@readystack/payroll-deduction-code-audit 1.0.2

package/LICENSE.txt

@@ -0,0 +1,16 @@
+Payroll Deduction Code Audit 2026 — Licence
+
+Free scope
+  Every deduction code in the open map is audited against twelve rules and each broken line is named with its line number. is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Audits every deduction map in the workspace at once and writes a dated exposure report you keep as the payroll audit trail. is the paid part. It asks for a licence key issued at purchase (one seat, one key;
+  7-day full refund, no questions). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

package/README.md

@@ -0,0 +1,52 @@
+# Payroll Deduction Code Audit 2026
+
+Twelve rules over the deduction-code map, before the January 31 W-2 filing date
+
+## Install
+
+```
+npx @readystack/payroll-deduction-code-audit file
+```
+
+Node 18+. The same 12 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Every deduction code in the open map is audited against twelve rules and each broken line is named with its line number.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Audits every deduction map in the workspace at once and writes a dated exposure report you keep as the payroll audit trail.
+
+```
+@readystack/payroll-deduction-code-audit --dir ./templates --report html --out report.html
+```
+
+Hand-checking one deduction map against the IRS Box 12 letter list is about half a day of a payroll analyst's time, every plan year
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "payroll-deduction-code-audit": { "command": "npx", "args": ["-y", "@readystack/payroll-deduction-code-audit", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: Payroll Deduction Code Audit 2026
+  run: npx -y @readystack/payroll-deduction-code-audit --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/payroll-deduction-code-audit --dir /work --ci`)
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_nAgRlEvSuB50Wdx5AxIH3jJ7eqwgOTIAwUFRk26gtYC)
+
+
+<!-- payroll deduction code audit -->

package/README.md.bak_s158refund

@@ -0,0 +1,52 @@
+# Payroll Deduction Code Audit 2026
+
+Twelve rules over the deduction-code map, before the January 31 W-2 filing date
+
+## Install
+
+```
+npx @readystack/payroll-deduction-code-audit file
+```
+
+Node 18+. The same 12 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Every deduction code in the open map is audited against twelve rules and each broken line is named with its line number.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Audits every deduction map in the workspace at once and writes a dated exposure report you keep as the payroll audit trail.
+
+```
+@readystack/payroll-deduction-code-audit --dir ./templates --report html --out report.html
+```
+
+Hand-checking one deduction map against the IRS Box 12 letter list is about half a day of a payroll analyst's time, every plan year
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "payroll-deduction-code-audit": { "command": "npx", "args": ["-y", "@readystack/payroll-deduction-code-audit", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence; the full sweep is free for 7 days). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: Payroll Deduction Code Audit 2026
+  run: npx -y @readystack/payroll-deduction-code-audit --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/payroll-deduction-code-audit --dir /work --ci`)
+
+Try the full run free for 7 days — no key needed. Then one licence, 7-day refund, no questions. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_nAgRlEvSuB50Wdx5AxIH3jJ7eqwgOTIAwUFRk26gtYC)
+
+
+<!-- payroll deduction code audit -->

