sh-ast 0.1.0 → 0.2.0

package/dist/parse-depth-guard.js

@@ -0,0 +1,633 @@
+import { ShParseMaxDepthError } from './errors.js';
+/**
+ * The maximum estimated structural nesting depth {@link assertParseDepthWithinLimit}
+ * accepts before refusing to hand `text` to the WASM parser at all. A single
+ * hard-coded, non-configurable safe default — see that function's doc comment
+ * for the empirical justification.
+ *
+ * Measured empirically (this repo's `vitest` environment, Node 24, the
+ * committed linux/amd64 `sh-ast.wasm` shim — which runs identically on
+ * darwin, since WASM bytecode is host-portable even though the *build* of
+ * that `.wasm` is not; see `shim/`'s rebuild-match CI job): feeding
+ * `parseSync` a flat top-level script consisting of `N` genuinely nested
+ * frames hits a raw, uncatchable-from-inside-the-shim
+ * `RangeError: Maximum call stack size exceeded` (thrown from `wasm-function`
+ * stack frames — i.e. inside mvdan/sh's own recursive-descent parser,
+ * running inside the WASM instance) at these depths, depending on which
+ * syntax construct supplies the nesting:
+ *
+ * | construct                                   | first crash observed at N = |
+ * | -------------------------------------------- | ---------------------------- |
+ * | `$(...)` command substitution (worst case)   | 252                          |
+ * | `${a:-${a:-...}}` nested parameter expansion | ~400–600                     |
+ * | `f(){ ... }` nested function definitions     | ~300–350                     |
+ * | `case`/`esac` nesting                        | ~350–400                     |
+ * | `while`/`done` nesting                       | ~450–800                     |
+ * | `$((...))` nested arithmetic expansion       | ~450–800                     |
+ * | `(...)` nested subshells                     | ~1,000–1,500                 |
+ * | `\|`/`&&`/`\|\|` chained pipeline/list stages | ~1,000                        |
+ * | `if`/`fi`, `for`/`done`, `{ }` block nesting  | ~1,000                        |
+ *
+ * `$(...)` command substitution is the tightest bound by a wide margin —
+ * each level costs the parser noticeably more native stack than a bare
+ * subshell paren — so the limit below is sized against *that* vector, not
+ * the more forgiving ones. The exact crash point is a hard native-stack
+ * limit, not a clean threshold, and it shrinks further the deeper the
+ * *caller's own* JS call stack already is when it invokes `parseSync`
+ * (measured: with as little as ~50–1,000 frames of unrelated pre-existing
+ * recursion already on the stack, the same 252-deep `$(...)` input that
+ * succeeds from a fresh top-level script instead crashes at a noticeably
+ * lower depth) — exactly the situation a real embedding (an ESLint rule, a
+ * CLI, a permission hook) is in, never a pristine empty stack.
+ *
+ * 150 leaves roughly 100 frames (⁓1.7x) of headroom below the *lowest*
+ * observed native-crash depth (252, `$(...)`) measured from a fresh stack,
+ * and was independently confirmed safe with as much as 3,000 frames of
+ * *additional*, unrelated caller-stack depth already consumed before the
+ * pathological input is scanned — comfortably past what any realistic
+ * caller stack looks like. It is not a round, "generous"-sounding number
+ * like 10,000 for the same reason `MAX_STRUCTURAL_DEPTH` (in
+ * `analyze/enumerate-commands.ts`) isn't: a limit that high would never
+ * actually fire before the real, uncatchable crash does. 150 also
+ * comfortably exceeds any realistic hand-written script's nesting — this
+ * is pathological-input protection, not a normal-usage ceiling (a
+ * deliberately deep-but-legitimate ~100-level script is still accepted;
+ * see `parse-depth-guard.test.ts`).
+ */
+const MAX_PARSE_NESTING_DEPTH = 150;
+const WHITESPACE = new Set([' ', '\t', '\n', '\r']);
+/**
+ * Characters that end a bare (unquoted) word during the word-boundary scan
+ * `estimateMaxNestingDepth` uses to recognize `if`/`for`/`while`/`until`/
+ * `case`/`select` (openers) and `fi`/`done`/`esac` (closers). Deliberately
+ * broader than strict shell tokenization needs to be — the goal is never to
+ * *merge* two words that should be separate (which could hide a keyword),
+ * not to perfectly reject non-keyword-boundary characters.
