deptrac.yaml

deptrac:
  paths:
    - ./packages
  layers:
    - name: Kernel
      collectors:
        - type: directory
          value: packages/kernel/src/.*
    - name: Container
      collectors:
        - type: directory
          value: packages/container/src/.*
    - name: Config
      collectors:
        - type: directory
          value: packages/config/src/.*
    - name: Context
      collectors:
        - type: directory
          value: packages/context/src/.*
    - name: AutoConfigure
      collectors:
        - type: directory
          value: packages/autoconfigure/src/.*
    - name: Validation
      collectors:
        - type: directory
          value: packages/validation/src/.*
    - name: Web
      collectors:
        - type: directory
          value: packages/web/src/.*
    - name: Resilience
      collectors:
        - type: directory
          value: packages/resilience/src/.*
    - name: Scheduling
      collectors:
        - type: directory
          value: packages/scheduling/src/.*
    - name: SchedulingPostgres
      collectors:
        - type: directory
          value: packages/scheduling-postgres/src/.*
    - name: Domain
      collectors:
        - type: directory
          value: packages/domain/src/.*
    - name: Data
      collectors:
        - type: directory
          value: packages/data/src/.*
    - name: Eda
      collectors:
        - type: directory
          value: packages/eda/src/.*
    - name: EdaRabbitmq
      collectors:
        - type: directory
          value: packages/eda-rabbitmq/src/.*
    - name: EdaPostgres
      collectors:
        - type: directory
          value: packages/eda-postgres/src/.*
    - name: EdaKafka
      collectors:
        - type: directory
          value: packages/eda-kafka/src/.*
    - name: Messaging
      collectors:
        - type: directory
          value: packages/messaging/src/.*
    - name: Cqrs
      collectors:
        - type: directory
          value: packages/cqrs/src/.*
    - name: Security
      collectors:
        - type: directory
          value: packages/security/src/.*
    - name: Actuator
      collectors:
        - type: directory
          value: packages/actuator/src/.*
    - name: Observability
      collectors:
        - type: directory
          value: packages/observability/src/.*
    - name: Testing
      collectors:
        - type: directory
          value: packages/testing/src/.*
    - name: Cli
      collectors:
        - type: directory
          value: packages/cli/src/.*
    - name: Installer
      collectors:
        - type: directory
          value: packages/installer/src/.*
  ruleset:
    # Kernel is the zero-dependency foundation.
    Kernel: ~
    # Container may depend on Kernel (and on external Illuminate/Symfony, which Deptrac ignores as unlayered).
    Container:
      - Kernel
    # Config layers on Kernel (errors) and Container (ValueResolver seam + DTO registration).
    Config:
      - Kernel
      - Container
    # Context is the boot engine: it composes Container + Config and reports Kernel errors.
    Context:
      - Kernel
      - Container
      - Config

    # AutoConfigure drives the M4 engine: it assembles BeanDefinitions from Container+Context manifests,
    # binds the kernel, and contributes Context passes. It must NOT depend on any capability package.
    AutoConfigure:
      - Kernel
      - Container
      - Config
      - Context

    # Validation core (Validator/IlluminateValidator/Rule/*) needs only Kernel + illuminate/validation.
    # Container: ValidationAutoConfiguration's #[Configuration]/#[Bean]/#[Order] attributes.
    # Context: its #[ConditionalOnMissingBean]. AutoConfigure: the AutoConfiguration base its provider extends.
    Validation:
      - Kernel
      - Container
      - AutoConfigure
      - Context

    # Web is the HTTP layer: it triggers Bean Validation (=> Validation), assembles BeanDefinitions via
    # AutoConfigure's seam, contributes Context passes, and reads Config. Validation must NOT depend on Web.
    Web:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Validation

    # Resilience is a leaf capability: cache-backed primitives + a config-built registry. It reads Config,
    # reuses Kernel infra exceptions, carries Container/Context attributes, and extends AutoConfigure's base.
    # No capability layer (Web/Validation) may depend on it; it must not depend on them.
    Resilience:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure

