@readystack/cra-24-72-14-reporting-lint 1.0.0

package/LICENSE.txt

@@ -0,0 +1,26 @@
+CRA 24/72/14 Reporting Lint — Licence
+
+Free scope
+  Checking the file currently open in the editor is free for any use, personal or
+  commercial, for as long as you keep the extension installed. No registration, no
+  telemetry, no network call.
+
+Full scope
+  The workspace sweep and the generated readiness report require a valid licence key.
+  One key covers one person, or one seat on a team. A key may be moved between machines
+  belonging to the same person or seat.
+
+Refund
+  Seven days, in full, for any reason.
+
+Restrictions
+  You may not redistribute, resell, sublicense or publish the extension package or the
+  rule table as your own product, and you may not remove or bypass the licence check.
+
+No warranty
+  This software is provided "as is", without warranty of any kind, express or implied.
+  It is a document linter. It is not legal advice, not a conformity assessment, and not
+  a substitute for counsel. In no event shall the author be liable for any claim,
+  damages or other liability arising from the use of this software.
+
+Copyright (c) 2026 ReadyStack. All rights reserved.

package/README.md

@@ -0,0 +1,52 @@
+# CRA 24/72/14 Reporting Lint (Article 14)
+
+Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT.
+
+## Install
+
+```
+npx @readystack/cra-24-72-14-reporting-lint file.md
+```
+
+Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Checks the Markdown file you have open against all 18 rules, offline, with the article and the replacement line for every finding — no watermark, no counter, nothing withheld.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Sweeps every Markdown file in the workspace in one pass, works out which checks are answered nowhere in the repository rather than merely missing from one file, and writes one dated CRA-24-72-14-READINESS.md to hand to an auditor.
+
+```
+@readystack/cra-24-72-14-reporting-lint --dir ./templates --report html --out report.html
+```
+
+One hour of EU product-compliance consulting runs $150-250, and a first documentation review is rarely one hour.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "cra-24-72-14-reporting-lint": { "command": "npx", "args": ["-y", "@readystack/cra-24-72-14-reporting-lint", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence; the full sweep is free for 7 days). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: CRA 24/72/14 Reporting Lint (Article 14)
+  run: npx -y @readystack/cra-24-72-14-reporting-lint --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/cra-24-72-14-reporting-lint --dir /work --ci`)
+
+Try the full run free for 7 days — no key needed. Then one licence, 7-day refund, no questions. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_zmN08yKAf6Qz5WMiSQO9V9MxIRQN87VQEfurn03M3KT)
+
+
+<!-- cra 24 72 14 reporting lint -->

package/cli.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (e.name === 'node_modules' || e.name === '.git' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    let t = null; try { t = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) {}
+    if (!t || !t.until) { t = { until: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString().slice(0, 10) }; fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(t)); }
+    return { active: new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t.until };
+  } catch (e) { return { active: false }; }
+}
+function mcpServe() {
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (7-day trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; the full run is free for 7 days)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once, 7-day refund): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once, 7-day refund): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s144 reverse trial: the full run is free for 7 days from the first paid use, then the key
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once (7-day refund). Get a licence: ' + lic.BUY_URL + '\n');
+      else { process.stderr.write(S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ', once): ' + lic.BUY_URL + '\n'); process.exit(2); }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

