version: 1
components:
  domain:
    role: core
    paths:
      - internal/domain/**
  usecase:
    role: usecase
    paths:
      - internal/usecase/**
  ports:
    role: ports
    paths:
      - internal/ports/**
  adapters:
    role: adapter
    paths:
      - internal/adapters/**
  clientlimit:
    # Per-client HTTP rate limiting: infrastructure shared by the HTTP adapters.
    role: adapter
    paths:
      - internal/clientlimit/**
  httprange:
    # Byte-range selection: infrastructure shared by the HTTP adapters.
    role: adapter
    paths:
      - internal/httprange/**
  mediapolicy:
    # Video host validation and CSP sources: shared HTTP infrastructure.
    role: adapter
    paths:
      - internal/mediapolicy/**
  entrypoints:
    # cmd/ermite only calls app.Run.
    role: entrypoint
    paths:
      - cmd/**
  app:
    # Composition root and CLI: builds the adapters and wires them to the use
    # cases. hexcheck has no dedicated bootstrap role; entrypoint is the
    # closest.
    role: entrypoint
    paths:
      - internal/app/**
  config:
    role: entrypoint
    paths:
      - internal/config/**
  generated:
    role: ignore
    paths:
      - gen/**
      - '**/mocks/**'
      - '**/*_templ.go'
  readertest:
    # Test-only fixtures and conformance suite for ports.RepoReader.
    role: ignore
    paths:
      - internal/readertest/**
# Cross-layer contracts live in ports: adapters and use cases import ports and
# domain, never each other. hexcheck has no rule for an adapter importing a use
# case or internal/app; internal/boundary/boundary_test.go enforces the full
# import matrix.
rules:
  no-adapter-imports-in-core: error
  no-infra-imports-in-usecase: error
  no-framework-types-in-core: error
  no-infra-types-in-ports: error
  no-adapter-to-adapter-imports: warn
  suspicious-business-logic-in-adapter: warn
  no-local-fakes-for-ports: warn
  missing-generated-mock-for-port: warn
  prefer-generated-mocks: warn
mocking:
  generatedMockPaths:
    - internal/ports/mocks/**
  generatedMockNamePatterns:
    - '{{Interface}}'
allow:
  # Secret-source exclusivity and file decoding are configuration validation,
  # not domain policy; config is intentionally a composition-root helper.
  - rule: suspicious-business-logic-in-adapter
    path: internal/config/config.go
    reason: validates explicit environment and secret-file sources at startup
  # clientlimit is a shared infrastructure library, not a sibling adapter: the
  # HTTP adapters that rate-limit clients import it by design.
  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/githttp/**
    reason: rate-limits Git clients with internal/clientlimit
  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/githubapi/**
    reason: rate-limits the clients of the REST subset with internal/clientlimit and selects byte ranges with internal/httprange
  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/oidchttp/**
    reason: rate-limits the clients of the OIDC token endpoint with internal/clientlimit
  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/rpc/**
    reason: rate-limits API clients with internal/clientlimit
  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/web/**
    reason: rate-limits login attempts with internal/clientlimit, selects byte ranges with internal/httprange and shares video hosts with internal/mediapolicy

  - rule: no-adapter-to-adapter-imports
    path: internal/adapters/httpserver/**
    reason: shares external video hosts and CSP sources with internal/mediapolicy