@skrr-ai/cli 0.1.110 → 0.1.111

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refreshClassification.js

@@ -97,7 +97,9 @@ function classifyRefreshResponse(status, body) {
             const fallback = body?.code === 'REFRESH_MISSING' ? 'Refresh token missing' : reason;
             return {
                 kind: 'failure',
-                failure: new types_js_1.PermanentAuthFailure(reason, body?.message ?? fallback),
+                failure: new types_js_1.PermanentAuthFailure(reason, body?.message ?? fallback, reason === 'SESSION_REVOKED' && typeof body?.reason === 'string'
+                    ? body.reason
+                    : undefined),
             };
         }
         // Unknown-shape 401 (no code, or a code we don't recognise). This is NOT a

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionRevocation.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Why a session was signed out, and what the person should do next (OSK-16941).
+ *
+ * ## Why this file exists
+ *
+ * The server always knew why it refused a session: `requireJwtAuth` answers
+ * `401 SESSION_REVOKED` with a `reason` for an inactive account, an account-wide
+ * revocation, a password change and a per-session sign-out. Nothing passed it
+ * on. The CLI dropped the field, the web client folded every unrecognised code
+ * into "your saved credentials are no longer valid", and a refresh refused for a
+ * revoked session answered with no code at all. A person signed out with no
+ * explanation reasonably concludes their account was stolen.
+ *
+ * So the vocabulary lives here, once, beside the one function that turns a
+ * reason into words: the API writes these codes, the web login page, the desktop
+ * banner, the desktop main process (OS notification and tray) and the CLI all
+ * render them through `describeSessionRevocation`.
+ *
+ * ## Why auth-core, behind its own subpath
+ *
+ * It was declared in `@skrr-ai/data-provider`, which the Electron main process
+ * does not (and should not) depend on — so main kept printing the server's raw
+ * message in the OS notification and the tray. auth-core is already the
+ * package that LATCHES the reason (`refresh.ts` writes `revocationReason` into
+ * `needs-reauth.json`), and every desktop, daemon and CLI process already
+ * depends on it. This module imports nothing, so the
+ * `@skrr-ai/auth-core/session-revocation` subpath is safe in a browser, React
+ * Native and Node alike, the same way `first-party-harness` is.
+ * `@skrr-ai/data-provider` re-exports it unchanged: there is still exactly one
+ * declaration of the vocabulary and one copy of its words.
+ *
+ * ## Three closed lists
+ *
+ * - `SESSION_REVOCATION_REASONS` — what a refused CLIENT is told. Wire values;
+ *   the 401 body's `reason` field. The account-state members keep the spelling
+ *   `requireJwtAuth` already sent (`banned`, `pending_deletion`, ...), so a
+ *   client that already switched on them keeps working.
+ * - `SESSION_REVOCATION_CAUSES` — what HAPPENED, recorded in Security activity
+ *   when sessions are revoked. Each cause names its trigger and the reason the
+ *   signed-out client is told.
+ * - `SESSION_REVOCATION_TRIGGERS` — who or what did it.
+ *
+ * ## Unknown is a member, and it is never hidden
+ *
+ * Each list carries an explicit `unknown`. A missing, empty or unrecognised
+ * value normalizes to it, and its copy says plainly that we could not tell why.
+ * It is never folded into the nearest reassuring reading: "Everything reads
+ * healthy and the thing is unusable" (root CLAUDE.md) is exactly what an
+ * optimistic default here would produce.
+ *
+ * Copy avoids contractions in code strings so a terminal and a source file read
+ * them the same; the web reads the localized keys instead.
+ */
+/**
+ * The CLI binary the `cli` surface names when the caller passes no `bin`. A
+ * literal because this module imports nothing; `@skrr-ai/data-provider`'s
+ * `sessionRevocation.spec` asserts it equals `BRAND_NAME`, so the two cannot
+ * drift.
