@acmekit/acmekit 2.13.86 → 2.13.88

package/dist/templates/plugin/.claude/rules/modules.md

@@ -396,6 +396,149 @@ Options flow: host config `providers[].options` → constructor second argument
 
 Available domain abstracts: `AbstractNotificationProviderService`, `AbstractFileProviderService`, `AbstractAuthModuleProvider`, `AbstractAnalyticsProviderService`, `AbstractModuleProvider<TConfig>` (generic base).
 
+### Provider Container Scoping
+
+**Providers are module-scoped.** The `container` passed to a provider constructor is the **parent module's** awilix cradle — not the application root container. This is by design: modules are isolated, self-contained units.
+
+**Providers CAN access:**
+- Sibling registrations within the parent module (e.g., `logger`, services registered by the module's loaders)
+- Their own `this.options_` (from `providers[].options` in host config)
+
+**Providers CANNOT access:**
+- Other modules — a provider under `RELAYER_MODULE` cannot resolve `TRON_MODULE`, `Modules.USER`, or any module outside its parent
+- Application-level container registrations not propagated to the module scope
+
+**Attempting to resolve another module from the provider's container silently returns `undefined` or throws at runtime** — there is no compile-time error.
+
+#### Cradle vs AcmeKitContainer — Two Different Objects
+
+AcmeKit has two container representations. Confusing them causes silent `undefined` at runtime.
+
+| | **Cradle** (awilix proxy) | **AcmeKitContainer** |
+|---|---|---|
+| What is it | Proxy object — property access triggers resolution | Full container with `.resolve()` method |
+| Access pattern | `container.logger`, `container[MODULE]` | `container.resolve(MODULE)` |
+| Who gets it | Provider constructors, service constructors | Workflow steps (`{ container }`), `req.scope` |
+| Type | `Record<string, unknown>` (or typed cradle) | `AcmeKitContainer` from `@acmekit/framework/types` |
+
+```typescript
+// Provider constructor — receives CRADLE (property access)
+constructor(container: Cradle, options: Options) {
+  this.logger_ = container.logger          // ✅ property access
+  this.logger_ = container.resolve("logger")  // ❌ cradle has no .resolve()
+}
+
+// Workflow step — receives ACMEKIT CONTAINER (.resolve() method)
+async (input, { container }) => {
+  const svc = container.resolve(MY_MODULE)      // ✅ .resolve() method
+  const svc = container[MY_MODULE]              // ❌ undefined — not a cradle
+}
+```
+
+**When passing the application container to a provider method, the provider must use `.resolve()` — not bracket access:**
+
+```typescript
+import type { AcmeKitContainer } from "@acmekit/framework/types"
+
+class MyProvider {
+  async doWork(request: Request, appContainer?: AcmeKitContainer) {
+    // appContainer is from the workflow step — use .resolve()
+    const otherService = appContainer?.resolve<IOtherService>(OTHER_MODULE)  // ✅
+    const otherService = appContainer?.[OTHER_MODULE]  // ❌ undefined!
+  }
+}
+```
+
+#### Simple Providers — No Cross-Module Dependencies
+
+When a provider's job is a single external operation (send email, upload file, call API), it needs only `this.options_` and sibling registrations. No special handling required.
+
+```typescript
+class SendGridNotification extends AbstractNotificationProviderService {
+  static identifier = "sendgrid"
+
+  async send(notification) {
+    // Only needs this.options_.apiKey — no other modules
+    return this.client_.send({ to: notification.to, template: notification.template })
+  }
+}
+```
+
+#### Complex Providers — Cross-Module Dependencies via Method Parameters
+
