@syncular/server 0.31.0 → 0.32.0

package/dist/admin.d.ts

@@ -1,31 +1,35 @@
 /**
- * `SyncularAdmin` is the operator-facing read surface over the server core.
- * It is a read-only, partition-scoped, JSON-able query layer over
- * `ServerStorage`, the optional segment/blob store stats, and an in-memory
- * event ring. It delivers the 80% operator value (who's connected, what's
- * flowing, horizon health, the event tail) as a handful of queries in the
- * server package — no separate UI package, no framework, and no wire-protocol
- * surface. This host surface is mirrored in the server README.
+ * `SyncularAdmin` is the operator-facing surface over the server core: a
+ * partition-scoped, JSON-able query layer over `ServerStorage`, the optional
+ * segment/blob store stats, and an in-memory event ring, plus three explicit
+ * operator actions (retry a dead-lettered reaction, prune the commit log,
+ * revoke a client's lease). No separate UI package, no framework, and no
+ * wire-protocol surface. This host surface is mirrored in the server README.
  *
- * Nothing here is on the sync hot path. Every method is a plain read; the
- * additive optional storage/store methods it depends on are documented as
- * such and this module fails loud (a thrown `Error`) when a backend lacks
- * one, so a host wiring an unsupported store learns immediately rather than
- * getting a silently-empty console.
+ * Nothing here is on the sync hot path. The additive optional storage/store
+ * methods it depends on are documented as such and this module fails loud (a
+ * thrown `Error`) when a backend lacks one, so a host wiring an unsupported
+ * store learns immediately rather than getting a silently-empty console.
  */
+import { type ColumnType, type JsonValue, type PushOperationResult, type ScopeMap } from '@syncular/core';
 import type { BlobStore, BlobStoreStats } from './blob-store.js';
-import { type SyncServerConfig } from './context.js';
-import type { SyncularServerEvent } from './events.js';
+import { type ResolveScopes, type SyncServerConfig } from './context.js';
+import { type SyncularServerEvent, type SyncularServerEvents } from './events.js';
 import type { RingBufferEvents, RingEventQuery } from './events-ring.js';
 import type { LeaseRecord, LeaseStore } from './lease-store.js';
+import { RealtimeHub } from './realtime.js';
 import { type RetentionPolicy } from './prune.js';
 import { type ServerSchema } from './schema.js';
 import type { SegmentStore, SegmentStoreStats } from './segment-store.js';
-import type { CheckpointDeclaration, CommitMetadata, ReactionStatus, ScopeCommitActivity, ServerStorage, StoredReaction } from './storage.js';
+import type { CheckpointDeclaration, CommitMetadata, ReactionStatus, StoredPushResult, RowChangeRecord, ScopeCommitActivity, ServerStorage, StoredReaction } from './storage.js';
 /** A connected/known client as the console sees it (§4.5, §8.1). */
 export interface AdminClient {
     readonly clientId: string;
     readonly actorId: string;
+    /** SSP2 wire version last accepted from this client. */
+    readonly wireVersion: number;
+    /** Highest codec schema version among its subscriptions, when recorded. */
+    readonly schemaVersion?: number;
     readonly cursor: number;
     /**
      * Commits the client has not pulled yet: `maxCommitSeq − max(cursor, 0)`.
@@ -40,6 +44,24 @@ export interface AdminClient {
     }[];
     /** True when the cursor record was touched within the active window. */
     readonly active: boolean;
+    /**
+     * True while the client holds an open realtime socket on this process.
+     * Absent when the admin has no realtime hub.
+     */
+    readonly connected?: boolean;
+    /** When the client's oldest open socket opened. */
+    readonly connectedSinceMs?: number;
+}
+export interface AdminListClientsOptions {
+    /** Default 200. */
+    readonly limit?: number;
+    /** `seen` (default): most recently seen first. `lag`: largest lag first. */
+    readonly sort?: 'seen' | 'lag';
+}
+export interface AdminClientPage {
+    readonly clients: readonly AdminClient[];
+    /** Known clients in the partition before `limit`. */
+    readonly total: number;
 }
 /** One client's drill-down: record + lease + its slice of the event tail. */
 export interface AdminClientDetail {
@@ -52,12 +74,27 @@ export interface AdminClientDetail {
     /** Recent ring events carrying this clientId (newest first). */
     readonly events: readonly SyncularServerEvent[];
 }
+/**
+ * How much of a requested window the ring still holds. `complete` is false
+ * when the ring dropped events inside the window; the aggregates then cover
+ * only `fromMs` onward.
