profclaw 0.0.1-beta.1

package/dist/routes/whatsapp.js

@@ -0,0 +1,391 @@
+/**
+ * WhatsApp Business Cloud API Routes
+ *
+ * Handles:
+ * - Webhook verification (GET challenge)
+ * - Webhook updates (messages, status updates)
+ * - Health checks
+ * - Security: HMAC-SHA256 signature verification, phone allowlist
+ */
+import { Hono } from 'hono';
+import { whatsappProvider, verifyWhatsAppWebhook, isWhatsAppSenderAllowed, setWhatsAppConfig, clearWhatsAppConfig, } from '../chat/providers/whatsapp/index.js';
+import { getChatRegistry } from '../chat/providers/registry.js';
+import { logger } from '../utils/logger.js';
+import { isDuplicateWebhookEvent } from './webhook-dedup.js';
+// Re-export formatToolResult for channel response formatting
+// Usage: formatToolResult(toolName, result, 'plain') → { summary, detail }
+export { formatToolResult } from '../chat/format/index.js';
+const whatsapp = new Hono();
+function buildScopedWhatsAppPayload(payload, entryIndex, changeIndex, messageIndex) {
+    const entry = payload.entry?.[entryIndex];
+    const change = entry?.changes?.[changeIndex];
+    const value = change?.value;
+    const message = value?.messages?.[messageIndex];
+    const contact = value?.contacts?.find((candidate) => candidate.wa_id === message?.from);
+    return {
+        object: payload.object,
+        entry: entry && change && value && message
+            ? [{
+                    ...entry,
+                    changes: [{
+                            ...change,
+                            value: {
+                                ...value,
+                                contacts: contact ? [contact] : [],
+                                messages: [message],
+                            },
+                        }],
+                }]
+            : [],
+    };
+}
+// CONFIGURATION
+const WHATSAPP_PHONE_NUMBER_ID = process.env.WHATSAPP_PHONE_NUMBER_ID || '';
+const WHATSAPP_BUSINESS_ACCOUNT_ID = process.env.WHATSAPP_BUSINESS_ACCOUNT_ID || '';
+const WHATSAPP_ACCESS_TOKEN = process.env.WHATSAPP_ACCESS_TOKEN || '';
+const WHATSAPP_WEBHOOK_VERIFY_TOKEN = process.env.WHATSAPP_WEBHOOK_VERIFY_TOKEN || '';
+const WHATSAPP_APP_SECRET = process.env.WHATSAPP_APP_SECRET || '';
+const WHATSAPP_ALLOWED_PHONES = (process.env.WHATSAPP_ALLOWED_PHONES || '')
+    .split(',')
+    .map((v) => v.trim())
+    .filter((v) => v.length > 0);
+// Build config from environment
+function getEnvConfig() {
+    return {
+        id: 'whatsapp-env',
+        name: 'WhatsApp (Environment)',
+        enabled: true,
+        isDefault: true,
+        provider: 'whatsapp',
+        phoneNumberId: WHATSAPP_PHONE_NUMBER_ID,
+        businessAccountId: WHATSAPP_BUSINESS_ACCOUNT_ID,
+        accessToken: WHATSAPP_ACCESS_TOKEN,
+        webhookVerifyToken: WHATSAPP_WEBHOOK_VERIFY_TOKEN,
+        appSecret: WHATSAPP_APP_SECRET,
+        allowedPhoneNumbers: WHATSAPP_ALLOWED_PHONES,
+    };
+}
+// Get config from registry or env
+function getConfig() {
+    // Try registry first (for multi-account support)
+    const registryAccount = getChatRegistry().getDefaultAccount('whatsapp');
+    if (registryAccount && registryAccount.provider === 'whatsapp') {
+        return registryAccount;
+    }
+    // Fall back to environment variables
+    if (WHATSAPP_ACCESS_TOKEN && WHATSAPP_PHONE_NUMBER_ID) {
+        return getEnvConfig();
+    }
+    return null;
+}
+// WEBHOOK ROUTES
+/**
+ * GET /webhook - Webhook verification challenge
+ *
+ * Meta sends this to verify webhook ownership:
+ * - hub.mode = 'subscribe'
+ * - hub.verify_token = your configured token
+ * - hub.challenge = random string to echo back
+ */
+whatsapp.get('/webhook', async (c) => {
+    const config = getConfig();
+    const mode = c.req.query('hub.mode');
+    const token = c.req.query('hub.verify_token');
+    const challenge = c.req.query('hub.challenge');
+    logger.debug('[WhatsApp] Webhook verification request', { mode, hasToken: !!token });
+    if (mode === 'subscribe') {
+        // Check verify token
