@bonesofspring/ai-rules 0.2.13 → 0.2.14

package/presets/cursor/svelte/rules/post-change-lint.mdc

@@ -0,0 +1,42 @@
+---
+description: Прогон ESLint, Stylelint и svelte-check после изменений кода. Requestable — подгружать после правок src/**; агенты обязаны запускать после code edits.
+alwaysApply: false
+---
+
+# Линтеры после изменений кода
+
+**Requestable, но обязателен при изменениях кода:** правило не always-on (экономия контекста); после правок исходников агент **должен** следовать этому чеклисту.
+
+## Когда применять
+
+После **любого** изменения исходников в `src/routes/**`, `src/lib/**`, `src/hooks.*.ts`, `src/params/**`, `tests/**` (Svelte/TS/JS, CSS, `<style>`).
+
+Исключения: правки документации, конфигов CI, `.cursor/rules/**`, если исполняемый код приложения не менялся.
+
+**Pipeline exception:** если задача идёт через agent team и следующий шаг — `build-verifier`, developer может ограничиться lint/check **изменённых файлов**; полный прогон — обязанность `build-verifier`. В single-agent режиме (без pipeline) — всегда полный прогон.
+
+## Обязательные команды
+
+Рабочий каталог — **корень SvelteKit** (где `svelte.config.*`). Менеджер пакетов — **`package-manager`**.
+
+1. **`lint:js`** — полный ESLint по проекту (`eslint-plugin-svelte` when configured).
+2. **`lint:css`** — полный Stylelint.
+
+Точечный lint на один файл **не заменяет** полный прогон перед завершением задачи (кроме pipeline exception выше).
+
+## Алгоритм
+
+1. Завершить правки кода.
+2. Запустить **`lint:js`** и **`lint:css`** из корня SvelteKit.
+3. Проанализировать весь вывод; исправить errors/warnings в изменённых файлах; для Stylelint — autofix если доступен.
+4. Повторить до exit code 0 или зафиксировать блокер в ответе пользователю.
+5. **`check`** (`svelte-kit sync && svelte-check`) при изменениях TypeScript / `.svelte` / SvelteKit config. CI-уровень: **`lint`** (= `lint:js` + `lint:css` + `check`).
+
+**Имя скрипта type/svelte gate — `check`**, не next-овский `type-check` и не nuxt-овский `typecheck`. Бинарь — `svelte-check`; package script — **`check`**.
+
+## Что исправлять
+
+- **Errors** — обязательно.
+- **Warnings** — обязательно в файлах задачи; вне скоупа — упомянуть, если мешают нулевому exit code.
+
+Конфиги: `eslint.config.js` / `eslint.config.mjs` / `.eslintrc*`, `.stylelintrc*` (порядок CSS — `css-property-order-stylelint`).

package/presets/cursor/svelte/rules/preset-layering.mdc

@@ -0,0 +1,37 @@
+---
+description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-layering.md -->
+
+
+# Preset layering
+
+Правила для **авторов пресетов** (`packages/ai-rules/presets/**`). Не always-on в consumer apps.
+
+## Слои
+
+| Слой | Где | Что класть |
+|------|-----|------------|
+| **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; без frontmatter; без путей `app/**`, `Features/**`, Playwright, xcodebuild |
+| **Stack** | `presets/{cursor\|claude}/<stack>/` | Domain/tooling, always-on trio стека, stack examples в **Stack notes** |
+| **Platform** | Cursor `.mdc` / Claude `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
+
+## Куда класть новое правило
+
+1. Общие принципы для всех стеков → **core** + адаптеры с `<!-- shared-core: … -->`.
+2. Только один из installable стеков (`next` / `nuxt` / `svelte` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (не в `_shared`).
+3. Только Cursor или только Claude packaging → platform artifact / frontmatter, не дублировать семантику.
+
+## SoT
+
+- Packages path — SoT; root `.cursor/` — dogfood sync.
+- Per stack: **Cursor** `presets/cursor/<stack>/` → Claude twin same PR.
+- `_shared` **не** `--preset` и не копируется CLI `init`.
+
+См. также: `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`.

