git clone https://github.com/aniruddhaadak80/pqc-triage
cd pqc-triage
npm ci
npm run dev

npm run typecheck    # tsc --noEmit, strict
npm run lint         # eslint, zero warnings tolerated
npm run test         # vitest, 125 deterministic unit tests
npm run build        # next build
npm run test:browser # Playwright: the full journey on desktop and mobile (needs a build first)
npm run verify:live  # end-to-end proof against a deployment

BASE=https://pqc-triage.vercel.app

# Health: proves the store with a real insert, read-back and delete
curl -s $BASE/api/health | jq '.store, .writeProbe, .engineVersion'

# Create a survey from a manifest and a source excerpt
SURVEY=$(curl -s -c jar -X POST $BASE/api/surveys \
  -H 'content-type: application/json' \
  -d '{"name":"billing-gateway","repoHint":"acme/gateway",
       "manifest":"{\"dependencies\":{\"jsonwebtoken\":\"^9.0.2\",\"node-forge\":\"^1.3.1\"}}",
       "source":"jwt.sign(p, s, { algorithm: \"HS256\" });\nconst legacy = crypto.createCipheriv(\"des-ede3\", key, iv);"}' \
  | jq -r '.survey.id')

# Read it back, with the analysis the UI renders
curl -s -b jar $BASE/api/surveys/$SURVEY | jq '.analysis.score, .analysis.band, .analysis.engineVersion'

# Decide on the worst surface
SURFACE=$(curl -s -b jar $BASE/api/surveys/$SURVEY | jq -r '.analysis.surfaces[0].surfaceId')
curl -s -b jar -X PATCH $BASE/api/surfaces/$SURFACE \
  -H 'content-type: application/json' \
  -d '{"decision":"migrate-now","decisionNote":"Hybrid KEM in the next release.","shelfLifeYears":27}'

# Read the persisted state back
curl -s -b jar $BASE/api/surveys/$SURVEY \
  | jq --arg s "$SURFACE" '.surfaces[] | select(.id==$s) | {decision, shelfLifeYears}'

# Run the engine over any primitive, with nothing stored
curl -s -X POST $BASE/api/mcp -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"assess_primitive","arguments":{"primitive":"rsa-2048","shelfLifeYears":25}}}'

# Replay the seal chain
curl -s -b jar "$BASE/api/integrity?survey=$SURVEY" | jq '.valid, .eventsChecked, .algorithm'

# Download the plan
curl -s -b jar -D- -o plan.md "$BASE/api/export?survey=$SURVEY&format=md"

# Retire it; the rows stay as tombstones and replay still verifies
curl -s -b jar -X DELETE $BASE/api/surveys/$SURVEY | jq '.tombstone, .seal'

{ "error": { "code": "validation_error", "message": "The request body did not match the schema.", "details": [{ "path": "name", "message": "Too small: expected string to have >=1 characters" }] } }

{
  "mcpServers": {
    "pqc-triage": {
      "type": "http",
      "url": "https://pqc-triage.vercel.app/api/mcp"
    }
  }
}

flowchart LR
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Client["Any MCP client"]:::infra -->|POST jsonrpc| Endpoint["/api/mcp"]:::infra
  Endpoint --> Init["initialize + ownerToken"]:::agent
  Endpoint --> List["tools/list with schemas"]:::agent
  Endpoint --> Call["tools/call"]:::agent
  Call --> Read["list_signals / list_surveys / get_survey"]:::data
  Call --> Engine["assess_primitive / classify_primitive"]:::engine
  Call --> Mutate["import_survey / record_decision / delete_survey"]:::risk
  Mutate --> Service["service layer, same as the UI"]:::infra
  Service --> Store[("hosted Postgres")]:::infra
  Service --> Seal["SHA-384 chain append"]:::agent
  Read --> Feed["deps.dev / OSV / arXiv / NIST"]:::data

flowchart TB
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Browser["Browser"]:::infra --> Proxy["proxy.ts assigns the owner cookie"]:::infra
  Proxy --> Pages["App Router pages, server by default"]:::infra
  Browser --> Rest["REST routes"]:::infra
  Browser --> Rpc["JSON-RPC 2.0"]:::agent
  Pages --> Service["service.ts, the only writer"]:::infra
  Rest --> Service
  Rpc --> Service
  Service --> Engine["engine hndl@1.0.0"]:::engine
  Service --> Extract["extract.ts"]:::engine
  Service --> Registry["crypto-registry.ts"]:::engine
  Service --> Adapter["SqlExecutor adapter"]:::infra
  Adapter --> Neon["Neon Postgres, production"]:::data
  Adapter --> Pglite["PGlite, local and CI"]:::data
  Service --> Seal["seal.ts"]:::agent
  Service --> Live["live sources"]:::data
  Engine --> Pages

flowchart LR
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Manifest["manifest paste"]:::data --> Detect["detectEcosystem"]:::engine
  Source["source excerpt"]:::data --> Scan["scanSource, line by line"]:::engine
  Detect --> Parse["parseManifest per ecosystem"]:::engine
  Parse --> Pkg["match the curated crypto package list"]:::engine
  Scan --> Hits["one hit per primitive, with line numbers"]:::engine
  Pkg --> Row["ExtractedSurface"]:::engine
  Hits --> Row
  Row --> Resolve["resolvePrimitive into the scoring table"]:::engine
  Resolve --> Enrich["enrich up to six dependencies"]:::data
  Enrich --> Persist["surfaces and surveys rows"]:::infra
  Persist --> Score["analyzeSurvey"]:::engine
  Score --> Bands["band and deadline per surface"]:::engine
  Bands --> Band["no live signal scores neutral, never zero"]:::risk

