@eslint-sh/eslint-plugin 0.5.0 → 0.6.0

package/dist/rules/shebang-matches-dialect.js

@@ -0,0 +1,69 @@
+import { createRule } from './create-rule.js';
+import { shebangShell } from './shebang-interpreter.js';
+/**
+ * Interpreter basenames that are POSIX shells for this rule's purpose: they
+ * implement the POSIX shell language and none of the bash extensions.
+ */
+const POSIX_SHELLS = new Set(['sh', 'dash', 'ash']);
+/** The UTF-8 byte order mark as it appears in a decoded string. */
+const BOM = '\uFEFF';
+/**
+ * Which mismatch, if any, the shebang's shell and the dialect form. `undefined`
+ * means the pair is consistent or outside this rule's bash/POSIX contract.
+ */
+function mismatchFor(shell, dialect) {
+    if (shell === undefined) {
+        return undefined;
+    }
+    if (dialect === 'bash' && POSIX_SHELLS.has(shell)) {
+        return 'posixShebangBashDialect';
+    }
+    if (dialect === 'posix' && shell === 'bash') {
+        return 'bashShebangPosixDialect';
+    }
+    return undefined;
+}
+/**
+ * The rule module registered as `shebang-matches-dialect`.
+ *
+ * @internal
+ */
+export const shebangMatchesDialect = createRule({
+    name: 'shebang-matches-dialect',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require the shebang to name the same kind of shell as languageOptions.dialect',
+        },
+        schema: [],
+        messages: {
+            posixShebangBashDialect: "The shebang '{{shebang}}' names a POSIX shell, but this file is linted as bash, so bash-only advice (such as pipefail) can break it. Set the dialect for these files with `languageOptions: { dialect: 'posix' }` in your eslint.config.js, or change the shebang to a bash one such as '#!/usr/bin/env bash'.",
+            bashShebangPosixDialect: "The shebang '{{shebang}}' names bash, but this file is linted as posix, so bash syntax goes unchecked. Set the dialect for these files with `languageOptions: { dialect: 'bash' }` in your eslint.config.js, or change the shebang to a POSIX one such as '#!/bin/sh'.",
+        },
+    },
+    create(context) {
+        const { sourceCode } = context;
+        return {
+            File() {
+                const firstLine = sourceCode.lines[0] ?? '';
+                const shebangLine = firstLine.startsWith(BOM) ? firstLine.slice(1) : firstLine;
+                if (!shebangLine.startsWith('#!')) {
+                    return;
+                }
+                const messageId = mismatchFor(shebangShell(shebangLine.slice('#!'.length)), sourceCode.dialect);
+                if (messageId === undefined) {
+                    return;
+                }
+                // Line 1 in full, from the line's own length.
+                context.report({
+                    loc: {
+                        start: { line: 1, column: 1 },
+                        end: { line: 1, column: firstLine.length + 1 },
+                    },
+                    messageId,
+                    data: { shebang: shebangLine.trimEnd() },
+                });
+            },
+        };
+    },
+});