package/presets/cursor/svelte/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,84 @@
+---
+description: Preset authoring: forbid cross-stack agent/path leakage in hooks and agents.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+
+# Preset no cross-stack leakage
+
+Запрет протекания stack-specific имён, путей и handoff stems между пресетами.
+
+## Principles
+
+- `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `nuxt` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `svelte` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in nuxt hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Nuxt app work
+- Frontend profile mirrors `next`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in svelte hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for SvelteKit app work
+- Frontend profile mirrors `next` / `nuxt`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `nuxt`, `svelte`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/svelte/rules/preset-pr-checklist.mdc

@@ -0,0 +1,40 @@
+---
+description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+
+# Preset PR checklist
+
+Чеклист для PR, затрагивающих `packages/ai-rules/presets/**` (и dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** правки в `packages/…` (не только root `.cursor/`)
+- [ ] **Core:** если менялся `_shared/core/**` — обновлены все `<!-- shared-core: … -->` consumers (или documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, nuxt, svelte, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — см. `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table актуален
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** нет чужих stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/svelte/rules/preset-token-budget.mdc

@@ -0,0 +1,42 @@
+---
+description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+
+# Preset token budget
+
+Инварианты загрузки правил в **установленном** пресете (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **ровно 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (где задокументировано): ≤140 строк суммарно (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/svelte/rules/preset-twin-sync.mdc

@@ -0,0 +1,55 @@
+---
+description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `nuxt` | `presets/cursor/nuxt/rules/*.mdc` | `presets/claude/nuxt/rules/<topic>/` | **Required** in `claude/nuxt/rules/README.md` |
+| `svelte` | `presets/cursor/svelte/rules/*.mdc` | `presets/claude/svelte/rules/<topic>/` | **Required** in `claude/svelte/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+| `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **nuxt:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **svelte:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+- **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/svelte/rules/public-imports.mdc

@@ -0,0 +1,45 @@
+---
+description: Импорт доменных типов и API только через публичные barrels ($lib/types, $lib/api)
+globs:
+  - src/lib/components/**/*
+  - src/lib/stores/**/*
+  - src/lib/**/*
+  - src/routes/**/*
+  - src/lib/types/**/*
+  - src/lib/api/**/*
+alwaysApply: false
+impact: HIGH
+---
+
+# Публичные импорты (`$lib/types`, `$lib/api`)
+
+Preferred alias: **`$lib`**. Accept **`@/`** if consumer vite/tsconfig maps it. Respect `$app/*` / `$env/*` — do not invent modules.
+
+## `$lib/types` (or `@/types`)
+
+- Публичный API типов — barrel `src/lib/types/index.ts`; снаружи слоя — только `$lib/types` / `@/types`.
+- Запрещено обходить barrel deep-импортами внутренних файлов типов (кроме project enum convention if present).
+- Внутри `src/lib/types/**` — относительные импорты.
+
+```typescript
+// ✅
+import type { TUserProfile } from '$lib/types'
+
+// ❌
+import type { TUserProfile } from '$lib/types/User.types'
+```
+
+## `$lib/api` (or `@/api`)
+
+- Публичный API — barrel `src/lib/api/index.ts`. Вне `src/lib/api/**` — только `$lib/api` / `@/api`.
+- Внутри слоя — относительные импорты и `$lib/api/services/**` / `$lib/clients/**` as neighbors do.
+
+```typescript
+// ✅
+import { ordersApi } from '$lib/api'
+
+// ❌
+import { ordersApi } from '$lib/api/services/orders/orders.service'
+```
+
+Новые публичные символы — реэкспорт в barrel по **`layer-barrel-exports`**.

