@bonesofspring/ai-rules 0.2.13 → 0.2.15

package/presets/claude/svelte/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **svelte** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/claude/svelte/hooks/examples/format-edited.example.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Optional: format/lint edited JS/TS/Svelte at SvelteKit project root after save.
+# NOT in default hooks.json. Cwd: directory with svelte.config.* (not Next-style app/).
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT" 2>/dev/null || exit 0
+[[ -f svelte.config.js || -f svelte.config.ts || -f svelte.config.mjs ]] || exit 0
+# Prefer project scripts; adjust names to match package.json (see package-manager).
+yarn lint --fix 2>/dev/null \
+  || yarn eslint --fix . 2>/dev/null \
+  || yarn check 2>/dev/null \
+  || true
+exit 0

package/presets/claude/svelte/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/claude/svelte/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Optional: scoped unit tests / check at SvelteKit project root.
+# NOT in default hooks.json. No Playwright here.
+# Cwd: directory with svelte.config.* (not Next-style app/).
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT" 2>/dev/null || exit 0
+[[ -f svelte.config.js || -f svelte.config.ts || -f svelte.config.mjs ]] || exit 0
+# Prefer Vitest related/run; fall back to package `test` / `check` (see package-manager).
+yarn vitest related --run --passWithNoTests 2>/dev/null \
+  || yarn test --run --passWithNoTests 2>/dev/null \
+  || yarn check 2>/dev/null \
+  || true
+exit 0

package/presets/claude/svelte/hooks/guard-shell-command.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Claude projects using this preset.
+
+set -euo pipefail
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/claude/svelte/mcp.json

@@ -0,0 +1,20 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp"]
+    },
+    "playwright-test": {
+      "command": "npx",
+      "args": ["-y", "@playwright/mcp@latest"]
+    },
+    "chrome-devtools": {
+      "command": "npx",
+      "args": ["-y", "chrome-devtools-mcp@latest"]
+    },
+    "figma": {
+      "type": "http",
+      "url": "https://mcp.figma.com/mcp"
+    }
+  }
+}

