@skrr-ai/cli 0.1.115 → 0.1.117

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionRevocation.js

@@ -1,484 +1,401 @@
 "use strict";
-/**
- * Why a session was signed out, and what the person should do next (OSK-16941).
- *
- * ## Why this file exists
- *
- * The server always knew why it refused a session: `requireJwtAuth` answers
- * `401 SESSION_REVOKED` with a `reason` for an inactive account, an account-wide
- * revocation, a password change and a per-session sign-out. Nothing passed it
- * on. The CLI dropped the field, the web client folded every unrecognised code
- * into "your saved credentials are no longer valid", and a refresh refused for a
- * revoked session answered with no code at all. A person signed out with no
- * explanation reasonably concludes their account was stolen.
- *
- * So the vocabulary lives here, once, beside the one function that turns a
- * reason into words: the API writes these codes, the web login page, the desktop
- * banner, the desktop main process (OS notification and tray) and the CLI all
- * render them through `describeSessionRevocation`.
- *
- * ## Why auth-core, behind its own subpath
- *
- * It was declared in `@skrr-ai/data-provider`, which the Electron main process
- * does not (and should not) depend on — so main kept printing the server's raw
- * message in the OS notification and the tray. auth-core is already the
- * package that LATCHES the reason (`refresh.ts` writes `revocationReason` into
- * `needs-reauth.json`), and every desktop, daemon and CLI process already
- * depends on it. This module imports nothing, so the
- * `@skrr-ai/auth-core/session-revocation` subpath is safe in a browser, React
- * Native and Node alike, the same way `first-party-harness` is.
- * `@skrr-ai/data-provider` re-exports it unchanged: there is still exactly one
- * declaration of the vocabulary and one copy of its words.
- *
- * ## Three closed lists
- *
- * - `SESSION_REVOCATION_REASONS` — what a refused CLIENT is told. Wire values;
- *   the 401 body's `reason` field. The account-state members keep the spelling
- *   `requireJwtAuth` already sent (`banned`, `pending_deletion`, ...), so a
- *   client that already switched on them keeps working.
- * - `SESSION_REVOCATION_CAUSES` — what HAPPENED, recorded in Security activity
- *   when sessions are revoked. Each cause names its trigger and the reason the
- *   signed-out client is told.
- * - `SESSION_REVOCATION_TRIGGERS` — who or what did it.
- *
- * ## Unknown is a member, and it is never hidden
- *
- * Each list carries an explicit `unknown`. A missing, empty or unrecognised
- * value normalizes to it, and its copy says plainly that we could not tell why.
- * It is never folded into the nearest reassuring reading: "Everything reads
- * healthy and the thing is unusable" (root CLAUDE.md) is exactly what an
- * optimistic default here would produce.
- *
- * Copy avoids contractions in code strings so a terminal and a source file read
- * them the same; the web reads the localized keys instead.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_REVOCATION_TRIGGER_COPY = exports.SESSION_REVOCATION_CAUSE_FACTS = exports.SESSION_REVOCATION_CAUSES = exports.SESSION_REVOCATION_TRIGGERS = exports.SESSION_REVOCATION_NEXT_STEPS = exports.NON_REVOCATION_REFUSAL_CODES = exports.SESSION_REVOCATION_QUERY_PARAM = exports.SESSION_REVOCATION_UNKNOWN = exports.SESSION_REVOCATION_REASONS = exports.SESSION_REVOCATION_DEFAULT_BIN = void 0;
-exports.isSessionRevocationReason = isSessionRevocationReason;
-exports.normalizeSessionRevocationReason = normalizeSessionRevocationReason;
-exports.isNonRevocationRefusalCode = isNonRevocationRefusalCode;
-exports.sessionRevocationForRefusal = sessionRevocationForRefusal;
-exports.describeSessionRevocation = describeSessionRevocation;
-exports.formatSessionRevocation = formatSessionRevocation;
-exports.normalizeSessionRevocationCause = normalizeSessionRevocationCause;
-exports.normalizeSessionRevocationTrigger = normalizeSessionRevocationTrigger;
-exports.describeSessionRevocationActivity = describeSessionRevocationActivity;
-/**
- * The CLI binary the `cli` surface names when the caller passes no `bin`. A
- * literal because this module imports nothing; `@skrr-ai/data-provider`'s
- * `sessionRevocation.spec` asserts it equals `BRAND_NAME`, so the two cannot
- * drift.
