@readystack/dotnet-eol-support-gate 1.0.1

package/LICENSE.txt

@@ -0,0 +1,16 @@
+.NET EOL & CRA Support Window Gate — Licence
+
+Free scope
+  Dates one .csproj or global.json you have open: every target framework, SDK pin and runtime-bound package gets its real end-of-support date, the days left, and the months it falls short of the support period you promise. is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Runs the same dating over every project file in the workspace at once and writes the dated support-window evidence file (Markdown + CSV) you keep and hand to an auditor. is the paid part. It asks for a licence key issued at purchase (one seat, one key;
+  7-day full refund, no questions). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

package/README.md

@@ -0,0 +1,52 @@
+# .NET EOL & CRA Support Window Gate
+
+Dates every target framework in a .csproj against Microsoft's end-of-support day and against the support period you promise
+
+## Install
+
+```
+npx @readystack/dotnet-eol-support-gate file
+```
+
+Node 18+. The same 10 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Dates one .csproj, Directory.Build.props or global.json you have open: every target framework, SDK pin and runtime-bound package gets its real end-of-support date, the days left, and the months it falls short of the support period you promise. 10 checks, no key.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Runs the same dating over every project file in the workspace in one pass and writes the dated support-window evidence file you keep and hand to an auditor.
+
+```
+@readystack/dotnet-eol-support-gate --dir ./templates --report html --out report.html
+```
+
+Having a contractor inventory runtime support dates across a solution and write the evidence page is commonly quoted as a multi-day engagement
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "dotnet-eol-support-gate": { "command": "npx", "args": ["-y", "@readystack/dotnet-eol-support-gate", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence; the full sweep is free for 7 days). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: .NET EOL & CRA Support Window Gate
+  run: npx -y @readystack/dotnet-eol-support-gate --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/dotnet-eol-support-gate --dir /work --ci`)
+
+Try the full run free for 7 days — no key needed. Then one licence, 7-day refund, no questions. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_Z3kgDSemeuFusqV4CgHenwXtVCDgUEjo92a1x2d70T6)
+
+
+<!-- dotnet eol support gate -->

package/cli.js

@@ -0,0 +1,120 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (e.name === 'node_modules' || e.name === '.git' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    let t = null; try { t = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) {}
+    if (!t || !t.until) { t = { until: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString().slice(0, 10) }; fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(t)); }
+    return { active: new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t.until };
+  } catch (e) { return { active: false }; }
+}
+function mcpServe() {
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (7-day trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; the full run is free for 7 days)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once, 7-day refund): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once, 7-day refund): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s144 reverse trial: the full run is free for 7 days from the first paid use, then the key
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once (7-day refund). Get a licence: ' + lic.BUY_URL + '\n');
+      else { process.stderr.write(S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ', once): ' + lic.BUY_URL + '\n'); process.exit(2); }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