package/presets/claude/svelte/rules/README.md

@@ -0,0 +1,90 @@
+# `.claude/rules` (preset svelte)
+
+In Claude Code all `.md` under `rules/` are **discovered recursively**. Bodies are **derived** from Cursor SoT; indexes are not a second SoT.
+
+## SoT sync
+
+| Principle | Detail |
+|-----------|--------|
+| **SoT** | `presets/cursor/svelte/rules/*.mdc` — edit here first |
+| **Derive** | Claude topic `.md` = body + `paths:` (from Cursor `globs:` / requestable triggers) |
+| **Drop** | Cursor-only keys (`alwaysApply`); keep short `description` |
+| **Checklist** | change Cursor → update Claude twin **same PR** (**FAIL** if missing — includes `svelte`; see `preset-twin-sync` / build-verifier) |
+| **Shared core** | `presets/_shared/core/**` — see `<!-- shared-core: … -->` markers; taxonomy in `_shared/README.md` |
+
+## Loading strategy
+
+- **Session start (no `paths:`):** exactly **3** — `svelte-app-core`, `package-manager`, `code-quality`
+- **On-demand (`paths:` or via commands):** `post-change-lint`, `security-sveltekit`, architecture, UI, tests, `svelte-sveltekit-anti-hallucination`, **preset-*** meta, …
+- **Skills:** `feature-delivery`, `svelte-performance`, `code-review`, …
+
+## Cursor → Claude mapping
+
+| Cursor `.mdc` (SoT) | Claude topic |
+|---------------------|--------------|
+| `svelte-app-core.mdc` | `stack/svelte-app-core.md` |
+| `package-manager.mdc` | `tooling-and-review/package-manager.md` |
+| `code-quality-and-refactoring.mdc` | `tooling-and-review/code-quality.md` |
+| `anti-sycophancy-discipline.mdc` | `tooling-and-review/anti-sycophancy-discipline.md` |
+| `svelte-sveltekit-anti-hallucination.mdc` | `anti-hallucination/svelte-sveltekit-anti-hallucination.md` |
+| `design-guidance.mdc` | `tooling-and-review/design-guidance.md` |
+| `sveltekit-routing.mdc` | `stack/sveltekit-routing.md` |
+| `svelte-script-conventions.mdc` | `stack/svelte-script-conventions.md` |
+| `types-jsdoc.mdc` | `stack/types-jsdoc.md` |
+| `no-type-assertion-as-import-export.mdc` | `stack/no-type-assertion.md` |
+| `navigation-router-stack.mdc` | `stack/navigation-router.md` |
+| `navigation-router-ui.mdc` | `stack/navigation-router-ui.md` |
+| `architecture-boundaries.mdc` | `architecture/architecture-boundaries.md` |
+| `architecture-boundaries-ui.mdc` | `architecture/architecture-boundaries-ui.md` |
+| `feature-delivery-workflow.mdc` | `architecture/feature-delivery-workflow.md` |
+| `reference-features.mdc` | `architecture/reference-features.md` |
+| `public-imports.mdc` | `architecture/public-imports.md` |
+| `layer-barrel-exports.mdc` | `architecture/layer-barrel-exports.md` |
+| `api-services.mdc` | `api-and-data/api-services.md` |
+| `http-client.mdc` | `api-and-data/http-client.md` |
+| `store-svelte.mdc` | `api-and-data/store-svelte.md` |
+| `svelte-ui.mdc` | `ui-and-accessibility/svelte-ui.md` |
+| `svelte-a11y-coding.mdc` | `ui-and-accessibility/svelte-a11y-coding.md` |
+| `no-rest-props-spread.mdc` | `ui-and-accessibility/no-rest-props-spread.md` |
+| `css-property-order-stylelint.mdc` | `ui-and-accessibility/css-property-order.md` |
+| `tests-unit.mdc` | `testing/tests-unit.md` |
+| `tests-e2e-structure.mdc` | `testing/tests-e2e-structure.md` |
+| `playwright-agents.mdc` | `testing/playwright-agents.md` |
+| `post-change-lint.mdc` | `tooling-and-review/post-change-lint.md` |
+| `code-review-mr.mdc` | `tooling-and-review/code-review-mr.md` |
+| `security-sveltekit.mdc` | `tooling-and-review/security-sveltekit.md` |
+| `agent-team-intake.mdc` | `tooling-and-review/agent-team-intake.md` |
+| `agent-team-orchestrator.mdc` | `tooling-and-review/agent-team-orchestrator.md` |
+| `technical-retro.mdc` | `tooling-and-review/technical-retro.md` |
+| `preset-layering.mdc` | `tooling-and-review/preset-layering.md` |
+| `preset-twin-sync.mdc` | `tooling-and-review/preset-twin-sync.md` |
+| `preset-token-budget.mdc` | `tooling-and-review/preset-token-budget.md` |
+| `preset-pr-checklist.mdc` | `tooling-and-review/preset-pr-checklist.md` |
+| `preset-no-cross-stack-leakage.mdc` | `tooling-and-review/preset-no-cross-stack-leakage.md` |
+
+## Core → stack mapping
+
+| Shared core | Cursor adapter | Notes |
+|-------------|----------------|-------|
+| `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` / `code-quality.md` | + Stack notes (ESLint/Svelte/CSS) |
+| `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | requestable |
+| `quality/design-guidance.md` | `design-guidance.mdc` | requestable |
+| `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | Roles in Stack notes |
+| `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | thin alias |
+| `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | SvelteKit layer checklist |
+| `architecture/reference-features.template.md` | `reference-features.mdc` | path table |
+| `review/code-review-mr.md` | `code-review-mr.mdc` | SvelteKit checklist refs |
+| `review/technical-retro.md` | `technical-retro.mdc` | thin alias |
+| `meta/preset-*.md` | `preset-*.mdc` | author globs only |
+
+## Folders
+
+| Folder | Contents |
+|--------|----------|
+| `stack/` | app-core, routing, script conventions, types |
+| `architecture/` | boundaries, public imports, feature delivery |
+| `api-and-data/` | store-svelte, http-client, api-services |
+| `ui-and-accessibility/` | svelte-ui, a11y, rest-props, css order |
+| `testing/` | unit, e2e, playwright agents |
+| `tooling-and-review/` | lint, security, agent-team, preset meta |
+| `anti-hallucination/` | svelte-sveltekit-anti-hallucination |

package/presets/claude/svelte/rules/anti-hallucination/svelte-sveltekit-anti-hallucination.md