+ */
+const WORD_DELIMITERS = new Set([
+    ';',
+    '|',
+    '&',
+    '(',
+    ')',
+    '{',
+    '}',
+    '<',
+    '>',
+    '`',
+    '"',
+    "'",
+    '#',
+    '\\',
+    ' ',
+    '\t',
+    '\n',
+    '\r',
+]);
+/**
+ * Keywords that open a genuinely-nested structural region, other than
+ * `case` (see {@link CASE_OPENER_KEYWORD} — it needs a distinct
+ * {@link ScanContext} kind, not this generic one, to avoid a case arm's
+ * pattern-terminating `)` being misread as this region's own closing
+ * paren). Paired with {@link STRUCTURAL_CLOSER_KEYWORDS}.
+ */
+const STRUCTURAL_OPENER_KEYWORDS = new Set(['if', 'for', 'while', 'until', 'select']);
+/** Keywords that close a genuinely-nested structural region opened by {@link STRUCTURAL_OPENER_KEYWORDS}. */
+const STRUCTURAL_CLOSER_KEYWORDS = new Set(['fi', 'done']);
+/**
+ * `case` needs its own {@link ScanContext} kind (`'case'`), distinct from
+ * the generic `'other'` used for `(`/`{`/`if`/`for`/`while`/`until`/
+ * `select`: each `case` arm is terminated by a bare `)` —
+ * `case WORD in PATTERN)` — that is **not** a closing paren for anything.
+ * If `case` pushed a generic `'other'` region, the first arm's `)` would
+ * blind-pop-close that region immediately (see {@link estimateMaxNestingDepth}'s
+ * "never matches specific opener/closer pairs" design), silently
+ * *under-counting* the case body's real nesting contribution for every
+ * arm after the first — the one direction this estimator must never be
+ * wrong in. A `'case'` region instead ignores a bare `)` outright (a
+ * pattern terminator, not a real closer) and is only closed by the
+ * word-boundary `esac` keyword; a *real* nested paren opened inside an
+ * arm's action list (e.g. `case x in a) (subshell) ;; esac`) still pushes
+ * its own `'other'` region on top of `'case'` and is closed by its own
+ * `)` exactly as usual, since that `)` pops the (different) top-of-stack
+ * entry, never the `'case'` entry beneath it.
+ */
+const CASE_OPENER_KEYWORD = 'case';
+const CASE_CLOSER_KEYWORD = 'esac';
+function isWordChar(ch) {
+    return ch !== undefined && !WORD_DELIMITERS.has(ch);
+}
+/**
+ * Conservatively upper-bounds the structural nesting depth mvdan/sh's
+ * parser will recurse through for `text`, via a single left-to-right
+ * character scan — **without** actually parsing the shell grammar. This is
+ * a heuristic, not a real shell tokenizer: see the module doc comment for
+ * the false-positive risk this trades for correctness.
+ *
+ * Combines two running counters into one "effective depth" (`bracketDepth +
+ * chainLen`), checked against `limit` after every increment:
+ *
+ * - `bracketDepth`, incremented for each of: an unquoted `(` or `{` (covers
+ *   subshells, brace groups, function bodies, `$(...)` command/`$((...))`
+ *   arithmetic substitution, process substitution, and — doubly, which
+ *   only makes the estimate *more* conservative — each paren of
+ *   `$((...))`), an unquoted backtick command-substitution open, and a
+ *   word-boundary `if`/`for`/`while`/`until`/`case`/`select` keyword; and
+ *   decremented for the corresponding `)`, `}`, closing backtick, or
+ *   `fi`/`done`/`esac` keyword. **Never** matches specific opener/closer
+ *   *pairs* — any closer decrements whatever is currently open, and a
+ *   closer seen with nothing open is simply ignored (never lets the
+ *   counter go negative) — so a malformed/mismatched-bracket input can
+ *   only ever make this estimate *more* conservative (higher), never miss
+ *   real nesting.