package/dist/rules/transparent-wrappers.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Wrapper data that built-in rules add to `sh-ast/analyze`'s
+ * `DEFAULT_TRANSPARENT_WRAPPERS` when they ask
+ * `ShellSourceCode.resolveInvokedCommand` which command an invocation runs.
+ *
+ * Everything here is a `WrapperSpec`: data that tells `resolveArgv0` how to
+ * find the word a wrapper runs. No rule logic lives here, and no entry makes
+ * a safety judgment. Each rule decides which of these entries it follows.
+ */
+import type { WrapperSpec } from 'sh-ast/analyze';
+/**
+ * Bash's `builtin [shell-builtin [args …]]`: runs the named builtin, bypassing
+ * any function of the same name. It takes no options of its own, so the word
+ * after it is the command it runs.
+ *
+ * `sh-ast/analyze`'s default wrapper table leaves `builtin` out, so
+ * `builtin "$x"` would otherwise resolve to the static command `builtin`.
+ *
+ * @see https://www.gnu.org/software/bash/manual/bash.html#Bash-Builtins — `builtin`
+ * @internal
+ */
+export declare const BUILTIN_WRAPPER: WrapperSpec;
+/**
+ * A shell invoked as a command (`bash …`, `sh …`), modeled as a wrapper so the
+ * command it runs is found the same way as for `env` or `sudo`:
+ *
+ * - `bash script.sh` runs `script.sh`; the options before it are skipped.
+ * - `bash -c STRING` (and `-c` clustered after one other option letter, such
+ *   as `bash -lc STRING` or `bash -ec STRING`) runs code embedded in a
+ *   string. `-c` is an unresolvable flag, so `resolveArgv0` reports the
+ *   effective command as `{ static: false, reason: 'embedded-command' }`
+ *   instead of guessing at the string's contents.
+ * - `bash -s` (and `bash` with no operand) reads its commands from standard
+ *   input. `-s` stops the chain: the shell itself is the effective command.
+ *
+ * `+`-prefixed option letters (`+x`) turn an option off and take no operand.
+ * `-o`/`+o` and Bash's `-O`/`+O` take an option name. An option this entry
+ * does not know makes `resolveArgv0` report `'unknown-flag'`, never a guess.
+ *
+ * `resolveArgv0` clusters `noArgFlags` with a following `argFlags` entry, but
+ * not with `unresolvableFlags` or `stopsChainFlags`, so the one-letter
+ * clusters ending in `c` or `s` are listed as exact tokens. Longer clusters
+ * (`-xec`) end in `'unknown-flag'`.
+ *
+ * Names match exactly, like every `sh-ast/analyze` wrapper: `/bin/bash` is not
+ * `bash`.
+ *
+ * @see https://www.gnu.org/software/bash/manual/bash.html#Invoking-Bash
+ * @see https://pubs.opengroup.org/onlinepubs/9699919799/utilities/sh.html — POSIX `sh`
+ * @internal
+ */
+export declare const SHELL_WRAPPER: WrapperSpec;

