@jerryan/just-bash 3.5.0

package/dist/limits.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Execution Limits Configuration
+ *
+ * Centralized configuration for all execution limits to prevent runaway compute.
+ * These limits can be overridden when creating a BashEnv instance.
+ */
+/**
+ * Configuration for execution limits.
+ * All limits are optional - undefined values use defaults.
+ */
+export interface ExecutionLimits {
+    /** Maximum shell source bytes accepted before parsing (normal default: 64 MiB) */
+    maxSourceBytes?: number;
+    /** Maximum nested interpreter executions through ctx.exec (default: 64) */
+    maxExecDepth?: number;
+    /** Maximum function call/recursion depth (normal default: 100) */
+    maxCallDepth?: number;
+    /** Maximum number of commands to execute (normal default: 100000) */
+    maxCommandCount?: number;
+    /** Maximum loop iterations for bash while/for/until loops (normal default: 100000) */
+    maxLoopIterations?: number;
+    /** Maximum loop iterations for AWK while/for loops (normal default: 100000) */
+    maxAwkIterations?: number;
+    /** Maximum command iterations for SED branch loops (normal default: 100000) */
+    maxSedIterations?: number;
+    /** Maximum iterations for jq loops (normal default: 100000) */
+    maxJqIterations?: number;
+    /** Maximum jq/yq parser tokens (default: 100000) */
+    maxQueryTokens?: number;
+    /** Maximum jq/yq object/query traversal depth (default: 1000) */
+    maxQueryDepth?: number;
+    /** Maximum jq/yq result elements (default: 1000000) */
+    maxQueryElements?: number;
+    /** Maximum AWK parser tokens (default: 100000) */
+    maxAwkParserTokens?: number;
+    /** Maximum AWK parser nesting depth (default: 256) */
+    maxAwkParserDepth?: number;
+    /** Maximum AWK parser operations (default: 1000000) */
+    maxAwkParserOperations?: number;
+    /** Maximum parsed CSV rows (default: 1000000) */
+    maxCsvRows?: number;
+    /** Maximum parsed CSV cells (default: 10000000) */
+    maxCsvCells?: number;
+    /** Aggregate execution work units shared across nested execution (default: 1000000) */
+    maxWorkUnits?: number;
+    /** Maximum filesystem entries visited by one traversal (default: 1000000) */
+    maxTraversalEntries?: number;
+    /** Maximum filesystem traversal nesting depth (default: 1000) */
+    maxTraversalDepth?: number;
+    /** Maximum filesystem traversal operations (default: 1000000) */
+    maxTraversalWork?: number;
+    /** Maximum reserved live/intermediate bytes (default: 512 MiB) */
+    maxLiveBytes?: number;
+    /** Maximum aggregate input bytes (default: 512 MiB) */
+    maxInputBytes?: number;
+    /** Maximum bytes retained by Bash's default in-memory filesystem (default: 1 GiB) */
+    maxFileSystemBytes?: number;
+    /** Maximum SQLite database image bytes (default: 1 GiB) */
+    maxDatabaseBytes?: number;
+    /** Maximum SQLite result bytes before output formatting (default: 256 MiB) */
+    maxDatabaseResultBytes?: number;
+    /** Maximum aggregate expanded archive bytes (default: 1 GiB) */
+    maxArchiveBytes?: number;
+    /** Maximum compressed archive input bytes (default: 512 MiB) */
+    maxArchiveCompressedBytes?: number;
+    /** Maximum bytes in one archive entry (default: 512 MiB) */
+    maxArchiveEntryBytes?: number;
+    /** Maximum archive entries (default: 1000000) */
+    maxArchiveEntries?: number;
+    /** Maximum worker request or response payload bytes (default: 64 MiB) */
+    maxWorkerMessageBytes?: number;
+    /** Maximum top-level execution wall time in milliseconds (default: 1 hour) */
+    maxExecutionTimeMs?: number;
+    /**
+     * Maximum time to let an aborted command acknowledge cancellation before its
+     * execution context is revoked (normal default: 100ms).
+     */
+    maxExtensionCleanupTimeMs?: number;
+    /** Maximum sqlite3 query execution time in milliseconds (normal default: 30000) */
+    maxSqliteTimeoutMs?: number;
+    /** Maximum Python execution time in milliseconds (normal default: 30000) */
+    maxPythonTimeoutMs?: number;
+    /** Maximum JavaScript execution time in milliseconds (normal default: 30000) */
+    maxJsTimeoutMs?: number;
+    /** Maximum glob filesystem operations (normal default: 1000000) */
+    maxGlobOperations?: number;
+    /** Maximum string length in bytes (normal default: 64 MiB) */
+    maxStringLength?: number;
+    /** Maximum array elements (normal default: 1000000) */
+    maxArrayElements?: number;
+    /** Maximum heredoc size in bytes (normal default: 64 MiB) */
+    maxHeredocSize?: number;
+    /** Maximum command substitution nesting depth (default: 50) */
+    maxSubstitutionDepth?: number;
+    /** Maximum brace expansion results (normal default: 100000) */
+    maxBraceExpansionResults?: number;
+    /** Maximum total output size in bytes (normal default: 256 MiB) */
+    maxOutputSize?: number;
+    /** Maximum number of open file descriptors (normal default: 4096) */
+    maxFileDescriptors?: number;
+    /** Maximum source/. nesting depth (default: 100) */
+    maxSourceDepth?: number;
+}
+/** Named limit presets. `normal` favors compatibility; `hardened` is opt-in. */
+export type ExecutionLimitProfile = "normal" | "hardened";
+/** Liberal default shared by shell and standalone transform entry points. */
+export declare const DEFAULT_MAX_SOURCE_BYTES: number;
+/**
+ * Resolve execution limits by merging user-provided limits with defaults.
+ */
+export declare function resolveLimits(userLimits?: ExecutionLimits, profile?: ExecutionLimitProfile): Required<ExecutionLimits>;

