export type TActivityAction =
  | 'login'
  | 'logout'
  | 'session_created'
  | 'session_revoked'
  | 'passport_device_enrolled'
  | 'passport_device_revoked'
  | 'passport_challenge_approved'
  | 'passport_challenge_rejected'
  | 'org_created'
  | 'org_updated'
  | 'org_deleted'
  | 'org_ownership_transferred'
  | 'org_joined'
  | 'org_left'
  | 'role_changed'
  | 'org_app_role_mappings_updated'
  | 'profile_updated'
  | 'totp_enabled'
  | 'totp_disabled'
  | 'backup_codes_regenerated'
  | 'mfa_completed'
  | 'passkey_registered'
  | 'passkey_revoked'
  | 'passkey_login'
  | 'app_connected'
  | 'app_disconnected'
  | 'user_suspended'
  | 'user_unsuspended'
  | 'global_admin_granted'
  | 'global_admin_removed'
  | 'global_capabilities_changed'
  | 'break_glass_requested'
  | 'break_glass_activated'
  | 'break_glass_used'
  | 'break_glass_reviewed'
  | 'administrator_recovery_requested'
  | 'administrator_recovery_activated'
  | 'administrator_recovery_completed'
  | 'account_deletion_requested'
  | 'account_deletion_cancelled'
  | 'account_purged'
  | 'sso_connection_created'
  | 'sso_connection_updated'
  | 'sso_connection_deleted'
  | 'sso_domain_verified'
  | 'sso_login'
  | 'scim_token_created'
  | 'scim_token_revoked'
  | 'scim_user_provisioned'
  | 'scim_user_updated'
  | 'scim_user_deactivated'
  | 'scim_group_membership_changed'
  | 'oidc_authorization_granted'
  | 'oidc_code_exchanged'
  | 'oidc_refresh_rotated'
  | 'oidc_refresh_reuse_detected'
  | 'oidc_token_revoked'
  | 'oidc_logout'
  | 'oidc_client_created'
  | 'oidc_client_updated'
  | 'oidc_client_activation_changed'
  | 'oidc_client_deleted'
  | 'oidc_client_secret_rotated'
  | 'oidc_signing_key_rotated'
  | 'oidc_lifecycle_revoked'
  | 'org_suspended'
  | 'org_unsuspended';

export type TActivityOutcome = 'attempted' | 'succeeded' | 'denied' | 'failed';

/**
 * Public failure reasons are deliberately finite and non-descriptive. They
 * classify an outcome without carrying provider errors, account data, or
 * caller-authored text across the public contract boundary.
 */
export type TActivityReasonCode =
  | 'account_inactive'
  | 'authentication_failed'
  | 'authorization_denied'
  | 'conflict'
  | 'expired'
  | 'invalid_request'
  | 'policy_denied'
  | 'rate_limited'
  | 'replay_detected'
  | 'revoked'
  | 'step_up_required'
  | 'upstream_unavailable'
  | 'user_cancelled';

export type TActivityTargetType =
  | 'account'
  | 'administrator_recovery'
  | 'application_connection'
  | 'break_glass_access'
  | 'mfa_method'
  | 'oidc_authorization'
  | 'oidc_client'
  | 'oidc_lifecycle'
  | 'oidc_signing_key'
  | 'oidc_token'
  | 'organization'
  | 'organization_membership'
  | 'organization_role_mapping'
  | 'passkey'
  | 'passport_challenge'
  | 'passport_device'
  | 'profile'
  | 'scim_group_membership'
  | 'scim_token'
  | 'scim_user'
  | 'session'
  | 'sso_connection'
  | 'sso_domain';

export type TActivityAuthenticationMethod = 'magic_link' | 'password';
export type TActivitySessionKind = 'browser' | 'oidc';
export type TActivityRevocationScope =
  | 'account'
  | 'all_sessions'
  | 'application'
  | 'current_session'
  | 'organization'
  | 'token_family';
export type TActivityRoleChange = 'assigned' | 'removed' | 'replaced';
export type TActivityMfaFactor = 'backup_code' | 'passkey' | 'totp';
export type TActivityMembershipChange = 'added' | 'reconciled' | 'removed';
export type TActivityOidcTokenType = 'access_token' | 'refresh_token' | 'token_family';