//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/encoding.d.ts
/**
 * Byte/text boundary types for the shell pipeline.
 *
 * Shell pipes carry bytes, not text. Internally we represent a byte buffer as
 * a JS string where `s.charCodeAt(i)` is the i-th byte (0–255), the same
 * convention as `Buffer.from(s, "latin1")`. That's a space-cheap byte buffer,
 * but the type system can't tell it apart from a real `string`, and command
 * authors keep writing `ctx.stdin.split(...)` / `RegExp.test(ctx.stdin)` /
 * `JSON.parse(ctx.stdin)` over data that is actually UTF-8 packed in latin1.
 * The result is silent mojibake — every multibyte codepoint gets misread as
 * several latin1 chars, then re-encoded as UTF-8 on the way out.
 *
 * `ByteString` is opaque (deliberately not assignable to/from `string`) so
 * you cannot accidentally call string methods on it. The only ways out are
 * `latin1FromBytes` (passthrough — stay byte-clean) and `decodeBytesToUtf8`
 * (decode — process as text). Pick one explicitly per call site.
 */
declare const __byteString: unique symbol;
interface ByteString {
  readonly [__byteString]: true;
}
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/limits.d.ts
/**
 * Execution Limits Configuration
 *
 * Centralized configuration for all execution limits to prevent runaway compute.
 * These limits can be overridden when creating a BashEnv instance.
 */
/**
 * Configuration for execution limits.
 * All limits are optional - undefined values use defaults.
 */
interface ExecutionLimits {
  /** Maximum shell source bytes accepted before parsing (normal default: 64 MiB) */
  maxSourceBytes?: number;
  /** Maximum nested interpreter executions through ctx.exec (default: 64) */
  maxExecDepth?: number;
  /** Maximum function call/recursion depth (normal default: 100) */
  maxCallDepth?: number;
  /** Maximum number of commands to execute (normal default: 100000) */
  maxCommandCount?: number;
  /** Maximum loop iterations for bash while/for/until loops (normal default: 100000) */
  maxLoopIterations?: number;
  /** Maximum loop iterations for AWK while/for loops (normal default: 100000) */
  maxAwkIterations?: number;
  /** Maximum command iterations for SED branch loops (normal default: 100000) */
  maxSedIterations?: number;
  /** Maximum iterations for jq loops (normal default: 100000) */
  maxJqIterations?: number;
  /** Maximum jq/yq parser tokens (default: 100000) */
  maxQueryTokens?: number;
  /** Maximum jq/yq object/query traversal depth (default: 1000) */
  maxQueryDepth?: number;
  /** Maximum jq/yq result elements (default: 1000000) */
  maxQueryElements?: number;
  /** Maximum AWK parser tokens (default: 100000) */
  maxAwkParserTokens?: number;
  /** Maximum AWK parser nesting depth (default: 256) */
  maxAwkParserDepth?: number;
  /** Maximum AWK parser operations (default: 1000000) */
  maxAwkParserOperations?: number;
  /** Maximum parsed CSV rows (default: 1000000) */
  maxCsvRows?: number;
  /** Maximum parsed CSV cells (default: 10000000) */
  maxCsvCells?: number;
  /** Aggregate execution work units shared across nested execution (default: 1000000) */
  maxWorkUnits?: number;
  /** Maximum filesystem entries visited by one traversal (default: 1000000) */
  maxTraversalEntries?: number;
  /** Maximum filesystem traversal nesting depth (default: 1000) */
  maxTraversalDepth?: number;
  /** Maximum filesystem traversal operations (default: 1000000) */
  maxTraversalWork?: number;
  /** Maximum reserved live/intermediate bytes (default: 512 MiB) */
  maxLiveBytes?: number;
  /** Maximum aggregate input bytes (default: 512 MiB) */
  maxInputBytes?: number;
  /** Maximum bytes retained by Bash's default in-memory filesystem (default: 1 GiB) */
  maxFileSystemBytes?: number;
  /** Maximum SQLite database image bytes (default: 1 GiB) */
  maxDatabaseBytes?: number;
  /** Maximum SQLite result bytes before output formatting (default: 256 MiB) */
  maxDatabaseResultBytes?: number;
  /** Maximum aggregate expanded archive bytes (default: 1 GiB) */
  maxArchiveBytes?: number;
  /** Maximum compressed archive input bytes (default: 512 MiB) */
  maxArchiveCompressedBytes?: number;
  /** Maximum bytes in one archive entry (default: 512 MiB) */
  maxArchiveEntryBytes?: number;
  /** Maximum archive entries (default: 1000000) */
  maxArchiveEntries?: number;
  /** Maximum worker request or response payload bytes (default: 64 MiB) */
  maxWorkerMessageBytes?: number;
  /** Maximum top-level execution wall time in milliseconds (default: 1 hour) */
  maxExecutionTimeMs?: number;
  /**
   * Maximum time to let an aborted command acknowledge cancellation before its
   * execution context is revoked (normal default: 100ms).