package/dist/rules/transparent-wrappers.js

@@ -0,0 +1,99 @@
+/**
+ * Bash's `builtin [shell-builtin [args …]]`: runs the named builtin, bypassing
+ * any function of the same name. It takes no options of its own, so the word
+ * after it is the command it runs.
+ *
+ * `sh-ast/analyze`'s default wrapper table leaves `builtin` out, so
+ * `builtin "$x"` would otherwise resolve to the static command `builtin`.
+ *
+ * @see https://www.gnu.org/software/bash/manual/bash.html#Bash-Builtins — `builtin`
+ * @internal
+ */
+export const BUILTIN_WRAPPER = { names: ['builtin'] };
+/**
+ * The single-letter shell options that take no operand when a shell is
+ * invoked: every option letter the `set` builtin accepts, plus Bash's
+ * invocation-only `-i`, `-l`, `-r` and `-D`. `-c`, `-s` and `-o`/`-O` are
+ * absent on purpose: they are modeled separately in {@link SHELL_WRAPPER}.
+ *
+ * @see https://www.gnu.org/software/bash/manual/bash.html#Invoking-Bash
+ * @see https://www.gnu.org/software/bash/manual/bash.html#The-Set-Builtin
+ * @see https://pubs.opengroup.org/onlinepubs/9699919799/utilities/sh.html — POSIX `sh` options
+ */
+const SHELL_NO_ARG_LETTERS = [
+    'a',
+    'b',
+    'e',
+    'f',
+    'h',
+    'k',
+    'm',
+    'n',
+    'p',
+    't',
+    'u',
+    'v',
+    'x',
+    'B',
+    'C',
+    'E',
+    'H',
+    'P',
+    'T',
+    'i',
+    'l',
+    'r',
+    'D',
+];
+/**
+ * A shell invoked as a command (`bash …`, `sh …`), modeled as a wrapper so the
+ * command it runs is found the same way as for `env` or `sudo`:
+ *
+ * - `bash script.sh` runs `script.sh`; the options before it are skipped.
+ * - `bash -c STRING` (and `-c` clustered after one other option letter, such
+ *   as `bash -lc STRING` or `bash -ec STRING`) runs code embedded in a
+ *   string. `-c` is an unresolvable flag, so `resolveArgv0` reports the
+ *   effective command as `{ static: false, reason: 'embedded-command' }`
+ *   instead of guessing at the string's contents.
+ * - `bash -s` (and `bash` with no operand) reads its commands from standard
+ *   input. `-s` stops the chain: the shell itself is the effective command.
+ *
+ * `+`-prefixed option letters (`+x`) turn an option off and take no operand.
+ * `-o`/`+o` and Bash's `-O`/`+O` take an option name. An option this entry
+ * does not know makes `resolveArgv0` report `'unknown-flag'`, never a guess.
+ *
+ * `resolveArgv0` clusters `noArgFlags` with a following `argFlags` entry, but
+ * not with `unresolvableFlags` or `stopsChainFlags`, so the one-letter
+ * clusters ending in `c` or `s` are listed as exact tokens. Longer clusters
+ * (`-xec`) end in `'unknown-flag'`.
+ *
+ * Names match exactly, like every `sh-ast/analyze` wrapper: `/bin/bash` is not
+ * `bash`.
+ *
+ * @see https://www.gnu.org/software/bash/manual/bash.html#Invoking-Bash
+ * @see https://pubs.opengroup.org/onlinepubs/9699919799/utilities/sh.html — POSIX `sh`
+ * @internal
+ */
+export const SHELL_WRAPPER = {
+    names: ['bash', 'sh', 'dash', 'ksh', 'mksh', 'zsh'],
+    noArgFlags: [
+        ...SHELL_NO_ARG_LETTERS.map((letter) => `-${letter}`),
+        '--debugger',
+        '--dump-po-strings',
+        '--dump-strings',
+        '--help',
+        '--login',
+        '--noediting',
+        '--noprofile',
+        '--norc',
+        '--posix',
+        '--pretty-print',
+        '--restricted',
+        '--verbose',
+        '--version',
+    ],
+    noArgFlagPattern: /^\+[abefhkmnptuvxBCEHPT]+$/,
+    argFlags: ['-o', '+o', '-O', '+O', '--init-file', '--rcfile'],
+    unresolvableFlags: ['-c', ...SHELL_NO_ARG_LETTERS.map((letter) => `-${letter}c`)],
+    stopsChainFlags: ['-s', ...SHELL_NO_ARG_LETTERS.map((letter) => `-${letter}s`)],
+};