+ */
+export declare const SESSION_REVOCATION_DEFAULT_BIN: "skrr";
+export declare const SESSION_REVOCATION_REASONS: readonly ["password_change", "sessions_revoked", "logged_out", "session_limit", "sign_in_method_removed", "security_check", "machine_removed", "banned", "disabled", "deleted", "pending_deletion", "unknown"];
+export type SessionRevocationReason = (typeof SESSION_REVOCATION_REASONS)[number];
+export declare const SESSION_REVOCATION_UNKNOWN: "unknown";
+/**
+ * The login-page query parameter that carries a revocation reason across the
+ * sign-out redirect (`/login?reason=SESSION_REVOKED&revocation=password_change`).
+ * `reason` keeps the refusal CODE it always carried, so a login page that
+ * predates this still says something.
+ */
+export declare const SESSION_REVOCATION_QUERY_PARAM: "revocation";
+export declare function isSessionRevocationReason(value: unknown): value is SessionRevocationReason;
+/**
+ * The canonical reason for any value a server or a URL handed us. Anything not
+ * in the vocabulary is `unknown` — never a guess.
+ */
+export declare function normalizeSessionRevocationReason(value: unknown): SessionRevocationReason;
+/**
+ * Refusal codes that end a session WITHOUT revoking it, each of which a surface
+ * explains in its own sentence (expired, no longer valid). Every other code a
+ * refusal latch can carry is read as a revocation.
+ */
+export declare const NON_REVOCATION_REFUSAL_CODES: readonly ["REFRESH_EXPIRED", "TOKEN_EXPIRED", "REFRESH_INVALID", "TOKEN_INVALID"];
+export type NonRevocationRefusalCode = (typeof NON_REVOCATION_REFUSAL_CODES)[number];
+export declare function isNonRevocationRefusalCode(value: unknown): value is NonRevocationRefusalCode;
+/**
+ * The revocation reason a refusal names — from a refusal CODE (`SESSION_REVOKED`,
+ * `REFRESH_REUSED`, ...) and the revocation reason that travelled beside it —
+ * or `null` when the code is one of `NON_REVOCATION_REFUSAL_CODES`.
+ *
+ * - A revocation reason, when present, always wins.
+ * - `SESSION_REVOKED` with no reason beside it IS a revocation whose reason we
+ *   do not know, so it is `unknown`.
+ * - `REFRESH_REUSED` is the refresh-family burn, i.e. a security check.
+ * - Any other code, including none at all, is `unknown`: "we could not tell
+ *   why", never a guess.
+ *
+ * Shared by the web banner and the desktop main process so the two read one
+ * latch the same way.
+ */
+export declare function sessionRevocationForRefusal(code: string | undefined | null, revocation?: string | undefined | null): SessionRevocationReason | null;
+export declare const SESSION_REVOCATION_NEXT_STEPS: readonly ["sign_in", "sign_in_and_review", "cancel_deletion", "contact_support", "use_another_account"];
+export type SessionRevocationNextStep = (typeof SESSION_REVOCATION_NEXT_STEPS)[number];
+/** Where the copy is shown: the CLI names its command, an app names a screen. */
+export type SessionRevocationSurface = 'cli' | 'app';
+/** Translation keys the web client renders; English values mirror the copy above. */
+export interface SessionRevocationKeys {
+    title: `com_auth_revoked_${SessionRevocationReason}_title`;
+    detail: `com_auth_revoked_${SessionRevocationReason}_detail`;
+    nextStep: `com_auth_revoked_next_${SessionRevocationNextStep}`;
+}
+export interface SessionRevocationDescription {
+    /** The canonical reason; `unknown` for anything unrecognised or missing. */
+    reason: SessionRevocationReason;
+    /**
+     * The value as received when it was NOT a recognised reason (and not empty),
+     * so a surface can show the code it could not explain instead of losing it.
