@wirecatch/cli 0.1.0 → 0.2.0

package/dist/wirecatch.mjs

@@ -1423,14 +1423,14 @@ var require_errors = __commonJS({
     };
     var kRequestRetryError = /* @__PURE__ */ Symbol.for("undici.error.UND_ERR_REQ_RETRY");
     var RequestRetryError = class extends UndiciError {
-      constructor(message, code, { headers, data }) {
+      constructor(message, code, { headers: headers2, data }) {
         super(message);
         this.name = "RequestRetryError";
         this.message = message || "Request retry error";
         this.code = "UND_ERR_REQ_RETRY";
         this.statusCode = code;
         this.data = data;
-        this.headers = headers;
+        this.headers = headers2;
       }
       static [Symbol.hasInstance](instance) {
         return instance && instance[kRequestRetryError] === true;
@@ -1441,14 +1441,14 @@ var require_errors = __commonJS({
     };
     var kResponseError = /* @__PURE__ */ Symbol.for("undici.error.UND_ERR_RESPONSE");
     var ResponseError = class extends UndiciError {
-      constructor(message, code, { headers, body }) {
+      constructor(message, code, { headers: headers2, body }) {
         super(message);
         this.name = "ResponseError";
         this.message = message || "Response error";
         this.code = "UND_ERR_RESPONSE";
         this.statusCode = code;
         this.body = body;
-        this.headers = headers;
+        this.headers = headers2;
       }
       static [Symbol.hasInstance](instance) {
         return instance && instance[kResponseError] === true;
@@ -1649,10 +1649,10 @@ var require_constants = __commonJS({
     Object.setPrototypeOf(headerNameLowerCasedRecord, null);
     var wellknownHeaderNameBuffers = {};
     Object.setPrototypeOf(wellknownHeaderNameBuffers, null);
-    function getHeaderNameAsBuffer(header) {
-      let buffer = wellknownHeaderNameBuffers[header];
+    function getHeaderNameAsBuffer(header2) {
+      let buffer = wellknownHeaderNameBuffers[header2];
       if (buffer === void 0) {
-        buffer = Buffer.from(header);
+        buffer = Buffer.from(header2);
       }
       return buffer;
     }
@@ -2032,14 +2032,14 @@ var require_util = __commonJS({
     function bufferToLowerCasedHeaderName(value) {
       return tree.lookup(value) ?? value.toString("latin1").toLowerCase();
     }
-    function parseHeaders(headers, obj) {
+    function parseHeaders(headers2, obj) {
       if (obj === void 0) obj = {};
-      for (let i = 0; i < headers.length; i += 2) {
-        const key = headerNameToString(headers[i]);
+      for (let i = 0; i < headers2.length; i += 2) {
+        const key = headerNameToString(headers2[i]);
         let val = obj[key];
         if (val !== void 0) {
           if (!Object.hasOwn(obj, key)) {
-            const headersValue = typeof headers[i + 1] === "string" ? headers[i + 1] : Array.isArray(headers[i + 1]) ? headers[i + 1].map((x) => x.toString("latin1")) : headers[i + 1].toString("latin1");
+            const headersValue = typeof headers2[i + 1] === "string" ? headers2[i + 1] : Array.isArray(headers2[i + 1]) ? headers2[i + 1].map((x) => x.toString("latin1")) : headers2[i + 1].toString("latin1");
             if (key === "__proto__") {
               Object.defineProperty(obj, key, {
                 value: headersValue,
@@ -2055,23 +2055,23 @@ var require_util = __commonJS({
               val = [val];
               obj[key] = val;
             }
-            val.push(headers[i + 1].toString("latin1"));
+            val.push(headers2[i + 1].toString("latin1"));
           }
         } else {
-          const headersValue = typeof headers[i + 1] === "string" ? headers[i + 1] : Array.isArray(headers[i + 1]) ? headers[i + 1].map((x) => x.toString("latin1")) : headers[i + 1].toString("latin1");
+          const headersValue = typeof headers2[i + 1] === "string" ? headers2[i + 1] : Array.isArray(headers2[i + 1]) ? headers2[i + 1].map((x) => x.toString("latin1")) : headers2[i + 1].toString("latin1");
           obj[key] = headersValue;
         }
       }
       return obj;
     }
-    function parseRawHeaders(headers) {
-      const headersLength = headers.length;
+    function parseRawHeaders(headers2) {
+      const headersLength = headers2.length;
       const ret = new Array(headersLength);
       let key;
       let val;
       for (let n = 0; n < headersLength; n += 2) {
-        key = headers[n];
-        val = headers[n + 1];
+        key = headers2[n];
+        val = headers2[n + 1];
         typeof key !== "string" && (key = key.toString());
         typeof val !== "string" && (val = val.toString("latin1"));
         ret[n] = key;
@@ -2079,9 +2079,9 @@ var require_util = __commonJS({
       }
       return ret;
     }
-    function toRawHeaders(headers) {
+    function toRawHeaders(headers2) {
       const rawHeaders = [];
-      for (const [name, value] of Object.entries(headers)) {
+      for (const [name, value] of Object.entries(headers2)) {
         if (Array.isArray(value)) {
           for (const entry of value) {
             rawHeaders.push(Buffer.from(name, "latin1"), Buffer.from(`${entry}`, "latin1"));
@@ -2092,11 +2092,11 @@ var require_util = __commonJS({
       }
       return rawHeaders;
     }
-    function encodeRawHeaders(headers) {
-      if (!Array.isArray(headers)) {
+    function encodeRawHeaders(headers2) {
+      if (!Array.isArray(headers2)) {
         throw new TypeError("expected headers to be an array");
       }
-      return headers.map((x) => Buffer.from(x));
+      return headers2.map((x) => Buffer.from(x));
     }
     function isBuffer(buffer) {
       return buffer instanceof Uint8Array || Buffer.isBuffer(buffer);
@@ -2943,7 +2943,7 @@ var require_request = __commonJS({
         path,
         method,
         body,
-        headers,
+        headers: headers2,
         query,
         idempotent,
         blocking,
@@ -3047,28 +3047,28 @@ var require_request = __commonJS({
         this.contentType = null;
         this.headers = [];
         this.expectContinue = expectContinue != null ? expectContinue : false;
-        if (Array.isArray(headers)) {
-          if (headers.length % 2 !== 0) {
+        if (Array.isArray(headers2)) {
+          if (headers2.length % 2 !== 0) {
             throw new InvalidArgumentError("headers array must be even");
           }
-          for (let i = 0; i < headers.length; i += 2) {
-            processHeader(this, headers[i], headers[i + 1]);
+          for (let i = 0; i < headers2.length; i += 2) {
+            processHeader(this, headers2[i], headers2[i + 1]);
           }
-        } else if (headers && typeof headers === "object") {
-          if (hasSafeIterator(headers)) {
-            for (const header of headers) {
-              if (!Array.isArray(header) || header.length !== 2) {
+        } else if (headers2 && typeof headers2 === "object") {
+          if (hasSafeIterator(headers2)) {
+            for (const header2 of headers2) {
+              if (!Array.isArray(header2) || header2.length !== 2) {
                 throw new InvalidArgumentError("headers must be in key-value pair format");
               }
-              processHeader(this, header[0], header[1]);
+              processHeader(this, header2[0], header2[1]);
             }
           } else {
-            const keys = Object.keys(headers);
+            const keys = Object.keys(headers2);
             for (let i = 0; i < keys.length; ++i) {
-              processHeader(this, keys[i], headers[keys[i]]);
+              processHeader(this, keys[i], headers2[keys[i]]);
             }
           }
-        } else if (headers != null) {
+        } else if (headers2 != null) {
           throw new InvalidArgumentError("headers must be an object or an array");
         }
         assertRequestHandler(handler, method, upgrade);
@@ -3115,14 +3115,14 @@ var require_request = __commonJS({
       onResponseStarted() {
         return this[kHandler].onResponseStarted?.();
       }
-      onHeaders(statusCode, headers, resume, statusText) {
+      onHeaders(statusCode, headers2, resume, statusText) {
         assert(!this.aborted);
         assert(!this.completed);
         if (channels.headers.hasSubscribers) {
-          channels.headers.publish({ request: this, response: { statusCode, headers, statusText } });
+          channels.headers.publish({ request: this, response: { statusCode, headers: headers2, statusText } });
         }
         try {
-          return this[kHandler].onHeaders(statusCode, headers, resume, statusText);
+          return this[kHandler].onHeaders(statusCode, headers2, resume, statusText);
         } catch (err) {
           this.abort(err);
         }
@@ -3146,14 +3146,14 @@ var require_request = __commonJS({
        * @param {import('node:stream').Duplex} socket
        * @param {string} [statusText]
        */
-      onUpgrade(statusCode, headers, socket, statusText = "") {
+      onUpgrade(statusCode, headers2, socket, statusText = "") {
         this.onFinally();
         assert(!this.aborted);
         assert(!this.completed);
         if (channels.headers.hasSubscribers) {
-          channels.headers.publish({ request: this, response: { statusCode, headers, statusText } });
+          channels.headers.publish({ request: this, response: { statusCode, headers: headers2, statusText } });
         }
-        const result = this[kHandler].onUpgrade(statusCode, headers, socket);
+        const result = this[kHandler].onUpgrade(statusCode, headers2, socket);
         if (!this.aborted) {
           this.completed = true;
           if (channels.trailers.hasSubscribers) {
@@ -3335,16 +3335,16 @@ var require_wrap_handler = __commonJS({
       onRequestStart(controller, context) {
         this.#handler.onConnect?.((reason) => controller.abort(reason), context);
       }
-      onRequestUpgrade(controller, statusCode, headers, socket) {
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
         const rawHeaders = [];
-        for (const [key, val] of Object.entries(headers)) {
+        for (const [key, val] of Object.entries(headers2)) {
           rawHeaders.push(Buffer.from(key, "latin1"), toRawHeaderValue(val));
         }
         this.#handler.onUpgrade?.(statusCode, rawHeaders, socket);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         const rawHeaders = [];
-        for (const [key, val] of Object.entries(headers)) {
+        for (const [key, val] of Object.entries(headers2)) {
           rawHeaders.push(Buffer.from(key, "latin1"), toRawHeaderValue(val));
         }
         if (this.#handler.onHeaders?.(statusCode, rawHeaders, () => controller.resume(), statusMessage) === false) {
@@ -3568,9 +3568,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve3, reject) => {
+          return new Promise((resolve4, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve3(data);
+              return err ? reject(err) : resolve4(data);
             });
           });
         }
@@ -3608,9 +3608,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve3, reject) => {
+          return new Promise((resolve4, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve3(data);
+              return err2 ? reject(err2) : resolve4(data);
             });
           });
         }
@@ -5957,9 +5957,9 @@ var require_util2 = __commonJS({
       return "success";
     }
     function appendFetchMetadata(httpRequest) {
-      let header = null;
-      header = httpRequest.mode;
-      httpRequest.headersList.set("sec-fetch-mode", header, true);
+      let header2 = null;
+      header2 = httpRequest.mode;
+      httpRequest.headersList.set("sec-fetch-mode", header2, true);
     }
     function appendRequestOriginHeader(request2) {
       let serializedOrigin = request2.origin;
@@ -6476,11 +6476,11 @@ var require_util2 = __commonJS({
     function createInflate(zlibOptions) {
       return new InflateStream(zlibOptions);
     }
-    function extractMimeType(headers) {
+    function extractMimeType(headers2) {
       let charset = null;
       let essence = null;
       let mimeType2 = null;
-      const values = getDecodeSplit("content-type", headers);
+      const values = getDecodeSplit("content-type", headers2);
       if (values === null) {
         return "failure";
       }
@@ -7116,8 +7116,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve3, reject) => {
-        res = resolve3;
+      const promise = new Promise((resolve4, reject) => {
+        res = resolve4;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -7393,8 +7393,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       return body != null && (body.stream.locked || util.isDisturbed(body.stream));
     }
     function bodyMimeType(requestOrResponse) {
-      const headers = requestOrResponse.headersList;
-      const mimeType2 = extractMimeType(headers);
+      const headers2 = requestOrResponse.headersList;
+      const mimeType2 = extractMimeType(headers2);
       if (mimeType2 === "failure") {
         return null;
       }
@@ -7838,12 +7838,12 @@ var require_client_h1 = __commonJS({
        * @param {Buffer} head
        */
       onUpgrade(head) {
-        const { upgrade, client, socket, headers, statusCode, statusText } = this;
+        const { upgrade, client, socket, headers: headers2, statusCode, statusText } = this;
         assert(upgrade);
         assert(client[kSocket] === socket);
         assert(!socket.destroyed);
         assert(!this.paused);
-        assert((headers.length & 1) === 0);
+        assert((headers2.length & 1) === 0);
         const request2 = client[kQueue][client[kRunningIdx]];
         assert(request2);
         assert(request2.upgrade || request2.method === "CONNECT");
@@ -7863,7 +7863,7 @@ var require_client_h1 = __commonJS({
         client[kQueue][client[kRunningIdx]++] = null;
         client.emit("disconnect", client[kUrl], [client], new InformationalError("upgrade"));
         try {
-          request2.onUpgrade(statusCode, headers, socket, statusText);
+          request2.onUpgrade(statusCode, headers2, socket, statusText);
         } catch (err) {
           util.errorRequest(client, request2, err);
           util.destroy(socket, err);
@@ -7877,7 +7877,7 @@ var require_client_h1 = __commonJS({
        * @returns {number}
        */
       onHeadersComplete(statusCode, upgrade, shouldKeepAlive) {
-        const { client, socket, headers, statusText } = this;
+        const { client, socket, headers: headers2, statusText } = this;
         if (socket.destroyed) {
           return -1;
         }
@@ -7942,7 +7942,7 @@ var require_client_h1 = __commonJS({
         } else {
           socket[kReset] = true;
         }
-        const pause = request2.onHeaders(statusCode, headers, this.resume, statusText) === false;
+        const pause = request2.onHeaders(statusCode, headers2, this.resume, statusText) === false;
         if (request2.aborted) {
           return -1;
         }
@@ -7990,7 +7990,7 @@ var require_client_h1 = __commonJS({
        * @returns {number}
        */
       onMessageComplete() {
-        const { client, socket, statusCode, upgrade, headers, contentLength, bytesRead, shouldKeepAlive } = this;
+        const { client, socket, statusCode, upgrade, headers: headers2, contentLength, bytesRead, shouldKeepAlive } = this;
         if (socket.destroyed && (!statusCode || shouldKeepAlive)) {
           return -1;
         }
@@ -8016,7 +8016,7 @@ var require_client_h1 = __commonJS({
           util.destroy(socket, new ResponseContentLengthMismatchError());
           return -1;
         }
-        request2.onComplete(headers);
+        request2.onComplete(headers2);
         client[kQueue][client[kRunningIdx]++] = null;
         socket[kSocketUsed] = client[kPending] === 0;
         if (socket[kWriting]) {
@@ -8281,7 +8281,7 @@ var require_client_h1 = __commonJS({
     }
     function writeH1(client, request2) {
       const { method, path, host, upgrade, blocking, reset } = request2;
-      let { body, headers, contentLength } = request2;
+      let { body, headers: headers2, contentLength } = request2;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
         if (!extractBody) {
@@ -8289,7 +8289,7 @@ var require_client_h1 = __commonJS({
         }
         const [bodyStream, contentType] = extractBody(body);
         if (request2.contentType == null) {
-          headers.push("content-type", contentType);
+          headers2.push("content-type", contentType);
         }
         body = bodyStream.stream;
         contentLength = bodyStream.length;
@@ -8301,7 +8301,7 @@ var require_client_h1 = __commonJS({
             util.errorRequest(client, request2, new InvalidArgumentError("invalid content-type header"));
             return false;
           }
-          headers.push("content-type", contentTypeValue);
+          headers2.push("content-type", contentTypeValue);
         }
       }
       if (body && typeof body.read === "function") {
@@ -8356,64 +8356,64 @@ var require_client_h1 = __commonJS({
         socket[kBlocking] = true;
       }
       setTypeOfService(socket, request2);
-      let header = `${method} ${path} HTTP/1.1\r
+      let header2 = `${method} ${path} HTTP/1.1\r
 `;
       if (typeof host === "string") {
-        header += `host: ${host}\r
+        header2 += `host: ${host}\r
 `;
       } else {
-        header += client[kHostHeader];
+        header2 += client[kHostHeader];
       }
       if (upgrade) {
-        header += `connection: upgrade\r
+        header2 += `connection: upgrade\r
 upgrade: ${upgrade}\r
 `;
       } else if (client[kPipelining] && !socket[kReset]) {
-        header += "connection: keep-alive\r\n";
+        header2 += "connection: keep-alive\r\n";
       } else {
-        header += "connection: close\r\n";
+        header2 += "connection: close\r\n";
       }
-      if (Array.isArray(headers)) {
-        for (let n = 0; n < headers.length; n += 2) {
-          const key = headers[n + 0];
-          const val = headers[n + 1];
+      if (Array.isArray(headers2)) {
+        for (let n = 0; n < headers2.length; n += 2) {
+          const key = headers2[n + 0];
+          const val = headers2[n + 1];
           if (Array.isArray(val)) {
             for (let i = 0; i < val.length; i++) {
-              header += `${key}: ${val[i]}\r
+              header2 += `${key}: ${val[i]}\r
 `;
             }
           } else {
-            header += `${key}: ${val}\r
+            header2 += `${key}: ${val}\r
 `;
           }
         }
       }
       if (channels.sendHeaders.hasSubscribers) {
-        channels.sendHeaders.publish({ request: request2, headers: header, socket });
+        channels.sendHeaders.publish({ request: request2, headers: header2, socket });
       }
       if (!body || bodyLength === 0) {
-        writeBuffer(abort, null, client, request2, socket, contentLength, header, expectsPayload);
+        writeBuffer(abort, null, client, request2, socket, contentLength, header2, expectsPayload);
       } else if (util.isBuffer(body)) {
-        writeBuffer(abort, body, client, request2, socket, contentLength, header, expectsPayload);
+        writeBuffer(abort, body, client, request2, socket, contentLength, header2, expectsPayload);
       } else if (util.isBlobLike(body)) {
         if (typeof body.stream === "function") {
-          writeIterable(abort, body.stream(), client, request2, socket, contentLength, header, expectsPayload);
+          writeIterable(abort, body.stream(), client, request2, socket, contentLength, header2, expectsPayload);
         } else {
-          writeBlob(abort, body, client, request2, socket, contentLength, header, expectsPayload);
+          writeBlob(abort, body, client, request2, socket, contentLength, header2, expectsPayload);
         }
       } else if (util.isStream(body)) {
-        writeStream(abort, body, client, request2, socket, contentLength, header, expectsPayload);
+        writeStream(abort, body, client, request2, socket, contentLength, header2, expectsPayload);
       } else if (util.isIterable(body)) {
-        writeIterable(abort, body, client, request2, socket, contentLength, header, expectsPayload);
+        writeIterable(abort, body, client, request2, socket, contentLength, header2, expectsPayload);
       } else {
         assert(false);
       }
       return true;
     }
-    function writeStream(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
+    function writeStream(abort, body, client, request2, socket, contentLength, header2, expectsPayload) {
       assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined");
       let finished = false;
-      const writer = new AsyncWriter({ abort, socket, request: request2, contentLength, client, expectsPayload, header });
+      const writer = new AsyncWriter({ abort, socket, request: request2, contentLength, client, expectsPayload, header: header2 });
       const onData = function(chunk) {
         if (finished) {
           return;
@@ -8479,22 +8479,22 @@ upgrade: ${upgrade}\r
         setImmediate(onClose);
       }
     }
-    function writeBuffer(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
+    function writeBuffer(abort, body, client, request2, socket, contentLength, header2, expectsPayload) {
       try {
         if (!body) {
           if (contentLength === 0) {
-            socket.write(`${header}content-length: 0\r
+            socket.write(`${header2}content-length: 0\r
 \r
 `, "latin1");
           } else {
             assert(contentLength === null, "no body must not have content length");
-            socket.write(`${header}\r
+            socket.write(`${header2}\r
 `, "latin1");
           }
         } else if (util.isBuffer(body)) {
           assert(contentLength === body.byteLength, "buffer body must have content length");
           socket.cork();
-          socket.write(`${header}content-length: ${contentLength}\r
+          socket.write(`${header2}content-length: ${contentLength}\r
 \r
 `, "latin1");
           socket.write(body);
@@ -8510,7 +8510,7 @@ upgrade: ${upgrade}\r
         abort(err);
       }
     }
-    async function writeBlob(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
+    async function writeBlob(abort, body, client, request2, socket, contentLength, header2, expectsPayload) {
       assert(contentLength === body.size, "blob body must have content length");
       try {
         if (contentLength != null && contentLength !== body.size) {
@@ -8518,7 +8518,7 @@ upgrade: ${upgrade}\r
         }
         const buffer = Buffer.from(await body.arrayBuffer());
         socket.cork();
-        socket.write(`${header}content-length: ${contentLength}\r
+        socket.write(`${header2}content-length: ${contentLength}\r
 \r
 `, "latin1");
         socket.write(buffer);
@@ -8533,7 +8533,7 @@ upgrade: ${upgrade}\r
         abort(err);
       }
     }
-    async function writeIterable(abort, body, client, request2, socket, contentLength, header, expectsPayload) {
+    async function writeIterable(abort, body, client, request2, socket, contentLength, header2, expectsPayload) {
       assert(contentLength !== 0 || client[kRunning] === 0, "iterator body cannot be pipelined");
       let callback = null;
       function onDrain() {
@@ -8543,16 +8543,16 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve3, reject) => {
+      const waitForDrain = () => new Promise((resolve4, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve3;
+          callback = resolve4;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
-      const writer = new AsyncWriter({ abort, socket, request: request2, contentLength, client, expectsPayload, header });
+      const writer = new AsyncWriter({ abort, socket, request: request2, contentLength, client, expectsPayload, header: header2 });
       try {
         for await (const chunk of body) {
           if (socket[kError]) {
@@ -8581,14 +8581,14 @@ upgrade: ${upgrade}\r
        * @param {boolean} arg.expectsPayload
        * @param {string} arg.header
        */
-      constructor({ abort, socket, request: request2, contentLength, client, expectsPayload, header }) {
+      constructor({ abort, socket, request: request2, contentLength, client, expectsPayload, header: header2 }) {
         this.socket = socket;
         this.request = request2;
         this.contentLength = contentLength;
         this.client = client;
         this.bytesWritten = 0;
         this.expectsPayload = expectsPayload;
-        this.header = header;
+        this.header = header2;
         this.abort = abort;
         socket[kWriting] = true;
       }
@@ -8597,7 +8597,7 @@ upgrade: ${upgrade}\r
        * @returns
        */
       write(chunk) {
-        const { socket, request: request2, contentLength, client, bytesWritten, expectsPayload, header } = this;
+        const { socket, request: request2, contentLength, client, bytesWritten, expectsPayload, header: header2 } = this;
         if (socket[kError]) {
           throw socket[kError];
         }
@@ -8620,10 +8620,10 @@ upgrade: ${upgrade}\r
             socket[kReset] = true;
           }
           if (contentLength === null) {
-            socket.write(`${header}transfer-encoding: chunked\r
+            socket.write(`${header2}transfer-encoding: chunked\r
 `, "latin1");
           } else {
-            socket.write(`${header}content-length: ${contentLength}\r
+            socket.write(`${header2}content-length: ${contentLength}\r
 \r
 `, "latin1");
           }
@@ -8650,7 +8650,7 @@ ${len.toString(16)}\r
        * @returns {void}
        */
