@node9/proxy 2.45.0 → 2.47.0

package/dist/index.mjs

@@ -64,22 +64,16 @@ var init_forecast_context = __esm({
 });
 
 // packages/policy-engine/dist/index.mjs
-import mvdanSh3 from "mvdan-sh";
 import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
-import mvdanSh from "mvdan-sh";
 import mvdanSh2 from "mvdan-sh";
+import mvdanSh from "mvdan-sh";
+import mvdanSh3 from "mvdan-sh";
 import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 import { createHash as createHash22 } from "crypto";
-import mvdanSh4 from "mvdan-sh";
-import mvdanSh5 from "mvdan-sh";
-import mvdanSh6 from "mvdan-sh";
-import mvdanSh8 from "mvdan-sh";
-import mvdanSh7 from "mvdan-sh";
 import { createHash as createHash3 } from "crypto";
-import mvdanSh9 from "mvdan-sh";
 import crypto from "crypto";
 function validateRegex(pattern) {
   if (!pattern) return "Pattern is required";
@@ -661,6 +655,62 @@ function resolveCheckMap(settings) {
   for (const c of CHECKS) out[c.id] = checkValue(settings, c.id);
   return out;
 }
+function isGoNode(v) {
+  return v !== null && typeof v === "object" && typeof v.Pos === "function";
+}
+function toPlainTree(goNode) {
+  const kind = syntax.NodeType(goNode);
+  const out = { kind, pos: goNode.Pos().Offset(), end: goNode.End().Offset() };
+  const spec = KINDS[kind];
+  if (!spec) {
+    unknownKinds.add(kind);
+    return out;
+  }
+  convertFields(goNode, spec, out, kind);
+  return out;
+}
+function convertFields(goNode, spec, out, kind) {
+  for (const f of spec.scalars ?? []) out[f] = goNode[f];
+  for (const f of spec.nodes ?? []) {
+    const v = goNode[f];
+    if (v === void 0 || v === null) {
+      out[f] = null;
+    } else if (Array.isArray(v)) {
+      out[f] = v.map((c) => isGoNode(c) ? toPlainTree(c) : c);
+    } else if (isGoNode(v)) {
+      out[f] = toPlainTree(v);
+    } else if (typeof v === "object" && STRUCTS[`${kind}.${f}`]) {
+      const sub = { struct: `${kind}.${f}` };
+      convertFields(v, STRUCTS[`${kind}.${f}`], sub, `${kind}.${f}`);
+      out[f] = sub;
+    } else {
+      out[f] = v;
+    }
+  }
+}
+function childrenOf(n) {
+  const spec = n.kind ? KINDS[n.kind] : STRUCTS[n.struct];
+  if (!spec?.nodes) return [];
+  const out = [];
+  for (const f of spec.nodes) {
+    if (spec.notWalked?.includes(f)) continue;
+    const v = n[f];
+    if (!v) continue;
+    if (Array.isArray(v)) {
+      for (const c of v) if (c) out.push(c);
+    } else if (v.kind) {
+      out.push(v);
+    } else if (v.struct) {
+      out.push(...childrenOf(v));
+    }
+  }
+  return out;
+}
+function walk(root, fn) {
+  if (!root) return;
+  if (!fn(root)) return;
+  for (const c of childrenOf(root)) walk(c, fn);
+}
 function isInvisibleChar(char) {
   return INVISIBLE_ONE.test(char);
 }
@@ -816,7 +866,7 @@ function judgeInlineCode(language, code, isProtected) {
 }
 function isCatHeredocOrLit(part) {
   if (!part) return false;
-  const t = syntax.NodeType(part);
+  const t = part.kind;
   if (t === "Lit") return true;
   if (t !== "CmdSubst") return false;
   const stmts = part.Stmts || [];
@@ -826,9 +876,9 @@ function isCatHeredocOrLit(part) {
   const hasHeredoc = redirs.some((r) => r && r.Hdoc);
   if (!hasHeredoc) return false;
   const cmd = stmt.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return false;
+  if (!cmd || cmd.kind !== "CallExpr") return false;
   const firstArg = cmd.Args?.[0]?.Parts || [];
-  if (firstArg.length !== 1 || syntax.NodeType(firstArg[0]) !== "Lit") return false;
+  if (firstArg.length !== 1 || firstArg[0].kind !== "Lit") return false;
   return (firstArg[0].Value || "").toLowerCase() === "cat";
 }
 function parseShared(command) {
@@ -840,7 +890,7 @@ function parseShared(command) {
   }
   let parsed;
   try {
-    parsed = sharedParser.Parse(command, "cmd");
+    parsed = toPlainTree(sharedParser.Parse(command, "cmd"));
   } catch {
     parsed = PARSE_FAIL;
   }
@@ -901,10 +951,10 @@ function fileAccessViewImpl(command) {
   const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
   const edits = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const words = args.map((a) => resolveWordLiteral(a));
       const head = unwrapCommandHead(words);
@@ -916,8 +966,8 @@ function fileAccessViewImpl(command) {
         if (!PROGRAM_DIR.test(word)) continue;
         const name = word.split(/[\\/]/).pop() ?? "";
         if (!name) continue;
-        const s = at(args[i].Pos().Offset());
-        const e = at(args[i].End().Offset());
+        const s = at(args[i].pos);
+        const e = at(args[i].end);
         if (s < 0 || e < 0) continue;
         edits.push([s, e, name]);
       }
@@ -945,10 +995,10 @@ function literalPayloadsOf(command, depth) {
   if (f === PARSE_FAIL) return [];
   const out = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || out.length >= MAX_READING_PAYLOADS) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const payload = literalShellPayload(words, baseWord(words[0]));
@@ -968,23 +1018,23 @@ function foldCommandWords(reading) {
   const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
   const edits = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const words = args.map((a) => resolveWordLiteral(a));
       const folded = words.map((w) => w === null ? null : foldHomoglyphs(w));
       const head = unwrapCommandHead(folded);
       for (let i = 0; i <= head && i < args.length; i++) {
         const parts = args[i].Parts || [];
-        if (parts.length !== 1 || syntax.NodeType(parts[0]) !== "Lit") continue;
+        if (parts.length !== 1 || parts[0].kind !== "Lit") continue;
         const value = parts[0].Value ?? "";
         const word = folded[i];
         if (word === null || word === value || !/[^\x00-\x7f]/.test(value)) continue;
         if (!/^[A-Za-z0-9._/-]+$/.test(word)) continue;
-        const s = at(args[i].Pos().Offset());
-        const e = at(args[i].End().Offset());
+        const s = at(args[i].pos);
+        const e = at(args[i].end);
         if (s < 0 || e < 0) continue;
         edits.push([s, e, word]);
       }
@@ -1021,10 +1071,10 @@ function interpreterHeredocSpans(f, at) {
   const stmts = f?.Stmts || [];
   const candidates = [];
   let unsafe = false;
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node || unsafe) return false;
     const n = node;
-    const t = syntax.NodeType(n);
+    const t = n.kind;
     if (t === "FuncDecl") {
       unsafe = true;
       return false;
@@ -1044,7 +1094,7 @@ function interpreterHeredocSpans(f, at) {
   });
   if (unsafe) return [];
   for (const st of stmts) {
