@try-works/dsh-tool-mode 0.0.0-stage → 0.5.45

package/lib/ptc-authority.js

@@ -0,0 +1,242 @@
+/**
+ * The authorized tool bindings a PTC program may call (CODE-03, ARCH-01, SEC-03).
+ *
+ * The directive is specific about this, and about what NOT to do:
+ *
+ *   "ONE authorized-tool-pipeline function feeding both native PTC and external
+ *    `tool_mode_run` — intersect requested names with the grant and the visible tool set,
+ *    REJECT unknown/forbidden rather than omit."
+ *
+ * **Reject rather than omit** is the whole design. A program that asks for a tool it may
+ * not have must fail loudly: silently handing it a smaller namespace produces a program
+ * that runs, quietly does something other than what it says, and reports success. That is
+ * worse than a refusal, because the caller cannot tell the difference.
+ *
+ * The bindings themselves are built with a **null prototype**, so a program cannot reach
+ * `Object.prototype` through a binding name — `toString`, `constructor` and `__proto__`
+ * stop being reachable as if they were tools.
+ *
+ * @module @try-works/dsh-tool-mode/ptc-authority
+ */
+/**
+ * Generate TypeScript bindings for EXACTLY the names a program was authorized to call
+ * (CODE-03). The generated source is descriptive metadata, not executable code.
+ * @param names - the bound names, after the grant/visibility intersection.
+ * @returns a TypeScript interface declaration.
+ */
+export function generateProgramTypes(names) {
+    const members = [...names]
+        .sort((left, right) => left.localeCompare(right))
+        .map(name => `  readonly ${name}: (args: Record<string, unknown>) => Promise<unknown>`);
+    return [
+        '/** TypeScript bindings for exactly the tools this program was authorized to call. */',
+        'export interface ToolProgramBindings {',
+        ...members,
+        '}',
+    ].join('\n');
+}
+/**
+ * Whether a name is usable as a binding.
+ *
+ * A generated program references bindings as identifiers, so a name that is not a plain
+ * identifier cannot be bound — and `__proto__` in particular must never become a key on
+ * the map, since assigning it would change the object's prototype rather than add a field.
+ * @param name - the candidate name.
+ * @returns whether it is usable.
+ */
+export function isBindableName(name) {
+    if (name.length === 0 || name.length > 64)
+        return false;
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
+        return false;
+    // Reserved words would produce a program that cannot be generated.
+    if (RESERVED_WORDS.has(name))
+        return false;
+    // Globals a binding must never shadow, because the runtime supplies them.
+    if (RESERVED_BINDING_GLOBALS.has(name))
+        return false;
+    return true;
+}
+/** Words that cannot appear as bindings in the generated language. */
+const RESERVED_WORDS = new Set([
+    'await', 'break', 'case', 'catch', 'class', 'const', 'continue', 'debugger', 'default',
+    'delete', 'do', 'else', 'enum', 'export', 'extends', 'false', 'finally', 'for',
+    'function', 'if', 'import', 'in', 'instanceof', 'new', 'null', 'return', 'super',
+    'switch', 'this', 'throw', 'true', 'try', 'typeof', 'var', 'void', 'while', 'with',
+    'yield', 'let', 'static', 'implements', 'interface', 'package', 'private', 'protected',
+    'public',
+]);
+/** Globals the runtime supplies, which a binding must not replace. */
+const RESERVED_BINDING_GLOBALS = new Set([
+    'console', 'globalThis', 'process', 'require', 'module', 'exports', 'JSON', 'Math',
+    'Promise', 'Object', 'Array', 'String', 'Number', 'Boolean', 'Date', 'RegExp', 'Error',
+    'Map', 'Set', 'Symbol', 'BigInt', 'Reflect', 'Proxy', 'undefined', 'NaN', 'Infinity',
+    'eval', 'Function', 'arguments', 'prototype', 'constructor', '__proto__',
+    /**
+     * EVERY `Object.prototype` member, named explicitly.
+     *
+     * These are not globals and not reserved words, so a check for those two categories
+     * alone lets them through — and they are exactly the names a program probes for. Even
+     * with a null-prototype map, refusing them BY NAME means a name that resolves to
+     * inherited behaviour can never be bound, rather than depending on the map's prototype
+     * staying null forever.
