@bonesofspring/ai-rules 0.2.13 → 0.2.15

package/presets/cursor/svelte/rules/post-change-lint.mdc

@@ -0,0 +1,42 @@
+---
+description: Run ESLint, Stylelint, and svelte-check after code changes. Requestable — load after edits under src/**; agents must run after code edits.
+alwaysApply: false
+---
+
+# Linters after code changes
+
+**Requestable, but required on code changes:** the rule is not always-on (context savings); after source edits the agent **must** follow this checklist.
+
+## When to apply
+
+After **any** source change under `src/routes/**`, `src/lib/**`, `src/hooks.*.ts`, `src/params/**`, `tests/**` (Svelte/TS/JS, CSS, `<style>`).
+
+Exceptions: docs, CI configs, `.cursor/rules/**`, when application executable code did not change.
+
+**Pipeline exception:** if the task goes through the agent team and the next step is `build-verifier`, the developer may limit lint/check to **changed files**; the full run is `build-verifier`’s duty. In single-agent mode (no pipeline) — always a full run.
+
+## Required commands
+
+Working directory — **SvelteKit root** (where `svelte.config.*` lives). Package manager — **`package-manager`**.
+
+1. **`lint:js`** — full project ESLint (`eslint-plugin-svelte` when configured).
+2. **`lint:css`** — full Stylelint.
+
+Point lint on a single file **does not replace** a full run before finishing the task (except the pipeline exception above).
+
+## Algorithm
+
+1. Finish code edits.
+2. Run **`lint:js`** and **`lint:css`** from SvelteKit root.
+3. Analyze the full output; fix errors/warnings in changed files; for Stylelint — autofix if available.
+4. Repeat until exit code 0 or record a blocker in the user reply.
+5. **`check`** (`svelte-kit sync && svelte-check`) when TypeScript / `.svelte` / SvelteKit config changed. CI-level: **`lint`** (= `lint:js` + `lint:css` + `check`).
+
+**Type/svelte gate script name is `check`**, not Next’s `type-check` and not Nuxt’s `typecheck`. Binary — `svelte-check`; package script — **`check`**.
+
+## What to fix
+
+- **Errors** — required.
+- **Warnings** — required in task files; outside scope — mention if they block a zero exit code.
+
+Configs: `eslint.config.js` / `eslint.config.mjs` / `.eslintrc*`, `.stylelintrc*` (CSS property order — `css-property-order-stylelint`).

package/presets/cursor/svelte/rules/preset-layering.mdc

@@ -0,0 +1,36 @@
+---
+description: Preset authoring: Core → Stack → Platform layering. Use when editing packages/ai-rules/presets/**.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-layering.md -->
+
+# Preset layering
+
+Rules for **preset authors** (`packages/ai-rules/presets/**`). Not always-on in consumer apps.
+
+## Layers
+
+| Layer | Where | What to put |
+|-------|-------|-------------|
+| **Core** | `presets/_shared/core/**` | Stack-agnostic prose + checklists; no frontmatter; no paths `app/**`, `Features/**`, Playwright, xcodebuild |
+| **Stack** | `presets/{cursor\|claude}/<stack>/` | Domain/tooling, stack always-on trio, stack examples in **Stack notes** |
+| **Platform** | Cursor `.mdc` / Claude `.md` | Frontmatter (`alwaysApply`/`globs` vs `paths:`), platform-only (`BUGBOT.md`, `CLAUDE.md`) |
+
+## Where to put a new rule
+
+1. Shared principles for all stacks → **core** + adapters with `<!-- shared-core: … -->`.
+2. Only one of the installable stacks (`next` / `nuxt` / `svelte` / `ios-swift` / `go` / `java` / `mcp-ts` / `php-hexagonal` / `php-laravel`) → **stack-specific** (not in `_shared`).
+3. Only Cursor or only Claude packaging → platform artifact / frontmatter; do not duplicate semantics.
+
+## SoT
+
+- Packages path — SoT; root `.cursor/` — dogfood sync.
+- Per stack: **Cursor** `presets/cursor/<stack>/` → Claude twin same PR.
+- `_shared` is **not** a `--preset` and is not copied by CLI `init`.
+
+See also: `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`.

