@rosthq/cli 0.7.78 → 0.7.80

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAiQ3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAkQ3D,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwRnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAOA,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAwBrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAK1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAcF,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;CACnD,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0RnG;AA0hBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -42527,6 +42527,20 @@ var credentialIngressOutputSchema = external_exports.object({
   provider: external_exports.string().min(1),
   seat_id: uuidSchema11.nullable()
 }).strict();
+var credentialListInputSchema = external_exports.object({}).strict();
+var credentialSummarySchema = external_exports.object({
+  credential_id: uuidSchema11,
+  provider: external_exports.string(),
+  scope_description: external_exports.string(),
+  seat_id: uuidSchema11.nullable(),
+  status: external_exports.string(),
+  created_at: external_exports.string(),
+  rotated_at: external_exports.string(),
+  revoked_at: external_exports.string().nullable()
+}).strict();
+var credentialListOutputSchema = external_exports.object({
+  credentials: external_exports.array(credentialSummarySchema)
+}).strict();
 var agentGoLiveInputSchema = external_exports.object({
   seat_id: uuidSchema11,
   charter_version_id: uuidSchema11
@@ -44220,6 +44234,11 @@ var READ_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 var brokerScopeTierSchema = external_exports.enum(["read", "write"]);
 var brokerInjectionModeSchema = external_exports.enum(["header_bearer", "header", "query"]);
 var brokerInjectionNameSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "injection_name may contain only letters, digits, . _ -");
+var brokerInjectionPrefixSchema = external_exports.string().min(1).max(32).refine((value) => ![...value].some((ch) => ch.charCodeAt(0) < 32 || ch.charCodeAt(0) === 127), {
+  message: "injection_prefix must not contain control characters"
+}).refine((value) => !hasSecretShapedValue(value), {
+  message: 'injection_prefix must be config (e.g. "Token "), never raw secret material'
+});
 var brokerAllowedMethodsSchema = external_exports.array(brokerHttpMethodSchema).min(1, "at least one allowed method is required").max(7).refine((methods) => new Set(methods).size === methods.length, { message: "allowed_methods must not contain duplicates" });
 var brokerGrantStatusSchema = external_exports.enum(["active", "revoked"]);
 function refineGrantShape(value, ctx) {
@@ -44251,8 +44270,13 @@ var secretGrantRequestOutputSchema = external_exports.object({
 var secretGrantGrantInputSchema = external_exports.object({
   seat_id: uuid10,
   grant_key: brokerGrantKeySchema,
-  // POINTER only. The vault-ref refinement rejects any raw-secret value.
-  vault_ref: brokerVaultRefSchema,
+  // Supply EXACTLY ONE of `vault_ref` or `credential_id` (DER-1777):
+  //  - `vault_ref`: the POINTER directly. The vault-ref refinement rejects any raw-secret value.
+  //  - `credential_id`: an existing tenant `credentials` row (from `credential.list` /
+  //    `credential.ingress` output); the command resolves its vault_ref server-side, so a human
+  //    never has to handle a ref. Both keep invariant #5 (Postgres stores only pointers).
+  vault_ref: brokerVaultRefSchema.optional(),
+  credential_id: uuid10.optional(),
   provider: brokerProviderSchema,
   allowed_host: brokerAllowedHostSchema,
   allowed_path_prefix: brokerAllowedPathPrefixSchema.optional(),
@@ -44260,9 +44284,29 @@ var secretGrantGrantInputSchema = external_exports.object({
   scope_tier: brokerScopeTierSchema,
   injection_mode: brokerInjectionModeSchema.default("header_bearer"),
   injection_name: brokerInjectionNameSchema.optional(),
+  // DER-1785: prepended to the secret for header/query grants; invalid for
+  // header_bearer (whose `Bearer ` prefix is implicit — see the refine below).
+  injection_prefix: brokerInjectionPrefixSchema.optional(),
   // ISO-8601; absent = no expiry.
   expires_at: external_exports.string().datetime({ offset: true }).optional()
-}).strict().superRefine((value, ctx) => refineGrantShape(value, ctx));
+}).strict().superRefine((value, ctx) => {
+  refineGrantShape(value, ctx);
+  const provided = [value.vault_ref, value.credential_id].filter((v) => v !== void 0).length;
+  if (provided !== 1) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["credential_id"],
+      message: "provide exactly one of vault_ref or credential_id"
+    });
+  }
+  if (value.injection_mode === "header_bearer" && value.injection_prefix !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["injection_prefix"],
+      message: "injection_prefix is not valid for header_bearer mode (its Bearer prefix is implicit)"
+    });
+  }
+});
 var secretGrantGrantOutputSchema = external_exports.object({
   grant_id: uuid10,
   seat_id: uuid10,
@@ -44288,6 +44332,7 @@ var secretGrantSummarySchema = external_exports.object({
   scope_tier: brokerScopeTierSchema,
   injection_mode: brokerInjectionModeSchema,
   injection_name: external_exports.string().nullable(),
+  injection_prefix: external_exports.string().nullable(),
   status: brokerGrantStatusSchema,
   granted_by_user_id: uuid10,
   granted_at: external_exports.string(),
@@ -46734,7 +46779,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-13.2",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -46825,6 +46870,8 @@ Agent creation at \`/agents/new\` begins with four doors: **Describe the job** o
 
