ioredis-toolkit 0.0.9 → 0.5.0

package/dist/session/session-errors.js

@@ -1,145 +0,0 @@
-import { RedisError } from '../errors.js';
-/* -------------------------------------------------------------------------- */
-/* Typed, safe session errors.                                                 */
-/*                                                                             */
-/* Rules:                                                                      */
-/*  - Never embed raw session tokens, cookies, passwords, encryption keys,     */
-/*    or full session payloads in messages.                                    */
-/*  - JTI/userId are only included in `details` (structured metadata) after    */
-/*    redaction, never as plain strings in `message`.                          */
-/*  - Authentication layers map these errors to HTTP semantics:                */
-/*      SessionStorageError      -> 503 (infrastructure unavailable)           */
-/*      SessionNotFoundError     -> 401                                        */
-/*      SessionExpiredError      -> 401                                        */
-/*      SessionRevokedError      -> 401                                        */
-/*      CircuitBreakerOpenError  -> 503                                        */
-/* -------------------------------------------------------------------------- */
-/**
- * Base class for every session subsystem error.
- * Extends {@link RedisError} so existing Redis error handling keeps working.
- */
-export class SessionError extends RedisError {
-    constructor(message, code = 'SESSION_ERROR', details) {
-        super(message, code, details);
-        this.name = 'SessionError';
-    }
-}
-/** The session does not exist (or no longer exists). */
-export class SessionNotFoundError extends SessionError {
-    constructor(details) {
-        super('Session not found.', 'SESSION_NOT_FOUND', details);
-        this.name = 'SessionNotFoundError';
-    }
-}
-/** The session expired (absolute or idle timeout), or was created in the past. */
-export class SessionExpiredError extends SessionError {
-    constructor(details) {
-        super('Session has expired.', 'SESSION_EXPIRED', details);
-        this.name = 'SessionExpiredError';
-    }
-}
-/** The session was revoked or consumed by a rotation (replay detected). */
-export class SessionRevokedError extends SessionError {
-    constructor(details) {
-        super('Session is no longer valid.', 'SESSION_REVOKED', details);
-        this.name = 'SessionRevokedError';
-    }
-}
-/** The session record exists but is invalid (corrupt, tampered, mismatched). */
-export class SessionInvalidError extends SessionError {
-    constructor(details) {
-        super('Session is invalid.', 'SESSION_INVALID', details);
-        this.name = 'SessionInvalidError';
-    }
-}
-/** A security-sensitive session transition (rotation) failed. */
-export class SessionRotationError extends SessionError {
-    constructor(details) {
-        super('Session rotation failed.', 'SESSION_ROTATION_FAILED', details);
-        this.name = 'SessionRotationError';
-    }
-}
-/** Reuse of an already-consumed session token was detected. */
-export class SessionReplayError extends SessionError {
-    constructor(details) {
-        super('Session reuse detected.', 'SESSION_REPLAY', details);
-        this.name = 'SessionReplayError';
-    }
-}
-/**
- * Redis (or the session storage backend) is unavailable.
- *
- * Authentication MUST fail closed on this error: never treat it as an
- * invalid session, and never fall back to assuming the session is valid.
- */
-export class SessionStorageError extends SessionError {
-    constructor(message = 'Session storage unavailable.', details) {
-        super(message, 'SESSION_STORAGE_UNAVAILABLE', details);
-        this.name = 'SessionStorageError';
-    }
-}
-/** Stored session data could not be deserialized/decrypted. */
-export class SessionSerializationError extends SessionError {
-    constructor(details) {
-        super('Stored session data is malformed.', 'SESSION_SERIALIZATION_ERROR', details);
-        this.name = 'SessionSerializationError';
-    }
-}
-/** Session configuration is invalid (fails at manager construction). */
-export class SessionConfigurationError extends SessionError {
-    constructor(message, details) {
-        super(message, 'SESSION_CONFIGURATION_ERROR', details);
-        this.name = 'SessionConfigurationError';
-    }
-}
-/** Optimistic-concurrency conflict on a session update. */
-export class SessionConcurrencyError extends SessionError {
-    constructor(details) {
-        super('Session was modified concurrently.', 'SESSION_CONCURRENCY', details);
-        this.name = 'SessionConcurrencyError';
-    }
-}
-/** A revocation could not be persisted (fail closed, do not swallow). */
-export class RevocationError extends SessionError {
-    constructor(details) {
-        super('Revocation could not be persisted.', 'REVOCATION_ERROR', details);
-        this.name = 'RevocationError';
-    }
-}
-/** A batch revocation partially failed; check `failures` for details. */
-export class RevocationBatchError extends SessionError {
-    /** Safe identifiers of the entries whose pipeline command failed. */
-    failures;
-    constructor(failures) {
-        super(`Revocation batch failed for ${failures.length} entr${failures.length === 1 ? 'y' : 'ies'}.`, 'REVOCATION_BATCH_ERROR', { failureCount: failures.length });
-        this.name = 'RevocationBatchError';
-        this.failures = failures;
-    }
-    /** Compatibility alias: the affected jtis. */
-    get ids() {
-        return this.failures.map((f) => f.jti);
-    }
-}
-/** The circuit breaker is open; requests fail closed without touching Redis. */
-export class CircuitBreakerOpenError extends SessionError {
-    constructor(details) {
-        super('Authentication infrastructure is temporarily unavailable.', 'CIRCUIT_OPEN', details);
-        this.name = 'CircuitBreakerOpenError';
-    }
-}
-/**
- * Redacts an identifier for safe inclusion in logs/errors/metrics labels.
- *
- * Only the length and a short opaque suffix are revealed; never the full
- * value. Use for jti/userId/deviceId/ipAddress in structured details.
- *
- * @example
- * redactIdentifier('dG9rZW5oYXNo...') // => 'token#c3V'
- */
-export function redactIdentifier(value) {
-    if (!value)
-        return 'none';
-    if (value.length <= 6)
-        return `#${'*'.repeat(value.length)}`;
-    return `${value.slice(0, 3)}…${value.slice(-3)}`;
-}

