@readystack/cra-annex-ii-docs-lint 1.0.0

package/LICENSE.txt

@@ -0,0 +1,16 @@
+CRA Annex II User Docs Lint — Licence
+
+Free scope
+  Lints the documentation file you have open and lists every Annex II item that is missing, vague or already expired, with line numbers. is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Scans every documentation file in the workspace at once and exports a dated Annex II evidence report (Markdown + CSV) you keep with your technical file. is the paid part. It asks for a licence key issued at purchase (one seat, one key;
+  7-day full refund, no questions). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

package/README.md

@@ -0,0 +1,54 @@
+# CRA Annex II User Docs Lint
+
+![CRA Annex II User Docs Lint](https://getreadystack.com/img/promo/sku79782_result_card.jpg)
+
+19 rules over the user documentation that ships with your product: support-period end date, vulnerability reporting contact, EU declaration of conformity address, secure decommissioning.
+
+## Install
+
+```
+npx @readystack/cra-annex-ii-docs-lint file
+```
+
+Node 18+. The same 19 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Lints the documentation file you have open with all 19 rules and puts every missing, vague or expired Annex II item on its line - 15 findings (11 errors, 4 warnings) on the bundled dirty fixture, 0 on the clean one. No key, no upload, finished on its own.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scope and ownership: one command sweeps every documentation file in the workspace and exports a dated Annex II evidence report (Markdown + CSV) you keep with your technical file. $29 once, one licence key per person or team seat, 7-day full refund.
+
+```
+@readystack/cra-annex-ii-docs-lint --dir ./templates --report html --out report.html
+```
+
+A compliance consultant reviewing one technical file bills about EUR 150 per hour.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "cra-annex-ii-docs-lint": { "command": "npx", "args": ["-y", "@readystack/cra-annex-ii-docs-lint", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence; the full sweep is free for 7 days). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: CRA Annex II User Docs Lint
+  run: npx -y @readystack/cra-annex-ii-docs-lint --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/cra-annex-ii-docs-lint --dir /work --ci`)
+
+Try the full run free for 7 days — no key needed. Then one licence, 7-day refund, no questions. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_mS0E5k9PqMWkUFlrIn7VEYPbBJmAX5ybAjvyM2dC7Zw)
+
+
+<!-- cra annex ii docs lint -->

package/cli.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (e.name === 'node_modules' || e.name === '.git' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    let t = null; try { t = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) {}
+    if (!t || !t.until) { t = { until: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString().slice(0, 10) }; fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(t)); }
+    return { active: new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t.until };
+  } catch (e) { return { active: false }; }
+}
+function mcpServe() {
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (7-day trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; the full run is free for 7 days)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once, 7-day refund): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once, 7-day refund): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s144 reverse trial: the full run is free for 7 days from the first paid use, then the key
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once (7-day refund). Get a licence: ' + lic.BUY_URL + '\n');
+      else { process.stderr.write(S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ', once): ' + lic.BUY_URL + '\n'); process.exit(2); }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