package/presets/cursor/svelte/rules/reference-features.mdc

@@ -0,0 +1,51 @@
+---
+description: Эталонные фичи репозитория — копировать структуру при реализации новых задач. Заполните пути после init в целевом репо.
+globs:
+  - src/lib/components/**/*
+  - src/lib/stores/**/*
+  - src/lib/api/**/*
+  - src/lib/types/**/*
+  - src/routes/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Эталонные фичи (reference features)
+
+## Stack notes
+
+Перед реализацией найди фичу того же типа и **повтори её структуру**, не изобретая новую организацию файлов.
+
+Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README.md) · [Preset contribution guide](../../../../docs/PRESET-CONTRIBUTION.md).
+
+## Таблица эталонов
+
+Замени **TBD** на реальные пути после договорённости в команде (или при `ai-rules init` в целевом репо):
+
+| Слой | Эталон | Что копировать |
+|------|--------|----------------|
+| UI route / page | **TBD** `src/routes/<example>/` | `+page.svelte`, `+page.ts`, layout nesting |
+| UI component | **TBD** `src/lib/components/<Example>/` | `.svelte`, styles, barrel |
+| Store | **TBD** `src/lib/stores/<example>.ts` | writable/derived or runes module, actions |
+| API service | **TBD** `src/lib/api/services/<example>/` | service, mappers, barrel |
+| Types module | **TBD** `src/lib/types/<example>/` | domain types, JSDoc, barrel export |
+| Unit tests | **TBD** рядом с эталонным mapper/service | `*.spec.ts`, describe/it naming |
+| E2E area | **TBD** `tests/e2e/<Area>/` | `*.cases.md`, page objects, `_shared/` |
+
+## Как использовать
+
+1. Определи затронутые слои из `decomposition.md` или задачи.
+2. Открой эталон из таблицы (после заполнения путей).
+3. Зеркаль именование, порядок файлов, паттерны импортов и тестов.
+4. Если эталона нет — выбери **самую близкую** существующую фичу того же слоя и зафиксируй выбор в handoff.
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Связанные правила
+
+- `code-quality-and-refactoring.mdc` — повторять паттерны, не deep-import.
+- `feature-delivery-workflow.mdc` — порядок слоёв.
+- skill `feature-delivery` — end-to-end сценарий.

package/presets/cursor/svelte/rules/security-sveltekit.mdc

@@ -0,0 +1,38 @@
+---
+description: SvelteKit security — env, SSR secrets, CSRF, XSS, hooks, +server
+globs: src/routes/**/*,src/hooks.server.ts,src/hooks.client.ts,src/lib/**/*
+alwaysApply: false
+---
+
+# Security (SvelteKit)
+
+## Secrets & env
+
+- Private secrets: `$env/static/private` / server-only modules — **never** import into client `.svelte` / universal modules that ship to browser.
+- Public config: `$env/static/public` (prefixed per project convention).
+- Do not commit `.env` with secrets; do not log tokens.
+
+## Server boundaries
+
+- `+server.ts`, `+page.server.ts`, `hooks.server.ts` may touch private env and privileged backends.
+- Do not import `.svelte` UI into server handlers by default.
+- Prefer `$lib/api` for domain client services; keep BFF thin.
+
+## XSS / HTML
+
+- Prefer text interpolation; `{@html …}` only with sanitized/trusted content.
+- Follow `svelte-a11y-coding` and eslint-plugin-svelte a11y where configured.
+
+## CSRF / forms
+
+- Prefer Kit form actions + progressive enhancement patterns already in the repo.
+- Validate/authorize on the server; never trust client-only checks for authz.
+
+## HTTP client
+
+- Use project `fetch` wrapper (`http-client`); forward cookies via `load`/`event.fetch` for same-origin SSR when required.
+- Do not put credentials in public env or client bundles.
+
+## Agent discipline
+
+- If unsure whether a module is server-only, check filename (`.server.ts`), imports, and siblings — mark `// VERIFY` rather than guessing.