package/dist/session/session-health.d.ts

@@ -1,38 +0,0 @@
-import type { RedisClientWrapper } from '../client.js';
-import type { SessionHealthConfig } from './session-config.js';
-export interface SessionHealthStatus {
-    /** True when PING latency and the recent error rate are within thresholds. */
-    healthy: boolean;
-    /** PING round trip in milliseconds, or null when the probe itself failed. */
-    latencyMs: number | null;
-    /** Recent operation error rate (0..1) from the sliding window. */
-    errorRate: number;
-    /** True when Redis is reachable at all (PING succeeded). */
-    reachable: boolean;
-    /** Unix ms of the last probe. */
-    checkedAt: number;
-}
-/**
- * Periodic PING probe + sliding-window error rate for the session dependency.
- *
- * Error-rate sampling is fed by {@link recordOp}; a PING probe runs on every
- * {@link check}. Both signals must be healthy for the overall status to be
- * healthy.
- */
-export declare class SessionHealthChecker {
-    private readonly client;
-    private readonly config;
-    private readonly now;
-    private readonly results;
-    constructor(client: RedisClientWrapper, config: SessionHealthConfig, options?: {
-        now?: () => number;
-    });
-    /** Feeds one operation outcome into the sliding window. */
-    recordOp(success: boolean): void;
-    private errorRate;
-    /**
-     * Runs a PING probe and returns the current health status.
-     * Never throws: probe failures surface as `reachable: false`.
-     */
-    check(): Promise<SessionHealthStatus>;
-}

package/dist/session/session-health.js

@@ -1,60 +0,0 @@
-/**
- * Periodic PING probe + sliding-window error rate for the session dependency.
- *
- * Error-rate sampling is fed by {@link recordOp}; a PING probe runs on every
- * {@link check}. Both signals must be healthy for the overall status to be
- * healthy.
- */
-export class SessionHealthChecker {
-    client;
-    config;
-    now;
-    results = [];
-    constructor(client, config, options = {}) {
-        this.client = client;
-        this.config = config;
-        this.now = options.now ?? (() => Date.now());
-    }
-    /** Feeds one operation outcome into the sliding window. */
-    recordOp(success) {
-        this.results.push(success);
-        const max = this.config.errorWindowSize;
-        if (this.results.length > max) {
-            this.results.splice(0, this.results.length - max);
-        }
-    }
-    errorRate() {
-        if (this.results.length === 0)
-            return 0;
-        let failures = 0;
-        for (const ok of this.results) {
-            if (!ok)
-                failures += 1;
-        }
-        return failures / this.results.length;
-    }
-    /**
-     * Runs a PING probe and returns the current health status.
-     * Never throws: probe failures surface as `reachable: false`.
-     */
-    async check() {
-        const checkedAt = this.now();
-        const started = performance.now();
-        let reachable = true;
-        let latencyMs = null;
-        try {
-            const pong = await this.client.raw.ping();
-            reachable = pong === 'PONG' || pong === true || pong === 'pong';
-            latencyMs = Math.round(performance.now() - started);
-        }
-        catch {
-            reachable = false;
-            latencyMs = null;
-        }
-        const errorRate = this.errorRate();
-        const healthy = reachable &&
-            (latencyMs === null || latencyMs <= this.config.latencyThresholdMs) &&
-            errorRate <= this.config.errorRateThreshold;
-        return { healthy, latencyMs, errorRate, reachable, checkedAt };
-    }
-}

