@nugehs/bouncer 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to `@nugehs/bouncer` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.1] - 2026-06-09
+### Added
+
+- Brand alignment: toolchain footer/badges.
+- README: badge row (npm version, CI, license, node, zero dependencies).
+- README: "bouncer vs semgrep / policy-as-code" positioning section.
+- README: prominent note that the shipped adapters today are `next` and
+  `react-native`, with an invitation for adapter PRs (nuxt, sveltekit, remix,
+  flutter, django).
+- README: Tests section documenting the Node built-in test suite and CI matrix.
+- Tag-triggered release workflow (`.github/workflows/release.yml`): runs tests,
+  creates a GitHub Release with notes extracted from this changelog, publishes
+  to npm.
+
+### Changed
+
+- Replaced a personal example target path with a generic `./my-app` in the
+  README and the repo-root `bouncer.config.json`.
+- README link to tieline now points at its npm package page.
+
 ## [0.1.0] - 2026-06-07
 
 Initial release.

package/README.md

@@ -1,6 +1,14 @@
 # bouncer
 
-**Static compliance-controls checker.** bouncer verifies that the controls a
+**Static compliance-controls checker — the controls a regulation requires, verified in your code.**
+
+[![npm](https://img.shields.io/npm/v/@nugehs/bouncer?style=flat-square)](https://www.npmjs.com/package/@nugehs/bouncer) [![CI](https://img.shields.io/github/actions/workflow/status/nugehs/bouncer/ci.yml?style=flat-square&label=CI)](https://github.com/nugehs/bouncer/actions/workflows/ci.yml) [![license: MIT](https://img.shields.io/badge/license-MIT-blue?style=flat-square)](LICENSE) [![node](https://img.shields.io/badge/node-%3E%3D18-blue?style=flat-square)](#) [![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen?style=flat-square)](#)
+
+**[nugehs.github.io/bouncer-web](https://nugehs.github.io/bouncer-web/)** (site)
+
+![bouncer demo](bouncer-demo.gif)
+
+bouncer verifies that the controls a
 regulation *requires* actually exist in your code — UK Online Safety Act, ICO
 Children's Code (AADC) — expressed as deterministic **rule packs**. It runs in CI,
 exits non-zero when a required control is missing, and needs **no LLM**.
@@ -19,8 +27,23 @@ Regulators now expect *demonstrable* controls: age assurance, high-privacy
 defaults for children, report/block affordances on user-generated content, a DPIA,
 a risk assessment. Those are concrete things that either exist in a codebase or
 don't. bouncer turns a regulation into a set of static checks over your repo, the
-same way [tieline](https://github.com/nugehs/tieline) turns an API contract into
-drift checks — the engine knows nothing about the law; the **rule packs** do.
+same way [tieline](https://www.npmjs.com/package/@nugehs/tieline) turns an API
+contract into drift checks — the engine knows nothing about the law; the
+**rule packs** do.
+
+### bouncer vs semgrep / policy-as-code
+
+Scanners like semgrep, CodeQL, or Snyk answer *"is there bad code here?"* — they
+hunt for vulnerabilities and dangerous patterns that **shouldn't exist**. bouncer
+answers the opposite question: *"does the code the regulation requires actually
+exist?"* — age assurance on sign-up, report/block on UGC surfaces, high-privacy
+defaults for children. A repo can be vulnerability-free and still fail every one
+of those obligations. Policy-as-code tools (OPA/Rego, Conftest) gate *configs and
+infrastructure* against policy; bouncer gates *application source* against
+regulatory rule packs, with `file:line` evidence for every control and an honest
+`unknown` when a surface can't be located. In short: **semgrep finds
+vulnerabilities; bouncer proves required controls exist.** They complement each
+other — run both.
 
 ## Install
 
@@ -65,8 +88,8 @@ not find. Missing surface → honest "can't determine".
 {
   "target": {
     "adapter": "next",
-    "repo": "../bashbop-event-web",
-    "roots": ["app", "src", "components", "redux"]
+    "repo": "./my-app",
+    "roots": ["app", "src", "components"]
   },
   "packs": ["uk-osa", "uk-aadc"],
   "packDirs": [],
@@ -76,7 +99,13 @@ not find. Missing surface → honest "can't determine".
 ```
 
 - `adapter` — how regulation *surfaces* (sign-up, profile, chat, livestream…) map
-  onto files for your stack. Ships with `next` (App Router).
+  onto files for your stack.
+
+> **Adapters shipped today: `next` (App Router) and `react-native`.** That's it —
+> if your stack isn't covered, an adapter is a single small file mapping surface
+> aliases to file globs (see `src/lib/adapters/next.js`). **Adapter PRs are very
+> welcome** — `nuxt`, `sveltekit`, `remix`, `flutter`, `django` are all natural
+> candidates.
 - `packs` — which rule packs to run. Built-ins: `uk-osa`, `uk-aadc`.
 - `packDirs` — extra directories of your own `*.json` packs.
 - `ignore` — rule ids to skip.
@@ -142,6 +171,30 @@ results:
 Fails the build when a required control goes missing — e.g. someone removes an
 age-gate or a report button from a UGC surface.
 
+## Tests
+
+```bash
+npm test    # node --test — zero dependencies, nothing to install
+```
+
+The suite runs on Node's built-in test runner against throwaway fixture repos:
+glob/brace expansion, every assertion probe (`find`, `allOf`/`anyOf`/`not`,
+`allInFile` + `within` windows, `expect: "absent"`), the pass/fail/`unknown`
+verdict semantics, and pack loading. CI runs it on Node 18, 20, and 22.
+
 ## License
 
 MIT
+
+---
+
+## Part of the toolchain
+
+**bouncer** is one of four tools that form a deterministic trust layer for AI-assisted development. Each answers a question people keep handing to an LLM — with static analysis instead.
+
+- [repoctx](https://www.npmjs.com/package/@nugehs/repoctx) — context: what does this change actually touch?
+- [tieline](https://www.npmjs.com/package/@nugehs/tieline) — contracts: did the front end and back end quietly stop agreeing?
+- **bouncer** (this tool) — compliance: could you defend this to Ofcom?
+- [aiglare](https://www.npmjs.com/package/@nugehs/aiglare) — governance: where can the model do something you can't undo?
+
+More at [segunolumbe.com](https://segunolumbe.com). *static analysis, never the model.*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nugehs/bouncer",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "mcpName": "io.github.nugehs/bouncer",
   "description": "bouncer — static compliance-controls checker. Verifies the controls a regulation requires actually exist in your code (UK Online Safety Act, ICO Children's Code), as deterministic rule packs. No LLM required.",
   "type": "module",