package/presets/cursor/svelte/rules/preset-no-cross-stack-leakage.mdc

@@ -0,0 +1,83 @@
+---
+description: Preset authoring: forbid cross-stack agent/path leakage in hooks and agents.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-no-cross-stack-leakage.md -->
+
+# Preset no cross-stack leakage
+
+Ban leakage of stack-specific names, paths, and handoff stems across presets.
+
+## Principles
+
+- `next` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `nuxt` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `svelte` must not require iOS-only agents/tooling (`xcuitest-*`, `xcodebuild` as required handoff, Keychain-only rules).
+- `ios-swift` must not ship Playwright handoffs or Next lint recipes as required commands.
+- `go` / `java` / `php-hexagonal` / `php-laravel` / `mcp-ts` must not ship Playwright, XCUITest, Next lint recipes, or `xcodebuild`/`SwiftLint` as required handoffs.
+- `mcp-ts` must not ship Go tool commands (`go test`, `go vet`, `golangci-lint`) or `integration-test-*` agents as required delivery gates.
+- Shared core must not embed stack paths (`app/src/**`, `Features/**`, `playwright`, `xcodebuild`).
+
+## Forbidden in ios-swift hooks/agents (FAIL)
+
+In ios-swift `chain-team-phases.sh` / agent handoffs (Cursor + Claude):
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`
+- `app/__tests__/e2e` as a required path
+- Positive yarn recipes `lint:js` / `lint:css` as commands to run (negation prose alone is weak — prefer zero occurrences)
+
+Required instead: `xcuitest-test-*` stems; build-verifier mentions `xcodebuild` or `post-change-build` / `xcode-tooling`.
+
+## Forbidden in next hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Next app work
+
+## Forbidden in nuxt hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for Nuxt app work
+- Frontend profile mirrors `next`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in svelte hooks/agents (FAIL when present as required)
+
+- `xcuitest-test-` as handoff stems
+- Requiring `xcodebuild` / SwiftLint as the default post-change gate for SvelteKit app work
+- Frontend profile mirrors `next` / `nuxt`: Playwright / `lint:js` / `lint:css` allowed
+
+## Forbidden in go / java / php-hexagonal / php-laravel hooks/agents (FAIL)
+
+Shared backend-stack bans (`go`, `java`, `php-hexagonal`, and `php-laravel`):
+
+- `playwright-test-`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css`
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Agent file `accessibility-reviewer` (no UI surface)
+
+Required instead: `integration-test-*`; build-verifier / `post-change-test` plus stack tooling — `go-tooling` (`go test`, `go vet`), `java-tooling` (`mvn test` / `./gradlew test`), or `php-tooling` (`php artisan test` / `composer test` / `vendor/bin/phpunit`).
+
+## Forbidden in mcp-ts hooks/agents (FAIL)
+
+Same UI/mobile bans as backend stacks, plus:
+
+- `playwright-test-`, `playwright-agents`, `playwright-e2e`, `user-playwright`, `app/__tests__/e2e`
+- Positive yarn recipes `lint:js` / `lint:css` as required gates
+- `xcuitest-test-`, `xcodebuild`, `SwiftLint` as required handoffs
+- Go tool commands as required MCP delivery gates: `go test`, `go vet`, `golangci-lint`
+- Agent files: `playwright-test-*`, `xcuitest-test-*`, `integration-test-*`, `accessibility-reviewer`
+
+Required instead: package-manager–discovered typecheck/test (`mcp-ts-tooling`, `post-change-test`); Phase 1 gates `build-verifier` + `security-reviewer`.
+
+## Soft / document
+
+- Mentioning the other stack in **docs** comparing presets is OK.
+- `build-verifier` may reference other stacks when validating **preset packaging** (`scope: preset-structure-validation`).
+
+## Chain fork
+
+`hooks/chain-team-phases.sh` must differ **byte-wise** pairwise among `next`, `nuxt`, `svelte`, `ios-swift`, `go`, `java`, `mcp-ts`, `php-hexagonal`, and `php-laravel` (per platform).

