@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/conductor/bridge-api-client.js

@@ -20,7 +20,7 @@ import { parseContinuationStatusResult, parseContinueParkedChildResult, } from "
 import { resolveDeclaredRunBaseBranch } from "./run-branch.js";
 import { safeEpicLaunchTargetUrl } from "../epic-launch-diagnostic.js";
 import { validateHttpBaseUrl } from "../base-url.js";
-import { isCiResumeRefusalCode } from "./repair-contract.js";
+import { RERUN_CI_CHECK_STATUSES, RERUN_CI_NOT_RUNNABLE_REASONS, RERUN_CI_OUTCOMES, isCiResumeRefusalCode, } from "./repair-contract.js";
 /** Default Bridge API base URL when `BAPI_BASE_URL` is unset. */
 export const CONDUCTOR_DEFAULT_BASE_URL = "https://bridgegpt-api.com";
 /** Default per-request timeout for conductor Bridge API calls. */
@@ -1285,6 +1285,7 @@ export async function unparkEpicTicket(access, request, fetchImpl = globalThis.f
         expected_row_version: request.expectedRowVersion,
         ...(request.idempotencyKey !== undefined ? { idempotency_key: request.idempotencyKey } : {}),
         ...(request.reason !== undefined ? { reason: request.reason } : {}),
+        ...(request.cleanupResolution !== undefined ? { cleanup_resolution: request.cleanupResolution } : {}),
     });
     return postUnparkLikeRequest(url, conductorPostHeaders(access), body, fetchImpl);
 }
@@ -1325,6 +1326,7 @@ export async function postContinueParkedChild(access, request, fetchImpl = globa
         source_park_generation: b.sourceParkGeneration,
         request_fingerprint: request.requestFingerprint,
         ...(request.reason ? { reason: request.reason } : {}),
+        ...(request.workerExitProof ? { worker_exit_proof: request.workerExitProof } : {}),
     });
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -1374,6 +1376,56 @@ export async function postContinueParkedChild(access, request, fetchImpl = globa
         clearTimeout(timer);
     }
 }
+/** One submission; a lost response is never interpreted as a refusal. */
+export async function postGrantContinuation(access, request, fetchImpl = globalThis.fetch) {
+    const url = buildConductorJiraUrl(access.baseUrl, `${continuationChildPath(request.epicRunId, request.ticketKey)}/grant-continuation`);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CONDUCTOR_FETCH_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "POST", headers: conductorPostHeaders(access),
+            signal: controller.signal,
+            body: JSON.stringify({
+                repo_name: access.repoName,
+                request_id: request.requestId,
+                parked_gate: request.parkedGate,
+                expected_row_version: request.expectedRowVersion,
+                source_park_generation: request.sourceParkGeneration,
+                extra_continuations: request.extraContinuations,
+                extra_seconds: request.extraSeconds,
+                reason: request.reason,
+            }),
+        });
+    }
+    catch {
+        clearTimeout(timer);
+        return { kind: "unconfirmed", requestId: request.requestId };
+    }
+    clearTimeout(timer);
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = null;
+    }
+    const grant = body && typeof body === "object"
+        ? body.grant : null;
+    if (response.ok && body && typeof body === "object" &&
+        typeof body.replayed === "boolean" &&
+        grant && typeof grant === "object" &&
+        grant.request_id === request.requestId) {
+        return {
+            kind: "result", requestId: request.requestId,
+            replayed: body.replayed,
+        };
+    }
+    if (response.status >= 500 || response.ok) {
+        return { kind: "unconfirmed", requestId: request.requestId };
+    }
+    return { kind: "refused", status: response.status, errorCode: safeDetailErrorCode(body) };
+}
 /**
  * GET `.../tickets/{ticket_key}/continuation` — the child's current episode and,
  * with `requestId`, that request's receipt. Read-only; bounded by the standard
@@ -1532,6 +1584,134 @@ export async function dispatchRemediation(access, request, fetchImpl = globalThi
     const parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/tickets/${encodeURIComponent(request.ticketKey)}/dispatch-remediation`, withGuard({ context: request.context }, request.guard), fetchImpl);
     return parseDispatchRemediationResult(parsed);
 }
+export async function escalateTicket(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.ticketKey);
+    requireNonEmptyString(request.cause);
+    requireNonEmptyString(request.actionNeeded);
+    if (request.actionNeeded.length > 300)
+        throw new ConductorBridgeApiError("server");
+    const result = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/tickets/${encodeURIComponent(request.ticketKey)}/escalate`, { cause: request.cause, action_needed: request.actionNeeded }, fetchImpl);
+    const value = result;
+    if (!value || !["created", "deduplicated", "suppressed"].includes(value.status) ||
+        !Number.isSafeInteger(value.notification_id) || value.notification_id <= 0 ||
+        typeof value.episode !== "string" || !value.blocks || !Array.isArray(value.blocks.tickets) ||
+        typeof value.channel !== "string" || typeof value.delivery_status !== "string" ||
+        !["server_park", "driver_enforced"].includes(value.blocker_enforcement))
+        throw new ConductorBridgeApiError("server");
+    return value;
+}
+// ---------------------------------------------------------------------------
+// BAPI-1388 — `rerun-ci`
+// ---------------------------------------------------------------------------
+/** The synthetic code an old server's missing route is reported under. */
+export const RERUN_CI_ROUTE_UNAVAILABLE_CODE = "RERUN_CI_ROUTE_UNAVAILABLE";
+/** The fixed operator text for a server that has no `rerun-ci` route. */
+export const RERUN_CI_ROUTE_UNAVAILABLE_MESSAGE = "rerun-ci is not available on this server; upgrade the Bridge API server before using it";
+const RERUN_CI_HEAD_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+function parseRerunCiCheck(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new ConductorBridgeApiError("server");
+    }
+    const c = value;
+    const status = c["status"];
+    if (typeof status !== "string" ||
+        !RERUN_CI_CHECK_STATUSES.includes(status)) {
+        throw new ConductorBridgeApiError("server");
+    }
+    const reason = c["reason"];
+    if (reason !== undefined &&
+        reason !== null &&
+        (typeof reason !== "string" ||
+            !RERUN_CI_NOT_RUNNABLE_REASONS.includes(reason))) {
+        throw new ConductorBridgeApiError("server");
+    }
+    const optionalPositive = (field) => {
+        const v = c[field];
+        if (v === undefined || v === null)
+            return null;
+        if (typeof v !== "number" || !Number.isSafeInteger(v) || v <= 0) {
+            throw new ConductorBridgeApiError("server");
+        }
+        return v;
+    };
+    const optionalText = (field) => {
+        const v = c[field];
+        if (v === undefined || v === null)
+            return null;
+        if (typeof v !== "string")
+            throw new ConductorBridgeApiError("server");
+        return v;
+    };
+    return {
+        name: optionalText("name"),
+        workflow_identity: optionalText("workflow_identity"),
+        run_id: optionalPositive("run_id"),
+        status: status,
+        reason: (reason ?? null),
+        job_id: optionalPositive("job_id"),
+    };
+}
+/**
+ * Strictly parse a `rerun-ci` success body. Anything short of the contract — an
+ * unknown outcome or per-check status, a malformed head, a non-list `checks` —
+ * throws, so a malformed answer is never read as a success.
