Merge pull request #221 from aykhans/dependabot/go_modules/charm.land/bubbles/v2-2.2.0

build(deps): bump charm.land/bubbles/v2 from 2.1.1 to 2.2.0
fix(nix): update vendorHash for bubbles 2.2.0
2026-08-29 03:24:33 +00:00 · 2026-08-25 10:43:40 +04:00 · 2026-08-25 10:28:29 +04:00 · 2026-08-25 00:12:58 +00:00 · 2026-08-24 16:07:49 +04:00 · 2026-08-24 15:46:34 +04:00
44 changed files with 5039 additions and 1459 deletions
@@ -1,2 +1 @@
 buy_me_a_coffee: aykhan
-custom: https://commerce.coinbase.com/checkout/0f33d2fb-54a6-44f5-8783-006ebf70d1a0
@@ -13,11 +13,15 @@ jobs:
    name: lint
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
        with:
-          go-version: 1.25.5
+          go-version: 1.26.5
+      - name: go fix
+        run: |
+          go fix ./...
+          git diff --exit-code
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
-          version: v2.7.2
+          version: v2.12.2
@@ -0,0 +1,36 @@
+name: nix
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - "go.mod"
+      - "go.sum"
+      - "nix/**"
+      - "flake.nix"
+      - "flake.lock"
+  workflow_call:
+    inputs:
+      ref:
+        description: "Ref to check out. Defaults to the triggering ref."
+        type: string
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: nix build
+        run: nix build .#default --no-link --print-build-logs
@@ -21,13 +21,49 @@ permissions:
  contents: write

 jobs:
+  nix:
+    name: Verify Nix package
+    uses: ./.github/workflows/nix.yaml
+    with:
+      ref: ${{ inputs.tag || github.ref }}
+
+  # nix/package.nix carries its own version string that has to be bumped by
+  # hand; catch a forgotten bump before the tag ships.
+  version:
+    name: Verify package version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Check nix/package.nix matches the release tag
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          expected="${TAG#v}"
+          actual="$(sed -n 's/^[[:space:]]*version = "\([^"]*\)".*/\1/p' nix/package.nix | head -1)"
+          if [ -z "$actual" ]; then
+            echo "::error file=nix/package.nix::could not read the version string"
+            exit 1
+          fi
+          if [ "$actual" != "$expected" ]; then
+            echo "::error file=nix/package.nix::version is '$actual' but the release tag is '$TAG' (expected '$expected')"
+            exit 1
+          fi
+          echo "nix/package.nix version '$actual' matches tag '$TAG'"
+
  build:
    name: Build binaries
+    needs: [nix, version]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag || github.ref }}

@@ -35,11 +71,11 @@ jobs:
        run: |
          echo "VERSION=$(git describe --tags --always)" >> $GITHUB_ENV
          echo "GIT_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
-          echo "GO_VERSION=1.25.5" >> $GITHUB_ENV
+          echo "GO_VERSION=1.26.5" >> $GITHUB_ENV

      - name: Set up Go
        if: github.event_name == 'release' || inputs.build_binaries
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true
@@ -53,38 +89,40 @@ jobs:
                   -X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)' \
                   -s -w"

-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=linux   GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-amd64 ./cmd/cli/main.go
-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=linux   GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-arm64 ./cmd/cli/main.go
-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=darwin  GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-amd64 ./cmd/cli/main.go
-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=darwin  GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-arm64 ./cmd/cli/main.go
-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=windows GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-amd64.exe ./cmd/cli/main.go
-          CGO_ENABLED=0 GOEXPERIMENT=greenteagc GOOS=windows GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-arm64.exe ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=linux   GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-amd64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=linux   GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-linux-arm64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-amd64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=freebsd GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-freebsd-arm64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=darwin  GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-amd64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=darwin  GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-darwin-arm64 ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-amd64.exe ./cmd/cli/main.go
+          CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-arm64.exe ./cmd/cli/main.go

      - name: Upload Release Assets
        if: github.event_name == 'release' || inputs.build_binaries
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          files: ./sarin-*

      - name: Set up QEMU
        if: github.event_name == 'release' || inputs.build_docker
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        if: github.event_name == 'release' || inputs.build_docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
        if: github.event_name == 'release' || inputs.build_docker
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        if: github.event_name == 'release' || inputs.build_docker
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -1 +1,5 @@
 bin/*
+
+# Nix build artifacts
+result
+result-*
@@ -1,7 +1,7 @@
 version: "2"

 run:
-  go: "1.25"
+  go: "1.26"
  concurrency: 12

 linters:
@@ -29,7 +29,6 @@ linters:
    - errorlint
    - exptostd
    - fatcontext
-    - forcetypeassert
    - funcorder
    - gocheckcompilerdirectives
    - gocritic
@@ -82,6 +81,11 @@ linters:
          - staticcheck
        text: "SA5011"

+      - linters:
+          - errcheck
+          - gosec
+        source: "lipgloss\\.Println\\("
+
 formatters:
  enable:
    - gofmt
@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.25.5
+ARG GO_VERSION=1.26.5

 FROM docker.io/library/golang:${GO_VERSION}-alpine AS builder

@@ -12,7 +12,7 @@ RUN --mount=type=bind,source=./go.mod,target=./go.mod \
    go mod download

 RUN --mount=type=bind,source=./,target=./ \
-    CGO_ENABLED=0 GOEXPERIMENT=greenteagc go build \
+    CGO_ENABLED=0 go build \
    -ldflags "-X 'go.aykhans.me/sarin/internal/version.Version=${VERSION}' \
    -X 'go.aykhans.me/sarin/internal/version.GitCommit=${GIT_COMMIT}' \
    -X 'go.aykhans.me/sarin/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)' \
@@ -2,6 +2,12 @@

 ## Sarin is a high-performance HTTP load testing tool built with Go and fasthttp.

+[![Go Reference](https://pkg.go.dev/badge/go.aykhans.me/sarin.svg)](https://pkg.go.dev/go.aykhans.me/sarin)
+[![Docker Pulls](https://img.shields.io/docker/pulls/aykhans/sarin)](https://hub.docker.com/r/aykhans/sarin)
+[![Downloads](https://img.shields.io/github/downloads/aykhans/sarin/total?cacheSeconds=3600)](https://github.com/aykhans/sarin/releases)
+[![Lint](https://img.shields.io/github/actions/workflow/status/aykhans/sarin/lint.yaml?branch=main&label=lint)](https://github.com/aykhans/sarin/actions/workflows/lint.yaml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
 </div>

 ![Demo](docs/static/demo.gif)
@@ -16,22 +22,23 @@

 ## Overview

-Sarin is designed for efficient HTTP load testing with minimal resource consumption. It prioritizes simplicity—features like templating add zero overhead when unused.
+Sarin is designed for efficient HTTP load testing with minimal resource consumption. It prioritizes simplicity and features like templating add zero overhead when unused.

-| ✅ Supported                                               | ❌ Not Supported                  |
-| ---------------------------------------------------------- | --------------------------------- |
-| High-performance with low memory footprint                 | Detailed response body analysis   |
-| Long-running duration/count based tests                    | Extensive response statistics     |
-| Dynamic requests via 320+ template functions               | Web UI or complex TUI             |
-| Multiple proxy protocols<br>(HTTP, HTTPS, SOCKS5, SOCKS5H) | Scripting or multi-step scenarios |
-| Flexible config (CLI, ENV, YAML)                           | HTTP/2, HTTP/3, WebSocket, gRPC   |
+| ✅ Supported                                               | ❌ Not Supported                |
+| ---------------------------------------------------------- | ------------------------------- |
+| High-performance with low memory footprint                 | Web UI or complex TUI           |
+| Dynamic requests via 340+ template functions               | Detailed response body analysis |
+| Request scripting with Lua and JavaScript                  | Distributed load testing        |
+| Multiple proxy protocols<br>(HTTP, HTTPS, SOCKS5, SOCKS5H) | HTTP/2, HTTP/3, WebSocket, gRPC |
+| Captcha solving<br>(2Captcha, Anti-Captcha, CapSolver)     | Plugins / extensions ecosystem  |

 ## Installation

-### Docker (Recommended)
+<details open>
+<summary><b>Docker</b></summary>

 ```sh
-docker pull aykhans/sarin:latest
+docker run --rm -it aykhans/sarin:latest --version
 ```

 With a local config file:
@@ -46,18 +53,53 @@ With a remote config file:
 docker run --rm -it aykhans/sarin -f https://example.com/config.yaml
 ```

-### Pre-built Binaries
+</details>
+
+<details>
+<summary><b>Nix</b></summary>
+
+Run directly without installing (requires flakes enabled):
+
+```sh
+nix run github:aykhans/sarin -- -U http://example.com -r 100 -c 10
+```
+
+Install into your profile:
+
+```sh
+nix profile install github:aykhans/sarin
+```
+
+Or add it to your own flake via the overlay:
+
+```nix
+{
+  inputs.sarin.url = "github:aykhans/sarin";
+
+  # In your outputs, apply the overlay to nixpkgs:
+  # nixpkgs.overlays = [ inputs.sarin.overlays.default ];
+  # then reference pkgs.sarin
+}
+```
+
+</details>
+
+<details>
+<summary><b>Pre-built Binaries</b></summary>

 Download the latest binaries from the [releases](https://github.com/aykhans/sarin/releases) page.

-### Building from Source
+</details>

-Requires [Go 1.25+](https://golang.org/dl/).
+<details>
+<summary><b>Building from Source</b></summary>
+
+Requires [Go 1.26+](https://golang.org/dl/).

 ```sh
 git clone https://github.com/aykhans/sarin.git && cd sarin

-CGO_ENABLED=0 GOEXPERIMENT=greenteagc go build \
+CGO_ENABLED=0 go build \
    -ldflags "-X 'go.aykhans.me/sarin/internal/version.Version=dev' \
    -X 'go.aykhans.me/sarin/internal/version.GitCommit=$(git rev-parse HEAD)' \
    -X 'go.aykhans.me/sarin/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)' \
@@ -66,6 +108,8 @@ CGO_ENABLED=0 GOEXPERIMENT=greenteagc go build \
    -o sarin ./cmd/cli/main.go
 ```

+</details>
+
 ## Quick Start

 Send 10,000 GET requests with 50 concurrent connections and a random User-Agent for each request:
@@ -93,22 +137,22 @@ For more usage examples, see the **[Examples Guide](docs/examples.md)**.
 Sarin supports environment variables, CLI flags, and YAML files. When the same option is specified in multiple sources, the following priority order applies:

 ```
-YAML (Highest) > CLI Flags > Environment Variables (Lowest)
+CLI Flags (Highest) > YAML > Environment Variables (Lowest)
 ```

 For detailed documentation on all configuration options (URL, method, timeout, concurrency, headers, cookies, proxy, etc.), see the **[Configuration Guide](docs/configuration.md)**.

 ## Templating

-Sarin supports Go templates in URL paths, methods, bodies, headers, params, cookies, and values. Use the 320+ built-in functions to generate dynamic data for each request.
+Sarin supports Go templates in URL paths, methods, bodies, headers, params, cookies, and values. Use the 340+ built-in functions to generate dynamic data for each request.

 **Example:**

 ```sh
 sarin -U "http://example.com/users/{{ fakeit_UUID }}" -r 1000 -c 10 \
-  -V "RequestID={{ fakeit_UUID }}" \
-  -H "X-Request-ID: {{ .Values.RequestID }}" \
-  -B '{"request_id": "{{ .Values.RequestID }}"}'
+  -V "REQUEST_ID={{ fakeit_UUID }}" \
+  -H "X-Request-ID: {{ .Values.REQUEST_ID }}" \
+  -B '{"request_id": "{{ .Values.REQUEST_ID }}"}'
 ```

 For the complete templating guide and functions reference, see the **[Templating Guide](docs/templating.md)**.
@@ -3,7 +3,7 @@ version: "3"

 vars:
  BIN_DIR: ./bin
-  GOLANGCI_LINT_VERSION: v2.7.2
+  GOLANGCI_LINT_VERSION: v2.12.2
  GOLANGCI: "{{.BIN_DIR}}/golangci-lint-{{.GOLANGCI_LINT_VERSION}}"

 tasks:
@@ -11,16 +11,22 @@ tasks:
    desc: Run fmt, tidy, and lint.
    cmds:
      - task: fmt
+      - task: fix
      - task: tidy
      - task: lint

  fmt:
-    desc: Run linters
+    desc: Run format
    deps:
      - install-golangci-lint
    cmds:
      - "{{.GOLANGCI}} fmt"

+  fix:
+    desc: Run go fix
+    cmds:
+      - go fix ./...
+
  tidy:
    desc: Run go mod tidy.
    cmds:
@@ -52,7 +58,7 @@ tasks:
    cmds:
      - rm -f {{.OUTPUT}}
      - >-
-        CGO_ENABLED=0 GOEXPERIMENT=greenteagc go build
+        CGO_ENABLED=0 go build
        -ldflags "-X 'go.aykhans.me/sarin/internal/version.Version=$(git describe --tags --always)'
        -X 'go.aykhans.me/sarin/internal/version.GitCommit=$(git rev-parse HEAD)'
        -X 'go.aykhans.me/sarin/internal/version.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)'
@@ -68,7 +74,7 @@ tasks:
      - test -f {{.GOLANGCI}}
    cmds:
      - rm -f {{.GOLANGCI}}
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b {{.BIN_DIR}} {{.GOLANGCI_LINT_VERSION}}
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/main/install.sh | sh -s -- -b {{.BIN_DIR}} {{.GOLANGCI_LINT_VERSION}}
      - mv {{.BIN_DIR}}/golangci-lint {{.GOLANGCI}}

  docker-build:
@@ -7,6 +7,7 @@ import (
 	"os/signal"
 	"syscall"

+	"charm.land/lipgloss/v2"
 	"go.aykhans.me/sarin/internal/config"
 	"go.aykhans.me/sarin/internal/sarin"
 	"go.aykhans.me/sarin/internal/types"
@@ -15,7 +16,8 @@ import (

 func main() {
 	ctx, cancel := context.WithCancel(context.Background())
-	go listenForTermination(func() { cancel() })
+	stopCtrl := sarin.NewStopController(cancel)
+	go listenForTermination(stopCtrl.Stop)

 	combinedConfig := config.ReadAllConfigs()

@@ -31,13 +33,13 @@ func main() {
 		utilsErr.OnType(func(err types.FieldValidationErrors) error {
 			for _, fieldErr := range err.Errors {
 				if fieldErr.Value == "" {
-					fmt.Fprintln(os.Stderr,
+					fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 						config.StyleYellow.Render(fmt.Sprintf("[VALIDATION] Field '%s': ", fieldErr.Field))+fieldErr.Err.Error(),
-					)
+					))
 				} else {
-					fmt.Fprintln(os.Stderr,
+					fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 						config.StyleYellow.Render(fmt.Sprintf("[VALIDATION] Field '%s' (%s): ", fieldErr.Field, fieldErr.Value))+fieldErr.Err.Error(),
-					)
+					))
 				}
 			}
 			os.Exit(1)
@@ -49,20 +51,31 @@ func main() {
 		ctx,
 		combinedConfig.Methods, combinedConfig.URL, *combinedConfig.Timeout,
 		*combinedConfig.Concurrency, combinedConfig.Requests, combinedConfig.Duration,
-		*combinedConfig.Quiet, *combinedConfig.Insecure, combinedConfig.Params, combinedConfig.Headers,
+		*combinedConfig.Progress == config.ConfigProgressTypeBar, *combinedConfig.Insecure, combinedConfig.Params, combinedConfig.Headers,
 		combinedConfig.Cookies, combinedConfig.Bodies, combinedConfig.Proxies, combinedConfig.Values,
 		*combinedConfig.Output != config.ConfigOutputTypeNone,
-		*combinedConfig.DryRun,
+		*combinedConfig.DryRun, *combinedConfig.LogLevel, *combinedConfig.LogFile,
+		combinedConfig.Lua, combinedConfig.Js,
 	)
 	_ = utilsErr.MustHandle(err,
 		utilsErr.OnType(func(err types.ProxyDialError) error {
-			fmt.Fprintln(os.Stderr, config.StyleRed.Render("[PROXY] ")+err.Error())
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(config.StyleRed.Render("[PROXY] ")+err.Error()))
+			os.Exit(1)
+			return nil
+		}),
+		utilsErr.OnSentinel(types.ErrScriptEmpty, func(err error) error {
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(config.StyleRed.Render("[SCRIPT] ")+err.Error()))
+			os.Exit(1)
+			return nil
+		}),
+		utilsErr.OnType(func(err types.ScriptLoadError) error {
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(config.StyleRed.Render("[SCRIPT] ")+err.Error()))
 			os.Exit(1)
 			return nil
 		}),
 	)

-	srn.Start(ctx)
+	srn.Start(ctx, stopCtrl)

 	switch *combinedConfig.Output {
 	case config.ConfigOutputTypeNone:
@@ -76,9 +89,10 @@ func main() {
 	}
 }

-func listenForTermination(do func()) {
-	sigChan := make(chan os.Signal, 1)
+func listenForTermination(stop func()) {
+	sigChan := make(chan os.Signal, 4)
 	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
-	<-sigChan
-	do()
+	for range sigChan {
+		stop()
+	}
 }
@@ -1,11 +1,11 @@
 # Configuration

-Sarin supports environment variables, CLI flags, and YAML files. However, they are not exactly equivalent—YAML files have the most configuration options, followed by CLI flags, and then environment variables.
+Sarin supports environment variables, CLI flags, and YAML files. However, they are not exactly equivalent: YAML files have the most configuration options, followed by CLI flags, and then environment variables.

 When the same option is specified in multiple sources, the following priority order applies:

 ```
-YAML (Highest) > CLI Flags > Environment Variables (Lowest)
+CLI Flags (Highest) > YAML > Environment Variables (Lowest)
 ```

 Use `-s` or `--show-config` to see the final merged configuration before sending requests.
@@ -14,8 +14,8 @@ Use `-s` or `--show-config` to see the final merged configuration before sending

 > **Note:** For CLI flags with `string / []string` type, the flag can be used once with a single value or multiple times to provide multiple values.

-| Name                        | YAML                                | CLI                                           | ENV                              | Default | Description                  |
-| --------------------------- | ----------------------------------- | --------------------------------------------- | -------------------------------- | ------- | ---------------------------- |
+| Name                        | YAML                                | CLI                                          | ENV                              | Default | Description                  |
+| --------------------------- | ----------------------------------- | -------------------------------------------- | -------------------------------- | ------- | ---------------------------- |
 | [Help](#help)               | -                                   | `-help` / `-h`                               | -                                | -       | Show help message            |
 | [Version](#version)         | -                                   | `-version` / `-v`                            | -                                | -       | Show version and build info  |
 | [Show Config](#show-config) | `showConfig`<br>(boolean)           | `-show-config` / `-s`<br>(boolean)           | `SARIN_SHOW_CONFIG`<br>(boolean) | `false` | Show merged configuration    |
@@ -26,7 +26,9 @@ Use `-s` or `--show-config` to see the final merged configuration before sending
 | [Concurrency](#concurrency) | `concurrency`<br>(number)           | `-concurrency` / `-c`<br>(number)            | `SARIN_CONCURRENCY`<br>(number)  | `1`     | Number of concurrent workers |
 | [Requests](#requests)       | `requests`<br>(number)              | `-requests` / `-r`<br>(number)               | `SARIN_REQUESTS`<br>(number)     | -       | Total requests to send       |
 | [Duration](#duration)       | `duration`<br>(duration)            | `-duration` / `-d`<br>(duration)             | `SARIN_DURATION`<br>(duration)   | -       | Test duration                |
-| [Quiet](#quiet)             | `quiet`<br>(boolean)                | `-quiet` / `-q`<br>(boolean)                 | `SARIN_QUIET`<br>(boolean)       | `false` | Hide progress bar and logs   |
+| [Log Level](#log-level)     | `logLevel`<br>(string)              | `-log-level` / `-l`<br>(string)              | `SARIN_LOG_LEVEL`<br>(string)    | `error` | Runtime log levels to emit   |
+| [Log File](#log-file)       | `logFile`<br>(string)               | `-log-file` / `-w`<br>(string)               | `SARIN_LOG_FILE`<br>(string)     | -       | Write runtime logs to a file |
+| [Progress](#progress)       | `progress`<br>(string)              | `-progress` / `-p`<br>(string)               | `SARIN_PROGRESS`<br>(string)     | `bar`   | Progress display (bar/none)  |
 | [Output](#output)           | `output`<br>(string)                | `-output` / `-o`<br>(string)                 | `SARIN_OUTPUT`<br>(string)       | `table` | Output format for stats      |
 | [Dry Run](#dry-run)         | `dryRun`<br>(boolean)               | `-dry-run` / `-z`<br>(boolean)               | `SARIN_DRY_RUN`<br>(boolean)     | `false` | Generate without sending     |
 | [Insecure](#insecure)       | `insecure`<br>(boolean)             | `-insecure` / `-I`<br>(boolean)              | `SARIN_INSECURE`<br>(boolean)    | `false` | Skip TLS verification        |
@@ -36,6 +38,8 @@ Use `-s` or `--show-config` to see the final merged configuration before sending
 | [Cookies](#cookies)         | `cookies`<br>(object)               | `-cookie` / `-C`<br>(string / []string)      | `SARIN_COOKIE`<br>(string)       | -       | HTTP cookies                 |
 | [Proxy](#proxy)             | `proxy`<br>(string / []string)      | `-proxy` / `-X`<br>(string / []string)       | `SARIN_PROXY`<br>(string)        | -       | Proxy URL(s)                 |
 | [Values](#values)           | `values`<br>(string / []string)     | `-values` / `-V`<br>(string / []string)      | `SARIN_VALUES`<br>(string)       | -       | Template values (key=value)  |
+| [Lua](#lua)                 | `lua`<br>(string / []string)        | `-lua`<br>(string / []string)                | `SARIN_LUA`<br>(string)          | -       | Lua script(s)                |
+| [Js](#js)                   | `js`<br>(string / []string)         | `-js`<br>(string / []string)                 | `SARIN_JS`<br>(string)           | -       | JavaScript script(s)         |

 ---

@@ -43,36 +47,71 @@ Use `-s` or `--show-config` to see the final merged configuration before sending

 Show help message.

+```sh
+sarin -help
+```
+
 ## Version

 Show version and build information.

+```sh
+sarin -version
+```
+
 ## Show Config

 Show the final merged configuration before sending requests.

+```sh
+sarin -show-config
+```
+
 ## Config File

 Path to configuration file(s). Supports local paths and remote URLs.

-If multiple config files are specified, they are merged in order. Later files override earlier ones.
+**Priority Rules:**
+
+1. **CLI flags** (`-f`) have highest priority, processed left to right (rightmost wins)
+2. **Included files** (via `configFile` property) are processed with lower priority than their parent
+3. **Environment variable** (`SARIN_CONFIG_FILE`) has lowest priority

 **Example:**

 ```yaml
 # config2.yaml
 configFile: /config4.yaml
+url: http://from-config2.com
 ```

 ```sh
 SARIN_CONFIG_FILE=/config1.yaml sarin -f /config2.yaml -f https://example.com/config3.yaml
 ```

-In this example, all 4 config files are read and merged with the following priority:
+**Resolution order (lowest to highest priority):**

-```
-config3.yaml > config2.yaml > config4.yaml > config1.yaml
-```
+| Source                   | File         | Priority |
+| ------------------------ | ------------ | -------- |
+| ENV (SARIN_CONFIG_FILE)  | config1.yaml | Lowest   |
+| Included by config2.yaml | config4.yaml | ↑        |
+| CLI -f (first)           | config2.yaml | ↑        |
+| CLI -f (second)          | config3.yaml | Highest  |
+
+**Why this order?**
+
+- `config1.yaml` comes from ENV → lowest priority
+- `config2.yaml` comes from CLI → higher than ENV
+- `config4.yaml` is included BY `config2.yaml` → inherits position below its parent
+- `config3.yaml` comes from CLI after `config2.yaml` → highest priority
+
+If all four files define `url`, the value from `config3.yaml` wins.
+
+**Merge behavior by field:**
+
+- **Scalar fields** (`url`, `requests`, `duration`, `timeout`, `concurrency`, etc.): higher priority overrides lower priority
+- **Method and Body**: higher priority overrides lower priority (no merging)
+- **Headers, Params, Cookies, Proxies, Values, Lua, and Js**: accumulated across all config files

 ## URL

@@ -94,7 +133,7 @@ sarin -U "http://example.com/users/{{ fakeit_UUID }}" -r 1000 -c 10

 ## Method

-HTTP method(s). If multiple values are provided, Sarin cycles through them randomly for each request. Supports [templating](templating.md).
+HTTP method(s). Defaults to `GET`. If multiple values are provided, Sarin starts at a random index and cycles through them in order. Once the cycle completes, it picks a new random starting point. Supports [templating](templating.md).

 **YAML example:**

@@ -104,9 +143,9 @@ method: GET
 # OR

 method:
-  - GET
-  - POST
-  - PUT
+    - GET
+    - POST
+    - PUT
 ```

 **CLI example:**
@@ -123,7 +162,7 @@ SARIN_METHOD=GET

 ## Timeout

-Request timeout. Must be greater than 0.
+Request timeout. Must be greater than 0. Defaults to `10s`.

 Valid time units: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`

@@ -131,7 +170,7 @@ Valid time units: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`

 ## Concurrency

-Number of concurrent workers. Must be between 1 and 100,000,000.
+Number of concurrent workers. Must be between 1 and 100,000,000. Defaults to `1`.

 ## Requests

@@ -145,15 +184,34 @@ Valid time units: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`

 **Examples:** `1m30s`, `25s`, `1h`

-## Quiet
+## Log Level

-Hide the progress bar and runtime logs.
+Runtime log levels to emit, comma-separated. Valid levels: `info`, `error`. Defaults to `error`.
+
+- `error`: errors that occur while generating or sending a request
+- `info`: every completed response
+
+Leave empty to disable logging entirely.
+
+**Examples:** `error` (only errors), `info` (only responses), `info,error` (both)
+
+## Log File
+
+Write runtime logs to this file instead of the terminal or stderr. The parent directory must exist.
+
+```sh
+sarin -U http://example.com -r 1000 --log-file ./run.log
+```
+
+## Progress
+
+Progress display. Valid values: `bar` (default), `none`. Use `none` to hide the progress bar.

 ## Output

 Output format for response statistics.

-Valid formats: `table`, `json`, `yaml`, `none`
+Valid formats: `table` (default), `json`, `yaml`, `none`

 Using `none` disables output and reduces memory usage since response statistics are not stored.

@@ -167,7 +225,7 @@ Skip TLS certificate verification.

 ## Body

-Request body. If multiple values are provided, Sarin cycles through them randomly for each request. Supports [templating](templating.md).
+Request body. If multiple values are provided, Sarin starts at a random index and cycles through them in order. Once the cycle completes, it picks a new random starting point. Supports [templating](templating.md).

 **YAML example:**

@@ -177,9 +235,9 @@ body: '{"product": "car"}'
 # OR

 body:
-  - '{"product": "car"}'
-  - '{"product": "phone"}'
-  - '{"product": "watch"}'
+    - '{"product": "car"}'
+    - '{"product": "phone"}'
+    - '{"product": "watch"}'
 ```

 **CLI example:**
@@ -196,26 +254,33 @@ SARIN_BODY='{"product": "car"}'

 ## Params

-URL query parameters. If multiple values are provided for a key, Sarin cycles through them randomly for each request. Supports [templating](templating.md).
+URL query parameters. Supports [templating](templating.md).
+
+When the same key appears as **separate entries** (in CLI or config file), all values are sent in every request. When multiple values are specified as an **array on a single key** (config file only), Sarin cycles through them.

 **YAML example:**

 ```yaml
 params:
-  key1: value1
-  key2: [value2, value3]
+    key1: value1
+    key2: [value2, value3] # cycles between value2 and value3

 # OR

 params:
-  - key1: value1
-  - key2: [value2, value3]
+    - key1: value1
+    - key2: [value2, value3] # cycles between value2 and value3
+
+# To send both values in every request, use separate entries:
+params:
+    - key2: value2
+    - key2: value3 # both sent in every request
 ```

 **CLI example:**

 ```sh
-param "key1=value1" -param "key2=value2" -param "key2=value3"
+-param "key1=value1" -param "key2=value2" -param "key2=value3"  # sends both value2 and value3
 ```

 **ENV example:**
@@ -226,26 +291,33 @@ SARIN_PARAM="key1=value1"

 ## Headers

-HTTP headers. If multiple values are provided for a key, Sarin cycles through them randomly for each request. Supports [templating](templating.md).
+HTTP headers. Supports [templating](templating.md).
+
+When the same key appears as **separate entries** (in CLI or config file), all values are sent in every request. When multiple values are specified as an **array on a single key** (config file only), Sarin cycles through them.

 **YAML example:**

 ```yaml
 headers:
-  key1: value1
-  key2: [value2, value3]
+    key1: value1
+    key2: [value2, value3] # cycles between value2 and value3

 # OR

 headers:
-  - key1: value1
-  - key2: [value2, value3]
+    - key1: value1
+    - key2: [value2, value3] # cycles between value2 and value3
+
+# To send both values in every request, use separate entries:
+headers:
+    - key2: value2
+    - key2: value3 # both sent in every request
 ```

 **CLI example:**

 ```sh
-header "key1: value1" -header "key2: value2" -header "key2: value3"
+-header "key1: value1" -header "key2: value2" -header "key2: value3"  # sends both value2 and value3
 ```

 **ENV example:**
@@ -256,26 +328,33 @@ SARIN_HEADER="key1: value1"

 ## Cookies

-HTTP cookies. If multiple values are provided for a key, Sarin cycles through them randomly for each request. Supports [templating](templating.md).
+HTTP cookies. Supports [templating](templating.md).
+
+When the same key appears as **separate entries** (in CLI or config file), all values are sent in every request. When multiple values are specified as an **array on a single key** (config file only), Sarin cycles through them.

 **YAML example:**

 ```yaml
 cookies:
-  key1: value1
-  key2: [value2, value3]
+    key1: value1
+    key2: [value2, value3] # cycles between value2 and value3

 # OR

 cookies:
-  - key1: value1
-  - key2: [value2, value3]
+    - key1: value1
+    - key2: [value2, value3] # cycles between value2 and value3
+
+# To send both values in every request, use separate entries:
+cookies:
+    - key2: value2
+    - key2: value3 # both sent in every request
 ```

 **CLI example:**

 ```sh
-cookie "key1=value1" -cookie "key2=value2" -cookie "key2=value3"
+-cookie "key1=value1" -cookie "key2=value2" -cookie "key2=value3"  # sends both value2 and value3
 ```

 **ENV example:**
@@ -286,7 +365,7 @@ SARIN_COOKIE="key1=value1"

 ## Proxy

-Proxy URL(s). If multiple values are provided, Sarin cycles through them randomly for each request.
+Proxy URL(s). If multiple values are provided, Sarin starts at a random index and cycles through them in order. Once the cycle completes, it picks a new random starting point.

 Supported protocols: `http`, `https`, `socks5`, `socks5h`

@@ -298,9 +377,9 @@ proxy: http://proxy1.com
 # OR

 proxy:
-  - http://proxy1.com
-  - socks5://proxy2.com
-  - socks5h://proxy3.com
+    - http://proxy1.com
+    - socks5://proxy2.com
+    - socks5h://proxy3.com
 ```

 **CLI example:**
@@ -329,9 +408,9 @@ values: "key=value"
 # OR

 values: |
-  key1=value1
-  key2=value2
-  key3=value3
+    key1=value1
+    key2=value2
+    key3=value3
 ```

 **CLI example:**
@@ -345,3 +424,133 @@ values: |
 ```sh
 SARIN_VALUES="key1=value1"
 ```
+
+## Lua
+
+Lua script(s) for request transformation. Each script must define a global `transform` function that receives a request object and returns the modified request object. Scripts run after template rendering, before the request is sent.
+
+If multiple Lua scripts are provided, they are chained in order-the output of one becomes the input to the next. When both Lua and JavaScript scripts are specified, all Lua scripts run first, then all JavaScript scripts.
+
+**Script sources:**
+
+Scripts can be provided as:
+
+- **Inline script:** Direct script code
+- **File reference:** `@/path/to/script.lua` or `@./relative/path.lua`
+- **URL reference:** `@http://...` or `@https://...`
+- **Escaped `@`:** `@@...` for inline scripts that start with a literal `@`
+
+**The `transform` function:**
+
+```lua
+function transform(req)
+    -- req.method   (string)                    - HTTP method (e.g. "GET", "POST")
+    -- req.path     (string)                    - URL path (e.g. "/api/users")
+    -- req.body     (string)                    - Request body
+    -- req.headers  (table of string/arrays)    - HTTP headers (e.g. {["X-Key"] = "value"})
+    -- req.params   (table of string/arrays)    - Query parameters (e.g. {["id"] = "123"})
+    -- req.cookies  (table of string/arrays)    - Cookies (e.g. {["session"] = "abc"})
+
+    req.headers["X-Custom"] = "my-value"
+    return req
+end
+```
+
+> **Note:** Header, parameter, and cookie values can be a single string or a table (array) for multiple values per key (e.g. `{"val1", "val2"}`).
+
+**YAML example:**
+
+```yaml
+lua: |
+    function transform(req)
+        req.headers["X-Custom"] = "my-value"
+        return req
+    end
+
+# OR
+
+lua:
+    - "@/path/to/script1.lua"
+    - "@/path/to/script2.lua"
+```
+
+**CLI example:**
+
+```sh
+-lua 'function transform(req) req.headers["X-Custom"] = "my-value" return req end'
+
+# OR
+
+-lua @/path/to/script1.lua -lua @/path/to/script2.lua
+```
+
+**ENV example:**
+
+```sh
+SARIN_LUA='function transform(req) req.headers["X-Custom"] = "my-value" return req end'
+```
+
+## Js
+
+JavaScript script(s) for request transformation. Each script must define a global `transform` function that receives a request object and returns the modified request object. Scripts run after template rendering, before the request is sent.
+
+If multiple JavaScript scripts are provided, they are chained in order-the output of one becomes the input to the next. When both Lua and JavaScript scripts are specified, all Lua scripts run first, then all JavaScript scripts.
+
+**Script sources:**
+
+Scripts can be provided as:
+
+- **Inline script:** Direct script code
+- **File reference:** `@/path/to/script.js` or `@./relative/path.js`
+- **URL reference:** `@http://...` or `@https://...`
+- **Escaped `@`:** `@@...` for inline scripts that start with a literal `@`
+
+**The `transform` function:**
+
+```javascript
+function transform(req) {
+    // req.method   (string)                    - HTTP method (e.g. "GET", "POST")
+    // req.path     (string)                    - URL path (e.g. "/api/users")
+    // req.body     (string)                    - Request body
+    // req.headers  (object of string/arrays)   - HTTP headers (e.g. {"X-Key": "value"})
+    // req.params   (object of string/arrays)   - Query parameters (e.g. {"id": "123"})
+    // req.cookies  (object of string/arrays)   - Cookies (e.g. {"session": "abc"})
+
+    req.headers["X-Custom"] = "my-value";
+    return req;
+}
+```
+
+> **Note:** Header, parameter, and cookie values can be a single string or an array for multiple values per key (e.g. `["val1", "val2"]`).
+
+**YAML example:**
+
+```yaml
+js: |
+    function transform(req) {
+        req.headers["X-Custom"] = "my-value";
+        return req;
+    }
+
+# OR
+
+js:
+    - "@/path/to/script1.js"
+    - "@/path/to/script2.js"
+```
+
+**CLI example:**
+
+```sh
+-js 'function transform(req) { req.headers["X-Custom"] = "my-value"; return req; }'
+
+# OR
+
+-js @/path/to/script1.js -js @/path/to/script2.js
+```
+
+**ENV example:**
+
+```sh
+SARIN_JS='function transform(req) { req.headers["X-Custom"] = "my-value"; return req; }'
+```
@@ -8,12 +8,16 @@ This guide provides practical examples for common Sarin use cases.
 - [Request-Based vs Duration-Based Tests](#request-based-vs-duration-based-tests)
 - [Headers, Cookies, and Parameters](#headers-cookies-and-parameters)
 - [Dynamic Requests with Templating](#dynamic-requests-with-templating)
+- [Solving Captchas](#solving-captchas)
 - [Request Bodies](#request-bodies)
+- [File Uploads](#file-uploads)
 - [Using Proxies](#using-proxies)
 - [Output Formats](#output-formats)
+- [Runtime Logging](#runtime-logging)
 - [Docker Usage](#docker-usage)
 - [Dry Run Mode](#dry-run-mode)
 - [Show Configuration](#show-configuration)
+- [Scripting](#scripting)

 ---

@@ -132,20 +136,34 @@ headers:

 </details>

-**Random headers from multiple values:**
+**Multiple values for the same header (all sent in every request):**

-> **Note:** When multiple values are provided for the same header, Sarin starts at a random index and cycles through all values in order. Once the cycle completes, it picks a new random starting point. This ensures all values are used while maintaining some randomness.
+> **Note:** When the same key appears as separate entries (in CLI or config file), all values are sent in every request.