package/dist/session/session-keys.d.ts

@@ -1,51 +0,0 @@
-/**
- * Deterministically encodes a userId for safe embedding in Redis keys.
- *
- * Every byte not in [A-Za-z0-9._-] is hex-encoded as %XX (UTF-8 aware),
- * so `{`, `}`, `:` and glob metacharacters can never appear. The encoding
- * is injective: distinct userIds always produce distinct encodings.
- */
-export declare function encodeUserId(userId: string): string;
-/**
- * Deterministic, Cluster-safe key strategy.
- *
- * Every key derived here is stable for the lifetime of the process and
- * identical across horizontally scaled instances (no randomness).
- */
-export declare class SessionKeyStrategy {
-    private readonly namespace;
-    /**
-     * @param namespace - Key namespace, e.g. `'authcore'`.
-     */
-    constructor(namespace: string);
-    private ns;
-    /**
-     * Key of a single session record. Hash-tagged by userId, so all of one
-     * user's session keys share a slot.
-     */
-    sessionKey(userId: string, jti: string): string;
-    /** Key of the user's session index (ZSET, member = jti, score = createdAt). */
-    userIndexKey(userId: string): string;
-    /** Key of the user's security version counter. Same user slot. */
-    securityVersionKey(userId: string): string;
-    /**
-     * Short-lived idempotent-creation claim key (user slot). Bounded TTL is
-     * set by the create script; a claim only ever suppresses a duplicate.
-     */
-    createClaimKey(userId: string, jti: string): string;
-    /**
-     * Key of the optional global JTI -> userId index.
-     * Deliberately NOT hash-tagged: it is cross-slot from the session record
-     * and treated as derived state (see docs/architecture).
-     */
-    jtiIndexKey(jti: string): string;
-    /** Key of a revocation entry (single-key, cluster-safe, no tag needed). */
-    revokedKey(jti: string): string;
-    /**
-     * Session key prefix for a user, used by Lua eviction to construct keys
-     * from jtis. The `{userId}` hash tag guarantees same-slot construction.
-     */
-    sessionKeyPrefix(userId: string): string;
-    /** Index key prefix for namespace-scoped administration. */
-    namespacePrefix(): string;
-}

