@phnx-labs/agents-cli 1.22.56 → 1.22.58

package/dist/lib/secrets/bundles.d.ts

@@ -1,24 +1,8 @@
 /**
  * Secret bundles — named sets of environment variables backed by a secret store.
- *
- * Bundle metadata (name, description, vars map) is stored as a JSON blob under
- * `agents-cli.bundles.<name>`; secret values live one per item under
- * `agents-cli.secrets.<bundle>.<key>`. Two backends carry those items:
- *
- *  - `keychain` (default): the macOS Keychain (device-local, Touch ID / device
- *    passcode gated) or Linux libsecret — see src/lib/secrets/index.ts.
- *  - `file`: an AES-256-GCM encrypted-file store keyed by a passphrase
- *    (src/lib/secrets/filestore.ts). Opt-in, for headless / remote runs where
- *    no biometry prompt can be satisfied (e.g. a release on a remote Mac over
- *    SSH). The item-name scheme is identical, so the only difference is where
- *    bytes land. A file-backed bundle is discovered by the presence of its
- *    metadata item in the file store.
- *  - `vault`: a single age-encrypted ~/.agents/vault.age file unlocked by
- *    `agents secrets vault unlock`; intended for user-managed cross-machine file sync.
- *
- * Server-backed cross-machine sync is handled by src/lib/secrets/sync.ts via
- * an explicit encrypted export/import flow; the bundle layer also supports the
- * local vault backend for user-managed file sync.
+ * Metadata lives under `agents-cli.bundles.<name>`; values under
+ * `agents-cli.secrets.<bundle>.<key>`. Backends: `keychain` (default),
+ * `file` (headless/passphrase), and `vault` (age-encrypted, user-synced).
  */
 import { type BundleValue, type SecretRef } from './index.js';
 /** Which store carries a bundle's items. */
@@ -26,69 +10,40 @@ export type SecretsBackend = 'keychain' | 'file' | 'vault';
 /** Disable the broker-only guard for in-memory keychain tests. */
 export declare function setKeychainAgentOnlyBypassForTest(bypass: boolean): void;
 /**
- * Discover a bundle's backend by location: a file-backed bundle's metadata
- * item exists in the encrypted-file store. This is a plain file-existence
- * check — no passphrase, no Touch ID — so it sidesteps the chicken-and-egg of
- * "read metadata to learn where metadata lives." Absent ⇒ keychain.
+ * Discover a bundle's backend by location. File store is checked first (a plain
+ * existence test, no passphrase); absent/locked vault falls back to keychain.
  */
 export declare function bundleBackend(name: string): SecretsBackend;
 /** Allowed values for a secret's `type` metadata field. */
 export declare const SECRET_TYPES: readonly ["api-key", "token", "password", "url", "database-url", "ssh-key", "certificate", "webhook", "note"];
 export type SecretType = typeof SECRET_TYPES[number];
-/** Per-secret metadata. All fields optional; absent ones omitted at write time. */
+/** Per-secret metadata; absent fields are omitted at write time. */
 export interface VarMeta {
     type?: SecretType;
-    /** ISO date 'YYYY-MM-DD'. Always future-dated at write time. */
+    /** Future-dated ISO date ('YYYY-MM-DD'). */
     expires?: string;
-    /** Singular freeform note. */
     note?: string;
 }
 /**
- * A bundle's prompt policy — how often macOS asks for Touch ID to read it:
- * - `hold` (default): ask once, then serve it silently for the configured hold
- *   duration (`secrets.agent.holdMs`, 7d by default). Named for what it does —
- *   it was called `daily`, which stated a period it never had.
- *   (Historical name — the window is now a rolling ~1 week, not one calendar day.)
- *   Eligible for the secrets-agent — the first real keychain read auto-loads it
- *   (auto-cache is on by default) so concurrent runs read it silently, or `unlock`
- *   it explicitly. Held from that unlock (not refreshed on use); re-asks sooner
- *   after sleep, logout, or `agents secrets lock`. A bare screen-lock does NOT
- *   drop it (the login password already gates a locked screen).
- * - `always`: asks every time. Never auto-held — only an explicit `agents
- *   secrets unlock` ever holds it; every other read pops Touch ID. Opt a
- *   high-value bundle into this when you want to confirm every single read.