 ```sh
 sarin -U http://example.com -r 1000 -c 10 \
  -H "X-Region: us-east" \
-  -H "X-Region: us-west" \
-  -H "X-Region: eu-central"
+  -H "X-Region: us-west"
 ```

 <details>
 <summary>YAML equivalent</summary>

+```yaml
+url: http://example.com
+requests: 1000
+concurrency: 10
+headers:
+    - X-Region: us-east
+    - X-Region: us-west
+```
+
+</details>
+
+**Cycling headers from multiple values (config file only):**
+
+> **Note:** When multiple values are specified as an array on a single key, Sarin starts at a random index and cycles through all values in order. Once the cycle completes, it picks a new random starting point.
+
 ```yaml
 url: http://example.com
 requests: 1000
@@ -157,8 +175,6 @@ headers:
        - eu-central
 ```

-</details>
-
 **Query parameters:**

 ```sh
@@ -175,8 +191,8 @@ url: http://example.com/search
 requests: 1000
 concurrency: 10
 params:
-    query: test
-    limit: "10"
+    query: "test"
+    limit: 10
 ```

 </details>
@@ -185,7 +201,7 @@ params:

 ```sh
 sarin -U http://example.com/users -r 1000 -c 10 \
-  -P "id={{ fakeit_IntRange 1 1000 }}" \
+  -P "id={{ fakeit_Number 1 1000 }}" \
  -P "fields=name,email"
 ```

@@ -197,8 +213,8 @@ url: http://example.com/users
 requests: 1000
 concurrency: 10
 params:
-    id: "{{ fakeit_IntRange 1 1000 }}"
-    fields: name,email
+    id: "{{ fakeit_Number 1 1000 }}"
+    fields: "name,email"
 ```

 </details>
@@ -357,7 +373,29 @@ body: '{"ip": "{{ fakeit_IPv4Address }}", "timestamp": "{{ fakeit_Date }}", "act

 </details>

-> For the complete list of 320+ template functions, see the **[Templating Guide](templating.md)**.
+> For the complete list of 340+ template functions, see the **[Templating Guide](templating.md)**.
+
+## Solving Captchas
+
+Sarin can solve captchas through third-party services and embed the resulting token into the request. Three services are supported via dedicated template functions: **2Captcha**, **Anti-Captcha**, and **CapSolver**.
+
+**Solve a reCAPTCHA v2 and submit the token in the request body:**
+
+```sh
+sarin -U https://example.com/login -M POST -r 1 \
+  -B '{"g-recaptcha-response": "{{ twocaptcha_RecaptchaV2 "YOUR_API_KEY" "SITE_KEY" "https://example.com/login" }}"}'
+```
+
+**Reuse a single solved token across multiple requests via `values`:**
+
+```sh
+sarin -U https://example.com/api -M POST -r 5 \
+  -V 'TOKEN={{ anticaptcha_Turnstile "YOUR_API_KEY" "SITE_KEY" "https://example.com/api" }}' \
+  -H "X-Turnstile-Token: {{ .Values.TOKEN }}" \
+  -B '{"token": "{{ .Values.TOKEN }}"}'
+```
+
+> See the **[Templating Guide](templating.md#captcha-functions)** for the full list of captcha functions and per-service support.

 ## Request Bodies

@@ -456,7 +494,7 @@ body: |
 ```sh
 sarin -U http://example.com/api/upload -r 1000 -c 10 \
  -M POST \
-  -B '{{ body_FormData (dict_Str "username" "john" "email" "john@example.com") }}'
+  -B '{{ body_FormData "username" "john" "email" "john@example.com" }}'
 ```

 <details>
@@ -467,7 +505,7 @@ url: http://example.com/api/upload
 requests: 1000
 concurrency: 10
 method: POST
-body: '{{ body_FormData (dict_Str "username" "john" "email" "john@example.com") }}'
+body: '{{ body_FormData "username" "john" "email" "john@example.com" }}'
 ```

 </details>
@@ -477,7 +515,7 @@ body: '{{ body_FormData (dict_Str "username" "john" "email" "john@example.com")
 ```sh
 sarin -U http://example.com/api/users -r 1000 -c 10 \
  -M POST \
-  -B '{{ body_FormData (dict_Str "name" (fakeit_Name) "email" (fakeit_Email) "phone" (fakeit_Phone)) }}'
+  -B '{{ body_FormData "name" (fakeit_Name) "email" (fakeit_Email) "phone" (fakeit_Phone) }}'
 ```

 <details>
@@ -488,13 +526,160 @@ url: http://example.com/api/users
 requests: 1000
 concurrency: 10
 method: POST
-body: '{{ body_FormData (dict_Str "name" (fakeit_Name) "email" (fakeit_Email) "phone" (fakeit_Phone)) }}'
+body: '{{ body_FormData "name" (fakeit_Name) "email" (fakeit_Email) "phone" (fakeit_Phone) }}'
 ```

 </details>

 > **Note:** `body_FormData` automatically sets the `Content-Type` header to `multipart/form-data` with the appropriate boundary.

+## File Uploads
+
+**File upload with multipart form data:**
+
+Upload a local file:
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -B '{{ body_FormData "title" "My Document" "document" "@/path/to/file.pdf" }}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+body: '{{ body_FormData "title" "My Document" "document" "@/path/to/file.pdf" }}'
+```
+
+</details>
+
+**Multiple file uploads (same field name):**
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -B '{{ body_FormData "files" "@/path/to/file1.pdf" "files" "@/path/to/file2.pdf" }}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+body: |
+    {{ body_FormData
+       "files" "@/path/to/file1.pdf"
+       "files" "@/path/to/file2.pdf"
+    }}
+```
+
+</details>
+
+**Multiple file uploads (different field names):**
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -B '{{ body_FormData "avatar" "@/path/to/photo.jpg" "resume" "@/path/to/cv.pdf" "cover_letter" "@/path/to/letter.docx" }}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+body: |
+    {{ body_FormData
+       "avatar" "@/path/to/photo.jpg"
+       "resume" "@/path/to/cv.pdf"
+       "cover_letter" "@/path/to/letter.docx"
+    }}
+```
+
+</details>
+
+**File from URL:**
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -B '{{ body_FormData "image" "@https://example.com/photo.jpg" }}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+body: '{{ body_FormData "image" "@https://example.com/photo.jpg" }}'
+```
+
+</details>
+
+> **Note:** Files (local and remote) are cached in memory after the first read, so they are not re-read for every request.
+
+**Base64 encoded file in JSON body (local file):**
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -H "Content-Type: application/json" \
+  -B '{"file": "{{ file_Base64 "/path/to/file.pdf" }}", "filename": "document.pdf"}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+headers:
+    Content-Type: application/json
+body: '{"file": "{{ file_Base64 "/path/to/file.pdf" }}", "filename": "document.pdf"}'
+```
+
+</details>
+
+**Base64 encoded file in JSON body (remote URL):**
+
+```sh
+sarin -U http://example.com/api/upload -r 100 -c 10 \
+  -M POST \
+  -H "Content-Type: application/json" \
+  -B '{"image": "{{ file_Base64 "https://example.com/photo.jpg" }}", "filename": "photo.jpg"}'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/upload
+requests: 100
+concurrency: 10
+method: POST
+headers:
+    Content-Type: application/json
+body: '{"image": "{{ file_Base64 "https://example.com/photo.jpg" }}", "filename": "photo.jpg"}'
+```
+
+</details>
+
 ## Using Proxies

 **Single HTTP proxy:**
@@ -535,7 +720,7 @@ proxy: socks5://proxy.example.com:1080

 </details>

-**Multiple proxies (load balanced):**
+**Multiple proxies (randomly cycled):**

 ```sh
 sarin -U http://example.com -r 1000 -c 10 \
@@ -652,10 +837,10 @@ output: none

 </details>

-**Quiet mode (hide progress bar):**
+**Hide the progress bar:**

 ```sh
-sarin -U http://example.com -r 1000 -c 10 -q
+sarin -U http://example.com -r 1000 -c 10 -p none
 ```

 <details>
@@ -665,7 +850,42 @@ sarin -U http://example.com -r 1000 -c 10 -q
 url: http://example.com
 requests: 1000
 concurrency: 10
-quiet: true
+progress: none
+```
+
+</details>
+
+## Runtime Logging
+
+`--log-level` selects which runtime logs Sarin emits (comma-separated `info` and `error`, default `error`). `error` covers request and generation errors, `info` covers every completed response (status, duration, headers, body). Logs appear in the progress log box on an interactive terminal, go to stderr when piped, or go to a file with `--log-file`.
+
+**Log responses and errors:**
+
+```sh
+sarin -U http://example.com -r 1000 -c 10 -l info,error
+```
+
+**Write logs to a file (the progress bar stays on screen):**
+
+```sh
+sarin -U http://example.com -r 1000 -c 10 -l info --log-file ./run.log
+```
+
+**Capture logs while keeping results on stdout:**
+
+```sh
+sarin -U http://example.com -r 1000 -l info -o json > stats.json 2> run.log
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com
+requests: 1000
+concurrency: 10
+logLevel: info,error
+logFile: ./run.log
 ```

 </details>
@@ -675,19 +895,19 @@ quiet: true
 **Basic Docker usage:**

 ```sh
-docker run --rm aykhans/sarin -U http://example.com -r 1000 -c 10
+docker run -it --rm aykhans/sarin -U http://example.com -r 1000 -c 10
 ```

 **With local config file:**

 ```sh
-docker run --rm -v $(pwd)/config.yaml:/config.yaml aykhans/sarin -f /config.yaml
+docker run -it --rm -v $(pwd)/config.yaml:/config.yaml aykhans/sarin -f /config.yaml
 ```

 **With remote config file:**

 ```sh
-docker run --rm aykhans/sarin -f https://example.com/config.yaml
+docker run -it --rm aykhans/sarin -f https://example.com/config.yaml
 ```

