@knpkv/control-center 0.4.0 → 0.5.0

package/dist/server/assets/{BindConfig-Bj282xDC.js → BindConfig-DAASchDn.js}

@@ -1,10 +1,10 @@
-import { $n as PrReviewSuggestionEdit, $r as GovernedActionAuthorityMismatch, Ar as PrReviewSuggestionId, B as LedgerRevision, Br as GovernedActionCommandId, Cr as PrReviewReport, Ct as ReleaseVersion, Dr as PrReviewSuggestionDraft, Fr as reconcilePrReviewReports, Ft as deriveReleaseRelay, Hi as derivePersonInitials, Ii as Person, Jn as PluginHealth, Mi as Actor, Nr as derivePrReviewOutcome, Pr as prReviewSuggestionIdentityMaterial, Qn as PrReviewSuggestionAgentAuthor, Sr as PrReviewReplacement, St as ReleaseServiceName, Tr as PrReviewSuggestion, Y as evidenceFreshnessAt, Yn as evaluateFreshnessAt, Yr as GovernedActionUnknownOutcome, _i as GovernedActionPluginConnectionRevision, ar as PrReviewSuggestionRevisionPageSize, bt as Release, ci as GovernedActionAuthorizationV1, dr as PrReviewCompletion, er as PrReviewSuggestionOperatorAuthor, gi as GovernedActionPluginConnectionAuthorityDigest, gr as PrReviewNoteId, hi as GovernedActionIdempotencyKey, hr as PrReviewNoteDraft, ir as PrReviewSuggestionRevisionPage, j as DeliveryRelationship, li as GovernedActionEnvelopeDigest, nr as PrReviewSuggestionRevision, o as WorkspaceSettingsV1, oi as GovernedActionAttemptV1, ti as governedActionAuthorityMismatches, ui as GovernedActionEnvelopeMaterialV1, ut as NormalizedIssueAttributes, vi as GovernedActionPolicyBinding, wi as GovernedActionTargetSnapshotV1, wr as PrReviewSubject, xi as GovernedActionPolicyEvaluationV1, xt as ReleaseLifecycle, yr as PrReviewPrevention, zi as Role, zr as GovernedActionCommandDigest } from "./workspaceSettings-C2Zsk6RI.js";
+import { $n as PrReviewSuggestionEdit, $r as GovernedActionAuthorityMismatch, Ar as PrReviewSuggestionId, B as LedgerRevision, Br as GovernedActionCommandId, Cr as PrReviewReport, Ct as ReleaseVersion, Dr as PrReviewSuggestionDraft, Fr as reconcilePrReviewReports, Ft as deriveReleaseRelay, Hi as derivePersonInitials, Ii as Person, Jn as PluginHealth, Mi as Actor, Nr as derivePrReviewOutcome, Pr as prReviewSuggestionIdentityMaterial, Qn as PrReviewSuggestionAgentAuthor, Sr as PrReviewReplacement, St as ReleaseServiceName, Tr as PrReviewSuggestion, Y as evidenceFreshnessAt, Yn as evaluateFreshnessAt, Yr as GovernedActionUnknownOutcome, _i as GovernedActionPluginConnectionRevision, ar as PrReviewSuggestionRevisionPageSize, bt as Release, ci as GovernedActionAuthorizationV1, dr as PrReviewCompletion, er as PrReviewSuggestionOperatorAuthor, gi as GovernedActionPluginConnectionAuthorityDigest, gr as PrReviewNoteId, hi as GovernedActionIdempotencyKey, hr as PrReviewNoteDraft, ir as PrReviewSuggestionRevisionPage, j as DeliveryRelationship, li as GovernedActionEnvelopeDigest, nr as PrReviewSuggestionRevision, o as WorkspaceSettingsV1, oi as GovernedActionAttemptV1, ti as governedActionAuthorityMismatches, ui as GovernedActionEnvelopeMaterialV1, ut as NormalizedIssueAttributes, vi as GovernedActionPolicyBinding, wi as GovernedActionTargetSnapshotV1, wr as PrReviewSubject, xi as GovernedActionPolicyEvaluationV1, xt as ReleaseLifecycle, yr as PrReviewPrevention, zi as Role, zr as GovernedActionCommandDigest } from "./workspaceSettings-sv8h_h2P.js";
 import { $ as SourceRevision$1, A as DiffInventoryPageRequestV1, D as DiffContentRangeRequestV1, Dt as ReviewSuggestionPublicationReservationId, Et as ReviewCommandArtifactId, H as PluginSyncRequestV1, I as PluginEntityReferenceV1, K as MaximumPluginPayloadBytes, L as PluginEntityType, M as DiffInventoryPageV1, N as NormalizedPluginEventV1, Nt as UtcTimestamp, O as DiffContentRangeRequestV2, Ot as RoleAssignmentId, P as PluginCheckpointV1, Q as Revision, S as PluginProviderOperationId, T as ProposePluginActionRequestV1, Tt as ReleaseId, U as ReadPluginEntityRequestV1, V as PluginSyncPageV1, W as ReadPluginEntityResultV1, Y as hasMaximumPluginJsonBytes, Z as ProviderId, _ as PluginActionPreflightV1, _t as PersonId, a as PluginConfigurationFieldV1, at as EntityId, b as PluginActionReconciliationRequestV1, bt as ProviderAccountId, ct as EvidenceClaimId, dt as GovernedActionAttemptId, et as SourceUrl, f as PluginActionActorIdentityV1, ft as GovernedActionAuthorizationId, g as PluginActionPayloadDigest, gt as JobId, h as PluginActionDispatchResultV1, it as DomainEventId, j as DiffInventoryPageRequestV2, jt as WorkspaceId, k as DiffContentRangeV1, kt as SessionId, l as AuthorizedPluginActionV1, m as PluginActionCancellationResultV1, mt as GovernedActionTransitionId, n as NegotiatedPluginDescriptorV1, nt as AgentId, ot as EnvironmentId, p as PluginActionCancellationRequestV1, pt as GovernedActionId, rt as AgentThreadId, tt as VendorImmutableId, ut as FollowedResourceId, v as PluginActionProposalV1, vt as PluginConnectionId, x as PluginActionReconciliationResultV1, y as PluginActionReconciliationKey, yt as PrReviewSuggestionRevisionId } from "./descriptor-CCvNzSZL.js";
-import { C as PublishedReviewComment, Cn as PayloadTooLargeApiError, D as PullRequestReviewNotStarted, Dn as UnauthorizedApiError, Dt as DiscoveredAtlassianProfile, E as PullRequestReviewInterrupted, En as ServiceUnavailableApiError, G as ReviewSuggestionPublicationAuthorityBinding, I as ReleaseAgentThreadCursor, It as PluginConfigurationKey, J as ReviewSuggestionPublicationPreview, K as ReviewSuggestionPublicationContent, M as PullRequestReviewThreadPage, N as PullRequestReviewUnavailable, O as PullRequestReviewPending, Sn as NotFoundApiError, T as PullRequestReviewFailed, Tn as RequestTimedOutApiError, W as ReviewAgentProfileId, X as ReviewSuggestionRevisionPage, _n as ConflictApiError, an as CsrfToken$1, b as MAXIMUM_REVIEW_SUGGESTION_PUBLICATION_CONTENT_LENGTH, bn as ForbiddenApiError, ct as AtlassianOAuthGrantExchangeResponse, f as DurableAgentPrompt, hn as SessionMutationAuth, j as PullRequestReviewThreadEvent, k as PullRequestReviewStale, lt as AtlassianOAuthGrantId, on as CurrentSession, p as DurableAgentProviderId, pn as SessionCookieAuth, pt as AtlassianOAuthSite, r as AgentModelId, vn as CorrelationId, w as PullRequestReviewCompleted, wn as RateLimitedApiError, wt as CreatePluginConnectionValue, xn as InvalidRequestApiError } from "./agent-ZvwskOQu.js";
+import { An as UnauthorizedApiError, C as PublishedReviewComment, Cn as ForbiddenApiError, D as PullRequestReviewNotStarted, Dn as RateLimitedApiError, Dt as DiscoveredAtlassianProfile, E as PullRequestReviewInterrupted, En as PayloadTooLargeApiError, G as ReviewSuggestionPublicationAuthorityBinding, I as ReleaseAgentThreadCursor, It as PluginConfigurationKey, J as ReviewSuggestionPublicationPreview, K as ReviewSuggestionPublicationContent, M as PullRequestReviewThreadPage, N as PullRequestReviewUnavailable, O as PullRequestReviewPending, On as RequestTimedOutApiError, T as PullRequestReviewFailed, Tn as NotFoundApiError, W as ReviewAgentProfileId, X as ReviewSuggestionRevisionPage, b as MAXIMUM_REVIEW_SUGGESTION_PUBLICATION_CONTENT_LENGTH, bn as ConflictApiError, ct as AtlassianOAuthGrantExchangeResponse, f as DurableAgentPrompt, gn as SessionCookieAuth, j as PullRequestReviewThreadEvent, k as PullRequestReviewStale, kn as ServiceUnavailableApiError, lt as AtlassianOAuthGrantId, mn as PairingCode, on as CsrfToken$1, p as DurableAgentProviderId, pt as AtlassianOAuthSite, r as AgentModelId, sn as CurrentSession, vn as SessionMutationAuth, w as PullRequestReviewCompleted, wn as InvalidRequestApiError, wt as CreatePluginConnectionValue, xn as CorrelationId } from "./agent-xQhAQXly.js";