package/dist/session/session-keys.js

@@ -1,113 +0,0 @@
-import { SessionConfigurationError } from './session-errors.js';
-/* -------------------------------------------------------------------------- */
-/* Redis key design for Redis Cluster.                                         */
-/*                                                                             */
-/*   session record : {ns}:session:{userId}:session:{jti}                      */
-/*   user index     : {ns}:user-sessions:{userId}          (ZSET)              */
-/*   security ver   : {ns}:security-version:{userId}      (string)             */
-/*   jti index (opt): {ns}:jti-index:{jti}               (cross-slot, global)  */
-/*   revoked (opt)  : {ns}:revoked:{jti}                 (cross-slot, single)  */
-/*                                                                             */
-/* The literal text `{userId}` is the Redis Cluster hash tag: every key of     */
-/* one user shares one slot, enabling atomic Lua scripts per user. No global   */
-/* hash tag is used, so sessions are spread across slots.                      */
-/*                                                                             */
-/* userId values are percent-encoded before embedding: values containing       */
-/* `{`, `}`, `:`, `*`, `?`, `[`, `]` etc. would otherwise break hash tags,     */
-/* glob patterns and key parsing. The encoding is deterministic and            */
-/* collision-free.                                                             */
-/* -------------------------------------------------------------------------- */
-/** Characters kept verbatim in the encoded user id. */
-const SAFE = /^[A-Za-z0-9._-]$/;
-/**
- * Deterministically encodes a userId for safe embedding in Redis keys.
- *
- * Every byte not in [A-Za-z0-9._-] is hex-encoded as %XX (UTF-8 aware),
- * so `{`, `}`, `:` and glob metacharacters can never appear. The encoding
- * is injective: distinct userIds always produce distinct encodings.
- */
-export function encodeUserId(userId) {
-    if (typeof userId !== 'string' || userId.length === 0 || userId.length > 512) {
-        throw new SessionConfigurationError('userId must be a non-empty string of at most 512 chars.');
-    }
-    let out = '';
-    for (let i = 0; i < userId.length; i++) {
-        const ch = userId[i];
-        if (SAFE.test(ch)) {
-            out += ch;
-        }
-        else {
-            for (const byte of Buffer.from(ch, 'utf8')) {
-                out += `%${byte.toString(16).padStart(2, '0')}`;
-            }
-        }
-    }
-    return out;
-}
-/**
- * Deterministic, Cluster-safe key strategy.
- *
- * Every key derived here is stable for the lifetime of the process and
- * identical across horizontally scaled instances (no randomness).
- */
-export class SessionKeyStrategy {
-    namespace;
-    /**
-     * @param namespace - Key namespace, e.g. `'authcore'`.
-     */
-    constructor(namespace) {
-        const trimmed = namespace.trim();
-        if (!trimmed || trimmed.length > 64 || /[\s{}/:*?[\]]/.test(trimmed)) {
-            throw new SessionConfigurationError('namespace must be 1-64 chars without whitespace or glob/hash-tag metacharacters.');
-        }
-        this.namespace = trimmed;
-    }
-    ns(part) {
-        return `${this.namespace}:${part}`;
-    }
-    /**
-     * Key of a single session record. Hash-tagged by userId, so all of one
-     * user's session keys share a slot.
-     */
-    sessionKey(userId, jti) {
-        return this.ns(`session:{${encodeUserId(userId)}}:session:${jti}`);
-    }
-    /** Key of the user's session index (ZSET, member = jti, score = createdAt). */
-    userIndexKey(userId) {
-        return this.ns(`user-sessions:{${encodeUserId(userId)}}`);
-    }
-    /** Key of the user's security version counter. Same user slot. */
-    securityVersionKey(userId) {
-        return this.ns(`security-version:{${encodeUserId(userId)}}`);
-    }
-    /**
-     * Short-lived idempotent-creation claim key (user slot). Bounded TTL is
-     * set by the create script; a claim only ever suppresses a duplicate.
-     */
-    createClaimKey(userId, jti) {
-        return this.ns(`create-claim:{${encodeUserId(userId)}}:${jti}`);
-    }
-    /**
-     * Key of the optional global JTI -> userId index.
-     * Deliberately NOT hash-tagged: it is cross-slot from the session record
-     * and treated as derived state (see docs/architecture).
-     */
-    jtiIndexKey(jti) {
-        return this.ns(`jti-index:${jti}`);
-    }
-    /** Key of a revocation entry (single-key, cluster-safe, no tag needed). */
-    revokedKey(jti) {
-        return this.ns(`revoked:${jti}`);
-    }
-    /**
-     * Session key prefix for a user, used by Lua eviction to construct keys
-     * from jtis. The `{userId}` hash tag guarantees same-slot construction.
-     */
-    sessionKeyPrefix(userId) {
-        return this.ns(`session:{${encodeUserId(userId)}}:session:`);
-    }
-    /** Index key prefix for namespace-scoped administration. */
-    namespacePrefix() {
-        return `${this.namespace}:`;
-    }
-}