+Some providers need other modules to do their job — e.g., a chain relayer provider that calls external APIs but also manages chain-specific DB state in a companion module. The provider can't resolve the companion module from `this.container_` (module-scoped), and splitting into workflow steps isn't always possible (the calling workflow belongs to a different plugin/package).
+
+**The correct pattern: the workflow step passes the `AcmeKitContainer` through the parent module's service method to the provider. The provider uses `.resolve()` on the passed container — never bracket access.**
+
+```typescript
+import type { AcmeKitContainer } from "@acmekit/framework/types"
+
+// 1. Workflow step — passes the full application container
+export const executeOnChainStep = createStep(
+  { name: "execute-on-chain-step", noCompensation: true },
+  async ({ request }, { container }) => {
+    const relayerService = container.resolve<IRelayerModuleService>(RELAYER_MODULE)
+    // Pass container (AcmeKitContainer) — provider will .resolve() what it needs
+    const result = await relayerService.relay(request, container)
+    return new StepResponse(result)
+  },
+  async () => {}
+)
+
+// 2. Parent module service — forwards AcmeKitContainer to the provider
+class RelayerModuleService {
+  @InjectManager()
+  async relay(
+    request: RelayRequest,
+    appContainer?: AcmeKitContainer,
+    @AcmeKitContext() sharedContext: Context = {}
+  ) {
+    return await this.relay_(request, appContainer, sharedContext)
+  }
+
+  @InjectTransactionManager()
+  protected async relay_(
+    request: RelayRequest,
+    appContainer?: AcmeKitContainer,
+    @AcmeKitContext() sharedContext: Context = {}
+  ) {
+    const provider = this.resolveChainRelayer(request.chain)
+    const wallet = await this.selectWallet_(request.chain, sharedContext)
+    return await provider.relay({ ...request, wallet }, appContainer)
+  }
+}
+
+// 3. Provider — uses .resolve() on the passed AcmeKitContainer
+class TronChainRelayer implements IChainRelayer {
+  static identifier = "tron-chain-relayer"
+
+  async relay(request: RelayRequest, appContainer?: AcmeKitContainer): Promise<RelayResult> {
+    // .resolve() with optional chaining — NOT bracket access
+    const tronService = appContainer?.resolve<ITronModuleService>(TRON_MODULE)
+    const delegation = await tronService.createDelegationRecords([...])
+    // this.options_ for own config (module-scoped — always available)
+    const client = new TronWeb({ fullHost: this.options_.fullNodeUrl })
+    const txResult = await client.broadcast(request.payload)
+    await tronService.reconcileDelegation(delegation.id, txResult)
+    return txResult
+  }
+}
+```
+
+**Key constraints:**
+- Provider constructor container (`this.container_`) is a **cradle** — property access only, ONLY for sibling registrations
+- The `AcmeKitContainer` passed as a method parameter uses **`.resolve()`** — never bracket access
+- The `appContainer` parameter is optional (`?`) — the provider interface uses the looser `Record<string, unknown>` type; implementations narrow to `AcmeKitContainer`
+- The workflow step is the only place that has the full `AcmeKitContainer`
+- Import: `import type { AcmeKitContainer } from "@acmekit/framework/types"`
+
+**When to use which tier:**
+
+| Provider type | Cross-module deps? | Pattern |
+|---|---|---|
+| File storage, notifications, SMS | No | Use `this.options_` and `this.container_` only |
+| Payment processors, chain relayers | Yes — companion modules for state/records | Receive deps as method params from workflow step |
+
 ### Module() vs ModuleProvider()
 