package/cli.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (['node_modules', '.git', '.hg', '.svn', '.venv', 'venv', '.tox', '.cache', '.next', '.nuxt', '.terraform', '__pycache__'].includes(e.name)) continue;   // s158 — .github · .gitlab-ci.yml · .env · .well-known 은 본다 (옛 줄은 점으로 시작하는 것을 전부 건너뛰어 워크플로 검사기가 .github/workflows 를 못 봤다)
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  // s158 — ⚑7일 무료 없음: 새 체험은 ⛔열지 않는다 · 이미 시작된 체험(trial.json)만 끝까지 지킨다 (읽기 전용)
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    const t = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return { active: !!(t && t.until) && new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t && t.until };
+  } catch (e) { return { active: false }; }
+}
+// ★s158 2026-09-23 — the free run SPEAKS about the rest of the folder (vsix: auto.js · crx: welcome tab).
+//   The answer for the named files is complete and free; the next step is shown with the user's OWN numbers:
+//   "this folder has N more matching files - M issues in K of them" + the one command that sweeps them.
+//   Never blocks, never starts a trial (s158: no free trial - the free answer on the named files is the "try it"), human seat only, 400 files / 1.5 s cap.
+function folderHint(done) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.READYSTACK_NO_HINT || !done.length) return;
+  const base = path.dirname(path.resolve(done[0]));
+  const seen = new Set(done.map((f) => path.resolve(f)));
+  const all = walk(base, S.exts || [], []).filter((f) => !seen.has(path.resolve(f)));
+  if (!all.length) return;
+  const t0 = Date.now(); let issues = 0, hitFiles = 0, scanned = 0;
+  for (const f of all.slice(0, 400)) { if (Date.now() - t0 > 1500) break; let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } scanned++; const h = scan(t, f); if (h.length) { issues += h.length; hitFiles++; } }
+  const rel = path.relative(process.cwd(), base) || '.';
+  const tail = trialState().active ? 'free during your trial' : '$' + S.price + ' once';
+  const more = all.length + ' more matching file' + (all.length > 1 ? 's' : '');
+  const found = issues ? ' - ' + (scanned < all.length ? 'at least ' : '') + issues + ' issue' + (issues > 1 ? 's' : '') + ' in ' + hitFiles + ' of them' : ' - no issues found in them';
+  process.stderr.write('\n' + (rel === '.' ? 'This folder' : rel) + ' has ' + more + found + '.\n' + (issues ? 'Sweep them all: ' + S.bin + ' --dir ' + (/\s/.test(rel) ? JSON.stringify(rel) : rel) + '   (' + tail + ')\n' : ''));
+}
+let _usePinged = false;
+function pingUse() {
+  try {
+    if (_usePinged) return; _usePinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;
+    if (!(process.stdout.isTTY || process.stdin.isTTY)) return;   // human seat only (s152)
+    const https = require('https');
+    const body = JSON.stringify({ t: 'use', slug: S.bin, src: 'cli', why: 'free' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + S.bin } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) {}
+}
+function mcpServe() {
+  process.env.READYSTACK_MCP = '1';   // s152 - 에이전트(Claude Code·Cursor)가 부른 세션은 사람 자리다 · 키 판 핑 src=mcp
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (s158: no free trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; $' + S.price + ' once)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s158 — ⚑7일 무료 없음 · 이미 시작된 체험만 지킨다
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once. Get a licence: ' + lic.BUY_URL + '\n');
+      else {
+        // s158 — the key is asked WITH the customer's own count (endowment · open loop): how many issues this folder holds.
+        let own = '';
+        if (dir) { try { const all = walk(dir, exts, []); let n = 0, k = 0, sc = 0; const t0 = Date.now();
+          for (const f of all.slice(0, 2000)) { if (Date.now() - t0 > 4000) break; let tx = ''; try { tx = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } sc++; const h = scan(tx, f); if (h.length) { n += h.length; k++; } }
+          if (n) own = dir + ': ' + (sc < all.length ? 'at least ' : '') + n + ' issue' + (n > 1 ? 's' : '') + ' in ' + k + ' of ' + all.length + ' files.\n'; } catch (e) {} }
+        process.stderr.write(own + S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ' once): ' + lic.BUY_URL + '\n'); process.exit(2);
+      }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  if (!paid) { try { folderHint(files); } catch (e) {} pingUse(); }   // s158 — a free run ends with the user's own folder count + one anonymous 'used' count (human seat only)
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

