@eslint-sh/eslint-plugin 0.5.0 → 0.6.0

package/dist/rules/compat/version-gates.js

@@ -0,0 +1,197 @@
+/**
+ * Every gated feature, keyed by the name rules pass to
+ * {@link isFeatureAvailable}.
+ */
+const FEATURE_GATES = Object.freeze({
+    /**
+     * The `&>>` redirection, appending both stdout and stderr: Bash 4.0 NEWS,
+     * "the new `&>>` redirection operator". Bash 3.2 rejects it as a syntax
+     * error, so the whole script fails to parse.
+     */
+    appendAllRedirect: Object.freeze({ bash: '4.0', posix: false }),
+    /** `declare -A` / `typeset -A`: Bash 4.0 NEWS, "associative arrays". */
+    associativeArrays: Object.freeze({ bash: '4.0', posix: false }),
+    /**
+     * The case-modifying expansions `${v^}`, `${v^^}`, `${v,}`, `${v,,}`: Bash
+     * 4.0 NEWS, "new case-modifying word expansions".
+     */
+    caseModification: Object.freeze({ bash: '4.0', posix: false }),
+    /**
+     * The case-converting attributes `declare -l` / `-u` (and through
+     * `typeset` and `local`): Bash 4.0 NEWS, "new `-l` and `-u` options to
+     * declare/typeset/local".
+     */
+    caseAttributes: Object.freeze({ bash: '4.0', posix: false }),
+    /**
+     * The `case` terminators `;&` (fall through) and `;;&` (test the next
+     * pattern): Bash 4.0 NEWS. POSIX.1-2024 adds `;&`, but dash 0.5.12 still
+     * rejects it, so a POSIX target does not have it.
+     */
+    caseFallthrough: Object.freeze({ bash: '4.0', posix: false }),
+    /** The `coproc` reserved word: Bash 4.0 NEWS, "a new `coproc` reserved word". */
+    coproc: Object.freeze({ bash: '4.0', posix: false }),
+    /**
+     * `declare -g` / `typeset -g`: Bash 4.2 NEWS, "declare/typeset has a new
+     * `-g` option".
+     */
+    declareGlobal: Object.freeze({ bash: '4.2', posix: false }),
+    /**
+     * The `[[ … ]]` conditional. POSIX section 2.4 lists `[[` and `]]` among the
+     * words whose results are unspecified; every Bash has it, and dash runs it
+     * as a command that does not exist.
+     */
+    doubleBracket: Object.freeze({ bash: null, posix: false }),
+    /** `$EPOCHSECONDS` and `$EPOCHREALTIME`: Bash 5.0 NEWS. */
+    epochVariables: Object.freeze({ bash: '5.0', posix: false }),
+    /**
+     * A `{varname}` redirection that allocates a descriptor into a variable
+     * (`exec {fd}>file`): Bash 4.1 NEWS. Bash 4.0 runs `{fd}` as a command.
+     */
+    fdVariable: Object.freeze({ bash: '4.1', posix: false }),
+    /** `shopt -s globstar` (recursive `**`): Bash 4.0 NEWS. */
+    globstar: Object.freeze({ bash: '4.0', posix: false }),
+    /** `shopt -s lastpipe`: Bash 4.2 NEWS, "a new `lastpipe` shell option". */
+    lastpipe: Object.freeze({ bash: '4.2', posix: false }),
+    /**
+     * The `let` builtin. POSIX section 2.9.1.4 lists `let` among the command
+     * names whose results are unspecified; every Bash has it, and dash has no
+     * such command.
+     */
+    letCommand: Object.freeze({ bash: null, posix: false }),
+    /** The `mapfile` builtin and its `readarray` synonym: Bash 4.0 NEWS. */
+    mapfile: Object.freeze({ bash: '4.0', posix: false }),
+    /** Namerefs, `declare -n` / `typeset -n` / `local -n`: Bash 4.3 NEWS. */
+    nameref: Object.freeze({ bash: '4.3', posix: false }),
+    /**
+     * Negative indexed-array subscripts (`${a[-1]}`, `a[-1]=x`): Bash 4.3 NEWS,
+     * "assigning, referencing, and unsetting elements of indexed arrays using
+     * negative subscripts". Bash 4.2 already reads `${a[-1]}`, but rejects the
+     * element length `${#a[-1]}`, assignment and unset, so 4.3 is the first
+     * release where every use works.