+ */
+export function parseRerunCiResult(parsed) {
+    const p = parseRepairBase(parsed);
+    const outcome = p["outcome"];
+    const checks = p["checks"];
+    const head = p["head_sha"];
+    if (typeof p["ticket_key"] !== "string" ||
+        typeof outcome !== "string" ||
+        !RERUN_CI_OUTCOMES.includes(outcome) ||
+        !Array.isArray(checks) ||
+        (head !== undefined && head !== null && (typeof head !== "string" || !RERUN_CI_HEAD_RE.test(head)))) {
+        throw new ConductorBridgeApiError("server");
+    }
+    return {
+        epic_run_id: p["epic_run_id"],
+        ticket_key: p["ticket_key"],
+        before: parseRepairNullableString(p["before"]),
+        after: parseRepairNullableString(p["after"]),
+        committed: p["committed"],
+        event_recorded: p["event_recorded"],
+        outcome: outcome,
+        head_sha: typeof head === "string" ? head : null,
+        checks: checks.map(parseRerunCiCheck),
+    };
+}
+/**
+ * POST `/jira/epic-runs/runs/{epic_run_id}/tickets/{ticket_key}/rerun-ci` — body
+ * `{repo_name, guard}` and nothing else: no context, check list, or run id, because
+ * the SERVER decides what is re-runnable from its own fresh, head-bound CI read.
+ *
+ * A generic `{"detail":"Not Found"}` 404 or a 405 means the server predates the
+ * route; it is reported under {@link RERUN_CI_ROUTE_UNAVAILABLE_CODE} so no caller
+ * can read it as a refusal of THIS ticket or as a success (following
+ * {@link classifySupervisorBootstrapFailure}). A structured 404 — notably
+ * `TICKET_NOT_IN_RUN` — keeps its own code and stays a refusal.
+ */
+export async function rerunCi(access, request, fetchImpl = globalThis.fetch) {
+    requireNonEmptyString(request.epicRunId);
+    requireNonEmptyString(request.ticketKey);
+    let parsed;
+    try {
+        parsed = await postRepairRequest(access, `${epicRunApiPath(request.epicRunId)}/tickets/${encodeURIComponent(request.ticketKey)}/rerun-ci`, { guard: request.guard }, fetchImpl);
+    }
+    catch (err) {
+        if (err instanceof ConductorBridgeApiError &&
+            !err.errorCode &&
+            (err.status === 404 || err.status === 405)) {
+            throw new ConductorBridgeApiError("http", err.status, {
+                errorCode: RERUN_CI_ROUTE_UNAVAILABLE_CODE,
+                bodyPreview: RERUN_CI_ROUTE_UNAVAILABLE_MESSAGE,
+            });
+        }
+        throw err;
+    }
+    return parseRerunCiResult(parsed);
+}
 /**
  * POST `/jira/epic-runs/runs/{epic_run_id}/merge-child` — body EXACTLY
  * `{repo_name, pr_number}`. The server composes the head, gate, and action key.
@@ -2442,6 +2622,47 @@ export const ADMISSION_EVIDENCE_VERDICTS = [
     "unable_to_verify",
     "not_applicable",
 ];
+/**
+ * BAPI-1390 — the four `required_checks` reasons the stored gate profile adds.
+ * Named for the remedies; an unrecognized reason still renders generically.
+ */
+export const GATE_PROFILE_ADMISSION_REASONS = [
+    "provider_check_unseen",
+    "provider_evidence_unavailable",
+    "local_command_unqualified",
+    "migration_guard_unset",
+];
+/** The two known warn-only codes. Any other code is kept and rendered generically. */
+export const GATE_PROFILE_WARNING_CODES = [
+    "provider_check_not_seen_on_epic_branches",
+    "epic_branch_search_unavailable",
+];
+/**
+ * True when the server's rules waive the CI lane file
+ * (`.github/workflows/epic-implementer-ci.yml`): a repository with a STORED gate
+ * profile names its own checks, so the lane file is not required. Absent profile
+ * (older server) keeps the lane-file requirement exactly as before.
