@syncular/server 0.32.0 → 0.33.0

package/dist/object-bucket.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The object-bucket seam: the handful of object-store operations the durable
+ * segment store (§5.1) and blob store (§5.9.2) actually perform, expressed
+ * without an HTTP transport.
+ *
+ * Two adapters implement it — `S3ObjectBucket` (`s3-object-bucket.ts`,
+ * hand-rolled SigV4 over `fetch`) and the R2 binding adapter in
+ * `@syncular/server-workers` (`r2-stores.ts`, the Worker's `env.BUCKET`) — so
+ * one implementation of the store logic (`bucket-segment-store.ts`,
+ * `bucket-blob-store.ts`) runs over both. The key layouts are the same on
+ * either transport, so a bucket can be served through the S3 API for one host
+ * and the binding for another.
+ *
+ * Everything here is structural: an adapter may be any object with these
+ * methods, and Cloudflare's `R2Bucket` is assignable to the declaration in
+ * `r2-stores.ts` without a dependency on `@cloudflare/workers-types`.
+ */
+/** One stored object, readable once. Mirrors `R2ObjectBody`. */
+export interface BucketObject {
+    /** The body, streamed; `null` only if the backend served none. */
+    readonly body: ReadableStream<Uint8Array<ArrayBuffer>> | null;
+    /** Backend ETag of the stored object (opaque, used as a CAS token). */
+    readonly etag: string | undefined;
+    /** Stored size in bytes, when the backend reports one. */
+    readonly size: number | undefined;
+    /** User metadata: the `x-amz-meta-*` headers S3-side, `customMetadata` on R2. */
+    readonly metadata: Readonly<Record<string, string>>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+    text(): Promise<string>;
+}
+/** One stored object's description without its body. Mirrors `R2Object`. */
+export interface BucketObjectHead {
+    readonly etag: string | undefined;
+    readonly size: number | undefined;
+    readonly metadata: Readonly<Record<string, string>>;
+}
+export interface BucketWriteOptions {
+    readonly body: Uint8Array;
+    readonly contentType: string;
+    /** User metadata; values must be ASCII (both backends require it). */
+    readonly metadata?: Readonly<Record<string, string>> | undefined;
+    /**
+     * Create-only write (`If-None-Match: *`, R2 `etagDoesNotMatch: '*'`). The
+     * content-addressed bytes object is written this way so a second publisher
+     * of identical bytes is a no-op and a hash collision cannot overwrite.
+     */
+    readonly createOnly?: boolean | undefined;
+    /**
+     * Compare-and-swap write (`If-Match`, R2 `etagMatches`): the write lands
+     * only if the stored ETag still equals this. The read-modify-write of the
+     * segment record and of the stats accumulator depend on it.
+     */
+    readonly ifMatch?: string | undefined;
+}
+/** One page of keys under a prefix. `cursor` is set when more remain. */
+export interface BucketListPage {
+    readonly keys: readonly string[];
+    readonly cursor: string | undefined;
+}
+export interface ObjectBucket {
+    /** The object plus its bytes, or `undefined` when the key is absent. */
+    get(key: string): Promise<BucketObject | undefined>;
+    head(key: string): Promise<BucketObjectHead | undefined>;
+    /**
+     * Write one object. Returns `false` when the `createOnly` / `ifMatch`
+     * precondition failed, so the caller can re-read and retry; a backend that
+     * ignores conditional writes would instead silently lose a concurrent
+     * update, which is why the return value is not optional.
+     */
+    put(key: string, options: BucketWriteOptions): Promise<boolean>;
+    /** Delete one object. Deleting an absent key succeeds (idempotent). */
+    delete(key: string): Promise<void>;
+    /**
+     * List keys under a prefix, one page at a time. The blob orphan sweep
+     * (§5.9.2) is the only caller: everything on the hot path is a GET/HEAD.
+     */
+    list(prefix: string, cursor?: string): Promise<BucketListPage>;
+}