+        const expectedToken = config?.webhookVerifyToken || WHATSAPP_WEBHOOK_VERIFY_TOKEN;
+        if (!expectedToken) {
+            logger.warn('[WhatsApp] No verify token configured');
+            return c.text('Forbidden - No verify token configured', 403);
+        }
+        if (token === expectedToken) {
+            logger.info('[WhatsApp] Webhook verified successfully');
+            return c.text(challenge || '', 200);
+        }
+        logger.warn('[WhatsApp] Webhook verification failed - token mismatch');
+        return c.text('Forbidden - Token mismatch', 403);
+    }
+    return c.text('Bad Request - Invalid mode', 400);
+});
+/**
+ * POST /webhook - Receive updates from WhatsApp
+ *
+ * Security:
+ * - Verifies X-Hub-Signature-256 header (HMAC-SHA256)
+ * - Checks phone number allowlist
+ * - Logs all webhook events for audit
+ */
+whatsapp.post('/webhook', async (c) => {
+    const config = getConfig();
+    if (!config || !config.accessToken || !config.phoneNumberId) {
+        logger.warn('[WhatsApp] Webhook received but not configured');
+        return c.json({ error: 'WhatsApp not configured' }, 503);
+    }
+    // Get raw body for signature verification
+    const rawBody = await c.req.text();
+    const signature = c.req.header('X-Hub-Signature-256');
+    // Verify signature
+    if (!verifyWhatsAppWebhook(config.appSecret, signature, rawBody)) {
+        logger.warn('[WhatsApp] Webhook signature verification failed');
+        return c.json({ error: 'Unauthorized' }, 401);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rawBody);
+    }
+    catch {
+        logger.error('[WhatsApp] Invalid JSON in webhook request');
+        return c.json({ error: 'Invalid JSON' }, 400);
+    }
+    // Verify this is a WhatsApp Business Account event
+    if (payload.object !== 'whatsapp_business_account') {
+        logger.debug('[WhatsApp] Non-WhatsApp event received', { object: payload.object });
+        return c.json({ ok: true });
+    }
+    // Set config for outbound adapter
+    setWhatsAppConfig(config);
+    // Process each entry
+    for (const [entryIndex, entry] of (payload.entry || []).entries()) {
+        for (const [changeIndex, change] of (entry.changes || []).entries()) {
+            const value = change.value;
+            // Handle status updates (log only - not a chat event)
+            if (value.statuses) {
+                for (const status of value.statuses) {
+                    logger.debug('[WhatsApp] Message status update', {
+                        messageId: status.id,
+                        status: status.status,
+                        recipientId: status.recipient_id,
+                    });
+                }
+            }
+            // Handle incoming messages
+            if (value.messages) {
+                for (const [messageIndex, message] of value.messages.entries()) {
+                    if (isDuplicateWebhookEvent('whatsapp:message', message.id)) {
+                        continue;
+                    }
+                    // Check phone allowlist
+                    const allowCheck = isWhatsAppSenderAllowed(config, message.from);
+                    if (!allowCheck.allowed) {
+                        logger.info(`[WhatsApp] Sender blocked: ${allowCheck.reason}`);
+                        continue;
+                    }
+                    const scopedPayload = buildScopedWhatsAppPayload(payload, entryIndex, changeIndex, messageIndex);
+                    // Parse as action (button/list reply)
+                    const action = whatsappProvider.inbound.parseAction(scopedPayload);
+                    if (action) {
+                        await getChatRegistry().emit({
+                            type: 'action',
+                            provider: 'whatsapp',
+                            accountId: config.id,
+                            timestamp: new Date(),
+                            payload: action,
+                        });
+                        continue;