 Agent seat pages show the operator-facing output trail, not just low-level run telemetry. The completed work area combines explicit \`agent_deliverables\`, successful \`work.log\` evidence, and recent successful run summaries into one readable list. Each item shows what was delivered, when it happened, what kind of work it was, and safe evidence links labelled as internal, Linear, GitHub, or external. Secret-shaped values are redacted before display, and run or task context is shown only when it belongs to the same seat. Forge artifact batches can also carry a metadata-only integrity verdict so duplicate hashes, zero-byte files, size outliers, and manifest count mismatches are visible without exposing file contents.
 
+The **Activity** tab layers a curated business-activity narrative above the Trust Card's forensic execution trace: period-scoped counter tiles (today, this week, or 30 days) summarise the seat's \`work.record\` activity by kind \u2014 a "held for your approval" tile is always shown, and an operator can pick which other kinds appear via a per-seat, browser-local tile picker. Below the tiles, a run-grouped activity feed lists each \`work.list\` record \u2014 verb, object, outcome, evidence link, and time \u2014 with a drill-down for entity refs, the \`template_ref\` used for external comms when one was recorded, and the raw structured details. A sessions browser lists the seat's runs and, for the selected one, its persisted transcript (\`session_transcripts\`) and artifacts rail: binary artifacts (Supabase Storage) get a freshly minted 60-second signed download link at render time, pointer artifacts (Gmail draft, Drive doc, PR, or an internal reference) link out when an external URL is known. The task queue and Trust Card below are unchanged. All of this sits behind the same sensitive-data access gate as the Trust Card; a restricted viewer sees an explicit unavailable state, never a guessed empty feed. The \`/agents\` fleet page mirrors the same row grammar in a tenant-wide **Work** view \u2014 every seat's activity in one filterable stream, each row linking back to that seat's Activity tab with the originating session focused.
+
 ## Read a human seat's page
 
 A human seat's page opens on one computed answer line \u2014 for example "On track \u2014 4 of 5 measurables on target \xB7 1 held draft awaiting review" \u2014 instead of a wall of always-shown sections. Below it:
@@ -46971,7 +47018,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47030,7 +47077,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
 - Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
-- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card.
+- Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include a \`denied_tool_call_count\` rollup \u2014 the actions held because they exceeded the charter. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
 
@@ -47299,7 +47346,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-07-04.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -47397,7 +47444,7 @@ Beyond each seat's own manifest, the company can set one ceiling on how much an
 
 ## What humans should review
 
-The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule. Seat pages render legacy Charter manifest scope text with customer-safe labels when old setup data used internal placeholder wording.
+The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. The same seat's Activity tab also shows a curated business-activity ledger (counter tiles plus a run-grouped \`work.record\` feed) and a sessions browser with the full persisted transcript and artifacts for the selected run \u2014 a layer above the Trust Card's forensic trace, not a replacement for it. The fleet page's own **Work** tab mirrors that ledger across every seat in one filterable, seat-labelled stream. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule. Seat pages render legacy Charter manifest scope text with customer-safe labels when old setup data used internal placeholder wording.
 
 Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat.
 
@@ -47410,7 +47457,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -47466,6 +47513,8 @@ The native Gmail handlers run inside the same broker boundary as the REST and Sl
 
 Google can be connected from Settings once the workspace OAuth app is configured. The connection flow requests offline access for Gmail read/compose/send and Sheets, stores the returned credential in the vault, and records only account, scope, and capability-availability metadata in the integration row. Partial grants are accepted when at least one connector capability is usable; missing or revoked scopes reduce the affected capability instead of granting more authority. The test action refreshes the vaulted credential and performs a minimal Gmail profile read. Gmail read/draft/send, bounded Sheets read, and approval-held Sheets write handlers run through the guarded broker when Google is connected; connecting Google still does not bypass the signed Charter manifest, tenant policy ceiling, credential vault, or tool-call audit. Sheet grants should use exact signed argument bindings for approved spreadsheet ids and ranges.
 
+A connected Baserow REST integration (\`integration.connect_rest\`) derives a \`baserow.read\` tenant capability ceiling the same way: a live connection surfaces read, and a disconnected/revoked one collapses to off. The derivation is read-only by design \u2014 \`baserow.write\` is never inferred from the connection and is granted only through an explicit per-seat brokered secret grant, matching the conservative-by-default rule for every connection-backed ceiling.
+
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
 \`integration.connect_rest\` creates or rotates the supported Baserow REST integration through the credential flow. It stores the token in the vault, persists only endpoint/account metadata plus a tenant-scoped integration row, marks the adapter as \`rest\`, and returns no vault ref or secret. Because the input includes a raw secret, generated CLI argv refuses the command and it is deliberately not exposed as an agent-callable MCP tool; run it from Settings or the command API credential flow instead of shell arguments.
@@ -47556,7 +47605,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.7",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48349,12 +48398,13 @@ Preview deployment creation is a governed command. \`software_factory.vercel.dep
 
 #### Secret broker grants (tenant-level)
 
-Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and stores the full \`Token <key>\` string as its vault secret.
+Generalized brokered-secret egress beyond Forge (DER-1738). A human grants an agent seat a scoped secret the \`secret.broker\` egress tool and the \`baserow.read\`/\`baserow.write\` tools (DER-1739) resolve server-side; Postgres stores only a vault-ref pointer, never secret material. A seat agent asks for and lists its own grants through the seat-scoped \`secret_grant.request\` / \`secret_grant.list\` tools (in Seat-scoped operating tools below); a human grants and revokes here. To grant, pass \`credential_id\` (from \`credential.list\`, DER-1777) instead of a raw \`vault_ref\` \u2014 the command resolves the ref server-side so no product flow ever exposes it. Baserow authenticates with an \`Authorization: Token <key>\` header, so a Baserow grant uses \`injection_mode: "header"\`, \`injection_name: "Authorization"\`, and \`injection_prefix: "Token "\` (DER-1785) \u2014 the broker prepends the prefix to the raw key at render time, so the credential's vault secret stays the RAW key and granting it by \`credential_id\` renders \`Authorization: Token <key>\` correctly. (\`injection_prefix\` is non-secret config, capped at 32 chars, rejects control characters, and is invalid for \`injection_mode: "header_bearer"\`, whose \`Bearer \` prefix is implicit.) Older grants that instead stored the full \`Token <key>\` string as the vault secret with no prefix still work \u2014 the broker injects that verbatim.
 
