poe-code 15.0.4 → 15.0.5

package/packages/safe-bash/dist/core.browser.js

@@ -2,10 +2,9 @@ import {
   createXmlCommands,
   defaultXmlQueryLimits,
   xmlCommands
-} from "./chunks/chunk-5MSOBYRG.js";
+} from "./chunks/chunk-IKATLB4I.js";
 import {
   Interpreter,
-  createOutputOperation,
   createYqCommand,
   createYqCommands,
   jsonValues,
@@ -14,14 +13,43 @@ import {
   rawValues,
   stringify,
   yqCommands
-} from "./chunks/chunk-NYHAKXQ7.js";
+} from "./chunks/chunk-6MHYEBAJ.js";
 import {
   Budget,
+  JqError,
+  JqLimitError,
+  copyObject,
+  defaultJqLimits,
+  interruptible,
+  object,
+  put,
+  resolveJqLimits,
+  truth,
+  wellFormed
+} from "./chunks/chunk-54Z5EUCW.js";
+import {
+  CurlError,
+  bindFileOutputBudget,
+  cloudflareWorkerNetworkLimits,
+  createCurlCommand,
+  createCurlCommands,
+  createFetchTransport,
+  createNetworkCommands,
+  createOriginAuthorizer,
+  createWgetCommand,
+  curlCommands,
+  defaultNetworkLimits,
+  networkCommands,
+  openFileOutput,
+  writeFileOutput
+} from "./chunks/chunk-UGMUVHIY.js";
+import {
+  createOutputOperation
+} from "./chunks/chunk-2GV4WO7O.js";
+import {
   CommandArgumentIdentityError,
   CommandRegistry,
   FsError,
-  JqError,
-  JqLimitError,
   PublicDiagnostic,
   RecordBuffer,
   UsageError,
@@ -35,11 +63,9 @@ import {
   collectText,
   concatShellValues,
   concatenate,
-  copyObject,
   createBytePipe,
   createCommandArguments,
   decoder,
-  defaultJqLimits,
   define,
   diagnostic,
   dirname,
@@ -55,7 +81,6 @@ import {
   input,
   inputRequirements,
   integer,
-  interruptible,
   isAbsolutePath,
   isErrnoCode,
   isFsError,
@@ -63,7 +88,6 @@ import {
   joinPath,
   lines,
   monotonicNow,
-  object,
   options,
   output,
   outputFailure,
@@ -71,14 +95,12 @@ import {
   pipeBytes,
   predicateRequirements,
   publicDiagnosticMessage,
-  put,
   pwdRequirements,
   readBytes,
   registerYieldCheckpoint,
   relativePath,
   replaceArgument,
   requireOperands,
-  resolveJqLimits,
   resolvePath,
   scheduleTurn,
   shellValueByteLength,
@@ -89,16 +111,14 @@ import {
   textOutputRequirements,
   toByteSource,
   toFsError,
-  truth,
   validateExitCode,
   validatePath,
   value,
-  wellFormed,
   writeBytes,
   writeDiagnostic,
   writeText,
   yieldTurn
-} from "./chunks/chunk-5OCQTFXT.js";
+} from "./chunks/chunk-LUJYX5H5.js";
 
 // packages/safe-bash/src/core.browser.ts
 init_platform();
@@ -3442,182 +3462,6 @@ function filesystemCommands(maxDirectoryEntries) {
 // packages/safe-bash/src/commands/streams.ts
 init_platform();
 
-// packages/safe-bash/src/contracts/filesystem-output.ts
-init_platform();
-var filesystemOutputBudgets = /* @__PURE__ */ new WeakMap();
-function bindFileOutputBudget(context2, budget) {
-  if (!context2.registerCleanup) throw new TypeError("Shell output budgets require invocation cleanup ownership");
-  filesystemOutputBudgets.set(context2.registerCleanup, budget);
-}
-async function writeFileOutput(context2, bytes3, write2) {
-  context2.signal.throwIfAborted();
-  const budget = context2.registerCleanup && filesystemOutputBudgets.get(context2.registerCleanup);
-  let pending;
-  const destination2 = { write(chunk) {
-    context2.signal.throwIfAborted();
-    return pending = (async () => {
-      await write2(chunk);
-    })();
-  } };
-  try {
-    await (budget?.(destination2) ?? destination2).write(bytes3);
-  } catch (error) {
-    await pending?.catch(() => {
-    });
-    context2.signal.throwIfAborted();
-    throw error;
-  }
-  context2.signal.throwIfAborted();
-}
-async function openFileOutput(context2, path, flag, incremental) {
-  let pipe;
-  let task;
-  let completed = false;
-  let ended = false;
-  let closing = false;
-  let failure;
-  const consumer = new AbortController();
-  let writes = Promise.resolve();
-  let acknowledge;
-  const acknowledgeWrite = () => {
-    const accepted = acknowledge;
-    acknowledge = void 0;
-    accepted?.();
-  };
-  let ready;
-  const opened = new Promise((resolve) => {
-    ready = resolve;
-  });
-  const destination2 = {
-    [outputFailure]: (reason) => operation2.abort(reason),
-    async write(chunk) {
-      if (closing) throw new FsError("EBADF", { path, syscall: "write" });
-      const writing = writes.then(async () => {
-        for (let offset = 0; offset < chunk.byteLength; offset += 64 * 1024) {
-          const accepted = new Promise((resolve) => {
-            acknowledge = resolve;
-          });
-          await pipe.writable.write(chunk.subarray(offset, offset + 64 * 1024));
-          await accepted;
-          if (failure) throw failure.reason;
-          operation2.signal.throwIfAborted();
-        }
-      });
-      writes = writing.catch(() => {
-      });
-      await writing;
-    }
-  };
-  const budget = context2.registerCleanup && filesystemOutputBudgets.get(context2.registerCleanup);
-  const operation2 = createOutputOperation(context2, budget?.(destination2) ?? destination2);
-  operation2.registerCleanup(async () => {
-    closing = true;
-    if (!completed) {
-      void operation2.abort(operation2.signal.aborted ? operation2.signal.reason : new FsError("ECANCELED", { path, syscall: "write" }));
-      await pipe?.abort(operation2.signal.reason);
-    }
-    await task?.catch(() => {
-    });
-    await writes;
-  });
-  try {
-    pipe = createBytePipe({ highWaterMark: 1, signal: operation2.signal });
-    let reading = false;
-    const source2 = {
-      [Symbol.asyncIterator]() {
-        return (async function* () {
-          reading = true;
-          ready();
-          for await (const chunk of pipe.readable) {
-            yield chunk;
-            acknowledgeWrite();
-          }
-          operation2.signal.throwIfAborted();
-          ended = true;
-        })();
-      }
-    };
-    task = (async () => {
-      const { fs } = context2;
-      const signal = operation2.signal;
-      signal.throwIfAborted();
-      const capabilities = await fs.capabilitiesFor?.(path, { signal }) ?? fs.capabilities;
-      if (capabilities.readOnly === true) throw new FsError("EROFS", { path, syscall: "write" });
-      try {
-        await fs.access(path, 2, { signal });
-      } catch (error) {
-        signal.throwIfAborted();
-        if (!(error instanceof FsError) || error.code !== "ENOENT" && error.code !== "ENOTSUP") throw error;
-      }
-      signal.throwIfAborted();
-      const streaming = flag === "a" ? capabilities.streamingAppend ?? capabilities.streamingWrite : capabilities.streamingWrite;
-      if ((!incremental || capabilities.descriptorWriteStream === true) && streaming !== false && fs.writeStream) {
-        try {
-          await fs.writeStream(path, source2, { flag, signal });
-          if (!ended) throw new FsError("EIO", { path, message: "Streaming writer returned before consuming output" });
-          return;
-        } catch (error) {
-          signal.throwIfAborted();
-          if (reading || !(error instanceof FsError) || error.code !== "ENOTSUP") throw error;
-        }
-      }
-      if (flag === "w" && capabilities.write === false) throw new FsError("ENOTSUP", { path, syscall: "writeFile" });
-      if ((!incremental || flag === "a") && capabilities.append === false) throw new FsError("ENOTSUP", { path, syscall: "appendFile" });
-      const sink = incremental ? await incremental() : await (async () => {
-        if (flag === "a") await fs.appendFile(path, new Uint8Array(), { signal });
-        else await fs.writeFile(path, new Uint8Array(), { flag, signal });
-        return { write: (chunk) => fs.appendFile(path, chunk, { signal }) };
-      })();
-      for await (const chunk of source2) {
-        signal.throwIfAborted();
-        await sink.write(chunk);
-      }
-    })();
-    void task.then(acknowledgeWrite, (error) => {
-      failure = { reason: error };
-      acknowledgeWrite();
-      if (!operation2.signal.aborted) consumer.abort(error);
-      void operation2.abort(error).catch(() => {
-      });
-    });
-    await Promise.race([opened, task]);
-    operation2.signal.throwIfAborted();
-    const write2 = async (chunk) => {
-      try {
-        await operation2.output.write(chunk);
-      } catch (error) {
-        throw failure ? failure.reason : error;
-      }
-    };
-    return {
-      signal: operation2.signal,
-      sink: {
-        [outputFailure]: destination2[outputFailure],
-        ownedOutput: { consumerClosed: consumer.signal, write: write2 },
-        write: write2
-      },
-      async finish() {
-        closing = true;
-        try {
-          await writes;
-          await pipe.close();
-          await task;
-          operation2.signal.throwIfAborted();
-          completed = true;
-        } catch (error) {
-          throw failure ? failure.reason : error;
-        } finally {
-          await operation2.close();
-        }
-      },
-      abort: (reason) => operation2.abort(reason)
-    };
-  } catch (error) {
-    await operation2.abort(error);
-    throw error;
-  }
-}
-
 // packages/safe-bash/src/commands/tail-follow.ts
 init_platform();
 var tailFollowScheduler = {
@@ -33508,8 +33352,8 @@ async function entities(text3, budget) {
       const name2 = match[1];
       if (name2[0] !== "#") result2.append(Object.hasOwn(named, name2) ? named[name2] : match[0]);
       else {
-        const hexadecimal = name2[1]?.toLowerCase() === "x";
-        const value2 = Number.parseInt(name2.slice(hexadecimal ? 2 : 1), hexadecimal ? 16 : 10);
+        const hexadecimal2 = name2[1]?.toLowerCase() === "x";
+        const value2 = Number.parseInt(name2.slice(hexadecimal2 ? 2 : 1), hexadecimal2 ? 16 : 10);
         result2.append(value2 === 0 || value2 > 1114111 || value2 >= 55296 && value2 <= 57343 ? "\uFFFD" : String.fromCodePoint(value2));
       }
       offset += match[0].length;
@@ -37498,12 +37342,23 @@ function literalIndex(source2, offset, budget = new ParseBudget()) {
   return { decimal: decimal4 };
 }
 function numericIndex(index) {
+  if (index.source !== void 0) {
+    try {
+      return numericIndex(literalIndex(index.source, 0));
+    } catch {
+      return void 0;
+    }
+  }
   if (index.decimal.length > 10 || index.decimal.length === 10 && index.decimal > "2147483647") return void 0;
   return Number(index.decimal);
 }
-function arraySelector(source2, offset, budget = new ParseBudget()) {
+function stringIndex(source2, budget, word) {
+  budget.admit(2);
+  return { decimal: source2, source: source2, ...word ? { word } : {} };
+}
+function arraySelector(source2, offset, budget = new ParseBudget(), word) {
   budget.admit();
-  return source2 === "@" || source2 === "*" ? { kind: "members", separator: source2 } : { kind: "element", index: literalIndex(source2, offset, budget) };
+  return source2 === "@" || source2 === "*" ? { kind: "members", separator: source2 } : { kind: "element", index: word ? stringIndex(source2, budget, word) : literalIndex(source2, offset, budget) };
 }
 function setArraySelector(part, selector) {
   selectors.set(part, selector);
@@ -37543,21 +37398,22 @@ function removePrefix(word, length, budget) {
   if (length !== 0) throw new ShellSyntaxError("Invalid indexed-array assignment", word.offset);
   return { offset: word.offset, parts };
 }
-function elementAssignment(word, budget = new ParseBudget()) {
+function elementAssignment(word, budget = new ParseBudget(), parseWord, subscriptEnd) {
   const source2 = word.spelling;
   const first = word.parts[0];
   if (source2 === void 0 || first?.kind !== "text" || first.quoted) return void 0;
   const name2 = /^([a-zA-Z_][a-zA-Z_0-9]*)\[/u.exec(source2)?.[1];
   if (!name2) return void 0;
-  const end = source2.indexOf("]", name2.length + 1);
+  const end = subscriptEnd ? subscriptEnd(source2, name2.length + 1) : source2.indexOf("]", name2.length + 1);
   if (end < 0 || !/^(?:\+?=)/u.test(source2.slice(end + 1))) {
     if (source2.includes("=")) throw new ShellSyntaxError("Invalid indexed-array assignment", word.offset);
     return void 0;
   }
   budget.admit();
-  const index = literalIndex(source2.slice(name2.length + 1, end), word.offset + name2.length + 1, budget);
+  const keySource = source2.slice(name2.length + 1, end);
+  const index = parseWord ? stringIndex(keySource, budget, parseWord(keySource)) : literalIndex(keySource, word.offset + name2.length + 1, budget);
   const append = source2[end + 1] === "+";
-  const value2 = removePrefix(word, name2.length + index.decimal.length + (append ? 4 : 3), budget);
+  const value2 = parseWord ? parseWord(source2.slice(end + (append ? 3 : 2))) : removePrefix(word, name2.length + index.decimal.length + (append ? 4 : 3), budget);
   return { kind: "element", name: name2, index, append, value: value2 };
 }
 function compoundHead(word, budget = new ParseBudget()) {
@@ -38126,7 +37982,8 @@ shell: command substitution: line ${line}: \`${sourceLine}'
           } else if (!literal && (inner === "$" || inner === "`")) {
             this.expansion(parts, true);
             const part = parts.at(-1);
-            nameListing ||= part.kind === "variable" && part.prefixNames === "@";
