@plumbus/core 0.6.7 → 0.6.9

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @plumbus/core changelog
 
+## 0.6.9
+
+### Added (M5 — authentication contract)
+
+- **Request-authentication contract** — `AuthenticationRequest`, `AuthenticationResult`, `RequestAuthenticator`, `wrapAuthAdapter`, and `createCompositeRequestAuthenticator` with bearer-over-cookie precedence.
+- **`HttpAuthenticationRuntime`** — optional `createServer({ authenticationRuntime })` seam for session/OIDC packages.
+- **`AuthContext.providerId`** — configured provider registration id for multi-provider mechanisms.
+- **`AuditWriter`** — injectable audit sink with `createDatabaseAuditWriter`.
+- **`parseCookieHeader` and `parseDurationToMs`** — shared HTTP cookie parsing and duration normalization utilities.
+- **Migrate `app/schemas/` seam** — `discoverResources` collects extra Drizzle tables for migration generation.
+- **`unauthorized` error code** — `UnauthorizedError` maps to HTTP 401.
+
+### Added (M6 — auth packages, docs, agent wiring)
+
+- **`@plumbus/auth` and `@plumbus/auth-cognito` publish steps** — CI publishes both packages after `@plumbus/core`.
+- **`docs/auth/`** — full OIDC session runtime documentation (getting started, configuration, providers, CSRF, Cognito, security, testing, migration, deployment).
+- **Consumer AI guidance includes auth** — `plumbus init` wires `@plumbus/auth/instructions/*` and `@plumbus/auth-cognito/instructions/*`. `AGENT_WIRING_VERSION` bumped to **9**. Run `plumbus init --patch` on existing projects.
+
+### Changed
+
+- **`auth.secret` no longer required** when a custom `authAdapter` or `authenticationRuntime` is supplied (§22.4).
+
+## 0.6.8
+
+### Added
+
+- **`Repository.aggregate()`** — compute `SUM` / `AVG` / `MIN` / `MAX` / `COUNT` / `COUNT(DISTINCT)` in the database, optionally with `GROUP BY`, instead of loading rows to reduce in memory. Filtering reuses the exact `findMany`/`count` semantics (the `query` equality arg plus `dateFilters`/`search`/`in`/`notEq`), and tenant scoping, soft-delete, and encrypted-field guards all apply. Without `groupBy` it returns one grand-total row (even over an empty scope, where `SUM` is `0`); with `groupBy`, one row per matching group. `orderBy` accepts group columns or aggregate aliases (e.g. `sum_cost`); `limit` is clamped to 1–1000. New public types: `AggregateOptions`, `AggregateRow`, `AggregateValue`. The in-memory test repository (`createInMemoryRepository` / `createTestContext`) mirrors the semantics exactly, so `aggregate()` is unit-testable without a database. Additive and backward compatible — existing repository callers are unaffected, and the release stays within the `0.6.x` line so `@plumbus/ui`/`chat`/`voice` peer ranges remain satisfied.
+
 ## 0.6.7
 
 ### Added

package/README.md

@@ -170,17 +170,7 @@ Full documentation: [github.com/plumbus-framework/plumbus/docs](https://github.c
 
 ## The Plumbus ecosystem
 
-| Package | Purpose | When to install |
-|---|---|---|
-| **`@plumbus/core`** | **You are here.** Foundation — capabilities, entities, events, flows, prompts, translations, runtime, CLI, audit, governance. | Always (required). |
-| [`@plumbus/ui`](../ui/) | Next.js/React UI — typed API clients, auth helpers, form metadata, scaffolds. | When building a Plumbus web UI. |
-| [`@plumbus/api`](../api/) | Partner external API — manifest, OpenAPI, docs, compatibility diff, test intent. | Optional peer `0.1.x` — when publishing a documented partner-facing HTTP API. |
-| [`@plumbus/mcp`](../mcp/) | MCP runtime — serve capabilities to AI agents (`tools/*`, `tasks/*`, transports). | Optional peer `0.5.x \|\| 0.6.x` — when exposing capabilities to MCP clients. |
-| [`@plumbus/chat`](../chat/) | Conversational runtime — `defineChat`, policy guards, context sources, streamed events. | Optional peer `0.1.x` — when adding a chat surface. |
-| [`@plumbus/chat-ui`](../chat-ui/) | React chat UI — hooks and `<ChatPanel />` for the `@plumbus/chat` turn protocol. | Peer of `@plumbus/chat` — when adding a browser chat client. |
-| [`@plumbus/knowledge-base`](../knowledge-base/) | Knowledge providers — scoped sources, registry, chat `knowledgeContext` integration. | Optional peer of `@plumbus/chat` `0.1.x` — when sharing named knowledge across features. |
-| [`@plumbus/voice`](../voice/) | Real-time voice runtime — `defineVoice`, STT/TTS/transport providers, session worker, cost ledger. | Optional peer `0.3.x` on `@plumbus/core` `0.6.x` — when adding speech I/O (not speech-to-speech); complements `@plumbus/chat` text surfaces. |
-| [`@plumbus/browser-extension`](../browser-extension/) | Extension scaffolder — WXT Chrome/Firefox project wired to your capabilities. | With `@plumbus/ui` (`0.1.x`) — when shipping a browser extension UI. |
+`@plumbus/core` is one package in the Plumbus framework. For the full list of packages and when to use each, see the [Plumbus monorepo README](https://github.com/plumbus-framework/plumbus#packages).
 
 ## License