- */
-exports.SESSION_REVOCATION_DEFAULT_BIN = 'skrr';
-/* ------------------------------------------------------------------------ */
-/* Reasons — what a refused client is told                                  */
-/* ------------------------------------------------------------------------ */
-exports.SESSION_REVOCATION_REASONS = [
-    'password_change',
-    'sessions_revoked',
-    'logged_out',
-    'session_limit',
-    'sign_in_method_removed',
-    'security_check',
-    'machine_removed',
-    'banned',
-    'disabled',
-    'deleted',
-    'pending_deletion',
-    'unknown',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sessionRevocation_exports = {};
+__export(sessionRevocation_exports, {
+  NON_REVOCATION_REFUSAL_CODES: () => NON_REVOCATION_REFUSAL_CODES,
+  SESSION_REVOCATION_CAUSES: () => SESSION_REVOCATION_CAUSES,
+  SESSION_REVOCATION_CAUSE_FACTS: () => SESSION_REVOCATION_CAUSE_FACTS,
+  SESSION_REVOCATION_DEFAULT_BIN: () => SESSION_REVOCATION_DEFAULT_BIN,
+  SESSION_REVOCATION_NEXT_STEPS: () => SESSION_REVOCATION_NEXT_STEPS,
+  SESSION_REVOCATION_QUERY_PARAM: () => SESSION_REVOCATION_QUERY_PARAM,
+  SESSION_REVOCATION_REASONS: () => SESSION_REVOCATION_REASONS,
+  SESSION_REVOCATION_TRIGGERS: () => SESSION_REVOCATION_TRIGGERS,
+  SESSION_REVOCATION_TRIGGER_COPY: () => SESSION_REVOCATION_TRIGGER_COPY,
+  SESSION_REVOCATION_UNKNOWN: () => SESSION_REVOCATION_UNKNOWN,
+  describeSessionRevocation: () => describeSessionRevocation,
+  describeSessionRevocationActivity: () => describeSessionRevocationActivity,
+  formatSessionRevocation: () => formatSessionRevocation,
+  isNonRevocationRefusalCode: () => isNonRevocationRefusalCode,
+  isSessionRevocationReason: () => isSessionRevocationReason,
+  normalizeSessionRevocationCause: () => normalizeSessionRevocationCause,
+  normalizeSessionRevocationReason: () => normalizeSessionRevocationReason,
+  normalizeSessionRevocationTrigger: () => normalizeSessionRevocationTrigger,
+  sessionRevocationForRefusal: () => sessionRevocationForRefusal
+});
+module.exports = __toCommonJS(sessionRevocation_exports);
+const SESSION_REVOCATION_DEFAULT_BIN = "skrr";
+const SESSION_REVOCATION_REASONS = [
+  "password_change",
+  "sessions_revoked",
+  "logged_out",
+  "session_limit",
+  "sign_in_method_removed",
+  "security_check",
+  "machine_removed",
+  "banned",
+  "disabled",
+  "deleted",
+  "pending_deletion",
+  "unknown"
 ];
-exports.SESSION_REVOCATION_UNKNOWN = 'unknown';
-/**
- * The login-page query parameter that carries a revocation reason across the
- * sign-out redirect (`/login?reason=SESSION_REVOKED&revocation=password_change`).
- * `reason` keeps the refusal CODE it always carried, so a login page that
- * predates this still says something.
- */
-exports.SESSION_REVOCATION_QUERY_PARAM = 'revocation';
-/**
- * Other spellings that already reach clients for the SAME reason: the
- * revocation-bus `cause` strings an older server put on `auth:revoked`, and the
- * `missing` account state. Kept so a client newer than its server still names
- * them; a new server sends the canonical member.
- */
+const SESSION_REVOCATION_UNKNOWN = "unknown";
+const SESSION_REVOCATION_QUERY_PARAM = "revocation";
 const SESSION_REVOCATION_REASON_ALIASES = Object.freeze({
-    logout: 'logged_out',
-    explicit_logout: 'logged_out',
-    session_limit_reached: 'session_limit',
-    reuse: 'security_check',
-    reuse_detected: 'security_check',
-    missing: 'deleted',
+  logout: "logged_out",
+  explicit_logout: "logged_out",
+  session_limit_reached: "session_limit",
+  reuse: "security_check",
+  reuse_detected: "security_check",
+  missing: "deleted"
 });
 function isSessionRevocationReason(value) {
-    return (typeof value === 'string' && exports.SESSION_REVOCATION_REASONS.includes(value));
+  return typeof value === "string" && SESSION_REVOCATION_REASONS.includes(value);
 }
-/**
- * The canonical reason for any value a server or a URL handed us. Anything not
- * in the vocabulary is `unknown` — never a guess.
