel.trade",
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
+    DECIBEL_FULLNODE_URL: [
+        "api.testnet.aptoslabs.com",
+        "api.netna.aptoslabs.com",
+        "api.mainnet.aptoslabs.com",
+    ],
     AEVO_REST_URL: ["api-testnet.aevo.xyz", "api.aevo.xyz"],
     ORDERLY_REST_URL: ["testnet-api.orderly.org", "api-evm.orderly.org"],
     PARADEX_REST_URL: ["api.testnet.paradex.trade", "api.prod.paradex.trade"],
@@ -118,13 +132,6 @@ export const envSchema = z
             message: "required when DECIBEL_API_WALLET_PRIVATE_KEY is set",
         });
     }
-    if (env.DECIBEL_API_BEARER_TOKEN && !env.DECIBEL_API_WALLET_ADDRESS) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["DECIBEL_API_WALLET_ADDRESS"],
-            message: "required when DECIBEL_API_BEARER_TOKEN is set",
-        });
-    }
     const aevoCredentialValues = [env.AEVO_API_KEY, env.AEVO_API_SECRET];
     const aevoCredentialCount = aevoCredentialValues.filter(Boolean).length;
     if (aevoCredentialCount === 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raintree-technology/perps",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Universal CLI for perpetual DEXes",
   "author": "Raintree Technology (https://raintree.technology)",
   "contributors": [
@@ -63,6 +63,8 @@
   "sideEffects": false,
   "scripts": {
     "build": "tsc",
+    "prepare": "npm run build",
+    "prepack": "npm run build",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
     "smoke": "node scripts/smoke.mjs",
@@ -82,7 +84,7 @@
     "lint:fix": "biome lint --write src scripts",
     "publint": "publint",
     "attw": "attw --pack . --profile esm-only",
-    "pack:check": "npm pack --dry-run",
+    "pack:check": "npm run build && npm pack --dry-run && node scripts/verify-pack.mjs",
     "prepublishOnly": "npm run build && npm run publint && npm run attw"
   },
   "dependencies": {
@@ -105,6 +107,7 @@
     "zod": "^3.24.0"
   },
   "devDependencies": {
+    "next": "^16.1.6",
     "@arethetypeswrong/cli": "^0.18.2",
     "@biomejs/biome": "^1.9.4",
     "@types/better-sqlite3": "^7.6.13",