just-binary 2.9.8

package/dist/interpreter/types.d.ts

@@ -0,0 +1,317 @@
+/**
+ * Interpreter Types
+ */
+import type { CommandNode, FunctionDefNode, ScriptNode, StatementNode } from "../ast/types.js";
+import type { IFileSystem } from "../fs/interface.js";
+import type { ExecutionLimits } from "../limits.js";
+import type { SecureFetch } from "../network/index.js";
+import type { CommandRegistry, ExecResult, FeatureCoverageWriter, TraceCallback } from "../types.js";
+/**
+ * Completion specification for a command, set by the `complete` builtin.
+ */
+export interface CompletionSpec {
+    /** Word list for -W option */
+    wordlist?: string;
+    /** Function name for -F option */
+    function?: string;
+    /** Command to run for -C option */
+    command?: string;
+    /** Completion options (nospace, filenames, etc.) */
+    options?: string[];
+    /** Actions to perform (from -A option) */
+    actions?: string[];
+    /** Whether this is a default completion (-D) */
+    isDefault?: boolean;
+}
+export interface ShellOptions {
+    /** set -e: Exit immediately if a command exits with non-zero status */
+    errexit: boolean;
+    /** set -o pipefail: Return the exit status of the last (rightmost) command in a pipeline that fails */
+    pipefail: boolean;
+    /** set -u: Treat unset variables as an error when substituting */
+    nounset: boolean;
+    /** set -x: Print commands and their arguments as they are executed */
+    xtrace: boolean;
+    /** set -v: Print shell input lines as they are read (verbose) */
+    verbose: boolean;
+    /** set -o posix: POSIX mode for stricter compliance */
+    posix: boolean;
+    /** set -a: Export all variables */
+    allexport: boolean;
+    /** set -C: Prevent overwriting files with redirection */
+    noclobber: boolean;
+    /** set -f: Disable filename expansion (globbing) */
+    noglob: boolean;
+    /** set -n: Read commands but do not execute them (syntax check mode) */
+    noexec: boolean;
+    /** set -o vi: Use vi-style line editing (mutually exclusive with emacs) */
+    vi: boolean;
+    /** set -o emacs: Use emacs-style line editing (mutually exclusive with vi) */
+    emacs: boolean;
+}
+export interface ShoptOptions {
+    /** shopt -s extglob: Enable extended globbing patterns @(), *(), +(), ?(), !() */
+    extglob: boolean;
+    /** shopt -s dotglob: Include dotfiles in glob expansion */
+    dotglob: boolean;
+    /** shopt -s nullglob: Return empty for non-matching globs instead of literal pattern */
+    nullglob: boolean;
+    /** shopt -s failglob: Fail if glob pattern has no matches */
+    failglob: boolean;
+    /** shopt -s globstar: Enable ** recursive glob patterns */
+    globstar: boolean;
+    /** shopt -s globskipdots: Skip . and .. in glob patterns (default: true in bash >=5.2) */
+    globskipdots: boolean;
+    /** shopt -s nocaseglob: Case-insensitive glob matching */
+    nocaseglob: boolean;
+    /** shopt -s nocasematch: Case-insensitive pattern matching in [[ ]] and case */
+    nocasematch: boolean;
+    /** shopt -s expand_aliases: Enable alias expansion */
+    expand_aliases: boolean;
+    /** shopt -s lastpipe: Run last command of pipeline in current shell context */
+    lastpipe: boolean;
+    /** shopt -s xpg_echo: Make echo interpret backslash escapes by default (like echo -e) */
+    xpg_echo: boolean;
+}
+/**
+ * Tracks variable type attributes (declare -i, -l, -u, -n, -a, -A, etc.)
+ * and export status. These affect how variables are read, written, and expanded.