       end() {
-        const { socket, contentLength, client, bytesWritten, expectsPayload, header, request: request2 } = this;
+        const { socket, contentLength, client, bytesWritten, expectsPayload, header: header2, request: request2 } = this;
         request2.onRequestSent();
         socket[kWriting] = false;
         if (socket[kError]) {
@@ -8661,11 +8661,11 @@ ${len.toString(16)}\r
         }
         if (bytesWritten === 0) {
           if (expectsPayload) {
-            socket.write(`${header}content-length: 0\r
+            socket.write(`${header2}content-length: 0\r
 \r
 `, "latin1");
           } else {
-            socket.write(`${header}\r
+            socket.write(`${header2}\r
 `, "latin1");
           }
         } else if (contentLength === null) {
@@ -8770,9 +8770,9 @@ var require_client_h2 = __commonJS({
         NGHTTP2_CANCEL
       }
     } = http2;
-    function parseH2Headers(headers) {
+    function parseH2Headers(headers2) {
       const result = [];
-      for (const [name, value] of Object.entries(headers)) {
+      for (const [name, value] of Object.entries(headers2)) {
         if (Array.isArray(value)) {
           for (const subvalue of value) {
             result.push(Buffer.from(name), Buffer.from(subvalue));
@@ -9039,36 +9039,36 @@ var require_client_h2 = __commonJS({
         util.errorRequest(client, request2, new InvalidArgumentError(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
         return false;
       }
-      const headers = {};
+      const headers2 = {};
       for (let n = 0; n < reqHeaders.length; n += 2) {
         const key = reqHeaders[n + 0];
         const val = reqHeaders[n + 1];
         if (key === "cookie") {
-          if (headers[key] != null) {
-            headers[key] = Array.isArray(headers[key]) ? (headers[key].push(val), headers[key]) : [headers[key], val];
+          if (headers2[key] != null) {
+            headers2[key] = Array.isArray(headers2[key]) ? (headers2[key].push(val), headers2[key]) : [headers2[key], val];
           } else {
-            headers[key] = val;
+            headers2[key] = val;
           }
           continue;
         }
         if (Array.isArray(val)) {
           for (let i = 0; i < val.length; i++) {
-            if (headers[key]) {
-              headers[key] += `, ${val[i]}`;
+            if (headers2[key]) {
+              headers2[key] += `, ${val[i]}`;
             } else {
-              headers[key] = val[i];
+              headers2[key] = val[i];
             }
           }
-        } else if (headers[key]) {
-          headers[key] += `, ${val}`;
+        } else if (headers2[key]) {
+          headers2[key] += `, ${val}`;
         } else {
-          headers[key] = val;
+          headers2[key] = val;
         }
       }
       let stream = null;
       const { hostname, port } = client[kUrl];
-      headers[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ""}`;
-      headers[HTTP2_HEADER_METHOD] = method;
+      headers2[HTTP2_HEADER_AUTHORITY] = host || `${hostname}${port ? `:${port}` : ""}`;
+      headers2[HTTP2_HEADER_METHOD] = method;
       const abort = (err) => {
         if (request2.aborted || request2.completed) {
           return;
@@ -9100,19 +9100,19 @@ var require_client_h2 = __commonJS({
             session.unref();
             return false;
           }
-          headers[HTTP2_HEADER_METHOD] = "CONNECT";
-          headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path;
+          headers2[HTTP2_HEADER_METHOD] = "CONNECT";
+          headers2[HTTP2_HEADER_PROTOCOL] = "websocket";
+          headers2[HTTP2_HEADER_PATH] = path;
           if (protocol === "ws:" || protocol === "wss:") {
-            headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
+            headers2[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
-            headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
+            headers2[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
           }
-          stream = session.request(headers, { endStream: false, signal });
+          stream = session.request(headers2, { endStream: false, signal });
           stream[kHTTP2Stream] = true;
           ++session[kOpenStreams];
-          stream.once("response", (headers2, _flags) => {
-            const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers2;
+          stream.once("response", (headers3, _flags) => {
+            const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers3;
             try {
               request2.onUpgrade(statusCode, parseH2Headers(realHeaders), stream);
             } catch (err) {
@@ -9133,11 +9133,11 @@ var require_client_h2 = __commonJS({
           stream.setTimeout(headersTimeout);
           return true;
         }
-        stream = session.request(headers, { endStream: false, signal });
+        stream = session.request(headers2, { endStream: false, signal });
         stream[kHTTP2Stream] = true;
         ++session[kOpenStreams];
-        stream.on("response", (headers2) => {
-          const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers2;
+        stream.on("response", (headers3) => {
+          const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers3;
           try {
             request2.onUpgrade(statusCode, parseH2Headers(realHeaders), stream);
           } catch (err) {
@@ -9154,8 +9154,8 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path;
-      headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
+      headers2[HTTP2_HEADER_PATH] = path;
+      headers2[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -9164,7 +9164,7 @@ var require_client_h2 = __commonJS({
       if (util.isFormDataLike(body)) {
         extractBody ??= require_body().extractBody;
         const [bodyStream, contentType] = extractBody(body);
-        headers["content-type"] = contentType;
+        headers2["content-type"] = contentType;
         body = bodyStream.stream;
         contentLength = bodyStream.length;
       }
@@ -9183,25 +9183,25 @@ var require_client_h2 = __commonJS({
       }
       if (contentLength != null) {
         assert(body || contentLength === 0, "no body must not have content length");
-        headers[HTTP2_HEADER_CONTENT_LENGTH] = `${contentLength}`;
+        headers2[HTTP2_HEADER_CONTENT_LENGTH] = `${contentLength}`;
       }
       session.ref();
       if (channels.sendHeaders.hasSubscribers) {
-        let header = "";
-        for (const key in headers) {
-          header += `${key}: ${headers[key]}\r
+        let header2 = "";
+        for (const key in headers2) {
+          header2 += `${key}: ${headers2[key]}\r
 `;
         }
-        channels.sendHeaders.publish({ request: request2, headers: header, socket: session[kSocket] });
+        channels.sendHeaders.publish({ request: request2, headers: header2, socket: session[kSocket] });
       }
       const shouldEndStream = method === "GET" || method === "HEAD" || body === null;
       if (expectContinue) {
-        headers[HTTP2_HEADER_EXPECT] = "100-continue";
-        stream = session.request(headers, { endStream: shouldEndStream, signal });
+        headers2[HTTP2_HEADER_EXPECT] = "100-continue";
+        stream = session.request(headers2, { endStream: shouldEndStream, signal });
         stream[kHTTP2Stream] = true;
         stream.once("continue", writeBodyH2);
       } else {
-        stream = session.request(headers, {
+        stream = session.request(headers2, {
           endStream: shouldEndStream,
           signal
         });
@@ -9211,8 +9211,8 @@ var require_client_h2 = __commonJS({
       ++session[kOpenStreams];
       stream.setTimeout(headersTimeout);
       let responseReceived = false;
-      stream.once("response", (headers2) => {
-        const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers2;
+      stream.once("response", (headers3) => {
+        const { [HTTP2_HEADER_STATUS]: statusCode, ...realHeaders } = headers3;
         request2.onResponseStarted();
         responseReceived = true;
         stream.setTimeout(bodyTimeout);
@@ -9432,12 +9432,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve3, reject) => {
+      const waitForDrain = () => new Promise((resolve4, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve3;
+          callback = resolve4;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -9754,16 +9754,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve3;
+            this[kClosedResolve] = resolve4;
           } else {
-            resolve3(null);
+            resolve4(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request2 = requests[i];
@@ -9776,7 +9776,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve3(null);
+            resolve4(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -10183,8 +10183,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve3) => {
-            this[kClosedResolve] = resolve3;
+          return new Promise((resolve4) => {
+            this[kClosedResolve] = resolve4;
           });
         }
       }
@@ -11306,7 +11306,7 @@ var require_socks5_proxy_agent = __commonJS({
         const proxyHost = this[kProxyUrl].hostname;
         const proxyPort = parseInt(this[kProxyUrl].port) || 1080;
         debug("creating SOCKS5 connection to", proxyHost, proxyPort);
-        const socket = await new Promise((resolve3, reject) => {
+        const socket = await new Promise((resolve4, reject) => {
           this[kConnector]({
             hostname: proxyHost,
             host: proxyHost,
@@ -11316,7 +11316,7 @@ var require_socks5_proxy_agent = __commonJS({
             if (err) {
               reject(err);
             } else {
-              resolve3(socket2);
+              resolve4(socket2);
             }
           });
         });
@@ -11326,14 +11326,14 @@ var require_socks5_proxy_agent = __commonJS({
           socket.destroy();
         });
         await socks5Client.handshake();
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve4, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 authentication timeout"));
           }, 5e3);
           const onAuthenticated = () => {
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve3();
+            resolve4();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -11342,14 +11342,14 @@ var require_socks5_proxy_agent = __commonJS({
           };
           if (socks5Client.state === STATES.AUTHENTICATED) {
             clearTimeout(timeout);
-            resolve3();
+            resolve4();
           } else {
             socks5Client.once("authenticated", onAuthenticated);
             socks5Client.once("error", onError);
           }
         });
         await socks5Client.connect(targetHost, targetPort);
-        await new Promise((resolve3, reject) => {
+        await new Promise((resolve4, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 connection timeout"));
           }, 5e3);
@@ -11357,7 +11357,7 @@ var require_socks5_proxy_agent = __commonJS({
             debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve3();
+            resolve4();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -11400,8 +11400,8 @@ var require_socks5_proxy_agent = __commonJS({
                       socket,
                       servername: this[kRequestTls]?.servername || targetHost
                     });
-                    await new Promise((resolve3, reject) => {
-                      finalSocket.once("secureConnect", resolve3);
+                    await new Promise((resolve4, reject) => {
+                      finalSocket.once("secureConnect", resolve4);
                       finalSocket.once("error", reject);
                     });
                   }
@@ -11485,12 +11485,12 @@ var require_proxy_agent = __commonJS({
     }
     var Http1ProxyWrapper = class extends DispatcherBase {
       #client;
-      constructor(proxyUrl, { headers = {}, connect, factory }) {
+      constructor(proxyUrl, { headers: headers2 = {}, connect, factory }) {
         if (!proxyUrl) {
           throw new InvalidArgumentError("Proxy URL is mandatory");
         }
         super();
-        this[kProxyHeaders] = headers;
+        this[kProxyHeaders] = headers2;
         if (factory) {
           this.#client = factory(proxyUrl, { connect });
         } else {
@@ -11511,14 +11511,14 @@ var require_proxy_agent = __commonJS({
         const {
           origin,
           path = "/",
-          headers = {}
+          headers: headers2 = {}
         } = opts;
         opts.path = origin + path;
-        if (!("host" in headers) && !("Host" in headers)) {
+        if (!("host" in headers2) && !("Host" in headers2)) {
           const { host } = new URL(origin);
-          headers.host = host;
+          headers2.host = host;
         }
-        opts.headers = { ...this[kProxyHeaders], ...headers };
+        opts.headers = { ...this[kProxyHeaders], ...headers2 };
         return this.#client[kDispatch](opts, handler);
       }
       [kClose]() {
@@ -11644,16 +11644,16 @@ var require_proxy_agent = __commonJS({
         });
       }
       dispatch(opts, handler) {
-        const headers = buildHeaders(opts.headers);
-        throwIfProxyAuthIsSent(headers);
-        if (headers && !("host" in headers) && !("Host" in headers)) {
+        const headers2 = buildHeaders(opts.headers);
+        throwIfProxyAuthIsSent(headers2);
+        if (headers2 && !("host" in headers2) && !("Host" in headers2)) {
           const { host } = new URL(opts.origin);
-          headers.host = host;
+          headers2.host = host;
         }
         return this[kAgent].dispatch(
           {
             ...opts,
-            headers
+            headers: headers2
           },
           handler
         );
@@ -11686,18 +11686,18 @@ var require_proxy_agent = __commonJS({
         return Promise.all(promises);
       }
     };
-    function buildHeaders(headers) {
-      if (Array.isArray(headers)) {
+    function buildHeaders(headers2) {
+      if (Array.isArray(headers2)) {
         const headersPair = {};
-        for (let i = 0; i < headers.length; i += 2) {
-          headersPair[headers[i]] = headers[i + 1];
+        for (let i = 0; i < headers2.length; i += 2) {
+          headersPair[headers2[i]] = headers2[i + 1];
         }
         return headersPair;
       }
-      return headers;
+      return headers2;
     }
-    function throwIfProxyAuthIsSent(headers) {
-      const existProxyAuth = headers && Object.keys(headers).find((key) => key.toLowerCase() === "proxy-authorization");
+    function throwIfProxyAuthIsSent(headers2) {
+      const existProxyAuth = headers2 && Object.keys(headers2).find((key) => key.toLowerCase() === "proxy-authorization");
       if (existProxyAuth) {
         throw new InvalidArgumentError("Proxy-Authorization should be sent in ProxyAgent constructor");
       }
@@ -11846,8 +11846,8 @@ var require_retry_handler = __commonJS({
       const retryTime = new Date(retryAfter).getTime();
       return isNaN(retryTime) ? 0 : retryTime - Date.now();
     }
-    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
-      const contentLength = headers["content-length"];
+    function validatePartialResponseContentLength(headers2, range, statusCode, retryCount) {
+      const contentLength = headers2["content-length"];
       if (contentLength == null) {
         return;
       }
@@ -11858,7 +11858,7 @@ var require_retry_handler = __commonJS({
       const expectedLength = range.end - range.start + 1;
       if (!Number.isFinite(length) || length !== expectedLength) {
         throw new RequestRetryError("Content-Length mismatch", statusCode, {
-          headers,
+          headers: headers2,
           data: { count: retryCount }
         });
       }
@@ -11968,15 +11968,15 @@ var require_retry_handler = __commonJS({
         this.etag = null;
         this.controllerProxy = new RetryController();
       }
-      onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err) {
+      onResponseStartWithRetry(controller, statusCode, headers2, statusMessage, err) {
         if (this.retryOpts.throwOnError) {
           if (this.retryOpts.statusCodes.includes(statusCode) === false) {
             if (this.headersSent) {
               this.handler.onResponseError?.(this.controllerProxy, err);
             } else {
               this.headersSent = true;
-              this.checkpointResponseEnd(headers);
-              this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage);
+              this.checkpointResponseEnd(headers2);
+              this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers2, statusMessage);
             }
           } else {
             this.error = err;
@@ -11985,8 +11985,8 @@ var require_retry_handler = __commonJS({
         }
         if (isDisturbed(this.opts.body)) {
           this.headersSent = true;
-          this.checkpointResponseEnd(headers);
-          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage);
+          this.checkpointResponseEnd(headers2);
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers2, statusMessage);
           return;
         }
         function shouldRetry(passedErr) {
@@ -11995,8 +11995,8 @@ var require_retry_handler = __commonJS({
               this.handler.onResponseError?.(this.controllerProxy, passedErr);
             } else {
               this.headersSent = true;
-              this.checkpointResponseEnd(headers);
-              this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage);
+              this.checkpointResponseEnd(headers2);
+              this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers2, statusMessage);
             }
             controller.resume();
             return;
@@ -12014,9 +12014,9 @@ var require_retry_handler = __commonJS({
           shouldRetry.bind(this)
         );
       }
-      checkpointResponseEnd(headers) {
+      checkpointResponseEnd(headers2) {
         if (this.end == null && this.opts.method !== "HEAD") {
-          const contentLength = headers["content-length"];
+          const contentLength = headers2["content-length"];
           this.end = contentLength != null ? Number(contentLength) - 1 : null;
           assert(
             this.end == null || Number.isFinite(this.end),
@@ -12031,11 +12031,11 @@ var require_retry_handler = __commonJS({
           this.handler.onRequestStart?.(this.controllerProxy, context);
         }
       }
-      onRequestUpgrade(_controller, statusCode, headers, socket) {
-        this.handler.onRequestUpgrade?.(this.controllerProxy, statusCode, headers, socket);
+      onRequestUpgrade(_controller, statusCode, headers2, socket) {
+        this.handler.onRequestUpgrade?.(this.controllerProxy, statusCode, headers2, socket);
       }
       static [kRetryHandlerDefaultRetry](err, { state, opts }, cb) {
-        const { statusCode, code, headers } = err;
+        const { statusCode, code, headers: headers2 } = err;
         const { method, retryOptions } = opts;
         const {
           maxRetries,
@@ -12063,52 +12063,52 @@ var require_retry_handler = __commonJS({
           cb(err);
           return;
         }
-        let retryAfterHeader = headers?.["retry-after"];
+        let retryAfterHeader = headers2?.["retry-after"];
         if (retryAfterHeader) {
           retryAfterHeader = Number(retryAfterHeader);
-          retryAfterHeader = Number.isNaN(retryAfterHeader) ? calculateRetryAfterHeader(headers["retry-after"]) : retryAfterHeader * 1e3;
+          retryAfterHeader = Number.isNaN(retryAfterHeader) ? calculateRetryAfterHeader(headers2["retry-after"]) : retryAfterHeader * 1e3;
         }
         const retryTimeout = retryAfterHeader > 0 ? Math.min(retryAfterHeader, maxTimeout) : Math.min(minTimeout * timeoutFactor ** (counter2 - 1), maxTimeout);
         setTimeout(() => cb(null), retryTimeout);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         this.error = null;
         this.retryCount += 1;
         if (statusCode >= 300) {
           const err = new RequestRetryError("Request failed", statusCode, {
-            headers,
+            headers: headers2,
             data: {
               count: this.retryCount
             }
           });
-          this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err);
+          this.onResponseStartWithRetry(controller, statusCode, headers2, statusMessage, err);
           return;
         }
         if (this.headersSent) {
           if (statusCode !== 206 && (this.start > 0 || statusCode !== 200)) {
             throw new RequestRetryError("server does not support the range header and the payload was partially consumed", statusCode, {
-              headers,
+              headers: headers2,
               data: { count: this.retryCount }
             });
           }
-          const contentRange = parseRangeHeader(headers["content-range"]);
+          const contentRange = parseRangeHeader(headers2["content-range"]);
           if (!contentRange) {
             throw new RequestRetryError("Content-Range mismatch", statusCode, {
-              headers,
+              headers: headers2,
               data: { count: this.retryCount }
             });
           }
-          if (this.etag != null && this.etag !== headers.etag) {
+          if (this.etag != null && this.etag !== headers2.etag) {
             throw new RequestRetryError("ETag mismatch", statusCode, {
-              headers,
+              headers: headers2,
               data: { count: this.retryCount }
             });
           }
-          validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+          validatePartialResponseContentLength(headers2, contentRange, statusCode, this.retryCount);
           const { start, size, end = size ? size - 1 : null } = contentRange;
           if (this.start !== start || this.end != null && this.end !== end) {
             throw new RequestRetryError("Content-Range mismatch", statusCode, {
-              headers,
+              headers: headers2,
               data: { count: this.retryCount }
             });
           }
@@ -12116,18 +12116,18 @@ var require_retry_handler = __commonJS({
         }
         if (this.end == null) {
           if (statusCode === 206) {
-            const range = parseRangeHeader(headers["content-range"]);
+            const range = parseRangeHeader(headers2["content-range"]);
             if (range == null) {
               this.headersSent = true;
               this.handler.onResponseStart?.(
                 this.controllerProxy,
                 statusCode,
-                headers,
+                headers2,
                 statusMessage
               );
               return;
             }
-            validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
+            validatePartialResponseContentLength(headers2, range, statusCode, this.retryCount);
             const { start, size, end = size ? size - 1 : null } = range;
             assert(
               start != null && Number.isFinite(start),
@@ -12138,7 +12138,7 @@ var require_retry_handler = __commonJS({
             this.end = end;
           }
           if (this.end == null) {
-            const contentLength = headers["content-length"];
+            const contentLength = headers2["content-length"];
             this.end = contentLength != null ? Number(contentLength) - 1 : null;
           }
           assert(Number.isFinite(this.start));
@@ -12147,7 +12147,7 @@ var require_retry_handler = __commonJS({
             "invalid content-length"
           );
           this.resume = true;
-          this.etag = headers.etag != null ? headers.etag : null;
+          this.etag = headers2.etag != null ? headers2.etag : null;
           if (this.etag != null && this.etag[0] === "W" && this.etag[1] === "/") {
             this.etag = null;
           }
@@ -12155,12 +12155,12 @@ var require_retry_handler = __commonJS({
           this.handler.onResponseStart?.(
             this.controllerProxy,
             statusCode,
-            headers,
+            headers2,
             statusMessage
           );
         } else {
           throw new RequestRetryError("Request failed", statusCode, {
-            headers,
+            headers: headers2,
             data: { count: this.retryCount }
           });
         }
@@ -12184,15 +12184,15 @@ var require_retry_handler = __commonJS({
       }
       retry() {
         if (this.start !== 0) {
-          const headers = { range: `bytes=${this.start}-${this.end ?? ""}` };
+          const headers2 = { range: `bytes=${this.start}-${this.end ?? ""}` };
           if (this.etag != null) {
-            headers["if-match"] = this.etag;
+            headers2["if-match"] = this.etag;
           }
           this.opts = {
             ...this.opts,
             headers: {
               ...this.opts.headers,
-              ...headers
+              ...headers2
             }
           };
         }
@@ -12534,7 +12534,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -12548,11 +12548,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve3(null);
+                resolve4(null);
               }
             });
           } else {
-            this.on("close", resolve3);
+            this.on("close", resolve4);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -12580,7 +12580,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve4, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -12595,7 +12595,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve3,
+              resolve: resolve4,
