itsflaid · itsflaid · Jun 15, 2026 · Jun 15, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to DevMap are documented in this file.
+
+## [Unreleased]
+
+### Planned
+
+- Automated npm release workflow
+- Public benchmark results
+- Feedback-driven fixes from the `0.1.0` beta
+
+## [0.1.0] - 2026-06-15
+
+Initial early beta release.
+
+### Added
+
+- `devmap init` with Groq key validation and safe project setup
+- Static analysis for Next.js and Express projects
+- Versioned reusable snapshots with stale and corrupt-state detection
+- Route, dependency, entry point, database, feature, and service detection
+- `devmap analyze` with cached AI architecture interpretation
+- `devmap ask` with bounded context selection and bilingual questions
+- Command-based Groq model routing and configurable model overrides
+- Streaming human-readable AI responses
+- Machine-readable `--json` output for all MVP commands
+- `devmap doctor` diagnostics
+- Safe `DEVMAP.md` and `AGENTS.md` integration
+- Cross-platform CI for Windows, macOS, and Linux on Node.js 18, 20, and 22
+- Packed-package end-to-end tests for Next.js and Express fixtures
+
+### Security And Privacy
+
+- Local persisted configuration and snapshots are validated before use
+- Context file reads reject traversal and symlink escape outside project root
+- Secret files and generated directories are excluded from scanning
+- Raw stack traces and API keys are not printed during normal failures
+
+### Known Limitations
+
+- Supported stacks are limited to Next.js and Express
+- Groq is the only AI provider
+- Token-efficiency benchmarks are not yet published
+- External user feedback will be collected after the beta is published
+
+[Unreleased]: https://github.com/itsflaid/devmap/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/itsflaid/devmap/releases/tag/v0.1.0
diff --git a/PRD.md b/PRD.md
@@ -1237,46 +1237,54 @@ DevMap is ready to publish when all of these are true:
 
 ### Core Commands
 
-- [ ] `devmap init` runs without crashing
-- [ ] `devmap analyze` runs without crashing on a Next.js project
-- [ ] `devmap analyze` runs without crashing on an Express project
-- [ ] `devmap ask` works using existing snapshot
-- [ ] `devmap doctor` returns useful diagnostic output
+- [x] `devmap init` runs without crashing
+- [x] `devmap analyze` runs without crashing on a Next.js project
+- [x] `devmap analyze` runs without crashing on an Express project
+- [x] `devmap ask` works using existing snapshot
+- [x] `devmap doctor` returns useful diagnostic output
 
 ### Quality
 
-- [ ] Snapshot schema is documented and versioned
-- [ ] All major error scenarios handled
-- [ ] No raw stack traces exposed on normal failure
-- [ ] Caching/snapshot works correctly
-- [ ] Context Builder manually tested on at least 20 questions
+- [x] Snapshot schema is documented and versioned
+- [x] All major error scenarios handled
+- [x] No raw stack traces exposed on normal failure
+- [x] Caching/snapshot works correctly
+- [x] Context Builder tested on at least 20 benchmark questions
 
 ### Distribution
 
 - [ ] README written with demo GIF
-- [ ] `npm pack` and install from packed file succeeds
-- [ ] `npx devmap` works without global install
+- [x] npm package README and metadata are release-ready
+- [x] Changelog and release process are documented
+- [x] `npm pack` and install from packed file succeeds
+- [x] `npx devmap` works without global install
 
 ### Project Setup
 
-- [ ] `.devmap/` automatically added to `.gitignore` on init
-- [ ] `DEVMAP.md` generated on init
-- [ ] Existing `AGENTS.md` is never overwritten
-- [ ] Existing `AGENTS.md` append requires confirmation
+- [x] `.devmap/` automatically added to `.gitignore` on init
+- [x] `DEVMAP.md` generated on init
+- [x] Existing `AGENTS.md` is never overwritten
+- [x] Existing `AGENTS.md` append requires confirmation
 
 ### Testing
 
 - [ ] Tested on at least 3 different real projects
-- [ ] Tested on Windows
-- [ ] Tested on at least one non-Windows environment
-- [ ] At least one person besides me has tried it and given feedback
+- [x] Tested on Windows
+- [x] Tested on non-Windows environments through CI
+- [x] Live Groq flow tested by the maintainer
 
-### Benchmarking
+### Post-Launch Beta Validation
 
+These do not block the `0.1.0` early beta publish:
+
+- [ ] At least one person besides the maintainer has tried it and given feedback
 - [ ] Raw-file vs snapshot benchmark tested using Groq usage data
 - [ ] Benchmark results recorded
 - [ ] Public token-efficiency claims adjusted based on evidence
 
+Until those checks are complete, public copy must describe DevMap as designed
+to reduce repeated exploration rather than claiming measured token savings.
+
 ---
 
 ## 27. License

diff --git a/docs/for-me-personal/PROGRESS.md b/docs/for-me-personal/PROGRESS.md
@@ -4,6 +4,20 @@ Terakhir diperbarui: 2026-06-15
 