   */
  maxExtensionCleanupTimeMs?: number;
  /** Maximum sqlite3 query execution time in milliseconds (normal default: 30000) */
  maxSqliteTimeoutMs?: number;
  /** Maximum Python execution time in milliseconds (normal default: 30000) */
  maxPythonTimeoutMs?: number;
  /** Maximum JavaScript execution time in milliseconds (normal default: 30000) */
  maxJsTimeoutMs?: number;
  /** Maximum glob filesystem operations (normal default: 1000000) */
  maxGlobOperations?: number;
  /** Maximum string length in bytes (normal default: 64 MiB) */
  maxStringLength?: number;
  /** Maximum array elements (normal default: 1000000) */
  maxArrayElements?: number;
  /** Maximum heredoc size in bytes (normal default: 64 MiB) */
  maxHeredocSize?: number;
  /** Maximum command substitution nesting depth (default: 50) */
  maxSubstitutionDepth?: number;
  /** Maximum brace expansion results (normal default: 100000) */
  maxBraceExpansionResults?: number;
  /** Maximum total output size in bytes (normal default: 256 MiB) */
  maxOutputSize?: number;
  /** Maximum number of open file descriptors (normal default: 4096) */
  maxFileDescriptors?: number;
  /** Maximum source/. nesting depth (default: 100) */
  maxSourceDepth?: number;
}
/** Named limit presets. `normal` favors compatibility; `hardened` is opt-in. */
type ExecutionLimitProfile = "normal" | "hardened";
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/execution-scope.d.ts
interface ResourceLease {
  release(): void;
}
/**
 * Accounting capability exposed to commands. Administrative lifecycle and
 * result-accounting operations intentionally remain on ExecutionScope only.
 */
interface CommandExecutionBudget {
  readonly remainingLiveBytes: number;
  consumeWork(units?: number, site?: string): number;
  consumeLimited(kind: string, count: number, maximum: number, site?: string): number;
  consumeInput(bytes: number, site?: string): number;
  reserveBytes(bytes: number, site?: string): ResourceLease;
  reserveBytes(kind: string, bytes: number, site?: string): ResourceLease;
  enterDepth(kind: string, site?: string): ResourceLease;
  enterDepth(kind: string, maximum: number, site?: string): ResourceLease;
  throwIfAborted(site?: string): void;
  remainingTimeMs(): number;
  registerCleanup(cleanup: Cleanup): () => void;
}
type Cleanup = () => void | Promise<void>;
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/fs/interface.d.ts
/**
 * Supported buffer encodings
 */
type BufferEncoding = "utf8" | "utf-8" | "ascii" | "binary" | "base64" | "hex" | "latin1";
/**
 * File content can be string or Buffer
 */
type FileContent = string | Uint8Array;
/**
 * Options for reading files
 */
interface ReadFileOptions {
  encoding?: BufferEncoding | null;
}
/**
 * Options for writing files
 */
interface WriteFileOptions {
  encoding?: BufferEncoding;
}
/**
 * Directory entry with type information (similar to Node's Dirent)
 * Used by readdirWithFileTypes for efficient directory listing without stat calls
 */
interface DirentEntry {
  name: string;
  isFile: boolean;
  isDirectory: boolean;
  isSymbolicLink: boolean;
}
/**
 * Stat result from the filesystem
 */
interface FsStat {
  isFile: boolean;
  isDirectory: boolean;
  isSymbolicLink: boolean;
  mode: number;
  size: number;
  mtime: Date;
  /** Stable filesystem identity when the backend can expose it safely. */
  dev?: number | bigint;
  ino?: number | bigint;
  identity?: string;
}
/**
 * Options for mkdir operation
 */
interface MkdirOptions {
  recursive?: boolean;
}
/**
 * Options for rm operation
 */
interface RmOptions {
  recursive?: boolean;
  force?: boolean;
}
/**
 * Options for cp operation
 */
interface CpOptions {
  recursive?: boolean;
}
/**
 * Abstract filesystem interface that can be implemented by different backends.