+            const selector = getArraySelector(part);
+            nameListing ||= part.kind === "variable" && (part.prefixNames === "@" || !!part.transform && (part.name === "@" || selector?.kind === "members" && selector.separator === "@"));
           } else if (inner === "\\" && /[$`"\\\n]/u.test(this.source[this.position + 1] ?? "")) {
             const escaped3 = this.source[this.position + 1];
             if (escaped3 !== "\n") text3(escaped3, true, false, this.position, this.position + 2);
@@ -38315,7 +38172,7 @@ shell: command substitution: line ${line}: \`${sourceLine}'
       if (!name2) this.error("Unsupported parameter expansion");
       this.position += name2.length;
       let prefixNames;
-      if (listing) {
+      if (listing && this.source[this.position] !== "[") {
         const separator = this.source[this.position];
         if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2) || separator !== "*" && separator !== "@" || this.source[this.position + 1] !== "}") this.error("Unsupported indirect parameter expansion");
         prefixNames = separator;
@@ -38325,11 +38182,20 @@ shell: command substitution: line ${line}: \`${sourceLine}'
       if (this.source[this.position] === "[") {
         if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) this.error("Unsupported indexed-array parameter");
         const start = ++this.position;
-        const end = this.source.indexOf("]", start);
-        if (end < 0) this.error("Unterminated indexed-array subscript");
-        selector = arraySelector(this.source.slice(start, end), start, this.budget);
+        const keyWord = this.word("]");
+        const end = this.position;
+        if (this.source[end] !== "]") this.error("Unterminated indexed-array subscript");
+        selector = arraySelector(this.source.slice(start, end), start, this.budget, keyWord);
         this.position = end + 1;
-        if (this.source[this.position] !== "}") this.error("Unsupported indexed-array operator");
+        if (this.source[this.position] !== "}" && this.source[this.position] !== "@") this.error("Unsupported indexed-array operator");
+      }
+      if (listing && selector?.kind === "element") this.error("Unsupported indirect parameter expansion");
+      let transform2;
+      if (this.source[this.position] === "@") {
+        const operation2 = this.source[this.position + 1];
+        if (length || prefixNames || operation2 !== "Q" && operation2 !== "E" || this.source[this.position + 2] !== "}") this.error("Unsupported parameter transform");
+        transform2 = operation2;
+        this.position += 2;
       }
       const operator = /^(?::[-=+?]|##|%%|\/\/|\/[#%]?|[-=+?#%])/u.exec(this.source.slice(this.position))?.[0];
       let alternate;
@@ -38373,7 +38239,8 @@ shell: command substitution: line ${line}: \`${sourceLine}'
         parts.push({ kind: "failed-parameter", source: this.source.slice(parameterStart, this.position), line, quoted: quoted2 });
       } else {
         this.position++;
-        const part = { kind: "variable", name: name2, quoted: quoted2, line, ...prefixNames ? { prefixNames } : {}, ...length ? { length } : {}, ...operator ? { operator, alternate } : {}, ...replacement ? { replacement } : {}, ...substring ? { substring } : {} };
+        const part = { kind: "variable", name: name2, quoted: quoted2, line, ...prefixNames ? { prefixNames } : {}, ...transform2 ? { transform: transform2 } : {}, ...length ? { length } : {}, ...operator ? { operator, alternate } : {}, ...replacement ? { replacement } : {}, ...substring ? { substring } : {} };
+        if (listing && selector) part.keys = true;
         if (selector) setArraySelector(part, selector);
         parts.push(part);
       }
@@ -38642,10 +38509,44 @@ var Parser4 = class {
       const body = this.nonemptyScript(/* @__PURE__ */ new Set(["done"]));
       this.expect("done", true);
       command7 = { kind, condition, body, redirects: [] };
-    } else if (this.is("for")) {
+    } else if (this.is("for") && this.peek().value === "(" && this.lexer.source.startsWith("((", this.peek().offset)) {
       this.advance();
+      const start = this.current.offset + 2;
+      let partStart = start;
+      let depth = 0;
+      let end = start;
+      this.budget.admit(4);
+      const sources2 = [];
+      for (; end < this.lexer.source.length; end++) {
+        this.budget.admit();
+        const character = this.lexer.source[end];
+        if (character === "(") depth++;
+        else if (character === ")") {
+          if (!depth && this.lexer.source[end + 1] === ")") break;
+          if (--depth < 0) this.error("Unterminated arithmetic for", true);
+        } else if (character === ";" && !depth) {
+          if (sources2.length === 2) this.error("Arithmetic for requires three expressions");
+          sources2.push(this.lexer.source.slice(partStart, end));
+          partStart = end + 1;
+        }
+      }
+      if (end === this.lexer.source.length) this.error("Unterminated arithmetic for", true);
+      if (sources2.length !== 2) this.error("Arithmetic for requires three expressions");
+      sources2.push(this.lexer.source.slice(partStart, end));
+      const expressions = sources2.map((source2) => source2.trim() ? prepareArithmetic(source2, this.budget) : void 0);
+      this.lexer.position = end + 2;
+      this.lookahead = void 0;
+      this.current = this.lexer.next();
+      if (this.is(";")) this.advance();
+      this.newlines();
+      this.expect("do", true);
+      const body = this.nonemptyScript(/* @__PURE__ */ new Set(["done"]));
+      this.expect("done", true);
+      command7 = { kind: "arithmetic-for", expressions, body, redirects: [] };
+    } else if (this.is("for") || this.is("select")) {
+      const kind = this.advance().value;
       const name2 = this.advance().value;
-      if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) this.error("Invalid for variable");
+      if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(name2)) this.error(`Invalid ${kind} variable`);
       this.newlines();
       let words;
       if (this.is("in")) {
@@ -38654,12 +38555,12 @@ var Parser4 = class {
         while (this.current.kind === "word") words.push(this.advance().word);
       }
       if (this.is(";") || this.is("\n")) this.advance();
-      else if (words) this.error("Expected for separator", true);
+      else if (words) this.error(`Expected ${kind} separator`, true);
       this.newlines();
       this.expect("do", true);
       const body = this.nonemptyScript(/* @__PURE__ */ new Set(["done"]));
       this.expect("done", true);
-      command7 = { kind: "for", name: name2, ...words ? { words } : {}, body, redirects: [] };
+      command7 = { kind, name: name2, ...words ? { words } : {}, body, redirects: [] };
     } else if (this.is("function")) {
       this.advance();
       if (this.current.kind !== "word" || !/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(this.current.value)) this.error("Invalid function name");
@@ -38677,7 +38578,7 @@ var Parser4 = class {
       this.expect("(");
       this.expect(")");
       this.newlines();
-      if (!["{", "(", "if", "case", "while", "until", "for", "[["].includes(this.current.value)) this.error("Expected function body");
+      if (!["{", "(", "if", "case", "while", "until", "for", "select", "[["].includes(this.current.value)) this.error("Expected function body");
       command7 = { kind: "function", name: name2, body: this.command(), redirects: [] };
     } else {
       if (["!", "then", "else", "elif", "fi", "do", "done", "}", "case", "esac", "select", "function", "[[", "]]"].includes(this.current.value)) this.error(`Unexpected or unsupported keyword ${this.current.value}`);
@@ -38714,7 +38615,12 @@ var Parser4 = class {
             word = { offset: word.offset, parts: word.parts, spelling: this.lexer.source.slice(word.offset, end) };
             setArrayAssignment(word, { kind: "compound", ...head, entries: entries2 });
           } else {
-            const assignment = words.every((previous) => getArrayAssignment(previous) || scalarAssignmentName(previous)) ? elementAssignment(word, this.budget) : void 0;
+            const assignment = words.every((previous) => getArrayAssignment(previous) || scalarAssignmentName(previous)) ? elementAssignment(word, this.budget, (source2) => parseArraySubscript(source2, this.budget, this.lexer.byteLocale, this.lexer.depth), (source2, start) => {
+              const lexer = new Lexer2(this.budget, source2, this.lexer.depth, [], 0, this.lexer.byteLocale);
+              lexer.position = start;
+              lexer.word("]");
+              return lexer.source[lexer.position] === "]" ? lexer.position : -1;
+            }) : void 0;
             if (assignment) setArrayAssignment(word, assignment);
           }
           words.push(word);
@@ -38756,6 +38662,10 @@ function parseShell(source2, depth = 0, options3 = {}) {
   budget.admit();
   return { ...script, ...warnings.length ? { warnings } : {} };
 }
+function parseArraySubscript(source2, budget, byteLocale2 = false, depth = 0) {
+  const lexer = new Lexer2(budget, source2, depth, [], 0, byteLocale2);
+  return lexer.word("\0");
+}
 function parseBraceWord(source2, opaque, budget) {
   budget.admit(source2.length + 1);
   const lexer = new Lexer2(budget, source2, 0);
@@ -39532,6 +39442,94 @@ function evaluatePositionalArithmetic(program, options3, evaluate) {
   }
 }
 
+// packages/safe-bash/src/shell/select-menu.ts
+init_platform();
+async function selectMenu(values, columns, byteLocale2, sink, work, allocation) {
+  allocation.reserve(64 + values.length * 32, 0);
+  const items = [];
+  let maximum = 0;
+  for (const value2 of values) {
+    const bytes3 = shellValueBytes(value2, allocation);
+    allocation.reserve(bytes3.length * 2 + 64, 0);
+    const decoder2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    let text3 = "";
+    for (let offset = 0; offset < bytes3.length; offset += 1024) {
+      const end = Math.min(offset + 1024, bytes3.length);
+      const pending = stringCheckpoint(work, end - offset);
+      if (pending) await pending;
+      if (text3 !== void 0) try {
+        text3 += decoder2.decode(bytes3.subarray(offset, end), { stream: end < bytes3.length });
+      } catch (error) {
+        if (!(error instanceof TypeError) || "code" in error && error.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
+        text3 = void 0;
+      }
+    }
+    let width = 0;
+    if (text3 !== void 0) for (const character of text3) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      const point = character.codePointAt(0);
+      if (byteLocale2 && point >= 128) {
+        width = 0;
+        break;
+      }
+      if (point < 32 || point === 127) {
+        width = bytes3.length;
+        break;
+      }
+      if (/[\p{Mn}\p{Me}\p{Cf}]/u.test(character)) continue;
+      width += point >= 4352 && (point <= 4447 || point === 9001 || point === 9002 || point >= 11904 && point <= 42191 && point !== 12351 || point >= 44032 && point <= 55203 || point >= 63744 && point <= 64255 || point >= 65040 && point <= 65049 || point >= 65072 && point <= 65135 || point >= 65280 && point <= 65376 || point >= 65504 && point <= 65510 || point >= 127744 && point <= 129791 || point >= 131072 && point <= 262141) ? 2 : 1;
+    }
+    maximum = Math.max(maximum, byteLocale2 ? bytes3.length : width);
+    items.push({ bytes: bytes3, width });
+  }
+  let screen = 0;
+  if (columns) {
+    let started = false;
+    for (const character of columns) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      if (!started && " 	\r\n\v\f".includes(character)) continue;
+      if (!started && character === "+") {
+        started = true;
+        continue;
+      }
+      if (character < "0" || character > "9") break;
+      started = true;
+      screen = Math.min(2147483647, screen * 10 + Number(character));
+    }
+  }
+  screen ||= 80;
+  const digits = String(values.length).length;
+  const cell2 = maximum + digits + 4;
+  let rows2 = Math.ceil(values.length / Math.max(1, Math.floor(screen / cell2)));
+  if (rows2 === 1) rows2 = values.length;
+  for (let row = 0; row < rows2; row++) {
+    let position = 0;
+    for (let index = row; index < items.length; index += rows2) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      const item = items[index];
+      const indexWidth = position ? digits : String(rows2).length;
+      await writeText(sink, `${String(index + 1).padStart(indexWidth)}) `);
+      await sink.write(item.bytes);
+      if (index + rows2 < items.length) {
+        let from = position + indexWidth + 2 + item.width;
+        const to = position + cell2;
+        while (from < to) {
+          const pending2 = stringCheckpoint(work);
+          if (pending2) await pending2;
+          const tab = Math.floor(to / 8) > Math.floor(from / 8);
+          await writeText(sink, tab ? "	" : " ");
+          from += tab ? 8 - from % 8 : 1;
+        }
+        position += cell2;
+      }
+    }