@@ -0,0 +1,71 @@
+---
+description: Svelte/SvelteKit anti-hallucination banlist — phantom imports, load/server APIs, stores/runes
+paths:
+  - "**/*.{svelte,ts,js}"
+  - src/routes/**/*
+  - src/lib/**/*
+---
+
+# Svelte / SvelteKit anti-hallucination
+
+These rows **OVERRIDE** generation for the listed patterns. Before inventing an import, load helper, or store API: verify against `package.json` (installed majors), `svelte.config.*`, and sibling files. If unsure, mark `// VERIFY: lib.symbol @ version` and surface the uncertainty — do not silently stub.
+
+## 1. Phantom `$app/*` / Kit modules
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented `$app/foo`, `$app/router`, `$app/auth` | Real `$app/navigation`, `$app/stores`, `$app/forms`, `$app/environment`, `$app/paths`, `$app/state` **for installed major** |
+| Importing Next `next/navigation` / `next/link` | `$app/navigation`, `<a href>` |
+| `navigateTo`, `<NuxtLink>`, `#imports` auto-import phantoms | Kit APIs + explicit imports that exist in repo |
+| Invented `@sveltejs/kit` helpers not in docs/lockfile | Documented Kit exports for installed version |
+
+## 2. Load / page data signatures
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Invented `PageLoad` / `LayoutServerLoad` shapes from blogs | Types from `./$types` generated for the route; match siblings |
+| Returning random keys without `data` contract | Follow existing `+page(.server).ts` return shapes |
+| Calling React `getServerSideProps` / Nuxt `useAsyncData` in Kit | `load` / form actions / `$lib/api` |
+
+## 3. Form actions / enhance
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Phantom `enhance` option bags siblings never use | `$app/forms` `enhance` patterns from neighbors + Kit docs |
+| Invented `fail` / `redirect` import paths | `@sveltejs/kit` exports verified for major |
+| Posting secrets from client form without server action | `+page.server.ts` actions + `$env` discipline |
+
+## 4. `$env/*` misuse
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| `$env/static/private` / private dynamic env in `.svelte` client | Private env only in `.server.ts` / hooks / `+server.ts` |
+| Invented `$env/secret` | `$env/static/public`, `$env/static/private`, `$env/dynamic/*` as documented |
+
+## 5. Runes vs stores
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| `import { $state } from 'svelte/store'` (wrong) | Runes are language/runtime — follow Svelte 5 docs / neighbors |
+| Pinia `defineStore` / RTK `createSlice` | `store-svelte` — writable/derived/readable or runes modules |
+| Invented `createRuneStore` helpers | Patterns already in `src/lib/stores/**` |
+
+## 6. Cross-stack APIs (banned as defaults)
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| React hooks (`useEffect`, `useState` from `react`) | Svelte reactivity / runes / stores |
+| RSC / `next/navigation` / `next/image` | Kit routes + `$app/*` |
+| Vue/Nuxt: `ref`, `defineStore`, `useFetch`, `navigateTo` | Svelte / Kit equivalents above |
+
+## 7. Paths / gates / spreads
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| E2E under `app/__tests__/e2e` | `tests/e2e/**` |
+| Required script named `typecheck` / `type-check` | Package script **`check`** (`svelte-kit sync && svelte-check`) |
+| Unlimited `{...props}` / `$$restProps` as default | Explicit props (`no-rest-props-spread`) |
+| Server-only modules imported into client components | Keep private env / Node APIs in `.server.ts` |
+| Vue-style auto-import of missing symbols | Explicit `$lib` / `$app` imports that exist |
+
+When a row conflicts with a verified sibling pattern in this repo, **the sibling wins** — update this banlist in a preset PR rather than inventing a third path.

package/presets/claude/svelte/rules/api-and-data/README.md

@@ -0,0 +1,9 @@
+# API and data
+
+HTTP transport, services, Svelte stores/runes store.
+
+| File | Contents | `paths:` |
+|------|----------|----------|
+| `http-client.md` | Shared HTTP client, errors, link to store | `src/lib/clients/**`, `src/lib/clients/**` |
+| `api-services.md` | Services, mappers, DTO → domain | `api/services/**` |
+| `store-svelte.md` | Svelte stores/runes, actions, typing | `src/lib/stores/**` |