+                    }
+                    // Parse as regular message
+                    const incomingMessage = whatsappProvider.inbound.parseMessage(scopedPayload);
+                    if (incomingMessage) {
+                        await getChatRegistry().emit({
+                            type: 'message',
+                            provider: 'whatsapp',
+                            accountId: config.id,
+                            timestamp: new Date(),
+                            payload: incomingMessage,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    logger.debug('[WhatsApp] Webhook processed');
+    return c.json({ ok: true });
+});
+// STATUS & HEALTH
+/**
+ * GET /status - WhatsApp status and health check
+ */
+whatsapp.get('/status', async (c) => {
+    const config = getConfig();
+    if (!config) {
+        return c.json({
+            configured: false,
+            connected: false,
+            message: 'WhatsApp not configured. Set WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID.',
+        });
+    }
+    const isConfigured = whatsappProvider.status.isConfigured(config);
+    if (!isConfigured) {
+        return c.json({
+            configured: false,
+            connected: false,
+            message: 'Access token or phone number ID not set',
+        });
+    }
+    const health = await whatsappProvider.status.checkHealth(config);
+    return c.json({
+        configured: true,
+        connected: health.connected,
+        latencyMs: health.latencyMs,
+        error: health.error,
+        phone: health.details
+            ? {
+                verifiedName: health.details.verifiedName,
+                displayPhoneNumber: health.details.displayPhoneNumber,
+                qualityRating: health.details.qualityRating,
+            }
+            : null,
+        allowlist: {
+            phones: config.allowedPhoneNumbers?.length || 0,
+        },
+    });
+});
+/**
+ * POST /test - Send a test message
+ *
+ * Body: { to: string, text: string }
+ */
+whatsapp.post('/test', async (c) => {
+    const config = getConfig();
+    if (!config?.accessToken || !config?.phoneNumberId) {
+        return c.json({ error: 'WhatsApp not configured' }, 400);
+    }
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return c.json({ error: 'Invalid JSON' }, 400);
+    }
+    if (!body.to || !body.text) {
+        return c.json({ error: 'Missing to or text parameter' }, 400);
+    }
+    // Set config for outbound adapter
+    setWhatsAppConfig(config);
+    const result = await whatsappProvider.outbound.send({
+        provider: 'whatsapp',
+        to: body.to,
+        text: body.text,
+    });
+    if (result.success) {
+        return c.json({
+            success: true,
+            messageId: result.messageId,
+        });
+    }
+    return c.json({ error: result.error || 'Failed to send message' }, 500);
+});
+// CONFIGURATION MANAGEMENT
+/**
+ * GET /config - Get current configuration (redacted)
+ */
+whatsapp.get('/config', async (c) => {
+    const config = getConfig();
+    if (!config) {
+        return c.json({
+            configured: false,
+            source: null,
+        });
+    }
+    return c.json({
+        configured: true,
+        source: config.id === 'whatsapp-env' ? 'environment' : 'database',
+        accountId: config.id,
+        accountName: config.name,
+        enabled: config.enabled,
+        isDefault: config.isDefault,
+        hasAppSecret: !!config.appSecret,
+        hasVerifyToken: !!config.webhookVerifyToken,
+        allowedPhones: config.allowedPhoneNumbers?.length || 0,
+        phoneNumberId: config.phoneNumberId ? `****${config.phoneNumberId.slice(-4)}` : null,
+    });
+});
+/**
+ * POST /config - Update configuration (stores in registry)
+ *
+ * Body: {
+ *   phoneNumberId: string,
+ *   businessAccountId?: string,
+ *   accessToken: string,
+ *   webhookVerifyToken?: string,
+ *   appSecret?: string,
+ *   allowedPhoneNumbers?: string[],
+ *   name?: string,