+     */
+    negativeArrayIndex: Object.freeze({ bash: '4.3', posix: false }),
+    /**
+     * Expanding an empty array (`"${a[@]}"`, `${a[*]}`) while `set -u` is on:
+     * the syntax is in every Bash, but through 4.3 it aborts with "unbound
+     * variable"; Bash 4.4 is the first release where it expands to nothing.
+     */
+    nounsetEmptyArray: Object.freeze({ bash: '4.4', posix: false }),
+    /**
+     * The parameter transformations `${v@Q}`, `${v@E}`, `${v@P}`, `${v@A}` and
+     * `${v@a}`: Bash 4.4 NEWS.
+     */
+    parameterTransformation: Object.freeze({ bash: '4.4', posix: false }),
+    /** The case transformations `${v@U}`, `${v@u}` and `${v@L}`: Bash 5.1 NEWS. */
+    parameterTransformationCase: Object.freeze({ bash: '5.1', posix: false }),
+    /** `${a[@]@k}`, key-value pairs as separate words: Bash 5.2 NEWS. */
+    parameterTransformationKeys: Object.freeze({ bash: '5.2', posix: false }),
+    /** `${a[@]@K}`, quoted key-value pairs: Bash 5.1 NEWS. */
+    parameterTransformationQuotedKeys: Object.freeze({ bash: '5.1', posix: false }),
+    /**
+     * The `|&` pipe, shorthand for `2>&1 |`: Bash 4.0 NEWS. Bash 3.2 rejects
+     * it as a syntax error.
+     */
+    pipeAll: Object.freeze({ bash: '4.0', posix: false }),
+    /** `printf`'s `%(fmt)T` date format: Bash 4.2 NEWS. */
+    printfTimeFormat: Object.freeze({ bash: '4.2', posix: false }),
+    /**
+     * The `source` builtin, Bash's name for `.`. POSIX section 2.9.1.4 lists
+     * `source` among the command names whose results are unspecified; every Bash
+     * has it, and dash has no such command.
+     */
+    sourceCommand: Object.freeze({ bash: null, posix: false }),
+    /**
+     * The `-v name` test (`[[ -v x ]]`, `test -v x`, `[ -v x ]`): Bash 4.2
+     * NEWS. In older Bash, `[[ -v x ]]` is a syntax error.
+     */
+    testVariableSet: Object.freeze({ bash: '4.2', posix: false }),
+    /**
+     * The `\u`/`\U` escapes in `$'…'` strings: Bash 4.2 NEWS. Earlier releases
+     * leave the escape as literal text. See `unicodeEscapeLatin1` for the one
+     * range the 4.2 release decodes wrongly.
+     */
+    unicodeEscape: Object.freeze({ bash: '4.2', posix: false }),
+    /**
+     * A `\u`/`\U` escape for a code point from U+0080 to U+00FF: the Bash 4.2
+     * release tarball writes these as a single Latin-1 byte even in a UTF-8
+     * locale (observed: `e9` for U+00E9, where UTF-8 is `c3 a9`), while every
+     * other code point is UTF-8. Bash 4.3 is the first release that writes all
+     * of them as UTF-8.
+     */
+    unicodeEscapeLatin1: Object.freeze({ bash: '4.3', posix: false }),
+    /** `wait -n`, waiting for the next job to finish: Bash 4.3 NEWS. */
+    waitNext: Object.freeze({ bash: '4.3', posix: false }),
+});
+/**
+ * Splits a `MAJOR[.MINOR]` string into numbers, so `"4"` is `[4, 0]` and
+ * `"3.10"` is `[3, 10]`. Returns `undefined` for any other shape; the
+ * language's option validation already rejects those, so the gate never
+ * sees one from a real config.
+ */
+function parseVersion(version) {
+    if (!/^\d+(?:\.\d+)?$/u.test(version))
+        return undefined;
+    const [major, minor = '0'] = version.split('.');
+    return [Number(major), Number(minor)];
+}
+/**
+ * Compares two `MAJOR[.MINOR]` versions numerically, major first, then minor:
+ * negative when `a` is older, `0` when equal, positive when `a` is newer. So
+ * `"3.10"` is newer than `"3.2"`, and `"4"` equals `"4.0"`.