- * - `never`: stored WITHOUT the biometry access control — reads are fully
- *   silent (no Touch ID, no broker). The least-safe tier: any code running as
- *   the user reads it with no user-presence check. Reserved for low-sensitivity,
- *   automation-only credentials. Writing a `never` item needs the signed helper's
- *   `set-no-acl` path (see keychain-helper.swift); an older pinned helper rejects
- *   it loudly rather than silently downgrading to `always`.
- *
- * The default is configurable via `secrets.policy` in agents.yaml. Stored on disk
- * under the legacy `tier` key (`session` == `hold`, `biometry` == explicit
- * `always`, `none` == `never`, absent == inherit the default) so bundles stay
- * readable across mixed CLI versions on synced machines. The user-facing
- * vocabulary is `policy`/`always`/`hold`/`never`.
+ * Bundle prompt policy. `hold` (default): one Touch ID per hold window (~7d),
+ * then silent via the secrets-agent. `always`: prompt every read. `never`: no
+ * biometry ACL — least-safe, automation-only. Configurable via `secrets.policy`;
+ * persisted under the legacy `tier` key for cross-version sync.
  */
 export type SecretsPolicy = 'always' | 'hold' | 'never';
-/** A named set of environment variable definitions backed by various secret providers. */
+/** A named set of environment variable definitions backed by secret stores. */
 export interface SecretsBundle {
     name: string;
     description?: string;
     allow_exec?: boolean;
-    /** Which store carries this bundle's items. Absent ⇒ `keychain` (the default). */
+    /** Absent ⇒ `keychain`. */
     backend?: SecretsBackend;
-    /** Prompt policy. Absent ⇒ the configured default (`hold`). Serialized under
-     * the legacy `tier` key — see SecretsPolicy. */
+    /** Absent ⇒ configured default (`hold`). */
     policy?: SecretsPolicy;
-    /** ISO 8601 UTC timestamp. Set once on the first writeBundle() for a bundle. */
     created_at?: string;
-    /** ISO 8601 UTC timestamp. Refreshed on every writeBundle(). */
     updated_at?: string;
-    /** ISO 8601 UTC timestamp. Stamped by resolveBundleEnv (throttled). */
     last_used?: string;
     vars: Record<string, BundleValue>;
-    /** Optional per-var metadata, keyed by var name (parallel to `vars`). */
     meta?: Record<string, VarMeta>;
 }
 export interface LegacyBundleCandidate {
@@ -102,11 +57,8 @@ export declare const BUNDLE_KEY_PATTERN: RegExp;
 export declare const BUNDLE_META_PREFIX = "agents-cli.bundles.";
 export declare const RESERVED_ENV_NAMES: Set<string>;
 /**
- * The reserved FILE-BACKED bundle that holds long-lived Claude setup-tokens.
- * Usage/probe reads authenticate with these instead of the ACL-bound login item,
- * so they never pop Touch ID and they can cross the fleet. A keychain- or
- * vault-backed bundle of this name is a misconfiguration: the consumer used to
- * return null (SEC-GAP-3) and silently fall through to Touch ID.
+ * Reserved FILE-BACKED bundle for long-lived setup tokens. Must be file-backed;
+ * a keychain/vault `auth` bundle is a misconfiguration and is ignored.
  */
 export declare const AUTH_BUNDLE_NAME = "auth";
 export declare const AUTH_BUNDLE_BACKEND: SecretsBackend;
@@ -118,11 +70,17 @@ export declare class ReservedBundleWrongBackendError extends Error {
     readonly backend: SecretsBackend;
     constructor(bundle: string, backend: SecretsBackend);
 }
-/** Fail loud when `name` is reserved and `backend` is not the required one. */
+/** Fail loud when a reserved bundle is on the wrong backend. */
 export declare function assertReservedBundleBackend(name: string, backend: SecretsBackend): void;
 /**
- * Presence + backend of the reserved `auth` bundle. `ok` is true when the
- * bundle is absent (nothing to fix) or present and file-backed.
+ * Check the reserved `auth` bundle. `ok` is true when absent or file-backed.
+ *
+ * Read-only status probe (`agents doctor`, `agents fleet apply`) — unlike the
+ * destructive-write guards `bundleExists()`/`hasKeychainToken()` document
+ * themselves as failing loud for, a diagnostic MUST NOT crash the whole
+ * command because ONE optional finding could not reach the keychain (e.g. the
+ * macOS Keychain helper source is unavailable — PHNX-3385). Treat an
+ * unreachable keychain the same as "bundle absent": nothing to warn about.
