Merge pull request #13 from marmar9615-cloud/release/v0.2.0-marmarlabs-scope

release: publish v0.2.0 under @marmarlabs scope

Author: marmar9615-cloud

CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to AgentBridge are documented here. The format is loosely
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] — 2026-04-27 — First public release
+
+### Added
+
+- All six publishable packages are now on npm under the `@marmarlabs`
+  scope:
+  - [`@marmarlabs/agentbridge-core`](https://www.npmjs.com/package/@marmarlabs/agentbridge-core)
+  - [`@marmarlabs/agentbridge-sdk`](https://www.npmjs.com/package/@marmarlabs/agentbridge-sdk)
+  - [`@marmarlabs/agentbridge-scanner`](https://www.npmjs.com/package/@marmarlabs/agentbridge-scanner)
+  - [`@marmarlabs/agentbridge-openapi`](https://www.npmjs.com/package/@marmarlabs/agentbridge-openapi)
+  - [`@marmarlabs/agentbridge-cli`](https://www.npmjs.com/package/@marmarlabs/agentbridge-cli)
+  - [`@marmarlabs/agentbridge-mcp-server`](https://www.npmjs.com/package/@marmarlabs/agentbridge-mcp-server)
+- [`docs/releases/v0.2.0.md`](docs/releases/v0.2.0.md) release notes.
+
+### Changed
+
+- Renamed publishable packages from `@marmar9615-cloud/agentbridge-*`
+  to `@marmarlabs/agentbridge-*`. Rationale: the `@marmar9615-cloud`
+  npm scope was never created on npm; `@marmarlabs` is the actual
+  owned scope of the publisher. See
+  [docs/npm-scope.md](docs/npm-scope.md).
+- README, docs, and per-package READMEs updated to use the
+  `@marmarlabs` scope and the now-published install commands.
+- The 0.2.0-beta GitHub prerelease is superseded by this release.
+
+### Compatibility
+
+- No code or behavior changes from 0.2.0-beta. The packages are the
+  same shape, the same APIs, the same safety invariants. Only the npm
+  scope changed.
+- All 86 tests pass on Node 20.x and 22.x.
+
 ## [0.2.0-beta] — 2026-04-26 — Phase 3A: Public Beta Release Hardening
 
 ### Changed (potentially breaking for any pre-existing imports)

CLAUDE.md

@@ -21,7 +21,7 @@ agentbridge/
 │   ├── sdk/        defineAgentAction, manifest builder, route handler wrapper
 │   ├── scanner/    0–100 readiness scoring, structured checks, Playwright probe
 │   ├── openapi/    OpenAPI 3.x → AgentBridge manifest converter
-│   └── cli/        @marmar9615-cloud/agentbridge-cli — scan, validate, init, generate, mcp-config
+│   └── cli/        @marmarlabs/agentbridge-cli — scan, validate, init, generate, mcp-config
 ├── apps/
 │   ├── demo-app/   Next.js fake order app (port 3000) — manifest + actions
 │   ├── studio/     Next.js dashboard (port 3001) — scan, exercise, audit
@@ -34,17 +34,17 @@ agentbridge/
 
 ## Package responsibilities
 
-Publishable packages are scoped `@marmar9615-cloud/agentbridge-*`; apps
+Publishable packages are scoped `@marmarlabs/agentbridge-*`; apps
 keep an unscoped name and stay private. The `@agentbridge` scope is
 unowned on npm and is intentionally not used.
 