package/engine.js

@@ -0,0 +1,92 @@
+/* CRA Annex II User Docs Lint - engine. Same file runs in Node (VS Code) and in the browser. */
+(function () {
+  var RULES = (typeof module !== 'undefined' && module.exports) ? require('./rules.json') : window.CRADOCS_RULES;
+
+  var MONTHS = {jan:1, feb:2, mar:3, apr:4, may:5, jun:6, jul:7, aug:8, sep:9, oct:10, nov:11, dec:12};
+  var SUPPORT_CTX = /(support period|security update|security support|end of support|supported until|patches until)/i;
+  var DATE_ISO = /(\d{4})-(\d{2})-(\d{2})/;
+  var DATE_DMY = /(\d{1,2})\s+([A-Za-z]{3,9})\.?\s+(\d{4})/;
+  var DATE_MDY = /([A-Za-z]{3,9})\.?\s+(\d{1,2}),?\s+(\d{4})/;
+
+  function pad(n) { return (n < 10 ? '0' : '') + n; }
+  function monthNum(w) { return MONTHS[String(w).slice(0, 3).toLowerCase()] || 0; }
+
+  function dateIn(line) {
+    var m = DATE_ISO.exec(line);
+    if (m) { return m[1] + '-' + m[2] + '-' + m[3]; }
+    m = DATE_DMY.exec(line);
+    if (m && monthNum(m[2])) { return m[3] + '-' + pad(monthNum(m[2])) + '-' + pad(parseInt(m[1], 10)); }
+    m = DATE_MDY.exec(line);
+    if (m && monthNum(m[1])) { return m[3] + '-' + pad(monthNum(m[1])) + '-' + pad(parseInt(m[2], 10)); }
+    return null;
+  }
+
+  function plusYears(iso, n) {
+    var p = iso.split('-');
+    return (parseInt(p[0], 10) + n) + '-' + p[1] + '-' + p[2];
+  }
+
+  function byCheck(name) {
+    for (var i = 0; i < RULES.length; i++) { if (RULES[i].check === name) { return RULES[i]; } }
+    return null;
+  }
+
+  function push(out, rule, line, extra) {
+    if (!rule) { return; }
+    out.push({check: rule.check, sev: rule.sev, msg: extra ? rule.msg + ' ' + extra : rule.msg, line: line || 1});
+  }
+
+  function check(text, opts) {
+    text = String(text == null ? '' : text);
+    opts = opts || {};
+    var today = /^\d{4}-\d{2}-\d{2}$/.test(opts.today || '') ? opts.today : '2026-09-16';
+    var lines = text.split(/\r?\n/);
+    var findings = [];
+    var i, j, k, r, hit, m;
+
+    for (i = 0; i < RULES.length; i++) {
+      r = RULES[i];
+      if (r.kind === 'require_any') {
+        hit = false;
+        for (j = 0; j < r.need.length; j++) { if (new RegExp(r.need[j], 'i').test(text)) { hit = true; break; } }
+        if (!hit) { push(findings, r, 1); }
+      } else if (r.kind === 'require_all') {
+        hit = true;
+        for (j = 0; j < r.need.length; j++) { if (!new RegExp(r.need[j], 'i').test(text)) { hit = false; break; } }
+        if (!hit) { push(findings, r, 1); }
+      } else if (r.kind === 'forbid') {
+        for (j = 0; j < lines.length; j++) {
+          for (k = 0; k < r.need.length; k++) {
+            m = new RegExp(r.need[k], 'i').exec(lines[j]);
+            if (m) { push(findings, r, j + 1, '(reads "' + String(m[0]).slice(0, 44) + '")'); break; }
+          }
+        }
+      }
+    }
+
+    var ctxLine = 0, endDate = null;
+    for (j = 0; j < lines.length; j++) {
+      if (SUPPORT_CTX.test(lines[j])) {
+        if (!ctxLine) { ctxLine = j + 1; }
+        var d = dateIn(lines[j]);
+        if (d) { endDate = d; ctxLine = j + 1; break; }
+      }
+    }
+    if (!endDate) {
+      push(findings, byCheck('support_end_date'), ctxLine);
+    } else if (endDate < today) {
+      push(findings, byCheck('support_end_expired'), ctxLine, '(found ' + endDate + ', today is ' + today + ')');
+    } else if (endDate < plusYears(today, 5)) {
+      push(findings, byCheck('support_period_short'), ctxLine, '(ends ' + endDate + ')');
+    }
+
+    var errors = 0, warnings = 0;
+    for (i = 0; i < findings.length; i++) { if (findings[i].sev === 'error') { errors++; } else { warnings++; } }
+    return {findings: findings, ok: findings.length === 0, errors: errors, warnings: warnings,
+            rules_checked: RULES.length, support_end_date: endDate, today: today};
+  }
+
+  var api = {engine: {check: check}, RULES: RULES, RULE_COUNT: RULES.length};
+  if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
+  if (typeof window !== 'undefined') { window.CRADOCS = api; }
+})();