package/presets/claude/svelte/rules/api-and-data/api-services.md

@@ -0,0 +1,45 @@
+---
+description: Conventions for API services and mappers (SvelteKit $lib/api)
+paths:
+  - src/lib/api/**/*.ts
+---
+
+# Role of the API layer
+
+- Encapsulate HTTP via clients in `src/lib/clients/**` (`http-client`), URLs, headers, DTOs.
+- Provide UI and store a **stable domain interface** — functions with domain types from `$lib/types` + DTO↔domain mappers.
+- May call relative `+server.ts` routes (`/api/...`) for BFF — still through services, not from `.svelte`.
+
+# Structure
+
+- Service directories under `src/lib/api/services/**` (or the neighbor scheme).
+- Outside the layer — only barrel `src/lib/api/index.ts` (`public-imports`, `layer-barrel-exports`).
+
+# Mappers
+
+- Pure functions; UI/store see domain models, not raw DTOs.
+- Do not call `fetch` directly in the service body — only through the client / `event.fetch` patterns documented in the repo.
+
+# Errors
+
+- Do not swallow errors; throw unified / Result-like forms as in the project.
+- APM — centrally in the client, not in every method.
+
+# Incorrect / Correct
+
+```ts
+// ❌ DTO leak
+export const getCard = async (id: string) => {
+  const data = await cardsClient.get(`/cards/${id}`)
+  return data
+}
+
+// ✅
+import type { TCard } from '$lib/types'
+import { mapCardResponse } from './cardResponseMappers'
+
+export const getCard = async (id: string): Promise<TCard> => {
+  const data = await cardsClient.get(`/cards/${id}`)
+  return mapCardResponse(data)
+}
+```

package/presets/claude/svelte/rules/api-and-data/http-client.md

@@ -0,0 +1,17 @@
+---
+description: HTTP client wrapper for SvelteKit — fetch, one stack, error contracts
+paths:
+  - src/lib/clients/**/*.ts
+  - src/lib/api/**/*.ts
+---
+
+# HTTP client
+
+- One HTTP stack for the app: wrap **`fetch`** (or the shared client already in `src/lib/clients/**`).
+- Do not mix ad-hoc `axios`/`ky` in features if a shared client exists.
+- Services in `src/lib/api/**` call the wrapper — UI/stores do not own transport.
+- In `load` / form actions, prefer the provided `event.fetch` for same-origin SSR cookie forwarding when calling own endpoints.
+- Map responses to domain models in services/mappers before stores/runes.
+- Errors: use project transport error types from `$lib/types`; narrow with `instanceof` when available.
+- Base URL / auth: from `$env/*` / existing client factories — do not hardcode secrets.
+- Calling relative `/api/*` (`+server.ts` BFF) from the client is fine when that is the repo pattern — still through services.

package/presets/claude/svelte/rules/api-and-data/store-svelte.md

@@ -0,0 +1,67 @@
+---
+description: Svelte stores and runes — client state (SvelteKit)
+paths:
+  - src/lib/stores/**/*.ts
+  - src/lib/stores/**/*.js
+  - **/*.svelte.ts
+---
+
+# Shared principles
+
+- **Primary (Svelte 5):** runes in `.svelte` / `.svelte.ts` — `$state`, `$derived`, `$effect`, `$props`, `$bindable` as applicable.
+- **Secondary (legacy / shared):** `writable` / `derived` / `readable` from `svelte/store` when neighbors do so or for shared state outside runes — “follow neighbors”.
+- Store / shared modules hold **domain models**, not raw DTOs.
+- DTO → domain mapping — in `src/lib/api/**` (or server mappers) **before** writing to store/runes.
+- UI-only flags may stay local in the component (`$state`) if that is the repo convention.
+
+# Forbidden in this preset
+
+- RTK / Redux: `createSlice`, `createAsyncThunk`, RTK Query, `useDispatch` / `useSelector`, stem `store-rtk`.
+- Pinia / Vuex: `defineStore`, stem `store-pinia`.
+- Raw `fetch` from the store bypassing `$lib/api` services (except narrow documented repo exceptions).
+- Importing `$state` / runes from invented packages — only Svelte runtime / documented APIs for the installed major.
+
+# Structure
+
+- Domain module — file under `src/lib/stores/**` (e.g. `src/lib/stores/profile.ts` or `profile.svelte.ts`).
+- Export explicit store factories / rune modules; names as neighbors use.
+- Actions / functions call services from `$lib/api` (`public-imports`).
+
+# Async
+
+```ts
+// Incorrect — raw HTTP + DTO in state
+import { writable } from 'svelte/store'
+export const profile = writable(null)
+export async function loadProfile() {
+  profile.set(await fetch('/api/profile').then((r) => r.json()))
+}
+
+// Correct
+import { writable } from 'svelte/store'
+import { profileApi } from '$lib/api'
+import type { Profile } from '$lib/types'
+
+export const profile = writable<Profile | null>(null)
+
+export async function loadProfile() {
+  profile.set(await profileApi.getProfile())
+}
+```
+
+# Typing and errors
+
+- Domain types from `$lib/types` (or `@/types` if aliased).
+- Transport errors — contracts from types / the accepted client class (`http-client`).
+- In UI: `$profile` / subscribe / `$derived` — follow neighbors.
+
+# Testing
+
+- Cover important stores / rune modules (init, transitions, actions with mocked API).
+- Unit: Vitest; mock `$lib/api` services.
+
+# Agent requirement
+
+- Do not put HTTP/transport in components.
+- Strictly type state/actions.
+- Follow the style of neighboring stores / runes modules.