+ * - `chainLen`, tracking how many `|`/`|&`/`&&`/`\|\|` pipeline/list-operator
+ *   tokens are chained in the *current* statement — mvdan/sh's parser
+ *   recurses per chain link the same way it does per bracket, so a long
+ *   flat `a|a|a|...` chain is just as much a real stack-depth risk as
+ *   nested subshells are (measured: ~1,000 stages — see
+ *   `MAX_PARSE_NESTING_DEPTH`'s doc comment), even though it is *not*
+ *   nested tree structure. Reset to `0` on a statement boundary (`;`, an
+ *   unescaped newline, or an unpaired `&`), and saved/restored (not
+ *   dropped) around a bracket/keyword region so a chain that continues
+ *   after a nested subshell (`a | (b) | c`) still accumulates its full
+ *   length rather than silently restarting. Correctly **not** counted: a
+ *   bare `|` while the innermost `case`'s current arm is still in
+ *   *pattern* position (`PATTERN1|PATTERN2|...)`) — that's glob-pattern
+ *   alternation, not a pipeline (see `casePatternStack`'s doc comment) —
+ *   while a `|` in that same arm's *action* list (after its terminating
+ *   `)`) is a real pipeline and is counted normally.
+ *
+ * Skips (does not count structure inside): single-quoted strings, `$'...'`
+ * ANSI-C-quoted strings, `#`-comments (only recognized at a word boundary,
+ * matching shell comment syntax), and backslash-escaped characters — none
+ * of these can contain an expansion mvdan/sh recurses into. Double-quoted
+ * strings are handled more carefully: their *literal* content (including
+ * multibyte characters — scanning is by JS string index, i.e. UTF-16 code
+ * unit, which never misaligns with a surrogate pair or any ASCII structural
+ * character) is skipped, but a `$(...)` command substitution or backtick
+ * expansion **nested inside** a double-quoted string is still a real,
+ * depth-bearing recursion in mvdan/sh's grammar and is still counted; once
+ * that nested region closes, scanning correctly resumes in "inside a
+ * double-quoted string" mode rather than losing track of the enclosing
+ * quote.
+ *
+ * Known, accepted false-positive sources (all documented here rather than
+ * papered over — see the module doc comment's "may over-estimate, must
+ * never under-estimate" rule):
+ * - A keyword word (`if`, `done`, …) used as a plain *argument*
+ *   (`echo if`) is indistinguishable from real command-position syntax by
+ *   this scanner and is still counted, since this scanner never tracks
+ *   grammatical position — only real parsing does that.
+ * - A bare `(`/`{` inside a double-quoted string is correctly *not*
+ *   counted (see above), but the same characters appearing entirely
+ *   outside of any quoting are always counted even in contexts a full
+ *   parser might not treat as nesting.
+ * - A pipeline/list chain that runs many *unrelated* statements in a row,
+ *   each separated by `;`/newline, correctly resets `chainLen` between
+ *   them — but a script with an unusually long *single* chain of harmless
+ *   `true | true | true | …` well past what any real script would ever
+ *   write is rejected exactly like a genuinely pathological one, since
+ *   this scanner cannot distinguish "long but benign" from "adversarial"
+ *   chain length any more than it can for bracket nesting.
+ *
+ * Heredoc bodies (`<<EOF` / `<<-EOF` / `<<'EOF'` through the matching
+ * delimiter line) are tracked, not merely skipped as ordinary text: a
+ * heredoc body is scanned line-by-line for its terminating delimiter, and
+ * — critically — a `$(...)` or backtick expansion appearing *inside* the
+ * body (still real recursion in mvdan/sh's grammar for an unquoted
+ * heredoc) is still counted, exactly as inside a double-quoted string.
+ * This is deliberate, not incidental: without heredoc-aware handling, a
+ * heredoc body containing plausible-looking closer text (stray `)`/`}`/
+ * `fi`/`done`/`esac` — completely inert as far as the real parser is
+ * concerned, since it's just heredoc body data) would blind-pop-close
+ * *real* open regions from **outside** the heredoc, silently
+ * *under-counting* genuine nesting split across a `<<EOF ... EOF` boundary
+ * — exactly the failure this estimator must never produce.