 import { a as PluginPipelineLogPageRequestV1, c as PluginDiscoveryV1, n as PluginPipelineArtifactRangeRequestV1, o as PluginPipelineLogPageV1, r as PluginPipelineArtifactRangeV1 } from "./plugins-DiPrfzV8.js";
-import { F as DiffFileAnchor, b as SafeMediaContentType, c as workspaceSettingsEtag, r as WorkspacePresentationReadModel, s as WorkspaceSettingsRevision, t as ControlCenterApi } from "./controlCenterApi-5j3gOXgE.js";
+import { F as DiffFileAnchor, b as SafeMediaContentType, c as workspaceSettingsEtag, r as WorkspacePresentationReadModel, s as WorkspaceSettingsRevision, t as ControlCenterApi } from "./controlCenterApi-DNXK7MT1.js";
 import { r as firstPartyServiceIdentityByProvider } from "./firstPartyServices-Cdzjcs2H.js";
-import { $ as negotiatePluginDescriptorV1, A as PullRequestReviews, An as ReviewSuggestionPublicationDigest, Ar as RecordAlreadyExistsError, B as persistenceLayerFromDatabase, Br as BackupIntegrityError, C as CodePipelineReads, Ct as ProjectionRow, D as MediaReads, Dr as PersistenceOperationError, E as LiveEvents, Er as PersistenceConfigError, Et as AgentJobRepository, F as TimelineReads, Fn as SecretRef, Fr as SourceIdentityMismatchError, Ft as AgentAttemptSequence, G as authorizeWorkspaceSettingsGovernanceRequest, H as ReviewCommandArtifactMetadata, Hr as BackupManifestError, I as WorkspaceSettingsAdministration, In as makePersistedRowQuarantine, Jn as ProviderAccountDisplayName, K as governedHumanMutationPolicyAllows, Kn as PluginConnectionDisplayName, Kr as BlobDigest, L as PluginConnection, Ln as QuarantineRepository, Lt as AgentEventCursor, M as ReleaseAgentJobs, N as ReleaseAgentTurns, Nr as RevisionConflictError, O as PluginAdministration, P as TimelineExportAudits, Pn as blobPath, Q as hasPluginCapability, Qt as AgentThreadEventPageSize, R as Persistence, Rn as ContentBlobDigest, Rt as AgentJobInputError, S as AuthorizedShares, St as EvidenceRow, T as DeliveryGraphInspection, Tr as PersistedRecordError, U as ReviewCommandArtifactRepository, Un as FollowedResourceDisplayName, Ur as BackupSqlError, Ut as AgentLeaseOwner, V as ReviewCommandArtifactHandle, Vr as BackupLimitError, W as WorkspaceSettingsRepository, Wr as BackupStorageError, Wt as AgentLeaseToken, Zt as AgentThreadEvent, _ as ApplicationConflict, _n as MAXIMUM_REVIEW_BUDGET_MILLIS, _r as validateCurrentSchema, _t as makeGovernedActionEnvelope, ar as VendorAccountId, at as makeGovernedActionTransactionWrite, b as ApplicationResourceNotFound, bt as makeDeliveryGraphDecoders, c as RawConfluenceAttachmentPage, ct as canonicalizeGovernedActionJson, d as RawConfluencePage, dr as mapPersistenceOperation, dt as digestGovernedActionPayload, et as PluginPageId, f as RawConfluenceSpacePage, fr as readChanges, ft as digestGovernedActionPolicyDefinition, g as RawConfluenceWatcherPage, gr as CURRENT_SCHEMA_VERSION, gt as encodeGovernedActionUnknownOutcome, h as RawConfluenceVersionPage, ht as encodeGovernedActionDispatchOutcome, i as DomainEventWakeups, it as StoredPluginConfigurationKey, j as RelationshipRepairProposals, jr as RecordNotFoundError, k as PortfolioSnapshots, kn as ReviewSuggestionPublicationCommentLocator, l as RawConfluenceCurrentUser, lt as digestCanonicalGovernedActionJson, m as RawConfluenceVersion, mr as databaseLayer, mt as digestGovernedActionTransitionCommand, n as reconcileRelationshipInferencePolicy, nr as RecordRevision, nt as PluginStreamKey, o as supportsFirstPartySynchronization, or as VendorResourceId, ot as makeGovernedActionTransaction, p as RawConfluenceUsers, pr as Database, pt as digestGovernedActionPolicyEvaluation, r as appendPortfolioInvalidation, rt as StoredPluginConfiguration, s as ConfluencePageAttributesV1, st as GovernedActionDigestError, tt as PluginRecordKey, u as RawConfluenceDraftPage, ur as BlobClassification, ut as digestGovernedActionEvidenceSet, v as ApplicationInvalidRequest, vn as PrReviewThreadContextSnapshot, vt as verifyGovernedActionEnvelope, w as CompleteDiffReads, wt as decodeRows$1, x as ApplicationServiceUnavailable, xr as decodePersistenceConfig, xt as ClaimRow, y as ApplicationRateLimited, yn as PrReviewThreadSubject, yt as GovernedActionCommitInput, zr as BackupInputError, zt as AgentJobPrompt } from "./relationshipInferenceMaterialization-CR6xyMNL.js";
+import { $ as negotiatePluginDescriptorV1, A as PullRequestReviews, An as ReviewSuggestionPublicationDigest, Ar as RecordAlreadyExistsError, B as persistenceLayerFromDatabase, Br as BackupIntegrityError, C as CodePipelineReads, Ct as ProjectionRow, D as MediaReads, Dr as PersistenceOperationError, E as LiveEvents, Er as PersistenceConfigError, Et as AgentJobRepository, F as TimelineReads, Fn as SecretRef, Fr as SourceIdentityMismatchError, Ft as AgentAttemptSequence, G as authorizeWorkspaceSettingsGovernanceRequest, H as ReviewCommandArtifactMetadata, Hr as BackupManifestError, I as WorkspaceSettingsAdministration, In as makePersistedRowQuarantine, Jn as ProviderAccountDisplayName, K as governedHumanMutationPolicyAllows, Kn as PluginConnectionDisplayName, Kr as BlobDigest, L as PluginConnection, Ln as QuarantineRepository, Lt as AgentEventCursor, M as ReleaseAgentJobs, N as ReleaseAgentTurns, Nr as RevisionConflictError, O as PluginAdministration, P as TimelineExportAudits, Pn as blobPath, Q as hasPluginCapability, Qt as AgentThreadEventPageSize, R as Persistence, Rn as ContentBlobDigest, Rt as AgentJobInputError, S as AuthorizedShares, St as EvidenceRow, T as DeliveryGraphInspection, Tr as PersistedRecordError, U as ReviewCommandArtifactRepository, Un as FollowedResourceDisplayName, Ur as BackupSqlError, Ut as AgentLeaseOwner, V as ReviewCommandArtifactHandle, Vr as BackupLimitError, W as WorkspaceSettingsRepository, Wr as BackupStorageError, Wt as AgentLeaseToken, Zt as AgentThreadEvent, _ as ApplicationConflict, _n as MAXIMUM_REVIEW_BUDGET_MILLIS, _r as validateCurrentSchema, _t as makeGovernedActionEnvelope, ar as VendorAccountId, at as makeGovernedActionTransactionWrite, b as ApplicationResourceNotFound, bt as makeDeliveryGraphDecoders, c as RawConfluenceAttachmentPage, ct as canonicalizeGovernedActionJson, d as RawConfluencePage, dr as mapPersistenceOperation, dt as digestGovernedActionPayload, et as PluginPageId, f as RawConfluenceSpacePage, fr as readChanges, ft as digestGovernedActionPolicyDefinition, g as RawConfluenceWatcherPage, gr as CURRENT_SCHEMA_VERSION, gt as encodeGovernedActionUnknownOutcome, h as RawConfluenceVersionPage, ht as encodeGovernedActionDispatchOutcome, i as DomainEventWakeups, it as StoredPluginConfigurationKey, j as RelationshipRepairProposals, jr as RecordNotFoundError, k as PortfolioSnapshots, kn as ReviewSuggestionPublicationCommentLocator, l as RawConfluenceCurrentUser, lt as digestCanonicalGovernedActionJson, m as RawConfluenceVersion, mr as databaseLayer, mt as digestGovernedActionTransitionCommand, n as reconcileRelationshipInferencePolicy, nr as RecordRevision, nt as PluginStreamKey, o as supportsFirstPartySynchronization, or as VendorResourceId, ot as makeGovernedActionTransaction, p as RawConfluenceUsers, pr as Database, pt as digestGovernedActionPolicyEvaluation, r as appendPortfolioInvalidation, rt as StoredPluginConfiguration, s as ConfluencePageAttributesV1, st as GovernedActionDigestError, tt as PluginRecordKey, u as RawConfluenceDraftPage, ur as BlobClassification, ut as digestGovernedActionEvidenceSet, v as ApplicationInvalidRequest, vn as PrReviewThreadContextSnapshot, vt as verifyGovernedActionEnvelope, w as CompleteDiffReads, wt as decodeRows$1, x as ApplicationServiceUnavailable, xr as decodePersistenceConfig, xt as ClaimRow, y as ApplicationRateLimited, yn as PrReviewThreadSubject, yt as GovernedActionCommitInput, zr as BackupInputError, zt as AgentJobPrompt } from "./relationshipInferenceMaterialization-Dyix96px.js";
