@bonesofspring/ai-rules 0.2.13 → 0.2.15

package/presets/cursor/nuxt/rules/no-v-bind-spread.mdc

@@ -0,0 +1,13 @@
+---
+description: Ban bulk v-bind object spread on components — prefer explicit props
+globs: "**/*.{vue,tsx,jsx}"
+alwaysApply: false
+---
+
+# No bulk `v-bind` object spread
+
+- **Forbidden:** `<Child v-bind="propsObject" />` / `v-bind="rest"` as a way to dump unknown prop bags.
+- **Prefer:** explicit prop bindings (`:title="title" :count="count"`).
+- Exception: intentional passthrough on a thin wrapper documented in-repo (rare); prefer `fallthroughAttributes` / explicit `inheritAttrs` patterns already used by neighbors.
+- Do not "simplify" templates by packing props into a reactive object solely for `v-bind`.
+- Analogue of next `no-props-spread` for Vue SFCs.

package/presets/cursor/nuxt/rules/nuxt-app-core.mdc

@@ -0,0 +1,45 @@
+---
+description: Baseline principles, stack, and architecture for a Nuxt 3 application (preset)
+alwaysApply: true
+---
+
+# Stack and environment
+
+Concrete versions — **from `package.json` and configs of the target repository**. Preset frame: Nuxt 3, Vue 3, TypeScript; runner/e2e/mocks/UI/APM — as established in the repo.
+
+# Project structure
+
+| Path | Purpose |
+|------|---------|
+| `pages/**` | File-based routes |
+| `components/**` | UI components (SFC) |
+| `composables/**` | Vue `use*` facades |
+| `stores/**` | Pinia stores |
+| `api/**` | Client services + mappers (barrel) |
+| `lib/clients/**`, `api/clients/**` | HTTP (`$fetch` / ofetch) |
+| `server/api/**` | Nitro server routes (BFF) |
+| `types/**` | Domain types (barrel) |
+| `tests/e2e/**` | Playwright e2e |
+
+**Aliases:** prefer `~/`, accept `@/`, respect `#imports` (do not invent auto-import symbols). Scripts cwd — **repository root** (where `nuxt.config.*` lives), not a Next-style `app/` wrapper.
+
+# Architectural layers
+
+| Layer | Directory | Details |
+|-------|-----------|---------|
+| UI | `pages/**`, `components/**`, `layouts/**` | `vue-ui`, `architecture-boundaries-ui` |
+| Composables | `composables/**` | thin orchestration; no raw HTTP |
+| Store | `stores/**` | `store-pinia` — `defineStore` only |
+| API | `api/**` | `api-services`, `http-client` |
+| HTTP | `lib/clients/**`, `api/clients/**` | wrap `$fetch` |
+| Server | `server/api/**` | `security-nuxt`; not a substitute for `api/**` |
+| Types | `types/**` | `public-imports`, `types-jsdoc` |
+
+Boundaries — **`architecture-boundaries`**. Imports `~/types` / `@/types`, `~/api` / `@/api` — **`public-imports`**. **Forbidden:** RTK / `store-rtk`, React/RSC defaults, `app/src/**` paths as the canon.
+
+# Agent work
+
+- Architecture and imports: `architecture-boundaries`, `public-imports`
+- Features: `feature-delivery-workflow` + skill `feature-delivery`
+- After edits: **invoke** `post-change-lint` (requestable); package manager: `package-manager`
+- Copy neighbor patterns; prefer `unknown` over `any`

package/presets/cursor/nuxt/rules/nuxt-pages-routing.mdc

@@ -0,0 +1,37 @@
+---
+description: Nuxt file-based routing, layouts, middleware, page meta
+globs: pages/**/*.{vue,ts},layouts/**/*.{vue,ts},middleware/**/*.{ts,js},nuxt.config.*
+alwaysApply: false
+---
+
+# Nuxt pages & routing
+
+Canonical layout: **Nuxt 3 project root** — `pages/`, `layouts/`, `middleware/`.  
+Nuxt 4 may use `app/` as `srcDir`; mention only as a note — **do not** default globs/examples to Next-style `app/src/**`.
+
+## Routing
+
+- File-based routes under `pages/**`.
+- Layouts in `layouts/**`; select via `definePageMeta({ layout: '…' })`.
+- Route middleware in `middleware/**` (`defineNuxtRouteMiddleware`).
+- Navigation helpers: `<NuxtLink>`, `navigateTo`, `useRouter`, `useRoute` — not `next/link` / `next/navigation`.
+- Server/API routes: `server/api/**` (Nitro) — see `security-nuxt`; domain client services stay in `api/**`.
+
+## Data on pages
+
+- Prefer composables + Pinia for client orchestration.
+- `useFetch` / `useAsyncData` OK when that is the repo pattern — still map to domain models; no raw DTO sprawl in templates.
+- Secrets only via `runtimeConfig` server-side.
+
+## Incorrect
+
+```ts
+import { useRouter } from 'next/navigation'
+```
+
+## Correct
+
+```ts
+const router = useRouter()
+await navigateTo('/items')
+```

