Module device 

User-agent parsing → friendly device labels.

Real UA parsers (uap-rs, ua_parser) ship 2k+ regex pairs. For the /api/auth/sessions UI we don’t need that — we want a single readable label per session (“Chrome on macOS”, “Safari on iOS”, “Yubikey CLI”). Substring matching covers >95% of real traffic at <1% the binary size.

What this DOESN’T do:

• Parse exact browser/OS versions (apps that need that should pull the UA string verbatim from Session.device and parse it themselves)
• Detect WebViews vs native (the UA isn’t reliable for that anyway)
• Identify bots (use a separate IP-reputation feed)

Bounded output — the friendly label caps at 80 chars so a pathological UA can’t blow up the session row.

Functions

parse_user_agent

Turn a User-Agent header value into a short friendly label. Falls back to “Unknown” for empty / unrecognized strings.