  */
 export declare function inspectReservedAuthBundle(): {
     exists: boolean;
@@ -130,10 +88,9 @@ export declare function inspectReservedAuthBundle(): {
     ok: boolean;
 };
 /**
- * After a file-backed import, actually decrypt the keys and fail if any are
- * unreadable. Import used to print "Imported N key(s)" from the write tally
- * alone — ciphertext sealed under a forwarded AGENTS_SECRETS_PASSPHRASE that
- * the destination daemon does not hold still counted as success.
+ * After a file-backed import, verify the keys actually decrypt. Import used to
+ * report success for ciphertext sealed under a forwarded passphrase this process
+ * does not hold.
  */
 export declare function assertFileBundleDecryptable(name: string, keys: string[]): void;
 export declare function bundleToEnvPrefix(name: string): string;
@@ -147,67 +104,42 @@ export declare function validateEnvKey(key: string): void;
 /** Assert that `t` is one of the known SECRET_TYPES. Throws with the allowed list otherwise. */
 export declare function validateSecretType(t: string): asserts t is SecretType;
 /**
- * Validate an `expires` value. Accepts strict 'YYYY-MM-DD' only and rejects
- * any date <= now. We compare against end-of-day UTC for the chosen date so
- * "today" is treated as past (per spec).
+ * Validate a future `expires` date. Accepts strict 'YYYY-MM-DD'; end-of-day UTC
+ * means "today" is past.
  */
 export declare function validateExpiresFutureDated(iso: string): void;
 export declare function bundleExists(name: string): boolean;
 /**
- * Thrown by `readBundle` for the one state `readBundleIfDecryptable` may treat
- * as "present but permanently unreadable": file-store ciphertext on disk that
- * will not decrypt with the passphrase in effect (lost/rotated key or a tampered
- * store). It is deliberately narrow — a bundle that is merely *locked for this
- * run* (headless macOS without `AGENTS_SECRETS_PASSPHRASE`, or a vault that is
- * not logged in) is recoverable and must not be collapsed into this.
+ * Thrown for file-store ciphertext that will not decrypt (lost/rotated key or
+ * tampered store). Narrow: temporarily-locked bundles are recoverable and must
+ * not be collapsed here.
  */
 export declare class BundleUndecryptableError extends Error {
     constructor(message: string);
 }
 /**
- * Read a bundle, or return null when its metadata is present but genuinely
- * cannot be decrypted — a lost or rotated file-store passphrase, or a tampered
- * file store (signalled by `BundleUndecryptableError`).
- *
- * Deleting such a bundle is the only way out of that state, and deletion needs
- * no plaintext, so it must not be gated behind a successful decrypt. Every other
- * failure rethrows: a genuinely missing bundle ("not found"), and — critically —
- * a bundle that is only *temporarily locked* for this run (headless macOS with no
- * `AGENTS_SECRETS_PASSPHRASE`, or a not-logged-in vault). Collapsing that
- * recoverable "set the env / log in" state into "unreadable, safe to delete"
- * would let `secrets delete <name> --yes` silently destroy a perfectly healthy
- * bundle from a cron/launchd run that merely forgot to export the passphrase.
+ * Read a bundle, returning null only when metadata is present but permanently
+ * unreadable (`BundleUndecryptableError`). Other failures — including temporary
+ * lockout — rethrow so a healthy bundle is never deleted by mistake.
  */
 export declare function readBundleIfDecryptable(name: string): SecretsBundle | null;
 export declare function readBundle(name: string): SecretsBundle;
-/** The default prompt policy applied to bundles without an explicit per-bundle
- * policy. Configurable via `secrets.policy` in agents.yaml; `hold` (one Touch ID
- * per hold window — `secrets.agent.holdMs`, 7d by default) unless the user
- * explicitly opts back into prompt-every-time with `always`. Best-effort: an
- * unreadable config falls back to the `hold` default. */
+/** Default policy for bundles without an explicit one (`secrets.policy`). */
 export declare function secretsDefaultPolicy(): SecretsPolicy;
-/** The effective prompt policy of a bundle (absent ⇒ the configured default). */
+/** Effective prompt policy of a bundle. */
 export declare function bundlePolicy(bundle: SecretsBundle): SecretsPolicy;
 /** Options for writeBundle. */
 export interface WriteBundleOptions {
     /**
-     * Skip evicting the bundle from the secrets-agent broker after the write.
