@indigoai-us/hq-cli 5.345.168 → 5.345.170

package/dist/commands/files.js

@@ -196,6 +196,7 @@ export function registerFilesCommand(program) {
         .description("Share file paths. foo/ is a private folder (children stay creator-only); quote the shared-folder glob 'foo/*' so the shell passes it literally. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.")
         .option("--with <principal>", "Email address, group id, company Outpost id (out_...), or '@all' to share with every active company member")
         .option("--permission <level>", "Permission level (only with --with): read | write")
+        .option("--exact", "With --with: grant exactly the object named by <prefix>, even when it looks like a folder (by default a bare folder name such as 'knowledge' is granted as the folder glob 'knowledge/*').")
         .option("--full", "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.")
         .option("--expires <duration>", "Token expiry duration for share-session URL (e.g. 15m, 1h, 24h). Default 15m. Max 24h.")
         .option("--no-open", "Print the share-session URL but do not launch the browser")
@@ -208,6 +209,14 @@ export function registerFilesCommand(program) {
                 console.error(chalk.red("--mention requires --channel <name>."));
                 process.exit(1);
             }
+            if (opts.exact && opts.with === undefined && opts.channel === undefined) {
+                console.error(chalk.red("--exact applies only to a direct grant and requires --with <principal> (or --channel with --mention)."));
+                process.exit(1);
+            }
+            if (opts.exact && opts.full) {
+                console.error(chalk.red("--exact cannot be combined with --full."));
+                process.exit(1);
+            }
             const companySlug = files.opts().company;
             const channelTarget = opts.channel !== undefined
                 ? await resolveShareChannelTarget({
@@ -258,6 +267,7 @@ export function registerFilesCommand(program) {
                     principal: opts.with,
                     permission: opts.permission,
                     companySlug,
+                    ...(opts.exact ? { exact: true } : {}),
                     ...channelTarget,
                 });
                 return;
@@ -278,6 +288,7 @@ export function registerFilesCommand(program) {
                         principal: uid,
                         permission,
                         companySlug,
+                        ...(opts.exact ? { exact: true } : {}),
                         ...(index === 0
                             ? {
                                 channelId: channelTarget.channelId,
@@ -302,14 +313,22 @@ export function registerFilesCommand(program) {
     });
     files
         .command("unshare <prefix>")
-        .description("Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with.")
+        .description("Remove a named file access grant, or remove an empty ACL row or grantee-less entries without --with. " +
+        "With --with, a bare name such as 'knowledge' first removes the exact 'knowledge' grant (rows from older " +
+        "`hq files share` versions) and, when none matches, the folder-glob 'knowledge/*' grant. Without --with, " +
+        "the prefix is used exactly as typed: pass 'knowledge/*' (quoted) to clean up the folder-glob row.")
         .option("--with <principal>", "Person uid, agent uid, company Outpost id (out_...), email address, group id, or '@all' to remove the grant")
+        .option("--exact", "With --with: remove the grant on exactly the object named by <prefix>. By default a bare folder name such as 'knowledge' resolves to the folder glob 'knowledge/*', the same way `hq files share` resolves it.")
         .action(async (prefix, opts) => {
         try {
+            if (opts.exact && !opts.with) {
+                console.error(chalk.red("--exact requires --with <principal>."));
+                process.exit(1);
+            }
             // Unshare MUTATES access with no preview. Anchored content paths remain
             // refused; the exact company-root ACL row is the sole exception and
             // resolves its anchor against the selected company before revoking.
-            const canonicalPrefix = normalizeCompanyFilePrefix(prefix, {
+            let canonicalPrefix = normalizeCompanyFilePrefix(prefix, {
                 mutating: true,
                 allowCompanyRootAclRow: true,
                 ...(files.opts().company !== undefined
@@ -385,40 +404,66 @@ export function registerFilesCommand(program) {
                     : `${cleanupMessage || `Removed empty ACL pattern '${canonicalPrefix}'. `}It now follows its parent folder's access, so anyone who can see that parent can see this folder.`));
                 return;
             }
-            const res = await vaultApiFetch({
-                token,
-                path: `/files/${encodeURIComponent(companyUid)}/acl/revoke`,
-                method: "POST",
-                body: { prefix: canonicalPrefix, granteeType, granteeId },
-            });
-            if (!res.ok) {
+            // A bare name may carry an exact-key row from older `hq files share`
+            // versions (DEV-5173) or the folder-glob row the current share
+            // creates. Try the exact row first, then `X/*` unless the vault says
+            // X is only a file. A revoke only reduces access, so the vault lookup
+            // never blocks it: a deleted path or a failed lookup still tries both.