 | Package | Owns |
 |---|---|
-| `@marmar9615-cloud/agentbridge-core` | The contract. All schemas, validation, audit log. |
-| `@marmar9615-cloud/agentbridge-sdk` | App author DX. Zod-first action definitions, route handler glue. |
-| `@marmar9615-cloud/agentbridge-scanner` | Audit/score any URL. Structured `checks[]` + grouped recommendations. |
-| `@marmar9615-cloud/agentbridge-openapi` | OpenAPI-to-manifest conversion logic. CLI uses it. |
-| `@marmar9615-cloud/agentbridge-cli` | `agentbridge` CLI. Wraps scanner/openapi/core. |
+| `@marmarlabs/agentbridge-core` | The contract. All schemas, validation, audit log. |
+| `@marmarlabs/agentbridge-sdk` | App author DX. Zod-first action definitions, route handler glue. |
+| `@marmarlabs/agentbridge-scanner` | Audit/score any URL. Structured `checks[]` + grouped recommendations. |
+| `@marmarlabs/agentbridge-openapi` | OpenAPI-to-manifest conversion logic. CLI uses it. |
+| `@marmarlabs/agentbridge-cli` | `agentbridge` CLI. Wraps scanner/openapi/core. |
 
 cli, openapi, scanner, and sdk all depend on core. Don't introduce
 circular deps.

README.md

@@ -11,35 +11,34 @@
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.7-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![Next.js](https://img.shields.io/badge/Next.js-15-black?logo=next.js&logoColor=white)](https://nextjs.org/)
 [![MCP](https://img.shields.io/badge/MCP-1.0-orange)](https://modelcontextprotocol.io)
-[![Status: Public Beta](https://img.shields.io/badge/Status-Public_Beta-blue)]()
+[![Status: v0.2.0](https://img.shields.io/badge/Status-v0.2.0-blue)]()
+[![npm](https://img.shields.io/npm/v/@marmarlabs/agentbridge-sdk?label=%40marmarlabs%2Fagentbridge-sdk)](https://www.npmjs.com/package/@marmarlabs/agentbridge-sdk)
 
 </div>
 
 ---
 
-## Public beta status
+## Status
 
-This is **v0.2.0 beta** — the first cut intended for outside developers to evaluate. It is suitable for local experimentation, prototyping, and reading. It is **not** yet a production security infrastructure: signed manifests, OAuth scope enforcement, HTTP MCP transport, and distributed audit storage are roadmap items (see [docs/roadmap.md](docs/roadmap.md)). Destructive demo actions remain simulated.
-
-**Distribution: source-only.** The `@marmar9615-cloud/agentbridge-*` packages are *prepared* for npm publishing (CI builds them, `npm pack --dry-run` validates each tarball) but **have not been published to npm yet**. The way to use AgentBridge today is to clone this repo:
+**AgentBridge v0.2.0 is the first public release.** The publishable
+packages are available on npm under the `@marmarlabs` scope.
 
 ```bash
-git clone https://github.com/marmar9615-cloud/agentbridge-protocol.git
-cd agentbridge-protocol
-npm install
-npm run dev      # demo on :3000, Studio on :3001
+npm install @marmarlabs/agentbridge-sdk @marmarlabs/agentbridge-core
+npx @marmarlabs/agentbridge-cli scan http://localhost:3000
+npx @marmarlabs/agentbridge-mcp-server
 ```
 
-npm publishing is a separate manual step (see [docs/npm-publishing.md](docs/npm-publishing.md)). After it happens, the equivalent commands will be:
-
-```bash
-# Available only after the packages are published — not today.
-npm install @marmar9615-cloud/agentbridge-sdk @marmar9615-cloud/agentbridge-core
-npx @marmar9615-cloud/agentbridge-cli scan http://localhost:3000
-npx @marmar9615-cloud/agentbridge-mcp-server
-```
+AgentBridge is usable today for local development, app prototyping,
+manifest authoring, scanner workflows, OpenAPI import, and MCP
+experiments. It is **not yet production security infrastructure** —
+signed manifests, OAuth scope enforcement, HTTP MCP transport, and
+distributed audit storage are roadmap items (see
+[docs/roadmap.md](docs/roadmap.md)). Destructive demo actions remain
+simulated.
 
-See [docs/public-beta.md](docs/public-beta.md) for what is and isn't in 0.2.0-beta, and [docs/releases/v0.2.0-beta.md](docs/releases/v0.2.0-beta.md) for full release notes.
+For the v0.2.0 release notes, see
+[docs/releases/v0.2.0.md](docs/releases/v0.2.0.md).
 