-     * Only for writers that change nothing the broker serves — today that is
-     * stampLastUsed (a usage-telemetry timestamp, fired on every broker HIT):
-     * evicting there would make the cache destroy itself on first use. Every
-     * mutating writer (add / rotate / remove / rename / policy / import) must
-     * leave this unset so a broker-held copy never serves stale values for up
-     * to the ~7d hold.
+     * Skip evicting the broker-held copy. Only for no-op writers such as
+     * stampLastUsed; mutating writes must evict so stale values aren't served.
      */
     skipBrokerEviction?: boolean;
 }
 /**
- * Whether a bundle write should evict the broker-held copy. Pure + exported
- * for regression coverage. Skips when the writer opted out (stampLastUsed),
- * when the broker integration is disabled (AGENTS_SECRETS_NO_AGENT — the same
- * kill-switch the read fast-path honors), or when a test keychain backend is
- * installed (an in-memory backend has no real keychain behind it, and a test
- * writing bundle 'prod' must never evict the user's real 'prod' unlock).
+ * Whether a bundle write should evict the broker-held copy. Exported for tests.
+ * Skips when the writer opted out, the broker is disabled, or a test backend is
+ * active (so tests don't evict the user's real unlocks).
  */
 export declare function shouldEvictAfterBundleWrite(skipRequested: boolean, noAgentEnv: string | undefined, backendOverridden: boolean): boolean;
 export declare function writeBundle(bundle: SecretsBundle, opts?: WriteBundleOptions): void;
@@ -225,18 +157,14 @@ export declare const __metaIndexForTest: {
     remove: typeof removeBundleFromMetaIndex;
 };
 /**
- * Re-write already-read keychain bundle metadata items WITHOUT the biometry ACL.
- * `metaJsonByName` maps bundle name → the exact metadata JSON listBundles just
- * batch-read, so writing it back only flips the ACL (via the helper's
- * delete-then-add `set-no-acl`) — contents and updated_at are preserved and no
- * extra keychain read is issued. Exported for tests. Returns the count healed.
+ * Re-write keychain metadata items without the biometry ACL. The caller supplies
+ * the JSON already read, so contents are preserved and no extra read is issued.
+ * Exported for tests.
  */
 export declare function healKeychainBundleMetadata(metaJsonByName: Map<string, string>): number;
 /**
- * One-time driver around healKeychainBundleMetadata (RUSH-1759). macOS + real
- * keychain only — libsecret/CredMan have no biometry ACL to shed, and a test
- * backend has no real keychain — and gated by a sentinel so it runs at most
- * once. Best-effort: a heal failure never breaks bundle listing.
+ * One-time driver for healKeychainBundleMetadata. macOS + real keychain only;
+ * gated by a sentinel. Best-effort: a heal failure never breaks listing.
  */
 export declare function healKeychainBundleMetadataAclOnce(metaJsonByName: Map<string, string>): void;
 export declare function listBundles(): SecretsBundle[];
@@ -249,64 +177,28 @@ export declare function describeBundle(bundle: SecretsBundle): BundleEntryInfo[]
 export declare function stampLastUsed(bundle: SecretsBundle): void;
 /** Options for resolveBundleEnv. */
 export interface ResolveBundleOptions {
-    /**
-     * Human-readable label for who is requesting the secrets. Currently
-     * informational only — the helper's Touch ID prompt is set by the OS and
-     * cannot be reliably customized once we drop the per-batch reason path,
-     * but we keep this in the API so call sites stay explicit about who's
-     * about to read the bundle.
-     */
     caller?: string;
-    /** Harness type whose unlock may be reused (claude, codex, kimi, ...). */
+    /** Harness type whose unlock may be reused. */
     agent?: string;
-    /** Human duration rendered in the Touch ID prompt. */
+    /** Duration shown in the Touch ID prompt. */
     duration?: string;
-    /** Explicitly permit this agent request to raise interactive authentication. */
+    /** Allow this call to raise an interactive biometric prompt. */
     interactiveUnlock?: boolean;
-    /**
-     * Skip the secrets-agent fast-path and read straight from the keychain
-     * (popping Touch ID). Set by callers that must NOT serve a cached snapshot —
-     * `unlock` (which populates the agent in the first place) and any flow that
-     * needs live values. Also honored via AGENTS_SECRETS_NO_AGENT=1.
