@readystack/email-footer-law-lint 1.0.0

package/LICENSE.txt

@@ -0,0 +1,16 @@
+Email Footer Law Lint (CAN-SPAM · CASL · DDG) — Licence
+
+Free scope
+  Check the email template open in your editor against all 14 footer-law rules, each finding carrying the statute and the fix is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Sweep every template in the workspace and write one dated, citable audit report file you can hand to a client or to counsel is the paid part. It asks for a licence key issued at purchase (one seat, one key;
+  7-day full refund, no questions). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

package/README.md

@@ -0,0 +1,35 @@
+# Email Footer Law Lint
+
+![Email Footer Law Lint](https://getreadystack.com/img/promo/sku40591_result_card.jpg)
+
+Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14.
+
+## Install
+
+```
+npx @readystack/email-footer-law-lint file
+```
+
+Node 18+. The same 14 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Check the email template open in your editor against all 14 footer-law rules, every finding carrying its line, its statute and its fix
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Sweep every template in the workspace and write one dated, citable audit report file you can hand to a client or to counsel
+
+```
+@readystack/email-footer-law-lint --dir ./templates --report html --out report.html
+```
+
+Outside counsel reads one email footer against CAN-SPAM, CASL and 5 DDG at about $300 an hour, and reads it once.
+
+7-day refund, no questions. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_UpcPQkomm2d1N52PaYHHfPjdB89okIRPLaTa70CzAj0)
+
+
+<!-- email footer law lint -->

package/cli.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (e.name === 'node_modules' || e.name === '.git' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once, 7-day refund): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) { process.stderr.write(S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ', once): ' + lic.BUY_URL + '\n'); process.exit(2); }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