+ */
+export interface AdminEventCoverage {
+    readonly complete: boolean;
+    readonly fromMs: number;
+}
+export interface AdminPushCounts {
+    readonly applied: number;
+    readonly rejected: number;
+    readonly conflicted: number;
+}
 /** Ring-derived request/push aggregates over a trailing window. */
 export interface AdminMetrics {
     readonly partition: string;
     readonly windowMs: number;
     /** Wall-clock the aggregation ran at (window end). */
     readonly atMs: number;
+    readonly coverage: AdminEventCoverage;
     readonly requests: {
         readonly count: number;
         readonly perMinute: number;
@@ -67,21 +104,58 @@ export interface AdminMetrics {
         readonly p50Ms: number;
         readonly p95Ms: number;
     };
-    readonly pushes: {
-        readonly applied: number;
-        readonly rejected: number;
-        readonly conflicted: number;
-    };
+    readonly pushes: AdminPushCounts;
     /**
-     * Request counts split into `counts.length` equal buckets, oldest first —
-     * the console's sparkline. `errors` marks the error share per bucket.
+     * The window split into `counts.length` equal buckets, oldest first: the
+     * request count, failed requests, p95 duration (`null` for an empty
+     * bucket), and push outcomes per bucket.
      */
     readonly buckets: {
         readonly widthMs: number;
         readonly counts: readonly number[];
         readonly errors: readonly number[];
+        readonly p95Ms: readonly (number | null)[];
+        readonly pushes: readonly AdminPushCounts[];
     };
 }
+/** Failures sharing one source and code within the window. */
+export interface AdminErrorGroup {
+    readonly source: 'request' | 'push' | 'reaction' | 'scopes';
+    /** The §10.2 code; `scopes.resolve_failed` for a throwing resolver. */
+    readonly code: string;
+    readonly count: number;
+    /** Distinct clients among the events that carry a clientId. */
+    readonly clients: number;
+    /** Distinct actors among the events that carry an actorId. */
+    readonly actors: number;
+    readonly lastAtMs: number;
+    /** Up to five client ids, most recent first. */
+    readonly sampleClientIds: readonly string[];
+    /** Up to five rows the failing pushes targeted, most recent first. */
+    readonly sampleRows: readonly {
+        readonly table: string;
+        readonly rowId: string;
+    }[];
+}
+/** One client's push failures within the window. */
+export interface AdminClientErrors {
+    readonly clientId: string;
+    readonly actorId: string;
+    readonly count: number;
+    readonly lastCode: string;
+    readonly lastAtMs: number;
+}
+/** "What is failing": ring failures grouped by code and by client. */
+export interface AdminErrorSummary {
+    readonly partition: string;
+    readonly windowMs: number;
+    readonly atMs: number;
+    readonly coverage: AdminEventCoverage;
+    /** Largest count first. */
+    readonly byCode: readonly AdminErrorGroup[];
+    /** Every client with a request or push failure, largest count first. */
+    readonly byClient: readonly AdminClientErrors[];
+}
 /** One partition's row in the fleet view (`listPartitions` + horizon math). */
 export interface AdminPartitionOverview {
     readonly partition: string;
@@ -93,14 +167,175 @@ export interface AdminPartitionOverview {
     readonly activeClients: number;
     readonly recommendation: 'up-to-date' | 'prune-recommended';
 }
+export interface AdminPartitionPage {
+    readonly partitions: readonly AdminPartitionOverview[];
+    /** Every registered partition before `offset`/`limit`. */
+    readonly total: number;
+}
 export interface AdminRowInspection {
     readonly table: string;
     readonly rowId: string;
     readonly exists: boolean;
     readonly serverVersion?: number;
     readonly scopes?: Record<string, string>;
-    /** blobIds this row currently references (§5.9.4), when the store tracks them. */
-    readonly referencedBlobIds?: readonly string[];
+    /** Present iff `exists`: the row decoded and rendered per §11. */
+    readonly values?: Record<string, JsonValue>;
+    /** The retained changes to this row, newest first. */
+    readonly history: readonly RowChangeRecord[];
+}
+/** One change in a commit drill-down. */
+export interface AdminCommitChange {
+    readonly table: string;
+    readonly rowId: string;
+    readonly op: 'upsert' | 'delete';
+    readonly rowVersion?: number;
+    readonly scopes: Record<string, string>;
+    /** The upserted row rendered per §11; absent for deletes. */
+    readonly values?: Record<string, JsonValue>;
+    /**
+     * True when the stored payload does not decode against the current
+     * schema (written under an older column set).
