The Problem

This repository delivers a functional OSINT global-threat visualization platform but operates as six self-contained projects with duplicated API logic, oversized modules, and critical SDLC gaps. No test coverage, no CI/CD, and no license mean changes ship without signal, and the code’s redistribution rights are undefined.

What This Does

The codebase organizes around six thematic projects beneath components/, app/, lib/, stores/, hooks/, and types/. The app/api/ directory contains the primary data pipeline: app/api/countries/conflicts/route.ts, app/api/entities/route.ts, app/api/military-bases/route.ts, and app/api/deepresearch/route.ts (and its [taskId] variant) each carry 85 repeated 6-line blocks across 18 files, violating DRY. The Map UI lives in components/map/threat-map.tsx at 735 lines and lib/valyu.ts, both flagged for oversize and deep nesting (max indentation depth 27 in app/api/military-bases/route.ts, components/map/country-conflicts-modal.tsx, components/search/entity-search.tsx). Auth flows through components/auth/auth-initializer.tsx, sign-in-panel.tsx, and sign-in-modal.tsx with 3 total import edges from components/auth/index.ts. State is managed via stores/auth-store.ts and stores/events-store.ts, while hooks/use-events.ts and hooks/use-valyu-search.ts supply feed and search data. Mapbox rendering depends on react-map-gl and Tailwind v4 config in tailwind.config.ts. The repository is 64 files: 29 TSX, 26 TypeScript, 3 JSON, 1 Markdown, 1 CSS, 1 YAML. It is not a single codebase but six discrete projects sharing minimal integration.

How It Is Wired

Execution begins at the Next.js App Router entry app/page.tsx, which renders the map and feeds data through components/map/threat-map.tsx (Ca 0, Ce 2, instability 1). Route handlers under app/api/ are the primary external touchpoints: app/api/countries/conflicts/route.ts, app/api/entities/route.ts, and app/api/military-bases/route.ts each pull data, classify events via lib/event-classifier.ts (Ca 1, Ce 1), and synthesize intelligence through lib/ai-classifier.ts (Ca 0, Ce 2). Deep research endpoints route through app/api/deepresearch/[taskId]/route.ts and app/api/deepresearch/route.ts, which call the Valyu Answer API. Auth state funnels through components/auth/auth-initializer.tsx (Ca 1, Ce 0) before reaching sign-in-panel and sign-in-modal. The widest blast radius resides in the 18 duplicated route files and the 735-line threat-map component: a change to the conflict-parsing logic requires edits across all copy-paste instances, and a modification to map rendering ripples through the single large file with no modular boundaries. The import graph contains 56 modules and 11 edges with zero circular dependencies, but the duplicated route pattern and oversized files create hidden coupling that any refactor must address.

How To Use It

Setup

pnpm install

Create .env.local at the repository root:

NEXT_PUBLIC_MAPBOX_TOKEN=your_mapbox_token_here
VALYU_API_KEY=your_valyu_api_key_here
NEXT_PUBLIC_APP_MODE=self-hosted
OPENAI_API_KEY=your_openai_api_key_here

Running it

pnpm run dev

Open http://localhost:3000 in a browser. The Mapbox token and Valyu key are required; without them the map and AI features fail to load.

Real-World Use

An analyst opens the map, selects a country, and toggles the tabbed interface between current (red) and historical (blue) conflicts. Clicking a military base marker fires app/api/military-bases/route.ts, which renders green/blue markers sourced from the Valyu layer. To research an actor, the analyst uses the entity-search component, which sends a query through components/search/entity-search.tsx, triggers lib/event-classifier.ts for location extraction, and plots purple markers on the map. If the analyst enables the optional OpenAI key, location extraction uses OPENAI_API_KEY for improved accuracy. A keyword alert configured in the UI would monitor the event feed for specified terms across registered regions.

Code Health & Issues

  • [HIGH] Duplicated code blocks: 85 repeated 6-line blocks across 18 files including app/api/countries/conflicts/route.ts, app/api/entities/route.ts, app/api/deepresearch/[taskId]/route.ts, app/api/deepresearch/route.ts …
  • [HIGH] Deep nesting x3: app/api/military-bases/route.ts, components/map/country-conflicts-modal.tsx, components/search/entity-search.tsx – max indentation depth 27
  • [MEDIUM] Oversized files: components/map/threat-map.tsx (735 lines), lib/valyu.ts – hard to hold in one head; changes ripple widely
  • [HIGH] No LICENSE at root – redistribution rights undefined; default is all rights reserved
  • [HIGH] No test suite – 56 source files, no test files; any change ships with no regression signal
  • [HIGH] No CI/CD pipeline – 56 source files, no .github/ build/test gate
  • [MEDIUM] No Dependabot/Renovate – 1 manifest, no update bot configured
  • [LOW] Missing .editorconfig, .gitattributes, formatter config

These findings come from static analysis of the repository’s 56 code files; they are deterministic and verified against the code, not inferred.

The Bottom Line

The platform works and maps real-time threat data with Mapbox and Valyu integration, but it’s held together by copy-pasted API routes and outsized modules with no test or CI guardrails. Without a license, the code has unclear redistribution rights, and the absence of tests means every merge is a gamble. It’s usable for prototyping or internal OSINT work, but any client engagement will need the duplicated logic extracted, a license added, and a basic test/CI pipeline bolted on before it’s production-grade.