-    if (!st?.Cmd || syntax.NodeType(st.Cmd) !== "CallExpr") continue;
+    if (!st?.Cmd || st.Cmd.kind !== "CallExpr") continue;
     const words = (st.Cmd.Args || []).map((a) => resolveWordLiteral(a));
     const name = (words[0] ?? "").toLowerCase();
     if (!STDIN_CODE_INTERPRETERS.test(name)) continue;
@@ -1059,8 +1109,8 @@ function interpreterHeredocSpans(f, at) {
     if (stdin.length !== 1 || others > 0) continue;
     const r = stdin[0];
     if (heredocText(r.Hdoc) === null) continue;
-    const hs = at(r.Hdoc.Pos().Offset());
-    const he = at(r.Hdoc.End().Offset());
+    const hs = at(r.Hdoc.pos);
+    const he = at(r.Hdoc.end);
     if (hs < 0 || he < 0 || he <= hs) continue;
     spans.push([hs, he]);
   }
@@ -1080,24 +1130,24 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
       strips.push([hs, he]);
       msgSpans.add(`${hs}:${he}`);
     }
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       for (let i = 0; i < args.length - 1; i++) {
         const argParts = args[i].Parts || [];
-        if (argParts.length !== 1 || syntax.NodeType(argParts[0]) !== "Lit") continue;
+        if (argParts.length !== 1 || argParts[0].kind !== "Lit") continue;
         const flagVal = argParts[0].Value || "";
         if (!MESSAGE_FLAGS.has(flagVal.toLowerCase())) continue;
         const next = args[i + 1];
         const nextParts = next.Parts || [];
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
-        const nt = syntax.NodeType(quotedNode);
+        const nt = quotedNode.kind;
         const markStrip = () => {
-          const s = at(next.Pos().Offset());
-          const e = at(next.End().Offset());
+          const s = at(next.pos);
+          const e = at(next.end);
           if (s < 0 || e < 0) return;
           strips.push([s, e]);
           msgSpans.add(`${s}:${e}`);
@@ -1106,7 +1156,7 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
           markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
-          const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
+          const allLit = innerParts.length === 0 || innerParts.every((p) => p.kind === "Lit");
           if (allLit) {
             markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
@@ -1115,8 +1165,8 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
         }
       }
       for (const arg of args) {
-        const s = at(arg.Pos().Offset());
-        const e = at(arg.End().Offset());
+        const s = at(arg.pos);
+        const e = at(arg.end);
         if (s < 0 || e < 0) continue;
         if (msgSpans.has(`${s}:${e}`)) continue;
         const resolved = resolveWordLiteral(arg);
@@ -1156,10 +1206,10 @@ function scanArgsForDynamicExec(args, startIdx) {
   let hasParamExp = false;
   let hasCurl = false;
   for (let i = startIdx; i < args.length; i++) {
-    syntax.Walk(args[i], (inner) => {
+    walk(args[i], (inner) => {
       if (!inner) return false;
       const inn = inner;
-      const it = syntax.NodeType(inn);
+      const it = inn.kind;
       if (it === "CmdSubst") hasCmdSubst = true;
       if (it === "ParamExp") hasParamExp = true;
       if (it === "Lit" && DOWNLOAD_CMDS.has(inn.Value?.toLowerCase())) hasCurl = true;
@@ -1172,15 +1222,16 @@ function scanArgsForDynamicExec(args, startIdx) {
 }
 function detectDangerousShellExec(command) {
   try {
-    const f = sharedParser.Parse(command, "cmd");
+    const f = parseShared(command);
+    if (f === PARSE_FAIL) return null;
     let result = null;
     const assigned = assignedNames(f);
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || result === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
+      if (n.kind === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = n.Y.Cmd;
-        if (call && syntax.NodeType(call) === "CallExpr") {
+        if (call && call.kind === "CallExpr") {
           const words = (call.Args || []).map((a) => resolveWordLiteral(a));
           const head2 = unwrapCommandHead(words);
           const name = (words[head2] ?? "").split("/").pop() ?? "";
@@ -1193,7 +1244,7 @@ function detectDangerousShellExec(command) {
             result = "review";
         }
       }
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       if (args.length === 0) return true;
       const headWords = args.map(
@@ -1204,7 +1255,7 @@ function detectDangerousShellExec(command) {
       if (!lookup && (opaqueExecutable(args[0], assigned) || opaqueExecutable(args[head], assigned)))
         result = "review";
       const firstParts = args[0].Parts || [];
-      if (firstParts.length !== 1 || syntax.NodeType(firstParts[0]) !== "Lit") return true;
+      if (firstParts.length !== 1 || firstParts[0].kind !== "Lit") return true;
       const cmdName = firstParts[0].Value?.toLowerCase() ?? "";
       if (cmdName === "eval") {
         const v = scanArgsForDynamicExec(args, 1);
@@ -1212,7 +1263,7 @@ function detectDangerousShellExec(command) {
       } else if (SHELL_INTERPRETERS.has(cmdName)) {
         for (let i = 1; i < args.length - 1; i++) {
           const flagParts = args[i].Parts || [];
-          if (flagParts.length !== 1 || syntax.NodeType(flagParts[0]) !== "Lit" || flagParts[0].Value !== "-c")
+          if (flagParts.length !== 1 || flagParts[0].kind !== "Lit" || flagParts[0].Value !== "-c")
             continue;
           const v = scanArgsForDynamicExec(args, i + 1);
           if (v === "block" || v === "review" && result === null) result = v;
@@ -1236,8 +1287,7 @@ function isDefaultExpansion(part) {
 }
 function lookupSubstitution(part) {
   const stmts = part.Stmts ?? [];
-  if (stmts.length !== 1 || !stmts[0].Cmd || syntax.NodeType(stmts[0].Cmd) !== "CallExpr")
-    return null;
+  if (stmts.length !== 1 || !stmts[0].Cmd || stmts[0].Cmd.kind !== "CallExpr") return null;
   const words = (stmts[0].Cmd.Args ?? []).map((a) => resolveWordLiteral(a));
   if (words.some((w) => w === null)) return null;
   if (words.length === 2 && words[0] === "which") return words[1];
@@ -1247,9 +1297,9 @@ function lookupSubstitution(part) {
 }
 function assignedNames(f) {
   const names = /* @__PURE__ */ new Set();
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node) return false;
-    const kind = syntax.NodeType(node);
+    const kind = node.kind;
     if (kind === "Assign" && node.Name?.Value) names.add(node.Name.Value);
     if (kind === "ForClause" && node.Loop?.Name?.Value) names.add(node.Loop.Name.Value);
     if (kind === "CallExpr") {
@@ -1264,7 +1314,7 @@ function assignedNames(f) {
 }
 function executableParts(word, assigned, quoted = false) {