 **Interactive mode with TTY:**
@@ -746,3 +966,124 @@ headers:
 ```

 </details>
+
+## Scripting
+
+Transform requests using Lua or JavaScript scripts. Scripts run after template rendering, before the request is sent.
+
+**Add a custom header with Lua:**
+
+```sh
+sarin -U http://example.com/api -r 1000 -c 10 \
+  -lua 'function transform(req) req.headers["X-Custom"] = "my-value" return req end'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api
+requests: 1000
+concurrency: 10
+lua: |
+    function transform(req)
+        req.headers["X-Custom"] = "my-value"
+        return req
+    end
+```
+
+</details>
+
+**Modify request body with JavaScript:**
+
+```sh
+sarin -U http://example.com/api/data -r 1000 -c 10 \
+  -M POST \
+  -H "Content-Type: application/json" \
+  -B '{"name": "test"}' \
+  -js 'function transform(req) { var body = JSON.parse(req.body); body.timestamp = Date.now(); req.body = JSON.stringify(body); return req; }'
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api/data
+requests: 1000
+concurrency: 10
+method: POST
+headers:
+    Content-Type: application/json
+body: '{"name": "test"}'
+js: |
+    function transform(req) {
+        var body = JSON.parse(req.body);
+        body.timestamp = Date.now();
+        req.body = JSON.stringify(body);
+        return req;
+    }
+```
+
+</details>
+
+**Load script from a file:**
+
+```sh
+sarin -U http://example.com/api -r 1000 -c 10 \
+  -lua @./scripts/transform.lua
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api
+requests: 1000
+concurrency: 10
+lua: "@./scripts/transform.lua"
+```
+
+</details>
+
+**Load script from a URL:**
+
+```sh
+sarin -U http://example.com/api -r 1000 -c 10 \
+  -js @https://example.com/scripts/transform.js
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api
+requests: 1000
+concurrency: 10
+js: "@https://example.com/scripts/transform.js"
+```
+
+</details>
+
+**Chain multiple scripts (Lua runs first, then JavaScript):**
+
+```sh
+sarin -U http://example.com/api -r 1000 -c 10 \
+  -lua @./scripts/auth.lua \
+  -lua @./scripts/headers.lua \
+  -js @./scripts/body.js
+```
+
+<details>
+<summary>YAML equivalent</summary>
+
+```yaml
+url: http://example.com/api
+requests: 1000
+concurrency: 10
+lua:
+    - "@./scripts/auth.lua"
+    - "@./scripts/headers.lua"
+js: "@./scripts/body.js"
+```
+
+</details>
@@ -4,13 +4,23 @@ Sarin supports Go templates in URL paths, methods, bodies, headers, params, cook

 > **Note:** Templating in URL host and scheme is not supported. Only the path portion of the URL can contain templates.

+> **Note:** Template rendering happens before the request is sent. The request timeout (`-T` / `timeout`) only governs the HTTP request itself and starts _after_ templates have finished rendering, so slow template functions (e.g. captcha solvers, remote `file_Read`) cannot cause a request timeout no matter how long they take.
+
 ## Table of Contents

 - [Using Values](#using-values)
 - [General Functions](#general-functions)
    - [String Functions](#string-functions)
    - [Collection Functions](#collection-functions)
+    - [JSON Functions](#json-functions)
+    - [Time Functions](#time-functions)
+    - [Crypto Functions](#crypto-functions)
    - [Body Functions](#body-functions)
+    - [File Functions](#file-functions)
+- [Captcha Functions](#captcha-functions)
+    - [2Captcha](#2captcha)
+    - [Anti-Captcha](#anti-captcha)
+    - [CapSolver](#capsolver)
 - [Fake Data Functions](#fake-data-functions)
    - [File](#file)
    - [ID](#id)
@@ -97,22 +107,217 @@ sarin -U http://example.com/users \
 | `strings_Truncate(s string, n int)`                        | Truncate to `n` characters with ellipsis                            | `{{ strings_Truncate "hello world" 5 }}` → `hello...`     |
 | `strings_TrimPrefix(s string, prefix string)`              | Remove prefix from string                                           | `{{ strings_TrimPrefix "hello" "he" }}` → `llo`           |
 | `strings_TrimSuffix(s string, suffix string)`              | Remove suffix from string                                           | `{{ strings_TrimSuffix "hello" "lo" }}` → `hel`           |
-| `strings_Join(sep string, values ...string)`               | Join strings with separator                                         | `{{ strings_Join "-" "a" "b" "c" }}` → `a-b-c`            |

 ### Collection Functions

-| Function                      | Description                                   | Example                                      |
-| ----------------------------- | --------------------------------------------- | -------------------------------------------- |
-| `dict_Str(pairs ...string)`   | Create string dictionary from key-value pairs | `{{ dict_Str "key1" "val1" "key2" "val2" }}` |
-| `slice_Str(values ...string)` | Create string slice                           | `{{ slice_Str "a" "b" "c" }}`                |
-| `slice_Int(values ...int)`    | Create int slice                              | `{{ slice_Int 1 2 3 }}`                      |
-| `slice_Uint(values ...uint)`  | Create uint slice                             | `{{ slice_Uint 1 2 3 }}`                     |
+| Function                                 | Description                                   | Example                                                  |
+| ---------------------------------------- | --------------------------------------------- | -------------------------------------------------------- |
+| `dict_Str(pairs ...string)`              | Create string dictionary from key-value pairs | `{{ dict_Str "key1" "val1" "key2" "val2" }}`             |
+| `slice_Str(values ...string)`            | Create string slice                           | `{{ slice_Str "a" "b" "c" }}`                            |
+| `slice_Join(slice []string, sep string)` | Join string slice with separator              | `{{ slice_Join (slice_Str "a" "b" "c") "-" }}` → `a-b-c` |
+| `slice_Int(values ...int)`               | Create int slice                              | `{{ slice_Int 1 2 3 }}`                                  |
+| `slice_Uint(values ...uint)`             | Create uint slice                             | `{{ slice_Uint 1 2 3 }}`                                 |
+
+### JSON Functions
+
+Build JSON payloads programmatically without manual quoting or escaping. `json_Object` is the ergonomic shortcut for flat objects; `json_Encode` marshals any value (slice, map, etc.) to a JSON string.
+
+| Function                    | Description                                                                                            | Example                                               |
+| --------------------------- | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- |
+| `json_Object(pairs ...any)` | Build an object from interleaved key-value pairs and return it as a JSON string. Keys must be strings. | `{{ json_Object "name" "Alice" "age" 30 }}`           |
+| `json_Encode(v any)`        | Marshal any value (slice, map, etc.) to a JSON string.                                                 | `{{ json_Encode (slice_Str "a" "b") }}` → `["a","b"]` |
+
+**Examples:**
+
+```yaml
+# Flat object with fake data
+body: '{{ json_Object "name" (fakeit_FirstName) "email" (fakeit_Email) }}'
+
+# Embed a solved captcha token
+body: '{{ json_Object "g-recaptcha-response" (twocaptcha_RecaptchaV2 "API_KEY" "SITE_KEY" "https://example.com") }}'
+
+# Encode a slice as a JSON array
+body: '{{ json_Encode (slice_Str "a" "b" "c") }}'
+
+# Encode a string dictionary (map[string]string)
+body: '{{ json_Encode (dict_Str "key1" "value1" "key2" "value2") }}'
+```
+
+> **Note:** Object keys are serialized in alphabetical order (Go's `encoding/json` default), not insertion order. For API payloads this is almost always fine because JSON key order is semantically irrelevant.
+
+### Time Functions
+
+| Function                 | Description                                 | Example                                                                         |
+| ------------------------ | ------------------------------------------- | ------------------------------------------------------------------------------- |
+| `time_NowUnix`           | Current Unix timestamp (seconds)            | `{{ time_NowUnix }}` → `1735689600`                                             |
+| `time_NowUnixMilli`      | Current Unix timestamp (milliseconds)       | `{{ time_NowUnixMilli }}` → `1735689600123`                                     |
+| `time_NowRFC3339`        | Current time in RFC3339 format              | `{{ time_NowRFC3339 }}` → `"2026-02-26T21:00:00Z"`                              |
+| `time_Format(layout, t)` | Format a `time.Time` value with a Go layout | `{{ time_Format "2006-01-02" (strings_ToDate "2024-05-10") }}` → `"2024-05-10"` |
+
+### Crypto Functions
+
+| Function                             | Description                                | Example                                      |
+| ------------------------------------ | ------------------------------------------ | -------------------------------------------- |
+| `crypto_SHA256(s string)`            | SHA-256 hash (hex-encoded)                 | `{{ crypto_SHA256 "hello" }}`                |
+| `crypto_MD5(s string)`               | MD5 hash (hex-encoded)                     | `{{ crypto_MD5 "hello" }}`                   |
+| `crypto_HMACSHA256(key, msg string)` | HMAC-SHA256 signature (hex-encoded)        | `{{ crypto_HMACSHA256 "secret" "payload" }}` |
+| `crypto_Base64URL(s string)`         | Base64 URL-safe encoding (without padding) | `{{ crypto_Base64URL "hello world" }}`       |

 ### Body Functions

-| Function                                  | Description                                                              | Example                                            |
-| ----------------------------------------- | ------------------------------------------------------------------------ | -------------------------------------------------- |
-| `body_FormData(fields map[string]string)` | Create multipart form data. Automatically sets the `Content-Type` header | `{{ body_FormData (dict_Str "field1" "value1") }}` |
+| Function                         | Description                                                                                                                                                                                                 | Example                                                             |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| `body_FormData(pairs ...string)` | Create multipart form data from key-value pairs. Automatically sets the `Content-Type` header. Values starting with `@` are treated as file references (local path or URL). Use `@@` to escape literal `@`. | `{{ body_FormData "field1" "value1" "file" "@/path/to/file.pdf" }}` |
+
+**`body_FormData` Details:**
+
+```yaml
+# Text fields only
+body: '{{ body_FormData "username" "john" "email" "john@example.com" }}'
+
+# Single file upload
+body: '{{ body_FormData "document" "@/path/to/file.pdf" }}'
+
+# File from URL
+body: '{{ body_FormData "image" "@https://example.com/photo.jpg" }}'
+
+# Mixed text fields and files
+body: |
+    {{ body_FormData
+       "title" "My Report"
+       "author" "John Doe"
+       "cover" "@/path/to/cover.jpg"
+       "document" "@/path/to/report.pdf"
+    }}
+
+# Multiple files with same field name
+body: |
+    {{ body_FormData
+       "files" "@/path/to/file1.pdf"
+       "files" "@/path/to/file2.pdf"
+    }}
+
+# Escape @ for literal value (sends "@username")
+body: '{{ body_FormData "twitter" "@@username" }}'
+```
+
+> **Note:** Files are cached in memory after the first read. Subsequent requests reuse the cached content, avoiding repeated disk/network I/O.
+
+### File Functions
+
+| Function                     | Description                                                                                               | Example                                 |
+| ---------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------- |
+| `file_Read(source string)`   | Read a file (local path or URL) and return raw content as string. Files are cached after first read.      | `{{ file_Read "/path/to/file.txt" }}`   |
+| `file_Base64(source string)` | Read a file (local path or URL) and return its Base64 encoded content. Files are cached after first read. | `{{ file_Base64 "/path/to/file.pdf" }}` |
+
+**`file_Read` and `file_Base64` Details:**
+
+```yaml
+# Local file as plain text
+body: '{{ file_Read "/path/to/template.json" }}'
+
+# Remote text file
+body: '{{ file_Read "https://example.com/payload.txt" }}'
+
+# Local file as Base64 in JSON body
+body: '{"file": "{{ file_Base64 "/path/to/document.pdf" }}", "filename": "document.pdf"}'
+
+# Remote file as Base64
+body: '{"image": "{{ file_Base64 "https://example.com/photo.jpg" }}"}'
+
+# Combined with values for reuse
+values: 'FILE_DATA={{ file_Base64 "/path/to/file.bin" }}'
+body: '{"data": "{{ .Values.FILE_DATA }}"}'
+```
+
+## Captcha Functions
+
+Captcha functions solve a captcha challenge through a third-party solving service and return the resulting token, which can then be embedded directly into a request. They are intended for load testing endpoints protected by reCAPTCHA, hCaptcha, or Cloudflare Turnstile.
+
+The functions are organized by service: `twocaptcha_*`, `anticaptcha_*`, and `capsolver_*`. Each accepts the API key as the first argument so no global configuration is required. Bring your own key and use any of the supported services per template.
+
+> **Important: performance and cost:**
+>
+> - **Each call is slow.** Solving typically takes ~5–60 seconds because the function blocks the template render until the third-party service returns a token. Internally the solver polls every 1s and gives up after 120s.
+> - **Each call costs money.** Every successful solve is billed by the captcha service (typically $0.001–$0.003 per solve). For high-volume tests, your captcha bill grows linearly with request count.
+
+**Common parameters across all captcha functions:**
+
+- `apiKey` - Your API key for the chosen captcha solving service
+- `siteKey` - The captcha sitekey extracted from the target page (e.g. the `data-sitekey` attribute on a reCAPTCHA, hCaptcha, or Turnstile element)
+- `pageURL` - The URL of the page where the captcha is hosted
+
+### 2Captcha
+
+Functions for the [2Captcha](https://2captcha.com) service. Note: 2Captcha **does not currently support hCaptcha** through their API.
+
+| Function                                                                 | Description                                                               |
+| ------------------------------------------------------------------------ | ------------------------------------------------------------------------- |
+| `twocaptcha_RecaptchaV2(apiKey, siteKey, pageURL string)`                | Solve a Google reCAPTCHA v2 challenge                                     |
+| `twocaptcha_RecaptchaV3(apiKey, siteKey, pageURL, pageAction string)`    | Solve a Google reCAPTCHA v3 challenge. Pass `""` for `pageAction` to omit |
+| `twocaptcha_Turnstile(apiKey, siteKey, pageURL string, cData ...string)` | Solve a Cloudflare Turnstile challenge. Optional `cData` argument         |
+
+### Anti-Captcha
+
+Functions for the [Anti-Captcha](https://anti-captcha.com) service. This is currently the only service that supports all four captcha types end-to-end.
+
+| Function                                                                  | Description                                                                                                           |
+| ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `anticaptcha_RecaptchaV2(apiKey, siteKey, pageURL string)`                | Solve a Google reCAPTCHA v2 challenge                                                                                 |
+| `anticaptcha_RecaptchaV3(apiKey, siteKey, pageURL, pageAction string)`    | Solve a Google reCAPTCHA v3 challenge. `minScore` is hardcoded to `0.3` (Anti-Captcha rejects the request without it) |
+| `anticaptcha_HCaptcha(apiKey, siteKey, pageURL string)`                   | Solve an hCaptcha challenge                                                                                           |
+| `anticaptcha_Turnstile(apiKey, siteKey, pageURL string, cData ...string)` | Solve a Cloudflare Turnstile challenge. Optional `cData` argument                                                     |
+
+### CapSolver
+
+Functions for the [CapSolver](https://capsolver.com) service. Note: CapSolver no longer supports hCaptcha.
+
+| Function                                                                | Description                                                               |
+| ----------------------------------------------------------------------- | ------------------------------------------------------------------------- |
+| `capsolver_RecaptchaV2(apiKey, siteKey, pageURL string)`                | Solve a Google reCAPTCHA v2 challenge                                     |
+| `capsolver_RecaptchaV3(apiKey, siteKey, pageURL, pageAction string)`    | Solve a Google reCAPTCHA v3 challenge. Pass `""` for `pageAction` to omit |
+| `capsolver_Turnstile(apiKey, siteKey, pageURL string, cData ...string)` | Solve a Cloudflare Turnstile challenge. Optional `cData` argument         |
+
+**Examples:**
+
+```yaml
+# reCAPTCHA v2 in a JSON body via 2Captcha
+method: POST
+url: https://example.com/login
+body: |
+    {
+      "username": "test",
+      "g-recaptcha-response": "{{ twocaptcha_RecaptchaV2 "YOUR_API_KEY" "6LfD3PIb..." "https://example.com/login" }}"
+    }
+```
+
+```yaml
+# Turnstile via Anti-Captcha with cData
+method: POST
+url: https://example.com/submit
+body: |
+    {
+      "cf-turnstile-response": "{{ anticaptcha_Turnstile "YOUR_API_KEY" "0x4AAAAAAA..." "https://example.com/submit" "session-cdata" }}"
+    }
+```
+
+```yaml
+# hCaptcha via Anti-Captcha (the only service that still supports it)
+method: POST
+url: https://example.com/protected
+body: |
+    {
+      "h-captcha-response": "{{ anticaptcha_HCaptcha "YOUR_API_KEY" "338af34c-..." "https://example.com/protected" }}"
+    }
+```
+
+```yaml
+# Share a single solved token across body and headers via values
+values: 'TOKEN={{ capsolver_Turnstile "YOUR_API_KEY" "0x4AAAAAAA..." "https://example.com" }}'
+headers:
+    X-Turnstile-Token: "{{ .Values.TOKEN }}"
+body: '{"token": "{{ .Values.TOKEN }}"}'
+```

 ## Fake Data Functions

@@ -184,24 +389,24 @@ These functions are powered by [gofakeit](https://github.com/brianvoe/gofakeit)

 ### Address

-| Function                                            | Description                  | Example Output                                      |
-| --------------------------------------------------- | ---------------------------- | --------------------------------------------------- |
-| `fakeit_City`                                       | City name                    | `"Marcelside"`                                      |
-| `fakeit_Country`                                    | Country name                 | `"United States of America"`                        |
-| `fakeit_CountryAbr`                                 | Country abbreviation         | `"US"`                                              |
-| `fakeit_State`                                      | State name                   | `"Illinois"`                                        |
-| `fakeit_StateAbr`                                   | State abbreviation           | `"IL"`                                              |
-| `fakeit_Street`                                     | Full street                  | `"364 East Rapidsborough"`                          |
-| `fakeit_StreetName`                                 | Street name                  | `"View"`                                            |
-| `fakeit_StreetNumber`                               | Street number                | `"13645"`                                           |
-| `fakeit_StreetPrefix`                               | Street prefix                | `"East"`                                            |
-| `fakeit_StreetSuffix`                               | Street suffix                | `"Ave"`                                             |
-| `fakeit_Unit`                                       | Unit                         | `"Apt 123"`                                         |
-| `fakeit_Zip`                                        | ZIP code                     | `"13645"`                                           |
-| `fakeit_Latitude`                                   | Random latitude              | `-73.534056`                                        |
-| `fakeit_Longitude`                                  | Random longitude             | `-147.068112`                                       |
-| `fakeit_LatitudeInRange(min float64, max float64)`  | Latitude in specified range  | `{{ fakeit_LatitudeInRange 0 90 }}` → `22.921026`   |
-| `fakeit_LongitudeInRange(min float64, max float64)` | Longitude in specified range | `{{ fakeit_LongitudeInRange 0 180 }}` → `-8.170450` |
+| Function                                            | Description                  | Example Output                                       |
+| --------------------------------------------------- | ---------------------------- | ---------------------------------------------------- |
+| `fakeit_City`                                       | City name                    | `"Marcelside"`                                       |
+| `fakeit_Country`                                    | Country name                 | `"United States of America"`                         |
+| `fakeit_CountryAbr`                                 | Country abbreviation         | `"US"`                                               |
+| `fakeit_State`                                      | State name                   | `"Illinois"`                                         |
+| `fakeit_StateAbr`                                   | State abbreviation           | `"IL"`                                               |
+| `fakeit_Street`                                     | Full street                  | `"364 East Rapidsborough"`                           |
+| `fakeit_StreetName`                                 | Street name                  | `"View"`                                             |
+| `fakeit_StreetNumber`                               | Street number                | `"13645"`                                            |
+| `fakeit_StreetPrefix`                               | Street prefix                | `"East"`                                             |
+| `fakeit_StreetSuffix`                               | Street suffix                | `"Ave"`                                              |
+| `fakeit_Unit`                                       | Unit                         | `"Apt 123"`                                          |
+| `fakeit_Zip`                                        | ZIP code                     | `"13645"`                                            |
+| `fakeit_Latitude`                                   | Random latitude              | `-73.534056`                                         |
+| `fakeit_Longitude`                                  | Random longitude             | `-147.068112`                                        |
+| `fakeit_LatitudeInRange(min float64, max float64)`  | Latitude in specified range  | `{{ fakeit_LatitudeInRange 0 90 }}` → `22.921026`    |
+| `fakeit_LongitudeInRange(min float64, max float64)` | Longitude in specified range | `{{ fakeit_LongitudeInRange 0 180 }}` → `122.471830` |

 ### Game

@@ -288,16 +493,16 @@ These functions are powered by [gofakeit](https://github.com/brianvoe/gofakeit)

 ### Text

-| Function                                                                                 | Description                                     | Example                                       |
-| ---------------------------------------------------------------------------------------- | ----------------------------------------------- | --------------------------------------------- |
-| `fakeit_Sentence`                                                                        | Random sentence                                 | `{{ fakeit_Sentence }}`                       |
-| `fakeit_Paragraph`                                                                       | Random paragraph                                | `{{ fakeit_Paragraph }}`                      |
-| `fakeit_LoremIpsumWord`                                                                  | Lorem ipsum word                                | `"lorem"`                                     |
-| `fakeit_LoremIpsumSentence(wordCount int)`                                               | Lorem ipsum sentence with specified word count  | `{{ fakeit_LoremIpsumSentence 5 }}`           |
-| `fakeit_LoremIpsumParagraph(paragraphs int, sentences int, words int, separator string)` | Lorem ipsum paragraphs with specified structure | `{{ fakeit_LoremIpsumParagraph 1 3 5 "\n" }}` |
-| `fakeit_Question`                                                                        | Random question                                 | `"What is your name?"`                        |
-| `fakeit_Quote`                                                                           | Random quote                                    | `"Life is what happens..."`                   |
-| `fakeit_Phrase`                                                                          | Random phrase                                   | `"a piece of cake"`                           |
+| Function                                                                                 | Description                                     | Example                                               |
+| ---------------------------------------------------------------------------------------- | ----------------------------------------------- | ----------------------------------------------------- |
+| `fakeit_Sentence(wordCount ...int)`                                                      | Random sentence (optional word count)           | `{{ fakeit_Sentence }}` or `{{ fakeit_Sentence 10 }}` |
+| `fakeit_Paragraph`                                                                       | Random paragraph                                | `{{ fakeit_Paragraph }}`                              |
+| `fakeit_LoremIpsumWord`                                                                  | Lorem ipsum word                                | `"lorem"`                                             |
+| `fakeit_LoremIpsumSentence(wordCount int)`                                               | Lorem ipsum sentence with specified word count  | `{{ fakeit_LoremIpsumSentence 5 }}`                   |
+| `fakeit_LoremIpsumParagraph(paragraphs int, sentences int, words int, separator string)` | Lorem ipsum paragraphs with specified structure | `{{ fakeit_LoremIpsumParagraph 1 3 5 "\n" }}`         |
+| `fakeit_Question`                                                                        | Random question                                 | `"What is your name?"`                                |
+| `fakeit_Quote`                                                                           | Random quote                                    | `"Life is what happens..."`                           |
+| `fakeit_Phrase`                                                                          | Random phrase                                   | `"a piece of cake"`                                   |

 ### Foods

@@ -532,7 +737,7 @@ These functions are powered by [gofakeit](https://github.com/brianvoe/gofakeit)
 | Function                              | Description                     | Example                                                         |
 | ------------------------------------- | ------------------------------- | --------------------------------------------------------------- |
 | `fakeit_Digit`                        | Single random digit             | `"0"`                                                           |
-| `fakeit_DigitN(n uint)`               | Generate `n` random digits      | `{{ fakeit_DigitN 5 }}` → `"0136459948"`                        |
+| `fakeit_DigitN(n uint)`               | Generate `n` random digits      | `{{ fakeit_DigitN 5 }}` → `"71364"`                             |
 | `fakeit_Letter`                       | Single random letter            | `"g"`                                                           |
 | `fakeit_LetterN(n uint)`              | Generate `n` random letters     | `{{ fakeit_LetterN 10 }}` → `"gbRMaRxHki"`                      |
 | `fakeit_Lexify(pattern string)`       | Replace `?` with random letters | `{{ fakeit_Lexify "?????@??????.com" }}` → `"billy@mister.com"` |
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
@@ -0,0 +1,55 @@
+{
+  description = "Sarin - high-performance HTTP load testing tool built with Go and fasthttp";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs = { self, nixpkgs }:
+    let
+      inherit (nixpkgs) lib;
+
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+
+      forAllSystems = f: lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+
+      rev = self.rev or self.dirtyRev or "unknown";
+
+      # self.lastModifiedDate is "YYYYMMDDHHMMSS"; reshape to RFC 3339 (UTC).
+      raw = self.lastModifiedDate or "19700101000000";
+      s = i: n: lib.substring i n raw;
+      buildDate = "${s 0 4}-${s 4 2}-${s 6 2}T${s 8 2}:${s 10 2}:${s 12 2}Z";
+    in
+    {
+      packages = forAllSystems (pkgs: {
+        default = pkgs.callPackage ./nix/package.nix {
+          inherit rev buildDate;
+        };
+      });
+
+      # nix run github:aykhans/sarin -- <args>
+      apps = forAllSystems (pkgs: {
+        default = {
+          type = "app";
+          program = "${self.packages.${pkgs.system}.default}/bin/sarin";
+          meta.description = "High-performance HTTP load testing tool";
+        };
+      });
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = [ pkgs.go_1_26 pkgs.golangci-lint pkgs.go-task ];
+        };
+      });
+
+      # For downstream flakes: inputs.sarin.overlays.default
+      overlays.default = final: _prev: {
+        sarin = final.callPackage ./nix/package.nix { };
+      };
+    };
+}
@@ -1,55 +1,53 @@
 module go.aykhans.me/sarin

-go 1.25.5
+go 1.26.5

 require (
-	github.com/brianvoe/gofakeit/v7 v7.14.0
-	github.com/charmbracelet/bubbles v0.21.0
-	github.com/charmbracelet/bubbletea v1.3.10
-	github.com/charmbracelet/glamour v0.10.0
-	github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834
+	charm.land/bubbles/v2 v2.2.0
+	charm.land/bubbletea/v2 v2.0.9
+	charm.land/glamour/v2 v2.0.1
+	charm.land/lipgloss/v2 v2.0.6
+	github.com/brianvoe/gofakeit/v7 v7.16.0
 	github.com/charmbracelet/x/term v0.2.2
+	github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6
 	github.com/joho/godotenv v1.5.1
-	github.com/valyala/fasthttp v1.69.0
+	github.com/valyala/fasthttp v1.73.0
+	github.com/yuin/gopher-lua v1.1.2
 	go.aykhans.me/utils v1.0.7
-	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/net v0.48.0
+	go.yaml.in/yaml/v4 v4.0.0-rc.6
+	golang.org/x/net v0.58.0
 )

 require (
-	github.com/alecthomas/chroma/v2 v2.21.1 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
+	github.com/andybalholm/brotli v1.2.2 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
-	github.com/charmbracelet/colorprofile v0.4.1 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/x/ansi v0.11.3 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.14 // indirect
-	github.com/charmbracelet/x/exp/slice v0.0.0-20260109001716-2fbdffcb221f // indirect
-	github.com/clipperhouse/displaywidth v0.6.2 // indirect
-	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
+	github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504 // indirect
+	github.com/charmbracelet/x/termios v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
+	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
+	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
-	github.com/klauspost/compress v1.18.2 // indirect
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
+	github.com/mattn/go-runewidth v0.0.27 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
-	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/reflow v0.3.0 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/yuin/goldmark v1.7.16 // indirect
+	github.com/xo/terminfo v1.0.0 // indirect
+	github.com/yuin/goldmark v1.8.5 // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.38.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 )
@@ -1,115 +1,110 @@
+charm.land/bubbles/v2 v2.2.0 h1:9GEMewcejrNtVIxZ9Y2wSsWJamsWNsXa8MpMLnH4yI4=
+charm.land/bubbles/v2 v2.2.0/go.mod h1:wdMgn+sje1KNXdwFizIWjbf328fIUBxqEmJ/vYPo8yc=
+charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
+charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
+charm.land/glamour/v2 v2.0.1 h1:xl+r00A4aJWU0z8fgwKd9fQQ4rsphqGUzuEiXZP5n+c=
+charm.land/glamour/v2 v2.0.1/go.mod h1:jo9z8XqVKPeEFMVdvCRLGk++RyJ3CdUwgNr7EvXLw3k=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
-github.com/alecthomas/chroma/v2 v2.21.1 h1:FaSDrp6N+3pphkNKU6HPCiYLgm8dbe5UXIXcoBhZSWA=
-github.com/alecthomas/chroma/v2 v2.21.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
+github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
-github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
+github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
+github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
+github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/brianvoe/gofakeit/v7 v7.14.0 h1:R8tmT/rTDJmD2ngpqBL9rAKydiL7Qr2u3CXPqRt59pk=
-github.com/brianvoe/gofakeit/v7 v7.14.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
-github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
-github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
-github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
-github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.4.1 h1:a1lO03qTrSIRaK8c3JRxJDZOvhvIeSco3ej+ngLk1kk=
-github.com/charmbracelet/colorprofile v0.4.1/go.mod h1:U1d9Dljmdf9DLegaJ0nGZNJvoXAhayhmidOdcBwAvKk=
-github.com/charmbracelet/glamour v0.10.0 h1:MtZvfwsYCx8jEPFJm3rIBFIMZUfUJ765oX8V6kXldcY=
-github.com/charmbracelet/glamour v0.10.0/go.mod h1:f+uf+I/ChNmqo087elLnVdCiVgjSKWuXa/l6NU2ndYk=
+github.com/brianvoe/gofakeit/v7 v7.16.0 h1:LXNcvT4Klw72/hqpLNNdEWFIcP7G0VFPNsqvEIGONBE=
+github.com/brianvoe/gofakeit/v7 v7.16.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834 h1:ZR7e0ro+SZZiIZD7msJyA+NjkCNNavuiPBLgerbOziE=
-github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834/go.mod h1:aKC/t2arECF6rNOnaKaVU6y4t4ZeHQzqfxedE/VkVhA=
-github.com/charmbracelet/x/ansi v0.11.3 h1:6DcVaqWI82BBVM/atTyq6yBoRLZFBsnoDoX9GCu2YOI=
-github.com/charmbracelet/x/ansi v0.11.3/go.mod h1:yI7Zslym9tCJcedxz5+WBq+eUGMJT0bM06Fqy1/Y4dI=
-github.com/charmbracelet/x/cellbuf v0.0.14 h1:iUEMryGyFTelKW3THW4+FfPgi4fkmKnnaLOXuc+/Kj4=
-github.com/charmbracelet/x/cellbuf v0.0.14/go.mod h1:P447lJl49ywBbil/KjCk2HexGh4tEY9LH0/1QrZZ9rA=
-github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
-github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260109001716-2fbdffcb221f h1:kvAY8ffwhFuxWqtVI6+9E5vmgTApG96hswFLXJfsxHI=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260109001716-2fbdffcb221f/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
+github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
+github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504 h1:Z0hBPQ9hslsfpFRRdMn+4cjnb3LK6FQH58hQkXrXv0A=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
-github.com/clipperhouse/displaywidth v0.6.2 h1:ZDpTkFfpHOKte4RG5O/BOyf3ysnvFswpyYrV7z2uAKo=
-github.com/clipperhouse/displaywidth v0.6.2/go.mod h1:R+kHuzaYWFkTm7xoMmK1lFydbci4X2CicfbGstSGg0o=