+ */
+export interface VariableAttributeState {
+    /** Set of variable names that are readonly */
+    readonlyVars?: Set<string>;
+    /** Set of variable names that are associative arrays */
+    associativeArrays?: Set<string>;
+    /** Set of variable names that are namerefs (declare -n) */
+    namerefs?: Set<string>;
+    /**
+     * Set of nameref variable names that were "bound" to valid targets at creation time.
+     * A bound nameref will always resolve through to its target, even if the target
+     * is later unset. An unbound nameref (target didn't exist at creation) acts like
+     * a regular variable, returning its raw value.
+     */
+    boundNamerefs?: Set<string>;
+    /**
+     * Set of nameref variable names that were created with an invalid target.
+     * Invalid namerefs always read/write their value directly, never resolving.
+     * For example, after `ref=1; typeset -n ref`, ref has an invalid target "1".
+     */
+    invalidNamerefs?: Set<string>;
+    /** Set of variable names that have integer attribute (declare -i) */
+    integerVars?: Set<string>;
+    /** Set of variable names that have lowercase attribute (declare -l) */
+    lowercaseVars?: Set<string>;
+    /** Set of variable names that have uppercase attribute (declare -u) */
+    uppercaseVars?: Set<string>;
+    /** Set of exported variable names */
+    exportedVars?: Set<string>;
+    /** Set of temporarily exported variable names (for prefix assignments like FOO=bar cmd) */
+    tempExportedVars?: Set<string>;
+    /**
+     * Stack of sets tracking variables exported within each local scope.
+     * When a function returns and a local scope is popped, if a variable was
+     * exported only in that scope (not before entering), the export attribute
+     * should be removed. This enables bash's scoped export behavior where
+     * `local V=x; export V` only exports the local, not the global.
+     */
+    localExportedVars?: Set<string>[];
+    /** Set of variable names that have been declared but not assigned a value */
+    declaredVars?: Set<string>;
+}
+/**
+ * Tracks the complex local variable scoping machinery.
+ * Bash's local variable behavior is intricate: variables are dynamically scoped,
+ * can be declared multiple times in nested contexts, and have different unset
+ * behaviors depending on whether the unset happens in the declaring scope.
+ */
+export interface LocalScopingState {
+    /** Stack of local variable scopes (one Map per function call) */
+    localScopes: Map<string, Uint8Array | undefined>[];
+    /**
+     * Tracks at which call depth each local variable was declared.
+     * Used for bash-specific unset scoping behavior:
+     * - local-unset (same scope): value-unset (clears value, keeps local cell)
+     * - dynamic-unset (different scope): cell-unset (removes local cell, exposes outer value)
+     */
+    localVarDepth?: Map<string, number>;
+    /**
+     * Stack of saved values for each local variable, supporting bash's localvar-nest behavior.
+     * Each entry contains the saved (outer) value and the scope index where it was saved.
+     * This allows multiple nested `local` declarations of the same variable (e.g., in nested evals)
+     * to each have their own cell that can be unset independently.
+     */
+    localVarStack?: Map<string, Array<{
+        value: Uint8Array | undefined;
+        scopeIndex: number;
+    }>>;
+    /**
+     * Map of variable names to scope index where they were fully unset.
+     * Used to prevent tempenv restoration after all local cells are removed.
+     * Entries are cleared when their scope returns.
+     */
+    fullyUnsetLocals?: Map<string, number>;
+    /**
+     * Stack of temporary environment bindings from prefix assignments (e.g., FOO=bar cmd).
+     * Each entry maps variable names to their saved (underlying) values.
+     * Used for bash-specific unset behavior: when unsetting a variable that has a
+     * tempenv binding, the unset should reveal the underlying value, not completely
+     * remove the variable.
+     */
+    tempEnvBindings?: Map<string, Uint8Array | undefined>[];
+    /**
+     * Set of tempenv variable names that have been explicitly written to within
+     * the current function context (after the prefix assignment, before local).
+     * Used to distinguish between "fresh" tempenvs (local-unset = value-unset)
+     * and "mutated" tempenvs (local-unset reveals the mutated value).