 * This allows BashEnv to work with:
 * - InMemoryFs (in-memory, default)
 * - Real filesystem (via node:fs)
 * - Custom implementations (e.g., remote storage, browser IndexedDB)
 */
interface IFileSystem {
  /**
   * Read the contents of a file as decoded text. Default encoding is utf8;
   * pass an explicit text encoding (`"ascii"`, etc.) to override.
   *
   * For raw bytes (encoding `"binary"` / `"latin1"`), use {@link readFileBytes}
   * — the opaque return type forces callers to decide whether to forward
   * bytes unchanged or decode as text.
   *
   * @throws Error if file doesn't exist or is a directory
   */
  readFile(path: string, options?: ReadFileOptions | BufferEncoding): Promise<string>;
  /**
   * Read the raw bytes of a file as a {@link ByteString} (latin1-shaped: each
   * char = one byte). Use when the bytes will be piped onward unchanged or
   * explicitly decoded with `decodeBytesToUtf8` — never call string methods
   * on the result, that's the bug class this type prevents.
   *
   * Optional for backwards compatibility with external `IFileSystem`
   * implementations written before this method existed; built-in
   * filesystems all implement it. Internal callers must route through the
   * `readBytesFrom(fs, path)` helper, which falls back to `readFileBuffer`
   * when this method is missing.
   *
   * @throws Error if file doesn't exist or is a directory
   */
  readFileBytes?(path: string): Promise<ByteString>;
  /**
   * Read the contents of a file as a Uint8Array (binary)
   * @throws Error if file doesn't exist or is a directory
   */
  readFileBuffer(path: string): Promise<Uint8Array>;
  /**
   * Write content to a file, creating it if it doesn't exist
   */
  writeFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
  /**
   * Append content to a file, creating it if it doesn't exist
   */
  appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
  /**
   * Check if a path exists
   */
  exists(path: string): Promise<boolean>;
  /**
   * Get file/directory information
   * @throws Error if path doesn't exist
   */
  stat(path: string): Promise<FsStat>;
  /**
   * Create a directory
   * @throws Error if parent doesn't exist (unless recursive) or path exists
   */
  mkdir(path: string, options?: MkdirOptions): Promise<void>;
  /**
   * Read directory contents
   * @returns Array of entry names (not full paths)
   * @throws Error if path doesn't exist or is not a directory
   */
  readdir(path: string): Promise<string[]>;
  /**
   * Read directory contents with file type information (optional)
   * This is more efficient than readdir + stat for each entry
   * @returns Array of DirentEntry objects with name and type
   * @throws Error if path doesn't exist or is not a directory
   */
  readdirWithFileTypes?(path: string): Promise<DirentEntry[]>;
  /**
   * Remove a file or directory
   * @throws Error if path doesn't exist (unless force) or directory not empty (unless recursive)
   */
  rm(path: string, options?: RmOptions): Promise<void>;
  /**
   * Copy a file or directory
   * @throws Error if source doesn't exist or trying to copy directory without recursive
   */
  cp(src: string, dest: string, options?: CpOptions): Promise<void>;
  /**
   * Move/rename a file or directory
   */
  mv(src: string, dest: string): Promise<void>;
  /**
   * Resolve a relative path against a base path
   */
  resolvePath(base: string, path: string): string;
  /**
   * Get all paths in the filesystem (useful for glob matching)
   * Optional - implementations may return empty array if not supported
   */
  getAllPaths(): string[];
  /**
   * Change file/directory permissions
   * @throws Error if path doesn't exist
   */
  chmod(path: string, mode: number): Promise<void>;
  /**
   * Create a symbolic link
   * @param target - The path the symlink should point to
   * @param linkPath - The path where the symlink will be created
   * @throws Error if linkPath already exists
   */
  symlink(target: string, linkPath: string): Promise<void>;
  /**
   * Create a hard link
   * @param existingPath - The existing file to link to
   * @param newPath - The path where the new link will be created
   * @throws Error if existingPath doesn't exist or newPath already exists
   */
  link(existingPath: string, newPath: string): Promise<void>;
  /**
   * Read the target of a symbolic link
   * @throws Error if path doesn't exist or is not a symlink
   */
  readlink(path: string): Promise<string>;
  /**
   * Get file/directory information without following symlinks
   * @throws Error if path doesn't exist
   */
  lstat(path: string): Promise<FsStat>;
  /**
   * Resolve all symlinks in a path to get the canonical physical path.
   * This is equivalent to POSIX realpath() - it resolves all symlinks
   * in the path and returns the absolute physical path.