package/presets/claude/svelte/rules/architecture/README.md

@@ -0,0 +1,12 @@
+# Architecture rules
+
+| File | Purpose |
+|------|---------|
+| `public-imports.md` | Imports `@/types`, `@/types/enums`, `@/api` (outside `src/lib/api/**`) |
+| `architecture-boundaries-ui.md` | Slim UI boundaries when editing components |
+| `architecture-boundaries.md` | Full UI / store / API map (api, store, types, lib) |
+| `layer-barrel-exports.md` | Two-level barrels for layers with a public API |
+| `feature-delivery-workflow.md` | End-to-end checklist for a new feature |
+| `reference-features.md` | Reference paths for UI/store/API/types |
+
+Deprecated stubs `types-public-imports.md` / `api-public-imports.md` **removed** — use `public-imports.md`.

package/presets/claude/svelte/rules/architecture/architecture-boundaries-ui.md

@@ -0,0 +1,16 @@
+---
+description: UI layer boundaries — slim rule for component edits (without the full store/API map)
+paths:
+  - src/lib/components/**/*
+  - src/routes/**/*
+---
+
+# UI layer boundaries (slim)
+
+- **Imports:** `src/lib/components/**`, facades under `src/lib/**`, `src/lib/stores/**` (public), types from `$lib/types` / `@/types`, API — only `$lib/api` / `@/api` (`public-imports`).
+- **Forbidden:** direct HTTP client (`fetch` outside `src/lib/clients`); knowing DTOs — domain types only.
+- **State:** write scenarios — via `store-svelte` (stores / runes); narrow direct `$lib/api` reads — only as in neighboring features.
+- **Organization:** `$lib` / `@/`; no deep imports into other features; public API only.
+- **Barrel:** when adding public symbols — re-export per `layer-barrel-exports`.
+
+Full layer map: **`architecture-boundaries`** — when editing `src/lib/api`, `src/lib/stores`, `src/lib/types`, `src/lib/clients`.

package/presets/claude/svelte/rules/architecture/architecture-boundaries.md

@@ -0,0 +1,65 @@
+---
+description: Architectural boundaries and import rules (SvelteKit)
+paths:
+  - src/lib/api/**/*
+  - src/lib/stores/**/*
+  - src/lib/types/**/*
+  - src/lib/clients/**/*
+  - src/lib/components/**/*
+  - src/routes/**/*
+---
+
+# Boundaries between layers
+
+```text
+src/routes (+page/+layout) / src/lib/components
+  → src/lib facades (optional)
+    → src/lib/stores ──→ src/lib/api (services barrel)
+                      ↘︎ src/lib/types
+    → src/lib/api (read-only / narrow cases) ──→ src/lib/clients (fetch)
++server.ts / hooks.server.ts ──→ types / shared pure utils
+```
+
+- **UI (`src/routes/**`, `src/lib/components/**`)**:
+  - May import: components, facades, `src/lib/stores/**` (public), types from `$lib/types` / `@/types`, API — **only** from `$lib/api` / `@/api` (`public-imports`).
+  - Must not: call the HTTP client directly; know backend DTOs.
+- **Store (`src/lib/stores/**`)** — `store-svelte`:
+  - May import: other stores (public), `$lib/api`, `$lib/types`.
+  - Must not: depend on UI; reach `src/lib/clients` bypassing services.
+- **API (`src/lib/api/**`)**:
+  - Services + mappers; HTTP via `src/lib/clients/**`.
+  - Must not: pull UI or store.
+- **Server (`+server.ts`, hooks)**:
+  - Edge/BFF; secrets via `$env/static/private`; do not replace `src/lib/api/**` domain services.
+
+## UI and API access
+
+- Scenarios that change server state — via store actions / rune modules.
+- Direct `$lib/api` calls from UI — only narrow read-only cases that do not duplicate a store scenario.
+- Facades under `src/lib/**` — thin orchestration (not Vue `composables/`).
+
+## Import rules
+
+- Between layers — `$lib/…` (preferred) or `@/…` if configured; respect `$app/*` / `$env/*` without phantoms.
+- Inside a feature — relative without climbing above the feature root.
+- Outside a layer — public barrels only (`layer-barrel-exports`, `public-imports`).
+
+## Forbidden as defaults
+
+- RTK / Pinia / Vuex; stems `store-rtk` / `store-pinia`.
+- Next `app/src/**`, Nuxt `pages/**` / `composables/**` as canon.
+
+## Incorrect
+
+```ts
+import { httpClient } from '$lib/clients/http'
+// UI / page calling transport directly
+await httpClient.get('/orders')
+```
+
+## Correct
+
+```ts
+import { loadOrders } from '$lib/stores/orders'
+await loadOrders()
+```