+ */
+export function gateProfileWaivesCiWorkflow(readiness) {
+    return readiness.gate_profile?.source === "stored";
+}
+/** BAPI-1405 — the review mode the server will actually apply to this repository. */
+export const EFFECTIVE_REVIEW_MODES = [
+    "repository_policy",
+    "verdict_protocol",
+    "native_review_decision",
+    "none",
+];
+/**
+ * BAPI-1405 — why the server warns that epic-branch PRs may run no CI. Fixed
+ * order on the server. A reason this client does not know is kept (when it is a
+ * bounded token) and rendered generically.
+ */
+export const EPIC_BRANCH_CI_NO_CI_REASONS = [
+    "gate_profile_none",
+    "gate_profile_local_only",
+    "triggers_do_not_cover_epic",
+];
 /** The evidence schema this client renders. A newer one is shown as unknown, never as held. */
 export const ADMISSION_EVIDENCE_SCHEMA_VERSION = 1;
 /** Upper bound of the server's capped `fresh_reconciler_count` ("two or more"). */
@@ -2469,6 +2690,20 @@ function requireBool(o, key) {
         throw readinessShapeError();
     return v;
 }
+/**
+ * An optional boolean field as a spreadable fragment: `{}` when the key is absent,
+ * `{ [key]: value }` when it is a boolean, and a shape error for anything else —
+ * including an explicit `null`. Spreading keeps an absent field ABSENT rather than
+ * present-as-`undefined`.
+ */
+function optionalBoolField(o, key) {
+    if (!(key in o) || o[key] === undefined)
+        return {};
+    const v = o[key];
+    if (typeof v !== "boolean")
+        throw readinessShapeError();
+    return { [key]: v };
+}
 function requireInt(o, key) {
     const v = o[key];
     if (typeof v !== "number" || !Number.isInteger(v))
@@ -2617,6 +2852,15 @@ function parseRequiredChecksVerification(sup, requiredChecksCount) {
         required_checks_evidence_fresh: fresh,
     };
 }
+/** Optional boolean: absent/null from an older server, a non-boolean fails closed. */
+function parseOptionalBool(o, key) {
+    const v = o[key];
+    if (v === undefined || v === null)
+        return null;
+    if (typeof v !== "boolean")
+        throw readinessShapeError();
+    return v;
+}
 /** Optional positive-integer threshold: absent/null from an older server. */
 function parseOptionalPositiveInt(o, key) {
     const v = o[key];
@@ -2666,6 +2910,9 @@ export function parseConductorReadinessResponse(body) {
             // Absent on a pre-BAPI-694 server, where no repository default can exist.
             review_policy_present: sup.review_policy_present === true,
             ...parseRequiredChecksVerification(sup, requiredChecksCount),
+            required_checks_retired_gate_configured: parseOptionalBool(sup, "required_checks_retired_gate_configured"),
+            required_checks_ci_workflow_absent: parseOptionalBool(sup, "required_checks_ci_workflow_absent"),
+            required_checks_review_workflow_absent: parseOptionalBool(sup, "required_checks_review_workflow_absent"),
         },
         github: {
             credentials_readable: requireBool(gh, "credentials_readable"),
@@ -2707,6 +2954,14 @@ export function parseConductorReadinessResponse(body) {
             const evidence = parseAdmissionEvidence(root);
             return evidence === undefined ? {} : { admission_evidence: evidence };
         })(),
+        ...(() => {
+            const profile = parseGateProfile(root);
+            return profile === undefined ? {} : { gate_profile: profile };
+        })(),
+        ...(() => {
+            const epicBranchCi = parseEpicBranchCiReadiness(root);
+            return epicBranchCi === undefined ? {} : { epic_branch_ci: epicBranchCi };
+        })(),
         ...(() => {
             const diagnostics = parseReadinessDiagnostics(root);
             return diagnostics === undefined ? {} : { diagnostics };
@@ -2793,10 +3048,210 @@ function parseAdmissionEvidence(body) {
             max_age_seconds: maxAge,
             reason: r.reason === undefined ? null : token(r.reason, true),
             next_action_owner: (owner ?? null),
+            // BAPI-1390 — additive and lenient: omitted when the server did not send
+            // the key, so an older server's records keep their exact shape.
+            ...(r.subject === undefined ? {} : { subject: safeSubject(r.subject) }),
         };
     });
     return { schema_version: schemaVersion, observed_at: observedAt, records };
 }
+/** The longest check or command name this client renders. */
+const GATE_PROFILE_SUBJECT_MAX_LENGTH = 200;
+const GATE_PROFILE_MEMBER_LIMIT = 64;
+/**
+ * A server-validated check or command name, or `null`. Lenient by design: a
+ * value this client will not render degrades to `null` and never fails the read.
+ */
+function safeSubject(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    if (value.length > GATE_PROFILE_SUBJECT_MAX_LENGTH)
+        return null;
+    // eslint-disable-next-line no-control-regex -- refusing control characters is the point
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return null;
+    return value;
+}
+function enumOrNull(value, allowed) {
+    return typeof value === "string" && allowed.includes(value) ? value : null;
+}
+function boolOrNull(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function tokenOrNull(value) {
+    return typeof value === "string" && BOUNDED_TOKEN.test(value) ? value : null;
+}
+/**
+ * Parse the optional BAPI-1390 `gate_profile` block.
+ *
+ * Absent → `undefined` (the key is then omitted). `null` → `null`. A PRESENT
+ * block follows the admission-evidence rule: its STRUCTURE is validated strictly
+ * (an object, booleans, a non-negative integer revision, bounded arrays of
+ * objects) and a malformed structure throws the field-free shape error, because a
+ * block that cannot be read is untrusted input, not an older server.