package/license.js

@@ -0,0 +1,64 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = 'ff8acc4e-ec44-47e8-8ec3-298424197b31';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_mS0E5k9PqMWkUFlrIn7VEYPbBJmAX5ybAjvyM2dC7Zw';
+const SLUG = 'cra-annex-ii-docs-lint';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+function validate(key) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(BENEFIT_ID) ? { key: key, organization_id: ORG_ID, benefit_id: BENEFIT_ID } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) return { ok: false, why: 'no_key' };
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@readystack/cra-annex-ii-docs-lint",
+  "version": "1.0.0",
+  "description": "19 rules over the user documentation that ships with your product: support-period end date, vulnerability reporting contact, EU declaration of conformity address, secure decommissioning.",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "cyber resilience act",
+    "cra",
+    "compliance",
+    "documentation",
+    "ce marking",
+    "annex ii",
+    "markdown"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_mS0E5k9PqMWkUFlrIn7VEYPbBJmAX5ybAjvyM2dC7Zw",
+  "bin": {
+    "cra-annex-ii-docs-lint": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/cra-annex-ii-docs-lint",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "cra-annex-ii-docs-lint"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

package/rules.json

@@ -0,0 +1,189 @@
+[
+ {
+  "check": "manufacturer_identity",
+  "sev": "error",
+  "kind": "require_all",
+  "need": [
+   "\\b(manufacturer|manufactured by)\\b",
+   "(address|registered office|postal address)\\s*:"
+  ],
+  "msg": "Annex II(1): name the manufacturer and give a postal address ('Manufacturer:' plus 'Address:')."
+ },
+ {
+  "check": "manufacturer_email",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
+  ],
+  "msg": "Annex II(1): give an electronic contact address for the manufacturer."
+ },
+ {
+  "check": "vulnerability_contact",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "report[^\\n]{0,60}vulnerabilit",
+   "vulnerabilit[^\\n]{0,60}(report|contact)"
+  ],
+  "msg": "Annex II(2): name a single point of contact where vulnerabilities can be reported."
+ },
+ {
+  "check": "disclosure_policy",
+  "sev": "warning",
+  "kind": "require_any",
+  "need": [
+   "coordinated vulnerability disclosure",
+   "disclosure policy",
+   "SECURITY\\.md",
+   "security\\.txt"
+  ],
+  "msg": "Annex II(2): say where the coordinated vulnerability disclosure policy can be found."
+ },
+ {
+  "check": "product_identification",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "(model|type designation|batch|serial|firmware version|product version|version)\\s*:"
+  ],
+  "msg": "Annex II(3): identify the product by type, batch, model or version."
+ },
+ {
+  "check": "intended_purpose",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "intended purpose",
+   "intended use"
+  ],
+  "msg": "Annex II(4): state the intended purpose of the product."
+ },
+ {
+  "check": "security_environment",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "security environment",
+   "intended (operational|operating) environment",
+   "operational environment"
+  ],
+  "msg": "Annex II(4): describe the intended security and operational environment."
+ },
+ {
+  "check": "essential_functions",
+  "sev": "warning",
+  "kind": "require_any",
+  "need": [
+   "essential function",
+   "security (properties|features)",
+   "security functions?"
+  ],
+  "msg": "Annex II(4): list the essential functions and the security properties."
+ },
+ {
+  "check": "known_risks",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "(known|foreseeable)[^\\n]{0,60}(risk|circumstanc)",
+   "risk[^\\n]{0,40}(misuse|foreseeable)"