               reject,
               length: 0,
               body: []
@@ -12669,18 +12669,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve: resolve3, stream, length } = consume2;
+      const { type, body, resolve: resolve4, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve3(chunksDecode(body, length, encoding));
+          resolve4(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve3(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve4(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve3(chunksConcat(body, length).buffer);
+          resolve4(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve3(new Blob(body, { type: stream[kContentType] }));
+          resolve4(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve3(chunksConcat(body, length));
+          resolve4(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -12791,14 +12791,14 @@ var require_api_request = __commonJS({
       }
       onHeaders(statusCode, rawHeaders, resume, statusMessage) {
         const { callback, opaque, abort, context, responseHeaders, highWaterMark } = this;
-        const headers = responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+        const headers2 = responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
         if (statusCode < 200) {
           if (this.onInfo) {
-            this.onInfo({ statusCode, headers });
+            this.onInfo({ statusCode, headers: headers2 });
           }
           return;
         }
-        const parsedHeaders = responseHeaders === "raw" ? util.parseHeaders(rawHeaders) : headers;
+        const parsedHeaders = responseHeaders === "raw" ? util.parseHeaders(rawHeaders) : headers2;
         const contentType = parsedHeaders["content-type"];
         const contentLength = parsedHeaders["content-length"];
         const res = new Readable({
@@ -12819,7 +12819,7 @@ var require_api_request = __commonJS({
             this.runInAsyncScope(callback, null, null, {
               statusCode,
               statusText: statusMessage,
-              headers,
+              headers: headers2,
               trailers: this.trailers,
               opaque,
               body: res,
@@ -12870,9 +12870,9 @@ var require_api_request = __commonJS({
     };
     function request2(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           request2.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve3(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -13013,10 +13013,10 @@ var require_api_stream = __commonJS({
       }
       onHeaders(statusCode, rawHeaders, resume, statusMessage) {
         const { factory, opaque, context, responseHeaders } = this;
-        const headers = responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+        const headers2 = responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
         if (statusCode < 200) {
           if (this.onInfo) {
-            this.onInfo({ statusCode, headers });
+            this.onInfo({ statusCode, headers: headers2 });
           }
           return;
         }
@@ -13026,7 +13026,7 @@ var require_api_stream = __commonJS({
         }
         const res = this.runInAsyncScope(factory, null, {
           statusCode,
-          headers,
+          headers: headers2,
           opaque,
           context
         });
@@ -13084,9 +13084,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve3(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -13236,8 +13236,8 @@ var require_api_pipeline = __commonJS({
         const { opaque, handler, context } = this;
         if (statusCode < 200) {
           if (this.onInfo) {
-            const headers = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
-            this.onInfo({ statusCode, headers });
+            const headers2 = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+            this.onInfo({ statusCode, headers: headers2 });
           }
           return;
         }
@@ -13245,10 +13245,10 @@ var require_api_pipeline = __commonJS({
         let body;
         try {
           this.handler = null;
-          const headers = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+          const headers2 = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
           body = this.runInAsyncScope(handler, null, {
             statusCode,
-            headers,
+            headers: headers2,
             opaque,
             body: this.res,
             context
@@ -13353,9 +13353,9 @@ var require_api_upgrade = __commonJS({
         const { callback, opaque, context } = this;
         removeSignal(this);
         this.callback = null;
-        const headers = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+        const headers2 = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
         this.runInAsyncScope(callback, null, null, {
-          headers,
+          headers: headers2,
           socket,
           opaque,
           context
@@ -13374,9 +13374,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve3(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -13444,13 +13444,13 @@ var require_api_connect = __commonJS({
         const { callback, opaque, context } = this;
         removeSignal(this);
         this.callback = null;
-        let headers = rawHeaders;
-        if (headers != null) {
-          headers = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
+        let headers2 = rawHeaders;
+        if (headers2 != null) {
+          headers2 = this.responseHeaders === "raw" ? util.parseRawHeaders(rawHeaders) : util.parseHeaders(rawHeaders);
         }
         this.runInAsyncScope(callback, null, null, {
           statusCode,
-          headers,
+          headers: headers2,
           socket,
           opaque,
           context
@@ -13469,9 +13469,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve3(data);
+            return err ? reject(err) : resolve4(data);
           });
         });
       }
@@ -13599,50 +13599,50 @@ var require_mock_utils = __commonJS({
       }
       return false;
     }
-    function lowerCaseEntries(headers) {
+    function lowerCaseEntries(headers2) {
       return Object.fromEntries(
-        Object.entries(headers).map(([headerName, headerValue2]) => {
+        Object.entries(headers2).map(([headerName, headerValue2]) => {
           return [headerName.toLocaleLowerCase(), headerValue2];
         })
       );
     }
-    function getHeaderByName(headers, key) {
-      if (Array.isArray(headers)) {
-        for (let i = 0; i < headers.length; i += 2) {
-          if (headers[i].toLocaleLowerCase() === key.toLocaleLowerCase()) {
-            return headers[i + 1];
+    function getHeaderByName(headers2, key) {
+      if (Array.isArray(headers2)) {
+        for (let i = 0; i < headers2.length; i += 2) {
+          if (headers2[i].toLocaleLowerCase() === key.toLocaleLowerCase()) {
+            return headers2[i + 1];
           }
         }
         return void 0;
-      } else if (typeof headers.get === "function") {
-        return headers.get(key);
+      } else if (typeof headers2.get === "function") {
+        return headers2.get(key);
       } else {
-        return lowerCaseEntries(headers)[key.toLocaleLowerCase()];
+        return lowerCaseEntries(headers2)[key.toLocaleLowerCase()];
       }
     }
-    function buildHeadersFromArray(headers) {
-      const clone = headers.slice();
+    function buildHeadersFromArray(headers2) {
+      const clone = headers2.slice();
       const entries = [];
       for (let index = 0; index < clone.length; index += 2) {
         entries.push([clone[index], clone[index + 1]]);
       }
       return Object.fromEntries(entries);
     }
-    function matchHeaders(mockDispatch2, headers) {
+    function matchHeaders(mockDispatch2, headers2) {
       if (typeof mockDispatch2.headers === "function") {
-        if (Array.isArray(headers)) {
-          headers = buildHeadersFromArray(headers);
+        if (Array.isArray(headers2)) {
+          headers2 = buildHeadersFromArray(headers2);
         }
-        return mockDispatch2.headers(headers ? lowerCaseEntries(headers) : {});
+        return mockDispatch2.headers(headers2 ? lowerCaseEntries(headers2) : {});
       }
       if (typeof mockDispatch2.headers === "undefined") {
         return true;
       }
-      if (typeof headers !== "object" || typeof mockDispatch2.headers !== "object") {
+      if (typeof headers2 !== "object" || typeof mockDispatch2.headers !== "object") {
         return false;
       }
       for (const [matchHeaderName, matchHeaderValue] of Object.entries(mockDispatch2.headers)) {
-        const headerValue2 = getHeaderByName(headers, matchHeaderName);
+        const headerValue2 = getHeaderByName(headers2, matchHeaderName);
         if (!matchValue(matchHeaderValue, headerValue2)) {
           return false;
         }
@@ -13685,11 +13685,11 @@ var require_mock_utils = __commonJS({
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path, method, body, headers }) {
+    function matchKey(mockDispatch2, { path, method, body, headers: headers2 }) {
       const pathMatch2 = matchValue(mockDispatch2.path, path);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
-      const headersMatch = matchHeaders(mockDispatch2, headers);
+      const headersMatch = matchHeaders(mockDispatch2, headers2);
       return pathMatch2 && methodMatch && bodyMatch && headersMatch;
     }
     function getResponseData(data) {
@@ -13727,8 +13727,8 @@ var require_mock_utils = __commonJS({
       }
       matchedMockDispatches = matchedMockDispatches.filter((mockDispatch2) => matchHeaders(mockDispatch2, key.headers));
       if (matchedMockDispatches.length === 0) {
-        const headers = typeof key.headers === "object" ? JSON.stringify(key.headers) : key.headers;
-        throw new MockNotMatchedError(`Mock dispatch not matched for headers '${headers}' on path '${resolvedPath}'`);
+        const headers2 = typeof key.headers === "object" ? JSON.stringify(key.headers) : key.headers;
+        throw new MockNotMatchedError(`Mock dispatch not matched for headers '${headers2}' on path '${resolvedPath}'`);
       }
       return matchedMockDispatches[0];
     }
@@ -13761,12 +13761,12 @@ var require_mock_utils = __commonJS({
       return path;
     }
     function buildKey(opts) {
-      const { path, method, body, headers, query } = opts;
+      const { path, method, body, headers: headers2, query } = opts;
       return {
         path,
         method,
         body,
-        headers,
+        headers: headers2,
         query
       };
     }
@@ -13804,7 +13804,7 @@ var require_mock_utils = __commonJS({
       if (mockDispatch2.data.callback) {
         mockDispatch2.data = { ...mockDispatch2.data, ...mockDispatch2.data.callback(opts) };
       }
-      const { data: { statusCode, data, headers, trailers, error }, delay, persist } = mockDispatch2;
+      const { data: { statusCode, data, headers: headers2, trailers, error }, delay, persist } = mockDispatch2;
       const { timesInvoked, times } = mockDispatch2;
       mockDispatch2.consumed = !persist && timesInvoked >= times;
       mockDispatch2.pending = timesInvoked < times;
@@ -13848,7 +13848,7 @@ var require_mock_utils = __commonJS({
           return;
         }
         const responseData = getResponseData(body);
-        const responseHeaders = generateKeyValues(headers);
+        const responseHeaders = generateKeyValues(headers2);
         const responseTrailers = generateKeyValues(trailers);
         handler.onHeaders?.(statusCode, responseHeaders, resume, getStatusText(statusCode));
         handler.onData?.(Buffer.from(responseData));
@@ -14023,9 +14023,9 @@ var require_mock_interceptor = __commonJS({
       createMockScopeDispatchData({ statusCode, data, responseOptions }) {
         const responseData = getResponseData(data);
         const contentLength = this[kContentLength] ? { "content-length": responseData.length } : {};
-        const headers = { ...this[kDefaultHeaders], ...contentLength, ...responseOptions.headers };
+        const headers2 = { ...this[kDefaultHeaders], ...contentLength, ...responseOptions.headers };
         const trailers = { ...this[kDefaultTrailers], ...responseOptions.trailers };
-        return { statusCode, data, headers, trailers };
+        return { statusCode, data, headers: headers2, trailers };
       }
       validateReplyParameters(replyParameters) {
         if (typeof replyParameters.statusCode === "undefined") {
@@ -14077,11 +14077,11 @@ var require_mock_interceptor = __commonJS({
       /**
        * Set default reply headers on the interceptor for subsequent replies
        */
-      defaultReplyHeaders(headers) {
-        if (typeof headers === "undefined") {
+      defaultReplyHeaders(headers2) {
+        if (typeof headers2 === "undefined") {
           throw new InvalidArgumentError("headers must be defined");
         }
-        this[kDefaultHeaders] = headers;
+        this[kDefaultHeaders] = headers2;
         return this;
       }
       /**
@@ -14663,15 +14663,15 @@ var require_snapshot_utils = __commonJS({
     function createHeaderFilters(matchOptions = {}) {
       const { ignoreHeaders = [], excludeHeaders = [], matchHeaders = [], caseSensitive = false } = matchOptions;
       return {
-        ignore: new Set(ignoreHeaders.map((header) => caseSensitive ? header : header.toLowerCase())),
-        exclude: new Set(excludeHeaders.map((header) => caseSensitive ? header : header.toLowerCase())),
-        match: new Set(matchHeaders.map((header) => caseSensitive ? header : header.toLowerCase()))
+        ignore: new Set(ignoreHeaders.map((header2) => caseSensitive ? header2 : header2.toLowerCase())),
+        exclude: new Set(excludeHeaders.map((header2) => caseSensitive ? header2 : header2.toLowerCase())),
+        match: new Set(matchHeaders.map((header2) => caseSensitive ? header2 : header2.toLowerCase()))
       };
     }
     var crypto2 = runtimeFeatures.has("crypto") ? __require("node:crypto") : null;
     var hashId = crypto2?.hash ? (value) => crypto2.hash("sha256", value, "base64url") : (value) => Buffer.from(value).toString("base64url");
-    function isUndiciHeaders(headers) {
-      return Array.isArray(headers) && (headers.length & 1) === 0;
+    function isUndiciHeaders(headers2) {
+      return Array.isArray(headers2) && (headers2.length & 1) === 0;
     }
     function isUrlExcludedFactory(excludePatterns = []) {
       if (excludePatterns.length === 0) {
@@ -14696,13 +14696,13 @@ var require_snapshot_utils = __commonJS({
         return false;
       };
     }
-    function normalizeHeaders(headers) {
+    function normalizeHeaders(headers2) {
       const normalizedHeaders = {};
-      if (!headers) return normalizedHeaders;
-      if (isUndiciHeaders(headers)) {
-        for (let i = 0; i < headers.length; i += 2) {
-          const key = headers[i];
-          const value = headers[i + 1];
+      if (!headers2) return normalizedHeaders;
+      if (isUndiciHeaders(headers2)) {
+        for (let i = 0; i < headers2.length; i += 2) {
+          const key = headers2[i];
+          const value = headers2[i + 1];
           if (key && value !== void 0) {
             const keyStr = Buffer.isBuffer(key) ? key.toString() : key;
             const valueStr = Buffer.isBuffer(value) ? value.toString() : value;
@@ -14711,8 +14711,8 @@ var require_snapshot_utils = __commonJS({
         }
         return normalizedHeaders;
       }
-      if (headers && typeof headers === "object") {
-        for (const [key, value] of Object.entries(headers)) {
+      if (headers2 && typeof headers2 === "object") {
+        for (const [key, value] of Object.entries(headers2)) {
           if (key && typeof key === "string") {
             normalizedHeaders[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : String(value);
           }
@@ -14744,8 +14744,8 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@7.30.2/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile2, readFile: readFile3, mkdir: mkdir2 } = __require("node:fs/promises");
-    var { dirname: dirname2, resolve: resolve3 } = __require("node:path");
+    var { writeFile: writeFile3, readFile: readFile3, mkdir: mkdir3 } = __require("node:fs/promises");
+    var { dirname: dirname3, resolve: resolve4 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -14762,14 +14762,14 @@ var require_snapshot_recorder = __commonJS({
         body: matchOptions.matchBody !== false && opts.body ? String(opts.body) : ""
       };
     }
-    function filterHeadersForMatching(headers, headerFilters, matchOptions = {}) {
-      if (!headers || typeof headers !== "object") return {};
+    function filterHeadersForMatching(headers2, headerFilters, matchOptions = {}) {
+      if (!headers2 || typeof headers2 !== "object") return {};
       const {
         caseSensitive = false
       } = matchOptions;
       const filtered = {};
       const { ignore, exclude, match } = headerFilters;
-      for (const [key, value] of Object.entries(headers)) {
+      for (const [key, value] of Object.entries(headers2)) {
         const headerKey = caseSensitive ? key : key.toLowerCase();
         if (exclude.has(headerKey)) continue;
         if (ignore.has(headerKey)) continue;
@@ -14780,14 +14780,14 @@ var require_snapshot_recorder = __commonJS({
       }
       return filtered;
     }
-    function filterHeadersForStorage(headers, headerFilters, matchOptions = {}) {
-      if (!headers || typeof headers !== "object") return {};
+    function filterHeadersForStorage(headers2, headerFilters, matchOptions = {}) {
+      if (!headers2 || typeof headers2 !== "object") return {};
       const {
         caseSensitive = false
       } = matchOptions;
       const filtered = {};
       const { exclude: excludeSet } = headerFilters;
-      for (const [key, value] of Object.entries(headers)) {
+      for (const [key, value] of Object.entries(headers2)) {
         const headerKey = caseSensitive ? key : key.toLowerCase();
         if (excludeSet.has(headerKey)) continue;
         filtered[headerKey] = value;
@@ -14946,7 +14946,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile3(resolve3(path), "utf8");
+          const data = await readFile3(resolve4(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -14975,13 +14975,13 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve3(path);
-        await mkdir2(dirname2(resolvedPath), { recursive: true });
+        const resolvedPath = resolve4(path);
+        await mkdir3(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
         }));
-        await writeFile2(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile3(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -15227,13 +15227,13 @@ var require_snapshot_agent = __commonJS({
           onRequestStart(controller, context) {
             return handler.onRequestStart(controller, { ...context, history: this.history });
           },
-          onRequestUpgrade(controller, statusCode, headers, socket) {
-            return handler.onRequestUpgrade(controller, statusCode, headers, socket);
+          onRequestUpgrade(controller, statusCode, headers2, socket) {
+            return handler.onRequestUpgrade(controller, statusCode, headers2, socket);
           },
-          onResponseStart(controller, statusCode, headers, statusMessage) {
+          onResponseStart(controller, statusCode, headers2, statusMessage) {
             responseData.statusCode = statusCode;
-            responseData.headers = headers;
-            return handler.onResponseStart(controller, statusCode, headers, statusMessage);
+            responseData.headers = headers2;
+            return handler.onResponseStart(controller, statusCode, headers2, statusMessage);
           },
           onResponseData(controller, chunk) {
             responseData.body.push(chunk);
@@ -15581,10 +15581,10 @@ var require_redirect_handler = __commonJS({
       onRequestStart(controller, context) {
         this.handler.onRequestStart?.(controller, { ...context, history: this.history });
       }
-      onRequestUpgrade(controller, statusCode, headers, socket) {
-        this.handler.onRequestUpgrade?.(controller, statusCode, headers, socket);
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
+        this.handler.onRequestUpgrade?.(controller, statusCode, headers2, socket);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         if (this.opts.throwOnMaxRedirect && this.history.length >= this.maxRedirections) {
           throw new Error("max redirects");
         }
@@ -15602,17 +15602,17 @@ var require_redirect_handler = __commonJS({
           }
           this.opts.body = null;
         }
-        this.location = this.history.length >= this.maxRedirections || util.isDisturbed(this.opts.body) || redirectableStatusCodes.indexOf(statusCode) === -1 ? null : headers.location;
+        this.location = this.history.length >= this.maxRedirections || util.isDisturbed(this.opts.body) || redirectableStatusCodes.indexOf(statusCode) === -1 ? null : headers2.location;
         if (this.opts.origin) {
           this.history.push(new URL(this.opts.path, this.opts.origin));
         }
         if (!this.location) {
-          this.handler.onResponseStart?.(controller, statusCode, headers, statusMessage);
+          this.handler.onResponseStart?.(controller, statusCode, headers2, statusMessage);
           return;
         }
         this.history[kRedirectCacheControl].push({
           statusCode,
-          headers: { ...headers },
+          headers: { ...headers2 },
           receivedAt: Date.now()
         });
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
@@ -15645,44 +15645,44 @@ var require_redirect_handler = __commonJS({
         this.handler.onResponseError?.(controller, error);
       }
     };
-    function shouldRemoveHeader(header, removeContent, unknownOrigin) {
-      if (header.length === 4) {
-        return util.headerNameToString(header) === "host";
+    function shouldRemoveHeader(header2, removeContent, unknownOrigin) {
+      if (header2.length === 4) {
+        return util.headerNameToString(header2) === "host";
       }
-      if (removeContent && util.headerNameToString(header).startsWith("content-")) {
+      if (removeContent && util.headerNameToString(header2).startsWith("content-")) {
         return true;
       }
-      if (unknownOrigin && (header.length === 13 || header.length === 6 || header.length === 19)) {
-        const name = util.headerNameToString(header);
+      if (unknownOrigin && (header2.length === 13 || header2.length === 6 || header2.length === 19)) {
+        const name = util.headerNameToString(header2);
         return name === "authorization" || name === "cookie" || name === "proxy-authorization";
       }
       return false;
     }
-    function cleanRequestHeaders(headers, removeContent, unknownOrigin) {
+    function cleanRequestHeaders(headers2, removeContent, unknownOrigin) {
       const ret = [];
-      if (Array.isArray(headers)) {
-        if (headers.length > 0 && Array.isArray(headers[0])) {
-          for (const [key, value] of headers) {
+      if (Array.isArray(headers2)) {
+        if (headers2.length > 0 && Array.isArray(headers2[0])) {
+          for (const [key, value] of headers2) {
             if (!shouldRemoveHeader(key, removeContent, unknownOrigin)) {
               ret.push(key, value);
             }
           }
         } else {
-          for (let i = 0; i < headers.length; i += 2) {
-            if (!shouldRemoveHeader(headers[i], removeContent, unknownOrigin)) {
-              ret.push(headers[i], headers[i + 1]);
+          for (let i = 0; i < headers2.length; i += 2) {
+            if (!shouldRemoveHeader(headers2[i], removeContent, unknownOrigin)) {
+              ret.push(headers2[i], headers2[i + 1]);
             }
           }
         }
-      } else if (headers && typeof headers === "object") {
-        const entries = util.hasSafeIterator(headers) ? headers : Object.entries(headers);
+      } else if (headers2 && typeof headers2 === "object") {
+        const entries = util.hasSafeIterator(headers2) ? headers2 : Object.entries(headers2);
         for (const [key, value] of entries) {
           if (!shouldRemoveHeader(key, removeContent, unknownOrigin)) {
             ret.push(key, value);
           }
         }
       } else {
-        assert(headers == null, "headers must be an object or an array");
+        assert(headers2 == null, "headers must be an object or an array");
       }
       return ret;
     }
@@ -15738,12 +15738,12 @@ var require_response_error = __commonJS({
         this.#body = "";
         return super.onRequestStart(controller, context);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         this.#statusCode = statusCode;
-        this.#headers = headers;
-        this.#contentType = headers["content-type"];
+        this.#headers = headers2;
+        this.#contentType = headers2["content-type"];
         if (this.#statusCode < 400) {
-          return super.onResponseStart(controller, statusCode, headers, statusMessage);
+          return super.onResponseStart(controller, statusCode, headers2, statusMessage);
         }
         if (this.#checkContentType("application/json") || this.#checkContentType("text/plain")) {
           this.#decoder = new TextDecoder("utf-8");
@@ -15845,8 +15845,8 @@ var require_dump = __commonJS({
         controller.abort = this.#abort.bind(this);
         return super.onRequestStart(controller, context);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