-github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
-github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
+github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
+github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
+github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
-github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/dlclark/regexp2/v2 v2.7.1 h1:yqDtwI1ptXXvEUNpYTk2lad4jLtAcKqkzepn4savSk4=
+github.com/dlclark/regexp2/v2 v2.7.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6 h1:Oh2rRG1un7tLlC3/NJDzKppZ4CeZGkVFJCUOTRwLpfw=
+github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6/go.mod h1:LiIEzozrcvNXorsG/3+ypGqdTUAqZryhzSsqi0oU/Qg=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
+github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
-github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
-github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
-github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
+github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
-github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.69.0 h1:fNLLESD2SooWeh2cidsuFtOcrEi4uB4m1mPrkJMZyVI=
-github.com/valyala/fasthttp v1.69.0/go.mod h1:4wA4PfAraPlAsJ5jMSqCE2ug5tqUPwKXxVj8oNECGcw=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/valyala/fasthttp v1.73.0 h1:ocTOORnBWtJ+P8t/6wAjdkchMzdfHmWx2VD/DPbgZ7s=
+github.com/valyala/fasthttp v1.73.0/go.mod h1:EtXQDHaR+5P18p8wqDRFpUhxr108Ga9mXvVJXHRrN2k=
+github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
+github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yuin/goldmark v1.7.16 h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE=
-github.com/yuin/goldmark v1.7.16/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.5 h1:r6N5afV5qj/5S4UTch8agZHJ8UxNCMwX7WjkkJam2NA=
+github.com/yuin/goldmark v1.8.5/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
 github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
+github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
+github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
 go.aykhans.me/utils v1.0.7 h1:ClHXHlWmkjfFlD7+w5BQY29lKCEztxY/yCf543x4hZw=
 go.aykhans.me/utils v1.0.7/go.mod h1:0Jz8GlZLN35cCHLOLx39sazWwEe33bF6SYlSeqzEXoI=
-go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
-go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -10,27 +10,13 @@ import (

 	"go.aykhans.me/sarin/internal/types"
 	versionpkg "go.aykhans.me/sarin/internal/version"
-	"go.aykhans.me/utils/common"
 )

 const cliUsageText = `Usage:
  sarin [flags]

 Simple usage:
-  sarin -U https://example.com -d 1m
-
-Usage with all flags:
-  sarin -s -q -z -o json -f ./config.yaml -c 50 -r 100_000 -d 2m30s \
-    -U https://example.com \
-    -M POST \
-    -V "sharedUUID={{ fakeit_UUID }}" \
-    -B '{"product": "car"}' \
-    -P "id={{ .Values.sharedUUID }}" \
-    -H "User-Agent: {{ fakeit_UserAgent }}" -H "Accept: */*" \
-    -C "token={{ .Values.sharedUUID }}" \
-    -X "http://proxy.example.com" \
-    -T 3s \
-    -I
+  sarin -U https://example.com -r 1

 Flags:
  General Config:
@@ -41,7 +27,9 @@ Flags:
    -c, -concurrency   uint       Number of concurrent requests (default %d)
    -r, -requests      uint       Number of total requests
    -d, -duration      time       Maximum duration for the test (e.g. 30s, 1m, 5h)
-    -q, -quiet         bool       Hide the progress bar and runtime logs (default %v)
+    -l, -log-level     string     Runtime log levels to emit, comma-separated (possible values: info, error) (default %s)
+    -w, -log-file      string     Write runtime logs to this file instead of the terminal/stderr
+    -p, -progress      string     Progress display (possible values: bar, none) (default '%v')
    -o, -output        string     Output format (possible values: table, json, yaml, none) (default '%v')
    -z, -dry-run       bool       Run without sending requests (default %v)

@@ -55,7 +43,9 @@ Flags:
    -X, -proxy         []string   Proxy for the request (e.g. "http://proxy.example.com:8080")
    -V, -values        []string   List of values for templating (e.g. "key1=value1")
    -T, -timeout       time       Timeout for the request (e.g. 400ms, 3s, 1m10s) (default %v)
-    -I, -insecure      bool       Skip SSL/TLS certificate verification (default %v)`
+    -I, -insecure      bool       Skip SSL/TLS certificate verification (default %v)
+        -lua           []string   Lua script for request transformation (inline or @file/@url)
+        -js            []string   JavaScript script for request transformation (inline or @file/@url)`

 var _ IParser = ConfigCLIParser{}

@@ -83,7 +73,6 @@ func (arg *stringSliceArg) Set(value string) error {

 // Parse parses command-line arguments into a Config object.
 // It can return the following errors:
-// - types.ErrCLINoArgs
 // - types.CLIUnexpectedArgsError
 // - types.FieldParseErrors
 func (parser ConfigCLIParser) Parse() (*Config, error) {
@@ -101,21 +90,25 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {
 		concurrency  uint
 		requestCount uint64
 		duration     time.Duration
-		quiet        bool
+		logLevel     string
+		logFile      string
+		progress     string
 		output       string
 		dryRun       bool

 		// Request config
-		urlInput string
-		methods  = stringSliceArg{}
-		bodies   = stringSliceArg{}
-		params   = stringSliceArg{}
-		headers  = stringSliceArg{}
-		cookies  = stringSliceArg{}
-		proxies  = stringSliceArg{}
-		values   = stringSliceArg{}
-		timeout  time.Duration
-		insecure bool
+		urlInput   string
+		methods    = stringSliceArg{}
+		bodies     = stringSliceArg{}
+		params     = stringSliceArg{}
+		headers    = stringSliceArg{}
+		cookies    = stringSliceArg{}
+		proxies    = stringSliceArg{}
+		values     = stringSliceArg{}
+		timeout    time.Duration
+		insecure   bool
+		luaScripts = stringSliceArg{}
+		jsScripts  = stringSliceArg{}
 	)

 	{
@@ -138,8 +131,14 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {
 		flagSet.DurationVar(&duration, "duration", 0, "Maximum duration for the test")
 		flagSet.DurationVar(&duration, "d", 0, "Maximum duration for the test")

-		flagSet.BoolVar(&quiet, "quiet", false, "Hide the progress bar and runtime logs")
-		flagSet.BoolVar(&quiet, "q", false, "Hide the progress bar and runtime logs")
+		flagSet.StringVar(&logLevel, "log-level", "", "Runtime log levels to emit, comma-separated (possible values: info, error)")
+		flagSet.StringVar(&logLevel, "l", "", "Runtime log levels to emit, comma-separated (possible values: info, error)")
+
+		flagSet.StringVar(&logFile, "log-file", "", "Write runtime logs to this file instead of the terminal/stderr")
+		flagSet.StringVar(&logFile, "w", "", "Write runtime logs to this file instead of the terminal/stderr")
+
+		flagSet.StringVar(&progress, "progress", "", "Progress display (possible values: bar, none)")
+		flagSet.StringVar(&progress, "p", "", "Progress display (possible values: bar, none)")

 		flagSet.StringVar(&output, "output", "", "Output format (possible values: table, json, yaml, none)")
 		flagSet.StringVar(&output, "o", "", "Output format (possible values: table, json, yaml, none)")
@@ -177,6 +176,10 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {

 		flagSet.BoolVar(&insecure, "insecure", false, "Skip SSL/TLS certificate verification")
 		flagSet.BoolVar(&insecure, "I", false, "Skip SSL/TLS certificate verification")
+
+		flagSet.Var(&luaScripts, "lua", "Lua script for request transformation (inline or @file/@url)")
+
+		flagSet.Var(&jsScripts, "js", "JavaScript script for request transformation (inline or @file/@url)")
 	}

 	// Parse the specific arguments provided to the parser, skipping the program name.
@@ -184,12 +187,6 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {
 		panic(err)
 	}

-	// Check if no flags were set and no non-flag arguments were provided.
-	// This covers cases where `sarin` is run without any meaningful arguments.
-	if flagSet.NFlag() == 0 && len(flagSet.Args()) == 0 {
-		return nil, types.ErrCLINoArgs
-	}
-
 	// Check for any unexpected non-flag arguments remaining after parsing.
 	if args := flagSet.Args(); len(args) > 0 {
 		return nil, types.NewCLIUnexpectedArgsError(args)
@@ -207,23 +204,27 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {
 		switch flagVar.Name {
 		// General config
 		case "show-config", "s":
-			config.ShowConfig = common.ToPtr(showConfig)
+			config.ShowConfig = new(showConfig)
 		case "config-file", "f":
 			for _, configFile := range configFiles {
 				config.Files = append(config.Files, *types.ParseConfigFile(configFile))
 			}
 		case "concurrency", "c":
-			config.Concurrency = common.ToPtr(concurrency)
+			config.Concurrency = new(concurrency)
 		case "requests", "r":
-			config.Requests = common.ToPtr(requestCount)
+			config.Requests = new(requestCount)
 		case "duration", "d":
-			config.Duration = common.ToPtr(duration)
-		case "quiet", "q":
-			config.Quiet = common.ToPtr(quiet)
+			config.Duration = new(duration)
+		case "log-level", "l":
+			config.LogLevel = new(logLevel)
+		case "log-file", "w":
+			config.LogFile = new(logFile)
+		case "progress", "p":
+			config.Progress = new(ConfigProgressType(progress))
 		case "output", "o":
-			config.Output = common.ToPtr(ConfigOutputType(output))
+			config.Output = new(ConfigOutputType(output))
 		case "dry-run", "z":
-			config.DryRun = common.ToPtr(dryRun)
+			config.DryRun = new(dryRun)

 		// Request config
 		case "url", "U":
@@ -256,9 +257,13 @@ func (parser ConfigCLIParser) Parse() (*Config, error) {
 		case "values", "V":
 			config.Values = append(config.Values, values...)
 		case "timeout", "T":
-			config.Timeout = common.ToPtr(timeout)
+			config.Timeout = new(timeout)
 		case "insecure", "I":
-			config.Insecure = common.ToPtr(insecure)
+			config.Insecure = new(insecure)
+		case "lua":
+			config.Lua = append(config.Lua, luaScripts...)
+		case "js":
+			config.Js = append(config.Js, jsScripts...)
 		}
 	})

@@ -274,7 +279,8 @@ func (parser ConfigCLIParser) PrintHelp() {
 		cliUsageText+"\n",
 		Defaults.ShowConfig,
 		Defaults.Concurrency,
-		Defaults.Quiet,
+		Defaults.LogLevel,
+		Defaults.Progress,
 		Defaults.Output,
 		Defaults.DryRun,

@@ -1,21 +1,24 @@
 package config

 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/url"
 	"os"
+	"path/filepath"
 	"slices"
 	"strconv"
 	"strings"
 	"time"

-	"github.com/charmbracelet/bubbles/viewport"
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/glamour"
-	"github.com/charmbracelet/glamour/styles"
-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/x/term"
+	"charm.land/bubbles/v2/viewport"
+	tea "charm.land/bubbletea/v2"
+	"charm.land/glamour/v2"
+	"charm.land/glamour/v2/styles"
+	"charm.land/lipgloss/v2"
+	"go.aykhans.me/sarin/internal/sarin"
+	"go.aykhans.me/sarin/internal/script"
 	"go.aykhans.me/sarin/internal/types"
 	"go.aykhans.me/sarin/internal/version"
 	"go.aykhans.me/utils/common"
@@ -29,25 +32,28 @@ var Defaults = struct {
 	RequestTimeout time.Duration
 	Concurrency    uint
 	ShowConfig     bool
-	Quiet          bool
+	Progress       ConfigProgressType
 	Insecure       bool
 	Output         ConfigOutputType
 	DryRun         bool
+	LogLevel       string
 }{
 	UserAgent:      "Sarin/" + version.Version,
 	Method:         "GET",
 	RequestTimeout: time.Second * 10,
 	Concurrency:    1,
 	ShowConfig:     false,
-	Quiet:          false,
+	Progress:       ConfigProgressTypeBar,
 	Insecure:       false,
 	Output:         ConfigOutputTypeTable,
 	DryRun:         false,
+	LogLevel:       "error",
 }

 var (
 	ValidProxySchemes      = []string{"http", "https", "socks5", "socks5h"}
 	ValidRequestURLSchemes = []string{"http", "https"}
+	ValidLogLevels         = []string{"info", "error"}
 )

 var (
@@ -68,29 +74,36 @@ var (
 	ConfigOutputTypeNone  ConfigOutputType = "none"
 )

-type Config struct {
-	ShowConfig  *bool              `yaml:"showConfig,omitempty"`
-	Files       []types.ConfigFile `yaml:"files,omitempty"`
-	Methods     []string           `yaml:"methods,omitempty"`
-	URL         *url.URL           `yaml:"url,omitempty"`
-	Timeout     *time.Duration     `yaml:"timeout,omitempty"`
-	Concurrency *uint              `yaml:"concurrency,omitempty"`
-	Requests    *uint64            `yaml:"requests,omitempty"`
-	Duration    *time.Duration     `yaml:"duration,omitempty"`
-	Quiet       *bool              `yaml:"quiet,omitempty"`
-	Output      *ConfigOutputType  `yaml:"output,omitempty"`
-	Insecure    *bool              `yaml:"insecure,omitempty"`
-	DryRun      *bool              `yaml:"dryRun,omitempty"`
-	Params      types.Params       `yaml:"params,omitempty"`
-	Headers     types.Headers      `yaml:"headers,omitempty"`
-	Cookies     types.Cookies      `yaml:"cookies,omitempty"`
-	Bodies      []string           `yaml:"bodies,omitempty"`
-	Proxies     types.Proxies      `yaml:"proxies,omitempty"`
-	Values      []string           `yaml:"values,omitempty"`
-}
+type ConfigProgressType string

-func NewConfig() *Config {
-	return &Config{}
+var (
+	ConfigProgressTypeBar  ConfigProgressType = "bar"
+	ConfigProgressTypeNone ConfigProgressType = "none"
+)
+
+type Config struct {
+	ShowConfig  *bool               `yaml:"showConfig,omitempty"`
+	Files       []types.ConfigFile  `yaml:"files,omitempty"`
+	Methods     []string            `yaml:"methods,omitempty"`
+	URL         *url.URL            `yaml:"url,omitempty"`
+	Timeout     *time.Duration      `yaml:"timeout,omitempty"`
+	Concurrency *uint               `yaml:"concurrency,omitempty"`
+	Requests    *uint64             `yaml:"requests,omitempty"`
+	Duration    *time.Duration      `yaml:"duration,omitempty"`
+	Progress    *ConfigProgressType `yaml:"progress,omitempty"`
+	Output      *ConfigOutputType   `yaml:"output,omitempty"`
+	Insecure    *bool               `yaml:"insecure,omitempty"`
+	DryRun      *bool               `yaml:"dryRun,omitempty"`
+	Params      types.Params        `yaml:"params,omitempty"`
+	Headers     types.Headers       `yaml:"headers,omitempty"`
+	Cookies     types.Cookies       `yaml:"cookies,omitempty"`
+	Bodies      []string            `yaml:"bodies,omitempty"`
+	Proxies     types.Proxies       `yaml:"proxies,omitempty"`
+	Values      []string            `yaml:"values,omitempty"`
+	Lua         []string            `yaml:"lua,omitempty"`
+	Js          []string            `yaml:"js,omitempty"`
+	LogLevel    *string             `yaml:"logLevel,omitempty"`
+	LogFile     *string             `yaml:"logFile,omitempty"`
 }

 func (config Config) MarshalYAML() (any, error) {
@@ -173,8 +186,8 @@ func (config Config) MarshalYAML() (any, error) {
 	if config.Duration != nil {
 		addField(content, "duration", toNode(*config.Duration), "")
 	}
-	if config.Quiet != nil {
-		addField(content, "quiet", toNode(*config.Quiet), "")
+	if config.Progress != nil {
+		addField(content, "progress", toNode(string(*config.Progress)), "")
 	}
 	if config.Output != nil {
 		addField(content, "output", toNode(string(*config.Output)), "")
@@ -219,6 +232,15 @@ func (config Config) MarshalYAML() (any, error) {
 	}

 	addStringSlice(content, "values", config.Values, false)
+	addStringSlice(content, "lua", config.Lua, false)
+	addStringSlice(content, "js", config.Js, false)
+	if config.LogLevel != nil {
+		addField(content, "logLevel", toNode(*config.LogLevel), "")
+	}
+
+	if config.LogFile != nil {
+		addField(content, "logFile", toNode(*config.LogFile), "")
+	}

 	return root, nil
 }
@@ -226,12 +248,12 @@ func (config Config) MarshalYAML() (any, error) {
 func (config Config) Print() bool {
 	configYAML, err := yaml.Marshal(config)
 	if err != nil {
-		fmt.Fprintln(os.Stderr, StyleRed.Render("Error marshaling config to yaml: "+err.Error()))
+		fmt.Fprint(os.Stderr, lipgloss.Sprintln(StyleRed.Render("Error marshaling config to yaml: "+err.Error())))
 		os.Exit(1)
 	}

 	// Pipe mode: output raw content directly
-	if !term.IsTerminal(os.Stdout.Fd()) {
+	if !sarin.IsInteractiveTerminal(os.Stdout.Fd()) {
 		fmt.Println(string(configYAML))
 		os.Exit(0)
 	}
@@ -245,25 +267,23 @@ func (config Config) Print() bool {
 		glamour.WithWordWrap(0),
 	)
 	if err != nil {
-		fmt.Fprintln(os.Stderr, StyleRed.Render(err.Error()))
+		fmt.Fprint(os.Stderr, lipgloss.Sprintln(StyleRed.Render(err.Error())))
 		os.Exit(1)
 	}

 	content, err := renderer.Render("```yaml\n" + string(configYAML) + "```")
 	if err != nil {
-		fmt.Fprintln(os.Stderr, StyleRed.Render(err.Error()))
+		fmt.Fprint(os.Stderr, lipgloss.Sprintln(StyleRed.Render(err.Error())))
 		os.Exit(1)
 	}

 	p := tea.NewProgram(
 		printConfigModel{content: strings.Trim(content, "\n"), rawContent: configYAML},
-		tea.WithAltScreen(),
-		tea.WithMouseCellMotion(),
 	)

 	m, err := p.Run()
 	if err != nil {
-		fmt.Fprintln(os.Stderr, StyleRed.Render(err.Error()))
+		fmt.Fprint(os.Stderr, lipgloss.Sprintln(StyleRed.Render(err.Error())))
 		os.Exit(1)
 	}

@@ -273,7 +293,7 @@ func (config Config) Print() bool {
 func (config *Config) Merge(newConfig *Config) {
 	config.Files = append(config.Files, newConfig.Files...)
 	if len(newConfig.Methods) > 0 {
-		config.Methods = append(config.Methods, newConfig.Methods...)
+		config.Methods = newConfig.Methods
 	}
 	if newConfig.URL != nil {
 		config.URL = newConfig.URL
@@ -293,8 +313,8 @@ func (config *Config) Merge(newConfig *Config) {
 	if newConfig.ShowConfig != nil {
 		config.ShowConfig = newConfig.ShowConfig
 	}
-	if newConfig.Quiet != nil {
-		config.Quiet = newConfig.Quiet
+	if newConfig.Progress != nil {
+		config.Progress = newConfig.Progress
 	}
 	if newConfig.Output != nil {
 		config.Output = newConfig.Output
@@ -315,7 +335,7 @@ func (config *Config) Merge(newConfig *Config) {
 		config.Cookies = append(config.Cookies, newConfig.Cookies...)
 	}
 	if len(newConfig.Bodies) != 0 {
-		config.Bodies = append(config.Bodies, newConfig.Bodies...)
+		config.Bodies = newConfig.Bodies
 	}
 	if len(newConfig.Proxies) != 0 {
 		config.Proxies.Append(newConfig.Proxies...)
@@ -323,6 +343,18 @@ func (config *Config) Merge(newConfig *Config) {
 	if len(newConfig.Values) != 0 {
 		config.Values = append(config.Values, newConfig.Values...)
 	}
+	if len(newConfig.Lua) != 0 {
+		config.Lua = append(config.Lua, newConfig.Lua...)
+	}
+	if len(newConfig.Js) != 0 {
+		config.Js = append(config.Js, newConfig.Js...)
+	}
+	if newConfig.LogLevel != nil {
+		config.LogLevel = newConfig.LogLevel
+	}
+	if newConfig.LogFile != nil {
+		config.LogFile = newConfig.LogFile
+	}
 }

 func (config *Config) SetDefaults() {
@@ -348,26 +380,34 @@ func (config *Config) SetDefaults() {
 		config.Timeout = &Defaults.RequestTimeout
 	}
 	if config.Concurrency == nil {
-		config.Concurrency = common.ToPtr(Defaults.Concurrency)
+		config.Concurrency = new(Defaults.Concurrency)
 	}
 	if config.ShowConfig == nil {
-		config.ShowConfig = common.ToPtr(Defaults.ShowConfig)
+		config.ShowConfig = new(Defaults.ShowConfig)
 	}
-	if config.Quiet == nil {
-		config.Quiet = common.ToPtr(Defaults.Quiet)
+	if config.Progress == nil {
+		config.Progress = new(Defaults.Progress)
 	}
 	if config.Insecure == nil {
-		config.Insecure = common.ToPtr(Defaults.Insecure)
+		config.Insecure = new(Defaults.Insecure)
 	}
 	if config.DryRun == nil {
-		config.DryRun = common.ToPtr(Defaults.DryRun)
+		config.DryRun = new(Defaults.DryRun)
 	}
 	if !config.Headers.Has("User-Agent") {
 		config.Headers = append(config.Headers, types.Header{Key: "User-Agent", Value: []string{Defaults.UserAgent}})
 	}

 	if config.Output == nil {
-		config.Output = common.ToPtr(Defaults.Output)
+		config.Output = new(Defaults.Output)
+	}
+
+	if config.LogLevel == nil {
+		config.LogLevel = new(Defaults.LogLevel)
+	}
+
+	if config.LogFile == nil {
+		config.LogFile = new("")
 	}
 }

@@ -410,7 +450,7 @@ func (config Config) Validate() error {
 		validationErrors = append(validationErrors, types.NewFieldValidationError("Duration", "0", errors.New("duration must be greater than 0")))
 	}

-	if *config.Timeout < 1 {
+	if config.Timeout == nil || *config.Timeout < 1 {
 		validationErrors = append(validationErrors, types.NewFieldValidationError("Timeout", "0", errors.New("timeout must be greater than 0")))
 	}

@@ -418,8 +458,21 @@ func (config Config) Validate() error {
 		validationErrors = append(validationErrors, types.NewFieldValidationError("ShowConfig", "", errors.New("showConfig field is required")))
 	}

-	if config.Quiet == nil {
-		validationErrors = append(validationErrors, types.NewFieldValidationError("Quiet", "", errors.New("quiet field is required")))
+	if config.Progress == nil {
+		validationErrors = append(validationErrors, types.NewFieldValidationError("Progress", "", errors.New("progress field is required")))
+	} else {
+		switch *config.Progress {
+		case ConfigProgressTypeBar, ConfigProgressTypeNone:
+		default:
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError(
+					"Progress",
+					string(*config.Progress),
+					fmt.Errorf("progress must be one of: %s, %s", ConfigProgressTypeBar, ConfigProgressTypeNone),
+				),
+			)
+		}
 	}

 	if config.Output == nil {
@@ -452,6 +505,36 @@ func (config Config) Validate() error {
 		validationErrors = append(validationErrors, types.NewFieldValidationError("DryRun", "", errors.New("dryRun field is required")))
 	}

+	if config.LogLevel != nil {
+		for i, level := range sarin.SplitLogLevels(*config.LogLevel) {
+			if !slices.Contains(ValidLogLevels, level) {
+				validationErrors = append(
+					validationErrors,
+					types.NewFieldValidationError(
+						fmt.Sprintf("LogLevel[%d]", i),
+						level,
+						fmt.Errorf("log level must be one of: %s", strings.Join(ValidLogLevels, ", ")),
+					),
+				)
+			}
+		}
+	}
+
+	if config.LogFile != nil && *config.LogFile != "" {
+		dir := filepath.Dir(*config.LogFile)
+		if info, err := os.Stat(dir); err != nil {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError("LogFile", *config.LogFile, fmt.Errorf("parent directory %q is not accessible", dir)),
+			)
+		} else if !info.IsDir() {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError("LogFile", *config.LogFile, fmt.Errorf("parent path %q is not a directory", dir)),
+			)
+		}
+	}
+
 	for i, proxy := range config.Proxies {
 		if !slices.Contains(ValidProxySchemes, proxy.Scheme) {
 			validationErrors = append(
@@ -465,6 +548,44 @@ func (config Config) Validate() error {
 		}
 	}

+	// Create a context with timeout for script validation (loading from URLs)
+	scriptCtx, scriptCancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer scriptCancel()
+
+	for i, scriptSrc := range config.Lua {
+		if err := validateScriptSource(scriptSrc); err != nil {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError(fmt.Sprintf("Lua[%d]", i), scriptSrc, err),
+			)
+			continue
+		}
+		// Validate script syntax
+		if err := script.ValidateScript(scriptCtx, scriptSrc, script.EngineTypeLua); err != nil {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError(fmt.Sprintf("Lua[%d]", i), scriptSrc, err),
+			)
+		}
+	}
+
+	for i, scriptSrc := range config.Js {
+		if err := validateScriptSource(scriptSrc); err != nil {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError(fmt.Sprintf("Js[%d]", i), scriptSrc, err),
+			)
+			continue
+		}
+		// Validate script syntax
+		if err := script.ValidateScript(scriptCtx, scriptSrc, script.EngineTypeJavaScript); err != nil {
+			validationErrors = append(
+				validationErrors,
+				types.NewFieldValidationError(fmt.Sprintf("Js[%d]", i), scriptSrc, err),
+			)
+		}
+	}
+
 	templateErrors := ValidateTemplates(&config)
 	validationErrors = append(validationErrors, templateErrors...)

@@ -490,19 +611,13 @@ func ReadAllConfigs() *Config {
 	cliParser := NewConfigCLIParser(os.Args)
 	cliConf, err := cliParser.Parse()
 	_ = utilsErr.MustHandle(err,
-		utilsErr.OnSentinel(types.ErrCLINoArgs, func(err error) error {
-			cliParser.PrintHelp()
-			fmt.Fprintln(os.Stderr, StyleYellow.Render("\nNo arguments provided."))
-			os.Exit(1)
-			return nil
-		}),
 		utilsErr.OnType(func(err types.CLIUnexpectedArgsError) error {
 			cliParser.PrintHelp()
-			fmt.Fprintln(os.Stderr,
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 				StyleYellow.Render(
 					"\nUnexpected CLI arguments provided: ",
 				)+strings.Join(err.Args, ", "),
-			)
+			))
 			os.Exit(1)
 			return nil
 		}),
@@ -520,20 +635,20 @@ func ReadAllConfigs() *Config {
 		_ = utilsErr.MustHandle(err,
 			utilsErr.OnType(func(err types.ConfigFileReadError) error {
 				cliParser.PrintHelp()
-				fmt.Fprintln(os.Stderr,
+				fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 					StyleYellow.Render(
 						fmt.Sprintf("\nFailed to read config file (%s): ", configFile.Path())+err.Error(),
 					),
-				)
+				))
 				os.Exit(1)
 				return nil
 			}),
 			utilsErr.OnType(func(err types.UnmarshalError) error {
-				fmt.Fprintln(os.Stderr,
+				fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 					StyleYellow.Render(
 						fmt.Sprintf("\nFailed to parse config file (%s): ", configFile.Path())+err.Error(),
 					),
-				)
+				))
 				os.Exit(1)
 				return nil
 			}),
@@ -582,16 +697,67 @@ func parseConfigFile(configFile types.ConfigFile, maxDepth int) (*Config, error)
 	return fileConfig, nil
 }

+// validateScriptSource validates a script source string.
+// Scripts can be:
+//   - Inline script: any string not starting with "@"
+//   - Escaped "@": strings starting with "@@" (literal "@" at start)
+//   - File reference: "@/path/to/file" or "@./relative/path"
+//   - URL reference: "@http://..." or "@https://..."
+//
+// It can return the following errors:
+//   - types.ErrScriptEmpty
+//   - types.ErrScriptSourceEmpty
+//   - types.ErrScriptURLNoHost
+//   - types.URLParseError
+func validateScriptSource(script string) error {
+	// Empty script is invalid
+	if script == "" {
+		return types.ErrScriptEmpty
+	}
+
+	// Not a file/URL reference - it's an inline script
+	if !strings.HasPrefix(script, "@") {
+		return nil
+	}
+
+	// Escaped @ - it's an inline script starting with literal @
+	if strings.HasPrefix(script, "@@") {
+		return nil
+	}
+
+	// It's a file or URL reference - validate the source
+	source := script[1:] // Remove the @ prefix
+
+	if source == "" {
+		return types.ErrScriptSourceEmpty
+	}
+
+	// Check if it's a http(s) URL
+	if strings.HasPrefix(source, "http://") || strings.HasPrefix(source, "https://") {
+		parsedURL, err := url.Parse(source)
+		if err != nil {
+			return types.NewURLParseError(source, err)
+		}
+		if parsedURL.Host == "" {
+			return types.ErrScriptURLNoHost
+		}
+		return nil
+	}
+
+	// It's a file path - basic validation (not empty, checked above)
+	return nil
+}
+
 func printParseErrors(parserName string, errors ...types.FieldParseError) {
 	for _, fieldErr := range errors {
 		if fieldErr.Value == "" {
-			fmt.Fprintln(os.Stderr,
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 				StyleYellow.Render(fmt.Sprintf("[%s] Field '%s': ", parserName, fieldErr.Field))+fieldErr.Err.Error(),
-			)
+			))
 		} else {
-			fmt.Fprintln(os.Stderr,
+			fmt.Fprint(os.Stderr, lipgloss.Sprintln(
 				StyleYellow.Render(fmt.Sprintf("[%s] Field '%s' (%s): ", parserName, fieldErr.Field, fieldErr.Value))+fieldErr.Err.Error(),
-			)
+			))
 		}
 	}
 }
@@ -632,7 +798,7 @@ func (m printConfigModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	var cmd tea.Cmd

 	switch msg := msg.(type) {
-	case tea.KeyMsg:
+	case tea.KeyPressMsg:
 		switch msg.String() {
 		case "ctrl+c", "esc":
 			return m, tea.Quit
@@ -655,13 +821,22 @@ func (m printConfigModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	return m, cmd
 }

-func (m printConfigModel) View() string {
+func (m printConfigModel) View() tea.View {
+	// AltScreen and MouseMode were program options in bubbletea v1; in v2 they
+	// are view properties, so every return path has to declare them.
+	newView := func(s string) tea.View {
+		v := tea.NewView(s)
+		v.AltScreen = true
+		v.MouseMode = tea.MouseModeCellMotion
+		return v
+	}
+
 	if !m.ready {
-		return "\n  Initializing..."
+		return newView("\n  Initializing...")
 	}

 	content := lipgloss.JoinHorizontal(lipgloss.Top, m.viewport.View(), m.scrollbar())
-	return fmt.Sprintf("%s\n%s\n%s", m.headerView(), content, m.footerView())
+	return newView(fmt.Sprintf("%s\n%s\n%s", m.headerView(), content, m.footerView()))
 }

 func (m *printConfigModel) saveContent() (printConfigModel, tea.Cmd) {
@@ -681,12 +856,13 @@ func (m *printConfigModel) handleResize(msg tea.WindowSizeMsg) {
 	width := msg.Width - scrollbarWidth

 	if !m.ready {
-		m.viewport = viewport.New(width, height)
+		m.viewport = viewport.New(viewport.WithWidth(width), viewport.WithHeight(height))
+		m.viewport.SetHorizontalStep(0)
 		m.viewport.SetContent(m.contentWithLineNumbers())
 		m.ready = true
 	} else {
-		m.viewport.Width = width
-		m.viewport.Height = height
+		m.viewport.SetWidth(width)
+		m.viewport.SetHeight(height)
 	}
 }

@@ -701,12 +877,12 @@ func (m printConfigModel) headerView() string {
 			printConfigKeyStyle.Render("ESC") + printConfigDescStyle.Render(" exit")
 		title = printConfigHelpStyle.Render(help)
 	}
-	line := strings.Repeat("─", max(0, m.viewport.Width+scrollbarWidth-lipgloss.Width(title)))
+	line := strings.Repeat("─", max(0, m.viewport.Width()+scrollbarWidth-lipgloss.Width(title)))
 	return lipgloss.JoinHorizontal(lipgloss.Center, title, line)
 }

 func (m printConfigModel) footerView() string {
-	return strings.Repeat("─", m.viewport.Width+scrollbarWidth)
+	return strings.Repeat("─", m.viewport.Width()+scrollbarWidth)
 }

 func (m printConfigModel) contentWithLineNumbers() string {
@@ -728,7 +904,7 @@ func (m printConfigModel) contentWithLineNumbers() string {
 }

 func (m printConfigModel) scrollbar() string {
-	height := m.viewport.Height
+	height := m.viewport.Height()
 	trackHeight := height - scrollbarBottomSpace
 	totalLines := m.viewport.TotalLineCount()

@@ -7,7 +7,6 @@ import (
 	"time"

 	"go.aykhans.me/sarin/internal/types"
-	"go.aykhans.me/utils/common"
 	utilsParse "go.aykhans.me/utils/parser"
 )

@@ -50,74 +49,6 @@ func (parser ConfigENVParser) Parse() (*Config, error) {
 		config.Files = append(config.Files, *types.ParseConfigFile(configFile))
 	}

-	if quiet := parser.getEnv("QUIET"); quiet != "" {
-		quietParsed, err := utilsParse.ParseString[bool](quiet)
-		if err != nil {
-			fieldParseErrors = append(
-				fieldParseErrors,
-				types.NewFieldParseError(
-					parser.getFullEnvName("QUIET"),
-					quiet,
-					errors.New("invalid value for boolean, expected 'true' or 'false'"),
-				),
-			)
-		} else {
-			config.Quiet = &quietParsed
-		}
-	}
-
-	if output := parser.getEnv("OUTPUT"); output != "" {
-		config.Output = common.ToPtr(ConfigOutputType(output))
-	}
-
-	if insecure := parser.getEnv("INSECURE"); insecure != "" {
-		insecureParsed, err := utilsParse.ParseString[bool](insecure)
-		if err != nil {
-			fieldParseErrors = append(
-				fieldParseErrors,
-				types.NewFieldParseError(
-					parser.getFullEnvName("INSECURE"),
-					insecure,
-					errors.New("invalid value for boolean, expected 'true' or 'false'"),
-				),
-			)
-		} else {
-			config.Insecure = &insecureParsed
-		}
-	}
-
-	if dryRun := parser.getEnv("DRY_RUN"); dryRun != "" {
-		dryRunParsed, err := utilsParse.ParseString[bool](dryRun)
-		if err != nil {
-			fieldParseErrors = append(
-				fieldParseErrors,
-				types.NewFieldParseError(
-					parser.getFullEnvName("DRY_RUN"),
-					dryRun,
-					errors.New("invalid value for boolean, expected 'true' or 'false'"),
-				),
-			)
-		} else {
-			config.DryRun = &dryRunParsed
-		}
-	}
-
-	if method := parser.getEnv("METHOD"); method != "" {
-		config.Methods = []string{method}
-	}
-
-	if urlEnv := parser.getEnv("URL"); urlEnv != "" {
-		urlEnvParsed, err := url.Parse(urlEnv)
-		if err != nil {
-			fieldParseErrors = append(
-				fieldParseErrors,
-				types.NewFieldParseError(parser.getFullEnvName("URL"), urlEnv, err),
-			)
-		} else {
-			config.URL = urlEnvParsed
-		}
-	}
-
 	if concurrency := parser.getEnv("CONCURRENCY"); concurrency != "" {
 		concurrencyParsed, err := utilsParse.ParseString[uint](concurrency)
 		if err != nil {
@@ -158,7 +89,7 @@ func (parser ConfigENVParser) Parse() (*Config, error) {
 				types.NewFieldParseError(
 					parser.getFullEnvName("DURATION"),
 					duration,
-					errors.New("invalid value duration, expected a duration string (e.g., '10s', '1h30m')"),
+					errors.New("invalid value for duration, expected a duration string (e.g., '10s', '1h30m')"),
 				),
 			)
 		} else {
@@ -166,22 +97,58 @@ func (parser ConfigENVParser) Parse() (*Config, error) {
 		}
 	}

-	if timeout := parser.getEnv("TIMEOUT"); timeout != "" {
-		timeoutParsed, err := utilsParse.ParseString[time.Duration](timeout)
+	if logLevel := parser.getEnv("LOG_LEVEL"); logLevel != "" {
+		config.LogLevel = new(logLevel)
+	}
+
+	if logFile := parser.getEnv("LOG_FILE"); logFile != "" {
+		config.LogFile = new(logFile)
+	}
+
+	if progress := parser.getEnv("PROGRESS"); progress != "" {
+		config.Progress = new(ConfigProgressType(progress))
+	}
+
+	if output := parser.getEnv("OUTPUT"); output != "" {
+		config.Output = new(ConfigOutputType(output))
+	}
+
+	if dryRun := parser.getEnv("DRY_RUN"); dryRun != "" {
+		dryRunParsed, err := utilsParse.ParseString[bool](dryRun)
 		if err != nil {
 			fieldParseErrors = append(
 				fieldParseErrors,
 				types.NewFieldParseError(
-					parser.getFullEnvName("TIMEOUT"),
-					timeout,
-					errors.New("invalid value duration, expected a duration string (e.g., '10s', '1h30m')"),
+					parser.getFullEnvName("DRY_RUN"),
+					dryRun,
+					errors.New("invalid value for boolean, expected 'true' or 'false'"),
 				),
 			)
 		} else {
-			config.Timeout = &timeoutParsed
+			config.DryRun = &dryRunParsed
 		}
 	}

+	if urlEnv := parser.getEnv("URL"); urlEnv != "" {
+		urlEnvParsed, err := url.Parse(urlEnv)
+		if err != nil {
+			fieldParseErrors = append(
+				fieldParseErrors,
+				types.NewFieldParseError(parser.getFullEnvName("URL"), urlEnv, err),
+			)
+		} else {
+			config.URL = urlEnvParsed
+		}
+	}
+
+	if method := parser.getEnv("METHOD"); method != "" {
+		config.Methods = []string{method}
+	}
+
+	if body := parser.getEnv("BODY"); body != "" {
+		config.Bodies = []string{body}
+	}
+
 	if param := parser.getEnv("PARAM"); param != "" {
 		config.Params.Parse(param)
 	}
@@ -194,10 +161,6 @@ func (parser ConfigENVParser) Parse() (*Config, error) {
 		config.Cookies.Parse(cookie)
 	}

-	if body := parser.getEnv("BODY"); body != "" {
-		config.Bodies = []string{body}
-	}
-
 	if proxy := parser.getEnv("PROXY"); proxy != "" {
 		err := config.Proxies.Parse(proxy)
 		if err != nil {
@@ -216,6 +179,46 @@ func (parser ConfigENVParser) Parse() (*Config, error) {
 		config.Values = []string{values}
 	}

+	if timeout := parser.getEnv("TIMEOUT"); timeout != "" {
+		timeoutParsed, err := utilsParse.ParseString[time.Duration](timeout)
+		if err != nil {
+			fieldParseErrors = append(
+				fieldParseErrors,
+				types.NewFieldParseError(
+					parser.getFullEnvName("TIMEOUT"),
+					timeout,
+					errors.New("invalid value for duration, expected a duration string (e.g., '10s', '1h30m')"),
+				),
+			)
+		} else {
+			config.Timeout = &timeoutParsed
+		}
+	}
+
+	if insecure := parser.getEnv("INSECURE"); insecure != "" {
+		insecureParsed, err := utilsParse.ParseString[bool](insecure)
+		if err != nil {
+			fieldParseErrors = append(
+				fieldParseErrors,
+				types.NewFieldParseError(
+					parser.getFullEnvName("INSECURE"),
+					insecure,
+					errors.New("invalid value for boolean, expected 'true' or 'false'"),
+				),
+			)
+		} else {
+			config.Insecure = &insecureParsed
+		}
+	}
+
+	if lua := parser.getEnv("LUA"); lua != "" {
+		config.Lua = []string{lua}
+	}
+
+	if js := parser.getEnv("JS"); js != "" {
+		config.Js = []string{js}
+	}
+
 	if len(fieldParseErrors) > 0 {
 		return nil, types.NewFieldParseErrors(fieldParseErrors)
 	}
@@ -12,7 +12,6 @@ import (
 	"time"

 	"go.aykhans.me/sarin/internal/types"
-	"go.aykhans.me/utils/common"
 	"go.yaml.in/yaml/v4"
 )

@@ -49,6 +48,10 @@ func (parser ConfigFileParser) Parse() (*Config, error) {
 }

