Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/transloadit/node-sdk/typescriptgit clone --depth 1 https://github.com/transloadit/node-sdkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01267 | $0.01267 |
| Opus 5 | $0.00633 | $0.00633 |
| Sonnet 5 | $0.00253 | $0.00253 |
| Haiku 4.5 | $0.00127 | $0.00127 |
Grade A, and why
typescript scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
For Typescript:
- Favor
contentGapItemSchema = z.object()overContentGapItemSchema = z.object() - Favor
from './PosterboyCommand.ts'overfrom './PosterboyCommand' - Favor
return ideas.filter(isPresent)overideas.filter((idea): idea is Idea => idea !== null) - Favor using
.tsxover.jsxfile extensions. - Use Node v24's native typestripping vs
tsxorts-node. These days you do not even need to pass--experimental-strip-types,node app.tswill just work. - In ESM TypeScript, use
import.meta.dirname/import.meta.filenameorURLobjects instead of rebuilding__dirnamewithfileURLToPath(import.meta.url)unless compatibility requires it. - Use
satisfieswhen you need literal preservation or structural conformance while keeping the expression's inferred type. If the variable should simply have a declared type, use a type annotation instead. - Avoid redundant type annotations inside expressions when TypeScript already infers the exact type, especially callback parameters. Keep explicit return types and public boundary annotations.
- Avoid
as, consider it a sin. If a cast is unavoidable, keep it as narrow as possible and explain the upstream type mismatch or runtime invariant. - For DOM queries and browser APIs, prefer runtime narrowing such as
element instanceof HTMLAnchorElementover type casts. Decide explicitly whether a missing element should throw, return early, or no-op. - Browser/client code must not use Node-only globals or APIs such as
Buffer. Use browser platform APIs such asbtoa,TextEncoder,Blob, orURL, or isolate the logic in server-only code. - When browser APIs are missing TypeScript declarations, augment the global interface in
_types/global.ts(or the relevant shared global types file) and narrow with checks such astypeof navigator.setAppBadge === 'function'instead of castingnavigatorlocally. - Prefer typed DOM properties such as
element.inert = trueandelement.tabIndex = -1when the platform exposes them. UsesetAttribute()only when you intentionally need raw attribute semantics. - Favor
unknownoverany, consideranya sin - Avoid
as unknown as ...andbiome-ignore lint/suspicious/noExplicitAny. If an upstream library type forces either, isolate it in a tiny adapter/helper with a comment naming the bad upstream type. - Every
@ts-expect-errormust be narrow and include a short explanation of the upstream type gap or invariant that makes it safe. - Favor validating data with Zod over using
anyor custom type guards - Extract duplicated Zod object shapes, regexes, and descriptions into reusable schema fragments
when they describe the same domain concept. Keep property-level concerns such as
.optional()and.default()at the property site unless absence is intrinsic to the reusable fragment. - Boolean Zod properties should usually use explicit defaults instead of
.optional()when omission has normal default behavior. Only leave a boolean optional whenundefinedis semantically different fromfalse. - Prefer
z.union([...])over chained.or()for multi-branch unions, and preferz.enum()or literal unions over clever regexes when the accepted values are finite and autocomplete matters. - Do not duplicate supported values in user-facing schema descriptions when schema metadata such as enums or suggested values can carry that information.
- In TypeScript files, use TypeScript syntax instead of JSDoc type annotations. In JavaScript files,
prefer JSDoc
@import/@paramforms over noisy inlineimport('...')annotations, and make sure@typeannotates the expression it is meant to type. - Avoid hand-written
.d.tsfiles when the declaration can come from TypeScript source or generation. If a declaration file is unavoidable, do not rely onskipLibCheckto hide duplicate or invalid exports. - Avoid
Reflect.getfor normal object property reads. After narrowing to a record, userecord[key]or a small typed reader helper. Only keepReflect.getfor exotic receivers such as proxies or framework objects where its semantics are intentionally required, and document why. - Prefer
Number.isFinite()/Number.isNaN()over globalisFinite()/isNaN()so numeric checks do not silently coerce non-numbers. isRecordstyle guards must reject arrays:typeof value === 'object' && value !== null && !Array.isArray(value). Prefer importing a shared guard when one already exists in the relevant shared layer.- Type-only refactors must preserve runtime behavior. If the behavior intentionally changes, call it out in the PR and cover the changed behavior with tests.
- Use ECMAScript
#privatefields for private state. Do not rely on underscore names or TypeScriptprivateto imply runtime privacy. - Prefer Zod defaults/preprocessing for schema-backed default values instead of duplicating default objects in runtime code.
- For local TypeScript files, import with the
.ts/.tsxextension (not.js, not extensionless). Note: we do not currently enable the TS 5.7rewriteRelativeImportExtensionscompiler option, because it errors on non-relative imports that include.ts/.tsx(for example viapathsaliases like@/…). If/when we enable it, we will need to adjust those imports first. - Favor defining props as an interface over inline
- Favor explicit return types over inferring them as it makes typescript a lot faster in the editor on our scale
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 79 lines · 1,267 tokens per session scan A 23387551d699
typescript is a cursor rule published in the GitHub repository transloadit/node-sdk (73 stars, last pushed 2d ago), licensed MIT. It adds 1,267 tokens to every session, about $0.0063 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
prefer-assertions-over-defensive-checks
Prefer assertions over defensive checks when data is guaranteed to be valid.
as-contract-cast-smell
// ❌ WRONG — bypasses the family ContractSerializer seam const contract = JSON.parse(raw) as Contract; const contract = JSON.parse(raw) as Contract .
no-family-vocabulary-in-framework
The framework domain (packages/1-framework) carries no family- or target-specific vocabulary — types, fields, hooks, or strategy values. Enforced by the no-family-vocabulary Biome plugin plus lint:framework-vocabulary.
no-barrel-files
Avoid barrel files and unnecessary re-exports.
interface-factory-pattern
Interface-based design with factory functions (keep classes private).
explicit-opt-in-over-diagnostics
Prefer requiring explicit opt-in over emitting diagnostics on intentional user paths.