+     */
+    readonly undecodable?: boolean;
+}
+export interface AdminCommitDetail extends CommitMetadata {
+    readonly changes: readonly AdminCommitChange[];
+}
+/**
+ * The trace verdict, evaluated in this order:
+ * `client-unknown`: no client record for the id.
+ * `row-missing`: no row and no retained change to it.
+ * `no-subscription`: the client subscribes to nothing on the table.
+ * `row-deleted`: the row's newest retained change is a delete the client
+ * has pulled.
+ * `scope-mismatch`: no subscription requests the row's stored scopes.
+ * `scope-denied`: a subscription requests them, but the actor's allowed
+ * scopes (the host `resolveScopes`) exclude the row.
+ * `pending-pull`: the client's cursor is below the row's newest change.
+ * `delivered`: the client has pulled the row's newest change.
+ */
+export type AdminTraceVerdict = 'client-unknown' | 'row-missing' | 'no-subscription' | 'row-deleted' | 'scope-mismatch' | 'scope-denied' | 'pending-pull' | 'delivered';
+/** One of the client's subscriptions on the traced table. */
+export interface AdminTraceSubscription {
+    readonly id: string;
+    readonly scopes: Record<string, readonly string[]>;
+    /** The row's stored scopes satisfy the requested scopes. */
+    readonly requestedMatch: boolean;
+    /** Each requested variable the row's stored value fails. */
+    readonly mismatches: readonly {
+        readonly variable: string;
+        readonly rowValue: string | null;
+        readonly requested: readonly string[];
+    }[];
+    /**
+     * The row also satisfies requested ∩ allowed (§3.2). Absent when the
+     * admin has no `resolveScopes` or the resolver reported an outage.
+     */
+    readonly effectiveMatch?: boolean;
+}
+/** "Why does client X (not) see row Y": one read across row and client. */
+export interface AdminRowTrace {
+    readonly verdict: AdminTraceVerdict;
+    readonly table: string;
+    readonly rowId: string;
+    readonly clientId: string;
+    readonly row: AdminRowInspection;
+    /** The row's newest retained change. */
+    readonly lastChange?: RowChangeRecord;
+    /** The partition horizon: changes at or below it are pruned. */
+    readonly horizonSeq: number;
+    readonly client?: AdminClient;
+    /**
+     * The actor's allowed scopes from the host `resolveScopes`, or `outage`
+     * when it returned the §7.3.3 outage sentinel. Absent without a resolver.
+     */
+    readonly allowed?: ScopeMap | 'outage';
+    readonly subscriptions: readonly AdminTraceSubscription[];
+    /** The client's retained push rejections and conflicts, newest first. */
+    readonly rejections: readonly SyncularServerEvent[];
+}
+/** One client's verdict in a row's delivery matrix. */
+export interface AdminRowDeliveryClient {
+    readonly client: AdminClient;
+    readonly verdict: AdminTraceVerdict;
+}
+/** Who has one row and who does not: every known client's verdict. */
+export interface AdminRowDelivery {
+    readonly table: string;
+    readonly rowId: string;
+    readonly row: AdminRowInspection;
+    readonly lastChange?: RowChangeRecord;
+    readonly horizonSeq: number;
+    /** Every known client, sorted by verdict then most recently seen. */
+    readonly clients: readonly AdminRowDeliveryClient[];
+}
+/** One actor and its devices (clients). */
+export interface AdminActor {
+    readonly actorId: string;
+    readonly clients: readonly AdminClient[];
+    /** Devices with an open socket; absent without a realtime hub. */
+    readonly connected?: number;
+    readonly lastSeenMs: number;
+    readonly maxLag: number;
+    /** The actor's failures in the last 5 minutes, as `errors().byClient` counts them. */
+    readonly recentFailures: number;
+}
+/** A page of decoded rows from one table. */
+export interface AdminRowPage {
+    readonly table: string;
+    readonly rows: readonly {
+        readonly rowId: string;
+        readonly serverVersion: number;
+        readonly scopes: Record<string, string>;
+        readonly values: Record<string, JsonValue>;
+    }[];
+    /** Pass as `afterRowId` for the next page; absent on the last page. */
+    readonly nextAfterRowId?: string;
+}
+/**
+ * One per-operation result of a stored write, JSON-safe: a conflict's
+ * `serverRow` and `conflictColumns` bytes are standard base64 (§11).