+ *
+ * Its VOCABULARY is lenient, so a newer server never turns into "no readiness
+ * at all": an unknown `kind`, outcome, qualification state, or verdict degrades
+ * to `null` (unknown, never held); an unknown `source` degrades to `unconfirmed`
+ * and clears `confirmed`; an unknown `reason` or warning `code` is kept when it
+ * is a bounded token and rendered generically. Names are kept only when they are
+ * safe to render ({@link safeSubject}).
+ */
+function parseGateProfile(body) {
+    const raw = body.gate_profile;
+    if (raw === undefined)
+        return undefined;
+    if (raw === null)
+        return null;
+    const o = requireObject(raw);
+    const revision = requireInt(o, "revision");
+    if (revision < 0)
+        throw readinessShapeError();
+    const sourceKnown = enumOrNull(o.source, ["stored", "legacy", "unconfirmed"]);
+    const list = (value) => {
+        if (value === undefined || value === null)
+            return [];
+        if (!Array.isArray(value) || value.length > GATE_PROFILE_MEMBER_LIMIT)
+            throw readinessShapeError();
+        return value.map((entry) => requireObject(entry));
+    };
+    const requiredName = (value) => {
+        const name = safeSubject(value);
+        if (name === null)
+            throw readinessShapeError();
+        return name;
+    };
+    const guardRaw = o.migration_guard;
+    let migrationGuard = null;
+    if (guardRaw !== undefined && guardRaw !== null) {
+        const g = requireObject(guardRaw);
+        const guardKind = enumOrNull(g.kind, ["provider", "local"]);
+        migrationGuard = guardKind === null ? null : { kind: guardKind, name: safeSubject(g.name) };
+    }
+    return {
+        source: sourceKnown ?? "unconfirmed",
+        confirmed: sourceKnown === null ? false : requireBool(o, "confirmed"),
+        stored_malformed: requireBool(o, "stored_malformed"),
+        read_failed: requireBool(o, "read_failed"),
+        kind: enumOrNull(o.kind, ["provider", "local", "mixed", "none"]),
+        revision,
+        provider_checks: list(o.provider_checks).map((c) => ({
+            name: requiredName(c.name),
+            outcome: enumOrNull(c.outcome, ["reported", "unseen", "evidence_unavailable"]),
+            epic_branch_seen: boolOrNull(c.epic_branch_seen),
+        })),
+        local_commands: list(o.local_commands).map((c) => ({
+            name: requiredName(c.name),
+            id: requiredName(c.id),
+        })),
+        migration_guard: migrationGuard,
+        migration_guard_required: boolOrNull(o.migration_guard_required),
+        qualification_state: enumOrNull(o.qualification_state, [
+            "qualified",
+            "unqualified",
+            "stale",
+            "not_required",
+        ]),
+        verdict: enumOrNull(o.verdict, ["confirmed", "denied", "unable_to_verify"]),
+        reason: tokenOrNull(o.reason),
+        subject: safeSubject(o.subject),
+        provider_evidence_complete: boolOrNull(o.provider_evidence_complete),
+        provider_evidence_unavailable_reason: tokenOrNull(o.provider_evidence_unavailable_reason),
+        epic_branch_search_available: boolOrNull(o.epic_branch_search_available),
+        warnings: list(o.warnings).map((w) => ({
+            code: tokenOrNull(w.code) ?? "unknown",
+            name: safeSubject(w.name),
+        })),
+    };
+}
+const EPIC_BRANCH_CI_DECISIONS = new Set(["include", "decline"]);
+const EPIC_BRANCH_CI_OBSERVATION_QUALITIES = new Set(["exact", "inferred", "could_not_tell"]);
+const EPIC_BRANCH_CI_EXEMPTION_OUTCOMES = new Set(["exempt", "not_exempt", "unknown"]);
+const EPIC_BRANCH_CI_EVIDENCE_KEYS = new Set([
+    "workflow_triggers_cover_epic",
+    "required_approvals_apply_to_epic",
+    "observation_quality",
+    "exemption_outcome",
+]);
+const EPIC_BRANCH_CI_REASON_LIMIT = 16;
+/**
+ * BAPI-1405 — validate an {@link EpicBranchCiEvidence} object, fail-closed. All
+ * four keys are required, every value must be one of its closed literals, and
+ * any extra key is a shape error (the server model forbids extras, so an extra
+ * key means the body is not what this client understands).
+ */
+function parseEpicBranchCiEvidence(value) {
+    const o = requireObject(value);
+    for (const key of Object.keys(o)) {
+        if (!EPIC_BRANCH_CI_EVIDENCE_KEYS.has(key))
+            throw readinessShapeError();
+    }
+    const nullableBool = (key) => {
+        if (!(key in o))
+            throw readinessShapeError();
+        const v = o[key];
+        if (v === null)
+            return null;
+        if (typeof v !== "boolean")
+            throw readinessShapeError();
+        return v;
+    };
+    return {
+        workflow_triggers_cover_epic: nullableBool("workflow_triggers_cover_epic"),
+        required_approvals_apply_to_epic: nullableBool("required_approvals_apply_to_epic"),
+        observation_quality: requireEnum(o, "observation_quality", EPIC_BRANCH_CI_OBSERVATION_QUALITIES),
+        exemption_outcome: requireEnum(o, "exemption_outcome", EPIC_BRANCH_CI_EXEMPTION_OUTCOMES),
+    };
+}
+/**
+ * Parse the optional BAPI-1405 `epic_branch_ci` readiness block.