 | Tool | Command | What it does | Scope | Notes |
 |---|---|---|---|---|
-| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access by vault ref (host, path prefix, methods, injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","vault_ref":"infisical://prod/baserow-token"}. |
+| \`rost_grant_a_brokered_secret\` | \`secret_grant.grant\` | A human grants a seat scoped brokered-secret access. Supply exactly one of credential_id (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side, so a human never handles a ref) or vault_ref directly. Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker and baserow.* tools resolve it server-side and the secret never enters agent context. | Tenant-admin | Call with {"seat_id":"<seat-id>","grant_key":"baserow","provider":"baserow","allowed_host":"baserow.example.com","allowed_path_prefix":"/api/database/rows/","allowed_methods":["GET","POST","PATCH"],"scope_tier":"write","injection_mode":"header","injection_name":"Authorization","injection_prefix":"Token ","credential_id":"<credential-id>"} (or "vault_ref":"infisical://prod/baserow-token" instead of credential_id). injection_prefix is optional; use it (DER-1785) when the credential stores a RAW key so the broker renders "Token <key>". |
 | \`rost_revoke_a_brokered_secret_grant\` | \`secret_grant.revoke\` | Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat egress immediately; the next broker call fails closed). Owner-only and human-gated. | Tenant-admin | Call with {"grant_id":"<grant-id>"}; non-interactive callers receive a confirmation handoff. |
+| \`rost_list_stored_credentials\` | \`credential.list\` | List the tenant's stored credentials as metadata only \u2014 credential id, provider, label, seat, status, and created/rotated/revoked dates. NEVER returns the vault ref or any secret. Use the returned credential_id with secret_grant.grant. | Tenant-admin | Call with {}. |
 
 ### Seat-scoped operating tools
 
@@ -49208,7 +49258,7 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-13.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -49256,7 +49306,7 @@ Approval replays are validated again before execution. If the stored confirmatio
 
 ## The approvals queue
 
-The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act.
+The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations with open steward escalations into a single queue, each item shown with its risk, the source seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy and escalations routed to their steward chain, and nothing else. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
 ## The rule for agents
 
@@ -49380,7 +49430,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-11.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -49403,7 +49453,7 @@ Start with members and invites, then provider and channel connections, then MCP
 
 ## Navigating Settings
 
-Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
+Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Any other \`integrations\` row \u2014 e.g. a Baserow REST/custom connection created through \`integration.connect_rest\` \u2014 renders as a generic connection card alongside the stock providers, so a non-stock connector is never invisible on this page. Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
 
 Section state is fully server-side: every in-app link, redirect, and save uses \`?section=<id>\`, never a \`#anchor\` \u2014 there is no client-side hash shim to desync from. Documented shortcut pages redirect straight to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` redirect to \`?section=connections\` (connector readiness lives inside the Connections overview, not on a standalone page), \`/settings/members\` redirects to \`?section=members\`, \`/settings/policy\` redirects to \`?section=guardrails\`, and MCP/CLI access tokens live in the Agent access tokens section (not a separate \`/mcp\` page \u2014 \`/mcp\` is the MCP protocol endpoint itself, not a browsable settings screen). The Advanced group links out to \`/migration/ninety\`, the one settings-adjacent page with no home in the grouped rail. Every settings form carries the section it lives in, so saving a change redirects back to that same section with no flash, instead of returning to the top.
 
@@ -49542,7 +49592,7 @@ When a user asks to add a person, clarify whether they mean app access, seat occ
     order: 74,
     title: "Notifications guide",
     summary: "How {{brand}} should notify humans about decisions, escalations, stale work, and agent boundaries.",
-    version: "2026-07-09.1",
+    version: "2026-07-14.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -49573,6 +49623,10 @@ Notifications should move decisions to the right human without turning {{brand}}
 
 \`{{cli}} notification errors --limit 10\` / \`notification.list_errors\` / \`rost_list_notification_errors\` returns recent failed deliveries. When a failed notification links to a product error, it includes \`error_log_id\`, \`source\`, and any linked \`seat_id\` / \`run_id\`; \`source=run\` means the notification is tied to an agent run and can be followed with \`agent.get_run\` for the transcript reference and run errors.
 