package/dist/object-bucket.js

@@ -0,0 +1,18 @@
+/**
+ * The object-bucket seam: the handful of object-store operations the durable
+ * segment store (§5.1) and blob store (§5.9.2) actually perform, expressed
+ * without an HTTP transport.
+ *
+ * Two adapters implement it — `S3ObjectBucket` (`s3-object-bucket.ts`,
+ * hand-rolled SigV4 over `fetch`) and the R2 binding adapter in
+ * `@syncular/server-workers` (`r2-stores.ts`, the Worker's `env.BUCKET`) — so
+ * one implementation of the store logic (`bucket-segment-store.ts`,
+ * `bucket-blob-store.ts`) runs over both. The key layouts are the same on
+ * either transport, so a bucket can be served through the S3 API for one host
+ * and the binding for another.
+ *
+ * Everything here is structural: an adapter may be any object with these
+ * methods, and Cloudflare's `R2Bucket` is assignable to the declaration in
+ * `r2-stores.ts` without a dependency on `@cloudflare/workers-types`.
+ */
+export {};

package/dist/operations-realtime.js

@@ -195,5 +195,8 @@ export function composeRealtimeNotifiers(...notifiers) {
         notifyCommit: async (partition, commit) => {
             await Promise.all(notifiers.map((notifier) => notifier.notifyCommit(partition, commit)));
         },
+        notifySubscriptions: async (partition, clientId) => {
+            await Promise.all(notifiers.map((notifier) => notifier.notifySubscriptions?.(partition, clientId)));
+        },
     };
 }

package/dist/operations.js

@@ -4,7 +4,7 @@ import { REMOTE_COMMAND_CLIENT_ID_PREFIX, RESOLVER_OUTAGE, touchAuthenticatedPar
 import { reportError, SyncError, syncError } from './errors.js';
 import { processPushOperationsWithTrace } from './push.js';
 import { compileSchema } from './schema.js';
-import { authorizeWrite } from './scopes.js';
+import { authorizeWrite, renderScopeValue, } from './scopes.js';
 import { transactionQuery } from './storage-query.js';
 import { toValidateRow } from './validate.js';
 function scopeAllowed(allowed, variable, value) {
@@ -265,9 +265,9 @@ function commandOperations(mutations, schema) {
             }
             return mutation.values[column.name] ?? null;
         });
-        const rowId = values[table.primaryKeyIndex];
-        if (typeof rowId !== 'string' || rowId.length === 0) {
-            throw syncError('operation.invalid_request', 'command upsert requires a non-empty string primary key');
+        const rowId = renderScopeValue(values[table.primaryKeyIndex]);
+        if (rowId === undefined) {
+            throw syncError('operation.invalid_request', 'command upsert requires a non-empty primary key');
         }
         return {
             table: table.name,

package/dist/push.js

@@ -298,6 +298,7 @@ async function applyOperation(tx, schema, wireSchema, resolved, op, opIndex, blo
             for (let i = 0; i < table.columns.length; i++) {
                 if (present[i] &&
                     !crdtIndexes.has(i) &&
+                    i !== table.primaryKeyIndex &&
                     effectiveVersion(i) > op.baseVersion) {
                     marked.push(i);
                 }
@@ -602,7 +603,16 @@ async function enforceReferences(tx, schema, staged, clientOpCount, cascadeLimit
     const changes = [];
     const operations = [];
     const originByIndex = [];
+    const finalByRow = new Map();
     for (const write of staged) {
+        const rowKey = `${write.table.name}\u0000${write.rowId}`;
+        const existing = finalByRow.get(rowKey);