package/presets/cursor/svelte/rules/preset-pr-checklist.mdc

@@ -0,0 +1,39 @@
+---
+description: Preset authoring: PR checklist for twin sync, budget, leakage, README. Use on preset PRs.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-pr-checklist.md -->
+
+# Preset PR checklist
+
+Checklist for PRs that touch `packages/ai-rules/presets/**` (and dogfood `.cursor/` sync).
+
+## Before merge
+
+- [ ] **SoT:** edits in `packages/…` (not only root `.cursor/`)
+- [ ] **Core:** if `_shared/core/**` changed — all `<!-- shared-core: … -->` consumers updated (or documented intentional fork)
+- [ ] **Twin:** Cursor change → Claude twin **same PR** (**FAIL** if missing on next, nuxt, svelte, ios-swift, go, java, mcp-ts, php-hexagonal, and php-laravel — see `preset-twin-sync`)
+- [ ] **Mapping:** `claude/<stack>/rules/README.md` mapping table is current
+- [ ] **Token budget:** alwaysApply / session-start ≤ 3; meta rules not always-on
+- [ ] **Leakage:** no foreign stack agent stems / handoff strings (`preset-no-cross-stack-leakage`)
+- [ ] **Twin depth:** domain ≥15 lines; thin aliases documented
+- [ ] **README:** stack `rules/README.md` core→stack mapping / catalog updated if stems added
+- [ ] **CHANGELOG / package README:** note when public preset paths or install surface change
+- [ ] **Dogfood:** run `packages/ai-rules/scripts/sync-dogfood-cursor.sh` (or document intentional skip) when maintaining this monorepo
+- [ ] **shared-core drift:** for embed-mode stems, run `packages/ai-rules/scripts/check-shared-core-drift.sh` (or document intentional fork)
+
+## Pointers
+
+- Layering: `preset-layering`
+- Sync: `preset-twin-sync`
+- Budget: `preset-token-budget`
+- Leakage: `preset-no-cross-stack-leakage`
+- Validation: stack `agents/build-verifier.md` → preset-structure section
+- Dogfood script: `packages/ai-rules/scripts/sync-dogfood-cursor.sh`
+- Drift script: `packages/ai-rules/scripts/check-shared-core-drift.sh`
+- Orchestrator: when editing presets, load this checklist + twin-sync

package/presets/cursor/svelte/rules/preset-token-budget.mdc

@@ -0,0 +1,41 @@
+---
+description: Preset authoring: ≤3 always-on / session-start; meta rules never alwaysApply.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-token-budget.md -->
+
+# Preset token budget
+
+Invariants for rule loading in an **installed** preset (consumer app).
+
+## Hard caps
+
+| Platform | Always-on | Cap |
+|----------|-----------|-----|
+| Cursor | `alwaysApply: true` | **≤ 3** |
+| Claude | rules **without** `paths:` | **exactly 3** |
+
+**Claude Option A (README exclusion):** when counting Claude rules without `paths:` / session-start, **exclude `**/README.md`** (topic indexes are not session-start rules). The intended session-start trio remains **exactly 3**; body budget sums **only those 3** rules.
+
+Session-start body budget (where documented): ≤140 lines total (stretch ≤120).
+
+## Meta / author rules
+
+Rules for preset authors (`preset-layering`, `preset-twin-sync`, …):
+
+- **Never** `alwaysApply: true` on consumer installs.
+- Cursor: `globs` limited to `packages/ai-rules/presets/**` (and dogfood `.cursor/**` where useful).
+- Claude: `paths:` limited to `packages/ai-rules/presets/**` (and `.claude/**` dogfood if present).
+
+## Heavy workflows
+
+Orchestrator, feature-delivery, code-review, post-change gates, domain globs — **requestable / paths**, not always-on.
+
+## Verifier
+
+build-verifier **FAIL** if alwaysApply / session-start count exceeds 3 (Claude count **excludes `**/README.md`**), or if a `preset-*` meta rule is marked always-on.

