@rosthq/cli 0.7.76 → 0.7.77

package/dist/index.js

@@ -38310,6 +38310,30 @@ var CATALOG_ENTRIES = [
     // (script_run_secret_grants) gates availability on top of this — no grant, no call.
     default_access_policy: "always_ask"
   },
+  {
+    // DER-1739: the first named consumers of the generalized secret broker. They ride
+    // the same server-side egress core as `secret.broker` — no credential ever enters
+    // agent context; a `baserow` secret grant (secret_grant.grant) pins the host/token.
+    id: "baserow.read",
+    title: "Read Baserow rows (brokered)",
+    provider: "baserow",
+    description: "Call this to read rows from an approved Baserow table \u2014 list a table's rows or fetch one row by id. You supply only the table id, an optional row id, and optional query filters (page, size, search, filter/order params) \u2014 never a credential. A server-side broker injects the tenant's Baserow token, calls only the allowlisted host, and returns a size-capped, secret-scrubbed result. Read-only.",
+    default_scope_tier: "read",
+    scope_tiers: ["read"],
+    // Resolved via a vault-ref `baserow` secret grant, injected server-side.
+    credential_required: true,
+    default_access_policy: "always_allow"
+  },
+  {
+    id: "baserow.write",
+    title: "Write Baserow row (brokered)",
+    provider: "baserow",
+    description: "Call this to request creating or updating a row in an approved Baserow table. You supply the table id, the field values, and \u2014 to UPDATE \u2014 the row id (omit it to CREATE). You never supply a credential. Every write is HELD for human approval before it is sent; on approval the broker injects the tenant's Baserow token server-side and audits the call. It never writes autonomously.",
+    default_scope_tier: "write_with_approval",
+    scope_tiers: ["write_with_approval"],
+    credential_required: true,
+    default_access_policy: "always_ask"
+  },
   {
     id: "ap.invoices.read",
     title: "Read AP invoices",
@@ -38668,7 +38692,7 @@ function providerRequirementFor(entry) {
   if (!entry.credential_required) {
     return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
   }
-  return entry.id === "secret.broker" ? "vault_ref" : "connection";
+  return entry.id === "secret.broker" || entry.id === "baserow.read" || entry.id === "baserow.write" ? "vault_ref" : "connection";
 }
 function trustedRequiredMetadataFor(entry) {
   if (entry.default_access_policy === "always_allow" && entry.default_scope_tier !== "write_with_approval") {
@@ -38693,7 +38717,7 @@ function enrichCatalogEntry(entry) {
     access_levels: accessLevels,
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
-    cost_class: entry.id === "script.run" || entry.id === "secret.broker" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
+    cost_class: entry.id === "script.run" || entry.id === "secret.broker" || entry.id === "baserow.read" || entry.id === "baserow.write" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
     lane_support: ["cloud", "runner", "mcp"],
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
@@ -44177,8 +44201,109 @@ var signalReadingProposalSchema = external_exports.object({
   }
 });
 
-// ../../packages/protocol/src/software-factory.ts
+// ../../packages/protocol/src/secret-broker.ts
 var uuid10 = external_exports.string().uuid();
+var VAULT_REF_PROVIDER = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
+var brokerVaultRefSchema = external_exports.string().min(1).max(500).regex(VAULT_REF_PROVIDER, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !hasSecretShapedValue(value), {
+  message: "vault_ref must be a pointer, never raw secret material"
+});
+var brokerGrantKeySchema = external_exports.string().trim().min(1).max(200).regex(/^[a-z0-9][a-z0-9._:-]*$/i, "grant_key must be a short identifier (letters, digits, . _ : -)").refine((value) => !hasSecretShapedValue(value), {
+  message: "grant_key must be an identifier, never raw secret material"
+});
+var brokerProviderSchema = external_exports.string().trim().min(1).max(100).refine((value) => !hasSecretShapedValue(value), {
+  message: "provider must be a label, never raw secret material"
+});
+var brokerAllowedHostSchema = external_exports.string().trim().min(1).max(255).regex(/^[a-zA-Z0-9.-]+$/, "allowed_host must be a bare hostname (letters, digits, dots, hyphens) \u2014 no scheme, port, or path");
+var brokerAllowedPathPrefixSchema = external_exports.string().min(1).max(512).refine((value) => value.startsWith("/"), { message: "allowed_path_prefix must start with /" }).refine((value) => !value.includes("//"), { message: "allowed_path_prefix must not contain //" }).refine((value) => !value.includes("\\"), { message: "allowed_path_prefix must not contain a backslash" }).refine((value) => !value.includes("://"), { message: "allowed_path_prefix must not contain a scheme" }).refine((value) => !value.includes("?") && !value.includes("#"), { message: "allowed_path_prefix must not contain a query or fragment" }).refine((value) => !value.includes(".."), { message: "allowed_path_prefix must not contain .." }).refine((value) => ![...value].some((ch) => ch <= " "), { message: "allowed_path_prefix must not contain whitespace or control characters" });
+var brokerHttpMethodSchema = external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]);
+var READ_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var brokerScopeTierSchema = external_exports.enum(["read", "write"]);
+var brokerInjectionModeSchema = external_exports.enum(["header_bearer", "header", "query"]);
+var brokerInjectionNameSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "injection_name may contain only letters, digits, . _ -");
+var brokerAllowedMethodsSchema = external_exports.array(brokerHttpMethodSchema).min(1, "at least one allowed method is required").max(7).refine((methods) => new Set(methods).size === methods.length, { message: "allowed_methods must not contain duplicates" });
+var brokerGrantStatusSchema = external_exports.enum(["active", "revoked"]);
+function refineGrantShape(value, ctx) {
+  if (value.scope_tier === "read" && value.allowed_methods.some((method) => !READ_SAFE_METHODS.has(method))) {
+    ctx.addIssue({ code: "custom", path: ["allowed_methods"], message: "a read-tier grant may only allow GET, HEAD, or OPTIONS" });
+  }
+  const injectionMode = value.injection_mode ?? "header_bearer";
+  if (injectionMode !== "header_bearer" && !value.injection_name) {
+    ctx.addIssue({ code: "custom", path: ["injection_name"], message: "injection_name is required unless injection_mode is header_bearer" });
+  }
+}
+var secretGrantRequestInputSchema = external_exports.object({
+  seat_id: uuid10,
+  grant_key: brokerGrantKeySchema,
+  provider: brokerProviderSchema,
+  allowed_host: brokerAllowedHostSchema,
+  allowed_path_prefix: brokerAllowedPathPrefixSchema.optional(),
+  allowed_methods: brokerAllowedMethodsSchema,
+  scope_tier: brokerScopeTierSchema,
+  reason: external_exports.string().max(2e3).refine((value) => !hasSecretShapedValue(value), { message: "reason must never contain secret material" }).optional()
+}).strict().superRefine((value, ctx) => refineGrantShape(value, ctx));
+var secretGrantRequestOutputSchema = external_exports.object({
+  requested: external_exports.literal(true),
+  event_id: uuid10,
+  seat_id: uuid10,
+  grant_key: external_exports.string(),
+  scope_tier: brokerScopeTierSchema
+}).strict();
+var secretGrantGrantInputSchema = external_exports.object({
+  seat_id: uuid10,
+  grant_key: brokerGrantKeySchema,
+  // POINTER only. The vault-ref refinement rejects any raw-secret value.
