pqcheck 0.1.0

package/bin/pqcheck.js

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+// =============================================================================
+// pqcheck CLI — npx pqcheck <domain>
+// =============================================================================
+// Tiny wrapper around the public scan API at quantapact.com.
+// Zero deps (uses node:fetch). Works under `npx pqcheck` without installation.
+// =============================================================================
+
+const API_BASE = process.env.PQCHECK_API_BASE || "https://quantapact.com";
+const VERSION = "0.1.0";
+
+const ANSI = {
+  reset:   "\x1b[0m",
+  bold:    "\x1b[1m",
+  dim:     "\x1b[2m",
+  red:     "\x1b[31m",
+  green:   "\x1b[32m",
+  yellow:  "\x1b[33m",
+  violet:  "\x1b[35m",
+  cyan:    "\x1b[36m",
+};
+const supportsColor = process.stdout.isTTY && process.env.TERM !== "dumb";
+const color = (c, s) => (supportsColor ? `${ANSI[c]}${s}${ANSI.reset}` : s);
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+    printUsage();
+    process.exit(args.length === 0 ? 1 : 0);
+  }
+  if (args.includes("--version") || args.includes("-v")) {
+    console.log(`pqcheck ${VERSION}`);
+    process.exit(0);
+  }
+
+  const domain = normalizeDomain(args.find((a) => !a.startsWith("-")) || "");
+  if (!domain) {
+    console.error(color("red", "error: no domain provided"));
+    printUsage();
+    process.exit(1);
+  }
+
+  const json = args.includes("--json");
+
+  process.stderr.write(color("dim", `Scanning ${domain} ...`));
+  let report;
+  try {
+    const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
+      method: "GET",
+      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+    });
+    process.stderr.write("\r\x1b[K"); // clear "Scanning ..." line
+    if (!resp.ok) {
+      const errBody = await safeJSON(resp);
+      console.error(color("red", `error: ${resp.status} ${errBody?.error || resp.statusText}`));
+      if (errBody?.detail) console.error(color("dim", errBody.detail));
+      process.exit(1);
+    }
+    report = await resp.json();
+  } catch (err) {
+    process.stderr.write("\r\x1b[K");
+    console.error(color("red", `error: ${err.message}`));
+    process.exit(1);
+  }
+
+  if (json) {
+    console.log(JSON.stringify(report, null, 2));
+    process.exit(0);
+  }
+
+  printReport(report);
+}
+
+function printReport(r) {
+  if (!r.reachable) {
+    console.log(color("red", `\n  ${r.domain} — unreachable`));
+    if (r.errorMessage) console.log(color("dim", `  ${r.errorMessage}`));
+    console.log("");
+    return;
+  }
+
+  const labelColor =
+    r.scoreLabel === "CRITICAL" ? "red" :
+    r.scoreLabel === "HIGH"     ? "yellow" :
+    r.scoreLabel === "MEDIUM"   ? "yellow" : "green";
+
+  console.log("");
+  console.log(`  ${color("bold", r.domain)}`);
+  console.log(color("dim", "  ─────────────────────────────────────"));
+  console.log(`  ${color("bold", "PUBLIC SURFACE BLAST RADIUS:")} ${color(labelColor, `${r.score} / 10`)} ${color(labelColor, `(${r.scoreLabel})`)}`);
+  console.log("");
+  console.log(color("dim", "  Public surface signals:"));
+  console.log(`  • TLS:           ${r.publicSurface.tlsVersion ?? "?"} ${r.publicSurface.cipher ? color("dim", `(${r.publicSurface.cipher})`) : ""}`);
+  console.log(`  • Hybrid PQC:    ${r.publicSurface.hybridPQC ? color("green", "yes") : color("yellow", "no")}`);
+  console.log(`  • Cert expires:  ${r.publicSurface.daysUntilCertExpiry !== null ? `in ${r.publicSurface.daysUntilCertExpiry} days` : "?"}`);
+  console.log(`  • HSTS:          ${r.publicSurface.hsts ? color("green", "enabled") : color("dim", "not detected")}`);
