@astram/guide 0.2.3 → 0.2.4

package/CAPABILITIES.md

@@ -142,7 +142,9 @@ imports: [
   `server/eslint.config.mjs` fails lint on driver imports, raw pools, `.query()` and the
   framework's internal DB exports anywhere in `src/**` except `app.module.ts` and `main.ts`, and on
   uuid-named route/body inputs read without `UuidPipe` / `uuidField` (`@astram/guard`). A lint
-  rule is a backstop, not a sandbox: do not go around it.
+  rule is a backstop, not a sandbox: do not go around it. The uuid check matches names only
+  (`id`, `uuid`, `…Id(s)`, `…Uuid(s)`): it is a nudge, not a guarantee, so put `UuidPipe` on
+  every uuid route param and a uuid helper on every uuid body/query field whatever its name.
 - **Gap signal** — an unsupported field type or operation throws `CapabilityNotSupportedError`
   (a Rule-4 STOP). Field types this version: `string`, `number`, `boolean`, `uuid`, `timestamp`,
   `json`.

package/FRAMEWORK_RULES.md

@@ -77,7 +77,11 @@ correctly.
 answer 400 for anything that is not a strict uuid and hand you the canonical lower-case
 form. The database matches uuids ignoring case, trailing spaces and character width, so
 a raw `"<id> "` reaches the row while your exact checks in code miss it. The lint wall
-flags uuid-named inputs (`id`, `uuid`, `…Id(s)`, `…Uuid(s)`) read without them.
+flags uuid-named inputs (`id`, `uuid`, `…Id(s)`, `…Uuid(s)`) read without them, but it is a
+name-based nudge, not a guarantee: a uuid under another name (`@Param('target')`), a
+destructured body, a body bound to another variable name, a value read off `req` or a param
+given any other pipe passes lint unchecked. Apply the
+pipe or helper to every uuid input whatever its name; a clean lint run proves nothing more.
 
 ## 4. When the framework can't do it: STOP and FLAG the gap — do NOT work around it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",