fix: add slippage-bps validation in create, handle 5xx ghost orders

- Validate --slippage-bps range (0-10000) in create, matching update
- On 5xx errors during order creation, check recent orders to warn
  about potential duplicates before the user retries

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Pepewitch

src/limit-order.js

@@ -490,6 +490,12 @@ export function buildLimitOrderCommands(deps = {}) {
       const expiresStr = options.expires || '30d';
       const walletName = options.wallet;
 
+      if (slippageBps != null && (isNaN(slippageBps) || slippageBps < 0 || slippageBps > 10000)) {
+        log('Error: --slippage-bps must be between 0 and 10000 basis points.');
+        exit(1);
+        return;
+      }
+
       if (!from || !to || !amount || triggerPrice == null || !triggerMintRaw || !triggerCondition) {
         log(`
 Usage: nansen trade limit create --from <token> --to <token> --amount <amount> --trigger-mint <token> --trigger-condition <above|below> --trigger-price <usd>
@@ -584,12 +590,16 @@ EXAMPLES:
         return;
       }
 
+      let authToken = null;
+      let walletPubkey = null;
+
       try {
         // 1. Resolve wallet
         const resolved = await resolveSolanaWallet(walletName, deps);
         if (!resolved) return;
 
         let { pubkey, walletType, walletInfo } = resolved;
+        walletPubkey = pubkey;
 
         // For local wallets, load private key now
         if (walletType === 'local') {
@@ -604,25 +614,25 @@ EXAMPLES:
         log(`  Trigger: $${price} (${triggerCondition})`);
 
         // 2. Authenticate
-        const token = await authenticate(pubkey, walletType, walletInfo, log);
+        authToken = await authenticate(pubkey, walletType, walletInfo, log);
 
         // 3. Check vault, auto-register if needed
         // Backend returns { vaultPubkey: "..." } when vault exists, or throws/returns empty when not
         let hasVault = false;
         try {
-          const vaultInfo = await getVault(token, pubkey);
+          const vaultInfo = await getVault(authToken, pubkey);
           hasVault = !!vaultInfo?.vaultPubkey;
         } catch {
           // No vault found
         }
         if (!hasVault) {
           log('  Registering vault for first-time use...');
-          await registerVault(token);
+          await registerVault(authToken);
         }
 
         // 4. Craft deposit transaction
         log('  Crafting deposit transaction...');
-        const deposit = await craftDeposit(token, {
+        const deposit = await craftDeposit(authToken, {
           inputMint: from,
           outputMint: to,
           userAddress: pubkey,
@@ -650,7 +660,7 @@ EXAMPLES:
           ...(expiresAt != null ? { expiresAt } : {}),
         };
 
-        const result = await createOrder(token, orderParams);
+        const result = await createOrder(authToken, orderParams);
 
         log(`\n  ✓ Limit order created`);
         log(`    Order ID:     ${result.id}`);
@@ -659,6 +669,21 @@ EXAMPLES:
         log('');
 
       } catch (err) {
+        // 5xx errors may indicate the order was created despite the error (e.g. gateway timeout).
+        // Check recent orders to warn the user before they retry and create duplicates.
+        if (err.status >= 500 && authToken && walletPubkey) {
+          log(`Warning: Order submission returned a server error, but may have succeeded.`);
+          log(`  Checking order status...`);
+          try {
+            const check = await listOrders(authToken, walletPubkey, { limit: 1 });
+            const recent = check.orders?.[0];
+            if (recent && recent.inputMint === from && recent.outputMint === to) {
+              log(`  Found recent matching order ${recent.id} (status: ${recent.status}).`);
+              log(`  Run: nansen trade limit list`);
+              return;
+            }
+          } catch { /* list check failed, fall through to error */ }
+        }
         log(`Error: ${err.message}`);
         if (err.details) log(`  Details: ${JSON.stringify(err.details)}`);
         if (err.cause) log(`  Cause: ${err.cause.message || err.cause}`);