Release v2.7.0

Origin-SHA: d8b784e51583e5cc3fd02c6a9268bd3395644983

### Minor Changes

- 931433c: Reject numeric option values that are not entirely numeric. `--limit 10foo`, `--limit 1.9`, `--limit 1e2`, `--limit 0x10`, and `--slippage 0.01%` used to be truncated to their numeric prefix and now fail with an "Invalid value" error. Integer options also reject values above `Number.MAX_SAFE_INTEGER`, and float options reject values that overflow to `Infinity`.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: douglasborthwick-crypto <douglasborthwick-crypto@users.noreply.github.com>
Co-authored-by: dumanoglu1 <dumanoglu1@users.noreply.github.com>
Co-authored-by: iborazzi <iborazzi@users.noreply.github.com>

Author: 6 people

AGENTS.md

@@ -23,7 +23,7 @@ pnpm run format
 
 1. **Never hand-roll API request/response types**. Import from `@opensea/api-types` via `src/types/api.ts`. Run `pnpm --filter @opensea/api-types run update-spec && pnpm --filter @opensea/api-types run build` before adding endpoints.
 2. **API path check**. `pnpm check-api-paths` (from the repo root) fails if source code references an `/api/v2/...` URL not in `packages/api-types/opensea-api.json`.
-3. **CLI commands are thin**. Parse args, call `OpenSeaClient`, format output with `formatOutput()`. Keep business logic in the client.
+3. **CLI commands are thin**. Parse args, call `OpenSeaClient`, format output with `formatOutput()` (or `outputGet()` from `src/output.ts` for plain GET commands, which also handles TOON). Keep business logic in the client.
 4. **One file per domain in `src/commands/`**. Register new commands in `src/commands/index.ts` and wire in `src/cli.ts`.
 5. **SDK classes in `src/sdk.ts`**. Add domain classes as `readonly` properties on `OpenSeaCLI` for programmatic consumers.
 6. **Auth session invariants**. Persisted tokens require access token, refresh token, wallet address, ISO expiration, scopes, and `oauth`/`siwe` method. Normalize only `0x`-prefixed EVM addresses to lowercase; preserve Solana base58 case.

CHANGELOG.md

@@ -1,5 +1,11 @@
 # @opensea/cli
 
+## 2.7.0
+
+### Minor Changes
+
+- 931433c: Reject numeric option values that are not entirely numeric. `--limit 10foo`, `--limit 1.9`, `--limit 1e2`, `--limit 0x10`, and `--slippage 0.01%` used to be truncated to their numeric prefix and now fail with an "Invalid value" error. Integer options also reject values above `Number.MAX_SAFE_INTEGER`, and float options reject values that overflow to `Infinity`.
+
 ## 2.6.1
 
 ### Patch Changes

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensea/cli",
-  "version": "2.6.1",
+  "version": "2.7.0",
   "type": "module",
   "description": "OpenSea CLI - Query the OpenSea API from the command line or programmatically",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@opensea/api-types": "^0.12.0",
-    "@opensea/sdk": "^12.9.0",
+    "@opensea/api-types": "^0.12.1",
+    "@opensea/sdk": "^12.9.1",
     "@opensea/wallet-adapters": "^1.2.1",
     "commander": "^14.0.3",
     "zod": "^4.3.6"

package.json

@@ -29,16 +29,19 @@ export function readJsonBodyOption<T = unknown>(
 }
 
 export function parseIntOption(value: string, name: string): number {
-  const parsed = Number.parseInt(value, 10)
-  if (Number.isNaN(parsed)) {
+  const parsed = Number(value)
+  if (!/^[+-]?\d+$/.test(value) || !Number.isSafeInteger(parsed)) {
     throw new Error(`Invalid value for ${name}: "${value}" is not an integer`)
   }
   return parsed
 }
 
 export function parseFloatOption(value: string, name: string): number {
-  const parsed = Number.parseFloat(value)
-  if (Number.isNaN(parsed)) {
+  const parsed = Number(value)
+  if (
+    !/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(value) ||
+    !Number.isFinite(parsed)
+  ) {
     throw new Error(`Invalid value for ${name}: "${value}" is not a number`)
   }
   return parsed