+        finalByRow.set(rowKey, {
+            first: existing?.first ?? write,
+            last: write,
+        });
+    }
+    for (const { last: write } of finalByRow.values()) {
         if (write.op !== 'upsert' || write.values === undefined)
             continue;
         for (const reference of write.table.references) {
@@ -636,9 +646,9 @@ async function enforceReferences(tx, schema, staged, clientOpCount, cascadeLimit
     const scheduled = new Set();
     const processed = new Set();
     const queue = [];
-    for (const write of staged) {
-        if (write.op === 'delete' && write.stored !== undefined) {
-            schedule(write.table, write.rowId, write.opIndex, scheduled, queue);
+    for (const { first, last } of finalByRow.values()) {
+        if (last.op === 'delete' && first.stored !== undefined) {
+            schedule(last.table, last.rowId, last.opIndex, scheduled, queue);
         }
     }
     for (let cursor = 0; cursor < queue.length; cursor++) {
@@ -649,6 +659,12 @@ async function enforceReferences(tx, schema, staged, clientOpCount, cascadeLimit
         if (processed.has(key))
             continue;
         processed.add(key);
+        const parentPkColumn = item.table.columns[item.table.primaryKeyIndex];
+        const parentKeyValue = parentPkColumn?.type === 'integer'
+            ? Number(item.rowId)
+            : parentPkColumn?.type === 'boolean'
+                ? item.rowId === 'true'
+                : item.rowId;
         for (const reference of item.table.referencedBy) {
             if (tx.scanRowsByIndex === undefined) {
                 throw new Error('storage transaction does not support declared-reference enforcement (scanRowsByIndex)');
@@ -659,7 +675,7 @@ async function enforceReferences(tx, schema, staged, clientOpCount, cascadeLimit
                 const page = await tx.scanRowsByIndex({
                     table: reference.table,
                     index: reference.index,
-                    values: [item.rowId],
+                    values: [parentKeyValue],
                     afterRowId,
                     limit: 1_000,
                 });
@@ -684,15 +700,20 @@ async function enforceReferences(tx, schema, staged, clientOpCount, cascadeLimit
                 throw new Error(`unreachable: reference child table ${reference.table} is not compiled`);
             }
             for (const childRow of children) {
+                if (reference.onDelete === 'CASCADE') {
+                    if (!schedule(child, childRow.rowId, item.originOpIndex, scheduled, queue)) {
+                        continue;
+                    }
+                }
+                else if (scheduled.has(`${child.name}\u0000${childRow.rowId}`)) {
+                    continue;
+                }
                 if (originByIndex.length >= cascadeLimit) {
                     return {
                         kind: 'terminate',
                         record: referenceRejection(item.originOpIndex, 'declared-reference cascade exceeded the per-commit operation cap (§6.11)', { reason: 'cascade_limit' }),
                     };
                 }
-                if (!schedule(child, childRow.rowId, item.originOpIndex, scheduled, queue)) {
-                    continue;
-                }
                 const syntheticIndex = clientOpCount + originByIndex.length;
                 const storedValues = decodeRow(child.columns, childRow.payload);
                 if (reference.onDelete === 'CASCADE') {