+  vault_ref: brokerVaultRefSchema,
+  provider: brokerProviderSchema,
+  allowed_host: brokerAllowedHostSchema,
+  allowed_path_prefix: brokerAllowedPathPrefixSchema.optional(),
+  allowed_methods: brokerAllowedMethodsSchema,
+  scope_tier: brokerScopeTierSchema,
+  injection_mode: brokerInjectionModeSchema.default("header_bearer"),
+  injection_name: brokerInjectionNameSchema.optional(),
+  // ISO-8601; absent = no expiry.
+  expires_at: external_exports.string().datetime({ offset: true }).optional()
+}).strict().superRefine((value, ctx) => refineGrantShape(value, ctx));
+var secretGrantGrantOutputSchema = external_exports.object({
+  grant_id: uuid10,
+  seat_id: uuid10,
+  grant_key: external_exports.string(),
+  scope_tier: brokerScopeTierSchema,
+  status: brokerGrantStatusSchema
+}).strict();
+var secretGrantRevokeInputSchema = external_exports.object({
+  grant_id: uuid10
+}).strict();
+var secretGrantRevokeOutputSchema = external_exports.object({
+  grant_id: uuid10,
+  status: brokerGrantStatusSchema
+}).strict();
+var secretGrantSummarySchema = external_exports.object({
+  id: uuid10,
+  seat_id: uuid10,
+  grant_key: external_exports.string(),
+  provider: external_exports.string(),
+  allowed_host: external_exports.string(),
+  allowed_path_prefix: external_exports.string(),
+  allowed_methods: external_exports.array(external_exports.string()),
+  scope_tier: brokerScopeTierSchema,
+  injection_mode: brokerInjectionModeSchema,
+  injection_name: external_exports.string().nullable(),
+  status: brokerGrantStatusSchema,
+  granted_by_user_id: uuid10,
+  granted_at: external_exports.string(),
+  revoked_at: external_exports.string().nullable(),
+  expires_at: external_exports.string().nullable()
+}).strict();
+var secretGrantListInputSchema = external_exports.object({
+  seat_id: uuid10.nullable().optional(),
+  include_revoked: external_exports.boolean().optional()
+}).strict();
+var secretGrantListOutputSchema = external_exports.object({
+  grants: external_exports.array(secretGrantSummarySchema)
+}).strict();
+
+// ../../packages/protocol/src/software-factory.ts
+var uuid11 = external_exports.string().uuid();
 var SOFTWARE_PHASE_VALUES = [
   "intake",
   "discovery_scoping",
@@ -44289,7 +44414,7 @@ var softwareConfigValueKindSchema = external_exports.enum(["plain", "secret_ref"
 var softwareCredentialRequestStatusSchema = external_exports.enum(["pending", "fulfilled", "rejected", "canceled"]);
 var softwareSecretAccessOperationSchema = external_exports.enum(["use", "vercel_env_sync", "test_execution"]);
 var softwareProjectSummarySchema = external_exports.object({
-  id: uuid10,
+  id: uuid11,
   name: external_exports.string().min(1),
   slug: external_exports.string().min(1),
   base_branch: external_exports.string().min(1),
@@ -44316,8 +44441,8 @@ var softwareProjectListInputSchema = external_exports.object({}).strict();
 var softwareProjectListOutputSchema = external_exports.object({
   projects: external_exports.array(softwareProjectSummarySchema)
 });
-var VAULT_REF_PROVIDER = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
-var softwareVaultRefSchema = external_exports.string().min(1).max(500).regex(VAULT_REF_PROVIDER, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !hasSecretShapedValue(value), {
+var VAULT_REF_PROVIDER2 = /^(?:infisical|doppler|local-dev):\/\/\S+$/;
+var softwareVaultRefSchema = external_exports.string().min(1).max(500).regex(VAULT_REF_PROVIDER2, "vault_ref must be a provider URI, e.g. infisical://path, doppler://path, or local-dev://path").refine((value) => !hasSecretShapedValue(value), {
   message: "vault_ref must be a pointer, never raw secret material"
 });
 var softwareSecretKeyNameSchema = external_exports.string().trim().min(1).max(200).refine((value) => !hasSecretShapedValue(value), {
@@ -44343,11 +44468,11 @@ var softwarePhaseSchedulerStateSchema = external_exports.object({
   ]).nullable(),
   message: external_exports.string(),
   remediation_href: external_exports.string().nullable(),
-  work_order_id: uuid10.nullable()
+  work_order_id: uuid11.nullable()
 });
 var softwareBuildRequestSummarySchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10,
+  id: uuid11,
+  software_project_id: uuid11,
   title: external_exports.string(),
   source_channel: softwareSourceChannelSchema,
   source_ref: external_exports.string().nullable(),
@@ -44363,7 +44488,7 @@ var softwareBuildRequestSummarySchema = external_exports.object({
   scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwarePhaseRunSummarySchema = external_exports.object({
-  id: uuid10,
+  id: uuid11,
   phase: softwarePhaseSchema,
   status: softwarePhaseRunStatusSchema,
   attempt_no: external_exports.number().int(),
@@ -44373,17 +44498,17 @@ var softwarePhaseRunSummarySchema = external_exports.object({
   scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwareGateSummarySchema = external_exports.object({
-  id: uuid10,
+  id: uuid11,
   gate_type: softwareGateTypeSchema,
   status: external_exports.enum(["pending", "approved", "rejected", "held"]),
-  phase_run_id: uuid10.nullable(),
-  resolved_by_user_id: uuid10.nullable(),
+  phase_run_id: uuid11.nullable(),
+  resolved_by_user_id: uuid11.nullable(),
   rationale: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
 var softwareChangesetSummarySchema = external_exports.object({
-  id: uuid10,
-  build_request_id: uuid10,
+  id: uuid11,
+  build_request_id: uuid11,
   ordinal: external_exports.number().int(),
   title: external_exports.string(),
   split_criterion: softwareChangesetSplitCriterionSchema,
@@ -44397,10 +44522,10 @@ var softwareChangesetSummarySchema = external_exports.object({
   created_at: external_exports.string()
 });
 var softwareTaskSummarySchema = external_exports.object({
-  id: uuid10,
-  build_request_id: uuid10,
-  changeset_id: uuid10,
-  plan_version_id: uuid10,
+  id: uuid11,
+  build_request_id: uuid11,
+  changeset_id: uuid11,
+  plan_version_id: uuid11,
   ordinal: external_exports.number().int(),
   task_key: external_exports.string(),
   title: external_exports.string(),
@@ -44415,8 +44540,8 @@ var softwareTaskSummarySchema = external_exports.object({
   created_at: external_exports.string()
 });
 var softwarePlanVersionSummarySchema = external_exports.object({
-  id: uuid10,
-  build_request_id: uuid10,
+  id: uuid11,
+  build_request_id: uuid11,
   version_no: external_exports.number().int(),
   status: softwarePlanVersionStatusSchema,
   summary: external_exports.string().nullable(),
@@ -44426,37 +44551,37 @@ var softwarePlanVersionSummarySchema = external_exports.object({
     question: external_exports.string(),
     answer: external_exports.string()
   })).default([]),
-  created_by_seat_id: uuid10.nullable(),
+  created_by_seat_id: uuid11.nullable(),
   created_at: external_exports.string()
 });
 var softwarePlanConformanceFindingSummarySchema = external_exports.object({