 import { a as PluginConflictFailure, c as PluginRateLimitFailure, d as PluginUnsupportedCapabilityFailure, f as pluginFailureClass, i as PluginConfigurationFailure, l as PluginTimeoutFailure, n as PluginAuthorizationFailure, o as PluginMalformedResponseFailure, s as PluginOutageFailure, t as PluginAuthenticationFailure, u as PluginUnknownOutcomeFailure } from "./failures-CesHLYbN.js";
 import { t as decodeCodePipelineStateProviderOutput } from "./CodePipelineStateDecoder-CNiFRgSi.js";
 import { AgentContextFingerprint, AgentContextMismatchError, AgentProviderError, AgentProviderId, AgentRunId, AgentRuntimeEvent, AgentRuntimeMetadata, AgentRuntimeMetadataError, AgentRuntimeProtocolError, AgentSessionRef, MAXIMUM_AGENT_OUTPUT_TEXT_LENGTH, MAXIMUM_MODEL_VISIBLE_TOOL_RESULT_BYTES, attachAgentRuntimeMetadata, makeAgentRuntime, makeToolAgentAdapter, readLocalCliRuntimeMetadata, runToolAgent } from "@knpkv/ai-runtime";
@@ -2937,6 +2937,8 @@ Schema.Class("PRComment")({
 	filePath: Schema.optional(Schema.String),
 	lineNumber: Schema.optional(Schema.Number)
 });
+/** Provider-relative side of a pull-request file position. */
+var RelativeFileVersion = Schema.Literals(["BEFORE", "AFTER"]);
 var PRCommentJson = Schema.Struct({
 	id: Schema.String,
 	content: Schema.String,
@@ -2955,6 +2957,7 @@ Schema.Struct({
 	filePath: Schema.optional(Schema.String),
 	beforeCommitId: Schema.optional(Schema.String),
 	afterCommitId: Schema.optional(Schema.String),
+	relativeFileVersion: Schema.optional(RelativeFileVersion),
 	comments: Schema.Array(CommentThreadJson)
 });
 var PersistentNotificationType = Schema.Literals([
@@ -3691,7 +3694,7 @@ var CodeCommitReviewTarget = Schema.Struct({
 var CodeCommitReviewLocation = class extends Schema.Class("CodeCommitReviewLocation")({
 	filePath: ReviewFilePath,
 	filePosition: ReviewFilePosition,
-	relativeFileVersion: Schema.Literals(["BEFORE", "AFTER"])
+	relativeFileVersion: RelativeFileVersion
 }) {};
 var CommentActionFields = {
 	target: CodeCommitReviewTarget,
@@ -12725,6 +12728,7 @@ var makeConfluencePageClient = (api) => ({
 		status: ["current"]
 	}))).pipe(Effect$1.flatMap(HttpClientResponse.filterStatusOk), Effect$1.flatMap(HttpClientResponse.schemaBodyJson(RawConfluencePage)))),
 	getPageDraft: (pageId) => bounded("confluence-page-draft-read", api.v2.httpClient.execute(HttpClientRequest.get(`/pages/${encodeURIComponent(pageId)}`).pipe(HttpClientRequest.setUrlParams({
+		"body-format": "atlas_doc_format",
 		"get-draft": true,
 		status: ["draft"]
 	}))).pipe(Effect$1.flatMap(HttpClientResponse.filterStatusOk), Effect$1.flatMap(HttpClientResponse.schemaBodyJson(RawConfluenceDraftPage)))),
@@ -12948,6 +12952,15 @@ var reconciliationKey = (payload) => PluginActionReconciliationKey.make(Schema$1
 	":",
 	payload.targetVersion
 ]));
+var confirmedRejectedUpdate = (payload, observedAt) => ({
+	_tag: "confirmed",
+	receipt: {
+		status: "failed",
+		providerOperationId: PluginProviderOperationId.make(`rejected:${payload.pageId}:v${payload.targetVersion}`),
+		safeSummary: "Confluence rejected the authorized page publication without applying it",
+		observedAt
+	}
+});
 var decodeReconciliationKey = (key) => {
 	return Schema$1.decodeUnknownEffect(ReconciliationLocator)(key).pipe(Effect$1.map(([, pageId, , targetVersion]) => ({
 		pageId,
@@ -12967,15 +12980,15 @@ var readExactVersion = Effect$1.fn("ConfluenceGovernedActions.readExactVersion")
 		version
 	};
 });
-var hasVisibleDraft = Effect$1.fn("ConfluenceGovernedActions.hasVisibleDraft")(function* (client, pageId, spaceId) {
-	const result = yield* client.getPageDraft(pageId).pipe(Effect$1.result);
+var hasDivergentDraft = Effect$1.fn("ConfluenceGovernedActions.hasDivergentDraft")(function* (client, page) {
+	const result = yield* client.getPageDraft(page.id).pipe(Effect$1.result);
 	if (Result$1.isFailure(result)) {
 		if (result.failure.reason === "not-found") return false;
 		return yield* clientFailure(result.failure).pipe(Effect$1.flatMap(Effect$1.fail));
 	}
 	const draft = yield* Schema$1.decodeUnknownEffect(RawConfluenceDraftPage)(result.success).pipe(Effect$1.mapError(() => malformed$2("confluence-page-draft-read", "confluence-page-draft-invalid")));
-	if (draft.id !== pageId || draft.spaceId !== spaceId) return yield* malformed$2("confluence-page-draft-read", "confluence-page-draft-scope-mismatch");
-	return true;
+	if (draft.id !== page.id || draft.spaceId !== page.spaceId) return yield* malformed$2("confluence-page-draft-read", "confluence-page-draft-scope-mismatch");
+	return draft.parentId === void 0 || page.parentId === void 0 || draft.ownerId === void 0 || page.ownerId === void 0 || draft.parentId !== page.parentId || draft.ownerId !== page.ownerId || draft.title !== page.title || draft.body.atlas_doc_format.value !== page.body?.atlas_doc_format?.value;
 });
 /** Build the governed Confluence proposal and executor surfaces. @internal */
 var makeConfluenceGovernedActions = (input) => {
@@ -13164,7 +13177,7 @@ var makeConfluenceGovernedActions = (input) => {
 					reasons: ["Confluence page revision changed after authorization"],
 					checkedAt
 				});
-				if (yield* hasVisibleDraft(input.client, payload.pageId, input.spaceId)) return yield* output("preflight", PluginActionPreflightV1, {
+				if (yield* hasDivergentDraft(input.client, page)) return yield* output("preflight", PluginActionPreflightV1, {
 					_tag: "blocked",
 					reasons: ["Confluence page has an unpublished draft that this publication could overwrite"],
 					checkedAt
@@ -13180,7 +13193,13 @@ var makeConfluenceGovernedActions = (input) => {
 				const payload = yield* decodeAuthorizedAction(request, input.spaceId).pipe(Effect$1.provideService(Crypto$1.Crypto, input.cryptoService));
 				const locator = reconciliationKey(payload);
 				const marker = versionMarker(request.idempotencyKey, request.payloadDigest, payload.versionMessage);
-				if (yield* hasVisibleDraft(input.client, payload.pageId, input.spaceId)) return yield* new PluginConflictFailure({
+				const currentResult = yield* input.client.getPage(payload.pageId).pipe(Effect$1.result);
+				if (Result$1.isFailure(currentResult)) {
+					if (currentResult.failure.reason === "not-found") return confirmedRejectedUpdate(payload, yield* DateTime$1.now);
+					return yield* clientFailure(currentResult.failure).pipe(Effect$1.flatMap(Effect$1.fail));
+				}
+				const currentPage = yield* decodePage("confluence-execute-page", currentResult.success, payload.pageId, input.spaceId);
+				if (yield* hasDivergentDraft(input.client, currentPage)) return yield* new PluginConflictFailure({
 					operation: "execute-authorized-action",
 					diagnosticCode: "confluence-page-draft-present"
 				});
@@ -13197,15 +13216,7 @@ var makeConfluenceGovernedActions = (input) => {
 						reconciliationKey: locator
 					});
 					if (result.failure.reason !== "not-found" && result.failure.reason !== "invalid-request") return yield* clientFailure(result.failure).pipe(Effect$1.flatMap(Effect$1.fail));
-					return {