 // fetchFile retrieves file contents from a local path or HTTP/HTTPS URL.
+// It can return the following errors:
+//   - types.FileReadError
+//   - types.HTTPFetchError
+//   - types.HTTPStatusError
 func fetchFile(ctx context.Context, src string) ([]byte, error) {
 	if strings.HasPrefix(src, "http://") || strings.HasPrefix(src, "https://") {
 		return fetchHTTP(ctx, src)
@@ -57,25 +60,28 @@ func fetchFile(ctx context.Context, src string) ([]byte, error) {
 }

 // fetchHTTP downloads file contents from an HTTP/HTTPS URL.
+// It can return the following errors:
+//   - types.HTTPFetchError
+//   - types.HTTPStatusError
 func fetchHTTP(ctx context.Context, url string) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
+		return nil, types.NewHTTPFetchError(url, err)
 	}

 	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("failed to fetch file: %w", err)
+		return nil, types.NewHTTPFetchError(url, err)
 	}
 	defer resp.Body.Close() //nolint:errcheck

 	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("failed to fetch file: HTTP %d %s", resp.StatusCode, resp.Status)
+		return nil, types.NewHTTPStatusError(url, resp.StatusCode, resp.Status)
 	}

 	data, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response body: %w", err)
+		return nil, types.NewHTTPFetchError(url, err)
 	}

 	return data, nil
@@ -83,19 +89,21 @@ func fetchHTTP(ctx context.Context, url string) ([]byte, error) {

 // fetchLocal reads file contents from the local filesystem.
 // It resolves relative paths from the current working directory.
+// It can return the following errors:
+//   - types.FileReadError
 func fetchLocal(src string) ([]byte, error) {
 	path := src
 	if !filepath.IsAbs(src) {
 		pwd, err := os.Getwd()
 		if err != nil {
-			return nil, fmt.Errorf("failed to get working directory: %w", err)
+			return nil, types.NewFileReadError(src, err)
 		}
 		path = filepath.Join(pwd, src)
 	}

 	data, err := os.ReadFile(path) //nolint:gosec
 	if err != nil {
-		return nil, fmt.Errorf("failed to read file: %w", err)
+		return nil, types.NewFileReadError(path, err)
 	}

 	return data, nil
@@ -184,24 +192,28 @@ func (kv *keyValuesField) unmarshalMapping(node *yaml.Node) error {
 }

 type configYAML struct {
+	ShowConfig   *bool              `yaml:"showConfig"`
 	ConfigFiles  stringOrSliceField `yaml:"configFile"`
-	Method       stringOrSliceField `yaml:"method"`
-	URL          *string            `yaml:"url"`
-	Timeout      *time.Duration     `yaml:"timeout"`
 	Concurrency  *uint              `yaml:"concurrency"`
 	RequestCount *uint64            `yaml:"requests"`
 	Duration     *time.Duration     `yaml:"duration"`
-	Quiet        *bool              `yaml:"quiet"`
+	LogLevel     *string            `yaml:"logLevel"`
+	LogFile      *string            `yaml:"logFile"`
+	Progress     *string            `yaml:"progress"`
 	Output       *string            `yaml:"output"`
-	Insecure     *bool              `yaml:"insecure"`
-	ShowConfig   *bool              `yaml:"showConfig"`
 	DryRun       *bool              `yaml:"dryRun"`
+	URL          *string            `yaml:"url"`
+	Method       stringOrSliceField `yaml:"method"`
+	Bodies       stringOrSliceField `yaml:"body"`
 	Params       keyValuesField     `yaml:"params"`
 	Headers      keyValuesField     `yaml:"headers"`
 	Cookies      keyValuesField     `yaml:"cookies"`
-	Bodies       stringOrSliceField `yaml:"body"`
 	Proxies      stringOrSliceField `yaml:"proxy"`
 	Values       stringOrSliceField `yaml:"values"`
+	Timeout      *time.Duration     `yaml:"timeout"`
+	Insecure     *bool              `yaml:"insecure"`
+	Lua          stringOrSliceField `yaml:"lua"`
+	Js           stringOrSliceField `yaml:"js"`
 }

 // ParseYAML parses YAML config file arguments into a Config object.
@@ -221,31 +233,7 @@ func (parser ConfigFileParser) ParseYAML(data []byte) (*Config, error) {

 	var fieldParseErrors []types.FieldParseError

-	config.Methods = append(config.Methods, parsedData.Method...)
-	config.Timeout = parsedData.Timeout
-	config.Concurrency = parsedData.Concurrency
-	config.Requests = parsedData.RequestCount
-	config.Duration = parsedData.Duration
 	config.ShowConfig = parsedData.ShowConfig
-	config.Quiet = parsedData.Quiet
-
-	if parsedData.Output != nil {
-		config.Output = common.ToPtr(ConfigOutputType(*parsedData.Output))
-	}
-
-	config.Insecure = parsedData.Insecure
-	config.DryRun = parsedData.DryRun
-	for _, kv := range parsedData.Params {
-		config.Params = append(config.Params, types.Param(kv))
-	}
-	for _, kv := range parsedData.Headers {
-		config.Headers = append(config.Headers, types.Header(kv))
-	}
-	for _, kv := range parsedData.Cookies {
-		config.Cookies = append(config.Cookies, types.Cookie(kv))
-	}
-	config.Bodies = append(config.Bodies, parsedData.Bodies...)
-	config.Values = append(config.Values, parsedData.Values...)

 	if len(parsedData.ConfigFiles) > 0 {
 		for _, configFile := range parsedData.ConfigFiles {
@@ -253,6 +241,22 @@ func (parser ConfigFileParser) ParseYAML(data []byte) (*Config, error) {
 		}
 	}

+	config.Concurrency = parsedData.Concurrency
+	config.Requests = parsedData.RequestCount
+	config.Duration = parsedData.Duration
+	config.LogLevel = parsedData.LogLevel
+	config.LogFile = parsedData.LogFile
+
+	if parsedData.Progress != nil {
+		config.Progress = new(ConfigProgressType(*parsedData.Progress))
+	}
+
+	if parsedData.Output != nil {
+		config.Output = new(ConfigOutputType(*parsedData.Output))
+	}
+
+	config.DryRun = parsedData.DryRun
+
 	if parsedData.URL != nil {
 		urlParsed, err := url.Parse(*parsedData.URL)
 		if err != nil {
@@ -262,6 +266,18 @@ func (parser ConfigFileParser) ParseYAML(data []byte) (*Config, error) {
 		}
 	}

+	config.Methods = append(config.Methods, parsedData.Method...)
+	config.Bodies = append(config.Bodies, parsedData.Bodies...)
+	for _, kv := range parsedData.Params {
+		config.Params = append(config.Params, types.Param(kv))
+	}
+	for _, kv := range parsedData.Headers {
+		config.Headers = append(config.Headers, types.Header(kv))
+	}
+	for _, kv := range parsedData.Cookies {
+		config.Cookies = append(config.Cookies, types.Cookie(kv))
+	}
+
 	for i, proxy := range parsedData.Proxies {
 		err := config.Proxies.Parse(proxy)
 		if err != nil {
@@ -272,6 +288,12 @@ func (parser ConfigFileParser) ParseYAML(data []byte) (*Config, error) {
 		}
 	}

+	config.Values = append(config.Values, parsedData.Values...)
+	config.Timeout = parsedData.Timeout
+	config.Insecure = parsedData.Insecure
+	config.Lua = append(config.Lua, parsedData.Lua...)
+	config.Js = append(config.Js, parsedData.Js...)
+
 	if len(fieldParseErrors) > 0 {
 		return nil, types.NewFieldParseErrors(fieldParseErrors)
 	}
@@ -8,6 +8,8 @@ import (
 	"go.aykhans.me/sarin/internal/types"
 )

+// It can return the following errors:
+//   - types.TemplateParseError
 func validateTemplateString(value string, funcMap template.FuncMap) error {
 	if value == "" {
 		return nil
@@ -15,7 +17,7 @@ func validateTemplateString(value string, funcMap template.FuncMap) error {

 	_, err := template.New("").Funcs(funcMap).Parse(value)
 	if err != nil {
-		return fmt.Errorf("template parse error: %w", err)
+		return types.NewTemplateParseError(err)
 	}

 	return nil
@@ -191,11 +193,12 @@ func validateTemplateURLPath(urlPath string, funcMap template.FuncMap) []types.F

 func ValidateTemplates(config *Config) []types.FieldValidationError {
 	// Create template function map using the same functions as sarin package
+	// Use nil for fileCache during validation - templates are only parsed, not executed
 	randSource := sarin.NewDefaultRandSource()
-	funcMap := sarin.NewDefaultTemplateFuncMap(randSource)
+	funcMap := sarin.NewDefaultTemplateFuncMap(randSource, nil)

 	bodyFuncMapData := &sarin.BodyTemplateFuncMapData{}
-	bodyFuncMap := sarin.NewDefaultBodyTemplateFuncMap(randSource, bodyFuncMapData)
+	bodyFuncMap := sarin.NewDefaultBodyTemplateFuncMap(randSource, bodyFuncMapData, nil)

 	var allErrors []types.FieldValidationError

@@ -0,0 +1,415 @@
+package sarin
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"go.aykhans.me/sarin/internal/types"
+)
+
+const (
+	captchaPollInterval = 1 * time.Second
+	captchaPollTimeout  = 120 * time.Second
+)
+
+var captchaHTTPClient = &http.Client{Timeout: 5 * time.Second}
+
+// solveCaptcha creates a task on the given captcha service and polls until it is solved,
+// returning the extracted token from the solution object.
+//
+// baseURL is the service API base (e.g. "https://api.2captcha.com").
+// task is the task payload the service expects (type + service-specific fields).
+// solutionKey is the field name in the solution object that holds the token.
+// taskIDIsString controls whether taskId is sent back as a string (CapSolver UUIDs)
+// or a JSON number (2Captcha, Anti-Captcha).
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func solveCaptcha(baseURL, apiKey string, task map[string]any, solutionKey string, taskIDIsString bool) (string, error) {
+	if apiKey == "" {
+		return "", types.ErrCaptchaKeyEmpty
+	}
+
+	taskID, err := captchaCreateTask(baseURL, apiKey, task)
+	if err != nil {
+		return "", err
+	}
+	return captchaPollResult(baseURL, apiKey, taskID, solutionKey, taskIDIsString)
+}
+
+// captchaCreateTask submits a task to the captcha service and returns the assigned taskId.
+// The taskId is normalized to a string: numeric IDs are preserved via json.RawMessage,
+// and quoted string IDs (CapSolver UUIDs) have their surrounding quotes stripped.
+//
+// It can return the following errors:
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+func captchaCreateTask(baseURL, apiKey string, task map[string]any) (string, error) {
+	body := map[string]any{
+		"clientKey": apiKey,
+		"task":      task,
+	}
+
+	data, err := json.Marshal(body)
+	if err != nil {
+		return "", types.NewCaptchaDecodeError("createTask", err)
+	}
+
+	resp, err := captchaHTTPClient.Post(
+		baseURL+"/createTask",
+		"application/json",
+		bytes.NewReader(data),
+	)
+	if err != nil {
+		return "", types.NewCaptchaRequestError("createTask", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	var result struct {
+		ErrorID          int             `json:"errorId"`
+		ErrorCode        string          `json:"errorCode"`
+		ErrorDescription string          `json:"errorDescription"`
+		TaskID           json.RawMessage `json:"taskId"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", types.NewCaptchaDecodeError("createTask", err)
+	}
+
+	if result.ErrorID != 0 {
+		return "", types.NewCaptchaAPIError("createTask", result.ErrorCode, result.ErrorDescription)
+	}
+
+	// taskId may be a JSON number (2captcha, anti-captcha) or a quoted string (capsolver UUIDs).
+	// Strip surrounding quotes if present so we always work with the underlying value.
+	taskID := strings.Trim(string(result.TaskID), `"`)
+	if taskID == "" {
+		return "", types.NewCaptchaAPIError("createTask", "EMPTY_TASK_ID", "service returned a successful response with no taskId")
+	}
+	return taskID, nil
+}
+
+// captchaPollResult polls the getTaskResult endpoint at captchaPollInterval until the task
+// is solved, an error is returned by the service, or the overall captchaPollTimeout is hit.
+//
+// It can return the following errors:
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaSolutionKeyError
+func captchaPollResult(baseURL, apiKey, taskID, solutionKey string, taskIDIsString bool) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), captchaPollTimeout)
+	defer cancel()
+
+	ticker := time.NewTicker(captchaPollInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return "", types.NewCaptchaPollTimeoutError(taskID)
+		case <-ticker.C:
+			token, err := captchaGetTaskResult(baseURL, apiKey, taskID, solutionKey, taskIDIsString)
+			if errors.Is(err, types.ErrCaptchaProcessing) {
+				continue
+			}
+			// Retry on transient HTTP errors (timeouts, connection resets, etc.)
+			// instead of failing the entire solve. The poll loop timeout will
+			// eventually catch permanently unreachable services.
+			if _, ok := errors.AsType[types.CaptchaRequestError](err); ok {
+				continue
+			}
+			if err != nil {
+				return "", err
+			}
+			return token, nil
+		}
+	}
+}
+
+// captchaGetTaskResult fetches a single task result from the captcha service.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaProcessing
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaSolutionKeyError
+func captchaGetTaskResult(baseURL, apiKey, taskID, solutionKey string, taskIDIsString bool) (string, error) {
+	var bodyMap map[string]any
+	if taskIDIsString {
+		bodyMap = map[string]any{"clientKey": apiKey, "taskId": taskID}
+	} else {
+		bodyMap = map[string]any{"clientKey": apiKey, "taskId": json.Number(taskID)}
+	}
+
+	data, err := json.Marshal(bodyMap)
+	if err != nil {
+		return "", types.NewCaptchaDecodeError("getTaskResult", err)
+	}
+
+	resp, err := captchaHTTPClient.Post(
+		baseURL+"/getTaskResult",
+		"application/json",
+		bytes.NewReader(data),
+	)
+	if err != nil {
+		return "", types.NewCaptchaRequestError("getTaskResult", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	var result struct {
+		ErrorID          int            `json:"errorId"`
+		ErrorCode        string         `json:"errorCode"`
+		ErrorDescription string         `json:"errorDescription"`
+		Status           string         `json:"status"`
+		Solution         map[string]any `json:"solution"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", types.NewCaptchaDecodeError("getTaskResult", err)
+	}
+
+	if result.ErrorID != 0 {
+		return "", types.NewCaptchaAPIError("getTaskResult", result.ErrorCode, result.ErrorDescription)
+	}
+
+	if result.Status == "processing" || result.Status == "idle" {
+		return "", types.ErrCaptchaProcessing
+	}
+
+	token, ok := result.Solution[solutionKey]
+	if !ok {
+		return "", types.NewCaptchaSolutionKeyError(solutionKey)
+	}
+	tokenStr, ok := token.(string)
+	if !ok {
+		return "", types.NewCaptchaSolutionKeyError(solutionKey)
+	}
+
+	return tokenStr, nil
+}
+
+// ======================================== 2Captcha ========================================
+
+const twoCaptchaBaseURL = "https://api.2captcha.com"
+
+// twoCaptchaSolveRecaptchaV2 solves a Google reCAPTCHA v2 challenge via 2Captcha.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func twoCaptchaSolveRecaptchaV2(apiKey, websiteURL, websiteKey string) (string, error) {
+	return solveCaptcha(twoCaptchaBaseURL, apiKey, map[string]any{
+		"type":       "RecaptchaV2TaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}, "gRecaptchaResponse", false)
+}
+
+// twoCaptchaSolveRecaptchaV3 solves a Google reCAPTCHA v3 challenge via 2Captcha.
+// pageAction may be empty.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func twoCaptchaSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction string) (string, error) {
+	task := map[string]any{
+		"type":       "RecaptchaV3TaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}
+	if pageAction != "" {
+		task["pageAction"] = pageAction
+	}
+	return solveCaptcha(twoCaptchaBaseURL, apiKey, task, "gRecaptchaResponse", false)
+}
+
+// twoCaptchaSolveTurnstile solves a Cloudflare Turnstile challenge via 2Captcha.
+// cData may be empty.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func twoCaptchaSolveTurnstile(apiKey, websiteURL, websiteKey, cData string) (string, error) {
+	task := map[string]any{
+		"type":       "TurnstileTaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}
+	if cData != "" {
+		task["data"] = cData
+	}
+	return solveCaptcha(twoCaptchaBaseURL, apiKey, task, "token", false)
+}
+
+// ======================================== Anti-Captcha ========================================
+
+const antiCaptchaBaseURL = "https://api.anti-captcha.com"
+
+// antiCaptchaSolveRecaptchaV2 solves a Google reCAPTCHA v2 challenge via Anti-Captcha.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func antiCaptchaSolveRecaptchaV2(apiKey, websiteURL, websiteKey string) (string, error) {
+	return solveCaptcha(antiCaptchaBaseURL, apiKey, map[string]any{
+		"type":       "RecaptchaV2TaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}, "gRecaptchaResponse", false)
+}
+
+// antiCaptchaSolveRecaptchaV3 solves a Google reCAPTCHA v3 challenge via Anti-Captcha.
+// pageAction may be empty. minScore is hardcoded to 0.3 (the loosest threshold) because
+// Anti-Captcha rejects the request without it.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func antiCaptchaSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction string) (string, error) {
+	task := map[string]any{
+		"type":       "RecaptchaV3TaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+		"minScore":   0.3,
+	}
+	if pageAction != "" {
+		task["pageAction"] = pageAction
+	}
+	return solveCaptcha(antiCaptchaBaseURL, apiKey, task, "gRecaptchaResponse", false)
+}
+
+// antiCaptchaSolveHCaptcha solves an hCaptcha challenge via Anti-Captcha.
+// Anti-Captcha returns hCaptcha tokens under "gRecaptchaResponse" (not "token").
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func antiCaptchaSolveHCaptcha(apiKey, websiteURL, websiteKey string) (string, error) {
+	return solveCaptcha(antiCaptchaBaseURL, apiKey, map[string]any{
+		"type":       "HCaptchaTaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}, "gRecaptchaResponse", false)
+}
+
+// antiCaptchaSolveTurnstile solves a Cloudflare Turnstile challenge via Anti-Captcha.
+// cData may be empty.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func antiCaptchaSolveTurnstile(apiKey, websiteURL, websiteKey, cData string) (string, error) {
+	task := map[string]any{
+		"type":       "TurnstileTaskProxyless",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}
+	if cData != "" {
+		task["cData"] = cData
+	}
+	return solveCaptcha(antiCaptchaBaseURL, apiKey, task, "token", false)
+}
+
+// ======================================== CapSolver ========================================
+
+const capSolverBaseURL = "https://api.capsolver.com"
+
+// capSolverSolveRecaptchaV2 solves a Google reCAPTCHA v2 challenge via CapSolver.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func capSolverSolveRecaptchaV2(apiKey, websiteURL, websiteKey string) (string, error) {
+	return solveCaptcha(capSolverBaseURL, apiKey, map[string]any{
+		"type":       "ReCaptchaV2TaskProxyLess",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}, "gRecaptchaResponse", true)
+}
+
+// capSolverSolveRecaptchaV3 solves a Google reCAPTCHA v3 challenge via CapSolver.
+// pageAction may be empty.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func capSolverSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction string) (string, error) {
+	task := map[string]any{
+		"type":       "ReCaptchaV3TaskProxyLess",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}
+	if pageAction != "" {
+		task["pageAction"] = pageAction
+	}
+	return solveCaptcha(capSolverBaseURL, apiKey, task, "gRecaptchaResponse", true)
+}
+
+// capSolverSolveTurnstile solves a Cloudflare Turnstile challenge via CapSolver.
+// cData may be empty. CapSolver nests cData under a "metadata" object.
+//
+// It can return the following errors:
+//   - types.ErrCaptchaKeyEmpty
+//   - types.CaptchaRequestError
+//   - types.CaptchaDecodeError
+//   - types.CaptchaAPIError
+//   - types.CaptchaPollTimeoutError
+//   - types.CaptchaSolutionKeyError
+func capSolverSolveTurnstile(apiKey, websiteURL, websiteKey, cData string) (string, error) {
+	task := map[string]any{
+		"type":       "AntiTurnstileTaskProxyLess",
+		"websiteURL": websiteURL,
+		"websiteKey": websiteKey,
+	}
+	if cData != "" {
+		task["metadata"] = map[string]any{"cdata": cData}
+	}
+	return solveCaptcha(capSolverBaseURL, apiKey, task, "token", true)
+}
@@ -5,7 +5,6 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/base64"
-	"errors"
 	"math"
 	"net"
 	"net/http"
@@ -95,6 +94,9 @@ func NewHostClients(
 	return []*fasthttp.HostClient{client}, nil
 }

+// NewProxyDialFunc creates a dial function for the given proxy URL.
+// It can return the following errors:
+//   - types.ProxyUnsupportedSchemeError
 func NewProxyDialFunc(ctx context.Context, proxyURL *url.URL, timeout time.Duration) (fasthttp.DialFunc, error) {
 	var (
 		dialer fasthttp.DialFunc
@@ -117,16 +119,14 @@ func NewProxyDialFunc(ctx context.Context, proxyURL *url.URL, timeout time.Durat
 	case "https":
 		dialer = fasthttpHTTPSDialerDualStackTimeout(proxyURL, timeout)
 	default:
-		return nil, errors.New("unsupported proxy scheme")
-	}
-
-	if dialer == nil {
-		return nil, errors.New("internal error: proxy dialer is nil")
+		return nil, types.NewProxyUnsupportedSchemeError(proxyURL.Scheme)
 	}

 	return dialer, nil
 }

+// The returned dial function can return the following errors:
+//   - types.ProxyDialError
 func fasthttpSocksDialerDualStackTimeout(ctx context.Context, proxyURL *url.URL, timeout time.Duration, resolveLocally bool) (fasthttp.DialFunc, error) {
 	netDialer := &net.Dialer{}

@@ -147,12 +147,18 @@ func fasthttpSocksDialerDualStackTimeout(ctx context.Context, proxyURL *url.URL,
 		return nil, err
 	}

+	proxyStr := proxyURL.String()
+
 	// Assert to ContextDialer for timeout support
 	contextDialer, ok := socksDialer.(proxy.ContextDialer)
 	if !ok {
 		// Fallback without timeout (should not happen with net.Dialer)
 		return func(addr string) (net.Conn, error) {
-			return socksDialer.Dial("tcp", addr)
+			conn, err := socksDialer.Dial("tcp", addr)
+			if err != nil {
+				return nil, types.NewProxyDialError(proxyStr, err)
+			}
+			return conn, nil
 		}, nil
 	}

@@ -163,18 +169,17 @@ func fasthttpSocksDialerDualStackTimeout(ctx context.Context, proxyURL *url.URL,
 		if resolveLocally {
 			host, port, err := net.SplitHostPort(addr)
 			if err != nil {
-				return nil, err
+				return nil, types.NewProxyDialError(proxyStr, err)
 			}

-			// Cap DNS resolution to half the timeout to reserve time for dial
 			dnsCtx, dnsCancel := context.WithTimeout(ctx, timeout)
 			ips, err := net.DefaultResolver.LookupIP(dnsCtx, "ip", host)
 			dnsCancel()
 			if err != nil {
-				return nil, err
+				return nil, types.NewProxyDialError(proxyStr, err)
 			}
 			if len(ips) == 0 {
-				return nil, errors.New("no IP addresses found for host: " + host)
+				return nil, types.NewProxyDialError(proxyStr, types.NewProxyResolveError(host))
 			}

 			// Use the first resolved IP
@@ -184,16 +189,22 @@ func fasthttpSocksDialerDualStackTimeout(ctx context.Context, proxyURL *url.URL,
 		// Use remaining time for dial
 		remaining := time.Until(deadline)
 		if remaining <= 0 {
-			return nil, context.DeadlineExceeded
+			return nil, types.NewProxyDialError(proxyStr, context.DeadlineExceeded)
 		}

 		dialCtx, dialCancel := context.WithTimeout(ctx, remaining)
 		defer dialCancel()

-		return contextDialer.DialContext(dialCtx, "tcp", addr)
+		conn, err := contextDialer.DialContext(dialCtx, "tcp", addr)
+		if err != nil {
+			return nil, types.NewProxyDialError(proxyStr, err)
+		}
+		return conn, nil
 	}, nil
 }

+// The returned dial function can return the following errors:
+//   - types.ProxyDialError
 func fasthttpHTTPSDialerDualStackTimeout(proxyURL *url.URL, timeout time.Duration) fasthttp.DialFunc {
 	proxyAddr := proxyURL.Host
 	if proxyURL.Port() == "" {
@@ -209,33 +220,35 @@ func fasthttpHTTPSDialerDualStackTimeout(proxyURL *url.URL, timeout time.Duratio
 		proxyAuth = "Basic " + base64.StdEncoding.EncodeToString([]byte(credentials))
 	}

+	proxyStr := proxyURL.String()
+
 	return func(addr string) (net.Conn, error) {
 		// Establish TCP connection to proxy with timeout
 		start := time.Now()
 		conn, err := fasthttp.DialDualStackTimeout(proxyAddr, timeout)
 		if err != nil {
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}

 		remaining := timeout - time.Since(start)
 		if remaining <= 0 {
 			conn.Close() //nolint:errcheck,gosec
-			return nil, context.DeadlineExceeded
+			return nil, types.NewProxyDialError(proxyStr, context.DeadlineExceeded)
 		}

 		// Set deadline for the TLS handshake and CONNECT request
 		if err := conn.SetDeadline(time.Now().Add(remaining)); err != nil {
 			conn.Close() //nolint:errcheck,gosec
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}

 		// Upgrade to TLS
-		tlsConn := tls.Client(conn, &tls.Config{ //nolint:gosec
+		tlsConn := tls.Client(conn, &tls.Config{
 			ServerName: proxyURL.Hostname(),
 		})
 		if err := tlsConn.Handshake(); err != nil {
 			tlsConn.Close() //nolint:errcheck,gosec
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}

 		// Build and send CONNECT request
@@ -251,7 +264,7 @@ func fasthttpHTTPSDialerDualStackTimeout(proxyURL *url.URL, timeout time.Duratio

 		if err := connectReq.Write(tlsConn); err != nil {
 			tlsConn.Close() //nolint:errcheck,gosec
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}

 		// Read response using buffered reader, but return wrapped connection
@@ -260,19 +273,19 @@ func fasthttpHTTPSDialerDualStackTimeout(proxyURL *url.URL, timeout time.Duratio
 		resp, err := http.ReadResponse(bufReader, connectReq)
 		if err != nil {
 			tlsConn.Close() //nolint:errcheck,gosec
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}
 		resp.Body.Close() //nolint:errcheck,gosec

 		if resp.StatusCode != http.StatusOK {
 			tlsConn.Close() //nolint:errcheck,gosec
-			return nil, errors.New("proxy CONNECT failed: " + resp.Status)
+			return nil, types.NewProxyDialError(proxyStr, types.NewProxyConnectError(resp.Status))
 		}

 		// Clear deadline for the tunneled connection
 		if err := tlsConn.SetDeadline(time.Time{}); err != nil {
 			tlsConn.Close() //nolint:errcheck,gosec
-			return nil, err
+			return nil, types.NewProxyDialError(proxyStr, err)
 		}

 		// Return wrapped connection that uses the buffered reader
@@ -0,0 +1,114 @@
+package sarin
+
+import (
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"go.aykhans.me/sarin/internal/types"
+)
+
+// CachedFile holds the cached content and metadata of a file.
+type CachedFile struct {
+	Content  []byte
+	Filename string
+}
+
+type FileCache struct {
+	cache          sync.Map // map[string]*CachedFile
+	requestTimeout time.Duration
+}
+
+func NewFileCache(requestTimeout time.Duration) *FileCache {
+	return &FileCache{
+		requestTimeout: requestTimeout,
+	}
+}
+
+// GetOrLoad retrieves a file from cache or loads it using the provided source.
+// The source can be a local file path or an HTTP/HTTPS URL.
+// It can return the following errors:
+//   - types.FileReadError
+//   - types.HTTPFetchError
+//   - types.HTTPStatusError
+func (fc *FileCache) GetOrLoad(source string) (*CachedFile, error) {
+	if val, ok := fc.cache.Load(source); ok {
+		return val.(*CachedFile), nil
+	}
+
+	var (
+		content  []byte
+		filename string
+		err      error
+	)
+	if strings.HasPrefix(source, "http://") || strings.HasPrefix(source, "https://") {
+		content, filename, err = fc.fetchURL(source)
+	} else {
+		content, filename, err = fc.readLocalFile(source)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	file := &CachedFile{Content: content, Filename: filename}
+
+	// LoadOrStore handles race condition - if another goroutine
+	// cached it first, we get theirs (no duplicate storage)
+	actual, _ := fc.cache.LoadOrStore(source, file)
+	return actual.(*CachedFile), nil
+}
+
+// readLocalFile reads a file from the local filesystem and returns its content and filename.
+// It can return the following errors:
+//   - types.FileReadError
+func (fc *FileCache) readLocalFile(filePath string) ([]byte, string, error) {
+	content, err := os.ReadFile(filePath) //nolint:gosec
+	if err != nil {
+		return nil, "", types.NewFileReadError(filePath, err)
+	}
+	return content, filepath.Base(filePath), nil
+}
+
+// fetchURL downloads file contents from an HTTP/HTTPS URL.
+// It can return the following errors:
+//   - types.HTTPFetchError
+//   - types.HTTPStatusError
+func (fc *FileCache) fetchURL(url string) ([]byte, string, error) {
+	client := &http.Client{
+		Timeout: fc.requestTimeout,
+	}
+
+	resp, err := client.Get(url)
+	if err != nil {
+		return nil, "", types.NewHTTPFetchError(url, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, "", types.NewHTTPStatusError(url, resp.StatusCode, resp.Status)
+	}
+
+	content, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, "", types.NewHTTPFetchError(url, err)
+	}
+
+	// Extract filename from URL path
+	filename := path.Base(url)
+	if filename == "" || filename == "/" || filename == "." {
+		filename = "downloaded_file"
+	}
+
+	// Remove query string from filename if present
+	if idx := strings.Index(filename, "?"); idx != -1 {
+		filename = filename[:idx]
+	}
+
+	return content, filename, nil
+}
@@ -8,7 +8,14 @@ import (
 func NewDefaultRandSource() rand.Source {
 	now := time.Now().UnixNano()
 	return rand.NewPCG(
-		uint64(now),     //nolint:gosec // G115: Safe conversion; UnixNano timestamp used as random seed, bit pattern is intentional
-		uint64(now>>32), //nolint:gosec // G115: Safe conversion; right-shifted timestamp for seed entropy, overflow is acceptable
+		uint64(now),
+		uint64(now>>32),
 	)
 }
+
+func firstOrEmpty(values []string) string {
+	if len(values) == 0 {
+		return ""
+	}
+	return values[0]
+}
@@ -2,7 +2,6 @@ package sarin

 import (
 	"bytes"
-	"fmt"
 	"maps"
 	"math/rand/v2"
 	"net/url"
@@ -11,13 +10,14 @@ import (

 	"github.com/joho/godotenv"
 	"github.com/valyala/fasthttp"
+	"go.aykhans.me/sarin/internal/script"
 	"go.aykhans.me/sarin/internal/types"
 	utilsSlice "go.aykhans.me/utils/slice"
 )

 type RequestGenerator func(*fasthttp.Request) error

-type RequestGeneratorWithData func(*fasthttp.Request, any) error
+type requestDataGenerator func(*script.RequestData, any) error

 type valuesData struct {
 	Values map[string]string
@@ -26,6 +26,9 @@ type valuesData struct {
 // NewRequestGenerator creates a new RequestGenerator function that generates HTTP requests
 // with the specified configuration. The returned RequestGenerator is NOT safe for concurrent
 // use by multiple goroutines.
+//
+// Note: Scripts must be validated before calling this function (e.g., in NewSarin).
+// The caller is responsible for managing the scriptTransformer lifecycle.
 func NewRequestGenerator(
 	methods []string,
 	requestURL *url.URL,
@@ -34,23 +37,59 @@ func NewRequestGenerator(
 	cookies types.Cookies,
 	bodies []string,
 	values []string,
+	fileCache *FileCache,
+	scriptTransformer *script.Transformer,
 ) (RequestGenerator, bool) {
 	randSource := NewDefaultRandSource()
 	//nolint:gosec // G404: Using non-cryptographic rand for load testing, not security
 	localRand := rand.New(randSource)
-	templateFuncMap := NewDefaultTemplateFuncMap(randSource)

-	pathGenerator, isPathGeneratorDynamic := createTemplateFunc(requestURL.Path, templateFuncMap)
-	methodGenerator, isMethodGeneratorDynamic := NewMethodGeneratorFunc(localRand, methods, templateFuncMap)
-	paramsGenerator, isParamsGeneratorDynamic := NewParamsGeneratorFunc(localRand, params, templateFuncMap)
-	headersGenerator, isHeadersGeneratorDynamic := NewHeadersGeneratorFunc(localRand, headers, templateFuncMap)
-	cookiesGenerator, isCookiesGeneratorDynamic := NewCookiesGeneratorFunc(localRand, cookies, templateFuncMap)
+	// Funcs() is only called if a value actually contains template syntax.
+	// The root template is shared across all createTemplateFunc calls so Funcs() is called at most once.
+	var templateRoot *template.Template
+	lazyTemplateRoot := func() *template.Template {
+		if templateRoot == nil {
+			templateRoot = template.New("").Funcs(NewDefaultTemplateFuncMap(randSource, fileCache))
+		}
+		return templateRoot
+	}
+
+	pathGenerator, isPathGeneratorDynamic := createTemplateFunc(requestURL.Path, lazyTemplateRoot)
+	methodGenerator, isMethodGeneratorDynamic := NewMethodGeneratorFunc(localRand, methods, lazyTemplateRoot)
+	paramsGenerator, isParamsGeneratorDynamic, paramKeysAreStatic := NewParamsGeneratorFunc(localRand, params, lazyTemplateRoot)
+	headersGenerator, isHeadersGeneratorDynamic, headerKeysAreStatic := NewHeadersGeneratorFunc(localRand, headers, lazyTemplateRoot)
+	cookiesGenerator, isCookiesGeneratorDynamic, cookieKeysAreStatic := NewCookiesGeneratorFunc(localRand, cookies, lazyTemplateRoot)

 	bodyTemplateFuncMapData := &BodyTemplateFuncMapData{}
-	bodyTemplateFuncMap := NewDefaultBodyTemplateFuncMap(randSource, bodyTemplateFuncMapData)
-	bodyGenerator, isBodyGeneratorDynamic := NewBodyGeneratorFunc(localRand, bodies, bodyTemplateFuncMap)
+	var bodyTemplateRoot *template.Template
+	lazyBodyTemplateRoot := func() *template.Template {
+		if bodyTemplateRoot == nil {
+			bodyTemplateRoot = template.New("").Funcs(NewDefaultBodyTemplateFuncMap(randSource, bodyTemplateFuncMapData, fileCache))
+		}
+		return bodyTemplateRoot
+	}
+	bodyGenerator, isBodyGeneratorDynamic := NewBodyGeneratorFunc(localRand, bodies, lazyBodyTemplateRoot)

-	valuesGenerator := NewValuesGeneratorFunc(values, templateFuncMap)
+	valuesGenerator := NewValuesGeneratorFunc(values, lazyTemplateRoot)
+
+	hasScripts := scriptTransformer != nil && !scriptTransformer.IsEmpty()
+
+	host := requestURL.Host
+	scheme := requestURL.Scheme
+
+	reqData := &script.RequestData{
+		Headers: make(map[string][]string),
+		Params:  make(map[string][]string),
+		Cookies: make(map[string][]string),
+	}
+
+	// When a map's key set is fixed, every request refills exactly the same keys, so
+	// the value slices can be truncated and reused instead of being reallocated after
+	// a clear(). Scripts are excluded: they may swap the maps out or add keys of their
+	// own, and they would observe a leftover empty slice where a key used to be absent.
+	reuseParamSlices := paramKeysAreStatic && !hasScripts
+	reuseHeaderSlices := headerKeysAreStatic && !hasScripts
+	reuseCookieSlices := cookieKeysAreStatic && !hasScripts

 	var (
 		data valuesData
@@ -58,7 +97,12 @@ func NewRequestGenerator(
 		err  error
 	)
 	return func(req *fasthttp.Request) error {
-			req.Header.SetHost(requestURL.Host)
+			resetStringSliceMap(reqData.Headers, reuseHeaderSlices)
+			resetStringSliceMap(reqData.Params, reuseParamSlices)
+			resetStringSliceMap(reqData.Cookies, reuseCookieSlices)
+			reqData.Method = ""
+			reqData.Path = ""
+			reqData.Body = ""

 			data, err = valuesGenerator()
 			if err != nil {
@@ -69,87 +113,147 @@ func NewRequestGenerator(
 			if err != nil {
 				return err
 			}
-			req.SetRequestURI(path)
+			reqData.Path = path

-			if err = methodGenerator(req, data); err != nil {
+			if err = methodGenerator(reqData, data); err != nil {
 				return err
 			}

-			bodyTemplateFuncMapData.ClearFormDataContenType()
-			if err = bodyGenerator(req, data); err != nil {
+			bodyTemplateFuncMapData.ClearFormDataContentType()
+			if err = bodyGenerator(reqData, data); err != nil {
 				return err
 			}

-			if err = headersGenerator(req, data); err != nil {
+			if err = headersGenerator(reqData, data); err != nil {
 				return err
 			}
-			if bodyTemplateFuncMapData.GetFormDataContenType() != "" {
-				req.Header.Add("Content-Type", bodyTemplateFuncMapData.GetFormDataContenType())
+			if bodyTemplateFuncMapData.GetFormDataContentType() != "" {
+				reqData.Headers["Content-Type"] = append(reqData.Headers["Content-Type"], bodyTemplateFuncMapData.GetFormDataContentType())
 			}

-			if err = paramsGenerator(req, data); err != nil {
+			if err = paramsGenerator(reqData, data); err != nil {
 				return err
 			}
-			if err = cookiesGenerator(req, data); err != nil {
+			if err = cookiesGenerator(reqData, data); err != nil {
 				return err
 			}

-			if requestURL.Scheme == "https" {
-				req.URI().SetScheme("https")
+			if hasScripts {
+				if err = scriptTransformer.Transform(reqData); err != nil {
+					return err
+				}
 			}
+
+			applyRequestDataToFastHTTP(reqData, req, host, scheme)
+
 			return nil
 		}, isPathGeneratorDynamic ||
 			isMethodGeneratorDynamic ||
 			isParamsGeneratorDynamic ||
 			isHeadersGeneratorDynamic ||
 			isCookiesGeneratorDynamic ||
-			isBodyGeneratorDynamic
+			isBodyGeneratorDynamic ||
+			hasScripts
 }

-func NewMethodGeneratorFunc(localRand *rand.Rand, methods []string, templateFunctions template.FuncMap) (RequestGeneratorWithData, bool) {
