vulcn 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-02-05
+
+### Added
+
+- Initial release of Vulcn - Security testing recorder & runner
+- **Session Recording** - Record browser interactions (clicks, form fills, navigation)
+- **Session Replay** - Replay sessions with security payloads injected
+- **Smart Browser Detection** - Uses system Chrome/Edge first, Playwright fallback
+- **Built-in Payloads** - XSS and SQL injection payload sets
+- **YAML Sessions** - Human-readable session format with Zod validation
+- **Cross-Platform** - macOS, Linux, and Windows support
+
+### CLI Commands
+
+- `vulcn record` - Record browser interactions
+- `vulcn run` - Replay session with payloads
+- `vulcn payloads` - List available payloads
+- `vulcn doctor` - Check browser availability
+- `vulcn install` - Install Playwright browsers
+
+[0.1.0]: https://github.com/rawlab-dev/vulcn/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rawlab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,227 @@
+# 🔐 Vulcn
+
+**Security testing made simple.** Record once, test with payloads, find vulnerabilities.
+
+[![CI](https://github.com/rawlab-dev/vulcn/actions/workflows/ci.yml/badge.svg)](https://github.com/rawlab-dev/vulcn/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/vulcn.svg)](https://www.npmjs.com/package/vulcn)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+## ⚡ Quick Start
+
+```bash
+# Install globally
+npm install -g vulcn
+
+# Record a session
+vulcn record --url https://example.com/login
+
+# Run with XSS payloads
+vulcn run session.vulcn.yml --payload xss-basic
+```
+
+**Zero-config browser support** — Vulcn uses your existing Chrome or Edge. No browser downloads needed.
+
+---
+
+## 🎯 What is Vulcn?
+
+Vulcn is a security testing tool that:
+
+1. **Records** your browser interactions (clicks, form inputs, navigation)
+2. **Replays** them with security payloads injected into input fields
+3. **Detects** vulnerabilities like XSS and SQL injection
+
+Think of it as **Playwright + Burp Suite**, but simpler and focused on automated payload testing.
+
+---
+
+## 🚀 Features
+
+| Feature               | Description                                         |
+| --------------------- | --------------------------------------------------- |
+| 🎬 **Record**         | Capture browser sessions as replayable YAML files   |
+| 🔍 **Test**           | Inject XSS, SQLi, and custom payloads automatically |
+| 🌐 **Cross-platform** | Works on macOS, Linux, and Windows                  |
+| 🚫 **Zero-config**    | Uses system Chrome/Edge by default                  |
+| 📊 **CI/CD Ready**    | Exit codes for pipeline integration                 |
+| 🔧 **Extensible**     | Add custom payloads and detection patterns          |
+
+---
+
+## 📦 Installation
+
+### CLI
+
+```bash
+npm install -g vulcn
+```
+
+### Programmatic API
+
+```bash
+npm install @vulcn/engine
+```
+
+```typescript
+import { Recorder, Runner, parseSession } from "@vulcn/engine";
+
+// Record programmatically
+const session = await Recorder.start("https://example.com");
+// ... user interacts ...
+const recorded = await session.stop();
+
+// Run with payloads
+const result = await Runner.execute(recorded, ["xss-basic"]);
+console.log(result.findings);
+```
+
+---
+
+## 🎬 Recording
+
+Start recording a session:
+
+```bash
+vulcn record --url https://target.com/login
+```
+
+Options:
+
+- `--url, -u` — Start URL (required)
+- `--output, -o` — Output file (default: `session.vulcn.yml`)
+- `--browser, -b` — Browser (`chromium`, `firefox`, `webkit`)
+- `--headless` — Run headless
+
+When recording:
+
+1. Browser opens to your start URL
+2. Interact normally (fill forms, click buttons)
+3. Press `Ctrl+C` to stop and save
+
+---
+
+## 🔍 Running Tests
+
+Run a recorded session with payloads:
+
+```bash
+vulcn run session.vulcn.yml --payload xss-basic --payload sqli-basic
+```
+
+Options:
+
+- `--payload, -p` — Payload to use (can specify multiple)
+- `--headless` — Run headless (default: true)
+- `--browser, -b` — Browser to use
+
+### Built-in Payloads
+
+| Payload      | Category | Description                    |
+| ------------ | -------- | ------------------------------ |
+| `xss-basic`  | XSS      | Script tags and event handlers |
+| `xss-event`  | XSS      | Event handler injection        |
+| `xss-svg`    | XSS      | SVG-based XSS                  |
+| `sqli-basic` | SQLi     | Basic SQL injection            |
+| `sqli-error` | SQLi     | Error-based SQLi detection     |
+| `sqli-blind` | SQLi     | Blind SQLi payloads            |
+
+List all payloads:
+
+```bash
+vulcn payloads
+```
+
+---
+
+## 📄 Session Format
+
+Sessions are stored as YAML:
+
+```yaml
+version: "1"
+name: Login Test
+recordedAt: "2026-02-05T12:00:00Z"
+browser: chromium
+viewport:
+  width: 1280
+  height: 720
+startUrl: https://example.com/login
+steps:
+  - id: step_001
+    type: navigate
+    url: https://example.com/login
+    timestamp: 0
+  - id: step_002
+    type: input
+    selector: input[name="username"]
+    value: testuser
+    injectable: true
+    timestamp: 1500
+  - id: step_003
+    type: click
+    selector: button[type="submit"]
+    timestamp: 3000
+```
+
+---
+
+## 🩺 Browser Management
+
+Check available browsers:
+
+```bash
+vulcn doctor
+```
+
+Install Playwright browsers (if needed):
+
+```bash
+vulcn install chromium
+vulcn install --all  # Install all browsers
+```
+
+---
+
+## 🔧 CI/CD Integration
+
+Vulcn returns exit code `1` when vulnerabilities are found:
+
+```yaml
+# GitHub Actions example
+- name: Security Test
+  run: |
+    npm install -g vulcn
+    vulcn run tests/login.vulcn.yml --payload xss-basic --headless
+```
+
+---
+
+## 📚 Documentation
+
+- [Contributing Guide](./CONTRIBUTING.md)
+- [Security Policy](./SECURITY.md)
+
+---
+
+## 🛣️ Roadmap
+
+- [ ] HTML/JSON reports
+- [ ] Custom payload definitions
+- [ ] SSRF and path traversal payloads
+- [ ] Authenticated session support
+- [ ] API endpoint testing
+- [ ] Vulnerability severity scoring
+
+---
+
+## 📝 License
+
+[MIT](./LICENSE) © [rawlab](https://rawlab.dev)
+
+---
+
+<p align="center">
+  Made with ❤️ by <a href="https://rawlab.dev">rawlab</a>
+</p>

package/dist/index.js

@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/record.ts
+import { writeFile } from "fs/promises";
+import { Recorder, serializeSession } from "@vulcn/engine";
+import chalk from "chalk";
+import ora from "ora";
+async function recordCommand(options) {
+  const spinner = ora("Starting browser...").start();
+  try {
+    const session = await Recorder.start(options.url, {
+      browser: options.browser,
+      headless: options.headless
+    });
+    spinner.succeed("Browser started");
+    console.log();
+    console.log(chalk.cyan("\u{1F3AC} Recording started"));
+    console.log(chalk.gray(`   URL: ${options.url}`));
+    console.log(chalk.gray(`   Browser: ${options.browser}`));
+    console.log();
+    console.log(
+      chalk.yellow("   Interact with the browser to record actions.")