 ---
 
@@ -266,7 +265,7 @@ agentbridge-protocol/
 │   ├── sdk/              # 📦 defineAgentAction, manifest builder
 │   ├── scanner/          # 📦 readiness scoring + structured checks
 │   ├── openapi/          # 📦 OpenAPI 3.x → AgentBridge manifest converter
-│   └── cli/              # 📦 @marmar9615-cloud/agentbridge-cli — scan, validate, init, generate
+│   └── cli/              # 📦 @marmarlabs/agentbridge-cli — scan, validate, init, generate
 ├── apps/
 │   ├── demo-app/         # 🛒 Next.js order-management demo (port 3000)
 │   ├── studio/           # 🎛 Next.js dashboard (port 3001)
@@ -301,7 +300,7 @@ import {
   summarizeAction,
   createAuditEvent,
   appendAuditEvent,
-} from "@marmar9615-cloud/agentbridge-core";
+} from "@marmarlabs/agentbridge-core";
 
 const result = validateManifest(rawJson);
 if (result.ok) {
@@ -325,7 +324,7 @@ Key exports:
 The author's interface. Define actions ergonomically with Zod, get JSON Schema for free.
 
 ```typescript
-import { defineAgentAction, createAgentBridgeManifest, z } from "@marmar9615-cloud/agentbridge-sdk";
+import { defineAgentAction, createAgentBridgeManifest, z } from "@marmarlabs/agentbridge-sdk";
 
 const refundAction = defineAgentAction({
   name: "draft_refund_order",
@@ -370,7 +369,7 @@ The SDK converts Zod → JSON Schema (via `zod-to-json-schema`) automatically, s
 Audit any URL for agent readiness. Returns a 0–100 score plus actionable recommendations.
 
 ```typescript
-import { scanUrl } from "@marmar9615-cloud/agentbridge-scanner";
+import { scanUrl } from "@marmarlabs/agentbridge-scanner";
 
 const report = await scanUrl("http://localhost:3000");
 // {
@@ -447,7 +446,7 @@ The `agentbridge` command. See [The CLI](#the-cli) below.
 npm run dev:cli -- scan http://localhost:3000
 
 # After installing the published package, or via npx without install:
-npx @marmar9615-cloud/agentbridge-cli scan http://localhost:3000
+npx @marmarlabs/agentbridge-cli scan http://localhost:3000
 ```
 
 | Command | What it does |
@@ -462,7 +461,7 @@ npx @marmar9615-cloud/agentbridge-cli scan http://localhost:3000
 Example: take an existing OpenAPI document and turn it into a draft manifest in one shot:
 