-						_tag: "confirmed",
-						receipt: {
-							status: "failed",
-							providerOperationId: PluginProviderOperationId.make(`rejected:${payload.pageId}:v${payload.targetVersion}`),
-							safeSummary: "Confluence rejected the authorized page publication without applying it",
-							observedAt
-						}
-					};
+					return confirmedRejectedUpdate(payload, observedAt);
 				}
 				const page = yield* decodePage("confluence-page-update", result.success, payload.pageId, input.spaceId).pipe(Effect$1.catchTag("PluginMalformedResponseFailure", () => Effect$1.fail(new PluginUnknownOutcomeFailure({
 					operation: "execute-authorized-action",
@@ -13721,6 +13732,8 @@ var fitSyncAttributes = (attributes) => {
 	const attachments = [...attributes.attachments];
 	let compacted = {
 		...attributes,
+		content: null,
+		contentState: "lazy",
 		versions,
 		contributors,
 		attachments,
@@ -13915,6 +13928,9 @@ var normalizeSyncEvents = Effect$1.fn("ConfluencePage.normalizeSyncEvents")(func
 	return (yield* Effect$1.forEach(contexts, Effect$1.fn("ConfluencePage.normalizeSyncPage")(function* (context) {
 		const { history, inventory, page, versions, watchers } = context;
 		const contributors = contributorsFromUsers(rolesByPage.get(page.id) ?? /* @__PURE__ */ new Map(), users);
+		const adf = page.body?.atlas_doc_format?.value;
+		const converted = adf === void 0 ? null : yield* toSafeConfluenceMarkdown(input.converter, adf);
+		const markdown = converted === null || converted.trim().length === 0 ? null : converted;
 		const attributes = yield* decodeProvider("confluence-sync", "confluence-sync-page-attributes-invalid", ConfluencePageAttributesV1, fitSyncAttributes({
 			schemaVersion: 1,
 			status: page.status,
@@ -13923,8 +13939,11 @@ var normalizeSyncEvents = Effect$1.fn("ConfluencePage.normalizeSyncEvents")(func
 			createdAt: page.createdAt,
 			updatedAt: page.version.createdAt,
 			currentVersion: page.version.number,
-			content: null,
-			contentState: "lazy",
+			content: markdown === null ? null : {
+				representation: "safe-markdown",
+				markdown
+			},
+			contentState: markdown === null ? "lazy" : "loaded",
 			versions: versions.map((version) => ({
 				number: version.number,
 				createdAt: version.createdAt,
@@ -14079,6 +14098,7 @@ var sourceUrl = (siteBaseUrl, webui) => {
 	const candidate = Result$1.try(() => new URL(webui, siteBaseUrl));
 	if (Result$1.isFailure(candidate) || candidate.success.origin !== siteBaseUrl.origin) return null;
 	if (candidate.success.username.length > 0 || candidate.success.password.length > 0) return null;
+	if (candidate.success.pathname.startsWith("/spaces/")) candidate.success.pathname = `/wiki${candidate.success.pathname}`;
 	return candidate.success.toString();
 };
 var readPageEntity = Effect$1.fn("ConfluencePage.readEntity")(function* (input, pageId) {
@@ -17642,7 +17662,7 @@ var makePluginAdministrationWithConnections = Effect$1.fn("PluginAdministration.
 	const fileSystem = yield* FileSystem$1.FileSystem;
 	const path = yield* Path$1.Path;
 	const awsResourceDiscovery = yield* Effect$1.contextWith((context) => Effect$1.succeed(Context$1.getOption(context, AwsResourceDiscovery)));
-	const manualSynchronization = pluginConnections === null ? null : yield* Effect$1.flatMap(Effect$1.promise(() => import("./manualPluginSynchronization-CzIhZ_Dw.js")), ({ makeManualPluginSynchronization }) => makeManualPluginSynchronization(pluginConnections));
+	const manualSynchronization = pluginConnections === null ? null : yield* Effect$1.flatMap(Effect$1.promise(() => import("./manualPluginSynchronization-DFIeUHP9.js")), ({ makeManualPluginSynchronization }) => makeManualPluginSynchronization(pluginConnections));
 	const patchProviderAccount = Effect$1.fn("PluginAdministration.patchProviderAccount")(function* (workspaceId, providerAccountId, patch) {
 		const displayName = yield* Schema$1.decodeUnknownEffect(ProviderAccountDisplayName)(patch.displayName).pipe(Effect$1.mapError(() => new ApplicationInvalidRequest()));
 		const current = yield* persistence.providerAccounts.get(workspaceId, providerAccountId).pipe(Effect$1.mapError(mapPersistenceReadError));
@@ -17904,6 +17924,103 @@ var pluginAdministrationOAuthLayerWithConnections = (pluginConnections, publicOr
 var listPluginConnectionSummaries = listPluginConnections;
 /** Secret-free fixed catalog projection consumed by the authenticated overview handler. */
 var listFirstPartyServiceMetadata = () => firstPartyServiceCatalog.map(({ metadata }) => metadata);
+Schema$1.Struct({
+	checked: Schema$1.Boolean,
+	label: Schema$1.String,
+	lineIndex: Schema$1.Int.check(Schema$1.isGreaterThanOrEqualTo(0)),
+	lineNumber: Schema$1.Int.check(Schema$1.isGreaterThan(0))
+});
+var taskLine = /^(?:\s*(?:(?:[-*+]|\d+\.)\s+)?)(?:\[( |x|X)?\]|\\\[( |x|X)?\\\])\s+(.+?)\s*$/u;
+var openingFenceLine = /^\s*(`{3,}|~{3,})/u;
+var closingFenceLine = /^\s*(`{3,}|~{3,})\s*$/u;
+/** Read task-list checkboxes while ignoring examples inside fenced code blocks. */
+var confluenceTasks = (markdown) => {
+	const tasks = [];
+	let fence = null;
+	for (const [lineIndex, line] of markdown.split("\n").entries()) {
+		const fenceMatch = (fence === null ? openingFenceLine : closingFenceLine).exec(line);
+		if (fenceMatch?.[1] !== void 0) {
+			const marker = fenceMatch[1];
+			const character = marker[0];
+			if (character === "`" || character === "~") {
+				if (fence === null) fence = {
+					character,
+					length: marker.length
+				};
+				else if (fence.character === character && marker.length >= fence.length) fence = null;
+			}
+			continue;
+		}
+		if (fence !== null) continue;
+		const match = taskLine.exec(line);
+		if (match?.[3] === void 0) continue;
+		const marker = match[1] ?? match[2];
+		tasks.push({
+			checked: marker?.toLocaleLowerCase("en-US") === "x",
+			label: match[3],
+			lineIndex,
+			lineNumber: lineIndex + 1
+		});
+	}
+	return tasks;
+};
+/** Summarize task completion for UI counts and release gates. */
+var confluenceTaskSummary = (markdown) => {
+	const tasks = confluenceTasks(markdown);
+	const completed = tasks.filter(({ checked }) => checked).length;
+	return {
+		completed,
+		outstanding: tasks.length - completed,
+		tasks,
+		total: tasks.length
+	};
+};
+//#endregion
+//#region src/domain/releasePipelineApproval.ts
+var currentRelationship$1 = (lifecycle) => lifecycle._tag !== "missing" && lifecycle._tag !== "rejected" && lifecycle._tag !== "superseded";
+var approvalName = (value) => /(?:^|[\s_-])(?:approval|approve)(?:$|[\s_-])/iu.test(value) || /release[\s_-]*gate/iu.test(value);
+/** Prove that every pipeline delivering a release PR is stopped at its observed manual approval gate. */
+var releasePipelineApprovalReadiness = (inspection) => {
+	const nodeById = new Map(inspection.nodes.map((node) => [node.nodeId, node]));
+	const projectionByEntityId = new Map(inspection.entityProjections.map(({ projection }) => [projection.entityId, projection]));
+	const affectedPipelineIds = new Set(inspection.relationships.flatMap((relationship) => {
+		if (relationship.kind !== "delivered-by" || relationship.sourceNodeKind !== "pull-request" || relationship.targetNodeKind !== "pipeline-execution" || !currentRelationship$1(relationship.lifecycle)) return [];
+		const source = nodeById.get(relationship.sourceNodeId);
+		const target = nodeById.get(relationship.targetNodeId);
