@wevion/cli 1.0.2381 → 1.0.2382

package/openapi.json

@@ -22823,7 +22823,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Verifies password (or skips for users without a local password), then generates TOTP secret + QR code.",
+        "description": "Generates a new inactive TOTP secret and QR code for first-time 2FA setup. Account password is never required inside the app.",
         "requestBody": {
           "required": true,
           "content": {
@@ -22831,12 +22831,7 @@
               "schema": {
                 "additionalProperties": false,
                 "type": "object",
-                "properties": {
-                  "password": {
-                    "maxLength": 128,
-                    "type": "string"
-                  }
-                }
+                "properties": {}
               }
             }
           }
@@ -23071,6 +23066,32 @@
                 }
               }
             }
+          },
+          "503": {
+            "description": "Service unavailable",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
           }
         }
       }
@@ -23078,11 +23099,11 @@
     "/api/v1/auth/2fa/disable": {
       "post": {
         "operationId": "postApiV1Auth2faDisable",
-        "summary": "Disable 2FA",
+        "summary": "Reset 2FA enrollment",
         "tags": [
           "auth"
         ],
-        "description": "Requires TOTP/backup code to disable 2FA. Password is required only for users with a local password; SSO-only users (e.g. Google sign-in with no local password) authenticate via JWT plus the 2FA code alone.",
+        "description": "Clears the current TOTP secret and backup codes after a TOTP/backup-code step-up. Used by the reset flow; account password is never accepted.",
         "requestBody": {
           "required": true,
           "content": {
@@ -23094,10 +23115,6 @@
                   "code"
                 ],
                 "properties": {
-                  "password": {
-                    "maxLength": 128,
-                    "type": "string"
-                  },
                   "code": {
                     "minLength": 6,
                     "maxLength": 8,
@@ -23380,7 +23397,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Generates a new set of backup codes. Requires step-up authentication on top of the JWT session: users with a local password must provide the password; SSO-only users must provide a valid current TOTP or one of their existing backup codes. The new codes are the recovery factor for the user, so issuing them without a second factor on a session that was itself granted by the codes would be a step-up gap.",
+        "description": "Generates a new set of backup codes. Requires step-up authentication on top of the JWT session: the user must provide a valid current TOTP or one existing backup code. Account password is never accepted.",
         "requestBody": {
           "required": true,
           "content": {
@@ -23388,11 +23405,10 @@
               "schema": {
                 "additionalProperties": false,
                 "type": "object",
+                "required": [
+                  "code"
+                ],
                 "properties": {
-                  "password": {
-                    "maxLength": 128,
-                    "type": "string"
-                  },
                   "code": {
                     "minLength": 6,
                     "maxLength": 8,
@@ -24386,7 +24402,10 @@
                           "login_method",
                           "success",
                           "failure_reason",
-                          "created_at"
+                          "created_at",
+                          "country",
+                          "is_new_device",
+                          "is_new_country"
                         ],
                         "properties": {
                           "id": {
@@ -24430,6 +24449,36 @@
                           },
                           "created_at": {
                             "type": "string"
+                          },
+                          "country": {
+                            "anyOf": [
+                              {
+                                "type": "string"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "is_new_device": {
+                            "anyOf": [
+                              {
+                                "type": "boolean"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
+                          },
+                          "is_new_country": {
+                            "anyOf": [
+                              {
+                                "type": "boolean"
+                              },
+                              {
+                                "type": "null"
+                              }
+                            ]
                           }
                         }
                       }
@@ -24510,7 +24559,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Returns the REAL non-expired BetterAuth sessions (auth_session rows) for the current user — one per signed-in device. Revoking these truly logs out the corresponding device.",
+        "description": "Returns the REAL non-expired BetterAuth sessions (auth_session rows) for the current user — one per signed-in device. The current device (`is_current`) is identified by the JWT `sid` claim (= auth_session.id, exposed as request.authSessionId); legacy tokens with no `sid` fall back to an IP + user-agent match. Revoking these truly logs out the corresponding device.",
         "security": [