-     */
+    /** Skip the broker fast-path and read from the keychain directly. */
     noAgent?: boolean;
-    /**
-     * Resolve only from an already-unlocked secrets-agent snapshot. If the
-     * broker has no snapshot, fail before touching Keychain or any other store.
-     * Background processes use this to guarantee they never surface a biometric
-     * prompt that nobody can answer.
-     */
+    /** Resolve only from an already-unlocked broker snapshot; fail before prompting. */
     agentOnly?: boolean;
-    /**
-     * Inject only this subset of keys from the bundle. Keys not in this list are
-     * silently excluded from the returned env map. An error is thrown if any
-     * requested key is absent from the bundle (fail-loud, never silent skip).
-     * When absent or empty, all keys are injected (original behaviour).
-     */
+    /** Inject only these keys. Errors if any requested key is absent. */
     keys?: string[];
-    /**
-     * When true, skip the pre-run expiry check and inject keys even if their
-     * `expires` date is in the past. By default any expired key (or a key whose
-     * bundle-level expiry has passed) aborts the run before Touch ID is popped.
-     */
+    /** Skip the per-key expiry gate. */
     allowExpired?: boolean;
-    /**
-     * `process` projects dotted account keys like `GITHUB_USERNAME.personal` to
-     * the shell-safe base env name (`GITHUB_USERNAME`). Direct value lookups and
-     * backup/export flows use `storage` to preserve the exact bundle key names.
-     */
+    /** `process` projects dotted keys to shell-safe env names; `storage` preserves them. */
     keyMode?: 'process' | 'storage';
 }
 export declare function canCacheResolvedEnv(bundle: SecretsBundle, selectedKeys: Set<string>, keyMode: ResolveBundleOptions['keyMode']): boolean;
 /**
- * Apply the --keys subset + expiry gate to an already-resolved snapshot from
- * the secrets-agent fast-path. The agent stores either a full unlock or a
- * scoped lease env, so a naive fast-path return could silently defeat --keys
- * and inject expired values. Mirrors the slow-path pre-checks in `resolveBundleEnv` /
- * `readAndResolveBundleEnv` and returns a new env whose keys match the subset.
- *
- * Exported for tests; production callers reach it via the fast-path branch in
- * `readAndResolveBundleEnv`.
+ * Apply --keys and --allow-expired to a broker snapshot so the fast path
+ * mirrors the slow path's gates. Exported for tests.
  */
 export declare function filterAgentHitBySubsetAndExpiry(hit: {
     bundle: SecretsBundle;
@@ -316,14 +208,8 @@ export declare function filterAgentHitBySubsetAndExpiry(hit: {
     env: Record<string, string>;
 };
 /**
- * Guard for remote-bundle callers (`bundle@host` / `--device`) — the SSH
- * resolver in `remoteResolveEnv` does not thread --keys or --allow-expired
- * yet. Silently applying them would inject the full remote env or an expired
- * value, defeating the least-privilege intent, so we fail loud.
- *
- * Exported so `agents run --secrets bundle@host` and `agents secrets exec
- * --device` share the exact same error text; the tests exercise this helper
- * directly instead of driving the whole CLI.
+ * Fail loud when remote bundle resolution is asked for flags the SSH resolver
+ * does not yet thread. Exported so callers share the same error text.
  */
 export declare function assertRemoteBundleFlagsUnsupported(bundleName: string, host: string, opts: {
     keys?: string[];
@@ -343,16 +229,8 @@ export declare function resolveBundleEnv(bundle: SecretsBundle, _opts?: ResolveB
 export { isHeadlessSecretsContext, isAgentInvocationContext } from './headless.js';
 /**
  * Read a bundle's metadata AND resolve its env in a single Touch ID prompt.