+     */
+    unrecognized: string | null;
+    title: string;
+    detail: string;
+    nextStep: SessionRevocationNextStep;
+    /** The next step as a sentence for the requested surface. */
+    nextStepText: string;
+    /** Whether the person should look at Security activity to explain it. */
+    reviewSecurityActivity: boolean;
+    keys: SessionRevocationKeys;
+}
+/**
+ * THE copy for a revoked session. Never throws, whatever it is given: the server
+ * can ship a reason before a client knows it, and that case must still say
+ * something true ("we could not tell why"), not nothing.
+ */
+export declare function describeSessionRevocation(value: unknown, { surface, bin, }?: {
+    surface?: SessionRevocationSurface;
+    bin?: string;
+}): SessionRevocationDescription;
+/** One line for a terminal or a notification: title, detail and next step. */
+export declare function formatSessionRevocation(value: unknown, options?: {
+    surface?: SessionRevocationSurface;
+    bin?: string;
+}): string;
+export declare const SESSION_REVOCATION_TRIGGERS: readonly ["account_owner", "administrator", "security_system", "external_provider", "account_lifecycle", "unknown"];
+export type SessionRevocationTrigger = (typeof SESSION_REVOCATION_TRIGGERS)[number];
+export declare const SESSION_REVOCATION_CAUSES: readonly ["password_change", "password_reset", "sign_out_everywhere", "sign_out_other_sessions", "session_signed_out", "two_factor_change", "email_change", "email_change_reverted", "account_recovery", "reported_not_me", "sign_in_method_removed", "machine_removed", "oauth_app_revoked", "session_limit", "suspicious_reuse", "administrator", "account_suspended", "external_provider", "account_deletion_scheduled", "account_superseded", "unverified_account_cleanup", "unknown"];
+export type SessionRevocationCause = (typeof SESSION_REVOCATION_CAUSES)[number];
+interface CauseFacts {
+    trigger: SessionRevocationTrigger;
+    /** What a client signed out by this cause is told. */
+    reason: SessionRevocationReason;
+    /** English sentence for the Security activity row. */
+    copy: string;
+}
+export declare const SESSION_REVOCATION_CAUSE_FACTS: Readonly<Record<SessionRevocationCause, CauseFacts>>;
+export declare const SESSION_REVOCATION_TRIGGER_COPY: Readonly<Record<SessionRevocationTrigger, string>>;
+export declare function normalizeSessionRevocationCause(value: unknown): SessionRevocationCause;
+export declare function normalizeSessionRevocationTrigger(value: unknown): SessionRevocationTrigger;
+export interface SessionRevocationActivityDescription {
+    cause: SessionRevocationCause;
+    trigger: SessionRevocationTrigger;
+    reason: SessionRevocationReason;
+    causeText: string;
+    triggerText: string;
+    keys: {
+        cause: `com_nav_security_activity_revocation_cause_${SessionRevocationCause}`;
+        trigger: `com_nav_security_activity_revocation_trigger_${SessionRevocationTrigger}`;
+    };
+}
+/**
+ * How Security activity explains one recorded revocation. A stored trigger wins
+ * over the cause's usual one (an administrator can change a password too); an
+ * unreadable one is `unknown`, never the cause's default.
+ */
+export declare function describeSessionRevocationActivity(record: {
+    cause?: unknown;
+    trigger?: unknown;
+}): SessionRevocationActivityDescription;
+export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionRevocation.js

@@ -0,0 +1,484 @@
+"use strict";
+/**
+ * Why a session was signed out, and what the person should do next (OSK-16941).
+ *
+ * ## Why this file exists
+ *
+ * The server always knew why it refused a session: `requireJwtAuth` answers
+ * `401 SESSION_REVOKED` with a `reason` for an inactive account, an account-wide
+ * revocation, a password change and a per-session sign-out. Nothing passed it
+ * on. The CLI dropped the field, the web client folded every unrecognised code
+ * into "your saved credentials are no longer valid", and a refresh refused for a
+ * revoked session answered with no code at all. A person signed out with no
+ * explanation reasonably concludes their account was stolen.