package/dist/session/session-manager.d.ts

@@ -1,73 +0,0 @@
-import type { RedisClientWrapper } from '../client.js';
-import type { RevocationStore } from './session-types.js';
-import { SessionCircuitBreaker } from './session-circuit-breaker.js';
-import type { PartialSessionConfig, SessionConfig } from './session-config.js';
-import { SessionCookieManager } from './session-cookie.js';
-import { SessionHealthChecker } from './session-health.js';
-import type { SessionKeyProvider } from './session-encryption.js';
-import { SessionKeyStrategy } from './session-keys.js';
-import { SessionMetrics } from './session-metrics.js';
-import type { SessionMetricsAdapter } from './session-metrics.js';
-import { SessionRepository } from './session-repository.js';
-import { SessionService } from './session-service.js';
-import { SessionTokenManager } from './session-token.js';
-export type SessionManagerOptions = {
-    /** Redis client (standalone, sentinel or cluster - all supported). */
-    client: RedisClientWrapper;
-    /** Session configuration (defaults applied; see SessionConfigSchema). */
-    config?: PartialSessionConfig;
-    /**
-     * Encryption key provider. REQUIRED when config.encryption.enabled is
-     * true (fail at construction rather than at first write). The provider
-     * should be backed by a KMS/vault in production.
-     */
-    encryptionKeyProvider?: SessionKeyProvider;
-    /** External revocation store (JWT jti denylists etc.). */
-    revocationStore?: RevocationStore;
-    /** Metrics adapter (no-op without it). */
-    metricsAdapter?: SessionMetricsAdapter;
-    /** Optional circuit breaker (enabled via config.circuitBreaker.enabled). */
-    circuitBreaker?: SessionCircuitBreaker;
-    /** Injectable clock for tests. */
-    now?: () => number;
-};
-export type WithSessionManagerOptions = {
-    /** Session configuration (defaults applied; see SessionConfigSchema). */
-    config?: PartialSessionConfig;
-    /**
-     * Encryption key provider. REQUIRED when config.encryption.enabled is
-     * true (fail at construction rather than at first write). The provider
-     * should be backed by a KMS/vault in production.
-     */
-    encryptionKeyProvider?: SessionKeyProvider;
-    /** Metrics adapter (no-op without it). */
-    metricsAdapter?: SessionMetricsAdapter;
-    /** Injectable clock for tests. */
-    now?: () => number;
-};
-export declare class SessionManager {
-    readonly config: SessionConfig;
-    readonly service: SessionService;
-    readonly repository: SessionRepository;
-    readonly metrics: SessionMetrics;
-    readonly circuitBreaker: SessionCircuitBreaker | null;
-    readonly health: SessionHealthChecker;
-    readonly cookies: SessionCookieManager;
-    readonly token: SessionTokenManager;
-    readonly keys: SessionKeyStrategy;
-    private readonly scripts;
-    private readonly client;
-    constructor(options: SessionManagerOptions);
-    /** Preloads Lua scripts now (awaits SCRIPT LOAD on all nodes). */
-    init(): Promise<void>;
-    /** No-op for symmetry: the client is owned by the application. */
-    close(): void;
-}
-/**
- * Creates a session manager. Synchronous: use `await manager.init()` when
- * eager script preloading matters (first call latency).
- *
- * @throws {SessionConfigurationError} when the config is invalid, encryption
- *   is enabled without a key provider, or sessions are not explicitly enabled.
- */
-export declare function createSessionManager(options: SessionManagerOptions): SessionManager;