+    await writeText(sink, "\n");
+  }
+}
+
 // packages/safe-bash/src/shell/locale.ts
 init_platform();
 function byteLocale(variables) {
@@ -39558,6 +39556,12 @@ function commandText(command7, indent) {
     case "arithmetic":
       text3 = `(( ${command7.source} ))`;
       break;
+    case "arithmetic-for":
+      text3 = `for (( ${command7.expressions.map((expression) => expression?.source ?? "").join("; ")} ));
+do
+${nested}${scriptText(command7.body, nested)};
+${indent}done`;
+      break;
     case "conditional":
       text3 = `[[${command7.source}]]`;
       break;
@@ -39590,7 +39594,8 @@ ${nested}${scriptText(command7.body, nested)};
 ${indent}done`;
       break;
     case "for":
-      text3 = `for ${command7.name}${command7.words ? ` in ${command7.words.map(spelling).join(" ")}` : ""};
+    case "select":
+      text3 = `${command7.kind} ${command7.name}${command7.words ? ` in ${command7.words.map(spelling).join(" ")}` : ""};
 do
 ${nested}${scriptText(command7.body, nested)};
 ${indent}done`;
@@ -40742,14 +40747,16 @@ var controlNames = /* @__PURE__ */ new Set([
   "LC_CTYPE"
 ]);
 var OwnedText = class {
-  constructor(value2, bytes3, admission) {
+  constructor(value2, bytes3, admission, rawValue) {
     this.value = value2;
     this.bytes = bytes3;
     this.admission = admission;
+    this.rawValue = rawValue;
   }
   value;
   bytes;
   admission;
+  rawValue;
   references = 1;
   retain() {
     if (this.references === Number.MAX_SAFE_INTEGER) throw new ArrayFailure("reference capacity is not representable");
@@ -40775,27 +40782,110 @@ async function textToken(owner, value2, signal) {
   const admission = owner.reserve({ payload: bytes3, metadata: 32, work: 4 });
   return new OwnedText(value2, bytes3, admission);
 }
+async function valueToken(owner, value2, signal) {
+  if (typeof value2 === "string") return textToken(owner, value2, signal);
+  const bytes3 = shellValueByteLength(value2);
+  const temporary = owner.reserve({ payload: bytes3 * 3, metadata: 64, work: 4 });
+  try {
+    const input3 = shellValueBytes(value2);
+    const decoder2 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+    let text3 = "";
+    for (let offset = 0; offset < bytes3; offset += 1024) {
+      const end = Math.min(bytes3, offset + 1024);
+      owner.reserve({ work: end - offset }).release();
+      await owner.ledger.checkpoint(signal, end - offset);
+      if (text3 !== void 0) try {
+        text3 += decoder2.decode(input3.subarray(offset, end), { stream: end < bytes3 });
+      } catch (error) {
+        if (!(error instanceof TypeError) || "code" in error && error.code !== "ERR_ENCODING_INVALID_ENCODED_DATA") throw error;
+        text3 = void 0;
+      }
+    }
+    if (text3 !== void 0) return await textToken(owner, text3, signal);
+    const admission = owner.reserve({ payload: bytes3 * 4, metadata: 128, work: 4 });
+    try {
+      const raw = shellValueFromBytes(input3);
+      return new OwnedText(shellValueText(raw), bytes3, admission, raw);
+    } catch (error) {
+      admission.release();
+      throw error;
+    }
+  } finally {
+    temporary.release();
+  }
+}
 var IndexedBinding = class _IndexedBinding {
-  constructor(owner) {
+  constructor(owner, associative = false) {
     this.owner = owner;
+    this.associative = associative;
   }
   owner;
+  associative;
   values = /* @__PURE__ */ new Map();
+  keys = /* @__PURE__ */ new Map();
+  keyByIndex = /* @__PURE__ */ new Map();
   maximum = -1;
   generation = 0;
   version = 0;
   references = 1;
   assigned = false;
-  static create(parent) {
+  static create(parent, associative = false) {
     const owner = ArrayOwner.create(parent.ledger, parent);
     try {
       owner.reserve({ wrappers: 1, metadata: 128, work: 7 });
-      return new _IndexedBinding(owner);
+      return new _IndexedBinding(owner, associative);
     } catch (error) {
       void owner.close();
       throw error;
     }
   }
+  async keyIdentity(value2, owner, signal) {
+    const length = shellValueByteLength(value2);
+    if (!length) throw new ArrayFailure("bad array subscript");
+    const admission = owner.reserve({ payload: length * 5, metadata: 64 + length * 16, work: length + 2 });
+    try {
+      const bytes3 = shellValueBytes(value2);
+      const parts = [];
+      for (const byte of bytes3) {
+        parts.push(byte.toString(16).padStart(2, "0"));
+        await owner.ledger.checkpoint(signal);
+      }
+      return parts.join("");
+    } finally {
+      admission.release();
+    }
+  }
+  async keyIndex(value2, owner, signal, create = false) {
+    const identity2 = await this.keyIdentity(value2, owner, signal);
+    const existing2 = this.keys.get(identity2);
+    if (existing2 || !create) return existing2?.index;
+    const index = this.maximum + 1;
+    const admission = this.owner.reserve({ metadata: 128 + identity2.length * 2, work: 8 });
+    let text3;
+    try {
+      text3 = await valueToken(this.owner, value2, signal);
+    } catch (error) {
+      admission.release();
+      throw error;
+    }
+    const entry = { index, text: text3, admission };
+    admission.cleanup = () => {
+      if (this.keys.get(identity2) === entry) {
+        this.keys.delete(identity2);
+        this.keyByIndex.delete(index);
+      }
+      text3.release();
+    };
+    this.keys.set(identity2, entry);
+    this.keyByIndex.set(index, identity2);
+    this.maximum = index;
+    return index;
+  }
+  remove(index) {
+    this.values.get(index)?.slot.release();
+    const identity2 = this.keyByIndex.get(index);
+    if (identity2 !== void 0) this.keys.get(identity2)?.admission.release();
+  }
   get(index) {
     return this.values.get(index)?.text.value;
   }
@@ -40822,13 +40912,30 @@ var IndexedBinding = class _IndexedBinding {
     previous?.slot.release();
   }
   async copy(signal) {
-    const copy2 = _IndexedBinding.create(this.owner.parent);
+    const copy2 = _IndexedBinding.create(this.owner.parent, this.associative);
     copy2.assigned = this.assigned;
     this.retain();
     try {
+      for (const [identity2, entry] of this.keys) {
+        const admission = copy2.owner.reserve({ metadata: 128 + identity2.length * 2, work: identity2.length + 8 });
+        copy2.owner.parent.adopt(entry.text.admission);
+        const text3 = entry.text.retain();
+        const cloned = { index: entry.index, text: text3, admission };
+        admission.cleanup = () => {
+          if (copy2.keys.get(identity2) === cloned) {
+            copy2.keys.delete(identity2);
+            copy2.keyByIndex.delete(entry.index);
+          }
+          text3.release();
+        };
+        copy2.keys.set(identity2, cloned);
+        copy2.keyByIndex.set(entry.index, identity2);
+        await copy2.owner.ledger.checkpoint(signal, identity2.length + 8);
+      }
       for (const [index, element] of this.values) {
         copy2.owner.reserve({ work: 2 }).release();
         const slot = copy2.owner.reserve({ slots: 1, metadata: 32, work: 5 });
+        copy2.owner.parent.adopt(element.text.admission);
         const text3 = element.text.retain();
         const cloned = { text: text3, slot };
         slot.cleanup = () => {
@@ -41011,6 +41118,116 @@ var BindingStore = class _BindingStore {
   }
 };
 
+// packages/safe-bash/src/shell/mapfile.ts
+init_platform();
+var MapfileUsageError = class extends Error {
+  constructor(message3, status2) {
+    super(message3);
+    this.status = status2;
+  }
+  status;
+};
+async function mapfileOptions(context2, work, allocation) {
+  const options3 = { name: "MAPFILE", strip: false, delimiter: 10, count: 0, skip: 0, origin: 0, preserve: false, callback: void 0, quantum: 5e3 };
+  const args = getCommandArguments(context2);
+  let cursor = 0;
+  const numeric4 = async (text3, maximum) => {
+    let value2 = 0;
+    let index = 0;
+    const whitespace2 = (code) => code === 32 || code >= 9 && code <= 13;
+    while (index < text3.length && whitespace2(text3.charCodeAt(index))) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      index++;
+    }
+    const negative = text3[index] === "-";
+    if (negative || text3[index] === "+") index++;
+    let digits = 0;
+    for (; index < text3.length; index++) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      const digit3 = text3.charCodeAt(index) - 48;
+      if (digit3 < 0 || digit3 > 9) break;
+      if (value2 > Math.floor((maximum - digit3) / 10)) throw new MapfileUsageError(`${text3}: invalid number`, 1);
+      value2 = value2 * 10 + digit3;
+      digits++;
+    }
+    for (; index < text3.length; index++) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      if (!whitespace2(text3.charCodeAt(index))) throw new MapfileUsageError(`${text3}: invalid number`, 1);
+    }
+    if (!digits || negative && value2 !== 0) throw new MapfileUsageError(`${text3}: invalid number`, 1);
+    return value2;
+  };
+  while (cursor < context2.args.length) {
+    const option = context2.args[cursor];
+    if (option === "--") {
+      cursor++;
+      break;
+    }
+    if (!option.startsWith("-") || option === "-") break;
+    cursor++;
+    for (let index = 1; index < option.length; index++) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      const flag = option[index];
+      if (flag === "t") {
+        options3.strip = true;
+        continue;
+      }
+      if (!"dnsOCc".includes(flag)) throw new MapfileUsageError(`-${flag}: invalid option`, 2);
+      const attached = index + 1 < option.length;
+      const operandIndex = attached ? cursor - 1 : cursor++;
+      const operand = attached ? option.slice(index + 1) : context2.args[operandIndex];
+      if (operand === void 0) throw new MapfileUsageError(`-${flag}: option requires an argument`, 2);
+      if (flag === "d") {
+        const bytes3 = shellValueBytes(args.values[operandIndex], allocation);
+        options3.delimiter = bytes3[attached ? index + 1 : 0] ?? 0;
+      } else if (flag === "C") options3.callback = operand;
+      else {
+        const value2 = await numeric4(operand, flag === "O" ? 2147483647 : Number.MAX_SAFE_INTEGER);
+        if (flag === "c") {
+          if (!value2) throw new MapfileUsageError("0: invalid callback quantum", 1);
+          options3.quantum = value2;
+        } else if (flag === "n") options3.count = value2;
+        else if (flag === "s") options3.skip = value2;
+        else {
+          options3.origin = value2;
+          options3.preserve = true;
+        }
+      }
+      break;
+    }
+  }
+  options3.name = context2.args[cursor] ?? "MAPFILE";
+  if (!/^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(options3.name)) throw new MapfileUsageError(`${options3.name}: invalid identifier`, 1);
+  return options3;
+}
+async function collectMapfile(options3, input3, hooks) {
+  let skipped = 0;
+  let written = 0;
+  while (!options3.count || written < options3.count) {
+    hooks.loop();
+    const allocation = hooks.allocation();
+    try {
+      const record4 = await input3.mapfileRecord(options3.delimiter, options3.strip, allocation);
+      if (!record4.present) break;
+      if (skipped < options3.skip) {
+        skipped++;
+        continue;
+      }
+      const index = options3.origin + written;
+      if (index > 2147483647) throw new MapfileUsageError("array index exceeds 2147483647", 1);
+      if (options3.callback !== void 0 && (written + 1) % options3.quantum === 0) await hooks.callback(options3.callback, index, record4.value);
+      await hooks.write(index, record4.value);
+      written++;
+    } finally {
+      allocation.close();
+    }
+  }
+}
+
 // packages/safe-bash/src/shell/arrays/state.ts
 init_platform();
 var sessions = /* @__PURE__ */ new WeakMap();
@@ -41609,6 +41826,138 @@ function* pathTargets(name2, path, limits, signal, fail4) {
   }
 }
 
+// packages/safe-bash/src/shell/parameter-transforms.ts
+init_platform();
+function hexadecimal(byte) {
+  return byte >= 48 && byte <= 57 ? byte - 48 : byte >= 65 && byte <= 70 ? byte - 55 : byte >= 97 && byte <= 102 ? byte - 87 : -1;
+}
+function utf8Unit(bytes3, offset) {
+  const first = bytes3[offset];
+  if (first < 128) return { point: first, size: 1 };
+  const size = first >= 194 && first <= 223 ? 2 : first >= 224 && first <= 239 ? 3 : first >= 240 && first <= 244 ? 4 : 0;
+  if (!size || offset + size > bytes3.length) return { point: -1, size: 1 };
+  let point = first & 127 >> size;
+  for (let index = 1; index < size; index++) {
+    const byte = bytes3[offset + index];
+    if (byte < 128 || byte > 191) return { point: -1, size: 1 };
+    point = point * 64 + (byte & 63);
+  }
+  if (point < (size === 2 ? 128 : size === 3 ? 2048 : 65536) || point > 1114111 || point >= 55296 && point <= 57343) return { point: -1, size: 1 };
+  return { point, size };
+}
+var controlEscapes = { 7: 97, 8: 98, 9: 116, 10: 110, 11: 118, 12: 102, 13: 114, 27: 69 };
+var decodedEscapes = { 97: 7, 98: 8, 116: 9, 110: 10, 118: 11, 102: 12, 114: 13, 101: 27, 69: 27, 92: 92, 39: 39, 34: 34, 63: 63 };
+async function transformParameter(value2, operator, options3) {