+     */
+    'toString', 'toLocaleString', 'valueOf', 'hasOwnProperty', 'isPrototypeOf',
+    'propertyIsEnumerable', '__defineGetter__', '__defineSetter__', '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/**
+ * Tool names a program binding must NEVER expose, regardless of grant (CODE-07).
+ *
+ * `tool_mode_run` is the recursive composition door: a program could nest programs, which
+ * the requirement forbids in v1. The management surface (`model_tools` and the extension
+ * install/activation controls) is operator territory: EXT-32 excludes installer and
+ * administration bindings from Code Mode, and SEC-09 keeps installation approval separate
+ * from tool-use permission, so a program that could reach them would hold the management
+ * grant by proxy.
+ *
+ * EXPORTED so the planning surface (NDL-02) reuses the SAME names: a `tools_plan`
+ * proposal must never target the composition door or the management surface either, and a
+ * second, independently maintained copy of this list would drift the first time one of
+ * them was edited. One set, two consumers, both refused by name.
+ *
+ * SEALED AS A FROZEN ARRAY, deliberately not a frozen `Set`: freezing a `Set` does NOT
+ * prevent `add`/`delete` (those methods mutate internal slots without consulting
+ * extensibility), so a frozen Set would only LOOK immutable. A frozen array throws on
+ * every mutation in strict mode, so neither consumer — nor any code holding a
+ * reference — can add or remove a name at runtime and silently desynchronize the two
+ * surfaces that depend on it.
+ */
+export const EXCLUDED_BINDINGS = Object.freeze(['tool_mode_run', 'model_tools', 'model_tools_manage', 'tool_mode_list', 'tool_mode_describe']);
+/**
+ * Build the bindings a program may call (CODE-03, SEC-03).
+ *
+ * Intersects the requested names with BOTH the grant and the visible set, and refuses the
+ * whole request if anything is unattainable — so a program never runs against a smaller
+ * namespace than it declared.
+ *
+ * @param request - what the program asked for.
+ * @param authority - what is granted and what is available.
+ * @param resolve - resolves one bound name to its implementation.
+ * @returns the bindings, or every rejection.
+ */
+export function authorizeProgramTools(request, authority, resolve) {
+    const granted = new Set(authority.granted);
+    const visible = new Set(authority.visible);
+    const confidential = new Set(authority.confidential ?? []);
+    const rejections = [];
+    const seen = new Set();
+    const bound = [];
+    for (const name of request.requested) {
+        if (!isBindableName(name)) {
+            rejections.push({
+                name,
+                reason: 'invalid-name',
+                remedy: 'A binding name must be a plain identifier that is not a reserved word, a runtime global or __proto__.',
+            });
+            continue;
+        }
+        if (seen.has(name)) {
+            rejections.push({
+                name,
+                reason: 'duplicate',
+                remedy: 'Request each tool once; a repeated name makes the generated bindings ambiguous.',
+            });
+            continue;
+        }
+        seen.add(name);
+        /**
+         * CODE-07 EXCLUSIONS ARE CHECKED FIRST.
+         *
+         * These names are un-bindable by policy, not by grant state: whether the caller's
+         * grant admits them is irrelevant, because a program must never hold the composition
+         * door or the management surface regardless of who authorizes it.
+         */
+        if (EXCLUDED_BINDINGS.includes(name)) {
+            rejections.push({
+                name,
+                reason: 'excluded',
+                remedy: `"${name}" cannot be called from a program: recursive composition and management bindings are excluded from Code Mode (CODE-07).`,
+            });
+            continue;
+        }
+        if (confidential.has(name)) {
+            rejections.push({
+                name,
+                reason: 'confidential',
+                remedy: `"${name}" is blocked by the operator confidentiality policy; its canonical value cannot cross the program boundary (MCP-11).`,
+            });
+            continue;
+        }
+        /**
+         * FORBIDDEN IS CHECKED BEFORE UNKNOWN, deliberately.
+         *
+         * A caller probing for names it has no grant for must be told "forbidden" rather than
+         * "unknown": telling it a tool does not exist would let it infer the difference
+         * between a name that is absent and a name it may not use, and the second is
+         * information the caller has not earned.