package/engine.js

@@ -0,0 +1,93 @@
+'use strict';
+// CRA 24/72/14 Reporting Lint — the engine. The same bytes run in VS Code and in the free web page.
+var RULES = (typeof module !== 'undefined' && module.exports && typeof require === 'function')
+  ? require('./rules.json')
+  : (typeof CRA_RULES !== 'undefined' ? CRA_RULES : []);
+
+var TODAY_DEFAULT = '2026-09-11';          // the day Article 14 reporting started applying
+var SUPPORT_MIN_YEARS = 5;                 // Art. 13(8) default expectation
+
+function lineOf(text, index) {
+  var n = 1;
+  for (var i = 0; i < index && i < text.length; i++) if (text.charCodeAt(i) === 10) n++;
+  return n;
+}
+
+function ymd(s) {
+  var m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(s || ''));
+  if (!m) return null;
+  var y = +m[1], mo = +m[2], d = +m[3];
+  if (mo < 1 || mo > 12 || d < 1 || d > 31) return null;
+  return y * 10000 + mo * 100 + d;
+}
+
+function plusYears(n, years) {
+  return n + years * 10000;
+}
+
+function supportDates(text) {
+  var out = [];
+  var re = /(?:support period|end of support|end-of-support|supported until|security updates)[^\n]{0,90}?(\d{4}-\d{2}-\d{2})/gi;
+  var m;
+  while ((m = re.exec(text)) !== null) {
+    var v = ymd(m[1]);
+    if (v) out.push({ raw: m[1], val: v, line: lineOf(text, m.index) });
+    if (re.lastIndex === m.index) re.lastIndex++;
+  }
+  return out;
+}
+
+function finding(rule, line, extra) {
+  return {
+    check: rule.id,
+    sev: rule.sev,
+    line: line,
+    msg: extra ? rule.msg + ' ' + extra : rule.msg,
+    fix: rule.fix,
+    cite: rule.cite
+  };
+}
+
+function check(text, opts) {
+  opts = opts || {};
+  var src = String(text == null ? '' : text);
+  var today = ymd(opts.today) || ymd(TODAY_DEFAULT);
+  var lines = src.split(/\r?\n/);
+  var findings = [];
+  var dates = supportDates(src);
+
+  for (var r = 0; r < RULES.length; r++) {
+    var rule = RULES[r];
+    if (rule.kind === 'date') {
+      for (var d = 0; d < dates.length; d++) {
+        var dt = dates[d];
+        if (rule.mode === 'past' && dt.val < today) {
+          findings.push(finding(rule, dt.line, 'Declared end ' + dt.raw + ', today ' + (opts.today || TODAY_DEFAULT) + '.'));
+        } else if (rule.mode === 'short' && dt.val >= today && dt.val < plusYears(today, SUPPORT_MIN_YEARS)) {
+          findings.push(finding(rule, dt.line, 'Declared end ' + dt.raw + ', five years from today is ' + String(plusYears(today, SUPPORT_MIN_YEARS)).replace(/^(\d{4})(\d{2})(\d{2})$/, '$1-$2-$3') + '.'));
+        }
+      }
+      continue;
+    }
+    if (!rule.re) continue;
+    if (rule.kind === 'wrong') {
+      var re = new RegExp(rule.re, 'i');
+      for (var i = 0; i < lines.length; i++) if (re.test(lines[i])) findings.push(finding(rule, i + 1));
+    } else {
+      if (!(new RegExp(rule.re, 'i')).test(src)) findings.push(finding(rule, 0));
+    }
+  }
+
+  findings.sort(function (a, b) { return (a.line - b.line) || (a.check < b.check ? -1 : a.check > b.check ? 1 : 0); });
+  return {
+    findings: findings,
+    counted: RULES.length,
+    errors: findings.filter(function (f) { return f.sev === 'error'; }).length,
+    warnings: findings.filter(function (f) { return f.sev === 'warn'; }).length,
+    today: opts.today || TODAY_DEFAULT
+  };
+}
+
+var CRAENGINE = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length, VERSION: '1.0.0' };
+if (typeof module !== 'undefined' && module.exports) module.exports = CRAENGINE;
+else window.CRAENGINE = CRAENGINE;

package/license.js

@@ -0,0 +1,64 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = 'd898f960-e6b2-457c-825f-53372843985c';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_zmN08yKAf6Qz5WMiSQO9V9MxIRQN87VQEfurn03M3KT';
+const SLUG = 'cra-24-72-14-reporting-lint';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+function validate(key) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(BENEFIT_ID) ? { key: key, organization_id: ORG_ID, benefit_id: BENEFIT_ID } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) return { ok: false, why: 'no_key' };
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@readystack/cra-24-72-14-reporting-lint",
+  "version": "1.0.0",
+  "description": "Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT.",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "cyber resilience act",
+    "cra",
+    "article 14",
+    "vulnerability reporting",
+    "enisa",
+    "csirt",
+    "security.md",
+    "compliance"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_zmN08yKAf6Qz5WMiSQO9V9MxIRQN87VQEfurn03M3KT",
+  "bin": {
+    "cra-24-72-14-reporting-lint": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