package/presets/cursor/nuxt/rules/package-manager.mdc

@@ -0,0 +1,18 @@
+---
+description: Before terminal commands, detect the repository package manager and use only that one
+alwaysApply: true
+---
+
+# Package manager (terminal)
+
+Before **`npm install` / `yarn` / `pnpm` / `bun`** and **`… run …`**, detect the repository package manager and **use only that one**.
+
+## How to detect
+
+1. **`packageManager`** in `package.json` (repository root; in a monorepo — the workspace root where scripts / `nuxt.config.*` live).
+2. **Lockfile** nearby: `yarn.lock` → yarn; `pnpm-lock.yaml` → pnpm; `package-lock.json` → npm; `bun.lock(b)` → bun.
+3. If ambiguous — where `node_modules` lives and which lockfile CI uses.
+
+## Stack notes
+
+Working directory for scripts — **repository root** (directory with `nuxt.config.*`), **not** Next `app/`. Examples: `yarn lint:js`, `pnpm run typecheck`. Do not guess — check the files.

package/presets/cursor/nuxt/rules/playwright-agents.mdc

@@ -0,0 +1,80 @@
+---
+description: Playwright Agents (planner/generator/healer) configuration for e2e structure in tests/e2e
+globs: tests/e2e/**/*
+alwaysApply: false
+---
+
+# Playwright Agents in this project
+
+In this repository, Playwright Agents (planner, generator, healer) **must follow the existing e2e structure**:
+
+- **Test directory**: `tests/e2e`
+- **Test plans (specs)**: `*.cases.md` files under `tests/e2e/**`
+- **Executable tests**: `*.spec.ts` files under `tests/e2e/**`
+- **Seed test**: `tests/e2e/seed.spec.ts`
+
+Do **not** introduce separate top-level `specs/` and `tests/` folders for real test coverage. Those may be used only as temporary sandboxes if explicitly requested.
+
+## Planner (test plans)
+
+When acting as a **Planner** (or working with the Playwright planner agent):
+
+- **Treat `*.cases.md` as the canonical test plan files**, equivalent to Playwright's `specs/*.md`.
+- **Location**:
+  - For a feature/domain, use the corresponding `*.cases.md` file under `tests/e2e`, e.g.:
+    - `tests/e2e/OrderHistory/order-history.cases.md`
+    - `tests/e2e/BillingReport/invoice-list.cases.md`
+- **Content requirements**:
+  - Group scenarios by feature and subfeature using headings.
+  - For each scenario include:
+    - clear title,
+    - preconditions,
+    - ordered steps,
+    - expected results.
+  - Write in concise business language, but precise enough for automatic test generation.
+- **Seed**:
+  - Assume environment is prepared by `tests/e2e/seed.spec.ts` (login, baseURL, mocks, etc.).
+
+When asked to "generate a test plan" for a feature, **create or update the appropriate `*.cases.md` file in `tests/e2e/**`**, not in a separate `specs/` folder.
+
+## Generator (tests from plans)
+
+When acting as a **Generator** (or working with the Playwright generator agent):
+
+- **Source of truth for scenarios**:
+  - Use the relevant `*.cases.md` file under `tests/e2e/**` as the test plan.
+- **Target for tests**:
+  - Generate or update `*.spec.ts` files under the same folder, e.g.:
+    - plan: `tests/e2e/OrderHistory/order-history.cases.md`
+    - tests: `tests/e2e/OrderHistory/order-history.spec.ts` (or additional `*.spec.ts` in that folder if needed).
+- **Structure**:
+  - Use `test.describe` to group by top-level plan sections (feature / user flow).
+  - Use `test(...)` titles that match scenario names from the plan.
+  - Prefer Page Object and fluent interfaces that already exist in this project, for example:
+    - `tests/e2e/OrderHistory/OrderHistoryPage.ts`
+    - shared helpers under `tests/e2e/_shared/`.
+- **Seed**:
+  - If a seed test is needed, use `tests/e2e/seed.spec.ts` as the reference for environment setup.
+
+Do **not** generate Playwright tests into a separate `tests/` folder by default. Keep all e2e tests under `tests/e2e/**` to respect project conventions.
+
+## Healer (fixing tests)
+
+When acting as a **Healer** (or working with the Playwright healer agent):
+
+- Operate only on `*.spec.ts` files under `tests/e2e/**`.
+- Use `*.cases.md` in the same folder as **documentation of the intended behavior**:
+  - Do not weaken or change business assertions in tests in a way that conflicts with the corresponding `*.cases.md`.
+  - Prefer updating locators, waits, and flow details to match the UI while keeping the scenario semantics intact.
+- When multiple specs are involved, prioritize:
+  - the spec file in the same folder as the failing test,
+  - then shared utilities in `tests/e2e/_shared/`.
+
+Healer should keep tests aligned with the existing test plans (`*.cases.md`) and with the page objects and helpers already used in the project.
+
+
+## Stack notes (Nuxt)
+
+- E2E root: `tests/e2e/`.
+- Default baseURL: `http://localhost:3000`.
+- Prefer Playwright `webServer` → `nuxt dev` or `nuxt build && nuxt preview`.