           {
             "bearerAuth": []
@@ -24642,7 +24691,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Logs out all OTHER devices while keeping the current one signed in (matches the UI copy \"except the current one\"): deletes every BetterAuth session (auth_session row) for the user EXCEPT the one matching the current request (by IP + user-agent), and sets token_invalidated_before=now so already-issued short-lived JWTs are rejected immediately. The current device stays signed in because its session row survives and api.ts transparently re-mints a JWT via GET /token. Requires password for users with a local password; for SSO-only users (e.g. Google sign-in with no local password) the JWT is sufficient.",
+        "description": "Logs out all devices, including the current one: deletes every BetterAuth session (auth_session row) for the user, denylists every sid in Redis for immediate JWT rejection, and sets token_invalidated_before=now so already-issued short-lived JWTs are rejected at once. Requires a current TOTP or backup code; account password is never accepted.",
         "requestBody": {
           "required": true,
           "content": {
@@ -24650,9 +24699,13 @@
               "schema": {
                 "additionalProperties": false,
                 "type": "object",
+                "required": [
+                  "code"
+                ],
                 "properties": {
-                  "password": {
-                    "maxLength": 128,
+                  "code": {
+                    "minLength": 6,
+                    "maxLength": 8,
                     "type": "string"
                   }
                 }
@@ -24772,7 +24825,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Truly revokes a specific device by deleting its real BetterAuth session (auth_session row). The :sessionId is an auth_session.id. Cannot revoke the current session.",
+        "description": "Truly revokes a specific device by deleting its BetterAuth session (auth_session row). The :sessionId is an auth_session.id (= the JWT `sid`). The session identified as current (sessionId === the caller’s sid) cannot be revoked here. The revoked sid is denylisted in Redis so the device’s outstanding short-lived JWT is rejected immediately.",
         "parameters": [
           {
             "schema": {
@@ -24922,7 +24975,7 @@
         "tags": [
           "auth"
         ],
-        "description": "Schedules account for deletion after 30-day grace period. Requires typing \"DELETE\". Password is required only for users with a local password; SSO-only users authenticate via JWT alone.",
+        "description": "Schedules account for deletion after 30-day grace period. Requires typing \"DELETE\". Also requires a current TOTP or backup code; account password is never accepted.",
         "requestBody": {
           "required": true,
           "content": {
@@ -24931,18 +24984,20 @@
                 "additionalProperties": false,
                 "type": "object",
                 "required": [
-                  "confirmation"
+                  "confirmation",
+                  "code"
                 ],
                 "properties": {
-                  "password": {
-                    "maxLength": 128,
-                    "type": "string"
-                  },
                   "confirmation": {
                     "type": "string",
                     "enum": [
                       "DELETE"
                     ]
+                  },
+                  "code": {
+                    "minLength": 6,
+                    "maxLength": 8,
+                    "type": "string"
                   }
                 }
               }
@@ -25321,6 +25376,289 @@
         }
       }
     },
+    "/api/v1/auth/security-nudge": {
+      "get": {
+        "operationId": "getApiV1AuthSecurityNudge",
+        "summary": "Get 2FA nudge state",
+        "tags": [
+          "auth"
+        ],
+        "description": "Returns the current user's 2FA-enable nudge banner state (last dismissal time, last shown time, snooze count). Defaults are returned when no state has been persisted yet.",
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "dismissed_at",
+                    "last_shown_at",
+                    "snooze_count"
+                  ],
+                  "properties": {
+                    "dismissed_at": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "last_shown_at": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "snooze_count": {
+                      "minimum": 0,
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - missing or invalid bearer token",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Internal server error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "put": {
+        "operationId": "putApiV1AuthSecurityNudge",
+        "summary": "Update 2FA nudge state",
+        "tags": [
+          "auth"
+        ],
+        "description": "Merges the provided fields into the current user's 2FA-enable nudge banner state and persists it. Used when the user snoozes (\"Più tardi\") or when the banner records that it was shown. Opt-in only; this never enforces 2FA.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "additionalProperties": false,
+                "type": "object",
+                "properties": {
+                  "dismissed_at": {
+                    "anyOf": [
+                      {
+                        "format": "date-time",
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "last_shown_at": {
+                    "anyOf": [
+                      {