+ */
+function compareVersions(a, b) {
+    return a[0] !== b[0] ? a[0] - b[0] : a[1] - b[1];
+}
+/**
+ * The dialects whose `shellVersion` is a Bash version. `bats` test files run
+ * under Bash, so they are gated exactly like `bash` files.
+ */
+const BASH_DIALECTS = new Set(['bash', 'bats']);
+/**
+ * Whether `feature` is available to a file linted with `languageOptions`.
+ *
+ * - `dialect: "posix"`: available only when the gate's `posix` is `true`,
+ *   at any `shellVersion` (a Bash-only feature is never available).
+ * - `dialect: "bash"` (the default) or `"bats"`: an unset `shellVersion`
+ *   means the newest Bash, so every Bash feature is available. A set
+ *   `shellVersion` makes the feature available when it is the gate's `bash`
+ *   minimum or newer, comparing major then minor numerically (`"4"` is
+ *   `4.0`; `"3.10"` is newer than `"3.2"`). A `null` minimum is available at
+ *   every version.
+ * - `dialect: "mksh"` or `"zsh"`: the table carries no data for these
+ *   shells, and their `shellVersion` numbers their own releases, not Bash's,
+ *   so no gate applies and every feature is available.
+ *
+ * @internal
+ */
+export function isFeatureAvailable(feature, languageOptions) {
+    const gate = FEATURE_GATES[feature];
+    const dialect = languageOptions.dialect ?? 'bash';
+    if (dialect === 'posix')
+        return gate.posix;
+    if (!BASH_DIALECTS.has(dialect))
+        return true;
+    const { shellVersion } = languageOptions;
+    if (shellVersion === undefined || gate.bash === null)
+        return true;
+    const target = parseVersion(shellVersion);
+    const minimum = parseVersion(gate.bash);
+    if (target === undefined || minimum === undefined)
+        return true;
+    return compareVersions(target, minimum) >= 0;
+}
+/**
+ * Describes why `feature` is unavailable under `languageOptions`, for a
+ * report's message data. Call it only when {@link isFeatureAvailable} is
+ * `false`.
+ *
+ * @internal
+ */
+export function describeGate(feature, languageOptions) {
+    const gate = FEATURE_GATES[feature];
+    const required = gate.bash === null ? 'bash' : `bash ${gate.bash} or newer`;
+    const target = (languageOptions.dialect ?? 'bash') === 'posix'
+        ? 'POSIX sh'
+        : `bash ${languageOptions.shellVersion ?? ''}`.trim();
+    return { required, target };
+}

package/dist/rules/create-rule.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The factory for this plugin's built-in rules: the public
+ * {@link defineShellRule} plus the one piece of metadata that only built-in
+ * rules share.
+ *
+ * `meta.docs.url` is derived from the rule name and always points at the
+ * rule's committed docs page, so the link a user follows from a lint report
+ * can never be hand-mistyped or left stale after a rename. Everything else —
+ * `meta.languages: ["sh/sh"]` and the shell-typed context, nodes and visitor —
+ * comes from `defineShellRule`, so built-in and third-party rules share one
+ * implementation of that guarantee.
+ *
+ * This module is internal (not re-exported from the package entry point): the
+ * docs URL scheme is this repository's. Rule packs use `defineShellRule` and
+ * write their own `meta.docs.url`.
+ */
+import type { RulesMetaDocs } from '@eslint/core';
+import type { ShellRule, ShellRuleContext, ShellRuleMeta, ShellRuleVisitor } from './define-shell-rule.js';
+/**
+ * The canonical documentation URL for the built-in rule `name`. This is the
+ * single place the URL scheme is spelled; the factory uses it to fill
+ * `meta.docs.url`, and the docs-page tests use it to check each registered
+ * rule points at its own committed page.
+ *
+ * @internal
+ */
+export declare function ruleDocsUrl(name: string): string;
+/**
+ * The documentation URL for `page`, a path relative to this package's `docs/`
+ * directory (`wrapper-rules.md` is the committed file
+ * `packages/eslint-plugin/docs/wrapper-rules.md`). Used for rules that are not
+ * in the registry, which have no `docs/rules/<name>.md` page of their own.
+ *
+ * @internal
+ */
+export declare function packageDocsUrl(page: string): string;
+/**
+ * The `meta.docs` an author writes: everything ESLint accepts except `url`,
+ * which the factory derives from the rule name. Typed `never` so supplying a
+ * URL by hand is a compile error rather than a silently-overwritten value.
