main

Project rules for a TypeScript service that provides one interface to several AI providers and includes caching, queues, usage analysis, and telemetry. TypeScript is JavaScript with optional type checks, while runtime validation checks data when the program runs.

In plain words
What is it for?
Use them when adding or changing gateway features, defining configuration or data structures, validating requests and responses, and working with provider integrations.
Why use it?
They keep changes consistent by requiring checked input and output data and by avoiding unsafe untyped values. This matters when the service connects different AI providers.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/adaline/gateway/main
Clone the repo
git clone --depth 1 https://github.com/adaline/gateway

Made for: Cursor.

Per session 3,683 This file is loaded in full into every session.
When invoked 3,683 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03683 $0.03683
Opus 5 $0.01842 $0.01842
Sonnet 5 $0.00737 $0.00737
Haiku 4.5 $0.00368 $0.00368

Measured 2d ago against content hash 7ce2d14e8b11, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

main scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/main.mdc · 558 lines

How it starts

The opening of the file, as written. The whole thing — 558 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Adaline Gateway Repository - Main Rules

Repository Overview

This is a TypeScript-based AI gateway service that provides unified interfaces for multiple AI providers (OpenAI, Anthropic, Google, etc.) with features like caching, queuing, analytics, and telemetry.

Core Architecture Principles

1. Type Safety & Schema Validation

Rules
  • ALWAYS use Zod schemas for runtime validation
  • ALWAYS export both the schema and inferred types
  • NEVER use any type - use proper generic constraints
  • ALWAYS validate input/output at runtime using schemas
Instructions
// ✅ CORRECT: Define schema first, then type
import { z } from 'zod';

const UserConfig = z.object({
  apiKey: z.string().min(1),
  model: z.string().min(1),
  temperature: z.number().min(0).max(2).default(1.0),
});
type UserConfigType = z.infer<typeof UserConfig>;

// Export both schema and type
export { UserConfig, type UserConfigType };

// ❌ INCORRECT: Using any type
function processData(data: any): any {
  return data; // Unsafe and loses type information
}

// ✅ CORRECT: Proper typing with validation
function processData(data: unknown): UserConfigType {
  return UserConfig.parse(data); // Validates at runtime
}
Implementation Steps
  1. Install Zod: npm install zod
  2. Define Schema: Create Zod schema with proper constraints
  3. Infer Type: Use z.infer<typeof SchemaName> for TypeScript types
  4. Export Both: Export schema for runtime validation, type for compile-time checking
  5. Validate Input: Use schema.parse() or schema.safeParse() for validation

2. Error Handling

Rules
  • ALWAYS use custom error classes extending GatewayError
  • ALWAYS provide meaningful error messages with context
  • ALWAYS handle errors gracefully with proper logging
  • NEVER let unhandled errors bubble up
Instructions
// ✅ CORRECT: Custom error class with context
import { GatewayError } from "./errors";

export class ProviderConnectionError extends GatewayError {
  constructor(
    message: string,
    public readonly provider: string,
    public readonly statusCode: number,
    public readonly originalError?: Error
  ) {
    super(`Failed to connect to ${provider}: ${message} (Status: ${statusCode})`, "PROVIDER_CONNECTION_ERROR");
  }
}

// Usage in code
try {
  await provider.makeRequest();
} catch (error) {
  if (error instanceof HttpError) {
    throw new ProviderConnectionError("API request failed", "anthropic", error.status, error);
  }
  throw error;
}

Read the full file on GitHub · 558 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 558 lines · 3,683 tokens per session scan A 7ce2d14e8b11

Subscribe to this mod's changes

main is a cursor rule published in the GitHub repository adaline/gateway (605 stars, last pushed 1mo ago), licensed MIT. It adds 3,683 tokens to every session, about $0.0184 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.