+     */
+    mutatedTempEnvVars?: Set<string>;
+    /**
+     * Set of tempenv variable names that have been accessed (read or written)
+     * within the current function context. Used to determine if a tempenv was
+     * "observed" before a local declaration.
+     */
+    accessedTempEnvVars?: Set<string>;
+}
+/**
+ * Tracks the function call stack and source file nesting.
+ * This state powers the FUNCNAME, BASH_LINENO, and BASH_SOURCE arrays,
+ * and determines the behavior of `return` in different contexts.
+ */
+export interface CallStackState {
+    /** Function definitions (name -> AST node) */
+    functions: Map<string, FunctionDefNode>;
+    /** Current function call depth (for recursion limits and local scoping) */
+    callDepth: number;
+    /** Current source script nesting depth (for return in sourced scripts) */
+    sourceDepth: number;
+    /** Stack of call line numbers for BASH_LINENO */
+    callLineStack?: number[];
+    /** Stack of function names for FUNCNAME */
+    funcNameStack?: string[];
+    /** Stack of source files for BASH_SOURCE (tracks where functions were defined) */
+    sourceStack?: string[];
+    /** Current source file context (for function definitions) */
+    currentSource?: string;
+}
+/**
+ * Tracks loop nesting and condition context.
+ * Used to implement break/continue commands and to suppress errexit
+ * in condition contexts (if, while, until, ||, &&).
+ */
+export interface ControlFlowState {
+    /** True when executing condition for if/while/until (errexit doesn't apply) */
+    inCondition: boolean;
+    /** Current loop nesting depth (for break/continue) */
+    loopDepth: number;
+    /** True if this subshell was spawned from within a loop context (for break/continue to exit subshell) */
+    parentHasLoopContext?: boolean;
+    /** True when the last executed statement's exit code is "safe" for errexit purposes
+     *  (e.g., from a &&/|| chain where the failure wasn't the final command) */
+    errexitSafe?: boolean;
+}
+/**
+ * Tracks process IDs, timing, and execution counts.
+ * Powers special variables like $$, $BASHPID, $!, and $SECONDS.
+ */
+export interface ProcessState {
+    /** Total commands executed (for execution limits) */
+    commandCount: number;
+    /** Time when shell started (for $SECONDS) */
+    startTime: number;
+    /** PID of last background job (for $!) */
+    lastBackgroundPid: number;
+    /** Current BASHPID (changes in subshells, unlike $$) */
+    bashPid: number;
+    /** Counter for generating unique virtual PIDs for subshells */
+    nextVirtualPid: number;
+}
+/**
+ * Tracks file descriptors and stdin content for I/O operations.
+ * Used for process substitution, here-documents, and compound command stdin.
+ */
+export interface IOState {
+    /** Stdin available for commands in compound commands (groups, subshells, while loops with piped input) */
+    groupStdin?: Uint8Array;
+    /** File descriptors for process substitution and here-docs */
+    fileDescriptors?: Map<number, string>;
+    /** Next available file descriptor for {varname}>file allocation (starts at 10) */
+    nextFd?: number;
+}
+/**
+ * Captures errors that occur during parameter expansion.
+ * Some expansion errors need to be reported after expansion completes,
+ * with their exit codes and stderr preserved.
+ */
+export interface ExpansionState {
+    /** Exit code from expansion errors (arithmetic, etc.) - overrides command exit code */
+    expansionExitCode?: number;
+    /** Stderr from expansion errors */
+    expansionStderr?: string;
+}
+/**
+ * Complete interpreter state for bash script execution.
+ *
+ * This interface is composed from focused sub-interfaces:
+ * - {@link VariableAttributeState} - Variable type attributes (readonly, integer, etc.)