+    );
+    console.log(chalk.yellow("   Press Ctrl+C to stop recording."));
+    console.log();
+    if (process.stdin.isTTY) {
+      process.stdin.setRawMode(true);
+    }
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    let stopped = false;
+    const stopRecording = async () => {
+      if (stopped) return;
+      stopped = true;
+      console.log();
+      const saveSpinner = ora("Stopping recording...").start();
+      try {
+        const result = await session.stop();
+        const yaml = serializeSession(result);
+        await writeFile(options.output, yaml, "utf-8");
+        saveSpinner.succeed(`Session saved to ${chalk.green(options.output)}`);
+        console.log();
+        console.log(chalk.cyan(`\u{1F4DD} Recorded ${result.steps.length} steps`));
+        console.log();
+        console.log(chalk.gray("To run with payloads:"));
+        console.log(
+          chalk.white(`   vulcn run ${options.output} --payload xss-basic`)
+        );
+      } catch (err) {
+        saveSpinner.fail("Failed to save session");
+        console.error(chalk.red(String(err)));
+        process.exit(1);
+      }
+    };
+    await new Promise((resolve) => {
+      const handleStop = () => {
+        process.stdin.removeAllListeners("data");
+        process.off("SIGINT", handleStop);
+        process.off("SIGTERM", handleStop);
+        stopRecording().then(() => {
+          resolve();
+        }).catch((err) => {
+          console.error(chalk.red(String(err)));
+          process.exit(1);
+        });
+      };
+      process.stdin.on("data", (key) => {
+        if (key === "") {
+          handleStop();
+        }
+      });
+      process.on("SIGINT", handleStop);
+      process.on("SIGTERM", handleStop);
+    });
+  } catch (err) {
+    spinner.fail("Failed to start recording");
+    console.error(chalk.red(String(err)));
+    process.exit(1);
+  }
+}
+
+// src/run.ts
+import { readFile } from "fs/promises";
+import {
+  Runner,
+  parseSession
+} from "@vulcn/engine";
+import chalk2 from "chalk";
+import ora2 from "ora";
+async function runCommand(sessionFile, options) {
+  const loadSpinner = ora2("Loading session...").start();
+  let sessionYaml;
+  try {
+    sessionYaml = await readFile(sessionFile, "utf-8");
+  } catch {
+    loadSpinner.fail(`Cannot read file: ${sessionFile}`);
+    process.exit(1);
+  }
+  let session;
+  try {
+    session = parseSession(sessionYaml);
+    loadSpinner.succeed(`Loaded session: ${chalk2.cyan(session.name)}`);
+  } catch (err) {
+    loadSpinner.fail("Invalid session file");
+    console.error(chalk2.red(String(err)));
+    process.exit(1);
+  }
+  const payloads = options.payload ?? ["xss-basic"];
+  console.log();
+  console.log(chalk2.cyan("\u{1F50D} Running security tests"));
+  console.log(chalk2.gray(`   Session: ${session.name}`));
+  console.log(chalk2.gray(`   Payloads: ${payloads.join(", ")}`));
+  console.log(chalk2.gray(`   Browser: ${options.browser}`));
+  console.log(chalk2.gray(`   Headless: ${options.headless}`));
+  console.log();
+  const runSpinner = ora2("Executing tests...").start();
+  try {
+    const result = await Runner.execute(session, payloads, {
+      browser: options.browser,
+      headless: options.headless,
+      onFinding: (finding) => {
+        runSpinner.stop();
+        console.log(chalk2.red(`\u26A0\uFE0F  FINDING: ${finding.title}`));
+        console.log(chalk2.gray(`   Step: ${finding.stepId}`));
+        console.log(
+          chalk2.gray(`   Payload: ${finding.payload.slice(0, 50)}...`)
+        );
+        console.log(chalk2.gray(`   URL: ${finding.url}`));
+        console.log();
+        runSpinner.start("Continuing tests...");
+      }
+    });
+    runSpinner.succeed("Tests completed");
+    console.log();
+    console.log(chalk2.cyan("\u{1F4CA} Results"));
+    console.log(chalk2.gray(`   Steps executed: ${result.stepsExecuted}`));
+    console.log(chalk2.gray(`   Payloads tested: ${result.payloadsTested}`));
+    console.log(
+      chalk2.gray(`   Duration: ${(result.duration / 1e3).toFixed(1)}s`)
+    );
+    console.log();
+    if (result.findings.length > 0) {
+      console.log(chalk2.red(`\u{1F6A8} ${result.findings.length} findings detected!`));
+      console.log();
+      for (const finding of result.findings) {
+        const severityColor = finding.severity === "critical" || finding.severity === "high" ? chalk2.red : finding.severity === "medium" ? chalk2.yellow : chalk2.gray;
+        console.log(
+          severityColor(`[${finding.severity.toUpperCase()}] ${finding.title}`)
+        );
+        console.log(chalk2.gray(`  Type: ${finding.type}`));
+        console.log(chalk2.gray(`  Step: ${finding.stepId}`));