package/engine.js

@@ -0,0 +1,115 @@
+// .NET EOL & CRA Support Window Gate — one brain, used by the extension and by the free web page.
+'use strict';
+var RULES = (typeof module !== 'undefined') ? require('./rules.json') : window.DOTNET_EOL_RULES;
+
+// Microsoft .NET release lifecycle — published end-of-support dates.
+var TFM_EOL = {
+  'netcoreapp3.1': '2022-12-13', 'net5.0': '2022-05-10', 'net6.0': '2024-11-12',
+  'net7.0': '2024-05-14', 'net8.0': '2026-11-10', 'net9.0': '2026-05-12', 'net10.0': '2028-11-14'
+};
+var MAJOR_EOL = { '3': '2022-12-13', '5': '2022-05-10', '6': '2024-11-12', '7': '2024-05-14', '8': '2026-11-10', '9': '2026-05-12', '10': '2028-11-14' };
+var FX_RETIRED = { 'net45': '2016-01-12', 'net451': '2016-01-12', 'net452': '2022-04-26', 'net46': '2022-04-26', 'net461': '2022-04-26' };
+var XAMARIN_END = '2024-05-01';
+var RUNTIME_PKG = /^(Microsoft\.AspNetCore\.|Microsoft\.EntityFrameworkCore|Microsoft\.Extensions\.)/;
+var SOON_DAYS = 180;
+
+function day(s) { var p = String(s || '').slice(0, 10).split('-'); return Date.UTC(+p[0], (+p[1] || 1) - 1, +p[2] || 1); }
+function daysBetween(a, b) { return Math.round((day(b) - day(a)) / 86400000); }
+function iso(ms) { return new Date(ms).toISOString().slice(0, 10); }
+function addYears(s, n) { var d = new Date(day(s)); d.setUTCFullYear(d.getUTCFullYear() + Math.round(n)); return iso(d.getTime()); }
+function months(a, b) { return Math.round(daysBetween(a, b) / 30.44); }
+
+function check(text, opts) {
+  opts = opts || {};
+  var today = String(opts.today || new Date().toISOString().slice(0, 10)).slice(0, 10);
+  var years = Number(opts.support_years || 5) || 5;
+  var placed = String(opts.placed_on_market || today).slice(0, 10);
+  var lines = String(text == null ? '' : text).split(/\r?\n/);
+  var out = [];
+  var declared = null, declaredLine = 0, sawProject = false, sawTfm = false;
+  var auditOff = false, auditMode = false, sawAudit = false;
+
+  function add(id, line, msg) { out.push({ check: id, sev: (RULES.filter(function (r) { return r.id === id; })[0] || {}).sev || 'error', msg: msg, line: line }); }
+
+  // pass 1 — declared support period and audit settings
+  lines.forEach(function (raw, i) {
+    var n = i + 1;
+    var d = raw.match(/(?:SupportedUntil|SupportPeriodEnd|SupportEndDate|CRA-support-until)\s*[>:=]\s*"?(\d{4}-\d{2}-\d{2})/i);
+    if (d && !declared) { declared = d[1]; declaredLine = n; }
+    if (/<Project\b|"sdk"\s*:/i.test(raw)) sawProject = true;
+    if (/<NuGetAudit>\s*false\s*</i.test(raw)) { auditOff = true; add('nuget_audit_off', n, 'NuGetAudit is switched off, so no package in this project is checked against the advisory database at build time. CRA Annex I Part II expects shipped components to be screened.'); }
+    if (/<NuGetAudit>\s*true\s*</i.test(raw)) sawAudit = true;
+    if (/<NuGetAuditMode>\s*all\s*</i.test(raw)) { auditMode = true; sawAudit = true; }
+  });
+  if (sawProject && !auditOff && sawAudit && !auditMode) add('nuget_audit_off', 1, 'NuGetAuditMode is not set to "all", so only your direct PackageReferences are screened and transitive dependencies — where most shipped CVEs live — are skipped.');
+
+  var windowEnd = declared || addYears(placed, years);
+  if (sawProject && !declared) {
+    add('support_period_undeclared', 1, 'No support period is declared in this file, so the gate uses the CRA Article 13(8) floor: ' + years + ' years from ' + placed + ', ending ' + windowEnd + '. Add <SupportedUntil>' + windowEnd + '</SupportedUntil> to make the promise explicit.');
+  }
+
+  function dateTfm(tfm, n) {
+    var t = tfm.toLowerCase().trim();
+    if (/-(preview|rc)/.test(t) || /^net(1[1-9])\.0/.test(t)) {
+      add('preview_runtime', n, tfm + ' is a preview or unreleased runtime. Preview builds carry no support period at all, so nothing you promise a buyer is backed by a patch stream.');
+      return;
+    }
+    if (/^(monoandroid|xamarin|xamarinios|xamarinmac)/.test(t)) {
