Release v1.14.1

Origin-SHA: 52ef447c3567b0003ad94b3598e72066fe9cfa09

Author: ryanio

.agents/rules.md

@@ -55,6 +55,8 @@ CLI (src/cli.ts)              SDK (src/sdk.ts)
 | `src/wallet/` | Wallet adapter re-exports from `@opensea/wallet-adapters` and chain ID resolution. |
 | `src/auth/store.ts` | Persists auth tokens to `~/.opensea/auth.json` (used by both `auth` and `login` commands). |
 | `src/auth/oauth-login.ts` | OAuth 2.1 authorization-code + PKCE loopback helper (used by the `login` command). |
+| `src/auth/siwe-login.ts` | SIWE sign-in helper (used by the `login` command for private-key server-side agents). |
+| `src/auth/private-key.ts` | Private-key resolution + wallet construction for SIWE login. |
 | `src/types/api.ts` | TypeScript interfaces matching OpenSea API v2 response shapes. |
 | `src/types/index.ts` | Re-exports API types plus internal config types. |
 
@@ -82,7 +84,7 @@ Each domain has both a CLI command file (`src/commands/<domain>.ts`) and an SDK
 - **accounts** - Account profile lookup
 - **api** - Low-level escape hatch to call any OpenSea API v2 endpoint (CLI only — no SDK class)
 - **assets** - Asset movement transactions (transfers)
-- **auth** - SIWE login and scoped token management (`login`, `status`, `refresh`, `revoke`, `tokens`, `scopes`, `clear`) plus API key requests (`request-key`)
+- **auth** - SIWE login and scoped token management (`login`, `link-wallet`, `status`, `refresh`, `revoke`, `tokens`, `scopes`, `clear`) plus API key requests (`request-key`)
 - **chains** - Chain information and supported networks
 - **collections** - Collection metadata, stats, traits
 - **drops** - NFT drop details, listing, and minting
@@ -97,8 +99,9 @@ Each domain has both a CLI command file (`src/commands/<domain>.ts`) and an SDK
 - **tokens** - Fungible token trending/top/details
 - **tools** - Search, list, and inspect registered AI agent tools (ERC-8257)
 - **transactions** - Transaction status and receipts
-- **login** - Keyless OAuth 2.1 (authorization-code + PKCE) login against the OpenSea authorization server; falls back to device flow for headless environments
+- **login** - Keyless OAuth 2.1 (authorization-code + PKCE) login against the OpenSea authorization server, or SIWE sign-in with a private key (`--private-key`) for server-side agents; falls back to device flow (`--device`) for headless environments
 - **wallet** - Inspect the active wallet adapter's security posture
+- **whoami** - Show the current authenticated wallet, scopes, and project roles decoded from the persisted access token (CLI only — no SDK class)
 
 ## Conventions
 

CHANGELOG.md

@@ -1,5 +1,15 @@
 # @opensea/cli
 
+## 1.14.1
+
+### Patch Changes
+
+- 06e96e1: Use the current SIWE session, scoped-token creation, token-exchange, session refresh, and session-only revocation endpoints in the SDK and CLI.
+- Updated dependencies [06e96e1]
+- Updated dependencies [feb1446]
+  - @opensea/sdk@11.4.9
+  - @opensea/api-types@0.8.2
+
 ## 1.14.0
 
 ### Minor Changes

README.md

@@ -66,7 +66,9 @@ server-side agents, set `OPENSEA_PRIVATE_KEY` and pass `--private-key` (or pass
 environment variable is recommended to keep the key out of shell history. The
 `api request` command supports GET, POST, PUT, PATCH, and DELETE plus JSON body
 files, so newly published scoped endpoints are available without waiting for a
-dedicated command.
+dedicated command. SIWE logins retain the session needed for session-only PAT
+revocation; `opensea auth revoke` refreshes that session before deleting the
+token.
 
 ## Quick Start
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensea/cli",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "type": "module",
   "description": "OpenSea CLI - Query the OpenSea API from the command line or programmatically",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@opensea/api-types": "^0.8.1",
-    "@opensea/sdk": "^11.4.8",
+    "@opensea/api-types": "^0.8.2",
+    "@opensea/sdk": "^11.4.9",
     "@opensea/wallet-adapters": "^0.3.3",
     "commander": "^14.0.3",
     "zod": "^4.3.6"

package.json

@@ -42,6 +42,7 @@ export interface SiweLoginResult {
   accessToken: string
   refreshToken: string
   scopedTokenId: string
+  sessionCookie: string
   expiresAt: Date
   requestedScopes: string[]
   scopes: string[]
@@ -130,6 +131,26 @@ export async function exchangeScopedToken(
   return response.json() as Promise<ScopedTokenExchangeResponse>
 }
 
+/**
+ * Rotate a SIWE browser session and return the replacement cookies. Scoped
+ * token management is session-only, so callers refresh before a management
+ * request instead of trying to use the wallet JWT as an administrator token.
+ */
+export async function refreshSiweSession(
+  baseUrl: string,
+  cookie: string,
+): Promise<string> {
+  const response = await fetch(`${baseUrl}/api/v2/auth/session/refresh`, {
+    method: "POST",
+    headers: { Cookie: cookie },
+  })
+  if (!response.ok) {
+    const body = await response.text().catch(() => "")
+    throw new Error(`Session refresh failed (${response.status}): ${body}`)
+  }
+  return sessionCookie(response.headers)
+}
+
 /**
  * Authenticate with SIWE using a private key and exchange the resulting
  * scoped token for a wallet-bound access token.
@@ -166,6 +187,8 @@ export async function loginWithSiwe({
   const { nonce } = (await nonceRes.json()) as { nonce: string }
 