package/presets/cursor/svelte/rules/store-svelte.mdc

@@ -0,0 +1,66 @@
+---
+description: Svelte stores и runes — клиентское состояние (SvelteKit)
+globs: src/lib/stores/**/*.ts,src/lib/stores/**/*.js,**/*.svelte.ts
+alwaysApply: false
+impact: HIGH
+---
+
+# Общие принципы
+
+- **Primary (Svelte 5):** runes в `.svelte` / `.svelte.ts` — `$state`, `$derived`, `$effect`, `$props`, `$bindable` as applicable.
+- **Secondary (legacy / shared):** `writable` / `derived` / `readable` из `svelte/store` когда так делают соседи или для shared state вне runes — “follow neighbors”.
+- В store / shared modules хранить **доменные модели**, не сырые DTO.
+- Маппинг DTO → domain — в `src/lib/api/**` (или server mappers) **до** записи в store/runes.
+- UI-only флаги можно держать локально в компоненте (`$state`), если так принято в репо.
+
+# Запрещено в этом пресете
+
+- RTK / Redux: `createSlice`, `createAsyncThunk`, RTK Query, `useDispatch` / `useSelector`, stem `store-rtk`.
+- Pinia / Vuex: `defineStore`, stem `store-pinia`.
+- Сырой `fetch` из store в обход `$lib/api` сервисов (кроме узких documented исключений репо).
+- Импорт `$state` / runes из выдуманных пакетов — только Svelte runtime / documented APIs для installed major.
+
+# Структура
+
+- Доменный модуль — файл в `src/lib/stores/**` (например `src/lib/stores/profile.ts` или `profile.svelte.ts`).
+- Export явных store factories / rune modules; имена как у соседей.
+- Actions / функции вызывают сервисы из `$lib/api` (`public-imports`).
+
+# Асинхронность
+
+```ts
+// Incorrect — raw HTTP + DTO in state
+import { writable } from 'svelte/store'
+export const profile = writable(null)
+export async function loadProfile() {
+  profile.set(await fetch('/api/profile').then((r) => r.json()))
+}
+
+// Correct
+import { writable } from 'svelte/store'
+import { profileApi } from '$lib/api'
+import type { Profile } from '$lib/types'
+
+export const profile = writable<Profile | null>(null)
+
+export async function loadProfile() {
+  profile.set(await profileApi.getProfile())
+}
+```
+
+# Типизация и ошибки
+
+- Доменные типы из `$lib/types` (или `@/types` если aliased).
+- Ошибки транспорта — контракты из типов / принятый класс клиента (`http-client`).
+- В UI: `$profile` / subscribe / `$derived` — follow neighbors.
+
+# Тестирование
+
+- Покрывать важные stores / rune modules (инициализация, переходы, actions с моком API).
+- Unit: Vitest; мокать `$lib/api` сервисы.
+
+# Требование к агенту
+
+- Не класть HTTP/transport в компоненты.
+- Строго типизировать state/actions.
+- Следовать стилю соседних stores / runes modules.

package/presets/cursor/svelte/rules/svelte-a11y-coding.mdc

@@ -0,0 +1,27 @@
+---
+description: Accessibility conventions for Svelte components and routes
+globs: src/lib/components/**/*,src/routes/**/*
+alwaysApply: false
+---
+
+# Svelte a11y coding
+
+- Prefer semantic HTML (`button`, `a`, `label`, landmarks) over clickable `div`/`span`.
+- Interactive elements need keyboard support and visible focus — follow neighbors and design system.
+- Images: meaningful `alt` (or empty alt for decorative).
+- Forms: associate labels; surface errors accessibly.
+- Respect `eslint-plugin-svelte` a11y rules when configured; do not blanket-disable without why.
+- Dynamic UI (dialogs, menus): focus trap / restore patterns already used in the repo — do not invent a second a11y stack.
+- Pair with `svelte-ui` and `architecture-boundaries-ui`.
+
+## Incorrect
+
+```svelte
+<div onclick={submit}>Save</div>
+```
+
+## Correct
+
+```svelte
+<button type="submit">Save</button>
+```