+            const bare = !opts.exact &&
+                companyRootSlug === undefined &&
+                looksLikeBareFolderPrefix(canonicalPrefix) &&
+                malformedBareSharePrefix(canonicalPrefix) === null;
+            const candidates = [canonicalPrefix];
+            const tried = [];
+            let aclMissingEverywhere = true;
+            for (let index = 0; index < candidates.length; index++) {
+                const candidate = candidates[index];
+                tried.push(candidate);
+                const res = await vaultApiFetch({
+                    token,
+                    path: `/files/${encodeURIComponent(companyUid)}/acl/revoke`,
+                    method: "POST",
+                    body: { prefix: candidate, granteeType, granteeId },
+                });
+                if (res.ok) {
+                    console.log(chalk.green(`Removed grant for ${principalLabel} on '${displayAclPattern(candidate)}'`));
+                    if (bare && candidate === canonicalPrefix) {
+                        console.log(chalk.dim(`This removed the exact '${candidate}' grant. A grant for ${principalLabel} on ` +
+                            `'${candidate}/*', if one exists, remains; remove it with ` +
+                            `hq files unshare '${candidate}/*' --with ${principal}.`));
+                    }
+                    return;
+                }
                 const body = await res.json().catch(() => ({}));
+                if (res.status === 404) {
+                    // A 404 means ZERO rows were removed — never report a green success
+                    // that implies a revoke happened. ACL_NOT_FOUND means the prefix
+                    // has no ACL at all; GRANT_NOT_FOUND (or an older server with no
+                    // code) means the ACL exists but no grant matched this principal.
+                    if (body.code !== "ACL_NOT_FOUND")
+                        aclMissingEverywhere = false;
+                    if (bare && candidate === canonicalPrefix) {
+                        const resolution = await resolveBareSharePrefix({
+                            token,
+                            companyUid,
+                            prefix: canonicalPrefix,
+                        });
+                        // Fall back to the folder glob unless the vault confirms X is a
+                        // file with nothing under it.
+                        if (resolution.kind !== "unchanged")
+                            candidates.push(`${canonicalPrefix}/*`);
+                    }
+                    continue;
+                }
                 if (res.status === 401) {
                     console.error(chalk.red("Not authenticated — please run `hq login`"));
                 }
                 else if (res.status === 403) {
                     console.error(chalk.red("Not authorized to modify this file prefix's ACL"));
-                    await offerAccessLadder(canonicalPrefix, {
+                    await offerAccessLadder(candidate, {
                         company: files.opts().company,
                     });
                 }
-                else if (res.status === 404) {
-                    // A 404 means ZERO rows were removed — never report a green success
-                    // that implies a revoke happened. Distinguish the two causes:
-                    //   ACL_NOT_FOUND  — the prefix has no ACL at all (nothing was ever
-                    //                    shared here): genuinely, benignly absent.
-                    //   GRANT_NOT_FOUND (or an older server with no code) — the ACL
-                    //                    exists but no grant matched this principal:
-                    //                    surface it as a warning so a typo'd/stale
-                    //                    principal isn't mistaken for a real removal.
