baseline.toml

# baseline.toml — Fast Rust-based code quality enforcement
# Replaces grit rules + select architecture.test.ts checks
#
# Remaining tests in baseline/architecture.test.ts:
#   T1  org-scoped queries (complex 49-table window with asymmetric search)
#   T4  client env var isolation (needs negative lookahead for NEXT_PUBLIC_)
#   T7  @tanstack/react-form in server (needs dual-quote 'use client' check)
#   T8  redirect() inside try/catch (needs brace-depth tracking)
#   T9  no console.log (needs template literal awareness)
#   T12 metadata save order (needs ordering semantics within function)
#   T13 duplicate infrastructure helpers (cross-file uniqueness)
#   T14 tailwind v3 css-var syntax (baseline skips files with lines >= 500
#       chars, which is exactly the dense-className files this rule targets)

[baseline]
name = "wraps"
include = ["**/*"]
extends = ["security"]
exclude = [
  "**/node_modules/**",
  "**/dist/**",
  "**/build/**",
  "**/.next/**",
  "**/target/**",
  "**/__tests__/**",
  "**/*.test.*",
  "**/.git/**",
  "**/.gritmodules/**",
]

[[baseline.scoped]]
preset = "nextjs"
path = "apps/web"

[[baseline.scoped]]
preset = "nextjs"
path = "apps/website"


# ══════════════════════════════════════════════
# BANNED IMPORTS
# ══════════════════════════════════════════════


[[rule]]
id = "no-axios"
type = "banned-import"
severity = "error"
packages = ["axios"]
glob = "**/*.{ts,tsx}"
message = "Use the native fetch API instead of axios."
suggest = "Replace with fetch() or a lightweight wrapper"

[[rule]]
id = "no-dayjs"
type = "banned-import"
severity = "error"
packages = ["dayjs"]
glob = "**/*.{ts,tsx}"
message = "Use date-fns or native Intl API instead of dayjs."
suggest = "Import from 'date-fns' or use Intl.DateTimeFormat"

[[rule]]
id = "no-moment"
type = "banned-import"
severity = "error"
packages = ["moment"]
glob = "**/*.{ts,tsx}"
message = "Use date-fns or native Intl API instead of moment.js (large bundle, deprecated)."
suggest = "Import from 'date-fns' or use Intl.DateTimeFormat"

[[rule]]
id = "no-next-router"
type = "banned-import"
severity = "error"
packages = ["next/router"]
glob = "**/*.{ts,tsx}"
message = "Use next/navigation instead of next/router. See Next.js App Router migration guide."
suggest = "Import from 'next/navigation' instead"

[[rule]]
id = "no-clsx-tailwind-merge"
type = "banned-import"
severity = "error"
packages = ["clsx", "tailwind-merge"]
glob = "**/*.{ts,tsx}"
message = "Use `cn` from the local lib/utils (backed by the `cn` package) instead of clsx or tailwind-merge."
suggest = "Import { cn } from '@/lib/utils' (or '@wraps/ui/lib/utils')"


# ══════════════════════════════════════════════
# ARCHITECTURE RULES (replaces select tests)
# ══════════════════════════════════════════════

# T6: No direct @radix-ui imports outside UI wrappers
[[rule]]
id = "no-radix-direct"
type = "banned-import"
severity = "error"
packages = [
  "@radix-ui/react-accordion",
  "@radix-ui/react-alert-dialog",
  "@radix-ui/react-aspect-ratio",
  "@radix-ui/react-avatar",
  "@radix-ui/react-checkbox",
  "@radix-ui/react-collapsible",
  "@radix-ui/react-context-menu",
  "@radix-ui/react-dialog",
  "@radix-ui/react-dropdown-menu",
  "@radix-ui/react-hover-card",
  "@radix-ui/react-label",
  "@radix-ui/react-menubar",
  "@radix-ui/react-navigation-menu",
  "@radix-ui/react-popover",
  "@radix-ui/react-progress",
  "@radix-ui/react-radio-group",
  "@radix-ui/react-scroll-area",
  "@radix-ui/react-select",
  "@radix-ui/react-separator",
  "@radix-ui/react-slider",
  "@radix-ui/react-slot",
  "@radix-ui/react-switch",
  "@radix-ui/react-tabs",
  "@radix-ui/react-toast",
  "@radix-ui/react-toggle",
  "@radix-ui/react-toggle-group",
  "@radix-ui/react-tooltip",
]
glob = "apps/**/*.{ts,tsx}"
exclude_glob = ["**/components/ui/**"]
message = "Import shadcn wrappers from packages/ui, not @radix-ui directly."
suggest = "Import the component from '@repo/ui' instead"