+  console.log(`  • Subdomains:    ${r.publicSurface.subdomainCount}${r.publicSurface.wildcardCert ? color("yellow", " (wildcard cert)") : ""}`);
+  console.log("");
+  if (r.findings && r.findings.length) {
+    console.log(color("dim", "  Findings:"));
+    for (const f of r.findings) {
+      const sev = f.severity.toUpperCase();
+      const sevColor =
+        f.severity === "critical" ? "red" :
+        f.severity === "high"     ? "yellow" :
+        f.severity === "medium"   ? "yellow" : "dim";
+      console.log(`  ${color(sevColor, `[${sev}]`)} ${f.title}`);
+      console.log(color("dim", `    ${f.detail}`));
+    }
+    console.log("");
+  }
+  console.log(color("dim", "  ⚠  This is the PUBLIC surface only."));
+  console.log(color("dim", `  ${r.internalMultiplierBenchmark}`));
+  console.log("");
+
+  // Phase C: plain-English impact headline + sector ranking
+  if (r.impact && r.impact.headline) {
+    console.log(color("violet", "  Plain-English impact:"));
+    console.log("  " + color("dim", r.impact.headline));
+    if (r.impact.dataTypeContext) {
+      console.log("  " + color("dim", `Data types at risk: ${r.impact.dataTypeContext}`));
+    }
+    if (r.impact.sensitivityNote) {
+      console.log("  " + color("dim", r.impact.sensitivityNote));
+    }
+    console.log("");
+  }
+  if (r.sectorRanking && r.sectorRanking.available) {
+    var sr = r.sectorRanking;
+    console.log(color("violet", `  Sector ranking:`));
+    console.log(`  Among ${sr.sectorLabel}: ` + color("bold", `${sr.rank} of ${sr.total}`) + color("dim", ` (worse than ${sr.betterThanCount} peers measured)`));
+    console.log("");
+  } else if (r.sectorRanking && r.sectorRanking.reason) {
+    console.log(color("dim", `  ${r.sectorRanking.reason}`));
+    console.log("");
+  }
+
+  console.log(color("violet", `  → Full report: ${API_BASE}/?check=${encodeURIComponent(r.domain)}`));
+  console.log("");
+}
+
+function normalizeDomain(raw) {
+  return (raw || "")
+    .trim()
+    .toLowerCase()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+}
+
+async function safeJSON(resp) {
+  try { return await resp.json(); } catch { return null; }
+}
+
+function printUsage() {
+  console.log(`
+${color("bold", "pqcheck")} ${color("dim", `v${VERSION}`)}
+
+Public Surface Blast Radius — quantum-decryption risk for any domain.
+
+${color("bold", "Usage:")}
+  npx pqcheck <domain>           Scan and print human-readable report
+  npx pqcheck <domain> --json    Output raw JSON
+
+${color("bold", "Options:")}
+  -h, --help        Show this help
+  -v, --version     Show version
+  --json            Print raw JSON output
+
+${color("bold", "Examples:")}
+  npx pqcheck chase.com
+  npx pqcheck quantapact.com --json
+
+Backed by the patented Decryption Blast Radius methodology.
+${color("violet", "https://quantapact.com")}
+`);
+}
+
+main().catch((err) => {
+  console.error(color("red", `fatal: ${err.message}`));
+  process.exit(2);
+});

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "pqcheck",
+  "version": "0.1.0",
+  "description": "Public Surface Blast Radius scanner — quantum-decryption risk in your terminal.",
+  "keywords": [
+    "post-quantum",
+    "cryptography",
+    "security",
+    "tls",
+    "scanner",
+    "harvest-now-decrypt-later",
+    "hndl",
+    "blast-radius",
+    "pqc"
+  ],
+  "homepage": "https://quantapact.com",
+  "bugs": "https://quantapact.com",
+  "license": "MIT",
+  "author": "Quantapact",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "pqcheck": "./bin/pqcheck.js"
+  },
+  "files": [
+    "bin/"
+  ]
+}