-                    if (body.code === "ACL_NOT_FOUND") {
-                        console.log(chalk.dim(`Nothing to remove — '${canonicalPrefix}' has no sharing grants.`));
-                    }
-                    else {
-                        console.warn(chalk.yellow(`No matching grant for ${principalLabel} on '${canonicalPrefix}' — nothing was removed.`));
-                    }
-                    return;
-                }
                 else if (res.status >= 500) {
                     console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
                 }
@@ -427,7 +472,18 @@ export function registerFilesCommand(program) {
                 }
                 process.exit(1);
             }
-            console.log(chalk.green(`Removed grant for ${principalLabel} on '${displayAclPattern(canonicalPrefix)}'`));
+            if (tried.length === 1) {
+                if (aclMissingEverywhere) {
+                    console.log(chalk.dim(`Nothing to remove — '${canonicalPrefix}' has no sharing grants.`));
+                }
+                else {
+                    console.warn(chalk.yellow(`No matching grant for ${principalLabel} on '${canonicalPrefix}' — nothing was removed.`));
+                }
+                return;
+            }
+            console.warn(chalk.yellow(`No matching grant for ${principalLabel} on ${tried.map((row) => `'${displayAclPattern(row)}'`).join(" or ")} ` +
+                `— nothing was removed. Check the grant with hq files acl, then re-run with --exact for the exact ` +
+                `'${canonicalPrefix}' row or pass '${canonicalPrefix}/*' (quoted) for the folder glob.`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -811,14 +867,130 @@ async function resolveMentionPersonUid(mention, companySlug) {
     console.error(chalk.red(`Could not resolve --mention '${trimmed}' to a person.`));
     process.exit(1);
 }
+/**
+ * True for a prefix that might name a folder without saying so: no trailing
+ * `/` (private folder), no `/*` (shared folder glob), and not the `*`
+ * wildcard, and a last segment with no extension (a name with an extension is
+ * taken as the file it names). The vault ACL treats such a path as an exact
+ * object key, so
+ * `hq files share knowledge --with x` used to grant an object named
+ * "knowledge" and nothing under `knowledge/` (DEV-5173: members were blocked
+ * under a folder their admin had "shared"). The name alone does not decide
+ * whether it is a folder (`Makefile`, `bin/hq`); resolveBareSharePrefix asks
+ * the vault.
+ */
+export function looksLikeBareFolderPrefix(prefix) {
+    if (prefix === "*" || prefix.endsWith("/") || prefix.endsWith("/*"))
+        return false;
+    const last = prefix.slice(prefix.lastIndexOf("/") + 1);
+    return last.length > 0 && !last.includes(".");
+}
+/**
+ * Refuse a bare prefix that would become a malformed grant if it were
+ * rewritten to a folder glob: a `*` inside a segment (`**`, `know*`) or an
+ * empty segment (`/knowledge`, `a//b`). Returns the error text, or null.
+ */
+export function malformedBareSharePrefix(prefix) {
+    if (!looksLikeBareFolderPrefix(prefix))
+        return null;
+    if (prefix.includes("*")) {
+        return (`'${prefix}' has a '*' inside a path segment. Only a whole trailing '/*' segment ` +
+            `(for example 'knowledge/*') or '*' alone (--full) is a glob.`);
+    }
+    if (prefix.split("/").some((segment) => segment.length === 0)) {
+        return `'${prefix}' has an empty path segment. Pass a company-relative path such as 'knowledge'.`;
+    }
+    return null;
+}
+/**
+ * Decide what a bare prefix means by looking it up in the vault. Rewrite `X`
+ * to `X/*` only when `X/` has children and no object `X` exists. Keep `X` when
+ * only the object exists. Refuse when both exist, when neither does, or when
+ * the lookup fails; the caller exits non-zero and points to --exact or `X/*`.
+ */
+export async function resolveBareSharePrefix(params) {
+    const { prefix } = params;
+    if (!looksLikeBareFolderPrefix(prefix))
+        return { kind: "unchanged", prefix };
+    const malformed = malformedBareSharePrefix(prefix);
+    if (malformed)
+        return { kind: "refused", prefix, message: malformed };
+    const folderGlob = `${prefix}/*`;
+    const choose = `Re-run with --exact to use exactly the object '${prefix}', or pass '${folderGlob}' ` +
+        `(quoted) to cover everything under the folder.`;
+    const list = async (listPrefix) => {
+        const res = await vaultApiFetch({
+            token: params.token,
+            path: "/v1/files/list",
+            query: { company: params.companyUid, prefix: listPrefix },
+        });
+        if (!res.ok)
+            throw new Error(`files list failed (${res.status})`);
+        const body = (await res.json());
+        return Array.isArray(body.objects) ? body.objects : [];
+    };
+    let objectExists;
+    let folderHasChildren;
+    try {
+        // The object `X` sorts first among keys that start with `X`, so the first
+        // page holds it when it exists. Children are listed separately so sibling
+        // keys such as `X-old.md` cannot push them off the page.