+      add('xamarin_retired', n, tfm + ' is a Xamarin target framework. Xamarin support ended on ' + XAMARIN_END + ', ' + daysBetween(XAMARIN_END, today) + ' days ago; move the head project to a net10.0-android / net10.0-ios .NET MAUI target.');
+      return;
+    }
+    if (FX_RETIRED[t]) {
+      add('framework_retired', n, tfm + ' (.NET Framework) left support on ' + FX_RETIRED[t] + ', ' + daysBetween(FX_RETIRED[t], today) + ' days ago. Retarget to net472 or later, or to net10.0.');
+      return;
+    }
+    var base = t.split('-')[0];
+    var eol = TFM_EOL[base];
+    if (!eol) return;
+    var left = daysBetween(today, eol);
+    if (left < 0) {
+      add('tfm_out_of_support', n, tfm + ' lost security servicing on ' + eol + ' — ' + (-left) + ' days ago. Every runtime CVE published since that day is still open in this build.');
+    } else if (left <= SOON_DAYS) {
+      add('tfm_ends_soon', n, tfm + ' stops receiving security fixes on ' + eol + ', in ' + left + ' days. A runtime bump is a release, not a patch — schedule it now.');
+    }
+    if (left >= 0 && day(eol) < day(windowEnd)) {
+      var tail = (day(TFM_EOL['net10.0']) >= day(windowEnd)) ? ' net10.0 covers that promise to ' + TFM_EOL['net10.0'] + '.' : ' Even net10.0 only reaches ' + TFM_EOL['net10.0'] + ', so this promise needs a planned retarget on the roadmap, not a one-off bump.';
+      add('support_window_gap', n, tfm + ' dies on ' + eol + ', but the support period running to ' + windowEnd + ' leaves ' + months(eol, windowEnd) + ' months you have promised to patch on a runtime nobody patches.' + tail);
+    }
+  }
+
+  // pass 2 — target frameworks, SDK pins, packages
+  lines.forEach(function (raw, i) {
+    var n = i + 1, m;
+    if ((m = raw.match(/<TargetFramework>\s*([^<\s]+)\s*</i))) { sawTfm = true; dateTfm(m[1], n); }
+    if ((m = raw.match(/<TargetFrameworks>\s*([^<]+)</i))) {
+      sawTfm = true;
+      m[1].split(';').forEach(function (t) { if (t.trim()) dateTfm(t, n); });
+    }
+    if ((m = raw.match(/"version"\s*:\s*"(\d+)\.(\d+)\.(\d+)/))) {
+      var eol = MAJOR_EOL[m[1]];
+      if (eol && daysBetween(today, eol) < 0) {
+        add('sdk_pin_out_of_support', n, 'global.json pins SDK ' + m[1] + '.' + m[2] + '.' + m[3] + '. That band went out of support on ' + eol + ', ' + daysBetween(eol, today) + ' days ago, and the pin overrides every up-to-date SDK on the build machine.');
+      } else if (eol && daysBetween(today, eol) <= SOON_DAYS) {
+        add('sdk_pin_out_of_support', n, 'global.json pins SDK ' + m[1] + '.' + m[2] + '.' + m[3] + ', whose band goes out of support on ' + eol + ', in ' + daysBetween(today, eol) + ' days. Every CI run will keep building on it until the pin moves.');
+      }
+    }
+    if ((m = raw.match(/<PackageReference\s+Include="([^"]+)"[^>]*Version="([^"]+)"/i))) {
+      var id = m[1], ver = m[2];
+      if (/^Xamarin\./i.test(id)) {
+        add('xamarin_retired', n, id + ' ' + ver + ' is a Xamarin package. Xamarin support ended on ' + XAMARIN_END + ', ' + daysBetween(XAMARIN_END, today) + ' days ago, and no fix is coming for anything found in it.');
+      } else if (RUNTIME_PKG.test(id)) {
+        var maj = (ver.match(/^(\d+)/) || [])[1];
+        var pe = MAJOR_EOL[maj];
+        if (pe && daysBetween(today, pe) < 0) {
+          add('runtime_bound_package', n, id + ' ' + ver + ' follows the .NET ' + maj + ' lifecycle, which ended on ' + pe + ' — ' + daysBetween(pe, today) + ' days ago. This package line is unpatched.');
+        }
+      }
+    }
+  });
+
+  return { findings: out, today: today, window_end: windowEnd, support_years: years, declared: !!declared, declared_line: declaredLine, rules: RULES.length, targets_seen: sawTfm };
+}
+
+var API = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length, TFM_EOL: TFM_EOL };
+if (typeof module !== 'undefined') module.exports = API;
+if (typeof window !== 'undefined') window.DOTNET_EOL_ENGINE = API;

