@foldrun/core 0.2.0

package/dist/src/script-tools.js

@@ -0,0 +1,296 @@
+// Scripts declared as tools. An agent that writes
+//
+//   scripts:
+//     - name: ads_summary
+//       run: scripts/summary.py
+//       description: Pull campaign performance for the account.
+//       args:
+//         customer_id: The Google Ads customer id
+//
+// gets a real tool called `ads_summary(customer_id)` — no bash needed. The
+// platform spawns the script with the declared args as CLI flags, injects the
+// agent's secrets as environment variables, and returns stdout.
+//
+// This is safer than granting `bash`: the agent can only run the scripts you
+// declared, with the arguments you declared, and never composes a shell line.
+import path from "node:path";
+import fs from "node:fs";
+import { spawn } from "node:child_process";
+import { z } from "zod";
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { runInContainer } from "./container.js";
+// A script's only clock is the `timeout:` its own tool.md declares. There
+// was a two-minute default and a ten-minute cap here; both were the
+// platform's opinion about how long a person's script may take, and the
+// deploy watcher had to be taught to call its tool four times to outlast the
+// cap. The platform orchestrates; it does not decide that.
+const timeoutFor = (spec) => (spec.timeout ? spec.timeout * 1000 : undefined);
+const MAX_OUTPUT = 20_000;
+export function parseScripts(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const e = entry;
+        const name = typeof e.name === "string" ? e.name : null;
+        const run = typeof e.run === "string" ? e.run : null;
+        const code = typeof e.code === "string" ? e.code : null;
+        if (!name || (!run && !code))
+            continue;
+        const args = {};
+        if (e.args && typeof e.args === "object" && !Array.isArray(e.args)) {
+            for (const [k, v] of Object.entries(e.args)) {
+                if (/^[a-z][a-z0-9_]*$/i.test(k))
+                    args[k] = String(v);
+            }
+        }
+        const timeout = Number(e.timeout);
+        out.push({
+            name: name.replace(/[^a-zA-Z0-9_]/g, "_"),
+            run: run ?? "",
+            ...(code ? { code, codeExt: typeof e.codeExt === "string" ? e.codeExt : ".mjs" } : {}),
+            description: typeof e.description === "string" ? e.description : "",
+            args,
+            interpreter: typeof e.interpreter === "string" ? e.interpreter : undefined,
+            secrets: e.secrets === "proxied" ? "proxied" : undefined,
+            timeout: Number.isFinite(timeout) && timeout > 0 ? timeout : undefined,
+        });
+    }
+    return out;
+}
+// Pick how to execute a file when no interpreter is declared.
+//
+// Exported because the tool tester has to make the same choice, and used to
+// make it from its own shorter table — which knew .js but not .mjs, so the
+// Test button spawned every .mjs tool as a program and reported EACCES for a
+// tool that runs perfectly. Two tables, one of them wrong.
+export function commandFor(spec, abs, overrides = {}) {
+    if (spec.interpreter)
+        return { cmd: spec.interpreter, args: [abs] };
+    const ext = path.extname(abs).toLowerCase();
+    // A prepared runtime (venv, npm prefix) wins over the host interpreter.
+    if (overrides[ext])
+        return { cmd: overrides[ext], args: [abs] };
+    const byExt = {
+        ".py": "python3",
+        ".sh": "bash",
+        ".js": "node",
+        ".mjs": "node",
+        ".ts": "node",
+        ".rb": "ruby",
+    };
+    const interp = byExt[ext];
+    return interp ? { cmd: interp, args: [abs] } : { cmd: abs, args: [] };
+}
+// Inside the image the interpreter is the distro's, not a host venv path.
+function containerInterpreter(abs) {
+    const byExt = {
+        ".py": "python3",
+        ".sh": "bash",
+        ".js": "node",
+        ".mjs": "node",
+        ".ts": "node",
+        ".rb": "ruby",
+    };
+    return byExt[path.extname(abs).toLowerCase()] ?? abs;
+}
+function runScript(cwd, spec, values, env, libraryScripts, interpreters, exec) {
+    // An inline-code tool has no file yet: write it inside the agent's own
+    // directory — already an allowed root — and run it like any other script.