+        objectExists = (await list(prefix)).some((object) => object.key === prefix);
+        folderHasChildren = (await list(`${prefix}/`)).length > 0;
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return {
+            kind: "refused",
+            prefix,
+            message: `Could not check whether '${prefix}' is a file or a folder (${reason}). ${choose}`,
+        };
+    }
+    if (folderHasChildren && !objectExists)
+        return { kind: "folder", prefix, folderGlob };
+    if (objectExists && !folderHasChildren)
+        return { kind: "unchanged", prefix };
+    return {
+        kind: "refused",
+        prefix,
+        message: objectExists
+            ? `'${prefix}' is both a file and a folder in the vault. ${choose}`
+            : `Nothing exists at '${prefix}' or under '${prefix}/' in the vault, so it is unclear ` +
+                `whether it is a file or a folder. ${choose}`,
+    };
+}
+/** Resolve a bare prefix for a mutating command: print the note, or exit 1 on refusal. */
+async function resolveBareSharePrefixOrExit(params) {
+    if (params.exact)
+        return params.prefix;
+    const resolution = await resolveBareSharePrefix(params);
+    if (resolution.kind === "refused") {
+        console.error(chalk.red(resolution.message));
+        process.exit(1);
+    }
+    if (resolution.kind === "folder") {
+        console.error(chalk.yellow(`Note: '${resolution.prefix}' is a folder in the vault, so this uses the folder glob ` +
+            `'${resolution.folderGlob}' (everything under it). Pass --exact to use the exact ` +
+            `object key '${resolution.prefix}' instead.`));
+        return resolution.folderGlob;
+    }
+    return resolution.prefix;
+}
 async function runDirectGrant(params) {
-    const canonicalPrefix = normalizeCompanyFilePrefix(params.prefix, {
+    let canonicalPrefix = normalizeCompanyFilePrefix(params.prefix, {
         mutating: true,
         rootAdvice: "Use --full --with <principal> to share the entire vault, or pass a bounded path.",
         ...(params.companySlug !== undefined
             ? { companySlug: params.companySlug }
             : {}),
     });
+    if (!params.exact) {
+        const malformed = malformedBareSharePrefix(canonicalPrefix);
+        if (malformed) {
+            console.error(chalk.red(malformed));
+            process.exit(1);
+        }
+    }
     if (!params.permission) {
         console.error(chalk.red("--permission is required when --with is set (read | write)"));
         process.exit(1);
@@ -864,6 +1036,14 @@ async function runDirectGrant(params) {
     const principalLabel = isAll ? "everyone in the company" : granteeId;
     const token = (await resolveVaultCredential()).token;
     const companyUid = await getCompanyUid(token, params.companySlug);
+    if (!params.fullVault) {
+        canonicalPrefix = await resolveBareSharePrefixOrExit({
+            token,
+            companyUid,
+            prefix: canonicalPrefix,
+            exact: params.exact,
+        });
+    }
     let res = await vaultApiFetch({
         token,
         path: `/files/${encodeURIComponent(companyUid)}/acl/grant`,
@@ -966,13 +1146,20 @@ async function runDirectGrant(params) {
 async function runShareSession(params) {
     // Validate every path before minting a session; an anchored path must never
     // silently become a share of the corresponding company-relative objects.
-    const normalizedPaths = params.paths.map((prefix) => normalizeCompanyFilePrefix(prefix, {
+    const canonicalPaths = params.paths.map((prefix) => normalizeCompanyFilePrefix(prefix, {
         mutating: true,
         rootAdvice: "Use --full --with <principal> to share the entire vault, or pass a bounded path.",
         ...(params.companySlug !== undefined
             ? { companySlug: params.companySlug }
             : {}),
     }));
+    for (const prefix of canonicalPaths) {
+        const malformed = malformedBareSharePrefix(prefix);
+        if (malformed) {
+            console.error(chalk.red(malformed));
+            process.exit(1);
+        }
+    }
     let expiresInMs;
     if (params.expires !== undefined) {
         const parsed = parseDuration(params.expires);
@@ -988,6 +1175,12 @@ async function runShareSession(params) {
     }
     const token = (await resolveVaultCredential()).token;
     const companyUid = await getCompanyUid(token, params.companySlug);
+    // A bare folder name in a share session would create the same exact-key row
+    // that blocked members in DEV-5173, so resolve each path like a direct grant.