package/presets/cursor/nuxt/rules/post-change-lint.mdc

@@ -0,0 +1,42 @@
+---
+description: Run ESLint and Stylelint after code changes. Requestable — load after edits under pages/components/stores/api/**; agents must run after code edits.
+alwaysApply: false
+---
+
+# Linters after code changes
+
+**Requestable, but required on code changes:** the rule is not always-on (context savings); after source edits the agent **must** follow this checklist.
+
+## When to apply
+
+After **any** source change under `pages/**`, `components/**`, `composables/**`, `stores/**`, `api/**`, `lib/**`, `server/**`, `types/**`, `layouts/**`, `middleware/**` (Vue/TS/JS, CSS, scoped/CSS modules).
+
+Exceptions: docs, CI configs, `.cursor/rules/**`, when application executable code did not change.
+
+**Pipeline exception:** if the task goes through the agent team and the next step is `build-verifier`, the developer may limit lint/typecheck to **changed files**; the full run is `build-verifier`’s duty. In single-agent mode (no pipeline) — always a full run.
+
+## Required commands
+
+Working directory — **repository root** (where `nuxt.config.*` lives). Package manager — **`package-manager`**.
+
+1. **`lint:js`** — full project ESLint.
+2. **`lint:css`** — full Stylelint.
+
+Point lint on a single file **does not replace** a full run before finishing the task (except the pipeline exception above).
+
+## Algorithm
+
+1. Finish code edits.
+2. Run **`lint:js`** and **`lint:css`** from the repository root.
+3. Analyze the full output; fix errors/warnings in changed files; for Stylelint — autofix if available.
+4. Repeat until exit code 0 or record a blocker in the user reply.
+5. **`typecheck`** (`nuxt typecheck`) when TypeScript / Vue SFC changed. CI-level: **`lint`** (= `lint:js` + `lint:css` + `typecheck`).
+
+**Type gate script name is `typecheck`**, not Next’s `type-check`.
+
+## What to fix
+
+- **Errors** — required.
+- **Warnings** — required in task files; outside scope — mention if they block a zero exit code.
+
+Configs: `eslint.config.js` / `eslint.config.mjs` / `.eslintrc*`, `.stylelintrc*` (CSS property order — `css-property-order-stylelint`).