   return (word?.Parts ?? []).flatMap((part) => {
-    const kind = syntax.NodeType(part);
+    const kind = part.kind;
     if (kind === "DblQuoted") return executableParts(part, assigned, true);
     if (kind === "Lit") return [{ kind: "Lit", value: part.Value ?? "", quoted }];
     if (kind === "SglQuoted")
@@ -1332,10 +1382,10 @@ function chmodHasOpenPermMode(command) {
   if (f === PARSE_FAIL) return false;
   let found = false;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || found) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const name = (words[0] ?? "").toLowerCase();
@@ -1388,11 +1438,11 @@ function redirStdinOps() {
 }
 function deriveBinaryOp(sample) {
   try {
-    const f = sharedParser.Parse(sample, "cmd");
+    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
     let op = -1;
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       const n = node;
-      if (n && syntax.NodeType(n) === "BinaryCmd" && op < 0) op = n.Op;
+      if (n && n.kind === "BinaryCmd" && op < 0) op = n.Op;
       return true;
     });
     return op;
@@ -1466,7 +1516,7 @@ function heredocText(word) {
   const parts = word?.Parts ?? [];
   let out = "";
   for (const p of parts) {
-    if (syntax.NodeType(p) !== "Lit") return null;
+    if (p.kind !== "Lit") return null;
     out += p.Value ?? "";
   }
   return out;
@@ -1502,7 +1552,7 @@ function attachedCode(interp, flag) {
 }
 function inlineExecCall(stmt, pipeFed) {
   const cmd = stmt?.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return null;
+  if (!cmd || cmd.kind !== "CallExpr") return null;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0) return null;
   const headIdx = unwrapCommandHead(words);
@@ -1583,10 +1633,10 @@ function shellPayloadNeedsReview(payload) {
   let review = false;
   payloadNesting++;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || review) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const h = unwrapCommandHead(words);
@@ -1620,10 +1670,10 @@ function inlineExecCalls(command) {
   if (f === PARSE_FAIL) return PARSE_FAIL;
   const calls = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || calls.length >= MAX_INLINE_CALLS) return false;
       const n = node;
-      const t = syntax.NodeType(n);
+      const t = n.kind;
       if (t === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = inlineExecCall(n.Y, true);
         if (call) calls.push(call);
@@ -1758,7 +1808,7 @@ function shellScriptOperands(command) {
     walkWithCalls(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const callArgs = n.Args || [];
       if (callArgs.length === 0) return true;
       const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -1794,7 +1844,7 @@ function shellScriptOperands(command) {
 }
 function windowsDrivePathSpelling(word) {
   const parts = word?.Parts || [];
-  if (parts.length === 0 || !parts.every((p) => syntax.NodeType(p) === "Lit")) return null;
+  if (parts.length === 0 || !parts.every((p) => p.kind === "Lit")) return null;
   const raw = parts.map((p) => p.Value ?? "").join("");
   return /^[A-Za-z]:\\[^\s'"$`]*$/.test(raw) ? raw : null;
 }
@@ -1832,15 +1882,15 @@ function recordTopLevelAssignments(f) {
 }
 function probeBinOp(src) {
   try {
-    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
-    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+    const cmd = toPlainTree(syntax2.NewParser().Parse(src, "probe"))?.Stmts?.[0]?.Cmd;
+    if (cmd && cmd.kind === "BinaryCmd") return cmd.Op;
   } catch {
   }
   return null;
 }
 function recordTopLevelStmt(stmt) {
   if (!stmt || !stmt.Cmd) return false;
-  const t = syntax.NodeType(stmt.Cmd);
+  const t = stmt.Cmd.kind;
   if (t === "BinaryCmd") {
     if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
     if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
@@ -1850,7 +1900,7 @@ function recordTopLevelStmt(stmt) {
   if (t !== "CallExpr" && t !== "DeclClause") return false;
   let at = 0;
   try {
-    at = stmt.Pos().Offset();
+    at = stmt.pos;
   } catch {
     at = 0;
   }
@@ -1861,14 +1911,14 @@ function recordTopLevelStmt(stmt) {
 }
 function recordAssignments(n, at) {
   if (!assignmentTable) return;
-  const t = syntax.NodeType(n);
+  const t = n.kind;
   let assigns = [];
   if (t === "CallExpr") {
     if ((n.Args || []).length > 0) return;
     assigns = n.Assigns || [];
   } else if (t === "DeclClause") {
     if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
-    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+    assigns = (n.Args || []).filter((a) => a.kind === "Assign");
   } else return;
   for (const a of assigns) {
     const name = a?.Name?.Value;
@@ -1877,13 +1927,13 @@ function recordAssignments(n, at) {
   }
 }
 function resolveTrivialSubst(part) {
-  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  if (part.kind !== "CmdSubst") return void 0;
   const stmts = part.Stmts || [];
   if (stmts.length !== 1) return void 0;
   const st = stmts[0];
   if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
   const cmd = st.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if (!cmd || cmd.kind !== "CallExpr") return void 0;
   if ((cmd.Assigns || []).length > 0) return void 0;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0 || words.some((w) => w === null)) return void 0;
@@ -1908,7 +1958,7 @@ function recordedExpansion(name) {
   return rec.value;
 }
 function isPlainParam(p) {
-  if (syntax.NodeType(p) !== "ParamExp") return false;
+  if (p.kind !== "ParamExp") return false;
   return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
 }
 function expandPlainParam(p) {
@@ -1920,9 +1970,9 @@ function expandPlainParam(p) {
 }
 function functionBodies(f) {
   const out = /* @__PURE__ */ new Map();
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     const n = node;
-    if (n && syntax.NodeType(n) === "FuncDecl" && n.Name?.Value && n.Body) {
+    if (n && n.kind === "FuncDecl" && n.Name?.Value && n.Body) {
       const list = out.get(n.Name.Value) ?? [];
       list.push(n.Body);
       out.set(n.Name.Value, list);
@@ -1933,10 +1983,10 @@ function functionBodies(f) {
 }
 function rebindsPositionals(body) {
   let found = false;
-  syntax.Walk(body, (node) => {
+  walk(body, (node) => {
     const n = node;
     if (found || !n) return false;
-    if (syntax.NodeType(n) === "CallExpr") {
+    if (n.kind === "CallExpr") {
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words[0] === "shift") found = true;
       else if (words[0] === "set" && words.slice(1).some((w) => w === null || w === "--" || !/^[-+]/.test(w)))