package/presets/cursor/svelte/rules/preset-twin-sync.mdc

@@ -0,0 +1,54 @@
+---
+description: Preset authoring: Cursor SoT → Claude twin same PR. Use when editing preset rules.
+globs:
+  - packages/ai-rules/presets/**/*
+  - .cursor/rules/**/*
+  - .cursor/team/tasks/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: meta/preset-twin-sync.md -->
+
+# Preset twin sync
+
+Cursor `.mdc` — **SoT per stack**. Claude topic `.md` — derived twin.
+
+## Matrix
+
+| Stack | Cursor SoT | Claude derive | Mapping table |
+|-------|------------|---------------|---------------|
+| `next` | `presets/cursor/next/rules/*.mdc` | `presets/claude/next/rules/<topic>/` | **Required** in `claude/next/rules/README.md` |
+| `nuxt` | `presets/cursor/nuxt/rules/*.mdc` | `presets/claude/nuxt/rules/<topic>/` | **Required** in `claude/nuxt/rules/README.md` |
+| `svelte` | `presets/cursor/svelte/rules/*.mdc` | `presets/claude/svelte/rules/<topic>/` | **Required** in `claude/svelte/rules/README.md` |
+| `ios-swift` | `presets/cursor/ios-swift/rules/*.mdc` | `presets/claude/ios-swift/rules/<topic>/` | Keep in `claude/ios-swift/rules/README.md` |
+| `go` | `presets/cursor/go/rules/*.mdc` | `presets/claude/go/rules/<topic>/` | Keep in `claude/go/rules/README.md` |
+| `java` | `presets/cursor/java/rules/*.mdc` | `presets/claude/java/rules/<topic>/` | Keep in `claude/java/rules/README.md` |
+| `mcp-ts` | `presets/cursor/mcp-ts/rules/*.mdc` | `presets/claude/mcp-ts/rules/<topic>/` | Keep in `claude/mcp-ts/rules/README.md` |
+| `php-hexagonal` | `presets/cursor/php-hexagonal/rules/*.mdc` | `presets/claude/php-hexagonal/rules/<topic>/` | Keep in `claude/php-hexagonal/rules/README.md` |
+| `php-laravel` | `presets/cursor/php-laravel/rules/*.mdc` | `presets/claude/php-laravel/rules/<topic>/` | Keep in `claude/php-laravel/rules/README.md` |
+
+## Same-PR checklist
+
+1. Edit Cursor rule first (body + frontmatter).
+2. Update Claude twin: body + `paths:` (from Cursor `globs:` / requestable triggers); drop `alwaysApply`.
+3. Update mapping table row if stem/path changed.
+4. If body embeds core (`<!-- shared-core: … -->`), sync core consumers across stacks when core changed.
+
+## Twin depth
+
+- **Domain** rules: ≥15 body lines (FAIL if thin without documented alias reason).
+- **Thin aliases** (`agent-team-intake`, `technical-retro`): may be shorter (soft) if they only point to a command/skill.
+
+## Severity (build-verifier)
+
+- **next:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **nuxt:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **svelte:** missing Claude twin for a changed Cursor rule → **FAIL** (mapping table required).
+- **ios-swift:** missing Claude twin for a changed Cursor rule → **FAIL**.
+- **go:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift; mapping table required).
+- **java:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go; mapping table required).
+- **mcp-ts:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java; mapping table required).
+- **php-hexagonal:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts; mapping table required).
+- **php-laravel:** missing Claude twin for a changed Cursor rule → **FAIL** (same as next / ios-swift / go / java / mcp-ts / php-hexagonal; mapping table required).
+
+Dogfood: sync packages → root `.cursor/` after Cursor SoT changes (not the reverse). Use `packages/ai-rules/scripts/sync-dogfood-cursor.sh`.

package/presets/cursor/svelte/rules/public-imports.mdc

@@ -0,0 +1,45 @@
+---
+description: Import domain types and API only through public barrels ($lib/types, $lib/api)
+globs:
+  - src/lib/components/**/*
+  - src/lib/stores/**/*
+  - src/lib/**/*
+  - src/routes/**/*
+  - src/lib/types/**/*
+  - src/lib/api/**/*
+alwaysApply: false
+impact: HIGH
+---
+
+# Public imports (`$lib/types`, `$lib/api`)
+
+Preferred alias: **`$lib`**. Accept **`@/`** if consumer vite/tsconfig maps it. Respect `$app/*` / `$env/*` — do not invent modules.
+
+## `$lib/types` (or `@/types`)
+
+- Public types API — barrel `src/lib/types/index.ts`; outside the layer — only `$lib/types` / `@/types`.
+- Forbidden to bypass the barrel via deep imports of internal type files (except a project enum convention if present).
+- Inside `src/lib/types/**` — relative imports.
+
+```typescript
+// ✅
+import type { TUserProfile } from '$lib/types'
+
+// ❌
+import type { TUserProfile } from '$lib/types/User.types'
+```
+
+## `$lib/api` (or `@/api`)
+
+- Public API — barrel `src/lib/api/index.ts`. Outside `src/lib/api/**` — only `$lib/api` / `@/api`.
+- Inside the layer — relative imports and `$lib/api/services/**` / `$lib/clients/**` as neighbors do.
+
+```typescript
+// ✅
+import { ordersApi } from '$lib/api'
+
+// ❌
+import { ordersApi } from '$lib/api/services/orders/orders.service'
+```
+
+New public symbols — re-export in the barrel per **`layer-barrel-exports`**.

