@cleocode/contracts 2026.10.4 → 2026.10.5-rc.ci.672

package/src/__tests__/cloud-replica-retirement.test.ts

@@ -0,0 +1,135 @@
+/**
+ * Cloud contract mirror of cleo-nexus #41 (T123 replica retirement, contract
+ * v2.28; T13284): the E31 request and answer, the stored retirement, and the
+ * `retiredAt` / `successor` fields home replicas gain, as the server validates
+ * them.
+ *
+ * @task T13284
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  AttachHomeReplicaResult,
+  HomeReplica,
+  ListHomeReplicasResult,
+  ReplicaRetirement,
+  RetireReplicaRequest,
+  RetireReplicaResult,
+} from '../cloud/index.js';
+import { NEXUS_REPLICA_RETIREMENT_REASONS } from '../nexus-vault.js';
+
+const DEVICE = '0192f1c2-7d3e-4abc-8def-0000000000b0';
+const R1 = '0192f1c2-7d3e-7abc-8def-0000000000a1';
+const R2 = '0192f1c2-7d3e-7abc-8def-0000000000b1';
+const STREAM = 'project:0192f1c2-7d3e-7abc-8def-0123456789ab';
+const SIG = Buffer.alloc(64, 7).toString('base64');
+
+const request = {
+  deviceId: DEVICE,
+  successor: R2,
+  lastReplicaSeq: 4,
+  txnId: `${R1}:17`,
+  signature: SIG,
+};
+
+describe('RetireReplicaRequest (T13284)', () => {
+  it('takes a successor, lastReplicaSeq and txn id, each nullable', () => {
+    expect(RetireReplicaRequest.safeParse(request).success).toBe(true);
+    expect(
+      RetireReplicaRequest.safeParse({
+        ...request,
+        successor: null,
+        lastReplicaSeq: null,
+        txnId: null,
+      }).success,
+    ).toBe(true);
+  });
+
+  it('refuses a negative or fractional lastReplicaSeq and a malformed txn id', () => {
+    expect(RetireReplicaRequest.safeParse({ ...request, lastReplicaSeq: -1 }).success).toBe(false);
+    expect(RetireReplicaRequest.safeParse({ ...request, lastReplicaSeq: 1.5 }).success).toBe(false);
+    for (const txnId of [
+      R1,
+      `${R1}:`,
+      `${R1}:01`,
+      `${R1}:-1`,
+      `not-a-uuid:3`,
+      `${R1}:12345678901234567`,
+    ]) {
+      expect(RetireReplicaRequest.safeParse({ ...request, txnId }).success).toBe(false);
+    }
+    // Any UUID may emit the transaction (the successor on a rebind), not only a v7 replica id.
+    expect(RetireReplicaRequest.safeParse({ ...request, txnId: `${DEVICE}:0` }).success).toBe(true);
+  });
+
+  it('a successor must be a replica id (UUIDv7)', () => {
+    expect(RetireReplicaRequest.safeParse({ ...request, successor: DEVICE }).success).toBe(false);
+  });
+});
+
+describe('ReplicaRetirement and RetireReplicaResult (T13284)', () => {
+  const stored = {
+    streamId: STREAM,
+    replicaId: R1,
+    successor: R2,
+    lastReplicaSeq: null,
+    signerDeviceId: DEVICE,
+    txnId: null,
+    signature: SIG,
+    retiredAt: '2026-10-06T07:00:00.000Z',
+  };
+
+  it('is the stored record, wrapped as { retirement }', () => {
+    expect(ReplicaRetirement.safeParse(stored).success).toBe(true);
+    expect(RetireReplicaResult.safeParse({ retirement: stored }).success).toBe(true);
+    expect(RetireReplicaResult.safeParse(stored).success).toBe(false);
+    const { retiredAt: _retiredAt, ...undated } = stored;
+    expect(ReplicaRetirement.safeParse(undated).success).toBe(false);
+  });
+});
+
+describe('home replicas carry retiredAt and successor (T13284)', () => {
+  const replica = {
+    replicaId: R1,
+    deviceId: DEVICE,
+    deviceState: 'active',
+    attachedAt: '2026-10-01T00:00:00.000Z',
+    lastSyncAt: null,
+    presence: null,
+    presenceAt: null,
+  };
+
+  it('parses an older server without them, and a retired replica with them', () => {
+    expect(HomeReplica.safeParse(replica).success).toBe(true);
+    const retired = { ...replica, retiredAt: '2026-10-06T07:00:00.000Z', successor: R2 };
+    expect(HomeReplica.parse(retired)).toMatchObject({
+      retiredAt: retired.retiredAt,
+      successor: R2,
+    });
+    expect(HomeReplica.safeParse({ ...replica, retiredAt: null, successor: null }).success).toBe(
+      true,
+    );
+    expect(HomeReplica.safeParse({ ...replica, successor: DEVICE }).success).toBe(false);
+  });
+
+  it('the attach answer and the list follow HomeReplica', () => {
+    expect(AttachHomeReplicaResult).toBe(HomeReplica);
+    expect(ListHomeReplicasResult.shape.replicas.element).toBe(HomeReplica);
+  });
+});
+
+describe('E31 refusal reasons (T13284)', () => {
+  it('are the seven server reasons', () => {
+    expect([...NEXUS_REPLICA_RETIREMENT_REASONS].sort()).toEqual(
+      [
+        'not-pinned-or-owner',
+        'replica-retired',
+        'retire-below-head',
+        'retired',
+        'successor-other-user',
+        'successor-retired',
+        'successor-taken',
+      ].sort(),
+    );
+  });
+});