+ *   enabled?: boolean
+ * }
+ */
+whatsapp.post('/config', async (c) => {
+    let body;
+    try {
+        body = await c.req.json();
+    }
+    catch {
+        return c.json({ error: 'Invalid JSON' }, 400);
+    }
+    if (!body.phoneNumberId || !body.accessToken) {
+        return c.json({ error: 'Missing phoneNumberId or accessToken' }, 400);
+    }
+    const config = {
+        id: body.id || `whatsapp-${Date.now()}`,
+        name: body.name || 'WhatsApp Business',
+        enabled: body.enabled ?? true,
+        isDefault: true,
+        provider: 'whatsapp',
+        phoneNumberId: body.phoneNumberId,
+        businessAccountId: body.businessAccountId,
+        accessToken: body.accessToken,
+        webhookVerifyToken: body.webhookVerifyToken || crypto.randomUUID(),
+        appSecret: body.appSecret,
+        allowedPhoneNumbers: body.allowedPhoneNumbers || [],
+    };
+    // Validate by checking health
+    setWhatsAppConfig(config);
+    const health = await whatsappProvider.status.checkHealth(config);
+    if (!health.connected) {
+        return c.json({ error: health.error || 'Invalid configuration - could not connect' }, 400);
+    }
+    // Register the account
+    try {
+        getChatRegistry().registerAccount(config);
+        logger.info('[WhatsApp] Account configured', {
+            id: config.id,
+            phoneNumber: health.details?.displayPhoneNumber,
+        });
+        return c.json({
+            success: true,
+            account: {
+                id: config.id,
+                name: config.name,
+                phoneNumber: health.details?.displayPhoneNumber,
+                verifiedName: health.details?.verifiedName,
+            },
+            webhookVerifyToken: config.webhookVerifyToken,
+        });
+    }
+    catch (error) {
+        logger.error('[WhatsApp] Failed to register account:', error instanceof Error ? error : undefined);
+        return c.json({ error: 'Failed to save configuration' }, 500);
+    }
+});
+/**
+ * DELETE /config - Disconnect WhatsApp
+ */
+whatsapp.delete('/config', async (c) => {
+    try {
+        const accounts = getChatRegistry().listAccounts('whatsapp');
+        for (const account of accounts) {
+            getChatRegistry().removeAccount('whatsapp', account.id);
+        }
+        clearWhatsAppConfig();
+        logger.info('[WhatsApp] Disconnected');
+        return c.json({ success: true });
+    }
+    catch (error) {
+        logger.error('[WhatsApp] Failed to disconnect:', error instanceof Error ? error : undefined);
+        return c.json({ error: 'Failed to disconnect' }, 500);
+    }
+});
+export { whatsapp as whatsappRoutes };
+//# sourceMappingURL=whatsapp.js.map

package/dist/security/audit-scanner.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Audit Scanner
+ *
+ * Advanced audit logging with proactive scanning.
+ * Features:
+ * - Skill scanning for dangerous patterns
+ * - Config validation for insecure settings
+ * - Pattern alerting with risk levels
+ * - Integration with AuditLogger
+ */
+import type { AuditScannerConfig, ScanResult, ConfigValidationResult } from './types.js';
+export declare class AuditScanner {
+    private config;
+    private patternDefs;
+    constructor(config?: Partial<AuditScannerConfig>);
+    /**
+     * Scan skill content for dangerous patterns
+     */
+    scanSkill(content: string, source: string): ScanResult;
+    /**
+     * Validate configuration for security issues
+     */
+    validateConfig(config: Record<string, unknown>): ConfigValidationResult;
+    /**
+     * Get current config
+     */
+    getConfig(): AuditScannerConfig;
+    private highestRisk;
+}
+export declare function getAuditScanner(): AuditScanner | null;
+export declare function createAuditScanner(config?: Partial<AuditScannerConfig>): AuditScanner;
+//# sourceMappingURL=audit-scanner.d.ts.map

package/dist/security/audit-scanner.js

@@ -0,0 +1,217 @@
+/**
+ * Audit Scanner
+ *
+ * Advanced audit logging with proactive scanning.