+  const { work, allocation, maximumBytes } = options3;
+  work.signal.throwIfAborted();
+  if (typeof value2 === "string") {
+    if (value2.length > maximumBytes) work.exhausted();
+    if ((await scanString(value2, work)).bytes > maximumBytes) work.exhausted();
+  } else if (shellValueByteLength(value2) > maximumBytes) work.exhausted();
+  const input3 = shellValueBytes(value2, allocation);
+  let ansi = false;
+  if (operator === "Q") {
+    for (let offset = 0; offset < input3.length; ) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      const unit2 = options3.byteLocale ? { point: input3[offset], size: 1 } : utf8Unit(input3, offset);
+      const printable = unit2.point >= 32 && unit2.point < 127 || !options3.byteLocale && unit2.point >= 128 && !/[\p{Cc}\p{Cf}\p{Cn}]/u.test(String.fromCodePoint(unit2.point));
+      if (!printable) ansi = true;
+      offset += unit2.size;
+    }
+  }
+  let output2 = void 0;
+  let size = 0;
+  const emit2 = (byte) => {
+    if (size >= maximumBytes) work.exhausted();
+    if (output2) output2[size] = byte;
+    size++;
+  };
+  const ascii2 = (text3) => {
+    for (let index = 0; index < text3.length; index++) emit2(text3.charCodeAt(index));
+  };
+  const scan = async () => {
+    size = 0;
+    if (operator === "Q") {
+      ascii2(ansi ? "$'" : "'");
+      for (let offset = 0; offset < input3.length; ) {
+        const pending = stringCheckpoint(work);
+        if (pending) await pending;
+        const unit2 = options3.byteLocale ? { point: input3[offset], size: 1 } : utf8Unit(input3, offset);
+        const printable = unit2.point >= 32 && unit2.point < 127 || !options3.byteLocale && unit2.point >= 128 && !/[\p{Cc}\p{Cf}\p{Cn}]/u.test(String.fromCodePoint(unit2.point));
+        if (ansi && !printable) {
+          if (unit2.size === 1 && controlEscapes[input3[offset]] !== void 0) {
+            emit2(92);
+            emit2(controlEscapes[input3[offset]]);
+          } else for (let index = 0; index < unit2.size; index++) ascii2("\\" + input3[offset + index].toString(8).padStart(3, "0"));
+        } else if (unit2.point === 39) ascii2(ansi ? "\\'" : "'\\''");
+        else if (ansi && unit2.point === 92) ascii2("\\\\");
+        else for (let index = 0; index < unit2.size; index++) emit2(input3[offset + index]);
+        offset += unit2.size;
+      }
+      emit2(39);
+      return;
+    }
+    for (let offset = 0; offset < input3.length; ) {
+      const pending = stringCheckpoint(work);
+      if (pending) await pending;
+      let byte = input3[offset++];
+      if (byte === 92 && offset < input3.length) {
+        const escape = input3[offset++];
+        if (decodedEscapes[escape] !== void 0) byte = decodedEscapes[escape];
+        else if (escape >= 48 && escape <= 55) {
+          byte = escape - 48;
+          for (let count2 = 1; count2 < 3 && offset < input3.length && input3[offset] >= 48 && input3[offset] <= 55; count2++) byte = byte * 8 + input3[offset++] - 48;
+          byte &= 255;
+        } else if (escape === 120 || escape === 117 || escape === 85) {
+          const maximum = escape === 120 ? 2 : escape === 117 ? 4 : 8;
+          let point = 0;
+          let count2 = 0;
+          while (count2 < maximum && offset < input3.length && hexadecimal(input3[offset]) >= 0) {
+            point = point * 16 + hexadecimal(input3[offset++]);
+            count2++;
+          }
+          if (!count2) {
+            emit2(92);
+            emit2(escape);
+            continue;
+          }
+          if (escape === 120) byte = point;
+          else {
+            if (!point || point >= 2147483648) return;
+            if (options3.byteLocale && point >= 55296 && point <= 57343) ascii2(`\\u${point.toString(16).toUpperCase().padStart(4, "0")}`);
+            else {
+              const width = point < 128 ? 1 : point < 2048 ? 2 : point < 65536 ? 3 : point < 2097152 ? 4 : point < 67108864 ? 5 : 6;
+              if (width === 1) emit2(point);
+              else {
+                const divisor = 64 ** (width - 1);
+                emit2(256 - 2 ** (8 - width) + Math.floor(point / divisor));
+                for (let shift = width - 2; shift >= 0; shift--) emit2(128 + Math.floor(point / 64 ** shift) % 64);
+              }
+            }
+            continue;
+          }
+        } else if (escape === 99 && offset < input3.length) {
+          const control = input3[offset++];
+          if (control === 92 && input3[offset] === 92) offset++;
+          byte = control === 63 ? 127 : control & 31;
+        } else {
+          emit2(92);
+          byte = escape;
+        }
+      }
+      if (!byte) return;
+      emit2(byte);
+    }
+  };
+  await scan();
+  allocation.reserve(size + 64, 1);
+  output2 = new Uint8Array(size);
+  await scan();
+  work.signal.throwIfAborted();
+  return shellValueFromBytes(output2, allocation);
+}
+
 // packages/safe-bash/src/shell/runtime.ts
 var defaultLimits = {
   maxParseUnits: defaultMaxParseUnits,
@@ -41640,6 +41989,9 @@ var shellBuiltinNames = /* @__PURE__ */ new Set([
   "local",
   "unset",
   "read",
+  "declare",
+  "mapfile",
+  "readarray",
   "exit",
   "return",
   "break",
@@ -42638,6 +42990,7 @@ var InvocationCancellationOwner = class {
     this.#failures.push(...result2.failures);
   }
 };
+var mapfileCallbackStates = /* @__PURE__ */ new WeakSet();
 var Runtime = class _Runtime {
   constructor(fs, commands, middleware, budget, signal = budget.signal, fileWrites = /* @__PURE__ */ new Map(), outputFiles = /* @__PURE__ */ new Map(), commandSignal = signal, cancellation, cancellationState, cancellationOwner, cancellationDepth, cancellationMaxDepth, outcomeFrame = void 0, inputProfile = fs) {
     this.fs = fs;
@@ -42949,6 +43302,18 @@ var Runtime = class _Runtime {
     this.signal.throwIfAborted();
     if (error instanceof NounsetFailure || error instanceof Flow2 || error instanceof ShellLimitError || error instanceof ShellSyntaxError) throw error;
   }
+  arithmeticValue(program, state, io) {
+    return evaluatePositionalArithmetic(program, {
+      parseBudget: this.budget.parsing,
+      positional: state.positional,
+      arg0: state.arg0 ?? "virtual-bash",
+      owner: arrayStore(state)?.owner,
+      maximumBytes: this.budget.limits.maxExpansionBytes,
+      checkpoint: () => this.signal.throwIfAborted(),
+      requireParameter: (name2, value2) => this.requireParameter(value2, name2, state, io),
+      limit: () => this.budget.fail("maxExpansionBytes")
+    }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine), this.budget.parsing));
+  }
   arithmeticVariables(state, line) {
     return new Proxy(state.variables, {
       get: (target, key) => {
@@ -42966,7 +43331,7 @@ var Runtime = class _Runtime {
   }
   variable(state, name2) {
     const binding = arrayStore(state)?.get(name2);
-    return binding ? binding.get(0) : state.variables[name2];
+    return binding ? binding.get(binding.associative ? binding.keys.get("30")?.index ?? -1 : 0) : state.variables[name2];
   }
   requireParameter(value2, name2, state, io, line) {
     if (state.nounset && value2 === void 0) throw new NounsetFailure(`${name2}: unbound variable`, io.diagnosticLine ?? line);
@@ -42976,7 +43341,7 @@ var Runtime = class _Runtime {
       this.writeVariable(state, name2, value2, origin);
       return;
     }
-    await this.arrayZero(state, name2, async () => shellValueText(value2));
+    await this.arrayZero(state, name2, async () => value2);
   }
   async prepareVariable(state, name2, saved, scalarLegacy = false) {
     const store = requireArrays(state);
@@ -43102,7 +43467,7 @@ var Runtime = class _Runtime {
           if (key !== index && key > maximum) maximum = key;
           await operation2.ledger.checkpoint(this.signal, 2);
         }
-        if (typeof index === "number") staged.values.get(index)?.slot.release();
+        if (typeof index === "number") staged.remove(index);
         staged.maximum = maximum;
       }
       this.signal.throwIfAborted();
@@ -43133,6 +43498,7 @@ var Runtime = class _Runtime {
     const store = requireArrays(state);
     const operation2 = ArrayOwner.create(store.owner.ledger, store.owner);
     const holding = store.owner.hold();
+    const valueAllocation = this.budget.values.scope();
     let staged;
     try {
       const watch = await store.watch(name2, operation2, this.signal);
@@ -43149,10 +43515,12 @@ var Runtime = class _Runtime {
       const current = store.get(name2);
       if (!current) throw new ArrayFailure("stale binding");
       staged = await current.copy(this.signal);
-      const value2 = append ? await this.arrayJoin(operation2, [current.get(0) ?? "", expanded], "") : expanded;
-      const token = await textToken(staged.owner, value2, this.signal);
+      const index = staged.associative ? await staged.keyIndex("0", operation2, this.signal, true) : 0;
+      const previous = current.values.get(index)?.text.rawValue ?? current.get(index) ?? "";
+      const value2 = !append ? expanded : typeof previous === "string" && typeof expanded === "string" ? await this.arrayJoin(operation2, [previous, expanded], "") : concatShellValues([previous, expanded], valueAllocation);
+      const token = await valueToken(staged.owner, value2, this.signal);
       try {
-        staged.insert(0, token);
+        staged.insert(index, token);
       } catch (error) {
         token.release();
         throw error;
@@ -43178,6 +43546,7 @@ var Runtime = class _Runtime {
         await staged?.release();
         await operation2.close();
       } finally {
+        valueAllocation.close();
         holding.release();
       }
     }
@@ -43196,10 +43565,33 @@ var Runtime = class _Runtime {
     await owner.ledger.checkpoint(this.signal);
     return result2;
   }
+  async arrayIndex(binding, index, state, io, owner, create = false) {
+    if (!binding?.associative) {
+      const selected = index.source === void 0 ? index : literalIndex(index.source, 0, this.budget.parsing);
+      const number5 = numericIndex(selected);
+      if (number5 === void 0) throw new ArrayFailure("index outside 0..2147483647");
+      return number5;
+    }
+    const word = index.word ?? parseArraySubscript(index.source ?? index.decimal, this.budget.parsing, byteLocale(state.variables), state.depth);
+    const fields3 = await this.valueWord(word, state, io, false);
+    const value2 = fields3.length === 1 ? fields3[0] : concatShellValues(fields3, io[valueScope]);
+    if (shellValueByteLength(value2) === 0) {
+      await this.diagnostic(io, "associative array: bad array subscript");
+      if (create) throw completedExit(1);
+      return void 0;
+    }
+    return binding.keyIndex(value2, owner, this.signal, create);
+  }
   async arrayAssignment(assignment, state, io) {
     const name2 = assignment.name;
     this.signal.throwIfAborted();
-    if (state.readonlyVariables?.has(name2)) throw new ArrayFailure("readonly binding");
+    if (state.readonlyVariables?.has(name2)) {
+      if (arrayStore(state)?.get(name2)?.associative) {
+        await this.diagnostic(io, `${name2}: readonly variable`);
+        throw completedExit(1);
+      }
+      throw new ArrayFailure("readonly binding");
+    }
     if (controlNames.has(name2)) throw new ArrayFailure("control binding cannot be indexed");
     if (state.exported.has(name2)) throw new ArrayFailure("exported binding cannot be indexed");
     const store = requireArrays(state);
@@ -43209,11 +43601,12 @@ var Runtime = class _Runtime {
     try {
       const watch = await store.watch(name2, operation2, this.signal);
       const current = store.get(name2);
+      if (current?.associative && assignment.kind === "compound" && assignment.entries.length) throw new ArrayFailure("nonempty associative compound assignment is unsupported");
       const initialMaximum = current?.maximum ?? (state.variables[name2] === void 0 ? -1 : 0);
       let planned = assignment.append && assignment.kind === "compound" ? initialMaximum + 1 : 0;
       if (assignment.kind === "element") {
         operation2.reserve({ work: assignment.index.decimal.length + 1 }).release();
-        if (numericIndex(assignment.index) === void 0) throw new ArrayFailure("index outside 0..2147483647");
+        if (!current?.associative && numericIndex(literalIndex(assignment.index.source ?? assignment.index.decimal, 0, this.budget.parsing)) === void 0) throw new ArrayFailure("index outside 0..2147483647");
       } else for (const entry of assignment.entries) {
         operation2.reserve({ work: entry.value.parts.length + (entry.index?.decimal.length ?? 0) + 2 }).release();
         if (entry.index) {
@@ -43239,9 +43632,9 @@ var Runtime = class _Runtime {
       const tickets = operation2.reserve({ generation: true, version: true, epoch: true, work: 8 });
       const prepared = await store.prepareName(name2, operation2, this.signal);
       const preserve = assignment.kind === "element" || assignment.append;
-      staged = preserve && current ? await current.copy(this.signal) : IndexedBinding.create(store.owner);
