@plumbus/core 0.7.0 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +7 -1
  2. package/README.md +0 -5
  3. package/instructions/framework.md +1 -1
  4. package/instructions/peer-dependencies.md +1 -1
  5. package/instructions/upgrading-security-release.md +20 -20
  6. package/package.json +6 -7
package/CHANGELOG.md CHANGED
@@ -1,10 +1,16 @@
1
1
  # @plumbus/core changelog
2
2
 
3
+ ## 0.7.1 — 2026-09-10
4
+
5
+ ### Fixed
6
+
7
+ - Publish the corrected package README without the added “Release family” banner, using normal `latest` publication. Runtime behavior and peer dependencies are unchanged from 0.7.0.
8
+
3
9
  ## 0.7.0 — 2026-09-10 — security hardening and fixed pricing
4
10
 
5
11
  ### Upgrade boundary
6
12
 
7
- - This release is an explicit minor-line upgrade. Previous caret ranges exclude it; install the coordinated core 0.7.x family and follow the [migration checklist](../../docs/upgrading-security-release.md). Packages stage under the `next` dist-tag.
13
+ - This release is an explicit minor-line upgrade. Previous caret ranges exclude it; install the coordinated core 0.7.x family and follow the [migration checklist](../../docs/upgrading-security-release.md). Packages publish to npm’s default `latest` dist-tag.
8
14
 
9
15
  ### Agent instructions
10
16
 
package/README.md CHANGED
@@ -1,10 +1,5 @@
1
1
  # @plumbus/core
2
2
 
3
- ## Release family 0.7.0
4
-
5
- This package requires an explicit upgrade from its previous minor line. Current Plumbus peers: `@plumbus/api` `0.2.x`, `@plumbus/ai-bedrock` `0.2.x`, `@plumbus/mcp` `0.6.x`. Install the matching versions of all Plumbus packages the app uses; do not bypass peer checks with `--force` or `--legacy-peer-deps`. Historical feature floors below describe earlier releases, not compatibility with this new family. Packages stage under `next`; read the core `instructions/upgrading-security-release.md` checklist and refresh agent wiring with `plumbus init --patch` (v16).
6
-
7
-
8
3
  **AI-native, contract-driven TypeScript application framework.**
9
4
 
10
5
  Define your application through six composable primitives — Capabilities, Entities, Events, Flows, Prompts, and Translations — and get deny-by-default security, advisory governance, audit trails, and managed AI integration out of the box. Optional companion packages extend the surface for partner APIs, MCP agents, chat, knowledge, UI generation, and browser extensions — install only what you need.
package/instructions/framework.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  ## Release family 0.7.0
4
4
 
5
- This package requires an explicit upgrade from its previous minor line. Current Plumbus peers: `@plumbus/api` `0.2.x`, `@plumbus/ai-bedrock` `0.2.x`, `@plumbus/mcp` `0.6.x`. Install the matching versions of all Plumbus packages the app uses; do not bypass peer checks with `--force` or `--legacy-peer-deps`. Historical feature floors below describe earlier releases, not compatibility with this new family. Packages stage under `next`; read the core `instructions/upgrading-security-release.md` checklist and refresh agent wiring with `plumbus init --patch` (v16).
5
+ This package requires an explicit upgrade from its previous minor line. Current Plumbus peers: `@plumbus/api` `0.2.x`, `@plumbus/ai-bedrock` `0.2.x`, `@plumbus/mcp` `0.6.x`. Install the matching versions of all Plumbus packages the app uses; do not bypass peer checks with `--force` or `--legacy-peer-deps`. Historical feature floors below describe earlier releases, not compatibility with this new family. Read the core `instructions/upgrading-security-release.md` checklist and refresh agent wiring with `plumbus init --patch` (v16).
6
6
 
7
7
 
8
8
  Plumbus is an AI-native, contract-driven TypeScript application framework. You build applications by composing six primitives — **Capabilities**, **Entities**, **Events**, **Flows**, **Prompts**, and **Translations** — through a controlled execution context (`ctx`). Optional add-on packages extend the surface when installed explicitly: `@plumbus/api` (partner HTTP API), `@plumbus/mcp` (AI agent tools), `@plumbus/chat` (+ `@plumbus/chat-ui`), `@plumbus/voice`, `@plumbus/knowledge-base`, `@plumbus/ui` (web UI generation), and `@plumbus/browser-extension`.
package/instructions/peer-dependencies.md CHANGED
@@ -31,7 +31,7 @@ Voice does not peer on vendor add-ons. Apps explicitly install only providers th
31
31
  - New-family packages require the new family. Do not publish narrowed peers or migration-requiring behavior as a patch on an old line: an existing caret could select that patch.
32
32
  - `pnpm install` passing in this workspace does not prove npm consumer compatibility. Validate packed tarballs with npm; production installs use npm.
33
33
  - Keep all manifests, READMEs, package instructions, changelogs, and AGENTS/CLAUDE in sync.
34
- - Packages stage under the **next** npm dist-tag. Promoting to latest is a separate operator decision after the entire family and consumer staging checks pass.
34
+ - Packages publish normally to npm’s **latest** dist-tag; there is no separate release-staging or promotion step.
35
35
 
36
36
  ## Future releases
37
37
 
package/instructions/upgrading-security-release.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Security release — consumer agent checklist
2
2
 