package/presets/cursor/nuxt/rules/preset-layering.mdc

@@ -0,0 +1,36 @@
+---
+description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-layering.md -->
+
+# Preset layering
+
+Rules for **preset authors** (`packages/ai-rules/presets/**`). Not always-on in consumer apps.
+
+## Layers
+
+| Layer | Where | What to put |
+|-------|-------|-------------|
+| **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; no frontmatter; no paths `app/**`, `Features/**`, Playwright, xcodebuild |
+| **Stack** | `presets/{cursor\|claude}/<stack>/` | Domain/tooling, stack always-on trio, stack examples in **Stack notes** |
+| **Platform** | Cursor `.mdc` / Claude `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
+
+## Where to put a new rule
+
+1. Shared principles for all stacks → **core** + adapters with `<!-- shared-core: … -->`.
+2. Only one of the installable stacks (`next` / `nuxt` / `svelte` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (not in `_shared`).
+3. Only Cursor or only Claude packaging → platform artifact / frontmatter; do not duplicate semantics.
+
+## SoT
+
+- Packages path — SoT; root `.cursor/` — dogfood sync.
+- Per stack: **Cursor** `presets/cursor/<stack>/` → Claude twin same PR.
+- `_shared` is **not** a `--preset` and is not copied by CLI `init`.
+
+See also: `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`.

package/presets/cursor/nuxt/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,83 @@
+---
+description: Preset authoring: forbid cross-stack agent/path leakage in hooks and agents.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+# Preset no cross-stack leakage
+
+Ban leakage of stack-specific names, paths, and handoff stems across presets.
+
+## Principles
+
+- `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `nuxt` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `svelte` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in nuxt hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Nuxt app work
+- Frontend profile mirrors `next`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in svelte hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for SvelteKit app work
+- Frontend profile mirrors `next` / `nuxt`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `nuxt`, `svelte`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/nuxt/rules/preset-pr-checklist.mdc

@@ -0,0 +1,39 @@
+---
+description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** edits in `packages/…` (not only root `.cursor/`)
+- [ ] **Core:** if `_shared/core/**` changed — all `<!-- shared-core: … -->` consumers updated (or documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, nuxt, svelte, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — see `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table is current
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** no foreign stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/nuxt/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Invariants for rule loading in an **installed** preset (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **exactly 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (where documented): ≤140 lines total (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/nuxt/rules/preset-twin-sync.mdc

@@ -0,0 +1,54 @@
+---
+description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `nuxt` | `presets/cursor/nuxt/rules/*.mdc` | `presets/claude/nuxt/rules/<topic>/` | **Required** in `claude/nuxt/rules/README.md` |
+| `svelte` | `presets/cursor/svelte/rules/*.mdc` | `presets/claude/svelte/rules/<topic>/` | **Required** in `claude/svelte/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+| `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **nuxt:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **svelte:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+- **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/nuxt/rules/public-imports.mdc

@@ -0,0 +1,62 @@
+---
+description: Import domain types and API only through public barrels @/types and @/api
+globs:
+  - components/**/*
+  - stores/**/*
+  - lib/**/*
+  - types/**/*
+  - api/**/*
+alwaysApply: false
+impact: HIGH
+---
+
+# Public imports (`@/types`, `@/api`)
+
+**Collisions:** type imports — `@/types` section below; API outside `api/**` — `@/api` section below (mirrors ESLint `no-restricted-imports` in `eslint.config.mjs`).
+
+## `@/types`
+
+- **Public types API** — barrel `types/index.ts`; import types only as `@/types` (or `@/types/index`).
+- **Forbidden** to bypass the barrel: `@/types/<anything>`, except enums.
+- **Enums** — only `@/types/enums` / `@/types/enums.ts`.
+- Inside `types/**` — relative imports between layer files.
+
+```typescript
+// ✅
+import type { TUserProfile } from '@/types'
+import { SomeEnum } from '@/types/enums'
+
+// ❌
+import type { TUserProfile } from '@/types/User.types'
+```
+
+New public types — re-export in `types/index.ts` per **`layer-barrel-exports.mdc`**.
+
+## `@/api`
+
+- **Public API** — barrel `api/index.ts`. Outside `api/**` — only `import … from '@/api'` (or `@/api/index`).
+- **Forbidden** from outside the layer: `@/api/<anything>`, except `@/api/index`.
+- Inside `api/**` — relative imports and `@/api/services/**`, `@/api/clients/**`.
+
+```typescript
+// ✅ in store, UI, lib outside api
+import { MedcardApiService } from '@/api'
+
+// ❌ outside api
+import { MedcardApiService } from '@/api/services/MedcardApiService/MedcardApiService'
+```
+
+New public API symbols — re-export in `api/index.ts` per **`layer-barrel-exports.mdc`**.
+## Incorrect
+
+```ts
+import type { TUserProfile } from '@/types/User.types'
+import { OrdersApi } from '@/api/services/OrdersApi'
+```
+
+## Correct
+
+```ts
+import type { TUserProfile } from '@/types'
+import { ordersApi } from '@/api'
+```