+ *
+ * Absent → `undefined` (the key is then omitted, so older fixtures keep their
+ * shape). `null` → `null`. Both mean "unreported" to every renderer — never
+ * "no warning".
+ *
+ * A PRESENT block follows the {@link parseGateProfile} rule. Its STRUCTURE is
+ * strict: an object, a boolean `no_ci_warning`, a bounded `no_ci_reasons` list,
+ * a `decision` that is `include`, `decline`, or `null`, and child-1 evidence
+ * validated by {@link parseEpicBranchCiEvidence} (or `null`). A malformed
+ * structure throws the field-free shape error. Only the open-ended VOCABULARY is
+ * lenient so a newer server never becomes "no readiness at all": an unknown
+ * `effective_review_mode` degrades to `null` (rendered as unknown), and an
+ * unknown reason is kept when it is a bounded token and rendered generically.
+ */
+export function parseEpicBranchCiReadiness(body) {
+    const raw = body.epic_branch_ci;
+    if (raw === undefined)
+        return undefined;
+    if (raw === null)
+        return null;
+    const o = requireObject(raw);
+    const decisionRaw = o.decision;
+    let decision = null;
+    if (decisionRaw !== null && decisionRaw !== undefined) {
+        if (typeof decisionRaw !== "string" || !EPIC_BRANCH_CI_DECISIONS.has(decisionRaw)) {
+            throw readinessShapeError();
+        }
+        decision = decisionRaw;
+    }
+    const evidence = o.evidence === null || o.evidence === undefined ? null : parseEpicBranchCiEvidence(o.evidence);
+    const reasonsRaw = o.no_ci_reasons;
+    if (!Array.isArray(reasonsRaw) || reasonsRaw.length > EPIC_BRANCH_CI_REASON_LIMIT) {
+        throw readinessShapeError();
+    }
+    const reasons = reasonsRaw.map((r) => {
+        if (typeof r !== "string" || !BOUNDED_TOKEN.test(r))
+            throw readinessShapeError();
+        return r;
+    });
+    return {
+        effective_review_mode: enumOrNull(o.effective_review_mode, EFFECTIVE_REVIEW_MODES),
+        decision,
+        evidence,
+        no_ci_warning: requireBool(o, "no_ci_warning"),
+        no_ci_reasons: reasons,
+    };
+}
 /**
  * Parse the optional `merge_execution` block (BAPI-1135).
  *
@@ -2891,6 +3346,11 @@ function parseConductorCiWorkflow(body) {
         probe_succeeded: requireBool(o, "probe_succeeded"),
         workflow_present: requireBool(o, "workflow_present"),
         migration_guard_present: requireBool(o, "migration_guard_present"),
+        // BAPI-1359: OPTIONAL so a newer CLI still reads an older server. An absent
+        // key stays `undefined` — never materialized as a default — and a present key
+        // must be a real boolean (`null`, strings, numbers, and objects all reject).
+        ...optionalBoolField(o, "migration_guard_required"),
+        ...optionalBoolField(o, "migration_chain_probe_succeeded"),
     };
 }
 /**
@@ -3306,3 +3766,399 @@ export async function resumeCiTicket(access, request, fetchImpl = globalThis.fet
         clearTimeout(timer);
     }
 }
+// ---------------------------------------------------------------------------
+// BAPI-1391 — gate profile, provider history, capability probe, qualification
+// ---------------------------------------------------------------------------
+//
+// The installer's typed access to BAPI-1390's gate-profile routes and to
+// BAPI-1391's qualification routes. Every parser is FAIL-CLOSED in the
+// bootstrap-preview style: a body this client cannot validate is never read as
+// a confirmed profile, an available history, an advertised capability, or an
+// accepted enqueue. Errors are the sanitized {@link ConductorBridgeApiError};
+// nothing here echoes a response body, the API key, or command output.
+/** The capability token the gate-profile server answers (BAPI-1390). */
+export const GATE_PROFILE_CAPABILITY_TOKEN = "gate_profile.v1";
+const GATE_PROFILE_KINDS = new Set(["provider", "local", "mixed", "none"]);
+const GATE_PROFILE_SOURCES = new Set(["stored", "legacy", "unconfirmed"]);
+const GATE_QUALIFICATION_STATES = new Set(["qualified", "unqualified", "stale", "not_required"]);
+const GATE_PROFILE_WRITE_OUTCOMES = new Set(["confirmed", "cleared", "preserved"]);
+const GATE_CHECK_OUTCOMES = new Set(["reported", "unseen", "evidence_unavailable"]);
+const EXECUTOR_JOB_STATUSES = new Set([
+    "queued",
+    "running",
+    "succeeded",
+    "failed",
+    "cancelled",
+    "dead_letter",
+]);
+const GATE_DIGEST_RE = /^[0-9a-f]{64}$/;
+const GATE_COMMAND_ID_RE = /^cmd-[0-9]{2,}-[0-9a-f]{16}$/;
+const GATE_MEMBER_NAME_MAX = 200;
+const GATE_COMMAND_NAME_MAX = 120;
+const GATE_ARGV_ENTRY_MAX = 1024;
+const GATE_MAX_PROVIDER_CHECKS = 32;
+const GATE_MAX_LOCAL_COMMANDS = 16;
+const GATE_MAX_CUSTOMIZED = 64;
+/** The provider-history walk makes bounded provider calls; give it longer. */
+const GATE_CHECK_HISTORY_TIMEOUT_MS = 90_000;
+function gateName(value, max) {
+    if (typeof value !== "string")
+        throw readinessShapeError();
+    const trimmed = value.trim();
+    if (!trimmed || trimmed !== value || value.length > max || /[\u0000-\u001F\u007F]/.test(value)) {
+        throw readinessShapeError();
+    }
+    return value;
+}
+function parseGateProfileBody(raw) {
+    const o = requireObject(raw);
+    const kind = requireEnum(o, "kind", GATE_PROFILE_KINDS);
+    const checksRaw = o.provider_checks;
+    if (!Array.isArray(checksRaw) || checksRaw.length > GATE_MAX_PROVIDER_CHECKS)
+        throw readinessShapeError();
+    const providerChecks = checksRaw.map((c) => gateName(requireObject(c).name, GATE_MEMBER_NAME_MAX));
+    const commandsRaw = o.local_commands;
+    if (!Array.isArray(commandsRaw) || commandsRaw.length > GATE_MAX_LOCAL_COMMANDS)
+        throw readinessShapeError();
+    const localCommands = commandsRaw.map((raw) => {