-  id: uuid10,
-  build_request_id: uuid10,
-  changeset_id: uuid10.nullable(),
-  phase_run_id: uuid10.nullable(),
-  plan_version_id: uuid10.nullable(),
+  id: uuid11,
+  build_request_id: uuid11,
+  changeset_id: uuid11.nullable(),
+  phase_run_id: uuid11.nullable(),
+  plan_version_id: uuid11.nullable(),
   severity: softwareConformanceSeveritySchema,
   category: softwareConformanceCategorySchema,
   summary: external_exports.string(),
   detail: external_exports.string().nullable(),
   status: softwareConformanceStatusSchema,
-  accepted_by_decision_id: uuid10.nullable(),
+  accepted_by_decision_id: uuid11.nullable(),
   resolved_at: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
 var softwareAuthorityProfileSummarySchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10.nullable(),
+  id: uuid11,
+  software_project_id: uuid11.nullable(),
   name: external_exports.string(),
   preset: softwareAuthorityPresetSchema,
   is_default: external_exports.boolean(),
   created_at: external_exports.string()
 });
 var softwareSecretGrantSummarySchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10,
+  id: uuid11,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   action: external_exports.string(),
   key_name: external_exports.string(),
   vault_ref: external_exports.string(),
@@ -44465,8 +44590,8 @@ var softwareSecretGrantSummarySchema = external_exports.object({
   revoked_at: external_exports.string().nullable()
 });
 var softwareConfigEntrySummarySchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10,
+  id: uuid11,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
   key_name: external_exports.string(),
   value_kind: softwareConfigValueKindSchema,
@@ -44476,20 +44601,20 @@ var softwareConfigEntrySummarySchema = external_exports.object({
   updated_at: external_exports.string()
 });
 var softwareCredentialRequestSummarySchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10,
+  id: uuid11,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  requested_by_seat_id: uuid10,
+  requested_by_seat_id: uuid11,
   action: external_exports.string(),
   key_name: external_exports.string(),
   reason: external_exports.string().nullable(),
   status: softwareCredentialRequestStatusSchema,
-  approval_task_id: uuid10.nullable(),
+  approval_task_id: uuid11.nullable(),
   created_at: external_exports.string()
 });
 var softwareCapacityObservationSummarySchema = external_exports.object({
-  id: uuid10,
-  runner_id: uuid10,
+  id: uuid11,
+  runner_id: uuid11,
   observed_at: external_exports.string(),
   os: external_exports.string().nullable(),
   cpu_count: external_exports.number().int().nullable(),
@@ -44505,7 +44630,7 @@ var softwareRequestCreateInputSchema = external_exports.object({
   // this schema) enforces that exactly one resolves, with an actionable error
   // when neither is given or neither matches — keeping this shape a plain
   // `z.object` so JSON-schema/CLI-flag projection stays simple (no `.refine`).
-  software_project_id: uuid10.optional(),
+  software_project_id: uuid11.optional(),
   project: external_exports.string().trim().min(1).max(200).optional(),
   // Untrusted display text (ADR-0018 §5) — bounded, never treated as an instruction.
   title: external_exports.string().trim().min(1).max(500),
@@ -44517,11 +44642,11 @@ var softwareRequestCreateInputSchema = external_exports.object({
   automation_mode: softwareAutomationModeSchema.optional()
 }).strict();
 var softwareRequestCreateOutputSchema = external_exports.object({
-  build_request_id: uuid10,
-  software_project_id: uuid10,
+  build_request_id: uuid11,
+  software_project_id: uuid11,
   status: softwareRequestStatusSchema,
   current_phase: softwarePhaseSchema,
-  phase_run_id: uuid10,
+  phase_run_id: uuid11,
   scheduler_state: softwarePhaseSchedulerStateSchema
 });
 var softwareRequestListInputSchema = external_exports.object({
@@ -44531,7 +44656,7 @@ var softwareRequestListOutputSchema = external_exports.object({
   requests: external_exports.array(softwareBuildRequestSummarySchema)
 });
 var softwareRequestShowInputSchema = external_exports.object({
-  build_request_id: uuid10
+  build_request_id: uuid11
 }).strict();
 var softwareRequestShowOutputSchema = external_exports.object({
   request: softwareBuildRequestSummarySchema,
@@ -44544,80 +44669,80 @@ var softwareRequestShowOutputSchema = external_exports.object({
 });
 var softwareRequestLifecycleReason = external_exports.string().trim().min(1).max(2e3);
 var softwareRequestPauseInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   reason: softwareRequestLifecycleReason.optional()
 }).strict();
 var softwareRequestCancelInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   reason: softwareRequestLifecycleReason.optional()
 }).strict();
 var softwareRequestResumeInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   reason: softwareRequestLifecycleReason.optional(),
   termination_bound: softwareTerminationBoundSchema.optional()
 }).strict();
 var softwareRequestLifecycleOutputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   status: softwareRequestStatusSchema,
   current_phase: softwarePhaseSchema,
-  phase_run_id: uuid10.nullable(),
-  work_order_id: uuid10.nullable(),
-  resume_from_task_id: uuid10.nullable()
+  phase_run_id: uuid11.nullable(),
+  work_order_id: uuid11.nullable(),
+  resume_from_task_id: uuid11.nullable()
 });
 var softwarePhaseAdvanceInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   to_phase: softwarePhaseSchema,
-  owning_seat_id: uuid10.optional(),
+  owning_seat_id: uuid11.optional(),
   note: external_exports.string().max(2e3).optional()
 }).strict();
 var softwarePhaseAdvanceOutputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   from_phase: softwarePhaseSchema,
   to_phase: softwarePhaseSchema,
-  phase_run_id: uuid10
+  phase_run_id: uuid11
 });
 var softwareGateDecideInputSchema = external_exports.object({
-  gate_id: uuid10,
+  gate_id: uuid11,
   decision: softwareGateDecisionSchema,
   rationale: external_exports.string().max(4e3).optional()
 }).strict();
 var softwareGateDecideOutputSchema = external_exports.object({
-  gate_id: uuid10,
+  gate_id: uuid11,
   status: external_exports.enum(["approved", "rejected"]),
-  resolved_by_user_id: uuid10,
-  decision_id: uuid10.nullable()
+  resolved_by_user_id: uuid11,
+  decision_id: uuid11.nullable()
 });
 var forgeClarificationAnswer = external_exports.object({
   question: external_exports.string().trim().min(1).max(2e3),
   answer: external_exports.string().trim().min(1).max(4e3)
 }).strict();
 var softwareRequestAnswerClarificationInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   answers: external_exports.array(forgeClarificationAnswer).min(1).max(50),
   // The planner marks the plan ready once its questions are resolved; the human/COS can
   // signal that here. Default false keeps the plan in needs_clarification.