+ *
+ * Stops scanning and returns as soon as the running depth exceeds `limit`
+ * (returning `limit + 1`, not necessarily the "true" final maximum) — this
+ * keeps the guard itself cheap even against a very large adversarial input,
+ * since only "did it exceed the limit" is ever needed by
+ * {@link assertParseDepthWithinLimit}.
+ *
+ * Not exported beyond this module — {@link assertParseDepthWithinLimit} is
+ * the only caller; exercised indirectly, through `parseSync`, by
+ * `test/parse-depth-guard.test.ts`.
+ */
+function estimateMaxNestingDepth(text, limit) {
+    let bracketDepth = 0;
+    let chainLen = 0;
+    let maxDepth = 0;
+    const contextStack = [];
+    const chainLenStack = [];
+    const heredocInfoStack = [];
+    const pendingHeredocs = [];
+    const n = text.length;
+    let i = 0;
+    // Parallel to `contextStack`, but pushed/popped only in lockstep with a
+    // `'case'` entry specifically (not with every entry): `true` while
+    // scanning the *pattern* list of the innermost open `case`'s current arm
+    // (`PATTERN)` — where a bare `|` is alternation, not a pipeline — and
+    // `false` once that arm's terminating `)` has been seen (its *action*
+    // list, `LIST` in `PATTERN) LIST ;;`, where `|` is once again a real
+    // pipeline). Reset back to `true` at that arm's `;;`/`;&`/`;;&`
+    // terminator (see the `;` handler below) for the next arm's pattern.
+    const casePatternStack = [];
+    // Read cursor into `pendingHeredocs` (append-only — see
+    // `startNextHeredocIfAny`) instead of `Array.prototype.shift()`, which is
+    // O(k) per call (re-indexes the whole remaining array) and so made a
+    // script queuing many heredocs an accidental O(k²) cost overall — this
+    // guard must stay cheap even against a large adversarial input (see this
+    // function's doc comment) for *every* operation it performs, not just the
+    // early-exit-on-limit-exceeded one.
+    let pendingHeredocCursor = 0;
+    function noteDepth() {
+        const total = bracketDepth + chainLen;
+        if (total > maxDepth)
+            maxDepth = total;
+    }
+    function open() {
+        bracketDepth++;
+        noteDepth();
+    }
+    function close() {
+        if (bracketDepth > 0)
+            bracketDepth--;
+    }
+    function pushRegion(kind) {
+        contextStack.push(kind);
+        chainLenStack.push(chainLen);
+        chainLen = 0;
+    }
+    /**
+     * Pops `contextStack`'s top entry — and, in lockstep, restores `chainLen`
+     * from `chainLenStack` — **only if** it actually equals `kind`; otherwise
+     * does nothing at all and returns `false`. Every caller **must** gate its
+     * own `close()` (or any other closing side effect) on this return value:
+     * a closer token whose region doesn't actually match the top of the
+     * stack (a stray `}` with no open `{`, an `esac` with no open `case`, …)
+     * is inert text as far as the *real* parser is concerned, and must be
+     * exactly as inert here — closing anyway (the bug this comment guards
+     * against: see `ShParseMaxDepthError`'s regression tests for
+     * `'case x in a}) '.repeat(n) + ... `) lets a self-canceling stray-closer
+     * input decrement `bracketDepth` once per repetition while `contextStack`
+     * (the *real* nesting mvdan/sh's parser will recurse through) keeps
+     * growing unboundedly — silently hiding real, unbounded nesting from this
+     * estimator, which is the one direction it must never be wrong in.
+     */
+    function popRegion(kind) {
+        if (contextStack.length > 0 && contextStack[contextStack.length - 1] === kind) {
+            contextStack.pop();
+            chainLen = chainLenStack.pop() ?? 0;
+            return true;
+        }
+        return false;
+    }
+    function toggleBacktick() {
+        if (popRegion('backtick')) {
+            close();
+        }
+        else {
+            pushRegion('backtick');
+            open();
+        }
+    }
+    function resetChain() {
+        chainLen = 0;
+    }
+    function chainLink() {
+        chainLen++;
+        noteDepth();
+    }
+    /**
+     * `true` iff the innermost open region is `'case'` and its current arm is
+     * still in *pattern* position — see `casePatternStack`'s doc comment.