# T2: Server action form error handling
[[rule]]
id = "server-action-form-errors"
type = "required-pattern"
severity = "error"
glob = "apps/web/src/actions/**/*.ts"
pattern = "formState"
condition_pattern = "createServerValidate"
message = "Files using createServerValidate must handle formState in catch blocks."
suggest = "Add: catch (e) { if (e instanceof ServerValidateError) return e.formState; throw e; }"

# T3: API routes must await async operations
[[rule]]
id = "no-fire-and-forget"
type = "window-pattern"
severity = "error"
pattern = "\\.catch\\("
condition_pattern = "await"
max_count = 15
regex = true
glob = "apps/api/src/routes/**/*.ts"
message = "Possible fire-and-forget: .catch() without await in API route. Lambda terminates when handler returns."
suggest = "Add await before the promise chain"

# T5a: No arbitrary hex colors in web app
[[rule]]
id = "no-hex-colors-web"
type = "banned-pattern"
severity = "error"
pattern = "(?:bg|text|border|ring|outline|shadow|accent|caret|fill|stroke|decoration)-\\[#[0-9a-fA-F]+\\]"
regex = true
glob = "apps/web/src/**/*.{ts,tsx}"
exclude_glob = ["**/components/ui/**", "**/lib/ai/**"]
message = "No arbitrary hex colors in Tailwind classes. Use theme tokens instead."
suggest = "Replace with a semantic color token from the design system"


# ══════════════════════════════════════════════
# RATCHET RULES
# ══════════════════════════════════════════════

# T5b: Hex colors in website (ratchet down from 41)
[[rule]]
id = "ratchet-hex-colors-website"
type = "ratchet"
severity = "error"
pattern = "(?:bg|text|border|ring|outline|shadow|accent|caret|fill|stroke|decoration)-\\[#[0-9a-fA-F]+\\]"
regex = true
max_count = 0
glob = "apps/website/src/**/*.{ts,tsx}"
exclude_glob = ["**/components/ui/**"]
message = "No arbitrary hex colors in Tailwind classes. Use theme tokens instead."

# T5c: Hardcoded white/black in web app (ratchet down from 177)
[[rule]]
id = "ratchet-white-black-web"
type = "ratchet"
severity = "error"
pattern = "(?:bg|text|border|ring|outline|shadow|accent|caret|fill|stroke|decoration)-(?:white|black)"
regex = true
max_count = 27
glob = "apps/web/src/**/*.{ts,tsx}"
exclude_glob = ["**/components/ui/**"]
message = "Migrate hardcoded white/black to theme colors for dark mode support (27 remaining, ratchet down)"

# Banned: react-hook-form (fully migrated to @tanstack/react-form)
[[rule]]
id = "no-react-hook-form"
type = "banned-import"
severity = "error"
packages = ["react-hook-form"]
glob = "**/*.{ts,tsx}"
message = "Use @tanstack/react-form instead of react-hook-form."
suggest = "Import from '@tanstack/react-form' instead"

[[rule]]
id = "no-hookform-resolvers"
type = "banned-import"
severity = "error"
packages = ["@hookform/resolvers"]
glob = "**/*.{ts,tsx}"
message = "Use @tanstack/react-form validators instead of @hookform/resolvers."
suggest = "Use inline validators or @tanstack/zod-form-adapter"

# Ratchet: raw Tailwind color utilities missing dark: variants
[[rule]]
id = "ratchet-dark-mode-web"
type = "ratchet"
severity = "error"
pattern = "(?:bg|text|border|ring|outline|shadow|accent|caret|fill|stroke|decoration|from|to|via)-(?:white|black|(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-\\d{2,3})"
regex = true
max_count = 988
glob = "apps/web/src/**/*.tsx"
exclude_glob = ["**/components/ui/**"]
message = "Migrate raw color utilities to theme tokens or add dark: variants (988 remaining, ratchet down)"

# Ratchet: raw Tailwind colors that should be semantic tokens
[[rule]]
id = "ratchet-theme-tokens-web"
type = "ratchet"
severity = "error"
pattern = "(?:bg|text|border)-(?:white|black|(?:gray|slate)-(?:50|100|200|300|400|500|600|700|800|900|950))"
regex = true
max_count = 71
glob = "apps/web/src/**/*.tsx"
exclude_glob = ["**/components/ui/**"]
message = "Use semantic tokens (bg-background, text-foreground, border-border) instead of raw colors (69 remaining, ratchet down)"