package/dist/rules/user-pattern.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Compiling regular-expression sources that a rule takes from its options and
+ * tests against text from the linted script.
+ *
+ * The configuration is trusted, but the subject is not: when the plugin lints
+ * a repository it does not control, the script's author picks the names a
+ * pattern runs against. V8's backtracking engine takes time exponential in the
+ * subject's length for a pattern that repeats a group which itself repeats,
+ * such as `^([A-Z]+_?)*_KEY$` against `AAAA…Ax`. {@link compileUserPattern}
+ * rejects the common form of such a pattern as a configuration error, so the
+ * accident of writing one is caught. It is not a proof that an accepted
+ * pattern is safe.
+ *
+ * The check is a static star-height test: a quantifier that repeats (`*`, `+`,
+ * `{n,}` or `{n,m}` with `m > 1`) applied to a group that already contains a
+ * repeating quantifier is rejected. It is conservative. A nested repetition
+ * that happens to be linear, such as `(a*b)*`, is rejected too; a rewrite
+ * without the nesting exists only for some such patterns. It does not detect every
+ * super-linear pattern: an alternation whose branches overlap under a
+ * repetition (`^([A-Z]|[A-Z0-9])+_KEY$`, `(a|a)+$`) passes, and so do
+ * adjacent quantifiers that can match the same text (`.*.*.*x`), whose cost is
+ * polynomial in the name's length. The rule docs list these limits.
+ *
+ * @see https://github.com/mike-north/eslint-sh/issues/221
+ */
+/**
+ * Where in a source a rejected nested repetition was found, for the error message.
+ *
+ * @internal
+ */
+export interface NestedRepetition {
+    /** The outer repeating quantifier as written, such as `*` or `{2,}`. */
+    readonly outer: string;
+    /** The text of the group the outer quantifier repeats, such as `([A-Z]+_?)`. */
+    readonly group: string;
+}
+/**
+ * Finds a repeating quantifier applied to a group that already contains one,
+ * the shape that makes a backtracking engine exponential. Returns the first
+ * such nesting, or `undefined` when the source has star height of at most one.
+ *
+ * The source is assumed to be a valid regular expression; the caller compiles
+ * it first.
+ *
+ * @internal
+ */
+export declare function findNestedRepetition(source: string): NestedRepetition | undefined;
+/**
+ * Compiles a regular-expression source from a rule option that will be tested
+ * against script-controlled text. Throws a `TypeError` naming the rule and the
+ * option when the source is not a valid expression, or when it nests one
+ * repetition inside another (see {@link findNestedRepetition}). ESLint reports
+ * the error from the rule's `create()`, so it surfaces on the first file linted
+ * with the rule ("Occurred while linting <file>"), not when the config loads.
+ *
+ * @param rule - The rule's full name, such as `sh/prefer-local`.
+ * @param option - The option as the user wrote it, such as `patterns[0]`.
+ * @param source - The regular-expression source.
+ * @param flags - The flags to compile with.
+ *
+ * @internal
+ */
+export declare function compileUserPattern(rule: string, option: string, source: string, flags: string): RegExp;