package/engine.js

@@ -0,0 +1,135 @@
+/* Payroll Deduction Code Audit — one brain, used by the VS Code extension and by the free web page. */
+(function (root) {
+  'use strict';
+
+  var RULES = (typeof module !== 'undefined' && module.exports)
+    ? require('./rules.json')
+    : (root.PDCA_RULES || []);
+
+  var RULE_BY_ID = {};
+  for (var r = 0; r < RULES.length; r++) { RULE_BY_ID[RULES[r].id] = RULES[r]; }
+
+  // IRS W-2 Box 12 code letters.
+  var BOX12 = ['A','B','C','D','E','F','G','H','J','K','L','M','N','P','Q','R','S','T','V','W','Y','Z',
+               'AA','BB','DD','EE','FF','GG','HH','II'];
+  var DEFERRAL_BOX12 = ['D','E','G','S','H','AA','BB','EE'];
+  var PLAN_BASIS = ['125','129','132','401K','403B','457B','408P','501C18D'];
+
+  var RE_ROTH = /roth/i;
+  var RE_GARNISH = /garnish|levy|child\s*support|childsup|chld|creditor\s*withhold/i;
+  var RE_DEFERRAL = /401\s*\(?k|401k|403\s*\(?b|403b|457\s*\(?b|457b|elective\s*deferral|deferral/i;
+  var RE_HSA = /\bhsa\b|health\s*savings/i;
+
+  function flat(s) { return String(s === undefined || s === null ? '' : s).replace(/\s+/g, ' ').trim(); }
+
+  function planYear(opts) {
+    var t = flat((opts || {}).today);
+    var m = t.match(/(\d{4})/);          // tolerate 2026-09-19, 2026/09/19, "2026-09-19x"
+    var y = m ? parseInt(m[1], 10) : NaN;
+    if (!y || y < 1990 || y > 2999) { y = new Date().getFullYear(); }
+    return y;
+  }
+
+  function splitRow(line) {
+    var out = [], cur = '', q = false;
+    for (var i = 0; i < line.length; i++) {
+      var c = line.charAt(i);
+      if (c === '"') { if (q && line.charAt(i + 1) === '"') { cur += '"'; i++; } else { q = !q; } }
+      else if (c === ',' && !q) { out.push(cur); cur = ''; }
+      else { cur += c; }
+    }
+    out.push(cur);
+    for (var j = 0; j < out.length; j++) { out[j] = flat(out[j]); }
+    return out;
+  }
+
+  function norm(h) { return h.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_|_$/g, ''); }
+
+  function check(text, opts) {
+    opts = opts || {};
+    var findings = [];
+    var year = planYear(opts);
+    var lines = String(text === undefined || text === null ? '' : text).split(/\r\n|\r|\n/);
+
+    function add(id, line, extra) {
+      var rule = RULE_BY_ID[id] || { id: id, sev: 'med', msg: id };
+      findings.push({ check: id, sev: rule.sev, msg: extra ? rule.msg + ' ' + extra : rule.msg, line: line });
+    }
+
+    // 1. locate the header row
+    var hIdx = -1, head = null;
+    for (var i = 0; i < lines.length; i++) {
+      if (!flat(lines[i])) { continue; }
+      var cells = splitRow(lines[i]).map(norm);
+      if (cells.indexOf('code') >= 0 || cells.indexOf('deduction_code') >= 0) { hIdx = i; head = cells; break; }
+      if (hIdx < 0 && i > 4) { break; }
+    }
+    if (hIdx < 0) { return { findings: findings, rows: 0, ruleCount: RULES.length, planYear: year }; }
+
+    function col(names) {
+      for (var n = 0; n < names.length; n++) { var k = head.indexOf(names[n]); if (k >= 0) { return k; } }
+      return -1;
+    }
+    var cCode = col(['code', 'deduction_code']);
+    var cDesc = col(['description', 'name', 'label']);
+    var cTax = col(['tax_treatment', 'tax', 'treatment', 'pre_tax']);
+    var cPlan = col(['plan_basis', 'plan', 'basis', 'plan_type']);
+    var cBox = col(['box12', 'w2_box12', 'box_12']);
+    var cEr = col(['employer_amount', 'employer', 'er_amount']);
+    var cEe = col(['employee_amount', 'employee', 'ee_amount']);
+    var cEff = col(['effective_date', 'effective', 'start_date']);
+    var cOrd = col(['order', 'priority', 'withholding_order', 'sequence']);
+
+    var seen = {}, rows = 0, sawGarnish = false;
+
+    for (var li = hIdx + 1; li < lines.length; li++) {
+      var raw = lines[li];
+      if (!flat(raw)) { continue; }
+      var f = splitRow(raw);
+      var get = function (k) { return k >= 0 && k < f.length ? f[k] : ''; };
+      var code = get(cCode);
+      if (!code) { continue; }
+      rows++;
+      var ln = li + 1;
+      var desc = get(cDesc);
+      var blob = code + ' ' + desc;
+      var tax = get(cTax).toLowerCase().replace(/[^a-z]/g, '');   // pre_tax -> pretax
+      var isPre = tax === 'pretax' || tax === 'pre' || tax === 'true' || tax === 'yes';
+      var plan = get(cPlan).toUpperCase().replace(/[^A-Z0-9]/g, '');
+      var box = get(cBox).toUpperCase().replace(/[^A-Z]/g, '');
+      var eff = get(cEff);
+      var garnish = RE_GARNISH.test(blob);
+      if (garnish) { sawGarnish = true; }
+
+      if (RE_ROTH.test(blob) && isPre) { add('roth_marked_pretax', ln, '(' + code + ')'); }
+      if (garnish && isPre) { add('garnishment_pretax', ln, '(' + code + ')'); }
+      if (!get(cTax)) { add('missing_tax_treatment', ln, '(' + code + ')'); }
+
+      var key = code.toUpperCase();
+      if (Object.prototype.hasOwnProperty.call(seen, key)) {
+        if (seen[key].tax !== tax) { add('duplicate_code_conflict', ln, '(' + code + ' first seen on line ' + seen[key].line + ')'); }
+      } else { seen[key] = { tax: tax, line: ln }; }
+
+      if (isPre && PLAN_BASIS.indexOf(plan) < 0) { add('pretax_without_plan_basis', ln, '(' + code + ')'); }
+      if (box && BOX12.indexOf(box) < 0) { add('bad_box12_letter', ln, '(' + code + ' carries ' + box + ')'); }
+      if (!box && RE_DEFERRAL.test(blob) && !RE_HSA.test(blob)) { add('deferral_without_box12', ln, '(' + code + ')'); }
+      if (RE_HSA.test(blob)) {
+        if (box !== 'W') { add('hsa_without_box12_w', ln, '(' + code + ')'); }
+        if (!get(cEr)) { add('hsa_no_employer_split', ln, '(' + code + ')'); }
+      }
+      var ym = eff.match(/(\d{4})/);
+      if (!eff) { add('missing_effective_date', ln, '(' + code + ')'); }
+      else if (ym && parseInt(ym[1], 10) < year) { add('stale_plan_year', ln, '(' + code + ' is dated ' + eff + ', plan year ' + year + ')'); }
+      void cEe; void DEFERRAL_BOX12;
+    }
+
+    if (sawGarnish && cOrd < 0) { add('no_withholding_order', hIdx + 1, '(header row has no order column)'); }
+
+    findings.sort(function (a, b) { return a.line - b.line; });
+    return { findings: findings, rows: rows, ruleCount: RULES.length, planYear: year };
+  }
+
+  var api = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length };
+  if (typeof module !== 'undefined' && module.exports) { module.exports = api; }
+  root.PDCAENGINE = api;
+})(typeof window !== 'undefined' ? window : globalThis);