@@ -1956,7 +2006,7 @@ function tableBindings() {
 function walkWithCalls(f, visit) {
   const bodies = functionBodies(f);
   if (bodies.size === 0) {
-    syntax.Walk(f, visit);
+    walk(f, visit);
     return;
   }
   const seenCalls = /* @__PURE__ */ new Set();
@@ -1990,8 +2040,8 @@ function walkWithCalls(f, visit) {
       currentStmtOffset = Number.MAX_SAFE_INTEGER;
       callDepth++;
       try {
-        if (body.Cmd && syntax.NodeType(body.Cmd) === "Block") recordTopLevelAssignments(body.Cmd);
-        syntax.Walk(body, step);
+        if (body.Cmd && body.Cmd.kind === "Block") recordTopLevelAssignments(body.Cmd);
+        walk(body, step);
       } finally {
         callDepth--;
         assignmentTable = outerTable;
@@ -2002,10 +2052,10 @@ function walkWithCalls(f, visit) {
   const step = (node) => {
     if (!node) return false;
     const go = visit(node);
-    if (go !== false && syntax.NodeType(node) === "CallExpr") inline(node);
+    if (go !== false && node.kind === "CallExpr") inline(node);
     return go;
   };
-  syntax.Walk(f, step);
+  walk(f, step);
 }
 function withAssignments(f, body) {
   const outerTable = assignmentTable;
@@ -2030,7 +2080,7 @@ function walkCommandScope(command, visit) {
   if (f === PARSE_FAIL) return "parse-fail";
   withAssignments(f, () => {
     walkWithCalls(f, (node) => {
-      if (node && syntax.NodeType(node) === "Stmt") trackStatement(node);
+      if (node && node.kind === "Stmt") trackStatement(node);
       return visit(node);
     });
   });
@@ -2038,7 +2088,7 @@ function walkCommandScope(command, visit) {
 }
 function trackStatement(n) {
   try {
-    currentStmtOffset = n.Pos().Offset();
+    currentStmtOffset = n.pos;
   } catch {
     currentStmtOffset = Number.MAX_SAFE_INTEGER;
   }
@@ -2054,11 +2104,11 @@ function resolveWordLiteral(w) {
   return s;
 }
 function resolveWordPrefix(w) {
-  const walk2 = (parts) => {
+  const walk3 = (parts) => {
     let s = "";
     for (const p of parts) {
       if (p && typeof p === "object" && Array.isArray(p.Parts) && p.Dollar !== void 0) {
-        const inner = walk2(p.Parts);
+        const inner = walk3(p.Parts);
         s += inner.prefix;
         if (inner.dynamic) return { prefix: s, dynamic: true };
         continue;
@@ -2069,10 +2119,10 @@ function resolveWordPrefix(w) {
     }
     return { prefix: s, dynamic: false };
   };
-  return walk2(w?.Parts || []);
+  return walk3(w?.Parts || []);
 }
 function resolvePart(p, inQuotes) {
-  const t = syntax.NodeType(p);
+  const t = p.kind;
   if (t === "Lit") {
     const raw = p.Value ?? "";
     if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
@@ -2168,7 +2218,7 @@ function extractShellDestinations(command) {
       () => walkWithCalls(f, (node) => {
         if (!node) return false;
         const n = node;
-        if (syntax.NodeType(n) === "Stmt") {
+        if (n.kind === "Stmt") {
           trackStatement(n);
           for (const raw of redirectWords(n)) {
             const host2 = devNetRedirectHost(raw);
@@ -2180,7 +2230,7 @@ function extractShellDestinations(command) {
             out.push({ host: host2, binary, raw });
           }
         }
-        if (syntax.NodeType(n) !== "CallExpr") return true;
+        if (n.kind !== "CallExpr") return true;
         const callArgs = n.Args || [];
         if (callArgs.length === 0) return true;
         const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -2215,7 +2265,7 @@ function extractShellDestTokens(command) {
       () => walkWithCalls(f, (node) => {
         if (!node) return false;
         const n = node;
-        if (syntax.NodeType(n) === "Stmt") {
+        if (n.kind === "Stmt") {
           trackStatement(n);
           for (const raw of redirectWords(n)) {
             const host2 = devNetRedirectHost(raw);
@@ -2227,7 +2277,7 @@ function extractShellDestTokens(command) {
             out.push({ token: host2, binary });
           }
         }
-        if (syntax.NodeType(n) !== "CallExpr") return true;
+        if (n.kind !== "CallExpr") return true;
         const callArgs = n.Args || [];
         if (callArgs.length === 0) return true;
         const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -2295,11 +2345,11 @@ function isWaivableCleanupTarget(p) {
 }
 function deriveRedirOp(sample) {
   try {
-    const f = sharedParser.Parse(sample, "cmd");
+    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
     let op = -1;
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       const n = node;
-      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      if (n && n.kind === "Redirect" && op < 0) op = n.Op;
       return true;
     });
     return op;
@@ -2312,7 +2362,7 @@ function collectSameCommandCreations(f) {
   try {
     const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
     for (const stmt of stmts) {
-      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      if (!stmt || !stmt.Cmd || stmt.Cmd.kind !== "CallExpr") continue;
       const redirs = stmt.Redirs || [];
       if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
       for (const r of redirs) {
@@ -2336,10 +2386,10 @@ function isRmCreatedInCommandCleanup(command) {
   let sawRm = false;
   let ok = true;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || !ok) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
       if (name !== "rm") return true;
@@ -2389,10 +2439,10 @@ function analyzeFsOperationImpl(command, depth = 0) {
     walkWithCalls(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
-      const nodeType = syntax.NodeType(n);
+      const nodeType = n.kind;
       if (nodeType === "Stmt") {
         try {
-          currentStmtOffset = n.Pos().Offset();
+          currentStmtOffset = n.pos;
         } catch {
           currentStmtOffset = Number.MAX_SAFE_INTEGER;
         }
@@ -2905,11 +2955,12 @@ function analyzeShellCommand(command) {
     if (lower2.startsWith("-")) allTokens.push(lower2.replace(/^-+/, ""));
   };
   try {
-    const f = sharedParser.Parse(command, "cmd");
-    syntax.Walk(f, (node) => {
+    const f = parseShared(command);
+    if (f === PARSE_FAIL) throw new Error("parse failed");
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const wordValues2 = (n.Args || []).map((arg) => {
         return (arg.Parts || []).map((p) => (p.Value ?? "").replace(/\\(.)/g, "$1")).join("");
       }).filter((s) => s.length > 0);
@@ -3181,7 +3232,7 @@ function runnablePrefix(command) {
   let text = command;