   * Used by pwd -P and cd -P for symlink resolution.
   * @throws Error if path doesn't exist or contains a broken symlink
   */
  realpath(path: string): Promise<string>;
  /**
   * Set access and modification times of a file
   * @param path - The file path
   * @param atime - Access time (currently ignored, kept for API compatibility)
   * @param mtime - Modification time
   * @throws Error if path doesn't exist
   */
  utimes(path: string, atime: Date, mtime: Date): Promise<void>;
}
/**
 * Extended file initialization options with optional metadata
 */
interface FileInit {
  content: FileContent;
  mode?: number;
  mtime?: Date;
}
/**
 * Lazy file provider - a function whose return value becomes the file content on first read
 */
type LazyFileProvider = () => string | Uint8Array | Promise<string | Uint8Array>;
/**
 * Initial files can be simple content, extended options with metadata, or lazy providers
 */
type InitialFiles = Record<string, FileContent | FileInit | LazyFileProvider>;
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/network/dns-pin.d.ts
// Browser-facing portion of just-bash's DNS pinning contract. The upstream
// declaration also exports internal Node test helpers that import all of Undici,
// including its node:buffer augmentation and Node type reference.
interface PinnedAddress {
  hostname: string;
  address: string;
  family: 4 | 6;
}
interface PinnedConnectionOwner {
  fetch: (url: string, init: RequestInit) => Promise<Response>;
  close: () => Promise<void>;
}
type PinnedConnectionOwnerFactory = (pinned: PinnedAddress) => Promise<PinnedConnectionOwner>;
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/network/types.d.ts
/**
 * DNS lookup result used for private IP resolution checks
 */
interface DnsLookupResult {
  address: string;
  family: number;
}
/**
 * HTTP methods that can be allowed
 */
type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
/**
 * Header transform applied at the fetch boundary.
 * Headers specified here override any user-supplied headers with the same name.
 */
interface RequestTransform {
  headers: Record<string, string>;
}
/**
 * An allowed URL entry with optional header transforms.
 * Transforms are applied at the fetch boundary so secrets never enter the sandbox.
 */
interface AllowedUrl {
  url: string;
  transform?: RequestTransform[];
}
/**
 * An entry in the allowedUrlPrefixes list: either a plain URL string or
 * an object with a URL and optional transforms.
 */
type AllowedUrlEntry = string | AllowedUrl;
/**
 * Configuration for network access
 */
interface NetworkConfig {
  /**
   * List of allowed URL prefixes. Each entry must be a full origin (scheme + host),
   * optionally followed by a path prefix:
   * - An origin: "https://api.example.com" - allows all paths on this origin
   * - An origin + path prefix: "https://api.example.com/v1/" - allows only paths starting with /v1/
   *
   * Entries can be plain strings or objects with transforms for credentials brokering:
   * ```
   * allowedUrlPrefixes: [
   *   "https://other-api.com",
   *   {
   *     url: "https://ai-gateway.vercel.sh",
   *     transform: [{ headers: { "Authorization": "Bearer secret" } }],
   *   },
   * ]
   * ```
   *
   * The check is performed on the full URL, so "https://api.example.com/v1" will allow:
   * - https://api.example.com/v1
   * - https://api.example.com/v1/users
   * - https://api.example.com/v1/users/123
   *
   * But NOT:
   * - https://api.example.com/v10
   * - https://api.example.com/v1-admin
   * - https://api.example.com/v2/users
   * - https://api.example.org/v1/users (different origin)
   * - URLs that rely on ambiguous separators or path parameters like %2f,
   *   %5c, semicolons, or nested encodings
   *
   * Invalid entries (missing scheme, missing host, relative paths) will throw an error.
   */
  allowedUrlPrefixes?: AllowedUrlEntry[];
  /**
   * List of allowed HTTP methods. Defaults to ["GET", "HEAD"] for safety.
   * dangerouslyAllowFullInternetAccess to enables all methods.
   */
  allowedMethods?: HttpMethod[];
  /**
   * Bypass the allow-list and allow all URLs and methods.
   * DANGEROUS: Only use this in trusted environments.
   */
  dangerouslyAllowFullInternetAccess?: boolean;
  /**
   * Maximum number of redirects to follow (default: 20)
   */
  maxRedirects?: number;
  /**
   * Request timeout in milliseconds (default: 30000)
   */
  timeoutMs?: number;
  /**
   * Maximum response body size in bytes (default: 10MB).