+ * Features:
+ * - Skill scanning for dangerous patterns
+ * - Config validation for insecure settings
+ * - Pattern alerting with risk levels
+ * - Integration with AuditLogger
+ */
+import { logger } from '../utils/logger.js';
+const DEFAULT_DANGEROUS_PATTERNS = [
+    // Shell execution
+    {
+        pattern: /child_process|exec\s*\(|execSync|spawn\s*\(|spawnSync/,
+        risk: 'CRITICAL',
+        description: 'Shell execution detected',
+    },
+    {
+        pattern: /\beval\s*\(/,
+        risk: 'CRITICAL',
+        description: 'eval() usage detected',
+    },
+    {
+        pattern: /Function\s*\(\s*['"`]/,
+        risk: 'HIGH',
+        description: 'Dynamic function construction',
+    },
+    // Network access
+    {
+        pattern: /\bfetch\s*\(|require\s*\(\s*['"]https?['"]\)|axios|got\s*\(/,
+        risk: 'HIGH',
+        description: 'Network access detected',
+    },
+    {
+        pattern: /net\.connect|dgram\.createSocket|tls\.connect/,
+        risk: 'CRITICAL',
+        description: 'Raw socket access',
+    },
+    // Environment / credential access
+    {
+        pattern: /process\.env\[|process\.env\./,
+        risk: 'MEDIUM',
+        description: 'Environment variable access',
+    },
+    {
+        pattern: /(?:API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)(?:\s*[:=]|\s*\])/i,
+        risk: 'HIGH',
+        description: 'Potential credential access',
+    },
+    // Filesystem writes outside project
+    {
+        pattern: /writeFileSync|appendFileSync|createWriteStream/,
+        risk: 'MEDIUM',
+        description: 'Filesystem write operation',
+    },
+    {
+        pattern: /unlinkSync|rmdirSync|rmSync/,
+        risk: 'HIGH',
+        description: 'Filesystem deletion operation',
+    },
+    // Prototype pollution / injection
+    {
+        pattern: /__proto__|constructor\s*\[|Object\.setPrototypeOf/,
+        risk: 'CRITICAL',
+        description: 'Prototype pollution risk',
+    },
+    // Obfuscation indicators
+    {
+        pattern: /atob\s*\(|Buffer\.from\s*\([^)]+,\s*['"]base64['"]\)/,
+        risk: 'MEDIUM',
+        description: 'Base64 decoding (possible obfuscation)',
+    },
+    {
+        pattern: /\\x[0-9a-f]{2}|\\u[0-9a-f]{4}/i,
+        risk: 'LOW',
+        description: 'Encoded characters detected',
+    },
+];
+const DEFAULT_CONFIG = {
+    enabled: true,
+    dangerousPatterns: DEFAULT_DANGEROUS_PATTERNS.map((p) => p.pattern),
+    alertOnMatch: true,
+};
+// Audit Scanner
+export class AuditScanner {
+    config;
+    patternDefs;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.patternDefs = DEFAULT_DANGEROUS_PATTERNS;
+    }
+    /**
+     * Scan skill content for dangerous patterns
+     */
+    scanSkill(content, source) {
+        if (!this.config.enabled) {
+            return { source, findings: [], riskLevel: 'LOW', scannedAt: Date.now() };
+        }
+        const findings = [];
+        const lines = content.split('\n');
+        for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+            const line = lines[lineIdx];
+            for (const def of this.patternDefs) {
+                const match = line.match(def.pattern);
+                if (match) {
+                    findings.push({
+                        pattern: def.pattern.source,
+                        match: match[0],
+                        line: lineIdx + 1,
+                        risk: def.risk,
+                        description: def.description,
+                    });
+                }
+            }
+        }
+        // Determine overall risk level
+        const riskLevel = this.highestRisk(findings);
+        if (findings.length > 0 && this.config.alertOnMatch) {
+            logger.warn(`[AuditScanner] ${findings.length} finding(s) in ${source}: ${riskLevel} risk`, { component: 'AuditScanner' });
+            for (const finding of findings) {
+                logger.info(`[AuditScanner]   Line ${finding.line}: ${finding.description} (${finding.risk})`, { component: 'AuditScanner' });
+            }
+        }
+        return { source, findings, riskLevel, scannedAt: Date.now() };
+    }
+    /**
+     * Validate configuration for security issues
+     */
+    validateConfig(config) {
+        const warnings = [];
+        // Check security mode
+        if (config.securityMode === 'full' || config.security_mode === 'full') {
+            warnings.push({