   for (let attempt = 0; attempt < 32; attempt++) {
     try {
-      return syntax2.NewParser().Parse(text, "");
+      return toPlainTree(syntax3.NewParser().Parse(text, ""));
     } catch (error) {
       const message = String(typeof error?.Error === "function" ? error.Error() : error?.message);
       const line = Number(/^(\d+):/.exec(message)?.[1]);
@@ -3249,7 +3300,7 @@ function wordValues(word, state) {
       out2 = next.slice(0, MAX_ALTERNATIVES);
     };
     for (const node of nodes) {
-      const kind = syntax2.NodeType(node);
+      const kind = node.kind;
       let pieces;
       if (kind === "ParamExp") pieces = paramValues(node, quoted);
       else if (kind === "DblQuoted") {
@@ -3317,9 +3368,9 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function substitutions(word, state, depth) {
     if (!word) return;
-    syntax2.Walk(word, (node) => {
+    walk(word, (node) => {
       if (!node) return false;
-      if (["CmdSubst", "ProcSubst"].includes(syntax2.NodeType(node))) {
+      if (["CmdSubst", "ProcSubst"].includes(node.kind)) {
         statements(node.Stmts ?? [], clone(state), depth + 1);
         return false;
       }
@@ -3743,7 +3794,7 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function readsScriptFromStdin(stmt) {
     const cmd = stmt?.Cmd;
-    if (!cmd || syntax2.NodeType(cmd) !== "CallExpr") return false;
+    if (!cmd || cmd.kind !== "CallExpr") return false;
     const words = (cmd.Args ?? []).map((a) => resolveWordLiteral(a));
     const head = unwrapCommandHead(words);
     return SHELL_INTERPRETERS.has(base(words[head])) && shellConsumesPipe(words.slice(head + 1));
@@ -3757,7 +3808,7 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function producedText(stmt) {
     const cmd = stmt?.Cmd;
-    if (!cmd || syntax2.NodeType(cmd) !== "CallExpr") return null;
+    if (!cmd || cmd.kind !== "CallExpr") return null;
     const words = (cmd.Args ?? []).map((a) => resolveWordLiteral(a));
     if (words.some((w) => w === null)) return null;
     const head = unwrapCommandHead(words);
@@ -3776,7 +3827,7 @@ function collectShellFileAccesses(command, context = {}) {
     if (!stmt || depth > MAX_DEPTH) return;
     state.onSuccess = void 0;
     if (stmt.Background) state = clone(state);
-    const headWord = stmt.Cmd && syntax2.NodeType(stmt.Cmd) === "CallExpr" ? base(resolveWordLiteral(stmt.Cmd.Args?.[0])) : "";
+    const headWord = stmt.Cmd && stmt.Cmd.kind === "CallExpr" ? base(resolveWordLiteral(stmt.Cmd.Args?.[0])) : "";
     const sends = SENDING_STDIN.has(headWord);
     for (const redir of stmt.Redirs ?? []) {
       substitutions(redir.Word, state, depth);
@@ -3792,7 +3843,7 @@ function collectShellFileAccesses(command, context = {}) {
     const cmd = stmt.Cmd;
     if (!cmd) return;
     stdinScript(stmt, state, depth);
-    switch (syntax2.NodeType(cmd)) {
+    switch (cmd.kind) {
       case "CallExpr":
         call(cmd, state, depth);
         break;
@@ -3806,7 +3857,7 @@ function collectShellFileAccesses(command, context = {}) {
         for (; ; ) {
           segments2.unshift({ op: node.Op, part: node.Y });
           const left = node.X;
-          if (left?.Cmd && syntax2.NodeType(left.Cmd) === "BinaryCmd" && !left.Redirs?.length && !left.Negated && !left.Background)
+          if (left?.Cmd && left.Cmd.kind === "BinaryCmd" && !left.Redirs?.length && !left.Negated && !left.Background)
             node = left.Cmd;
           else {
             segments2.unshift({ op: node.Op, part: left });
@@ -5144,11 +5195,10 @@ function shellWriteUnseen(command, target) {
   let unseen = false;
   let seen = false;
   try {
-    syntax4.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || unseen) return false;
       const n = node;
-      if (syntax4.NodeType(n) !== "Stmt" || !n.Cmd || syntax4.NodeType(n.Cmd) !== "CallExpr")
-        return true;
+      if (n.kind !== "Stmt" || !n.Cmd || n.Cmd.kind !== "CallExpr") return true;
       const words = (n.Cmd.Args || []).map(
         (a) => resolveWordLiteral(a)
       );
@@ -5203,14 +5253,14 @@ function analyzeGitImpl(command) {
     seen.add(key);
     findings.push(f);
   };
-  const walk2 = new GitWalk((inv) => classify(inv).forEach(found), found);
-  const parsed = walk2.run(command, 0);
+  const walk3 = new GitWalk((inv) => classify(inv).forEach(found), found);
+  const parsed = walk3.run(command, 0);
   return { parsed, findings };
 }
 function isPositionalParam(word) {
   let parts = word?.Parts || [];
-  if (parts.length === 1 && syntax5.NodeType(parts[0]) === "DblQuoted") parts = parts[0].Parts || [];
-  if (parts.length !== 1 || syntax5.NodeType(parts[0]) !== "ParamExp") return false;
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return false;
   return /^(\d+|@|\*)$/.test(parts[0].Param?.Value ?? "");
 }
 function boundPositionals() {
@@ -5224,11 +5274,11 @@ function boundPositionals() {
 function plainParamName(word) {
   let parts = word?.Parts || [];
   let quoted = false;
-  if (parts.length === 1 && syntax5.NodeType(parts[0]) === "DblQuoted") {
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") {
     parts = parts[0].Parts || [];
     quoted = true;
   }
-  if (parts.length !== 1 || syntax5.NodeType(parts[0]) !== "ParamExp") return null;
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return null;
   const p = parts[0];
   if (p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp) return null;
   const name = p.Param?.Value;
@@ -5253,7 +5303,7 @@ function resolveGitWords(word) {
   }
   const parts = word?.Parts || [];
   const expansion = parts.some((p) => {
-    const t = syntax5.NodeType(p);
+    const t = p.kind;
     return t === "ParamExp" || t === "CmdSubst";
   });
   return expansion ? splitFields(value) : [value];
@@ -5654,14 +5704,14 @@ function hookCommands(text) {
   const root = parsed?.hooks;
   if (!root || typeof root !== "object") return null;
   const out = [];
-  const walk2 = (v, depth) => {
+  const walk3 = (v, depth) => {
     if (depth > 8 || !v || typeof v !== "object") return;
     for (const [k, x] of Object.entries(v)) {
       if (k === "command" && typeof x === "string") out.push(x);
-      else walk2(x, depth + 1);
+      else walk3(x, depth + 1);
     }
   };
-  walk2(root, 0);
+  walk3(root, 0);
   return out;
 }
 function hooksDisarmed(text) {
@@ -5828,9 +5878,9 @@ function isDupInOp(op) {
   if (dupInOp === null) {
     let found = -1;
     try {
-      syntax6.Walk(parseShared("cat <&3"), (node) => {
+      walk(parseShared("cat <&3"), (node) => {
         const n = node;