   mark_ready_for_plan_review: external_exports.boolean().default(false)
 }).strict();
 var softwareRequestAnswerClarificationOutputSchema = external_exports.object({
-  build_request_id: uuid10,
-  plan_version_id: uuid10,
+  build_request_id: uuid11,
+  plan_version_id: uuid11,
   status: softwarePlanVersionStatusSchema,
   answered_count: external_exports.number().int()
 });
 var softwarePlanApproveInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   rationale: external_exports.string().trim().min(1).max(4e3).optional()
 }).strict();
 var softwarePlanRejectInputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   // A rejection must say why (it routes the request back to discovery/scoping).
   rationale: external_exports.string().trim().min(1).max(4e3)
 }).strict();
 var softwarePlanDecisionOutputSchema = external_exports.object({
-  build_request_id: uuid10,
-  plan_version_id: uuid10,
+  build_request_id: uuid11,
+  plan_version_id: uuid11,
   status: external_exports.enum(["approved", "rejected"]),
-  decision_id: uuid10,
+  decision_id: uuid11,
   current_phase: softwarePhaseSchema
 });
 var forgeConformanceFindingInput = external_exports.object({
@@ -44625,41 +44750,41 @@ var forgeConformanceFindingInput = external_exports.object({
   category: softwareConformanceCategorySchema.default("other"),
   summary: external_exports.string().trim().min(1).max(2e3),
   detail: external_exports.string().trim().min(1).max(8e3).optional(),
-  changeset_id: uuid10.optional(),
-  plan_version_id: uuid10.optional()
+  changeset_id: uuid11.optional(),
+  plan_version_id: uuid11.optional()
 }).strict();
 var softwareConformanceRecordFindingsInputSchema = external_exports.object({
-  build_request_id: uuid10,
-  phase_run_id: uuid10.optional(),
+  build_request_id: uuid11,
+  phase_run_id: uuid11.optional(),
   findings: external_exports.array(forgeConformanceFindingInput).min(1).max(50)
 }).strict();
 var softwareConformanceRecordFindingsOutputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   recorded_count: external_exports.number().int(),
-  finding_ids: external_exports.array(uuid10),
+  finding_ids: external_exports.array(uuid11),
   open_finding_count: external_exports.number().int()
 }).strict();
 var softwareConformanceResolveFindingInputSchema = external_exports.object({
-  build_request_id: uuid10,
-  finding_ids: external_exports.array(uuid10).min(1).max(50),
+  build_request_id: uuid11,
+  finding_ids: external_exports.array(uuid11).min(1).max(50),
   // The re-review run that verified the fix — provenance only (rides into the append-only audit
   // event; the finding row's resolution state is the durable transition).
-  phase_run_id: uuid10.optional()
+  phase_run_id: uuid11.optional()
 }).strict();
 var softwareConformanceResolveFindingOutputSchema = external_exports.object({
-  build_request_id: uuid10,
+  build_request_id: uuid11,
   resolved_count: external_exports.number().int(),
-  resolved_finding_ids: external_exports.array(uuid10),
+  resolved_finding_ids: external_exports.array(uuid11),
   open_finding_count: external_exports.number().int()
 }).strict();
 var softwareAuthorityProfileListInputSchema = external_exports.object({
-  software_project_id: uuid10.nullable().optional()
+  software_project_id: uuid11.nullable().optional()
 }).strict();
 var softwareAuthorityProfileListOutputSchema = external_exports.object({
   profiles: external_exports.array(softwareAuthorityProfileSummarySchema)
 });
 var softwareAuthorityProfileCreateInputSchema = external_exports.object({
-  software_project_id: uuid10.nullable().optional(),
+  software_project_id: uuid11.nullable().optional(),
   name: external_exports.string().trim().min(1).max(120),
   preset: softwareAuthorityPresetSchema.default("read_only"),
   // A closed capability map (booleans by capability key). Never derived from
@@ -44668,77 +44793,77 @@ var softwareAuthorityProfileCreateInputSchema = external_exports.object({
   is_default: external_exports.boolean().optional()
 }).strict();
 var softwareAuthorityProfileCreateOutputSchema = external_exports.object({
-  profile_id: uuid10,
+  profile_id: uuid11,
   name: external_exports.string(),
   preset: softwareAuthorityPresetSchema
 });
 var softwareAuthorityGrantInputSchema = external_exports.object({
-  software_project_id: uuid10,
-  seat_id: uuid10,
-  authority_profile_id: uuid10
+  software_project_id: uuid11,
+  seat_id: uuid11,
+  authority_profile_id: uuid11
 }).strict();
 var softwareAuthorityGrantOutputSchema = external_exports.object({
-  grant_id: uuid10,
-  software_project_id: uuid10,
-  seat_id: uuid10,
-  authority_profile_id: uuid10,
+  grant_id: uuid11,
+  software_project_id: uuid11,
+  seat_id: uuid11,
+  authority_profile_id: uuid11,
   status: softwareGrantStatusSchema
 });
 var softwareAuthorityRevokeInputSchema = external_exports.object({
-  grant_id: uuid10
+  grant_id: uuid11
 }).strict();
 var softwareAuthorityRevokeOutputSchema = external_exports.object({
-  grant_id: uuid10,
+  grant_id: uuid11,
   status: softwareGrantStatusSchema
 });
 var softwareSecretRequestInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   reason: external_exports.string().max(2e3).optional()
 }).strict();
 var softwareSecretRequestOutputSchema = external_exports.object({
   requested: external_exports.literal(true),
-  credential_request_id: uuid10,
-  approval_task_id: uuid10,
-  software_project_id: uuid10,
+  credential_request_id: uuid11,
+  approval_task_id: uuid11,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   key_name: external_exports.string()
 });
 var softwareSecretGrantInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   // POINTER only. The vault ref shape refinement rejects any raw-secret value.