package/rules.json

@@ -0,0 +1,166 @@
+[
+ {
+  "id": "art14_no_24h_early_warning",
+  "kind": "missing",
+  "sev": "error",
+  "re": "(24[ -]?hours?|twenty-four hours)[^\\n]{0,90}(early warning|ENISA|CSIRT)|early warning[^\\n]{0,90}(24[ -]?hours?|twenty-four hours)",
+  "msg": "No 24-hour early warning step. The clock starts when you become aware, not when you finish triage.",
+  "fix": "Step 1 of the runbook: early warning to the coordinating CSIRT and ENISA within 24 hours of awareness.",
+  "cite": "CRA Art. 14(1)(a), Art. 14(4)(a)"
+ },
+ {
+  "id": "art14_no_72h_notification",
+  "kind": "missing",
+  "sev": "error",
+  "re": "(72[ -]?hours?|seventy-two hours)[^\\n]{0,90}(notification|notify|vulnerability|incident)|(notification|notify)[^\\n]{0,90}(72[ -]?hours?|seventy-two hours)",
+  "msg": "No 72-hour notification step. The early warning does not discharge the obligation on its own.",
+  "fix": "Step 2: vulnerability or incident notification within 72 hours, with severity, impact and any corrective measures taken.",
+  "cite": "CRA Art. 14(1)(b), Art. 14(4)(b)"
+ },
+ {
+  "id": "art14_no_14day_final_report",
+  "kind": "missing",
+  "sev": "error",
+  "re": "(14[ -]?days?|fourteen days)[^\\n]{0,110}(final report|corrective|remediat)|final report[^\\n]{0,110}(14[ -]?days?|fourteen days)",
+  "msg": "No final report step. The 14-day clock runs from the moment a corrective measure is available, not from disclosure.",
+  "fix": "Step 3: final report no later than 14 days after a corrective or mitigating measure is available.",
+  "cite": "CRA Art. 14(2)(c)"
+ },
+ {
+  "id": "art14_no_enisa",
+  "kind": "missing",
+  "sev": "error",
+  "re": "ENISA",
+  "msg": "ENISA is never named. Every Article 14 report goes to ENISA as well as to a CSIRT.",
+  "fix": "Name ENISA as a simultaneous recipient of the early warning, the notification and the final report.",
+  "cite": "CRA Art. 14(1)"
+ },
+ {
+  "id": "art14_no_csirt",
+  "kind": "missing",
+  "sev": "error",
+  "re": "CSIRT",
+  "msg": "No CSIRT named. Reports go to the CSIRT designated as coordinator for your main establishment in the Union.",
+  "fix": "Name the Member State and the coordinating CSIRT you report to, so the on-call engineer does not have to find it at 3am.",
+  "cite": "CRA Art. 14(1), Art. 14(7)"
+ },
+ {
+  "id": "art16_no_single_reporting_platform",
+  "kind": "missing",
+  "sev": "warn",
+  "re": "single reporting platform",
+  "msg": "The single reporting platform is not mentioned, so the runbook does not say where the report is actually filed.",
+  "fix": "State that reports are submitted through the single reporting platform and record the account that can file them.",
+  "cite": "CRA Art. 16"
+ },
+ {
+  "id": "art14_no_actively_exploited_trigger",
+  "kind": "missing",
+  "sev": "error",
+  "re": "actively exploited",
+  "msg": "The trigger is not defined. The duty attaches to an actively exploited vulnerability, not to every vulnerability you receive.",
+  "fix": "Define 'actively exploited' in the runbook and say who decides that a report has crossed the line.",
+  "cite": "CRA Art. 14(1), Art. 3(42)"
+ },
+ {
+  "id": "art14_no_severe_incident_trigger",
+  "kind": "missing",
+  "sev": "error",
+  "re": "severe incident",
+  "msg": "The second trigger is missing. A severe incident affecting the security of the product is reportable on the same clock.",
+  "fix": "Add the severe-incident trigger alongside the actively-exploited-vulnerability trigger.",
+  "cite": "CRA Art. 14(3), Art. 14(4)"
+ },
+ {
+  "id": "annex1_no_cvd_policy",
+  "kind": "missing",
+  "sev": "warn",
+  "re": "coordinated vulnerability disclosure|disclosure policy|CVD policy",
+  "msg": "No coordinated vulnerability disclosure policy is referenced, so reporters have no stated route in.",
+  "fix": "Link the coordinated vulnerability disclosure policy and say what a reporter can expect from you.",
+  "cite": "CRA Annex I Part II(5)"
+ },
+ {
+  "id": "annex1_no_sbom",
+  "kind": "missing",
+  "sev": "warn",
+  "re": "SBOM|software bill of materials|CycloneDX|SPDX",
+  "msg": "No SBOM is referenced. Without one you cannot answer 'which shipped versions contain the component' inside 72 hours.",
+  "fix": "Reference the SBOM location and format so the notification can list affected versions.",
+  "cite": "CRA Annex I Part II(1)"
+ },