 | | `Module()` | `ModuleProvider()` |
@@ -590,6 +733,32 @@ class MyProvider {
   }
 }
 
+// WRONG — provider resolving another module from its own container (cradle)
+// Provider container is scoped to the PARENT module — other modules are not visible
+class TronRelayer implements IChainRelayer {
+  async relay(request: RelayRequest) {
+    const tronService = this.container_[TRON_MODULE]  // ❌ undefined — not in module scope
+    await tronService.createDelegationRecords([...])  // crashes
+  }
+}
+
+// WRONG — using bracket access on AcmeKitContainer (it's NOT a cradle)
+class TronRelayer implements IChainRelayer {
+  async relay(request: RelayRequest, appContainer?: AcmeKitContainer) {
+    const svc = appContainer[TRON_MODULE]             // ❌ undefined — wrong access pattern!
+    const svc2 = appContainer[TRON_MODULE] as any     // ❌ same bug, hidden by cast
+  }
+}
+
+// RIGHT — use .resolve() on AcmeKitContainer passed from workflow step
+class TronRelayer implements IChainRelayer {
+  async relay(request: RelayRequest, appContainer?: AcmeKitContainer) {
+    const tronService = appContainer?.resolve<ITronModuleService>(TRON_MODULE)  // ✅
+    await tronService.createDelegationRecords([...])
+    return await this.client_.broadcast(request.payload)
+  }
+}
+
 // WRONG — hardcoding prefix/identifiersKey inline in multiple files
 // A typo between createProvidersLoader and AcmeKitService silently breaks resolution
 createProvidersLoader({ prefix: "cr_", identifiersKey: "chain_relayer_providers_identifier" })

package/dist/templates/plugin/.claude/rules/testing.md

@@ -8,7 +8,30 @@ paths:
 
 # Testing Rules
 
-## Critical — Read Before Writing Any Test
+## Pre-Flight Checklist (MANDATORY before writing any test)
+
+Complete these steps IN ORDER before writing a single line of test code:
+
+1. **Build the plugin.** Run `pnpm build` (or verify `pnpm dev` is running). Stale `.acmekit/server/` output causes cryptic errors like `__joinerConfig is not a function` or missing module services. The test runner loads compiled output from `.acmekit/server/`, not source files.
+
+2. **Verify jest config buckets.** Read `jest.config.js` and confirm the test type you need exists:
+   ```
+   integration:plugin  → integration-tests/plugin/
+   integration:http    → integration-tests/http/
+   integration:modules → src/modules/*/__tests__/
+   unit                → src/**/__tests__/*.unit.spec.ts
+   ```
+   If the bucket is missing, add the jest config entry BEFORE writing the test. A test file in a directory with no matching jest config is silently ignored.
+
+3. **Read the source code under test.** Read service methods, route handlers, workflow steps, subscriber handlers — understand actual method signatures, return types, and error paths.
+
+4. **Read mock interfaces.** When your test depends on auto-injected mocks (`MockEventBusService`, `MockLockingService`, `MockSecretsService`), read the mock source in `@acmekit/test-utils` to verify method names and signatures. Do NOT assume mock methods match the real service 1:1 — mocks have convenience methods (e.g., `setSecret()`, `getEmittedEvents()`) and may omit advanced features.
+
+5. **Identify the correct test tier.** Match your test to the right mode and file location (see Test Runner Selection below).
+
+---
+
+## Critical Rules
 
 **Single unified runner.** Use `integrationTestRunner` from `@acmekit/test-utils` with a `mode` parameter. The old names (`pluginIntegrationTestRunner`, `moduleIntegrationTestRunner`) are deprecated aliases — NEVER use them.
 
@@ -26,6 +49,8 @@ paths:
 
 **Always add `jest.clearAllMocks()` in `beforeEach`.** Mock state leaks between test blocks. Without explicit cleanup, assertions on mock call counts fail from prior-test contamination.
 
+**`pluginPath` is MANDATORY in plugin mode.** Always use `pluginPath: process.cwd()`. Omitting it causes `Cannot read properties of undefined` during ConfigStage.
+
 ---
 