+ * - {@link LocalScopingState} - Local variable scoping machinery
+ * - {@link CallStackState} - Function calls and source file tracking
+ * - {@link ControlFlowState} - Loop nesting and condition context
+ * - {@link ProcessState} - PIDs, timing, execution counts
+ * - {@link IOState} - File descriptors and stdin
+ * - {@link ExpansionState} - Expansion error capture
+ */
+export interface InterpreterState extends VariableAttributeState, LocalScopingState, CallStackState, ControlFlowState, ProcessState, IOState, ExpansionState {
+    /** Environment variables (exported to commands) - uses Map to prevent prototype pollution */
+    env: Map<string, Uint8Array>;
+    /** Current working directory */
+    cwd: string;
+    /** Previous directory (for `cd -`) */
+    previousDir: string;
+    /** Exit code of last executed command */
+    lastExitCode: number;
+    /** Last argument of previous command, for $_ expansion */
+    lastArg: Uint8Array;
+    /** Current line number being executed (for $LINENO) */
+    currentLine: number;
+    /** Shell options (set -e, etc.) */
+    options: ShellOptions;
+    /** Shopt options (shopt -s, etc.) */
+    shoptOptions: ShoptOptions;
+    /** Completion specifications set by the `complete` builtin */
+    completionSpecs?: Map<string, CompletionSpec>;
+    /** Directory stack for pushd/popd/dirs */
+    directoryStack?: string[];
+    /** Hash table for PATH command lookup caching */
+    hashTable?: Map<string, string>;
+    /**
+     * Suppress verbose mode output (set -v) when inside command substitutions.
+     * bash only prints verbose output for the main script, not for commands
+     * inside $(...) or backticks.
+     */
+    suppressVerbose?: boolean;
+}
+export interface InterpreterContext {
+    state: InterpreterState;
+    fs: IFileSystem;
+    commands: CommandRegistry;
+    /** Execution limits configuration */
+    limits: Required<ExecutionLimits>;
+    execFn: (script: string, options?: {
+        env?: Record<string, string>;
+        cwd?: string;
+        stdin?: Uint8Array;
+    }) => Promise<ExecResult>;
+    executeScript: (node: ScriptNode) => Promise<ExecResult>;
+    executeStatement: (node: StatementNode) => Promise<ExecResult>;
+    executeCommand: (node: CommandNode, stdin: Uint8Array) => Promise<ExecResult>;
+    /** Optional secure fetch function for network-enabled commands */
+    fetch?: SecureFetch;
+    /** Optional sleep function for testing with mock clocks */
+    sleep?: (ms: number) => Promise<void>;
+    /** Optional trace callback for performance profiling */
+    trace?: TraceCallback;
+    /** Current command substitution nesting depth (for limit enforcement) */
+    substitutionDepth?: number;
+    /** Optional feature coverage writer for fuzzing instrumentation */
+    coverage?: FeatureCoverageWriter;
+}

package/dist/limits.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Execution Limits Configuration
+ *
+ * Centralized configuration for all execution limits to prevent runaway compute.
+ * These limits can be overridden when creating a BashEnv instance.
+ */
+/**
+ * Configuration for execution limits.
+ * All limits are optional - undefined values use defaults.
+ */
+export interface ExecutionLimits {
+    /** Maximum function call/recursion depth (default: 100) */
+    maxCallDepth?: number;
+    /** Maximum number of commands to execute (default: 10000) */
+    maxCommandCount?: number;
+    /** Maximum loop iterations for bash while/for/until loops (default: 10000) */
+    maxLoopIterations?: number;
+    /** Maximum loop iterations for AWK while/for loops (default: 10000) */
+    maxAwkIterations?: number;
+    /** Maximum command iterations for SED (branch loops) (default: 10000) */
+    maxSedIterations?: number;
+    /** Maximum iterations for jq loops (until, while, repeat) (default: 10000) */
+    maxJqIterations?: number;
+    /** Maximum sqlite3 query execution time in milliseconds (default: 5000) */
+    maxSqliteTimeoutMs?: number;
+    /** Maximum Python execution time in milliseconds (default: 30000) */
+    maxPythonTimeoutMs?: number;
+    /** Maximum glob filesystem operations (default: 100000) */
+    maxGlobOperations?: number;
+    /** Maximum string length in bytes (default: 10MB = 10485760) */
+    maxStringLength?: number;
+    /** Maximum array elements (default: 100000) */
+    maxArrayElements?: number;
+    /** Maximum heredoc size in bytes (default: 10MB = 10485760) */
+    maxHeredocSize?: number;
+    /** Maximum command substitution nesting depth (default: 50) */
+    maxSubstitutionDepth?: number;
+}
+/**
+ * Resolve execution limits by merging user-provided limits with defaults.