package/dist/network/allow-list/shared.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Shared utilities for allow-list e2e tests
+ *
+ * This module provides:
+ * - Mock fetch implementation with predefined responses
+ * - Environment adapters for BashEnv and Sandbox
+ * - Test utilities like expectBlocked
+ */
+import { vi } from "vitest";
+import type { BashOptions } from "../../Bash.js";
+export declare const MOCK_SUCCESS_BODY: string;
+export declare const MOCK_USERS_BODY: string;
+export declare const MOCK_POSTS_BODY: string;
+export declare const MOCK_FILE_BODY: string;
+export declare const MOCK_EVIL_BODY: string;
+export declare const originalFetch: typeof fetch;
+export declare function createMockFetch(): ReturnType<typeof vi.fn<typeof fetch>>;
+/**
+ * Environment adapter interface for running tests with both BashEnv and Sandbox
+ */
+export interface EnvAdapter {
+    exec(cmd: string): Promise<{
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    readFile(path: string): Promise<string>;
+}
+/**
+ * Creates an adapter for BashEnv
+ */
+export declare function createBashEnvAdapter(options: BashOptions): EnvAdapter;
+/**
+ * Creates an adapter for Sandbox
+ */
+export declare function createSandboxAdapter(options: BashOptions): Promise<EnvAdapter>;
+export type AdapterFactory = (options: BashOptions) => EnvAdapter | Promise<EnvAdapter>;
+/**
+ * Utility for testing that a URL is blocked
+ */
+export declare function expectBlocked(env: EnvAdapter, url: string, expectedUrl?: string): Promise<void>;
+/**
+ * Utility for testing that a URL is blocked due to private IP
+ */
+export declare function expectBlockedPrivate(env: EnvAdapter, url: string, expectedUrl?: string): Promise<void>;
+/**
+ * Utility for testing that a URL succeeds with expected mock response
+ */
+export declare function expectAllowed(env: EnvAdapter, url: string, expectedBody: string): Promise<void>;