   vault_ref: softwareVaultRefSchema
 }).strict();
 var softwareSecretGrantOutputSchema = external_exports.object({
-  grant_id: uuid10,
+  grant_id: uuid11,
   key_name: external_exports.string(),
   environment: softwareEnvironmentSchema,
   status: softwareGrantStatusSchema
 });
 var softwareSecretRevokeInputSchema = external_exports.object({
-  grant_id: uuid10
+  grant_id: uuid11
 }).strict();
 var softwareSecretRevokeOutputSchema = external_exports.object({
-  grant_id: uuid10,
+  grant_id: uuid11,
   status: softwareGrantStatusSchema
 });
 var softwareConfigListInputSchema = external_exports.object({
-  software_project_id: uuid10.nullable().optional(),
+  software_project_id: uuid11.nullable().optional(),
   environment: softwareEnvironmentSchema.nullable().optional()
 }).strict();
 var softwareConfigListOutputSchema = external_exports.object({
   entries: external_exports.array(softwareConfigEntrySummarySchema)
 });
 var softwareConfigSetInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
   key_name: softwareSecretKeyNameSchema,
   value_kind: softwareConfigValueKindSchema,
@@ -44758,24 +44883,24 @@ var softwareConfigSetInputSchema = external_exports.object({
   }
 });
 var softwareConfigSetOutputSchema = external_exports.object({
-  config_entry_id: uuid10,
-  software_project_id: uuid10,
+  config_entry_id: uuid11,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
   key_name: external_exports.string(),
   value_kind: softwareConfigValueKindSchema,
   has_secret_ref: external_exports.boolean()
 });
 var softwareSecretRequestListInputSchema = external_exports.object({
-  software_project_id: uuid10.nullable().optional(),
+  software_project_id: uuid11.nullable().optional(),
   status: softwareCredentialRequestStatusSchema.nullable().optional()
 }).strict();
 var softwareSecretRequestListOutputSchema = external_exports.object({
   requests: external_exports.array(softwareCredentialRequestSummarySchema)
 });
 var softwareSecretUseInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   environment: softwareEnvironmentSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   action: softwareSecretActionSchema,
   key_name: softwareSecretKeyNameSchema,
   operation: softwareSecretAccessOperationSchema.default("use")
@@ -44786,12 +44911,12 @@ var softwareSecretUseOutputSchema = external_exports.object({
   key_name: external_exports.string(),
   environment: softwareEnvironmentSchema,
   operation: softwareSecretAccessOperationSchema,
-  access_log_id: uuid10,
-  missing_request_id: uuid10.nullable(),
+  access_log_id: uuid11,
+  missing_request_id: uuid11.nullable(),
   redacted_summary: external_exports.record(external_exports.string(), external_exports.unknown())
 });
 var softwareCapacityListInputSchema = external_exports.object({
-  runner_id: uuid10.nullable().optional(),
+  runner_id: uuid11.nullable().optional(),
   limit: external_exports.number().int().positive().max(200).optional()
 }).strict();
 var softwareCapacityListOutputSchema = external_exports.object({
@@ -44846,9 +44971,9 @@ var forgeTrustedControlSchema = external_exports.object({
   automation_mode: softwareAutomationModeSchema,
   inferred_risk: softwareRiskLevelSchema,
   risk_ceiling: softwareRiskLevelSchema.nullable().default(null),
-  authority_profile_ids: external_exports.array(uuid10).max(50).default([]),
+  authority_profile_ids: external_exports.array(uuid11).max(50).default([]),
   active_secret_grant_count: external_exports.number().int().nonnegative().max(1e3).default(0),
-  pending_gate_ids: external_exports.array(uuid10).max(50).default([])
+  pending_gate_ids: external_exports.array(uuid11).max(50).default([])
 }).strict();
 var forgeSeatSkillSchema = external_exports.object({
   slug: external_exports.string().trim().min(1).max(200),
@@ -44857,9 +44982,9 @@ var forgeSeatSkillSchema = external_exports.object({
 }).strict();
 var forgeRuntimeContextPacketSchema = external_exports.object({
   schema_version: external_exports.literal(1),
-  phase_run_id: uuid10,
-  build_request_id: uuid10,
-  software_project_id: uuid10,
+  phase_run_id: uuid11,
+  build_request_id: uuid11,
+  software_project_id: uuid11,
   phase: softwarePhaseSchema,
   request_status: softwareRequestStatusSchema,
   project: external_exports.object({
@@ -44868,7 +44993,7 @@ var forgeRuntimeContextPacketSchema = external_exports.object({
   }).strict(),
   scheduler: external_exports.object({
     lease_model: external_exports.literal("work_order_claim_heartbeat"),
-    runner_id: uuid10,
+    runner_id: uuid11,
     max_runner_sessions: external_exports.number().int().positive().max(8),
     model_account_state: external_exports.string().min(1).max(80),
     account_alias: external_exports.string().min(1).max(200).nullable()
@@ -44952,7 +45077,7 @@ var runnerTurnReportSchema = external_exports.object({
 var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // The human-accountable steward seat for the installed team. Agent seats created
   // by the template chain through this seat so no agent occupancy can be orphaned.
-  steward_seat_id: uuid10,
+  steward_seat_id: uuid11,
   // Optional project scope for authority grants. Authority profile presets are
   // installed tenant-wide either way; grants are project-scoped only when supplied.
   // DER-1241: `.nullable()` too — this command is human-confirmed, so its input is
@@ -44960,7 +45085,7 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
   // replay; an empty project round-trips as JSON `null`, which a bare `.optional()`
   // rejects (→ "Command input failed schema validation"). Matches the sibling
   // software-factory schemas that already use `.nullable().optional()`.