+        console.log(chalk2.gray(`  URL: ${finding.url}`));
+        console.log(chalk2.gray(`  Payload: ${finding.payload}`));
+        console.log();
+      }
+      process.exit(1);
+    } else {
+      console.log(chalk2.green("\u2705 No vulnerabilities detected"));
+    }
+    if (result.errors.length > 0) {
+      console.log();
+      console.log(
+        chalk2.yellow(`\u26A0\uFE0F  ${result.errors.length} errors during execution:`)
+      );
+      for (const err of result.errors.slice(0, 5)) {
+        console.log(chalk2.gray(`   - ${err}`));
+      }
+      if (result.errors.length > 5) {
+        console.log(chalk2.gray(`   ... and ${result.errors.length - 5} more`));
+      }
+    }
+  } catch (err) {
+    runSpinner.fail("Test execution failed");
+    console.error(chalk2.red(String(err)));
+    process.exit(1);
+  }
+}
+
+// src/payloads.ts
+import { BUILTIN_PAYLOADS } from "@vulcn/engine";
+import chalk3 from "chalk";
+async function payloadsCommand() {
+  console.log();
+  console.log(chalk3.cyan("\u{1F4E6} Available Payloads"));
+  console.log();
+  const payloads = Object.values(BUILTIN_PAYLOADS);
+  for (const payload of payloads) {
+    console.log(chalk3.white(`  ${payload.name}`));
+    console.log(chalk3.gray(`    Category: ${payload.category}`));
+    console.log(chalk3.gray(`    ${payload.description}`));
+    console.log(chalk3.gray(`    Payloads: ${payload.payloads.length}`));
+    console.log();
+  }
+  console.log(chalk3.gray("Usage:"));
+  console.log(chalk3.white("  vulcn run session.vulcn.yml --payload xss-basic"));
+}
+
+// src/install.ts
+import { installBrowsers, checkBrowsers } from "@vulcn/engine";
+import chalk4 from "chalk";
+import ora3 from "ora";
+async function installCommand(browsers, options) {
+  let browsersToInstall;
+  if (options?.all) {
+    browsersToInstall = ["chromium", "firefox", "webkit"];
+  } else if (browsers && browsers.length > 0) {
+    browsersToInstall = browsers;
+  } else {
+    browsersToInstall = ["chromium"];
+  }
+  console.log();
+  console.log(chalk4.cyan("\u{1F527} Installing browsers for Vulcn"));
+  console.log();
+  try {
+    await installBrowsers(browsersToInstall);
+    console.log();
+    console.log(chalk4.green("\u2705 Browsers installed successfully"));
+  } catch (err) {
+    console.error(chalk4.red("Failed to install browsers:"), err);
+    process.exit(1);
+  }
+}
+async function doctorCommand() {
+  console.log();
+  console.log(chalk4.cyan("\u{1FA7A} Vulcn Browser Check"));
+  console.log();
+  const spinner = ora3("Checking available browsers...").start();
+  try {
+    const status = await checkBrowsers();
+    spinner.stop();
+    console.log(chalk4.white("System Browsers:"));
+    console.log(
+      `  Chrome:    ${status.systemChrome ? chalk4.green("\u2713 Available") : chalk4.gray("\u2717 Not found")}`
+    );
+    console.log(
+      `  Edge:      ${status.systemEdge ? chalk4.green("\u2713 Available") : chalk4.gray("\u2717 Not found")}`
+    );
+    console.log();
+    console.log(chalk4.white("Playwright Browsers:"));
+    console.log(
+      `  Chromium:  ${status.playwrightChromium ? chalk4.green("\u2713 Installed") : chalk4.gray("\u2717 Not installed")}`
+    );
+    console.log(
+      `  Firefox:   ${status.playwrightFirefox ? chalk4.green("\u2713 Installed") : chalk4.gray("\u2717 Not installed")}`
+    );
+    console.log(
+      `  WebKit:    ${status.playwrightWebkit ? chalk4.green("\u2713 Installed") : chalk4.gray("\u2717 Not installed")}`
+    );
+    console.log();
+    if (status.systemChrome || status.systemEdge) {
+      console.log(
+        chalk4.green("\u2705 Ready to use! Vulcn will use your system browser.")
+      );
+    } else if (status.playwrightChromium) {
+      console.log(
+        chalk4.green("\u2705 Ready to use! Vulcn will use Playwright Chromium.")
+      );
+    } else {
+      console.log(chalk4.yellow("\u26A0\uFE0F  No browsers found."));
+      console.log();
+      console.log(chalk4.white("Options:"));
+      console.log(chalk4.gray("  1. Install Google Chrome (recommended)"));
+      console.log(chalk4.gray("  2. Run: vulcn install"));
+    }
+  } catch (err) {
+    spinner.fail("Failed to check browsers");
+    console.error(chalk4.red(String(err)));
+    process.exit(1);
+  }
+}
+
+// src/index.ts
+var program = new Command();
+program.name("vulcn").description("Security testing recorder & runner").version("0.1.0");
+program.command("record").description("Record browser interactions").requiredOption("-u, --url <url>", "Starting URL to record from").option("-o, --output <file>", "Output file path", "session.vulcn.yml").option(
+  "-b, --browser <browser>",
+  "Browser to use (chromium, firefox, webkit)",