+      staged = preserve && current ? await current.copy(this.signal) : IndexedBinding.create(store.owner, current?.associative);
       if (preserve && !current && state.variables[name2] !== void 0) {
-        const token = await textToken(staged.owner, state.variables[name2], this.signal);
+        const token = await valueToken(staged.owner, stateMonitor(state)?.values.get(name2, state.variables[name2]) ?? state.variables[name2], this.signal);
         try {
           staged.insert(0, token);
         } catch (error) {
@@ -43253,7 +43646,7 @@ var Runtime = class _Runtime {
       let cursor = assignment.append && assignment.kind === "compound" ? initialMaximum + 1 : 0;
       const insert = async (index, value2) => {
         if (index > 2147483647) throw new ArrayFailure("index outside 0..2147483647");
-        const token = await textToken(staged.owner, value2, this.signal);
+        const token = await valueToken(staged.owner, value2, this.signal);
         try {
           staged.insert(index, token);
         } catch (error) {
@@ -43262,11 +43655,12 @@ var Runtime = class _Runtime {
         }
         writes++;
       };
+      const join = async (values) => values.every((value2) => typeof value2 === "string") ? this.arrayJoin(operation2, values, "") : concatShellValues(values, io[valueScope]);
       if (assignment.kind === "element") {
-        const index = numericIndex(assignment.index);
-        const fields3 = await this.word(assignment.value, state, io, false);
-        let value2 = await this.arrayJoin(operation2, fields3, "");
-        if (assignment.append) value2 = await this.arrayJoin(operation2, [staged.get(index) ?? "", value2], "");
+        const index = await this.arrayIndex(staged, assignment.index, state, io, operation2, true);
+        const fields3 = await this.valueWord(assignment.value, state, io, false);
+        let value2 = await join(fields3);
+        if (assignment.append) value2 = await join([staged.values.get(index)?.text.rawValue ?? staged.get(index) ?? "", value2]);
         await insert(index, value2);
       } else for (const entry of assignment.entries) {
         const original = compoundEntryWords.get(entry);
@@ -43277,16 +43671,16 @@ var Runtime = class _Runtime {
             expandedEntry = true;
             const values = await this.valueWord(expanded, state, io, true, false, false, false, void 0, false);
             for (const value2 of values) {
-              await insert(cursor, shellValueText(value2));
+              await insert(cursor, value2);
               cursor++;
             }
           }
           if (expandedEntry) continue;
         }
-        const fields3 = await this.word(entry.value, state, io, entry.index === void 0);
+        const fields3 = await this.valueWord(entry.value, state, io, entry.index === void 0);
         if (entry.index) {
           const index = numericIndex(entry.index);
-          await insert(index, await this.arrayJoin(operation2, fields3, ""));
+          await insert(index, await join(fields3));
           cursor = index + 1;
         } else for (const value2 of fields3) {
           await insert(cursor, value2);
@@ -43649,16 +44043,7 @@ var Runtime = class _Runtime {
         }
         if (command7.kind === "arithmetic") {
           try {
-            return Number(evaluatePositionalArithmetic(command7.expression, {
-              parseBudget: this.budget.parsing,
-              positional: state.positional,
-              arg0: state.arg0 ?? "virtual-bash",
-              owner: arrayStore(state)?.owner,
-              maximumBytes: this.budget.limits.maxExpansionBytes,
-              checkpoint: () => this.signal.throwIfAborted(),
-              requireParameter: (name2, value2) => this.requireParameter(value2, name2, state, io),
-              limit: () => this.budget.fail("maxExpansionBytes")
-            }, (prepared) => evaluateArithmetic(prepared, this.arithmeticVariables(state, io.diagnosticLine), this.budget.parsing)) === 0n);
+            return Number(this.arithmeticValue(command7.expression, state, io) === 0n);
           } catch (error) {
             this.rethrowArithmeticControl(error);
             throw new PublicDiagnostic(`((: ${message2(error, this.budget.onInternalError)}`);
@@ -43717,6 +44102,87 @@ var Runtime = class _Runtime {
               status3 = result2.status;
               if (result2.stop) break;
             }
+          } else if (command7.kind === "arithmetic-for") {
+            const evaluate = async (program) => {
+              if (!program) return 1n;
+              try {
+                return this.arithmeticValue(program, state, io);
+              } catch (error) {
+                this.rethrowArithmeticControl(error);
+                await this.diagnostic(io, `((: ${message2(error, this.budget.onInternalError)}`);
+                return void 0;
+              }
+            };
+            if (await evaluate(command7.expressions[0]) === void 0) return 1;
+            while (true) {
+              this.budget.loop();
+              await yieldTurn(this.signal);
+              const condition = await evaluate(command7.expressions[1]);
+              if (condition === void 0) return 1;
+              if (condition === 0n) break;
+              const result2 = await this.loopBody(command7.body, state, io);
+              status3 = result2.status;
+              if (result2.stop) break;
+              if (await evaluate(command7.expressions[2]) === void 0) return 1;
+            }
+          } else if (command7.kind === "select") {
+            const values = command7.words ? await this.valueWords(command7.words, state, io) : this.positionalValues(state);
+            if (!values.length) return 0;
+            const input3 = io.stdin instanceof ShellInput ? io.stdin : new ShellInput(io.stdin, this.budget, this.signal);
+            const work = { remaining: this.budget.limits.maxExpansionBytes * 8, signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+            let showMenu = true;
+            while (true) {
+              this.budget.loop();
+              if (showMenu) await selectMenu(values, state.variables.COLUMNS, byteLocale(state.variables), io.stderr, work, allocation);
+              const prompt = stateMonitor(state)?.values.get("PS3", state.variables.PS3 ?? "#? ") ?? state.variables.PS3 ?? "#? ";
+              await io.stderr.write(shellValueBytes(prompt, allocation));
+              const line = await input3.selectLine(allocation);
+              if (state.readonlyVariables?.has("REPLY")) {
+                await this.diagnostic(io, "REPLY: readonly variable");
+                await writeText(io.stdout, "\n");
+                return 1;
+              }
+              this.writeVariable(state, "REPLY", line.value);
+              if (!line.terminated) {
+                await writeText(io.stdout, "\n");
+                return 1;
+              }
+              const bytes3 = shellValueBytes(line.value, allocation);
+              if (!bytes3.length) {
+                showMenu = true;
+                continue;
+              }
+              let choice = 0;
+              let phase = "start";
+              let valid = true;
+              let negative = false;
+              let digits = false;
+              for (const byte of bytes3) {
+                const pending = stringCheckpoint(work);
+                if (pending) await pending;
+                if (byte === 32 || byte >= 9 && byte <= 13) {
+                  if (phase === "digits") phase = "tail";
+                  continue;
+                }
+                if (phase === "start" && (byte === 43 || byte === 45)) {
+                  negative = byte === 45;
+                  phase = "digits";
+                  continue;
+                }
+                if (phase === "tail" || byte < 48 || byte > 57) {
+                  valid = false;
+                  continue;
+                }
+                phase = "digits";
+                digits = true;
+                choice = Math.min(values.length + 1, choice * 10 + byte - 48);
+              }
+              await this.assignVariable(state, command7.name, valid && digits && !negative && choice >= 1 && choice <= values.length ? values[choice - 1] : "");
+              const result2 = await this.loopBody(command7.body, state, io);
+              status3 = result2.status;
+              if (result2.stop) break;
+              showMenu = shellValueByteLength(stateMonitor(state)?.values.get("REPLY", state.variables.REPLY ?? "") ?? state.variables.REPLY ?? "") === 0;
+            }
           } else {
             while (true) {
               this.budget.loop();
@@ -43815,6 +44281,7 @@ var Runtime = class _Runtime {
   async document(document, state, io, line = document.endLine) {
     this.signal.throwIfAborted();
     let value2 = "";
+    let fragments;
     let size = 0;
     let words = 0;
     const warnings = [];
@@ -43824,16 +44291,25 @@ var Runtime = class _Runtime {
         for (const warning of warnings.splice(0)) await writeDiagnostic(io.stderr, `shell: warning: ${warning}
 `);
         if (++words % 128 === 0) await yieldTurn(this.signal);
-        const part = (await this.word(word, state, { ...io, nameExpansionContext: "document" }, false)).join("");
-        size += import_buffer.Buffer.byteLength(part);
+        const part = concatShellValues(await this.valueWord(word, state, { ...io, nameExpansionContext: "document" }, false), io[valueScope]);
+        size += shellValueByteLength(part);
         if (size > this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
-        value2 += part;
+        if (!fragments && typeof part === "string") value2 += part;
+        else {
+          if (!fragments) {
+            io[valueScope]?.reserve(64 + value2.length * 2, 0);
+            fragments = [value2];
+            value2 = "";
+          }
+          io[valueScope]?.reserve(32 + (typeof part === "string" ? part.length * 2 : 0), 0);
+          fragments.push(part);
+        }
       }
     } finally {
       for (const warning of warnings.splice(0)) await writeDiagnostic(io.stderr, `shell: warning: ${warning}
 `);
     }
-    return value2;
+    return fragments ? concatShellValues(fragments, io[valueScope]) : value2;
   }
   async redirect(redirects, state, io, inputs2, outputs, isolatedInlineInput = false, persistMoves = false, fileShortcut = false, line) {
     this.signal.throwIfAborted();
@@ -43862,6 +44338,7 @@ var Runtime = class _Runtime {
       const stdinIsDefault = descriptor2?.input ? descriptor2.stdinIsDefault : false;
       return {
         [invocationScope]: io[invocationScope],
+        ...io[valueScope] === void 0 ? {} : { [valueScope]: io[valueScope] },
         ...io.execution === void 0 ? {} : { execution: io.execution },
         ...io.diagnosticLine === void 0 ? {} : { diagnosticLine: io.diagnosticLine },
         ...io.diagnosticOffset === void 0 ? {} : { diagnosticOffset: io.diagnosticOffset },
@@ -43882,7 +44359,7 @@ var Runtime = class _Runtime {
           const hereString = redirect.operator === "<<<";
           let value2;
           try {
-            value2 = redirect.document ? await this.document(redirect.document, state, currentIO(), line) : (await this.word(redirect.target, state, currentIO(), false, false, hereString)).join("");
+            value2 = redirect.document ? await this.document(redirect.document, state, currentIO(), line) : concatShellValues(await this.valueWord(redirect.target, state, currentIO(), false, false, hereString), io[valueScope]);
           } catch (error) {
             if (error instanceof NounsetFailure) throw error;
             if (error instanceof ParameterExpansionFailure && !isolatedInlineInput) throw error;
@@ -43891,10 +44368,10 @@ var Runtime = class _Runtime {
             throw error;
           }
           if (hereString) {
-            if (import_buffer.Buffer.byteLength(value2) >= this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
-            value2 += "\n";
+            if (shellValueByteLength(value2) >= this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
+            value2 = concatShellValues([value2, "\n"], io[valueScope]);
           }
-          const input3 = new ShellInput(toByteSource(value2), this.budget, this.signal);
+          const input3 = new ShellInput(toByteSource(typeof value2 === "string" ? value2 : shellValueBytes(value2, io[valueScope])), this.budget, this.signal);
           inputs2.add(input3);
           descriptors.set(redirect.descriptor, { input: input3, stdinIsDefault: false });
           continue;
@@ -44094,8 +44571,8 @@ var Runtime = class _Runtime {
             throw new ArrayFailure("indexed binding cannot be a command prefix");
           }
           await this.arrayZero(state, assignment.name, async () => {
-            const fields3 = await this.word(assignment.value, state, io, false);
-            return this.arrayJoin(requireArrays(state).owner, fields3, "");
+            const fields3 = await this.valueWord(assignment.value, state, io, false);