package/presets/cursor/svelte/rules/reference-features.mdc

@@ -0,0 +1,51 @@
+---
+description: Repository reference features — mirror their structure when implementing new work. Fill in paths after init in the target repo.
+globs:
+  - src/lib/components/**/*
+  - src/lib/stores/**/*
+  - src/lib/api/**/*
+  - src/lib/types/**/*
+  - src/routes/**/*
+alwaysApply: false
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features
+
+## Stack notes
+
+Before implementing, find a feature of the same type and **mirror its structure**; do not invent a new file organization.
+
+Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README.md) · [Preset contribution guide](../../../../docs/PRESET-CONTRIBUTION.md).
+
+## Reference table
+
+Replace **TBD** with real paths after team agreement (or on `ai-rules init` in the target repo):
+
+| Layer | Reference | What to copy |
+|-------|-----------|--------------|
+| UI route / page | **TBD** `src/routes/<example>/` | `+page.svelte`, `+page.ts`, layout nesting |
+| UI component | **TBD** `src/lib/components/<Example>/` | `.svelte`, styles, barrel |
+| Store | **TBD** `src/lib/stores/<example>.ts` | writable/derived or runes module, actions |
+| API service | **TBD** `src/lib/api/services/<example>/` | service, mappers, barrel |
+| Types module | **TBD** `src/lib/types/<example>/` | domain types, JSDoc, barrel export |
+| Unit tests | **TBD** next to the reference mapper/service | `*.spec.ts`, describe/it naming |
+| E2E area | **TBD** `tests/e2e/<Area>/` | `*.cases.md`, page objects, `_shared/` |
+
+## How to use
+
+1. Identify affected layers from `decomposition.md` or the task.
+2. Open the reference from the table (after paths are filled in).
+3. Mirror naming, file order, import patterns, and tests.
+4. If there is no reference — pick the **closest** existing feature in the same layer and record the choice in the handoff.
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
+## Related rules
+
+- `code-quality-and-refactoring.mdc` — repeat patterns; no deep-import.
+- `feature-delivery-workflow.mdc` — layer order.
+- skill `feature-delivery` — end-to-end scenario.

package/presets/cursor/svelte/rules/security-sveltekit.mdc

@@ -0,0 +1,38 @@
+---
+description: SvelteKit security — env, SSR secrets, CSRF, XSS, hooks, +server
+globs: src/routes/**/*,src/hooks.server.ts,src/hooks.client.ts,src/lib/**/*
+alwaysApply: false
+---
+
+# Security (SvelteKit)
+
+## Secrets & env
+
+- Private secrets: `$env/static/private` / server-only modules — **never** import into client `.svelte` / universal modules that ship to browser.
+- Public config: `$env/static/public` (prefixed per project convention).
+- Do not commit `.env` with secrets; do not log tokens.
+
+## Server boundaries
+
+- `+server.ts`, `+page.server.ts`, `hooks.server.ts` may touch private env and privileged backends.
+- Do not import `.svelte` UI into server handlers by default.
+- Prefer `$lib/api` for domain client services; keep BFF thin.
+
+## XSS / HTML
+
+- Prefer text interpolation; `{@html …}` only with sanitized/trusted content.
+- Follow `svelte-a11y-coding` and eslint-plugin-svelte a11y where configured.
+
+## CSRF / forms
+
+- Prefer Kit form actions + progressive enhancement patterns already in the repo.
+- Validate/authorize on the server; never trust client-only checks for authz.
+
+## HTTP client
+
+- Use project `fetch` wrapper (`http-client`); forward cookies via `load`/`event.fetch` for same-origin SSR when required.
+- Do not put credentials in public env or client bundles.
+
+## Agent discipline
+
+- If unsure whether a module is server-only, check filename (`.server.ts`), imports, and siblings — mark `// VERIFY` rather than guessing.