- */
 function normalizeSessionRevocationReason(value) {
-    if (isSessionRevocationReason(value))
-        return value;
-    if (typeof value === 'string' &&
-        Object.prototype.hasOwnProperty.call(SESSION_REVOCATION_REASON_ALIASES, value)) {
-        return SESSION_REVOCATION_REASON_ALIASES[value];
-    }
-    return exports.SESSION_REVOCATION_UNKNOWN;
+  if (isSessionRevocationReason(value))
+    return value;
+  if (typeof value === "string" && Object.prototype.hasOwnProperty.call(SESSION_REVOCATION_REASON_ALIASES, value)) {
+    return SESSION_REVOCATION_REASON_ALIASES[value];
+  }
+  return SESSION_REVOCATION_UNKNOWN;
 }
-/**
- * Refusal codes that end a session WITHOUT revoking it, each of which a surface
- * explains in its own sentence (expired, no longer valid). Every other code a
- * refusal latch can carry is read as a revocation.
- */
-exports.NON_REVOCATION_REFUSAL_CODES = [
-    'REFRESH_EXPIRED',
-    'TOKEN_EXPIRED',
-    'REFRESH_INVALID',
-    'TOKEN_INVALID',
+const NON_REVOCATION_REFUSAL_CODES = [
+  "REFRESH_EXPIRED",
+  "TOKEN_EXPIRED",
+  "REFRESH_INVALID",
+  "TOKEN_INVALID"
 ];
 function isNonRevocationRefusalCode(value) {
-    return (typeof value === 'string' && exports.NON_REVOCATION_REFUSAL_CODES.includes(value));
+  return typeof value === "string" && NON_REVOCATION_REFUSAL_CODES.includes(value);
 }
-/**
- * The revocation reason a refusal names — from a refusal CODE (`SESSION_REVOKED`,
- * `REFRESH_REUSED`, ...) and the revocation reason that travelled beside it —
- * or `null` when the code is one of `NON_REVOCATION_REFUSAL_CODES`.
- *
- * - A revocation reason, when present, always wins.
- * - `SESSION_REVOKED` with no reason beside it IS a revocation whose reason we
- *   do not know, so it is `unknown`.
- * - `REFRESH_REUSED` is the refresh-family burn, i.e. a security check.
- * - Any other code, including none at all, is `unknown`: "we could not tell
- *   why", never a guess.
- *
- * Shared by the web banner and the desktop main process so the two read one
- * latch the same way.
- */
 function sessionRevocationForRefusal(code, revocation) {
-    if (revocation)
-        return normalizeSessionRevocationReason(revocation);
-    if (code === 'SESSION_REVOKED')
-        return exports.SESSION_REVOCATION_UNKNOWN;
-    if (code === 'REFRESH_REUSED')
-        return 'security_check';
-    if (isNonRevocationRefusalCode(code))
-        return null;
-    return normalizeSessionRevocationReason(code);
+  if (revocation)
+    return normalizeSessionRevocationReason(revocation);
+  if (code === "SESSION_REVOKED")
+    return SESSION_REVOCATION_UNKNOWN;
+  if (code === "REFRESH_REUSED")
+    return "security_check";
+  if (isNonRevocationRefusalCode(code))
+    return null;
+  return normalizeSessionRevocationReason(code);
 }
-/* ------------------------------------------------------------------------ */
-/* Next steps                                                               */
-/* ------------------------------------------------------------------------ */
-exports.SESSION_REVOCATION_NEXT_STEPS = [
-    'sign_in',
-    'sign_in_and_review',
-    'cancel_deletion',
-    'contact_support',
-    'use_another_account',
+const SESSION_REVOCATION_NEXT_STEPS = [
+  "sign_in",
+  "sign_in_and_review",
+  "cancel_deletion",
+  "contact_support",
+  "use_another_account"
 ];
 const REASON_COPY = Object.freeze({
-    password_change: {
-        title: 'Your password was changed.',
-        detail: 'Changing the password signs out every session that was opened before the change, including this one.',
-        nextStep: 'sign_in_and_review',
-    },
-    sessions_revoked: {
-        title: 'Every session on your account was signed out.',
-        detail: 'All sessions were ended at once. That happens when someone signed in to the account chooses to sign out everywhere, changes two-factor or email settings, uses a recovery key or reports a sign-in, and when an administrator or an automatic security measure revokes sessions. Security activity records which one it was.',
-        nextStep: 'sign_in_and_review',
-    },
-    logged_out: {
-        title: 'This session was signed out.',
-        detail: 'It was signed out on this device or from another device signed in to your account.',
-        nextStep: 'sign_in',
-    },
-    session_limit: {
-        title: 'This session was signed out to make room for a newer one.',
-        detail: 'Your account reached its limit of signed-in sessions, so the oldest one was ended.',
-        nextStep: 'sign_in',
-    },
-    sign_in_method_removed: {
-        title: 'The way this session signed in was removed from your account.',
-        detail: 'The password, passkey or sign-in provider this session used is no longer on the account.',
-        nextStep: 'sign_in_and_review',
-    },
-    security_check: {