+ {
+  "id": "annex2_no_contact_point",
+  "kind": "missing",
+  "sev": "error",
+  "re": "[\\w.+-]+@[\\w-]+\\.[a-z]{2,}|mailto:|https?://[^\\s)]+/(security|report|advisor)",
+  "msg": "No single point of contact. There is no address a finder or an authority can reach you at.",
+  "fix": "Publish one monitored address or form as the single point of contact for security reports.",
+  "cite": "CRA Annex II(4)"
+ },
+ {
+  "id": "art13_no_support_period_date",
+  "kind": "missing",
+  "sev": "error",
+  "re": "(support period|end of support|end-of-support|supported until|security updates)[^\\n]{0,90}\\d{4}-\\d{2}-\\d{2}",
+  "msg": "No support period end date in ISO form. A prose promise of 'ongoing support' is not a declared support period.",
+  "fix": "Write the support period end date as YYYY-MM-DD next to the words 'support period' or 'end of support'.",
+  "cite": "CRA Art. 13(8)"
+ },
+ {
+  "id": "wrong_start_date_2027",
+  "kind": "wrong",
+  "sev": "error",
+  "re": "(report|notif|article 14|obligation)[^\\n]{0,100}(december 2027|11 december 2027|2027-12-11|dec\\.? 2027|december 11,? 2027)",
+  "msg": "Wrong start date. The reporting obligation already applies; December 2027 is when the remaining obligations follow.",
+  "fix": "Correct the date to 11 September 2026 for reporting, and keep 11 December 2027 only for the other obligations.",
+  "cite": "CRA Art. 71(2)"
+ },
+ {
+  "id": "wrong_recipient",
+  "kind": "wrong",
+  "sev": "error",
+  "re": "(report|notify|notification|disclose)[^\\n]{0,80}(european commission|europol|local police|national police|data protection authority|supervisory authority)",
+  "msg": "Wrong recipient on the Article 14 path. This report does not go there.",
+  "fix": "Route the report to the coordinating CSIRT and ENISA. Keep any other authority in a separate, clearly labelled path.",
+  "cite": "CRA Art. 14(1)"
+ },
+ {
+  "id": "gdpr_clock_confusion",
+  "kind": "wrong",
+  "sev": "error",
+  "re": "(gdpr|general data protection)[^\\n]{0,90}(72|article 33)|article 33[^\\n]{0,70}72",
+  "msg": "Two different 72-hour clocks are being treated as one. The personal-data breach duty is a separate obligation with a separate recipient.",
+  "fix": "Split the runbook into two paths and say plainly that one incident can start both clocks at once.",
+  "cite": "CRA Art. 14 vs GDPR Art. 33"
+ },
+ {
+  "id": "response_window_in_days",
+  "kind": "wrong",
+  "sev": "warn",
+  "re": "(respond|reply|acknowledge|triage)[^\\n]{0,60}within\\s+\\d+\\s*(business\\s+)?(day|week|month)",
+  "msg": "A response window measured in days sits next to an obligation measured in hours. A reporter reading this will assume the slower number.",
+  "fix": "Keep your disclosure-timeline promise, but state the 24/72/14 clock separately so neither is mistaken for the other.",
+  "cite": "CRA Art. 14(1)"
+ },
+ {
+  "id": "support_period_lapsed",
+  "kind": "date",
+  "mode": "past",
+  "sev": "error",
+  "re": "",
+  "msg": "The declared support period has already ended, while the product is still published.",
+  "fix": "Either extend the declared support period or state the withdrawal date for the affected versions.",
+  "cite": "CRA Art. 13(8)"
+ },
+ {
+  "id": "support_period_under_five_years",
+  "kind": "date",
+  "mode": "short",
+  "sev": "warn",
+  "re": "",
+  "msg": "The declared support period is shorter than five years from today.",
+  "fix": "Five years is the default expectation unless the product's expected lifetime is genuinely shorter. If it is, say so and say why.",
+  "cite": "CRA Art. 13(8)"
+ }
+]

package/strings.json

@@ -0,0 +1,12 @@
+{
+ "name": "CRA 24/72/14 Reporting Lint (Article 14)",
+ "subtitle": "Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT.",
+ "bin": "cra-24-72-14-reporting-lint",
+ "price": 29,
+ "free": "Checks the Markdown file you have open against all 18 rules, offline, with the article and the replacement line for every finding — no watermark, no counter, nothing withheld.",
+ "paid": "Sweeps every Markdown file in the workspace in one pass, works out which checks are answered nowhere in the repository rather than merely missing from one file, and writes one dated CRA-24-72-14-READINESS.md to hand to an auditor.",
+ "need_key": "This option needs a licence (CRA 24/72/14 Reporting Lint (Article 14)).",
+ "exts": [
+  ".md"
+ ]
+}