+     */
+    function inCasePatternPosition() {
+        if (contextStack.length === 0 ||
+            contextStack[contextStack.length - 1] !== 'case' ||
+            casePatternStack.length === 0) {
+            return false;
+        }
+        return casePatternStack[casePatternStack.length - 1];
+    }
+    function startNextHeredocIfAny() {
+        if (pendingHeredocCursor < pendingHeredocs.length) {
+            // `pendingHeredocCursor < pendingHeredocs.length` just checked above,
+            // so this is a real element.
+            const next = pendingHeredocs[pendingHeredocCursor];
+            pendingHeredocCursor++;
+            pushRegion('heredoc');
+            heredocInfoStack.push(next);
+        }
+    }
+    while (i < n) {
+        if (maxDepth > limit)
+            return maxDepth;
+        const topKind = contextStack.length > 0 ? contextStack[contextStack.length - 1] : undefined;
+        const ch = text[i];
+        if (topKind === 'heredoc') {
+            const atLineStart = i === 0 || text[i - 1] === '\n';
+            // `heredocInfoStack` is pushed/popped in lockstep with every
+            // `'heredoc'` entry in `contextStack` (see `startNextHeredocIfAny`
+            // and the delimiter-match branch below) — `topKind === 'heredoc'`
+            // here already guarantees a corresponding entry exists.
+            const info = heredocInfoStack[heredocInfoStack.length - 1];
+            if (atLineStart) {
+                let lineEnd = i;
+                while (lineEnd < n && text[lineEnd] !== '\n')
+                    lineEnd++;
+                const lineRaw = text.slice(i, lineEnd);
+                const compareLine = info.stripLeadingTabs ? lineRaw.replace(/^\t+/, '') : lineRaw;
+                if (compareLine === info.delimiter) {
+                    popRegion('heredoc');
+                    heredocInfoStack.pop();
+                    i = lineEnd < n ? lineEnd + 1 : lineEnd;
+                    startNextHeredocIfAny();
+                    continue;
+                }
+            }
+            // Heredoc body content, not the terminator line: `$(...)`/backtick
+            // are still real recursion (see the module doc comment); everything
+            // else — including a bare `(`/`{`/keyword-looking text and multibyte
+            // characters — is inert body data.
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === '$' && text[i + 1] === '(') {
+                pushRegion('other');
+                open();
+                i += 2;
+                continue;
+            }
+            if (ch === '`') {
+                toggleBacktick();
+                i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (topKind === 'dquote') {
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === '"') {
+                contextStack.pop();
+                i++;
+                continue;
+            }
+            if (ch === '$' && text[i + 1] === '(') {
+                pushRegion('other');
+                open();
+                i += 2;
+                continue;
+            }
+            if (ch === '`') {
+                toggleBacktick();
+                i++;
+                continue;
+            }
+            // Literal double-quoted content — including multibyte characters —
+            // never affects depth.
+            i++;
+            continue;
+        }
+        // "code" scanning mode (top-level, or inside an already-open paren/
+        // brace/keyword/backtick region — all of those contain ordinary shell
+        // code, so they share this same scanning mode).
+        if (ch === '\\') {
+            i += 2;
+            continue;
+        }
+        if (ch === '#') {
+            const prev = i > 0 ? text[i - 1] : undefined;
+            if (prev === undefined || WHITESPACE.has(prev) || WORD_DELIMITERS.has(prev)) {
+                while (i < n && text[i] !== '\n')
+                    i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (ch === "'") {
+            i++;
+            while (i < n && text[i] !== "'")
+                i++;
+            if (i < n)
+                i++;
+            continue;
+        }
+        if (ch === '$' && text[i + 1] === "'") {
+            i += 2;
+            while (i < n && text[i] !== "'") {
+                if (text[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                i++;
+            }
+            if (i < n)
+                i++;
+            continue;
+        }
+        if (ch === '"') {
+            contextStack.push('dquote');
+            i++;
+            continue;
+        }
+        if (ch === '`') {
+            toggleBacktick();
+            i++;
+            continue;
+        }
+        if (ch === '(' || ch === '{') {
+            pushRegion('other');
+            open();
+            i++;
+            continue;
+        }
+        if (ch === ')') {
+            // A bare `)` directly inside a `case` region (no intervening real
+            // opener) is that arm's pattern terminator, not a closing paren —
+            // see CASE_OPENER_KEYWORD's doc comment. Leave the region open, but
+            // this arm's pattern list has ended: everything until the next
+            // `;;`/`;&`/`;;&` is now its *action* list (see `casePatternStack`'s
+            // doc comment) — a bare `|` there is a real pipeline again.