+  "chromium"
+).option("--headless", "Run in headless mode", false).action(recordCommand);
+program.command("run").description("Run a recorded session with payloads").argument("<session>", "Session file to run (.vulcn.yml)").option(
+  "-p, --payload <names...>",
+  "Payloads to use (e.g., xss-basic, sqli-basic)"
+).option("-b, --browser <browser>", "Browser to use", "chromium").option("--headless", "Run in headless mode", true).option("--no-headless", "Run with visible browser").action(runCommand);
+program.command("payloads").description("List available payloads").action(payloadsCommand);
+program.command("install").description("Install Playwright browsers").argument("[browsers...]", "Browsers to install (chromium, firefox, webkit)").option("--all", "Install all browsers").action(installCommand);
+program.command("doctor").description("Check available browsers").action(doctorCommand);
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/record.ts","../src/run.ts","../src/payloads.ts","../src/install.ts"],"sourcesContent":["import { Command } from \"commander\";\nimport { recordCommand } from \"./record\";\nimport { runCommand } from \"./run\";\nimport { payloadsCommand } from \"./payloads\";\nimport { installCommand, doctorCommand } from \"./install\";\n\nconst program = new Command();\n\nprogram\n  .name(\"vulcn\")\n  .description(\"Security testing recorder & runner\")\n  .version(\"0.1.0\");\n\n// vulcn record\nprogram\n  .command(\"record\")\n  .description(\"Record browser interactions\")\n  .requiredOption(\"-u, --url <url>\", \"Starting URL to record from\")\n  .option(\"-o, --output <file>\", \"Output file path\", \"session.vulcn.yml\")\n  .option(\n    \"-b, --browser <browser>\",\n    \"Browser to use (chromium, firefox, webkit)\",\n    \"chromium\",\n  )\n  .option(\"--headless\", \"Run in headless mode\", false)\n  .action(recordCommand);\n\n// vulcn run\nprogram\n  .command(\"run\")\n  .description(\"Run a recorded session with payloads\")\n  .argument(\"<session>\", \"Session file to run (.vulcn.yml)\")\n  .option(\n    \"-p, --payload <names...>\",\n    \"Payloads to use (e.g., xss-basic, sqli-basic)\",\n  )\n  .option(\"-b, --browser <browser>\", \"Browser to use\", \"chromium\")\n  .option(\"--headless\", \"Run in headless mode\", true)\n  .option(\"--no-headless\", \"Run with visible browser\")\n  .action(runCommand);\n\n// vulcn payloads\nprogram\n  .command(\"payloads\")\n  .description(\"List available payloads\")\n  .action(payloadsCommand);\n\n// vulcn install\nprogram\n  .command(\"install\")\n  .description(\"Install Playwright browsers\")\n  .argument(\"[browsers...]\", \"Browsers to install (chromium, firefox, webkit)\")\n  .option(\"--all\", \"Install all browsers\")\n  .action(installCommand);\n\n// vulcn doctor\nprogram\n  .command(\"doctor\")\n  .description(\"Check available browsers\")\n  .action(doctorCommand);\n\nprogram.parse();\n","import { writeFile } from \"node:fs/promises\";\nimport { Recorder, serializeSession, type BrowserType } from \"@vulcn/engine\";\nimport chalk from \"chalk\";\nimport ora from \"ora\";\n\ninterface RecordOptions {\n  url: string;\n  output: string;\n  browser: string;\n  headless: boolean;\n}\n\nexport async function recordCommand(options: RecordOptions) {\n  const spinner = ora(\"Starting browser...\").start();\n\n  try {\n    const session = await Recorder.start(options.url, {\n      browser: options.browser as BrowserType,\n      headless: options.headless,\n    });\n\n    spinner.succeed(\"Browser started\");\n    console.log();\n    console.log(chalk.cyan(\"🎬 Recording started\"));\n    console.log(chalk.gray(`   URL: ${options.url}`));\n    console.log(chalk.gray(`   Browser: ${options.browser}`));\n    console.log();\n    console.log(\n      chalk.yellow(\"   Interact with the browser to record actions.\"),\n    );\n    console.log(chalk.yellow(\"   Press Ctrl+C to stop recording.\"));\n    console.log();\n\n    // Enable raw mode to intercept Ctrl+C before it becomes SIGINT\n    if (process.stdin.isTTY) {\n      process.stdin.setRawMode(true);\n    }\n    process.stdin.resume();\n    process.stdin.setEncoding(\"utf8\");\n\n    // Handle Ctrl+C gracefully\n    let stopped = false;\n    const stopRecording = async (): Promise<void> => {\n      if (stopped) return;\n      stopped = true;\n\n      console.log();\n      const saveSpinner = ora(\"Stopping recording...