-	methodGenerator, isDynamic := buildStringSliceGenerator(localRand, methods, templateFunctions)
+// resetStringSliceMap empties m for the next render. With reuse it truncates the
+// value slices in place so the following appends land in the existing backing
+// arrays, without it the map is cleared so no stale key can survive.
+func resetStringSliceMap(m map[string][]string, reuse bool) {
+	if !reuse {
+		clear(m)
+		return
+	}
+	for k, v := range m {
+		m[k] = v[:0]
+	}
+}
+
+func applyRequestDataToFastHTTP(reqData *script.RequestData, req *fasthttp.Request, host, scheme string) {
+	req.Header.SetHost(host)
+	req.SetRequestURI(reqData.Path)
+	req.Header.SetMethod(reqData.Method)
+	req.SetBodyString(reqData.Body)
+
+	for k, values := range reqData.Headers {
+		for _, v := range values {
+			req.Header.Add(k, v)
+		}
+	}
+
+	if len(reqData.Params) > 0 {
+		args := req.URI().QueryArgs()
+		for k, values := range reqData.Params {
+			for _, v := range values {
+				args.Add(k, v)
+			}
+		}
+	}
+
+	if len(reqData.Cookies) > 0 {
+		var sb strings.Builder
+		for k, values := range reqData.Cookies {
+			for _, v := range values {
+				if sb.Len() > 0 {
+					sb.WriteString("; ")
+				}
+				sb.WriteString(k)
+				sb.WriteByte('=')
+				sb.WriteString(v)
+			}
+		}
+		req.Header.Add("Cookie", sb.String())
+	}
+
+	if scheme == "https" {
+		req.URI().SetScheme("https")
+	}
+}
+
+func NewMethodGeneratorFunc(localRand *rand.Rand, methods []string, lazyRoot func() *template.Template) (requestDataGenerator, bool) {
+	methodGenerator, isDynamic := buildStringSliceGenerator(localRand, methods, lazyRoot)

 	var (
 		method string
 		err    error
 	)
-	return func(req *fasthttp.Request, data any) error {
+	return func(reqData *script.RequestData, data any) error {
 		method, err = methodGenerator()(data)
 		if err != nil {
 			return err
 		}

-		req.Header.SetMethod(method)
+		reqData.Method = method
 		return nil
 	}, isDynamic
 }

-func NewBodyGeneratorFunc(localRand *rand.Rand, bodies []string, templateFunctions template.FuncMap) (RequestGeneratorWithData, bool) {
-	bodyGenerator, isDynamic := buildStringSliceGenerator(localRand, bodies, templateFunctions)
+func NewBodyGeneratorFunc(localRand *rand.Rand, bodies []string, lazyRoot func() *template.Template) (requestDataGenerator, bool) {
+	bodyGenerator, isDynamic := buildStringSliceGenerator(localRand, bodies, lazyRoot)

 	var (
 		body string
 		err  error
 	)
-	return func(req *fasthttp.Request, data any) error {
+	return func(reqData *script.RequestData, data any) error {
 		body, err = bodyGenerator()(data)
 		if err != nil {
 			return err
 		}

-		req.SetBody([]byte(body))
+		reqData.Body = body
 		return nil
 	}, isDynamic
 }

-func NewParamsGeneratorFunc(localRand *rand.Rand, params types.Params, templateFunctions template.FuncMap) (RequestGeneratorWithData, bool) {
-	generators, isDynamic := buildKeyValueGenerators(localRand, params, templateFunctions)
+func NewParamsGeneratorFunc(localRand *rand.Rand, params types.Params, lazyRoot func() *template.Template) (requestDataGenerator, bool, bool) {
+	generators, isDynamic, keysAreStatic := buildKeyValueGenerators(localRand, params, lazyRoot)

 	var (
 		key, value string
 		err        error
 	)
-	return func(req *fasthttp.Request, data any) error {
+	return func(reqData *script.RequestData, data any) error {
 		for _, gen := range generators {
 			key, err = gen.Key(data)
 			if err != nil {
@@ -161,20 +265,20 @@ func NewParamsGeneratorFunc(localRand *rand.Rand, params types.Params, templateF
 				return err
 			}

-			req.URI().QueryArgs().Add(key, value)
+			reqData.Params[key] = append(reqData.Params[key], value)
 		}
 		return nil
-	}, isDynamic
+	}, isDynamic, keysAreStatic
 }

-func NewHeadersGeneratorFunc(localRand *rand.Rand, headers types.Headers, templateFunctions template.FuncMap) (RequestGeneratorWithData, bool) {
-	generators, isDynamic := buildKeyValueGenerators(localRand, headers, templateFunctions)
+func NewHeadersGeneratorFunc(localRand *rand.Rand, headers types.Headers, lazyRoot func() *template.Template) (requestDataGenerator, bool, bool) {
+	generators, isDynamic, keysAreStatic := buildKeyValueGenerators(localRand, headers, lazyRoot)

 	var (
 		key, value string
 		err        error
 	)
-	return func(req *fasthttp.Request, data any) error {
+	return func(reqData *script.RequestData, data any) error {
 		for _, gen := range generators {
 			key, err = gen.Key(data)
 			if err != nil {
@@ -186,50 +290,54 @@ func NewHeadersGeneratorFunc(localRand *rand.Rand, headers types.Headers, templa
 				return err
 			}

-			req.Header.Add(key, value)
+			reqData.Headers[key] = append(reqData.Headers[key], value)
 		}
 		return nil
-	}, isDynamic
+	}, isDynamic, keysAreStatic
 }

-func NewCookiesGeneratorFunc(localRand *rand.Rand, cookies types.Cookies, templateFunctions template.FuncMap) (RequestGeneratorWithData, bool) {
-	generators, isDynamic := buildKeyValueGenerators(localRand, cookies, templateFunctions)
+func NewCookiesGeneratorFunc(localRand *rand.Rand, cookies types.Cookies, lazyRoot func() *template.Template) (requestDataGenerator, bool, bool) {
+	generators, isDynamic, keysAreStatic := buildKeyValueGenerators(localRand, cookies, lazyRoot)

 	var (
 		key, value string
 		err        error
 	)
-	if len(generators) > 0 {
-		return func(req *fasthttp.Request, data any) error {
-			cookieStrings := make([]string, 0, len(generators))
-			for _, gen := range generators {
-				key, err = gen.Key(data)
-				if err != nil {
-					return err
-				}
-
-				value, err = gen.Value()(data)
-				if err != nil {
-					return err
-				}
-
-				cookieStrings = append(cookieStrings, key+"="+value)
+	return func(reqData *script.RequestData, data any) error {
+		for _, gen := range generators {
+			key, err = gen.Key(data)
+			if err != nil {
+				return err
 			}
-			req.Header.Add("Cookie", strings.Join(cookieStrings, "; "))
-			return nil
-		}, isDynamic
+
+			value, err = gen.Value()(data)
+			if err != nil {
+				return err
+			}
+
+			reqData.Cookies[key] = append(reqData.Cookies[key], value)
+		}
+		return nil
+	}, isDynamic, keysAreStatic
+}
+
+func NewValuesGeneratorFunc(values []string, lazyRoot func() *template.Template) func() (valuesData, error) {
+	// No values configured: hand back one shared empty map instead of allocating a
+	// fresh one for every request. Nothing ever writes to it.
+	if len(values) == 0 {
+		empty := valuesData{Values: map[string]string{}}
+		return func() (valuesData, error) { return empty, nil }
 	}

-	return func(req *fasthttp.Request, data any) error {
-		return nil
-	}, isDynamic
-}
-
-func NewValuesGeneratorFunc(values []string, templateFunctions template.FuncMap) func() (valuesData, error) {
 	generators := make([]func(_ any) (string, error), len(values))

+	isDynamic := false
 	for i, v := range values {
-		generators[i], _ = createTemplateFunc(v, templateFunctions)
+		var valueIsDynamic bool
+		generators[i], valueIsDynamic = createTemplateFunc(v, lazyRoot)
+		if valueIsDynamic {
+			isDynamic = true
+		}
 	}

 	var (
@@ -237,17 +345,17 @@ func NewValuesGeneratorFunc(values []string, templateFunctions template.FuncMap)
 		data     map[string]string
 		err      error
 	)
-	return func() (valuesData, error) {
+	generate := func() (valuesData, error) {
 		result := make(map[string]string)
 		for _, generator := range generators {
 			rendered, err = generator(nil)
 			if err != nil {
-				return valuesData{}, fmt.Errorf("values rendering: %w", err)
+				return valuesData{}, types.NewTemplateRenderError(err)
 			}

 			data, err = godotenv.Unmarshal(rendered)
 			if err != nil {
-				return valuesData{}, fmt.Errorf("values rendering: %w", err)
+				return valuesData{}, types.NewTemplateRenderError(err)
 			}

 			maps.Copy(result, data)
@@ -255,20 +363,37 @@ func NewValuesGeneratorFunc(values []string, templateFunctions template.FuncMap)

 		return valuesData{Values: result}, nil
 	}
+
+	// Every value is a literal, so the parsed result is identical on every request:
+	// render and parse once instead of re-running godotenv per request.
+	if !isDynamic {
+		staticResult, staticErr := generate()
+		return func() (valuesData, error) { return staticResult, staticErr }
+	}
+
+	return generate
 }

-func createTemplateFunc(value string, templateFunctions template.FuncMap) (func(data any) (string, error), bool) {
-	tmpl, err := template.New("").Funcs(templateFunctions).Parse(value)
+func createTemplateFunc(value string, lazyRoot func() *template.Template) (func(data any) (string, error), bool) {
+	if !strings.Contains(value, "{{") {
+		return func(_ any) (string, error) { return value, nil }, false
+	}
+
+	tmpl, err := lazyRoot().New("").Parse(value)
 	if err == nil && hasTemplateActions(tmpl) {
-		var err error
+		var (
+			buf bytes.Buffer
+			err error
+		)
 		return func(data any) (string, error) {
-			var buf bytes.Buffer
+			buf.Reset()
 			if err = tmpl.Execute(&buf, data); err != nil {
-				return "", fmt.Errorf("template rendering: %w", err)
+				return "", types.NewTemplateRenderError(err)
 			}
 			return buf.String(), nil
 		}, true
 	}
+
 	return func(_ any) (string, error) { return value, nil }, false
 }

@@ -284,9 +409,10 @@ type keyValueItem interface {
 func buildKeyValueGenerators[T keyValueItem](
 	localRand *rand.Rand,
 	items []T,
-	templateFunctions template.FuncMap,
-) ([]keyValueGenerator, bool) {
+	lazyRoot func() *template.Template,
+) ([]keyValueGenerator, bool, bool) {
 	isDynamic := false
+	keysAreStatic := true
 	generators := make([]keyValueGenerator, len(items))

 	for generatorIndex, item := range items {
@@ -294,15 +420,16 @@ func buildKeyValueGenerators[T keyValueItem](
 		keyValue := types.KeyValue[string, []string](item)

 		// Generate key function
-		keyFunc, keyIsDynamic := createTemplateFunc(keyValue.Key, templateFunctions)
+		keyFunc, keyIsDynamic := createTemplateFunc(keyValue.Key, lazyRoot)
 		if keyIsDynamic {
 			isDynamic = true
+			keysAreStatic = false
 		}

 		// Generate value functions
 		valueFuncs := make([]func(data any) (string, error), len(keyValue.Value))
 		for j, v := range keyValue.Value {
-			valueFunc, valueIsDynamic := createTemplateFunc(v, templateFunctions)
+			valueFunc, valueIsDynamic := createTemplateFunc(v, lazyRoot)
 			if valueIsDynamic {
 				isDynamic = true
 			}
@@ -319,13 +446,13 @@ func buildKeyValueGenerators[T keyValueItem](
 		}
 	}

-	return generators, isDynamic
+	return generators, isDynamic, keysAreStatic
 }

 func buildStringSliceGenerator(
 	localRand *rand.Rand,
 	values []string,
-	templateFunctions template.FuncMap,
+	lazyRoot func() *template.Template,
 ) (func() func(data any) (string, error), bool) {
 	// Return a function that returns an empty string generator if values is empty
 	if len(values) == 0 {
@@ -337,7 +464,7 @@ func buildStringSliceGenerator(
 	valueFuncs := make([]func(data any) (string, error), len(values))

 	for i, value := range values {
-		valueFunc, valueIsDynamic := createTemplateFunc(value, templateFunctions)
+		valueFunc, valueIsDynamic := createTemplateFunc(value, lazyRoot)
 		if valueIsDynamic {
 			isDynamic = true
 		}
@@ -2,7 +2,6 @@ package sarin

 import (
 	"encoding/json"
-	"fmt"
 	"math/big"
 	"os"
 	"slices"
@@ -10,8 +9,8 @@ import (
 	"sync"
 	"time"

-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/lipgloss/table"
+	"charm.land/lipgloss/v2"
+	"charm.land/lipgloss/v2/table"
 	"go.yaml.in/yaml/v4"
 )

@@ -159,7 +158,7 @@ func (data *SarinResponseData) PrintTable() {
 			return cellStyle
 		})

-	fmt.Println(tbl)
+	lipgloss.Println(tbl)
 }

 func (data *SarinResponseData) PrintJSON() {
@@ -0,0 +1,497 @@
+package sarin
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/charmbracelet/x/term"
+	"github.com/valyala/fasthttp"
+	"go.aykhans.me/sarin/internal/script"
+	"go.aykhans.me/sarin/internal/types"
+)
+
+type runtimeLogLevel uint8
+
+const (
+	runtimeLogLevelInfo runtimeLogLevel = iota
+	runtimeLogLevelError
+)
+
+type runtimeLog struct {
+	timestamp time.Time
+	level     runtimeLogLevel
+	text      string
+}
+
+type runtimeLogger func(level runtimeLogLevel, text string)
+
+// SplitLogLevels parses a comma-separated log-level string into a deduplicated
+// slice of level tokens (surrounding whitespace trimmed, empties dropped). Level
+// names are matched case-sensitively, like the other enum options.
+func SplitLogLevels(levels string) []string {
+	var out []string
+	seen := make(map[string]bool)
+	for part := range strings.SplitSeq(levels, ",") {
+		token := strings.TrimSpace(part)
+		if token == "" || seen[token] {
+			continue
+		}
+		seen[token] = true
+		out = append(out, token)
+	}
+	return out
+}
+
+// IsInteractiveTerminal reports whether fd is a terminal that can actually be
+// drawn on. A pty reports as a terminal even while its size is still zero, and
+// Bubble Tea paints into a width x height cell buffer, so a zero dimension
+// renders nothing at all.
+func IsInteractiveTerminal(fd uintptr) bool {
+	if !term.IsTerminal(fd) {
+		return false
+	}
+	width, height, err := term.GetSize(fd)
+	return err == nil && width > 0 && height > 0
+}
+
+// respLogger logs a single completed response.
+type respLogger func(duration time.Duration, resp *fasthttp.Response)
+
+func noopLog(runtimeLogLevel, string)               {}
+func noopRespLog(time.Duration, *fasthttp.Response) {}
+
+// gateSendLog wraps emit with level filtering decided once from the enabled
+// levels. It stays general (any level filters correctly) while avoiding a
+// per-log check when both levels are on and any work at all when both are off.
+func gateSendLog(logInfo, logError bool, emit func(level runtimeLogLevel, text string)) runtimeLogger {
+	switch {
+	case logInfo && logError:
+		return emit
+	case logInfo:
+		return func(level runtimeLogLevel, text string) {
+			if level == runtimeLogLevelInfo {
+				emit(level, text)
+			}
+		}
+	case logError:
+		return func(level runtimeLogLevel, text string) {
+			if level == runtimeLogLevelError {
+				emit(level, text)
+			}
+		}
+	default:
+		return noopLog
+	}
+}
+
+// respBodySnippetLen bounds how many bytes of the body the compact (TUI)
+// rendering shows.
+const respBodySnippetLen = 100
+
+// formatRuntimeLogLine renders a runtime log as a plain (unstyled) line for
+// stderr output. ANSI styling is left to the TUI.
+func formatRuntimeLogLine(timestamp time.Time, level runtimeLogLevel, text string) string {
+	levelStr := "ERROR"
+	if level == runtimeLogLevelInfo {
+		levelStr = "INFO"
+	}
+	return "[" + timestamp.Format("15:04:05") + "] " + levelStr + ": " + text
+}
+
+// respToLog renders a response as a compact one-line summary for the TUI log box
+// (the "[time] INFO:" prefix is added by the TUI).
+func respToLog(duration time.Duration, resp *fasthttp.Response) string {
+	var sb strings.Builder
+	sb.WriteString(statusCodeToString(resp.StatusCode()))
+	sb.WriteString(" ")
+	sb.WriteString(Duration(duration).String())
+	if snippet := bodySnippet(resp.Body(), respBodySnippetLen); snippet != "" {
+		sb.WriteString(" | ")
+		sb.WriteString(snippet)
+	}
+	return sb.String()
+}
+
+type respLogEntry struct {
+	Status   int                 `json:"status"`
+	Duration string              `json:"duration"`
+	Headers  map[string][]string `json:"headers,omitempty"`
+	Body     string              `json:"body,omitempty"`
+}
+
+// respToLogJSON renders a response as a single, self-contained JSON line so the
+// stderr stream stays valid NDJSON (pipeable to jq or any consumer).
+func respToLogJSON(duration time.Duration, resp *fasthttp.Response) string {
+	entry := respLogEntry{
+		Status:   resp.StatusCode(),
+		Duration: Duration(duration).String(),
+		Headers:  collectRespHeaders(resp),
+		Body:     string(resp.Body()),
+	}
+	data, err := json.Marshal(entry)
+	if err != nil {
+		return `{"error":"failed to marshal response log"}`
+	}
+	return string(data)
+}
+
+func collectRespHeaders(resp *fasthttp.Response) map[string][]string {
+	headers := make(map[string][]string)
+	for key, value := range resp.Header.All() {
+		k := string(key)
+		headers[k] = append(headers[k], string(value))
+	}
+	return headers
+}
+
+// bodySnippet returns the first maxLen bytes of body collapsed onto a single
+// line (control characters replaced with spaces), with an ellipsis when truncated.
+func bodySnippet(body []byte, maxLen int) string {
+	if len(body) == 0 {
+		return ""
+	}
+
+	truncated := false
+	if len(body) > maxLen {
+		body = body[:maxLen]
+		truncated = true
+	}
+
+	s := strings.Map(func(r rune) rune {
+		if r == '\n' || r == '\r' || r == '\t' {
+			return ' '
+		}
+		return r
+	}, string(body))
+
+	if truncated {
+		s += "..."
+	}
+	return s
+}
+
+type sarin struct {
+	workers        uint
+	requestURL     *url.URL
+	methods        []string
+	params         types.Params
+	headers        types.Headers
+	cookies        types.Cookies
+	bodies         []string
+	totalRequests  *uint64
+	totalDuration  *time.Duration
+	timeout        time.Duration
+	showProgress   bool
+	skipCertVerify bool
+	values         []string
+	collectStats   bool
+	dryRun         bool
+	logInfo        bool
+	logError       bool
+	logFile        string
+
+	hostClients []*fasthttp.HostClient
+	responses   *SarinResponseData
+	fileCache   *FileCache
+	scriptChain *script.Chain
+}
+
+// NewSarin creates a new sarin instance for load testing.
+// It can return the following errors:
+//   - types.ProxyDialError
+//   - types.ErrScriptEmpty
+//   - types.ScriptLoadError
+func NewSarin(
+	ctx context.Context,
+	methods []string,
+	requestURL *url.URL,
+	timeout time.Duration,
+	workers uint,
+	totalRequests *uint64,
+	totalDuration *time.Duration,
+	showProgress bool,
+	skipCertVerify bool,
+	params types.Params,
+	headers types.Headers,
+	cookies types.Cookies,
+	bodies []string,
+	proxies types.Proxies,
+	values []string,
+	collectStats bool,
+	dryRun bool,
+	logLevel string,
+	logFile string,
+	luaScripts []string,
+	jsScripts []string,
+) (*sarin, error) {
+	if workers == 0 {
+		workers = 1
+	}
+
+	// Resolve which log levels are enabled once, up front.
+	var logInfo, logError bool
+	for _, level := range SplitLogLevels(logLevel) {
+		switch level {
+		case "info":
+			logInfo = true
+		case "error":
+			logError = true
+		}
+	}
+
+	hostClients, err := newHostClients(ctx, timeout, proxies, workers, requestURL, skipCertVerify)
+	if err != nil {
+		return nil, err
+	}
+
+	// Load script sources
+	luaSources, err := script.LoadSources(ctx, luaScripts, script.EngineTypeLua)
+	if err != nil {
+		return nil, err
+	}
+
+	jsSources, err := script.LoadSources(ctx, jsScripts, script.EngineTypeJavaScript)
+	if err != nil {
+		return nil, err
+	}
+
+	scriptChain := script.NewChain(luaSources, jsSources)
+
+	srn := &sarin{
+		workers:        workers,
+		requestURL:     requestURL,
+		methods:        methods,
+		params:         params,
+		headers:        headers,
+		cookies:        cookies,
+		bodies:         bodies,
+		totalRequests:  totalRequests,
+		totalDuration:  totalDuration,
+		timeout:        timeout,
+		showProgress:   showProgress,
+		skipCertVerify: skipCertVerify,
+		values:         values,
+		collectStats:   collectStats,
+		dryRun:         dryRun,
+		logInfo:        logInfo,
+		logError:       logError,
+		logFile:        logFile,
+		hostClients:    hostClients,
+		fileCache:      NewFileCache(time.Second * 10),
+		scriptChain:    scriptChain,
+	}
+
+	if collectStats {
+		srn.responses = NewSarinResponseData(uint32(100))
+	}
+
+	return srn, nil
+}
+
+func (s sarin) GetResponses() *SarinResponseData {
+	return s.responses
+}
+
+func (s sarin) Start(ctx context.Context, stopCtrl *StopController) {
+	jobsCtx, jobsCancel := context.WithCancel(ctx)
+
+	var workersWG sync.WaitGroup
+	jobsCh := make(chan struct{}, max(s.workers, 1))
+
+	var counter atomic.Uint64
+
+	totalRequests := uint64(0)
+	if s.totalRequests != nil {
+		totalRequests = *s.totalRequests
+	}
+
+	onTerminal := IsInteractiveTerminal(os.Stdout.Fd())
+	// The progress bar needs an interactive terminal to render.
+	showProgressBar := s.showProgress && onTerminal
+	// The bubbletea TUI hosts the bar and/or the live log box, so it runs whenever
+	// either has something to show: the bar, or logs that would land in the box
+	// (i.e. logs are enabled and not redirected to a file).
+	runTUI := showProgressBar || (onTerminal && (s.logInfo || s.logError) && s.logFile == "")
+
+	// Open the log file up front, before registering any defer, so a bad path
+	// exits cleanly.
+	var logFile *os.File
+	if s.logFile != "" {
+		f, err := os.OpenFile(s.logFile, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "failed to open log file "+s.logFile+": "+err.Error())
+			os.Exit(1)
+		}
+		defer f.Close() //nolint:errcheck
+		logFile = f
+	}
+
+	var (
+		streamCtx     context.Context
+		streamCancel  context.CancelFunc
+		streamCh      chan struct{}
+		tuiLogChannel chan runtimeLog
+	)
+	if runTUI {
+		streamCtx, streamCancel = context.WithCancel(context.Background())
+		defer streamCancel()
+		streamCh = make(chan struct{})
+		tuiLogChannel = make(chan runtimeLog, max(s.workers, 1))
+	}
+
+	// Route logs: to the file if given, else to the TUI log box while it runs,
+	// otherwise to stderr.
+	var (
+		sendLog     runtimeLogger
+		sendRespLog respLogger
+	)
+	switch {
+	case logFile != nil:
+		sendLog, sendRespLog = s.newWriterLog(logFile)
+	case runTUI:
+		sendLog, sendRespLog = s.newChannelLog(tuiLogChannel)
+	default:
+		sendLog, sendRespLog = s.newWriterLog(os.Stderr)
+	}
+
+	// Start workers
+	s.startWorkers(&workersWG, jobsCh, s.hostClients, &counter, sendLog, sendRespLog)
+
+	if runTUI {
+		//nolint:contextcheck // streamCtx must remain active until all workers complete to ensure all collected data is streamed
+		go s.streamProgress(streamCtx, stopCtrl, streamCh, totalRequests, &counter, tuiLogChannel, showProgressBar)
+	}
+
+	// Setup duration-based cancellation
+	s.setupDurationTimeout(ctx, jobsCancel)
+	// Distribute jobs to workers.
+	// This blocks until all jobs are sent or the context is canceled.
+	s.sendJobs(jobsCtx, jobsCh)
+
+	// Close the jobs channel so workers stop after completing their current job
+	close(jobsCh)
+	// Wait until all workers stopped
+	workersWG.Wait()
+	if tuiLogChannel != nil {
+		close(tuiLogChannel)
+	}
+
+	if runTUI {
+		// Stop the progress streaming
+		streamCancel()
+		// Wait until progress streaming has completely stopped
+		<-streamCh
+	}
+}
+
+// newWriterLog builds the loggers that write formatted lines to w (a log file or
+// stderr). sendLog stays general (it filters by each log's level); sendRespLog
+// only ever emits info, so its decision is baked once into a no-op when off.
+func (s sarin) newWriterLog(w io.Writer) (runtimeLogger, respLogger) {
+	// log.Logger serializes writes with its own mutex, so concurrent workers
+	// won't interleave lines.
+	logger := log.New(w, "", 0)
+
+	sendLog := gateSendLog(s.logInfo, s.logError, func(level runtimeLogLevel, text string) {
+		logger.Println(formatRuntimeLogLine(time.Now(), level, text))
+	})
+
+	var sendRespLog respLogger = noopRespLog
+	if s.logInfo {
+		sendRespLog = func(duration time.Duration, resp *fasthttp.Response) {
+			logger.Println(formatRuntimeLogLine(time.Now(), runtimeLogLevelInfo, respToLogJSON(duration, resp)))
+		}
+	}
+
+	return sendLog, sendRespLog
+}
+
+// newChannelLog builds the loggers that feed the TUI log box through ch, with the
+// same gating as newWriterLog.
+func (s sarin) newChannelLog(ch chan<- runtimeLog) (runtimeLogger, respLogger) {
+	sendLog := gateSendLog(s.logInfo, s.logError, func(level runtimeLogLevel, text string) {
+		ch <- runtimeLog{timestamp: time.Now(), level: level, text: text}
+	})
+
+	var sendRespLog respLogger = noopRespLog
+	if s.logInfo {
+		sendRespLog = func(duration time.Duration, resp *fasthttp.Response) {
+			ch <- runtimeLog{timestamp: time.Now(), level: runtimeLogLevelInfo, text: respToLog(duration, resp)}
+		}
+	}
+
+	return sendLog, sendRespLog
+}
+
+// newHostClients initializes HTTP clients for the given configuration.
+// It can return the following errors:
+// - types.ProxyDialError
+func newHostClients(
+	ctx context.Context,
+	timeout time.Duration,
+	proxies types.Proxies,
+	workers uint,
+	requestURL *url.URL,
+	skipCertVerify bool,
+) ([]*fasthttp.HostClient, error) {
+	proxiesRaw := make([]url.URL, len(proxies))
+	for i, proxy := range proxies {
+		proxiesRaw[i] = url.URL(proxy)
+	}
+
+	return NewHostClients(
+		ctx,
+		timeout,
+		proxiesRaw,
+		workers,
+		requestURL,
+		skipCertVerify,
+	)
+}
+
+func (s sarin) startWorkers(wg *sync.WaitGroup, jobs <-chan struct{}, hostClients []*fasthttp.HostClient, counter *atomic.Uint64, sendLog runtimeLogger, sendRespLog respLogger) {
+	for range max(s.workers, 1) {
+		wg.Go(func() {
+			s.Worker(jobs, NewHostClientGenerator(hostClients...), counter, sendLog, sendRespLog)
+		})
+	}
+}
+
+func (s sarin) setupDurationTimeout(ctx context.Context, cancel context.CancelFunc) {
+	if s.totalDuration != nil {
+		go func() {
+			timer := time.NewTimer(*s.totalDuration)
+			defer timer.Stop()
+			select {
+			case <-timer.C:
+				cancel()
+			case <-ctx.Done():
+				// Context cancelled, cleanup
+			}
+		}()
+	}
+}
+
+func (s sarin) sendJobs(ctx context.Context, jobs chan<- struct{}) {
+	if s.totalRequests != nil && *s.totalRequests > 0 {
+		for range *s.totalRequests {
+			if ctx.Err() != nil {
+				break
+			}
+			jobs <- struct{}{}
+		}
+	} else {
+		for ctx.Err() == nil {
+			jobs <- struct{}{}
+		}
+	}
+}
@@ -1,776 +0,0 @@
-package sarin
-
-import (
-	"context"
-	"net/url"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/charmbracelet/bubbles/progress"
-	"github.com/charmbracelet/bubbles/spinner"
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/lipgloss"
-	"github.com/valyala/fasthttp"
-	"go.aykhans.me/sarin/internal/types"
-)
-
-type runtimeMessageLevel uint8
-
-const (
-	runtimeMessageLevelWarning runtimeMessageLevel = iota
-	runtimeMessageLevelError
-)
-
-type runtimeMessage struct {
-	timestamp time.Time
-	level     runtimeMessageLevel
-	text      string
-}
-
-type messageSender func(level runtimeMessageLevel, text string)
-
-type sarin struct {
-	workers        uint
-	requestURL     *url.URL
-	methods        []string
-	params         types.Params
-	headers        types.Headers
-	cookies        types.Cookies
-	bodies         []string
-	totalRequests  *uint64
-	totalDuration  *time.Duration
-	timeout        time.Duration
-	quiet          bool
-	skipCertVerify bool
-	values         []string
-	collectStats   bool
-	dryRun         bool
-
-	hostClients []*fasthttp.HostClient
-	responses   *SarinResponseData
-}
-
-// NewSarin creates a new sarin instance for load testing.
-// It can return the following errors:
-// - types.ProxyDialError
-func NewSarin(
-	ctx context.Context,
-	methods []string,
-	requestURL *url.URL,
-	timeout time.Duration,
-	workers uint,
-	totalRequests *uint64,
-	totalDuration *time.Duration,
-	quiet bool,
-	skipCertVerify bool,
-	params types.Params,
-	headers types.Headers,
-	cookies types.Cookies,
-	bodies []string,
-	proxies types.Proxies,
-	values []string,
-	collectStats bool,
-	dryRun bool,
-) (*sarin, error) {
-	if workers == 0 {
-		workers = 1
-	}
-
-	hostClients, err := newHostClients(ctx, timeout, proxies, workers, requestURL, skipCertVerify)
-	if err != nil {
-		return nil, err
-	}
-
-	srn := &sarin{
-		workers:        workers,
-		requestURL:     requestURL,
-		methods:        methods,
-		params:         params,
-		headers:        headers,
-		cookies:        cookies,
-		bodies:         bodies,
-		totalRequests:  totalRequests,
-		totalDuration:  totalDuration,
-		timeout:        timeout,
-		quiet:          quiet,
-		skipCertVerify: skipCertVerify,
-		values:         values,
-		collectStats:   collectStats,
-		dryRun:         dryRun,
-		hostClients:    hostClients,
-	}
-
-	if collectStats {
-		srn.responses = NewSarinResponseData(uint32(100))
-	}
-
-	return srn, nil
-}
-
-func (q sarin) GetResponses() *SarinResponseData {
-	return q.responses
-}
-
-func (q sarin) Start(ctx context.Context) {
-	jobsCtx, jobsCancel := context.WithCancel(ctx)
-
-	var workersWG sync.WaitGroup
-	jobsCh := make(chan struct{}, max(q.workers, 1))
-
-	var counter atomic.Uint64
-
-	totalRequests := uint64(0)
-	if q.totalRequests != nil {
-		totalRequests = *q.totalRequests
-	}
-
-	var streamCtx context.Context
-	var streamCancel context.CancelFunc
-	var streamCh chan struct{}
-	var messageChannel chan runtimeMessage
-	var sendMessage messageSender
-
-	if q.quiet {
-		sendMessage = func(level runtimeMessageLevel, text string) {}
-	} else {
-		streamCtx, streamCancel = context.WithCancel(context.Background())
-		defer streamCancel()
-		streamCh = make(chan struct{})
-		messageChannel = make(chan runtimeMessage, max(q.workers, 1))
-		sendMessage = func(level runtimeMessageLevel, text string) {
-			messageChannel <- runtimeMessage{
-				timestamp: time.Now(),
-				level:     level,
-				text:      text,
-			}
-		}
-	}
-
-	// Start workers
-	q.startWorkers(&workersWG, jobsCh, q.hostClients, &counter, sendMessage)
-
-	if !q.quiet {
-		// Start streaming to terminal
-		//nolint:contextcheck // streamCtx must remain active until all workers complete to ensure all collected data is streamed
-		go q.streamProgress(streamCtx, jobsCancel, streamCh, totalRequests, &counter, messageChannel)
-	}
-
-	// Setup duration-based cancellation
-	q.setupDurationTimeout(ctx, jobsCancel)
-	// Distribute jobs to workers.
-	// This blocks until all jobs are sent or the context is canceled.
-	q.sendJobs(jobsCtx, jobsCh)
-
-	// Close the jobs channel so workers stop after completing their current job
-	close(jobsCh)
-	// Wait until all workers stopped
-	workersWG.Wait()
-	if messageChannel != nil {
-		close(messageChannel)
-	}
-
-	if !q.quiet {
-		// Stop the progress streaming
-		streamCancel()
-		// Wait until progress streaming has completely stopped
-		<-streamCh
-	}
-}
-
-func (q sarin) Worker(
-	jobs <-chan struct{},
-	hostClientGenerator HostClientGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	req := fasthttp.AcquireRequest()
-	resp := fasthttp.AcquireResponse()
-	defer fasthttp.ReleaseRequest(req)
-	defer fasthttp.ReleaseResponse(resp)
-
-	requestGenerator, isDynamic := NewRequestGenerator(q.methods, q.requestURL, q.params, q.headers, q.cookies, q.bodies, q.values)
-
-	if q.dryRun {
-		switch {
-		case q.collectStats && isDynamic:
-			q.workerDryRunStatsWithDynamic(jobs, req, requestGenerator, counter, sendMessage)
-		case q.collectStats && !isDynamic:
-			q.workerDryRunStatsWithStatic(jobs, req, requestGenerator, counter, sendMessage)
-		case !q.collectStats && isDynamic:
-			q.workerDryRunNoStatsWithDynamic(jobs, req, requestGenerator, counter, sendMessage)
-		default:
-			q.workerDryRunNoStatsWithStatic(jobs, req, requestGenerator, counter, sendMessage)
-		}
-	} else {
-		switch {
-		case q.collectStats && isDynamic:
-			q.workerStatsWithDynamic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendMessage)
-		case q.collectStats && !isDynamic:
-			q.workerStatsWithStatic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendMessage)
-		case !q.collectStats && isDynamic:
-			q.workerNoStatsWithDynamic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendMessage)
-		default:
-			q.workerNoStatsWithStatic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendMessage)
-		}
-	}
-}
-
-func (q sarin) workerStatsWithDynamic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	resp *fasthttp.Response,
-	requestGenerator RequestGenerator,
-	hostClientGenerator HostClientGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	for range jobs {
-		req.Reset()
-		resp.Reset()
-
-		if err := requestGenerator(req); err != nil {
-			q.responses.Add(err.Error(), 0)
-			sendMessage(runtimeMessageLevelError, err.Error())
-			counter.Add(1)
-			continue
-		}
-
-		startTime := time.Now()
-		err := hostClientGenerator().DoTimeout(req, resp, q.timeout)
-		if err != nil {
-			q.responses.Add(err.Error(), time.Since(startTime))
-		} else {
-			q.responses.Add(statusCodeToString(resp.StatusCode()), time.Since(startTime))
-		}
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerStatsWithStatic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	resp *fasthttp.Response,
-	requestGenerator RequestGenerator,
-	hostClientGenerator HostClientGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	if err := requestGenerator(req); err != nil {
-		// Static request generation failed - record all jobs as errors
-		for range jobs {
-			q.responses.Add(err.Error(), 0)
-			sendMessage(runtimeMessageLevelError, err.Error())
-			counter.Add(1)
-		}
-		return
-	}
-
-	for range jobs {
-		resp.Reset()
-
-		startTime := time.Now()
-		err := hostClientGenerator().DoTimeout(req, resp, q.timeout)
-		if err != nil {
-			q.responses.Add(err.Error(), time.Since(startTime))
-		} else {
-			q.responses.Add(statusCodeToString(resp.StatusCode()), time.Since(startTime))
-		}
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerNoStatsWithDynamic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	resp *fasthttp.Response,
-	requestGenerator RequestGenerator,
-	hostClientGenerator HostClientGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	for range jobs {
-		req.Reset()
-		resp.Reset()
-		if err := requestGenerator(req); err != nil {
-			sendMessage(runtimeMessageLevelError, err.Error())
-			counter.Add(1)
-			continue
-		}
-		_ = hostClientGenerator().DoTimeout(req, resp, q.timeout)
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerNoStatsWithStatic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	resp *fasthttp.Response,
-	requestGenerator RequestGenerator,
-	hostClientGenerator HostClientGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	if err := requestGenerator(req); err != nil {
-		sendMessage(runtimeMessageLevelError, err.Error())
-
-		// Static request generation failed - just count the jobs without sending
-		for range jobs {
-			counter.Add(1)
-		}
-		return
-	}
-
-	for range jobs {
-		resp.Reset()
-		_ = hostClientGenerator().DoTimeout(req, resp, q.timeout)
-		counter.Add(1)
-	}
-}
-
-const dryRunResponseKey = "dry-run"
-
-// statusCodeStrings contains pre-computed string representations for HTTP status codes 100-599.
-var statusCodeStrings = func() map[int]string {
-	m := make(map[int]string, 500)
-	for i := 100; i < 600; i++ {
-		m[i] = strconv.Itoa(i)
-	}
-	return m
-}()
-
-// statusCodeToString returns a string representation of the HTTP status code.
-// Uses a pre-computed map for codes 100-599, falls back to strconv.Itoa for others.
-func statusCodeToString(code int) string {
-	if s, ok := statusCodeStrings[code]; ok {
-		return s
-	}
-	return strconv.Itoa(code)
-}
-
-func (q sarin) workerDryRunStatsWithDynamic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	requestGenerator RequestGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	for range jobs {
-		req.Reset()
-		startTime := time.Now()
-		if err := requestGenerator(req); err != nil {
-			q.responses.Add(err.Error(), time.Since(startTime))
-			sendMessage(runtimeMessageLevelError, err.Error())
-			counter.Add(1)
-			continue
-		}
-		q.responses.Add(dryRunResponseKey, time.Since(startTime))
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerDryRunStatsWithStatic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	requestGenerator RequestGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	if err := requestGenerator(req); err != nil {
-		// Static request generation failed - record all jobs as errors
-		for range jobs {
-			q.responses.Add(err.Error(), 0)
-			sendMessage(runtimeMessageLevelError, err.Error())
-			counter.Add(1)
-		}
-		return
-	}
-
-	for range jobs {
-		q.responses.Add(dryRunResponseKey, 0)
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerDryRunNoStatsWithDynamic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	requestGenerator RequestGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	for range jobs {
-		req.Reset()
-		if err := requestGenerator(req); err != nil {
-			sendMessage(runtimeMessageLevelError, err.Error())
-		}
-		counter.Add(1)
-	}
-}
-