package/engine.js

@@ -0,0 +1,164 @@
+// Email Footer Law Lint — the whole brain. Same file runs in Node (VS Code) and in the browser.
+'use strict';
+var RULES = (typeof module !== 'undefined' && module.exports) ? require('./rules.json') : window.EFL_RULES;
+
+var UNSUB = /(unsubscrib|un-?subscribe|opt[\s-]?out|opting[\s-]?out|abmelde|abbestell|austragen|désabonn)/i;
+var DE_MARK = /(GmbH|UG \(haftungsbeschr|Abmelden|Datenschutz|Impressum|Anbieter|Geschäftsführer|Handelsregister|Umsatzsteuer|USt-IdNr|Newsletter abbestellen)/g;
+var IMPRESSUM = /(impressum|anbieterkennzeichnung|legal-?notice)/i;
+var REGISTER = /(handelsregister|\bHRB\b|\bHRA\b|USt-?IdNr|VAT ID|Umsatzsteuer-Identifikationsnummer)/i;
+var ENTITY = /\b(Inc\.?|LLC|L\.L\.C\.|Ltd\.?|Limited|Corp\.?|Corporation|GmbH|AG|KGaA|KG|UG|e\.K\.|B\.V\.|N\.V\.|S\.A\.|S\.A\.S|SARL|S\.r\.l\.|Oy|AB|A\/S|ApS|Pty|PLC|plc)\b/;
+var CONSENT = /(because you (signed up|subscribed|opted|asked|created)|you (signed up|subscribed|opted in)|opted[- ]in|consent|einwillig|you are receiving this)/i;
+
+function blankOut(s, re) { return s.replace(re, function (m) { return m.replace(/[^\n]/g, ' '); }); }
+function lineAt(text, i) { var n = 1, k; for (k = 0; k < i && k < text.length; k++) { if (text.charCodeAt(k) === 10) n++; } return n; }
+
+// tags out, character positions kept so every finding can name a real line
+function stripTags(s) {
+  var out = '', map = [], inTag = false, k, c;
+  for (k = 0; k < s.length; k++) {
+    c = s.charAt(k);
+    if (c === '<') { inTag = true; continue; }
+    if (c === '>') { if (inTag) { inTag = false; out += ' '; map.push(k); continue; } }
+    if (!inTag) { out += c; map.push(k); }
+  }
+  return { text: out, map: map };
+}
+
+function anchors(masked, raw) {
+  var list = [], re = /<a\b([^>]*)>([\s\S]*?)<\/a>/gi, m, h;
+  while ((m = re.exec(masked))) {
+    h = /href\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i.exec(m[1] || '');
+    list.push({
+      href: h ? (h[1] || h[2] || h[3] || '') : '',
+      text: (m[2] || '').replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim(),
+      line: lineAt(raw, m.index),
+      i: m.index
+    });
+  }
+  return list;
+}
+
+function check(text, opts) {
+  text = String(text == null ? '' : text);
+  opts = opts || {};
+  var today = /^\d{4}-\d{2}-\d{2}$/.test(String(opts.today || '')) ? String(opts.today) : new Date().toISOString().slice(0, 10);
+  var thisYear = parseInt(today.slice(0, 4), 10);
+
+  var masked = blankOut(blankOut(text, /<!--[\s\S]*?-->/g), /<style\b[\s\S]*?<\/style\s*>/gi);
+  var P = stripTags(masked);
+  var plain = P.text;
+  var flat = plain.replace(/\s+/g, ' ');
+  var findings = [];
+  var seen = {};
+
+  function add(id, line, detail) {
+    if (seen[id]) { return; }
+    seen[id] = 1;
+    var r = null, k;
+    for (k = 0; k < RULES.length; k++) { if (RULES[k].id === id) { r = RULES[k]; break; } }
+    if (!r) { return; }
+    findings.push({
+      check: id,
+      sev: r.sev,
+      line: Math.max(1, line || 1),