+    const normalizedPaths = [];
+    for (const prefix of canonicalPaths) {
+        normalizedPaths.push(await resolveBareSharePrefixOrExit({ token, companyUid, prefix }));
+    }
     let session;
     try {
         session = await mintShareSession({

package/dist/commands/mesh.js

@@ -2070,11 +2070,16 @@ async function runContextOrganize(opts) {
             !opts.untracked);
     if (isList) {
         let fetchCandidates;
+        let resolveCompanyUid;
         let offline = Boolean(opts.offline);
         if (!offline) {
             try {
                 const token = await requireToken();
                 fetchCandidates = createCandidatesFetcher({ token });
+                resolveCompanyUid = async (slug) => {
+                    const membership = await resolveActiveMembershipCompany(token, slug, AbortSignal.timeout(ONLINE_MEMBERSHIP_VALIDATION_TIMEOUT_MS));
+                    return membership?.companyUid ?? null;
+                };
             }
             catch {
                 offline = true;
@@ -2084,6 +2089,7 @@ async function runContextOrganize(opts) {
             sessionId,
             root,
             fetchCandidates,
+            resolveCompanyUid,
             offline,
         });
         if (opts.json || opts.machine) {

package/dist/commands/sync-manifest.d.ts

@@ -103,7 +103,23 @@ export interface RunSyncManifestOptions {
      * of forcing a pass on every tick.
      */
     respectThrottle?: boolean;
+    /**
+     * Print one JSON line ({@link manifestOutcomeLine}) instead of the human
+     * summary. `hq doctor --fix` reads it, because the exit code is 0 for
+     * `soft_skipped`, `throttled`, `disabled`, `locked` and
+     * `resend_full_scheduled` too, and none of those uploaded anything.
+     */
+    json?: boolean;
+}
+/** The machine-readable outcome `--json` prints. Fixed tokens only, no paths. */
+export interface ManifestOutcomeLine {
+    status: string;
+    mode?: string;
+    errorKind?: string;
+    errorStatus?: number;
 }
+/** Build the `--json` line for one pass. The free-text error detail is left out. */
+export declare function manifestOutcomeLine(result: RunManifestUploadPassResult): ManifestOutcomeLine;
 export interface RunSyncManifestOutcome {
     result: RunManifestUploadPassResult;
     scope: ResolvedManifestScope;

package/dist/commands/sync-manifest.js

@@ -64,6 +64,15 @@ export const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
 export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export const PERSONAL_SCOPE = "personal";
+/** Build the `--json` line for one pass. The free-text error detail is left out. */
+export function manifestOutcomeLine(result) {
+    return {
+        status: result.status,
+        ...(result.mode ? { mode: result.mode } : {}),
+        ...(result.error?.kind ? { errorKind: result.error.kind } : {}),
+        ...(typeof result.error?.status === "number" ? { errorStatus: result.error.status } : {}),
+    };
+}
 // ── Pure helpers ────────────────────────────────────────────────────────────
 /**
  * Resolve `--scope` into the wire scope.