-        title: 'This session was ended by a security check.',
-        detail: 'Its credential was presented in a way that suggested it may have been copied, so it was ended to protect your account.',
-        nextStep: 'sign_in_and_review',
-    },
-    machine_removed: {
-        title: 'The machine this session belonged to was removed.',
-        detail: 'The machine connection that held this sign-in was removed or replaced.',
-        nextStep: 'sign_in',
-    },
-    banned: {
-        title: 'This account has been suspended.',
-        detail: 'An administrator suspended the account, so its sessions no longer work.',
-        nextStep: 'contact_support',
-    },
-    disabled: {
-        title: 'This account is disabled.',
-        detail: 'The account was disabled, so its sessions no longer work.',
-        nextStep: 'contact_support',
-    },
-    deleted: {
-        title: 'This account no longer exists.',
-        detail: 'The account this session belonged to was deleted.',
-        nextStep: 'use_another_account',
-    },
-    pending_deletion: {
-        title: 'This account is scheduled for deletion.',
-        detail: 'Until the deletion is carried out, signing in can only cancel it.',
-        nextStep: 'cancel_deletion',
-    },
-    unknown: {
-        title: 'You were signed out, and we could not tell why.',
-        detail: 'The server ended this session without saying why. That can happen with an older server or an unexpected error.',
-        nextStep: 'sign_in_and_review',
-    },
+  password_change: {
+    title: "Your password was changed.",
+    detail: "Changing the password signs out every session that was opened before the change, including this one.",
+    nextStep: "sign_in_and_review"
+  },
+  sessions_revoked: {
+    title: "Every session on your account was signed out.",
+    detail: "All sessions were ended at once. That happens when someone signed in to the account chooses to sign out everywhere, changes two-factor or email settings, uses a recovery key or reports a sign-in, and when an administrator or an automatic security measure revokes sessions. Security activity records which one it was.",
+    nextStep: "sign_in_and_review"
+  },
+  logged_out: {
+    title: "This session was signed out.",
+    detail: "It was signed out on this device or from another device signed in to your account.",
+    nextStep: "sign_in"
+  },
+  session_limit: {
+    title: "This session was signed out to make room for a newer one.",
+    detail: "Your account reached its limit of signed-in sessions, so the oldest one was ended.",
+    nextStep: "sign_in"
+  },
+  sign_in_method_removed: {
+    title: "The way this session signed in was removed from your account.",
+    detail: "The password, passkey or sign-in provider this session used is no longer on the account.",
+    nextStep: "sign_in_and_review"
+  },
+  security_check: {
+    title: "This session was ended by a security check.",
+    detail: "Its credential was presented in a way that suggested it may have been copied, so it was ended to protect your account.",
+    nextStep: "sign_in_and_review"
+  },
+  machine_removed: {
+    title: "The machine this session belonged to was removed.",
+    detail: "The machine connection that held this sign-in was removed or replaced.",
+    nextStep: "sign_in"
+  },
+  banned: {
+    title: "This account has been suspended.",
+    detail: "An administrator suspended the account, so its sessions no longer work.",
+    nextStep: "contact_support"
+  },
+  disabled: {
+    title: "This account is disabled.",
+    detail: "The account was disabled, so its sessions no longer work.",
+    nextStep: "contact_support"
+  },
+  deleted: {
+    title: "This account no longer exists.",
+    detail: "The account this session belonged to was deleted.",
+    nextStep: "use_another_account"
+  },
+  pending_deletion: {
+    title: "This account is scheduled for deletion.",
+    detail: "Until the deletion is carried out, signing in can only cancel it.",
+    nextStep: "cancel_deletion"
+  },
+  unknown: {
+    title: "You were signed out, and we could not tell why.",
+    detail: "The server ended this session without saying why. That can happen with an older server or an unexpected error.",
+    nextStep: "sign_in_and_review"
+  }
 });
 function nextStepCopy(step, surface, bin) {
-    const signIn = surface === 'cli' ? `Run \`${bin} login\` to sign in again.` : 'Sign in again to continue.';
-    switch (step) {
-        case 'sign_in':
-            return signIn;
-        case 'sign_in_and_review':
-            return (`${signIn} If this was not you, open Settings > Account > Security activity to see ` +
-                'what happened, and change your password.');
-        case 'cancel_deletion':
-            return surface === 'cli'
-                ? 'Sign in on the web to cancel the deletion if you want to keep the account.'