+		return source?.resolution._tag === "resolved" && source.resolution.target._tag === "entity" && target?.resolution._tag === "resolved" && target.resolution.target._tag === "entity" ? [target.resolution.target.entityId] : [];
+	}));
+	let unverifiablePipelines = 0;
+	const gates = [];
+	for (const entityId of affectedPipelineIds) {
+		const projection = projectionByEntityId.get(entityId);
+		const details = projection?.details;
+		if (projection?.entityState !== "present" || projection.entityType !== "pipeline-execution" || details?._tag !== "pipeline-execution") {
+			unverifiablePipelines += 1;
+			continue;
+		}
+		const approvalActionStages = new Set((details.actions ?? []).flatMap((action) => action.category?.toLocaleLowerCase("en-US") === "approval" || action.provider?.toLocaleLowerCase("en-US") === "manual" ? [action.stageName] : []));
+		const approvalStages = (details.stages ?? []).filter((stage) => approvalActionStages.has(stage.name) || approvalName(stage.name));
+		const waiting = approvalStages.some((stage) => {
+			if (stage.status !== "running") return false;
+			const explicitActions = (details.actions ?? []).filter((action) => action.stageName === stage.name && (action.category?.toLocaleLowerCase("en-US") === "approval" || action.provider?.toLocaleLowerCase("en-US") === "manual"));
+			return explicitActions.length === 0 || explicitActions.some(({ status }) => status === "running");
+		});
+		gates.push({
+			entityId,
+			pipelineName: details.pipelineName,
+			state: approvalStages.length === 0 ? "missing" : waiting ? "waiting" : "not-waiting"
+		});
+	}
+	return {
+		affected: affectedPipelineIds.size,
+		gates,
+		missing: gates.filter(({ state }) => state === "missing").length,
+		notWaiting: gates.filter(({ state }) => state === "not-waiting").length,
+		ready: !inspection.truncated && unverifiablePipelines === 0 && gates.every(({ state }) => state === "waiting"),
+		unverifiablePipelines,
+		waiting: gates.filter(({ state }) => state === "waiting").length
+	};
+};
 //#endregion
 //#region src/domain/releasePublication.ts
 /** Canonical owner-visible title shared by explicit and natural-language publication paths. */
@@ -17980,6 +18097,47 @@ var digestReleaseSourceRevisions = Effect$1.fn("ReleasePublicationMetadata.diges
 	const digest = yield* digestCanonicalGovernedActionJson(yield* Schema$1.decodeUnknownEffect(Schema$1.Json)(stableRevisions));
 	return GovernedActionEnvelopeDigest.make(`sha256:${digest}`);
 });
+var relationshipIsCurrent = (relationship) => relationship.lifecycle._tag !== "missing" && relationship.lifecycle._tag !== "rejected" && relationship.lifecycle._tag !== "superseded";
+/** Resolve only pages directly documenting the inspected release. */
+var releaseRunbookEntityIds = (inspection) => {
+	const nodes = new Map(inspection.nodes.map((node) => [node.nodeId, node]));
+	return Array.from(new Set(inspection.relationships.flatMap((relationship) => {
+		if (relationship.kind !== "documented-by" || relationship.sourceNodeKind !== "release" || relationship.targetNodeKind !== "page" || !relationshipIsCurrent(relationship)) return [];
+		const source = nodes.get(relationship.sourceNodeId);
+		const target = nodes.get(relationship.targetNodeId);
+		return source?.resolution._tag === "resolved" && source.resolution.target._tag === "release" && source.resolution.target.releaseId === inspection.releaseId && target?.resolution._tag === "resolved" && target.resolution.target._tag === "entity" ? [target.resolution.target.entityId] : [];
+	})));
+};
+/** Hydrate exact safe page content only for release runbooks whose tasks govern readiness. */
+var hydrateReleaseRunbookContent = Effect$1.fn("ReleaseRunbookHydration.hydrate")(function* (persistence, workspaceId, inspection) {
+	const presentEntityIds = new Set(inspection.entityProjections.flatMap(({ projection }) => projection.entityState === "present" ? [projection.entityId] : []));
+	const candidates = releaseRunbookEntityIds(inspection).filter((entityId) => presentEntityIds.has(entityId));
+	const exactPages = new Array();
+	let hydratedCharacters = 0;
+	let hydrationTruncated = candidates.length > 16;
+	for (const entityId of candidates.slice(0, 16)) {
+		const page = yield* persistence.deliveryGraph.read(workspaceId, {
+			_tag: "entityProjection",
+			entityId,
+			revision: null
+		}).pipe(Effect$1.flatMap((result) => result._tag === "entityProjection" ? Effect$1.succeed(result.value) : Effect$1.die("Expected an exact entity projection for release runbook")), Effect$1.catchTag("RecordNotFoundError", () => Effect$1.succeed(null)));
+		if (page === null) continue;
+		const pageCharacters = page.projection.details._tag === "page" ? page.projection.details.content?.markdown.length ?? 0 : 0;
+		if (hydratedCharacters + pageCharacters > 1048576) {
+			hydrationTruncated = true;
+			break;
+		}
+		hydratedCharacters += pageCharacters;
+		exactPages.push(page);
+	}
+	if (exactPages.length === 0 && !hydrationTruncated) return inspection;
+	const exactByEntityId = new Map(exactPages.map((page) => [page.projection.entityId, page]));
+	return {
+		...inspection,
+		truncated: inspection.truncated || hydrationTruncated,
+		entityProjections: inspection.entityProjections.map((summary) => exactByEntityId.get(summary.projection.entityId) ?? summary)
+	};
+});
 //#endregion
 //#region src/server/application/releasePublicationSubmissions.ts
 /** Human-confirmed, append-only release publication boundary for Relay. @module */
@@ -17990,6 +18148,14 @@ var ReleasePublicationSubmissionError = class extends Schema$1.TaggedErrorClass(
 	"invalid-request",
 	"unavailable"
 ]) }) {};
+/** Bind an explicitly selected related page, continuing its chain only when the latest receipt is for that page. */
+var confluenceEntityPublicationContext = (history, target) => {
+	return {
+		historyMatches: true,
+		predecessorPublicationActionId: history.latestReference?.pageId === target.pageId ? history.latestReference.publicationActionId : null,
+		publication: target
+	};
+};
 /** Require creates to have no history and updates to match the exact latest durable receipt. */
 var confluencePublicationRequestMatchesHistory = (request, history) => {
 	return request.publicationActionId === void 0 ? !history.hasBlockingPublication : history.latestReference?.publicationActionId === request.publicationActionId;
@@ -18026,8 +18192,50 @@ var loadConfluenceReleasePublicationByActionId = Effect$1.fn("ReleasePublication
 });
 var ReleasePublicationSubmissions = class extends Context$1.Service()("@knpkv/control-center/server/application/ReleasePublicationSubmissions") {};
 var failure = (reason) => new ReleasePublicationSubmissionError({ reason });
+var ConfluencePageVersionFromRevision = Schema$1.FiniteFromString.check(Schema$1.isInt(), Schema$1.isBetween({
+	minimum: 1,
+	maximum: 2147483646
+}));
+/** Require the provider revision reviewed by the owner to remain current at submission time. */
+var confluenceTargetRevisionMatches = (currentRevision, requestedRevision) => currentRevision === requestedRevision;
 /** Match Jira's release-version name and UTF-8 description limits before provider work. */
 var jiraPublicationPayloadWithinLimits = (title, markdown) => title.length <= 255 && jiraReleaseVersionDescriptionWithinLimit(markdown);
+var currentRelationship = (lifecycle) => lifecycle._tag !== "missing" && lifecycle._tag !== "rejected" && lifecycle._tag !== "superseded";
+/** Prove every task on a directly release-related Confluence page is complete. */
