@nurix/etna 0.19.62 → 0.19.64

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "51ceda35d5cc",
+    "fingerprint": "6b7cd94d8ed9",
     "harnesses": {
         "apollo": {
             "plugin": "apollo",

package/data/harnesses/code/harness.json

@@ -10,5 +10,5 @@
   "seeds": [
     ".mcp.json"
   ],
-  "digest": "00ab519e0423"
+  "digest": "b7f0d55f9ba4"
 }

package/data/harnesses/delivery/harness.json

@@ -8,5 +8,5 @@
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "e35c6d22e9ba"
+  "digest": "3d15299f4b1f"
 }

package/data/harnesses/delivery/hooks/generate-ownership-index.mjs

@@ -79,9 +79,17 @@ function field(block, key) {
     const raw = m[1].trim();
     if (raw === "") {
       // A bare key may continue as an indented inline array on the next line, or a `- item` block.
+      // The array may span several lines, so join through the closing bracket before parsing —
+      // reading only the first line yields a bare "[", which parses to [] and makes the whole doc
+      // look like it owns nothing, dropping it from the index entirely.
       const next = (lines[i + 1] || "").trim();
       if (next.startsWith("[")) {
-        return parseInlineArray(next);
+        let joined = "";
+        for (let j = i + 1; j < lines.length; j++) {
+          joined += (joined ? " " : "") + lines[j].trim();
+          if (lines[j].includes("]")) break;
+        }
+        return parseInlineArray(joined);
       }
       const items = [];
       for (let j = i + 1; j < lines.length; j++) {

package/data/harnesses/etna/harness.json

@@ -8,5 +8,5 @@
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "b78faf3cf571"
+  "digest": "5ddc026fa3b1"
 }

package/data/harnesses/etna/hooks/generate-ownership-index.mjs

@@ -79,9 +79,17 @@ function field(block, key) {
     const raw = m[1].trim();
     if (raw === "") {
       // A bare key may continue as an indented inline array on the next line, or a `- item` block.
+      // The array may span several lines, so join through the closing bracket before parsing —
+      // reading only the first line yields a bare "[", which parses to [] and makes the whole doc
+      // look like it owns nothing, dropping it from the index entirely.
       const next = (lines[i + 1] || "").trim();
       if (next.startsWith("[")) {
-        return parseInlineArray(next);
+        let joined = "";
+        for (let j = i + 1; j < lines.length; j++) {
+          joined += (joined ? " " : "") + lines[j].trim();
+          if (lines[j].includes("]")) break;
+        }
+        return parseInlineArray(joined);
       }
       const items = [];
       for (let j = i + 1; j < lines.length; j++) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.62",
+    "version": "0.19.64",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "51ceda35d5cc"
+    "etnaFingerprint": "6b7cd94d8ed9"
 }