+        const c = requireObject(raw);
+        const id = c.id;
+        const digest = c.digest;
+        const argv = c.argv;
+        if (typeof id !== "string" || !GATE_COMMAND_ID_RE.test(id))
+            throw readinessShapeError();
+        if (typeof digest !== "string" || !GATE_DIGEST_RE.test(digest))
+            throw readinessShapeError();
+        if (!Array.isArray(argv) ||
+            argv.length === 0 ||
+            argv.some((a) => typeof a !== "string" || a.length === 0 || a.length > GATE_ARGV_ENTRY_MAX)) {
+            throw readinessShapeError();
+        }
+        const timeout = requireInt(c, "timeout_seconds");
+        if (timeout < 1 || timeout > 1800)
+            throw readinessShapeError();
+        return {
+            id,
+            name: gateName(c.name, GATE_COMMAND_NAME_MAX),
+            argv: argv,
+            timeout_seconds: timeout,
+            digest,
+        };
+    });
+    let guard = null;
+    if (o.migration_guard !== null && o.migration_guard !== undefined) {
+        const g = requireObject(o.migration_guard);
+        guard = {
+            kind: requireEnum(g, "kind", new Set(["provider", "local"])),
+            id: gateName(g.id, GATE_MEMBER_NAME_MAX),
+        };
+    }
+    const customized = o.customized_commands ?? [];
+    if (!Array.isArray(customized) || customized.length > GATE_MAX_CUSTOMIZED)
+        throw readinessShapeError();
+    const revision = requireInt(o, "revision");
+    if (revision < 0)
+        throw readinessShapeError();
+    // The kind must agree with its members, exactly as the server validates it;
+    // a profile that does not cannot be shown as a confirmed gate.
+    const expectedKind = providerChecks.length > 0 && localCommands.length > 0
+        ? "mixed"
+        : providerChecks.length > 0
+            ? "provider"
+            : localCommands.length > 0
+                ? "local"
+                : "none";
+    if (expectedKind !== kind)
+        throw readinessShapeError();
+    return {
+        kind,
+        provider_checks: providerChecks,
+        local_commands: localCommands,
+        migration_guard: guard,
+        customized_commands: customized.map((n) => gateName(n, GATE_MEMBER_NAME_MAX)),
+        confirmed_by: requireNullableString(o, "confirmed_by"),
+        confirmed_at: requireNullableString(o, "confirmed_at"),
+        revision,
+    };
+}
+/** Validate a gate-profile body, fail-closed. */
+export function parseConductorGateProfileResponse(body, expectedRepoName) {
+    const o = requireObject(body);
+    if (o.repo_name !== expectedRepoName)
+        throw readinessShapeError();
+    const source = requireEnum(o, "source", GATE_PROFILE_SOURCES);
+    const confirmed = requireBool(o, "confirmed");
+    const revision = requireInt(o, "revision");
+    if (revision < 0)
+        throw readinessShapeError();
+    const profile = o.profile === null || o.profile === undefined ? null : parseGateProfileBody(o.profile);
+    // "Confirmed" is believed only when it is internally consistent: a confirmed
+    // read needs a readable profile from a stored or legacy source whose revision
+    // matches. Anything else is a shape error, never a quietly confirmed gate.
+    if (confirmed && (profile === null || source === "unconfirmed" || profile.revision !== revision)) {
+        throw readinessShapeError();
+    }
+    if (!confirmed && profile !== null)
+        throw readinessShapeError();
+    const outcome = o.outcome;
+    if (outcome !== undefined && outcome !== null && (typeof outcome !== "string" || !GATE_PROFILE_WRITE_OUTCOMES.has(outcome))) {
+        throw readinessShapeError();
+    }
+    return {
+        repo_name: expectedRepoName,
+        source,
+        confirmed,
+        stored_malformed: requireBool(o, "stored_malformed"),
+        revision,
+        profile,
+        qualification_state: requireEnum(o, "qualification_state", GATE_QUALIFICATION_STATES),
+        outcome: (outcome ?? null),
+    };
+}
+function gateProfileUrl(access, suffix = "") {
+    return buildConductorJiraUrl(access.baseUrl, `${EPIC_RUNS_API_PREFIX}/supervisor-setup/gate-profile/${suffix}`, { repo_name: access.repoName });
+}
+/** GET the repository's gate profile. Throws a sanitized error on any failure. */
+export async function fetchConductorGateProfile(access, fetchImpl) {
+    const body = await fetchConductorJsonWithTimeout(gateProfileUrl(access), conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parseConductorGateProfileResponse(body, access.repoName);
+}
+function classifyGateProfileWriteFailure(err) {
+    if (!(err instanceof ConductorBridgeApiError))
+        return "network";
+    if (err.errorCode === "STALE_REVISION")
+        return "stale-revision";
+    if (err.errorCode === "UNKNOWN_STORED_STATE")
+        return "unknown-stored-state";
+    if (err.errorCode === "VALIDATION")
+        return "validation";
+    if (err.errorCode === "STATE_UNAVAILABLE")
+        return "state-unavailable";
+    if (err.kind === "invalid-input")
+        return "unsupported-protocol";
+    if (err.kind === "unauthorized")
+        return "unauthorized";
+    if (err.kind === "timeout")
+        return "timeout";
+    if (err.kind === "network")
+        return "network";
+    if (err.status === 404 || err.status === 405 || err.status === 422)
+        return "unsupported-protocol";
+    if (err.kind === "server")
+        return "server";
+    return "rejected";
+}
+/**
+ * PUT a confirm or clear. Never throws: a refusal (403 admin gate, 409 stale
+ * revision, 400 validation, an unreadable answer) is a typed outcome, and the
+ * caller keeps showing the PRIOR confirmed profile, because nothing was written.