package/src/__tests__/cloud-status-checkpoint-reads.test.ts

@@ -0,0 +1,60 @@
+/**
+ * Cloud contract mirrors of cleo-nexus #38 (`DeviceScope`, `StatusQuery`;
+ * T13282) and #39 (`GetCheckpointResult`; T13283): the shapes the server
+ * validates, so a client that parses with them agrees with it.
+ *
+ * @task T13282
+ * @task T13283
+ */
+
+import { describe, expect, it } from 'vitest';
+import {
+  DeviceScope,
+  GetCheckpointResult,
+  ListCheckpointsResult,
+  StatusQuery,
+} from '../cloud/index.js';
+
+const PROJECT = '0190a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b';
+const REPLICA = '0198a1b2-0000-7000-8000-0000000000a1';
+
+describe('DeviceScope and StatusQuery (T13282)', () => {
+  it('DeviceScope is the eight §2.3 scopes and nothing else', () => {
+    expect(DeviceScope.options).toEqual([
+      'account:read',
+      'devices:read',
+      'projects:read',
+      'projects:write',
+      'sync:read',
+      'sync:write',
+      'keys:read',
+      'keys:write',
+    ]);
+    expect(DeviceScope.safeParse('admin').success).toBe(false);
+  });
+
+  it('StatusQuery: both optional, replicaId requires projectId and must be a UUIDv7', () => {
+    expect(StatusQuery.safeParse({}).success).toBe(true);
+    expect(StatusQuery.safeParse({ projectId: PROJECT }).success).toBe(true);
+    expect(StatusQuery.safeParse({ projectId: PROJECT, replicaId: REPLICA }).success).toBe(true);
+    const orphan = StatusQuery.safeParse({ replicaId: REPLICA });
+    expect(orphan.success).toBe(false);
+    expect(orphan.error?.issues[0]?.message).toBe('replicaId requires projectId');
+    // A UUIDv4 is not a replica id.
+    expect(
+      StatusQuery.safeParse({
+        projectId: PROJECT,
+        replicaId: '0198a1b2-0000-4000-8000-0000000000a1',
+      }).success,
+    ).toBe(false);
+  });
+});
+
+describe('GetCheckpointResult (T13283)', () => {
+  it('is one checkpoint shaped exactly as a list item', () => {
+    const listItem = ListCheckpointsResult.shape.checkpoints.element;
+    expect(GetCheckpointResult.shape.checkpoint).toBe(listItem);
+    expect(Object.keys(GetCheckpointResult.shape)).toEqual(['checkpoint']);
+    expect(GetCheckpointResult.safeParse({ checkpoints: [] }).success).toBe(false);
+  });
+});

package/src/agent-registry.ts

@@ -47,7 +47,11 @@ export interface AgentCredential {
    * device). Re-register with `cleo agent register --id <id> --api-key <key>`.
    */
   requiresReauth?: boolean;
-  /** Base URL of the messaging API (default: api.signaldock.io). */
+  /**
+   * Base URL of the cloud messaging API, or `'local'` for none. Rows from
+   * before T13169 may still hold the retired `https://api.signaldock.io`;
+   * CLEO never calls a SignalDock host.
+   */
   apiBaseUrl: string;
   /** Agent classification from the registry (e.g. 'code_dev', 'orchestrator'). */
   classification?: string;

package/src/cloud/api.ts

@@ -69,8 +69,45 @@ export type Device = z.infer<typeof Device>;
 export const ListDevicesResult = z.object({ devices: z.array(Device) });
 export type ListDevicesResult = z.infer<typeof ListDevicesResult>;
 