+      msg: (detail ? detail + ' ' : '') + r.msg + ' ' + r.fix + ' [' + r.cite + ']'
+    });
+  }
+  function lineOfPlain(pi) { return lineAt(text, P.map[Math.min(pi, P.map.length - 1)] || 0); }
+  function bodyLine() {
+    var m = /<\/body\s*>/i.exec(text);
+    return m ? lineAt(text, m.index) : Math.max(1, text.split(/\r?\n/).length);
+  }
+
+  var A = anchors(masked, text);
+  var unsubs = A.filter(function (a) { return UNSUB.test(a.text) || UNSUB.test(a.href); });
+
+  // 1 · is there an opt-out at all
+  if (!unsubs.length) { add('unsub_missing', bodyLine()); }
+
+  unsubs.forEach(function (a) {
+    var h = a.href.trim();
+    // 2 · does it go anywhere
+    if (!h || h === '#' || /^javascript:/i.test(h) || /^about:blank$/i.test(h)) { add('unsub_dead_href', a.line, 'href="' + h + '".'); }
+    // 3 · does it demand an account
+    if (/(\/|[?&=])(log-?in|sign-?in|sign-?on|account|my-?account|dashboard)\b/i.test(h)) { add('unsub_behind_login', a.line, h.slice(0, 70) + ' .'); }
+  });
+
+  // 4..6 · what the footer promises, read near the opt-out words
+  var ure = new RegExp(UNSUB.source, 'gi'), um;
+  while ((um = ure.exec(flat))) {
+    var win = flat.slice(Math.max(0, um.index - 90), um.index + 220);
+    var pi = flat.indexOf(win.slice(0, 24));
+    var ln = lineOfPlain(pi < 0 ? 0 : pi);
+    var gate = /(account number|customer number|member(ship)? number|order number|credit card|processing fee|a fee of|\$\d+(\.\d+)?\s*(fee|charge)|postal code and)/i.exec(win);
+    if (gate) { add('unsub_fee_or_data', ln, '"' + gate[0] + '".'); }
+    var slow = /(please allow|may take|allow up to|takes? up to|within|processing time of|removal in)[^.]{0,40}?(\d{1,3})\s*(business days|working days|days|weeks|months)/i.exec(win);
+    if (slow) {
+      var n = parseInt(slow[2], 10), unit = slow[3].toLowerCase(), over = false;
+      if (/business|working/.test(unit)) { over = n > 10; }
+      else if (unit === 'days') { over = n > 14; }
+      else if (unit === 'weeks') { over = n > 2; }
+      else { over = n >= 1; }
+      if (over) { add('unsub_deadline_too_long', ln, '"' + slow[0].trim() + '".'); }
+    }
+    var win2 = /(valid|active|work|works|available|good|expires?|live)[^.]{0,40}?(\d{1,3})\s*(days|months)/i.exec(win);
+    if (win2) {
+      var d = parseInt(win2[2], 10) * (/month/i.test(win2[3]) ? 30 : 1);
+      if (d < 60) { add('unsub_window_under_60d', ln, '"' + win2[0].trim() + '" = ' + d + ' days.'); }
+    }
+  }
+
+  // 7 · conspicuous, or buried
+  var sre = /(font-size\s*:\s*(\d+(?:\.\d+)?)\s*px|display\s*:\s*none|visibility\s*:\s*hidden)/gi, sm;
+  while ((sm = sre.exec(text))) {
+    var near = text.slice(Math.max(0, sm.index - 260), sm.index + 420);
+    if (!UNSUB.test(near)) { continue; }
+    if (sm[2] === undefined) { add('unsub_too_small', lineAt(text, sm.index), 'The opt-out block carries ' + sm[1].replace(/\s+/g, '') + '.'); }
+    else if (parseFloat(sm[2]) < 10) { add('unsub_too_small', lineAt(text, sm.index), 'The opt-out is set at ' + sm[2] + 'px.'); }
+  }
+