   * Responses larger than this will be rejected with ResponseTooLargeError.
   */
  maxResponseSize?: number;
  /**
   * Reject URLs with private/loopback IP addresses as hostnames.
   * Performs both lexical hostname checks and DNS resolution to catch
   * domains that resolve to private IPs (e.g., DNS rebinding attacks).
   * Domain requests fail closed on resolution errors, empty or malformed
   * answers, and runtimes that cannot pin the reviewed address to the actual
   * connection. Each redirect hop is resolved and pinned independently.
   * Useful for mitigating SSRF attacks. Default: false (opt-in).
   *
   * When enabled, the private IP check is enforced even when
   * `dangerouslyAllowFullInternetAccess` is true, ensuring that
   * internal/loopback addresses are never reachable.
   */
  denyPrivateRanges?: boolean;
  /**
   * @internal Override DNS resolution for testing.
   * When set, used instead of the default `dns.lookup` for the
   * denyPrivateRanges DNS rebinding check.
   */
  _dnsResolve?: (hostname: string) => Promise<DnsLookupResult[]>;
  /**
   * @internal Override request-owned connection binding for testing.
   */
  _createConnectionOwner?: PinnedConnectionOwnerFactory;
}
/**
 * Result of a network fetch operation
 */
interface FetchResult {
  status: number;
  statusText: string;
  headers: Record<string, string>;
  /** Raw response bytes (never decoded as UTF-8 text). */
  body: Uint8Array;
  url: string;
}
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/network/fetch.d.ts
interface SecureFetchOptions {
  method?: string;
  headers?: Headers | Record<string, string>;
  body?: string;
  followRedirects?: boolean;
  /** Override timeout for this request (capped at global timeout) */
  timeoutMs?: number;
  /** Override redirects for this request (capped at the host policy). */
  maxRedirects?: number;
  /** Abort DNS review, redirects, transport, and response-body consumption. */
  signal?: AbortSignal;
}
/**
 * Type for the secure fetch function
 */
type SecureFetch = (url: string, options?: SecureFetchOptions) => Promise<FetchResult>;
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/types.d.ts
/**
 * Lightweight interface for feature coverage tracking during fuzzing.
 * Lives here to avoid circular dependencies between fuzzing → core modules.
 */
interface FeatureCoverageWriter {
  hit(feature: string): void;
}
interface ExecResult {
  stdout: string;
  stderr: string;
  exitCode: number;
  /** The final environment variables after execution (only set by BashEnv.exec) */
  env?: Record<string, string>;
  /**
   * Explicit metadata for what shape `stdout` is in. The pipeline + redirect
   * layers consult this instead of guessing from string contents:
   *
   *   - `"text"`: `stdout` is JS Unicode text. The pipeline UTF-8 encodes it
   *     before handing it to the next command's stdin; redirects write it
   *     as UTF-8.
   *   - `"bytes"`: `stdout` is a latin1-shaped byte buffer (each char = one
   *     byte). The pipeline forwards the bytes verbatim; redirects write
   *     them as binary.
   *
   * Producers should set this via `textOutput()` / `bytesOutput()` from
   * `encoding.ts` rather than poking the raw flag. Absent values fall back
   * to the legacy `stdoutEncoding` heuristic for back-compat with older
   * commands that haven't been migrated yet.
   */
  stdoutKind?: "text" | "bytes";
  /**
   * Legacy alias for `stdoutKind: "bytes"`. Older commands set this to
   * `"binary"` to mark binary output. New code should prefer `stdoutKind`.
   */
  stdoutEncoding?: "binary";
  /** @internal PIPESTATUS override used by synthesized transform builtins. */
  internalPipeStatusOverride?: number[];
  /** @internal Leaf command that produced output through wrapper builtins. */
  internalProducerCommand?: string;
  /** @internal Whether `exec` gives the producer external diagnostic formatting. */
  internalProducerOmitsShellPrefix?: boolean;
  /** @internal Bytes consumed from a descriptor-backed stdin stream. */
  internalStdinConsumed?: number;
  /**
   * Bytes in the current result that have already been charged to the shared
   * execution output budget. Interpreter plumbing must preserve this when it
   * combines child results so nested shells do not refresh or double-charge
   * the budget.
   * @internal
   */
  internalOutputAccounting?: {
    stdout: number;
    stderr: number;
  };
}
/** Result from BashEnv.exec() - always includes env */
interface BashExecResult extends ExecResult {
  env: Record<string, string>;
  metadata?: Record<string, unknown>;
}
/** Options for exec calls within commands (internal API) */
interface CommandExecOptions {
  /** Environment variables to merge into the exec state */
  env?: Record<string, string>;
  /**
   * Replace the execution environment instead of merging with parent env.