package/dist/realtime.d.ts

@@ -162,6 +162,11 @@ export declare class RealtimeSession {
      * deltas immediately; it also survives a newer round-end refresh that
      * failed, because that round applied nothing.
      */
+    /**
+     * A pull outside this connection changed the client's subscriptions. A
+     * round in flight on the connection reloads them at its end anyway.
+     */
+    refreshAfterPull(): Promise<void>;
     refreshRegistrations(failClosed: boolean): Promise<void>;
     sendHeartbeat(): void;
     sendWake(reason: WakeReason): void;
@@ -230,6 +235,12 @@ export declare class RealtimeHub {
     disconnect(session: RealtimeSession): void;
     /** RealtimeNotifier: fan an applied commit out to matching sessions. */
     notifyCommit(partition: string, commit: StoredCommit): Promise<void>;
+    /**
+     * RealtimeNotifier: a pull changed a client's subscription list (§8.7).
+     * Its sockets reload their registrations with the round-end semantics, so
+     * an unreadable record keeps the previous registrations.
+     */
+    notifySubscriptions(partition: string, clientId: string): Promise<void>;
     /**
      * Host-initiated, fail-closed registration refresh (§8.7). A host calls this
      * after it changes an actor's membership or connection state, so the

package/dist/realtime.js

@@ -16,7 +16,7 @@
  * one handler, two framings); the only JSON data-plane server event is
  * the `sync` wake-up (§8.3).
  */
-import { DecodeError, decodeMessage, encodeMessage, encodePresenceError, encodePresenceFanout, MessageStreamScanner, PROTOCOL_WIRE_VERSION, parseRealtimePresencePublish, REALTIME_TAG_DELTA, REALTIME_TAG_ROUND, } from '@syncular/core';
+import { DecodeError, decodeMessage, encodeMessage, encodePresenceError, encodePresenceFanout, isSupportedProtocolWireVersion, MessageStreamScanner, PROTOCOL_WIRE_VERSION, parseRealtimePresencePublish, REALTIME_TAG_DELTA, REALTIME_TAG_ROUND, } from '@syncular/core';
 import { REMOTE_COMMAND_CLIENT_ID_PREFIX, RESOLVER_OUTAGE, touchAuthenticatedPartition, } from './context.js';
 import { adapterSyncError, reportError, SyncError, syncError, } from './errors.js';
 import { emitEvent } from './events.js';
@@ -160,6 +160,8 @@ export class RealtimeSession {
     #registrationGeneration = 0;
     /** Generation of the most recent refresh whose result was applied. */
     #registrationApplied = 0;
+    /** Highest sequence that required a catch-up wake for this session. */
+    #wakeRequiredThroughSeq;
     constructor(hub, options, registrations, cursor, latestSeq, clock, maxDeltaBytes, storage, logEpoch, wireVersion, events) {
         this.sessionId = crypto.randomUUID();
         this.partition = options.partition;
@@ -170,6 +172,7 @@ export class RealtimeSession {
         this.cursor = cursor;
         this.lastKnownSeq = latestSeq;
         this.wakePending = cursor < latestSeq;
+        this.#wakeRequiredThroughSeq = cursor < latestSeq ? latestSeq : 0;
         this.registrations = registrations;
         this.openedAtMs = clock();
         this.#send = options.send;
@@ -208,10 +211,10 @@ export class RealtimeSession {
         // proves those commits no longer need socket notifications, so the next
         // notification must be adjacent to the acknowledged cursor.
         this.lastKnownSeq = Math.max(this.lastKnownSeq, this.cursor);
-        if (this.cursor >= this.lastKnownSeq)
+        if (this.cursor >= this.#wakeRequiredThroughSeq)
             this.wakePending = false;
         // §8.2: acks update the client cursor record without an HTTP pull.
-        this.#persistCursor();
+        this.#persistCursor(cursor);
     }
     /**
      * Resolve once every queued control-plane write has settled (§8.2). A host
@@ -413,7 +416,7 @@ export class RealtimeSession {
         };
         try {
             const requestedWireVersion = (requestBytes[4] ?? 0) | ((requestBytes[5] ?? 0) << 8);
-            if (requestedWireVersion === 1 || requestedWireVersion === 2) {
+            if (isSupportedProtocolWireVersion(requestedWireVersion)) {
                 this.wireVersion = requestedWireVersion;
             }
             let stream;
@@ -507,6 +510,15 @@ export class RealtimeSession {
      * deltas immediately; it also survives a newer round-end refresh that
      * failed, because that round applied nothing.
      */
+    /**
+     * A pull outside this connection changed the client's subscriptions. A
+     * round in flight on the connection reloads them at its end anyway.
+     */
+    async refreshAfterPull() {
+        if (this.#activeRound !== undefined)
+            return;
+        await this.refreshRegistrations(false);
+    }
     async refreshRegistrations(failClosed) {
         const generation = ++this.#registrationGeneration;
         let registrations;
@@ -537,12 +549,12 @@ export class RealtimeSession {
         this.#closeSocket?.();
         this.#hub.disconnect(this);
     }
-    #persistCursor() {
+    #persistCursor(cursor) {
         // §8.2: start the write now and keep it on the control tail so `drain()`
         // can await it. Two acks may write concurrently: storage folds them with
         // `MAX(cursor, ?)`, so neither order loses the later cursor.
         const write = (async () => {