# Ratchet: reduce `as any` type assertions (baselined at 95)
[[rule]]
id = "ratchet-as-any"
type = "ratchet"
severity = "error"
pattern = "as any"
max_count = 93
glob = "**/*.{ts,tsx}"
# blog page files excluded: substring pattern false-positives on marketing prose
# (e.g. "as any verified identity" in agent-mailboxes/page.tsx), not TS assertions.
# Scoped to prose-bearing page files only — other blog code (charts, OG images) stays covered.
exclude_glob = [
  "**/__tests__/**",
  "**/*.test.*",
  "**/*.config.*",
  "**/app/blog/**/page.tsx",
  "**/app/blog/**/page-content.tsx",
]
message = "Reduce 'as any' assertions — use proper types or 'as unknown' (93 remaining, ratchet down)"


# ══════════════════════════════════════════════
# BANNED DEPENDENCIES (audit package.json)
# ══════════════════════════════════════════════

[[rule]]
id = "dep-no-axios"
type = "banned-dependency"
severity = "error"
packages = ["axios"]
message = "axios is banned. Use native fetch."

[[rule]]
id = "dep-no-moment"
type = "banned-dependency"
severity = "error"
packages = ["moment", "dayjs"]
message = "Use date-fns or Intl API instead."

[[rule]]
id = "dep-no-react-hook-form"
type = "banned-dependency"
severity = "error"
packages = ["react-hook-form", "@hookform/resolvers"]
message = "Fully migrated to @tanstack/react-form. Do not re-add."

# ══════════════════════════════════════════════
# ESM ENFORCEMENT
# ══════════════════════════════════════════════

[[rule]]
id = "no-commonjs-require"
type = "banned-pattern"
severity = "error"
pattern = "(?:^|\\s)require\\(['\"]"
regex = true
glob = "**/*.{ts,tsx}"
exclude_glob = ["**/node_modules/**", "**/*.config.*", "**/next.config.*", "packages/pulumi/**"]
message = "Use ESM imports, not require(). This is an ESM-only codebase."
suggest = "Replace with: import ... from '...'"

[[rule]]
id = "no-module-exports"
type = "banned-pattern"
severity = "error"
pattern = "^module\\.exports\\s*="
regex = true
glob = "**/*.{ts,tsx}"
exclude_glob = ["**/node_modules/**", "**/*.config.*"]
message = "Use export/export default, not module.exports."
suggest = "Replace with: export default ... or export { ... }"


# ══════════════════════════════════════════════
# TYPE SAFETY
# ══════════════════════════════════════════════

[[rule]]
id = "no-ts-ignore"
type = "banned-pattern"
severity = "error"
pattern = "@ts-ignore"
glob = "**/*.{ts,tsx}"
message = "Use @ts-expect-error instead of @ts-ignore (fails when the suppressed error is fixed)."
suggest = "Replace with @ts-expect-error and add a reason comment"

[[rule]]
id = "no-catch-any"
type = "banned-pattern"
severity = "error"
pattern = "catch\\s*\\(\\s*\\w+\\s*:\\s*any\\s*\\)"
regex = true
glob = "packages/cli/src/**/*.ts"
message = "catch (error: any) should be catch (error) with type guards."
suggest = "Use catch (error) and narrow with instanceof checks"


# ══════════════════════════════════════════════
# ERROR HANDLING
# ══════════════════════════════════════════════

[[rule]]
id = "no-swallowed-errors"
type = "banned-pattern"
severity = "error"
pattern = "catch\\s*\\(\\s*_\\w|[})\\]]\\s*catch\\s*\\{"
regex = true
glob = "packages/cli/src/commands/**/*.ts"
message = "Swallowed error — use specific error checks instead of ignoring."
suggest = "Capture the error and handle it with instanceof checks"


# ══════════════════════════════════════════════
# FILE PRESENCE
# ══════════════════════════════════════════════
#
# NOTE: code-baseline 1.6.0 does not load user-declared `file-presence` rules
# at all — these two are kept only as documentation of intent; they do not
# run (verified: a scan alongside a banned-pattern rule reports "1 rules
# loaded", not 2, and a missing required file produces no diagnostic). Root
# env files (.env, .env.local) are guarded by the built-in `no-env-files`
# rule from `extends = ["security"]`; apps/web/.env and apps/api/.env are
# not. The real checks now live in
# baseline/architecture.test.ts ("file-presence guardrails" describe block).
# Do not delete these rules — that would silently invite someone to re-add
# them believing they work.