+ *
+ * So the vocabulary lives here, once, beside the one function that turns a
+ * reason into words: the API writes these codes, the web login page, the desktop
+ * banner, the desktop main process (OS notification and tray) and the CLI all
+ * render them through `describeSessionRevocation`.
+ *
+ * ## Why auth-core, behind its own subpath
+ *
+ * It was declared in `@skrr-ai/data-provider`, which the Electron main process
+ * does not (and should not) depend on — so main kept printing the server's raw
+ * message in the OS notification and the tray. auth-core is already the
+ * package that LATCHES the reason (`refresh.ts` writes `revocationReason` into
+ * `needs-reauth.json`), and every desktop, daemon and CLI process already
+ * depends on it. This module imports nothing, so the
+ * `@skrr-ai/auth-core/session-revocation` subpath is safe in a browser, React
+ * Native and Node alike, the same way `first-party-harness` is.
+ * `@skrr-ai/data-provider` re-exports it unchanged: there is still exactly one
+ * declaration of the vocabulary and one copy of its words.
+ *
+ * ## Three closed lists
+ *
+ * - `SESSION_REVOCATION_REASONS` — what a refused CLIENT is told. Wire values;
+ *   the 401 body's `reason` field. The account-state members keep the spelling
+ *   `requireJwtAuth` already sent (`banned`, `pending_deletion`, ...), so a
+ *   client that already switched on them keeps working.
+ * - `SESSION_REVOCATION_CAUSES` — what HAPPENED, recorded in Security activity
+ *   when sessions are revoked. Each cause names its trigger and the reason the
+ *   signed-out client is told.
+ * - `SESSION_REVOCATION_TRIGGERS` — who or what did it.
+ *
+ * ## Unknown is a member, and it is never hidden
+ *
+ * Each list carries an explicit `unknown`. A missing, empty or unrecognised
+ * value normalizes to it, and its copy says plainly that we could not tell why.
+ * It is never folded into the nearest reassuring reading: "Everything reads
+ * healthy and the thing is unusable" (root CLAUDE.md) is exactly what an
+ * optimistic default here would produce.
+ *
+ * Copy avoids contractions in code strings so a terminal and a source file read
+ * them the same; the web reads the localized keys instead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_REVOCATION_TRIGGER_COPY = exports.SESSION_REVOCATION_CAUSE_FACTS = exports.SESSION_REVOCATION_CAUSES = exports.SESSION_REVOCATION_TRIGGERS = exports.SESSION_REVOCATION_NEXT_STEPS = exports.NON_REVOCATION_REFUSAL_CODES = exports.SESSION_REVOCATION_QUERY_PARAM = exports.SESSION_REVOCATION_UNKNOWN = exports.SESSION_REVOCATION_REASONS = exports.SESSION_REVOCATION_DEFAULT_BIN = void 0;
+exports.isSessionRevocationReason = isSessionRevocationReason;
+exports.normalizeSessionRevocationReason = normalizeSessionRevocationReason;
+exports.isNonRevocationRefusalCode = isNonRevocationRefusalCode;
+exports.sessionRevocationForRefusal = sessionRevocationForRefusal;
+exports.describeSessionRevocation = describeSessionRevocation;
+exports.formatSessionRevocation = formatSessionRevocation;
+exports.normalizeSessionRevocationCause = normalizeSessionRevocationCause;
+exports.normalizeSessionRevocationTrigger = normalizeSessionRevocationTrigger;
+exports.describeSessionRevocationActivity = describeSessionRevocationActivity;
+/**
+ * The CLI binary the `cli` surface names when the caller passes no `bin`. A
+ * literal because this module imports nothing; `@skrr-ai/data-provider`'s
+ * `sessionRevocation.spec` asserts it equals `BRAND_NAME`, so the two cannot
+ * drift.