-                : 'Sign in to cancel the deletion if you want to keep the account.';
-        case 'contact_support':
-            return 'Contact support if you think this is a mistake.';
-        case 'use_another_account':
-            return surface === 'cli'
-                ? `Run \`${bin} login\` to sign in with a different account.`
-                : 'Sign in with a different account, or create a new one.';
-    }
+  const signIn = surface === "cli" ? `Run \`${bin} login\` to sign in again.` : "Sign in again to continue.";
+  switch (step) {
+    case "sign_in":
+      return signIn;
+    case "sign_in_and_review":
+      return `${signIn} If this was not you, open Settings > Account > Security activity to see what happened, and change your password.`;
+    case "cancel_deletion":
+      return surface === "cli" ? "Sign in on the web to cancel the deletion if you want to keep the account." : "Sign in to cancel the deletion if you want to keep the account.";
+    case "contact_support":
+      return "Contact support if you think this is a mistake.";
+    case "use_another_account":
+      return surface === "cli" ? `Run \`${bin} login\` to sign in with a different account.` : "Sign in with a different account, or create a new one.";
+  }
 }
-/**
- * THE copy for a revoked session. Never throws, whatever it is given: the server
- * can ship a reason before a client knows it, and that case must still say
- * something true ("we could not tell why"), not nothing.
- */
-function describeSessionRevocation(value, { surface = 'app', bin = exports.SESSION_REVOCATION_DEFAULT_BIN, } = {}) {
-    const reason = normalizeSessionRevocationReason(value);
-    const unrecognized = reason === exports.SESSION_REVOCATION_UNKNOWN &&
-        typeof value === 'string' &&
-        value.trim() !== '' &&
-        value !== exports.SESSION_REVOCATION_UNKNOWN
-        ? value.trim().slice(0, 64)
-        : null;
-    const copy = REASON_COPY[reason];
-    return {
-        reason,
-        unrecognized,
-        title: copy.title,
-        detail: copy.detail,
-        nextStep: copy.nextStep,
-        nextStepText: nextStepCopy(copy.nextStep, surface, bin),
-        reviewSecurityActivity: copy.nextStep === 'sign_in_and_review',
-        keys: {
-            title: `com_auth_revoked_${reason}_title`,
-            detail: `com_auth_revoked_${reason}_detail`,
-            nextStep: `com_auth_revoked_next_${copy.nextStep}`,
-        },
-    };
+function describeSessionRevocation(value, { surface = "app", bin = SESSION_REVOCATION_DEFAULT_BIN } = {}) {
+  const reason = normalizeSessionRevocationReason(value);
+  const unrecognized = reason === SESSION_REVOCATION_UNKNOWN && typeof value === "string" && value.trim() !== "" && value !== SESSION_REVOCATION_UNKNOWN ? value.trim().slice(0, 64) : null;
+  const copy = REASON_COPY[reason];
+  return {
+    reason,
+    unrecognized,
+    title: copy.title,
+    detail: copy.detail,
+    nextStep: copy.nextStep,
+    nextStepText: nextStepCopy(copy.nextStep, surface, bin),
+    reviewSecurityActivity: copy.nextStep === "sign_in_and_review",
+    keys: {
+      title: `com_auth_revoked_${reason}_title`,
+      detail: `com_auth_revoked_${reason}_detail`,
+      nextStep: `com_auth_revoked_next_${copy.nextStep}`
+    }
+  };
 }
-/** One line for a terminal or a notification: title, detail and next step. */
 function formatSessionRevocation(value, options = {}) {
-    const d = describeSessionRevocation(value, options);
-    const code = d.unrecognized ? ` (reason code: ${d.unrecognized})` : '';
-    return `${d.title}${code} ${d.detail} ${d.nextStepText}`;
+  const d = describeSessionRevocation(value, options);
+  const code = d.unrecognized ? ` (reason code: ${d.unrecognized})` : "";
+  return `${d.title}${code} ${d.detail} ${d.nextStepText}`;
 }
-/* ------------------------------------------------------------------------ */
-/* Triggers and causes — the Security activity record                       */
-/* ------------------------------------------------------------------------ */
-exports.SESSION_REVOCATION_TRIGGERS = [
-    'account_owner',
-    'administrator',