+    // Materialised per call rather than per build, so an edit to the tool's
+    // markdown is live on the next call with nothing to clean up but one file.
+    if (!spec.run && spec.code) {
+        const dir = path.join(cwd, ".tool-code");
+        fs.mkdirSync(dir, { recursive: true });
+        const file = path.join(dir, `${spec.name}${spec.codeExt ?? ".mjs"}`);
+        fs.writeFileSync(file, spec.code, { mode: 0o755 });
+        spec = { ...spec, run: `.tool-code/${spec.name}${spec.codeExt ?? ".mjs"}` };
+    }
+    return new Promise((resolve) => {
+        // Confine to the agent's own directory plus the workspace it belongs to.
+        // The workspace root is allowed because `shared/` resolves to
+        // <workspace>/scripts — a virtual prefix expanded at resolve time, not a
+        // symlink on disk. (Symlinking it was tried and reverted: the link
+        // recursed into the workspace's own file listing.)
+        const abs = resolveRunPath(cwd, spec.run, libraryScripts);
+        const workspaceRoot = path.resolve(cwd, "..", "..");
+        // The library's tools/ as well as its scripts/: a folder tool installed at
+        // the account keeps its code beside its definition, which is one directory
+        // over from where shared scripts live. Without it the containment check
+        // refuses an account tool the resolver just found.
+        const libraryTools = libraryScripts ? path.resolve(libraryScripts, "..", "tools") : "";
+        const allowedRoots = [path.resolve(cwd), workspaceRoot, libraryScripts, libraryTools]
+            .filter(Boolean)
+            .map((p) => {
+            try {
+                return fs.realpathSync(p);
+            }
+            catch {
+                return p;
+            }
+        });
+        let real;
+        try {
+            real = fs.realpathSync(abs);
+        }
+        catch {
+            return resolve({ code: null, out: `script not found: ${spec.run}` });
+        }
+        // Containment, not a string prefix. `startsWith` called
+        // `<workspace>-attacker/steal.py` a path inside `<workspace>`, because it
+        // is — as text. The question is whether one path is under another, and
+        // only path.relative answers that.
+        const within = (root) => {
+            const rel = path.relative(root, real);
+            return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+        };
+        if (!allowedRoots.some(within)) {
+            return resolve({ code: null, out: `script path escapes the workspace: ${spec.run}` });
+        }
+        const { cmd, args } = commandFor(spec, abs, interpreters);
+        // Declared args become long flags: --customer_id 123
+        for (const key of Object.keys(spec.args)) {
+            if (values[key] !== undefined && values[key] !== "") {
+                args.push(`--${key}`, values[key]);
+            }
+        }
+        // Container path: same command, executed inside an isolated container
+        // with only the agent's directory (plus declared shared dirs) mounted.
+        if (exec && exec.executor === "docker") {
+            const inContainer = (p) => {
+                if (p.startsWith(path.resolve(cwd)))
+                    return p.replace(path.resolve(cwd), "/workspace");
+                for (const [host, mount] of Object.entries(exec.mounts)) {
+                    if (p.startsWith(host))
+                        return p.replace(host, mount);
+                }
+                return p;
+            };
+            const argv = [
+                // The interpreter inside the image, not the host's venv path.
+                spec.interpreter ?? containerInterpreter(abs),
+                ...args.map(inContainer),
+            ].filter(Boolean);
+            // Drop the host interpreter that commandFor prepended, if any.