+ */
+exports.SESSION_REVOCATION_DEFAULT_BIN = 'skrr';
+/* ------------------------------------------------------------------------ */
+/* Reasons — what a refused client is told                                  */
+/* ------------------------------------------------------------------------ */
+exports.SESSION_REVOCATION_REASONS = [
+    'password_change',
+    'sessions_revoked',
+    'logged_out',
+    'session_limit',
+    'sign_in_method_removed',
+    'security_check',
+    'machine_removed',
+    'banned',
+    'disabled',
+    'deleted',
+    'pending_deletion',
+    'unknown',
+];
+exports.SESSION_REVOCATION_UNKNOWN = 'unknown';
+/**
+ * The login-page query parameter that carries a revocation reason across the
+ * sign-out redirect (`/login?reason=SESSION_REVOKED&revocation=password_change`).
+ * `reason` keeps the refusal CODE it always carried, so a login page that
+ * predates this still says something.
+ */
+exports.SESSION_REVOCATION_QUERY_PARAM = 'revocation';
+/**
+ * Other spellings that already reach clients for the SAME reason: the
+ * revocation-bus `cause` strings an older server put on `auth:revoked`, and the
+ * `missing` account state. Kept so a client newer than its server still names
+ * them; a new server sends the canonical member.
+ */
+const SESSION_REVOCATION_REASON_ALIASES = Object.freeze({
+    logout: 'logged_out',
+    explicit_logout: 'logged_out',
+    session_limit_reached: 'session_limit',
+    reuse: 'security_check',
+    reuse_detected: 'security_check',
+    missing: 'deleted',
+});
+function isSessionRevocationReason(value) {
+    return (typeof value === 'string' && exports.SESSION_REVOCATION_REASONS.includes(value));
+}
+/**
+ * The canonical reason for any value a server or a URL handed us. Anything not
+ * in the vocabulary is `unknown` — never a guess.
+ */
+function normalizeSessionRevocationReason(value) {
+    if (isSessionRevocationReason(value))
+        return value;
+    if (typeof value === 'string' &&
+        Object.prototype.hasOwnProperty.call(SESSION_REVOCATION_REASON_ALIASES, value)) {
+        return SESSION_REVOCATION_REASON_ALIASES[value];
+    }
+    return exports.SESSION_REVOCATION_UNKNOWN;
+}
+/**
+ * Refusal codes that end a session WITHOUT revoking it, each of which a surface
+ * explains in its own sentence (expired, no longer valid). Every other code a
+ * refusal latch can carry is read as a revocation.
+ */
+exports.NON_REVOCATION_REFUSAL_CODES = [
+    'REFRESH_EXPIRED',
+    'TOKEN_EXPIRED',
+    'REFRESH_INVALID',
+    'TOKEN_INVALID',
+];
+function isNonRevocationRefusalCode(value) {
+    return (typeof value === 'string' && exports.NON_REVOCATION_REFUSAL_CODES.includes(value));
+}
+/**
+ * The revocation reason a refusal names — from a refusal CODE (`SESSION_REVOKED`,
+ * `REFRESH_REUSED`, ...) and the revocation reason that travelled beside it —
+ * or `null` when the code is one of `NON_REVOCATION_REFUSAL_CODES`.
+ *
+ * - A revocation reason, when present, always wins.
+ * - `SESSION_REVOKED` with no reason beside it IS a revocation whose reason we
+ *   do not know, so it is `unknown`.
+ * - `REFRESH_REUSED` is the refresh-family burn, i.e. a security check.
+ * - Any other code, including none at all, is `unknown`: "we could not tell
+ *   why", never a guess.
+ *
+ * Shared by the web banner and the desktop main process so the two read one
+ * latch the same way.