package/presets/cursor/svelte/rules/store-svelte.mdc

@@ -0,0 +1,66 @@
+---
+description: Svelte stores and runes — client state (SvelteKit)
+globs: src/lib/stores/**/*.ts,src/lib/stores/**/*.js,**/*.svelte.ts
+alwaysApply: false
+impact: HIGH
+---
+
+# Shared principles
+
+- **Primary (Svelte 5):** runes in `.svelte` / `.svelte.ts` — `$state`, `$derived`, `$effect`, `$props`, `$bindable` as applicable.
+- **Secondary (legacy / shared):** `writable` / `derived` / `readable` from `svelte/store` when neighbors do so or for shared state outside runes — “follow neighbors”.
+- Store / shared modules hold **domain models**, not raw DTOs.
+- DTO → domain mapping — in `src/lib/api/**` (or server mappers) **before** writing to store/runes.
+- UI-only flags may stay local in the component (`$state`) if that is the repo convention.
+
+# Forbidden in this preset
+
+- RTK / Redux: `createSlice`, `createAsyncThunk`, RTK Query, `useDispatch` / `useSelector`, stem `store-rtk`.
+- Pinia / Vuex: `defineStore`, stem `store-pinia`.
+- Raw `fetch` from the store bypassing `$lib/api` services (except narrow documented repo exceptions).
+- Importing `$state` / runes from invented packages — only Svelte runtime / documented APIs for the installed major.
+
+# Structure
+
+- Domain module — file under `src/lib/stores/**` (e.g. `src/lib/stores/profile.ts` or `profile.svelte.ts`).
+- Export explicit store factories / rune modules; names as neighbors use.
+- Actions / functions call services from `$lib/api` (`public-imports`).
+
+# Async
+
+```ts
+// Incorrect — raw HTTP + DTO in state
+import { writable } from 'svelte/store'
+export const profile = writable(null)
+export async function loadProfile() {
+  profile.set(await fetch('/api/profile').then((r) => r.json()))
+}
+
+// Correct
+import { writable } from 'svelte/store'
+import { profileApi } from '$lib/api'
+import type { Profile } from '$lib/types'
+
+export const profile = writable<Profile | null>(null)
+
+export async function loadProfile() {
+  profile.set(await profileApi.getProfile())
+}
+```
+
+# Typing and errors
+
+- Domain types from `$lib/types` (or `@/types` if aliased).
+- Transport errors — contracts from types / the accepted client class (`http-client`).
+- In UI: `$profile` / subscribe / `$derived` — follow neighbors.
+
+# Testing
+
+- Cover important stores / rune modules (init, transitions, actions with mocked API).
+- Unit: Vitest; mock `$lib/api` services.
+
+# Agent requirement
+
+- Do not put HTTP/transport in components.
+- Strictly type state/actions.
+- Follow the style of neighboring stores / runes modules.

package/presets/cursor/svelte/rules/svelte-a11y-coding.mdc

@@ -0,0 +1,27 @@
+---
+description: Accessibility conventions for Svelte components and routes
+globs: src/lib/components/**/*,src/routes/**/*
+alwaysApply: false
+---
+
+# Svelte a11y coding
+
+- Prefer semantic HTML (`button`, `a`, `label`, landmarks) over clickable `div`/`span`.
+- Interactive elements need keyboard support and visible focus — follow neighbors and design system.
+- Images: meaningful `alt` (or empty alt for decorative).
+- Forms: associate labels; surface errors accessibly.
+- Respect `eslint-plugin-svelte` a11y rules when configured; do not blanket-disable without why.
+- Dynamic UI (dialogs, menus): focus trap / restore patterns already used in the repo — do not invent a second a11y stack.
+- Pair with `svelte-ui` and `architecture-boundaries-ui`.
+
+## Incorrect
+
+```svelte
+<div onclick={submit}>Save</div>
+```
+
+## Correct
+
+```svelte
+<button type="submit">Save</button>
+```