\").start();\n\n      try {\n        const result = await session.stop();\n        const yaml = serializeSession(result);\n        await writeFile(options.output, yaml, \"utf-8\");\n\n        saveSpinner.succeed(`Session saved to ${chalk.green(options.output)}`);\n        console.log();\n        console.log(chalk.cyan(`📝 Recorded ${result.steps.length} steps`));\n        console.log();\n        console.log(chalk.gray(\"To run with payloads:\"));\n        console.log(\n          chalk.white(`   vulcn run ${options.output} --payload xss-basic`),\n        );\n      } catch (err) {\n        saveSpinner.fail(\"Failed to save session\");\n        console.error(chalk.red(String(err)));\n        process.exit(1);\n      }\n    };\n\n    // Use a promise-based approach to handle signals properly\n    await new Promise<void>((resolve) => {\n      const handleStop = () => {\n        // Remove all handlers to prevent double-handling\n        process.stdin.removeAllListeners(\"data\");\n        process.off(\"SIGINT\", handleStop);\n        process.off(\"SIGTERM\", handleStop);\n\n        stopRecording()\n          .then(() => {\n            resolve();\n          })\n          .catch((err) => {\n            console.error(chalk.red(String(err)));\n            process.exit(1);\n          });\n      };\n\n      // Listen for Ctrl+C keypress (char code 0x03) in raw mode\n      process.stdin.on(\"data\", (key: string) => {\n        if (key === \"\\u0003\") {\n          handleStop();\n        }\n      });\n\n      // Also handle SIGINT/SIGTERM for non-TTY or external signals\n      process.on(\"SIGINT\", handleStop);\n      process.on(\"SIGTERM\", handleStop);\n    });\n  } catch (err) {\n    spinner.fail(\"Failed to start recording\");\n    console.error(chalk.red(String(err)));\n    process.exit(1);\n  }\n}\n","import { readFile } from \"node:fs/promises\";\nimport {\n  Runner,\n  parseSession,\n  type BrowserType,\n  type PayloadName,\n} from \"@vulcn/engine\";\nimport chalk from \"chalk\";\nimport ora from \"ora\";\n\ninterface RunOptions {\n  payload?: string[];\n  browser: string;\n  headless: boolean;\n}\n\nexport async function runCommand(sessionFile: string, options: RunOptions) {\n  // Load session\n  const loadSpinner = ora(\"Loading session...\").start();\n\n  let sessionYaml: string;\n  try {\n    sessionYaml = await readFile(sessionFile, \"utf-8\");\n  } catch {\n    loadSpinner.fail(`Cannot read file: ${sessionFile}`);\n    process.exit(1);\n  }\n\n  let session;\n  try {\n    session = parseSession(sessionYaml);\n    loadSpinner.succeed(`Loaded session: ${chalk.cyan(session.name)}`);\n  } catch (err) {\n    loadSpinner.fail(\"Invalid session file\");\n    console.error(chalk.red(String(err)));\n    process.exit(1);\n  }\n\n  // Validate payloads\n  const payloads = (options.payload ?? [\"xss-basic\"]) as PayloadName[];\n  console.log();\n  console.log(chalk.cyan(\"🔍 Running security tests\"));\n  console.log(chalk.gray(`   Session: ${session.name}`));\n  console.log(chalk.gray(`   Payloads: ${payloads.join(\", \")}`));\n  console.log(chalk.gray(`   Browser: ${options.browser}`));\n  console.log(chalk.gray(`   Headless: ${options.headless}`));\n  console.log();\n\n  const runSpinner = ora(\"Executing tests...\").start();\n\n  try {\n    const result = await Runner.execute(session, payloads, {\n      browser: options.browser as BrowserType,\n      headless: options.headless,\n      onFinding: (finding) => {\n        runSpinner.stop();\n        console.log(chalk.red(`⚠️  FINDING: ${finding.title}`));\n        console.log(chalk.gray(`   Step: ${finding.stepId}`));\n        console.log(\n          chalk.gray(`   Payload: ${finding.payload.slice(0, 50)}...`),\n        );\n        console.log(chalk.gray(`   URL: ${finding.url}`));\n        console.log();\n        runSpinner.start(\"Continuing tests...\");\n      },\n    });\n\n    runSpinner.succeed(\"Tests completed\");\n    console.log();\n\n    // Summary\n    console.log(chalk.cyan(\"📊 Results\"));\n    console.log(chalk.gray(`   Steps executed: ${result.stepsExecuted}`));\n    console.log(chalk.gray(`   Payloads tested: ${result.payloadsTested}`));\n    console.log(\n      chalk.gray(`   Duration: ${(result.duration / 1000).toFixed(1)}s`),\n    );\n    console.log();\n\n    if (result.findings.length > 0) {\n      console.log(chalk.red(`🚨 ${result.findings.length} findings detected!