- *
- * `readBundle` + `resolveBundleEnv` issued two separate `LAContext` calls
- * (metadata read via `get-auth`, then secret values via `get-batch`) which
- * surfaced as two consecutive Touch ID prompts. macOS does not honor
- * "Always Allow" for items protected with `kSecAttrAccessControl`+biometry,
- * so caching at the OS level was never an option. This collapses both reads
- * into one `get-batch` call: we enumerate the bundle's secret items first
- * (silent — `list` returns attrs only and does not trigger biometry) and
- * include the metadata item in the same batch. One prompt, correctly scoped
- * to the bundle name and caller.
+ * `readBundle` + `resolveBundleEnv` used to issue two LAContext calls (two
+ * prompts). This collapses them into one batch that includes the metadata item.
  */
 export declare function readAndResolveBundleEnv(name: string, opts?: ResolveBundleOptions): {
     bundle: SecretsBundle;
@@ -370,57 +248,30 @@ export interface RotateOptions {
     meta?: Partial<VarMeta>;
 }
 /**
- * Rotate a keychain-backed secret in `bundle`. Errors if `key` is not present
- * in the bundle (use `add` to introduce a new key). Preserves existing meta
- * unless `clearMeta` or a `meta` patch is supplied.
+ * Rotate a keychain-backed secret. Errors if the key is absent; preserves meta
+ * unless cleared or patched.
  */
 export declare function rotateBundleSecret(bundle: SecretsBundle, key: string, opts: RotateOptions): void;
 /**
- * Reconcile a bundle's keychain-backed VALUE items to its CURRENT policy, then
- * write the (always no-ACL) metadata.
- *
- * `writeBundle` only rewrites the metadata item, so a policy change alone leaves
- * every value item carrying the ACL it was created with — and macOS gates each
- * read on the ITEM's ACL, not the bundle's declared tier (spec SEC-19). Without
- * this reconcile, `agents secrets policy <b> never` reports "silent" while the
- * still-ACL'd value keeps popping Touch ID on every read, forever.
- *
- *   hold/always -> never  strips the biometry ACL (helper `set-no-acl`: delete+add)
- *   never -> hold/always  re-attaches it (helper `set`)
- *
- * The current values are read in ONE batch, so the reconcile costs at most a
- * single Touch ID — the last prompt a hold->never bundle will ever raise (a
- * never->* flip reads silently, since the items are already no-ACL). No-op on the
- * ACL to write for non-keychain backends (file/vault have no biometry concept),
- * and a metadata-only write when the bundle has no keychain-backed values.
+ * Reconcile keychain value items to the bundle's current policy. macOS gates
+ * reads on each item's ACL, not the bundle's declared policy, so a policy change
+ * alone would leave stale ACLs. hold/always → never strips ACL; never → *
+ * re-attaches it. Non-keychain backends no-op.
  */
 export declare function reAclBundleItems(bundle: SecretsBundle): void;
 /** Options for renameBundle. */
 export interface RenameOptions {
-    /** When true, overwrite an existing destination bundle (purges its keychain items first). */
+    /** Overwrite an existing destination bundle. */
     force?: boolean;
 }
 /**
- * Rename a bundle: move metadata + every keychain-backed value to a new name.
- *
- * Sequence is ordered so the source stays intact if anything in the copy
- * phase fails:
- *   1) read source, validate dest
- *   2) purge dest if --force, refuse otherwise
- *   3) copy each keychain value source -> dest
- *   4) write new bundle metadata
- *   5) delete the old per-key keychain items + old metadata
- *
- * Steps 1-4 are reversible. If 5 partially fails, running `rename` again is
- * a safe no-op for the source items.
+ * Rename a bundle: copy metadata + keychain values to the new name, then delete
+ * the source. Steps are ordered so a copy-phase failure leaves the source intact.
  */
 export declare function renameBundle(oldName: string, newName: string, opts?: RenameOptions): void;
 /**
- * The store (keychain or encrypted file) that carries a bundle's items. The
- * CLI uses this to read/write/delete per-key items (built with
- * secretsKeychainItem) in the same store as the bundle's metadata, for `add` /
- * `import` / `remove` / `delete`. Pass the bundle's resolved backend
- * (`bundle.backend ?? 'keychain'`).
+ * The item store (keychain or encrypted file) for a bundle's per-key secrets.
+ * Pass the resolved backend (`bundle.backend ?? 'keychain'`).
  */
 export declare function bundleItemStore(backend: SecretsBackend | undefined, opts?: {
     noAcl?: boolean;