 ## Test Runner Selection
@@ -492,34 +517,27 @@ integrationTestRunner({
 
 ## Asserting Domain Events
 
-Plugin mode (without HTTP) injects `MockEventBusService`. Spy on the **prototype**, not an instance.
+`MockEventBusService` accumulates all emitted events. Use `.getEmittedEvents()` — no spy needed.
 
 ```typescript
-import { MockEventBusService } from "@acmekit/test-utils"
+it("should emit greeting.created event", async () => {
+  const service = container.resolve(GREETING_MODULE)
+  await service.createGreetings([{ message: "Hello" }])
 
-it("should capture events", async () => {
-  const spy = jest.spyOn(MockEventBusService.prototype, "emit")
   const eventBus = container.resolve(Modules.EVENT_BUS)
-
-  await eventBus.emit([
-    { name: "greeting.created", data: { id: "g1", message: "Hello" } },
-  ])
-
-  expect(spy).toHaveBeenCalledTimes(1)
-  expect(spy.mock.calls[0][0]).toEqual(
+  const events = eventBus.getEmittedEvents()
+  expect(events).toEqual(
     expect.arrayContaining([
       expect.objectContaining({
-        name: "greeting.created",
-        data: expect.objectContaining({ id: "g1" }),
+        name: "greeting.created",  // NOTE: property is "name", NOT "eventName"
+        data: expect.objectContaining({ id: expect.any(String) }),
       }),
     ])
   )
-
-  spy.mockRestore()
 })
 ```
 
-**Note:** MockEventBusService `emit` takes an **array** of events. Real event bus `emit` takes a single `{ name, data }` object.
+> `emitEventStep` maps `eventName` to `name` internally — always assert on `event.name`.
 
 ---
 
@@ -765,7 +783,9 @@ integrationTestRunner({
 
 ## Configuring Providers in Plugin Tests
 
-Use `pluginModuleOptions` to pass per-module options (e.g., provider configuration) keyed by module name:
+Providers CANNOT be mocked with `jest.mock({ virtual: true })`. The module loader uses `require.resolve()` which bypasses jest. Providers must be **real files on disk** exporting `ModuleProvider()`.
+
+Use `pluginModuleOptions` to register providers keyed by module name. Provider `resolve` paths must be **absolute** (the loader resolves from `modules-sdk` dist, not your test file):
 
 ```typescript
 integrationTestRunner({
@@ -775,8 +795,8 @@ integrationTestRunner({
     tron: {
       providers: [
         {
-          resolve: "./src/providers/energy/own-pool",
-          id: "own-pool",
+          resolve: process.cwd() + "/integration-tests/helpers/mock-energy-provider",
+          id: "mock-energy",
           options: { apiKey: "test-key" },
         },
       ],
@@ -786,10 +806,135 @@ integrationTestRunner({
 })
 ```
 
+The helper file must be a real module:
+
+```typescript
+// integration-tests/helpers/mock-energy-provider.ts
+import { ModuleProvider } from "@acmekit/framework/utils"
+
+class MockEnergyService {
+  static identifier = "mock-energy"
+  // implement provider interface methods
+}
+
+export default ModuleProvider("tron", { services: [MockEnergyService] })
+```
+
 `pluginModuleOptions` is merged into the discovered module config AFTER `pluginOptions`, so module-specific options override plugin-level ones.
 