    # Scheduling is a leaf capability: a DistributedLock port + adapters, a #[Scheduled] scanner/manifest, and a
    # ScheduleWiringPass. It reads Config, reuses Kernel infra exceptions (CacheLock's unsupported-store guard),
    # carries Container/Context attributes, extends AutoConfigure's base, and depends on Resilience for
    # Duration::parse (fixed-rate/lock-ttl durations). No capability layer (Web/Validation) may depend on it.
    Scheduling:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Resilience

    # SchedulingPostgres is the Postgres advisory-lock adapter for Scheduling's DistributedLock port: it ships
    # in its own package (every backend its own package) so the core scheduling package stays free of the
    # pdo_pgsql dependency. It reads Config indirectly via #[ConditionalOnProperty], carries Container/Context
    # attributes, extends AutoConfigure's base, and implements Scheduling's DistributedLock interface.
    SchedulingPostgres:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Scheduling

    # Domain is the pure DDD base: Entity / ValueObject / AggregateRoot / DomainEvent. It carries no framework
    # dependency (Kernel is permitted but deliberately unused). NOTHING may depend on Domain except Data.
    Domain:
      - Kernel

    # Data is the persistence + transaction-interception capability. It reuses Kernel infra exceptions, carries
    # Container/Context attributes (the BPP seam, #[Configuration]/#[Bean] auto-config), reads Config, extends
    # AutoConfigure's base, and builds on Domain (after-commit event dispatch). It depends on illuminate
    # (database/support/contracts), which Deptrac ignores as unlayered. Data -> Domain, NEVER the reverse.
    Data:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Domain

    # Eda is an async event-transport leaf capability: an EventPublisher broker-bus port + in-memory/queue adapters,
    # a #[EventListener] scanner/manifest, retry/DLQ, and a serializer seam. It reads Config, reuses Kernel infra
    # exceptions, carries Container/Context attributes, extends AutoConfigure's base, and depends on illuminate
    # (queue/bus/container/contracts/support), which Deptrac ignores as unlayered. NO edge to/from Messaging; no
    # capability layer (Web/Validation/Resilience/Scheduling/Data) may depend on it, and it depends on none of them.
    Eda:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure

    # EdaRabbitmq is the RabbitMQ adapter for Eda's EventPublisher port (php-amqplib): its own package (every
    # broker its own package, the SchedulingPostgres precedent) so the core eda package stays free of the
    # php-amqplib dependency. It reads Config indirectly via #[ConditionalOnProperty], carries Container/Context
    # attributes, extends AutoConfigure's base, implements Eda's EventPublisher, and supplies an Actuator
    # HealthIndicator. It is depended on by NONE.
    EdaRabbitmq:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Eda
      - Actuator

    # EdaPostgres is the GENUINE same-transaction Postgres OUTBOX adapter for Eda's EventPublisher port: its own
    # package (every broker its own package, the SchedulingPostgres precedent) so the core eda package stays free of
    # the pdo_pgsql dependency. Its PostgresEventPublisher writes the outbox row on the aggregate's current
    # connection (illuminate/database, ignored as unlayered); its OutboxPreCommitHook implements Data's
    # PreCommitEventHook (=> Data) and reuses Cqrs's EdaCommandEventPublisher/HandlerManifest/CorrelationContext to
    # mirror the after-commit domain->envelope mapping (=> Cqrs), mapping Domain's DomainEvent (=> Domain); it supplies
    # an Actuator HealthIndicator (=> Actuator). It reads Config indirectly via #[ConditionalOnProperty], carries
    # Container/Context attributes, and extends AutoConfigure's base. It is depended on by NONE.
    EdaPostgres:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Domain
      - Data
      - Eda
      - Cqrs
      - Actuator

    # EdaKafka is the Kafka adapter for Eda's EventPublisher port over the OPTIONAL ext-rdkafka (suggest +
    # extension_loaded guard, never a hard require): its own package (every broker its own package, the
    # SchedulingPostgres/EdaRabbitmq/EdaPostgres precedent) so the core eda package stays free of the rdkafka
    # dependency. It reads Config indirectly via #[ConditionalOnProperty], carries Container/Context attributes,
    # extends AutoConfigure's base, implements Eda's EventPublisher, and supplies an Actuator HealthIndicator. It
    # is depended on by NONE.
    EdaKafka:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Eda
      - Actuator