-        const contentLength = headers["content-length"];
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
+        const contentLength = headers2["content-length"];
         if (contentLength != null && contentLength > this.#maxSize) {
           throw new RequestAbortedError(
             `Response size (${contentLength}) larger than maxSize (${this.#maxSize})`
@@ -15855,7 +15855,7 @@ var require_dump = __commonJS({
         if (this.aborted === true) {
           return true;
         }
-        return super.onResponseStart(controller, statusCode, headers, statusMessage);
+        return super.onResponseStart(controller, statusCode, headers2, statusMessage);
       }
       onResponseError(controller, err) {
         super.onResponseError(controller, this.aborted === true ? this.reason : err);
@@ -15904,62 +15904,62 @@ var require_dns = __commonJS({
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
     var maxInt = Math.pow(2, 31) - 1;
-    function hasSafeIterator(headers) {
-      const prototype = Object.getPrototypeOf(headers);
-      const ownIterator = Object.prototype.hasOwnProperty.call(headers, Symbol.iterator);
-      return ownIterator || prototype != null && prototype !== Object.prototype && typeof headers[Symbol.iterator] === "function";
+    function hasSafeIterator(headers2) {
+      const prototype = Object.getPrototypeOf(headers2);
+      const ownIterator = Object.prototype.hasOwnProperty.call(headers2, Symbol.iterator);
+      return ownIterator || prototype != null && prototype !== Object.prototype && typeof headers2[Symbol.iterator] === "function";
     }
     function isHostHeader(key) {
       return typeof key === "string" && key.toLowerCase() === "host";
     }
-    function normalizeHeaders(headers) {
-      if (headers == null) {
+    function normalizeHeaders(headers2) {
+      if (headers2 == null) {
         return null;
       }
-      if (Array.isArray(headers)) {
-        if (headers.length === 0 || !Array.isArray(headers[0])) {
-          return headers;
+      if (Array.isArray(headers2)) {
+        if (headers2.length === 0 || !Array.isArray(headers2[0])) {
+          return headers2;
         }
         const normalized = [];
-        for (const header of headers) {
-          if (Array.isArray(header) && header.length === 2) {
-            normalized.push(header[0], header[1]);
+        for (const header2 of headers2) {
+          if (Array.isArray(header2) && header2.length === 2) {
+            normalized.push(header2[0], header2[1]);
           } else {
-            normalized.push(header);
+            normalized.push(header2);
           }
         }
         return normalized;
       }
-      if (typeof headers === "object" && hasSafeIterator(headers)) {
+      if (typeof headers2 === "object" && hasSafeIterator(headers2)) {
         const normalized = [];
-        for (const header of headers) {
-          if (Array.isArray(header) && header.length === 2) {
-            normalized.push(header[0], header[1]);
+        for (const header2 of headers2) {
+          if (Array.isArray(header2) && header2.length === 2) {
+            normalized.push(header2[0], header2[1]);
           } else {
-            normalized.push(header);
+            normalized.push(header2);
           }
         }
         return normalized;
       }
-      return headers;
+      return headers2;
     }
-    function hasHostHeader(headers) {
-      if (headers == null) {
+    function hasHostHeader(headers2) {
+      if (headers2 == null) {
         return false;
       }
-      if (Array.isArray(headers)) {
-        if (headers.length === 0) {
+      if (Array.isArray(headers2)) {
+        if (headers2.length === 0) {
           return false;
         }
-        for (let i = 0; i < headers.length; i += 2) {
-          if (isHostHeader(headers[i])) {
+        for (let i = 0; i < headers2.length; i += 2) {
+          if (isHostHeader(headers2[i])) {
             return true;
           }
         }
         return false;
       }
-      if (typeof headers === "object") {
-        for (const key in headers) {
+      if (typeof headers2 === "object") {
+        for (const key in headers2) {
           if (isHostHeader(key)) {
             return true;
           }
@@ -15967,8 +15967,8 @@ var require_dns = __commonJS({
       }
       return false;
     }
-    function withHostHeader(host, headers) {
-      const normalizedHeaders = normalizeHeaders(headers);
+    function withHostHeader(host, headers2) {
+      const normalizedHeaders = normalizeHeaders(headers2);
       if (hasHostHeader(normalizedHeaders)) {
         return normalizedHeaders;
       }
@@ -16471,24 +16471,24 @@ var require_cache = __commonJS({
         headers: opts.headers
       };
     }
-    function appendHeader(headers, key, val) {
+    function appendHeader(headers2, key, val) {
       const headerName = key.toLowerCase();
-      const current = headers[headerName];
+      const current = headers2[headerName];
       const values = Array.isArray(val) ? val : [val];
       if (current === void 0) {
-        headers[headerName] = Array.isArray(val) ? val.slice() : val;
+        headers2[headerName] = Array.isArray(val) ? val.slice() : val;
       } else if (Array.isArray(current)) {
         current.push(...values);
       } else {
-        headers[headerName] = [current, ...values];
+        headers2[headerName] = [current, ...values];
       }
     }
     function normalizeHeaders(opts) {
-      let headers;
+      let headers2;
       if (opts.headers == null) {
-        headers = {};
+        headers2 = {};
       } else if (typeof opts.headers === "object") {
-        headers = {};
+        headers2 = {};
         if (hasSafeIterator(opts.headers)) {
           if (Array.isArray(opts.headers)) {
             if (Array.isArray(opts.headers[0])) {
@@ -16500,7 +16500,7 @@ var require_cache = __commonJS({
                 if (typeof key !== "string" || typeof val !== "string") {
                   throw new Error("opts.headers is not a valid header map");
                 }
-                appendHeader(headers, key, val);
+                appendHeader(headers2, key, val);
               }
             } else {
               if (opts.headers.length % 2 !== 0) {
@@ -16513,9 +16513,9 @@ var require_cache = __commonJS({
                   throw new Error("opts.headers is not a valid header map");
                 }
                 if (typeof val === "string") {
-                  appendHeader(headers, key, val);
+                  appendHeader(headers2, key, val);
                 } else {
-                  appendHeader(headers, key, val.map((item) => typeof item === "string" ? item : item.toString("latin1")));
+                  appendHeader(headers2, key, val.map((item) => typeof item === "string" ? item : item.toString("latin1")));
                 }
               }
             }
@@ -16528,18 +16528,18 @@ var require_cache = __commonJS({
               if (typeof key !== "string" || typeof val !== "string") {
                 throw new Error("opts.headers is not a valid header map");
               }
-              appendHeader(headers, key, val);
+              appendHeader(headers2, key, val);
             }
           }
         } else {
           for (const key of Object.keys(opts.headers)) {
-            appendHeader(headers, key, opts.headers[key]);
+            appendHeader(headers2, key, opts.headers[key]);
           }
         }
       } else {
         throw new Error("opts.headers is not an object");
       }
-      return headers;
+      return headers2;
     }
     function assertCacheKey(key) {
       if (typeof key !== "object") {
@@ -16576,11 +16576,11 @@ var require_cache = __commonJS({
         throw new TypeError(`expected value.etag to be string, got ${typeof value.etag}`);
       }
     }
-    function parseCacheControlHeader(header) {
+    function parseCacheControlHeader(header2) {
       const output = {};
       const invalidNumericDirectives = /* @__PURE__ */ new Set();
       const invalidNoArgumentDirectives = /* @__PURE__ */ new Set();
-      const directives = splitCacheControlHeaderValue(Array.isArray(header) ? header.join(",") : header);
+      const directives = splitCacheControlHeaderValue(Array.isArray(header2) ? header2.join(",") : header2);
       for (let i = 0; i < directives.length; i++) {
         const directiveRecord = directives[i];
         const directive = directiveRecord.value.toLowerCase();
@@ -16680,11 +16680,11 @@ var require_cache = __commonJS({
                   break;
                 }
                 i = lastQuotedPart;
-                const headers = fieldList.split(",");
+                const headers2 = fieldList.split(",");
                 let validFieldNames = true;
-                for (let j = 0; j < headers.length; j++) {
-                  headers[j] = trimOWS(headers[j]);
-                  if (!isValidHTTPToken(headers[j])) {
+                for (let j = 0; j < headers2.length; j++) {
+                  headers2[j] = trimOWS(headers2[j]);
+                  if (!isValidHTTPToken(headers2[j])) {
                     validFieldNames = false;
                   }
                 }
@@ -16692,9 +16692,9 @@ var require_cache = __commonJS({
                   output[key] = true;
                 } else if (output[key] !== true) {
                   if (key in output) {
-                    output[key] = output[key].concat(headers);
+                    output[key] = output[key].concat(headers2);
                   } else {
-                    output[key] = headers;
+                    output[key] = headers2;
                   }
                 }
               } else {
@@ -16759,24 +16759,24 @@ var require_cache = __commonJS({
       }
       return false;
     }
-    function parseVaryHeader(varyHeader, headers) {
+    function parseVaryHeader(varyHeader, headers2) {
       if (hasVaryStar(varyHeader)) {
-        return headers;
+        return headers2;
       }
       const output = (
         /** @type {Record<string, string | string[] | null>} */
         {}
       );
       const varyingHeaders = splitVaryHeader(varyHeader);
-      for (const header of varyingHeaders) {
-        const trimmedHeader = trimOWS(header).toLowerCase();
+      for (const header2 of varyingHeaders) {
+        const trimmedHeader = trimOWS(header2).toLowerCase();
         if (trimmedHeader.length === 0) {
           continue;
         }
         if (!isValidHTTPToken(trimmedHeader)) {
           return void 0;
         }
-        const headerValue2 = headers[trimmedHeader];
+        const headerValue2 = headers2[trimmedHeader];
         output[trimmedHeader] = Array.isArray(headerValue2) ? headerValue2.slice() : headerValue2 ?? null;
       }
       return output;
@@ -16820,17 +16820,17 @@ var require_cache = __commonJS({
       }
     }
     function makeDeduplicationKey(cacheKey, excludeHeaders) {
-      const headers = {};
+      const headers2 = {};
       if (cacheKey.headers) {
         const sortedHeaders = Object.keys(cacheKey.headers).sort();
-        for (const header of sortedHeaders) {
-          if (excludeHeaders?.has(header.toLowerCase())) {
+        for (const header2 of sortedHeaders) {
+          if (excludeHeaders?.has(header2.toLowerCase())) {
             continue;
           }
-          headers[header] = cacheKey.headers[header];
+          headers2[header2] = cacheKey.headers[header2];
         }
       }
-      return JSON.stringify([cacheKey.origin, cacheKey.method, cacheKey.path, headers]);
+      return JSON.stringify([cacheKey.origin, cacheKey.method, cacheKey.path, headers2]);
     }
     module.exports = {
       makeCacheKey,
@@ -17474,8 +17474,8 @@ var require_cache_handler = __commonJS({
       deleteLocationTargets(store, cacheKey, resHeaders.location);
       deleteLocationTargets(store, cacheKey, resHeaders["content-location"]);
     }
-    function requestCarriesCredentials(headers) {
-      return headers != null && (Object.hasOwn(headers, "authorization") || Object.hasOwn(headers, "cookie") || Object.hasOwn(headers, "proxy-authorization"));
+    function requestCarriesCredentials(headers2) {
+      return headers2 != null && (Object.hasOwn(headers2, "authorization") || Object.hasOwn(headers2, "cookie") || Object.hasOwn(headers2, "proxy-authorization"));
     }
     var CacheHandler = class {
       /**
@@ -17536,8 +17536,8 @@ var require_cache_handler = __commonJS({
         this.#history = context?.history;
         this.#handler.onRequestStart?.(controller, context);
       }
-      onRequestUpgrade(controller, statusCode, headers, socket) {
-        this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket);
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
+        this.#handler.onRequestUpgrade?.(controller, statusCode, headers2, socket);
       }
       /**
        * @param {import('../../types/dispatcher.d.ts').default.DispatchController} controller
@@ -18343,13 +18343,13 @@ var require_cache_revalidation_handler = __commonJS({
         this.#successful = false;
         this.#context = context;
       }
-      onRequestUpgrade(controller, statusCode, headers, socket) {
-        this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket);
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
+        this.#handler.onRequestUpgrade?.(controller, statusCode, headers2, socket);
       }
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         assert(this.#callback != null);
         this.#successful = statusCode === 304 || this.#allowErrorStatusCodes && statusCode >= 500 && statusCode <= 504;
-        this.#callback(this.#successful, this.#context, statusCode, headers);
+        this.#callback(this.#successful, this.#context, statusCode, headers2);
         this.#callback = null;
         if (this.#successful) {
           return true;
@@ -18358,7 +18358,7 @@ var require_cache_revalidation_handler = __commonJS({
         this.#handler.onResponseStart?.(
           controller,
           statusCode,
-          headers,
+          headers2,
           statusMessage
         );
       }
@@ -18440,8 +18440,8 @@ var require_cache2 = __commonJS({
       }
       return false;
     }
-    function hasPragmaNoCache(headers) {
-      const pragma = headers?.pragma;
+    function hasPragmaNoCache(headers2) {
+      const pragma = headers2?.pragma;
       if (!pragma) {
         return false;
       }
@@ -18460,14 +18460,14 @@ var require_cache2 = __commonJS({
       }
       return false;
     }
-    function needsRevalidation(result, cacheControlDirectives, { headers = {} }) {
+    function needsRevalidation(result, cacheControlDirectives, { headers: headers2 = {} }) {
       if (cacheControlDirectives?.["no-cache"]) {
         return true;
       }
       if (result.cacheControlDirectives?.["no-cache"] && !Array.isArray(result.cacheControlDirectives["no-cache"])) {
         return true;
       }
-      if (headers["if-modified-since"] || headers["if-none-match"]) {
+      if (headers2["if-modified-since"] || headers2["if-none-match"]) {
         return true;
       }
       return false;
@@ -18477,19 +18477,19 @@ var require_cache2 = __commonJS({
       // s-maxage implies proxy-revalidate for shared caches.
       result.cacheControlDirectives?.["s-maxage"] !== void 0);
     }
-    function revalidationResponseDisallowsCachedReuse(cacheType, headers) {
-      if (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary) || cacheType === "shared" && Object.hasOwn(headers, "set-cookie")) {
+    function revalidationResponseDisallowsCachedReuse(cacheType, headers2) {
+      if (headers2.vary && isInvalidOrWildcardVaryHeader(headers2.vary) || cacheType === "shared" && Object.hasOwn(headers2, "set-cookie")) {
         return true;
       }
-      const cacheControl = headers["cache-control"];
+      const cacheControl = headers2["cache-control"];
       if (!cacheControl) {
         return false;
       }
       const cacheControlDirectives = parseCacheControlHeader(cacheControl);
       return cacheControlDirectives["no-store"] === true || cacheType === "shared" && cacheControlDirectives.private === true;
     }
-    function revalidationResponseUpdatesCacheControl(headers) {
-      return headers["cache-control"] !== void 0;
+    function revalidationResponseUpdatesCacheControl(headers2) {
+      return headers2["cache-control"] !== void 0;
     }
     function revalidationResponseAddsVary(result, varyDirectives) {
       if (!varyDirectives) {
@@ -18508,28 +18508,28 @@ var require_cache2 = __commonJS({
       } catch {
       }
     }
-    function getUsableLastModified(headers) {
-      const lastModified = headers?.["last-modified"];
+    function getUsableLastModified(headers2) {
+      const lastModified = headers2?.["last-modified"];
       if (typeof lastModified === "string" && parseHttpDate(lastModified)) {
         return lastModified;
       }
     }
     function makeRevalidationHeaders(opts, result) {
-      const headers = {
+      const headers2 = {
         ...opts.headers,
         "if-modified-since": getUsableLastModified(result.headers) ?? new Date(result.cachedAt).toUTCString()
       };
       if (result.etag) {
-        headers["if-none-match"] = result.etag;
+        headers2["if-none-match"] = result.etag;
       }
       if (result.vary) {
         for (const key in result.vary) {
           if (result.vary[key] != null) {
-            headers[key] = result.vary[key];
+            headers2[key] = result.vary[key];
           }
         }
       }
-      return headers;
+      return headers2;
     }
     function revalidationTargetMatchesCacheKey(cacheKey, context) {
       const history = context?.history;
@@ -18544,11 +18544,11 @@ var require_cache2 = __commonJS({
         return false;
       }
     }
-    function revalidationEtagMatchesCachedValue(result, headers) {
-      if (!Object.hasOwn(headers, "etag")) {
+    function revalidationEtagMatchesCachedValue(result, headers2) {
+      if (!Object.hasOwn(headers2, "etag")) {
         return true;
       }
-      const responseEtag = headers.etag;
+      const responseEtag = headers2.etag;
       const cachedEtag = result.etag;
       if (typeof responseEtag !== "string" || typeof cachedEtag !== "string" || !isEtagUsable(responseEtag) || !isEtagUsable(cachedEtag)) {
         return false;
@@ -18660,13 +18660,13 @@ var require_cache2 = __commonJS({
       if (stream.destroyed) {
         return;
       }
-      const headers = { ...result.headers, age: String(age) };
+      const headers2 = { ...result.headers, age: String(age) };
       if (isStale2) {
-        headers.warning = '110 - "response is stale"';
+        headers2.warning = '110 - "response is stale"';
       }
-      controller.rawHeaders = util.toRawHeaders(headers);
+      controller.rawHeaders = util.toRawHeaders(headers2);
       try {
-        handler.onResponseStart?.(controller, result.statusCode, headers, result.statusMessage);
+        handler.onResponseStart?.(controller, result.statusCode, headers2, result.statusMessage);
       } catch (err) {
         stream.destroy(err);
         return;
@@ -18709,11 +18709,11 @@ var require_cache2 = __commonJS({
         if (!revalidate && withinStaleWhileRevalidateWindow(result, globalOpts.type)) {
           sendCachedValue(handler, opts, result, age, null, true);
           queueMicrotask(() => {
-            const headers2 = makeRevalidationHeaders(opts, result);
+            const headers3 = makeRevalidationHeaders(opts, result);
             dispatch(
               {
                 ...opts,
-                headers: headers2
+                headers: headers3
               },
               new CacheHandler(globalOpts, cacheKey, {
                 // Silent handler that just updates the cache
@@ -18741,7 +18741,7 @@ var require_cache2 = __commonJS({
             withinStaleIfErrorThreshold = now < result.staleAt + staleIfErrorExpiry * 1e3;
           }
         }
-        const headers = makeRevalidationHeaders(opts, result);
+        const headers2 = makeRevalidationHeaders(opts, result);
         const refetch = () => {
           if (util.isStream(result.body)) {
             result.body.on("error", nop).destroy();
@@ -18752,18 +18752,18 @@ var require_cache2 = __commonJS({
         return dispatch(
           {
             ...opts,
-            headers
+            headers: headers2
           },
           new CacheRevalidationHandler(
-            (success, context, statusCode, headers2) => {
+            (success, context, statusCode, headers3) => {
               if (success) {
                 if (statusCode === 304) {
-                  if (!revalidationTargetMatchesCacheKey(cacheKey, context) || !revalidationEtagMatchesCachedValue(result, headers2) || revalidationResponseDisallowsCachedReuse(globalOpts.type, headers2)) {
+                  if (!revalidationTargetMatchesCacheKey(cacheKey, context) || !revalidationEtagMatchesCachedValue(result, headers3) || revalidationResponseDisallowsCachedReuse(globalOpts.type, headers3)) {
                     return refetch();
                   }
-                  if (revalidationResponseUpdatesCacheControl(headers2)) {
+                  if (revalidationResponseUpdatesCacheControl(headers3)) {
                     deleteCachedValue(globalOpts.store, cacheKey);
-                  } else if (revalidationResponseAddsVary(result, headers2.vary ? parseVaryHeader(headers2.vary, opts.headers) : void 0)) {
+                  } else if (revalidationResponseAddsVary(result, headers3.vary ? parseVaryHeader(headers3.vary, opts.headers) : void 0)) {
                     return refetch();
                   }
                 }
@@ -19261,8 +19261,8 @@ var require_decompress = __commonJS({
         this.#controller.target = controller;
         return super.onRequestStart(this.#controller, context);
       }
-      onRequestUpgrade(controller, statusCode, headers, socket) {
-        return super.onRequestUpgrade(this.#controller, statusCode, headers, socket);
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
+        return super.onRequestUpgrade(this.#controller, statusCode, headers2, socket);
       }
       /**
        * @param {Controller} controller
@@ -19271,19 +19271,19 @@ var require_decompress = __commonJS({
        * @param {string} statusMessage
        * @returns {void}
        */
-      onResponseStart(controller, statusCode, headers, statusMessage) {
-        const rawContentEncoding = headers["content-encoding"];
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
+        const rawContentEncoding = headers2["content-encoding"];
         const contentEncoding = Array.isArray(rawContentEncoding) ? rawContentEncoding.join(",") : rawContentEncoding;
         if (this.#shouldSkipDecompression(contentEncoding, statusCode)) {
-          return super.onResponseStart(this.#controller, statusCode, headers, statusMessage);
+          return super.onResponseStart(this.#controller, statusCode, headers2, statusMessage);
         }
         const decompressors = this.#createDecompressionChain(contentEncoding.toLowerCase());
         if (decompressors.length === 0) {
           this.#cleanupDecompressors();
-          return super.onResponseStart(this.#controller, statusCode, headers, statusMessage);
+          return super.onResponseStart(this.#controller, statusCode, headers2, statusMessage);
         }
         this.#decompressors = decompressors;
-        const { "content-encoding": _, "content-length": __, ...newHeaders } = headers;
+        const { "content-encoding": _, "content-length": __, ...newHeaders } = headers2;
         if (this.#controller.rawHeaders) {
           const rawHeaders = this.#controller.rawHeaders;
           if (Array.isArray(rawHeaders)) {
@@ -19526,8 +19526,8 @@ var require_deduplication_handler = __commonJS({
        * @param {import('../../types/header.d.ts').IncomingHttpHeaders} headers
        * @param {Socket} socket
        */
-      onRequestUpgrade(controller, statusCode, headers, socket) {
-        this.#primaryHandler.onRequestUpgrade?.(controller, statusCode, headers, socket);
+      onRequestUpgrade(controller, statusCode, headers2, socket) {
+        this.#primaryHandler.onRequestUpgrade?.(controller, statusCode, headers2, socket);
       }
       /**
        * @param {import('../../types/dispatcher.d.ts').default.DispatchController} controller
@@ -19535,12 +19535,12 @@ var require_deduplication_handler = __commonJS({
        * @param {Record<string, string | string[]>} headers
        * @param {string} statusMessage
        */
-      onResponseStart(controller, statusCode, headers, statusMessage) {
+      onResponseStart(controller, statusCode, headers2, statusMessage) {
         this.#responseStarted = true;
         this.#statusCode = statusCode;
-        this.#headers = headers;
+        this.#headers = headers2;
         this.#statusMessage = statusMessage;
-        this.#primaryHandler.onResponseStart?.(controller, statusCode, headers, statusMessage);
+        this.#primaryHandler.onResponseStart?.(controller, statusCode, headers2, statusMessage);
         for (const waitingHandler of this.#waitingHandlers) {
           const { handler, controller: waitingController } = waitingHandler;
           if (waitingHandler.done || waitingController.aborted) {
@@ -19551,7 +19551,7 @@ var require_deduplication_handler = __commonJS({
             handler.onResponseStart?.(