   * Useful for implementing `env -i` semantics safely without shell prefixes.
   */
  replaceEnv?: boolean;
  /**
   * Working directory for the exec.
   * Required to prevent bugs where subcommands run in the wrong directory.
   * Always pass `ctx.cwd` from the calling command's context.
   */
  cwd: string;
  /**
   * Standard input to pass to the subcommand.
   * Optional - if not provided, stdin will be empty.
   */
  stdin?: string;
  /**
   * Shape of {@link stdin}:
   *   - `"text"` (default): JS Unicode text. UTF-8 encoded into bytes
   *     before reaching the subcommand, so byte consumers (`wc -c`,
   *     `base64`, `md5sum`) inside the script see real UTF-8 bytes.
   *   - `"bytes"`: a latin1-shaped byte buffer (each char = one byte,
   *     e.g. from `Buffer.from(...).toString("latin1")`). Forwarded
   *     verbatim — useful for piping raw binary into commands like
   *     `gzip -d`.
   */
  stdinKind?: "text" | "bytes";
  /**
   * Abort signal for cooperative cancellation.
   * When aborted, the interpreter stops executing at the next statement boundary.
   * Used by `timeout` to ensure timed-out commands don't continue running.
   */
  signal?: AbortSignal;
  /**
   * Additional argv entries appended to the first executed command.
   * Values bypass shell parsing entirely — no escaping, splitting, or globbing.
   * Like child_process.spawnSync(cmd, args).
   */
  args?: string[];
}
/**
 * Context provided to commands during execution.
 *
 * ## Field Availability
 *
 * **Always available (core fields):**
 * - `fs`, `cwd`, `env`, `stdin`
 *
 * **Available when running via BashEnv interpreter:**
 * - `exec` - For commands like `xargs`, `bash -c` that need to run subcommands
 * - `getRegisteredCommands` - For the `help` command to list available commands
 *
 * **Conditionally available based on configuration:**
 * - `fetch` - Only when `network` option is configured in BashEnv
 * - `sleep` - Only when a custom sleep function is provided (e.g., for testing)
 */
/**
 * Performance trace event for profiling command execution
 */
interface TraceEvent {
  /** Event category (e.g., "find", "grep") */
  category: string;
  /** Event name (e.g., "readdir", "stat", "eval") */
  name: string;
  /** Duration in milliseconds */
  durationMs: number;
  /** Optional details (e.g., path, count) */
  details?: Record<string, unknown>;
}
/**
 * Trace callback function for receiving performance events
 */
type TraceCallback = (event: TraceEvent) => void;
interface RuntimeCommandContext {
  /** Virtual filesystem interface for file operations */
  fs: IFileSystem;
  /** Stable identity of the underlying filesystem across defense wrappers. */
  fsIdentity?: object;
  /** Current working directory */
  cwd: string;
  /** Environment variables - uses Map to prevent prototype pollution */
  env: Map<string, string>;
  /** Interpreter-owned assignment gateway for commands such as `printf -v`. */
  assignShellVariable?: (name: string, value: string, subscript?: string) => void | Promise<void>;
  /**
   * Exported environment variables only.
   * Used by commands like printenv and env that should only show exported vars.
   * In bash, only exported variables are passed to child processes.
   */
  exportedEnv?: Record<string, string>;
  /**
   * Standard input as a byte buffer. Opaque on purpose — see `encoding.ts`.
   *
   * Pipelines carry bytes (a previous command's stdout becomes this stdin).
   * Choose a conversion at the use site:
   *   - `latin1FromBytes(ctx.stdin)` to forward bytes unchanged (cat, head,
   *     tee, base64 -d, gzip, ...).
   *   - `decodeBytesToUtf8(ctx.stdin)` to interpret as UTF-8 text (jq, sed,
   *     grep, awk, parsers, code execution, char-position math, ...).
   * Mixing the two — calling string methods on a latin1 byte buffer that
   * actually holds UTF-8 — is the bug class this type prevents.
   */
  stdin: ByteString;
  /**
   * Execution limits configuration.
   * Fully resolved by Bash before a command is invoked.
   */
  limits: Required<ExecutionLimits>;
  /** Shared top-level accounting, present for interpreter-dispatched commands. */
  executionScope?: CommandExecutionBudget;
  /**
   * Performance trace callback for profiling.