+## Telegram channel
+
+Telegram is an opt-in delivery channel that sits alongside email. A workspace admin connects a Telegram bot once (create it with @BotFather, paste the token in Settings \u2192 Notifications; the token is stored in the vault as a credential reference, never in env or logs). Each person then opts in from the same page: {{brand}} shows a one-time deep link, you start the bot, and {{brand}} verifies your chat. Once verified, held approvals, escalations, briefs, and the daily digest are delivered to Telegram, with email as the fallback. Messages are bounded and secret-free and link back to the relevant {{brand}} item. Opt out any time from Settings \u2192 Notifications.
+
 ## Keep notifications useful
 
 Every notification should include the seat, cause, evidence, and requested decision. Avoid status-only messages when no action is needed.`
@@ -51563,6 +51617,7 @@ var COMMAND_MANIFEST = [
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
   { "id": "confirmation.remint", "namespace": "confirmation", "action": "remint", "title": "Re-mint an expired confirmation", "description": "Stage a fresh confirmation for the same command as an expired one, re-running the normal minting authorization checks.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-mint an expired confirmation into a fresh one before approving, instead of re-running the original command from scratch." },
   { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
+  { "id": "credential.list", "namespace": "credential", "action": "list", "title": "List stored credentials", "description": "List the tenant's stored credentials as metadata only \u2014 credential id, provider, label, seat, status, and created/rotated/revoked dates. NEVER returns the vault ref or any secret. Use the returned credential_id with secret_grant.grant to grant a seat brokered access without ever handling a raw ref.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List stored-credential metadata (id, provider, label, status, dates) to find the credential_id for secret_grant.grant. Never returns the vault ref or any secret." },
   { "id": "deliverable.accept", "namespace": "deliverable", "action": "accept", "title": "Accept deliverable value", "description": "Record a human-confirmed accepted value (USD) on a deliverable. Humans decide; agents cannot self-accept. Re-accepting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "impact_value_usd", "flag": "impact-value-usd", "type": "number", "required": true }], "hasComplexInput": false, "help": "Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event." },
   { "id": "deliverable.attach", "namespace": "deliverable", "action": "attach", "title": "Attach agent deliverable", "description": "Attach a deliverable to a source run, task, or work order for the acting seat. Source refs are validated server-side.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "run_id", "flag": "run-id", "type": "string", "required": false }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }, { "name": "work_order_id", "flag": "work-order-id", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }], "hasComplexInput": true, "help": "Attach a scrubbed deliverable to a source run, task, or work order that belongs to the acting seat." },
   { "id": "deliverable.create", "namespace": "deliverable", "action": "create", "title": "Create agent deliverable", "description": "Create an agent deliverable for the acting seat. The deliverable is scrubbed for secrets before storage.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }, { "name": "delivered_at", "flag": "delivered-at", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a scrubbed durable work output for the acting seat without making a durable company decision." },
@@ -51638,7 +51693,7 @@ var COMMAND_MANIFEST = [
   { "id": "seat.rename", "namespace": "seat", "action": "rename", "title": "Rename seat", "description": "Rename a Responsibility Graph seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "name", "flag": "name", "type": "string", "required": true }], "hasComplexInput": false, "help": "Seat names should describe the function and accountability clearly." },
   { "id": "seat.reparent", "namespace": "seat", "action": "reparent", "title": "Reparent seat", "description": "Move a Responsibility Graph seat under a new parent.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "new_parent_seat_id", "flag": "new-parent-seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Reparent seats only when it clarifies accountable structure and preserves a clean graph." },