+// ---------- device credential scopes and E3 status (§4.1) ----------
+
+/** What a device credential may do (§2.3). A signed-in session holds every scope. */
+export const DeviceScope = z.enum([
+  'account:read',
+  'devices:read',
+  'projects:read',
+  'projects:write',
+  'sync:read',
+  'sync:write',
+  'keys:read',
+  'keys:write',
+]);
+/** One device credential scope. */
+export type DeviceScope = z.infer<typeof DeviceScope>;
+
+/** E3 `GET /v1/status` query (§4.1): `replicaId` (a UUIDv7) requires `projectId`. */
+export const StatusQuery = z
+  .object({ projectId: ProjectId.optional(), replicaId: ReplicaId.optional() })
+  .refine((q) => q.replicaId === undefined || q.projectId !== undefined, {
+    message: 'replicaId requires projectId',
+  });
+/** The E3 status query. */
+export type StatusQuery = z.infer<typeof StatusQuery>;
+
 // ---------- projects ----------
 
+/**
+ * A new project's first data key, stored in the same transaction as its registration (onboarding B): key
+ * version 1, wrapped by the registrant's account master key. Needs keys:write on top of projects:write, and is
+ * honoured only when the call creates the project. Later versions stay rotations
+ * (PUT /v1/projects/:projectId/keys/:userId).
+ */
+export const InitialProjectKey = z.object({
+  /** The project data key, wrapped by the registrant's master key at key version 1. */
+  wrappedProjectKey: Base64,
+});
+export type InitialProjectKey = z.infer<typeof InitialProjectKey>;
+
 export const RegisterProjectRequest = z.object({
   projectId: ProjectId,
   /**
@@ -87,6 +124,8 @@ export const RegisterProjectRequest = z.object({
    * caller's personal organization, which every account has.
    */
   organizationId: z.string().uuid().optional(),
+  /** The project's first data key (onboarding B). Honoured only when this call creates the project. */
+  initialKey: InitialProjectKey.optional(),
 });
 export type RegisterProjectRequest = z.infer<typeof RegisterProjectRequest>;
 
@@ -103,7 +142,16 @@ export const Project = z.object({
 });
 export type Project = z.infer<typeof Project>;
 
-export const RegisterProjectResult = z.object({ project: Project, streamId: StreamId });
+export const RegisterProjectResult = z.object({
+  project: Project,
+  streamId: StreamId,
+  /**
+   * The key version `initialKey` is stored at for the caller: 1 when this call created the project with it,
+   * or repeated the caller's identical version 1; null when no initialKey was sent, or the project already
+   * existed with no key (initialKey ignored). Absent from servers older than initialKey.
+   */
+  initialKeyVersion: KeyVersion.nullable().optional(),
+});
 export type RegisterProjectResult = z.infer<typeof RegisterProjectResult>;
 
 /**
@@ -162,6 +210,10 @@ export const HomeReplica = z.object({
   lastSyncAt: z.iso.datetime().nullable(),
   presence: ReplicaPresence.nullable(),
   presenceAt: z.iso.datetime().nullable(),
+  /** When the replica was retired (T123), else null. Absent from servers older than retirement. */
+  retiredAt: z.iso.datetime().nullable().optional(),
+  /** The retired replica's named successor, else null (not retired, or retired with none). */
+  successor: ReplicaId.nullable().optional(),
 });
 export type HomeReplica = z.infer<typeof HomeReplica>;
 
@@ -501,6 +553,15 @@ export type CreateCheckpointResult = z.infer<typeof CreateCheckpointResult>;
 export const ListCheckpointsResult = z.object({ checkpoints: z.array(Checkpoint) });
 export type ListCheckpointsResult = z.infer<typeof ListCheckpointsResult>;
 