@@ -301,7 +310,9 @@ export async function runSyncManifest(options, deps) {
             status: "disabled",
             scopeKey: "unknown",
         };
-        deps.log(`${chalk.dim("·")} Manifest upload disabled by ${MANIFEST_DISABLED_ENV} — nothing to do.`);
+        deps.log(options.json === true
+            ? JSON.stringify(manifestOutcomeLine(result))
+            : `${chalk.dim("·")} Manifest upload disabled by ${MANIFEST_DISABLED_ENV} — nothing to do.`);
         return { result, scope: { kind: "personal" }, exitCode: 0 };
     }
     const scope = await resolveManifestScope(options.scopeArg, options.hqRoot, deps.resolveCompanyUid);
@@ -326,6 +337,9 @@ export async function runSyncManifest(options, deps) {
     if (print) {
         deps.log(JSON.stringify(result.chunks ?? [], null, 2));
     }
+    else if (options.json === true) {
+        deps.log(JSON.stringify(manifestOutcomeLine(result)));
+    }
     else {
         deps.log(formatManifestSummary(result, scope));
     }
@@ -342,6 +356,7 @@ export function registerSyncManifestCommand(syncCmd) {
         .option("--scope <scope>", `'${PERSONAL_SCOPE}' or a company slug (defaults to the active company, else ${PERSONAL_SCOPE})`)
         .option("--full", "Send a fresh full baseline instead of a delta")
         .option("--print", "Build and print the chunks as JSON; upload nothing")
+        .option("--json", "Print the pass outcome as one JSON line instead of a summary")
         .option("--respect-throttle", "Honour the 24h per-scope upload throttle instead of forcing a pass (for scheduled callers)")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (options) => {
@@ -360,6 +375,7 @@ export function registerSyncManifestCommand(syncCmd) {
                 full: options.full,
                 print: options.print,
                 respectThrottle: options.respectThrottle,
+                json: options.json,
             }, createDefaultDeps());
             if (outcome.exitCode !== 0)
                 process.exit(outcome.exitCode);

package/dist/lib/bot/decisions.d.ts

@@ -0,0 +1,62 @@
+import { type Decision, type DecisionOption } from "../decisions/client.js";
+export interface DecisionDmClient {
+    list(open?: boolean): Promise<Decision[]>;
+    answer(id: string, choiceId: string, source: "thread"): Promise<Decision>;
+}
+export interface DecisionDmInput {
+    text: string;
+    speakerUid: string | undefined;
+    rootEventId?: string;
+    ownerUid: string;
+    agentUid: string;
+    /** The owner's company uids. Null when they could not be read: refuse. */
+    companyUids: readonly string[] | null;
+    nowMs: number;
+    /** Decision ids already restated after 24 hours. */
+    restated: ReadonlySet<string>;
+}
+export type DecisionDmResult = {
+    kind: "none";
+    notLive?: true;
+} | {
+    kind: "reply";
+    text: string;
+    decisionId?: string;
+    recorded: boolean;
+    notLive?: true;
+} | {
+    kind: "model";
+    note: string;
+    decisionId: string;
+    restate?: string;
+};
+export declare const DECISIONS_NOT_LIVE_REPLY = "Decisions are not live on this HQ server yet (the decisions API returned 404), so I did not record that pick.";
+export declare const RESTATE_AFTER_MS: number;
+/** Same key hq-pro uses for the owner-bot DM pair. */
+export declare function decisionTalkThreadId(ownerUid: string, botUid: string): string;
+export declare function looksLikePick(text: string): boolean;
+export declare function matchDecisionPick(text: string, options: readonly DecisionOption[], opts?: {
+    inCardThread?: boolean;
+}): {
+    kind: "pick";
+    option: DecisionOption;
+} | {
+    kind: "ambiguous";
+    options: DecisionOption[];
+} | {
+    kind: "none";
+};
+/** Full step, for the one restate after 24 hours. Never says "waiting on". */
+export declare function restateDecision(decision: Decision): string;
+export declare function decisionContextNote(decision: Decision): string;
+export declare function handleDecisionDm(input: DecisionDmInput, client: DecisionDmClient): Promise<DecisionDmResult>;
+export interface DecisionTalkState {
+    v: 1;
+    restated: Record<string, string>;
+    /** Replies decided but not yet delivered, by inbox message id. Resent on retry so a saved pick is never re-run. */
+    pending?: Record<string, string>;
+}
+export declare function decisionTalkStatePath(dir: string): string;
+export declare function readDecisionTalkState(dir: string): DecisionTalkState;
+export declare function writeDecisionTalkState(dir: string, state: DecisionTalkState): void;
+//# sourceMappingURL=decisions.d.ts.map