-    'security_system',
-    'external_provider',
-    'account_lifecycle',
-    'unknown',
+const SESSION_REVOCATION_TRIGGERS = [
+  "account_owner",
+  "administrator",
+  "security_system",
+  "external_provider",
+  "account_lifecycle",
+  "unknown"
 ];
-exports.SESSION_REVOCATION_CAUSES = [
-    'password_change',
-    'password_reset',
-    'sign_out_everywhere',
-    'sign_out_other_sessions',
-    'session_signed_out',
-    'two_factor_change',
-    'email_change',
-    'email_change_reverted',
-    'account_recovery',
-    'reported_not_me',
-    'sign_in_method_removed',
-    'machine_removed',
-    'oauth_app_revoked',
-    'session_limit',
-    'suspicious_reuse',
-    'administrator',
-    'account_suspended',
-    'external_provider',
-    'account_deletion_scheduled',
-    'account_superseded',
-    'unverified_account_cleanup',
-    'unknown',
+const SESSION_REVOCATION_CAUSES = [
+  "password_change",
+  "password_reset",
+  "sign_out_everywhere",
+  "sign_out_other_sessions",
+  "session_signed_out",
+  "two_factor_change",
+  "email_change",
+  "email_change_reverted",
+  "account_recovery",
+  "reported_not_me",
+  "sign_in_method_removed",
+  "machine_removed",
+  "oauth_app_revoked",
+  "session_limit",
+  "suspicious_reuse",
+  "administrator",
+  "account_suspended",
+  "external_provider",
+  "account_deletion_scheduled",
+  "account_superseded",
+  "unverified_account_cleanup",
+  "unknown"
 ];
-exports.SESSION_REVOCATION_CAUSE_FACTS = Object.freeze({
-    password_change: {
-        trigger: 'account_owner',
-        reason: 'password_change',
-        copy: 'The password was changed.',
-    },
-    password_reset: {
-        trigger: 'account_owner',
-        reason: 'password_change',
-        copy: 'The password was reset from an emailed link.',
-    },
-    sign_out_everywhere: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'Sign out everywhere was chosen.',
-    },
-    sign_out_other_sessions: {
-        trigger: 'account_owner',
-        reason: 'logged_out',
-        copy: 'Every other session was signed out.',
-    },
-    session_signed_out: {
-        trigger: 'account_owner',
-        reason: 'logged_out',
-        copy: 'A session was signed out.',
-    },
-    two_factor_change: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'Two-factor authentication settings changed.',
-    },
-    email_change: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'The account email address was changed.',
-    },
-    email_change_reverted: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'An email address change was undone from the link sent to the previous address.',
-    },
-    account_recovery: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'The account was recovered with a recovery key.',
-    },
-    reported_not_me: {
-        trigger: 'account_owner',
-        reason: 'sessions_revoked',
-        copy: 'A sign-in was reported as not you.',
-    },
-    sign_in_method_removed: {
-        trigger: 'account_owner',
-        reason: 'sign_in_method_removed',
-        copy: 'A sign-in method was removed, and the sessions that used it were ended.',
-    },
-    machine_removed: {
-        trigger: 'account_owner',
-        reason: 'machine_removed',
-        copy: 'A machine connection was removed, and the sessions it held were ended.',
-    },
-    oauth_app_revoked: {
-        trigger: 'account_owner',
-        reason: 'logged_out',
-        copy: 'Access for a connected application was revoked.',
-    },
-    session_limit: {
-        trigger: 'security_system',
-        reason: 'session_limit',
-        copy: 'The limit of signed-in sessions was reached, so the oldest session was ended.',
-    },
-    suspicious_reuse: {
-        trigger: 'security_system',
-        reason: 'security_check',
-        copy: 'A sign-in credential was presented twice, which can mean it was copied, so its sessions were ended.',
-    },
-    administrator: {
-        trigger: 'administrator',
-        reason: 'sessions_revoked',
-        copy: 'An administrator revoked the sessions.',
-    },
-    account_suspended: {
-        trigger: 'administrator',