+var releaseConfluenceTaskReadiness = (inspection) => {
+	const nodeById = new Map(inspection.nodes.map((node) => [node.nodeId, node]));
+	const projectionByEntityId = new Map(inspection.entityProjections.map(({ projection }) => [projection.entityId, projection]));
+	const releasePageIds = new Set(inspection.relationships.flatMap((relationship) => {
+		if (relationship.kind !== "documented-by" || relationship.sourceNodeKind !== "release" || relationship.targetNodeKind !== "page" || !currentRelationship(relationship.lifecycle)) return [];
+		const source = nodeById.get(relationship.sourceNodeId);
+		const target = nodeById.get(relationship.targetNodeId);
+		return source?.resolution._tag === "resolved" && source.resolution.target._tag === "release" && source.resolution.target.releaseId === inspection.releaseId && target?.resolution._tag === "resolved" && target.resolution.target._tag === "entity" ? [target.resolution.target.entityId] : [];
+	}));
+	let completed = 0;
+	let outstanding = 0;
+	let unverifiablePages = 0;
+	for (const entityId of releasePageIds) {
+		const projection = projectionByEntityId.get(entityId);
+		if (projection?.entityState !== "present" || projection.entityType !== "page" || projection.details._tag !== "page") {
+			unverifiablePages += 1;
+			continue;
+		}
+		if (projection.details.contentState !== "loaded") {
+			unverifiablePages += 1;
+			continue;
+		}
+		const summary = confluenceTaskSummary(projection.details.content?.markdown ?? "");
+		completed += summary.completed;
+		outstanding += summary.outstanding;
+	}
+	return {
+		completed,
+		outstanding,
+		ready: !inspection.truncated && unverifiablePages === 0 && outstanding === 0,
+		total: completed + outstanding,
+		unverifiablePages
+	};
+};
 var mapFailure$1 = Effect$1.catch((cause) => Schema$1.is(ReleasePublicationSubmissionError)(cause) ? Effect$1.fail(cause) : Effect$1.logError("Release publication submission failed", cause).pipe(Effect$1.andThen(Effect$1.fail(failure("unavailable")))));
 var makeService = Effect$1.gen(function* () {
 	const cryptoService = yield* Crypto$1.Crypto;
@@ -18036,30 +18244,86 @@ var makeService = Effect$1.gen(function* () {
 	const proposalAuthority = yield* GovernedActionProposalAuthority;
 	const policies = yield* GovernedActionPolicyBindingSource;
 	const submission = yield* GovernedActionSubmission;
+	const loadConfluenceEntityPublicationTarget = Effect$1.fn("ReleasePublicationSubmissions.loadConfluenceEntityPublicationTarget")(function* (workspaceId, releaseId, entityId, targetRevision) {
+		const entity = yield* persistence.entities.get(workspaceId, entityId).pipe(mapFailure$1);
+		const graph = yield* persistence.deliveryGraph.read(workspaceId, {
+			_tag: "entitySlice",
+			entityId,
+			limit: 1
+		}).pipe(mapFailure$1);
+		if (graph._tag !== "entitySlice" || !graph.value.entity.releaseIds.includes(releaseId) || graph.value.entity.projection.entityType !== "page" || graph.value.entity.projection.details._tag !== "page" || entity.sourceRevision.providerId !== "confluence" || !confluenceTargetRevisionMatches(entity.sourceRevision.revision, targetRevision)) return yield* failure("conflict");
+		const pageVersion = yield* Schema$1.decodeUnknownEffect(ConfluencePageVersionFromRevision)(entity.sourceRevision.revision).pipe(Effect$1.mapError(() => failure("invalid-request")));
+		return {
+			pageId: entity.sourceRevision.vendorImmutableId,
+			pageVersion,
+			pluginConnectionId: entity.sourceRevision.pluginConnectionId
+		};
+	});
+	const loadConfluenceTemplatePublicationSource = Effect$1.fn("ReleasePublicationSubmissions.loadConfluenceTemplatePublicationSource")(function* (workspaceId, entityId) {
+		const entity = yield* persistence.entities.get(workspaceId, entityId).pipe(mapFailure$1);
+		const graph = yield* persistence.deliveryGraph.read(workspaceId, {
+			_tag: "entitySlice",
+			entityId,
+			limit: 1
+		}).pipe(mapFailure$1);
+		if (graph._tag !== "entitySlice" || graph.value.entity.projection.entityType !== "page" || graph.value.entity.projection.details._tag !== "page" || entity.sourceRevision.providerId !== "confluence") return yield* failure("conflict");
+		return { pluginConnectionId: entity.sourceRevision.pluginConnectionId };
+	});
 	const submit = Effect$1.fn("ReleasePublicationSubmissions.submit")(function* (input) {
 		const checkedAt = yield* DateTime$1.now;
 		if (input.session.actor._tag !== "human" || input.session.workspaceId !== input.workspaceId || input.session.revokedAt !== null || DateTime$1.Order(checkedAt, input.session.idleExpiresAt) >= 0 || DateTime$1.Order(checkedAt, input.session.absoluteExpiresAt) >= 0) return yield* failure("unauthorized");
 		if (input.session.permission !== "workspace-owner") return yield* failure("forbidden");
-		if (input.request.provider !== "confluence" && input.request.publicationActionId !== void 0) return yield* failure("conflict");
+		if (input.request.provider !== "confluence" && (input.request.publicationActionId !== void 0 || input.request.targetEntityId !== void 0 || input.request.targetRevision !== void 0 || input.request.templateEntityId !== void 0)) return yield* failure("conflict");
+		if ([
+			input.request.publicationActionId,
+			input.request.targetEntityId,
+			input.request.templateEntityId
+		].filter((value) => value !== void 0).length > 1) return yield* failure("conflict");
+		if (input.request.targetEntityId === void 0 !== (input.request.targetRevision === void 0)) return yield* failure("invalid-request");
 		const release = yield* persistence.releases.get(input.workspaceId, input.releaseId).pipe(mapFailure$1);
 		if (input.expectedReleaseUpdatedAt !== void 0 && release.release.updatedAt !== input.expectedReleaseUpdatedAt) return yield* failure("conflict");
 		const publicationTitle = input.useReleaseIdentity === true ? canonicalReleasePublicationTitle(release.release.version) : input.request.title;
 		const publicationMarkdown = input.useReleaseIdentity === true ? `Release ${release.release.version} for ${release.release.serviceName}. Published by Relay after human confirmation.` : input.request.markdown;
 		if (input.request.provider === "jira" && !jiraPublicationPayloadWithinLimits(publicationTitle, publicationMarkdown)) return yield* failure("invalid-request");
+		if (input.request.provider === "jira") {
+			const taskInspection = yield* persistence.deliveryGraph.read(input.workspaceId, {
+				_tag: "releaseSlice",
+				releaseId: input.releaseId,
+				environmentId: null,
+				limit: 500
+			}).pipe(mapFailure$1);
+			if (taskInspection._tag !== "releaseSlice") return yield* failure("conflict");
+			const hydratedTaskInspection = yield* hydrateReleaseRunbookContent(persistence, input.workspaceId, taskInspection.value).pipe(mapFailure$1);
+			if (!releaseConfluenceTaskReadiness(hydratedTaskInspection).ready || !releasePipelineApprovalReadiness(hydratedTaskInspection).ready) return yield* failure("conflict");
+		}
 		const sources = release.release.sourceRevisions.filter(({ providerId }) => providerId === input.request.provider);
 		if (sources.length > 1) return yield* failure("conflict");
 		const releaseSource = sources[0];
 		let publicationReceiptConnectionId;
 		let confluencePublication = null;
 		let confluenceHistoryMatches = true;
+		let predecessorPublicationActionId = input.request.publicationActionId ?? null;
 		if (input.request.provider === "confluence") {