+ */
+export declare function resolveLimits(userLimits?: ExecutionLimits): Required<ExecutionLimits>;

package/dist/network/allow-list/shared.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared utilities for allow-list e2e tests
+ *
+ * This module provides:
+ * - Mock fetch implementation with predefined responses
+ * - Environment adapters for BashEnv and Sandbox
+ * - Test utilities like expectBlocked
+ */
+import { vi } from "vitest";
+import type { BashOptions } from "../../Bash.js";
+export declare const MOCK_SUCCESS_BODY: string;
+export declare const MOCK_USERS_BODY: string;
+export declare const MOCK_POSTS_BODY: string;
+export declare const MOCK_FILE_BODY: string;
+export declare const MOCK_EVIL_BODY: string;
+export declare const originalFetch: typeof fetch;
+export declare function createMockFetch(): ReturnType<typeof vi.fn<typeof fetch>>;
+/**
+ * Environment adapter interface for running tests with both BashEnv and Sandbox
+ */
+export interface EnvAdapter {
+    exec(cmd: string): Promise<{
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    readFile(path: string): Promise<string>;
+}
+/**
+ * Creates an adapter for BashEnv
+ */
+export declare function createBashEnvAdapter(options: BashOptions): EnvAdapter;
+/**
+ * Creates an adapter for Sandbox
+ */
+export declare function createSandboxAdapter(options: BashOptions): Promise<EnvAdapter>;
+export type AdapterFactory = (options: BashOptions) => EnvAdapter | Promise<EnvAdapter>;
+/**
+ * Utility for testing that a URL is blocked
+ */
+export declare function expectBlocked(env: EnvAdapter, url: string, expectedUrl?: string): Promise<void>;
+/**
+ * Utility for testing that a URL succeeds with expected mock response
+ */
+export declare function expectAllowed(env: EnvAdapter, url: string, expectedBody: string): Promise<void>;

package/dist/network/allow-list.d.ts

@@ -0,0 +1,51 @@
+/**
+ * URL allow-list matching
+ *
+ * This module provides URL allow-list matching that is enforced at the fetch layer,
+ * independent of any parsing or user input manipulation.
+ */
+/**
+ * Parses a URL string into its components.
+ * Returns null if the URL is invalid.
+ */
+export declare function parseUrl(urlString: string): {
+    origin: string;
+    pathname: string;
+    href: string;
+} | null;
+/**
+ * Normalizes an allow-list entry for consistent matching.
+ * - Removes trailing slashes from origins without paths
+ * - Preserves path prefixes as-is
+ */
+export declare function normalizeAllowListEntry(entry: string): {
+    origin: string;
+    pathPrefix: string;
+} | null;
+/**
+ * Checks if a URL matches an allow-list entry.
+ *
+ * The matching rules are:
+ * 1. Origins must match exactly (case-sensitive for scheme and host)
+ * 2. The URL's path must start with the allow-list entry's path
+ * 3. If the allow-list entry has no path (or just "/"), all paths are allowed
+ *
+ * @param url The URL to check (as a string)
+ * @param allowedEntry The allow-list entry to match against
+ * @returns true if the URL matches the allow-list entry
+ */
+export declare function matchesAllowListEntry(url: string, allowedEntry: string): boolean;
+/**
+ * Checks if a URL is allowed by any entry in the allow-list.