+ */
+export type AdminWriteResult = Exclude<PushOperationResult, {
+    status: 'conflict';
+}> | (Omit<Extract<PushOperationResult, {
+    status: 'conflict';
+}>, 'serverRow' | 'conflictColumns'> & {
+    readonly serverRow: string;
+    readonly conflictColumns: string;
+});
+/** One stored outcome of a client write (§2.3 idempotency record). */
+export interface AdminWriteOutcome {
+    readonly clientId: string;
+    readonly status: StoredPushResult['status'];
+    readonly commitSeq?: number;
+    readonly recordedAtMs?: number;
+    readonly results: readonly AdminWriteResult[];
+}
+/** What happened to the write a client logged as `clientCommitId`. */
+export interface AdminWriteLookup {
+    readonly clientCommitId: string;
+    /** One outcome per client that sent this clientCommitId. */
+    readonly outcomes: readonly AdminWriteOutcome[];
+    /** Retained ring events carrying this clientCommitId, newest first. */
+    readonly events: readonly SyncularServerEvent[];
+}
+/** Everything an id pasted into the console search matches. */
+export interface AdminSearchResult {
+    readonly query: string;
+    /** Clients whose id contains the query, or whose actor equals it. */
+    readonly clients: readonly AdminClient[];
+    /** Actors whose id contains the query. */
+    readonly actors: readonly string[];
+    /** Rows whose id equals the query, one per table that holds it. */
+    readonly rows: readonly {
+        readonly table: string;
+        readonly rowId: string;
+    }[];
+    /** The commit whose seq equals the query. */
+    readonly commit?: CommitMetadata;
+    /** Outcomes of writes whose clientCommitId equals the query. */
+    readonly writes: readonly AdminWriteOutcome[];
 }
 export interface AdminHorizonStatus {
     readonly partition: string;
@@ -114,10 +349,28 @@ export interface AdminHorizonStatus {
     readonly recommendedHorizonSeq: number;
     readonly recommendation: 'up-to-date' | 'prune-recommended';
 }
+export interface AdminPruneResult {
+    readonly previousHorizonSeq: number;
+    readonly horizonSeq: number;
+}
+/** One schema table as the console's pickers need it. */
+export interface AdminTableInfo {
+    readonly name: string;
+    readonly columns: readonly {
+        readonly name: string;
+        readonly type: ColumnType;
+        readonly nullable: boolean;
+        readonly primaryKey: boolean;
+    }[];
+}
 export interface AdminListCommitsOptions {
     readonly afterSeq?: number;
+    /** Exclusive upper bound: pass the oldest seq of a page for the next. */
+    readonly beforeSeq?: number;
     readonly limit?: number;
     readonly table?: string;
+    /** Attach each commit's first N changes as `sample`. */
+    readonly changeSample?: number;
 }
 export interface AdminScopeActivityOptions {
     readonly limit?: number;
@@ -134,57 +387,124 @@ export interface AdminStats {
 export interface SyncularAdminOptions {
     readonly storage: ServerStorage;
     /**
-     * The server schema. When present, row reads (`inspectRow`) ensure the
-     * relational row tables exist first — needed when the admin runs against
-     * a storage instance that has not served a sync request yet.
+     * The server schema. Row reads (`inspectRow`, `traceRow`, `commitDetail`)
+     * require it: it decodes payloads and ensures the relational row tables
+     * exist on a storage instance that has not served a sync request yet.