+         */
+        if (!granted.has(name)) {
+            rejections.push({
+                name,
+                reason: 'forbidden',
+                remedy: 'Request only tools this invocation is authorized for; the grant is not widened by asking.',
+            });
+            continue;
+        }
+        if (!visible.has(name)) {
+            rejections.push({
+                name,
+                reason: 'unknown',
+                remedy: 'The tool is authorized but not currently registered; its owning extension may be deactivated.',
+            });
+            continue;
+        }
+        if (resolve(name) === undefined) {
+            rejections.push({
+                name,
+                reason: 'unknown',
+                remedy: 'No implementation is bound for this name.',
+            });
+            continue;
+        }
+        bound.push(name);
+    }
+    if (rejections.length > 0) {
+        // ALL OR NOTHING. Binding the reachable subset would run a program that does not do
+        // what it declares, which is the failure mode this refusal exists to prevent.
+        return { ok: false, rejections };
+    }
+    /**
+     * A NULL-PROTOTYPE map, built with `defineProperty`.
+     *
+     * A plain object literal would inherit `toString`, `constructor` and friends, so a
+     * program referencing `toString()` would reach `Object.prototype` instead of failing.
+     * A null prototype removes that path entirely rather than filtering the names that use
+     * it.
+     */
+    const bindings = Object.create(null);
+    for (const name of bound) {
+        const binding = resolve(name);
+        Object.defineProperty(bindings, name, {
+            value: binding,
+            enumerable: true,
+            writable: false,
+            configurable: false,
+        });
+    }
+    return { ok: true, bindings, bound };
+}
+/**
+ * Describe a refusal for a caller (CODE-03).
+ *
+ * Names every rejection and why, because a program author who is told only that the
+ * request failed cannot fix it.
+ * @param rejections - the refusals.
+ * @returns a readable summary.
+ */
+export function describeRejections(rejections) {
+    const lines = rejections.map(entry => `  ${entry.name}: ${entry.reason} — ${entry.remedy}`);
+    return `the program requested tools it may not use:\n${lines.join('\n')}`;
+}
+//# sourceMappingURL=ptc-authority.js.map

package/lib/ptc-confinement.d.ts

@@ -0,0 +1,60 @@
+/** The environment variable naming the evidence artifact. */
+export declare const CONFINEMENT_EVIDENCE_ENV = "DSH_PTC_CONFINEMENT_EVIDENCE";
+/** The artifact's discriminator. */
+export declare const CONFINEMENT_EVIDENCE_KIND = "ptc-confinement-evidence";
+/** The artifact's schema version. */
+export declare const CONFINEMENT_EVIDENCE_VERSION = 1;
+/** The validated shape the recorder writes. */
+export interface ConfinementEvidence {
+    readonly kind: typeof CONFINEMENT_EVIDENCE_KIND;
+    readonly version: number;
+    readonly passed: boolean;
+    /** ISO timestamp of the run. */
+    readonly generatedAt: string;
+    /** The package version the suite ran against. */
+    readonly packageVersion: string;
+    /** `process.platform` of the machine that ran it. */
+    readonly platform: string;
+    /** `process.version` of the machine that ran it. */
+    readonly node: string;
+    /** The suite files that were run. */
+    readonly tests: readonly string[];
+    /** The exact command line, so the run is reproducible. */
+    readonly command: string;
+}
+/** The result of reading the artifact. */
+export type ConfinementEvidenceCheck = {
+    readonly ok: true;
+    readonly path: string;
+    readonly evidence: ConfinementEvidence;
+} | {
+    readonly ok: false;
+    readonly present: boolean;
+    readonly path?: string;
+    readonly reason: string;
+};
+/**
+ * Read and validate the evidence artifact.
+ *
+ * The path is the operator's `DSH_PTC_CONFINEMENT_EVIDENCE` when set, otherwise the
+ * standard local artifact `~/.dsh/ptc-confinement-evidence.json` that the recorder writes.
+ * The default matters because a host started normally never carries that variable, and a
+ * gate whose only release path requires a wrapper launcher is still effectively closed.
+ * The default is not a bypass: the artifact is validated exactly like an explicit one —
+ * kind, schema, pass, package version, platform, timestamp, test list, command and counts.
