v1.3.1 — Pro language walk-back + repo polish

Patch release. Softens the Pro tier language introduced in v1.3.0 and formally releases accumulated repo polish (CODE_OF_CONDUCT, dependabot, issue/PR templates, bump-badge workflow, landing page).

Changed

• Pro tier language softened to "in development". v1.3.0 positioned @jordannewell/curtis-compliance-pro as installable today and linked to curtiscompliance.com/pro — a domain this project doesn't own (same dead-link class as the curtis.ai cleanup in v1.3.0). README + landing page + printProAbsent() runtime message now describe Pro as in development and link to the public stub repo at JordanNewell/curtis-compliance-pro. No behavior change — the license subcommand still detects Pro and defers to it when present.

Added

• CODE_OF_CONDUCT.md (Contributor Covenant v2.1).
• .github/dependabot.yml — weekly dependency + actions updates.
• Issue templates (bug report / feature request / config question) + PR template.
• .github/ISSUE_TEMPLATE/config.yml — disables blank issues, points security reports at SECURITY.md.
• bump-badge workflow — auto-bumps the static release badge in README on tag push. SHA-pinned actions + concurrency group + scoped regex.
• Landing page at docs/index.html + GitHub Pages deploy workflow.
• Favicon set (16/32/512/apple-touch-icon) replacing inline SVG.

Fixed

• Static release badge replaces dynamic shields.io github/v/release URL — the endpoint intermittently 503s on their shared token pool (recurring across JordanNewell repos). Static badge is reliable; bump-badge workflow above automates the per-release bump.
• .gitignore now covers .zcode/ + .claude/ (AI agent state, never committed). .gitattributes normalizes line endings (* text=auto) — silences LF→CRLF warnings on Windows checkouts.

---

npm: npm install @jordannewell/curtis-compliance@1.3.1

Verify: curtis-compliance --version should report 1.3.1.

Full changelog: CHANGELOG.md

v1.2.1 — README positioning rewrite

Patch release. Sharpens README positioning against the actual comparison set (secret scanners + compliance automation platforms, not code-style linters) and re-renders the hero/terminal/social-preview assets.

Changed

• README repositioned vs the real comparison set. Previous framing invited a category error — comparing regulatory compliance to ESLint / Biome / Nx Conformance (code-style linters, different problem). New "How it differs" section explicitly contrasts with the actual neighbors:
  • Gitleaks / TruffleHog / GitGuardian — secret scanners. Curtis uses similar detection (21 patterns across 12 providers) but wraps every finding in a compliance workflow — each is a cited audit failure, not just a regex hit.
  • Vanta / Drata / Secureframe — compliance automation platforms. Those manage org-wide posture and collect evidence for auditors. Curtis sits inside the developer loop, preventing violations at commit time before they ship — the thing that makes the controls those platforms attest to actually true in the code.
• Quick Start replaced with a 60-second copy-paste walkthrough. Scratch repo + deliberately-bad commit → see the block + citation in your own terminal. Answers the five questions a public-package README should answer immediately (what problem / why better / install under 60s / complete example / what does output look like).
• "Intentionally no paid tier / no SaaS" → "currently no paid tier." Leaves the door open for a future open-core without overpromising today. (The open-core pivot shipped in v1.3.0; the Pro tier claims were walked back in v1.3.1.)
• "What's not in this project" → "Common misconceptions." Less defensive framing, same content.

Fixed

• Hero / terminal / social-preview re-rendered via Playwright. Chrome's --headless --screenshot was silently clipping fixed-dimension HTML and leaving a scrollbar gutter — switched to Playwright, which respects viewport + deviceScaleFactor exactly. Replaces previously-broken renders that had been live for weeks without anyone noticing.

Housekeeping

• License attribution standardized to [MIT](LICENSE) © Jordan Newell across all source files.

---

npm: npm install @jordannewell/curtis-compliance@1.2.1 (superceded — latest is v1.3.1)

Full changelog: CHANGELOG.md

v1.2.0 — drops Node 18, adds repo polish

Minor release. Drops EOL Node 18, formally releases the accumulated repo polish.

⚠️ Breaking

• engines.node bumped to >=20.0.0. Node 18 reached end-of-life April 30, 2025 — the previous >=18.0.0 declaration was claiming support for an unsupported runtime. If you're still on Node 18, pin to @jordannewell/curtis-compliance@1.1.2.

Added

• files allowlist in package.json — explicit list of what ships in the tarball (cleaner than relying on .npmignore denylist alone).
• README hero banner, terminal screenshot, social preview image.
• CI badge in the README badge row.
• CI matrix updated to Node 20 / 22 / 24.

Changed

• Tarball no longer ships source maps (files allowlist narrows dist to *.js/*.d.ts/*.json). Tarball size 35.6 KB → 25.8 KB.
• SECURITY.md supported-versions table updated: 1.2.x ✓, < 1.2 ✗.
• coverage/ added to .gitignore.

Already on master since v1.1.2, now formally released

• SECURITY.md — vulnerability-reporting policy
• CONTRIBUTING.md — not accepting external PRs yet
• .github/FUNDING.yml — Sponsor button
• .github/workflows/ci.yml — test workflow
• Branch protection on master (no force-push, no deletions, linear history)

---

npm: npm install @jordannewell/curtis-compliance@1.2.0

v1.1.2 — Node 18 audit-trail fix

Patch release. Fixes a crash on Node 18 and ships accumulated repo-hygiene work.

Fixed

• audit-trail no longer crashes on Node 18. buildEvent referenced global crypto.randomUUID(), which only exists as a bare global on Node 19+. On Node 18 (which engines declares as supported), every audit-emitting code path threw ReferenceError: crypto is not defined. Now imports randomUUID from node:crypto directly.

Changed

• README: new Disclaimer section — explicit "not legal advice / not a substitute for a formal audit" framing.

Added

• SECURITY.md — vulnerability-reporting policy
• CONTRIBUTING.md — not accepting external PRs yet; bug / security / framework requests via Issues welcome
• GitHub Actions CI — test suite runs against Node 18 / 20 / 22 on every push and PR. (This is how the Node 18 bug above was caught.)
• FUNDING.yml — Sponsor button in the GitHub UI
• Branch protection on master (no force-push, no deletions, required linear history)

---

npm: npm install @jordannewell/curtis-compliance@1.1.2

v1.1.1

Fixed

• Removed phantom gdpr framework — it was declared in the enum but had no rule mappings, so --framework gdpr produced a falsely "compliant" empty report.

Internal

• Test count: 44 → 43 (removed the test that was documenting the bug)
• Package metadata: author email, repository URL normalized

---

Known issue in 1.1.1: audit-trail crashes on Node 18 with ReferenceError: crypto is not defined. Fixed in 1.1.2.

v1.1.0 — initial public release

First public release.

Open-source compliance checks for fintech code — pre-commit gate, PR review, hash-chained audit trail. Scans for HIPAA / SOC2 / PCI-DSS violations and emits cited findings.

Install

npm install @jordannewell/curtis-compliance

Or one-shot:

npx @jordannewell/curtis-compliance

What's included

• TypeScript CLI
• HIPAA, SOC2, PCI-DSS rule packs
• Hash-chained audit trail
• Pre-commit hook integration
• 44 unit tests