-  software_project_id: uuid10.nullable().optional(),
+  software_project_id: uuid11.nullable().optional(),
   assign_skills: external_exports.boolean().default(true),
   // DER-1264: the install auto-staffs live agents at a pr_only, observe-first
   // posture. If the tenant's company autonomy ceiling (`agent_policy`) is MORE
@@ -44980,34 +45105,34 @@ var softwareDeveloperTeamInstallInputSchema = external_exports.object({
 }).strict();
 var softwareDeveloperTeamSeatSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  seat_id: uuid10,
+  seat_id: uuid11,
   name: external_exports.string(),
-  charter_version_id: uuid10,
+  charter_version_id: uuid11,
   created: external_exports.boolean()
 });
 var softwareDeveloperTeamSkillSummarySchema = external_exports.object({
   slug: external_exports.string(),
-  skill_id: uuid10,
-  skill_version_id: uuid10,
-  assigned_seat_ids: external_exports.array(uuid10)
+  skill_id: uuid11,
+  skill_version_id: uuid11,
+  assigned_seat_ids: external_exports.array(uuid11)
 });
 var softwareDeveloperTeamAuthorityProfileSummarySchema = external_exports.object({
   preset: softwareAuthorityPresetSchema,
-  profile_id: uuid10,
+  profile_id: uuid11,
   name: external_exports.string()
 });
 var softwareDeveloperTeamAuthorityGrantSummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  software_project_id: uuid10,
-  seat_id: uuid10,
-  authority_profile_id: uuid10,
-  grant_id: uuid10,
+  software_project_id: uuid11,
+  seat_id: uuid11,
+  authority_profile_id: uuid11,
+  grant_id: uuid11,
   created: external_exports.boolean()
 });
 var softwareDeveloperTeamOccupancySummarySchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema,
-  seat_id: uuid10,
-  agent_id: uuid10,
+  seat_id: uuid11,
+  agent_id: uuid11,
   template_slug: external_exports.string(),
   status: external_exports.literal("live"),
   // false when a live agent already occupied the seat (idempotent re-install).
@@ -45027,7 +45152,7 @@ var softwareDeveloperTeamTokenBudgetSummarySchema = external_exports.object({
   set_by_install: external_exports.boolean()
 });
 var softwareDeveloperTeamGithubPolicySummarySchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   automation_mode_ceiling: softwareAutomationModeSchema,
   // false when a pre-existing policy was preserved (not created by this install).
   created: external_exports.boolean()
@@ -45055,8 +45180,8 @@ var softwareDeveloperTeamUninstallInputSchema = external_exports.object({
 }).strict();
 var softwareDeveloperTeamDecommissionedAgentSchema = external_exports.object({
   role: softwareDeveloperTeamRoleSchema.nullable(),
-  seat_id: uuid10,
-  agent_id: uuid10
+  seat_id: uuid11,
+  agent_id: uuid11
 });
 var softwareDeveloperTeamUninstallOutputSchema = external_exports.object({
   torn_down: external_exports.boolean(),
@@ -45206,8 +45331,8 @@ var forgeMemoryDraftArtifact = external_exports.object({
   follow_up_items: forgeArtifactList
 }).strict();
 var softwareGithubAutomationPolicyInputSchema = external_exports.object({
-  software_project_id: uuid10,
-  authority_profile_id: uuid10.nullable().optional(),
+  software_project_id: uuid11,
+  authority_profile_id: uuid11.nullable().optional(),
   automation_mode_ceiling: softwareAutomationModeSchema.default("plan_only"),
   allowed_actions: external_exports.array(softwareGithubActionSchema).max(20),
   // DER-1233: the element schema is a single FLATTENED enum (the union of the
@@ -45238,12 +45363,12 @@ var softwareGithubInstallationConnectInputSchema = external_exports.object({
   repositories: external_exports.array(softwareGithubConnectedRepositoryInputSchema).min(1).max(200)
 }).strict();
 var softwareGithubInstallationConnectOutputSchema = external_exports.object({
-  github_installation_id: uuid10,
+  github_installation_id: uuid11,
   repositories_connected: external_exports.number().int().nonnegative()
 });
 var softwareGithubRepositoryBindMappingSchema = external_exports.object({
   repository_id: external_exports.number().int().positive(),
-  software_project_id: uuid10
+  software_project_id: uuid11
 }).strict();
 var softwareGithubInstallationBindInputSchema = external_exports.object({
   app_slug: external_exports.string().trim().min(1).max(120).default("rost-forge"),
@@ -45251,7 +45376,7 @@ var softwareGithubInstallationBindInputSchema = external_exports.object({
   bindings: external_exports.array(softwareGithubRepositoryBindMappingSchema).min(1).max(100)
 }).strict();
 var softwareGithubInstallationBindOutputSchema = external_exports.object({
-  github_installation_id: uuid10,
+  github_installation_id: uuid11,
   repositories_bound: external_exports.number().int().nonnegative()
 });
 var softwareGithubRepositoryUnbindInputSchema = external_exports.object({
@@ -45272,12 +45397,12 @@ var softwareGithubInstallationRepositoryViewSchema = external_exports.object({
   private: external_exports.boolean(),
   default_branch: external_exports.string(),
   status: external_exports.enum(["connected", "active"]),
-  software_project_id: uuid10.nullable(),
+  software_project_id: uuid11.nullable(),
   software_project_name: external_exports.string().nullable(),
   software_project_slug: external_exports.string().nullable()
 });
 var softwareGithubInstallationViewSchema = external_exports.object({
-  id: uuid10,
+  id: uuid11,
   installation_id: external_exports.number().int().positive(),
   account_login: external_exports.string(),
   account_id: external_exports.number().int().positive(),
@@ -45289,16 +45414,16 @@ var softwareGithubInstallationListOutputSchema = external_exports.object({
   installations: external_exports.array(softwareGithubInstallationViewSchema)
 });
 var softwareGithubAutomationPolicyUpsertOutputSchema = external_exports.object({
-  policy_id: uuid10,
-  software_project_id: uuid10,
+  policy_id: uuid11,
+  software_project_id: uuid11,
   automation_mode_ceiling: softwareAutomationModeSchema
 });
 var softwareGithubInstallationTokenCreateInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   repository_id: external_exports.number().int().positive(),
   requested_actions: external_exports.array(softwareGithubActionSchema).min(1).max(20),
   requested_automation_mode: softwareAutomationModeSchema.default("plan_only"),
-  seat_id: uuid10.optional()
+  seat_id: uuid11.optional()
 }).strict();
 var softwareGithubInstallationTokenCreateOutputSchema = external_exports.object({