+            if (argv[1] === argv[0])
+                argv.splice(1, 1);
+            runInContainer({
+                agentDir: path.resolve(cwd),
+                readOnly: exec.mounts,
+                image: exec.image,
+                argv,
+                env,
+                timeoutMs: timeoutFor(spec),
+                network: exec.network,
+                maxOutput: MAX_OUTPUT,
+            }).then(resolve, (err) => resolve({ code: null, out: `container error: ${err instanceof Error ? err.message : String(err)}` }));
+            return;
+        }
+        const child = spawn(cmd, args, {
+            cwd,
+            env: { ...process.env, ...env },
+            timeout: timeoutFor(spec),
+        });
+        let out = "";
+        const append = (chunk) => {
+            if (out.length < MAX_OUTPUT)
+                out += chunk.toString();
+        };
+        child.stdout.on("data", append);
+        child.stderr.on("data", append);
+        child.on("error", (err) => resolve({ code: null, out: `failed to start: ${err.message}` }));
+        child.on("close", (code) => resolve({
+            code,
+            out: out.length > MAX_OUTPUT
+                ? `${out.slice(0, MAX_OUTPUT)}\n…[truncated]`
+                : out || "(no output)",
+        }));
+    });
+}
+// `run:` accepts:
+//   scripts/x.py              this agent's own script
+//   workspace/tools/<t>/x.py  a folder tool's own code, in this workspace
+//   account/tools/<t>/x.py    a folder tool's own code, in the library
+//   shared/x.py               the workspace's scripts/
+//   library/x.py              the workspace library's scripts/
+//
+// The tools/ forms are written by readToolDir rather than by hand: a folder
+// tool's definition says `run: run.mjs` and never names its own scope, which
+// is what lets the same folder be copied into a workspace or installed at the
+// account without an edit.
+export function resolveRunPath(agentDir, run, libraryScripts) {
+    const workspaceRoot = path.resolve(agentDir, "..", "..");
+    // The library's tools/ sits beside its scripts/ — one mount, two shelves.
+    const libraryRoot = path.resolve(libraryScripts, "..");
+    if (run.startsWith("workspace/tools/")) {
+        return path.resolve(workspaceRoot, "tools", run.slice("workspace/tools/".length));
+    }
+    if (run.startsWith("account/tools/")) {
+        return path.resolve(libraryRoot, "tools", run.slice("account/tools/".length));
+    }
+    // Canonical prefixes, then the legacy spellings they replaced.
+    for (const p of ["workspace/scripts/", "shared/"]) {
+        if (run.startsWith(p)) {
+            return path.resolve(workspaceRoot, "scripts", run.slice(p.length));
+        }
+    }
+    for (const p of ["account/scripts/", "library/"]) {
+        if (run.startsWith(p))
+            return path.resolve(libraryScripts, run.slice(p.length));
+    }
+    return path.resolve(agentDir, run);
+}
+/**
+ * The schema a script's arguments are offered to the model under. Every
+ * argument becomes a command-line flag, so it is text on the way out — but a
+ * model reading "depth: how many results (default 20)" sends 10, the number,
+ * and the SDK refuses the call before the handler's String() ever runs; on
+ * the fast tier the model then announced a retry and ended its turn. A
+ * number or a boolean is accepted and written out as the text it would
+ * have been.
+ */
+export function scriptArgShape(args) {
+    const shape = {};
+    for (const [arg, desc] of Object.entries(args)) {
+        shape[arg] = z.union([z.string(), z.number(), z.boolean()]).optional().describe(desc);
+    }
+    return shape;
+}
+export function buildScriptTools(agentDir, scripts, env, libraryScripts = "", interpreters = {}, exec = null) {
+    if (scripts.length === 0) {
+        return { server: null, toolNames: [], promptLines: [], drainLog: () => [] };
+    }
+    const log = [];
+    const tools = scripts.map((spec) => {
+        const shape = scriptArgShape(spec.args);
+        return tool(spec.name, `${spec.description || `Run ${spec.run}.`} Runs the workspace script ${spec.run}; returns its output. ` +
+            `Credentials it needs are already in its environment.`, shape, async (args) => {
+            const started = Date.now();
+            const values = Object.fromEntries(Object.entries(args ?? {}).map(([k, v]) => [k, v === undefined ? "" : String(v)]));
+            const { code, out } = await runScript(agentDir, spec, values, env, libraryScripts, interpreters, exec);
+            // The arguments, on the record. Without them a run says a script was
+            // called and not what it was asked to do — and for a script that
+            // writes to someone else's system, "it ran" is not an account of what
+            // happened. Model-supplied strings only: secrets reach a script
+            // through its environment, never through these.