-            await this.#storage.advanceClientCursor(this.partition, this.clientId, this.actorId, this.logEpoch, this.cursor, this.#clock());
+            await this.#storage.advanceClientCursor(this.partition, this.clientId, this.actorId, this.logEpoch, cursor, this.#clock());
         })();
         write.catch((error) => {
             // Best-effort for the connection (the next pull repairs the cursor);
@@ -571,6 +583,7 @@ export class RealtimeSession {
     }
     sendWake(reason) {
         this.wakePending = true;
+        this.#wakeRequiredThroughSeq = Math.max(this.#wakeRequiredThroughSeq, this.lastKnownSeq);
         this.#sendSafe(JSON.stringify({
             event: 'sync',
             data: {
@@ -841,58 +854,13 @@ export class RealtimeHub {
             // segment store the HTTP binding uses — never a degraded round.
             throw syncError('sync.invalid_request', 'socket sync rounds require a segment store on the realtime hub (§8.7)');
         }
+        // The whole config, so a new `SyncServerConfig` field reaches socket and
+        // hub-served HTTP rounds without being listed here.
         return {
+            ...this.#config,
+            segments,
             partition: identity.partition,
             actorId: identity.actorId,
-            schema: this.#config.schema,
-            ...(this.#config.schemaWindow !== undefined
-                ? { schemaWindow: this.#config.schemaWindow }
-                : {}),
-            storage: this.#config.storage,
-            segments,
-            resolveScopes: this.#config.resolveScopes,
-            ...(this.#config.blobs !== undefined
-                ? { blobs: this.#config.blobs }
-                : {}),
-            ...(this.#config.maxBlobBytes !== undefined
-                ? { maxBlobBytes: this.#config.maxBlobBytes }
-                : {}),
-            ...(this.#config.crdtMergers !== undefined
-                ? { crdtMergers: this.#config.crdtMergers }
-                : {}),
-            ...(this.#config.validators !== undefined
-                ? { validators: this.#config.validators }
-                : {}),
-            ...(this.#config.commitValidator !== undefined
-                ? { commitValidator: this.#config.commitValidator }
-                : {}),
-            ...(this.#config.clock !== undefined
-                ? { clock: this.#config.clock }
-                : {}),
-            ...(this.#config.limits !== undefined
-                ? { limits: this.#config.limits }
-                : {}),
-            ...(this.#config.signedUrls !== undefined
-                ? { signedUrls: this.#config.signedUrls }
-                : {}),
-            ...(this.#config.blobSignedUrls !== undefined
-                ? { blobSignedUrls: this.#config.blobSignedUrls }
-                : {}),
-            ...(this.#config.blobUploadUrls !== undefined
-                ? { blobUploadUrls: this.#config.blobUploadUrls }
-                : {}),
-            ...(this.#config.sqliteImageBuilder !== undefined
-                ? { sqliteImageBuilder: this.#config.sqliteImageBuilder }
-                : {}),
-            ...(this.#config.leases !== undefined
-                ? { leases: this.#config.leases }
-                : {}),
-            ...(this.#config.events !== undefined
-                ? { events: this.#config.events }
-                : {}),
-            ...(this.#config.onError !== undefined
-                ? { onError: this.#config.onError }
-                : {}),
             realtime: this,
         };
     }
@@ -929,7 +897,9 @@ export class RealtimeHub {
         const registrations = await this.loadRegistrations(options.partition, options.actorId, options.clientId);
         const latestSeq = await storage.getMaxCommitSeq(options.partition);
         const cursor = record?.cursor ?? -1;
-        const session = new RealtimeSession(this, options, registrations, cursor, latestSeq, clock, this.#config.maxDeltaBytes ?? DEFAULT_MAX_DELTA_BYTES, storage, registry.logEpoch, record?.wireVersion ?? PROTOCOL_WIRE_VERSION, this.#config.events);
+        const session = new RealtimeSession(this, options, registrations, cursor, latestSeq, clock, this.#config.maxDeltaBytes ?? DEFAULT_MAX_DELTA_BYTES, storage, registry.logEpoch, record !== undefined && isSupportedProtocolWireVersion(record.wireVersion)
+            ? record.wireVersion
+            : PROTOCOL_WIRE_VERSION, this.#config.events);
         this.#sessions.add(session);
         const helloResult = options.send(JSON.stringify({
             event: 'hello',
@@ -997,6 +967,18 @@ export class RealtimeHub {
             session.deliverCommit(commit);
         }
     }
+    /**
+     * RealtimeNotifier: a pull changed a client's subscription list (§8.7).
+     * Its sockets reload their registrations with the round-end semantics, so
+     * an unreadable record keeps the previous registrations.
+     */
+    async notifySubscriptions(partition, clientId) {
+        for (const session of [...this.#sessions]) {
+            if (session.partition !== partition || session.clientId !== clientId)
+                continue;
+            await session.refreshAfterPull();
+        }
+    }
     /**
      * Host-initiated, fail-closed registration refresh (§8.7). A host calls this
      * after it changes an actor's membership or connection state, so the