 			const publicationHistory = yield* loadConfluenceReleasePublicationHistory(persistence.governedActions, input.workspaceId, input.releaseId).pipe(mapFailure$1);
-			const requestedReference = input.request.publicationActionId === void 0 ? null : yield* loadConfluenceReleasePublicationByActionId(persistence.governedActions, input.workspaceId, input.releaseId, input.request.publicationActionId).pipe(mapFailure$1);
-			const publicationContext = confluencePublicationRequestContext(input.request, publicationHistory, requestedReference);
-			confluenceHistoryMatches = publicationContext.historyMatches;
-			confluencePublication = publicationContext.publication;
-			if (input.request.publicationActionId !== void 0 && confluencePublication === null) return yield* failure("conflict");
-			publicationReceiptConnectionId = confluencePublication?.pluginConnectionId;
+			if (input.request.templateEntityId !== void 0) {
+				const template = yield* loadConfluenceTemplatePublicationSource(input.workspaceId, input.request.templateEntityId);
+				confluenceHistoryMatches = true;
+				predecessorPublicationActionId = null;
+				publicationReceiptConnectionId = template.pluginConnectionId;
+			} else if (input.request.targetEntityId !== void 0) {
+				if (input.request.targetRevision === void 0) return yield* failure("invalid-request");
+				const publicationContext = confluenceEntityPublicationContext(publicationHistory, yield* loadConfluenceEntityPublicationTarget(input.workspaceId, input.releaseId, input.request.targetEntityId, input.request.targetRevision));
+				confluenceHistoryMatches = publicationContext.historyMatches;
+				confluencePublication = publicationContext.publication;
+				predecessorPublicationActionId = publicationContext.predecessorPublicationActionId;
+			} else {
+				const requestedReference = input.request.publicationActionId === void 0 ? null : yield* loadConfluenceReleasePublicationByActionId(persistence.governedActions, input.workspaceId, input.releaseId, input.request.publicationActionId).pipe(mapFailure$1);
+				const publicationContext = confluencePublicationRequestContext(input.request, publicationHistory, requestedReference);
+				confluenceHistoryMatches = publicationContext.historyMatches;
+				confluencePublication = publicationContext.publication;
+				if (input.request.publicationActionId !== void 0 && confluencePublication === null) return yield* failure("conflict");
+			}
+			publicationReceiptConnectionId ??= confluencePublication?.pluginConnectionId;
 		}
 		const connectionSelection = selectReleasePublicationConnection({
 			enabledConnectionIds: (releaseSource === void 0 && publicationReceiptConnectionId === void 0 ? yield* persistence.pluginConnections.list(input.workspaceId).pipe(mapFailure$1) : []).filter(({ isEnabled, providerId }) => providerId === input.request.provider && isEnabled).map(({ pluginConnectionId }) => pluginConnectionId),
@@ -18123,7 +18387,8 @@ var makeService = Effect$1.gen(function* () {
 			title: publicationTitle,
 			markdown: publicationMarkdown,
 			parentId: input.request.parentId,
-			publicationActionId: input.request.publicationActionId ?? null,
+			publicationActionId: predecessorPublicationActionId,
+			sourceEntityId: input.request.targetEntityId ?? input.request.templateEntityId ?? null,
 			pageId: confluencePublication?.pageId ?? null,
 			expectedVersion: confluencePublication?.pageVersion ?? null,
 			sourceRevisionDigest,
@@ -18191,7 +18456,8 @@ var makeService = Effect$1.gen(function* () {
 			correlationId: null,
 			releasePublication: {
 				releaseId: input.releaseId,
-				predecessorPublicationActionId: input.request.publicationActionId ?? null,
+				predecessorPublicationActionId,
+				...input.request.templateEntityId === void 0 ? {} : { templateSourceEntityId: input.request.templateEntityId },
 				sourceRevisionDigest,
 				sourceRevisionCount: release.release.sourceRevisions.length
 			}
@@ -18480,7 +18746,18 @@ var sessionHandlersLayer = HttpApiBuilder.group(ControlCenterApi, "session", (ha
 		};
 	})).handle("list", ({ request }) => Effect$1.gen(function* () {
 		return yield* mapAuthenticationFailures(auth.listSessions(currentSessionToken(request)));
-	})).handle("revoke", ({ params, request }) => Effect$1.gen(function* () {
+	})).handle("issueBrowserPairingCode", ({ payload, request }) => lifecycle.runMutation(Effect$1.gen(function* () {
+		const session = yield* CurrentSession;
+		const issued = yield* mapAuthenticationFailures(auth.issuePairingCode(currentSessionToken(request), {
+			actor: session.actor,
+			permission: payload.permission
+		}));
+		yield* HttpEffect.appendPreResponseHandler((_request, response) => Effect$1.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store")));
+		return {
+			pairingCode: PairingCode.make(Redacted$1.value(issued.pairingCode)),
+			expiresAt: issued.summary.expiresAt
+		};
+	})).pipe(Effect$1.catchTag("ServerDraining", () => Effect$1.flatMap(serviceUnavailableApiError(), Effect$1.fail)))).handle("revoke", ({ params, request }) => Effect$1.gen(function* () {
 		yield* mapAuthenticationFailures(auth.revokeSession(currentSessionToken(request), params.sessionId));
 	})).handle("logout", ({ request }) => Effect$1.gen(function* () {
 		yield* mapAuthenticationFailures(auth.logout(currentSessionToken(request)));
@@ -20593,7 +20870,7 @@ var makeDeliveryGraphInspection = Effect$1.gen(function* () {
 			limit: 500
 		}));
 		if (result._tag !== "releaseSlice") return yield* unexpectedResult("release slice");
-		return result.value;
+		return yield* hydrateReleaseRunbookContent(persistence, input.workspaceId, result.value).pipe(mapPersistenceRead);
 	});
 	const readRelationship = Effect$1.fn("DeliveryGraphInspection.relationship")(function* (input) {
 		const result = yield* mapPersistenceRead(persistence.deliveryGraph.read(input.workspaceId, {
@@ -20640,11 +20917,13 @@ var makeDeliveryGraphInspection = Effect$1.gen(function* () {
 		const [connection, runtime] = yield* Effect$1.all([persistence.pluginConnections.get(input.workspaceId, entityRecord.sourceRevision.pluginConnectionId).pipe(Effect$1.result), persistence.pluginRuntime.getRuntime(input.workspaceId, entityRecord.sourceRevision.pluginConnectionId).pipe(Effect$1.result)]);
 		const negotiated = Result$1.isSuccess(runtime) ? Schema$1.decodeUnknownResult(Schema$1.fromJsonString(NegotiatedPluginDescriptorV1))(runtime.success.descriptorJson) : null;
 		const sourceActionsAvailable = Result$1.isSuccess(connection) && connection.success.isEnabled && negotiated !== null && Result$1.isSuccess(negotiated) && hasPluginCapability(negotiated.success, "action.propose", 1) && hasPluginCapability(negotiated.success, "action.execute", 1);
+		const sourceSynchronizationAvailable = Result$1.isSuccess(connection) && connection.success.isEnabled && negotiated !== null && Result$1.isSuccess(negotiated) && hasPluginCapability(negotiated.success, "sync.incremental", 1);
 		return {
 			entity: result.value.entity,
 			source: entityRecord.sourceRevision,
 			isSourceCurrent: Number(entityRecord.revision) === Number(result.value.entity.projection.sourceEntityRevision),
 			sourceActionsAvailable,
+			sourceSynchronizationAvailable,
 			freshness,
 			clockifyApproval: projectClockifyApproval(input.entityId, entityRecord.sourceRevision, clockifyActions),
 			graph: {
@@ -25721,7 +26000,7 @@ var makeGovernedActionExecutionBegin = Effect$1.gen(function* () {
 					reason: "authority-changed"
 				});
 			}