package/license.js

@@ -0,0 +1,68 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = '9069ee21-6b85-46bb-9a95-17f2e0db8bb0';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_Z3kgDSemeuFusqV4CgHenwXtVCDgUEjo92a1x2d70T6';
+const SLUG = 'dotnet-eol-support-gate';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+const ALL_BENEFIT_ID = '22692551-5203-4467-b1a3-e33cdba6589d';   // s149 2026-09-17 — 팀 키(전 린터 한 키 · Polar benefit) · 상품 benefit 다음에 한 번 더 묻는다
+function validate(key) {
+  return validate1(key, BENEFIT_ID).then(function (r) { return (r.ok || r.offline || !/^[0-9a-f-]{36}$/.test(ALL_BENEFIT_ID)) ? r : validate1(key, ALL_BENEFIT_ID); });
+}
+function validate1(key, ben) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(ben) ? { key: key, organization_id: ORG_ID, benefit_id: ben } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) return { ok: false, why: 'no_key' };
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@readystack/dotnet-eol-support-gate",
+  "version": "1.0.1",
+  "description": "Dates every target framework in a .csproj against Microsoft's end-of-support day and against the support period you promise",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "dotnet",
+    "net8.0 end of support",
+    "csproj",
+    "end of life",
+    "Cyber Resilience Act",
+    "maui",
+    "lifecycle"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_Z3kgDSemeuFusqV4CgHenwXtVCDgUEjo92a1x2d70T6",
+  "bin": {
+    "dotnet-eol-support-gate": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/dotnet-eol-support-gate",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "dotnet-eol-support-gate"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

package/rules.json

@@ -0,0 +1,62 @@
+[
+ {
+  "id": "tfm_out_of_support",
+  "sev": "error",
+  "title": "Target framework is past its end-of-support date",
+  "why": "Microsoft ships no security fixes for it, so every later CVE in the runtime stays open in your build."
+ },
+ {
+  "id": "tfm_ends_soon",
+  "sev": "error",
+  "title": "Target framework loses support inside 180 days",
+  "why": "A runtime bump is a release-planning item, not a patch; 180 days is the last comfortable window to schedule it."
+ },
+ {
+  "id": "support_window_gap",
+  "sev": "error",
+  "title": "Runtime dies before the support period you promise ends",
+  "why": "CRA Article 13(8) makes the manufacturer support the product for the declared period, at least 5 years, so the runtime has to outlive the promise."
+ },
+ {
+  "id": "support_period_undeclared",
+  "sev": "warn",
+  "title": "No support period declared in the project file",
+  "why": "CRA Article 13(8) requires a determined support period; if it is nowhere in the repo, the gate has to assume the 5-year floor."
+ },
+ {
+  "id": "framework_retired",
+  "sev": "error",
+  "title": ".NET Framework 4.6.1 or older",
+  "why": ".NET Framework 4.5.2, 4.6 and 4.6.1 all left support on 2022-04-26 and never come back."
+ },
+ {
+  "id": "xamarin_retired",
+  "sev": "error",
+  "title": "Xamarin target or package reference",
+  "why": "Xamarin support ended on 2024-05-01; the .NET MAUI move is the only supported path."
+ },
+ {
+  "id": "sdk_pin_out_of_support",
+  "sev": "error",
+  "title": "global.json pins an SDK band that is out of support",
+  "why": "A pinned dead SDK silently overrides an up-to-date machine and rebuilds the dead runtime on every CI run."
+ },
+ {
+  "id": "preview_runtime",
+  "sev": "error",
+  "title": "Preview or release-candidate runtime in a shipping project",
+  "why": "Preview builds carry no support period at all, so they cannot back any declared support promise."
+ },
+ {
+  "id": "runtime_bound_package",
+  "sev": "error",
+  "title": "Package pinned to a runtime version that is out of support",
+  "why": "ASP.NET Core, EF Core and Microsoft.Extensions.* follow the .NET release lifecycle exactly, so a 6.x or 9.x pin is already unpatched."
+ },
+ {
+  "id": "nuget_audit_off",
+  "sev": "error",
+  "title": "NuGet vulnerability audit disabled or not covering transitive packages",
+  "why": "CRA Annex I Part II asks manufacturers to handle vulnerabilities in the components they ship, including the ones they did not pick directly."
+ }
+]

package/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": ".NET EOL & CRA Support Window Gate",
+ "subtitle": "Dates every target framework in a .csproj against Microsoft's end-of-support day and against the support period you promise",
+ "bin": "dotnet-eol-support-gate",
+ "price": 29,
+ "free": "Dates one .csproj, Directory.Build.props or global.json you have open: every target framework, SDK pin and runtime-bound package gets its real end-of-support date, the days left, and the months it falls short of the support period you promise. 10 checks, no key.",
+ "paid": "Runs the same dating over every project file in the workspace in one pass and writes the dated support-window evidence file you keep and hand to an auditor.",
+ "need_key": "This option needs a licence (.NET EOL & CRA Support Window Gate).",
+ "exts": []
+}