-func (q sarin) workerDryRunNoStatsWithStatic(
-	jobs <-chan struct{},
-	req *fasthttp.Request,
-	requestGenerator RequestGenerator,
-	counter *atomic.Uint64,
-	sendMessage messageSender,
-) {
-	if err := requestGenerator(req); err != nil {
-		sendMessage(runtimeMessageLevelError, err.Error())
-	}
-
-	for range jobs {
-		counter.Add(1)
-	}
-}
-
-// newHostClients initializes HTTP clients for the given configuration.
-// It can return the following errors:
-// - types.ProxyDialError
-func newHostClients(
-	ctx context.Context,
-	timeout time.Duration,
-	proxies types.Proxies,
-	workers uint,
-	requestURL *url.URL,
-	skipCertVerify bool,
-) ([]*fasthttp.HostClient, error) {
-	proxiesRaw := make([]url.URL, len(proxies))
-	for i, proxy := range proxies {
-		proxiesRaw[i] = url.URL(proxy)
-	}
-
-	maxConns := max(fasthttp.DefaultMaxConnsPerHost, workers)
-	maxConns = ((maxConns * 50 / 100) + maxConns)
-	return NewHostClients(
-		ctx,
-		timeout,
-		proxiesRaw,
-		maxConns,
-		requestURL,
-		skipCertVerify,
-	)
-}
-
-func (q sarin) startWorkers(wg *sync.WaitGroup, jobs <-chan struct{}, hostClients []*fasthttp.HostClient, counter *atomic.Uint64, sendMessage messageSender) {
-	for range max(q.workers, 1) {
-		wg.Go(func() {
-			q.Worker(jobs, NewHostClientGenerator(hostClients...), counter, sendMessage)
-		})
-	}
-}
-
-func (q sarin) setupDurationTimeout(ctx context.Context, cancel context.CancelFunc) {
-	if q.totalDuration != nil {
-		go func() {
-			timer := time.NewTimer(*q.totalDuration)
-			defer timer.Stop()
-			select {
-			case <-timer.C:
-				cancel()
-			case <-ctx.Done():
-				// Context cancelled, cleanup
-			}
-		}()
-	}
-}
-
-func (q sarin) sendJobs(ctx context.Context, jobs chan<- struct{}) {
-	if q.totalRequests != nil && *q.totalRequests > 0 {
-		for range *q.totalRequests {
-			if ctx.Err() != nil {
-				break
-			}
-			jobs <- struct{}{}
-		}
-	} else {
-		for ctx.Err() == nil {
-			jobs <- struct{}{}
-		}
-	}
-}
-
-type tickMsg time.Time
-
-var (
-	helpStyle           = lipgloss.NewStyle().Foreground(lipgloss.Color("#d1d1d1"))
-	errorStyle          = lipgloss.NewStyle().Foreground(lipgloss.Color("#FC5B5B")).Bold(true)
-	warningStyle        = lipgloss.NewStyle().Foreground(lipgloss.Color("#FFD93D")).Bold(true)
-	messageChannelStyle = lipgloss.NewStyle().
-				Border(lipgloss.ThickBorder(), false, false, false, true).
-				BorderForeground(lipgloss.Color("#757575")).
-				PaddingLeft(1).
-				Margin(1, 0, 0, 0).
-				Foreground(lipgloss.Color("#888888"))
-)
-
-type progressModel struct {
-	progress   progress.Model
-	startTime  time.Time
-	messages   []string
-	counter    *atomic.Uint64
-	current    uint64
-	maxValue   uint64
-	ctx        context.Context //nolint:containedctx
-	cancel     context.CancelFunc
-	cancelling bool
-}
-
-func (m progressModel) Init() tea.Cmd {
-	return tea.Batch(progressTickCmd())
-}
-
-func (m progressModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	switch msg := msg.(type) {
-	case tea.KeyMsg:
-		if msg.Type == tea.KeyCtrlC {
-			m.cancelling = true
-			m.cancel()
-		}
-		return m, nil
-
-	case tea.WindowSizeMsg:
-		m.progress.Width = max(10, msg.Width-1)
-		if m.ctx.Err() != nil {
-			return m, tea.Quit
-		}
-		return m, nil
-
-	case runtimeMessage:
-		var msgBuilder strings.Builder
-		msgBuilder.WriteString("[")
-		msgBuilder.WriteString(msg.timestamp.Format("15:04:05"))
-		msgBuilder.WriteString("] ")
-		switch msg.level {
-		case runtimeMessageLevelError:
-			msgBuilder.WriteString(errorStyle.Render("ERROR: "))
-		case runtimeMessageLevelWarning:
-			msgBuilder.WriteString(warningStyle.Render("WARNING: "))
-		}
-		msgBuilder.WriteString(msg.text)
-		m.messages = append(m.messages[1:], msgBuilder.String())
-		if m.ctx.Err() != nil {
-			return m, tea.Quit
-		}
-		return m, nil
-
-	case tickMsg:
-		if m.ctx.Err() != nil {
-			return m, tea.Quit
-		}
-		return m, progressTickCmd()
-
-	default:
-		if m.ctx.Err() != nil {
-			return m, tea.Quit
-		}
-		return m, nil
-	}
-}
-
-func (m progressModel) View() string {
-	var messagesBuilder strings.Builder
-	for i, msg := range m.messages {
-		if len(msg) > 0 {
-			messagesBuilder.WriteString(msg)
-			if i < len(m.messages)-1 {
-				messagesBuilder.WriteString("\n")
-			}
-		}
-	}
-
-	var finalBuilder strings.Builder
-	if messagesBuilder.Len() > 0 {
-		finalBuilder.WriteString(messageChannelStyle.Render(messagesBuilder.String()))
-		finalBuilder.WriteString("\n")
-	}
-
-	m.current = m.counter.Load()
-	finalBuilder.WriteString("\n ")
-	finalBuilder.WriteString(strconv.FormatUint(m.current, 10))
-	finalBuilder.WriteString("/")
-	finalBuilder.WriteString(strconv.FormatUint(m.maxValue, 10))
-	finalBuilder.WriteString(" - ")
-	finalBuilder.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
-	finalBuilder.WriteString("\n ")
-	finalBuilder.WriteString(m.progress.ViewAs(float64(m.current) / float64(m.maxValue)))
-	finalBuilder.WriteString("\n\n  ")
-	if m.cancelling {
-		finalBuilder.WriteString(helpStyle.Render("Stopping..."))
-	} else {
-		finalBuilder.WriteString(helpStyle.Render("Press Ctrl+C to quit"))
-	}
-	return finalBuilder.String()
-}
-
-func progressTickCmd() tea.Cmd {
-	return tea.Tick(time.Millisecond*250, func(t time.Time) tea.Msg {
-		return tickMsg(t)
-	})
-}
-
-var infiniteProgressStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("#00D4FF"))
-
-type infiniteProgressModel struct {
-	spinner    spinner.Model
-	startTime  time.Time
-	counter    *atomic.Uint64
-	messages   []string
-	ctx        context.Context //nolint:containedctx
-	quit       bool
-	cancel     context.CancelFunc
-	cancelling bool
-}
-
-func (m infiniteProgressModel) Init() tea.Cmd {
-	return m.spinner.Tick
-}
-
-func (m infiniteProgressModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	switch msg := msg.(type) {
-	case tea.KeyMsg:
-		if msg.Type == tea.KeyCtrlC {
-			m.cancelling = true
-			m.cancel()
-		}
-		return m, nil
-
-	case runtimeMessage:
-		var msgBuilder strings.Builder
-		msgBuilder.WriteString("[")
-		msgBuilder.WriteString(msg.timestamp.Format("15:04:05"))
-		msgBuilder.WriteString("] ")
-		switch msg.level {
-		case runtimeMessageLevelError:
-			msgBuilder.WriteString(errorStyle.Render("ERROR: "))
-		case runtimeMessageLevelWarning:
-			msgBuilder.WriteString(warningStyle.Render("WARNING: "))
-		}
-		msgBuilder.WriteString(msg.text)
-		m.messages = append(m.messages[1:], msgBuilder.String())
-		if m.ctx.Err() != nil {
-			m.quit = true
-			return m, tea.Quit
-		}
-		return m, nil
-
-	default:
-		if m.ctx.Err() != nil {
-			m.quit = true
-			return m, tea.Quit
-		}
-		var cmd tea.Cmd
-		m.spinner, cmd = m.spinner.Update(msg)
-		return m, cmd
-	}
-}
-
-func (m infiniteProgressModel) View() string {
-	var messagesBuilder strings.Builder
-	for i, msg := range m.messages {
-		if len(msg) > 0 {
-			messagesBuilder.WriteString(msg)
-			if i < len(m.messages)-1 {
-				messagesBuilder.WriteString("\n")
-			}
-		}
-	}
-
-	var finalBuilder strings.Builder
-	if messagesBuilder.Len() > 0 {
-		finalBuilder.WriteString(messageChannelStyle.Render(messagesBuilder.String()))
-		finalBuilder.WriteString("\n")
-	}
-
-	if m.quit {
-		finalBuilder.WriteString("\n  ")
-		finalBuilder.WriteString(strconv.FormatUint(m.counter.Load(), 10))
-		finalBuilder.WriteString("  ")
-		finalBuilder.WriteString(infiniteProgressStyle.Render("∙∙∙∙∙"))
-		finalBuilder.WriteString("  ")
-		finalBuilder.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
-		finalBuilder.WriteString("\n\n")
-	} else {
-		finalBuilder.WriteString("\n  ")
-		finalBuilder.WriteString(strconv.FormatUint(m.counter.Load(), 10))
-		finalBuilder.WriteString("  ")
-		finalBuilder.WriteString(m.spinner.View())
-		finalBuilder.WriteString("  ")
-		finalBuilder.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
-		finalBuilder.WriteString("\n\n  ")
-		if m.cancelling {
-			finalBuilder.WriteString(helpStyle.Render("Stopping..."))
-		} else {
-			finalBuilder.WriteString(helpStyle.Render("Press Ctrl+C to quit"))
-		}
-	}
-	return finalBuilder.String()
-}
-
-func (q sarin) streamProgress(
-	ctx context.Context,
-	cancel context.CancelFunc,
-	done chan<- struct{},
-	total uint64,
-	counter *atomic.Uint64,
-	messageChannel <-chan runtimeMessage,
-) {
-	var program *tea.Program
-	if total > 0 {
-		model := progressModel{
-			progress:  progress.New(progress.WithGradient("#151594", "#00D4FF")),
-			startTime: time.Now(),
-			messages:  make([]string, 8),
-			counter:   counter,
-			current:   0,
-			maxValue:  total,
-			ctx:       ctx,
-			cancel:    cancel,
-		}
-
-		program = tea.NewProgram(model)
-	} else {
-		model := infiniteProgressModel{
-			spinner: spinner.New(
-				spinner.WithSpinner(
-					spinner.Spinner{
-						Frames: []string{
-							"●∙∙∙∙",
-							"∙●∙∙∙",
-							"∙∙●∙∙",
-							"∙∙∙●∙",
-							"∙∙∙∙●",
-							"∙∙∙●∙",
-							"∙∙●∙∙",
-							"∙●∙∙∙",
-						},
-						FPS: time.Second / 8, //nolint:mnd
-					},
-				),
-				spinner.WithStyle(infiniteProgressStyle),
-			),
-			startTime: time.Now(),
-			counter:   counter,
-			messages:  make([]string, 8),
-			ctx:       ctx,
-			cancel:    cancel,
-			quit:      false,
-		}
-
-		program = tea.NewProgram(model)
-	}
-
-	go func() {
-		for msg := range messageChannel {
-			program.Send(msg)
-		}
-	}()
-
-	if _, err := program.Run(); err != nil {
-		panic(err)
-	}
-
-	done <- struct{}{}
-}
@@ -0,0 +1,55 @@
+package sarin
+
+import (
+	"fmt"
+	"os"
+	"sync"
+	"sync/atomic"
+
+	tea "charm.land/bubbletea/v2"
+)
+
+const forceExitCode = 130
+
+// StopController coordinates a two-stage shutdown.
+//
+// The first Stop call cancels the supplied context so workers and the job
+// loop can drain. The second Stop call restores the terminal (if a bubbletea
+// program has been attached) and calls os.Exit(forceExitCode), bypassing any
+// in-flight captcha polls, Lua/JS scripts, or HTTP requests that would
+// otherwise keep the process alive.
+type StopController struct {
+	count   atomic.Int32
+	cancel  func()
+	mu      sync.Mutex
+	program *tea.Program
+}
+
+func NewStopController(cancel func()) *StopController {
+	return &StopController{cancel: cancel}
+}
+
+// AttachProgram registers the active bubbletea program so the terminal state
+// can be restored before os.Exit on the forced shutdown path. Pass nil to
+// detach once the program has finished.
+func (s *StopController) AttachProgram(program *tea.Program) {
+	s.mu.Lock()
+	s.program = program
+	s.mu.Unlock()
+}
+
+func (s *StopController) Stop() {
+	switch s.count.Add(1) {
+	case 1:
+		s.cancel()
+	case 2:
+		s.mu.Lock()
+		p := s.program
+		s.mu.Unlock()
+		if p != nil {
+			_ = p.ReleaseTerminal()
+		}
+		fmt.Fprintln(os.Stderr, "killing...")
+		os.Exit(forceExitCode)
+	}
+}
@@ -2,6 +2,12 @@ package sarin

 import (
 	"bytes"
+	"crypto/hmac"
+	"crypto/md5" // #nosec G501 -- exposed intentionally as a template utility helper
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
 	"math/rand/v2"
 	"mime/multipart"
 	"strings"
@@ -10,9 +16,10 @@ import (
 	"time"

 	"github.com/brianvoe/gofakeit/v7"
+	"go.aykhans.me/sarin/internal/types"
 )

-func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
+func NewDefaultTemplateFuncMap(randSource rand.Source, fileCache *FileCache) template.FuncMap {
 	fakeit := gofakeit.NewFaker(randSource, false)

 	return template.FuncMap{
@@ -60,10 +67,6 @@ func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
 		},
 		"strings_TrimPrefix": strings.TrimPrefix,
 		"strings_TrimSuffix": strings.TrimSuffix,
-		"strings_Join": func(sep string, values ...string) string {
-			return strings.Join(values, sep)
-		},
-
 		// Dict
 		"dict_Str": func(values ...string) map[string]string {
 			dict := make(map[string]string)
@@ -81,6 +84,94 @@ func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
 		"slice_Str":  func(values ...string) []string { return values },
 		"slice_Int":  func(values ...int) []int { return values },
 		"slice_Uint": func(values ...uint) []uint { return values },
+		"slice_Join": strings.Join,
+
+		// JSON
+		// json_Encode marshals any value to a JSON string.
+		// Usage: {{ json_Encode (dict_Str "key" "value") }}
+		"json_Encode": func(v any) (string, error) {
+			data, err := json.Marshal(v)
+			if err != nil {
+				return "", types.NewJSONEncodeError(err)
+			}
+			return string(data), nil
+		},
+		// json_Object builds a JSON object from interleaved key-value pairs and returns it
+		// as a JSON string. Keys must be strings; values may be any JSON-encodable type.
+		// Usage: {{ json_Object "name" "Alice" "age" 30 }}
+		"json_Object": func(pairs ...any) (string, error) {
+			if len(pairs)%2 != 0 {
+				return "", types.ErrJSONObjectOddArgs
+			}
+			obj := make(map[string]any, len(pairs)/2)
+			for i := 0; i < len(pairs); i += 2 {
+				key, ok := pairs[i].(string)
+				if !ok {
+					return "", types.NewJSONObjectKeyError(i, pairs[i])
+				}
+				obj[key] = pairs[i+1]
+			}
+			data, err := json.Marshal(obj)
+			if err != nil {
+				return "", types.NewJSONEncodeError(err)
+			}
+			return string(data), nil
+		},
+
+		// Time
+		"time_NowUnix":      func() int64 { return time.Now().Unix() },
+		"time_NowUnixMilli": func() int64 { return time.Now().UnixMilli() },
+		"time_NowRFC3339":   func() string { return time.Now().Format(time.RFC3339) },
+		"time_Format": func(layout string, t time.Time) string {
+			return t.Format(layout)
+		},
+
+		// Crypto
+		"crypto_SHA256": func(s string) string {
+			sum := sha256.Sum256([]byte(s))
+			return hex.EncodeToString(sum[:])
+		},
+		"crypto_MD5": func(s string) string {
+			sum := md5.Sum([]byte(s)) // #nosec G401 -- MD5 is intentionally provided as a non-security template helper
+			return hex.EncodeToString(sum[:])
+		},
+		"crypto_HMACSHA256": func(key string, msg string) string {
+			mac := hmac.New(sha256.New, []byte(key))
+			_, _ = mac.Write([]byte(msg))
+			return hex.EncodeToString(mac.Sum(nil))
+		},
+		"crypto_Base64URL": func(s string) string {
+			return base64.RawURLEncoding.EncodeToString([]byte(s))
+		},
+
+		// File
+		// file_Read reads a file (local or remote URL) and returns its content as a string.
+		// Usage: {{ file_Read "/path/to/file.txt" }}
+		//        {{ file_Read "https://example.com/data.txt" }}
+		"file_Read": func(source string) (string, error) {
+			if fileCache == nil {
+				return "", types.ErrFileCacheNotInitialized
+			}
+			cached, err := fileCache.GetOrLoad(source)
+			if err != nil {
+				return "", err
+			}
+			return string(cached.Content), nil
+		},
+
+		// file_Base64 reads a file (local or remote URL) and returns its Base64 encoded content.
+		// Usage: {{ file_Base64 "/path/to/file.pdf" }}
+		//        {{ file_Base64 "https://example.com/image.png" }}
+		"file_Base64": func(source string) (string, error) {
+			if fileCache == nil {
+				return "", types.ErrFileCacheNotInitialized
+			}
+			cached, err := fileCache.GetOrLoad(source)
+			if err != nil {
+				return "", err
+			}
+			return base64.StdEncoding.EncodeToString(cached.Content), nil
+		},

 		// Fakeit / File
 		// "fakeit_CSV": fakeit.CSV(nil),
@@ -228,7 +319,7 @@ func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
 		"fakeit_AdverbFrequencyDefinite":   fakeit.AdverbFrequencyDefinite,
 		"fakeit_AdverbFrequencyIndefinite": fakeit.AdverbFrequencyIndefinite,

-		// Propositions
+		// Prepositions
 		"fakeit_Preposition":         fakeit.Preposition,
 		"fakeit_PrepositionSimple":   fakeit.PrepositionSimple,
 		"fakeit_PrepositionDouble":   fakeit.PrepositionDouble,
@@ -516,8 +607,7 @@ func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
 		"fakeit_ErrorHTTP":       func() string { return fakeit.ErrorHTTP().Error() },
 		"fakeit_ErrorHTTPClient": func() string { return fakeit.ErrorHTTPClient().Error() },
 		"fakeit_ErrorHTTPServer": func() string { return fakeit.ErrorHTTPServer().Error() },
-		// "fakeit_ErrorInput": func() string { return fakeit.ErrorInput().Error() },
-		"fakeit_ErrorRuntime": func() string { return fakeit.ErrorRuntime().Error() },
+		"fakeit_ErrorRuntime":    func() string { return fakeit.ErrorRuntime().Error() },

 		// Fakeit / School
 		"fakeit_School": fakeit.School,
@@ -527,36 +617,139 @@ func NewDefaultTemplateFuncMap(randSource rand.Source) template.FuncMap {
 		"fakeit_SongName":   fakeit.SongName,
 		"fakeit_SongArtist": fakeit.SongArtist,
 		"fakeit_SongGenre":  fakeit.SongGenre,
+
+		// Captcha / 2Captcha
+		// Usage: {{ twocaptcha_RecaptchaV2 "API_KEY" "SITE_KEY" "https://example.com" }}
+		"twocaptcha_RecaptchaV2": func(apiKey, websiteKey, websiteURL string) (string, error) {
+			return twoCaptchaSolveRecaptchaV2(apiKey, websiteURL, websiteKey)
+		},
+		// Usage: {{ twocaptcha_RecaptchaV3 "API_KEY" "SITE_KEY" "https://example.com" "action" }}
+		"twocaptcha_RecaptchaV3": func(apiKey, websiteKey, websiteURL, pageAction string) (string, error) {
+			return twoCaptchaSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction)
+		},
+		// Usage: {{ twocaptcha_Turnstile "API_KEY" "SITE_KEY" "https://example.com" }}
+		//        {{ twocaptcha_Turnstile "API_KEY" "SITE_KEY" "https://example.com" "cdata" }}
+		"twocaptcha_Turnstile": func(apiKey, websiteKey, websiteURL string, cData ...string) (string, error) {
+			return twoCaptchaSolveTurnstile(apiKey, websiteURL, websiteKey, firstOrEmpty(cData))
+		},
+
+		// Captcha / Anti-Captcha
+		// Usage: {{ anticaptcha_RecaptchaV2 "API_KEY" "SITE_KEY" "https://example.com" }}
+		"anticaptcha_RecaptchaV2": func(apiKey, websiteKey, websiteURL string) (string, error) {
+			return antiCaptchaSolveRecaptchaV2(apiKey, websiteURL, websiteKey)
+		},
+		// Usage: {{ anticaptcha_RecaptchaV3 "API_KEY" "SITE_KEY" "https://example.com" "action" }}
+		"anticaptcha_RecaptchaV3": func(apiKey, websiteKey, websiteURL, pageAction string) (string, error) {
+			return antiCaptchaSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction)
+		},
+		// Usage: {{ anticaptcha_HCaptcha "API_KEY" "SITE_KEY" "https://example.com" }}
+		"anticaptcha_HCaptcha": func(apiKey, websiteKey, websiteURL string) (string, error) {
+			return antiCaptchaSolveHCaptcha(apiKey, websiteURL, websiteKey)
+		},
+		// Usage: {{ anticaptcha_Turnstile "API_KEY" "SITE_KEY" "https://example.com" }}
+		//        {{ anticaptcha_Turnstile "API_KEY" "SITE_KEY" "https://example.com" "cdata" }}
+		"anticaptcha_Turnstile": func(apiKey, websiteKey, websiteURL string, cData ...string) (string, error) {
+			return antiCaptchaSolveTurnstile(apiKey, websiteURL, websiteKey, firstOrEmpty(cData))
+		},
+
+		// Captcha / CapSolver
+		// Usage: {{ capsolver_RecaptchaV2 "API_KEY" "SITE_KEY" "https://example.com" }}
+		"capsolver_RecaptchaV2": func(apiKey, websiteKey, websiteURL string) (string, error) {
+			return capSolverSolveRecaptchaV2(apiKey, websiteURL, websiteKey)
+		},
+		// Usage: {{ capsolver_RecaptchaV3 "API_KEY" "SITE_KEY" "https://example.com" "action" }}
+		"capsolver_RecaptchaV3": func(apiKey, websiteKey, websiteURL, pageAction string) (string, error) {
+			return capSolverSolveRecaptchaV3(apiKey, websiteURL, websiteKey, pageAction)
+		},
+		// Usage: {{ capsolver_Turnstile "API_KEY" "SITE_KEY" "https://example.com" }}
+		//        {{ capsolver_Turnstile "API_KEY" "SITE_KEY" "https://example.com" "cdata" }}
+		"capsolver_Turnstile": func(apiKey, websiteKey, websiteURL string, cData ...string) (string, error) {
+			return capSolverSolveTurnstile(apiKey, websiteURL, websiteKey, firstOrEmpty(cData))
+		},
 	}
 }

 type BodyTemplateFuncMapData struct {
-	formDataContenType string
+	formDataContentType string
 }

-func (data BodyTemplateFuncMapData) GetFormDataContenType() string {
-	return data.formDataContenType
+func (data BodyTemplateFuncMapData) GetFormDataContentType() string {
+	return data.formDataContentType
 }

-func (data *BodyTemplateFuncMapData) ClearFormDataContenType() {
-	data.formDataContenType = ""
+func (data *BodyTemplateFuncMapData) ClearFormDataContentType() {
+	data.formDataContentType = ""
 }

-func NewDefaultBodyTemplateFuncMap(randSource rand.Source, data *BodyTemplateFuncMapData) template.FuncMap {
-	funcMap := NewDefaultTemplateFuncMap(randSource)
+func NewDefaultBodyTemplateFuncMap(
+	randSource rand.Source,
+	data *BodyTemplateFuncMapData,
+	fileCache *FileCache,
+) template.FuncMap {
+	funcMap := NewDefaultTemplateFuncMap(randSource, fileCache)

 	if data != nil {
-		funcMap["body_FormData"] = func(kv map[string]string) string {
-			var multipartData bytes.Buffer
-			writer := multipart.NewWriter(&multipartData)
-			data.formDataContenType = writer.FormDataContentType()
-
-			for k, v := range kv {
-				_ = writer.WriteField(k, v)
+		// body_FormData creates a multipart/form-data body from key-value pairs.
+		// Usage: {{ body_FormData "field1" "value1" "field2" "value2" ... }}
+		//
+		// Values starting with "@" are treated as file references:
+		//   - "@/path/to/file.txt" - local file
+		//   - "@http://example.com/file" - remote file via HTTP
+		//   - "@https://example.com/file" - remote file via HTTPS
+		//
+		// To send a literal string starting with "@", escape it with "@@":
+		//   - "@@literal" sends "@literal"
+		//
+		// Example with mixed text and files:
+		//   {{ body_FormData "name" "John" "avatar" "@/path/to/photo.jpg" "doc" "@https://example.com/file.pdf" }}
+		funcMap["body_FormData"] = func(pairs ...string) (string, error) {
+			if len(pairs)%2 != 0 {
+				return "", types.ErrFormDataOddArgs
 			}

-			_ = writer.Close()
-			return multipartData.String()
+			var multipartData bytes.Buffer
+			writer := multipart.NewWriter(&multipartData)
+			data.formDataContentType = writer.FormDataContentType()
+
+			for i := 0; i < len(pairs); i += 2 {
+				key := pairs[i]
+				val := pairs[i+1]
+
+				switch {
+				case strings.HasPrefix(val, "@@"):
+					// Escaped @ - send as literal string without first @
+					if err := writer.WriteField(key, val[1:]); err != nil {
+						return "", err
+					}
+				case strings.HasPrefix(val, "@"):
+					// File (local path or remote URL)
+					if fileCache == nil {
+						return "", types.ErrFileCacheNotInitialized
+					}
+					source := val[1:]
+					cached, err := fileCache.GetOrLoad(source)
+					if err != nil {
+						return "", err
+					}
+					part, err := writer.CreateFormFile(key, cached.Filename)
+					if err != nil {
+						return "", err
+					}
+					if _, err := part.Write(cached.Content); err != nil {
+						return "", err
+					}
+				default:
+					// Regular text field
+					if err := writer.WriteField(key, val); err != nil {
+						return "", err
+					}
+				}
+			}
+
+			if err := writer.Close(); err != nil {
+				return "", err
+			}
+			return multipartData.String(), nil
 		}
 	}

@@ -0,0 +1,346 @@
+package sarin
+
+import (
+	"context"
+	"slices"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+
+	"charm.land/bubbles/v2/progress"
+	"charm.land/bubbles/v2/spinner"
+	tea "charm.land/bubbletea/v2"
+	"charm.land/lipgloss/v2"
+)
+
+type tickMsg time.Time
+
+// logBatch carries the log lines accumulated since the last repaint.
+type logBatch []runtimeLog
+
+const (
+	// logBoxLines is how many lines the log box shows at once.
+	logBoxLines = 8
+	// logBatchInterval is how often accumulated logs are handed to the program.
+	logBatchInterval = 250 * time.Millisecond
+)
+
+var (
+	helpStyle  = lipgloss.NewStyle().Foreground(lipgloss.Color("#d1d1d1"))
+	errorStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("#FC5B5B")).Bold(true)
+	infoStyle  = lipgloss.NewStyle().Foreground(lipgloss.Color("#5BC0FC")).Bold(true)
+
+	errorLabel = errorStyle.Render("ERROR: ")
+	infoLabel  = infoStyle.Render("INFO: ")
+
+	logChannelStyle = lipgloss.NewStyle().
+			Border(lipgloss.ThickBorder(), false, false, false, true).
+			BorderForeground(lipgloss.Color("#757575")).
+			PaddingLeft(1).
+			Margin(1, 0, 0, 0).
+			Foreground(lipgloss.Color("#888888"))
+)
+
+// renderRuntimeLog builds a single styled log line for the TUI log box.
+func renderRuntimeLog(log runtimeLog) string {
+	label := errorLabel
+	if log.level == runtimeLogLevelInfo {
+		label = infoLabel
+	}
+	return "[" + log.timestamp.Format("15:04:05") + "] " + label + log.text
+}
+
+// renderLogBox renders the styled log box, or "" when there are no lines.
+func renderLogBox(logs []string) string {
+	var b strings.Builder
+	for i, line := range logs {
+		if len(line) > 0 {
+			b.WriteString(line)
+			if i < len(logs)-1 {
+				b.WriteString("\n")
+			}
+		}
+	}
+	if b.Len() == 0 {
+		return ""
+	}
+	return logChannelStyle.Render(b.String())
+}
+
+func helpLine(cancelling bool) string {
+	if cancelling {
+		return helpStyle.Render("Stopping... (Ctrl+C again to force)")
+	}
+	return helpStyle.Render("Press Ctrl+C to quit")
+}
+
+type progressModel struct {
+	progress   progress.Model
+	startTime  time.Time
+	logs       []string
+	counter    *atomic.Uint64
+	maxValue   uint64
+	showBar    bool
+	ctx        context.Context //nolint:containedctx
+	stop       func()
+	cancelling bool
+}
+
+func (m progressModel) Init() tea.Cmd {
+	return tea.Batch(progressTickCmd())
+}
+
+func (m progressModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.KeyPressMsg:
+		if msg.String() == "ctrl+c" {
+			m.cancelling = true
+			m.stop()
+		}
+		return m, nil
+
+	case tea.WindowSizeMsg:
+		m.progress.SetWidth(max(10, msg.Width-1))
+		if m.ctx.Err() != nil {
+			return m, tea.Quit
+		}
+		return m, nil
+
+	case logBatch:
+		for _, entry := range msg {
+			m.logs = append(m.logs[1:], renderRuntimeLog(entry))
+		}
+		if m.ctx.Err() != nil {
+			return m, tea.Quit
+		}
+		return m, nil
+
+	case tickMsg:
+		if m.ctx.Err() != nil {
+			return m, tea.Quit
+		}
+		return m, progressTickCmd()
+
+	default:
+		if m.ctx.Err() != nil {
+			return m, tea.Quit
+		}
+		return m, nil
+	}
+}
+
+func (m progressModel) View() tea.View {
+	var b strings.Builder
+	if box := renderLogBox(m.logs); box != "" {
+		b.WriteString(box)
+		b.WriteString("\n")
+	}
+
+	if m.showBar {
+		current := m.counter.Load()
+		b.WriteString("\n ")
+		b.WriteString(strconv.FormatUint(current, 10))
+		b.WriteString("/")
+		b.WriteString(strconv.FormatUint(m.maxValue, 10))
+		b.WriteString(" - ")
+		b.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
+		b.WriteString("\n ")
+		b.WriteString(m.progress.ViewAs(float64(current) / float64(m.maxValue)))
+	}
+
+	b.WriteString("\n\n  ")
+	b.WriteString(helpLine(m.cancelling))
+	return tea.NewView(b.String())
+}
+
+func progressTickCmd() tea.Cmd {
+	return tea.Tick(time.Millisecond*250, func(t time.Time) tea.Msg {
+		return tickMsg(t)
+	})
+}
+
+var infiniteProgressStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("#00D4FF"))
+
+type infiniteProgressModel struct {
+	spinner    spinner.Model
+	startTime  time.Time
+	counter    *atomic.Uint64
+	logs       []string
+	showBar    bool
+	ctx        context.Context //nolint:containedctx
+	quit       bool
+	stop       func()
+	cancelling bool
+}
+
+func (m infiniteProgressModel) Init() tea.Cmd {
+	return m.spinner.Tick
+}
+
+func (m infiniteProgressModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	switch msg := msg.(type) {
+	case tea.KeyPressMsg:
+		if msg.String() == "ctrl+c" {
+			m.cancelling = true
+			m.stop()
+		}
+		return m, nil
+
+	case logBatch:
+		for _, entry := range msg {
+			m.logs = append(m.logs[1:], renderRuntimeLog(entry))
+		}
+		if m.ctx.Err() != nil {
+			m.quit = true
+			return m, tea.Quit
+		}
+		return m, nil
+
+	default:
+		if m.ctx.Err() != nil {
+			m.quit = true
+			return m, tea.Quit
+		}
+		var cmd tea.Cmd
+		m.spinner, cmd = m.spinner.Update(msg)
+		return m, cmd
+	}
+}
+
+func (m infiniteProgressModel) View() tea.View {
+	var b strings.Builder
+	if box := renderLogBox(m.logs); box != "" {
+		b.WriteString(box)
+		b.WriteString("\n")
+	}
+
+	// Without a spinner, the view is just the log box (plus help until quit).
+	if !m.showBar {
+		if !m.quit {
+			b.WriteString("\n\n  ")
+			b.WriteString(helpLine(m.cancelling))
+		}
+		return tea.NewView(b.String())
+	}
+
+	if m.quit {
+		b.WriteString("\n  ")
+		b.WriteString(strconv.FormatUint(m.counter.Load(), 10))
+		b.WriteString("  ")
+		b.WriteString(infiniteProgressStyle.Render("∙∙∙∙∙"))
+		b.WriteString("  ")
+		b.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
+		b.WriteString("\n\n")
+	} else {
+		b.WriteString("\n  ")
+		b.WriteString(strconv.FormatUint(m.counter.Load(), 10))
+		b.WriteString("  ")
+		b.WriteString(m.spinner.View())
+		b.WriteString("  ")
+		b.WriteString(time.Since(m.startTime).Round(time.Second / 10).String())
+		b.WriteString("\n\n  ")
+		b.WriteString(helpLine(m.cancelling))
+	}
+	return tea.NewView(b.String())
+}
+
+func (s sarin) streamProgress(
+	ctx context.Context,
+	stopCtrl *StopController,
+	done chan<- struct{},
+	total uint64,
+	counter *atomic.Uint64,
+	logChannel <-chan runtimeLog,
+	showBar bool,
+) {
+	var program *tea.Program
+	if total > 0 {
+		model := progressModel{
+			progress: progress.New(
+				progress.WithColors(lipgloss.Color("#151594"), lipgloss.Color("#00D4FF")),
+				progress.WithFillCharacters(progress.DefaultFullCharFullBlock, progress.DefaultEmptyCharBlock),
+			),
+			startTime: time.Now(),
+			logs:      make([]string, logBoxLines),
+			counter:   counter,
+			maxValue:  total,
+			showBar:   showBar,
+			ctx:       ctx,
+			stop:      stopCtrl.Stop,
+		}
+
+		program = tea.NewProgram(model)
+	} else {
+		model := infiniteProgressModel{
+			spinner: spinner.New(
+				spinner.WithSpinner(
+					spinner.Spinner{
+						Frames: []string{
+							"●∙∙∙∙",
+							"∙●∙∙∙",
+							"∙∙●∙∙",
+							"∙∙∙●∙",
+							"∙∙∙∙●",
+							"∙∙∙●∙",
+							"∙∙●∙∙",
+							"∙●∙∙∙",
+						},
+						FPS: time.Second / 8, //nolint:mnd
+					},
+				),
+				spinner.WithStyle(infiniteProgressStyle),
+			),
+			startTime: time.Now(),
+			counter:   counter,
+			logs:      make([]string, logBoxLines),
+			showBar:   showBar,
+			ctx:       ctx,
+			stop:      stopCtrl.Stop,
+			quit:      false,
+		}
+
+		program = tea.NewProgram(model)
+	}
+
+	stopCtrl.AttachProgram(program)
+	defer stopCtrl.AttachProgram(nil)
+
+	// Bubble Tea repaints once per message, so forwarding every log made the run
+	// wait on the terminal. Send only what the box shows, on a fixed cadence.
+	go func() {
+		ticker := time.NewTicker(logBatchInterval)
+		defer ticker.Stop()
+
+		pending := make(logBatch, 0, logBoxLines)
+		flush := func() {
+			if len(pending) == 0 {
+				return
+			}
+			program.Send(slices.Clone(pending))
+			pending = pending[:0]
+		}
+
+		for {
+			select {
+			case entry, ok := <-logChannel:
+				if !ok {
+					flush()
+					return
+				}
+				if len(pending) == logBoxLines {
+					pending = append(pending[:0], pending[1:]...)
+				}
+				pending = append(pending, entry)
+			case <-ticker.C:
+				flush()
+			}
+		}
+	}()
+
+	if _, err := program.Run(); err != nil {
+		panic(err)
+	}
+
+	done <- struct{}{}
+}
@@ -0,0 +1,283 @@
+package sarin
+
+import (
+	"strconv"
+	"sync/atomic"
+	"time"
+
+	"github.com/valyala/fasthttp"
+	"go.aykhans.me/sarin/internal/script"
+)
+
+const dryRunResponseKey = "dry-run"
+
+// statusCodeStrings contains pre-computed string representations for HTTP status codes 100-599.
+var statusCodeStrings = func() [500]string {
+	var codes [500]string
+	for i := range codes {
+		codes[i] = strconv.Itoa(i + 100)
+	}
+	return codes
+}()
+
+// statusCodeToString returns a string representation of the HTTP status code.
+// Uses a pre-computed table for codes 100-599, falls back to strconv.Itoa for others.
+func statusCodeToString(code int) string {
+	if i := code - 100; i >= 0 && i < len(statusCodeStrings) {
+		return statusCodeStrings[i]
+	}
+	return strconv.Itoa(code)
+}
+
+func (s sarin) Worker(
+	jobs <-chan struct{},
+	hostClientGenerator HostClientGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+	sendRespLog respLogger,
+) {
+	req := fasthttp.AcquireRequest()
+	resp := fasthttp.AcquireResponse()
+	defer fasthttp.ReleaseRequest(req)
+	defer fasthttp.ReleaseResponse(resp)
+
+	// Create script transformer for this worker (engines are not thread-safe)
+	// Scripts are pre-validated in NewSarin, so this should not fail
+	var scriptTransformer *script.Transformer
+	if !s.scriptChain.IsEmpty() {
+		var err error
+		scriptTransformer, err = s.scriptChain.NewTransformer()
+		if err != nil {
+			panic(err)
+		}
+		defer scriptTransformer.Close()
+	}
+
+	requestGenerator, isDynamic := NewRequestGenerator(
+		s.methods, s.requestURL, s.params, s.headers, s.cookies, s.bodies, s.values, s.fileCache, scriptTransformer,
+	)
+
+	if s.dryRun {
+		switch {
+		case s.collectStats && isDynamic:
+			s.workerDryRunStatsWithDynamic(jobs, req, requestGenerator, counter, sendLog)
+		case s.collectStats && !isDynamic:
+			s.workerDryRunStatsWithStatic(jobs, req, requestGenerator, counter, sendLog)
+		case !s.collectStats && isDynamic:
+			s.workerDryRunNoStatsWithDynamic(jobs, req, requestGenerator, counter, sendLog)
+		default:
+			s.workerDryRunNoStatsWithStatic(jobs, req, requestGenerator, counter, sendLog)
+		}
+	} else {
+		switch {
+		case s.collectStats && isDynamic:
+			s.workerStatsWithDynamic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendLog, sendRespLog)
+		case s.collectStats && !isDynamic:
+			s.workerStatsWithStatic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendLog, sendRespLog)
+		case !s.collectStats && isDynamic:
+			s.workerNoStatsWithDynamic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendLog, sendRespLog)
+		default:
+			s.workerNoStatsWithStatic(jobs, req, resp, requestGenerator, hostClientGenerator, counter, sendLog, sendRespLog)
+		}
+	}
+}
+
+func (s sarin) workerStatsWithDynamic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	resp *fasthttp.Response,
+	requestGenerator RequestGenerator,
+	hostClientGenerator HostClientGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+	sendRespLog respLogger,
+) {
+	for range jobs {
+		req.Reset()
+
+		if err := requestGenerator(req); err != nil {
+			s.responses.Add(err.Error(), 0)
+			sendLog(runtimeLogLevelError, err.Error())
+			counter.Add(1)
+			continue
+		}
+
+		startTime := time.Now()
+		err := hostClientGenerator().DoTimeout(req, resp, s.timeout)
+		respDuration := time.Since(startTime)
+
+		if err != nil {
+			s.responses.Add(err.Error(), respDuration)
+		} else {
+			s.responses.Add(statusCodeToString(resp.StatusCode()), respDuration)
+			sendRespLog(respDuration, resp)
+		}
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerStatsWithStatic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	resp *fasthttp.Response,
+	requestGenerator RequestGenerator,
+	hostClientGenerator HostClientGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+	sendRespLog respLogger,
+) {
+	if err := requestGenerator(req); err != nil {
+		// Static request generation failed - record all jobs as errors
+		for range jobs {
+			s.responses.Add(err.Error(), 0)
+			sendLog(runtimeLogLevelError, err.Error())
+			counter.Add(1)
+		}
+		return
+	}
+
+	for range jobs {
+		startTime := time.Now()
+		err := hostClientGenerator().DoTimeout(req, resp, s.timeout)
+		respDuration := time.Since(startTime)
+		if err != nil {
+			s.responses.Add(err.Error(), respDuration)
+		} else {
+			s.responses.Add(statusCodeToString(resp.StatusCode()), respDuration)
+			sendRespLog(respDuration, resp)
+		}
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerNoStatsWithDynamic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	resp *fasthttp.Response,
+	requestGenerator RequestGenerator,
+	hostClientGenerator HostClientGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+	sendRespLog respLogger,
+) {
+	for range jobs {
+		req.Reset()
+		if err := requestGenerator(req); err != nil {
+			sendLog(runtimeLogLevelError, err.Error())
+			counter.Add(1)
+			continue
+		}
+		startTime := time.Now()
+		err := hostClientGenerator().DoTimeout(req, resp, s.timeout)
+		if err == nil {
+			sendRespLog(time.Since(startTime), resp)
+		}
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerNoStatsWithStatic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	resp *fasthttp.Response,
+	requestGenerator RequestGenerator,
+	hostClientGenerator HostClientGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+	sendRespLog respLogger,