+ *
+ * Failures are VALUES with a reason, never exceptions: a gate that throws on a malformed
+ * file would crash the host, and one that silently treats a malformed file as evidence
+ * would open the gate. Both are refused here with the reason spelled out.
+ * @param options - the environment, the expected package version, and the platform.
+ * @returns the check outcome.
+ */
+export declare function checkConfinementEvidence(options: {
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly expectedVersion: string;
+    readonly platform?: string;
+    readonly readFile?: (path: string) => string;
+    /** Fallback path when the environment names none; the runtime supplies the home file. */
+    readonly defaultPath?: string;
+}): ConfinementEvidenceCheck;
+//# sourceMappingURL=ptc-confinement.d.ts.map

package/lib/ptc-confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ptc-confinement.d.ts","sourceRoot":"","sources":["../src/ptc-confinement.ts"],"names":[],"mappings":"AAwBA,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,iCAAiC,CAAA;AACtE,oCAAoC;AACpC,eAAO,MAAM,yBAAyB,6BAA6B,CAAA;AACnE,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAE7C,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,yBAAyB,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,gCAAgC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,0CAA0C;AAC1C,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAOtG;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B,GAAG,wBAAwB,CA+J3B"}

package/lib/ptc-confinement.js

@@ -0,0 +1,212 @@
+/**
+ * The CODE-09 evidence artifact: a durable record that the confinement acceptance
+ * suite passed on THIS build.
+ *
+ * Why an artifact instead of a module flag: the flag shipped false and only a test-only
+ * setter (armed by an environment marker) could move it, so a real deployment could never
+ * serve `tool_mode_run` — not by configuration, not by running the very tests the
+ * specification names. That is a release gate with no release path.
+ *
+ * This module gives the gate an operator path that stays auditable:
+ *
+ * 1. the operator runs `scripts/record-confinement-evidence.mjs`, which runs the
+ *    confinement suite (`tests/ptc-sandbox.test.ts`, on the real Node backend) and writes
+ *    the artifact ONLY when the suite passes;
+ * 2. the operator starts the host with `DSH_PTC_CONFINEMENT_EVIDENCE=<artifact path>`;
+ * 3. the runtime reads and VALIDATES the artifact (kind, version, pass, package version,
+ *    platform, non-empty test list) — a malformed, stale or failed artifact is refused
+ *    with the reason, never treated as "some evidence exists".
+ *
+ * The conjunction is unchanged: CODE-10's operator grant AND this evidence. External MCP
+ * exposure keeps its own additional gate.
+ */
+import { readFileSync } from 'node:fs';
+/** The environment variable naming the evidence artifact. */
+export const CONFINEMENT_EVIDENCE_ENV = 'DSH_PTC_CONFINEMENT_EVIDENCE';
+/** The artifact's discriminator. */
+export const CONFINEMENT_EVIDENCE_KIND = 'ptc-confinement-evidence';
+/** The artifact's schema version. */
+export const CONFINEMENT_EVIDENCE_VERSION = 1;
+/** One well-formedness question about a parsed value. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Read and validate the evidence artifact.
+ *
+ * The path is the operator's `DSH_PTC_CONFINEMENT_EVIDENCE` when set, otherwise the
+ * standard local artifact `~/.dsh/ptc-confinement-evidence.json` that the recorder writes.
+ * The default matters because a host started normally never carries that variable, and a
+ * gate whose only release path requires a wrapper launcher is still effectively closed.
+ * The default is not a bypass: the artifact is validated exactly like an explicit one —
+ * kind, schema, pass, package version, platform, timestamp, test list, command and counts.
+ *
+ * Failures are VALUES with a reason, never exceptions: a gate that throws on a malformed
+ * file would crash the host, and one that silently treats a malformed file as evidence
+ * would open the gate. Both are refused here with the reason spelled out.
+ * @param options - the environment, the expected package version, and the platform.
+ * @returns the check outcome.