flowchart TB
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  In["primitive, role, X, H, decision"]:::engine --> Deadline["mustStartBy = H - (X + Y)"]:::engine
  In --> Bits["quantum bits from SP 800-57"]:::engine
  In --> QCost["Shor resource estimate"]:::data
  Deadline --> Harvest["F1 harvest 0.26"]:::engine
  Bits --> QB["F2 quantum bits 0.22"]:::engine
  Deadline --> Sched["F3 headroom 0.18"]:::engine
  In --> Class["F4 classical 0.14"]:::engine
  In --> Supply["F5 supply 0.12"]:::engine
  In --> Use["F6 usage 0.08"]:::engine
  Harvest --> Sum["score = 100 x sum(w x s)"]:::engine
  QB --> Sum
  Sched --> Sum
  Class --> Sum
  Supply --> Sum
  Use --> Sum
  Sum --> Band["bands at 75 / 55 / 35 / 15"]:::risk
  Sum --> Repl["replacement and its lead time Y"]:::engine
  Band --> Out["score, factors, mustStartBy, decryptableFrom, seal"]:::engine
  Repl --> Out

flowchart LR
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Deps["deps.dev release metadata"]:::data --> Live["live"]:::infra
  Osv["OSV advisories"]:::data --> Live
  Arxiv["arXiv quant-ph / cs.CR"]:::data --> Live
  Nist["NIST news feed"]:::data --> Live
  Live --> Norm["NormalizedSignal: source, status, fetchedAt, href"]:::infra
  Live -.->|timeout or unreachable| Fallback["sealed dated sample"]:::risk
  Fallback --> Norm
  Norm --> Score["supply factor"]:::engine
  Norm --> Board["live signal board"]:::infra
  Fallback -->|never| User["user-created surfaces"]:::infra
  User --> Store[("hosted store")]:::data

flowchart TB
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Push["push to main"]:::infra --> Ci["GitHub Actions on Node 22"]:::agent
  Ci --> Type["typecheck + lint + test + build"]:::agent
  Type --> Ok{"all green?"}:::risk
  Ok -->|no| Stop["blocked, nothing deploys"]:::risk
  Ok -->|yes| Ver["vercel --prod"]:::infra
  Ver --> Neon["Neon integration injects DATABASE_URL"]:::data
  Ver --> Alias["public production alias"]:::infra
  Neon --> Guard["no DATABASE_URL means refuse, never fall back"]:::risk
  Alias --> Live["scripts/verify-live.mjs proves 100+ checks"]:::agent
  Live --> Badge["README badge, mcp.json, sitemap, OG metadata"]:::infra

flowchart TB
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Write["create, decide, retire"]:::agent --> Canon["canonicalJson: keys sorted, arrays ordered"]:::agent
  Canon --> Seal["SHA-384(prevSeal + canonicalJson(event))"]:::agent
  Seal --> Head["surveys.last_seal and event_count"]:::infra
  Replay["GET /api/integrity"]:::infra --> Genesis["genesis derived from the survey id"]:::agent
  Genesis --> Recompute["recompute every seal in seq order"]:::agent
  Recompute --> Verdict["valid, or the first broken seq with a reason"]:::risk
  Delete["delete"]:::risk --> Tomb["soft delete, row retained"]:::risk
  Tomb --> Replay

flowchart LR
  classDef data fill:#22d3ee,stroke:#0e7490,color:#083344
  classDef engine fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  classDef agent fill:#34d399,stroke:#047857,color:#022c22
  classDef infra fill:#94a3b8,stroke:#475569,color:#0f172a
  classDef risk fill:#fb7185,stroke:#be123c,color:#4c0519
  Visit["Land on /"]:::infra --> Import["Paste a manifest and a source excerpt"]:::data
  Import --> Read["Read the fringe plate and the factor table"]:::engine
  Read --> Sweep["Move the quantum horizon"]:::engine
  Sweep --> Decide["Record a decision with a rationale"]:::risk
  Decide --> Residual["Watch the residual score fall"]:::engine
  Residual --> Export["Download the migration plan"]:::data
  Export --> Share["Publish or revoke a report link"]:::agent
  Share --> Verify["Replay the seal chain"]:::agent
  Verify --> Retire["Retire the survey, tombstones retained"]:::risk

flowchart LR
  classDef ok fill:#34d399,stroke:#047857,color:#022c22
  A["Extract manifests and source"]:::ok --> B["Score with hndl@1.0.0"]:::ok
  B --> C["Agent tools over JSON-RPC"]:::ok --> D["Sealed export"]:::ok

flowchart LR
  classDef next fill:#22d3ee,stroke:#0e7490,color:#083344
  A["Package graph reachability"]:::next --> B["Hybrid KEM rollout checklist"]:::next
  B --> C["Saved plan versions"]:::next --> D["Signed share links"]:::next

flowchart LR
  classDef later fill:#a78bfa,stroke:#6d28d9,color:#2e1065
  A["SBOM ingest"]:::later --> B["Hardware inventory"]:::later
  B --> C["Policy-as-code export"]:::later

npm ci && npm run typecheck && npm run lint && npm run test && npm run build