-        if (found === -1 && n && syntax6.NodeType(n) === "Stmt" && n.Redirs?.[0]) {
+        if (found === -1 && n && n.kind === "Stmt" && n.Redirs?.[0]) {
           found = n.Redirs[0].Op;
         }
         return true;
@@ -5851,10 +5901,10 @@ function analyzeOutbound(command) {
     return hit;
   }
   const findings = [];
-  const walk2 = new OutboundWalk(findings);
-  const parsed = walk2.run(command, 0);
+  const walk3 = new OutboundWalk(findings);
+  const parsed = walk3.run(command, 0);
   const envOut = findings.find((f) => f.checkId === "data.env-exfil");
-  if (envOut) envOut.destinations = walk2.envDestinations();
+  if (envOut) envOut.destinations = walk3.envDestinations();
   const computed = { parsed, findings };
   if (cache2.size >= CACHE_MAX2) {
     const oldest = cache2.keys().next().value;
@@ -5870,7 +5920,7 @@ function wordShape(word) {
   const parts = word?.Parts || [];
   let out = "";
   for (const p of parts) {
-    const t = syntax6.NodeType(p);
+    const t = p.kind;
     if (t === "Lit" || t === "SglQuoted") out += p.Value ?? "";
     else if (t === "DblQuoted") out += wordShape(p);
     else out += "X";
@@ -6005,16 +6055,16 @@ function declDumpsEnv(decl) {
 }
 function paramName(word) {
   let parts = word?.Parts || [];
-  if (parts.length === 1 && syntax6.NodeType(parts[0]) === "DblQuoted") parts = parts[0].Parts || [];
-  if (parts.length !== 1 || syntax6.NodeType(parts[0]) !== "ParamExp") return null;
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return null;
   return parts[0].Param?.Value ?? null;
 }
 function refersTo(word, names) {
   let hit = false;
-  syntax6.Walk(word, (node) => {
+  walk(word, (node) => {
     if (hit || !node) return false;
     const n = node;
-    if (syntax6.NodeType(n) === "ParamExp" && names.has(n.Param?.Value)) hit = true;
+    if (n.kind === "ParamExp" && names.has(n.Param?.Value)) hit = true;
     return !hit;
   });
   return hit;
@@ -6022,10 +6072,10 @@ function refersTo(word, names) {
 function runsCommandsIn(stmt) {
   const readVars = /* @__PURE__ */ new Set();
   let hit = false;
-  syntax6.Walk(stmt, (node) => {
+  walk(stmt, (node) => {
     if (hit || !node) return false;
     const n = node;
-    if (syntax6.NodeType(n) !== "CallExpr") return true;
+    if (n.kind !== "CallExpr") return true;
     const words = wordsOf(n);
     if (words.length === 0) return true;
     const { head, at } = headOf(words);
@@ -6602,7 +6652,7 @@ function localContexts(file2) {
     if (depth > 64) return null;
     if (!stmt || stmt.Background || stmt.Negated || stmt.Redirs?.length) return null;
     const cmd = stmt.Cmd;
-    const kind = syntax7.NodeType(cmd);
+    const kind = cmd.kind;
     if (kind === "BinaryCmd" && cmd.Op === andOp) {
       const next = visit(cmd.X, steps, depth + 1);
       return next === null ? null : visit(cmd.Y, next, depth + 1);
@@ -6618,7 +6668,7 @@ function localContexts(file2) {
       )
     ))
       return null;
-    contexts.set(cmd.Pos().Offset(), steps);
+    contexts.set(cmd.pos, steps);
     return null;
   }
   if (file2.Stmts?.length === 1) visit(file2.Stmts[0], []);
@@ -6629,12 +6679,12 @@ function collect(command, out, depth) {
   const f = parseShared(command);
   if (typeof f === "symbol") return;
   const contexts = depth === 0 ? localContexts(f) : /* @__PURE__ */ new Map();
-  syntax7.Walk(f, (node) => {
-    if (node && syntax7.NodeType(node) === "CallExpr") {
+  walk(f, (node) => {
+    if (node && node.kind === "CallExpr") {
       const words = (node.Args || []).map((a) => resolveWordLiteral(a));
       const start = out.length;
       if (words.length > 0) fromCall(words, out, depth);
-      const steps = contexts.get(node.Pos().Offset());
+      const steps = contexts.get(node.pos);
       for (let i = start; i < out.length; i++) {
         if (["npx", "bunx", "npm exec"].includes(out[i].manager)) {
           if (!steps) out[i].localCwd = null;
@@ -6681,7 +6731,7 @@ function collect2(command, out, depth) {
   try {
     walkCommandScope(command, (node) => {
       const n = node;
-      if (!n || syntax8.NodeType(n) !== "CallExpr") return true;
+      if (!n || n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const prefix = (n.Assigns || []).filter((a) => a?.Name?.Value).map(
@@ -8066,12 +8116,12 @@ function extractContentDestinations(text) {
 function extractArgDestinations(args) {
   const out = /* @__PURE__ */ new Set();
   try {
-    walk(args, void 0, out, 0);
+    walk2(args, void 0, out, 0);
   } catch {
   }
   return [...out];
 }
-function walk(value, key, out, depth) {
+function walk2(value, key, out, depth) {
   if (out.size >= MAX_DESTINATIONS || depth > 12) return;
   if (typeof value === "string") {
     const s = value.length > MAX_SCAN_CHARS ? value.slice(0, MAX_SCAN_CHARS) : value;
@@ -8090,12 +8140,12 @@ function walk(value, key, out, depth) {
     return;
   }
   if (Array.isArray(value)) {
-    for (const v of value) walk(v, key, out, depth + 1);
+    for (const v of value) walk2(v, key, out, depth + 1);
     return;
   }
   if (value && typeof value === "object") {
     for (const [k, v] of Object.entries(value))
-      walk(v, k, out, depth + 1);
+      walk2(v, k, out, depth + 1);
   }
 }
 function destinationDomain(dest) {
@@ -8747,9 +8797,9 @@ function classifyCall(head, args, prefixes, env, state, out) {
 function walkCalls(command, out, depth, state) {
   const f = parseShared(command);
   if (typeof f === "symbol" || !f) return;
-  syntax9.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node) return false;
-    const type = syntax9.NodeType(node);
+    const type = node.kind;
     if (type === "DeclClause") {
       for (const a of node.Args || []) if (a?.Name?.Value) state.env.add(a.Name.Value);
       return true;
@@ -8890,7 +8940,7 @@ function matchCanaryArgs(args, values) {
   if (values.length === 0) return null;
   const needles = prepare(values);
   if (needles.length === 0) return null;
-  const walk2 = (v, depth, fieldPath) => {
+  const walk3 = (v, depth, fieldPath) => {
     if (depth > MAX_DEPTH4) return null;
     if (typeof v === "string") {
       const hit = matchPrepared(v, needles);
@@ -8899,31 +8949,31 @@ function matchCanaryArgs(args, values) {
         const trimmed = v.trim();
         if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
           try {
-            return walk2(JSON.parse(v), depth + 1, fieldPath);
+            return walk3(JSON.parse(v), depth + 1, fieldPath);
           } catch {
           }
         }
       }
       return null;