-			const currentTarget = publication !== void 0 && record.envelope.targetEntityId === EntityId.make(publication.releaseId) ? yield* Schema$1.decodeUnknownEffect(GovernedActionTargetSnapshotV1)({
+			const currentTarget = publication !== void 0 && record.envelope.targetEntityId === EntityId.make(publication.releaseId) ? yield* Schema$1.decodeUnknownEffect(Schema$1.toType(GovernedActionTargetSnapshotV1))({
 				workspaceId: record.envelope.workspaceId,
 				entityId: record.envelope.targetEntityId,
 				entityType: record.envelope.proposal.request.target.entityType,
@@ -27847,4 +28126,4 @@ var effectiveReachableUrls = (config, detectedPrivateAddresses) => {
 //#endregion
 export { deliveryGraphInspectionLayer as $, controlCenterBootstrapLayer as $n, TerminalRecoveryRefusedError as $r, authorizePairingRequest as $t, makeTimelineExportAudits as A, PrReviewSandboxTools as An, makeSecretStore as Ar, listPluginConnectionSummaries as At, releaseAgentJobsUnavailableLayer as B, prReviewSandboxToolsLayer as Bn, terminalRecoveryLayer as Br, JiraReadPluginConfiguration as Bt, staticApplicationWithAssetsLayer as C, AgentJobWorker as Cn, decodeOperationalDataPaths as Cr, DEFAULT_MAXIMUM_LIVE_STREAMS as Ct, makeStaticAssetStore as D, PrReviewCommandArtifactId as Dn, syncDataRootPath as Dr, releasePublicationSubmissionsLayer as Dt, StaticAssetStoreError as E, prReviewAgentJobWorkerLayer as En, publishFreshDataRootClaim as Er, LiveStreamAdmissionExceeded as Et, synchronizeFakeRelease as F, ReviewReadFile as Fn, SecretTooLargeError as Fr, pluginAdministrationLayerWithConnections as Ft, relationshipRepairProposalsLayer as G, PLUGIN_RETRY_MAX_DELAY_MILLIS as Gn, SESSION_ABSOLUTE_LIFETIME_DAYS as Gr, ClockifyReadPluginConfiguration as Gt, releaseAgentTurnsLayer as H, PLUGIN_OPERATION_MAX_ATTEMPTS as Hn, PairingCodeId as Hr, makeJiraReadPluginRuntime as Ht, synchronizeFakeReleaseFromMap as I, ReviewRunCommand as In, secretStoreIoError as Ir, pluginAdministrationOAuthLayer as It, portfolioSnapshotsLayer as J, retryPluginStream as Jn, AuthCryptoError as Jr, makeClockifyReadPluginRuntime as Jt, pullRequestReviewsLayer as K, isPluginFailureRetryable as Kn, SESSION_IDLE_LIFETIME_HOURS as Kr, clockifyReadOnlyPluginDescriptor as Kt, makeReleaseAgentJobs as L, ReviewSearchArtifact as Ln, MINIMUM_PR_REVIEW_BUDGET_MILLIS as Lr, pluginAdministrationOAuthLayerWithConnections as Lt, reconcileFakeReleaseProjection as M, ReviewListFiles as Mn, SecretProtectionError as Mr, makePluginAdministrationWithConnections as Mt, reconcileFakeReleaseSyncAttempts as N, ReviewPageArtifact as Nn, SecretStoreInputError as Nr, makePluginAdministrationWithOAuth as Nt, makeWorkspaceSettingsAdministration as O, PrReviewSandboxSessionError as On, SecretRoot as Or, releasePublicationSubmissionsUnavailableLayer as Ot, recoverFakeReleaseProjection as P, ReviewReadDiff as Pn, SecretStoreIoError as Pr, pluginAdministrationLayer as Pt, makeLiveEvents as Q, ControlCenterBootstrap as Qn, FirstRunPairingAlreadyIssuedError as Qr, PluginConnectionMap as Qt, releaseAgentJobsLayer as R, ReviewSearchFiles as Rn, TERMINAL_RECOVERY_CONFIRMATION as Rr, mapPersistenceReadError as Rt, staticApplicationLayer as S, ApiBindConfiguration as Sn, decodeControlCenterDataPaths as Sr, controlCenterApiMiddlewareLayer as St, StaticAssetStore as T, agentJobWorkerWithPrReviewLayer as Tn, publishDataRootMarker as Tr, LiveStreamAdmission as Tt, releaseAgentUnavailableLayer as U, PLUGIN_RATE_LIMIT_MAX_DELAY_MILLIS as Un, PairingCodeSummary as Ur, makeJiraReadPluginRuntimeFromProvider as Ut, makeReleaseAgentTurns as V, CodeCommitPluginDefinition as Vn, PAIRING_CODE_LIFETIME_MINUTES as Vr, jiraReadPluginDescriptor as Vt, makeRelationshipRepairProposals as W, PLUGIN_RETRY_BASE_DELAY_MILLIS as Wn, PairingPurpose as Wr, CodePipelinePluginDefinition as Wt, mediaReadsLayer as X, agentProviderRuntimeRegistryLayer as Xn, AuthPersistenceError as Xr, clockifyActionSubmissionsLayer as Xt, makeMediaReads as Y, AgentRuntimeRegistry as Yn, AuthPermissionDeniedError as Yr, makeClockifyReadPluginRuntimeFromProvider as Yt, liveEventsLayer as Z, agentRuntimeRegistryLayer as Zn, CredentialRejectedError as Zr, clockifyActionSubmissionsUnavailableLayer as Zt, prReviewWorkerStartupLayer as _, hashCsrfToken as _n, DATA_ROOT_MARKER_V1_CONTENT as _r, HttpByteLimit as _t, decodeBindConfig as a, withCorrelationResponse as an, restoreBackup as ar, codePipelineReadsLayer as at, controlCenterTransportProtocol as b, ServerDraining as bn, DATA_ROOT_STAGING_PREFIX as br, controlCenterApiLayer as bt, makeControlCenterApplication as c, InsecureLanCapability as cn, BackupBlobEntryV1 as cr, makeAuthorizedShares as ct, ReleaseSynchronizationStartup as d, authorizeAuthenticatedMutation as dn, BackupId as dr, requestRateLimiterLayer as dt, mutationCsrfLayer as en, makeControlCenterBootstrap as er, makeDeliveryGraphInspection as et, ReleaseSynchronizationStartupConfigurationError as f, authorizeAuthenticatedRead as fn, BackupManifestJsonV1 as fr, securityHeaders as ft, PrReviewWorkerStartup as g, effectiveRequestAuthority as gn, DATA_ROOT_MARKER_NAME as gr, DEFAULT_HTTP_SECURITY_LIMITS as gt, PrReviewWorkerRunning as h, authorizeRequest as hn, DATA_ROOT_MARKER_MAX_BYTES as hr, limitRequestBodyStream as ht, TransportPolicy as i, provideCurrentRequest as in, createVerifiedBackup as ir, makeCompleteDiffReads as it, timelineExportAuditsLayer as j, ReviewApplyPatch as jn, SecretNotFoundError as jr, makePluginAdministration as jt, workspaceSettingsAdministrationLayer as k, PrReviewSandboxSessions as kn, SecretStore as kr, listFirstPartyServiceMetadata as kt, makeControlCenterServer as l, RequestAccess as ln, BackupBoundaryV1 as lr, requestBoundaryLayer as lt, releaseSynchronizationStartupLayer as m, authorizeInsecureLanCapability as mn, ReproducibleBlobGap as mr, authorizeRequestBody as mt, BindConfigError as n, CurrentRequestContext as nn, authLayer as nr, timelineReadsLayer as nt, effectiveReachableUrls as o, CsrfDigest as on, verifyBackup as or, makeCodePipelineReads as ot, releaseIdFromStartupState as p, authorizeAuthenticatedReadPost as pn, BackupManifestV1 as pr, RequestBodyPolicyError as pt, makePortfolioSnapshots as q, retryPluginOperation as qn, SessionSummary as qr, clockifyReadPluginDescriptor as qt, DirectTlsMaterial as r, makeCurrentRequestContext as rn, createOfflineVerifiedBackup as rr, completeDiffReadsLayer as rt, PrReviewWorkerConfigurationError as s, CsrfToken as sn, BackupBlobCountsV1 as sr, authorizedSharesLayer as st, BindConfig as t, sessionCookieAuthLayer as tn, Auth as tr, makeTimelineReads as tt, requestUrlBoundaryLayer as u, RequestSecurityError as un, BackupDatabaseArtifactV1 as ur, RequestLimitPolicy as ut, DirectTlsServerError as v, sessionCookiePolicy as vn, DATA_ROOT_MARKER_V2_PREFIX as vr, HttpSecurityLimits as vt, StaticAssetMimeType as w, agentJobWorkerLayer as wn, inspectFreshDataRootClaim as wr, DEFAULT_MAXIMUM_LIVE_STREAMS_PER_SESSION as wt, makeNodeTransportLayer as x, ServerLifecycle as xn, boundDataRootMarkerContent as xr, controlCenterApiLayerWithLifecycle as xt, NODE_LISTENER_SECURITY_POLICY as y, verifyCsrfToken as yn, DATA_ROOT_PENDING_MARKER_PREFIX as yr, controlCenterApiHandlersLayer as yt, releaseAgentJobsLayerForWorkerWorkspace as z, prReviewSandboxSessionsLayer as zn, TerminalRecovery as zr, mapPersistenceWriteError as zt };
 
-//# sourceMappingURL=BindConfig-Bj282xDC.js.map
+//# sourceMappingURL=BindConfig-DAASchDn.js.map