`));\n      console.log();\n      for (const finding of result.findings) {\n        const severityColor =\n          finding.severity === \"critical\" || finding.severity === \"high\"\n            ? chalk.red\n            : finding.severity === \"medium\"\n              ? chalk.yellow\n              : chalk.gray;\n\n        console.log(\n          severityColor(`[${finding.severity.toUpperCase()}] ${finding.title}`),\n        );\n        console.log(chalk.gray(`  Type: ${finding.type}`));\n        console.log(chalk.gray(`  Step: ${finding.stepId}`));\n        console.log(chalk.gray(`  URL: ${finding.url}`));\n        console.log(chalk.gray(`  Payload: ${finding.payload}`));\n        console.log();\n      }\n      process.exit(1); // Non-zero exit for CI/CD\n    } else {\n      console.log(chalk.green(\"✅ No vulnerabilities detected\"));\n    }\n\n    if (result.errors.length > 0) {\n      console.log();\n      console.log(\n        chalk.yellow(`⚠️  ${result.errors.length} errors during execution:`),\n      );\n      for (const err of result.errors.slice(0, 5)) {\n        console.log(chalk.gray(`   - ${err}`));\n      }\n      if (result.errors.length > 5) {\n        console.log(chalk.gray(`   ... and ${result.errors.length - 5} more`));\n      }\n    }\n  } catch (err) {\n    runSpinner.fail(\"Test execution failed\");\n    console.error(chalk.red(String(err)));\n    process.exit(1);\n  }\n}\n","import { BUILTIN_PAYLOADS } from \"@vulcn/engine\";\nimport chalk from \"chalk\";\n\nexport async function payloadsCommand() {\n  console.log();\n  console.log(chalk.cyan(\"📦 Available Payloads\"));\n  console.log();\n\n  const payloads = Object.values(BUILTIN_PAYLOADS);\n\n  for (const payload of payloads) {\n    console.log(chalk.white(`  ${payload.name}`));\n    console.log(chalk.gray(`    Category: ${payload.category}`));\n    console.log(chalk.gray(`    ${payload.description}`));\n    console.log(chalk.gray(`    Payloads: ${payload.payloads.length}`));\n    console.log();\n  }\n\n  console.log(chalk.gray(\"Usage:\"));\n  console.log(chalk.white(\"  vulcn run session.vulcn.yml --payload xss-basic\"));\n}\n","import { installBrowsers, checkBrowsers, type BrowserType } from \"@vulcn/engine\";\nimport chalk from \"chalk\";\nimport ora from \"ora\";\n\nexport async function installCommand(\n  browsers?: string[],\n  options?: { all?: boolean },\n) {\n  // Determine which browsers to install\n  let browsersToInstall: BrowserType[];\n\n  if (options?.all) {\n    browsersToInstall = [\"chromium\", \"firefox\", \"webkit\"];\n  } else if (browsers && browsers.length > 0) {\n    browsersToInstall = browsers as BrowserType[];\n  } else {\n    browsersToInstall = [\"chromium\"];\n  }\n\n  console.log();\n  console.log(chalk.cyan(\"🔧 Installing browsers for Vulcn\"));\n  console.log();\n\n  try {\n    await installBrowsers(browsersToInstall);\n    console.log();\n    console.log(chalk.green(\"✅ Browsers installed successfully\"));\n  } catch (err) {\n    console.error(chalk.red(\"Failed to install browsers:\"), err);\n    process.exit(1);\n  }\n}\n\nexport async function doctorCommand() {\n  console.log();\n  console.log(chalk.cyan(\"🩺 Vulcn Browser Check\"));\n  console.log();\n\n  const spinner = ora(\"Checking available browsers...\").start();\n\n  try {\n    const status = await checkBrowsers();\n    spinner.stop();\n\n    console.log(chalk.white(\"System Browsers:\"));\n    console.log(\n      `  Chrome:    ${status.systemChrome ? chalk.green(\"✓ Available\") : chalk.gray(\"✗ Not found\")}`,\n    );\n    console.log(\n      `  Edge:      ${status.systemEdge ? chalk.green(\"✓ Available\") : chalk.gray(\"✗ Not found\")}`,\n    );\n    console.log();\n\n    console.log(chalk.white(\"Playwright Browsers:\"));\n    console.log(\n      `  Chromium:  ${status.playwrightChromium ? chalk.green(\"✓ Installed\") : chalk.gray(\"✗ Not installed\")}`,\n    );\n    console.log(\n      `  Firefox:   ${status.playwrightFirefox ? chalk.green(\"✓ Installed\") : chalk.gray(\"✗ Not installed\")}`,\n    );\n    console.log(\n      `  WebKit:    ${status.playwrightWebkit ? chalk.green(\"✓ Installed\") : chalk.gray(\"✗ Not installed\")}`,\n    );\n    console.log();\n\n    // Recommendation\n    if (status.systemChrome || status.systemEdge) {\n      console.log(\n        chalk.green(\"✅ Ready to use! Vulcn will use your system browser.\"),\n      );\n    } else if (status.playwrightChromium) {\n      console.log(\n        chalk.green(\"✅ Ready to use! Vulcn will use Playwright Chromium.\"),\n      );\n    } else {\n      console.log(chalk.yellow(\"⚠️  No browsers found.