+            if (contextStack.length > 0 && contextStack[contextStack.length - 1] === 'case') {
+                if (casePatternStack.length > 0) {
+                    casePatternStack[casePatternStack.length - 1] = false;
+                }
+                i++;
+                continue;
+            }
+            if (popRegion('other'))
+                close();
+            i++;
+            continue;
+        }
+        if (ch === '}') {
+            if (popRegion('other'))
+                close();
+            i++;
+            continue;
+        }
+        if (ch === '<' && text[i + 1] === '<' && text[i + 2] !== '<') {
+            // A `<<`/`<<-` heredoc redirect — queue its delimiter; the body
+            // itself starts at the *next* newline (there may be more of this
+            // line — another redirect, another heredoc, the rest of the command
+            // — still to scan first).
+            let j = i + 2;
+            let stripLeadingTabs = false;
+            if (text[j] === '-') {
+                stripLeadingTabs = true;
+                j++;
+            }
+            while (j < n && (text[j] === ' ' || text[j] === '\t'))
+                j++;
+            let delimiter = '';
+            if (text[j] === "'" || text[j] === '"') {
+                const quote = text[j];
+                j++;
+                while (j < n && text[j] !== quote) {
+                    delimiter += text[j];
+                    j++;
+                }
+                if (j < n)
+                    j++;
+            }
+            else {
+                while (j < n && isWordChar(text[j])) {
+                    if (text[j] === '\\') {
+                        j++;
+                        if (j < n) {
+                            delimiter += text[j];
+                            j++;
+                        }
+                        continue;
+                    }
+                    delimiter += text[j];
+                    j++;
+                }
+            }
+            pendingHeredocs.push({ delimiter, stripLeadingTabs });
+            i = j;
+            continue;
+        }
+        if (ch === ';') {
+            // `;;`/`;;&` (both start with two semicolons) or `;&` end the
+            // *current* case arm and return to *pattern* position for the next
+            // one — see `casePatternStack`'s doc comment. A single `;` mid-arm
+            // (an ordinary statement separator within one arm's action list)
+            // does not; only the first `;` of one of these two-character
+            // sequences flips the flag, matched by lookahead without consuming
+            // extra characters (the loop still advances one `;` at a time below,
+            // which is harmless — `resetChain()`/this flag flip are each
+            // idempotent).
+            if (contextStack.length > 0 &&
+                contextStack[contextStack.length - 1] === 'case' &&
+                casePatternStack.length > 0 &&
+                !casePatternStack[casePatternStack.length - 1] &&
+                (text[i + 1] === ';' || text[i + 1] === '&')) {
+                casePatternStack[casePatternStack.length - 1] = true;
+            }
+            resetChain();
+            i++;
+            continue;
+        }
+        if (ch === '\n') {
+            resetChain();
+            i++;
+            startNextHeredocIfAny();
+            continue;
+        }
+        if (ch === '&' && text[i + 1] === '&') {
+            if (!inCasePatternPosition())
+                chainLink();
+            i += 2;
+            continue;
+        }
+        if (ch === '|' && text[i + 1] === '|') {
+            if (!inCasePatternPosition())
+                chainLink();
+            i += 2;
+            continue;
+        }
+        if (ch === '|' && text[i + 1] === '&') {
+            if (!inCasePatternPosition())
+                chainLink();
+            i += 2;
+            continue;
+        }
+        if (ch === '|') {
+            // A bare `|` while the innermost `case`'s current arm is still in
+            // *pattern* position (`PATTERN1|PATTERN2|...)`) is glob-pattern
+            // alternation, not a pipeline — mvdan/sh's parser doesn't recurse per
+            // alternative the way it does per pipeline stage, so counting it as
+            // a chain link would falsely reject e.g. a 200-alternative case arm
+            // that real bash parses trivially. Once this arm's action list
+            // begins (after its terminating `)`), `|` is a real pipeline again —
+            // see `casePatternStack`'s and the `)` handler's doc comments.