+/**
+ * E29 `GET …/checkpoints/head` and E30 `GET …/checkpoints/:checkpointId` (cleo-nexus T122, contract
+ * v2.27): one checkpoint, shaped as a list item. Both answer 404 when there is no head, or the id is
+ * unknown, malformed or on another stream.
+ */
+export const GetCheckpointResult = z.object({ checkpoint: Checkpoint });
+/** One checkpoint read by id or as the head. */
+export type GetCheckpointResult = z.infer<typeof GetCheckpointResult>;
+
 // ---------- blobs ----------
 
 export const PresignUploadRequest = z.object({
@@ -585,6 +646,69 @@ export type ListedLease = z.infer<typeof ListedLease>;
 export const ListLeasesResult = z.object({ leases: z.array(ListedLease) });
 export type ListLeasesResult = z.infer<typeof ListLeasesResult>;
 
+// ---------- replica retirement (T123; cleocode journal spec §1.3, §3.5 D5) ----------
+
+/**
+ * A journal transaction id, `<emittingReplicaId>:<localTxnSeq>`: the replica that emitted the transaction and its own
+ * transaction counter. Only the format is checked: the emitting replica may be the successor (a rebind), not the
+ * retired one.
+ */
+const JournalTxnId = z
+  .string()
+  .regex(
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:(0|[1-9][0-9]{0,15})$/,
+    'expected <uuid>:<non-negative integer>',
+  );
+
+/**
+ * E31 `POST /v1/streams/:streamId/replicas/:replicaId/retirements` (cleo-nexus T123, contract v2.28): the replica
+ * writes no segment past `lastReplicaSeq` (none at all when it is null). The journal's own `retire` transaction
+ * travels E2E-encrypted; this is the server's signed copy, so it can refuse later appends and show the retirement in
+ * the reads.
+ */
+export const RetireReplicaRequest = z.object({
+  /** The signing device. It must be the calling device. */
+  deviceId: DeviceId,
+  /** The replica that carries on this one's history, or null. Never the retired replica itself. */
+  successor: ReplicaId.nullable(),
+  /**
+   * The replica's last segment: at least its highest appended replicaSeq, and late segments up to it still land. Null
+   * when the replica wrote nothing: then no segment of it is stored, and none may land.
+   */
+  lastReplicaSeq: z.number().int().nonnegative().nullable(),
+  /**
+   * The journal transaction that carries the retire (`${emittingReplicaId}:${localTxnSeq}`), or null for an owner's
+   * retirement with no journal transaction.
+   */
+  txnId: JournalTxnId.nullable(),
+  /** Ed25519 by the calling device over replicaRetireMessage(...). */
+  signature: Base64,
+});
+/** The E31 request body. */
+export type RetireReplicaRequest = z.infer<typeof RetireReplicaRequest>;
+
+/** A stored retirement: one per (stream, replica), insert-only. */
+export const ReplicaRetirement = z.object({
+  streamId: StreamId,
+  replicaId: ReplicaId,
+  successor: ReplicaId.nullable(),
+  /** Null: the replica wrote nothing. */
+  lastReplicaSeq: z.number().int().nonnegative().nullable(),
+  /** The device that signed it: the replica's own, a project owner's, or (home streams) another of the account's. */
+  signerDeviceId: DeviceId,
+  txnId: JournalTxnId.nullable(),
+  /** The signer's Ed25519 over replicaRetireMessage(...), so a client or an auditor can verify the record. */
+  signature: Base64,
+  retiredAt: z.iso.datetime(),
+});
+/** A stored replica retirement. */
+export type ReplicaRetirement = z.infer<typeof ReplicaRetirement>;
+
+/** 201 for a new retirement, 200 with the stored one for a repeat with the same successor and lastReplicaSeq. */
+export const RetireReplicaResult = z.object({ retirement: ReplicaRetirement });
+/** The E31 answer. */
+export type RetireReplicaResult = z.infer<typeof RetireReplicaResult>;
+
 // ---------- keys (wrapped project keys; the account master key is escrowed on the server, T082: encryption at rest, not end-to-end) ----------
 
 /**

package/src/dispatch/operations-registry.ts

@@ -9,7 +9,7 @@
  * @since SG-ARCH-SOLID Saga T9831 · E-CLI-BOUNDARY T9833 · T10061
  */
 