+            const shown = Object.entries(values)
+                .filter(([, v]) => v !== "")
+                .map(([k, v]) => `${k}=${v.length > 80 ? `${v.slice(0, 77)}…` : v}`)
+                .join(", ");
+            log.push(`${spec.name}(${shown}) → exit ${code ?? "error"} ` +
+                `(${Date.now() - started}ms, ${exec?.executor ?? "sandbox"})`);
+            return {
+                content: [{ type: "text", text: `exit ${code ?? "error"}\n\n${out}` }],
+                isError: code !== 0,
+            };
+        });
+    });
+    return {
+        server: createSdkMcpServer({ name: "foldrun_scripts", version: "1.0.0", tools }),
+        toolNames: scripts.map((s) => `mcp__foldrun_scripts__${s.name}`),
+        promptLines: scripts.map((s) => `- **${s.name}** — ${s.description || `runs ${s.run}`}${Object.keys(s.args).length ? ` Arguments: ${Object.keys(s.args).join(", ")}.` : ""}`),
+        drainLog: () => log.splice(0, log.length),
+    };
+}

package/dist/src/secret-files.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Turn any @file/@ssh/@api values in `env` into files under
+ * `<agentDir>/.secret-files`, rewriting each to its path. Returns the
+ * directory written (for cleanup) and the transformed env. Plain values
+ * pass through untouched.
+ */
+export declare function materializeFileSecrets(agentDir: string, env: Record<string, string>): {
+    env: Record<string, string>;
+    dir: string | null;
+};
+/** Best-effort removal of a materialised secret-files directory. */
+export declare function cleanupFileSecrets(dir: string | null): void;

package/dist/src/secret-files.js

@@ -0,0 +1,92 @@
+// Materialising config-shaped secrets (@file, @ssh, @api) into a run.
+//
+// An SSH private key and a client certificate are credentials tools read
+// from a path — ssh flatly refuses a key that isn't 0600, curl wants
+// --cert a file. And an SSH or API *connection* is more than a value: host,
+// port, user, headers. The user describes the connection; this layer turns
+// it into something directly runnable — a 0600 file, or a 0700 wrapper
+// script — and the env var carries the *path*. The agent runs
+// `"$PROD_VM" 'uptime'` or `"$STRIPE" /v1/charges` and never learns whether
+// it was key or password, one header or five.
+//
+// Everything lands in a per-run scratch directory inside the agent's own
+// tree (so it crosses into a container with the workspace) but dot-prefixed
+// and never archived or copied back — it holds live credentials.
+import fs from "node:fs";
+import path from "node:path";
+import { isFileValue, fileContent, isSshValue, sshConfigOf, isApiValue, apiConfigOf, } from "./secrets.js";
+// POSIX single-quoting: the one escape sh actually honours inside ' is none,
+// so close, backslash-quote, reopen. Wrapper scripts embed hosts, users and
+// header values through this and nothing else.
+const q = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+function writeWrapper(dir, name, body) {
+    const file = path.join(dir, name.toLowerCase());
+    fs.writeFileSync(file, `#!/bin/sh\n${body}\n`, { mode: 0o700 });
+    return file;
+}
+/**
+ * Turn any @file/@ssh/@api values in `env` into files under
+ * `<agentDir>/.secret-files`, rewriting each to its path. Returns the
+ * directory written (for cleanup) and the transformed env. Plain values
+ * pass through untouched.
+ */
+export function materializeFileSecrets(agentDir, env) {
+    const entries = Object.entries(env).filter(([, v]) => typeof v === "string" && (isFileValue(v) || isSshValue(v) || isApiValue(v)));
+    if (entries.length === 0)
+        return { env, dir: null };
+    const dir = path.join(agentDir, ".secret-files");
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const out = { ...env };
+    for (const [name, value] of entries) {
+        // Lowercased name as the filename keeps it predictable without leaking
+        // the value; the env var still points at it by absolute path.
+        if (isFileValue(value)) {
+            const file = path.join(dir, name.toLowerCase());
+            fs.writeFileSync(file, fileContent(value), { mode: 0o600 });
+            out[name] = file;
+        }
+        else if (isSshValue(value)) {
+            const ssh = sshConfigOf(value);
+            const dest = `${ssh.user}@${ssh.host}`;
+            const opts = `-p ${ssh.port ?? 22} -o StrictHostKeyChecking=accept-new`;
+            let cmd;
+            if (ssh.private_key) {
+                const key = path.join(dir, `${name.toLowerCase()}.key`);
+                // ssh wants a trailing newline on OpenSSH keys and 0600 or it balks.