package/data/harnesses/code/rules/cloudflare.md

@@ -1,167 +0,0 @@
-# Cloudflare Worker
-
-Conventions for Cloudflare Workers — `wrangler.jsonc` setup, vars and secrets, and code shape (dispatch, errors, modules, WebSockets). Schema design doctrine is the `schema-design` skill.
-
-## 1. Project & wrangler.jsonc Setup
-
-### 1.1 Wrangler version
-
-- Use Wrangler **v4** — v3's bundled config schema is missing newer keys (e.g. `secrets_store_secrets`), so editors flag valid config as invalid.
-- **No `package.json`** (dep-free worker): use `npx wrangler@4` in every command and doc — the `@4` is the pin. Don't create a `package.json` just to record it.
-- **`package.json` exists**: pin wrangler to the exact version tested against (not `^4.0.0`), reinstall, and verify with `wrangler deploy --dry-run` before pushing.
-
-### 1.2 Config format
-
-- Use `wrangler.jsonc` (not `wrangler.toml`).
-- Include `"$schema": "node_modules/wrangler/config-schema.json"` so the editor validates against the exact installed wrangler version.
-
-### 1.3 Comments in jsonc
-
-None by default. Keep a comment only when it captures a non-obvious **WHY** — a hidden constraint, workaround, or account-specific quirk. Never narrate what a key already says.
-
-### 1.4 workers.dev URLs
-
-- Set `"workers_dev": false` once a custom domain is wired up, so the custom domain is the only entry point.
-- Pair with a `routes` entry using `custom_domain: true` so Cloudflare manages the DNS record and cert.
-
-### 1.5 Observability
-
-Default block for every Worker:
-
-```jsonc
-"observability": {
-    "logs": {
-        "enabled": false,
-        "invocation_logs": true
-    }
-}
-```
-
-`enabled: false` avoids per-log billing; `invocation_logs: true` keeps the cheap per-request audit trail. **Bootstrap override:** a new Worker (especially cron-only) runs with `enabled: true` until a few real runs look clean — with logs off, `console.log` is visible only live via `npx wrangler tail` and nothing persists after a failed run. Flip back once stable.
-
-### 1.6 Project structure & dependencies
-
-- Main entry file: `index.ts`. Reusable helpers: `helper.ts`.
-- TypeScript under `strict: true` — wrangler bundles it natively, no separate build step; a minimal `tsconfig.json` ships even in dep-free Workers.
-- Don't run `npm run build` or `npm run deploy` in examples.
-- **`package.json` / `package-lock.json` are opt-in, not default.** Create them only when code under `src/` imports an npm package at runtime — a Worker on built-in Web/Workers APIs alone needs no manifest; run wrangler, linters, and one-offs via `npx <tool>`. Add both files the moment the first real dep lands. `node_modules/` stays in `.gitignore` either way.
-
-### 1.7 Environment & configuration
-
-- Use the deployed Cloudflare URL in docs/tests, not `localhost`.
-- Prefer SQLite-based Durable Objects over in-memory-only designs; add classes under `migrations.new_sqlite_classes`.
-
-### 1.8 Cloudflare Secrets Store
-
-Use when the user mentions it. Use the same `binding` name as the `secret_name`.
-
-```jsonc
-"secrets_store_secrets": [
-    { "binding": "CLICKUP_KEY", "store_id": "792206780c0c46e8ba8ade3f21b44eac", "secret_name": "CLICKUP_KEY" }
-]
-```
-
-Access in code: `await env.CLICKUP_KEY.get()`.
-
-### 1.9 Naming
-
-- Repo/dir: `cf-<name>` (e.g. `cf-extract-design`).
-- Worker name: `<name>` — repo name minus the `cf-` prefix.
-- R2 bucket, D1 database, and KV namespace names: equal to the worker name. One name, one resource set.
-
-### 1.10 Vars & secrets
-
-**Non-secret vars live in the `vars` block in `wrangler.jsonc`** — checked in, one source of truth. Vars are configuration, not runtime state; do not move them to the dashboard. A single-tenant application Worker (one deployment — e.g. Apollo) declares them at the top level; a multi-tenant Worker declares per-tenant vars under each `env.<tenant>` block (§11).
-
-**Secrets never touch git.** Local dev: a gitignored `.dev.vars` (`KEY=VALUE` dotenv, auto-loaded by `wrangler dev`) with a committed `.dev.vars.example` listing the keys and placeholder values. Production: `wrangler secret put <NAME>`, a gitignored `.secrets` file pushed with `wrangler secret bulk .secrets` (or shipped with a deploy via `wrangler deploy --secrets-file .secrets`), or the Secrets Store (§1.8). Never log or echo a secret value.
-
-**No `keep_vars`.** Leave it unset (default `false`) — each deploy reconciles vars to exactly what the config declares. `keep_vars` only guards plaintext vars set out-of-band in the dashboard; it never touches secrets — `wrangler secret put` secrets survive every deploy regardless. Only the multi-tenant pattern sets `keep_vars: true` (§11).
-
-**Never name a deployed-value file `.env` or `.env.<anything>`** — `wrangler dev` auto-loads a root `.env` as local dev vars, so a prod-valued `.env` silently becomes the local environment on a fresh clone or in CI. Committed `*.example` files carry keys with placeholder values only.
-
-`.gitignore`: `.dev.vars`, `.secrets`, `.secrets.*`, `.env`, `.env.*`