package/dist/rules/user-pattern.js

@@ -0,0 +1,184 @@
+/**
+ * Compiling regular-expression sources that a rule takes from its options and
+ * tests against text from the linted script.
+ *
+ * The configuration is trusted, but the subject is not: when the plugin lints
+ * a repository it does not control, the script's author picks the names a
+ * pattern runs against. V8's backtracking engine takes time exponential in the
+ * subject's length for a pattern that repeats a group which itself repeats,
+ * such as `^([A-Z]+_?)*_KEY$` against `AAAA…Ax`. {@link compileUserPattern}
+ * rejects the common form of such a pattern as a configuration error, so the
+ * accident of writing one is caught. It is not a proof that an accepted
+ * pattern is safe.
+ *
+ * The check is a static star-height test: a quantifier that repeats (`*`, `+`,
+ * `{n,}` or `{n,m}` with `m > 1`) applied to a group that already contains a
+ * repeating quantifier is rejected. It is conservative. A nested repetition
+ * that happens to be linear, such as `(a*b)*`, is rejected too; a rewrite
+ * without the nesting exists only for some such patterns. It does not detect every
+ * super-linear pattern: an alternation whose branches overlap under a
+ * repetition (`^([A-Z]|[A-Z0-9])+_KEY$`, `(a|a)+$`) passes, and so do
+ * adjacent quantifiers that can match the same text (`.*.*.*x`), whose cost is
+ * polynomial in the name's length. The rule docs list these limits.
+ *
+ * @see https://github.com/mike-north/eslint-sh/issues/221
+ */
+/** Matches a `{n}`, `{n,}` or `{n,m}` quantifier at the start of the string. */
+const BRACE_QUANTIFIER = /^\{\d+(?:,\d*)?\}/u;
+/**
+ * Reads the quantifier starting at `source[i]`, if there is one. Returns its
+ * length in characters, including a trailing lazy `?`, and whether it can
+ * match its atom more than once.
+ */
+function readQuantifier(source, i) {
+    const char = source[i];
+    let length;
+    let repeats;
+    if (char === '*' || char === '+') {
+        length = 1;
+        repeats = true;
+    }
+    else if (char === '?') {
+        length = 1;
+        repeats = false;
+    }
+    else if (char === '{') {
+        const match = BRACE_QUANTIFIER.exec(source.slice(i));
+        // Without the `u` flag a `{` that does not form a quantifier is a literal.
+        if (match === null)
+            return undefined;
+        length = match[0].length;
+        // `{n}` repeats at most n times, `{n,}` without bound, `{n,m}` at most m times.
+        const bounds = match[0].slice(1, -1);
+        const comma = bounds.indexOf(',');
+        const upper = comma === -1
+            ? Number(bounds)
+            : comma === bounds.length - 1
+                ? Infinity
+                : Number(bounds.slice(comma + 1));
+        repeats = upper > 1;
+    }
+    else {
+        return undefined;
+    }
+    // A lazy quantifier (`*?`, `{2,}?`) backtracks the same way.
+    if (source[i + length] === '?')
+        length++;
+    return { length, repeats };
+}
+/**
+ * Returns the index just past the escape sequence starting at `source[i]`
+ * (which is `\`). Braced and angled forms (`\u{…}`, `\p{…}`, `\k<…>`) are
+ * consumed whole, so their braces are not read as a quantifier.
+ */
+function skipEscape(source, i) {
+    const next = source[i + 1];
+    const close = next === 'k' ? '>' : '}';
+    const open = next === 'k' ? '<' : '{';
+    if ((next === 'u' || next === 'p' || next === 'P' || next === 'k') && source[i + 2] === open) {
+        const end = source.indexOf(close, i + 3);
+        if (end !== -1)
+            return end + 1;
+    }
+    return i + 2;
+}
+/** Returns the index just past the character class starting at `source[i]` (which is `[`). */
+function skipClass(source, i) {
+    let j = i + 1;
+    if (source[j] === '^')
+        j++;
+    while (j < source.length && source[j] !== ']') {
+        j = source[j] === '\\' ? j + 2 : j + 1;
+    }
+    return j + 1;
+}
+/**
+ * Finds a repeating quantifier applied to a group that already contains one,
+ * the shape that makes a backtracking engine exponential. Returns the first
+ * such nesting, or `undefined` when the source has star height of at most one.
+ *
+ * The source is assumed to be a valid regular expression; the caller compiles
+ * it first.
+ *
+ * @internal
+ */
+export function findNestedRepetition(source) {
+    const stack = [{ start: 0, containsRepetition: false }];
+    let i = 0;
+    while (i < source.length) {
+        const char = source[i];
+        // The atom just read: where it starts, where it ends, and whether it
+        // already contains a repetition (only a group can).
+        let atomStart = i;
+        let atomEnd;
+        let atomRepeats = false;
+        if (char === '\\') {
+            atomEnd = skipEscape(source, i);
+        }
+        else if (char === '[') {
+            atomEnd = skipClass(source, i);
+        }
+        else if (char === '(') {
+            stack.push({ start: i, containsRepetition: false });
+            i++;
+            continue;
+        }
+        else if (char === ')') {
+            const frame = stack.pop();
+            // An unbalanced `)` is a syntax error the caller already rejected.
+            if (frame === undefined || stack.length === 0)
+                return undefined;
+            atomStart = frame.start;
+            atomEnd = i + 1;
+            atomRepeats = frame.containsRepetition;
+        }
+        else {
+            atomEnd = i + 1;
+        }
+        const quantifier = readQuantifier(source, atomEnd);
+        if (quantifier?.repeats === true && atomRepeats) {
+            return {
+                outer: source.slice(atomEnd, atomEnd + quantifier.length),
+                group: source.slice(atomStart, atomEnd),
+            };
+        }
+        const top = stack.at(-1);
+        if (top !== undefined && (atomRepeats || quantifier?.repeats === true)) {
+            top.containsRepetition = true;
+        }
+        i = atomEnd + (quantifier?.length ?? 0);
+    }
+    return undefined;
+}
+/**
+ * Compiles a regular-expression source from a rule option that will be tested
+ * against script-controlled text. Throws a `TypeError` naming the rule and the
+ * option when the source is not a valid expression, or when it nests one
+ * repetition inside another (see {@link findNestedRepetition}). ESLint reports
+ * the error from the rule's `create()`, so it surfaces on the first file linted
+ * with the rule ("Occurred while linting <file>"), not when the config loads.
+ *
+ * @param rule - The rule's full name, such as `sh/prefer-local`.
+ * @param option - The option as the user wrote it, such as `patterns[0]`.
+ * @param source - The regular-expression source.
+ * @param flags - The flags to compile with.
+ *
+ * @internal
+ */
+export function compileUserPattern(rule, option, source, flags) {
+    let pattern;
+    try {
+        pattern = new RegExp(source, flags);
+    }
+    catch {
+        throw new TypeError(`${rule}: \`${option}\` must be a valid regular expression; got ${JSON.stringify(source)}.`);
+    }
+    const nested = findNestedRepetition(source);
+    if (nested !== undefined) {
+        throw new TypeError(`${rule}: \`${option}\` (${JSON.stringify(source)}) repeats ${nested.group} with \`${nested.outer}\`, ` +
+            'and that group already repeats. The pattern runs against names the linted script chooses, ' +
+            'and a nested repetition can take exponential time on a long name. Rewrite it with one level ' +
+            'of repetition, for example `[A-Z0-9_]*` instead of `([A-Z]+_?)*`.');
+    }
+    return pattern;
+}