   * If provided, commands emit timing events for analysis.
   */
  trace?: TraceCallback;
  /**
   * Execute a subcommand (e.g., for `xargs`, `bash -c`).
   * Available when running commands via BashEnv interpreter.
   *
   * @param command - The command string to execute
   * @param options - Required options including `cwd` to prevent directory bugs
   */
  exec?: (command: string, options: CommandExecOptions) => Promise<ExecResult>;
  /**
   * Invoke the bundled command shadowed by the current custom command.
   * Available only when a custom command overrides a bundled command.
   */
  origCommand?: (args: string[]) => Promise<ExecResult>;
  /** @internal Closed path for forwarding this command's already-accounted stdin. */
  execWithInheritedStdin?: (command: string, options: Omit<CommandExecOptions, "stdin" | "stdinKind">) => Promise<ExecResult>;
  /**
   * Secure fetch function for network requests (e.g., for `curl`).
   * Only available when `network` option is configured in BashEnv.
   */
  fetch?: SecureFetch;
  /**
   * Returns names of all registered commands.
   * Available when running commands via BashEnv interpreter.
   * Used by the `help` command.
   */
  getRegisteredCommands?: () => string[];
  /**
   * Custom sleep implementation.
   * If provided, used instead of real setTimeout.
   * Useful for testing with mock clocks.
   */
  sleep?: (ms: number) => Promise<void>;
  /**
   * File descriptors map for here-docs and process substitution.
   * Maps FD numbers to their content (e.g., 3 -> "content from 3<<EOF").
   * Note: FD 0 content is in `stdin`, but may also appear here for consistency.
   */
  fileDescriptors?: Map<number, string>;
  /**
   * Whether xpg_echo shopt is enabled.
   * When true, echo interprets backslash escapes by default (like echo -e).
   */
  xpgEcho?: boolean;
  /**
   * Current command substitution nesting depth.
   * Used to prevent stack exhaustion from deeply nested $(...).
   */
  substitutionDepth?: number;
  /**
   * Feature coverage writer for fuzzing instrumentation.
   * When provided, commands emit coverage hits for analysis.
   */
  coverage?: FeatureCoverageWriter;
  /**
   * Abort signal from the current execution context.
   * Commands that spawn sub-executions (bash -c, xargs, etc.)
   * should forward this signal so cooperative cancellation propagates.
   */
  signal?: AbortSignal;
  /**
   * When true, command execution must remain inside DefenseInDepthBox
   * async context. Commands with async boundaries should assert this
   * before and after awaited operations.
   */
  requireDefenseContext?: boolean;
  /**
   * Bootstrap JavaScript code for js-exec.
   * Threaded through the context chain instead of shell env to prevent
   * user access/injection via environment variables.
   */
  jsBootstrapCode?: string;
  /**
   * Tool invoker hook. When present, js-exec sets up a `tools` proxy that
   * routes calls through this callback. Receives `(path, argsJson)` and
   * returns a JSON result string.
   */
  invokeTool?: (path: string, argsJson: string) => Promise<string>;
}
/** Context supplied by Bash when dispatching a registered command. */
type ResolvedCommandContext = RuntimeCommandContext;
interface Command {
  name: string;
  /**
   * Host-provided commands are trusted by default for compatibility. Set this
   * to false to select the restricted extension boundary.
   * Built-in commands should generally remain untrusted and use explicit
   * trusted wrappers only at narrow infrastructure boundaries.
   */
  trusted?: boolean;
  /** @internal Marks host extensions that receive a least-authority budget. */
  internalIsExtension?: boolean;
  execute(args: string[], ctx: ResolvedCommandContext): Promise<ExecResult>;
}
//#endregion
//#region ../../.bun/install/cache/links/just-bash@3.4.2-8196b62c07b67856/node_modules/just-bash/dist/custom-commands.d.ts
/**
 * A custom command - either a Command object or a lazy loader.
 */
type CustomCommand = Command | LazyCommand;
/**
 * Lazy-loaded custom command (for code-splitting).
 */
interface LazyCommand {
  name: string;
  /**
   * Set false to run through the restricted extension boundary. Commands are
   * trusted by default for compatibility with existing host integrations.
   */
  trusted?: boolean;
  load: () => Promise<Command>;
}
/**
 * Define a TypeScript command with type inference.
 * Convenience wrapper - you can also just use the Command interface directly.