+ *
+ * @param url The URL to check
+ * @param allowedUrlPrefixes The list of allowed URL prefixes
+ * @returns true if the URL is allowed
+ */
+export declare function isUrlAllowed(url: string, allowedUrlPrefixes: string[]): boolean;
+/**
+ * Validates an allow-list configuration.
+ * Each entry must be a full origin (scheme + host), optionally followed by a path prefix.
+ * Returns an array of error messages for invalid entries.
+ */
+export declare function validateAllowList(allowedUrlPrefixes: string[]): string[];

package/dist/network/fetch.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Secure fetch wrapper with allow-list enforcement
+ *
+ * This module provides a fetch wrapper that:
+ * 1. Enforces URL allow-list at the fetch layer (not subject to parsing)
+ * 2. Handles redirects manually to check each redirect target against the allow-list
+ * 3. Provides timeout support
+ */
+import { type FetchResult, type NetworkConfig } from "./types.js";
+export interface SecureFetchOptions {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    followRedirects?: boolean;
+    /** Override timeout for this request (capped at global timeout) */
+    timeoutMs?: number;
+}
+/**
+ * Type for the secure fetch function
+ */
+export type SecureFetch = (url: string, options?: SecureFetchOptions) => Promise<FetchResult>;
+/**
+ * Creates a secure fetch function that enforces the allow-list.
+ */
+export declare function createSecureFetch(config: NetworkConfig): SecureFetch;

package/dist/network/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Network module
+ *
+ * Provides secure network access with URL allow-list enforcement.
+ */
+export { createSecureFetch, type SecureFetch, type SecureFetchOptions, } from "./fetch.js";
+export { type FetchResult, type HttpMethod, NetworkAccessDeniedError, type NetworkConfig, RedirectNotAllowedError, TooManyRedirectsError, } from "./types.js";

package/dist/network/types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Network configuration types
+ *
+ * Network access is disabled by default. To enable network access (e.g., for curl),
+ * you must explicitly configure allowed URLs.
+ */
+/**
+ * HTTP methods that can be allowed
+ */
+export type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
+/**
+ * Configuration for network access
+ */
+export interface NetworkConfig {
+    /**
+     * List of allowed URL prefixes. Each entry must be a full origin (scheme + host),
+     * optionally followed by a path prefix:
+     * - An origin: "https://api.example.com" - allows all paths on this origin
+     * - An origin + path prefix: "https://api.example.com/v1/" - allows only paths starting with /v1/
+     *
+     * The check is performed on the full URL, so "https://api.example.com/v1" will allow:
+     * - https://api.example.com/v1
+     * - https://api.example.com/v1/users
+     * - https://api.example.com/v1/users/123
+     *
+     * But NOT:
+     * - https://api.example.com/v2/users
+     * - https://api.example.org/v1/users (different origin)
+     *
+     * Invalid entries (missing scheme, missing host, relative paths) will throw an error.
+     */
+    allowedUrlPrefixes?: string[];
+    /**
+     * List of allowed HTTP methods. Defaults to ["GET", "HEAD"] for safety.
+     * dangerouslyAllowFullInternetAccess to enables all methods.
+     */
+    allowedMethods?: HttpMethod[];
+    /**
+     * Bypass the allow-list and allow all URLs and methods.
+     * DANGEROUS: Only use this in trusted environments.
+     */
+    dangerouslyAllowFullInternetAccess?: boolean;
+    /**
+     * Maximum number of redirects to follow (default: 20)
+     */
+    maxRedirects?: number;
+    /**
+     * Request timeout in milliseconds (default: 30000)
+     */
+    timeoutMs?: number;
+    /**
+     * Maximum response body size in bytes (default: 10MB).
+     * Responses larger than this will be rejected with ResponseTooLargeError.