package/dist/syntax/analyze.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The faithful shell analysis surface (`@eslint-sh/eslint-plugin/syntax/analyze`): the complete
+ * public surface of `sh-ast/analyze`, re-exported unchanged from the very `sh-ast` instance this
+ * plugin's language parses with.
+ *
+ * It provides `enumerateCommands`, `resolveArgv0` (whose `chainIndices` locate a resolved command's
+ * arguments in its site's `argv`), `DEFAULT_TRANSPARENT_WRAPPERS`, `WrapperSpec`, the raw
+ * `resolveWord(Node)`, and the named operator constants with `rawOperator` for comparing and
+ * constructing the operator values those records carry. All of it works on the faithful records
+ * from `@eslint-sh/eslint-plugin/syntax`. The plugin root's `resolveWord` takes a lint-view
+ * `ShellNode` instead; the two share a name but not an input contract, so this subpath is kept
+ * separate from the root.
+ *
+ * Like `@eslint-sh/eslint-plugin/syntax`, it tracks the plugin's pinned `sh-ast` minor and never
+ * wraps or renames anything.
+ *
+ * @packageDocumentation
+ */
+export * from 'sh-ast/analyze';

package/dist/syntax/analyze.js

@@ -0,0 +1,21 @@
+/* eslint-disable @api-extractor-tools/package-documentation -- this file is the barrel of the
+   `./syntax/analyze` entry point (package.json `exports`); the rule only recognizes the root barrel. */
+/**
+ * The faithful shell analysis surface (`@eslint-sh/eslint-plugin/syntax/analyze`): the complete
+ * public surface of `sh-ast/analyze`, re-exported unchanged from the very `sh-ast` instance this
+ * plugin's language parses with.
+ *
+ * It provides `enumerateCommands`, `resolveArgv0` (whose `chainIndices` locate a resolved command's
+ * arguments in its site's `argv`), `DEFAULT_TRANSPARENT_WRAPPERS`, `WrapperSpec`, the raw
+ * `resolveWord(Node)`, and the named operator constants with `rawOperator` for comparing and
+ * constructing the operator values those records carry. All of it works on the faithful records
+ * from `@eslint-sh/eslint-plugin/syntax`. The plugin root's `resolveWord` takes a lint-view
+ * `ShellNode` instead; the two share a name but not an input contract, so this subpath is kept
+ * separate from the root.
+ *
+ * Like `@eslint-sh/eslint-plugin/syntax`, it tracks the plugin's pinned `sh-ast` minor and never
+ * wraps or renames anything.
+ *
+ * @packageDocumentation
+ */
+export * from 'sh-ast/analyze';