+            return fields3.every((value3) => typeof value3 === "string") ? this.arrayJoin(requireArrays(state).owner, fields3, "") : concatShellValues(fields3, io[valueScope]);
           }, assignment.append);
           continue;
         }
@@ -44241,6 +44718,7 @@ var Runtime = class _Runtime {
   }
   async dispatchScoped(name2, values, state, io, assignments2, bypassFunctions) {
     const { [invocationScope]: scope, ...publicIO } = io;
+    Reflect.deleteProperty(publicIO, valueScope);
     const allocation = this.budget.values.scope();
     scope.register(() => allocation.close());
     const argumentValues = this.admitArguments(values, allocation);
@@ -44289,7 +44767,13 @@ var Runtime = class _Runtime {
       scope.assertOpen();
       const forwardedValues = getCommandArguments(forwarded);
       const admitted = forwardedValues === argumentValues ? argumentValues : this.admitArguments(forwardedValues.values, allocation);
-      const context3 = { ...forwarded, args: admitted.args, argumentValues: admitted, [invocationScope]: scope };
+      const context3 = {
+        ...forwarded,
+        args: admitted.args,
+        argumentValues: admitted,
+        [invocationScope]: scope,
+        ...io[valueScope] === void 0 ? {} : { [valueScope]: io[valueScope] }
+      };
       const previous = /* @__PURE__ */ new Map();
       const cwd = state.cwd;
       const directoryStackCwdPublication = state.directoryStackCwdPublication;
@@ -44407,6 +44891,8 @@ var Runtime = class _Runtime {
             functionRestoration?.close();
             throw error;
           }
+          const callerLoopDepth = state.loopDepth;
+          if (mapfileCallbackStates.has(state)) state.loopDepth = 0;
           try {
             return { exitCode: await this.command(body, state, { ...io, ...context3, scriptName: body.sourceName ?? io.scriptName ?? "shell" }) };
           } catch (error) {
@@ -44420,6 +44906,7 @@ var Runtime = class _Runtime {
               savedPositionals.close();
               state.positionalSetVersion = positionalSetVersion;
               state.functionDepth--;
+              state.loopDepth = callerLoopDepth;
               state.depth--;
               state.locals.pop();
             };
@@ -44886,6 +45373,8 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
           return invocation2;
         }
       };
+      Reflect.deleteProperty(context2, invocationScope);
+      Reflect.deleteProperty(context2, valueScope);
       bindCommandIO(context2);
       bindFileOutputBudget(context2, (sink) => this.budget.sink(sink, runtime.signal));
       if (argumentValues.values.every((value2) => typeof value2 === "string")) Reflect.deleteProperty(context2, "argumentValues");
@@ -45889,12 +46378,120 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       allocation.close();
     }
   }
+  async mapfileBuiltin(context2, state) {
+    const allocation = this.budget.values.scope();
+    const work = { remaining: this.budget.limits.maxExpansionBytes * 8, signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+    let pinned;
+    let releaseHolding;
+    try {
+      const options3 = await mapfileOptions(context2, work, allocation);
+      if (arrayStore(state)?.get(options3.name)?.associative) throw new MapfileUsageError(`${options3.name}: not an indexed array`, 1);
+      if (state.readonlyVariables?.has(options3.name)) throw new MapfileUsageError(`${options3.name}: readonly variable`, 1);
+      if (controlNames.has(options3.name) || state.exported.has(options3.name)) throw new ArrayFailure("control or exported binding cannot be indexed");
+      const store = requireArrays(state);
+      const holding = store.owner.hold();
+      releaseHolding = () => holding.release();
+      if (!options3.preserve || !store.get(options3.name)) await this.arrayAssignment({ kind: "compound", name: options3.name, append: options3.preserve, entries: [] }, state, context2);
+      const entry = store.bindings.get(options3.name);
+      allocation.reserve(128 + import_buffer.Buffer.byteLength(options3.name) * 2, 0);
+      pinned = entry.binding.retain();
+      const input3 = context2.stdin instanceof ShellInput ? context2.stdin : new ShellInput(context2.stdin, this.budget, this.signal);
+      let pendingFlow;
+      await collectMapfile(options3, input3, {
+        allocation: () => this.budget.values.scope(),
+        loop: () => this.budget.loop(),
+        write: async (index, value2) => {
+          if (pinned !== entry.binding) {
+            const previous = pinned;
+            pinned = entry.binding.retain();
+            await previous.release();
+          }
+          const operation2 = ArrayOwner.create(store.owner.ledger, store.owner);
+          let staged;
+          try {
+            const current = pinned;
+            const attached = store.bindings.get(options3.name) === entry;
+            const watch = attached ? await store.watch(options3.name, operation2, this.signal) : void 0;
+            const supersede = attached ? await stateMonitor(state).prepareTypedPublication(options3.name, operation2, this.signal) : void 0;
+            if (attached) await this.prepareArrayObservers(state, operation2);
+            const tickets = operation2.reserve({ generation: true, version: true, epoch: true, work: 8 });
+            staged = current.references > (attached ? 2 : 1) ? await current.copy(this.signal) : current.retain();
+            const token = await valueToken(staged.owner, value2, this.signal);
+            try {
+              this.signal.throwIfAborted();
+              if (watch && !watch.valid()) throw new ArrayFailure("stale binding");
+              staged.insert(index, token);
+            } catch (error) {
+              token.release();
+              throw error;
+            }
+            if (attached) {
+              let released;
+              stateMonitor(state).publish(tickets, options3.name, () => {
+                supersede();
+                released = store.publish(options3.name, staged, tickets);
+              });
+              staged = void 0;
+              await released;
+            } else {
+              const previous = pinned;
+              pinned = staged;
+              entry.binding = staged;
+              staged = void 0;
+              await previous.release();
+            }
+          } finally {
+            try {
+              await staged?.release();
+            } finally {
+              await operation2.close();
+            }
+          }
+        },
+        callback: async (source2, index, value2) => {
+          if (pendingFlow) return;
+          const callbackAllocation = this.budget.values.scope();
+          const nested = mapfileCallbackStates.has(state);
+          try {
+            const quoted2 = shellValueText(await transformParameter(value2, "Q", { maximumBytes: this.budget.limits.maxExpansionBytes, byteLocale: byteLocale(state.variables), work, allocation: callbackAllocation }));
+            if (import_buffer.Buffer.byteLength(source2) + import_buffer.Buffer.byteLength(quoted2) + String(index).length + 2 > this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
+            mapfileCallbackStates.add(state);
+            await this.evalBuiltin({ ...context2, args: [source2, String(index), quoted2] }, state, context2, false);
+          } catch (error) {
+            if (error instanceof Flow2 && (error.kind === "break" || error.kind === "continue")) pendingFlow = error;
+            else throw error;
+          } finally {
+            if (!nested) mapfileCallbackStates.delete(state);
+            callbackAllocation.close();
+          }
+        }
+      });
+      if (pendingFlow) throw pendingFlow;
+      return 0;
+    } catch (error) {
+      this.signal.throwIfAborted();
+      if (!(error instanceof MapfileUsageError)) throw error;
+      await this.diagnostic(context2, `${context2.command}: ${error.message}`);
+      return error.status;
+    } finally {
+      try {
+        await pinned?.release();
+      } finally {
+        try {
+          releaseHolding?.();
+        } finally {
+          allocation.close();
+        }
+      }
+    }
+  }
   async builtin(context2, state, assignments2, diagnose, suppressSpecial = false) {
     const { command: command7, args, stdout, stderr } = context2;
     if (command7 === ":" || command7 === "true") return 0;
     if (command7 === "false") return 1;
     if (command7 === "shopt") return this.shoptBuiltin(context2, state);
     if (command7 === "let") return this.letBuiltin(context2, state);
+    if (command7 === "mapfile" || command7 === "readarray") return this.mapfileBuiltin(context2, state);
     if (command7 === "getopts") return this.getoptsBuiltin(context2, state);
     if (command7 === "pushd" || command7 === "dirs" || command7 === "popd") return this.directoryStackBuiltin(context2, state, diagnose);
     if (command7 === "pwd") {
@@ -45959,9 +46556,16 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       this.replacePositionals(state, this.positionalValues(state).slice(count2));
       return 0;
     }
-    if (command7 === "export" || command7 === "local" || command7 === "readonly") {
+    if (command7 === "export" || command7 === "local" || command7 === "readonly" || command7 === "declare") {
+      const associativeDeclaration = command7 === "declare";
       const declarationArgs = [...args];
-      let indexedLocal = false;
+      let indexedLocal = associativeDeclaration;
+      if (associativeDeclaration) {
+        if (declarationArgs.shift() !== "-A" || !declarationArgs.length) {
+          await this.diagnostic(context2, "declare: only -A NAME is supported");
+          return 2;
+        }
+      }
       if (command7 === "local") {
         const options3 = localDeclarationOptions(declarationArgs, this.signal);
         if (options3.error !== void 0) {
@@ -46024,11 +46628,11 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
           status2 = 1;
           continue;
         }
-        if (command7 === "local" && indexedLocal) {
+        if ((command7 === "local" || associativeDeclaration) && indexedLocal) {
           if (controlNames.has(name2)) throw new ArrayFailure("control binding cannot be indexed");
           if (state.exported.has(name2)) throw new ArrayFailure("exported binding cannot be indexed");
-          const existingLocal = locals.get(name2);
-          const saved = existingLocal ? void 0 : assignments2.get(name2) ?? saveVariable(state, name2);
+          const existingLocal = locals?.get(name2);
+          const saved = !locals || existingLocal ? void 0 : assignments2.get(name2) ?? saveVariable(state, name2);
           let operation2;
           let holding;
           let shadow;
@@ -46053,12 +46657,14 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
             const tickets = operation2.reserve({ generation: true, version: true, epoch: true, work: 8 });
             const prepared = await store.prepareName(name2, operation2, this.signal);
             const current = store.get(name2);
-            shadow = !saved && current ? await current.copy(this.signal) : IndexedBinding.create(store.owner);
+            if (!saved && current && current.associative !== associativeDeclaration) throw new ArrayFailure("cannot convert array kind");
+            shadow = !saved && current ? await current.copy(this.signal) : IndexedBinding.create(store.owner, associativeDeclaration);
             const value2 = match[2] ?? (!saved && !current && Object.hasOwn(state.variables, name2) ? state.variables[name2] : void 0);
             if (value2 !== void 0) {
-              const token = await textToken(shadow.owner, value2, this.signal);
+              const retained = associativeDeclaration && match[2] === void 0 ? stateMonitor(state).values.get(name2, value2) : value2;
+              const token = await valueToken(shadow.owner, retained, this.signal);
               try {
-                shadow.insert(0, token);
+                shadow.insert(associativeDeclaration ? await shadow.keyIndex("0", operation2, this.signal, true) : 0, token);
               } catch (error) {
                 token.release();
                 throw error;
@@ -46206,7 +46812,8 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     }
     if (command7 === "unset") {
       let status2 = 0;
-      for (const name2 of args) {
+      for (let argument2 = 0; argument2 < args.length; argument2++) {
+        const name2 = args[argument2];
         const selected = /^([a-zA-Z_][a-zA-Z_0-9]*)\[(.*)\]$/su.exec(name2);
         if (selected) {
           const base = selected[1];
@@ -46216,7 +46823,12 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
             status2 = 1;
             continue;
           }
-          if (selector === "@" || selector === "*") await this.unsetIndexed(state, base, "members");
+          const binding = arrayStore(state)?.get(base);
+          if (binding?.associative) {
+            const original = getCommandArguments(context2).values[argument2];