+  // 8..9 · the postal address
+  var STREET = /(\b\d{1,6}\s+[A-Z][\w.'-]*(?:\s+[\w.'-]+){0,4}\s+(St|Street|Ave|Avenue|Rd|Road|Blvd|Boulevard|Dr|Drive|Ln|Lane|Way|Pkwy|Parkway|Ct|Court|Plaza|Sq|Square|Terrace|Circle)\b|\bP\.?\s?O\.?\s*Box\s*\d+|[A-ZÄÖÜ][\wäöüß.-]*(?:straße|strasse|str\.|weg|allee|platz|gasse|ring|damm|ufer)\s+\d+|\b\d{1,4}\s+(rue|avenue|boulevard)\s+[A-Z])/i;
+  var PLACEHOLDER = /(\[[^\]]*(address|street|company|city)[^\]]*\]|123 Main (St|Street)|1234 Street|Your Company (Name|Address)|123 Anywhere|Musterstraße|Musterstrasse|Lorem ipsum|ADDRESS_LINE|YOUR[_ ]ADDRESS|Street Address Here)/i;
+  var ph = PLACEHOLDER.exec(flat);
+  if (ph) { add('postal_address_placeholder', lineOfPlain(flat.indexOf(ph[0])), '"' + ph[0] + '".'); }
+  if (!STREET.test(flat)) { add('postal_address_missing', bodyLine()); }
+
+  // 10 · the German provider line
+  var tmg = /(§\s*5\s*(Abs\.?\s*\d\s*)?TMG|\bTMG\b|Telemediengesetz)/.exec(text);
+  if (tmg) { add('tmg_5_outdated', lineAt(text, tmg.index), '"' + tmg[0] + '" as of ' + today + '.'); }
+
+  // 11 · German-facing, but the imprint is not reachable
+  var marks = flat.match(DE_MARK) || [];
+  var distinct = {}, dn = 0;
+  marks.forEach(function (x) { var key = x.toLowerCase(); if (!distinct[key]) { distinct[key] = 1; dn++; } });
+  var hasImpressumLink = A.some(function (a) { return IMPRESSUM.test(a.text) || IMPRESSUM.test(a.href); });
+  if (dn >= 2 && !hasImpressumLink && !REGISTER.test(flat)) { add('de_imprint_incomplete', bodyLine(), dn + ' German provider markers, no Impressum link, no register or VAT number.'); }
+
+  // 12 · who is actually sending this
+  if (!ENTITY.test(flat) && !/(©|&copy;|Copyright)\s*\d{0,4}\s*[A-Z]/.test(flat)) { add('sender_identity_missing', bodyLine()); }
+
+  // 13 · the open-tracking pixel
+  var ire = /<img\b[^>]*>/gi, im2, pixel = null;
+  while ((im2 = ire.exec(masked))) {
+    var tag = im2[0];
+    var w = /\bwidth\s*=\s*["']?(\d+)/i.exec(tag), hh = /\bheight\s*=\s*["']?(\d+)/i.exec(tag);
+    var styled = /width\s*:\s*1px/i.test(tag) && /height\s*:\s*1px/i.test(tag);
+    if ((w && hh && +w[1] <= 1 && +hh[1] <= 1) || styled) { pixel = im2; break; }
+  }
+  if (pixel && !CONSENT.test(flat)) { add('tracking_pixel_unconsented', lineAt(text, pixel.index)); }
+
+  // 14 · the year in the footer, read against today
+  var yre = /(©|&copy;|Copyright)[^0-9]{0,20}(\d{4})(\s*[-–]\s*(\d{4}))?/gi, ym, newest = 0, yline = 1;
+  while ((ym = yre.exec(text))) {
+    var y = parseInt(ym[4] || ym[2], 10);
+    if (y > newest) { newest = y; yline = lineAt(text, ym.index); }
+  }
+  if (newest && newest < thisYear) { add('copyright_year_stale', yline, 'Footer says ' + newest + '; today is ' + today + '.'); }
+
+  findings.sort(function (a, b) { return a.line - b.line; });
+  return { findings: findings };
+}
+
+var EFLENGINE = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length };
+if (typeof module !== 'undefined' && module.exports) { module.exports = EFLENGINE; } else { window.EFLENGINE = EFLENGINE; }