-        reason: 'banned',
-        copy: 'An administrator suspended the account, which ends every session.',
-    },
-    external_provider: {
-        trigger: 'external_provider',
-        reason: 'sessions_revoked',
-        copy: 'Your sign-in provider reported a change to the account it vouches for.',
-    },
-    account_deletion_scheduled: {
-        trigger: 'account_owner',
-        reason: 'pending_deletion',
-        copy: 'Deletion of the account was requested.',
-    },
-    account_superseded: {
-        trigger: 'account_lifecycle',
-        reason: 'password_change',
-        copy: 'A new registration proved this email address and replaced the unverified account.',
-    },
-    unverified_account_cleanup: {
-        trigger: 'account_lifecycle',
-        reason: 'deleted',
-        copy: 'The unverified account was cleaned up.',
-    },
-    unknown: {
-        trigger: 'unknown',
-        reason: 'unknown',
-        copy: 'Sessions were revoked, and the server did not record why.',
-    },
+const SESSION_REVOCATION_CAUSE_FACTS = Object.freeze({
+  password_change: {
+    trigger: "account_owner",
+    reason: "password_change",
+    copy: "The password was changed."
+  },
+  password_reset: {
+    trigger: "account_owner",
+    reason: "password_change",
+    copy: "The password was reset from an emailed link."
+  },
+  sign_out_everywhere: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "Sign out everywhere was chosen."
+  },
+  sign_out_other_sessions: {
+    trigger: "account_owner",
+    reason: "logged_out",
+    copy: "Every other session was signed out."
+  },
+  session_signed_out: {
+    trigger: "account_owner",
+    reason: "logged_out",
+    copy: "A session was signed out."
+  },
+  two_factor_change: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "Two-factor authentication settings changed."
+  },
+  email_change: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "The account email address was changed."
+  },
+  email_change_reverted: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "An email address change was undone from the link sent to the previous address."
+  },
+  account_recovery: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "The account was recovered with a recovery key."
+  },
+  reported_not_me: {
+    trigger: "account_owner",
+    reason: "sessions_revoked",
+    copy: "A sign-in was reported as not you."
+  },
+  sign_in_method_removed: {
+    trigger: "account_owner",
+    reason: "sign_in_method_removed",
+    copy: "A sign-in method was removed, and the sessions that used it were ended."
+  },
+  machine_removed: {
+    trigger: "account_owner",
+    reason: "machine_removed",
+    copy: "A machine connection was removed, and the sessions it held were ended."
+  },
+  oauth_app_revoked: {
+    trigger: "account_owner",
+    reason: "logged_out",
+    copy: "Access for a connected application was revoked."
+  },
+  session_limit: {
+    trigger: "security_system",
+    reason: "session_limit",
+    copy: "The limit of signed-in sessions was reached, so the oldest session was ended."
+  },
+  suspicious_reuse: {
+    trigger: "security_system",
+    reason: "security_check",
+    copy: "A sign-in credential was presented twice, which can mean it was copied, so its sessions were ended."
+  },
+  administrator: {
+    trigger: "administrator",
+    reason: "sessions_revoked",
+    copy: "An administrator revoked the sessions."
+  },
+  account_suspended: {
+    trigger: "administrator",
+    reason: "banned",
+    copy: "An administrator suspended the account, which ends every session."
+  },
+  external_provider: {
+    trigger: "external_provider",
+    reason: "sessions_revoked",
+    copy: "Your sign-in provider reported a change to the account it vouches for."
+  },
+  account_deletion_scheduled: {
+    trigger: "account_owner",
+    reason: "pending_deletion",
+    copy: "Deletion of the account was requested."
+  },
+  account_superseded: {
+    trigger: "account_lifecycle",
+    reason: "password_change",
+    copy: "A new registration proved this email address and replaced the unverified account."