 ---
 
+## Auto-Injected Infrastructure Mocks
+
+The test runner automatically injects mock implementations for infrastructure modules in plugin and module modes. You do NOT need to manually inject these:
+
+| Module | Mock class | Behavior |
+|---|---|---|
+| `Modules.EVENT_BUS` | `MockEventBusService` | Accumulates events — call `.getEmittedEvents()` to inspect |
+| `Modules.LOCKING` | `MockLockingService` | In-memory locking — `execute()` runs job immediately, acquire/release tracked |
+| `Modules.SECRETS` | `MockSecretsService` | In-memory store — pre-populate with `.setSecret(id, value)` |
+
+Override any mock via `injectedDependencies` if needed — user overrides take precedence.
+
+### Asserting emitted events (no spy needed)
+
+```typescript
+// Resolve the mock event bus from the container
+const eventBus = container.resolve(Modules.EVENT_BUS)
+
+// Run your workflow/operation that emits events
+await createGreetingsWorkflow(container).run({ input: { greetings: [{ message: "Hi" }] } })
+
+// Inspect emitted events directly — no jest.spyOn needed
+const events = eventBus.getEmittedEvents()
+const greetingEvent = events.find((e: any) => e.name === "greeting.created")
+expect(greetingEvent).toBeDefined()
+expect(greetingEvent.data).toEqual(expect.objectContaining({ id: expect.any(String) }))
+```
+
+> Event objects have `{ name, data, metadata?, options? }`. The property is `name`, NOT `eventName` — `emitEventStep` maps `eventName` to `name` internally.
+
+### Pre-populating secrets for tests
+
+```typescript
+integrationTestRunner({
+  mode: "plugin",
+  pluginPath: process.cwd(),
+  testSuite: ({ container }) => {
+    beforeEach(() => {
+      const secrets = container.resolve(Modules.SECRETS)
+      secrets.setSecret("prod/wallet", { address: "0xtest123" })
+    })
+
+    it("resolves wallet address from secrets", async () => {
+      const addr = await container.resolve(Modules.SECRETS).getKey("prod/wallet", "address")
+      expect(addr).toBe("0xtest123")
+    })
+  },
+})
+```
+
+---
+
+## injectedDependencies vs pluginModuleOptions
+
+| | `injectedDependencies` | `pluginModuleOptions` |
+|---|---|---|
+| **Injects into** | Root container | Per-module config |
+| **Use for** | Infrastructure mocks (locking, secrets, custom services) | Provider registration, module-specific config |
+| **Shape** | `{ [Modules.X]: mockInstance }` | `{ moduleName: { providers: [...], options } }` |
+| **Path resolution** | N/A | Must be **absolute** (`process.cwd() + "/path"`) |
+
+---
+
+## Client Routes Require API Key
+
+Routes under `/client/*` use `AcmeKitTypedRequest` (non-authenticated), but they are NOT fully public. AcmeKit middleware enforces a client API key header on all `/client/*` routes.
+
+```typescript
+// WRONG — 401 "Client API key required"
+const response = await api.get("/client/plugin/greetings")  // ❌
+