 ```bash
-npx @marmar9615-cloud/agentbridge-cli generate openapi ./your-api.openapi.json \
+npx @marmarlabs/agentbridge-cli generate openapi ./your-api.openapi.json \
   --base-url https://api.acme.com \
   --out ./public/.well-known/agentbridge.json
 ```
@@ -473,7 +472,7 @@ See [docs/openapi-import.md](docs/openapi-import.md) for the full guide.
 
 ## OpenAPI import
 
-The CLI's `generate openapi` command and the `@marmar9615-cloud/agentbridge-openapi` package
+The CLI's `generate openapi` command and the `@marmarlabs/agentbridge-openapi` package
 turn an existing OpenAPI 3.x document into a draft AgentBridge manifest.
 
 | OpenAPI method | Risk inferred | requiresConfirmation |
@@ -495,7 +494,7 @@ intent. See the [example](examples/openapi-store/) and
 ## Manifest spec
 
 The manifest format is a stable, versioned spec — not just whatever
-`@marmar9615-cloud/agentbridge-core` happens to validate.
+`@marmarlabs/agentbridge-core` happens to validate.
 
 | Artifact | Path |
 |---|---|
@@ -551,7 +550,7 @@ Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):
   "mcpServers": {
     "agentbridge": {
       "command": "npx",
-      "args": ["@marmar9615-cloud/agentbridge-mcp-server"]
+      "args": ["@marmarlabs/agentbridge-mcp-server"]
     }
   }
 }

apps/demo-app/app/audit/page.tsx

@@ -1,4 +1,4 @@
-import { readAuditEvents, getAuditFilePath } from "@marmar9615-cloud/agentbridge-core";
+import { readAuditEvents, getAuditFilePath } from "@marmarlabs/agentbridge-core";
 
 export const dynamic = "force-dynamic";
 

apps/demo-app/lib/actions.ts

@@ -2,7 +2,7 @@
 // through audit metadata (actor user id, request id, IP). The demo trusts
 // the caller and only logs the action invocation.
 
-import { createActionHandler } from "@marmar9615-cloud/agentbridge-sdk";
+import { createActionHandler } from "@marmarlabs/agentbridge-sdk";
 import {
   listOrders,
   getOrder,

apps/demo-app/lib/audit.ts

@@ -1,4 +1,4 @@
-import { createAuditEvent, appendAuditEvent } from "@marmar9615-cloud/agentbridge-core";
+import { createAuditEvent, appendAuditEvent } from "@marmarlabs/agentbridge-core";
 
 export interface DemoAuditInput {
   actionName: string;

apps/demo-app/lib/manifest.ts

@@ -1,7 +1,7 @@
 // PROD: Real apps would attach OAuth scopes per action and check them on
 // each invocation. The demo treats permissions as documentation only.
 
-import { defineAgentAction, createAgentBridgeManifest, z } from "@marmar9615-cloud/agentbridge-sdk";
+import { defineAgentAction, createAgentBridgeManifest, z } from "@marmarlabs/agentbridge-sdk";
 
 export const listOrdersAction = defineAgentAction({
   name: "list_orders",

apps/demo-app/next.config.mjs

@@ -2,7 +2,7 @@
 const nextConfig = {
   // Workspace packages ship raw TS (main → src/index.ts). Next needs to
   // transpile them on the fly during dev/build.
-  transpilePackages: ["@marmar9615-cloud/agentbridge-core", "@marmar9615-cloud/agentbridge-sdk"],
+  transpilePackages: ["@marmarlabs/agentbridge-core", "@marmarlabs/agentbridge-sdk"],
   // The /.well-known/agentbridge.json route is implemented as a route
   // handler. Folder names beginning with `.` confuse Next's app-dir
   // resolver, so we rewrite to a normal segment.

apps/demo-app/package.json

@@ -8,8 +8,8 @@
     "start": "next start -p 3000"
   },
   "dependencies": {
-    "@marmar9615-cloud/agentbridge-core": "^0.2.0",
-    "@marmar9615-cloud/agentbridge-sdk": "^0.2.0",
+    "@marmarlabs/agentbridge-core": "^0.2.0",
+    "@marmarlabs/agentbridge-sdk": "^0.2.0",
     "next": "^15.0.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",

apps/mcp-server/README.md

@@ -1,4 +1,4 @@
-# @marmar9615-cloud/agentbridge-mcp-server
+# @marmarlabs/agentbridge-mcp-server
 
 stdio MCP server that exposes [AgentBridge](https://github.com/marmar9615-cloud/agentbridge-protocol)
 actions to AI agents (Claude Desktop, Cursor, custom clients) with
@@ -7,9 +7,9 @@ confirmation gates, origin pinning, and audit logging.
 ## Install
 
 ```bash
-npm install -g @marmar9615-cloud/agentbridge-mcp-server
+npm install -g @marmarlabs/agentbridge-mcp-server
 # or run directly:
-npx @marmar9615-cloud/agentbridge-mcp-server
+npx @marmarlabs/agentbridge-mcp-server
 ```
 
 ## Wire it up
@@ -23,7 +23,7 @@ Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
   "mcpServers": {
     "agentbridge": {
       "command": "npx",
-      "args": ["@marmar9615-cloud/agentbridge-mcp-server"]
+      "args": ["@marmarlabs/agentbridge-mcp-server"]
     }
   }
 }