   installation_id: external_exports.number().int().positive(),
@@ -45335,13 +45460,13 @@ var softwareVercelConnectionConnectInputSchema = external_exports.object({
   scopes: external_exports.array(external_exports.string().trim().min(1).max(120)).max(40).default([])
 }).strict();
 var softwareVercelConnectionConnectOutputSchema = external_exports.object({
-  vercel_connection_id: uuid10,
+  vercel_connection_id: uuid11,
   account_id: external_exports.string(),
   team_id: external_exports.string().nullable()
 });
 var softwareVercelProjectLinkInputSchema = external_exports.object({
-  software_project_id: uuid10,
-  vercel_connection_id: uuid10,
+  software_project_id: uuid11,
+  vercel_connection_id: uuid11,
   vercel_project_id: external_exports.string().trim().min(1).max(200),
   vercel_project_name: external_exports.string().trim().min(1).max(255),
   framework: external_exports.string().trim().min(1).max(120).nullable().optional(),
@@ -45350,12 +45475,12 @@ var softwareVercelProjectLinkInputSchema = external_exports.object({
   git_repository: external_exports.record(external_exports.string().min(1), external_exports.unknown()).default({})
 }).strict();
 var softwareVercelProjectLinkOutputSchema = external_exports.object({
-  vercel_project_link_id: uuid10,
-  software_project_id: uuid10,
+  vercel_project_link_id: uuid11,
+  software_project_id: uuid11,
   vercel_project_id: external_exports.string()
 });
 var softwareVercelConnectionViewSchema = external_exports.object({
-  id: uuid10,
+  id: uuid11,
   account_id: external_exports.string(),
   account_name: external_exports.string().nullable(),
   team_id: external_exports.string().nullable(),
@@ -45366,11 +45491,11 @@ var softwareVercelConnectionViewSchema = external_exports.object({
   connected_at: external_exports.string()
 });
 var softwareVercelProjectLinkViewSchema = external_exports.object({
-  id: uuid10,
-  software_project_id: uuid10,
+  id: uuid11,
+  software_project_id: uuid11,
   software_project_name: external_exports.string(),
   software_project_slug: external_exports.string(),
-  vercel_connection_id: uuid10,
+  vercel_connection_id: uuid11,
   vercel_project_id: external_exports.string(),
   vercel_project_name: external_exports.string(),
   framework: external_exports.string().nullable(),
@@ -45384,16 +45509,16 @@ var softwareVercelProjectListOutputSchema = external_exports.object({
   project_links: external_exports.array(softwareVercelProjectLinkViewSchema)
 });
 var softwareVercelDeployPreviewInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  software_project_id: uuid11,
   commit_sha: external_exports.string().trim().regex(/^[A-Fa-f0-9]{7,64}$/),
   git_ref: external_exports.string().trim().min(1).max(255),
-  build_request_id: uuid10.optional(),
-  phase_run_id: uuid10.optional(),
-  seat_id: uuid10.optional(),
+  build_request_id: uuid11.optional(),
+  phase_run_id: uuid11.optional(),
+  seat_id: uuid11.optional(),
   required_secret_keys: external_exports.array(external_exports.string().trim().min(1).max(200)).max(25).default([])
 }).strict();
 var softwareVercelDeployPreviewOutputSchema = external_exports.object({
-  vercel_deployment_record_id: uuid10,
+  vercel_deployment_record_id: uuid11,
   deployment_id: external_exports.string(),
   deployment_url: external_exports.string().nullable(),
   commit_sha: external_exports.string(),
@@ -45401,18 +45526,18 @@ var softwareVercelDeployPreviewOutputSchema = external_exports.object({
 });
 
 // ../../packages/protocol/src/software-factory-events.ts
-var uuid11 = external_exports.string().uuid();
+var uuid12 = external_exports.string().uuid();
 var softwareFactoryPhaseRunCompletedEventSchema = external_exports.object({
-  tenantId: uuid11,
-  phaseRunId: uuid11,
-  buildRequestId: uuid11.nullish(),
+  tenantId: uuid12,
+  phaseRunId: uuid12,
+  buildRequestId: uuid12.nullish(),
   status: external_exports.enum(["passed", "failed"]),
   idempotencyKey: external_exports.string().min(1).optional()
 }).strict();
 var softwareFactoryBudgetExhaustedEventSchema = external_exports.object({
-  tenantId: uuid11,
-  phaseRunId: uuid11,
-  buildRequestId: uuid11,
+  tenantId: uuid12,
+  phaseRunId: uuid12,
+  buildRequestId: uuid12,
   reason: external_exports.string().min(1),
   idempotencyKey: external_exports.string().min(1).optional()
 }).strict();
@@ -47267,7 +47392,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.4",
+    version: "2026-07-13.6",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48058,6 +48183,15 @@ Forge Vercel access is through a tenant-bound OAuth connection, never a browser-
 
 Preview deployment creation is a governed command. \`software_factory.vercel.deploy_preview\` requires an active Vercel project link, a Vercel OAuth vault-ref connection, active \`deploy_preview\` Forge authority for the requesting seat when a seat is supplied, and any requested preview secret/config grants. It writes the deployment id, URL, commit SHA, checks, status, and error metadata into \`software_vercel_deployments\`; build-request deployments also write a Forge artifact and event. Raw OAuth tokens and vault refs are never returned.
 
+#### Secret broker grants (tenant-level)
+
+Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and stores the full \`Token <key>\` string as its vault secret.
+
+| Tool | Command | What it does | Scope | Notes |
+|---|---|---|---|---|
+| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access by vault ref (host, path prefix, methods, injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","vault_ref":"infisical://prod/baserow-token"}. |
+| \`rost_revoke_a_brokered_secret_grant\` | \`secret_grant.revoke\` | Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat egress immediately; the next broker call fails closed). Owner-only and human-gated. | Tenant-admin | Call with {"grant_id":"<grant-id>"}; non-interactive callers receive a confirmation handoff. |
+
 ### Seat-scoped operating tools
 
 Seat-scoped MCP tokens expose the operating protocol below. The server still checks the seat's permission manifest, Charter, task ownership, and tenant boundary. These are the **seat-token equivalents** of the CLI \`{{cli}} task\` / \`{{cli}} signal\` / \`{{cli}} friction\` wrappers and the tenant-admin task tools above: \`rost_get_tasks\`, \`{{cli}} task list\`, and \`task.list\` are the same operation reached three different ways. The command-id column makes the mapping explicit.