package/presets/cursor/svelte/rules/svelte-app-core.mdc

@@ -0,0 +1,45 @@
+---
+description: Базовые принципы, стек и архитектура SvelteKit приложения (preset)
+alwaysApply: true
+---
+
+# Стек и окружение
+
+Конкретные версии — **из `package.json` и конфигов целевого репозитория**. Рамка preset: SvelteKit, Svelte 5 (primary), TypeScript; runner/e2e/mocks/UI/APM — как заведено в репо.
+
+# Структура проекта
+
+| Путь | Назначение |
+|------|------------|
+| `src/routes/**` | Routes, layouts, load, form actions (`+page`, `+layout`, `+server`) |
+| `src/lib/components/**` | UI components (`.svelte`) |
+| `src/lib/**` | Facades / utils (no Vue-style `composables/` tree) |
+| `src/lib/stores/**` | Svelte stores + shared runes modules |
+| `src/lib/api/**` | Client services + mappers (barrel) |
+| `src/lib/clients/**` | HTTP (`fetch` wrapper) |
+| `src/hooks.server.ts` / `src/hooks.client.ts` | App hooks |
+| `src/lib/types/**` | Domain types (barrel) |
+| `tests/e2e/**` | Playwright e2e |
+
+**Aliases:** prefer `$lib`; respect `$app/*` / `$env/*` (не изобретать символы); accept `@/` если настроен. Scripts cwd — **корень SvelteKit** (где `svelte.config.*`), не Next-обёртка `app/`.
+
+# Архитектурные слои
+
+| Слой | Каталог | Детали |
+|------|---------|--------|
+| UI | `src/routes/**`, `src/lib/components/**` | `svelte-ui`, `architecture-boundaries-ui` |
+| Facades | `src/lib/**` | thin orchestration; no raw HTTP |
+| Store | `src/lib/stores/**` | `store-svelte` — writable/derived/readable + runes |
+| API | `src/lib/api/**` | `api-services`, `http-client` |
+| HTTP | `src/lib/clients/**` | wrap `fetch` |
+| Server | `+server.ts`, hooks | `security-sveltekit`; not a substitute for `src/lib/api/**` |
+| Types | `src/lib/types/**` | `public-imports`, `types-jsdoc` |
+
+Границы — **`architecture-boundaries`**. Импорты `$lib/types`, `$lib/api` (или `@/…` если aliased) — **`public-imports`**. **Запрещено:** RTK / Pinia / stems `store-rtk` / `store-pinia`, React/RSC, Vue/Nuxt defaults, пути `app/src/**` / `pages/**` / `composables/**` как канон.
+
+# Работа агента
+
+- Архитектура и импорты: `architecture-boundaries`, `public-imports`
+- Фичи: `feature-delivery-workflow` + skill `feature-delivery`
+- После правок: **вызвать** `post-change-lint` (requestable); менеджер пакетов: `package-manager`
+- Копировать паттерны соседей; предпочитать `unknown` вместо `any`

package/presets/cursor/svelte/rules/svelte-script-conventions.mdc

@@ -0,0 +1,33 @@
+---
+description: Svelte script conventions — lang=ts, runes primary, follow neighbors
+globs: "**/*.{svelte,ts}"
+alwaysApply: false
+---
+
+# Svelte script conventions
+
+- In `.svelte`: prefer `<script lang="ts">` (or project dual-script pattern if neighbors use it).
+- **Svelte 5 primary:** `$state` / `$derived` / `$effect` / `$props` / snippets for new code.
+- **Legacy secondary:** `svelte/store` writable/derived when neighbors use them — do not rewrite unrelated modules to runes in a drive-by.
+- Keep `<script>` focused: UI bindings + thin orchestration; HTTP only via `$lib/api` / store actions.
+- Prefer `unknown` over `any`; narrow before use.
+- Do not invent Options-API / Vue `<script setup>` patterns in this preset.
+- Arrow vs function: follow local neighbors; no blanket rewrite.
+
+## Incorrect
+
+```svelte
+<script>
+  // no lang=ts in a TS codebase; Vue setup APIs
+  import { ref } from 'vue'
+  const count = ref(0)
+</script>
+```
+
+## Correct
+
+```svelte
+<script lang="ts">
+  let count = $state(0)
+</script>
+```