+  },
+  unverified_account_cleanup: {
+    trigger: "account_lifecycle",
+    reason: "deleted",
+    copy: "The unverified account was cleaned up."
+  },
+  unknown: {
+    trigger: "unknown",
+    reason: "unknown",
+    copy: "Sessions were revoked, and the server did not record why."
+  }
 });
-exports.SESSION_REVOCATION_TRIGGER_COPY = Object.freeze({
-    account_owner: 'Someone signed in to this account',
-    administrator: 'An administrator',
-    security_system: 'An automatic security measure',
-    external_provider: 'Your sign-in provider',
-    account_lifecycle: 'Account cleanup',
-    unknown: 'Unknown: the server could not tell who or what',
+const SESSION_REVOCATION_TRIGGER_COPY = Object.freeze({
+  account_owner: "Someone signed in to this account",
+  administrator: "An administrator",
+  security_system: "An automatic security measure",
+  external_provider: "Your sign-in provider",
+  account_lifecycle: "Account cleanup",
+  unknown: "Unknown: the server could not tell who or what"
 });
 function normalizeSessionRevocationCause(value) {
-    return typeof value === 'string' &&
-        exports.SESSION_REVOCATION_CAUSES.includes(value)
-        ? value
-        : 'unknown';
+  return typeof value === "string" && SESSION_REVOCATION_CAUSES.includes(value) ? value : "unknown";
 }
 function normalizeSessionRevocationTrigger(value) {
-    return typeof value === 'string' &&
-        exports.SESSION_REVOCATION_TRIGGERS.includes(value)
-        ? value
-        : 'unknown';
+  return typeof value === "string" && SESSION_REVOCATION_TRIGGERS.includes(value) ? value : "unknown";
 }
-/**
- * How Security activity explains one recorded revocation. A stored trigger wins
- * over the cause's usual one (an administrator can change a password too); an
- * unreadable one is `unknown`, never the cause's default.
- */
 function describeSessionRevocationActivity(record) {
-    const cause = normalizeSessionRevocationCause(record?.cause);
-    const trigger = record?.trigger === undefined || record?.trigger === null
-        ? 'unknown'
-        : normalizeSessionRevocationTrigger(record.trigger);
-    const facts = exports.SESSION_REVOCATION_CAUSE_FACTS[cause];
-    return {
-        cause,
-        trigger,
-        reason: facts.reason,
-        causeText: facts.copy,
-        triggerText: exports.SESSION_REVOCATION_TRIGGER_COPY[trigger],
-        keys: {
-            cause: `com_nav_security_activity_revocation_cause_${cause}`,
-            trigger: `com_nav_security_activity_revocation_trigger_${trigger}`,
-        },
-    };
+  const cause = normalizeSessionRevocationCause(record?.cause);
+  const trigger = record?.trigger === void 0 || record?.trigger === null ? "unknown" : normalizeSessionRevocationTrigger(record.trigger);
+  const facts = SESSION_REVOCATION_CAUSE_FACTS[cause];
+  return {
+    cause,
+    trigger,
+    reason: facts.reason,
+    causeText: facts.copy,
+    triggerText: SESSION_REVOCATION_TRIGGER_COPY[trigger],
+    keys: {
+      cause: `com_nav_security_activity_revocation_cause_${cause}`,
+      trigger: `com_nav_security_activity_revocation_trigger_${trigger}`
+    }
+  };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NON_REVOCATION_REFUSAL_CODES,
+  SESSION_REVOCATION_CAUSES,
+  SESSION_REVOCATION_CAUSE_FACTS,
+  SESSION_REVOCATION_DEFAULT_BIN,
+  SESSION_REVOCATION_NEXT_STEPS,
+  SESSION_REVOCATION_QUERY_PARAM,
+  SESSION_REVOCATION_REASONS,
+  SESSION_REVOCATION_TRIGGERS,
+  SESSION_REVOCATION_TRIGGER_COPY,
+  SESSION_REVOCATION_UNKNOWN,
+  describeSessionRevocation,
+  describeSessionRevocationActivity,
+  formatSessionRevocation,
+  isNonRevocationRefusalCode,
+  isSessionRevocationReason,
+  normalizeSessionRevocationCause,
+  normalizeSessionRevocationReason,
+  normalizeSessionRevocationTrigger,
+  sessionRevocationForRefusal
+});