package/license.js

@@ -0,0 +1,83 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = '78b648bf-3893-4fa5-927f-930a4c8854bc';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_nAgRlEvSuB50Wdx5AxIH3jJ7eqwgOTIAwUFRk26gtYC';
+const SLUG = 'payroll-deduction-code-audit';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+const ALL_BENEFIT_ID = '22692551-5203-4467-b1a3-e33cdba6589d';   // s149 2026-09-17 — 팀 키(전 린터 한 키 · Polar benefit) · 상품 benefit 다음에 한 번 더 묻는다
+function validate(key) {
+  return validate1(key, BENEFIT_ID).then(function (r) { return (r.ok || r.offline || !/^[0-9a-f-]{36}$/.test(ALL_BENEFIT_ID)) ? r : validate1(key, ALL_BENEFIT_ID); });
+}
+function validate1(key, ben) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(ben) ? { key: key, organization_id: ORG_ID, benefit_id: ben } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+// ★s151 2026-09-19 — 키 판(키가 없거나 거절된 순간)을 익명으로 센다 (슬러그·출처·이유만) · DO_NOT_TRACK=1 · READYSTACK_NO_TELEMETRY 면 안 보낸다 · 실패는 조용히 · 프로세스당 한 번.
+let _pinged = false;
+function pingPaywall(why) {
+  try {
+    if (_pinged) return; _pinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;   // s151: CI(깃허브 액션 등)와 우리 빌드는 손님이 아니다
+    if (!(process.stdout.isTTY || process.stdin.isTTY || process.env.READYSTACK_MCP === '1')) return;   // s152: 사람 자리(터미널·MCP 세션)에서만 센다 - 발행 1분 뒤 남의 실행기(JP · 우리 3대는 US)가 돌린 no_key 13건은 손님이 아니다
+    const body = JSON.stringify({ t: 'paywall', slug: SLUG, src: process.env.READYSTACK_MCP === '1' ? 'mcp' : 'cli', why: why || 'no_key' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + SLUG } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) { /* 세는 것이 실패해도 상품은 돈다 */ }
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) { pingPaywall('no_key'); return { ok: false, why: 'no_key' }; }   // s151
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  if (!r.offline) pingPaywall('invalid');   // s151
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@readystack/payroll-deduction-code-audit",
+  "version": "1.0.2",
+  "description": "Twelve rules over the deduction-code map, before the January 31 W-2 filing date",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "payroll",
+    "deduction code",
+    "W-2 Box 12",
+    "pre-tax",
+    "HRIS",
+    "csv lint",
+    "plan year"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_nAgRlEvSuB50Wdx5AxIH3jJ7eqwgOTIAwUFRk26gtYC",
+  "bin": {
+    "payroll-deduction-code-audit": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/payroll-deduction-code-audit",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "payroll-deduction-code-audit"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