+ *
+ * @internal
+ */
+export type BuiltInRuleDocs = Omit<RulesMetaDocs, 'url'> & {
+    readonly url?: never;
+};
+/**
+ * The `meta` a built-in rule writes: {@link ShellRuleMeta} (so the language
+ * fields are already forbidden), with `docs` narrowed to
+ * {@link BuiltInRuleDocs} because the factory derives `docs.url`.
+ *
+ * @internal
+ */
+export type BuiltInRuleMeta<RuleOptions extends unknown[], MessageIds extends string> = Omit<ShellRuleMeta<RuleOptions, MessageIds>, 'docs'> & {
+    readonly docs?: BuiltInRuleDocs;
+};
+/**
+ * What an author hands to {@link createRule}: the rule's registry name (used
+ * to derive its docs URL), its author-owned metadata, and its `create()`.
+ *
+ * @internal
+ */
+export interface BuiltInRuleSpec<RuleOptions extends unknown[], MessageIds extends string> {
+    /**
+     * The rule's name without the plugin namespace (`require-shebang`, not
+     * `sh/require-shebang`). For a built-in rule it must equal the rule's key in
+     * the registry and the basename of its docs page.
+     */
+    readonly name: string;
+    /**
+     * The docs URL of a rule that is not in the registry. A rule made by one of
+     * this package's public factories (for example `createWrapperRule`) has no
+     * `docs/rules/<name>.md` page: it links its factory's page
+     * ({@link packageDocsUrl}), or the page its rule pack supplies. Omit it for
+     * a built-in rule, whose page is always `docs/rules/<name>.md`.
+     */
+    readonly docsUrl?: string;
+    readonly meta: BuiltInRuleMeta<RuleOptions, MessageIds>;
+    /** Builds the rule's listeners for one file; receives the shell-typed context. */
+    readonly create: (context: ShellRuleContext<RuleOptions, MessageIds>) => ShellRuleVisitor;
+}
+/**
+ * Builds a built-in shell rule from its spec with {@link defineShellRule},
+ * after setting `meta.docs.url` to the rule's docs page ({@link ruleDocsUrl},
+ * or the spec's `docsUrl` for a rule outside the registry). The URL is
+ * written after the author's `docs`, so even an untyped caller cannot
+ * override it; `defineShellRule` does the same for `meta.languages`.
+ *
+ * @internal
+ */
+export declare function createRule<RuleOptions extends unknown[] = [], MessageIds extends string = string>(spec: BuiltInRuleSpec<RuleOptions, MessageIds>): ShellRule<RuleOptions, MessageIds>;

package/dist/rules/create-rule.js

@@ -0,0 +1,51 @@
+import { defineShellRule } from './define-shell-rule.js';
+/**
+ * Where this package's shipped docs live in the source repository: the
+ * committed `packages/eslint-plugin/docs/` directory.
+ */
+const PACKAGE_DOCS_BASE_URL = 'https://github.com/mike-north/eslint-sh/blob/main/packages/eslint-plugin/docs/';
+/**
+ * Where built-in rule docs pages live in the source repository. A rule named
+ * `foo` is documented at `<this>/foo.md`, i.e. the committed file
+ * `packages/eslint-plugin/docs/rules/foo.md`.
+ */
+const RULE_DOCS_BASE_URL = `${PACKAGE_DOCS_BASE_URL}rules/`;
+/**
+ * The canonical documentation URL for the built-in rule `name`. This is the
+ * single place the URL scheme is spelled; the factory uses it to fill
+ * `meta.docs.url`, and the docs-page tests use it to check each registered
+ * rule points at its own committed page.
+ *
+ * @internal
+ */
+export function ruleDocsUrl(name) {
+    return `${RULE_DOCS_BASE_URL}${name}.md`;
+}
+/**
+ * The documentation URL for `page`, a path relative to this package's `docs/`
+ * directory (`wrapper-rules.md` is the committed file
+ * `packages/eslint-plugin/docs/wrapper-rules.md`). Used for rules that are not
+ * in the registry, which have no `docs/rules/<name>.md` page of their own.