      */
     readonly schema?: ServerSchema;
     /** RFC 0007: declarations `inspectRow` carries into `ensureSchema`. */
     readonly checkpoints?: readonly CheckpointDeclaration[];
     /** The event ring feeding the event tail. Absent ⇒ `events()` is empty. */
     readonly ring?: RingBufferEvents;
+    /** Receives `prune.completed` and `lease.revoked` from operator actions. */
+    readonly events?: SyncularServerEvents;
+    /** The host resolver: `traceRow` checks the actor's allowed scopes. */
+    readonly resolveScopes?: ResolveScopes;
+    /** The realtime hub: which clients hold an open socket right now. */
+    readonly realtime?: RealtimeHub;
     readonly segments?: SegmentStore;
     readonly blobs?: BlobStore;
-    /** The §7.3 lease store — feeds the client drill-down's lease read. */
+    /** The §7.3 lease store — the client drill-down and `revokeLease`. */
     readonly leases?: LeaseStore;
-    /** Retention policy for horizon recommendation (defaults to §4.6). */
+    /** Retention policy for horizon recommendation and prune (§4.6). */
     readonly retention?: Partial<RetentionPolicy>;
     /** Epoch-ms clock (defaults to `Date.now`) — active-window math. */
     readonly clock?: () => number;
 }
-/** The read-only console query surface. Construct one per host process. */
+/** The console query surface plus its operator actions. One per process. */
 export declare class SyncularAdmin {
     #private;
     constructor(options: SyncularAdminOptions);
     /**
-     * Build an admin over a `SyncServerConfig`, reusing its storage / segment
-     * / blob store / clock. Pass the ring separately (it is an events sink,
-     * composed into the config's `events` by the host — see `composeEvents`).
+     * Build an admin over a `SyncServerConfig`, reusing its storage, schema,
+     * resolver, events sink, stores, leases and clock. Pass the ring
+     * separately (it is an events sink, composed into the config's `events` by
+     * the host — see `composeEvents`).
      */
     static fromConfig(config: SyncServerConfig, extra?: {
         ring?: RingBufferEvents;
         retention?: Partial<RetentionPolicy>;
     }): SyncularAdmin;
-    /** The known clients for a partition (cursor, lag, subscriptions). */
-    listClients(partition: string): Promise<AdminClient[]>;
+    /** The server schema version; `undefined` without a schema. */
+    get schemaVersion(): number | undefined;
+    /** The schema tables and columns, for row and commit pickers. */
+    tables(): AdminTableInfo[];
+    /** The known clients for a partition (cursor, lag, versions, subs). */
+    listClients(partition: string, options?: AdminListClientsOptions): Promise<AdminClientPage>;
     /**
      * One client's drill-down: its record (with lag), its §7.3 lease when a
-     * lease store is wired, and its recent slice of the event tail. Answers
-     * "why is this client stale" in a single read.
+     * lease store is wired, its realtime state, and its recent slice of the
+     * event tail. Answers "why is this client stale" in a single read.
      */
     clientDetail(partition: string, clientId: string, options?: {
         readonly eventLimit?: number;
     }): Promise<AdminClientDetail>;
     /** Commit-log metadata (no payloads), newest first. */
     listCommits(partition: string, options?: AdminListCommitsOptions): Promise<CommitMetadata[]>;
+    /**
+     * One retained commit with every change rendered per §11. Throws
+     * `sync.not_found` when the commit does not exist or was pruned.
+     */
+    commitDetail(partition: string, commitSeq: number): Promise<AdminCommitDetail>;
     /** Pending, leased, completed, and dead-lettered durable reactions. */
     listReactions(partition: string, options?: AdminListReactionsOptions): Promise<StoredReaction[]>;
     /**
-     * Inspect a single row: current server_version, stored scopes, and the
-     * blobIds it references (when the store tracks references). Payload bytes
-     * are deliberately NOT decoded — the console shows metadata, not content.
+     * Inspect a single row: server_version, stored scopes, its values decoded
+     * per §11, and its retained change history (newest first). Throws
+     * `sync.unknown_table` for a table outside the schema.
+     */
+    inspectRow(partition: string, table: string, rowId: string, options?: {
+        readonly historyLimit?: number;
+    }): Promise<AdminRowInspection>;
+    /**
+     * Trace whether one client receives one row, combining the row's stored
+     * scopes and newest change with the client's subscriptions, cursor, the
+     * actor's allowed scopes, and its retained push failures. See
+     * `AdminTraceVerdict` for the verdict order.
+     */
+    traceRow(partition: string, query: {
+        readonly table: string;
+        readonly rowId: string;
+        readonly clientId: string;
+    }): Promise<AdminRowTrace>;
+    /**
+     * Who has one row and who does not: the trace verdict for every known
+     * client in the partition, resolving each actor's allowed scopes once.
      */
-    inspectRow(partition: string, table: string, rowId: string): Promise<AdminRowInspection>;
+    rowDelivery(partition: string, table: string, rowId: string): Promise<AdminRowDelivery>;
+    /**
+     * The partition's actors with their devices (clients), open sockets,
+     * worst lag, and failures in the last 5 minutes; most recently seen
+     * first.