+ */
+function sessionRevocationForRefusal(code, revocation) {
+    if (revocation)
+        return normalizeSessionRevocationReason(revocation);
+    if (code === 'SESSION_REVOKED')
+        return exports.SESSION_REVOCATION_UNKNOWN;
+    if (code === 'REFRESH_REUSED')
+        return 'security_check';
+    if (isNonRevocationRefusalCode(code))
+        return null;
+    return normalizeSessionRevocationReason(code);
+}
+/* ------------------------------------------------------------------------ */
+/* Next steps                                                               */
+/* ------------------------------------------------------------------------ */
+exports.SESSION_REVOCATION_NEXT_STEPS = [
+    'sign_in',
+    'sign_in_and_review',
+    'cancel_deletion',
+    'contact_support',
+    'use_another_account',
+];
+const REASON_COPY = Object.freeze({
+    password_change: {
+        title: 'Your password was changed.',
+        detail: 'Changing the password signs out every session that was opened before the change, including this one.',
+        nextStep: 'sign_in_and_review',
+    },
+    sessions_revoked: {
+        title: 'Every session on your account was signed out.',
+        detail: 'All sessions were ended at once. That happens when someone signed in to the account chooses to sign out everywhere, changes two-factor or email settings, uses a recovery key or reports a sign-in, and when an administrator or an automatic security measure revokes sessions. Security activity records which one it was.',
+        nextStep: 'sign_in_and_review',
+    },
+    logged_out: {
+        title: 'This session was signed out.',
+        detail: 'It was signed out on this device or from another device signed in to your account.',
+        nextStep: 'sign_in',
+    },
+    session_limit: {
+        title: 'This session was signed out to make room for a newer one.',
+        detail: 'Your account reached its limit of signed-in sessions, so the oldest one was ended.',
+        nextStep: 'sign_in',
+    },
+    sign_in_method_removed: {
+        title: 'The way this session signed in was removed from your account.',
+        detail: 'The password, passkey or sign-in provider this session used is no longer on the account.',
+        nextStep: 'sign_in_and_review',
+    },
+    security_check: {
+        title: 'This session was ended by a security check.',
+        detail: 'Its credential was presented in a way that suggested it may have been copied, so it was ended to protect your account.',
+        nextStep: 'sign_in_and_review',
+    },
+    machine_removed: {
+        title: 'The machine this session belonged to was removed.',
+        detail: 'The machine connection that held this sign-in was removed or replaced.',
+        nextStep: 'sign_in',
+    },
+    banned: {
+        title: 'This account has been suspended.',
+        detail: 'An administrator suspended the account, so its sessions no longer work.',
+        nextStep: 'contact_support',
+    },
+    disabled: {
+        title: 'This account is disabled.',
+        detail: 'The account was disabled, so its sessions no longer work.',
+        nextStep: 'contact_support',
+    },
+    deleted: {
+        title: 'This account no longer exists.',
+        detail: 'The account this session belonged to was deleted.',
+        nextStep: 'use_another_account',
+    },
+    pending_deletion: {
+        title: 'This account is scheduled for deletion.',
+        detail: 'Until the deletion is carried out, signing in can only cancel it.',
+        nextStep: 'cancel_deletion',
+    },
+    unknown: {
+        title: 'You were signed out, and we could not tell why.',
+        detail: 'The server ended this session without saying why. That can happen with an older server or an unexpected error.',
+        nextStep: 'sign_in_and_review',
+    },
+});
+function nextStepCopy(step, surface, bin) {
+    const signIn = surface === 'cli' ? `Run \`${bin} login\` to sign in again.` : 'Sign in again to continue.';
+    switch (step) {
+        case 'sign_in':
+            return signIn;
+        case 'sign_in_and_review':
+            return (`${signIn} If this was not you, open Settings > Account > Security activity to see ` +
+                'what happened, and change your password.');
+        case 'cancel_deletion':
+            return surface === 'cli'
+                ? 'Sign in on the web to cancel the deletion if you want to keep the account.'