 *
 * @example
 * ```ts
 * const hello = defineCommand("hello", async (args, ctx) => {
 *   const name = args[0] || "world";
 *   return { stdout: `Hello, ${name}!\n`, stderr: "", exitCode: 0 };
 * });
 *
 * const bash = new Bash({ customCommands: [hello] });
 * await bash.exec("hello Alice"); // "Hello, Alice!\n"
 * ```
 */
declare function defineCommand(name: string, execute: (args: string[], ctx: ResolvedCommandContext) => Promise<ExecResult>, options?: {
  trusted?: boolean;
}): Command;
//#endregion
//#region src/patch/operations.d.ts
type ApplyPatchOperation = {
  readonly type: 'create_file';
  readonly path: string;
  readonly diff: string;
} | {
  readonly type: 'update_file';
  readonly path: string;
  readonly diff: string;
  readonly moveTo?: string;
} | {
  readonly type: 'delete_file';
  readonly path: string;
};
type ApplyPatchStatus = 'completed' | 'failed';
type ApplyPatchBatchMode = 'all-or-nothing' | 'ordered';
interface ApplyPatchResult {
  readonly status: ApplyPatchStatus;
  readonly output?: string;
  readonly cause?: Error;
}
interface ApplyPatchOptions {
  readonly maxPatchSize?: number;
  readonly mode?: ApplyPatchBatchMode;
}
declare const DEFAULT_MAX_PATCH_SIZE = 1048576;
//#endregion
//#region src/policy/types.d.ts
type PolicyReasonCode = 'ambiguous-path' | 'command-too-long' | 'compression-unsupported' | 'dangerous-command' | 'host-escape' | 'network-disabled' | 'path-out-of-root' | 'pipeline-too-deep' | 'recursive-root' | 'reserved-path' | 'too-many-segments' | 'unbounded-work' | 'unsupported-command' | 'unsupported-syntax';
interface CommandInspectDecision {
  readonly allow: boolean;
  readonly code?: string;
  readonly reason?: string;
}
interface CommandInspector {
  readonly inspect: (command: string) => CommandInspectDecision | Promise<CommandInspectDecision>;
}
interface CommandPolicyFileSystem {
  readonly lstat: IFileSystem['lstat'];
  readonly readlink: IFileSystem['readlink'];
}
interface CommandPolicyOptions {
  readonly allowNetwork?: boolean;
  readonly allowRecursiveRoot?: boolean;
  readonly extraAllowCommands?: readonly string[];
  readonly extraDenyCommands?: readonly string[];
  readonly fs?: CommandPolicyFileSystem;
  readonly inspectors?: readonly CommandInspector[];
  readonly maxCommandLength?: number;
  readonly maxPipelineDepth?: number;
  readonly maxSegments?: number;
}
declare const DEFAULT_MAX_COMMAND_LENGTH = 32768;
declare const DEFAULT_MAX_PIPELINE_DEPTH = 8;
declare const DEFAULT_MAX_SEGMENTS = 32;
//#endregion
//#region src/core/filesystem-view.d.ts
interface WorkspaceFileSystemViewOptions {
  /** A workspace directory presented to tools as their filesystem root. */
  readonly root?: string;
  /** Paths relative to the presented root that tools cannot see or address. */
  readonly hiddenRoots?: readonly string[];
}
declare const createWorkspaceFileSystemView: (inner: IFileSystem, options?: WorkspaceFileSystemViewOptions) => IFileSystem;
//#endregion
export { IFileSystem as A, SecureFetch as C, DirentEntry as D, CpOptions as E, WriteFileOptions as F, ExecutionLimitProfile as I, ExecutionLimits as L, MkdirOptions as M, ReadFileOptions as N, FileContent as O, RmOptions as P, ByteString as R, TraceCallback as S, BufferEncoding as T, CustomCommand as _, CommandPolicyFileSystem as a, Command as b, DEFAULT_MAX_PIPELINE_DEPTH as c, ApplyPatchBatchMode as d, ApplyPatchOperation as f, DEFAULT_MAX_PATCH_SIZE as g, ApplyPatchStatus as h, CommandInspector as i, InitialFiles as j, FsStat as k, DEFAULT_MAX_SEGMENTS as l, ApplyPatchResult as m, createWorkspaceFileSystemView as n, CommandPolicyOptions as o, ApplyPatchOptions as p, CommandInspectDecision as r, DEFAULT_MAX_COMMAND_LENGTH as s, WorkspaceFileSystemViewOptions as t, PolicyReasonCode as u, defineCommand as v, NetworkConfig as w, FeatureCoverageWriter as x, BashExecResult as y };