package/presets/claude/svelte/rules/architecture/feature-delivery-workflow.md

@@ -0,0 +1,61 @@
+---
+description: End-to-end checklist for a new feature and the “layer → Cursor rule” matrix. Use when implementing features via feature-developer or feature-delivery skill.
+paths:
+  - src/routes/**/*
+  - src/lib/components/**/*
+  - src/lib/stores/**/*
+  - api/**/*
+  - src/lib/**/*
+  - types/**/*
+---
+
+<!-- shared-core: architecture/feature-delivery-workflow.md -->
+
+# Feature delivery (end-to-end order)
+
+## Stack notes
+
+Typical feature with backend data and shared state. Layer details — `architecture-boundaries.mdc`, `svelte-app-core.mdc`.
+
+Canonical paths: `src/routes/**`, `src/lib/{components,stores,api,clients,types}/**`, `tests/e2e/**`. Aliases: `$lib` preferred; `@/` if configured. State: `store-svelte` (runes primary; legacy stores secondary).
+
+## Checklist (work order)
+
+1. **Domain types** — `src/lib/types/**`, barrel (`public-imports`, `layer-barrel-exports`); JSDoc — `types-jsdoc`.
+2. **API contract** — DTOs where the repo uses them; domain types in `$lib/types`.
+3. **Mappers** — DTO → domain in `*responseMappers.ts` (`api-services`).
+4. **Services** — clients `src/lib/clients/**`, barrel `$lib/api` (`api-services`, `http-client`). No `fetch` from UI/store.
+5. **State** — `src/lib/stores/**` / runes (`store-svelte`); actions → `$lib/api`. **Not** RTK / Pinia.
+6. **UI** — `src/routes/**`, `src/lib/components/**`; data via store / facades / `load`.
+7. **Unit** — colocated `*.spec.ts` (Vitest + Testing Library Svelte).
+8. **E2E** — `tests/e2e/<Area>/<plan>.cases.md` + `*.spec.ts`.
+9. **Gate** — `post-change-lint`: `lint:js`, `lint:css`, `check`.
+
+## Partial scenarios
+
+| Task | Minimum |
+|------|---------|
+| API + types only | Types, service, mappers, `$lib/api` barrel; unit for mapper. |
+| Store only | Store/runes actions on `$lib/api`. |
+| UI only | Store/`load` data; no HTTP/DTO. |
+| E2E only | `*.cases.md` + spec; page object. |
+
+## Anti-patterns
+
+- DTO in UI or untyped store.
+- HTTP from a component / store bypassing the service.
+- Deep-import `$lib/api/services/**` from UI/store.
+- `{...props}` / `$$restProps` without discipline — `no-rest-props-spread`.
+- RTK / Pinia / Vue / Nuxt APIs as defaults.
+- Load `design-guidance` when assessing structure / smells.
+
+## Zone → rules matrix
+
+| Zone | Rules |
+|------|-------|
+| `src/lib/clients/**` | `http-client`, `tests-unit` |
+| `src/lib/api/**` | `api-services`, `layer-barrel-exports`, `http-client` |
+| `src/lib/stores/**` | `store-svelte`, `architecture-boundaries`, `public-imports` |
+| `src/lib/components/**`, `src/routes/**` | `svelte-ui`, `no-rest-props-spread`, `public-imports` |
+| `src/lib/types/**` | `public-imports`, `types-jsdoc`, `layer-barrel-exports` |
+| `tests/e2e/**` | `tests-e2e-structure`, `playwright-agents` |