-import { DOCS_LIFECYCLE_STATUSES } from '../operations/docs.js';
+import { DOCS_LIFECYCLE_STATUSES } from '../operations/docs-lifecycle.js';
 import { OUTPUT_CONTRACTS } from '../operations/output-contracts-data.js';
 import { tasksUpdateInputContract } from '../operations/tasks.js';
 import type { CanonicalDomain, Gateway, OperationDef, ParamDef, Tier } from './operation-def.js';

package/src/doctor.ts

@@ -1124,8 +1124,71 @@ export interface SupersededStoreConflict {
   targetTable: string;
   /** Legacy rows left uncopied. */
   rows: number;
-  /** Why they were left. */
-  reason: 'live-authoritative' | 'collides-with-live';
+  /**
+   * Why they were left. `id-collision-undecided` (full mode, T13172): a live
+   * task holds the legacy task's id and one of the two creation times does
+   * not parse, so the run cannot tell whether they are the same task; it
+   * neither renumbers nor copies the legacy task. `withheld-undecided`: a
+   * task-graph table such a run did not copy at all, so the undecided task's
+   * children, dependencies and criteria cannot attach to the live task.
+   */
+  reason:
+    | 'live-authoritative'
+    | 'collides-with-live'
+    | 'id-collision-undecided'
+    | 'withheld-undecided';
+  /** The legacy ids left uncopied, when the run can name them. */
+  ids?: string[];
+}
+
+/**
+ * A legacy task recovered under a fresh id because a DIFFERENT live task holds
+ * its id (a task written into the empty store after a deferred exodus, T13172).
+ * The renumbering happens in a scratch copy of the legacy file, with every
+ * reference to the task re-pointed; the legacy file and live rows are untouched.
+ *
+ * @task T13172
+ */
+export interface SupersededStoreIdRemap {
+  /** Logical legacy source. */
+  sourceDb: string;
+  /** The legacy task's id, which the live store uses for another task. */
+  legacyId: string;
+  /** The id the legacy task is recovered under. */
+  newId: string;
+  /** The legacy task's title. */
+  legacyTitle: string;
+  /** Title of the live task that holds `legacyId`. */
+  liveTitle: string;
+  /** `true` when a previous run already recovered it as `newId` (nothing new is copied). */
+  alreadyRecovered: boolean;
+  /** Legacy rows re-pointed from `legacyId` to `newId` (children, dependencies, criteria, …). */
+  referencesRepointed: number;
+  /**
+   * The legacy task's creation time and type, which a later run (and
+   * `cleo show <legacy id>`) checks against the recovered task before trusting
+   * this record (T13183). Absent in receipts written before T13183.
+   */
+  legacyCreatedAt?: string;
+  legacyType?: string | null;
+}
+
+/**
+ * One bare legacy table of the live store a reconcile carried: its row count
+ * and key digest when the run verified (T13319). The run records it in the
+ * store (T13320) and in its receipt; the sync refusal for stranded bare rows
+ * stands down for a table that still matches, so a row the runtime later
+ * deletes from the prefixed twin is never mistaken for one never carried.
+ *
+ * @task T13319
+ */
+export interface SupersededStoreBareAccount {
+  /** The bare table, e.g. `task_labels`. */
+  table: string;
+  /** Its rows when the run carried it. */
+  rows: number;
+  /** sha256 of its primary-key values in order (every column if keyless). */
+  digest: string;
 }
 
 /**
@@ -1161,8 +1224,17 @@ export interface SupersededStoreReconcileResult {
    * touch the live task graph, and list everything left in `conflicts`.
    */
   mode: 'full' | 'additive';
-  /** Legacy rows deliberately left uncopied (additive mode); empty in full mode. */
+  /**
+   * Legacy rows deliberately left uncopied: additive mode's live-authoritative
+   * tables, and in full mode the task-id collisions the run cannot decide.
+   */
   conflicts: SupersededStoreConflict[];
+  /**
+   * Legacy tasks whose id a different live task holds, recovered (full mode)
+   * or to be recovered (dry-run) under a new id. Empty in additive mode, which
+   * never writes the task graph.
+   */
+  remaps: SupersededStoreIdRemap[];
   /** `true` when nothing was written. */
   dryRun: boolean;
   /** Absolute project root. */
@@ -1185,4 +1257,11 @@ export interface SupersededStoreReconcileResult {
   receiptPath: string | null;
   /** Human-readable explanation, suitable for printing verbatim. */
   reason: string;
+  /**
+   * The live store's bare tables this run carried, on a `reconciled` receipt
+   * that copied the bare family (T13319). Audit only: the sync check reads the
+   * record the run wrote into the store itself, which travels with backups
+   * (T13320).
+   */
+  accounted?: SupersededStoreBareAccount[];
 }