+ */
+export function checkConfinementEvidence(options) {
+    const env = options.env ?? process.env;
+    const configured = env[CONFINEMENT_EVIDENCE_ENV];
+    const path = configured !== undefined && configured.trim().length > 0 ? configured : options.defaultPath;
+    if (path === undefined || path.trim().length === 0) {
+        return {
+            ok: false,
+            present: false,
+            reason: `no confinement evidence is configured (set ${CONFINEMENT_EVIDENCE_ENV} to the `
+                + 'artifact written by scripts/record-confinement-evidence.mjs)',
+        };
+    }
+    let text;
+    try {
+        text = (options.readFile ?? (file => readFileSync(file, 'utf8')))(path);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} cannot be read: `
+                + `${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} is not JSON: `
+                + `${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (!isRecord(parsed)) {
+        return { ok: false, present: true, path, reason: `the confinement evidence at ${path} is not an object` };
+    }
+    if (parsed['kind'] !== CONFINEMENT_EVIDENCE_KIND) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} has kind ${JSON.stringify(parsed['kind'])}, `
+                + `expected ${JSON.stringify(CONFINEMENT_EVIDENCE_KIND)}`,
+        };
+    }
+    if (parsed['version'] !== CONFINEMENT_EVIDENCE_VERSION) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} is schema version ${String(parsed['version'])}, `
+                + `expected ${String(CONFINEMENT_EVIDENCE_VERSION)}`,
+        };
+    }
+    if (parsed['passed'] !== true) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} does not record a passing run`,
+        };
+    }
+    const expectedVersion = options.expectedVersion;
+    if (parsed['packageVersion'] !== expectedVersion) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} was recorded for package version `
+                + `${JSON.stringify(parsed['packageVersion'])}, but this host is ${JSON.stringify(expectedVersion)}; `
+                + 're-run scripts/record-confinement-evidence.mjs against this build',
+        };
+    }
+    const platform = options.platform ?? process.platform;
+    if (parsed['platform'] !== platform) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} was recorded on ${JSON.stringify(parsed['platform'])}, `
+                + `not ${JSON.stringify(platform)}`,
+        };
+    }
+    if (typeof parsed['generatedAt'] !== 'string' || Number.isNaN(Date.parse(parsed['generatedAt']))) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} has no valid generatedAt timestamp`,
+        };
+    }
+    if (!Array.isArray(parsed['tests']) || parsed['tests'].length === 0
+        || parsed['tests'].some(entry => typeof entry !== 'string' || entry.length === 0)) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} names no test file`,
+        };
+    }
+    /**
+     * COUNTS are validated, not decorative.
+     *
+     * "2 pass, 3 skipped" is not evidence that the workspace-write arms are confined — a
+     * skip is an arm that never ran. The recorder refuses to write such an artifact, and the
+     * runtime refuses one anyway: a hand-edited or older artifact must not open a gate the
+     * suite did not earn.
+     */
+    const counts = parsed['counts'];
+    if (!isRecord(counts)
+        || typeof counts['tests'] !== 'number' || typeof counts['pass'] !== 'number'
+        || typeof counts['fail'] !== 'number' || typeof counts['skipped'] !== 'number') {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} carries no test counts`,
+        };
+    }
+    const testsCount = counts['tests'];
+    const passCount = counts['pass'];
+    const failCount = counts['fail'];
+    const skippedCount = counts['skipped'];
+    if (testsCount <= 0 || passCount !== testsCount || failCount !== 0 || skippedCount !== 0) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} records ${String(testsCount)} tests, `
+                + `${String(passCount)} passed, ${String(failCount)} failed, ${String(skippedCount)} skipped; `
+                + 'every confinement arm must pass with none skipped',
+        };
+    }
+    if (typeof parsed['command'] !== 'string' || parsed['command'].length === 0) {
+        return {
+            ok: false,
+            present: true,
+            path,
+            reason: `the confinement evidence at ${path} has no command line`,
+        };
+    }
+    return {
+        ok: true,
+        path,
+        evidence: {
+            kind: CONFINEMENT_EVIDENCE_KIND,
+            version: CONFINEMENT_EVIDENCE_VERSION,
+            passed: true,
+            generatedAt: parsed['generatedAt'],
+            packageVersion: expectedVersion,
+            platform,
+            node: typeof parsed['node'] === 'string' ? parsed['node'] : '',
+            tests: parsed['tests'],
+            command: parsed['command'],
+        },
+    };
+}
+//# sourceMappingURL=ptc-confinement.js.map