+            const index = typeof original === "string" ? await this.arrayIndex(binding, { decimal: selector, source: selector }, state, context2, binding.owner) : await binding.keyIndex(shellValueFromBytes(shellValueBytes(original, context2[valueScope]).subarray(base.length + 1, shellValueByteLength(original) - 1), context2[valueScope]), binding.owner, this.signal);
+            if (index !== void 0) await this.unsetIndexed(state, base, index);
+          } else if (selector === "@" || selector === "*") await this.unsetIndexed(state, base, "members");
           else {
             let index;
             try {
@@ -46447,6 +47059,31 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     }
   }
   async valuePart(part, state, io, hereString = false) {
+    if (part.kind === "variable" && part.transform) {
+      const selector2 = getArraySelector(part);
+      if (selector2?.kind === "members" || part.name === "@" || part.name === "*") {
+        const members = selector2 ? await this.arrayMembers(part.name, state, io, part.keys) : this.positionalValues(state);
+        const ifs = state.variables.IFS ?? " ";
+        const separator = ifs.length ? String.fromCodePoint(ifs.codePointAt(0)) : "";
+        const fragments = [];
+        let bytes3 = 0;
+        for (const member2 of members) {
+          const value3 = await this.transformValue(member2, part.transform, state, io);
+          bytes3 += shellValueByteLength(value3) + (fragments.length ? import_buffer.Buffer.byteLength(separator) : 0);
+          if (bytes3 > this.budget.limits.maxExpansionBytes) this.budget.fail("maxExpansionBytes");
+          io[valueScope]?.reserve(32, 0);
+          if (fragments.length) fragments.push(separator);
+          fragments.push(value3);
+        }
+        return concatShellValues(fragments, io[valueScope]);
+      }
+      const base = { ...part };
+      delete base.transform;
+      copyArraySelector(part, base);
+      const existing2 = selector2?.kind === "element" ? arrayStore(state)?.get(part.name)?.get(numericIndex(selector2.index) ?? -1) ?? (numericIndex(selector2.index) === 0 ? this.variable(state, part.name) : void 0) : /^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name) ? this.variable(state, part.name) : /^[1-9][0-9]*$/u.test(part.name) ? state.positional[Number(part.name) - 1] : "";
+      const value2 = await this.valuePart(base, state, io, hereString);
+      return existing2 === void 0 ? "" : this.transformValue(value2, part.transform, state, io);
+    }
     if (part.kind === "variable" && part.prefixNames) {
       const ifs = state.variables.IFS ?? " ";
       const separator = io.nameExpansionContext === "document" || io.nameExpansionContext === "conditional" && part.prefixNames === "@" ? " " : ifs.length ? String.fromCodePoint(ifs.codePointAt(0)) : "";
@@ -46465,10 +47102,22 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     const binding = part.kind === "variable" ? arrayStore(state)?.get(part.name) : void 0;
     const holding = binding ? requireArrays(state).owner.hold() : void 0;
     const selector = getArraySelector(part);
-    const index = selector?.kind === "element" ? numericIndex(selector.index) : 0;
+    if (selector?.kind === "element" && binding?.associative) {
+      try {
+        const index2 = await this.arrayIndex(binding, selector.index, state, io, binding.owner);
+        const token2 = index2 === void 0 ? void 0 : binding.values.get(index2)?.text;
+        this.requireParameter(token2?.value, part.kind === "variable" ? part.name : "", state, io);
+        if (part.kind === "variable" && part.length) return this.parameterLength(token2?.value ?? "");
+        return token2?.rawValue ? shellValueFromBytes(shellValueBytes(token2.rawValue, io[valueScope]), io[valueScope]) : token2?.value ?? "";
+      } finally {
+        holding?.release();
+      }
+    }
+    const index = selector?.kind === "element" ? numericIndex(selector.index) : binding?.associative ? binding.keys.get("30")?.index : 0;
     const token = index === void 0 || selector?.kind === "members" ? void 0 : binding?.values.get(index)?.text;
     token?.retain();
     try {
+      if (token?.rawValue && part.kind === "variable" && !part.length && !part.operator && !part.substring) return shellValueFromBytes(shellValueBytes(token.rawValue, io[valueScope]), io[valueScope]);
       const value2 = await this.partValue(part, state, io, hereString);
       if (binding) await textToken(requireArrays(state).owner, shellValueText(value2), this.signal);
       return value2;
@@ -46483,6 +47132,19 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     if (state.depth + parameterDepth > 64) throw new ShellSyntaxError("Syntax nesting exceeds 64", word.offset);
     return { ...io, parameterDepth };
   }
+  async transformValue(value2, operator, state, io) {
+    const allocation = io[valueScope] ?? this.budget.values.scope();
+    try {
+      return await transformParameter(value2, operator, {
+        maximumBytes: this.budget.limits.maxExpansionBytes,
+        byteLocale: byteLocale(state.variables),
+        allocation,
+        work: { remaining: Math.min(Number.MAX_SAFE_INTEGER, this.budget.limits.maxExpansionBytes * 8 + 1024), signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") }
+      });
+    } finally {
+      if (!io[valueScope]) allocation.close();
+    }
+  }
   async partValue(part, state, io, hereString) {
     this.signal.throwIfAborted();
     if (part.kind === "compound-substitution-eof") {
@@ -46573,8 +47235,11 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         return part.length ? this.parameterLength(value3 ?? "") : value3 ?? "";
       }
       if (part.length) return String(binding?.values.size ?? (state.variables[part.name] === void 0 ? 0 : 1));
-      const values = await this.arrayMembers(part.name, state);
-      return this.arrayJoin(store.owner, values, Array.from(state.variables.IFS ?? " ")[0] ?? "");
+      const values = await this.arrayMembers(part.name, state, io, part.keys);
+      const separator = Array.from(state.variables.IFS ?? " ")[0] ?? "";
+      if (values.every((value3) => typeof value3 === "string")) return this.arrayJoin(store.owner, values, separator);
+      io[valueScope]?.reserve(values.length * 32 + 64, 0);
+      return concatShellValues(values.flatMap((value3, index) => index ? [separator, value3] : [value3]), io[valueScope]);
     }
     let value2 = part.name === "?" ? String(state.status) : part.name === "-" ? `${state.errexit ? "e" : ""}${state.nounset ? "u" : ""}${state.braceexpand !== false ? "B" : ""}` : part.name === "#" ? String(state.positional.length) : part.name === "@" || part.name === "*" ? state.positional.join(hereString && (part.name === "@" || !part.quoted) ? " " : Array.from(state.variables.IFS ?? " ")[0] ?? "") : /^0+$/u.test(part.name) ? state.arg0 ?? "virtual-bash" : /^\d+$/u.test(part.name) ? state.positional[Number(part.name) - 1] : this.variable(state, part.name);
     let retained = value2;
@@ -46852,7 +47517,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
       return fields3;
     }
     const arrayOwned = word.parts.some((part) => part.kind === "variable" && !part.prefixNames && (getArraySelector(part) !== void 0 || arrayStore(state)?.get(part.name) !== void 0));
-    const prefixOwned = word.parts.some((part) => part.kind === "variable" && part.prefixNames === "@");
+    const prefixOwned = word.parts.some((part) => part.kind === "variable" && (part.prefixNames === "@" || part.transform && part.name === "@"));
     const owner = arrayOwned ? requireArrays(state).owner : void 0;
     const holding = owner?.hold();
     const scratch = !owner && split4 && state.variables.IFS !== "" && word.parts.some((part) => !part.quoted && part.kind !== "text") ? this.budget.values.scope() : void 0;
@@ -46982,19 +47647,25 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
             emptyNameGroups ??= /* @__PURE__ */ new Set();
             emptyNameGroups.add(quoteGroup);
           }
-        } else if (part.kind === "variable" && selector?.kind === "members" && !part.length && split4 && (!part.quoted || selector.separator === "@")) {
-          const members = await this.arrayMembers(part.name, state);
+        } else if (part.kind === "variable" && split4 && (selector?.kind === "members" && !part.length && (!part.quoted || selector.separator === "@") || part.transform && part.name === "@")) {
+          const members = selector?.kind === "members" ? await this.arrayMembers(part.name, state, io, part.keys) : this.positionalValues(state);
           for (let position = 0; position < members.length; position++) {
             if (position > 0) addField();
-            const value2 = members[position];
-            if (part.quoted || state.variables.IFS === "") append(value2, !part.quoted, part.quoted || value2.length > 0);
+            const original = members[position];
+            const value2 = part.transform ? await this.transformValue(original, part.transform, state, partIO) : original;
+            if (part.quoted || state.variables.IFS === "") append(value2, !part.quoted, part.quoted || shellValueByteLength(value2) > 0);
             else await appendSplit(value2);
           }
+          if (part.transform && members.length === 0 && quoteGroup) {
+            io[valueScope]?.reserve(32, 0);
+            emptyNameGroups ??= /* @__PURE__ */ new Set();
+            emptyNameGroups.add(quoteGroup);
+          }
         } else if (part.kind === "text" && !splitText) {
           let value2 = invokedValues.get(part) ?? part.byteValue ?? part.value;
           if (typeof value2 === "string" && index === 0 && !part.quoted && /^~(?:\/|$)/u.test(value2)) value2 = (state.variables.HOME ?? "~") + value2.slice(1);
           append(value2, !part.quoted, quotedPresence || shellValueByteLength(value2) > 0);
-        } else if (part.kind === "variable" && part.name === "@" && part.quoted && !part.operator && split4) {
+        } else if (part.kind === "variable" && part.name === "@" && part.quoted && !part.operator && !part.transform && split4) {
           for (let position = 0; position < state.positional.length; position++) {
             if (position > 0) addField();
             append(stateMonitor(state)?.positionals.get(String(position), state.positional[position]) ?? state.positional[position], false, true);
@@ -47119,7 +47790,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
     for (const value2 of values) if (typeof value2 !== "string") allocation.hold(value2);
     return createCommandArguments(values, allocation);
   }
-  async arrayMembers(name2, state) {
+  async arrayMembers(name2, state, io, keys = false) {
     const store = requireArrays(state);
     const holding = store.owner.hold();
     try {
@@ -47130,7 +47801,7 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         if (value2 === void 0) return [];
         store.owner.reserve({ metadata: 32, allocatedSlots: 1, work: 3 });
         await textToken(store.owner, value2, this.signal);
-        return [value2];
+        return [keys ? "0" : value2];
       }
       binding.retain();
       try {
@@ -47138,8 +47809,9 @@ ${prefix3} line ${offset + line}: \`${source2.split("\n")[line - 1] ?? ""}'
         const values = [];
         for (const index of indices) {
           store.owner.reserve({ metadata: 32, allocatedSlots: 1, work: 4 });
-          const value2 = binding.get(index);
-          await textToken(store.owner, value2, this.signal);
+          const token = keys ? binding.associative ? binding.keys.get(binding.keyByIndex.get(index)).text : await textToken(store.owner, String(index), this.signal) : binding.values.get(index).text;
+          const value2 = token.rawValue === void 0 ? token.value : shellValueFromBytes(shellValueBytes(token.rawValue, io[valueScope]), io[valueScope]);
+          if (typeof value2 === "string") await textToken(store.owner, value2, this.signal);
           values.push(value2);
           await store.owner.ledger.checkpoint(this.signal);
         }
@@ -47768,6 +48440,97 @@ var ShellInput = class _ShellInput {
   line(raw, options3) {
     return this.#cursor.consume(this.signal, () => options3 ? this.readBounded(raw, options3) : this.readLine(raw));
   }
+  /** Select uses read's escape rules without projecting raw REPLY bytes to text. */
+  selectLine(allocation) {
+    return this.#cursor.consume(this.signal, async () => {
+      allocation.reserve(64, 0);
+      const parts = [];
+      let escaping = false;
+      let length = 0;
+      let pulls = 0;
+      while (true) {
+        if (++pulls % 128 === 0) await yieldTurn(this.signal);
+        const result2 = await this.#cursor.take(this.signal);
+        if (result2.done) return { value: concatShellValues(parts, allocation), terminated: false };
+        const chunk = result2.value;
+        for (let offset = 0; offset < chunk.length; ) {
+          await yieldTurn(this.signal);
+          const end = Math.min(offset + 1024, chunk.length);
+          allocation.reserve(end - offset + 64, 0);