@@ -48078,6 +48212,8 @@ Seat-scoped MCP tokens expose the operating protocol below. The server still che
 | \`rost_attach_agent_deliverable\` | \`deliverable.attach\` | Attach a scrubbed deliverable to a source run, task, or work order after server-side seat validation. | Seat | Call with title, kind, and the source ids that belong to the acting seat. |
 | \`rost_request_a_forge_secret_grant\` | \`software_factory.secret.request\` | Request access to a project secret by key. It creates a durable credential request and approval Task, never accepts a secret value, and does not grant access by itself. | Seat | Call with \`{"software_project_id":"<project-id>","environment":"preview","seat_id":"<seat-id>","action":"test.run","key_name":"OPENAI_API_KEY"}\`. |
 | \`rost_verify_forge_secret_broker_access\` | \`software_factory.secret.use\` | Verify broker authorization for a Forge secret without opening the vault. Missing grants create or reuse a credential request + approval Task; allowed grants return a redacted authorization summary only. Runtime vault use happens runner-side. | Seat | Call with \`{"software_project_id":"<project-id>","environment":"preview","seat_id":"<seat-id>","action":"test.run","key_name":"OPENAI_API_KEY","operation":"test_execution"}\`. |
+| \`rost_request_a_brokered_secret_grant\` | \`secret_grant.request\` | A seat agent requests a scoped brokered-secret grant (for secret.broker / baserow.*) by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret and no vault ref; returns an event id for a human to grant via secret_grant.grant. | Seat | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET"],"scope_tier":"read"}. |
+| \`rost_list_brokered_secret_grants\` | \`secret_grant.list\` | List the seat's own brokered secret grants. Returns egress allowlist metadata only (host, path prefix, methods, scope, status), never the vault ref or any secret. | Seat | Call with {} (an agent is server-pinned to its own seat). |
 | \`rost_record_forge_conformance_findings\` | \`software_factory.conformance.record_findings\` | A Forge review seat (plan conformance, security, or QA) records structured findings as reviewer evidence. Set \`changeset_id\` on a finding that targets a specific changeset. Open findings route the request back to implementation; accepting a gap remains a separate human gate. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","findings":[{"severity":"major","category":"scope_gap","summary":"Missing migration verification","changeset_id":"<changeset-id>"}]}\`. |
 | \`rost_resolve_forge_conformance_finding\` | \`software_factory.conformance.resolve_finding\` | A Forge review seat marks a prior open finding resolved after re-reviewing the changeset and verifying it is fixed (reviewer verification, not human gap-acceptance). A resolved finding stops routing the request back to implementation, so the recycle loop converges. Requires the seat's signed manifest grant. | Seat | Call with \`{"build_request_id":"<request-id>","finding_ids":["<finding-id>"]}\`. |
 
@@ -51336,6 +51472,10 @@ var COMMAND_MANIFEST = [
   { "id": "seat.rename", "namespace": "seat", "action": "rename", "title": "Rename seat", "description": "Rename a Responsibility Graph seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "name", "flag": "name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Seat names should describe the function and accountability clearly." },
   { "id": "seat.reparent", "namespace": "seat", "action": "reparent", "title": "Reparent seat", "description": "Move a Responsibility Graph seat under a new parent.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "new_parent_seat_id", "flag": "new-parent-seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reparent seats only when it clarifies accountable structure and preserves a clean graph." },
   { "id": "seat.set_type", "namespace": "seat", "action": "set_type", "title": "Set seat type", "description": "Set a Responsibility Graph seat type.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "seat_type", "flag": "seat-type", "type": "enum", "required": true, "enumValues": ["human", "agent", "hybrid"] }], "hasComplexInput": false, "help": "Seat type should follow the work, risk, measurable, and stewardship model." },
+  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by VAULT REF (host + path prefix + methods + scope + injection). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
+  { "id": "secret_grant.list", "namespace": "secret_grant", "action": "list", "title": "List brokered secret grants", "description": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only (host, path prefix, methods, scope, status) \u2014 never the vault ref or any secret. An agent sees only its own seat's grants.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only \u2014 host, path prefix, methods, scope, status \u2014 never the vault ref or any secret." },
+  { "id": "secret_grant.request", "namespace": "secret_grant", "action": "request", "title": "Request a brokered secret grant", "description": "An agent or user REQUESTS a scoped brokered-secret grant by naming the egress it needs (grant key, host, path prefix, methods, scope). No secret and no vault ref are ever accepted (invariant #5) \u2014 this only records a durable ask for a human to grant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "An agent or user requests a brokered-secret egress grant by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret or vault ref is accepted; a human grants it." },
+  { "id": "secret_grant.revoke", "namespace": "secret_grant", "action": "revoke", "title": "Revoke a brokered secret grant", "description": "Revoke a brokered secret grant \u2014 a compromised or over-scoped seat's egress access can be cut immediately; the next broker call resolves no grant and fails closed. Owner-only, human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat's egress immediately; the next broker call fails closed). Owner-only and human-gated." },
   { "id": "settings.agent_policy.get", "namespace": "settings", "action": "agent_policy.get", "title": "Get company autonomy ceiling", "description": "Read this company's Company Guardrails ceiling (ADR-0007): the profile, enforcement mode, and the most an agent may do autonomously (max_autonomous_risk). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's autonomy ceiling (Company Guardrails, ADR-0007): profile, enforcement mode, and the most an agent may do autonomously." },
   { "id": "settings.agent_policy.update", "namespace": "settings", "action": "agent_policy.update", "title": "Set company autonomy ceiling", "description": "Set the Company Guardrails ceiling (ADR-0007): a named profile (locked_down, balanced, high_autonomy) or custom + max_autonomous_risk. Tenant-admin and human-gated. An explicitly set ceiling is ENFORCED by default; pass enforcement=observe to stage a change without blocking.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "profile", "flag": "profile", "type": "enum", "required": true, "enumValues": ["locked_down", "balanced", "high_autonomy", "custom"] }, { "name": "max_autonomous_risk", "flag": "max-autonomous-risk", "type": "enum", "required": false, "enumValues": ["low", "medium", "high", "critical"] }, { "name": "enforcement", "flag": "enforcement", "type": "enum", "required": false, "enumValues": ["observe", "enforce"] }], "hasComplexInput": false, "help": "Set the company autonomy ceiling: a profile (locked_down, balanced, high_autonomy) or custom + max_autonomous_risk. Owner-only, human-gated, and enforced by default." },
   { "id": "settings.confirmation_policy.get", "namespace": "settings", "action": "confirmation_policy.get", "title": "Get CLI confirmation mode", "description": "Read this company's CLI confirmation mode (DER-1490): careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's CLI confirmation mode: careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations)." },