+                field: 'securityMode',
+                message: 'Security mode is set to "full" - all tool calls are unrestricted',
+                risk: 'CRITICAL',
+            });
+        }
+        // Check sandbox disabled
+        if (config.enableSandbox === false || config.sandbox?.toString() === 'false') {
+            warnings.push({
+                field: 'enableSandbox',
+                message: 'Docker sandbox is disabled - tool execution is not isolated',
+                risk: 'HIGH',
+            });
+        }
+        // Check missing auth
+        if (!config.authToken && !config.AUTH_TOKEN && !config.apiKey && !config.API_KEY) {
+            warnings.push({
+                field: 'authToken',
+                message: 'No authentication token configured',
+                risk: 'HIGH',
+            });
+        }
+        // Check deployment mode
+        if (config.PROFCLAW_MODE === 'pico' || config.deploymentMode === 'pico') {
+            // Pico mode has limited security features
+            if (config.securityMode !== 'deny' && config.security_mode !== 'deny') {
+                warnings.push({
+                    field: 'deploymentMode',
+                    message: 'Pico mode has limited security - consider restricting security mode',
+                    risk: 'MEDIUM',
+                });
+            }
+        }
+        // Check for insecure defaults
+        if (config.POOL_TIMEOUT_MS && Number(config.POOL_TIMEOUT_MS) > 600_000) {
+            warnings.push({
+                field: 'POOL_TIMEOUT_MS',
+                message: 'Tool timeout exceeds 10 minutes - risk of long-running attacks',
+                risk: 'MEDIUM',
+            });
+        }
+        if (config.POOL_MAX_CONCURRENT && Number(config.POOL_MAX_CONCURRENT) > 200) {
+            warnings.push({
+                field: 'POOL_MAX_CONCURRENT',
+                message: 'High concurrency limit may enable resource exhaustion',
+                risk: 'LOW',
+            });
+        }
+        if (warnings.length > 0 && this.config.alertOnMatch) {
+            logger.warn(`[AuditScanner] Config validation: ${warnings.length} warning(s)`, { component: 'AuditScanner' });
+        }
+        return {
+            valid: !warnings.some((w) => w.risk === 'CRITICAL'),
+            warnings,
+        };
+    }
+    /**
+     * Get current config
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    // Private
+    highestRisk(findings) {
+        const order = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+        let highest = 'LOW';
+        for (const f of findings) {
+            if (order.indexOf(f.risk) > order.indexOf(highest)) {
+                highest = f.risk;
+            }
+        }
+        return highest;
+    }
+}
+// Singleton
+let instance = null;
+export function getAuditScanner() {
+    return instance;
+}
+export function createAuditScanner(config) {
+    instance = new AuditScanner(config);
+    return instance;
+}
+//# sourceMappingURL=audit-scanner.js.map

package/dist/security/fs-guard.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Filesystem Guard
+ *
+ * Prevents path traversal and unauthorized filesystem access.
+ * Features:
+ * - Path normalization (resolve + normalize to eliminate ../)
+ * - Symlink resolution to detect symlink-based escapes
+ * - Per-mode allowlists (pico/mini/pro)
+ * - Configurable blocked paths and patterns
+ * - Home directory scoping
+ */
+import type { GuardResult, FsGuardConfig, FsOperation } from './types.js';
+export declare class FsGuard {
+    private config;
+    private normalizedAllowed;
+    private normalizedBlocked;
+    constructor(config?: Partial<FsGuardConfig>);
+    /**
+     * Validate a file path before access
+     */
+    validatePath(filePath: string, operation?: FsOperation): Promise<GuardResult>;
+    /**
+     * Check if a path is within any of the allowed paths
+     */
+    isInAllowedPath(normalizedPath: string): boolean;
+    /**
+     * Get current config
+     */
+    getConfig(): FsGuardConfig;
+    /**
+     * Validate a symlink-resolved path
+     */
+    private validateResolvedPath;
+    /**
+     * Safely resolve realpath, returning null if file doesn't exist
+     */
+    private safeRealpath;
+}
+export declare function getFsGuard(): FsGuard | null;
+export declare function createFsGuard(config?: Partial<FsGuardConfig>): FsGuard;
+//# sourceMappingURL=fs-guard.d.ts.map