package/dist/network/allow-list.d.ts

@@ -0,0 +1,59 @@
+/**
+ * URL allow-list matching
+ *
+ * This module provides URL allow-list matching that is enforced at the fetch layer,
+ * independent of any parsing or user input manipulation.
+ */
+import type { AllowedUrlEntry } from "./types.js";
+/**
+ * Parses a URL string into its components.
+ * Returns null if the URL is invalid.
+ */
+export declare function parseUrl(urlString: string): {
+    origin: string;
+    pathname: string;
+    href: string;
+} | null;
+/**
+ * Normalizes an allow-list entry for consistent matching.
+ * - Removes trailing slashes from origins without paths
+ * - Preserves path prefixes as-is
+ */
+export declare function normalizeAllowListEntry(entry: string): {
+    origin: string;
+    pathPrefix: string;
+} | null;
+/**
+ * Checks if a URL matches an allow-list entry.
+ *
+ * The matching rules are:
+ * 1. Origins must match exactly (case-sensitive for scheme and host)
+ * 2. Path-scoped entries match on path segment boundaries, not raw string prefix
+ * 3. Ambiguous encoded separators (%2f, %5c) are rejected for path-scoped entries
+ * 4. If the allow-list entry has no path (or just "/"), all paths are allowed
+ *
+ * @param url The URL to check (as a string)
+ * @param allowedEntry The allow-list entry to match against
+ * @returns true if the URL matches the allow-list entry
+ */
+export declare function matchesAllowListEntry(url: string, allowedEntry: string): boolean;
+/**
+ * Checks if a URL is allowed by any entry in the allow-list.
+ *
+ * @param url The URL to check
+ * @param allowedUrlPrefixes The list of allowed URL prefixes (strings or objects)
+ * @returns true if the URL is allowed
+ */
+export declare function isUrlAllowed(url: string, allowedUrlPrefixes: AllowedUrlEntry[]): boolean;
+/**
+ * Check if a hostname is a private/loopback IP address.
+ * Only checks the string format — does not perform DNS resolution.
+ */
+export declare function isPrivateIp(hostname: string): boolean;
+/**
+ * Validates an allow-list configuration.
+ * Each entry must be a full origin (scheme + host), optionally followed by a path prefix.
+ * Accepts both plain strings and AllowedUrl objects.
+ * Returns an array of error messages for invalid entries.
+ */
+export declare function validateAllowList(allowedUrlPrefixes: AllowedUrlEntry[]): string[];

package/dist/network/dns-pin.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Request-owned connection binding for DNS-reviewed HTTP requests.
+ *
+ * Each owner has a private Undici Agent whose connector resolves exactly one
+ * hostname to exactly one preflight-reviewed address. The Agent is never
+ * shared between requests or redirect hops, so an existing origin pool cannot
+ * substitute a socket opened under a different DNS decision.
+ *
+ * The browser build removes the Node-only `undici` branch and edge runtimes
+ * that cannot construct this owner fail closed when private-range denial is
+ * enabled.
+ */
+export interface PinnedAddress {
+    hostname: string;
+    address: string;
+    family: 4 | 6;
+}
+export interface PinnedConnectionOwner {
+    fetch(url: string, init: RequestInit): Promise<Response>;
+    close(): Promise<void>;
+}
+export type PinnedConnectionOwnerFactory = (pinned: PinnedAddress) => Promise<PinnedConnectionOwner>;
+/**
+ * Both shapes a dynamic `import("undici")` can resolve to.
+ *
+ * Node resolves the package and exposes its CommonJS exports as named ones. A
+ * bundler that inlines the same module into its own graph cannot always do
+ * that, and hands back a namespace carrying the module under `default` alone.
+ */
+type UndiciNamespace = typeof import("undici") | Pick<typeof import("undici"), "default">;
+type UndiciExports = typeof import("undici") | typeof import("undici").default;
+/** @internal Pure namespace normalization used by focused interop tests. */
+export declare function _undiciExports(namespace: UndiciNamespace): UndiciExports;
+type PinnedLookup = import("node:net").LookupFunction;
+/** @internal Pure connector lookup used by focused binding tests. */
+export declare function _createPinnedLookup(pinned: PinnedAddress): PinnedLookup;
+/**
+ * Create a disposable transport whose pool identity is the reviewed address.
+ * The returned owner must be closed after the response body is consumed.
+ */
+export declare const createPinnedConnectionOwner: PinnedConnectionOwnerFactory;
+export {};