+// RIGHT — create client API key and pass header
+const apiKey = await apiKeyModule.createApiKeys({
+  title: "Test Client Key",
+  type: ApiKeyType.CLIENT,
+  created_by: "test",
+})
+const response = await api.get("/client/plugin/greetings", {
+  headers: { [CLIENT_API_KEY_HEADER]: apiKey.token },
+})
+```
+
+---
+
+## Known Environment Issues
+
+### Stale `.acmekit/server/` Build Output
+
+**Symptom:** `__joinerConfig is not a function`, missing module services, `Cannot find module` errors when tests previously worked.
+
+**Cause:** Plugin tests load compiled JS from `.acmekit/server/src/`, not TypeScript source. If you edited source files but didn't rebuild, the compiled output is stale.
+
+**Fix:** Run `pnpm build` (one-time) or keep `pnpm dev` running (watch mode). After build, re-run the failing test.
+
+### Database Teardown Permission Errors
+
+**Symptom:** `permission denied for schema public` or `cannot drop schema` during test teardown (afterAll).
+
+**Cause:** PostgreSQL user lacks `CREATE`/`DROP` privileges on the `public` schema, or concurrent test processes hold locks.
+
+**Fix:**
+```bash
+# Grant full privileges to the test user (run once)
+psql -U postgres -c "GRANT ALL ON SCHEMA public TO <your_user>;"
+psql -U postgres -c "ALTER USER <your_user> CREATEDB;"
+```
+
+This is an environment setup issue, not a test code issue. If teardown fails but all tests passed, the test results are still valid.
+
+---
+
 ## Anti-Patterns — NEVER Do These
 
 ```typescript
@@ -915,4 +1060,26 @@ const re = new RegExp("^(\\*|[0-9]+)(\\/[0-9]+)?$")
 const result = await provider.process(bad)
 expect(result.success).toBe(false)  // ❌ actually throws
 // RIGHT — read implementation first to check if it throws or returns
+
+// WRONG — jest virtual mock for providers (require.resolve bypasses jest)
+jest.mock("../../src/providers/mock-provider", () => ({ ... }), { virtual: true })  // ❌
+// RIGHT — create a real file and use absolute path
+// integration-tests/helpers/mock-provider.ts (real file with ModuleProvider export)
+pluginModuleOptions: { mod: { providers: [{ resolve: process.cwd() + "/integration-tests/helpers/mock-provider" }] } }
+
+// WRONG — relative provider resolve path (resolved from modules-sdk dist, not test file)
+{ resolve: "../../src/providers/my-provider" }  // ❌
+// RIGHT
+{ resolve: process.cwd() + "/src/providers/my-provider" }
+
+// WRONG — using jest.spyOn to inspect emitted events
+jest.spyOn(MockEventBusService.prototype, "emit")  // ❌ fragile, complex extraction
+// RIGHT — use built-in event accumulation
+const eventBus = container.resolve(Modules.EVENT_BUS)
+const events = eventBus.getEmittedEvents()
+
+// WRONG — checking event.eventName (emitEventStep maps eventName → name internally)
+expect(event.eventName).toBe("greeting.created")  // ❌ property doesn't exist
+// RIGHT
+expect(event.name).toBe("greeting.created")
 ```