package/rules.json

@@ -0,0 +1,62 @@
+[
+ {
+  "id": "roth_marked_pretax",
+  "sev": "high",
+  "msg": "Roth deferrals are always after-tax. This row is flagged pre_tax, so taxable wages come out low."
+ },
+ {
+  "id": "garnishment_pretax",
+  "sev": "high",
+  "msg": "Garnishments, child support and levies are withheld after tax. This row is flagged pre_tax."
+ },
+ {
+  "id": "missing_tax_treatment",
+  "sev": "high",
+  "msg": "tax_treatment is empty. Nothing in the map says whether this code reduces taxable wages."
+ },
+ {
+  "id": "duplicate_code_conflict",
+  "sev": "high",
+  "msg": "This deduction code already appears above with a different tax_treatment."
+ },
+ {
+  "id": "pretax_without_plan_basis",
+  "sev": "med",
+  "msg": "Pre-tax row names no plan_basis (125, 401k, 403b, 457b, 132), so nothing supports the exclusion."
+ },
+ {
+  "id": "bad_box12_letter",
+  "sev": "high",
+  "msg": "This box12 value is not an IRS W-2 Box 12 code letter."
+ },
+ {
+  "id": "deferral_without_box12",
+  "sev": "med",
+  "msg": "Elective-deferral code carries no W-2 Box 12 letter (D, E, G, S, AA, BB, EE)."
+ },
+ {
+  "id": "hsa_without_box12_w",
+  "sev": "high",
+  "msg": "HSA contributions report in W-2 Box 12 under code W. This row does not carry W."
+ },
+ {
+  "id": "hsa_no_employer_split",
+  "sev": "med",
+  "msg": "Box 12 code W is employer plus employee combined. This row has no employer_amount to add."
+ },
+ {
+  "id": "stale_plan_year",
+  "sev": "high",
+  "msg": "effective_date is older than the plan year being filed. Deduction limits reset every January 1."
+ },
+ {
+  "id": "missing_effective_date",
+  "sev": "med",
+  "msg": "effective_date is empty, so the row cannot be tied to a plan year."
+ },
+ {
+  "id": "no_withholding_order",
+  "sev": "med",
+  "msg": "A garnishment code is present but the map has no order column to rank it against other deductions."
+ }
+]

package/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "Payroll Deduction Code Audit 2026",
+ "subtitle": "Twelve rules over the deduction-code map, before the January 31 W-2 filing date",
+ "bin": "payroll-deduction-code-audit",
+ "price": 29,
+ "free": "Every deduction code in the open map is audited against twelve rules and each broken line is named with its line number.",
+ "paid": "Audits every deduction map in the workspace at once and writes a dated exposure report you keep as the payroll audit trail.",
+ "need_key": "This option needs a licence (Payroll Deduction Code Audit 2026).",
+ "exts": []
+}