package/dist/s3-blob-store.d.ts

@@ -1,37 +1,15 @@
 /**
  * S3-compatible blob store (SPEC.md §5.9.2 durable objects, §5.9.5 delegated
- * presign) — AWS S3, Cloudflare R2, MinIO. The blob twin of
- * `s3-segment-store.ts`: same hand-rolled SigV4 over `fetch` (sigv4.ts), same
- * content-addressed key layout, same LIST-free-on-the-hot-path CAS stats
- * accumulator. Zero dependencies.
+ * presign) — AWS S3, Cloudflare R2's S3 endpoint, MinIO. The blob twin of
+ * `s3-segment-store.ts`.
  *
- * Key layout (deterministic — every point lookup is a GET/HEAD, never a LIST):
- *
- *   {keyPrefix}blob/sha256/{hex}
- *     The blob bytes, VERBATIM (the object body MUST be exactly the
- *     content-addressed bytes so a presigned GET serves them directly and the
- *     client's §5.9.1 hash check passes — blobs are never re-compressed at
- *     rest, §5.8/§5.9.5). The `byteLength` + optional `mediaType` ride along
- *     as object user metadata `x-amz-meta-syncular-blob` = base64url(JSON), so
- *     `get` is a single GET. `createdAtMs` is stored there too so the orphan
- *     sweep (§5.9.2) can read the upload age without a separate index.
- *
- * DURABILITY vs SEGMENT TTL — the honest interface difference (§5.9.2): a
- * blob referenced by a live row must stay downloadable INDEFINITELY. So,
- * unlike `S3SegmentStore`, this store writes **no `expiresAtMs`, no S3
- * lifecycle-expiration mapping, and no TTL config**. Expiry is
- * REFERENCE-driven, not time-driven: reclamation is the host-scheduled
- * `sweepOrphanBlobs` (blob-store.ts) deleting only objects no live row
- * references after a grace period — never a bucket lifecycle rule. Do NOT
- * put a lifecycle expiration on the `blob/` prefix; it would delete
- * still-referenced attachments.
- *
- * The orphan sweep is the ONLY operation that LISTs: `sweepOrphans` pages
- * `ListObjectsV2` over the `blob/` prefix (an admin/GC path, off the hot
- * path) to find candidates, reads each object's `createdAtMs` from its
- * metadata for the grace check, and DELETEs the unreferenced-and-old ones.
+ * The store logic (content-addressed key layout, idempotent re-put, orphan
+ * sweep, CAS stats accumulator) is `BucketBlobStore`, shared with
+ * `R2BlobStore` in `@syncular/server-workers`; this class adds the S3 REST
+ * transport (`S3ObjectBucket`) and the SigV4 presign methods, which a bucket
+ * binding cannot mint.
  */
-import type { BlobRecord, BlobStore, BlobStoreStats } from './blob-store.js';
+import { BucketBlobStore } from './bucket-blob-store.js';
 import type { BlobPresignConfig, BlobUploadPresignConfig, SegmentUrlIssue } from './signed-url.js';
 export interface S3BlobStoreConfig {
     /**
@@ -52,42 +30,9 @@ export interface S3BlobStoreConfig {
     /** Key namespace inside the bucket, e.g. `syncular/`. Default: none. */
     readonly keyPrefix?: string;
 }
-export declare class S3BlobStore implements BlobStore {
+export declare class S3BlobStore extends BucketBlobStore {
     #private;
     constructor(config: S3BlobStoreConfig);
-    /**
-     * `{keyPrefix}blob/{partition}/sha256/{hex}` — the §5.9.5 "signed key embeds
-     * the blobId". Blobs are content-addressed, but download authorization and
-     * the reference index are per-partition, so the same bytes uploaded under
-     * two partitions are two objects (a partition MUST NOT read another's
-     * attachment by guessing a content address). The partition is folded into
-     * the key as a path segment.
-     */
-    objectKeyFor(partition: string, blobId: string): string;
-    put(partition: string, blobId: string, bytes: Uint8Array, nowMs: number, mediaType?: string): Promise<BlobRecord>;
-    has(partition: string, blobId: string): Promise<boolean>;
-    get(partition: string, blobId: string): Promise<{
-        record: BlobRecord;
-        bytes: Uint8Array;
-    } | undefined>;
-    /**
-     * §5.9.2 orphan sweep — the ONLY LISTing operation. Page `ListObjectsV2`
-     * over `{prefix}blob/{partition}/`, HEAD each object for its `createdAtMs`,
-     * and DELETE the ones both older than `olderThanMs` AND absent from
-     * `referencedBlobIds`. Returns the deleted blobIds. Never deletes a
-     * referenced blob (§5.9.2). Off the hot path — a host-scheduled GC job.
-     */
-    sweepOrphans(partition: string, olderThanMs: number, referencedBlobIds: ReadonlySet<string>): Promise<string[]>;
-    /**
-     * Store-wide counters from the pointer-object accumulator (never a LIST on
-     * the read path). `approximate: true` for the same reasons `S3SegmentStore`
-     * documents: best-effort ETag-CAS maintenance and sweep deletes that may
-     * miss the decrement. Exact within a single writer; a health gauge under
-     * concurrency. Note this is store-WIDE, not partition-scoped, so a shared
-     * bucket reports the whole bucket — the parameter is accepted for interface
-     * parity but the accumulator is one object per store.
-     */
-    stats(_partition: string): Promise<BlobStoreStats>;
     /**
      * SigV4 presigned GET for a blob object (§5.9.5 delegated presign). The
      * signed key embeds the `blobId`; `urlExpiresAtMs` is the provider-enforced