+) {
+	if err := requestGenerator(req); err != nil {
+		sendLog(runtimeLogLevelError, err.Error())
+
+		// Static request generation failed - just count the jobs without sending
+		for range jobs {
+			counter.Add(1)
+		}
+		return
+	}
+
+	for range jobs {
+		startTime := time.Now()
+		err := hostClientGenerator().DoTimeout(req, resp, s.timeout)
+		if err == nil {
+			sendRespLog(time.Since(startTime), resp)
+		}
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerDryRunStatsWithDynamic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	requestGenerator RequestGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+) {
+	for range jobs {
+		req.Reset()
+		startTime := time.Now()
+		if err := requestGenerator(req); err != nil {
+			s.responses.Add(err.Error(), time.Since(startTime))
+			sendLog(runtimeLogLevelError, err.Error())
+			counter.Add(1)
+			continue
+		}
+		s.responses.Add(dryRunResponseKey, time.Since(startTime))
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerDryRunStatsWithStatic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	requestGenerator RequestGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+) {
+	if err := requestGenerator(req); err != nil {
+		// Static request generation failed - record all jobs as errors
+		for range jobs {
+			s.responses.Add(err.Error(), 0)
+			sendLog(runtimeLogLevelError, err.Error())
+			counter.Add(1)
+		}
+		return
+	}
+
+	for range jobs {
+		s.responses.Add(dryRunResponseKey, 0)
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerDryRunNoStatsWithDynamic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	requestGenerator RequestGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+) {
+	for range jobs {
+		req.Reset()
+		if err := requestGenerator(req); err != nil {
+			sendLog(runtimeLogLevelError, err.Error())
+		}
+		counter.Add(1)
+	}
+}
+
+func (s sarin) workerDryRunNoStatsWithStatic(
+	jobs <-chan struct{},
+	req *fasthttp.Request,
+	requestGenerator RequestGenerator,
+	counter *atomic.Uint64,
+	sendLog runtimeLogger,
+) {
+	if err := requestGenerator(req); err != nil {
+		sendLog(runtimeLogLevelError, err.Error())
+	}
+
+	for range jobs {
+		counter.Add(1)
+	}
+}
@@ -0,0 +1,107 @@
+package script
+
+import (
+	"go.aykhans.me/sarin/internal/types"
+)
+
+// Chain holds the loaded script sources and can create engine instances.
+// The sources are loaded once, but engines are created per-worker since they're not thread-safe.
+type Chain struct {
+	luaSources []*Source
+	jsSources  []*Source
+}
+
+// NewChain creates a new script chain from loaded sources.
+// Lua scripts run first, then JavaScript scripts, in the order provided.
+func NewChain(luaSources, jsSources []*Source) *Chain {
+	return &Chain{
+		luaSources: luaSources,
+		jsSources:  jsSources,
+	}
+}
+
+// IsEmpty returns true if there are no scripts to execute.
+func (c *Chain) IsEmpty() bool {
+	return len(c.luaSources) == 0 && len(c.jsSources) == 0
+}
+
+// Transformer holds instantiated script engines for a single worker.
+// It is NOT safe for concurrent use.
+type Transformer struct {
+	luaEngines []*LuaEngine
+	jsEngines  []*JsEngine
+}
+
+// NewTransformer creates engine instances from the chain's sources.
+// Call this once per worker goroutine.
+// It can return the following errors:
+//   - types.ScriptChainError
+func (c *Chain) NewTransformer() (*Transformer, error) {
+	if c.IsEmpty() {
+		return &Transformer{}, nil
+	}
+
+	t := &Transformer{
+		luaEngines: make([]*LuaEngine, 0, len(c.luaSources)),
+		jsEngines:  make([]*JsEngine, 0, len(c.jsSources)),
+	}
+
+	// Create Lua engines
+	for i, src := range c.luaSources {
+		engine, err := NewLuaEngine(src.Content)
+		if err != nil {
+			t.Close() // Clean up already created engines
+			return nil, types.NewScriptChainError("lua", i, err)
+		}
+		t.luaEngines = append(t.luaEngines, engine)
+	}
+
+	// Create JS engines
+	for i, src := range c.jsSources {
+		engine, err := NewJsEngine(src.Content)
+		if err != nil {
+			t.Close() // Clean up already created engines
+			return nil, types.NewScriptChainError("js", i, err)
+		}
+		t.jsEngines = append(t.jsEngines, engine)
+	}
+
+	return t, nil
+}
+
+// Transform applies all scripts to the request data.
+// Lua scripts run first, then JavaScript scripts.
+// It can return the following errors:
+//   - types.ScriptChainError
+func (t *Transformer) Transform(req *RequestData) error {
+	// Run Lua scripts
+	for i, engine := range t.luaEngines {
+		if err := engine.Transform(req); err != nil {
+			return types.NewScriptChainError("lua", i, err)
+		}
+	}
+
+	// Run JS scripts
+	for i, engine := range t.jsEngines {
+		if err := engine.Transform(req); err != nil {
+			return types.NewScriptChainError("js", i, err)
+		}
+	}
+
+	return nil
+}
+
+// Close releases all engine resources.
+func (t *Transformer) Close() {
+	for _, engine := range t.luaEngines {
+		engine.Close()
+	}
+	for _, engine := range t.jsEngines {
+		engine.Close()
+	}
+}
+
+// IsEmpty returns true if there are no engines.
+func (t *Transformer) IsEmpty() bool {
+	return len(t.luaEngines) == 0 && len(t.jsEngines) == 0
+}
@@ -0,0 +1,198 @@
+package script
+
+import (
+	"errors"
+
+	"github.com/dop251/goja"
+	"go.aykhans.me/sarin/internal/types"
+)
+
+// JsEngine implements the Engine interface using goja (JavaScript).
+type JsEngine struct {
+	runtime   *goja.Runtime
+	transform goja.Callable
+}
+
+// NewJsEngine creates a new JavaScript script engine with the given script content.
+// The script must define a global `transform` function that takes a request object
+// and returns the modified request object.
+//
+// Example JavaScript script:
+//
+//	function transform(req) {
+//	    req.headers["X-Custom"] = ["value"];
+//	    return req;
+//	}
+//
+// It can return the following errors:
+//   - types.ErrScriptTransformMissing
+//   - types.ScriptExecutionError
+func NewJsEngine(scriptContent string) (*JsEngine, error) {
+	vm := goja.New()
+
+	// Execute the script to define the transform function
+	_, err := vm.RunString(scriptContent)
+	if err != nil {
+		return nil, types.NewScriptExecutionError("JavaScript", err)
+	}
+
+	// Get the transform function
+	transformVal := vm.Get("transform")
+	if transformVal == nil || goja.IsUndefined(transformVal) || goja.IsNull(transformVal) {
+		return nil, types.ErrScriptTransformMissing
+	}
+
+	transform, ok := goja.AssertFunction(transformVal)
+	if !ok {
+		return nil, types.NewScriptExecutionError("JavaScript", errors.New("'transform' must be a function"))
+	}
+
+	return &JsEngine{
+		runtime:   vm,
+		transform: transform,
+	}, nil
+}
+
+// Transform executes the JavaScript transform function with the given request data.
+// It can return the following errors:
+//   - types.ScriptExecutionError
+func (e *JsEngine) Transform(req *RequestData) error {
+	// Convert RequestData to JavaScript object
+	reqObj := e.requestDataToObject(req)
+
+	// Call transform(req)
+	result, err := e.transform(goja.Undefined(), reqObj)
+	if err != nil {
+		return types.NewScriptExecutionError("JavaScript", err)
+	}
+
+	// Update RequestData from the returned object
+	if err := e.objectToRequestData(result, req); err != nil {
+		return types.NewScriptExecutionError("JavaScript", err)
+	}
+
+	return nil
+}
+
+// Close releases the JavaScript runtime resources.
+func (e *JsEngine) Close() {
+	// goja doesn't have an explicit close method, but we can help GC
+	e.runtime = nil
+	e.transform = nil
+}
+
+// requestDataToObject converts RequestData to a goja Value (JavaScript object).
+func (e *JsEngine) requestDataToObject(req *RequestData) goja.Value {
+	obj := e.runtime.NewObject()
+
+	_ = obj.Set("method", req.Method)
+	_ = obj.Set("path", req.Path)
+	_ = obj.Set("body", req.Body)
+
+	// Headers (map[string][]string -> object of arrays)
+	headers := e.runtime.NewObject()
+	for k, values := range req.Headers {
+		_ = headers.Set(k, e.stringSliceToArray(values))
+	}
+	_ = obj.Set("headers", headers)
+
+	// Params (map[string][]string -> object of arrays)
+	params := e.runtime.NewObject()
+	for k, values := range req.Params {
+		_ = params.Set(k, e.stringSliceToArray(values))
+	}
+	_ = obj.Set("params", params)
+
+	// Cookies (map[string][]string -> object of arrays)
+	cookies := e.runtime.NewObject()
+	for k, values := range req.Cookies {
+		_ = cookies.Set(k, e.stringSliceToArray(values))
+	}
+	_ = obj.Set("cookies", cookies)
+
+	return obj
+}
+
+// objectToRequestData updates RequestData from a JavaScript object.
+func (e *JsEngine) objectToRequestData(val goja.Value, req *RequestData) error {
+	if val == nil || goja.IsUndefined(val) || goja.IsNull(val) {
+		return types.ErrScriptTransformReturnObject
+	}
+
+	obj := val.ToObject(e.runtime)
+	if obj == nil {
+		return types.ErrScriptTransformReturnObject
+	}
+
+	// Method
+	if v := obj.Get("method"); v != nil && !goja.IsUndefined(v) {
+		req.Method = v.String()
+	}
+
+	// Path
+	if v := obj.Get("path"); v != nil && !goja.IsUndefined(v) {
+		req.Path = v.String()
+	}
+
+	// Body
+	if v := obj.Get("body"); v != nil && !goja.IsUndefined(v) {
+		req.Body = v.String()
+	}
+
+	// Headers
+	if v := obj.Get("headers"); v != nil && !goja.IsUndefined(v) && !goja.IsNull(v) {
+		req.Headers = e.objectToStringSliceMap(v.ToObject(e.runtime))
+	}
+
+	// Params
+	if v := obj.Get("params"); v != nil && !goja.IsUndefined(v) && !goja.IsNull(v) {
+		req.Params = e.objectToStringSliceMap(v.ToObject(e.runtime))
+	}
+
+	// Cookies
+	if v := obj.Get("cookies"); v != nil && !goja.IsUndefined(v) && !goja.IsNull(v) {
+		req.Cookies = e.objectToStringSliceMap(v.ToObject(e.runtime))
+	}
+
+	return nil
+}
+
+// stringSliceToArray converts a Go []string to a JavaScript array.
+func (e *JsEngine) stringSliceToArray(values []string) *goja.Object {
+	ifaces := make([]any, len(values))
+	for i, v := range values {
+		ifaces[i] = v
+	}
+	return e.runtime.NewArray(ifaces...)
+}
+
+// objectToStringSliceMap converts a JavaScript object to a Go map[string][]string.
+// Supports both single string values and array values.
+func (e *JsEngine) objectToStringSliceMap(obj *goja.Object) map[string][]string {
+	if obj == nil {
+		return make(map[string][]string)
+	}
+
+	result := make(map[string][]string)
+	for _, key := range obj.Keys() {
+		v := obj.Get(key)
+		if v == nil || goja.IsUndefined(v) || goja.IsNull(v) {
+			continue
+		}
+
+		// Check if it's an array
+		if arr, ok := v.Export().([]any); ok {
+			var values []string
+			for _, item := range arr {
+				if s, ok := item.(string); ok {
+					values = append(values, s)
+				}
+			}
+			result[key] = values
+		} else {
+			// Single value - wrap in slice
+			result[key] = []string{v.String()}
+		}
+	}
+	return result
+}
@@ -0,0 +1,191 @@
+package script
+
+import (
+	"fmt"
+
+	lua "github.com/yuin/gopher-lua"
+	"go.aykhans.me/sarin/internal/types"
+)
+
+// LuaEngine implements the Engine interface using gopher-lua.
+type LuaEngine struct {
+	state     *lua.LState
+	transform *lua.LFunction
+}
+
+// NewLuaEngine creates a new Lua script engine with the given script content.
+// The script must define a global `transform` function that takes a request table
+// and returns the modified request table.
+//
+// Example Lua script:
+//
+//	function transform(req)
+//	    req.headers["X-Custom"] = {"value"}
+//	    return req
+//	end
+//
+// It can return the following errors:
+//   - types.ErrScriptTransformMissing
+//   - types.ScriptExecutionError
+func NewLuaEngine(scriptContent string) (*LuaEngine, error) {
+	L := lua.NewState()
+
+	// Execute the script to define the transform function
+	if err := L.DoString(scriptContent); err != nil {
+		L.Close()
+		return nil, types.NewScriptExecutionError("Lua", err)
+	}
+
+	// Get the transform function
+	transform := L.GetGlobal("transform")
+	if transform.Type() != lua.LTFunction {
+		L.Close()
+		return nil, types.ErrScriptTransformMissing
+	}
+
+	return &LuaEngine{
+		state:     L,
+		transform: transform.(*lua.LFunction),
+	}, nil
+}
+
+// Transform executes the Lua transform function with the given request data.
+// It can return the following errors:
+//   - types.ScriptExecutionError
+func (e *LuaEngine) Transform(req *RequestData) error {
+	// Convert RequestData to Lua table
+	reqTable := e.requestDataToTable(req)
+
+	// Call transform(req)
+	e.state.Push(e.transform)
+	e.state.Push(reqTable)
+	if err := e.state.PCall(1, 1, nil); err != nil {
+		return types.NewScriptExecutionError("Lua", err)
+	}
+
+	// Get the result
+	result := e.state.Get(-1)
+	e.state.Pop(1)
+
+	if result.Type() != lua.LTTable {
+		return types.NewScriptExecutionError("Lua", fmt.Errorf("transform function must return a table, got %s", result.Type()))
+	}
+
+	// Update RequestData from the returned table
+	e.tableToRequestData(result.(*lua.LTable), req)
+
+	return nil
+}
+
+// Close releases the Lua state resources.
+func (e *LuaEngine) Close() {
+	if e.state != nil {
+		e.state.Close()
+	}
+}
+
+// requestDataToTable converts RequestData to a Lua table.
+func (e *LuaEngine) requestDataToTable(req *RequestData) *lua.LTable {
+	L := e.state
+	t := L.NewTable()
+
+	t.RawSetString("method", lua.LString(req.Method))
+	t.RawSetString("path", lua.LString(req.Path))
+	t.RawSetString("body", lua.LString(req.Body))
+
+	// Headers (map[string][]string -> table of arrays)
+	headers := L.NewTable()
+	for k, values := range req.Headers {
+		arr := L.NewTable()
+		for _, v := range values {
+			arr.Append(lua.LString(v))
+		}
+		headers.RawSetString(k, arr)
+	}
+	t.RawSetString("headers", headers)
+
+	// Params (map[string][]string -> table of arrays)
+	params := L.NewTable()
+	for k, values := range req.Params {
+		arr := L.NewTable()
+		for _, v := range values {
+			arr.Append(lua.LString(v))
+		}
+		params.RawSetString(k, arr)
+	}
+	t.RawSetString("params", params)
+
+	// Cookies (map[string][]string -> table of arrays)
+	cookies := L.NewTable()
+	for k, values := range req.Cookies {
+		arr := L.NewTable()
+		for _, v := range values {
+			arr.Append(lua.LString(v))
+		}
+		cookies.RawSetString(k, arr)
+	}
+	t.RawSetString("cookies", cookies)
+
+	return t
+}
+
+// tableToRequestData updates RequestData from a Lua table.
+func (e *LuaEngine) tableToRequestData(t *lua.LTable, req *RequestData) {
+	// Method
+	if v := t.RawGetString("method"); v.Type() == lua.LTString {
+		req.Method = string(v.(lua.LString))
+	}
+
+	// Path
+	if v := t.RawGetString("path"); v.Type() == lua.LTString {
+		req.Path = string(v.(lua.LString))
+	}
+
+	// Body
+	if v := t.RawGetString("body"); v.Type() == lua.LTString {
+		req.Body = string(v.(lua.LString))
+	}
+
+	// Headers
+	if v := t.RawGetString("headers"); v.Type() == lua.LTTable {
+		req.Headers = e.tableToStringSliceMap(v.(*lua.LTable))
+	}
+
+	// Params
+	if v := t.RawGetString("params"); v.Type() == lua.LTTable {
+		req.Params = e.tableToStringSliceMap(v.(*lua.LTable))
+	}
+
+	// Cookies
+	if v := t.RawGetString("cookies"); v.Type() == lua.LTTable {
+		req.Cookies = e.tableToStringSliceMap(v.(*lua.LTable))
+	}
+}
+
+// tableToStringSliceMap converts a Lua table to a Go map[string][]string.
+// Supports both single string values and array values.
+func (e *LuaEngine) tableToStringSliceMap(t *lua.LTable) map[string][]string {
+	result := make(map[string][]string)
+	t.ForEach(func(k, v lua.LValue) {
+		if k.Type() != lua.LTString {
+			return
+		}
+		key := string(k.(lua.LString))
+
+		switch v.Type() {
+		case lua.LTString:
+			// Single string value
+			result[key] = []string{string(v.(lua.LString))}
+		case lua.LTTable:
+			// Array of strings
+			var values []string
+			v.(*lua.LTable).ForEach(func(_, item lua.LValue) {
+				if item.Type() == lua.LTString {
+					values = append(values, string(item.(lua.LString)))
+				}
+			})
+			result[key] = values
+		}
+	})
+	return result
+}
@@ -0,0 +1,197 @@
+package script
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"go.aykhans.me/sarin/internal/types"
+)
+
+// RequestData represents the request data passed to scripts for transformation.
+// Scripts can modify any field and the changes will be applied to the actual request.
+// Headers, Params, and Cookies use []string values to support multiple values per key.
+type RequestData struct {
+	Method  string              `json:"method"`
+	Path    string              `json:"path"`
+	Headers map[string][]string `json:"headers"`
+	Params  map[string][]string `json:"params"`
+	Cookies map[string][]string `json:"cookies"`
+	Body    string              `json:"body"`
+}
+
+// Engine defines the interface for script engines (Lua, JavaScript).
+// Each engine must be able to transform request data using a user-provided script.
+type Engine interface {
+	// Transform executes the script's transform function with the given request data.
+	// The script should modify the RequestData and return it.
+	Transform(req *RequestData) error
+
+	// Close releases any resources held by the engine.
+	Close()
+}
+
+// EngineType represents the type of script engine.
+type EngineType string
+
+const (
+	EngineTypeLua        EngineType = "lua"
+	EngineTypeJavaScript EngineType = "js"
+)
+
+// Source represents a loaded script source.
+type Source struct {
+	Content    string
+	EngineType EngineType
+}
+
+// LoadSource loads a script from the given source string.
+// The source can be:
+//   - Inline script: any string not starting with "@"
+//   - Escaped "@": strings starting with "@@" (literal "@" at start, returns string without first @)
+//   - File reference: "@/path/to/file" or "@./relative/path"
+//   - URL reference: "@http://..." or "@https://..."
+//
+// It can return the following errors:
+//   - types.ErrScriptEmpty
+//   - types.ScriptLoadError
+func LoadSource(ctx context.Context, source string, engineType EngineType) (*Source, error) {
+	if source == "" {
+		return nil, types.ErrScriptEmpty
+	}
+
+	var content string
+	var err error
+
+	switch {
+	case strings.HasPrefix(source, "@@"):
+		// Escaped @ - it's an inline script starting with literal @
+		content = source[1:] // Remove first @, keep the rest
+	case strings.HasPrefix(source, "@"):
+		// File or URL reference
+		ref := source[1:]
+		if strings.HasPrefix(ref, "http://") || strings.HasPrefix(ref, "https://") {
+			content, err = fetchURL(ctx, ref)
+		} else {
+			content, err = readFile(ref)
+		}
+		if err != nil {
+			return nil, types.NewScriptLoadError(ref, err)
+		}
+	default:
+		// Inline script
+		content = source
+	}
+
+	return &Source{
+		Content:    content,
+		EngineType: engineType,
+	}, nil
+}
+
+// LoadSources loads multiple script sources.
+// It can return the following errors:
+//   - types.ErrScriptEmpty
+//   - types.ScriptLoadError
+func LoadSources(ctx context.Context, sources []string, engineType EngineType) ([]*Source, error) {
+	loaded := make([]*Source, 0, len(sources))
+	for _, src := range sources {
+		source, err := LoadSource(ctx, src, engineType)
+		if err != nil {
+			return nil, err
+		}
+		loaded = append(loaded, source)
+	}
+	return loaded, nil
+}
+
+// ValidateScript validates a script source by loading it and checking syntax.
+// It loads the script (from file/URL/inline), parses it, and verifies
+// that a 'transform' function is defined.
+// It can return the following errors:
+//   - types.ErrScriptEmpty
+//   - types.ErrScriptTransformMissing
+//   - types.ScriptLoadError
+//   - types.ScriptExecutionError
+//   - types.ScriptUnknownEngineError
+func ValidateScript(ctx context.Context, source string, engineType EngineType) error {
+	// Load the script source
+	src, err := LoadSource(ctx, source, engineType)
+	if err != nil {
+		return err
+	}
+
+	// Try to create an engine - this validates syntax and transform function
+	var engine Engine
+	switch engineType {
+	case EngineTypeLua:
+		engine, err = NewLuaEngine(src.Content)
+	case EngineTypeJavaScript:
+		engine, err = NewJsEngine(src.Content)
+	default:
+		return types.NewScriptUnknownEngineError(string(engineType))
+	}
+
+	if err != nil {
+		return err
+	}
+
+	// Clean up the engine - we only needed it for validation
+	engine.Close()
+	return nil
+}
+
+// fetchURL downloads content from an HTTP/HTTPS URL.
+// It can return the following errors:
+//   - types.HTTPFetchError
+//   - types.HTTPStatusError
+func fetchURL(ctx context.Context, url string) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return "", types.NewHTTPFetchError(url, err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", types.NewHTTPFetchError(url, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return "", types.NewHTTPStatusError(url, resp.StatusCode, resp.Status)
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", types.NewHTTPFetchError(url, err)
+	}
+
+	return string(data), nil
+}
+
+// readFile reads content from a local file.
+// It can return the following errors:
+//   - types.FileReadError
+func readFile(path string) (string, error) {
+	if !filepath.IsAbs(path) {
+		pwd, err := os.Getwd()
+		if err != nil {
+			return "", types.NewFileReadError(path, err)
+		}
+		path = filepath.Join(pwd, path)
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec
+	if err != nil {
+		return "", types.NewFileReadError(path, err)
+	}
+
+	return string(data), nil
+}
@@ -15,7 +15,7 @@ func (cookies Cookies) GetValue(key string) *[]string {
 	return nil
 }

-func (cookies *Cookies) Append(cookie ...Cookie) {
+func (cookies *Cookies) Merge(cookie ...Cookie) {
 	for _, c := range cookie {
 		if item := cookies.GetValue(c.Key); item != nil {
 			*item = append(*item, c.Value...)
@@ -27,7 +27,7 @@ func (cookies *Cookies) Append(cookie ...Cookie) {

 func (cookies *Cookies) Parse(rawValues ...string) {
 	for _, rawValue := range rawValues {
-		cookies.Append(*ParseCookie(rawValue))
+		*cookies = append(*cookies, *ParseCookie(rawValue))
 	}
 }

@@ -6,16 +6,12 @@ import (
 	"strings"
 )

-var (
-	// General
-	ErrNoError = errors.New("no error (internal)")
-
-	// CLI
-	ErrCLINoArgs = errors.New("CLI expects arguments but received none")
-)
-
 // ======================================== General ========================================

+var (
+	errNoError = errors.New("no error (internal)")
+)
+
 type FieldParseError struct {
 	Field string
 	Value string
@@ -24,7 +20,7 @@ type FieldParseError struct {

 func NewFieldParseError(field string, value string, err error) FieldParseError {
 	if err == nil {
-		err = ErrNoError
+		err = errNoError
 	}
 	return FieldParseError{field, value, err}
 }
@@ -72,7 +68,7 @@ type FieldValidationError struct {

 func NewFieldValidationError(field string, value string, err error) FieldValidationError {
 	if err == nil {
-		err = ErrNoError
+		err = errNoError
 	}
 	return FieldValidationError{field, value, err}
 }
@@ -118,7 +114,7 @@ type UnmarshalError struct {

 func NewUnmarshalError(err error) UnmarshalError {
 	if err == nil {
-		err = ErrNoError
+		err = errNoError
 	}
 	return UnmarshalError{err}
 }
@@ -131,6 +127,160 @@ func (e UnmarshalError) Unwrap() error {
 	return e.error
 }

+// ======================================== General I/O ========================================
+
+type FileReadError struct {
+	Path string
+	Err  error
+}
+
+func NewFileReadError(path string, err error) FileReadError {
+	if err == nil {
+		err = errNoError
+	}
+	return FileReadError{path, err}
+}
+
+func (e FileReadError) Error() string {
+	return fmt.Sprintf("failed to read file %s: %v", e.Path, e.Err)
+}
+
+func (e FileReadError) Unwrap() error {
+	return e.Err
+}
+
+type HTTPFetchError struct {
+	URL string
+	Err error
+}
+
+func NewHTTPFetchError(url string, err error) HTTPFetchError {
+	if err == nil {
+		err = errNoError
+	}
+	return HTTPFetchError{url, err}
+}
+
+func (e HTTPFetchError) Error() string {
+	return fmt.Sprintf("failed to fetch %s: %v", e.URL, e.Err)
+}
+
+func (e HTTPFetchError) Unwrap() error {
+	return e.Err
+}
+
+type HTTPStatusError struct {
+	URL        string
+	StatusCode int
+	Status     string
+}
+
+func NewHTTPStatusError(url string, statusCode int, status string) HTTPStatusError {
+	return HTTPStatusError{url, statusCode, status}
+}
+
+func (e HTTPStatusError) Error() string {
+	return fmt.Sprintf("HTTP %d %s (url: %s)", e.StatusCode, e.Status, e.URL)
+}
+
+type URLParseError struct {
+	URL string
+	Err error
+}
+
+func NewURLParseError(url string, err error) URLParseError {
+	if err == nil {
+		err = errNoError
+	}
+	return URLParseError{url, err}
+}
+
+func (e URLParseError) Error() string {
+	return fmt.Sprintf("invalid URL %q: %v", e.URL, e.Err)
+}
+
+func (e URLParseError) Unwrap() error {
+	return e.Err
+}
+
+// ======================================== Template ========================================
+
+var (
+	ErrFileCacheNotInitialized = errors.New("file cache is not initialized")
+	ErrFormDataOddArgs         = errors.New("body_FormData requires an even number of arguments (key-value pairs)")
+	ErrJSONObjectOddArgs       = errors.New("json_Object requires an even number of arguments (key-value pairs)")
+)
+
+type JSONObjectKeyError struct {
+	Index int
+	Value any
+}
+
+func NewJSONObjectKeyError(index int, value any) JSONObjectKeyError {
+	return JSONObjectKeyError{Index: index, Value: value}
+}
+
+func (e JSONObjectKeyError) Error() string {
+	return fmt.Sprintf("json_Object key at index %d must be a string, got %T", e.Index, e.Value)
+}
+
+type JSONEncodeError struct {
+	Err error
+}
+
+func NewJSONEncodeError(err error) JSONEncodeError {
+	if err == nil {
+		err = errNoError
+	}
+	return JSONEncodeError{Err: err}
+}
+
+func (e JSONEncodeError) Error() string {
+	return "json_Encode failed: " + e.Err.Error()
+}
+
+func (e JSONEncodeError) Unwrap() error {
+	return e.Err
+}
+
+type TemplateParseError struct {
+	Err error
+}
+
+func NewTemplateParseError(err error) TemplateParseError {
+	if err == nil {
+		err = errNoError
+	}
+	return TemplateParseError{err}
+}
+
+func (e TemplateParseError) Error() string {
+	return "template parse error: " + e.Err.Error()
+}
+
+func (e TemplateParseError) Unwrap() error {
+	return e.Err
+}
+
+type TemplateRenderError struct {
+	Err error
+}
+
+func NewTemplateRenderError(err error) TemplateRenderError {
+	if err == nil {
+		err = errNoError
+	}
+	return TemplateRenderError{err}
+}
+
+func (e TemplateRenderError) Error() string {
+	return "template rendering: " + e.Err.Error()
+}
+
+func (e TemplateRenderError) Unwrap() error {
+	return e.Err
+}
+
 // ======================================== CLI ========================================

 type CLIUnexpectedArgsError struct {
@@ -153,7 +303,7 @@ type ConfigFileReadError struct {

 func NewConfigFileReadError(err error) ConfigFileReadError {
 	if err == nil {
-		err = ErrNoError
+		err = errNoError
 	}
 	return ConfigFileReadError{err}
 }
@@ -168,6 +318,61 @@ func (e ConfigFileReadError) Unwrap() error {

 // ======================================== Proxy ========================================

+type ProxyUnsupportedSchemeError struct {
+	Scheme string
+}
+
+func NewProxyUnsupportedSchemeError(scheme string) ProxyUnsupportedSchemeError {
+	return ProxyUnsupportedSchemeError{scheme}
+}
+
+func (e ProxyUnsupportedSchemeError) Error() string {
+	return "unsupported proxy scheme: " + e.Scheme
+}
+
+type ProxyParseError struct {
+	Err error
+}
+
+func NewProxyParseError(err error) ProxyParseError {
+	if err == nil {
+		err = errNoError
+	}
+	return ProxyParseError{err}
+}
+
+func (e ProxyParseError) Error() string {
+	return "failed to parse proxy URL: " + e.Err.Error()
+}
+
+func (e ProxyParseError) Unwrap() error {
+	return e.Err
+}
+
+type ProxyConnectError struct {
+	Status string
+}
+
+func NewProxyConnectError(status string) ProxyConnectError {
+	return ProxyConnectError{status}
+}
+
+func (e ProxyConnectError) Error() string {
+	return "proxy CONNECT failed: " + e.Status
+}
+
+type ProxyResolveError struct {
+	Host string
+}
+
+func NewProxyResolveError(host string) ProxyResolveError {
+	return ProxyResolveError{host}
+}
+
+func (e ProxyResolveError) Error() string {
+	return "no IP addresses found for host: " + e.Host
+}
+
 type ProxyDialError struct {
 	Proxy string
 	Err   error
@@ -175,7 +380,7 @@ type ProxyDialError struct {

 func NewProxyDialError(proxy string, err error) ProxyDialError {
 	if err == nil {
-		err = ErrNoError
+		err = errNoError
 	}
 	return ProxyDialError{proxy, err}
 }
@@ -187,3 +392,174 @@ func (e ProxyDialError) Error() string {
 func (e ProxyDialError) Unwrap() error {
 	return e.Err
 }
+
+// ======================================== Script ========================================
+
+var (
+	ErrScriptEmpty                 = errors.New("script cannot be empty")
+	ErrScriptSourceEmpty           = errors.New("script source cannot be empty after @")
+	ErrScriptTransformMissing      = errors.New("script must define a global 'transform' function")
+	ErrScriptTransformReturnObject = errors.New("transform function must return an object")
+	ErrScriptURLNoHost             = errors.New("script URL must have a host")
+)
+
+type ScriptLoadError struct {
+	Source string
+	Err    error
+}
+
+func NewScriptLoadError(source string, err error) ScriptLoadError {
+	if err == nil {
+		err = errNoError
+	}
+	return ScriptLoadError{source, err}
+}
+
+func (e ScriptLoadError) Error() string {
+	return fmt.Sprintf("failed to load script from %q: %v", e.Source, e.Err)
+}
+
+func (e ScriptLoadError) Unwrap() error {
+	return e.Err
+}
+
+type ScriptExecutionError struct {
+	EngineType string
+	Err        error
+}
+
+func NewScriptExecutionError(engineType string, err error) ScriptExecutionError {
+	if err == nil {
+		err = errNoError
+	}
+	return ScriptExecutionError{engineType, err}
+}
+
+func (e ScriptExecutionError) Error() string {
+	return fmt.Sprintf("%s script error: %v", e.EngineType, e.Err)
+}
+
+func (e ScriptExecutionError) Unwrap() error {
+	return e.Err
+}
+
+type ScriptChainError struct {
+	EngineType string
+	Index      int
+	Err        error
+}
+
+func NewScriptChainError(engineType string, index int, err error) ScriptChainError {
+	if err == nil {
+		err = errNoError
+	}
+	return ScriptChainError{engineType, index, err}
+}
+
+func (e ScriptChainError) Error() string {
+	return fmt.Sprintf("%s script[%d]: %v", e.EngineType, e.Index, e.Err)
+}
+
+func (e ScriptChainError) Unwrap() error {
+	return e.Err
+}
+
+type ScriptUnknownEngineError struct {
+	EngineType string
+}
+
+func NewScriptUnknownEngineError(engineType string) ScriptUnknownEngineError {
+	return ScriptUnknownEngineError{engineType}
+}
+
+func (e ScriptUnknownEngineError) Error() string {
+	return "unknown engine type: " + e.EngineType
+}
+
+// ======================================== Captcha ========================================
+
+var (
+	ErrCaptchaKeyEmpty = errors.New("captcha API key cannot be empty")
+	// ErrCaptchaProcessing is an internal sentinel returned by the captcha solver polling
+	// code to signal that a task is not yet solved and polling should continue.
+	// It should never be surfaced to callers outside of the captcha poll loop.
+	ErrCaptchaProcessing = errors.New("captcha task still processing")
+)
+
+type CaptchaAPIError struct {
+	Endpoint    string
+	Code        string
+	Description string
+}
+
+func NewCaptchaAPIError(endpoint, code, description string) CaptchaAPIError {
+	return CaptchaAPIError{Endpoint: endpoint, Code: code, Description: description}
+}
+
+func (e CaptchaAPIError) Error() string {
+	return fmt.Sprintf("captcha %s error: %s (%s)", e.Endpoint, e.Code, e.Description)
+}
+
+type CaptchaRequestError struct {
+	Endpoint string
+	Err      error
+}
+
+func NewCaptchaRequestError(endpoint string, err error) CaptchaRequestError {
+	if err == nil {
+		err = errNoError
+	}
+	return CaptchaRequestError{Endpoint: endpoint, Err: err}
+}
+
+func (e CaptchaRequestError) Error() string {
+	return fmt.Sprintf("captcha %s request failed: %v", e.Endpoint, e.Err)
+}
+
+func (e CaptchaRequestError) Unwrap() error {
+	return e.Err
+}
+
+type CaptchaDecodeError struct {
+	Endpoint string
+	Err      error
+}
+
+func NewCaptchaDecodeError(endpoint string, err error) CaptchaDecodeError {
+	if err == nil {
+		err = errNoError
+	}
+	return CaptchaDecodeError{Endpoint: endpoint, Err: err}
+}
+
+func (e CaptchaDecodeError) Error() string {
+	return fmt.Sprintf("captcha %s decode failed: %v", e.Endpoint, e.Err)
+}
+
+func (e CaptchaDecodeError) Unwrap() error {
+	return e.Err
+}
+
+type CaptchaPollTimeoutError struct {
+	TaskID string
+}
+
+func NewCaptchaPollTimeoutError(taskID string) CaptchaPollTimeoutError {
+	return CaptchaPollTimeoutError{TaskID: taskID}
+}
+
+func (e CaptchaPollTimeoutError) Error() string {
+	return fmt.Sprintf("captcha solving timed out (taskId: %s)", e.TaskID)
+}
+
+type CaptchaSolutionKeyError struct {
+	Key string
+}
+
+func NewCaptchaSolutionKeyError(key string) CaptchaSolutionKeyError {
+	return CaptchaSolutionKeyError{Key: key}
+}
+
+func (e CaptchaSolutionKeyError) Error() string {
+	return fmt.Sprintf("captcha solution missing expected key %q", e.Key)
+}
@@ -24,7 +24,7 @@ func (headers Headers) GetValue(key string) *[]string {
 	return nil
 }

-func (headers *Headers) Append(header ...Header) {
+func (headers *Headers) Merge(header ...Header) {
 	for _, h := range header {
 		if item := headers.GetValue(h.Key); item != nil {
 			*item = append(*item, h.Value...)
@@ -36,7 +36,7 @@ func (headers *Headers) Append(header ...Header) {

 func (headers *Headers) Parse(rawValues ...string) {
 	for _, rawValue := range rawValues {
-		headers.Append(*ParseHeader(rawValue))
+		*headers = append(*headers, *ParseHeader(rawValue))
 	}
 }

@@ -15,7 +15,7 @@ func (params Params) GetValue(key string) *[]string {
 	return nil
 }

-func (params *Params) Append(param ...Param) {
+func (params *Params) Merge(param ...Param) {
 	for _, p := range param {
 		if item := params.GetValue(p.Key); item != nil {
 			*item = append(*item, p.Value...)
@@ -27,7 +27,7 @@ func (params *Params) Append(param ...Param) {

 func (params *Params) Parse(rawValues ...string) {
 	for _, rawValue := range rawValues {
-		params.Append(*ParseParam(rawValue))
+		*params = append(*params, *ParseParam(rawValue))
 	}
 }

@@ -1,7 +1,6 @@
 package types

 import (
-	"fmt"
 	"net/url"
 )

@@ -17,6 +16,9 @@ func (proxies *Proxies) Append(proxy ...Proxy) {
 	*proxies = append(*proxies, proxy...)
 }

+// Parse parses a raw proxy string and appends it to the list.
+// It can return the following errors:
+//   - ProxyParseError
 func (proxies *Proxies) Parse(rawValue string) error {
 	parsedProxy, err := ParseProxy(rawValue)
 	if err != nil {
@@ -27,10 +29,13 @@ func (proxies *Proxies) Parse(rawValue string) error {
 	return nil
 }

+// ParseProxy parses a raw proxy URL string into a Proxy.
+// It can return the following errors:
+//   - ProxyParseError
 func ParseProxy(rawValue string) (*Proxy, error) {
 	urlParsed, err := url.Parse(rawValue)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse proxy URL: %w", err)
+		return nil, NewProxyParseError(err)
 	}

 	proxyParsed := Proxy(*urlParsed)
@@ -0,0 +1,44 @@
+{ lib
+, buildGoModule
+, go_1_26
+, rev ? "unknown"
+, buildDate ? "unknown"
+}:
+
+(buildGoModule.override { go = go_1_26; }) (finalAttrs: {
+  pname = "sarin";
+  version = "1.4.2"; # bump per release
+
+  src = lib.cleanSource ../.;
+
+  vendorHash = "sha256-bxIJoAsrzXMeTyjIGKL0GgVddJFpieuMRsDihWw+EkM=";
+
+  subPackages = [ "cmd/cli" ];
+
+  env.CGO_ENABLED = 0; # fully static binary
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=go.aykhans.me/sarin/internal/version.Version=v${finalAttrs.version}"
+    "-X=go.aykhans.me/sarin/internal/version.GitCommit=${rev}"
+    "-X=go.aykhans.me/sarin/internal/version.BuildDate=${buildDate}"
+  ];
+
+  preBuild = ''
+    ldflags+=("-X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)'")
+  '';
+
+  # cmd/cli produces a binary named "cli"; rename it to "sarin".
+  postInstall = ''
+    mv $out/bin/cli $out/bin/sarin
+  '';
+
+  meta = {
+    description = "High-performance HTTP load testing tool built with Go and fasthttp";
+    homepage = "https://github.com/aykhans/sarin";
+    license = lib.licenses.mit;
+    mainProgram = "sarin";
+    maintainers = [ ];
+  };
+})