               waitingController,
               statusCode,
-              headers,
+              headers2,
               statusMessage
             );
           } catch {
@@ -20170,7 +20170,7 @@ var require_sqlite_cache_store = __commonJS({
        */
       #findValue(key, canBeExpired = false) {
         const url = this.#makeValueUrl(key);
-        const { headers, method } = key;
+        const { headers: headers2, method } = key;
         const values = this.#getValuesQuery.all(url, method);
         if (values.length === 0) {
           return void 0;
@@ -20183,8 +20183,8 @@ var require_sqlite_cache_store = __commonJS({
           let matches = true;
           if (value.vary) {
             const vary = JSON.parse(value.vary);
-            for (const header in vary) {
-              if (!headerValueEquals(headers[header], vary[header])) {
+            for (const header2 in vary) {
+              if (!headerValueEquals(headers2[header2], vary[header2])) {
                 matches = false;
                 break;
               }
@@ -20244,22 +20244,22 @@ var require_headers = __commonJS({
       while (j > i && isHTTPWhiteSpaceCharCode(potentialValue.charCodeAt(i))) ++i;
       return i === 0 && j === potentialValue.length ? potentialValue : potentialValue.substring(i, j);
     }
-    function fill(headers, object) {
+    function fill(headers2, object) {
       if (Array.isArray(object)) {
         for (let i = 0; i < object.length; ++i) {
-          const header = object[i];
-          if (header.length !== 2) {
+          const header2 = object[i];
+          if (header2.length !== 2) {
             throw webidl.errors.exception({
               header: "Headers constructor",
-              message: `expected name/value pair to be length 2, found ${header.length}.`
+              message: `expected name/value pair to be length 2, found ${header2.length}.`
             });
           }
-          appendHeader(headers, header[0], header[1]);
+          appendHeader(headers2, header2[0], header2[1]);
         }
       } else if (typeof object === "object" && object !== null) {
         const keys = Object.keys(object);
         for (let i = 0; i < keys.length; ++i) {
-          appendHeader(headers, keys[i], object[keys[i]]);
+          appendHeader(headers2, keys[i], object[keys[i]]);
         }
       } else {
         throw webidl.errors.conversionFailed({
@@ -20269,7 +20269,7 @@ var require_headers = __commonJS({
         });
       }
     }
-    function appendHeader(headers, name, value) {
+    function appendHeader(headers2, name, value) {
       value = headerValueNormalize(value);
       if (!isValidHeaderName(name)) {
         throw webidl.errors.invalidArgument({
@@ -20284,10 +20284,10 @@ var require_headers = __commonJS({
           type: "header value"
         });
       }
-      if (getHeadersGuard(headers) === "immutable") {
+      if (getHeadersGuard(headers2) === "immutable") {
         throw new TypeError("immutable");
       }
-      return getHeadersList(headers).append(name, value, false);
+      return getHeadersList(headers2).append(name, value, false);
     }
     function headersListSortAndCombine(target) {
       const headersList = getHeadersList(target);
@@ -20297,7 +20297,7 @@ var require_headers = __commonJS({
       if (headersList.sortedMap) {
         return headersList.sortedMap;
       }
-      const headers = [];
+      const headers2 = [];
       const names = headersList.toSortedArray();
       const cookies = headersList.cookies;
       if (cookies === null || cookies.length === 1) {
@@ -20307,13 +20307,13 @@ var require_headers = __commonJS({
         const { 0: name, 1: value } = names[i];
         if (name === "set-cookie") {
           for (let j = 0; j < cookies.length; ++j) {
-            headers.push([name, cookies[j]]);
+            headers2.push([name, cookies[j]]);
           }
         } else {
-          headers.push([name, value]);
+          headers2.push([name, value]);
         }
       }
-      return headersList.sortedMap = headers;
+      return headersList.sortedMap = headers2;
     }
     function compareHeaderName(a, b) {
       return a[0] < b[0] ? -1 : 1;
@@ -20411,31 +20411,31 @@ var require_headers = __commonJS({
         }
       }
       get entries() {
-        const headers = {};
+        const headers2 = {};
         if (this.headersMap.size !== 0) {
           for (const { name, value } of this.headersMap.values()) {
-            headers[name] = value;
+            headers2[name] = value;
           }
         }
-        return headers;
+        return headers2;
       }
       rawValues() {
         return this.headersMap.values();
       }
       get entriesList() {
-        const headers = [];
+        const headers2 = [];
         if (this.headersMap.size !== 0) {
           for (const { 0: lowerName, 1: { name, value } } of this.headersMap) {
             if (lowerName === "set-cookie") {
               for (const cookie of this.cookies) {
-                headers.push([name, cookie]);
+                headers2.push([name, cookie]);
               }
             } else {
-              headers.push([name, value]);
+              headers2.push([name, value]);
             }
           }
         }
-        return headers;
+        return headers2;
       }
       // https://fetch.spec.whatwg.org/#convert-header-names-to-a-sorted-lowercase-set
       toSortedArray() {
@@ -21036,10 +21036,10 @@ var require_response = __commonJS({
     function fromInnerResponse(innerResponse, guard) {
       const response = new Response(kConstruct);
       setResponseState(response, innerResponse);
-      const headers = new Headers(kConstruct);
-      setResponseHeaders(response, headers);
-      setHeadersList(headers, innerResponse.headersList);
-      setHeadersGuard(headers, guard);
+      const headers2 = new Headers(kConstruct);
+      setResponseHeaders(response, headers2);
+      setHeadersList(headers2, innerResponse.headersList);
+      setHeadersGuard(headers2, guard);
       if (innerResponse.urlList.length !== 0 && innerResponse.body?.stream) {
         streamRegistry.register(response, new WeakRef(innerResponse.body.stream));
       }
@@ -21390,15 +21390,15 @@ var require_request2 = __commonJS({
         }
         if (initHasKey) {
           const headersList = getHeadersList(this.#headers);
-          const headers = init.headers !== void 0 ? init.headers : new HeadersList(headersList);
+          const headers2 = init.headers !== void 0 ? init.headers : new HeadersList(headersList);
           headersList.clear();
-          if (headers instanceof HeadersList) {
-            for (const { name, value } of headers.rawValues()) {
+          if (headers2 instanceof HeadersList) {
+            for (const { name, value } of headers2.rawValues()) {
               headersList.append(name, value, false);
             }
-            headersList.cookies = headers.cookies;
+            headersList.cookies = headers2.cookies;
           } else {
-            fillHeaders(this.#headers, headers);
+            fillHeaders(this.#headers, headers2);
           }
         }
         const inputBody = webidl.is.Request(input) ? input.#state.body : null;
@@ -21718,10 +21718,10 @@ var require_request2 = __commonJS({
       setRequestState(request2, innerRequest);
       setRequestDispatcher(request2, dispatcher);
       setRequestSignal(request2, signal);
-      const headers = new Headers(kConstruct);
-      setRequestHeaders(request2, headers);
-      setHeadersList(headers, innerRequest.headersList);
-      setHeadersGuard(headers, guard);
+      const headers2 = new Headers(kConstruct);
+      setRequestHeaders(request2, headers2);
+      setHeadersList(headers2, innerRequest.headersList);
+      setHeadersGuard(headers2, guard);
       return request2;
     }
     Object.defineProperties(Request.prototype, {
@@ -22103,7 +22103,7 @@ var require_fetch = __commonJS({
     function handleFetchDone(response) {
       finalizeAndReportTiming(response, "fetch");
     }
-    function fetch(input, init = void 0) {
+    function fetch2(input, init = void 0) {
       webidl.argumentLengthCheck(arguments, 1, "globalThis.fetch");
       let p = createDeferredPromise();
       let requestObject;
@@ -22955,7 +22955,7 @@ var require_fetch = __commonJS({
         const agent = fetchParams.controller.dispatcher;
         const path = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
-        return new Promise((resolve3, reject) => agent.dispatch(
+        return new Promise((resolve4, reject) => agent.dispatch(
           {
             path: hasTrailingQuestionMark ? `${path}?` : path,
             origin: url.origin,
@@ -23043,7 +23043,7 @@ var require_fetch = __commonJS({
               }
               this.body = new Readable({ read: resume });
               const onError = this.onError.bind(this);
-              resolve3({
+              resolve4({
                 status,
                 statusText,
                 headersList,
@@ -23078,12 +23078,12 @@ var require_fetch = __commonJS({
               fetchParams.controller.terminate(error);
               reject(error);
             },
-            onRequestUpgrade(_controller, status, headers, socket) {
+            onRequestUpgrade(_controller, status, headers2, socket) {
               if (socket.session != null && status !== 200 || socket.session == null && status !== 101) {
                 return false;
               }
               const headersList = new HeadersList();
-              for (const [name, value] of Object.entries(headers)) {
+              for (const [name, value] of Object.entries(headers2)) {
                 if (value == null) {
                   continue;
                 }
@@ -23096,7 +23096,7 @@ var require_fetch = __commonJS({
                   headersList.append(headerName, String(value), true);
                 }
               }
-              resolve3({
+              resolve4({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -23120,7 +23120,7 @@ var require_fetch = __commonJS({
                   headersList.append(nameStr, value.toString("latin1"), true);
                 }
               }
-              resolve3({
+              resolve4({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -23133,7 +23133,7 @@ var require_fetch = __commonJS({
       }
     }
     module.exports = {
-      fetch,
+      fetch: fetch2,
       Fetch,
       fetching,
       finalizeAndReportTiming
@@ -23153,10 +23153,10 @@ var require_util3 = __commonJS({
       const serializedB = URLSerializer(B, excludeFragment);
       return serializedA === serializedB;
     }
-    function getFieldValues(header) {
-      assert(header !== null);
+    function getFieldValues(header2) {
+      assert(header2 !== null);
       const values = [];
-      for (let value of header.split(",")) {
+      for (let value of header2.split(",")) {
         value = value.trim();
         if (isValidHeaderName(value)) {
           values.push(value);
@@ -24063,20 +24063,20 @@ var require_parse = __commonJS({
     var { maxNameValuePairSize, maxAttributeValueSize } = require_constants4();
     var { isCTLExcludingHtab } = require_util4();
     var assert = __require("node:assert");
-    function parseSetCookie2(header) {
-      if (isCTLExcludingHtab(header)) {
+    function parseSetCookie2(header2) {
+      if (isCTLExcludingHtab(header2)) {
         return null;
       }
       let nameValuePair = "";
       let unparsedAttributes = "";
       let name = "";
       let value = "";
-      if (header.includes(";")) {
+      if (header2.includes(";")) {
         const position = { position: 0 };
-        nameValuePair = collectASequenceOfCodePointsFast(";", header, position);
-        unparsedAttributes = header.slice(position.position);
+        nameValuePair = collectASequenceOfCodePointsFast(";", header2, position);
+        unparsedAttributes = header2.slice(position.position);
       } else {
-        nameValuePair = header;
+        nameValuePair = header2;
       }
       if (!nameValuePair.includes("=")) {
         value = nameValuePair;
@@ -24201,10 +24201,10 @@ var require_cookies = __commonJS({
     var { webidl } = require_webidl();
     var { Headers } = require_headers();
     var brandChecks = webidl.brandCheckMultiple([Headers, globalThis.Headers].filter(Boolean));
-    function getCookies(headers) {
+    function getCookies(headers2) {
       webidl.argumentLengthCheck(arguments, 1, "getCookies");
-      brandChecks(headers);
-      const cookie = headers.get("cookie");
+      brandChecks(headers2);
+      const cookie = headers2.get("cookie");
       const out = { __proto__: null };
       if (!cookie) {
         return out;
@@ -24215,23 +24215,23 @@ var require_cookies = __commonJS({
       }
       return out;
     }
-    function deleteCookie(headers, name, attributes) {
-      brandChecks(headers);
+    function deleteCookie(headers2, name, attributes) {
+      brandChecks(headers2);
       const prefix = "deleteCookie";
       webidl.argumentLengthCheck(arguments, 2, prefix);
       name = webidl.converters.DOMString(name, prefix, "name");
       attributes = webidl.converters.DeleteCookieAttributes(attributes);
-      setCookie(headers, {
+      setCookie(headers2, {
         name,
         value: "",
         expires: /* @__PURE__ */ new Date(0),
         ...attributes
       });
     }
-    function getSetCookies(headers) {
+    function getSetCookies(headers2) {
       webidl.argumentLengthCheck(arguments, 1, "getSetCookies");
-      brandChecks(headers);
-      const cookies = headers.getSetCookie();
+      brandChecks(headers2);
+      const cookies = headers2.getSetCookie();
       if (!cookies) {
         return [];
       }
@@ -24241,13 +24241,13 @@ var require_cookies = __commonJS({
       cookie = webidl.converters.DOMString(cookie);
       return parseSetCookie2(cookie);
     }
-    function setCookie(headers, cookie) {
+    function setCookie(headers2, cookie) {
       webidl.argumentLengthCheck(arguments, 2, "setCookie");
-      brandChecks(headers);
+      brandChecks(headers2);
       cookie = webidl.converters.Cookie(cookie);
       const str2 = stringify(cookie);
       if (str2) {
-        headers.append("set-cookie", str2, true);
+        headers2.append("set-cookie", str2, true);
       }
     }
     webidl.converters.DeleteCookieAttributes = webidl.dictionaryConverter([
@@ -25944,7 +25944,7 @@ var require_websocket = __commonJS({
         }
         fireEvent("open", this);
         if (channels.open.hasSubscribers) {
-          const headers = response.headersList.entries;
+          const headers2 = response.headersList.entries;
           channels.open.publish({
             address: getSocketAddress(response.socket),
             protocol: this.#protocol,
@@ -25953,7 +25953,7 @@ var require_websocket = __commonJS({
             handshakeResponse: {
               status: response.status,
               statusText: response.statusText,
-              headers
+              headers: headers2
             }
           });
         }
@@ -27278,7 +27278,7 @@ var require_undici = __commonJS({
     var errors = require_errors();
     var util = require_util();
     var { InvalidArgumentError } = errors;
-    var api = require_api();
+    var api2 = require_api();
     var buildConnector = require_connect();
     var MockClient = require_mock_client();
     var { MockCallHistory, MockCallHistoryLog } = require_mock_call_history();
@@ -27290,7 +27290,7 @@ var require_undici = __commonJS({
     var { getGlobalDispatcher, setGlobalDispatcher } = require_global2();
     var DecoratorHandler = require_decorator_handler();
     var RedirectHandler = require_redirect_handler();
-    Object.assign(Dispatcher.prototype, api);
+    Object.assign(Dispatcher.prototype, api2);
     module.exports.Dispatcher = Dispatcher;
     module.exports.Client = Client;
     module.exports.Pool = Pool;
@@ -27387,7 +27387,7 @@ var require_undici = __commonJS({
       err.stack = stack ? `${stack}
 ${captureLines}` : capture.stack;
     }
-    module.exports.fetch = function fetch(init, options = void 0) {
+    module.exports.fetch = function fetch2(init, options = void 0) {
       return fetchImpl(init, options).catch((err) => {
         if (currentFilename) {
           appendFetchStackTrace(err, currentFilename);
@@ -27425,11 +27425,11 @@ ${captureLines}` : capture.stack;
     module.exports.ping = ping;
     module.exports.WebSocketStream = require_websocketstream().WebSocketStream;
     module.exports.WebSocketError = require_websocketerror().WebSocketError;
-    module.exports.request = makeDispatcher(api.request);
-    module.exports.stream = makeDispatcher(api.stream);
-    module.exports.pipeline = makeDispatcher(api.pipeline);
-    module.exports.connect = makeDispatcher(api.connect);
-    module.exports.upgrade = makeDispatcher(api.upgrade);
+    module.exports.request = makeDispatcher(api2.request);
+    module.exports.stream = makeDispatcher(api2.stream);
+    module.exports.pipeline = makeDispatcher(api2.pipeline);
+    module.exports.connect = makeDispatcher(api2.connect);
+    module.exports.upgrade = makeDispatcher(api2.upgrade);
     module.exports.MockClient = MockClient;
     module.exports.MockCallHistory = MockCallHistory;
     module.exports.MockCallHistoryLog = MockCallHistoryLog;
@@ -27456,9 +27456,9 @@ ${captureLines}` : capture.stack;
 });
 
 // src/main.ts
-import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
-import { dirname, resolve as resolve2 } from "node:path";
-import { parseArgs } from "node:util";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, resolve as resolve3 } from "node:path";
+import { parseArgs as parseArgs2 } from "node:util";
 
 // ../../packages/core/src/relay.ts
 var TEXTUAL = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql|ld\+json|problem\+json|[\w.+-]+\+(json|xml)))|image\/svg\+xml/i;
@@ -27466,9 +27466,9 @@ function isTextualContentType(contentType) {
   if (!contentType) return true;
   return TEXTUAL.test(contentType.trim());
 }
-function headerValue(headers, name) {
+function headerValue(headers2, name) {
   const lower = name.toLowerCase();
-  return headers.find(([k]) => k.toLowerCase() === lower)?.[1];
+  return headers2.find(([k]) => k.toLowerCase() === lower)?.[1];
 }
 
 // ../../packages/core/src/format.ts
@@ -27528,20 +27528,20 @@ var CONTENT_TYPES = {
   xml: "application/xml",
   form: "application/x-www-form-urlencoded"
 };
-function buildSendRequest(draft, resolve3 = identity, inheritedAuth2, files) {
-  const headers = draft.headers.filter((h) => h.enabled && h.key.trim()).map((h) => [resolve3(h.key).trim(), resolve3(h.value)]);
-  const has = (name) => headers.some(([k]) => k.toLowerCase() === name.toLowerCase());
-  let url = resolve3(draft.url.trim());
+function buildSendRequest(draft, resolve4 = identity, inheritedAuth2, files) {
+  const headers2 = draft.headers.filter((h) => h.enabled && h.key.trim()).map((h) => [resolve4(h.key).trim(), resolve4(h.value)]);
+  const has = (name) => headers2.some(([k]) => k.toLowerCase() === name.toLowerCase());
+  let url = resolve4(draft.url.trim());
   if (url && !/^[a-z][a-z0-9+.-]*:\/\//i.test(url) && !url.startsWith("{{")) url = `http://${url}`;
   const auth = draft.auth.type === "inherit" ? inheritedAuth2 ?? { type: "none" } : draft.auth;
-  if (auth.type === "bearer" && auth.token && !has("authorization")) headers.push(["Authorization", `Bearer ${resolve3(auth.token)}`]);
-  if (auth.type === "basic" && !has("authorization")) headers.push(["Authorization", `Basic ${base64(`${resolve3(auth.username)}:${resolve3(auth.password)}`)}`]);
+  if (auth.type === "bearer" && auth.token && !has("authorization")) headers2.push(["Authorization", `Bearer ${resolve4(auth.token)}`]);
+  if (auth.type === "basic" && !has("authorization")) headers2.push(["Authorization", `Basic ${base64(`${resolve4(auth.username)}:${resolve4(auth.password)}`)}`]);
   if (auth.type === "oauth2" && auth.token?.accessToken && !has("authorization"))
-    headers.push(["Authorization", `${auth.headerPrefix.trim() || "Bearer"} ${auth.token.accessToken}`]);
+    headers2.push(["Authorization", `${auth.headerPrefix.trim() || "Bearer"} ${auth.token.accessToken}`]);
   if (auth.type === "apikey" && auth.key) {
     if (auth.in === "header") {
-      if (!has(auth.key)) headers.push([resolve3(auth.key), resolve3(auth.value)]);
-    } else url += `${url.includes("?") ? "&" : "?"}${encodeQuery([{ key: resolve3(auth.key), value: resolve3(auth.value) }])}`;
+      if (!has(auth.key)) headers2.push([resolve4(auth.key), resolve4(auth.value)]);
+    } else url += `${url.includes("?") ? "&" : "?"}${encodeQuery([{ key: resolve4(auth.key), value: resolve4(auth.value) }])}`;
   }
   let body;
   let bodyEncoding;
@@ -27557,36 +27557,36 @@ function buildSendRequest(draft, resolve3 = identity, inheritedAuth2, files) {
     if (f) {
       body = bytesToBase64(bytesOf(f));
       bodyEncoding = "base64";
-      if (!has("content-type")) headers.push(["Content-Type", f.type || "application/octet-stream"]);
+      if (!has("content-type")) headers2.push(["Content-Type", f.type || "application/octet-stream"]);
     }
   } else if (mode === "graphql") {
-    body = graphqlBody(resolve3(draft.body.raw), resolve3(draft.body.variables ?? ""), draft.body.operationName?.trim());
-    if (!has("content-type")) headers.push(["Content-Type", "application/json"]);
+    body = graphqlBody(resolve4(draft.body.raw), resolve4(draft.body.variables ?? ""), draft.body.operationName?.trim());
+    if (!has("content-type")) headers2.push(["Content-Type", "application/json"]);
   } else if (mode !== "none") {
     const rows2 = draft.body.form.filter((f) => f.enabled && f.key);
     if (mode === "multipart") {
       const boundary = `----wirecatch${uid("b").replace(/\W/g, "")}`;
-      const parts = rows2.map((f) => f.isFile ? f.file ? { key: resolve3(f.key), file: f.file, bytes: bytesOf(f.file) } : { key: resolve3(f.key), value: "" } : { key: resolve3(f.key), value: resolve3(f.value) });
+      const parts = rows2.map((f) => f.isFile ? f.file ? { key: resolve4(f.key), file: f.file, bytes: bytesOf(f.file) } : { key: resolve4(f.key), value: "" } : { key: resolve4(f.key), value: resolve4(f.value) });
       if (parts.some((p) => "bytes" in p)) {
         body = bytesToBase64(multipartBytes(parts, boundary));
         bodyEncoding = "base64";
       } else body = multipart(parts, boundary);
-      headers.push(["Content-Type", `multipart/form-data; boundary=${boundary}`]);
+      headers2.push(["Content-Type", `multipart/form-data; boundary=${boundary}`]);
     } else {
-      const fields = rows2.map((f) => ({ key: resolve3(f.key), value: resolve3(f.value) }));
-      body = mode === "form" ? encodeQuery(fields) : resolve3(draft.body.raw);
-      if (!has("content-type")) headers.push(["Content-Type", CONTENT_TYPES[mode]]);
+      const fields = rows2.map((f) => ({ key: resolve4(f.key), value: resolve4(f.value) }));
+      body = mode === "form" ? encodeQuery(fields) : resolve4(draft.body.raw);
+      if (!has("content-type")) headers2.push(["Content-Type", CONTENT_TYPES[mode]]);
     }
   }
-  return { method: draft.method.toUpperCase(), url, headers, body, ...bodyEncoding === "base64" ? { bodyEncoding } : {} };
+  return { method: draft.method.toUpperCase(), url, headers: headers2, body, ...bodyEncoding === "base64" ? { bodyEncoding } : {} };
 }
 var GraphQLVariablesError = class extends Error {
 };
-function graphqlVariablesProblem(text) {
-  if (!text.trim()) return "";
+function graphqlVariablesProblem(text2) {
+  if (!text2.trim()) return "";
   let v;
   try {
-    v = JSON.parse(text);
+    v = JSON.parse(text2);
   } catch (e) {
     return `GraphQL variables are not valid JSON: ${e.message}`;
   }
@@ -27701,8 +27701,8 @@ function dynamic(name) {
       return void 0;
   }
 }
-function resolveVariables(text, scopes, maxDepth = 5) {
-  let out = text;
+function resolveVariables(text2, scopes, maxDepth = 5) {
+  let out = text2;
   for (let depth = 0; depth < maxDepth && out.includes("{{"); depth++) {
     const next = out.replace(VAR, (whole, name) => {
       for (const s of scopes) if (Object.hasOwn(s, name)) return s[name];
@@ -27714,7 +27714,7 @@ function resolveVariables(text, scopes, maxDepth = 5) {
   return out;
 }
 function makeResolver(scopes) {
-  return (text) => resolveVariables(text, scopes);
+  return (text2) => resolveVariables(text2, scopes);
 }
 
 // ../../packages/core/src/oauth2.ts
@@ -27725,8 +27725,8 @@ function newOAuth2() {
   return { type: "oauth2", grant: "client_credentials", tokenUrl: "", clientId: "", clientSecret: "", scope: "", audience: "", username: "", password: "", clientAuth: "basic", headerPrefix: "Bearer" };
 }
 var formEncode = (s) => encodeURIComponent(s).replace(/%20/g, "+");
-function tokenRequest(a, resolve3, refreshToken) {
-  const url = resolve3(a.tokenUrl).trim();
+function tokenRequest(a, resolve4, refreshToken) {
+  const url = resolve4(a.tokenUrl).trim();
   if (!url) throw new OAuth2Error("Set the token URL first.");
   const form = new URLSearchParams();
   if (refreshToken) {
@@ -27736,27 +27736,27 @@ function tokenRequest(a, resolve3, refreshToken) {
     if (a.grant === "authorization_code") throw new OAuth2Error("Sign in first: the authorization code grant needs a browser sign-in (Sign in, under Auth).");
     form.set("grant_type", a.grant);
     if (a.grant === "password") {