3
- Read this before upgrading an app to `@plumbus/core` **0.7.0**. This guide ships inside the package; it does not require a checkout of the framework repository.
3
+ Read this before upgrading an app to the `@plumbus/core` **0.7.x** line. This guide ships inside the package; it does not require a checkout of the framework repository.
4
4
 
5
5
  ## Keep the framework architecture
6
6
 
@@ -10,28 +10,28 @@ Implement app business logic through Plumbus capabilities, flows, entities, even
10
10
 
11
11
  | Installed package | Security release |
12
12
  | --- | --- |
13
- | `@plumbus/ai-bedrock` | 0.2.0 |
14
- | `@plumbus/api` | 0.2.0 |
15
- | `@plumbus/auth` | 0.2.0 |
16
- | `@plumbus/auth-cognito` | 0.2.0 |
17
- | `@plumbus/browser-extension` | 0.2.0 |
18
- | `@plumbus/chat` | 0.2.0 |
19
- | `@plumbus/chat-ui` | 0.2.0 |
20
- | `@plumbus/knowledge-base` | 0.2.0 |
21
- | `@plumbus/mcp` | 0.6.0 |
22
- | `@plumbus/core` | 0.7.0 |
23
- | `@plumbus/ui` | 0.8.0 |
24
- | `@plumbus/voice` | 0.5.0 |
25
- | `@plumbus/voice-deepdub` | 0.2.0 |
26
- | `@plumbus/voice-elevenlabs` | 0.2.0 |
27
- | `@plumbus/voice-livekit` | 0.2.0 |
28
- | `@plumbus/voice-minimax` | 0.2.0 |
29
- | `@plumbus/voice-openai` | 0.2.0 |
30
- | `@plumbus/voice-soniox` | 0.2.0 |
13
+ | `@plumbus/ai-bedrock` | 0.2.1 |
14
+ | `@plumbus/api` | 0.2.1 |
15
+ | `@plumbus/auth` | 0.2.1 |
16
+ | `@plumbus/auth-cognito` | 0.2.1 |
17
+ | `@plumbus/browser-extension` | 0.2.1 |
18
+ | `@plumbus/chat` | 0.2.1 |
19
+ | `@plumbus/chat-ui` | 0.2.1 |
20
+ | `@plumbus/knowledge-base` | 0.2.1 |
21
+ | `@plumbus/mcp` | 0.6.1 |
22
+ | `@plumbus/core` | 0.7.1 |
23
+ | `@plumbus/ui` | 0.8.1 |
24
+ | `@plumbus/voice` | 0.5.1 |
25
+ | `@plumbus/voice-deepdub` | 0.2.1 |
26
+ | `@plumbus/voice-elevenlabs` | 0.2.1 |
27
+ | `@plumbus/voice-livekit` | 0.2.1 |
28
+ | `@plumbus/voice-minimax` | 0.2.1 |
29
+ | `@plumbus/voice-openai` | 0.2.1 |
30
+ | `@plumbus/voice-soniox` | 0.2.1 |
31
31
 
32
32
  This is an explicit migration across minor lines, not a caret-compatible patch. Update every Plumbus package the app already uses to this family in one dependency change. Do not install unused add-ons. Core peers must be `0.7.x`, voice-provider peers `0.5.x`; copy all literals from [peer-dependencies.md](./peer-dependencies.md). Never bypass mixed-family errors with `--force` or `--legacy-peer-deps`.
33
33
 
34
- Packages stage under `next`. Select explicit versions from this table after they are available and review the checks below before deploying. Legacy caret ranges remain on old versions, which do not include these security fixes. Preserve the existing lockfile until the app is ready to migrate, then regenerate it intentionally and use frozen installs in production. Wildcards and broad `^0` ranges do not provide the same protection.
34
+ Packages publish normally to `latest`. Select explicit versions from this table after they are available and review the checks below before deploying. Legacy caret ranges remain on old versions, which do not include these security fixes. Preserve the existing lockfile until the app is ready to migrate, then regenerate it intentionally and use frozen installs in production. Wildcards and broad `^0` ranges do not provide the same protection.
35
35
 
36
36
  After installing the release, run these commands from the app root:
37
37
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@plumbus/core",
3
- "version": "0.7.0",
3
+ "version": "0.7.1",
4
4
  "description": "Plumbus framework core — types, SDK, runtime, CLI, test utilities",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
@@ -52,8 +52,7 @@
52
52
  "directory": "packages/plumbus-core"
53
53
  },
54
54
  "publishConfig": {
55
- "access": "public",
56
- "tag": "next"
55
+ "access": "public"
57
56
  },
58
57
  "engines": {
59
58
  "node": ">=20.6.0"
@@ -104,10 +103,10 @@
104
103
  "@vitest/browser": "^3.0.0",
105
104
  "esbuild": "^0.25.12",
106
105
  "typescript": "^5.7.0",
107
- "@plumbus/api": "0.2.0",
108
- "@plumbus/ai-bedrock": "0.2.0",
109
- "@plumbus/mcp": "0.6.0",
110
- "@plumbus/voice": "0.5.0"
106
+ "@plumbus/api": "0.2.1",
107
+ "@plumbus/voice": "0.5.1",
108
+ "@plumbus/ai-bedrock": "0.2.1",
109
+ "@plumbus/mcp": "0.6.1"
111
110
  },
112
111
  "scripts": {
113
112
  "build": "tsc -b",