+                : 'Sign in to cancel the deletion if you want to keep the account.';
+        case 'contact_support':
+            return 'Contact support if you think this is a mistake.';
+        case 'use_another_account':
+            return surface === 'cli'
+                ? `Run \`${bin} login\` to sign in with a different account.`
+                : 'Sign in with a different account, or create a new one.';
+    }
+}
+/**
+ * THE copy for a revoked session. Never throws, whatever it is given: the server
+ * can ship a reason before a client knows it, and that case must still say
+ * something true ("we could not tell why"), not nothing.
+ */
+function describeSessionRevocation(value, { surface = 'app', bin = exports.SESSION_REVOCATION_DEFAULT_BIN, } = {}) {
+    const reason = normalizeSessionRevocationReason(value);
+    const unrecognized = reason === exports.SESSION_REVOCATION_UNKNOWN &&
+        typeof value === 'string' &&
+        value.trim() !== '' &&
+        value !== exports.SESSION_REVOCATION_UNKNOWN
+        ? value.trim().slice(0, 64)
+        : null;
+    const copy = REASON_COPY[reason];
+    return {
+        reason,
+        unrecognized,
+        title: copy.title,
+        detail: copy.detail,
+        nextStep: copy.nextStep,
+        nextStepText: nextStepCopy(copy.nextStep, surface, bin),
+        reviewSecurityActivity: copy.nextStep === 'sign_in_and_review',
+        keys: {
+            title: `com_auth_revoked_${reason}_title`,
+            detail: `com_auth_revoked_${reason}_detail`,
+            nextStep: `com_auth_revoked_next_${copy.nextStep}`,
+        },
+    };
+}
+/** One line for a terminal or a notification: title, detail and next step. */
+function formatSessionRevocation(value, options = {}) {
+    const d = describeSessionRevocation(value, options);
+    const code = d.unrecognized ? ` (reason code: ${d.unrecognized})` : '';
+    return `${d.title}${code} ${d.detail} ${d.nextStepText}`;
+}
+/* ------------------------------------------------------------------------ */
+/* Triggers and causes — the Security activity record                       */
+/* ------------------------------------------------------------------------ */
+exports.SESSION_REVOCATION_TRIGGERS = [
+    'account_owner',
+    'administrator',
+    'security_system',
+    'external_provider',
+    'account_lifecycle',
+    'unknown',
+];
+exports.SESSION_REVOCATION_CAUSES = [
+    'password_change',
+    'password_reset',
+    'sign_out_everywhere',
+    'sign_out_other_sessions',
+    'session_signed_out',
+    'two_factor_change',
+    'email_change',
+    'email_change_reverted',
+    'account_recovery',
+    'reported_not_me',
+    'sign_in_method_removed',
+    'machine_removed',
+    'oauth_app_revoked',
+    'session_limit',
+    'suspicious_reuse',
+    'administrator',
+    'account_suspended',
+    'external_provider',
+    'account_deletion_scheduled',
+    'account_superseded',
+    'unverified_account_cleanup',
+    'unknown',
+];
+exports.SESSION_REVOCATION_CAUSE_FACTS = Object.freeze({
+    password_change: {
+        trigger: 'account_owner',
+        reason: 'password_change',
+        copy: 'The password was changed.',
+    },
+    password_reset: {
+        trigger: 'account_owner',
+        reason: 'password_change',
+        copy: 'The password was reset from an emailed link.',
+    },
+    sign_out_everywhere: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'Sign out everywhere was chosen.',
+    },
+    sign_out_other_sessions: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'Every other session was signed out.',
+    },
+    session_signed_out: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'A session was signed out.',
+    },
+    two_factor_change: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'Two-factor authentication settings changed.',
+    },
+    email_change: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'The account email address was changed.',
+    },
+    email_change_reverted: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'An email address change was undone from the link sent to the previous address.',
+    },