-      form.set("username", resolve3(a.username));
-      form.set("password", resolve3(a.password));
+      form.set("username", resolve4(a.username));
+      form.set("password", resolve4(a.password));
     }
   }
-  if (resolve3(a.scope).trim()) form.set("scope", resolve3(a.scope).trim());
-  if (!refreshToken && resolve3(a.audience).trim()) form.set("audience", resolve3(a.audience).trim());
-  return withClient(a, resolve3, url, form);
+  if (resolve4(a.scope).trim()) form.set("scope", resolve4(a.scope).trim());
+  if (!refreshToken && resolve4(a.audience).trim()) form.set("audience", resolve4(a.audience).trim());
+  return withClient(a, resolve4, url, form);
 }
-function withClient(a, resolve3, url, form) {
-  const headers = [["Content-Type", "application/x-www-form-urlencoded"], ["Accept", "application/json"]];
-  const id = resolve3(a.clientId);
-  const secret = resolve3(a.clientSecret);
+function withClient(a, resolve4, url, form) {
+  const headers2 = [["Content-Type", "application/x-www-form-urlencoded"], ["Accept", "application/json"]];
+  const id = resolve4(a.clientId);
+  const secret = resolve4(a.clientSecret);
   if (a.grant === "authorization_code" && !secret) {
     if (id) form.set("client_id", id);
   } else if (a.clientAuth === "body") {
     if (id) form.set("client_id", id);
     if (secret) form.set("client_secret", secret);
   } else if (id || secret) {
-    headers.push(["Authorization", `Basic ${btoa(`${formEncode(id)}:${formEncode(secret)}`)}`]);
+    headers2.push(["Authorization", `Basic ${btoa(`${formEncode(id)}:${formEncode(secret)}`)}`]);
   }
-  return { method: "POST", url, headers, body: form.toString() };
+  return { method: "POST", url, headers: headers2, body: form.toString() };
 }
 function parseTokenResponse(res, now = Date.now()) {
   const ct = headerValue(res.headers, "content-type") ?? "";
@@ -27786,8 +27786,8 @@ function parseTokenResponse(res, now = Date.now()) {
 function tokenFresh(t, now = Date.now(), skewMs = 3e4) {
   return !!t?.accessToken && (t.expiresAt === void 0 || t.expiresAt - skewMs > now);
 }
-function tokenCacheKey(a, resolve3) {
-  return JSON.stringify([a.grant, resolve3(a.tokenUrl), resolve3(a.clientId), resolve3(a.scope), resolve3(a.audience), a.grant === "password" ? resolve3(a.username) : ""]);
+function tokenCacheKey(a, resolve4) {
+  return JSON.stringify([a.grant, resolve4(a.tokenUrl), resolve4(a.clientId), resolve4(a.scope), resolve4(a.audience), a.grant === "password" ? resolve4(a.username) : ""]);
 }
 
 // ../../packages/core/src/postman.ts
@@ -27850,8 +27850,8 @@ function authOf(a, where, warnings) {
 function script(events, listen) {
   const e = events?.find((x) => x.listen === listen);
   const exec = e?.script?.exec;
-  const text = Array.isArray(exec) ? exec.join("\n") : exec ?? "";
-  return text.trim() ? text : void 0;
+  const text2 = Array.isArray(exec) ? exec.join("\n") : exec ?? "";
+  return text2.trim() ? text2 : void 0;
 }
 function bodyOf(b, where, warnings) {
   const empty2 = { mode: "none", raw: "", form: [] };
@@ -27888,14 +27888,14 @@ function requestOf(item, path, warnings) {
   const where = path;
   const params = typeof r.url === "object" && r.url?.query ? rows(r.url.query) : [];
   const url = params.length ? withQuery(urlOf(r.url), params) : urlOf(r.url);
-  const headers = typeof r.header === "string" ? [] : rows(r.header);
+  const headers2 = typeof r.header === "string" ? [] : rows(r.header);
   const preRequest = script(item.event, "prerequest");
   return newRequest({
     name: item.name || url || "Untitled request",
     method: (r.method ?? "GET").toUpperCase(),
     url,
     params: params.length ? params : rows([]),
-    headers,
+    headers: headers2,
     body: bodyOf(r.body, where, warnings),
     auth: authOf(r.auth, where, warnings) ?? { type: "inherit" },
     ...script(item.event, "test") ? { tests: script(item.event, "test") } : {},
@@ -27974,12 +27974,12 @@ function runnableRequests(collection, folderId) {
   walk(start, root?.type === "folder" ? [root.name] : []);
   return out;
 }
-function parseCsv(text) {
+function parseCsv(text2) {
   const rows2 = [];
   let row = [];
   let field = "";
   let quoted = false;
-  const s = text.replace(/^/, "");
+  const s = text2.replace(/^/, "");
   for (let i = 0; i < s.length; i++) {
     const c = s[i];
     if (quoted) {
@@ -28004,16 +28004,16 @@ function parseCsv(text) {
   if (row.some((f) => f !== "")) rows2.push(row);
   return rows2;
 }
-function parseDataFile(text, filename = "") {
-  const trimmed = text.trim();
+function parseDataFile(text2, filename = "") {
+  const trimmed = text2.trim();
   if (filename.toLowerCase().endsWith(".json") || trimmed.startsWith("[")) {
     const data = JSON.parse(trimmed);
     if (!Array.isArray(data) || !data.every((r) => r && typeof r === "object" && !Array.isArray(r))) throw new Error("A JSON data file must be an array of objects.");
     return data.map((r) => Object.fromEntries(Object.entries(r).map(([k, v]) => [k, typeof v === "string" ? v : JSON.stringify(v)])));
   }
-  const [header, ...rows2] = parseCsv(text);
-  if (!header?.length) throw new Error("The CSV file is empty.");
-  return rows2.map((r) => Object.fromEntries(header.map((h, i) => [h.trim(), r[i] ?? ""])));
+  const [header2, ...rows2] = parseCsv(text2);
+  if (!header2?.length) throw new Error("The CSV file is empty.");
+  return rows2.map((r) => Object.fromEntries(header2.map((h, i) => [h.trim(), r[i] ?? ""])));
 }
 function summarise(steps) {
   const tests = steps.flatMap((s) => s.tests);
@@ -28049,15 +28049,15 @@ function pathMatch(reqPath, cookiePath) {
   return cookiePath.endsWith("/") || reqPath[cookiePath.length] === "/";
 }
 var secureOk = (u) => u.protocol === "https:" || ["localhost", "127.0.0.1", "::1"].includes(hostOf(u)) || hostOf(u).endsWith(".localhost");
-function parseSetCookie(header, url, now = Date.now()) {
+function parseSetCookie(header2, url, now = Date.now()) {
   let u;
   try {
     u = new URL(url);
   } catch {
     return null;
   }
-  if (header.length > MAX_COOKIE_BYTES) return null;
-  const [pair = "", ...attrs] = header.split(";");
+  if (header2.length > MAX_COOKIE_BYTES) return null;
+  const [pair = "", ...attrs] = header2.split(";");
   const eq = pair.indexOf("=");
   if (eq < 1) return null;
   const name = pair.slice(0, eq).trim();
@@ -28163,6 +28163,249 @@ function mergeCookieHeader(userHeader, jarCookies) {
   return [...own, ...jarCookies.filter((c) => !names.has(c.name)).map((c) => `${c.name}=${c.value}`)].join("; ");
 }
 
+// ../../packages/core/src/security.ts
+var ORDER = ["high", "medium", "low", "info"];
+var SECURITY_SEVERITIES = ORDER;
+var atLeast = (severity, threshold) => ORDER.indexOf(severity) <= ORDER.indexOf(threshold);
+var BODY_SCAN = 256 * 1024;
+var LOCAL = /^(localhost|127(?:\.\d{1,3}){3}|\[::1\]|::1|0\.0\.0\.0)$/i;
+var SESSION_COOKIE = /(sess|sid|auth|token|jwt|login|remember|csrf|xsrf)/i;
+var URL_SECRET = /^(access_?token|id_?token|refresh_?token|token|api_?key|apikey|key|secret|client_?secret|password|passwd|pwd|auth|session_?id|sessionid|jwt)$/i;
+var BODY_SECRET = /^(password|passwd|pwd|password_?hash|passwordhash|secret|client_?secret|api_?secret|private_?key|privatekey|ssn|card_?number|cardnumber|cvv|cvc)$/i;
+var ERROR_SIGNS = [
+  [/\n\s+at [\w$.<>]+ \(?[^\n]*:\d+:\d+\)?/, "a JavaScript stack trace"],
+  [/Traceback \(most recent call last\)/, "a Python traceback"],
+  [/(?:^|\n)\s*at (?:java|javax|org\.springframework|com\.)[\w.$]+\([\w.]+:\d+\)/, "a Java stack trace"],
+  [/Exception in thread "/, "a Java exception"],
+  [/You have an error in your SQL syntax|SQLSTATE\[|ORA-\d{5}|PG::\w+Error|pg_query\(\)|SQLite3::|Microsoft OLE DB Provider|Unclosed quotation mark after the character string/i, "a database error"],
+  [/(?:Fatal error|Warning|Notice): .+ in \/[^\s]+\.php on line \d+/, "a PHP error with a file path"],
+  [/\/node_modules\/[\w@.-]+\//, "server file paths"],
+  [/System\.\w+Exception|at System\.[\w.]+\(/, "a .NET exception"],
+  [/ActionController::|ActiveRecord::\w+Error/, "a Rails error"]
+];
+var header = (list, name) => list.find(([k]) => k.toLowerCase() === name)?.[1];
+var headers = (list, name) => list.filter(([k]) => k.toLowerCase() === name).map(([, v]) => v);
+function passiveFindings(input) {
+  const out = [];
+  const add = (f) => {
+    if (!out.some((x) => x.id === f.id)) out.push(f);
+  };
+  let url = null;
+  try {
+    url = new URL(input.url);
+  } catch {
+  }
+  const local = !!url && LOCAL.test(url.hostname);
+  const https = url?.protocol === "https:";
+  const res = input.response;
+  const type = (header(res.headers, "content-type") ?? "").toLowerCase();
+  const html = type.includes("text/html");
+  if (url?.protocol === "http:" && !local) add({
+    id: "transport.http",
+    severity: "medium",
+    title: "Sent over plain HTTP",
+    detail: "Anyone on the network path can read and change this request and its answer, including tokens and cookies.",
+    fix: "Serve the API over HTTPS only, and redirect or refuse plain HTTP."
+  });
+  if (https && !local) {
+    const hsts = header(res.headers, "strict-transport-security");
+    if (!hsts) add({
+      id: "hsts.missing",
+      severity: "low",
+      title: "No Strict-Transport-Security header",
+      detail: "Without HSTS, a browser can be tricked into using plain HTTP for this host on a first visit or a typed URL.",
+      fix: "Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses.",
+      evidence: "strict-transport-security"
+    });
+    else {
+      const age = Number(/max-age\s*=\s*"?(\d+)/i.exec(hsts)?.[1] ?? "0");
+      if (age < 15552e3) add({
+        id: "hsts.short",
+        severity: "info",
+        title: "Strict-Transport-Security max-age is short",
+        detail: `max-age is ${age} seconds. Under 180 days, browsers forget the rule quickly and the protection lapses.`,
+        fix: "Use max-age=31536000 (one year) once HTTPS works everywhere on the host.",
+        evidence: "strict-transport-security"
+      });
+    }
+  }
+  if (!header(res.headers, "x-content-type-options")?.toLowerCase().includes("nosniff") && res.body.length > 0) add({
+    id: "headers.nosniff",
+    severity: "low",
+    title: "No X-Content-Type-Options: nosniff",
+    detail: "Browsers may guess the type of the answer and run it as script or HTML, which can turn an upload or a JSON answer into an attack.",
+    fix: "Send X-Content-Type-Options: nosniff on every response.",
+    evidence: "x-content-type-options"
+  });
+  if (html) {
+    const csp = headers(res.headers, "content-security-policy").join("; ");
+    if (!csp) add({
+      id: "headers.csp-missing",
+      severity: "medium",
+      title: "HTML page without a Content-Security-Policy",
+      detail: "A CSP limits what scripts a page can load and run. Without one, any injected script runs with the page's full rights.",
+      fix: "Add a Content-Security-Policy, starting from default-src 'self' and loosening only what the page needs.",
+      evidence: "content-security-policy"
+    });
+    const xfo = header(res.headers, "x-frame-options");
+    if (!/frame-ancestors/i.test(csp) && !xfo) add({
+      id: "headers.framing",
+      severity: "low",
+      title: "Page can be shown inside another site's frame",
+      detail: "Another site can load this page in a hidden frame and trick people into clicking on it (clickjacking).",
+      fix: "Send Content-Security-Policy: frame-ancestors 'none' (or 'self'), or X-Frame-Options: DENY.",
+      evidence: "x-frame-options"
+    });
+  }
+  const acao = header(res.headers, "access-control-allow-origin")?.trim();
+  const acac = header(res.headers, "access-control-allow-credentials")?.trim().toLowerCase() === "true";
+  const sentOrigin = header(input.requestHeaders, "origin");
+  if (acao === "*" && acac) add({
+    id: "cors.wildcard-credentials",
+    severity: "high",
+    title: "CORS allows any origin with credentials",
+    detail: "Access-Control-Allow-Origin: * together with Allow-Credentials: true shows the server means to let any website read signed-in answers. Browsers block this exact pair, so the server likely also echoes origins elsewhere.",
+    fix: "Allow only a fixed list of your own origins, and send credentials only to those.",
+    evidence: "access-control-allow-origin"
+  });
+  if (acao === "null") add({
+    id: "cors.null-origin",
+    severity: "medium",
+    title: 'CORS allows the "null" origin',
+    detail: "Sandboxed frames and local files send Origin: null, so any attacker page can use a sandboxed frame to read these answers.",
+    fix: "Never allow the null origin; list your real origins instead.",
+    evidence: "access-control-allow-origin"
+  });
+  if (sentOrigin && acao && acao !== "*" && acao === sentOrigin && acac && !local) add({
+    id: "cors.reflected-origin",
+    severity: "medium",
+    title: "CORS echoes the request's origin with credentials",
+    detail: `The answer allowed ${sentOrigin} to read it with cookies. If the server copies any Origin it receives, every website can read signed-in data. Run the active checks to confirm with an origin you do not own.`,
+    fix: "Compare the Origin against a fixed allow-list before echoing it.",
+    evidence: "access-control-allow-origin"
+  });
+  const setCookies = headers(res.headers, "set-cookie");
+  const noSecure = [], noHttpOnly = [], noSameSite = [];
+  for (const c of setCookies) {
+    const [pair = "", ...attrs] = c.split(";");
+    const name = pair.split("=")[0].trim();
+    if (!name) continue;
+    const a = attrs.map((x) => x.trim().toLowerCase());
+    const has = (k) => a.some((x) => x === k || x.startsWith(`${k}=`));
+    if (https && !has("secure")) noSecure.push(name);
+    if (SESSION_COOKIE.test(name) && !has("httponly")) noHttpOnly.push(name);
+    if (!has("samesite")) noSameSite.push(name);
+  }
+  if (noSecure.length) add({
+    id: "cookie.secure",
+    severity: "medium",
+    title: "Cookie without the Secure flag",
+    detail: "The browser will also send this cookie over plain HTTP, where it can be read on the network.",
+    fix: "Add Secure to every cookie set over HTTPS.",
+    evidence: noSecure.join(", ")
+  });
+  if (noHttpOnly.length) add({
+    id: "cookie.httponly",
+    severity: "medium",
+    title: "Session cookie readable by scripts",
+    detail: "Without HttpOnly, any script injected into the page can read this cookie and take over the session.",
+    fix: "Add HttpOnly to session and authentication cookies.",
+    evidence: noHttpOnly.join(", ")
+  });
+  if (noSameSite.length) add({
+    id: "cookie.samesite",
+    severity: "low",
+    title: "Cookie without a SameSite setting",
+    detail: "Older browsers send cookies without SameSite on requests started by other sites, which helps cross-site request forgery.",
+    fix: "Set SameSite=Lax (or Strict) explicitly; use None only with Secure and when cross-site use is needed.",
+    evidence: noSameSite.join(", ")
+  });
+  const server = header(res.headers, "server");
+  if (server && /\d+\.\d+/.test(server)) add({
+    id: "disclosure.server-version",
+    severity: "low",
+    title: "Server version given away",
+    detail: `The Server header says "${server.slice(0, 80)}". Exact versions tell attackers which known flaws to try.`,
+    fix: "Hide the version (for example server_tokens off in nginx, ServerTokens Prod in Apache).",
+    evidence: "server"
+  });
+  for (const name of ["x-powered-by", "x-aspnet-version", "x-aspnetmvc-version", "x-generator"]) {
+    const v = header(res.headers, name);
+    if (v) {
+      add({
+        id: "disclosure.powered-by",
+        severity: "low",
+        title: "Framework given away in a header",
+        detail: `${name}: ${v.slice(0, 80)} tells attackers what the server runs.`,
+        fix: "Remove the header (for example app.disable('x-powered-by') in Express, expose_php = Off in PHP).",
+        evidence: name
+      });
+      break;
+    }
+  }
+  const text2 = res.bodyEncoding === "utf8" ? res.body.slice(0, BODY_SCAN) : "";
+  if (text2) {
+    const sign = ERROR_SIGNS.find(([re]) => re.test(text2));
+    if (sign) add({
+      id: "disclosure.error-detail",
+      severity: "medium",
+      title: "Internal error details in the answer",
+      detail: `The body contains ${sign[1]}. Stack traces and database errors reveal code paths, file names and queries that make attacks easier.`,
+      fix: "Return a short error with a reference id, and log the details on the server only.",
+      evidence: sign[1]
+    });
+  }
+  if (url) {
+    const names = [...url.searchParams.keys()].filter((k) => URL_SECRET.test(k));
+    if (names.length) add({
+      id: "url.credentials",
+      severity: "medium",
+      title: "Credentials in the URL",
+      detail: "URLs end up in server logs, proxy logs, browser history and Referer headers, so a secret in the query string leaks widely.",
+      fix: "Send credentials in a header (Authorization) or the request body instead.",
+      evidence: [...new Set(names)].join(", ")
+    });
+  }
+  if (header(input.requestHeaders, "authorization") || header(input.requestHeaders, "cookie")) {
+    const cc = (header(res.headers, "cache-control") ?? "").toLowerCase();
+    if (res.status < 400 && !/no-store|private/.test(cc)) add({
+      id: "cache.authenticated",
+      severity: "low",
+      title: "Signed-in answer may be cached",
+      detail: "The request carried credentials, but the answer does not say Cache-Control: no-store or private, so a shared cache or proxy may keep it and serve it to someone else.",
+      fix: "Send Cache-Control: no-store on answers that depend on who is signed in.",
+      evidence: "cache-control"
+    });
+  }
+  if (text2 && (type.includes("json") || /^\s*[[{]/.test(text2))) {
+    let data;
+    try {
+      data = JSON.parse(res.body.length > BODY_SCAN ? "" : res.body);
+    } catch {
+      data = void 0;
+    }
+    const paths = [];
+    const walk = (v, path, depth) => {
+      if (depth > 12 || paths.length >= 10 || !v || typeof v !== "object") return;
+      for (const [k, child] of Object.entries(v)) {
+        const p = path ? `${path}.${k}` : k;
+        if (BODY_SECRET.test(k) && (typeof child === "string" || typeof child === "number") && String(child).length > 0) paths.push(Array.isArray(v) ? path : p);
+        else walk(child, Array.isArray(v) ? `${path}[]` : p, depth + 1);
+      }
+    };
+    walk(data, "", 0);
+    if (paths.length) add({
+      id: "body.secret-field",
+      severity: "medium",
+      title: "Secret field sent back in the answer",
+      detail: "The JSON answer includes fields that look like passwords, password hashes, keys or card data. Answers are logged and cached in many places; secrets should never leave the server.",
+      fix: "Leave these fields out of the response model (an explicit allow-list of fields to return).",
+      evidence: [...new Set(paths)].join(", ")
+    });
+  }
+  return out.sort((a, b) => ORDER.indexOf(a.severity) - ORDER.indexOf(b.severity));
+}
+
 // ../../packages/core/src/pipeline.ts
 function applyVariableUpdates(rows2, updates) {
   let out = rows2;
@@ -28208,17 +28451,17 @@ async function executeRequest(host, input) {
     }
   }
   const s = host.scopes();
-  const resolve3 = makeResolver([local, iterationData, s.environment ?? {}, s.collection ?? {}, s.globals]);
+  const resolve4 = makeResolver([local, iterationData, s.environment ?? {}, s.collection ?? {}, s.globals]);
   let auth = draft.auth.type === "inherit" ? inherited : draft.auth;
   if (auth?.type === "oauth2") {
-    const got = await ensureToken(host, auth, resolve3, signal);
+    const got = await ensureToken(host, auth, resolve4, signal);
     if (!got.ok) return { result: { ok: false, error: { code: "auth", error: `Could not get an OAuth 2.0 token: ${got.error}` } }, scripts: hasOutput() ? merged : void 0 };
     auth = { ...auth, token: got.token };
     draft.auth = auth;
   }
   let wire;
   try {
-    wire = buildSendRequest(draft, resolve3, inherited, host.files);
+    wire = buildSendRequest(draft, resolve4, inherited, host.files);
   } catch (e) {
     return { result: { ok: false, error: { code: "invalid_request", error: e.message } }, scripts: hasOutput() ? merged : void 0 };
   }
@@ -28235,8 +28478,8 @@ async function executeRequest(host, input) {
   const result = await host.send(wire, signal);
   if (host.cookies && result.ok) {
     for (const c of result.response.setCookies ?? []) host.cookies.store(c.url, [c.value]);
-    const set = result.response.headers.filter(([k]) => k.toLowerCase() === "set-cookie").map(([, v]) => v);
-    if (set.length) host.cookies.store(result.response.url || wire.url, set);
+    const set2 = result.response.headers.filter(([k]) => k.toLowerCase() === "set-cookie").map(([, v]) => v);
+    if (set2.length) host.cookies.store(result.response.url || wire.url, set2);
   }
   if (signal?.aborted || !result.ok || chain.tests.length === 0) {
     return { result, wire, scripts: chain.preRequest.length && hasOutput() ? merged : void 0 };
@@ -28254,8 +28497,8 @@ async function executeRequest(host, input) {
   }
   return { result, wire, scripts: merged };
 }
-async function ensureToken(host, a, resolve3, signal, force = false) {
-  const key = tokenCacheKey(a, resolve3);
+async function ensureToken(host, a, resolve4, signal, force = false) {
+  const key = tokenCacheKey(a, resolve4);
   const cached = host.tokens?.get(key);
   if (!force) {
     if (tokenFresh(a.token)) return { ok: true, token: a.token };
@@ -28263,7 +28506,7 @@ async function ensureToken(host, a, resolve3, signal, force = false) {
   }
   const refresh = force ? void 0 : cached?.refreshToken ?? a.token?.refreshToken;
   const attempt = async (refreshToken) => {
-    const r = await host.send(tokenRequest(a, resolve3, refreshToken), signal);
+    const r = await host.send(tokenRequest(a, resolve4, refreshToken), signal);
     if (!r.ok) throw new OAuth2Error(r.error.error);
     const t = parseTokenResponse(r.response);
     return refreshToken && !t.refreshToken ? { ...t, refreshToken } : t;
@@ -28284,6 +28527,7 @@ async function ensureToken(host, a, resolve3, signal, force = false) {
 }
 function toRunStep(iteration, requestId, path, request2, out) {
   const { result, scripts } = out;
+  const security = result?.ok && out.wire ? passiveFindings({ method: out.wire.method, url: out.wire.url, requestHeaders: out.wire.headers, response: result.response }) : [];
   return {
     iteration,
     requestId,
@@ -28293,48 +28537,98 @@ function toRunStep(iteration, requestId, path, request2, out) {
     url: out.wire?.url ?? request2.url,
     ...result?.ok ? { status: result.response.status, timeMs: result.response.timeMs } : { error: result ? result.error.error : `Pre-request script failed: ${scripts?.error ?? "unknown error"}` },
     tests: [...scripts?.tests ?? [], ...scripts?.error && result?.ok ? [{ name: "Script error", passed: false, error: scripts.error }] : []],
-    ...scripts?.logs.length ? { logs: scripts.logs } : {}
+    ...scripts?.logs.length ? { logs: scripts.logs } : {},
+    ...security.length ? { security } : {}
   };
 }
 var failed = (s) => !!s.error || s.tests.some((t) => !t.passed);
+var MAX_PARALLEL = 50;
+function laneHost(host, start) {
+  const env = start.environment ? { ...start.environment } : null;
+  const col = start.collection ? { ...start.collection } : null;
+  const glob = { ...start.globals };
+  const put = (scope, u) => {
+    if (!scope) return;
+    for (const [k, v] of Object.entries(u)) {
+      if (v === null) delete scope[k];
+      else scope[k] = v;
+    }
+  };
+  const jar = host.cookies ? new CookieJar(host.cookies.list?.() ?? []) : void 0;
+  return {
+    ...host,
+    scopes: () => ({ environment: env ? { ...env } : null, collection: col ? { ...col } : null, globals: { ...glob } }),
+    apply: (u) => {
+      put(env, u.environment);
+      put(col, u.collection);
+      put(glob, u.globals);
+    },
+    cookies: jar
+  };
+}
 async function runCollection(host, opts) {
-  const { collection, signal } = opts;
-  const list = runnableRequests(collection, opts.folderId);
+  const { collection } = opts;
+  const parallel = opts.parallel ?? 1;
+  if (!Number.isInteger(parallel) || parallel < 1 || parallel > MAX_PARALLEL) throw new RangeError(`parallel must be a whole number between 1 and ${MAX_PARALLEL}.`);
+  const only = opts.requestIds ? new Set(opts.requestIds) : null;
+  const list = runnableRequests(collection, opts.folderId).filter((r) => !only || only.has(r.requestId));
   const rounds = opts.data?.length ? opts.data.length : Math.max(1, opts.iterations ?? 1);
-  const steps = [];
+  const stop = new AbortController();
+  const onOuterAbort = () => stop.abort();
+  opts.signal?.addEventListener("abort", onOuterAbort);
+  if (opts.signal?.aborted) stop.abort();
+  const signal = stop.signal;
+  const byIteration = Array.from({ length: rounds }, () => []);
   let bailed = false;
-  outer: for (let it = 0; it < rounds; it++) {
+  const start = parallel > 1 ? host.scopes() : null;
+  const iteration = async (it) => {
+    const h = start ? laneHost(host, start) : host;
     opts.onIteration?.(it, rounds);
     for (const r of list) {
-      if (signal?.aborted) break outer;
+      if (signal.aborted) return;
       const current = findItem(collection.items, r.requestId);
       const request2 = current?.type === "request" ? current.request : r.request;