package/presets/cursor/svelte/rules/svelte-app-core.mdc

@@ -0,0 +1,45 @@
+---
+description: Core principles, stack, and architecture for a SvelteKit app (preset)
+alwaysApply: true
+---
+
+# Stack and environment
+
+Concrete versions — **from `package.json` and configs in the target repository**. Preset frame: SvelteKit, Svelte 5 (primary), TypeScript; runner/e2e/mocks/UI/APM — as established in the repo.
+
+# Project structure
+
+| Path | Purpose |
+|------|---------|
+| `src/routes/**` | Routes, layouts, load, form actions (`+page`, `+layout`, `+server`) |
+| `src/lib/components/**` | UI components (`.svelte`) |
+| `src/lib/**` | Facades / utils (no Vue-style `composables/` tree) |
+| `src/lib/stores/**` | Svelte stores + shared runes modules |
+| `src/lib/api/**` | Client services + mappers (barrel) |
+| `src/lib/clients/**` | HTTP (`fetch` wrapper) |
+| `src/hooks.server.ts` / `src/hooks.client.ts` | App hooks |
+| `src/lib/types/**` | Domain types (barrel) |
+| `tests/e2e/**` | Playwright e2e |
+
+**Aliases:** prefer `$lib`; respect `$app/*` / `$env/*` (do not invent symbols); accept `@/` if configured. Scripts cwd — **SvelteKit root** (where `svelte.config.*` lives), not a Next-style `app/` wrapper.
+
+# Architectural layers
+
+| Layer | Directory | Details |
+|-------|-----------|---------|
+| UI | `src/routes/**`, `src/lib/components/**` | `svelte-ui`, `architecture-boundaries-ui` |
+| Facades | `src/lib/**` | thin orchestration; no raw HTTP |
+| Store | `src/lib/stores/**` | `store-svelte` — writable/derived/readable + runes |
+| API | `src/lib/api/**` | `api-services`, `http-client` |
+| HTTP | `src/lib/clients/**` | wrap `fetch` |
+| Server | `+server.ts`, hooks | `security-sveltekit`; not a substitute for `src/lib/api/**` |
+| Types | `src/lib/types/**` | `public-imports`, `types-jsdoc` |
+
+Boundaries — **`architecture-boundaries`**. Imports `$lib/types`, `$lib/api` (or `@/…` if aliased) — **`public-imports`**. **Forbidden:** RTK / Pinia / stems `store-rtk` / `store-pinia`, React/RSC, Vue/Nuxt defaults, paths `app/src/**` / `pages/**` / `composables/**` as canon.
+
+# Agent work
+
+- Architecture and imports: `architecture-boundaries`, `public-imports`
+- Features: `feature-delivery-workflow` + skill `feature-delivery`
+- After edits: **invoke** `post-change-lint` (requestable); package manager: `package-manager`
+- Copy neighbor patterns; prefer `unknown` over `any`

package/presets/cursor/svelte/rules/svelte-script-conventions.mdc

@@ -0,0 +1,33 @@
+---
+description: Svelte script conventions — lang=ts, runes primary, follow neighbors
+globs: "**/*.{svelte,ts}"
+alwaysApply: false
+---
+
+# Svelte script conventions
+
+- In `.svelte`: prefer `<script lang="ts">` (or project dual-script pattern if neighbors use it).
+- **Svelte 5 primary:** `$state` / `$derived` / `$effect` / `$props` / snippets for new code.
+- **Legacy secondary:** `svelte/store` writable/derived when neighbors use them — do not rewrite unrelated modules to runes in a drive-by.
+- Keep `<script>` focused: UI bindings + thin orchestration; HTTP only via `$lib/api` / store actions.
+- Prefer `unknown` over `any`; narrow before use.
+- Do not invent Options-API / Vue `<script setup>` patterns in this preset.
+- Arrow vs function: follow local neighbors; no blanket rewrite.
+
+## Incorrect
+
+```svelte
+<script>
+  // no lang=ts in a TS codebase; Vue setup APIs
+  import { ref } from 'vue'
+  const count = ref(0)
+</script>
+```
+
+## Correct
+
+```svelte
+<script lang="ts">
+  let count = $state(0)
+</script>
+```