package/dist/network/fetch.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Secure fetch adapter.
+ *
+ * just-bash retains path allow-listing, firewall headers, response conversion,
+ * and redirect policy; guarded-fetch handles SSRF and transport safety.
+ */
+import { type FetchResult, type NetworkConfig } from "./types.js";
+export interface SecureFetchOptions {
+    method?: string;
+    headers?: Headers | Record<string, string>;
+    body?: string;
+    followRedirects?: boolean;
+    /** Override timeout for this request (capped at global timeout) */
+    timeoutMs?: number;
+    /** Override redirects for this request (capped at the host policy). */
+    maxRedirects?: number;
+    /** Abort DNS review, redirects, transport, and response-body consumption. */
+    signal?: AbortSignal;
+}
+/**
+ * Type for the secure fetch function
+ */
+export type SecureFetch = (url: string, options?: SecureFetchOptions) => Promise<FetchResult>;
+/**
+ * Creates a secure fetch function that enforces the allow-list.
+ */
+export declare function createSecureFetch(config: NetworkConfig): SecureFetch;

package/dist/network/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Network module
+ *
+ * Provides secure network access with URL allow-list enforcement.
+ */
+export { createSecureFetch, type SecureFetch, type SecureFetchOptions, } from "./fetch.js";
+export { type AllowedUrl, type AllowedUrlEntry, type FetchResult, type HttpMethod, NetworkAccessDeniedError, type NetworkConfig, RedirectNotAllowedError, type RequestTransform, TooManyRedirectsError, } from "./types.js";