+                fs.writeFileSync(key, ssh.private_key.replace(/\n?$/, "\n"), { mode: 0o600 });
+                cmd = `exec ssh -i ${q(key)} ${opts} ${q(dest)} "$@"`;
+                out[`${name}_KEY`] = key;
+            }
+            else {
+                const pw = path.join(dir, `${name.toLowerCase()}.pw`);
+                fs.writeFileSync(pw, ssh.password ?? "", { mode: 0o600 });
+                cmd = `exec sshpass -f ${q(pw)} ssh ${opts} ${q(dest)} "$@"`;
+            }
+            out[name] = writeWrapper(dir, name, cmd);
+            // The parts, for scp/rsync/anything the wrapper doesn't cover.
+            out[`${name}_HOST`] = ssh.host;
+            out[`${name}_PORT`] = String(ssh.port ?? 22);
+            out[`${name}_USER`] = ssh.user;
+        }
+        else {
+            const api = apiConfigOf(value);
+            const headers = Object.entries(api.headers)
+                .map(([h, v]) => `-H ${q(`${h}: ${v}`)}`)
+                .join(" ");
+            // With a base URL, a path-shaped first argument gets prefixed — so
+            // `"$STRIPE" /v1/charges` and `"$STRIPE" https://elsewhere` both work.
+            const prefix = api.base_url
+                ? `case "$1" in /*) _u=${q(api.base_url)}"$1"; shift; set -- "$_u" "$@";; esac\n`
+                : "";
+            out[name] = writeWrapper(dir, name, `${prefix}exec curl -sS ${headers} "$@"`);
+            if (api.base_url)
+                out[`${name}_URL`] = api.base_url;
+        }
+    }
+    return { env: out, dir };
+}
+/** Best-effort removal of a materialised secret-files directory. */
+export function cleanupFileSecrets(dir) {
+    if (dir)
+        fs.rmSync(dir, { recursive: true, force: true });
+}

package/dist/src/secrets.d.ts

@@ -0,0 +1,147 @@
+/** Which store a secret came from. */
+export type SecretScope = "account" | "workspace";
+/** How the stored value is used at run time — "oauth2"/"service-account"
+ *  are refreshed into live tokens, "file"/"ssh"/"api" are materialised into
+ *  the run's scratch. Plain values have no kind. */
+export type SecretKind = "oauth2" | "service-account" | "file" | "ssh" | "api";
+export declare const SECRET_NAME: RegExp;
+export declare function setSecret(tenant: string, name: string, value: string, workspace?: string, kind?: SecretKind): void;
+/** Encrypt one value for an account — the same envelope secrets use, exported
+ *  so sibling stores (OAuth clients) don't invent a second crypto path. */
+export declare function encryptValue(tenant: string, value: string): {
+    iv: string;
+    tag: string;
+    data: string;
+    k?: "tenant";
+};
+export declare function decryptValue(tenant: string, rec: {
+    iv: string;
+    tag: string;
+    data: string;
+    k?: "tenant";
+} | undefined): string | null;
+/** Nearest wins: a workspace secret shadows an account one of the same name. */
+export declare function getSecret(tenant: string, name: string, workspace?: string): {
+    value: string;
+    scope: SecretScope;
+} | null;
+export declare function deleteSecret(tenant: string, name: string, workspace?: string): void;
+export interface SecretEntry {
+    name: string;
+    updatedAt: string;
+    scope: SecretScope;
+    /** An account secret this workspace overrides — worth showing, not hiding. */
+    shadowed?: boolean;
+    /** How this credential works: auto-refreshing oauth2, a signed service
+     *  account, a file/ssh/api materialised into runs — absent for static values. */
+    kind?: SecretKind;
+}
+export declare function listSecrets(tenant: string, workspace?: string): SecretEntry[];
+export declare function resolveSecrets(tenant: string, names: string[], workspace?: string): {
+    env: Record<string, string>;
+    from: Record<string, SecretScope>;
+    missing: string[];
+};
+/**
+ * Where the master key came from.