+                        "format": "date-time",
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "snooze_count": {
+                    "minimum": 0,
+                    "type": "integer"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "dismissed_at",
+                    "last_shown_at",
+                    "snooze_count"
+                  ],
+                  "properties": {
+                    "dismissed_at": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "last_shown_at": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "snooze_count": {
+                      "minimum": 0,
+                      "type": "integer"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request - schema validation failed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - missing or invalid bearer token",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Internal server error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/v1/auth/me": {
       "get": {
         "operationId": "getApiV1AuthMe",
@@ -25498,6 +25836,12 @@
                     "two_factor_required": {
                       "type": "boolean"
                     },
+                    "two_factor_setup_required": {
+                      "type": "boolean"
+                    },
+                    "two_factor_mandatory": {
+                      "type": "boolean"
+                    },
                     "has_password": {
                       "type": "boolean"
                     },
@@ -26178,6 +26522,12 @@
                     "two_factor_required": {
                       "type": "boolean"
                     },
+                    "two_factor_setup_required": {
+                      "type": "boolean"
+                    },
+                    "two_factor_mandatory": {
+                      "type": "boolean"
+                    },
                     "has_password": {
                       "type": "boolean"
                     },
@@ -26614,6 +26964,12 @@
                     "two_factor_required": {
                       "type": "boolean"
                     },
+                    "two_factor_setup_required": {
+                      "type": "boolean"
+                    },
+                    "two_factor_mandatory": {
+                      "type": "boolean"
+                    },
                     "has_password": {
                       "type": "boolean"
                     },
@@ -141223,7 +141579,7 @@
                 "properties": {
                   "preferences": {
                     "minItems": 1,
-                    "maxItems": 24,
+                    "maxItems": 29,
                     "type": "array",
                     "items": {
                       "additionalProperties": false,
@@ -216703,7 +217059,8 @@
                     "type": "string"
                   },
                   "daily_budget": {
-                    "description": "Daily budget in cents",
+                    "minimum": 1,
+                    "description": "Daily budget in cents (must be > 0 for CBO and ABO)",
                     "type": "number"
                   },
                   "adset_names": {
@@ -216782,10 +217139,14 @@
                     "type": "string"
                   },
                   "min_age": {
+                    "minimum": 13,
+                    "maximum": 65,
                     "description": "Minimum age targeting",
                     "type": "number"
                   },
                   "max_age": {
+                    "minimum": 13,
+                    "maximum": 65,
                     "description": "Maximum age targeting",
                     "type": "number"
                   },
@@ -225323,6 +225684,62 @@
         }
       }
     },
+    "/meta/extension.zip": {
+      "get": {
+        "operationId": "getMetaExtensionZip",
+        "summary": "Download the auto-connect Chrome extension",
+        "tags": [
+          "meta"
+        ],
+        "description": "Returns a .zip of the \"Wevion Connect\" Chrome extension, pre-configured with this workspace OAuth link. Install it in Chrome or on any Chromium antidetect browser (AdsPower, Multilogin, GoLogin, Dolphin, ...) and open the profiles: the Facebook accounts connect to this workspace automatically.",
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ZIP archive of the pre-configured \"Wevion Connect\" Chrome extension (application/zip).",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "format": "binary",
+                  "description": "ZIP archive of the pre-configured \"Wevion Connect\" Chrome extension (application/zip).",
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized — a valid session is required.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "description": "Unauthorized — a valid session is required.",
+                  "type": "object",
+                  "required": [
+                    "statusCode",
+                    "error",
+                    "message"
+                  ],
+                  "properties": {
+                    "statusCode": {
+                      "type": "number"
+                    },
+                    "error": {
+                      "type": "string"
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/meta/login-callback": {
       "get": {
         "operationId": "getMetaLoginCallback",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wevion/cli",
-  "version": "1.0.2381",
+  "version": "1.0.2382",
   "description": "Wevion API command-line interface — generated from the public OpenAPI spec",
   "type": "module",
   "bin": {