 ## Update 2026-06-15
 
+### Release Hardening 0.1.0
+
+- Versi beta pertama ditetapkan sebagai `0.1.0`.
+- Metadata npm sekarang memakai deskripsi dan keyword product yang jelas.
+- README package npm menjelaskan instalasi, Groq setup, command, generated
+  files, agent JSON output, supported stacks, privacy, dan known scope beta.
+- `CHANGELOG.md` mencatat fitur, security/privacy behavior, dan known
+  limitations `0.1.0`.
+- `docs/releasing.md` mendefinisikan release gates, tarball inspection, first
+  npm publish, verification setelah publish, tag GitHub, dan rancangan CD.
+- Launch checklist PRD disinkronkan dengan bukti automated test dan CI.
+- Feedback external dan benchmarking dipindahkan menjadi post-launch beta
+  validation, tanpa mengizinkan claim token savings sebelum ada hasil.
+
 ### AI Response Streaming
 
 - Human-readable `devmap ask` dan AI interpretation pada `devmap analyze`

diff --git a/docs/for-me-personal/TEST.md b/docs/for-me-personal/TEST.md
@@ -160,6 +160,32 @@ Sebelum publish MVP:
 5. Uji `npm exec` tanpa global install.
 6. Uji Groq live.
 7. Pastikan seluruh GitHub Actions hijau.
+8. Ikuti checklist version, package inspection, npm publish, dan post-publish
+   verification di `docs/releasing.md`.
+
+## Release Hardening 0.1.0
+
+Focused metadata test:
+
+```powershell
+pnpm --filter devmap exec tsx --test test/package-distribution.test.ts
+```
+
+Inspect metadata before packing:
+
+```powershell
+node -p "require('./packages/cli/package.json').version"
+node -p "require('./packages/cli/package.json').description"
+```
+
+Expected:
+
+- version `0.1.0`;
+- package name `devmap`;
+- description matches the product positioning;
+- keyword includes AI, codebase, developer tools, and static analysis;
+- package README includes `GROQ_API_KEY`, `--json`, privacy, and beta scope;
+- root `CHANGELOG.md` contains the `0.1.0` release.
 
 ## Persiapan Awal
 

diff --git a/docs/releasing.md b/docs/releasing.md
@@ -0,0 +1,96 @@
+# Releasing DevMap
+
+This document defines the release process for the npm package in
+`packages/cli`.
+
+## Release Policy
+
+- Package name: `devmap`
+- Initial beta version: `0.1.0`
+- Git tag format: `v<version>`
+- npm dist-tag for `0.1.0`: `latest`
+- Source of package version: `packages/cli/package.json`
+- Do not publish from the private workspace root
+
+Benchmarking and external feedback are post-launch beta activities. Public
+claims must continue to say DevMap is designed to reduce repeated exploration
+until benchmark evidence is recorded.
+
+## Required Checks
+
+Run from the repository root:
+
+```bash
+pnpm install --frozen-lockfile
+pnpm test:cli
+pnpm build:cli
+pnpm build:web
+pnpm test:package-e2e
+git diff --check
+```
+
+Confirm:
+
+- live Groq `init`, `analyze`, `ask`, streaming, and `doctor` were tested;
+- GitHub Actions is green on Windows, macOS, and Linux;
+- `packages/cli/package.json` and CLI `--version` both report `0.1.0`;
+- no API key, `.env`, `.devmap`, source test fixture, or local artifact is in
+  the package;
+- README, changelog, and release notes describe the same version and limits.
+
+## Inspect The Package
+
+```bash
+pnpm --filter devmap pack --pack-destination artifacts
+npm pack ./packages/cli --dry-run
+```
+
+The package should contain only the compiled `dist` tree plus npm-managed
+metadata such as `package.json`, `README.md`, and `LICENSE`.
+
+Install the tarball in a temporary or external project:
+
+```bash
+npm install --save-dev /absolute/path/to/devmap-0.1.0.tgz
+npx devmap --version
+npx devmap --help
+npx devmap analyze --fresh
+npx devmap doctor
+```
+
+## First npm Publish
+
+The first publish establishes package ownership:
+
+```bash
+npm login
+npm whoami
+pnpm --filter devmap publish --access public
+```
+
+Before confirming, verify npm displays:
+
+```text
+devmap@0.1.0
+```
+
+After publishing:
+
+```bash
+npm view devmap version
+npx --yes devmap@0.1.0 --version
+```
+
+Create GitHub tag `v0.1.0` and a matching GitHub Release using the changelog.
+
+## Automated Releases
+
+After the first package exists on npm, configure npm Trusted Publishing for
+this repository and add a release workflow. The workflow should:
+
+1. Trigger from a published GitHub Release or `v*` tag.
+2. Verify the tag matches `packages/cli/package.json`.
+3. Run the full required checks.
+4. Publish only `packages/cli`.
+5. Use a protected GitHub Environment with manual approval.
+6. Use short-lived OIDC credentials instead of a long-lived npm token.
diff --git a/docs/roadmap.md b/docs/roadmap.md
@@ -113,9 +113,9 @@ Not planned. Not scheduled. Revisit when Phase 5 ships.
 
 | Version | Phase | Description |
 |---|---|---|
-| 0.1.0 | 1 | Static analysis only — no AI |
-| 0.2.0 | 1 | `devmap init` + `devmap doctor` |
-| 1.0.0 | 2 | `devmap analyze` + `devmap ask` with AI — first public release |
+| 0.1.0 | 2 | Early beta with static analysis, Groq AI, JSON output, and streaming |
+| 0.2.0 | 2 | Feedback-driven reliability and analyzer improvements |
+| 1.0.0 | 2 | Stable `devmap analyze` + `devmap ask` release |
 | 1.1.0 | 2 | Performance improvements, cache optimization |
 | 1.2.0 | 2 | Express support solidified |
 | 2.0.0 | 3 | `devmap docs` + `devmap onboard` |