package/src/index.ts

@@ -514,7 +514,9 @@ export type {
   SagaAuditResult,
   SagaAuditViolation,
   SagaAuditViolationKind,
+  SupersededStoreBareAccount,
   SupersededStoreConflict,
+  SupersededStoreIdRemap,
   SupersededStoreReconcileOutcome,
   SupersededStoreReconcileResult,
   SupersededStoreTableCount,
@@ -2281,6 +2283,7 @@ export type {
   HeavyHeapSource,
   HeavyLeverChange,
   HeavyToolResourcePlan,
+  MemoryPressureReading,
   ResourceClass,
   ResourceDeferral,
   ResourceGrant,
@@ -2320,7 +2323,13 @@ export type {
 // === Row Identity Types (T12341 — uid merge keys) ===
 export type {
   RowIdentityKind,
+  RowIdentityNexusAnswer,
   RowIdentityRef,
+  RowIdentityRefillCounts,
+  RowIdentityRefillReport,
+  RowIdentityShareSignal,
+  RowIdentityShareSignalCode,
+  RowIdentityShareState,
   RowIdentitySpec,
   StoredRefUid,
   SymmetricEdge,
@@ -2461,6 +2470,14 @@ export {
   // Terminal state sets
   TERMINAL_TASK_STATUSES,
 } from './status-registry.js';
+// === Store restore (T13240 — restore cleo.db from a named snapshot or backup id) ===
+export type {
+  StoreRecoverResult,
+  StoreRestoreKept,
+  StoreRestoreResult,
+  StoreRestoreSource,
+  StoreRestoreVerification,
+} from './store-restore.js';
 // === Sub-Accessor Contracts (T9188) ===
 export type {
   AgentRegistrySubAccessor,
@@ -3049,12 +3066,21 @@ export type {
   CloudPaging,
   CloudProjectShowResult,
   CloudProjectsResult,
+  CloudRetiredReplica,
   CloudStatusGlobalStore,
+  CloudStatusHolder,
   CloudStatusLocal,
   CloudStatusOfflineDetails,
   CloudStatusResult,
   CloudStatusSummary,
+  CloudStatusSync,
+  CloudStatusSyncStream,
   CloudStatusVerdict,
+  CloudSyncFact,
+  CloudSyncFlags,
+  CloudSyncKnown,
+  CloudSyncLag,
+  CloudSyncUnknown,
   CloudWarning,
   CloudWhoamiResult,
   NexusCloudCredential,
@@ -3078,6 +3104,7 @@ export {
   NEXUS_DEVICE_LIST_STATES,
   NEXUS_DEVICE_STATE_UNKNOWN,
   NEXUS_DEVICE_STATES,
+  NEXUS_FEATURE_PROJECT_INITIAL_KEY,
   NEXUS_FORBIDDEN_ERRORS,
   NEXUS_FORBIDDEN_REASONS,
   NEXUS_PAGE_LIMIT_MAX,
@@ -3120,6 +3147,9 @@ export {
 export {
   type CloudActivityItem,
   type CloudActivityResult,
+  type CloudConflict,
+  type CloudConflictResolveResult,
+  type CloudConflictsResult,
   type CloudLeaseReleaseResult,
   type CloudPushResult,
   type CloudRestoreResult,
@@ -3129,9 +3159,12 @@ export {
   type CloudVaultStatusResult,
   type CloudVaultTable,
   type CloudVaultTableDiff,
+  type CloudVerifyDeepCheck,
   type CloudVerifyResult,
+  NEXUS_REPLICA_RETIREMENT_REASONS,
   NEXUS_VAULT_LEASE_ROLE,
   type NexusActivityEvent,
+  type NexusReplicaRetirementReason,
   nexusActivityEventSchema,
   nexusActivityPageSchema,
   nexusLeaseAcquireSchema,