+            if (!inCasePatternPosition())
+                chainLink();
+            i++;
+            continue;
+        }
+        if (ch === '&') {
+            // An unpaired `&` (background-job separator) ends the current
+            // pipeline/list the same way `;` does.
+            resetChain();
+            i++;
+            continue;
+        }
+        if (isWordChar(ch)) {
+            let j = i + 1;
+            while (j < n && isWordChar(text[j]))
+                j++;
+            const word = text.slice(i, j);
+            if (STRUCTURAL_OPENER_KEYWORDS.has(word)) {
+                pushRegion('other');
+                open();
+            }
+            else if (STRUCTURAL_CLOSER_KEYWORDS.has(word)) {
+                if (popRegion('other'))
+                    close();
+            }
+            else if (word === CASE_OPENER_KEYWORD) {
+                pushRegion('case');
+                casePatternStack.push(true);
+                open();
+            }
+            else if (word === CASE_CLOSER_KEYWORD) {
+                if (popRegion('case')) {
+                    close();
+                    casePatternStack.pop();
+                }
+            }
+            i = j;
+            continue;
+        }
+        // Whitespace or another shell metacharacter with no structural meaning
+        // for this scanner's purposes (`<`, `>`).
+        i++;
+    }
+    return maxDepth;
+}
+/**
+ * Throws {@link ShParseMaxDepthError} if `text`'s conservatively-estimated
+ * structural nesting depth (see {@link estimateMaxNestingDepth}) exceeds
+ * {@link MAX_PARSE_NESTING_DEPTH} — called by {@link parseSync} *before* it
+ * ever hands `text` to the WASM shim, so pathological input never reaches
+ * (and never risks crashing) the shared WASM instance in the first place.
+ *
+ * @internal
+ */
+export function assertParseDepthWithinLimit(text) {
+    const estimated = estimateMaxNestingDepth(text, MAX_PARSE_NESTING_DEPTH);
+    if (estimated > MAX_PARSE_NESTING_DEPTH) {
+        throw new ShParseMaxDepthError(MAX_PARSE_NESTING_DEPTH, estimated);
+    }
+}
+//# sourceMappingURL=parse-depth-guard.js.map

package/dist/parse-depth-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-depth-guard.js","sourceRoot":"","sources":["../src/parse-depth-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,GAAG;IACH,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtF,6GAA6G;AAC7G,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,SAAS,UAAU,CAAC,EAAsB;IACxC,OAAO,EAAE,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgGG;AACH,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAqB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,qEAAqE;IACrE,MAAM,gBAAgB,GAAc,EAAE,CAAC;IACvC,wDAAwD;IACxD,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,SAAS,SAAS;QAChB,MAAM,KAAK,GAAG,YAAY,GAAG,QAAQ,CAAC;QACtC,IAAI,KAAK,GAAG,QAAQ;YAAE,QAAQ,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,SAAS,IAAI;QACX,YAAY,EAAE,CAAC;QACf,SAAS,EAAE,CAAC;IACd,CAAC;IACD,SAAS,KAAK;QACZ,IAAI,YAAY,GAAG,CAAC;YAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IACD,SAAS,UAAU,CAAC,IAAiB;QACnC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IACD;;;;;;;;;;;;;;;OAeG;IACH,SAAS,SAAS,CAAC,IAAiB;QAClC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9E,YAAY,CAAC,GAAG,EAAE,CAAC;YACnB,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,cAAc;QACrB,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,UAAU,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC;IACD,SAAS,UAAU;QACjB,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IACD,SAAS,SAAS;QAChB,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;IACd,CAAC;IACD;;;OAGG;IACH,SAAS,qBAAqB;QAC5B,IACE,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM;YAChD,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,SAAS,qBAAqB;QAC5B,IAAI,oBAAoB,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC;YAClD,sEAAsE;YACtE,6BAA6B;YAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,oBAAoB,CAAC,CAAC;YACnD,oBAAoB,EAAE,CAAC;YACvB,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,QAAQ,GAAG,KAAK;YAAE,OAAO,QAAQ,CAAC;QAEtC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;YACpD,6DAA6D;YAC7D,mEAAmE;YACnE,kEAAkE;YAClE,wDAAwD;YACxD,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,OAAO,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,CAAC;gBACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACvC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAClF,IAAI,WAAW,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnC,SAAS,CAAC,SAAS,CAAC,CAAC;oBACrB,gBAAgB,CAAC,GAAG,EAAE,CAAC;oBACvB,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBACxC,qBAAqB,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,mCAAmC;YACnC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpB,IAAI,EAAE,CAAC;gBACP,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpB,IAAI,EAAE,CAAC;gBACP,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,mEAAmE;YACnE,uBAAuB;YACvB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,cAAc,EAAE,CAAC;YACjB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC;YACP,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,+DAA+D;YAC/D,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;gBACxD,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,KAAK,EAAE,CAAC;YAChC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,KAAK,EAAE,CAAC;YAChC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,gEAAgE;YAChE,iEAAiE;YACjE,oEAAoE;YACpE,0BAA0B;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACpB,gBAAgB,GAAG,IAAI,CAAC;gBACxB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC,EAAE,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBAClC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC;oBAAE,CAAC,EAAE,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBACrB,CAAC,EAAE,CAAC;wBACJ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BACV,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;4BACrB,CAAC,EAAE,CAAC;wBACN,CAAC;wBACD,SAAS;oBACX,CAAC;oBACD,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,CAAC,EAAE,CAAC;gBACN,CAAC;YACH,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,8DAA8D;YAC9D,mEAAmE;YACnE,mEAAmE;YACnE,iEAAiE;YACjE,6DAA6D;YAC7D,mEAAmE;YACnE,qEAAqE;YACrE,6DAA6D;YAC7D,eAAe;YACf,IACE,YAAY,CAAC,MAAM,GAAG,CAAC;gBACvB,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM;gBAChD,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9C,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAC5C,CAAC;gBACD,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACvD,CAAC;YACD,UAAU,EAAE,CAAC;YACb,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,UAAU,EAAE,CAAC;YACb,CAAC,EAAE,CAAC;YACJ,qBAAqB,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,EAAE;gBAAE,SAAS,EAAE,CAAC;YAC1C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,EAAE;gBAAE,SAAS,EAAE,CAAC;YAC1C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,qBAAqB,EAAE;gBAAE,SAAS,EAAE,CAAC;YAC1C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,kEAAkE;YAClE,gEAAgE;YAChE,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,+DAA+D;YAC/D,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,EAAE;gBAAE,SAAS,EAAE,CAAC;YAC1C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,8DAA8D;YAC9D,uCAAuC;YACvC,UAAU,EAAE,CAAC;YACb,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpB,IAAI,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,SAAS,CAAC,OAAO,CAAC;oBAAE,KAAK,EAAE,CAAC;YAClC,CAAC;iBAAM,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACxC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,KAAK,EAAE,CAAC;oBACR,gBAAgB,CAAC,GAAG,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QAED,uEAAuE;QACvE,0CAA0C;QAC1C,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACzE,IAAI,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/parse.d.ts

@@ -34,9 +34,14 @@ export declare function isResultEnvelope(value: unknown): value is ResultEnvelop
  * position appears only inside `.message`, which is mvdan/sh's own
  * formatted string, verbatim. Throws {@link ShInvalidDialectError} when
  * {@link ParseOptions.dialect} is not a supported dialect. Throws
- * {@link ShBridgeInternalError} for failures that should never happen given
+ * {@link ShInternalError} for failures that should never happen given
  * a correctly-behaving shim (malformed envelope, unexpected root node
- * type, shim contract violations).
+ * type, shim contract violations). Throws {@link ShParseMaxDepthError} if
+ * `text`'s conservatively estimated structural nesting depth exceeds the
+ * limit this bridge accepts — checked, and thrown, *before* `text` is ever
+ * handed to the WASM shim, since mvdan/sh's own parser has no recovery path
+ * for exhausting its stack on pathological nesting (see that error's doc
+ * comment and `parse-depth-guard.ts`).
  *
  * @public
  */