+ *
+ * @internal
+ */
+export function packageDocsUrl(page) {
+    return `${PACKAGE_DOCS_BASE_URL}${page}`;
+}
+/**
+ * Builds a built-in shell rule from its spec with {@link defineShellRule},
+ * after setting `meta.docs.url` to the rule's docs page ({@link ruleDocsUrl},
+ * or the spec's `docsUrl` for a rule outside the registry). The URL is
+ * written after the author's `docs`, so even an untyped caller cannot
+ * override it; `defineShellRule` does the same for `meta.languages`.
+ *
+ * @internal
+ */
+export function createRule(spec) {
+    const { name, docsUrl, meta, create } = spec;
+    const url = docsUrl ?? ruleDocsUrl(name);
+    return defineShellRule({
+        meta: { ...meta, docs: { ...meta.docs, url } },
+        create,
+    });
+}

package/dist/rules/create-wrapper-rule.d.ts

@@ -0,0 +1,166 @@
+import type { WrapperSpec } from 'sh-ast/analyze';
+import type { ShellRule } from './define-shell-rule.js';
+/**
+ * Restricts a listed command to some of its subcommands, for commands such as
+ * `git` where only some subcommands are in scope (`git fetch` is a network
+ * call, `git status` is not).
+ *
+ * The flag fields are `WrapperSpec`'s own, picked from it so the two cannot
+ * drift, and describe the command's options that may appear before the
+ * subcommand (`git -C dir fetch`): `noArgFlags` take no operand (`--bare`),
+ * `argFlags` take one (`-C <dir>`), and `stopsChainFlags` mean the command
+ * runs no subcommand at all (`git --version fetch` prints the version, and is
+ * never reported). The subcommand is found the way a wrapped command is:
+ * declared options are skipped, and a flag the command does not declare
+ * leaves the subcommand unknown, so the invocation is not reported.
+ *
+ * @public
+ */
+export interface WrapperRuleSubcommands extends Pick<WrapperSpec, 'noArgFlags' | 'argFlags' | 'stopsChainFlags'> {
+    /** The subcommands that make an invocation of the command count, such as `['fetch', 'push']`. */
+    readonly names: readonly string[];
+}
+/**
+ * Names the operand of a listed command whose value decides whether the
+ * invocation can leave the machine, such as the source of `git clone`.
+ *
+ * The flags describe the options that may precede the operand, with the same
+ * meaning as {@link WrapperRuleSubcommands}'s: `noArgFlags` take no value and
+ * `argFlags` take one (as `--depth 1`, or `--depth=1` in one word). The
+ * operand is the first word after them, or after a `--`. A flag that is not
+ * declared leaves the operand unknown, and an unknown operand is never taken
+ * as local.
+ *
+ * @public
+ */
+export interface WrapperRuleLocalOperand extends Pick<WrapperSpec, 'noArgFlags' | 'argFlags'> {
+    /**
+     * The operand counts as local when it is a static word starting with one
+     * of these, such as `['./', '../', '/', 'file://']`.
+     */
+    readonly localPrefixes: readonly string[];
+}
+/**
+ * Ways to invoke one listed command that only act locally, so the policy has
+ * nothing to guard. An invocation matching either field is not reported.
+ *
+ * @public
+ */
+export interface WrapperRuleLocalInvocation {
+    /**
+     * Complete argument lists, after the command (and its subcommand, if it has
+     * one), that make the invocation local. They match exactly: with
+     * `[['--version']]`, `curl --version` is local and
+     * `curl --version https://example.com` is not.
+     */
+    readonly argLists?: readonly (readonly string[])[];
+    /** Local when the command's source operand is a local path. */
+    readonly localOperand?: WrapperRuleLocalOperand;
+}
+/**
+ * What a "must be run through a wrapper" rule enforces. Passed to
+ * {@link createWrapperRule}.
+ *
+ * @public
+ */
+export interface WrapperRuleConfig {
+    /**
+     * The command names that must be run through the wrapper. A static command
+     * word matches a name when it equals it, or when it contains a slash and
+     * its basename equals it (`/usr/bin/curl` and `./bin/curl` match `curl`).
+     */
+    readonly commands: readonly string[];
+    /**
+     * The wrapper the commands must be run through. A string names a wrapper
+     * that takes no options of its own (`retry curl x`), unless it names one of
+     * `sh-ast/analyze`'s default transparent wrappers (`timeout`, `nice`, …),
+     * whose known option shape is used. A `WrapperSpec` declares the wrapper's
+     * option shape, so that `retry -n 3 curl x` is recognized as `curl` run
+     * through `retry`; any of its `names` counts as the wrapper. Like
+     * `commands`, a wrapper run by path matches by basename
+     * (`/usr/local/bin/retry curl x`).