+ *
+ * The key and the ciphertext it protects live on the same disk by default, so
+ * one filesystem read gets both. `FOLDRUN_SECRET_KEY` fixes that — a managed
+ * secret store holds the key, the disk holds only the encrypted values — and
+ * this reports which of the two is in force so the platform can say so rather
+ * than leaving it to be discovered.
+ */
+export declare function masterKeySource(): {
+    source: "env" | "file";
+    path: string | null;
+};
+export interface RotationResult {
+    /** Files rewritten, and how many values each held. */
+    rewritten: {
+        file: string;
+        secrets: number;
+    }[];
+    /** Names that could not be read with `from` — left untouched, never dropped. */
+    unreadable: string[];
+}
+/**
+ * Re-encrypt every secret in an account from one master key to another.
+ *
+ * Without this, moving the key into a secret manager is unsafe: change the key
+ * and every stored value fails to decrypt, which the platform reports as a
+ * *missing* secret. You would not lose the ciphertext, but you would lose the
+ * ability to read it, and the error would tell you the secret was never set.
+ *
+ * Both keys are passed in raw, exactly as FOLDRUN_SECRET_KEY would be, and
+ * hashed here the same way masterKey does — so the caller never has to know
+ * how a key becomes an AES key.
+ *
+ * A value that will not decrypt with `from` is reported and left exactly as it
+ * is. Half-rotating is bad; silently discarding is worse.
+ */
+export declare function rotateMasterKey(tenant: string, from: string, to: string): RotationResult;
+export interface OAuth2Config {
+    token_url: string;
+    client_id: string;
+    client_secret: string;
+    /** Required for the refresh grant; absent for client_credentials. */
+    refresh_token?: string;
+    /** "refresh_token" (default — user-consented) or "client_credentials"
+     *  (machine-to-machine: no user, no refresh token, re-exchanged on
+     *  expiry). One machinery, two grants. */
+    grant_type?: "refresh_token" | "client_credentials";
+    /** Extra form fields some providers want (audience, scope, …). */
+    extra?: Record<string, string>;
+}
+export declare function setOAuth2Secret(tenant: string, name: string, config: OAuth2Config, workspace?: string): void;
+export declare function isOAuth2Value(value: string): boolean;
+/**
+ * Swap every oauth2 recipe in an env map for a live access token. The one
+ * async moment in secret resolution, kept out of the sync paths: callers
+ * materialise right before values are injected or substituted. A failed
+ * refresh throws with the secret's name and the provider's reason — a run
+ * should fail saying "GOOGLE_ADS_TOKEN: invalid_grant", not 401 somewhere.
+ */
+export declare function materializeSecrets(env: Record<string, string>): Promise<Record<string, string>>;
+export interface ServiceAccountConfig {
+    token_url: string;
+    issuer: string;
+    private_key: string;
+    scope: string;
+    /** JWT audience — usually the same as token_url. */
+    audience?: string;
+}
+export declare function setServiceAccountSecret(tenant: string, name: string, config: ServiceAccountConfig, workspace?: string): void;
+export declare function setFileSecret(tenant: string, name: string, content: string, workspace?: string): void;
+export declare function isFileValue(value: string): boolean;
+export declare function fileContent(value: string): string;
+export interface SshConfig {
+    host: string;
+    port?: number;
+    user: string;
+    /** Exactly one of these two. */
+    private_key?: string;
+    password?: string;
+}
+export declare function setSshSecret(tenant: string, name: string, config: SshConfig, workspace?: string): void;
+export declare function isSshValue(value: string): boolean;
+export declare function sshConfigOf(value: string): SshConfig;
+export interface ApiConfig {
+    base_url?: string;
+    headers: Record<string, string>;
+}
+export declare function setApiSecret(tenant: string, name: string, config: ApiConfig, workspace?: string): void;
+export declare function isApiValue(value: string): boolean;
+export declare function apiConfigOf(value: string): ApiConfig;
+/**
+ * Move an account's secrets from the install key onto its own key.
+ *
+ * Read with whichever key each record names, write them all back under the
+ * account's. Every value is decrypted BEFORE anything is written: a vault
+ * half-moved is an account that can authenticate nothing, so the whole file
+ * either converts or is left exactly as it was.
+ */
+export declare function rewrapTenantSecrets(tenant: string): {
+    moved: number;
+    unreadable: string[];
+};