\"));\n      console.log();\n      console.log(chalk.white(\"Options:\"));\n      console.log(chalk.gray(\"  1. Install Google Chrome (recommended)\"));\n      console.log(chalk.gray(\"  2. Run: vulcn install\"));\n    }\n  } catch (err) {\n    spinner.fail(\"Failed to check browsers\");\n    console.error(chalk.red(String(err)));\n    process.exit(1);\n  }\n}\n"],"mappings":";;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,iBAAiB;AAC1B,SAAS,UAAU,wBAA0C;AAC7D,OAAO,WAAW;AAClB,OAAO,SAAS;AAShB,eAAsB,cAAc,SAAwB;AAC1D,QAAM,UAAU,IAAI,qBAAqB,EAAE,MAAM;AAEjD,MAAI;AACF,UAAM,UAAU,MAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChD,SAAS,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,YAAQ,QAAQ,iBAAiB;AACjC,YAAQ,IAAI;AACZ,YAAQ,IAAI,MAAM,KAAK,6BAAsB,CAAC;AAC9C,YAAQ,IAAI,MAAM,KAAK,WAAW,QAAQ,GAAG,EAAE,CAAC;AAChD,YAAQ,IAAI,MAAM,KAAK,eAAe,QAAQ,OAAO,EAAE,CAAC;AACxD,YAAQ,IAAI;AACZ,YAAQ;AAAA,MACN,MAAM,OAAO,iDAAiD;AAAA,IAChE;AACA,YAAQ,IAAI,MAAM,OAAO,oCAAoC,CAAC;AAC9D,YAAQ,IAAI;AAGZ,QAAI,QAAQ,MAAM,OAAO;AACvB,cAAQ,MAAM,WAAW,IAAI;AAAA,IAC/B;AACA,YAAQ,MAAM,OAAO;AACrB,YAAQ,MAAM,YAAY,MAAM;AAGhC,QAAI,UAAU;AACd,UAAM,gBAAgB,YAA2B;AAC/C,UAAI,QAAS;AACb,gBAAU;AAEV,cAAQ,IAAI;AACZ,YAAM,cAAc,IAAI,uBAAuB,EAAE,MAAM;AAEvD,UAAI;AACF,cAAM,SAAS,MAAM,QAAQ,KAAK;AAClC,cAAM,OAAO,iBAAiB,MAAM;AACpC,cAAM,UAAU,QAAQ,QAAQ,MAAM,OAAO;AAE7C,oBAAY,QAAQ,oBAAoB,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE;AACrE,gBAAQ,IAAI;AACZ,gBAAQ,IAAI,MAAM,KAAK,sBAAe,OAAO,MAAM,MAAM,QAAQ,CAAC;AAClE,gBAAQ,IAAI;AACZ,gBAAQ,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/C,gBAAQ;AAAA,UACN,MAAM,MAAM,gBAAgB,QAAQ,MAAM,sBAAsB;AAAA,QAClE;AAAA,MACF,SAAS,KAAK;AACZ,oBAAY,KAAK,wBAAwB;AACzC,gBAAQ,MAAM,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,YAAM,aAAa,MAAM;AAEvB,gBAAQ,MAAM,mBAAmB,MAAM;AACvC,gBAAQ,IAAI,UAAU,UAAU;AAChC,gBAAQ,IAAI,WAAW,UAAU;AAEjC,sBAAc,EACX,KAAK,MAAM;AACV,kBAAQ;AAAA,QACV,CAAC,EACA,MAAM,CAAC,QAAQ;AACd,kBAAQ,MAAM,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,kBAAQ,KAAK,CAAC;AAAA,QAChB,CAAC;AAAA,MACL;AAGA,cAAQ,MAAM,GAAG,QAAQ,CAAC,QAAgB;AACxC,YAAI,QAAQ,KAAU;AACpB,qBAAW;AAAA,QACb;AAAA,MACF,CAAC;AAGD,cAAQ,GAAG,UAAU,UAAU;AAC/B,cAAQ,GAAG,WAAW,UAAU;AAAA,IAClC,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,KAAK,2BAA2B;AACxC,YAAQ,MAAM,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;ACvGA,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,OAAOA,YAAW;AAClB,OAAOC,UAAS;AAQhB,eAAsB,WAAW,aAAqB,SAAqB;AAEzE,QAAM,cAAcA,KAAI,oBAAoB,EAAE,MAAM;AAEpD,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,SAAS,aAAa,OAAO;AAAA,EACnD,QAAQ;AACN,gBAAY,KAAK,qBAAqB,WAAW,EAAE;AACnD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,aAAa,WAAW;AAClC,gBAAY,QAAQ,mBAAmBD,OAAM,KAAK,QAAQ,IAAI,CAAC,EAAE;AAAA,EACnE,SAAS,KAAK;AACZ,gBAAY,KAAK,sBAAsB;AACvC,YAAQ,MAAMA,OAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,WAAY,QAAQ,WAAW,CAAC,WAAW;AACjD,UAAQ,IAAI;AACZ,UAAQ,IAAIA,OAAM,KAAK,kCAA2B,CAAC;AACnD,UAAQ,IAAIA,OAAM,KAAK,eAAe,QAAQ,IAAI,EAAE,CAAC;AACrD,UAAQ,IAAIA,OAAM,KAAK,gBAAgB,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;AAC7D,UAAQ,IAAIA,OAAM,KAAK,eAAe,QAAQ,OAAO,EAAE,CAAC;AACxD,UAAQ,IAAIA,OAAM,KAAK,gBAAgB,QAAQ,QAAQ,EAAE,CAAC;AAC1D,UAAQ,IAAI;AAEZ,QAAM,aAAaC,KAAI,oBAAoB,EAAE,MAAM;AAEnD,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,QAAQ,SAAS,UAAU;AAAA,MACrD,SAAS,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,WAAW,CAAC,YAAY;AACtB,mBAAW,KAAK;AAChB,gBAAQ,IAAID,OAAM,IAAI,0BAAgB,QAAQ,KAAK,EAAE,CAAC;AACtD,gBAAQ,IAAIA,OAAM,KAAK,YAAY,QAAQ,MAAM,EAAE,CAAC;AACpD,gBAAQ;AAAA,UACNA,OAAM,KAAK,eAAe,QAAQ,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QAC7D;AACA,gBAAQ,IAAIA,OAAM,KAAK,WAAW,QAAQ,GAAG,EAAE,CAAC;AAChD,gBAAQ,IAAI;AACZ,mBAAW,MAAM,qBAAqB;AAAA,MACxC;AAAA,IACF,CAAC;AAED,eAAW,QAAQ,iBAAiB;AACpC,YAAQ,IAAI;AAGZ,YAAQ,IAAIA,OAAM,KAAK,mBAAY,CAAC;AACpC,YAAQ,IAAIA,OAAM,KAAK,sBAAsB,OAAO,aAAa,EAAE,CAAC;AACpE,YAAQ,IAAIA,OAAM,KAAK,uBAAuB,OAAO,cAAc,EAAE,CAAC;AACtE,YAAQ;AAAA,MACNA,OAAM,KAAK,iBAAiB,OAAO,WAAW,KAAM,QAAQ,CAAC,CAAC,GAAG;AAAA,IACnE;AACA,YAAQ,IAAI;AAEZ,QAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,cAAQ,IAAIA,OAAM,IAAI,aAAM,OAAO,SAAS,MAAM,qBAAqB,CAAC;AACxE,cAAQ,IAAI;AACZ,iBAAW,WAAW,OAAO,UAAU;AACrC,cAAM,gBACJ,QAAQ,aAAa,cAAc,QAAQ,aAAa,SACpDA,OAAM,MACN,QAAQ,aAAa,WACnBA,OAAM,SACNA,OAAM;AAEd,gBAAQ;AAAA,UACN,cAAc,IAAI,QAAQ,SAAS,YAAY,CAAC,KAAK,QAAQ,KAAK,EAAE;AAAA,QACtE;AACA,gBAAQ,IAAIA,OAAM,KAAK,WAAW,QAAQ,IAAI,EAAE,CAAC;AACjD,gBAAQ,IAAIA,OAAM,KAAK,WAAW,QAAQ,MAAM,EAAE,CAAC;AACnD,gBAAQ,IAAIA,OAAM,KAAK,UAAU,QAAQ,GAAG,EAAE,CAAC;AAC/C,gBAAQ,IAAIA,OAAM,KAAK,cAAc,QAAQ,OAAO,EAAE,CAAC;AACvD,gBAAQ,IAAI;AAAA,MACd;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB,OAAO;AACL,cAAQ,IAAIA,OAAM,MAAM,oCAA+B,CAAC;AAAA,IAC1D;AAEA,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,cAAQ,IAAI;AACZ,cAAQ;AAAA,QACNA,OAAM,OAAO,iBAAO,OAAO,OAAO,MAAM,2BAA2B;AAAA,MACrE;AACA,iBAAW,OAAO,OAAO,OAAO,MAAM,GAAG,CAAC,GAAG;AAC3C,gBAAQ,IAAIA,OAAM,KAAK,QAAQ,GAAG,EAAE,CAAC;AAAA,MACvC;AACA,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,IAAIA,OAAM,KAAK,cAAc,OAAO,OAAO,SAAS,CAAC,OAAO,CAAC;AAAA,MACvE;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,eAAW,KAAK,uBAAuB;AACvC,YAAQ,MAAMA,OAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;ACzHA,SAAS,wBAAwB;AACjC,OAAOE,YAAW;AAElB,eAAsB,kBAAkB;AACtC,UAAQ,IAAI;AACZ,UAAQ,IAAIA,OAAM,KAAK,8BAAuB,CAAC;AAC/C,UAAQ,IAAI;AAEZ,QAAM,WAAW,OAAO,OAAO,gBAAgB;AAE/C,aAAW,WAAW,UAAU;AAC9B,YAAQ,IAAIA,OAAM,