package/dist/network/types.d.ts

@@ -0,0 +1,182 @@
+/**
+ * Network configuration types
+ *
+ * Network access is disabled by default. To enable network access (e.g., for curl),
+ * you must explicitly configure allowed URLs.
+ */
+import type { PinnedConnectionOwnerFactory } from "./dns-pin.js";
+/**
+ * DNS lookup result used for private IP resolution checks
+ */
+export interface DnsLookupResult {
+    address: string;
+    family: number;
+}
+/**
+ * HTTP methods that can be allowed
+ */
+export type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
+/**
+ * Header transform applied at the fetch boundary.
+ * Headers specified here override any user-supplied headers with the same name.
+ */
+export interface RequestTransform {
+    headers: Record<string, string>;
+}
+/**
+ * An allowed URL entry with optional header transforms.
+ * Transforms are applied at the fetch boundary so secrets never enter the sandbox.
+ */
+export interface AllowedUrl {
+    url: string;
+    transform?: RequestTransform[];
+}
+/**
+ * An entry in the allowedUrlPrefixes list: either a plain URL string or
+ * an object with a URL and optional transforms.
+ */
+export type AllowedUrlEntry = string | AllowedUrl;
+/**
+ * Configuration for network access
+ */
+export interface NetworkConfig {
+    /**
+     * List of allowed URL prefixes. Each entry must be a full origin (scheme + host),
+     * optionally followed by a path prefix:
+     * - An origin: "https://api.example.com" - allows all paths on this origin
+     * - An origin + path prefix: "https://api.example.com/v1/" - allows only paths starting with /v1/
+     *
+     * Entries can be plain strings or objects with transforms for credentials brokering:
+     * ```
+     * allowedUrlPrefixes: [
+     *   "https://other-api.com",
+     *   {
+     *     url: "https://ai-gateway.vercel.sh",
+     *     transform: [{ headers: { "Authorization": "Bearer secret" } }],
+     *   },
+     * ]
+     * ```
+     *
+     * The check is performed on the full URL, so "https://api.example.com/v1" will allow:
+     * - https://api.example.com/v1
+     * - https://api.example.com/v1/users
+     * - https://api.example.com/v1/users/123
+     *
+     * But NOT:
+     * - https://api.example.com/v10
+     * - https://api.example.com/v1-admin
+     * - https://api.example.com/v2/users
+     * - https://api.example.org/v1/users (different origin)
+     * - URLs that rely on ambiguous separators or path parameters like %2f,
+     *   %5c, semicolons, or nested encodings
+     *
+     * Invalid entries (missing scheme, missing host, relative paths) will throw an error.
+     */
+    allowedUrlPrefixes?: AllowedUrlEntry[];
+    /**
+     * List of allowed HTTP methods. Defaults to ["GET", "HEAD"] for safety.
+     * dangerouslyAllowFullInternetAccess to enables all methods.
+     */
+    allowedMethods?: HttpMethod[];
+    /**
+     * Bypass the allow-list and allow all URLs and methods.
+     * DANGEROUS: Only use this in trusted environments.
+     */
+    dangerouslyAllowFullInternetAccess?: boolean;
+    /**
+     * Maximum number of redirects to follow (default: 20)
+     */
+    maxRedirects?: number;
+    /**
+     * Request timeout in milliseconds (default: 30000)
+     */
+    timeoutMs?: number;
+    /**
+     * Maximum response body size in bytes (default: 10MB).
+     * Responses larger than this will be rejected with ResponseTooLargeError.
+     */
+    maxResponseSize?: number;
+    /**
+     * Reject URLs with private/loopback IP addresses as hostnames.
+     * Performs both lexical hostname checks and DNS resolution to catch
+     * domains that resolve to private IPs (e.g., DNS rebinding attacks).
+     * Domain requests fail closed on resolution errors, empty or malformed
+     * answers, and runtimes that cannot pin the reviewed address to the actual
+     * connection. Each redirect hop is resolved and pinned independently.
+     * Useful for mitigating SSRF attacks. Default: false (opt-in).
+     *
+     * When enabled, the private IP check is enforced even when
+     * `dangerouslyAllowFullInternetAccess` is true, ensuring that
+     * internal/loopback addresses are never reachable.
+     */
+    denyPrivateRanges?: boolean;
+    /**
+     * @internal Override DNS resolution for testing.
+     * @deprecated guarded-fetch resolves DNS internally; `createSecureFetch`
+     * throws when this is set rather than running a weaker policy silently.
+     */
+    _dnsResolve?: (hostname: string) => Promise<DnsLookupResult[]>;
+    /**
+     * @internal Override request-owned connection binding for testing.
+     * @deprecated guarded-fetch pins connections itself; `createSecureFetch`
+     * throws when this is set rather than running a weaker policy silently.
+     */
+    _createConnectionOwner?: PinnedConnectionOwnerFactory;
+    /**
+     * @internal Override the HTTP transport for testing. Required to intercept
+     * requests on the private-range-enforcing path, which ignores
+     * `globalThis.fetch`. DNS resolution and IP validation still run.
+     */
+    _fetch?: typeof fetch;
+}
+/**
+ * Result of a network fetch operation
+ */
+export interface FetchResult {
+    status: number;
+    statusText: string;
+    headers: Record<string, string>;
+    /** Raw response bytes (never decoded as UTF-8 text). */
+    body: Uint8Array;
+    url: string;
+    /**
+     * Intermediate redirect responses in hop order (excluding the final
+     * response). Populated when redirects were followed so callers like
+     * `curl -D` can dump every status/header block the way real curl does.
+     */
+    redirectChain?: Array<{
+        status: number;
+        statusText: string;
+        headers: Record<string, string>;
+    }>;
+}
+/**
+ * Error thrown when a URL is not allowed
+ */
+export declare class NetworkAccessDeniedError extends Error {
+    constructor(url: string, reason?: string);
+}
+/**
+ * Error thrown when too many redirects occur
+ */
+export declare class TooManyRedirectsError extends Error {
+    constructor(maxRedirects: number);
+}
+/**
+ * Error thrown when a redirect target is not allowed
+ */
+export declare class RedirectNotAllowedError extends Error {
+    constructor(url: string);
+}
+/**
+ * Error thrown when an HTTP method is not allowed
+ */
+export declare class MethodNotAllowedError extends Error {
+    constructor(method: string, allowedMethods: string[]);
+}
+/**
+ * Error thrown when a response body exceeds the maximum allowed size
+ */
+export declare class ResponseTooLargeError extends Error {
+    constructor(maxSize: number);
+}