+     */
+    readonly wrapper: string | WrapperSpec;
+    /**
+     * Listed commands that count only with some subcommands, keyed by command
+     * name. A listed command with no entry here counts with any arguments.
+     */
+    readonly subcommands?: Readonly<Record<string, WrapperRuleSubcommands>>;
+    /**
+     * Invocations of a listed command that only act locally and so are not
+     * reported, keyed by the command as the rule's message names it: the listed
+     * name (`curl`), or the name with its subcommand (`git clone`).
+     */
+    readonly localInvocations?: Readonly<Record<string, WrapperRuleLocalInvocation>>;
+    /**
+     * The rule's `meta.docs` fields a rule pack owns. `url` defaults to this
+     * package's wrapper-rules docs page, and `description` to a sentence naming
+     * the commands and the wrapper. Set them to point users at the pack's own
+     * documentation.
+     */
+    readonly docs?: {
+        readonly url?: string;
+        readonly description?: string;
+    };
+}
+/**
+ * The message ids a wrapper rule reports with: `unwrappedCommand` names the
+ * command (with its subcommand, when one was matched) and the wrapper.
+ *
+ * @internal
+ */
+export type WrapperRuleMessageId = 'unwrappedCommand';
+/**
+ * The messages every wrapper rule reports with. Shared so that a rule which
+ * delegates to the factory (`sh/require-network-wrapper`) declares exactly the
+ * messages the factory's listeners report.
+ *
+ * @internal
+ */
+export declare const WRAPPER_RULE_MESSAGES: Readonly<Record<WrapperRuleMessageId, string>>;
+/**
+ * The wrapper-rule factory, typed for this package's rules: it is what
+ * {@link createWrapperRule} returns, with the shell-specific rule type and an
+ * options tuple chosen by the caller. A built-in rule whose config comes from
+ * its own options (`sh/require-network-wrapper`) builds the factory's rule
+ * per config and calls its `create` with its own context, so the options
+ * tuple is that rule's. The factory's rule itself reads no options.
+ *
+ * @internal
+ */
+export declare function buildWrapperRule<RuleOptions extends unknown[] = []>(config: WrapperRuleConfig): ShellRule<RuleOptions, WrapperRuleMessageId>;
+/**
+ * Creates a rule that reports every listed command that is not run through
+ * `config.wrapper`, for a rule pack's "must be wrapped by X" policies:
+ *
+ * ```js
+ * import { createWrapperRule } from '@eslint-sh/eslint-plugin';
+ *
+ * export const requireAudit = createWrapperRule({
+ *   commands: ['kubectl', 'terraform'],
+ *   wrapper: 'audit-run',
+ * });
+ * ```
+ *
+ * The rule declares `meta.languages: ["sh/sh"]`, takes no options (the
+ * config is bound here), and reports with message id `unwrappedCommand`,
+ * naming the command and the wrapper. Its `meta.docs.url` and
+ * `meta.docs.description` default to this package's wrapper-rules page and a
+ * sentence naming the policy; `config.docs` overrides either. A listed
+ * command is wrapped when the wrapper encloses it in `sh-ast/analyze`'s
+ * transparent-wrapper chain, so `audit-run sudo kubectl apply` is wrapped.
+ * Command and wrapper words written as paths match by basename
+ * (`/usr/bin/kubectl`). Commands inside `$(…)`, functions, and pipelines are
+ * checked; a command whose name or subcommand is not static is not reported.
+ *
+ * @param config - The commands, the wrapper they must be run through, any
+ * subcommand restrictions, and optional `meta.docs` overrides.
+ * @returns A {@link ShellRule}: an ESLint rule for the `sh/sh` language,
+ * typed so a pack's own declarations need no `@eslint/core` import to name it.
+ * @throws TypeError when `config` is malformed (no `commands` array, an empty
+ * wrapper name, a subcommand restriction without `names`, or an empty or
+ * non-string `docs.url` / `docs.description`).
+ *
+ * @public
+ */
+export declare function createWrapperRule(config: WrapperRuleConfig): ShellRule<[], 'unwrappedCommand'>;