-
-## 2. Code & Helpers
-
-- Use `generateUuidV7()` in `helper.ts` for IDs (time-sortable UUIDv7).
-- Only `await` what's needed (e.g. `request.json()`, `do.fetch(...)`).
-
-## 3. fetch() Structure
-
-`validateRequest()` first, then `switch (path)` for dispatch. Single `try/catch` wrapping the entire handler. No if-chains, no regex in fetch.
-
-```js
-export default {
-  async fetch(request, env, ctx) {
-    try {
-      const route = validateRequest(request);
-      switch (route.path) {
-        case "monitors":
-          return await handleMonitors({ ...route, env, ctx });
-        default:
-          throw { code: 404, message: "Route not found" };
-      }
-    } catch (error) {
-      console.error("Unhandled error in fetch()", error);
-      return createErrorResponse(
-        error.message || "Internal server error",
-        error.code || 500,
-      );
-    }
-  },
-};
-```
-
-No nested `try/catch` except around WebSocket `send`/`close` (see §9).
-
-## 4. validateRequest()
-
-Lives in `helper.ts`. Parses the URL in one place and returns `{ path, method, query, resourceId, subPath }`; throws `{ code: 400 }` when a path requires a resource ID and none is present.
-
-## 5. Validation
-
-Fail fast with thrown `{ code, message }` (`400` bad input, `401` missing/invalid auth). Validate required fields explicitly — no optional chaining for required fields.
-
-## 6. Errors & Responses
-
-- Throw structured errors: `{ code, message }`. Always `console.error()` with context (path, user, etc.). No empty catch blocks.
-- Response envelope `{ status: 1|0, message, data }` — the shared cross-service contract.
-- `createResponse(data, message, code)` in `helper.ts` bakes CORS in, returns a null body for 204/304, and uses proper HTTP codes; `createErrorResponse(message, code)` delegates to it.
-- CORS is passive: a `CORS_HEADERS` const in `helper.ts`, spread into `createResponse()` — no explicit OPTIONS handler, no wrapper functions. Origin-restricted CORS builds the headers from an allowlist (plus `localhost` in dev), still inside `createResponse()`.
-
-## 7. Handler Signatures
-
-Single destructured object — never positional args. Compose by spreading route with env/ctx: `handleGetStats({ request, env, resourceId })`, not `handleGetStats(request, id, env)`.
-
-## 8. Module Structure
-
-Feature-based folders with `handle.ts` + `helper.ts` pairs. `index.ts` only does dispatch.
-
-| Path | Role |
-| --- | --- |
-| `src/index.ts` | Entry point — dispatch only |
-| `src/helper.ts` | Shared CORS, responses, validation, utilities |
-| `src/database.ts` | Shared D1 queries |
-| `src/<feature>/handle.ts` | Route handlers |
-| `src/<feature>/helper.ts` | Feature-specific helpers & DB ops |
-
-## 9. WebSockets
-
-Standard `WebSocketPair` handshake (`server.accept()`, return 101 with `webSocket: client`). Check `readyState === WebSocket.OPEN` before sending. The only acceptable nested `try/catch`: wrap `send`; in its catch, `close(1011)` inside a bare inner try, then evict the session.
-
-## 10. D1 Schema
-
-Follows the shared database naming and column-type vocabulary; what earns a table and the rest of the design doctrine is the `schema-design` skill.
-
-## 11. Multi-tenant Workers (native environments)
-
-Rare — only when **one Worker codebase ships as several independent tenants** (separate Workers, domains, and data stores from a single `src/`, e.g. `~/dev/auth` → `auth-nuplay`, `auth-nustack`). Use **native wrangler environments**, never one Worker that switches tenant at runtime. For a single-tenant application Worker, §1.10 applies and this section does not.
-
-- **One config, `env.<tenant>` blocks.** The top-level block is **local dev** (`wrangler dev`): a `*-dev` name and placeholder D1/KV ids, simulated locally. Each `env.<tenant>` block is **one production tenant**; deploy it with `wrangler deploy --env <tenant>`.
-- **Named environments never inherit** `vars` / `d1_databases` / `kv_namespaces` / `routes` / `secrets_store_secrets` / `assets` from the top level — **each `env.<tenant>` declares them in full**. Dropping a binding from an env block disables that capability for that one tenant.
-- **Per-tenant non-secret vars live in `env.<tenant>.vars`** — still checked in; one file holds every tenant's config side by side.
-- **Local-dev vars** come from a gitignored `.vars.local`, injected as `--var` by the dev script (the top-level block carries no in-config `vars`).
-- **Per-tenant secrets, never in git** — `wrangler secret put <NAME> --env <tenant>`, or a gitignored per-tenant `.secrets` (e.g. `worker/tenants/<tenant>/.secrets`) pushed with `wrangler secret bulk --env <tenant>`, plus a committed `.secrets.example`. Secrets Store bindings are declared inside each env block.
-- **`keep_vars: true`** (top level) keeps a per-tenant deploy **additive**: tenants inject their non-secret vars via `--var` (or the dashboard), and without it a deploy would wipe them. On secrets it changes nothing (§1.10).
-
-`.gitignore`: `.vars.local`, `.secrets`, `.secrets.*`, `.env`, `.env.*`