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC;AAC5C,YAAQ,IAAIA,OAAM,KAAK,iBAAiB,QAAQ,QAAQ,EAAE,CAAC;AAC3D,YAAQ,IAAIA,OAAM,KAAK,OAAO,QAAQ,WAAW,EAAE,CAAC;AACpD,YAAQ,IAAIA,OAAM,KAAK,iBAAiB,QAAQ,SAAS,MAAM,EAAE,CAAC;AAClE,YAAQ,IAAI;AAAA,EACd;AAEA,UAAQ,IAAIA,OAAM,KAAK,QAAQ,CAAC;AAChC,UAAQ,IAAIA,OAAM,MAAM,mDAAmD,CAAC;AAC9E;;;ACpBA,SAAS,iBAAiB,qBAAuC;AACjE,OAAOC,YAAW;AAClB,OAAOC,UAAS;AAEhB,eAAsB,eACpB,UACA,SACA;AAEA,MAAI;AAEJ,MAAI,SAAS,KAAK;AAChB,wBAAoB,CAAC,YAAY,WAAW,QAAQ;AAAA,EACtD,WAAW,YAAY,SAAS,SAAS,GAAG;AAC1C,wBAAoB;AAAA,EACtB,OAAO;AACL,wBAAoB,CAAC,UAAU;AAAA,EACjC;AAEA,UAAQ,IAAI;AACZ,UAAQ,IAAID,OAAM,KAAK,yCAAkC,CAAC;AAC1D,UAAQ,IAAI;AAEZ,MAAI;AACF,UAAM,gBAAgB,iBAAiB;AACvC,YAAQ,IAAI;AACZ,YAAQ,IAAIA,OAAM,MAAM,wCAAmC,CAAC;AAAA,EAC9D,SAAS,KAAK;AACZ,YAAQ,MAAMA,OAAM,IAAI,6BAA6B,GAAG,GAAG;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAEA,eAAsB,gBAAgB;AACpC,UAAQ,IAAI;AACZ,UAAQ,IAAIA,OAAM,KAAK,+BAAwB,CAAC;AAChD,UAAQ,IAAI;AAEZ,QAAM,UAAUC,KAAI,gCAAgC,EAAE,MAAM;AAE5D,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,YAAQ,KAAK;AAEb,YAAQ,IAAID,OAAM,MAAM,kBAAkB,CAAC;AAC3C,YAAQ;AAAA,MACN,gBAAgB,OAAO,eAAeA,OAAM,MAAM,kBAAa,IAAIA,OAAM,KAAK,kBAAa,CAAC;AAAA,IAC9F;AACA,YAAQ;AAAA,MACN,gBAAgB,OAAO,aAAaA,OAAM,MAAM,kBAAa,IAAIA,OAAM,KAAK,kBAAa,CAAC;AAAA,IAC5F;AACA,YAAQ,IAAI;AAEZ,YAAQ,IAAIA,OAAM,MAAM,sBAAsB,CAAC;AAC/C,YAAQ;AAAA,MACN,gBAAgB,OAAO,qBAAqBA,OAAM,MAAM,kBAAa,IAAIA,OAAM,KAAK,sBAAiB,CAAC;AAAA,IACxG;AACA,YAAQ;AAAA,MACN,gBAAgB,OAAO,oBAAoBA,OAAM,MAAM,kBAAa,IAAIA,OAAM,KAAK,sBAAiB,CAAC;AAAA,IACvG;AACA,YAAQ;AAAA,MACN,gBAAgB,OAAO,mBAAmBA,OAAM,MAAM,kBAAa,IAAIA,OAAM,KAAK,sBAAiB,CAAC;AAAA,IACtG;AACA,YAAQ,IAAI;AAGZ,QAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,cAAQ;AAAA,QACNA,OAAM,MAAM,0DAAqD;AAAA,MACnE;AAAA,IACF,WAAW,OAAO,oBAAoB;AACpC,cAAQ;AAAA,QACNA,OAAM,MAAM,0DAAqD;AAAA,MACnE;AAAA,IACF,OAAO;AACL,cAAQ,IAAIA,OAAM,OAAO,kCAAwB,CAAC;AAClD,cAAQ,IAAI;AACZ,cAAQ,IAAIA,OAAM,MAAM,UAAU,CAAC;AACnC,cAAQ,IAAIA,OAAM,KAAK,0CAA0C,CAAC;AAClE,cAAQ,IAAIA,OAAM,KAAK,yBAAyB,CAAC;AAAA,IACnD;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,0BAA0B;AACvC,YAAQ,MAAMA,OAAM,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;;;AJhFA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,OAAO,EACZ,YAAY,oCAAoC,EAChD,QAAQ,OAAO;AAGlB,QACG,QAAQ,QAAQ,EAChB,YAAY,6BAA6B,EACzC,eAAe,mBAAmB,6BAA6B,EAC/D,OAAO,uBAAuB,oBAAoB,mBAAmB,EACrE;AAAA,EACC;AAAA,EACA;AAAA,EACA;AACF,EACC,OAAO,cAAc,wBAAwB,KAAK,EAClD,OAAO,aAAa;AAGvB,QACG,QAAQ,KAAK,EACb,YAAY,sCAAsC,EAClD,SAAS,aAAa,kCAAkC,EACxD;AAAA,EACC;AAAA,EACA;AACF,EACC,OAAO,2BAA2B,kBAAkB,UAAU,EAC9D,OAAO,cAAc,wBAAwB,IAAI,EACjD,OAAO,iBAAiB,0BAA0B,EAClD,OAAO,UAAU;AAGpB,QACG,QAAQ,UAAU,EAClB,YAAY,yBAAyB,EACrC,OAAO,eAAe;AAGzB,QACG,QAAQ,SAAS,EACjB,YAAY,6BAA6B,EACzC,SAAS,iBAAiB,iDAAiD,EAC3E,OAAO,SAAS,sBAAsB,EACtC,OAAO,cAAc;AAGxB,QACG,QAAQ,QAAQ,EAChB,YAAY,0BAA0B,EACtC,OAAO,aAAa;AAEvB,QAAQ,MAAM;","names":["chalk","ora","chalk","chalk","ora"]}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "vulcn",
+  "version": "0.1.0",
+  "description": "Security testing CLI - Record once, test with payloads, find vulnerabilities",
+  "type": "module",
+  "bin": {
+    "vulcn": "./vulcn.mjs"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "vulcn.mjs",
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "clean": "rm -rf dist vulcn.mjs LICENSE README.md CHANGELOG.md",
+    "typecheck": "tsc --noEmit",
+    "prepack": "cp ../vulcn.mjs ../LICENSE ../README.md ../CHANGELOG.md .",
+    "postpack": "rm -f vulcn.mjs LICENSE README.md CHANGELOG.md",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "vulcn",
+    "security",
+    "testing",
+    "cli",
+    "recorder",
+    "xss",
+    "sql-injection",
+    "penetration-testing",
+    "pentest",
+    "vulnerability",
+    "scanner",
+    "playwright",
+    "browser",
+    "automation"
+  ],
+  "author": "rawlab",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rawlab-dev/vulcn.git",
+    "directory": "cli"
+  },
+  "homepage": "https://rawlab.dev/vulcn",
+  "bugs": {
+    "url": "https://github.com/rawlab-dev/vulcn/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@vulcn/engine": "workspace:*",
+    "commander": "^13.1.0",
+    "chalk": "^5.4.0",
+    "ora": "^8.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "tsup": "^8.4.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/vulcn.mjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+import module from "node:module";
+
+// Enable Node.js module compile cache for faster startup
+// https://nodejs.org/api/module.html#module-compile-cache
+if (module.enableCompileCache && !process.env.NODE_DISABLE_COMPILE_CACHE) {
+  try {
+    module.enableCompileCache();
+  } catch {
+    // Ignore errors (older Node versions)
+  }
+}
+
+await import("./cli/dist/index.js");