package/dist/parser/arithmetic-parser.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Arithmetic Expression Parser
+ *
+ * Parses bash arithmetic expressions like:
+ * - $((1 + 2))
+ * - $((x++))
+ * - $((a ? b : c))
+ * - $((2#1010))
+ *
+ * All functions take a Parser instance as the first argument for shared state access.
+ */
+import type { ArithExpr, ArithmeticExpressionNode } from "../ast/types.js";
+import { parseArithNumber } from "./arithmetic-primaries.js";
+import type { Parser } from "./parser.js";
+export { parseArithNumber };
+/**
+ * Parse an arithmetic expression string into an AST node
+ */
+export declare function parseArithmeticExpression(_p: Parser, input: string): ArithmeticExpressionNode;
+export declare function parseArithExpr(p: Parser, input: string, pos: number): {
+    expr: ArithExpr;
+    pos: number;
+};

package/dist/parser/arithmetic-primaries.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Helper functions for parsing primary arithmetic expressions
+ */
+import type { ArithExpr } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+/**
+ * Skip whitespace in arithmetic expression input.
+ * Also handles line continuations (backslash followed by newline).
+ */
+export declare function skipArithWhitespace(input: string, pos: number): number;
+/**
+ * Assignment operators in arithmetic expressions
+ */
+export declare const ARITH_ASSIGN_OPS: readonly ["=", "+=", "-=", "*=", "/=", "%=", "<<=", ">>=", "&=", "|=", "^="];
+/**
+ * Parse a number string with various bases (decimal, hex, octal, base#num)
+ * Returns NaN for invalid numbers.
+ */
+export declare function parseArithNumber(str: string): number;
+/**
+ * Parse nested arithmetic expression: $((expr))
+ */
+export declare function parseNestedArithmetic(parseArithExpr: (p: Parser, input: string, pos: number) => {
+    expr: ArithExpr;
+    pos: number;
+}, p: Parser, input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;
+/**
+ * Parse ANSI-C quoting: $'...'
+ * Returns the numeric value of the string content
+ */
+export declare function parseAnsiCQuoting(input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;
+/**
+ * Parse localization quoting: $"..."
+ * Returns the numeric value of the string content
+ */
+export declare function parseLocalizationQuoting(input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;

package/dist/parser/command-parser.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Command Parser
+ *
+ * Handles parsing of simple commands, redirections, and assignments.
+ */
+import { type RedirectionNode, type SimpleCommandNode } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+export declare function isRedirection(p: Parser): boolean;
+export declare function parseRedirection(p: Parser): RedirectionNode;
+export declare function parseSimpleCommand(p: Parser): SimpleCommandNode;

package/dist/parser/compound-parser.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Compound Command Parser
+ *
+ * Handles parsing of compound commands: if, for, while, until, case, subshell, group.
+ */
+import { type CaseNode, type CStyleForNode, type ForNode, type GroupNode, type IfNode, type SubshellNode, type UntilNode, type WhileNode } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+export declare function parseIf(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): IfNode;
+export declare function parseFor(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): ForNode | CStyleForNode;
+export declare function parseWhile(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): WhileNode;
+export declare function parseUntil(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): UntilNode;
+export declare function parseCase(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): CaseNode;
+export declare function parseSubshell(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): SubshellNode | CStyleForNode;
+export declare function parseGroup(p: Parser, options?: {
+    skipRedirections?: boolean;
+}): GroupNode;

package/dist/parser/conditional-parser.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Conditional Expression Parser
+ *
+ * Handles parsing of [[ ... ]] conditional commands.
+ */
+import type { ConditionalExpressionNode } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+export declare function parseConditionalExpression(p: Parser): ConditionalExpressionNode;

package/dist/parser/expansion-parser.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Expansion Parser
+ *
+ * Handles parsing of parameter expansions, arithmetic expansions, etc.
+ */
+import { type WordPart } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+export declare function parseWordParts(p: Parser, value: string, quoted?: boolean, singleQuoted?: boolean, isAssignment?: boolean, hereDoc?: boolean, 
+/** When true, single quotes are treated as literal characters, not quote delimiters */
+singleQuotesAreLiteral?: boolean, 
+/** When true, brace expansion is disabled (used in [[ ]] conditionals) */
+noBraceExpansion?: boolean, 
+/** When true, all backslash escapes create Escaped nodes (for regex patterns in [[ =~ ]]) */
+regexPattern?: boolean, 
+/** When true, \} is treated as escaped } (used in parameter expansion default values) */
+inParameterExpansion?: boolean, 
+/** Whether this token starts the complete shell word. */
+atWordStart?: boolean): WordPart[];