     }
-    if (typeof v === "number" && Number.isFinite(v)) return walk2(String(v), depth, fieldPath);
+    if (typeof v === "number" && Number.isFinite(v)) return walk3(String(v), depth, fieldPath);
     if (Array.isArray(v)) {
       for (let i = 0; i < v.length; i++) {
-        const h = walk2(v[i], depth + 1, `${fieldPath}[${i}]`);
+        const h = walk3(v[i], depth + 1, `${fieldPath}[${i}]`);
         if (h) return h;
       }
       return null;
     }
     if (v && typeof v === "object") {
       for (const [k, child] of Object.entries(v)) {
-        const h = walk2(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        const h = walk3(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
         if (h) return h;
       }
     }
     return null;
   };
   try {
-    return walk2(args, 0, "");
+    return walk3(args, 0, "");
   } catch (e) {
     console.error(
       "[node9 engine] canary args walk failed:",
@@ -8932,7 +8982,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, APPENDS, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, syntax3, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, syntax4, RDR_IN, COPY_VERBS2, LITERAL_VERBS, syntax5, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, syntax6, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, syntax7, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, syntax8, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax9, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax2, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax3, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, APPENDS, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -11580,6 +11630,61 @@ var init_dist = __esm({
         return s.untrustedContent.afterExposure === "log-only" ? "log" : "review";
       }
     };
+    ({ syntax } = mvdanSh);
+    KINDS = {
+      File: { nodes: ["Stmts"] },
+      Stmt: { nodes: ["Cmd", "Redirs"], scalars: ["Negated", "Background", "Coprocess"] },
+      CallExpr: { nodes: ["Assigns", "Args"] },
+      Assign: { nodes: ["Name", "Value", "Index", "Array"], scalars: ["Append", "Naked"] },
+      Word: { nodes: ["Parts"] },
+      Lit: { scalars: ["Value"] },
+      SglQuoted: { scalars: ["Value", "Dollar"] },
+      DblQuoted: { nodes: ["Parts"], scalars: ["Dollar"] },
+      ParamExp: {
+        nodes: ["Param", "Index", "Slice", "Repl", "Exp"],
+        scalars: ["Short", "Excl", "Length", "Width"]
+      },
+      CmdSubst: { nodes: ["Stmts"], scalars: ["Backquotes", "TempFile", "ReplyVar"] },
+      ArithmExp: { nodes: ["X"], scalars: ["Bracket", "Unsigned"] },
+      ArithmCmd: { nodes: ["X"], scalars: ["Unsigned"] },
+      ProcSubst: { nodes: ["Stmts"], scalars: ["Op"] },
+      ExtGlob: { nodes: ["Pattern"], scalars: ["Op"] },
+      BraceExp: { nodes: ["Elems"], scalars: ["Sequence"] },
+      // only with SplitBraces, unused here
+      BinaryCmd: { nodes: ["X", "Y"], scalars: ["Op"] },
+      BinaryArithm: { nodes: ["X", "Y"], scalars: ["Op"] },
+      UnaryArithm: { nodes: ["X"], scalars: ["Op", "Post"] },
+      ParenArithm: { nodes: ["X"] },
+      BinaryTest: { nodes: ["X", "Y"], scalars: ["Op"] },
+      UnaryTest: { nodes: ["X"], scalars: ["Op"] },
+      ParenTest: { nodes: ["X"] },
+      Redirect: { nodes: ["N", "Word", "Hdoc"], scalars: ["Op"] },
+      Block: { nodes: ["Stmts"] },
+      Subshell: { nodes: ["Stmts"] },
+      IfClause: { nodes: ["Cond", "Then", "Else"] },
+      WhileClause: { nodes: ["Cond", "Do"], scalars: ["Until"] },
+      ForClause: { nodes: ["Loop", "Do"], scalars: ["Select"] },
+      WordIter: { nodes: ["Name", "Items"] },
+      CStyleLoop: { nodes: ["Init", "Cond", "Post"] },
+      CaseClause: { nodes: ["Word", "Items"] },
+      CaseItem: { nodes: ["Patterns", "Stmts"], scalars: ["Op"] },
+      FuncDecl: { nodes: ["Name", "Body"], scalars: ["RsrvWord"] },
+      DeclClause: { nodes: ["Variant", "Args"], notWalked: ["Variant"] },
+      LetClause: { nodes: ["Exprs"] },
+      TimeClause: { nodes: ["Stmt"], scalars: ["PosixFormat"] },
+      CoprocClause: { nodes: ["Name", "Stmt"] },
+      TestClause: { nodes: ["X"] },
+      TestDecl: { nodes: ["Description", "Body"] },
+      ArrayExpr: { nodes: ["Elems"] },
+      ArrayElem: { nodes: ["Index", "Value"] },
+      Comment: { scalars: ["Text"] }
+    };
+    STRUCTS = {
+      "ParamExp.Slice": { nodes: ["Offset", "Length"], notWalked: ["Offset", "Length"] },
+      "ParamExp.Repl": { nodes: ["Orig", "With"], scalars: ["All"] },
+      "ParamExp.Exp": { nodes: ["Word"], scalars: ["Op"] }
+    };
+    unknownKinds = /* @__PURE__ */ new Set();
     INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
     INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
     HOMOGLYPHS = {
@@ -11865,8 +11970,8 @@ var init_dist = __esm({
       php: PHP
     };
     STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
-    ({ syntax } = mvdanSh);
-    sharedParser = syntax.NewParser();
+    ({ syntax: syntax2 } = mvdanSh2);
+    sharedParser = syntax2.NewParser();
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
       "-m",
       "--message",
@@ -11900,7 +12005,7 @@ var init_dist = __esm({
     NORMALIZE_CACHE_MAX = 5e3;
     normalizeCache = /* @__PURE__ */ new Map();
     codeBodiesCache = /* @__PURE__ */ new Map();
-    AST_CACHE_MAX = 5e3;
+    AST_CACHE_MAX = 256;
     astCache = /* @__PURE__ */ new Map();
     PARSE_FAIL = /* @__PURE__ */ Symbol("parse-fail");
     INTERPRETER_LINE = /^#![ \t]*[\w./+-]+(?:[ \t]+[\w./+=:-]+)*[ \t]*\r?(?=\n|$)/;
@@ -12885,7 +12990,7 @@ var init_dist = __esm({
     ARGV_FIELDS = ["args", "argv"];
     BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
     MAX_ARGV_CHARACTERS = 262144;
-    ({ syntax: syntax2 } = mvdanSh2);
+    ({ syntax: syntax3 } = mvdanSh3);
     MAX_ALTERNATIVES = 64;
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
@@ -12977,7 +13082,6 @@ var init_dist = __esm({
     );
     exempt = (p) => SYSTEM_DIRS_EXEMPT.some((d) => within(p, d));
     RANK = { allow: 0, review: 1, block: 2 };
-    ({ syntax: syntax3 } = mvdanSh3);
     SEQUENCE_OPS = (() => {
       const ops = /* @__PURE__ */ new Set();
       for (const text of ["x && y", "x || y"]) {
@@ -16138,7 +16242,6 @@ zoo`.split("\n");
     );
     NEVER_NEGATED = /* @__PURE__ */ new Set([SIGNALS[1].any[0]]);
     NEGATION_BEFORE = /\b(never|do not|don'?t|must not|mustn'?t|should not|shouldn'?t|not allowed to|forbidden to|avoid|without|no|not)\b[^.!?;:\n]{0,24}$/i;
-    ({ syntax: syntax4 } = mvdanSh4);
     RDR_IN = (() => {