package/presets/cursor/nuxt/rules/reference-features.mdc

@@ -0,0 +1,49 @@
+---
+description: Repository reference features — copy structure when implementing new tasks. Fill paths after init in the target repo.
+globs:
+  - components/**/*
+  - stores/**/*
+  - api/**/*
+  - types/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features
+
+## Stack notes
+
+Before implementing, find a feature of the same type and **mirror its structure**; do not invent a new file organization.
+
+Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README.md) · [Preset contribution guide](../../../../docs/PRESET-CONTRIBUTION.md).
+
+## Reference table
+
+Replace **TBD** with real paths after team agreement (or on `ai-rules init` in the target repo):
+
+| Layer | Reference | What to copy |
+|-------|-----------|--------------|
+| UI page | **TBD** `components/pages/<Example>/` | `components/`, `*.data.ts`, `styles.ts`, barrel |
+| Store | **TBD** `stores/<example>.ts` | `defineStore`, actions, getters, types |
+| API service | **TBD** `api/services/<example>/` | service, mappers, barrel |
+| Types module | **TBD** `types/<example>/` | domain types, JSDoc, barrel export |
+| Unit tests | **TBD** next to the reference mapper/service | `*.spec.ts`, describe/it naming |
+| E2E area | **TBD** `tests/e2e/<Area>/` | `*.cases.md`, page objects, `_shared/` |
+
+## How to use
+
+1. Identify affected layers from `decomposition.md` or the task.
+2. Open the reference from the table (after paths are filled).
+3. Mirror naming, file order, import patterns, and tests.
+4. If there is no reference — pick the **closest** existing feature of the same layer and record the choice in the handoff.
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Related rules
+
+- `code-quality-and-refactoring.mdc` — repeat patterns, no deep-import.
+- `feature-delivery-workflow.mdc` — layer order.
+- skill `feature-delivery` — end-to-end scenario.

package/presets/cursor/nuxt/rules/script-setup-conventions.mdc

@@ -0,0 +1,13 @@
+---
+description: Prefer script setup lang=ts and idiomatic Vue function style
+globs: "**/*.{vue,ts}"
+alwaysApply: false
+---
+
+# Script setup conventions
+
+- Prefer `<script setup lang="ts">` for pages/components/layouts.
+- Named composables / helpers: follow repo naming (`useX`); export functions consistently with neighbors.
+- Prefer `const fn = () =>` / concise handlers where the file already does; do not churn style across untouched files.
+- Auto-imports (`#imports`) OK when Nuxt resolves them — do not invent symbols; verify against `.nuxt/` / docs (`vue-nuxt-anti-hallucination`).
+- Keep business orchestration in composables/stores; keep SFC scripts thin.

package/presets/cursor/nuxt/rules/security-nuxt.mdc

@@ -0,0 +1,34 @@
+---
+description: Nuxt/Nitro security — runtimeConfig, SSR secrets, XSS, CSRF, server routes
+globs: server/**/*,nuxt.config.*,pages/**/*,components/**/*,middleware/**/*
+alwaysApply: false
+---
+
+# Security (Nuxt)
+
+## Secrets & config
+
+- Private secrets: `runtimeConfig` (server-only). Public: `runtimeConfig.public` only.
+- Never ship API keys / tokens in client bundles, composables without guard, or `public` config.
+- `.env` / `.env.*` — do not commit secrets; document required keys without values.
+
+## Server (Nitro)
+
+- Validate/authorize in `server/api/**` and `server/middleware/**`.
+- Do not trust client body/query; sanitize inputs.
+- Prefer server proxies for third-party secrets rather than exposing keys to the browser.
+
+## XSS / templates
+
+- Prefer text interpolation; avoid `v-html` unless sanitized and necessary.
+- User-generated content — follow existing sanitize helpers in the repo.
+
+## Auth / CSRF / cookies
+
+- Follow project auth middleware / session patterns; do not invent ad-hoc cookie auth.
+- Cookie flags (`HttpOnly`, `Secure`, `SameSite`) — match security baseline of the repo.
+- CSRF: use established Nuxt/server pattern already in the codebase when mutating state.
+
+## Agent requirement
+
+When touching auth, forms, env, or `server/api`, load this rule and prefer agent `security-reviewer` for risky changes.