package/dist/session/session-manager.js

@@ -1,94 +0,0 @@
-import { SessionConfigurationError } from './session-errors.js';
-import { SessionCircuitBreaker } from './session-circuit-breaker.js';
-import { parseSessionConfig } from './session-config.js';
-import { SessionCookieManager } from './session-cookie.js';
-import { SessionHealthChecker } from './session-health.js';
-import { SessionKeyStrategy } from './session-keys.js';
-import { SessionMetrics } from './session-metrics.js';
-import { SessionRepository } from './session-repository.js';
-import { SessionScriptRegistry } from './session-scripts.js';
-import { SessionService } from './session-service.js';
-import { SessionTokenManager } from './session-token.js';
-export class SessionManager {
-    config;
-    service;
-    repository;
-    metrics;
-    circuitBreaker;
-    health;
-    cookies;
-    token;
-    keys;
-    scripts;
-    client;
-    constructor(options) {
-        const config = parseSessionConfig(options.config);
-        if (config.encryption.enabled && !options.encryptionKeyProvider) {
-            throw new SessionConfigurationError('encryptionKeyProvider is required when config.encryption.enabled is true.');
-        }
-        if (!config.enabled) {
-            // Constructing an enabled-by-default subsystem would surprise; the
-            // manager is inert until config.enabled is explicitly set.
-            throw new SessionConfigurationError('Session subsystem is not enabled: set config.enabled = true to opt in.');
-        }
-        this.client = options.client;
-        this.config = config;
-        this.token = new SessionTokenManager(config.tokenBytes);
-        this.keys = new SessionKeyStrategy(config.namespace);
-        this.scripts = new SessionScriptRegistry(options.client);
-        this.repository = new SessionRepository({
-            client: options.client,
-            keys: this.keys,
-            config,
-            scripts: this.scripts,
-            keyProvider: options.encryptionKeyProvider ?? null,
-        });
-        this.metrics = new SessionMetrics(options.metricsAdapter, options.client.mode);
-        this.circuitBreaker =
-            options.circuitBreaker ??
-                (config.circuitBreaker.enabled
-                    ? new SessionCircuitBreaker(config.circuitBreaker, {
-                        onTransition: (state) => this.metrics.breakerState(state),
-                    })
-                    : null);
-        this.health = new SessionHealthChecker(options.client, config.health, {
-            ...(options.now !== undefined ? { now: options.now } : {}),
-        });
-        this.cookies = new SessionCookieManager(config.cookie);
-        this.service = new SessionService({
-            config,
-            client: options.client,
-            repository: this.repository,
-            token: this.token,
-            keys: this.keys,
-            ...(options.revocationStore !== undefined
-                ? { revocationStore: options.revocationStore }
-                : {}),
-            metrics: this.metrics,
-            ...(this.circuitBreaker !== null ? { circuitBreaker: this.circuitBreaker } : {}),
-            health: this.health,
-            ...(options.now !== undefined ? { now: options.now } : {}),
-        });
-        // Preload scripts in the background; the EVALSHA + NOSCRIPT fallback
-        // keeps working until (and after) the preload finishes.
-        void this.scripts.preload();
-    }
-    /** Preloads Lua scripts now (awaits SCRIPT LOAD on all nodes). */
-    async init() {
-        await this.scripts.preload();
-    }
-    /** No-op for symmetry: the client is owned by the application. */
-    close() {
-        this.scripts.invalidate();
-    }
-}
-/**
- * Creates a session manager. Synchronous: use `await manager.init()` when
- * eager script preloading matters (first call latency).
- *
- * @throws {SessionConfigurationError} when the config is invalid, encryption
- *   is enabled without a key provider, or sessions are not explicitly enabled.
- */
-export function createSessionManager(options) {
-    return new SessionManager(options);
-}

package/dist/session/session-metrics.d.ts

@@ -1,33 +0,0 @@
-/** Application-provided metrics sink. Implementations must be non-throwing. */
-export interface SessionMetricsAdapter {
-    /** Increments a counter by delta (default 1). */
-    incCounter(name: string, delta?: number, attributes?: Record<string, string | number>): void;
-    /** Records a duration sample (milliseconds). */
-    recordHistogram(name: string, value: number, attributes?: Record<string, string | number>): void;
-    /** Sets a gauge to a value. */
-    setGauge(name: string, value: number, attributes?: Record<string, string | number>): void;
-}
-export type SessionOperation = 'create' | 'validate' | 'touch' | 'rotate' | 'update' | 'destroy' | 'revoke' | 'revoke_all' | 'delete_by_user' | 'list' | 'find_by_user' | 'set_security_version' | 'health';
-/**
- * Internal session metrics facade. Safe no-op without an adapter.
- */
-export declare class SessionMetrics {
-    private readonly adapter;
-    private readonly topology;
-    constructor(adapter?: SessionMetricsAdapter | null, topology?: string);
-    /** Adds the constant topology label to an attribute set. */
-    private withTopology;
-    /** Counts a completed session operation, with its outcome. */
-    operation(op: SessionOperation, outcome: 'ok' | 'error' | 'invalid', code?: string): void;
-    /** Records operation latency in milliseconds. */
-    latency(op: SessionOperation, ms: number): void;
-    /** Records the circuit breaker state transition. */
-    breakerState(state: 'closed' | 'open' | 'half_open'): void;
-    /** Records a fail-closed revocation-store failure (a security-relevant miss). */
-    revocationMiss(): void;
-    /** Records encryption failures (key rotation issues, corruption). */
-    encryptionError(reason: string): void;
-    /** Records a failed best-effort jti index write (derived-state degradation). */
-    jtiIndexWriteFailure(): void;
-}
-export declare const SESSION_OPERATIONS: readonly SessionOperation[];