+     */
+    actors(partition: string): Promise<AdminActor[]>;
+    /** Row counts per schema table for the partition. */
+    tableCounts(partition: string): Promise<Record<string, number>>;
+    /**
+     * One page of a table's rows decoded per §11, ordered by rowId. With a
+     * `scope`, only rows whose stored scope matches, read through the scope
+     * index.
+     */
+    listRows(partition: string, table: string, options?: {
+        readonly afterRowId?: string;
+        readonly limit?: number;
+        readonly scope?: {
+            readonly variable: string;
+            readonly value: string;
+        };
+    }): Promise<AdminRowPage>;
+    /**
+     * What happened to a write: every stored idempotency outcome for the
+     * clientCommitId (applied with its commitSeq, or rejected with the
+     * per-operation results), plus the retained ring events that carry it.
+     */
+    findWrite(partition: string, clientCommitId: string): Promise<AdminWriteLookup>;
+    /**
+     * Resolve an id pasted from a bug report: clients and actors containing
+     * it, rows with that rowId in any table, the commit with that seq, and
+     * writes with that clientCommitId.
+     */
+    search(partition: string, query: string): Promise<AdminSearchResult>;
     /**
      * Recent commits touching one scope key (`variable:value`, e.g.
      * `project:p1`) — routed through the change-scope index, never a scan.
@@ -201,10 +521,8 @@ export declare class SyncularAdmin {
     horizonStatus(partition: string): Promise<AdminHorizonStatus>;
     /** Segment + blob store counters where the stores expose them. */
     stats(partition: string): Promise<AdminStats>;
-    /** Segment store counters alone (undefined when unsupported/unset). */
-    segmentStats(): Promise<SegmentStoreStats | undefined>;
-    /** Blob store counters for a partition (undefined when unsupported/unset). */
-    blobStats(partition: string): Promise<BlobStoreStats | undefined>;
+    /** True when a realtime hub is wired: clients report `connected`. */
+    get hasRealtime(): boolean;
     /** True when this admin has an event ring wired (the event tail is live). */
     get hasEventStream(): boolean;
     /** The event tail from the ring buffer (newest first). Empty when unwired. */
@@ -218,19 +536,45 @@ export declare class SyncularAdmin {
     /**
      * Request/push health over a trailing window, derived entirely from the
      * ring (zero new server state): rates, error share, duration percentiles,
-     * and per-bucket counts for the console's sparkline. Only events carrying
-     * this `partition` count. Empty (all zeros) when no ring is wired.
+     * and per-bucket series. Only events carrying this `partition` count.
+     * `coverage` reports when the ring dropped events inside the window.
      */
     metrics(partition: string, options?: {
         readonly windowMs?: number;
         readonly buckets?: number;
     }): AdminMetrics;
+    /**
+     * Failures over a trailing window, grouped by source and code and by
+     * client: failed requests, push rejections and conflicts, dead-lettered
+     * reactions, and throwing scope resolvers. Derived from the ring.
+     */
+    errors(partition: string, options?: {
+        readonly windowMs?: number;
+    }): AdminErrorSummary;
     /** Every authenticated partition in the storage-backed registry. */
     listPartitions(): Promise<string[]>;
     /**
      * The fleet view: one row per known partition — retained backlog, client
-     * counts, prune recommendation. A cross-partition read (every other
-     * method is partition-scoped); host authorization should account for it.
+     * counts, prune recommendation — paged by `offset`/`limit` (default 100)
+     * because each row costs several reads. A cross-partition read (every
+     * other method is partition-scoped); host authorization should account
+     * for it.
+     */
+    partitionsOverview(options?: {
+        readonly limit?: number;
+        readonly offset?: number;
+    }): Promise<AdminPartitionPage>;
+    /**
+     * Operator action: requeue a dead-lettered reaction. Throws
+     * `sync.invalid_request` when the key names no dead-lettered reaction.
+     */
+    retryReaction(partition: string, idempotencyKey: string): Promise<StoredReaction>;
+    /** Operator action: one §4.6 prune pass now, emitting `prune.completed`. */
+    prune(partition: string): Promise<AdminPruneResult>;
+    /**
+     * Operator action: revoke the client's §7.3 lease (§7.3.4), emitting
+     * `lease.revoked`. Throws `sync.invalid_request` when the client holds no
+     * lease.
      */
-    partitionsOverview(): Promise<AdminPartitionOverview[]>;
+    revokeLease(partition: string, clientId: string): Promise<LeaseRecord>;
 }