package/dist/syntax/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The faithful shell syntax surface (`@eslint-sh/eslint-plugin/syntax`): the complete public
+ * surface of `sh-ast`'s root entry point, re-exported unchanged from the very `sh-ast` instance
+ * this plugin's language parses with.
+ *
+ * Use it when a custom rule edits or analyzes the parser's own records rather than the plugin's
+ * lint view: `walk`, `parseSync`, `printSync` and `PrintOptions`, the record types (`Node`,
+ * `Word`, `CallExpr`, `SyntaxPos`, `GoString`, …), and the operator and language constants.
+ * Importing them from here, instead of installing `sh-ast` separately, means a rule always gets
+ * the same `sh-ast` version and module instance as the language that produced its syntax. Under
+ * 0.x a different `sh-ast` minor is a breaking change, and records from one copy are not
+ * guaranteed to be accepted by another.
+ *
+ * This entry point tracks the plugin's pinned `sh-ast` minor, so an `sh-ast` 0.x minor bump is a
+ * minor release of this plugin. It never wraps or renames anything: every name has `sh-ast`'s
+ * own contract. The plugin root (`@eslint-sh/eslint-plugin`) keeps the view-aware helpers such
+ * as `resolveWord(ShellNode)`, which differ from the raw helpers of the same name in
+ * `@eslint-sh/eslint-plugin/syntax/analyze`. That is why these names live on their own subpath
+ * and are not merged into the root.
+ *
+ * @packageDocumentation
+ */
+export * from 'sh-ast';

package/dist/syntax/index.js

@@ -0,0 +1,25 @@
+/* eslint-disable @api-extractor-tools/package-documentation -- this file is the barrel of the
+   `./syntax` entry point (package.json `exports`); the rule only recognizes the root barrel. */
+/**
+ * The faithful shell syntax surface (`@eslint-sh/eslint-plugin/syntax`): the complete public
+ * surface of `sh-ast`'s root entry point, re-exported unchanged from the very `sh-ast` instance
+ * this plugin's language parses with.
+ *
+ * Use it when a custom rule edits or analyzes the parser's own records rather than the plugin's
+ * lint view: `walk`, `parseSync`, `printSync` and `PrintOptions`, the record types (`Node`,
+ * `Word`, `CallExpr`, `SyntaxPos`, `GoString`, …), and the operator and language constants.
+ * Importing them from here, instead of installing `sh-ast` separately, means a rule always gets
+ * the same `sh-ast` version and module instance as the language that produced its syntax. Under
+ * 0.x a different `sh-ast` minor is a breaking change, and records from one copy are not
+ * guaranteed to be accepted by another.
+ *
+ * This entry point tracks the plugin's pinned `sh-ast` minor, so an `sh-ast` 0.x minor bump is a
+ * minor release of this plugin. It never wraps or renames anything: every name has `sh-ast`'s
+ * own contract. The plugin root (`@eslint-sh/eslint-plugin`) keeps the view-aware helpers such
+ * as `resolveWord(ShellNode)`, which differ from the raw helpers of the same name in
+ * `@eslint-sh/eslint-plugin/syntax/analyze`. That is why these names live on their own subpath
+ * and are not merged into the root.
+ *
+ * @packageDocumentation
+ */
+export * from 'sh-ast';

package/dist/version.d.ts

@@ -11,4 +11,3 @@
  * @internal
  */
 export declare function readPackageVersion(): string;
-//# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -26,4 +26,3 @@ export function readPackageVersion() {
     }
     throw new Error(`@eslint-sh/eslint-plugin: package.json at ${packageJsonPath} is missing a string "version" field`);
 }
-//# sourceMappingURL=version.js.map