src/parse.ts

@@ -0,0 +1,94 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
+import { transactionsCommand } from "../../src/commands/transactions.js"
+import { type CommandTestContext, createCommandTestContext } from "../mocks.js"
+
+function writeTempFile(contents: string): { dir: string; file: string } {
+  const dir = mkdtempSync(join(tmpdir(), "opensea-cli-transactions-"))
+  const file = join(dir, "request.json")
+  writeFileSync(file, contents)
+  return { dir, file }
+}
+
+describe("transactionsCommand", () => {
+  let ctx: CommandTestContext
+
+  beforeEach(() => {
+    ctx = createCommandTestContext()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it("creates the receipt subcommand", () => {
+    const cmd = transactionsCommand(ctx.getClient, ctx.getFormat)
+
+    expect(cmd.name()).toBe("transactions")
+    expect(cmd.commands.map(command => command.name())).toContain("receipt")
+  })
+
+  it("posts the parsed request body to the receipt endpoint", async () => {
+    ctx.mockClient.post.mockResolvedValue({ status: "confirmed" })
+    const body = { swap_quote: { id: "quote-1" } }
+    const { dir, file } = writeTempFile(JSON.stringify(body))
+
+    const cmd = transactionsCommand(ctx.getClient, ctx.getFormat)
+    try {
+      await cmd.parseAsync(["receipt", "--request", file], { from: "user" })
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+
+    expect(ctx.mockClient.post).toHaveBeenCalledWith(
+      "/api/v2/transactions/receipt",
+      body,
+    )
+    expect(ctx.consoleSpy).toHaveBeenCalledWith(
+      JSON.stringify({ status: "confirmed" }, null, 2),
+    )
+  })
+
+  it("names the option and path when the request file is missing", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "opensea-cli-transactions-"))
+    const missing = join(dir, "missing.json")
+
+    const cmd = transactionsCommand(ctx.getClient, ctx.getFormat)
+    try {
+      await expect(
+        cmd.parseAsync(["receipt", "--request", missing], { from: "user" }),
+      ).rejects.toThrow(`--request: could not read or parse '${missing}': `)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+    expect(ctx.mockClient.post).not.toHaveBeenCalled()
+  })
+
+  it("names the option and path when the request file is invalid JSON", async () => {
+    const { dir, file } = writeTempFile("{ not json }")
+
+    const cmd = transactionsCommand(ctx.getClient, ctx.getFormat)
+    try {
+      await expect(
+        cmd.parseAsync(["receipt", "--request", file], { from: "user" }),
+      ).rejects.toThrow(`--request: could not read or parse '${file}': `)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+    expect(ctx.mockClient.post).not.toHaveBeenCalled()
+  })
+
+  it("requires --request", async () => {
+    const cmd = transactionsCommand(ctx.getClient, ctx.getFormat)
+    const receipt = cmd.commands.find(command => command.name() === "receipt")
+    expect(receipt).toBeDefined()
+    receipt?.exitOverride()
+
+    await expect(cmd.parseAsync(["receipt"], { from: "user" })).rejects.toThrow(
+      "error: required option '--request <file>' not specified",
+    )
+    expect(ctx.mockClient.post).not.toHaveBeenCalled()
+  })
+})

test/commands/transactions.test.ts

@@ -27,13 +27,38 @@ describe("parseIntOption", () => {
       'Invalid value for --limit: "" is not an integer',
     )
   })
+
+  it.each([
+    "10foo",
+    "1.9",
+    "1e2",
+    "0x10",
+    " 10",
+    "10\n",
+  ])('throws when "%s" is not entirely an integer', value => {
+    expect(() => parseIntOption(value, "--limit")).toThrow(
+      `Invalid value for --limit: "${value}" is not an integer`,
+    )
+  })
+
+  it("accepts the largest safe integer and rejects the next one", () => {
+    expect(parseIntOption("9007199254740991", "--before")).toBe(
+      Number.MAX_SAFE_INTEGER,
+    )
+    expect(() => parseIntOption("9007199254740992", "--before")).toThrow(
+      'Invalid value for --before: "9007199254740992" is not an integer',
+    )
+  })
 })
 
 describe("parseFloatOption", () => {
   it("parses valid floats", () => {
     expect(parseFloatOption("0.5", "--slippage")).toBe(0.5)
     expect(parseFloatOption("1", "--slippage")).toBe(1)
     expect(parseFloatOption("0.01", "--slippage")).toBe(0.01)
+    expect(parseFloatOption(".5", "--slippage")).toBe(0.5)
+    expect(parseFloatOption("1.", "--slippage")).toBe(1)
+    expect(parseFloatOption("1e-2", "--slippage")).toBe(0.01)
   })
 
   it("throws on non-numeric strings", () => {
@@ -47,6 +72,18 @@ describe("parseFloatOption", () => {
       'Invalid value for --slippage: "" is not a number',
     )
   })
+
+  it.each([
+    "0.5oops",
+    "0.01%",
+    "Infinity",
+    "1e309",
+    "1.5\n",
+  ])('throws when "%s" is not an entirely finite number', value => {
+    expect(() => parseFloatOption(value, "--slippage")).toThrow(
+      `Invalid value for --slippage: "${value}" is not a number`,
+    )
+  })
 })
 
 describe("readJsonBodyOption", () => {