-      const out = await executeRequest(host, { draft: request2, collection, requestId: r.requestId, data: opts.data?.[it], iteration: it, signal });
-      if (signal?.aborted) break outer;
+      const out = await executeRequest(h, { draft: request2, collection, requestId: r.requestId, data: opts.data?.[it], iteration: it, signal });
+      if (signal.aborted) return;
       const step = toRunStep(it, r.requestId, r.path, request2, out);
-      steps.push(step);
+      byIteration[it].push(step);
       opts.onStep?.(step, out);
       if (opts.bail && failed(step)) {
         bailed = true;
-        break outer;
+        stop.abort();
+        return;
       }
       if (opts.delayMs) await new Promise((res) => setTimeout(res, opts.delayMs));
     }
+    opts.onIterationDone?.(it, rounds, byIteration[it]);
+  };
+  try {
+    let next = 0;
+    const worker = async () => {
+      while (!signal.aborted && next < rounds) await iteration(next++);
+    };
+    await Promise.all(Array.from({ length: Math.min(parallel, rounds) }, worker));
+  } finally {
+    opts.signal?.removeEventListener("abort", onOuterAbort);
   }
+  const steps = byIteration.flat();
   return { collection: collection.name, steps, summary: summarise(steps), bailed };
 }
 var xml = (s) => s.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]/g, "").replace(/[<>&"']/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c]);
-function toJUnit(report) {
+function toJUnit(report, opts = {}) {
+  const securityCases = (s) => (opts.securityFailOn ? (s.security ?? []).filter((f) => atLeast(f.severity, opts.securityFailOn)) : []).map((f) => `    <testcase name="${xml(`Security: ${f.title}`)}" classname="${xml(s.name)}" time="0"><failure message="${xml(`${f.severity}: ${f.detail}`)}" type="SecurityFinding">${xml(`Fix: ${f.fix}`)}</failure></testcase>`);
   const suites = report.steps.map((s) => {
     const name = [...s.path, s.name].join(" / ");
-    const cases = s.error ? [`    <testcase name="Request" classname="${xml(s.name)}" time="0"><failure message="${xml(s.error)}" type="RequestError">${xml(`${s.method} ${s.url}`)}</failure></testcase>`] : s.tests.map((t) => t.passed ? `    <testcase name="${xml(t.name)}" classname="${xml(s.name)}" time="${((s.timeMs ?? 0) / 1e3).toFixed(3)}"/>` : `    <testcase name="${xml(t.name)}" classname="${xml(s.name)}" time="${((s.timeMs ?? 0) / 1e3).toFixed(3)}"><failure message="${xml(t.error ?? "failed")}" type="AssertionError"/></testcase>`);
-    const failures2 = s.error ? 1 : s.tests.filter((t) => !t.passed).length;
+    const sec = securityCases(s);
+    const plain = s.error ? [`    <testcase name="Request" classname="${xml(s.name)}" time="0"><failure message="${xml(s.error)}" type="RequestError">${xml(`${s.method} ${s.url}`)}</failure></testcase>`] : s.tests.map((t) => t.passed ? `    <testcase name="${xml(t.name)}" classname="${xml(s.name)}" time="${((s.timeMs ?? 0) / 1e3).toFixed(3)}"/>` : `    <testcase name="${xml(t.name)}" classname="${xml(s.name)}" time="${((s.timeMs ?? 0) / 1e3).toFixed(3)}"><failure message="${xml(t.error ?? "failed")}" type="AssertionError"/></testcase>`);
+    const cases = [...plain, ...sec];
+    const failures2 = (s.error ? 1 : s.tests.filter((t) => !t.passed).length) + sec.length;
     return `  <testsuite name="${xml(name)}" tests="${cases.length}" failures="${failures2}" errors="0" time="${((s.timeMs ?? 0) / 1e3).toFixed(3)}" iteration="${s.iteration}">
 ${cases.join("\n")}
   </testsuite>`;
   });
-  const tests = report.steps.reduce((n, s) => n + (s.error ? 1 : s.tests.length), 0);
-  const failures = report.steps.reduce((n, s) => n + (s.error ? 1 : s.tests.filter((t) => !t.passed).length), 0);
+  const tests = report.steps.reduce((n, s) => n + (s.error ? 1 : s.tests.length) + securityCases(s).length, 0);
+  const failures = report.steps.reduce((n, s) => n + (s.error ? 1 : s.tests.filter((t) => !t.passed).length) + securityCases(s).length, 0);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <testsuites name="${xml(report.collection)}" tests="${tests}" failures="${failures}">
 ${suites.join("\n")}
@@ -28449,6 +28743,194 @@ var OutputFormat;
 // ../../packages/core/src/validation.ts
 var MAX_CONFIG_BYTES = 64 * 1024;
 
+// ../../packages/core/src/active.ts
+var SAFE = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var PROBE_HOST = "wirecatch-probe.invalid";
+var PROBE_ORIGIN = `https://${PROBE_HOST}`;
+var CANARY = "wc<b>wcprobe7q</b>";
+var CANARY_SEEN = "<b>wcprobe7q</b>";
+var CRED_HEADERS = /^(authorization|cookie|x-api-key|api-key|apikey|x-auth-token|x-access-token|proxy-authorization)$/i;
+var CRED_PARAMS = /^(access_?token|token|api_?key|apikey|key|auth|session_?id|jwt)$/i;
+var DB_ERROR = /You have an error in your SQL syntax|SQLSTATE\[|ORA-\d{5}|PG::\w+Error|pg_query\(\)|SQLite3::|SQLITE_ERROR|Microsoft OLE DB Provider|Unclosed quotation mark|unterminated quoted string|syntax error at or near|quoted string not properly terminated/i;
+var ROUTING_HEADER = /^(host|:authority|:path|:scheme|:method|forwarded|x-forwarded-[\w-]+|x-real-ip|x-client-ip|true-client-ip|x-originating-ip|x-original-url|x-rewrite-url|connection|keep-alive|transfer-encoding|te|trailer|upgrade|proxy-[\w-]+|content-length)$/i;
+var LOCAL_HOST = /^(localhost|[\w-]+\.localhost|127(?:\.\d{1,3}){3}|::1|\[::1\])$/i;
+function isLocalTarget(url) {
+  try {
+    return LOCAL_HOST.test(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+}
+var hdr = (list, name) => list.find(([k]) => k.toLowerCase() === name)?.[1];
+var without = (list, test) => list.filter(([k]) => !test(k));
+var set = (list, name, value) => [...without(list, (k) => k.toLowerCase() === name.toLowerCase()), [name, value]];
+var probe = (id, title, request2) => ({ id, title, request: { ...request2, followRedirects: false, timeoutMs: request2.timeoutMs ?? 15e3 } });
+function activeProbes(given, opts = {}) {
+  const base = { ...given, headers: given.headers.filter(([k]) => !ROUTING_HEADER.test(k)) };
+  const url = new URL(base.url);
+  const method = base.method.toUpperCase();
+  const replay = SAFE.has(method) || !!opts.allowUnsafe;
+  const probes = [];
+  const skipped = [];
+  const credHeaders = base.headers.filter(([k]) => CRED_HEADERS.test(k));
+  const credParams = [...url.searchParams.keys()].filter((k) => CRED_PARAMS.test(k));
+  if (!replay) skipped.push(`Checks that resend the ${method} request were left out: they could change data. Allow requests that change data to include them.`);
+  if (replay) {
+    if (credHeaders.length || credParams.length) {
+      const bare = new URL(url);
+      for (const k of credParams) bare.searchParams.delete(k);
+      probes.push(probe("auth.removed", "Same request without credentials", { ...base, url: bare.toString(), headers: without(base.headers, (k) => CRED_HEADERS.test(k)) }));
+      const auth = hdr(base.headers, "authorization");
+      if (auth) {
+        const bogus = /^basic\s/i.test(auth) ? `Basic ${btoa("wirecatch:not-the-password")}` : "Bearer wirecatch-invalid-token";
+        const others = new URL(url);
+        for (const k of credParams) others.searchParams.delete(k);
+        probes.push(probe("auth.invalid", "Same request with a made-up token", { ...base, url: others.toString(), headers: [...without(base.headers, (k) => CRED_HEADERS.test(k)), ["Authorization", bogus]] }));
+      }
+    } else skipped.push("Credential checks were left out: the request carries no credentials.");
+    probes.push(probe("cors.origin", "Request from another website's origin", { ...base, headers: set(base.headers, "Origin", PROBE_ORIGIN) }));
+    probes.push(probe("cors.null", "Request from a sandboxed (null) origin", { ...base, headers: set(base.headers, "Origin", "null") }));
+    probes.push(probe("host.forwarded", "Forwarded host header from elsewhere", { ...base, headers: set(base.headers, "X-Forwarded-Host", PROBE_HOST) }));
+  } else {
+    probes.push(probe("cors.origin", "Preflight from another website's origin", {
+      method: "OPTIONS",
+      url: base.url,
+      headers: [["Origin", PROBE_ORIGIN], ["Access-Control-Request-Method", method], ["Access-Control-Request-Headers", "authorization,content-type"]]
+    }));
+  }
+  probes.push(probe("method.trace", "TRACE request", { method: "TRACE", url: base.url, headers: [["X-Wirecatch-Probe", "trace"]] }));
+  if (method === "GET") {
+    const reflect = new URL(url);
+    reflect.searchParams.set("wc_probe", CANARY);
+    probes.push(probe("input.reflect", "Marked input in the query string", { ...base, url: reflect.toString() }));
+    const quoted = new URL(url);
+    const param = [...quoted.searchParams.keys()].find((k) => !CRED_PARAMS.test(k));
+    if (param) quoted.searchParams.set(param, `${quoted.searchParams.get(param)}'`);
+    else {
+      const parts = quoted.pathname.split("/");
+      const last = parts.length - 1;
+      if (parts[last]) parts[last] = `${parts[last]}'`;
+      quoted.pathname = parts.join("/");
+    }
+    if (quoted.toString() !== url.toString()) probes.push(probe("input.quote", "A single quote added to an input", { ...base, url: quoted.toString() }));
+  } else skipped.push("Input checks were left out: they only run on GET requests.");
+  return { probes, skipped };
+}
+var ok = (r) => !!r && r.status >= 200 && r.status < 300;
+var text = (r) => r && r.bodyEncoding === "utf8" ? r.body.slice(0, 256 * 1024) : "";
+var similar = (a, b) => {
+  if (a.body === b.body) return true;
+  const la = a.body.length, lb = b.body.length;
+  return la > 0 && Math.abs(la - lb) / la < 0.1;
+};
+var JUDGES = {
+  "auth.removed": (b, r) => ok(b) && ok(r) && similar(b, r) ? {
+    id: "active.auth-not-required",
+    severity: "high",
+    title: "Answers without credentials",
+    detail: "The same request with its credentials removed got the same successful answer. Anyone who knows the URL can read this. If the endpoint is meant to be public, ignore this.",
+    fix: "Check authentication on every route on the server (a default-deny middleware), not only in the client."
+  } : null,
+  "auth.invalid": (b, r) => ok(b) && ok(r) && similar(b, r) ? {
+    id: "active.auth-invalid-accepted",
+    severity: "high",
+    title: "Accepts a made-up token",
+    detail: "A request with an invented token got the same successful answer as the real one, so the token is not being checked.",
+    fix: "Verify the token's signature, expiry and audience on every request, and reject anything that does not verify."
+  } : null,
+  "cors.origin": (_b, r) => {
+    const acao = hdr(r.headers, "access-control-allow-origin");
+    if (acao !== PROBE_ORIGIN && acao !== "*") return null;
+    const creds = hdr(r.headers, "access-control-allow-credentials")?.toLowerCase() === "true";
+    if (acao === "*" && !creds) return null;
+    return {
+      id: "active.cors-any-origin",
+      severity: creds ? "high" : "medium",
+      title: "CORS trusts any website",
+      detail: `A request from ${PROBE_ORIGIN}, a site you do not own, was allowed${creds ? " with credentials, so any website a signed-in user visits can read their data from this API" : ", so any website can read these answers"}.`,
+      fix: "Compare the Origin against a fixed list of your own origins before allowing it.",
+      evidence: "access-control-allow-origin"
+    };
+  },
+  "cors.null": (_b, r) => hdr(r.headers, "access-control-allow-origin") === "null" ? {
+    id: "active.cors-null-origin",
+    severity: "medium",
+    title: "CORS trusts the null origin",
+    detail: "A request with Origin: null was allowed. Any page can send that origin from a sandboxed frame and read the answer.",
+    fix: "Never allow the null origin.",
+    evidence: "access-control-allow-origin"
+  } : null,
+  "host.forwarded": (_b, r) => text(r).includes(PROBE_HOST) || (hdr(r.headers, "location") ?? "").includes(PROBE_HOST) ? {
+    id: "active.host-reflected",
+    severity: "medium",
+    title: "Forwarded host copied into the answer",
+    detail: `X-Forwarded-Host: ${PROBE_HOST} came back in the answer's links. Attackers use this to poison caches and password-reset emails with their own domain.`,
+    fix: "Build absolute links from a configured public URL, and only trust forwarded headers set by your own proxy.",
+    evidence: "x-forwarded-host"
+  } : null,
+  "ip.spoof": (b, r) => !ok(b) && ok(r) ? {
+    id: "active.ip-spoof-bypass",
+    severity: "high",
+    title: "Block bypassed with a forwarded-for header",
+    detail: `The request was refused (${b.status}) until it claimed to come from 127.0.0.1 in X-Forwarded-For and similar headers, then it succeeded. Anyone can send those headers.`,
+    fix: "Take the client address from your proxy configuration (trusted hop count), never from headers the client controls.",
+    evidence: "x-forwarded-for"
+  } : null,
+  "method.trace": (_b, r) => r.status === 200 && /x-wirecatch-probe/i.test(text(r)) ? {
+    id: "active.trace-enabled",
+    severity: "low",
+    title: "TRACE is enabled",
+    detail: "The server echoes TRACE requests back, headers included. Combined with other flaws it can expose cookies and tokens.",
+    fix: "Turn TRACE off on the server or proxy (for example TraceEnable off in Apache)."
+  } : null,
+  "input.reflect": (_b, r) => text(r).includes(CANARY_SEEN) && (hdr(r.headers, "content-type") ?? "").toLowerCase().includes("html") ? {
+    id: "active.input-reflected",
+    severity: "medium",
+    title: "Input sent back without escaping",
+    detail: "A marked value in the query string came back in an HTML answer with its tags intact. That is how reflected cross-site scripting starts.",
+    fix: "Escape everything you put into HTML (use your template engine's auto-escaping), and add a Content-Security-Policy.",
+    evidence: "wc_probe"
+  } : null,
+  "input.quote": (b, r) => DB_ERROR.test(text(r)) && !DB_ERROR.test(text(b)) ? {
+    id: "active.sql-error",
+    severity: "high",
+    title: "A quote breaks a database query",
+    detail: "Adding a single quote to an input produced a database error. The input is likely pasted into SQL, which allows SQL injection.",
+    fix: "Use parameterised queries or your ORM's query builder for every value; never build SQL from strings."
+  } : null
+};
+async function runActiveChecks(send2, given, opts = {}) {
+  const report = { findings: [], probes: [], skipped: [], requests: 0 };
+  const base = { ...given, headers: given.headers.filter(([k]) => !ROUTING_HEADER.test(k)) };
+  const first = await send2({ ...base, followRedirects: false });
+  report.requests++;
+  if (!first.ok) return { ...report, error: `The request itself failed: ${first.error.error}` };
+  const baseline = first.response;
+  const { probes, skipped } = activeProbes(base, opts);
+  if (base.headers.length !== given.headers.length) skipped.push("Headers that route a request (Host, Forwarded, X-Forwarded-*, Connection and similar) were left out of every check.");
+  report.skipped = skipped;
+  if ([401, 403].includes(baseline.status) && (SAFE.has(base.method.toUpperCase()) || opts.allowUnsafe)) {
+    let h = base.headers;
+    for (const name of ["X-Forwarded-For", "X-Real-IP", "X-Client-IP", "True-Client-IP", "X-Originating-IP"]) h = set(h, name, "127.0.0.1");
+    probes.push(probe("ip.spoof", "Claiming to come from 127.0.0.1", { ...base, headers: h }));
+  }
+  for (const p of probes) {
+    if (opts.signal?.aborted) break;
+    const r = await send2(p.request);
+    report.requests++;
+    if (!r.ok) {
+      report.probes.push({ id: p.id, title: p.title, method: p.request.method, error: r.error.error, flagged: false });
+      continue;
+    }
+    const finding = JUDGES[p.id]?.(baseline, r.response, p.request) ?? null;
+    if (finding && !report.findings.some((f) => f.id === finding.id)) report.findings.push(finding);
+    report.probes.push({ id: p.id, title: p.title, method: p.request.method, status: r.response.status, flagged: !!finding });
+  }
+  const order = ["high", "medium", "low", "info"];
+  report.findings.sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity));
+  return report;
+}
+
 // ../server/src/send.ts
 var import_undici = __toESM(require_undici(), 1);
 import zlib from "node:zlib";
@@ -28556,23 +29038,23 @@ function validate2(input) {
     throw fail(400, "invalid_request", `Not a valid URL: ${r.url}`);
   }
   if (url.protocol !== "http:" && url.protocol !== "https:") throw fail(400, "invalid_request", "Only http and https URLs can be sent");
-  const headers = Array.isArray(r.headers) ? r.headers : [];
-  for (const h of headers) {
+  const headers2 = Array.isArray(r.headers) ? r.headers : [];
+  for (const h of headers2) {
     if (!Array.isArray(h) || typeof h[0] !== "string" || typeof h[1] !== "string" || !TOKEN.test(h[0]) || /[\r\n]/.test(h[1]))
       throw fail(400, "invalid_request", `Invalid header: ${JSON.stringify(h)}`);
   }
   if (r.body !== void 0 && typeof r.body !== "string") throw fail(400, "invalid_request", "Body must be a string");
   if (r.cookieJar !== void 0) {
-    const ok = Array.isArray(r.cookieJar) && r.cookieJar.length <= 300 && r.cookieJar.every((c) => c && typeof c === "object" && typeof c.name === "string" && typeof c.value === "string" && typeof c.domain === "string" && typeof c.path === "string" && c.name.length + c.value.length < 4096 && c.domain.length < 256 && c.path.length < 1024 && !/[\r\n;]/.test(c.name + c.value));
-    if (!ok) throw fail(400, "invalid_request", "cookieJar must be a list of at most 300 cookies");
+    const ok2 = Array.isArray(r.cookieJar) && r.cookieJar.length <= 300 && r.cookieJar.every((c) => c && typeof c === "object" && typeof c.name === "string" && typeof c.value === "string" && typeof c.domain === "string" && typeof c.path === "string" && c.name.length + c.value.length < 4096 && c.domain.length < 256 && c.path.length < 1024 && !/[\r\n;]/.test(c.name + c.value));
+    if (!ok2) throw fail(400, "invalid_request", "cookieJar must be a list of at most 300 cookies");
   }
-  return { ...r, method: r.method.toUpperCase(), url: url.toString(), headers };
+  return { ...r, method: r.method.toUpperCase(), url: url.toString(), headers: headers2 };
 }
 async function decode(buf, encoding, cap) {
   const kind = (encoding ?? "").trim().toLowerCase();
   const make = (raw = false) => kind === "gzip" || kind === "x-gzip" ? zlib.createGunzip() : kind === "br" ? zlib.createBrotliDecompress() : raw ? zlib.createInflateRaw() : zlib.createInflate();
   if (!["gzip", "x-gzip", "deflate", "br"].includes(kind)) return { bytes: buf, truncated: false };
-  const run2 = (stream) => new Promise((resolve3, reject) => {
+  const run2 = (stream) => new Promise((resolve4, reject) => {
     const chunks = [];
     let size = 0;
     let done = false;
@@ -28584,7 +29066,7 @@ async function decode(buf, encoding, cap) {
         size = cap;
         done = true;
         stream.destroy();
-        resolve3({ bytes: Buffer.concat(chunks), truncated: true });
+        resolve4({ bytes: Buffer.concat(chunks), truncated: true });
         return;
       }
       chunks.push(c);
@@ -28593,7 +29075,7 @@ async function decode(buf, encoding, cap) {
     stream.on("end", () => {
       if (!done) {
         done = true;
-        resolve3({ bytes: Buffer.concat(chunks), truncated: false });
+        resolve4({ bytes: Buffer.concat(chunks), truncated: false });
       }
     });
     stream.on("error", (e) => {
@@ -28622,12 +29104,12 @@ async function send(input, opts) {
   const started = performance.now();
   let url = new URL(req.url);
   let method = req.method;
-  let headers = req.headers;
+  let headers2 = req.headers;
   let body = req.body === void 0 ? void 0 : Buffer.from(req.body, req.bodyEncoding === "base64" ? "base64" : "utf8");
   let redirects = 0;
   const hopJar = new CookieJar((req.cookieJar ?? []).map((c) => ({ ...c, hostOnly: !!c.hostOnly, secure: !!c.secure, httpOnly: !!c.httpOnly, created: Number(c.created) || 0, ...typeof c.expires === "number" ? { expires: c.expires } : {} })));
   const fromJar = new Map(hopJar.matching(url.toString()).map((c) => [c.name, c.value]));
-  let userCookies = headers.filter(([k]) => k.toLowerCase() === "cookie").flatMap(([, v]) => v.split(";")).map((s) => s.trim()).filter(Boolean).filter((p) => {
+  let userCookies = headers2.filter(([k]) => k.toLowerCase() === "cookie").flatMap(([, v]) => v.split(";")).map((s) => s.trim()).filter(Boolean).filter((p) => {
     const i = p.indexOf("=");
     return fromJar.get(p.slice(0, i).trim()) !== p.slice(i + 1).trim();
   });
@@ -28637,9 +29119,9 @@ async function send(input, opts) {
       if (!opts.allowPrivate) await assertPublicUrl(url);
       const res = await (0, import_undici.request)(url, {
         method,
-        headers: headers.flat(),
+        headers: headers2.flat(),
         body: method === "GET" || method === "HEAD" ? void 0 : body,
-        dispatcher: !opts.allowPrivate ? guardedAgent : opts.insecure ? insecureAgent : openAgent,
+        dispatcher: opts.dispatcher ?? (!opts.allowPrivate ? guardedAgent : opts.insecure ? insecureAgent : openAgent),
         signal,
         maxRedirections: 0
       });
@@ -28649,8 +29131,8 @@ async function send(input, opts) {
         if (++redirects > MAX_REDIRECTS) throw fail(502, "too_many_redirects", `Stopped after ${MAX_REDIRECTS} redirects`);
         const next = new URL(location2, url);
         if (next.protocol !== "http:" && next.protocol !== "https:") throw fail(502, "network", `Redirect to unsupported URL ${next}`);
-        const set = res.headers["set-cookie"];
-        const setList = set === void 0 ? [] : Array.isArray(set) ? set : [String(set)];
+        const set2 = res.headers["set-cookie"];
+        const setList = set2 === void 0 ? [] : Array.isArray(set2) ? set2 : [String(set2)];
         if (setList.length) {
           hopJar.store(url.toString(), setList);
           for (const value of setList) hopCookies.push({ url: url.toString(), value });
@@ -28658,17 +29140,17 @@ async function send(input, opts) {
           userCookies = userCookies.filter((p) => !setNames.has(p.split("=")[0].trim()));
         }
         if (next.origin !== url.origin) {
-          headers = headers.filter(([k]) => !["authorization", "proxy-authorization"].includes(k.toLowerCase()));
+          headers2 = headers2.filter(([k]) => !["authorization", "proxy-authorization"].includes(k.toLowerCase()));
           userCookies = [];
         }
         const jarCookies = hopJar.matching(next.toString());
         const names = new Set(userCookies.map((p) => p.split("=")[0].trim()));
         const cookie = [...userCookies, ...jarCookies.filter((c) => !names.has(c.name)).map((c) => `${c.name}=${c.value}`)].join("; ");
-        headers = [...headers.filter(([k]) => k.toLowerCase() !== "cookie"), ...cookie ? [["Cookie", cookie]] : []];
+        headers2 = [...headers2.filter(([k]) => k.toLowerCase() !== "cookie"), ...cookie ? [["Cookie", cookie]] : []];
         if (res.statusCode === 303 || (res.statusCode === 301 || res.statusCode === 302) && method === "POST") {
           method = "GET";
           body = void 0;
-          headers = headers.filter(([k]) => !["content-type", "content-length"].includes(k.toLowerCase()));
+          headers2 = headers2.filter(([k]) => !["content-type", "content-length"].includes(k.toLowerCase()));
         }
         url = next;
         continue;
@@ -28811,7 +29293,7 @@ var Sandbox = class {
   async run(source, ctx, phase) {
     const w = await this.start();
     const runId = ++this.runs;
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       let waiting = 0;
       let idle;
       const cleanup = () => {
@@ -28823,13 +29305,13 @@ var Sandbox = class {
       };
       const finish = (r) => {
         cleanup();
-        resolve3(r);
+        resolve4(r);
       };
       const kill = (why) => {
         cleanup();
         this.worker = void 0;
         void w.terminate();
-        resolve3({ ...empty(), error: why });
+        resolve4({ ...empty(), error: why });
       };
       const arm = () => {
         clearTimeout(idle);
@@ -28867,12 +29349,12 @@ var Sandbox = class {
       const onError = (e) => {
         cleanup();
         this.worker = void 0;
-        resolve3({ ...empty(), error: `The script sandbox failed: ${e.message}` });
+        resolve4({ ...empty(), error: `The script sandbox failed: ${e.message}` });
       };
       const onExit = () => {
         cleanup();
         this.worker = void 0;
-        resolve3({ ...empty(), error: "The script sandbox stopped." });
+        resolve4({ ...empty(), error: "The script sandbox stopped." });
       };
       w.on("message", onMessage);
       w.on("error", onError);
@@ -28998,9 +29480,181 @@ async function attachFiles(collection, opts) {
   return (id) => store.get(id);
 }
 
+// src/scan.ts
+import { writeFile, mkdir } from "node:fs/promises";
+import { dirname, resolve as resolve2 } from "node:path";
+import { parseArgs } from "node:util";
+var SCAN_USAGE = `Usage: wirecatch scan <url> [options]
+
+Active security checks on one request (Team plan): about ten altered copies of it (no credentials, a made-up
+token, another website's origin, forwarded headers, TRACE, marked input) to find weaknesses. Needs an
+organization key. Sites your organization has verified are checked by the Wirecatch server; localhost is
+checked from this machine. Exits 0 when nothing at --fail-on or above was found, 1 when something was,
+2 when the scan could not run.