+ */
+export async function putConductorGateProfile(access, request, fetchImpl) {
+    try {
+        const body = await fetchConductorJsonWithMethodAndTimeout("PUT", gateProfileUrl(access), conductorPostHeaders(access), JSON.stringify(request), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+        return { ok: true, profile: parseConductorGateProfileResponse(body, access.repoName) };
+    }
+    catch (err) {
+        return { ok: false, refusal: classifyGateProfileWriteFailure(err) };
+    }
+}
+const EPIC_BRANCH_CI_AUDITED_FIELD_LIMIT = 8;
+/**
+ * BAPI-1405 — validate a decision-write response, fail-closed. Every closed
+ * value (the decision and all four evidence keys) must be a known literal; an
+ * unknown literal, a missing key, or an extra evidence key throws the
+ * field-free shape error rather than being coerced.
+ */
+export function parseEpicBranchCiDecisionResponse(body) {
+    const o = requireObject(body);
+    const repoName = o.repo_name;
+    if (typeof repoName !== "string" || repoName.length === 0)
+        throw readinessShapeError();
+    const decision = requireEnum(o, "decision", EPIC_BRANCH_CI_DECISIONS);
+    const evidence = parseEpicBranchCiEvidence(o.evidence);
+    const names = o.audited_field_names;
+    if (!Array.isArray(names) || names.length > EPIC_BRANCH_CI_AUDITED_FIELD_LIMIT)
+        throw readinessShapeError();
+    const auditedFieldNames = names.map((n) => {
+        if (typeof n !== "string" || !BOUNDED_TOKEN.test(n))
+            throw readinessShapeError();
+        return n;
+    });
+    return { repo_name: repoName, decision, evidence, audited_field_names: auditedFieldNames };
+}
+/**
+ * BAPI-1405 — record the repository's explicit epic-branch CI decision and the
+ * evidence recorded at install.
+ *
+ * Uses the same PUT transport as {@link putConductorGateProfile} (sanitized
+ * {@link ConductorBridgeApiError}, timeout, `X-API-Key` header only), but
+ * THROWS instead of returning a refusal so the install flow can tell a recorded
+ * decision from one that was not written. Invalid local input (a decision other
+ * than `include`/`decline`, or evidence outside child 1's closed shape) is
+ * rejected with `invalid-input` BEFORE any request is sent. A 2xx answer that
+ * does not validate, or that names a different repository, also throws.
+ * Never call this with a `decline` synthesized from an unreadable inspection.
+ */
+export async function putEpicBranchCiDecision(access, repoName, body, fetchImpl = globalThis.fetch) {
+    if (typeof repoName !== "string" || repoName.length === 0) {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    if (typeof body?.decision !== "string" || !EPIC_BRANCH_CI_DECISIONS.has(body.decision)) {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    let evidence;
+    try {
+        evidence = parseEpicBranchCiEvidence(body.evidence);
+    }
+    catch {
+        throw new ConductorBridgeApiError("invalid-input");
+    }
+    const url = buildConductorJiraUrl(access.baseUrl, `${EPIC_RUNS_API_PREFIX}/supervisor-setup/epic-branch-ci-decision/`, { repo_name: repoName });
+    const response = await fetchConductorJsonWithMethodAndTimeout("PUT", url, conductorPostHeaders(access), JSON.stringify({ decision: body.decision, evidence }), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    const parsed = parseEpicBranchCiDecisionResponse(response);
+    if (parsed.repo_name !== repoName)
+        throw readinessShapeError();
+    return parsed;
+}
+/** Validate a provider-history body; only names the caller asked about are kept. */
+export function parseConductorGateCheckHistory(body, expectedRepoName, askedNames) {
+    const o = requireObject(body);
+    if (o.repo_name !== expectedRepoName)
+        throw readinessShapeError();
+    const checksRaw = o.checks;
+    if (!Array.isArray(checksRaw) || checksRaw.length > GATE_MAX_PROVIDER_CHECKS)
+        throw readinessShapeError();
+    const asked = new Set(askedNames);
+    const checks = [];
+    for (const raw of checksRaw) {
+        const c = requireObject(raw);
+        const name = c.name;
+        if (typeof name !== "string")
+            throw readinessShapeError();
+        const outcome = requireEnum(c, "outcome", GATE_CHECK_OUTCOMES);
+        if (asked.has(name))
+            checks.push({ name, outcome });
+    }
+    const reason = requireNullableString(o, "unavailable_reason");
+    if (reason !== null && !BOUNDED_TOKEN.test(reason))
+        throw readinessShapeError();
+    return { complete: requireBool(o, "complete"), unavailable_reason: reason, checks };
+}
+/**
+ * GET bounded provider history for exactly `names` (at most 32). Read-only on
+ * the server. Throws a sanitized error on any failure, so a caller can tell
+ * "history unavailable" from a successful empty answer.