   { "id": "seat.set_type", "namespace": "seat", "action": "set_type", "title": "Set seat type", "description": "Set a Responsibility Graph seat type.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "seat_type", "flag": "seat-type", "type": "enum", "required": true, "enumValues": ["human", "agent", "hybrid"] }], "hasComplexInput": false, "help": "Seat type should follow the work, risk, measurable, and stewardship model." },
-  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by VAULT REF (host + path prefix + methods + scope + injection). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
+  { "id": "secret_grant.grant", "namespace": "secret_grant", "action": "grant", "title": "Grant a brokered secret", "description": "A human grants a seat scoped access to a brokered secret by CREDENTIAL ID (from credential.list / credential.ingress \u2014 resolved to its vault ref server-side) or by VAULT REF directly (exactly one). Postgres stores only the pointer \u2014 never secret material (invariant #5). Owner-only, human-gated. The secret.broker/baserow.* tools resolve this grant server-side; the secret never enters agent context.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "vault_ref", "flag": "vault-ref", "type": "string", "required": false }, { "name": "credential_id", "flag": "credential-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "injection_mode", "flag": "injection-mode", "type": "enum", "required": false, "enumValues": ["header_bearer", "header", "query"] }, { "name": "injection_name", "flag": "injection-name", "type": "string", "required": false }, { "name": "injection_prefix", "flag": "injection-prefix", "type": "string", "required": false }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }], "hasComplexInput": false, "help": "A human grants a seat a scoped brokered secret by vault ref (host + path prefix + methods + injection). Postgres stores only the pointer, never secret material. Owner-only and human-gated; the secret.broker/baserow.* tools resolve it server-side." },
   { "id": "secret_grant.list", "namespace": "secret_grant", "action": "list", "title": "List brokered secret grants", "description": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only (host, path prefix, methods, scope, status) \u2014 never the vault ref or any secret. An agent sees only its own seat's grants.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "include_revoked", "flag": "include-revoked", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List brokered secret grants for the tenant (or one seat). Returns the egress allowlist metadata only \u2014 host, path prefix, methods, scope, status \u2014 never the vault ref or any secret." },
   { "id": "secret_grant.request", "namespace": "secret_grant", "action": "request", "title": "Request a brokered secret grant", "description": "An agent or user REQUESTS a scoped brokered-secret grant by naming the egress it needs (grant key, host, path prefix, methods, scope). No secret and no vault ref are ever accepted (invariant #5) \u2014 this only records a durable ask for a human to grant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "grant_key", "flag": "grant-key", "type": "string", "required": true }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "allowed_host", "flag": "allowed-host", "type": "string", "required": true }, { "name": "allowed_path_prefix", "flag": "allowed-path-prefix", "type": "string", "required": false }, { "name": "allowed_methods", "flag": "allowed-methods", "type": "array", "required": true, "itemType": "string" }, { "name": "scope_tier", "flag": "scope-tier", "type": "enum", "required": true, "enumValues": ["read", "write"] }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "An agent or user requests a brokered-secret egress grant by naming the host, path prefix, methods, and scope it needs. Draft-and-confirm: no secret or vault ref is accepted; a human grants it." },
   { "id": "secret_grant.revoke", "namespace": "secret_grant", "action": "revoke", "title": "Revoke a brokered secret grant", "description": "Revoke a brokered secret grant \u2014 a compromised or over-scoped seat's egress access can be cut immediately; the next broker call resolves no grant and fails closed. Owner-only, human-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Revoke a brokered secret grant (teardown \u2014 cut a compromised or over-scoped seat's egress immediately; the next broker call fails closed). Owner-only and human-gated." },
@@ -57958,7 +58013,7 @@ async function main(argv = process.argv.slice(2), options = {}) {
   const refreshSession = options.refreshSession ?? refreshCliSessionIfNeeded;
   const [rawCommand, ...args] = argv;
   const command = rawCommand === "--help" || rawCommand === "-h" ? "help" : rawCommand;
-  if (isSecretBlockedNamespace(command)) {
+  if (isSecretBlockedNamespace(command) || isSecretBlockedCommand(args[0] === void 0 ? void 0 : `${command}.${args[0]}`)) {
     io.stderr.write(`${SECRET_ARGV_GUIDANCE}
 `);
     return 1;