+
+Options:
+  -X, --method <method>          Request method (default GET)
+  -H, --header <name: value>     Request header (repeatable)
+  -d, --data <body>              Request body
+      --allow-unsafe             Also resend requests that change data (POST, PUT, PATCH, DELETE)
+      --org-key <key>            Organization key (default: $WIRECATCH_ORG_KEY)
+      --server <url>             Wirecatch server (default: $WIRECATCH_SERVER or https://app.wirecatch.com)
+      --fail-on <level>          high, medium (default), low, info, or none
+  -r, --reporters <list>         cli, json, junit (default cli)
+      --reporter-json-export <file>   (default wirecatch-scan.json)
+      --reporter-junit-export <file>  (default wirecatch-scan.xml)
+  -k, --insecure                 Accept any TLS certificate (localhost only)
+  -h, --help                     Show this help`;
+var ScanError = class extends Error {
+};
+var color = !process.env.NO_COLOR && process.stdout.isTTY;
+var paint = (code) => (s) => color ? `\x1B[${code}m${s}\x1B[0m` : s;
+var red = paint("31");
+var green = paint("32");
+var dim = paint("2");
+var bold = paint("1");
+var xml2 = (s) => s.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F￾￿]/g, "").replace(/[<>&"']/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c]);
+async function api(server, path, key, body) {
+  let res;
+  try {
+    res = await fetch(`${server}${path}`, { method: body ? "POST" : "GET", headers: { authorization: `Bearer ${key}`, ...body ? { "content-type": "application/json" } : {} }, body: body ? JSON.stringify(body) : void 0 });
+  } catch (e) {
+    throw new ScanError(`Could not reach ${server}: ${e.message}`);
+  }
+  const data = await res.json().catch(() => null);
+  if (!res.ok) throw new ScanError(data?.error ?? `${server} answered ${res.status}`);
+  return data;
+}
+function junit(url, report, failOn) {
+  const failing = (sev) => failOn !== "none" && atLeast(sev, failOn);
+  const cases = report.probes.map((p) => {
+    const f = report.findings.find((x) => p.flagged && JUDGED[p.id] === x.id);
+    return f && failing(f.severity) ? `    <testcase name="${xml2(p.title)}" classname="security"><failure message="${xml2(`${f.severity}: ${f.title}`)}" type="SecurityFinding">${xml2(`${f.detail}
+Fix: ${f.fix}`)}</failure></testcase>` : `    <testcase name="${xml2(p.title)}" classname="security"/>`;
+  });
+  const failures = report.findings.filter((f) => failing(f.severity)).length;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<testsuites name="Wirecatch security scan" tests="${cases.length}" failures="${failures}">
+  <testsuite name="${xml2(url)}" tests="${cases.length}" failures="${failures}">
+${cases.join("\n")}
+  </testsuite>
+</testsuites>
+`;
+}
+var JUDGED = {
+  "auth.removed": "active.auth-not-required",
+  "auth.invalid": "active.auth-invalid-accepted",
+  "cors.origin": "active.cors-any-origin",
+  "cors.null": "active.cors-null-origin",
+  "host.forwarded": "active.host-reflected",
+  "ip.spoof": "active.ip-spoof-bypass",
+  "method.trace": "active.trace-enabled",
+  "input.reflect": "active.input-reflected",
+  "input.quote": "active.sql-error"
+};
+async function scanCommand(argv2) {
+  try {
+    return await scan(argv2);
+  } catch (e) {
+    if (e instanceof ScanError || e.code?.startsWith("ERR_PARSE_ARGS")) {
+      process.stderr.write(`wirecatch scan: ${e.message}
+${e instanceof ScanError ? "" : `
+${SCAN_USAGE}
+`}`);
+      return 2;
+    }
+    throw e;
+  }
+}
+async function scan(argv2) {
+  const { values: o, positionals } = parseArgs({
+    args: argv2,
+    allowPositionals: true,
+    options: {
+      method: { type: "string", short: "X" },
+      header: { type: "string", short: "H", multiple: true },
+      data: { type: "string", short: "d" },
+      "allow-unsafe": { type: "boolean" },
+      "org-key": { type: "string" },
+      server: { type: "string" },
+      "fail-on": { type: "string" },
+      reporters: { type: "string", short: "r" },
+      "reporter-json-export": { type: "string" },
+      "reporter-junit-export": { type: "string" },
+      insecure: { type: "boolean", short: "k" },
+      help: { type: "boolean", short: "h" }
+    }
+  });
+  if (o.help) {
+    process.stdout.write(`${SCAN_USAGE}
+`);
+    return 0;
+  }
+  const [url, ...extra] = positionals;
+  if (!url || extra.length) throw new ScanError(`Which URL should be checked?
+
+${SCAN_USAGE}`);
+  try {
+    new URL(url);
+  } catch {
+    throw new ScanError(`Not a URL: ${url}`);
+  }
+  const failOn = o["fail-on"] ?? "medium";
+  if (failOn !== "none" && !SECURITY_SEVERITIES.includes(failOn)) throw new ScanError(`--fail-on must be one of ${SECURITY_SEVERITIES.join(", ")} or none`);
+  const reporters = new Set((o.reporters ?? "cli").split(",").map((r) => r.trim()).filter(Boolean));
+  for (const r of reporters) if (!["cli", "json", "junit"].includes(r)) throw new ScanError(`Unknown reporter "${r}". Use cli, json or junit.`);
+  const key = o["org-key"] || process.env.WIRECATCH_ORG_KEY;
+  if (!key) throw new ScanError("Active checks need an organization key: pass --org-key or set WIRECATCH_ORG_KEY (Organization in the Wirecatch app).");
+  const server = (o.server ?? process.env.WIRECATCH_SERVER ?? "https://app.wirecatch.com").replace(/\/+$/, "");
+  const headers2 = (o.header ?? []).map((h) => {
+    const i = h.indexOf(":");
+    if (i < 1) throw new ScanError(`--header needs "Name: value", got "${h}"`);
+    return [h.slice(0, i).trim(), h.slice(i + 1).trim()];
+  });
+  const request2 = { method: (o.method ?? (o.data ? "POST" : "GET")).toUpperCase(), url, headers: headers2, ...o.data !== void 0 ? { body: o.data } : {} };
+  let report;
+  if (isLocalTarget(url)) {
+    const me = await api(server, "/api/orgs/me", key);
+    if (me.plan !== "team") throw new ScanError("Active security checks are part of the Team plan. Ask Wired Technologies to upgrade this organization.");
+    report = await runActiveChecks(async (r) => {
+      try {
+        return { ok: true, response: await send({ ...r, timeoutMs: r.timeoutMs ?? 15e3 }, { allowPrivate: true, insecure: !!o.insecure, maxTimeoutMs: 3e4, maxBodyBytes: 1024 * 1024 }) };
+      } catch (e) {
+        return { ok: false, error: e instanceof SendFailure ? e.detail : { code: "network", error: e.message } };
+      }
+    }, request2, { allowUnsafe: !!o["allow-unsafe"] });
+  } else {
+    report = await api(server, "/api/security/scan", key, { request: request2, allowUnsafe: !!o["allow-unsafe"] });
+  }
+  if (reporters.has("cli")) {
+    const out = [`${bold("Security scan")} ${request2.method} ${url}`, ""];
+    if (report.error) out.push(red(report.error));
+    for (const f of report.findings) {
+      out.push(`${f.severity === "high" || f.severity === "medium" ? red(f.severity.toUpperCase()) : dim(f.severity.toUpperCase())} ${f.title}${f.evidence ? dim(` (${f.evidence})`) : ""}`);
+      out.push(`  ${dim(f.detail)}`, `  Fix: ${f.fix}`, "");
+    }
+    for (const p of report.probes) out.push(`  ${p.flagged ? red("\u2717") : green("\u2713")} ${p.title} ${dim(`${p.method} \u2192 ${p.error ?? p.status}`)}`);
+    for (const s of report.skipped) out.push(dim(`  ${s}`));
+    out.push("", `${report.requests} requests sent \xB7 ${report.findings.length === 0 ? green("no weaknesses found") : red(`${report.findings.length} finding${report.findings.length === 1 ? "" : "s"}`)}`);
+    process.stdout.write(`${out.join("\n")}
+`);
+  }
+  const write = async (path, content) => {
+    const p = resolve2(path);
+    await mkdir(dirname(p), { recursive: true });
+    await writeFile(p, content);
+  };
+  if (reporters.has("json")) await write(o["reporter-json-export"] ?? "wirecatch-scan.json", `${JSON.stringify({ url, method: request2.method, at: (/* @__PURE__ */ new Date()).toISOString(), ...report }, null, 2)}
+`);
+  if (reporters.has("junit")) await write(o["reporter-junit-export"] ?? "wirecatch-scan.xml", junit(url, report, failOn));
+  if (report.error) return 2;
+  return failOn !== "none" && report.findings.some((f) => atLeast(f.severity, failOn)) ? 1 : 0;
+}
+
 // src/main.ts
-var VERSION = true ? "0.1.0" : "0.1.0-dev";
+var VERSION = true ? "0.2.0" : "0.1.0-dev";
 var USAGE = `Usage: wirecatch run <collection.json> [options]
+       wirecatch scan <url> [options]     Active security checks (Team plan); see wirecatch scan --help
 
 Runs every request in a collection file (v2.0 or v2.1 format, as Wirecatch exports), with its scripts and tests.
 Exits 0 when everything passed, 1 when a request or test failed, 2 when the input could not be used.
@@ -29017,6 +29671,11 @@ Options:
       --timeout-request <ms>        Give up on a request after this long (default 30000)
       --script-timeout <ms>         Stop a script that runs this long on its own (default 5000)
       --bail                        Stop at the first failed request or test
+      --fail-on-security <level>    Fail the run when a security finding is at least this severe:
+                                    high, medium, low or info (findings are shown either way)
+  -p, --parallel <n>                Run up to n iterations at once (1-50). Requests inside an iteration
+                                    stay in order; each iteration keeps the variables its scripts set to
+                                    itself, so --export-environment writes the starting values
       --working-dir <dir>           Where file uploads named in the collection are read from (default: here)
       --insecure-file-read          Allow uploads from outside the working directory
   -k, --insecure                    Accept any TLS certificate
@@ -29030,21 +29689,21 @@ Options:
   -v, --version                     Show the version`;
 var UsageError = class extends Error {
 };
-var color = !process.env.NO_COLOR && process.stdout.isTTY;
-var paint = (code) => (s) => color ? `\x1B[${code}m${s}\x1B[0m` : s;
-var green = paint("32");
-var red = paint("31");
-var dim = paint("2");
-var bold = paint("1");
+var color2 = !process.env.NO_COLOR && process.stdout.isTTY;
+var paint2 = (code) => (s) => color2 ? `\x1B[${code}m${s}\x1B[0m` : s;
+var green2 = paint2("32");
+var red2 = paint2("31");
+var dim2 = paint2("2");
+var bold2 = paint2("1");
 async function readJson(path, what) {
-  let text;
+  let text2;
   try {
-    text = await readFile2(path, "utf8");
+    text2 = await readFile2(path, "utf8");
   } catch {
     throw new UsageError(`Could not read the ${what} file: ${path}`);
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
     throw new UsageError(`The ${what} file is not valid JSON: ${path}`);
   }
@@ -29077,19 +29736,20 @@ function withOverrides(rows2, overrides) {
   return applyVariableUpdates(rows2, overrides);
 }
 async function writeOut(path, content) {
-  await mkdir(dirname(resolve2(path)), { recursive: true });
-  await writeFile(path, content);
+  await mkdir2(dirname2(resolve3(path)), { recursive: true });
+  await writeFile2(path, content);
 }
 function printStep(step, verbose) {
   const name = [...step.path, step.name].join(" / ");
-  const out = [`${bold("\u2192")} ${name}`];
-  const line = step.error ? `  ${step.method} ${step.url}  ${red(`failed: ${step.error}`)}` : `  ${step.method} ${step.url}  ${(step.status ?? 0) >= 400 ? red(String(step.status)) : green(String(step.status))}  ${dim(formatDuration(step.timeMs ?? 0))}`;
+  const out = [`${bold2("\u2192")} ${name}`];
+  const line = step.error ? `  ${step.method} ${step.url}  ${red2(`failed: ${step.error}`)}` : `  ${step.method} ${step.url}  ${(step.status ?? 0) >= 400 ? red2(String(step.status)) : green2(String(step.status))}  ${dim2(formatDuration(step.timeMs ?? 0))}`;
   out.push(line);
   for (const t of step.tests) {
-    out.push(t.passed ? `  ${green("\u2713")} ${t.name}` : `  ${red("\u2717")} ${t.name}`);
-    if (!t.passed && t.error) out.push(`    ${red(t.error)}`);
+    out.push(t.passed ? `  ${green2("\u2713")} ${t.name}` : `  ${red2("\u2717")} ${t.name}`);
+    if (!t.passed && t.error) out.push(`    ${red2(t.error)}`);
   }
-  if (verbose) for (const l of step.logs ?? []) out.push(`  ${dim(`\u2502 ${l}`)}`);
+  for (const f of step.security ?? []) out.push(`  ${f.severity === "high" || f.severity === "medium" ? red2("!") : dim2("\xB7")} ${dim2(`security ${f.severity}:`)} ${f.title}${f.evidence ? dim2(` (${f.evidence})`) : ""}`);
+  if (verbose) for (const l of step.logs ?? []) out.push(`  ${dim2(`\u2502 ${l}`)}`);
   process.stdout.write(`${out.join("\n")}
 
 `);
@@ -29098,18 +29758,18 @@ function printSummary(report) {
   const s = report.summary;
   const parts = [
     `${s.requests} request${s.requests === 1 ? "" : "s"}`,
-    green(`${s.passed} passed`),
-    s.failed ? red(`${s.failed} failed`) : `${s.failed} failed`,
-    ...s.failedRequests ? [red(`${s.failedRequests} with problems`)] : [],
-    dim(`avg ${formatDuration(s.avgMs)}`)
+    green2(`${s.passed} passed`),
+    s.failed ? red2(`${s.failed} failed`) : `${s.failed} failed`,
+    ...s.failedRequests ? [red2(`${s.failedRequests} with problems`)] : [],
+    dim2(`avg ${formatDuration(s.avgMs)}`)
   ];
   process.stdout.write(`${parts.join(" \xB7 ")}
 `);
-  if (report.bailed) process.stdout.write(red("Stopped at the first failure (--bail).\n"));
+  if (report.bailed) process.stdout.write(red2("Stopped at the first failure (--bail).\n"));
 }
-async function run(argv) {
-  const { values: o, positionals } = parseArgs({
-    args: argv,
+async function run(argv2) {
+  const { values: o, positionals } = parseArgs2({
+    args: argv2,
     allowPositionals: true,
     options: {
       environment: { type: "string", short: "e" },
@@ -29123,6 +29783,8 @@ async function run(argv) {
       "timeout-request": { type: "string" },
       "script-timeout": { type: "string" },
       bail: { type: "boolean" },
+      parallel: { type: "string", short: "p" },
+      "fail-on-security": { type: "string" },
       "working-dir": { type: "string" },
       "insecure-file-read": { type: "boolean" },
       insecure: { type: "boolean", short: "k" },
@@ -29176,14 +29838,14 @@ async function run(argv) {
   globals = withOverrides(globals, pairs(o["global-var"], "--global-var"));
   let data;
   if (o["iteration-data"]) {
-    let text;
+    let text2;
     try {
-      text = await readFile2(o["iteration-data"], "utf8");
+      text2 = await readFile2(o["iteration-data"], "utf8");
     } catch {
       throw new UsageError(`Could not read the data file: ${o["iteration-data"]}`);
     }
     try {
-      data = parseDataFile(text, o["iteration-data"]);
+      data = parseDataFile(text2, o["iteration-data"]);
     } catch (e) {
       throw new UsageError(`${o["iteration-data"]}: ${e.message}`);
     }
@@ -29197,11 +29859,15 @@ async function run(argv) {
   const delayMs = intOption(o["delay-request"], "--delay-request", 0);
   const timeoutMs = intOption(o["timeout-request"], "--timeout-request", 3e4, 1);
   const scriptMs = intOption(o["script-timeout"], "--script-timeout", 5e3, 50);
+  const parallel = intOption(o.parallel, "--parallel", 1, 1);
+  const securityFailOn = o["fail-on-security"];
+  if (securityFailOn !== void 0 && !SECURITY_SEVERITIES.includes(securityFailOn)) throw new UsageError(`--fail-on-security must be one of ${SECURITY_SEVERITIES.join(", ")}`);
+  if (parallel > MAX_PARALLEL) throw new UsageError(`--parallel can be at most ${MAX_PARALLEL}.`);
   const state = { collection, environment, globals };
   const files = await attachFiles(collection, { workingDir: o["working-dir"] ?? process.cwd(), insecureFileRead: !!o["insecure-file-read"] });
   const { host, close } = createHost(state, { timeoutMs, scriptMs, insecure: !!o.insecure, files });
   const cli = reporters.has("cli");
-  if (cli) process.stdout.write(`${bold(collection.name)}${o.folder ? dim(` / ${o.folder}`) : ""}
+  if (cli) process.stdout.write(`${bold2(collection.name)}${o.folder ? dim2(` / ${o.folder}`) : ""}
 
 `);
   let report;
@@ -29213,13 +29879,22 @@ async function run(argv) {
       data,
       delayMs,
       bail: !!o.bail,
+      parallel,
+      // In parallel, iterations finish in any order: print each one whole when it is done.
       onIteration: (it, total) => {
-        if (cli && total > 1) process.stdout.write(`${bold(`Iteration ${it + 1}/${total}`)}
+        if (cli && total > 1 && parallel === 1) process.stdout.write(`${bold2(`Iteration ${it + 1}/${total}`)}
 
 `);
       },
       onStep: (step) => {
-        if (cli) printStep(step, !!o.verbose);
+        if (cli && parallel === 1) printStep(step, !!o.verbose);
+      },
+      onIterationDone: (it, total, steps) => {
+        if (!cli || parallel === 1) return;
+        if (total > 1) process.stdout.write(`${bold2(`Iteration ${it + 1}/${total}`)}
+
+`);
+        for (const step of steps) printStep(step, !!o.verbose);
       }
     });
   } finally {
@@ -29228,14 +29903,18 @@ async function run(argv) {
   if (cli) printSummary(report);
   if (reporters.has("json")) await writeOut(o["reporter-json-export"] ?? "wirecatch-run.json", `${JSON.stringify({ collection: report.collection, at: (/* @__PURE__ */ new Date()).toISOString(), summary: report.summary, bailed: report.bailed, steps: report.steps }, null, 2)}
 `);
-  if (reporters.has("junit")) await writeOut(o["reporter-junit-export"] ?? "wirecatch-junit.xml", toJUnit(report));
+  if (reporters.has("junit")) await writeOut(o["reporter-junit-export"] ?? "wirecatch-junit.xml", toJUnit(report, { securityFailOn }));
   if (o["export-environment"]) await writeOut(o["export-environment"], `${JSON.stringify(exportPostmanEnvironment(state.environment ?? { id: "env_cli", name: "CLI", variables: [] }), null, 2)}
 `);
   if (o["export-globals"]) await writeOut(o["export-globals"], `${JSON.stringify({ ...exportPostmanEnvironment({ id: "globals", name: "Globals", variables: state.globals }), _postman_variable_scope: "globals" }, null, 2)}
 `);
-  return report.summary.failedRequests > 0 || report.summary.failed > 0 ? 1 : 0;
+  const insecure = securityFailOn ? report.steps.some((st) => st.security?.some((f) => atLeast(f.severity, securityFailOn))) : false;
+  if (cli && insecure) process.stdout.write(red2(`Security findings at ${securityFailOn} or above (--fail-on-security).
+`));
+  return report.summary.failedRequests > 0 || report.summary.failed > 0 || insecure ? 1 : 0;
 }
-run(process.argv.slice(2)).then(
+var argv = process.argv.slice(2);
+(argv[0] === "scan" ? scanCommand(argv.slice(1)) : run(argv)).then(
   (code) => {
     process.exitCode = code;
   },