+          const output2 = new Uint8Array(end - offset);
+          let used = 0;
+          let terminated = false;
+          while (offset < end) {
+            const byte = chunk[offset++];
+            this.#cursor.position++;
+            if (++length > this.budget.limits.maxOutputBytes) this.budget.fail("maxOutputBytes");
+            if (byte === 0) continue;
+            if (escaping) {
+              escaping = false;
+              if (byte !== 10) output2[used++] = byte;
+            } else if (byte === 92) escaping = true;
+            else if (byte === 10) {
+              terminated = true;
+              break;
+            } else output2[used++] = byte;
+          }
+          if (used) {
+            allocation.reserve(32, 0);
+            parts.push(shellValueFromBytes(output2.subarray(0, used), allocation));
+          }
+          if (terminated) {
+            if (offset < chunk.length) this.#cursor.remainder = chunk.subarray(offset);
+            return { value: concatShellValues(parts, allocation), terminated: true };
+          }
+        }
+      }
+    });
+  }
+  mapfileRecord(delimiter, strip, allocation) {
+    return this.#cursor.consume(this.signal, async () => {
+      this.#cursor.admitBoundedRead();
+      allocation.reserve(64, 0);
+      const parts = [];
+      let length = 0;
+      let truncated = false;
+      let pulls = 0;
+      while (true) {
+        if (++pulls % 128 === 0) await yieldTurn(this.signal);
+        const result2 = await this.#cursor.take(this.signal);
+        if (result2.done) return { value: concatShellValues(parts, allocation), present: length > 0 };
+        const chunk = result2.value;
+        for (let offset = 0; offset < chunk.length; ) {
+          await yieldTurn(this.signal);
+          if (length >= this.budget.limits.maxOutputBytes) this.budget.fail("maxOutputBytes");
+          const end = Math.min(offset + 1024, chunk.length, offset + this.budget.limits.maxOutputBytes - length);
+          allocation.reserve(end - offset + 64, 0);
+          const output2 = new Uint8Array(end - offset);
+          let used = 0;
+          let terminated = false;
+          while (offset < end) {
+            const byte = chunk[offset++];
+            this.#cursor.position++;
+            if (++length > this.budget.limits.maxOutputBytes) this.budget.fail("maxOutputBytes");
+            if (byte === delimiter) {
+              if (!strip && byte !== 0 && !truncated) output2[used++] = byte;
+              terminated = true;
+              break;
+            }
+            if (byte === 0) truncated = true;
+            if (!truncated) output2[used++] = byte;
+          }
+          if (used) {
+            allocation.reserve(32, 0);
+            parts.push(shellValueFromBytes(output2.subarray(0, used), allocation));
+          }
+          if (terminated) {
+            if (offset < chunk.length) this.#cursor.remainder = chunk.subarray(offset);
+            return { value: concatShellValues(parts, allocation), present: true };
+          }
+        }
+      }
+    });
+  }
   async readBounded(raw, options3) {
     const text3 = new ReadText();
     let characters = 0;
@@ -49994,15 +50757,15 @@ function* entities2(text3) {
     const predefined = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
     if (Object.hasOwn(predefined, entity)) result2 += predefined[entity];
     else {
-      const hexadecimal = entity.startsWith("#x");
-      const digits = entity.slice(hexadecimal ? 2 : 1);
+      const hexadecimal2 = entity.startsWith("#x");
+      const digits = entity.slice(hexadecimal2 ? 2 : 1);
       if (!entity.startsWith("#") || !digits.length) invalid("undeclared entity");
       let point = 0;
       for (let index = 0; index < digits.length; index++) {
         const code = digits.charCodeAt(index);
-        const digit3 = code >= 48 && code <= 57 ? code - 48 : hexadecimal && code >= 65 && code <= 70 ? code - 55 : hexadecimal && code >= 97 && code <= 102 ? code - 87 : -1;
+        const digit3 = code >= 48 && code <= 57 ? code - 48 : hexadecimal2 && code >= 65 && code <= 70 ? code - 55 : hexadecimal2 && code >= 97 && code <= 102 ? code - 87 : -1;
         if (digit3 < 0) invalid("undeclared entity");
-        point = point * (hexadecimal ? 16 : 10) + digit3;
+        point = point * (hexadecimal2 ? 16 : 10) + digit3;
         if (point > 1114111) invalid("invalid character reference");
         if ((index + 1) % 512 === 0) yield 512;
       }
@@ -52082,182 +52845,6 @@ function safeJsCommands(options3 = {}) {
   } };
 }
 
-// packages/safe-bash/src/commands/network/fetch-transport.ts
-init_platform();
-
-// packages/safe-bash/src/commands/network/types.ts
-init_platform();
-var defaultNetworkLimits = Object.freeze({
-  maxUploadBytes: 64 * 1024 * 1024,
-  maxDownloadBytes: 64 * 1024 * 1024,
-  maxBufferBytes: 8 * 1024 * 1024,
-  maxHeaderBytes: 64 * 1024,
-  maxRedirects: 10,
-  maxRetries: 5,
-  maxUrls: 32,
-  maxTimeMs: 12e4,
-  maxTotalTimeMs: 12e4
-});
-var cloudflareWorkerNetworkLimits = Object.freeze({
-  maxUploadBytes: 4 * 1024 * 1024,
-  maxDownloadBytes: 4 * 1024 * 1024,
-  maxBufferBytes: 1024 * 1024,
-  maxHeaderBytes: 32 * 1024,
-  maxRedirects: 2,
-  maxRetries: 1,
-  maxUrls: 8,
-  maxTimeMs: 1e4,
-  maxTotalTimeMs: 1e4
-});
-var CurlError = class extends Error {
-  constructor(exitCode, message3) {
-    super(message3);
-    this.exitCode = exitCode;
-    this.name = "CurlError";
-  }
-  exitCode;
-};
-
-// packages/safe-bash/src/commands/network/fetch-transport.ts
-function requestBody(source2, signal) {
-  if (!source2) return void 0;
-  const iterator = source2[Symbol.asyncIterator]();
-  return new ReadableStream({
-    async pull(controller) {
-      try {
-        signal.throwIfAborted();
-        const next = await iterator.next();
-        if (next.done) controller.close();
-        else controller.enqueue(next.value);
-      } catch (error) {
-        controller.error(error);
-      }
-    },
-    async cancel(reason) {
-      await iterator.return?.(reason);
-    }
-  });
-}
-function createFetchTransport(options3 = {}) {
-  const fetchRequest = options3.fetch ?? globalThis.fetch;
-  if (typeof fetchRequest !== "function") throw new TypeError("Fetch is unavailable");
-  return async (input3) => {
-    input3.signal.throwIfAborted();
-    const url = new URL(input3.url);
-    if (url.protocol !== "http:" && url.protocol !== "https:") throw new CurlError(1, "Unsupported protocol");
-    if (input3.denyPrivateNetworks === true) throw new CurlError(7, "Fetch transport cannot enforce private-network denial");
-    const stopped = new AbortController();
-    const signal = AbortSignal.any([input3.signal, stopped.signal]);
-    const body = requestBody(input3.body, signal);
-    const headers = new Headers();
-    for (const [name2, value2] of input3.headers) headers.append(name2, value2);
-    const request = new Request(url, {
-      method: input3.method,
-      headers,
-      body,
-      credentials: "omit",
-      redirect: "manual",
-      signal,
-      ...body ? { duplex: "half" } : {}
-    });
-    let response;
-    const dispose = async () => {
-      stopped.abort();
-      if (response?.body) await response.body.cancel().catch(() => void 0);
-    };
-    input3.registerCleanup?.(dispose);
-    response = await fetchRequest(request);
-    const reader = response.body?.getReader();
-    const responseBody = reader ? (async function* () {
-      try {
-        while (true) {
-          input3.signal.throwIfAborted();
-          const next = await reader.read();
-          if (next.done) return;
-          yield next.value;
-        }
-      } finally {
-        reader.releaseLock();
-      }
-    })() : (async function* () {
-    })();
-    return {
-      status: response.status,
-      statusText: response.statusText,
-      headers: [...response.headers.entries()],
-      body: responseBody,
-      dispose
-    };
-  };
-}
-
-// packages/safe-bash/src/commands/network/authorizer.ts
-init_platform();
-
-// packages/safe-bash/src/commands/network/private-address.ts
-init_platform();
-function privateIPv4(first, second) {
-  return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31 || first === 100 && second >= 64 && second <= 127 || first === 198 && second >= 18 && second <= 19 || first >= 224;
-}
-function privateHostname(input3) {
-  const hostname = input3.toLowerCase().replace(/\.$/u, "").replace(/^\[|\]$/gu, "");
-  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1") return true;
-  if (hostname.includes(":")) {
-    const [prefix3, suffix2] = hostname.split("::");
-    const leading = prefix3 ? prefix3.split(":") : [];
-    const trailing = suffix2 ? suffix2.split(":") : [];
-    const hextets = new Array(8).fill(0);
-    for (let index = 0; index < leading.length; index++) hextets[index] = Number.parseInt(leading[index], 16);
-    for (let index = 0; index < trailing.length; index++) hextets[8 - trailing.length + index] = Number.parseInt(trailing[index], 16);
-    if (hextets.every((value2) => value2 === 0)) return true;
-    const mappedIPv4 = hextets.slice(0, 5).every((value2) => value2 === 0) && hextets[5] === 65535;
-    const translatedIPv4 = hextets.slice(0, 4).every((value2) => value2 === 0) && hextets[4] === 65535 && hextets[5] === 0;
-    const nat64IPv4 = hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((value2) => value2 === 0);
-    const compatibleIPv4 = hextets.slice(0, 6).every((value2) => value2 === 0);
-    if (mappedIPv4 || translatedIPv4 || nat64IPv4 || compatibleIPv4) {
-      return privateIPv4(hextets[6] >>> 8, hextets[6] & 255);
-    }
-    if (hextets[0] === 8194) return privateIPv4(hextets[1] >>> 8, hextets[1] & 255);
-    return (hextets[0] & 65024) === 64512 || (hextets[0] & 65472) === 65152 || (hextets[0] & 65472) === 65216 || (hextets[0] & 65280) === 65280 || hextets[0] === 100 && hextets[1] === 65435 && hextets[2] === 1;
-  }
-  const parts = hostname.split(".");
-  if (parts.length !== 4 || parts.some((part) => !part || Array.from(part).some((character) => character < "0" || character > "9"))) return false;
-  const octets = parts.map(Number);
-  if (octets.some((value2) => value2 < 0 || value2 > 255)) return false;
-  const [first, second] = octets;
-  return privateIPv4(first, second);
-}
-
-// packages/safe-bash/src/commands/network/authorizer.ts
-function createOriginAuthorizer(allowlist = "*", options3 = {}) {
-  const denyPrivateNetworks = options3.denyPrivateNetworks === true;
-  const origins = /* @__PURE__ */ new Set();
-  const hosts = /* @__PURE__ */ new Set();
-  for (const entry of allowlist === "*" ? [] : allowlist) {
-    const value2 = entry.trim();
-    if (!value2) throw new TypeError("Origin allowlist entries must not be empty");
-    if (value2.includes("://")) {
-      const url = new URL(value2);
-      if (url.pathname !== "/" || url.search || url.hash || url.username || url.password) {
-        throw new TypeError(`Origin allowlist entry must be an origin: ${entry}`);
-      }
-      origins.add(url.origin);
-    } else {
-      if (value2.includes("/") || value2.includes("@")) throw new TypeError(`Invalid hostname allowlist entry: ${entry}`);
-      hosts.add(value2.toLowerCase().replace(/\.$/u, ""));
-    }
-  }
-  return (request) => {
-    const url = new URL(request.url);
-    const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
-    if (denyPrivateNetworks) {
-      request.requirePrivateNetworkDeny?.();
-      if (privateHostname(hostname)) return false;
-    }
-    return allowlist === "*" || origins.has(url.origin) || hosts.has(hostname);
-  };
-}
-
 // packages/safe-bash/src/commands/grep-aliases/index.ts
 init_platform();
 function createGrepAliasCommands(options3 = {}) {
@@ -52327,6 +52914,7 @@ export {
   ACCESS_MODES,
   CommandArgumentIdentityError,
   CommandRegistry,
+  CurlError,
   DEFAULT_ARCHIVE_LIMITS,
   EreLedger,
   EreProfileLimitError,
@@ -52368,6 +52956,8 @@ export {
   createColumnCommand,
   createColumnCommands,
   createCommandArguments,
+  createCurlCommand,
+  createCurlCommands,
   createDiffPatchCommands,
   createDuCommand,
   createDuCommands,
@@ -52382,6 +52972,7 @@ export {
   createMemoryFileSystem2 as createMemoryFileSystem,
   createMetadataCommands,
   createMountFileSystem2 as createMountFileSystem,
+  createNetworkCommands,
   createOriginAuthorizer,
   createOutputOperation,
   createOverlayFileSystem2 as createOverlayFileSystem,
@@ -52401,13 +52992,16 @@ export {
   createTimeoutCommands,
   createTreeCommand,
   createTreeCommands,
+  createWgetCommand,
   createWhichCommand,
   createWhichCommands,
   createXmlCommands,
   createYqCommand,
   createYqCommands,
+  curlCommands,
   defaultJqLimits,
   defaultMemoryFileSystemLimits2 as defaultMemoryFileSystemLimits,
+  defaultNetworkLimits,
   defaultSafeJsLimits,
   defaultXmlQueryLimits,
   diffPatchCommands,
@@ -52430,6 +53024,7 @@ export {
   makeSafeJsShellModule,
   matchEre,
   metadataCommands,
+  networkCommands,
   normalizePath2 as normalizePath,
   outputFailure,
   parseShell,