package/dist/templates/plugin/.claude/rules/workflows.md

@@ -502,6 +502,8 @@ dismissRemoteLinkStep([{
 
 Always resolve services fresh from `container`. Never capture from closure in compensation.
 
+**Workflow steps have the full application container** — they can resolve ANY module. Module providers and services are scoped to their parent module and cannot resolve other modules. When a provider needs cross-module dependencies, the step resolves them and passes them through the service to the provider as method parameters (see `modules.md` → Provider Container Scoping).
+
 ```typescript
 // Typed resolution (preferred)
 const service = container.resolve<IBlogModuleService>(BLOG_MODULE)

package/dist/templates/plugin/.claude/skills/admin-customization/SKILL.md

@@ -376,6 +376,16 @@ Each widget file exports exactly one default component and one `config`.
 
 Widgets receive no props. Fetch all data internally using hooks.
 
+### Admin Dependencies
+
+Form-related packages are provided by acmekit — do NOT install them separately:
+
+- `react-hook-form` — import `useForm` from `"react-hook-form"` (add to `peerDependencies` + `devDependencies`)
+- `@hookform/resolvers` — import `zodResolver` from `"@hookform/resolvers/zod"` (add to `peerDependencies` + `devDependencies`)
+- `zod` — import as `import * as zod from "@acmekit/deps/zod"` (NOT `from "zod"`)
+
+**Plugin dependency placement:** These packages must be in `peerDependencies` (host provides them), mirrored in `devDependencies` (for local dev). NEVER put them in only `devDependencies`.
+
 ### Prefer Shared SDK Over Raw Fetch
 
 Use `src/admin/lib/sdk.ts` for backend calls so auth, path prefixes, and route typings stay consistent:

package/dist/templates/plugin/.claude/skills/write-test/SKILL.md

@@ -15,6 +15,13 @@ Generate tests for AcmeKit plugins using `integrationTestRunner` with the correc
 - Plugin integration tests: !`ls integration-tests/plugin/*.spec.ts 2>/dev/null || echo "(none)"`
 - HTTP integration tests: !`ls integration-tests/http/*.spec.ts 2>/dev/null || echo "(none)"`
 
+## Pre-Flight Checklist (MANDATORY — do these BEFORE writing any test)
+
+1. **Build the plugin.** Run `pnpm build` (or verify `pnpm dev` is running). Stale `.acmekit/server/` causes `__joinerConfig is not a function` and missing services.
+2. **Verify jest config buckets.** Read `jest.config.js` — confirm the bucket you need exists (`integration:plugin`, `integration:http`, `integration:modules`, `unit`). If missing, add the entry and create the directory first.
+3. **Read source code under test.** Understand method signatures, return types, error handling.
+4. **Read mock interfaces.** If using auto-injected mocks, read their source to verify method names. Don't guess from real service interfaces.
+
 ## Critical Gotchas — Every Test Must Get These Right
 
 1. **Unified runner only.** `import { integrationTestRunner } from "@acmekit/test-utils"`. NEVER use `pluginIntegrationTestRunner` or `moduleIntegrationTestRunner` — those are deprecated.
@@ -26,6 +33,7 @@ Generate tests for AcmeKit plugins using `integrationTestRunner` with the correc
 7. **HTTP mode requires auth.** `mode: "plugin"` + `http: true` boots the full framework — inline JWT + client API key setup in `beforeEach`.
 8. **Axios throws on 4xx/5xx.** Use `.catch((e: any) => e)` for error assertions in HTTP tests.
 9. **MockEventBusService emit takes arrays.** In plugin container mode, `emit` receives `[{ name, data }]` (array). Real event bus uses `{ name, data }` (single object).
+10. **`pluginPath` is MANDATORY.** Always use `pluginPath: process.cwd()`. Omitting it causes `Cannot read properties of undefined`.
 
 ## Instructions
 

package/dist/templates/plugin/CLAUDE.md

@@ -8,7 +8,8 @@ You are a senior AcmeKit plugin developer. Build distributable plugins that add
 
 - Edit files in `src/types/generated/` — overwritten by `npx acmekit generate types`
 - Import from `.acmekit/types/` or `src/types/generated/` directly — use `InferTypeOf` or barrel exports
-- Import `zod`, `awilix`, or `pg` directly — use `@acmekit/framework/zod`, `@acmekit/framework/awilix`, `@acmekit/framework/pg`
+- Import `zod`, `awilix`, or `pg` directly — backend: use `@acmekit/framework/zod`, `@acmekit/framework/awilix`, `@acmekit/framework/pg`; admin UI: use `@acmekit/deps/zod`