[[rule]]
id = "required-project-files"
type = "file-presence"
severity = "error"
required = ["CLAUDE.md", "baseline.toml", "turbo.json", "biome.jsonc"]
message = "Critical project files must not be deleted."

[[rule]]
id = "no-env-committed"
type = "file-presence"
severity = "error"
forbidden = [".env", ".env.local", "apps/web/.env", "apps/api/.env"]
message = "Environment files must not be committed to the repository."


# ══════════════════════════════════════════════
# INFRASTRUCTURE CONVENTIONS
# ══════════════════════════════════════════════

[[rule]]
id = "resource-tagging"
type = "required-pattern"
severity = "error"
glob = "packages/cli/src/infrastructure/resources/*.ts"
exclude_glob = ["**/iam.ts", "**/__tests__/**"]
pattern = "ManagedBy"
message = "All infrastructure resources must include ManagedBy: 'wraps-cli' tag."
suggest = "Add tags: { ManagedBy: 'wraps-cli' } to the resource (iam.ts is excluded — tags applied via shared/iam.ts helper)"

[[rule]]
id = "resource-prefix"
type = "required-pattern"
severity = "error"
glob = "packages/cli/src/infrastructure/resources/*.ts"
pattern = "wraps-"
message = "All resource names must use the wraps- prefix."
suggest = "Prefix the resource name with wraps-email- or wraps-sms-"


# ══════════════════════════════════════════════
# PRESET OVER-RIDES (security preset)
# ══════════════════════════════════════════════

# Override security preset: console.log is legitimate in CLI, Lambda, API,
# build scripts, and docs code examples. Only warn in dashboard UI code.
[[rule]]
id = "no-console-log"
type = "banned-pattern"
severity = "warning"
pattern = "console\\.log"
regex = true
glob = "**/*.{ts,tsx}"
exclude_glob = [
  "packages/cli/**",
  "packages/cdk/**",
  "packages/console/**",
  "packages/pulumi/**",
  "**/scripts/**",
  "**/*.config.*",
  "**/*.test.*",
  "**/__tests__/**",
  "**/*.mjs",
  "**/*.md",
  "apps/api/src/lib/logger.ts",
  "apps/website/src/app/docs/**",
  "apps/website/src/app/blog/**",
  "apps/website/src/app/inbound/**",
  "apps/website/src/app/landing/**",
]
message = "Remove console.log before deploying — use a proper logger or remove debug output"

# Override security preset: http:// URLs are legitimate in SVGs (xmlns),
# DNSBL lookups, docs code examples, and localhost dev fallbacks
[[rule]]
id = "no-http-links"
type = "banned-pattern"
severity = "error"
pattern = "http://"
glob = "**/*.{ts,tsx}"
exclude_glob = [
  "**/svgs/**",
  "**/email-check/**",
  "**/*-content.tsx",
  "**/infrastructure/**",
  "**/auth-client.ts",
  "**/brand-kit/**",
  "packages/auth/src/index.ts",
  "**/scripts/**",
  "**/console/**",
  "packages/cli/**",
  "apps/api/src/index.ts",
  "apps/web/src/actions/members.ts",
  "apps/website/src/app/landing/**",
  "apps/website/src/app/blog/**",
  "**/*.config.*",
]
message = "Insecure http:// URL — use https:// instead"

# Override security preset: dangerouslySetInnerHTML used legitimately for
# code syntax highlighting (docs/blog), email preview, and JSON-LD
[[rule]]
id = "no-dangerous-html"
type = "ratchet"
severity = "error"
pattern = "dangerouslySetInnerHTML"
max_count = 4
glob = "**/*.{ts,tsx}"
exclude_glob = ["**/node_modules/**"]
message = "Reduce dangerouslySetInnerHTML usage — sanitize content or use safe alternatives (4 remaining, ratchet down)"

# Override security preset: innerHTML used for asciinema cleanup and GTM injection
[[rule]]
id = "no-innerhtml"
type = "ratchet"
severity = "error"
pattern = "\\.innerHTML"
regex = true
max_count = 4
glob = "**/*.{ts,tsx}"
exclude_glob = ["**/node_modules/**"]
message = "Reduce innerHTML usage — use textContent or a sanitizer (4 remaining, ratchet down)"