       try {
         return parseShared("x <y").Stmts[0].Redirs[0].Op;
@@ -16167,7 +16270,6 @@ zoo`.split("\n");
       "tar"
     ]);
     LITERAL_VERBS = /* @__PURE__ */ new Set(["echo", "printf", ":", "true", "touch", "sed"]);
-    ({ syntax: syntax5 } = mvdanSh5);
     GIT_PRESCREEN_RE = /git|husky/i;
     MAX_PAYLOAD_DEPTH2 = 8;
     MAX_ALIAS_DEPTH = 5;
@@ -16236,7 +16338,7 @@ zoo`.split("\n");
       visit(node, depth) {
         if (!node) return false;
         const n = node;
-        const type = syntax5.NodeType(n);
+        const type = n.kind;
         if (type === "Stmt") {
           this.visitHeredocShell(n, depth);
           return true;
@@ -16244,7 +16346,7 @@ zoo`.split("\n");
         if (type === "ForClause") {
           const loop = n.Loop;
           const name = loop?.Name?.Value;
-          if (name && syntax5.NodeType(loop) === "WordIter") {
+          if (name && loop.kind === "WordIter") {
             const items = (loop.Items || []).map((w) => resolveWordLiteral(w));
             const literal = items.length > 0 && items.every((v) => v !== null);
             this.loopVars.set(name, literal ? items.slice(0, MAX_LOOP_ITEMS) : null);
@@ -16311,7 +16413,7 @@ zoo`.split("\n");
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       visitHeredocShell(stmt, depth) {
         const cmd = stmt.Cmd;
-        if (!cmd || syntax5.NodeType(cmd) !== "CallExpr" || depth >= MAX_PAYLOAD_DEPTH2) return;
+        if (!cmd || cmd.kind !== "CallExpr" || depth >= MAX_PAYLOAD_DEPTH2) return;
         const redirs = stmt.Redirs || [];
         const hdoc = redirs.find((r) => r?.Hdoc && (r.N == null || r.N.Value === "0"));
         if (!hdoc) return;
@@ -16565,7 +16667,6 @@ zoo`.split("\n");
     ]);
     SETTINGS_RE = /\/(?:\.claude\/settings(?:\.local)?\.json|\.gemini\/settings\.json|\.codex\/hooks\.json|\.cursor\/hooks\.json)$/i;
     HOOK_WORDS_RE = /"hooks"|\b(PreToolUse|PostToolUse|UserPromptSubmit|Notification|Stop|SubagentStop|SessionStart|SessionEnd|PreCompact|BeforeTool|AfterTool)\b|"command"\s*:/;
-    ({ syntax: syntax6 } = mvdanSh6);
     SHELLS = /* @__PURE__ */ new Set([...SHELL_INTERPRETERS, "mksh", "ash", "csh", "tcsh"]);
     NETCATS = /* @__PURE__ */ new Set(["nc", "ncat", "netcat", "nc.traditional", "nc.openbsd"]);
     NET_CLIENTS = /* @__PURE__ */ new Set([...NETCATS, "telnet", "socat"]);
@@ -16623,7 +16724,7 @@ zoo`.split("\n");
         const f = parseShared(command);
         if (!f || typeof f !== "object" || !f.Stmts) return false;
         try {
-          syntax6.Walk(f, (node) => this.visit(node, depth));
+          walk(f, (node) => this.visit(node, depth));
         } catch {
           return false;
         }
@@ -16662,7 +16763,7 @@ zoo`.split("\n");
       }
       visit(n, depth) {
         if (!n) return false;
-        const type = syntax6.NodeType(n);
+        const type = n.kind;
         if (type === "Stmt") {
           this.visitStmt(n, depth);
           return true;
@@ -16682,7 +16783,7 @@ zoo`.split("\n");
         const redirs = redirectWords(stmt);
         const toSocket = redirs.some((w) => w !== null && DEV_NET_RE.test(w));
         if (!cmd) return;
-        const type = syntax6.NodeType(cmd);
+        const type = cmd.kind;
         if (type !== "CallExpr" || wordsOf(cmd).length > 0) {
           if (this.readsNetFd(stmt) && runsCommandsIn(stmt)) {
             this.reverseShell("commands are read from a network socket opened with exec");
@@ -16768,7 +16869,7 @@ zoo`.split("\n");
         const stages = [];
         const flatten = (s) => {
           const c = s?.Cmd;
-          if (c && syntax6.NodeType(c) === "BinaryCmd" && isPipeOp(c.Op)) {
+          if (c && c.kind === "BinaryCmd" && isPipeOp(c.Op)) {
             flatten(c.X);
             flatten(c.Y);
           } else stages.push(s);
@@ -16790,8 +16891,8 @@ zoo`.split("\n");
             sinks.set(i, socketHosts(st));
           }
           if (!c) return;
-          if (syntax6.NodeType(c) === "DeclClause" && declDumpsEnv(c) && dump < 0) dump = i;
-          if (syntax6.NodeType(c) !== "CallExpr") {
+          if (c.kind === "DeclClause" && declDumpsEnv(c) && dump < 0) dump = i;
+          if (c.kind !== "CallExpr") {
             if (runsCommandsIn(st)) shell = i;
             return;
           }
@@ -16832,10 +16933,10 @@ zoo`.split("\n");
       /** A word (or assignment value) whose text includes an env dump's output. */
       carriesEnv(word) {
         let hit = false;
-        syntax6.Walk(word, (node) => {
+        walk(word, (node) => {
           if (hit || !node) return false;
           const n = node;
-          const t = syntax6.NodeType(n);
+          const t = n.kind;
           if (t === "ParamExp" && n.Param?.Value && this.envVars.has(n.Param.Value)) {
             hit = true;
             return false;
@@ -16852,11 +16953,11 @@ zoo`.split("\n");
       stmtsDumpEnv(stmts) {
         let hit = false;
         for (const s of stmts) {
-          syntax6.Walk(s, (node) => {
+          walk(s, (node) => {
             if (hit || !node) return false;
             const n = node;
-            const t = syntax6.NodeType(n);
-            if (t === "Stmt" && n.Cmd && syntax6.NodeType(n.Cmd) === "CallExpr") {
+            const t = n.kind;
+            if (t === "Stmt" && n.Cmd && n.Cmd.kind === "CallExpr") {
               const words = wordsOf(n.Cmd);
               if (words.length > 0 && dumpsEnv(words, n)) hit = true;
             }
@@ -16873,7 +16974,6 @@ zoo`.split("\n");
         this.run(payload, depth + 1);
       }
     };
-    ({ syntax: syntax7 } = mvdanSh7);
     NPM_INSTALL_VERBS = /* @__PURE__ */ new Set([
       "install",
       "i",
@@ -17255,7 +17355,6 @@ zoo`.split("\n");
     SHELLS2 = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh", "ash"]);
     MAX_NESTING = 3;
     SHELL_VALUE_FLAGS = /* @__PURE__ */ new Set(["--rcfile", "--init-file", "-O", "+O", "-o", "+o"]);
-    ({ syntax: syntax8 } = mvdanSh8);
     NPM_FAMILY = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun", "npx", "pnpx", "bunx"]);
     PIP_FAMILY = /* @__PURE__ */ new Set(["pip", "pip3", "uv", "uvx", "pipx", "pipenv"]);
     NPM_FETCH_VERBS = /* @__PURE__ */ new Set([
@@ -17787,7 +17886,6 @@ zoo`.split("\n");
     ACCOUNT_KEY_RE = /("(?:iban|account|account_number|accountNumber)"\s*:\s*")([A-Za-z0-9 .-]{6,40})(")/g;
     ACCOUNT_VALUE_RE = /"([A-Z]{2}\d{2}[A-Z0-9]{11,30})"/g;
     MAX_MASK_DEPTH = 64;
-    ({ syntax: syntax9 } = mvdanSh9);
     EMPTY = {
       fetches: false,
       sends: false,