   // 2. Build & sign SIWE message
+  // Webauth uses SIWE only to establish the wallet session. PAT scopes are
+  // authorized separately by the session-authenticated token request below.
   const message = createSiwxMessage({
     address,
     chainArch: "EVM",
@@ -239,6 +262,7 @@ export async function loginWithSiwe({
     accessToken: tokenData.accessToken,
     refreshToken: scopedToken.token,
     scopedTokenId: scopedToken.id,
+    sessionCookie: cookie,
     expiresAt,
     requestedScopes: scopes,
     scopes: grantedScopes,

src/auth/siwe-login.ts

@@ -17,6 +17,7 @@ export interface StoredToken {
   accessToken: string
   refreshToken: string
   scopedTokenId?: string
+  sessionCookie?: string
   expiresAt: string
   requestedScopes: string[]
   scopes: string[]
@@ -42,6 +43,7 @@ const storedTokenSchema = z
     accessToken: z.string().min(1),
     refreshToken: z.string().min(1),
     scopedTokenId: z.string().min(1).optional(),
+    sessionCookie: z.string().min(1).optional(),
     expiresAt: z.iso.datetime(),
     requestedScopes: z.array(z.string().min(1)),
     scopes: z.array(z.string().min(1)),
@@ -57,6 +59,23 @@ const storedTokenSchema = z
     authMethod: z.enum(["oauth", "siwe"]),
   })
   .strict()
+  .superRefine((token, context) => {
+    if (token.authMethod !== "siwe") return
+    if (!token.scopedTokenId) {
+      context.addIssue({
+        code: "custom",
+        path: ["scopedTokenId"],
+        message: "SIWE tokens require a scoped token id",
+      })
+    }
+    if (!token.sessionCookie) {
+      context.addIssue({
+        code: "custom",
+        path: ["sessionCookie"],
+        message: "SIWE tokens require session cookies",
+      })
+    }
+  })
 
 const authStoreSchema = z
   .object({

src/auth/store.ts

@@ -17,6 +17,7 @@ import {
   DEFAULT_TOKEN_TTL_SECONDS,
   exchangeScopedToken,
   loginWithSiwe,
+  refreshSiweSession,
 } from "../auth/siwe-login.js"
 import {
   clearTokens,
@@ -100,6 +101,7 @@ export function authCommand(
         accessToken: result.accessToken,
         refreshToken: result.refreshToken,
         scopedTokenId: result.scopedTokenId,
+        sessionCookie: result.sessionCookie,
         expiresAt: result.expiresAt.toISOString(),
         requestedScopes: result.requestedScopes,
         scopes: result.scopes,
@@ -368,12 +370,25 @@ export function authCommand(
       }
       const baseUrl = getBaseUrl() ?? DEFAULT_BASE_URL
       let res: Response
-      if (token.authMethod === "siwe" && token.scopedTokenId) {
+      if (token.authMethod === "siwe") {
+        if (!token.scopedTokenId || !token.sessionCookie) {
+          throw new Error(
+            "Stored SIWE login cannot manage its token. Run `opensea login --private-key` again.",
+          )
+        }
+        const refreshedCookie = await refreshSiweSession(
+          baseUrl,
+          token.sessionCookie,
+        )
+        // Refresh tokens rotate. Persist the replacement before revocation so
+        // a transient DELETE failure can be retried without reusing the old
+        // session token.
+        saveToken({ ...token, sessionCookie: refreshedCookie })
         res = await fetch(
           `${baseUrl}/api/v2/auth/tokens/${token.scopedTokenId}`,
           {
             method: "DELETE",
-            headers: { Authorization: `Bearer ${token.accessToken}` },
+            headers: { Cookie: refreshedCookie },
           },
         )
       } else {

src/commands/auth.ts

@@ -123,6 +123,7 @@ export function loginCommand(
             accessToken: result.accessToken,
             refreshToken: result.refreshToken,
             scopedTokenId: result.scopedTokenId,
+            sessionCookie: result.sessionCookie,
             expiresAt: result.expiresAt.toISOString(),
             requestedScopes: scopes,
             scopes: result.scopes,

src/commands/login.ts

@@ -114,13 +114,38 @@ describe("auth store", () => {
       ...baseToken,
       authMethod: "siwe" as const,
       scopedTokenId: "381768924447939181",
+      sessionCookie: "access_token=session; refresh_token=refresh",
     }
 
     saveToken(siweToken)
 
     expect(loadCurrentToken()).toEqual(siweToken)
   })
 
+  test("rejects SIWE stores without session management credentials", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {})
+    mkdirSync(`${testHome}/.opensea`, { recursive: true })
+    writeFileSync(
+      `${testHome}/.opensea/auth.json`,
+      JSON.stringify({
+        currentAddress: "0xabc",
+        tokens: {
+          "0xabc": {
+            ...baseToken,
+            address: "0xabc",
+            authMethod: "siwe",
+            scopedTokenId: "pat-id",
+          },
+        },
+      }),
+    )
+
+    expect(loadCurrentToken()).toBeUndefined()
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("corrupted or incompatible"),
+    )
+  })
+
   test("rejects prerelease stores missing requested scopes", () => {
     const warn = vi.spyOn(console, "warn").mockImplementation(() => {})
     mkdirSync(`${testHome}/.opensea`, { recursive: true })