[Kewe63]

Summary

• validate deterministic CLOB command inputs before resolving signers or authenticating
• cover single, batch, market-order, and reward-date inputs
• preserve authentication and submission behavior for valid commands

Problem

Several authenticated CLOB commands contacted authentication endpoints before parsing local arguments. Malformed values could therefore trigger credential-based network requests and return misleading authentication errors instead of local validation errors.

Approach

Token IDs, decimal values, CSV cardinality, amount semantics, and dates are parsed before the authenticated client is created. The existing authenticated paths are unchanged after validation succeeds.

Tests

• RED/GREEN loopback regression asserting malformed input performs zero HTTP requests
• valid-input control confirming authentication is still attempted
• full CLI integration suite: 51 passed
• CLOB unit tests: 11 passed
• cargo +1.91.1 fmt --check
• cargo +1.91.1 clippy --locked -- -D warnings
• git diff --check

Risk

Low to moderate. The change reorders deterministic parsing ahead of network setup but does not alter valid request construction or authentication.

Fixes #92

---

Note

Low Risk
Reorders deterministic parsing ahead of auth with no change to valid order submission or API call shapes; regression tests cover the new behavior.

Overview
Authenticated CLOB trading and reward commands now parse and validate local arguments before resolving the signer or opening an authenticated client, so bad token IDs, decimals, batch CSV lengths, amounts, and YYYY-MM-DD dates fail with clear CLI errors instead of hitting auth/network first.

Trading paths (create-order, post-orders, market-order): token/price/size (or amount) validation runs ahead of authenticate_with_signer; post-orders also validates all prices and sizes in bulk before the order loop.

Reward paths (rewards, earnings, earnings-markets): parse_date runs before authenticated_clob_client.

Tests add a loopback RequestFixture that points POLYMARKET_CLOB_HOST at a local server and asserts malformed inputs produce zero HTTP requests, with a control case confirming valid create-order input still attempts authentication.

^{Reviewed by Cursor Bugbot for commit 3681b29. Bugbot is set up for automated code reviews on this repo. Configure here.}