+  ],
+  "msg": "Annex II(5): describe known or foreseeable circumstances that lead to significant cybersecurity risk."
+ },
+ {
+  "check": "doc_address",
+  "sev": "error",
+  "kind": "require_all",
+  "need": [
+   "declaration of conformity",
+   "https?://"
+  ],
+  "msg": "Annex II(6): give the internet address where the EU declaration of conformity can be accessed."
+ },
+ {
+  "check": "support_end_date",
+  "sev": "error",
+  "kind": "support_date",
+  "msg": "Annex II(7): give the end of the support period as a calendar date (for example 2032-12-31)."
+ },
+ {
+  "check": "support_end_vague",
+  "sev": "error",
+  "kind": "forbid",
+  "need": [
+   "(support|updates?)[^\\n]{0,80}(as long as|for the foreseeable future|indefinitely|until further notice|where possible|on an ongoing basis)",
+   "(as long as|indefinitely)[^\\n]{0,80}(support|updates?)"
+  ],
+  "msg": "Annex II(7): an open-ended support promise is not an end date."
+ },
+ {
+  "check": "support_end_expired",
+  "sev": "error",
+  "kind": "support_date",
+  "msg": "Annex II(7): the support period end date in this document has already passed."
+ },
+ {
+  "check": "support_period_short",
+  "sev": "warning",
+  "kind": "support_date",
+  "msg": "Annex II(7): the support period ends less than five years from today."
+ },
+ {
+  "check": "support_type",
+  "sev": "warning",
+  "kind": "require_any",
+  "need": [
+   "type of[^\\n]{0,30}support",
+   "security support[^\\n]{0,40}(includes|covers|means)",
+   "security patches"
+  ],
+  "msg": "Annex II(7): say what the technical security support covers."
+ },
+ {
+  "check": "update_instructions",
+  "sev": "error",
+  "kind": "require_any",
+  "need": [
+   "(install|apply|download)[^\\n]{0,40}(security )?updates?",
+   "update[^\\n]{0,30}instructions"
+  ],
+  "msg": "Annex II(8): give instructions for installing security updates."
+ },
+ {
+  "check": "secure_decommissioning",
+  "sev": "error",
+  "kind": "require_all",
+  "need": [
+   "(decommission|secure disposal|end of (use|life))",
+   "(remove|delete|erase|wipe)[^\\n]{0,60}data"
+  ],
+  "msg": "Annex II(8): cover secure decommissioning, including how user data is erased."
+ },
+ {
+  "check": "sbom_access",
+  "sev": "warning",
+  "kind": "require_any",
+  "need": [
+   "software bill of materials",
+   "\\bSBOM\\b",
+   "CycloneDX",
+   "SPDX"
+  ],
+  "msg": "Annex II(9): say how the machine-readable software bill of materials can be accessed."
+ },
+ {
+  "check": "template_placeholder",
+  "sev": "error",
+  "kind": "forbid",
+  "need": [
+   "\\[(company|product|insert|your)[^\\]]*\\]",
+   "<insert[^>]*>",
+   "\\bTODO\\b",
+   "XX/XX",
+   "YYYY-MM-DD",
+   "lorem ipsum"
+  ],
+  "msg": "A template placeholder is still in the shipped documentation."
+ }
+]

package/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "CRA Annex II User Docs Lint",
+ "subtitle": "19 rules over the user documentation that ships with your product: support-period end date, vulnerability reporting contact, EU declaration of conformity address, secure decommissioning.",
+ "bin": "cra-annex-ii-docs-lint",
+ "price": 29,
+ "free": "Lints the documentation file you have open with all 19 rules and puts every missing, vague or expired Annex II item on its line - 15 findings (11 errors, 4 warnings) on the bundled dirty fixture, 0 on the clean one. No key, no upload, finished on its own.",
+ "paid": "Scope and ownership: one command sweeps every documentation file in the workspace and exports a dated Annex II evidence report (Markdown + CSV) you keep with your technical file. $29 once, one licence key per person or team seat, 7-day full refund.",
+ "need_key": "This option needs a licence (CRA Annex II User Docs Lint).",
+ "exts": []
+}