+- Add `react-hook-form` or `@hookform/resolvers` to only `devDependencies` — they are provided by acmekit, must be in `peerDependencies` (+ `devDependencies` mirror)
 - Use string literals for container keys — use `ContainerRegistrationKeys.*` and `Modules.*`
 - Call services directly for mutations in routes — use workflows
 - Put business logic in workflow steps — steps are thin wrappers; service methods own orchestration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acmekit/acmekit",
-  "version": "2.13.86",
+  "version": "2.13.88",
   "description": "Generic application bootstrap and loaders for the AcmeKit framework",
   "main": "dist/index.js",
   "exports": {
@@ -49,45 +49,45 @@
     "test:integration": "../../node_modules/.bin/jest --passWithNoTests --forceExit --testPathPattern=\"src/.*/integration-tests/__tests__/.*\\.ts\""
   },
   "devDependencies": {
-    "@acmekit/framework": "2.13.86"
+    "@acmekit/framework": "2.13.88"
   },
   "dependencies": {
-    "@acmekit/admin-bundler": "2.13.86",
-    "@acmekit/analytics": "2.13.86",
-    "@acmekit/analytics-local": "2.13.86",
-    "@acmekit/analytics-posthog": "2.13.86",
-    "@acmekit/api-key": "2.13.86",
-    "@acmekit/auth": "2.13.86",
-    "@acmekit/auth-emailpass": "2.13.86",
-    "@acmekit/auth-github": "2.13.86",
-    "@acmekit/auth-google": "2.13.86",
-    "@acmekit/cache-inmemory": "2.13.86",
-    "@acmekit/cache-redis": "2.13.86",
-    "@acmekit/caching": "2.13.86",
-    "@acmekit/caching-redis": "2.13.86",
-    "@acmekit/core-flows": "2.13.86",
-    "@acmekit/event-bus-local": "2.13.86",
-    "@acmekit/event-bus-redis": "2.13.86",
-    "@acmekit/file": "2.13.86",
-    "@acmekit/file-local": "2.13.86",
-    "@acmekit/file-s3": "2.13.86",
-    "@acmekit/index": "2.13.86",
-    "@acmekit/link-modules": "2.13.86",
-    "@acmekit/locking": "2.13.86",
-    "@acmekit/locking-postgres": "2.13.86",
-    "@acmekit/locking-redis": "2.13.86",
-    "@acmekit/notification": "2.13.86",
-    "@acmekit/notification-local": "2.13.86",
-    "@acmekit/notification-sendgrid": "2.13.86",
-    "@acmekit/rbac": "2.13.86",
-    "@acmekit/secrets-aws": "2.13.86",
-    "@acmekit/secrets-local": "2.13.86",
-    "@acmekit/settings": "2.13.86",
-    "@acmekit/telemetry": "2.13.86",
-    "@acmekit/translation": "2.13.86",
-    "@acmekit/user": "2.13.86",
-    "@acmekit/workflow-engine-inmemory": "2.13.86",
-    "@acmekit/workflow-engine-redis": "2.13.86",
+    "@acmekit/admin-bundler": "2.13.88",
+    "@acmekit/analytics": "2.13.88",
+    "@acmekit/analytics-local": "2.13.88",
+    "@acmekit/analytics-posthog": "2.13.88",
+    "@acmekit/api-key": "2.13.88",
+    "@acmekit/auth": "2.13.88",
+    "@acmekit/auth-emailpass": "2.13.88",
+    "@acmekit/auth-github": "2.13.88",
+    "@acmekit/auth-google": "2.13.88",
+    "@acmekit/cache-inmemory": "2.13.88",
+    "@acmekit/cache-redis": "2.13.88",
+    "@acmekit/caching": "2.13.88",
+    "@acmekit/caching-redis": "2.13.88",
+    "@acmekit/core-flows": "2.13.88",
+    "@acmekit/event-bus-local": "2.13.88",
+    "@acmekit/event-bus-redis": "2.13.88",
+    "@acmekit/file": "2.13.88",
+    "@acmekit/file-local": "2.13.88",
+    "@acmekit/file-s3": "2.13.88",
+    "@acmekit/index": "2.13.88",
+    "@acmekit/link-modules": "2.13.88",
+    "@acmekit/locking": "2.13.88",
+    "@acmekit/locking-postgres": "2.13.88",
+    "@acmekit/locking-redis": "2.13.88",
+    "@acmekit/notification": "2.13.88",
+    "@acmekit/notification-local": "2.13.88",
+    "@acmekit/notification-sendgrid": "2.13.88",
+    "@acmekit/rbac": "2.13.88",
+    "@acmekit/secrets-aws": "2.13.88",
+    "@acmekit/secrets-local": "2.13.88",
+    "@acmekit/settings": "2.13.88",
+    "@acmekit/telemetry": "2.13.88",
+    "@acmekit/translation": "2.13.88",
+    "@acmekit/user": "2.13.88",
+    "@acmekit/workflow-engine-inmemory": "2.13.88",
+    "@acmekit/workflow-engine-redis": "2.13.88",
     "@inquirer/checkbox": "^2.3.11",
     "@inquirer/input": "^2.2.9",
     "boxen": "^5.0.1",
@@ -106,7 +106,7 @@
   },
   "peerDependencies": {
     "@acmekit/docs-bundler": "^2.13.42",
-    "@acmekit/framework": "2.13.86",
+    "@acmekit/framework": "2.13.88",
     "@jimsheen/yalc": "^1.2.2",
     "@swc/core": "^1.7.28",
     "posthog-node": "^5.11.0",