package/license.js

@@ -0,0 +1,64 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = '14f46867-b9b1-488f-9e0f-9315a28c4b58';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_UpcPQkomm2d1N52PaYHHfPjdB89okIRPLaTa70CzAj0';
+const SLUG = 'email-footer-law-lint';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+function validate(key) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(BENEFIT_ID) ? { key: key, organization_id: ORG_ID, benefit_id: BENEFIT_ID } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) return { ok: false, why: 'no_key' };
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@readystack/email-footer-law-lint",
+  "version": "1.0.0",
+  "description": "Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14.",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "email",
+    "can-spam",
+    "casl",
+    "ddg",
+    "impressum",
+    "unsubscribe",
+    "html email",
+    "compliance",
+    "deliverability"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_UpcPQkomm2d1N52PaYHHfPjdB89okIRPLaTa70CzAj0",
+  "bin": {
+    "email-footer-law-lint": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

package/rules.json

@@ -0,0 +1,100 @@
+[
+ {
+  "id": "unsub_missing",
+  "sev": "error",
+  "msg": "No unsubscribe link anywhere in this template.",
+  "fix": "Add a working one-click opt-out link in the footer.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(3); CASL s.11(1)"
+ },
+ {
+  "id": "unsub_dead_href",
+  "sev": "error",
+  "msg": "The opt-out link points nowhere.",
+  "fix": "Point it at a real opt-out endpoint or an ESP merge tag, not # or an empty href.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(3)(A)"
+ },
+ {
+  "id": "unsub_behind_login",
+  "sev": "error",
+  "msg": "The opt-out link lands on a sign-in page.",
+  "fix": "Opt-out must work from one page with no account; drop the login redirect.",
+  "cite": "CAN-SPAM 16 CFR 316.5"
+ },
+ {
+  "id": "unsub_fee_or_data",
+  "sev": "error",
+  "msg": "Opting out is gated behind a fee or extra personal data.",
+  "fix": "Ask for nothing but the click; the address is already in the link.",
+  "cite": "CAN-SPAM 16 CFR 316.5"
+ },
+ {
+  "id": "unsub_deadline_too_long",
+  "sev": "error",
+  "msg": "The footer promises a removal window longer than the law allows.",
+  "fix": "Honour opt-outs within 10 business days and say so.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(4)(A)(ii)"
+ },
+ {
+  "id": "unsub_window_under_60d",
+  "sev": "error",
+  "msg": "The opt-out link is declared valid for less than 60 days.",
+  "fix": "Keep the unsubscribe mechanism live for at least 60 days after sending.",
+  "cite": "CASL S.C. 2010 c.23 s.11(1)(b)"
+ },
+ {
+  "id": "unsub_too_small",
+  "sev": "warn",
+  "msg": "The opt-out is styled too small or hidden to be conspicuous.",
+  "fix": "Render the opt-out at 10px or larger and keep it visible.",
+  "cite": "CAN-SPAM 16 CFR 316.5; CASL s.11(1)"
+ },
+ {
+  "id": "postal_address_missing",
+  "sev": "error",
+  "msg": "No physical postal address in the template.",
+  "fix": "Add the sender's street address or registered PO Box to the footer.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(5)(A)(iii)"
+ },
+ {
+  "id": "postal_address_placeholder",
+  "sev": "error",
+  "msg": "The postal address is still sample or placeholder text.",
+  "fix": "Replace it with the real registered address before this template ships.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(5)(A)(iii)"
+ },
+ {
+  "id": "tmg_5_outdated",
+  "sev": "error",
+  "msg": "The provider line still cites the TMG, which was repealed on 2024-05-14.",
+  "fix": "Cite 5 DDG (Digitale-Dienste-Gesetz) instead of 5 TMG.",
+  "cite": "DDG 5; TMG repealed by DDG, in force 2024-05-14"
+ },
+ {
+  "id": "de_imprint_incomplete",
+  "sev": "error",
+  "msg": "German-facing footer with no Impressum link and no register or VAT identifier.",
+  "fix": "Link the Impressum, or name the register court, HRB number and USt-IdNr.",
+  "cite": "DDG 5 Abs. 1 Nr. 4 and Nr. 6"
+ },
+ {
+  "id": "sender_identity_missing",
+  "sev": "error",
+  "msg": "The footer never names the legal entity sending the mail.",
+  "fix": "Name the sending company as registered, not just the brand.",
+  "cite": "CAN-SPAM 15 U.S.C. 7704(a)(5); CASL s.6(2)(a); DDG 5 Abs. 1 Nr. 1"
+ },
+ {
+  "id": "tracking_pixel_unconsented",
+  "sev": "warn",
+  "msg": "A 1x1 open-tracking pixel ships with no line telling the reader why they got this mail.",
+  "fix": "State the consent basis in the footer, or drop the pixel for EU recipients.",
+  "cite": "ePrivacy Directive Art. 5(3); EDPB Guidelines 2/2023, adopted 2024-10-14"
+ },
+ {
+  "id": "copyright_year_stale",
+  "sev": "warn",
+  "msg": "The copyright year in the footer is older than today.",
+  "fix": "Roll the year, or render it from the send date.",
+  "cite": "House style; a stale year is the cheapest tell that a footer is unmaintained"
+ }
+]

package/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "Email Footer Law Lint",
+ "subtitle": "Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14.",
+ "bin": "email-footer-law-lint",
+ "price": 29,
+ "free": "Check the email template open in your editor against all 14 footer-law rules, every finding carrying its line, its statute and its fix",
+ "paid": "Sweep every template in the workspace and write one dated, citable audit report file you can hand to a client or to counsel",
+ "need_key": "This option needs a licence (Email Footer Law Lint).",
+ "exts": []
+}