+ */
+export async function fetchConductorGateCheckHistory(access, names, fetchImpl) {
+    const url = new URL(gateProfileUrl(access, "check-history/"));
+    for (const name of names.slice(0, GATE_MAX_PROVIDER_CHECKS))
+        url.searchParams.append("check", name);
+    const body = await fetchConductorJsonWithTimeout(url.toString(), conductorGetHeaders(access), GATE_CHECK_HISTORY_TIMEOUT_MS, fetchImpl);
+    return parseConductorGateCheckHistory(body, access.repoName, names);
+}
+/**
+ * GET the BAPI-1390 capability probe. NEVER throws and fails CLOSED: a 404 (a
+ * server older than BAPI-1390), a malformed body, or a body without the token
+ * all read as unsupported, so the installer writes nothing.
+ */
+export async function probeConductorGateProfileCapability(access, fetchImpl) {
+    let body;
+    try {
+        body = await fetchConductorJsonWithTimeout(gateProfileUrl(access, "capability/"), conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    }
+    catch (err) {
+        if (err instanceof ConductorBridgeApiError) {
+            if (err.kind === "unauthorized")
+                return { supported: false, reason: "unauthorized" };
+            if (err.kind === "network" || err.kind === "timeout")
+                return { supported: false, reason: "unreachable" };
+            if (err.kind === "invalid-input")
+                return { supported: false, reason: "unreadable" };
+        }
+        return { supported: false, reason: "absent" };
+    }
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+        return { supported: false, reason: "unreadable" };
+    }
+    const o = body;
+    const caps = o.capabilities;
+    if (o.repo_name !== access.repoName || !Array.isArray(caps) || caps.some((c) => typeof c !== "string")) {
+        return { supported: false, reason: "unreadable" };
+    }
+    return caps.includes(GATE_PROFILE_CAPABILITY_TOKEN)
+        ? { supported: true }
+        : { supported: false, reason: "absent" };
+}
+const QUALIFICATION_REFUSAL_CODES = Object.freeze({
+    PROFILE_NOT_CONFIRMED: "profile-not-confirmed",
+    NO_LOCAL_COMMANDS: "no-local-commands",
+    STALE_REVISION: "stale-revision",
+    STATE_UNAVAILABLE: "state-unavailable",
+});
+/** POST the qualification enqueue for the confirmed revision. Never throws. */
+export async function enqueueConductorGateQualification(access, request, fetchImpl) {
+    let body;
+    try {
+        body = await fetchConductorJsonWithMethodAndTimeout("POST", gateProfileUrl(access, "qualification/"), conductorPostHeaders(access), JSON.stringify(request.expectedRevision === undefined ? {} : { expected_revision: request.expectedRevision }), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    }
+    catch (err) {
+        if (!(err instanceof ConductorBridgeApiError))
+            return { kind: "uncertain" };
+        const mapped = err.errorCode ? QUALIFICATION_REFUSAL_CODES[err.errorCode] : undefined;
+        if (mapped)
+            return { kind: "refused", refusal: mapped };
+        if (err.kind === "unauthorized")
+            return { kind: "refused", refusal: "unauthorized" };
+        if (err.kind === "timeout" || err.kind === "network" || err.kind === "server") {
+            return { kind: "uncertain" };
+        }
+        if (err.status === 404 || err.status === 405 || err.status === 422) {
+            return { kind: "refused", refusal: "unsupported-protocol" };
+        }
+        return { kind: "refused", refusal: "rejected" };
+    }
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+        return { kind: "uncertain" };
+    const o = body;
+    const jobId = o.job_id;
+    const revision = o.revision;
+    const jobStatus = o.job_status;
+    if (o.repo_name !== access.repoName ||
+        typeof jobId !== "number" ||
+        !Number.isSafeInteger(jobId) ||
+        jobId <= 0 ||
+        typeof revision !== "number" ||
+        !Number.isSafeInteger(revision) ||
+        revision <= 0 ||
+        typeof jobStatus !== "string" ||
+        !EXECUTOR_JOB_STATUSES.has(jobStatus)) {
+        return { kind: "uncertain" };
+    }
+    return { kind: "accepted", jobId, jobStatus, revision };
+}
+export function parseConductorGateQualificationJob(body, expectedRepoName, expectedJobId) {
+    const o = requireObject(body);
+    if (o.repo_name !== expectedRepoName || o.job_id !== expectedJobId)
+        throw readinessShapeError();
+    const state = o.qualification_state;
+    if (state !== null && state !== undefined && !["qualified", "unqualified", "stale"].includes(state)) {
+        throw readinessShapeError();
+    }
+    const failure = o.failure;
+    if (failure !== null && failure !== undefined && failure !== "stale" && failure !== "could_not_run") {
+        throw readinessShapeError();
+    }
+    return {
+        job_id: expectedJobId,
+        job_status: requireEnum(o, "job_status", EXECUTOR_JOB_STATUSES),
+        revision: requireInt(o, "revision"),
+        qualification_state: (state ?? null),
+        current_revision: requireNullableInt(o, "current_revision"),
+        failure: (failure ?? null),
+    };
+}
+/** GET one qualification job's verified state. Throws a sanitized error on failure. */
+export async function fetchConductorGateQualificationJob(access, jobId, fetchImpl) {
+    const body = await fetchConductorJsonWithTimeout(gateProfileUrl(access, `qualification/${encodeURIComponent(String(jobId))}/`), conductorGetHeaders(access), CONDUCTOR_FETCH_TIMEOUT_MS, fetchImpl);
+    return parseConductorGateQualificationJob(body, access.repoName, jobId);
+}