+    account_recovery: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'The account was recovered with a recovery key.',
+    },
+    reported_not_me: {
+        trigger: 'account_owner',
+        reason: 'sessions_revoked',
+        copy: 'A sign-in was reported as not you.',
+    },
+    sign_in_method_removed: {
+        trigger: 'account_owner',
+        reason: 'sign_in_method_removed',
+        copy: 'A sign-in method was removed, and the sessions that used it were ended.',
+    },
+    machine_removed: {
+        trigger: 'account_owner',
+        reason: 'machine_removed',
+        copy: 'A machine connection was removed, and the sessions it held were ended.',
+    },
+    oauth_app_revoked: {
+        trigger: 'account_owner',
+        reason: 'logged_out',
+        copy: 'Access for a connected application was revoked.',
+    },
+    session_limit: {
+        trigger: 'security_system',
+        reason: 'session_limit',
+        copy: 'The limit of signed-in sessions was reached, so the oldest session was ended.',
+    },
+    suspicious_reuse: {
+        trigger: 'security_system',
+        reason: 'security_check',
+        copy: 'A sign-in credential was presented twice, which can mean it was copied, so its sessions were ended.',
+    },
+    administrator: {
+        trigger: 'administrator',
+        reason: 'sessions_revoked',
+        copy: 'An administrator revoked the sessions.',
+    },
+    account_suspended: {
+        trigger: 'administrator',
+        reason: 'banned',
+        copy: 'An administrator suspended the account, which ends every session.',
+    },
+    external_provider: {
+        trigger: 'external_provider',
+        reason: 'sessions_revoked',
+        copy: 'Your sign-in provider reported a change to the account it vouches for.',
+    },
+    account_deletion_scheduled: {
+        trigger: 'account_owner',
+        reason: 'pending_deletion',
+        copy: 'Deletion of the account was requested.',
+    },
+    account_superseded: {
+        trigger: 'account_lifecycle',
+        reason: 'password_change',
+        copy: 'A new registration proved this email address and replaced the unverified account.',
+    },
+    unverified_account_cleanup: {
+        trigger: 'account_lifecycle',
+        reason: 'deleted',
+        copy: 'The unverified account was cleaned up.',
+    },
+    unknown: {
+        trigger: 'unknown',
+        reason: 'unknown',
+        copy: 'Sessions were revoked, and the server did not record why.',
+    },
+});
+exports.SESSION_REVOCATION_TRIGGER_COPY = Object.freeze({
+    account_owner: 'Someone signed in to this account',
+    administrator: 'An administrator',
+    security_system: 'An automatic security measure',
+    external_provider: 'Your sign-in provider',
+    account_lifecycle: 'Account cleanup',
+    unknown: 'Unknown: the server could not tell who or what',
+});
+function normalizeSessionRevocationCause(value) {
+    return typeof value === 'string' &&
+        exports.SESSION_REVOCATION_CAUSES.includes(value)
+        ? value
+        : 'unknown';
+}
+function normalizeSessionRevocationTrigger(value) {
+    return typeof value === 'string' &&
+        exports.SESSION_REVOCATION_TRIGGERS.includes(value)
+        ? value
+        : 'unknown';
+}
+/**
+ * How Security activity explains one recorded revocation. A stored trigger wins
+ * over the cause's usual one (an administrator can change a password too); an
+ * unreadable one is `unknown`, never the cause's default.
+ */
+function describeSessionRevocationActivity(record) {
+    const cause = normalizeSessionRevocationCause(record?.cause);
+    const trigger = record?.trigger === undefined || record?.trigger === null
+        ? 'unknown'
+        : normalizeSessionRevocationTrigger(record.trigger);
+    const facts = exports.SESSION_REVOCATION_CAUSE_FACTS[cause];
+    return {
+        cause,
+        trigger,
+        reason: facts.reason,
+        causeText: facts.copy,
+        triggerText: exports.SESSION_REVOCATION_TRIGGER_COPY[trigger],
+        keys: {
+            cause: `com_nav_security_activity_revocation_cause_${cause}`,
+            trigger: `com_nav_security_activity_revocation_trigger_${trigger}`,
+        },
+    };
+}