+     */
+    maxResponseSize?: number;
+}
+/**
+ * Result of a network fetch operation
+ */
+export interface FetchResult {
+    status: number;
+    statusText: string;
+    headers: Record<string, string>;
+    body: string;
+    url: string;
+}
+/**
+ * Error thrown when a URL is not allowed
+ */
+export declare class NetworkAccessDeniedError extends Error {
+    constructor(url: string);
+}
+/**
+ * Error thrown when too many redirects occur
+ */
+export declare class TooManyRedirectsError extends Error {
+    constructor(maxRedirects: number);
+}
+/**
+ * Error thrown when a redirect target is not allowed
+ */
+export declare class RedirectNotAllowedError extends Error {
+    constructor(url: string);
+}
+/**
+ * Error thrown when an HTTP method is not allowed
+ */
+export declare class MethodNotAllowedError extends Error {
+    constructor(method: string, allowedMethods: string[]);
+}
+/**
+ * Error thrown when a response body exceeds the maximum allowed size
+ */
+export declare class ResponseTooLargeError extends Error {
+    constructor(maxSize: number);
+}

package/dist/parser/arithmetic-parser.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Arithmetic Expression Parser
+ *
+ * Parses bash arithmetic expressions like:
+ * - $((1 + 2))
+ * - $((x++))
+ * - $((a ? b : c))
+ * - $((2#1010))
+ *
+ * All functions take a Parser instance as the first argument for shared state access.
+ */
+import type { ArithExpr, ArithmeticExpressionNode } from "../ast/types.js";
+import { parseArithNumber } from "./arithmetic-primaries.js";
+import type { Parser } from "./parser.js";
+export { parseArithNumber };
+/**
+ * Parse an arithmetic expression string into an AST node
+ */
+export declare function parseArithmeticExpression(_p: Parser, input: string): ArithmeticExpressionNode;
+export declare function parseArithExpr(p: Parser, input: string, pos: number): {
+    expr: ArithExpr;
+    pos: number;
+};

package/dist/parser/arithmetic-primaries.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Helper functions for parsing primary arithmetic expressions
+ */
+import type { ArithExpr } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+/**
+ * Skip whitespace in arithmetic expression input.
+ * Also handles line continuations (backslash followed by newline).
+ */
+export declare function skipArithWhitespace(input: string, pos: number): number;
+/**
+ * Assignment operators in arithmetic expressions
+ */
+export declare const ARITH_ASSIGN_OPS: readonly ["=", "+=", "-=", "*=", "/=", "%=", "<<=", ">>=", "&=", "|=", "^="];
+/**
+ * Parse a number string with various bases (decimal, hex, octal, base#num)
+ * Returns NaN for invalid numbers.
+ */
+export declare function parseArithNumber(str: string): number;
+/**
+ * Parse nested arithmetic expression: $((expr))
+ */
+export declare function parseNestedArithmetic(parseArithExpr: (p: Parser, input: string, pos: number) => {
+    expr: ArithExpr;
+    pos: number;
+}, p: Parser, input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;
+/**
+ * Parse ANSI-C quoting: $'...'
+ * Returns the numeric value of the string content
+ */
+export declare function parseAnsiCQuoting(input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;
+/**
+ * Parse localization quoting: $"..."
+ * Returns the numeric value of the string content
+ */
+export declare function parseLocalizationQuoting(input: string, currentPos: number): {
+    expr: ArithExpr;
+    pos: number;
+} | null;

package/dist/parser/command-parser.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Command Parser
+ *
+ * Handles parsing of simple commands, redirections, and assignments.
+ */
+import { type RedirectionNode, type SimpleCommandNode } from "../ast/types.js";
+import type { Parser } from "./parser.js";
+export declare function isRedirection(p: Parser): boolean;
+export declare function parseRedirection(p: Parser): RedirectionNode;
+export declare function parseSimpleCommand(p: Parser): SimpleCommandNode;