    # Messaging is a lower-level raw-bytes transport leaf capability: a MessageBrokerPort + in-memory/queue adapters,
    # a #[MessageListener] scanner/manifest, and a bytes-aware retry/DLQ. It reads Config, reuses Kernel infra
    # exceptions, carries Container/Context attributes, extends AutoConfigure's base, and depends on illuminate
    # (queue/bus/container/contracts/support). NO edge to/from Eda (independent siblings); no capability layer may
    # depend on it, and it depends on none of them.
    Messaging:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure

    # Cqrs is the command/query dispatch capability that COMPOSES lower layers: a synchronous CommandBus/QueryBus +
    # HandlerRegistry, #[CommandHandler]/#[QueryHandler] stereotypes discovered by HandlerScanner into a manifest, a
    # CqrsHandlerWiringPass, a bounded pipeline of seams, and the domain->integration bridge. It reuses Kernel
    # exceptions, carries Container stereotypes + Context boot/condition/#event attributes, reads Config, extends
    # AutoConfigure's base, validates over Validation's Validator, maps Domain's DomainEvent, and publishes to Eda's
    # EventPublisher. NO edge to Data (the bridge listens on in-process DomainEvents via the 'events' dispatcher +
    # an instanceof filter, never Data's AggregateTracker/DomainEventDispatcher). Nothing may depend on Cqrs; it is a
    # top-of-stack capability like Web.
    Cqrs:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Validation
      - Domain
      - Eda

    # Security is a top-of-stack capability (like Web/Cqrs): a first-party principal model + authn/authz that
    # LIGHTS UP pre-built seams. It reuses Kernel security exceptions, carries Container stereotypes + Context
    # boot/condition attributes, reads Config, extends AutoConfigure's base, adds a no-op ControllerSecurityGuard
    # port to Web and a real impl, supplies Cqrs's Command/QueryAuthorizer + Data's AuditorAware, and may validate
    # over Validation. NOTHING depends on Security.
    Security:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Web
      - Data
      - Cqrs
      - Validation

    # Actuator is a top-of-stack capability (like Web/Cqrs/Security): health/info/introspection endpoints mounted on
    # the illuminate Router by a route-registration BootPass. It reads Config, carries Container stereotypes + Context
    # boot/condition attributes, extends AutoConfigure's base, mounts on Web (RouteManifest/ProblemDetailsRenderer/
    # filters), and reads the Scheduling manifest for /scheduledtasks. Its Db health indicator uses illuminate DB
    # DIRECTLY (no Data->Actuator edge). No Actuator->Security edge (secured by config). NOTHING depends on Actuator.
    Actuator:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Web
      - Scheduling

    # Observability is a top-of-stack capability: a pure-PHP MeterRegistry + Prometheus exposition whose metrics
    # endpoints implement Actuator's ActuatorEndpoint contract (=> Actuator), instruments HTTP via a Web filter
    # (=> Web), backs Cqrs's CqrsMetrics seam (=> Cqrs), and gauges Resilience circuit breakers (=> Resilience). It
    # reads Config, carries Container/Context attributes, extends AutoConfigure's base. NOTHING depends on it.
    Observability:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Web
      - Actuator
      - Cqrs
      - Resilience

    # Testing is the top-of-stack test-support kit: its recording doubles implement every capability
    # package's frozen ports, so it depends on ALL layers. It is depended on by NONE — consumers use it
    # only from their tests/, which Deptrac's src-only collectors never see (no cycle; dev-scoped dep).
    Testing:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Validation
      - Web
      - Resilience
      - Scheduling
      - SchedulingPostgres
      - Domain
      - Data
      - Eda
      - Messaging
      - Cqrs
      - Security
      - Actuator
      - Observability

    # Cli is the top-of-stack developer-experience package: firefly:cache drives each of the 12
    # compile-producing packages' scanner/compiler pair directly (D4 DIRECT DEPENDENCY). UNLIKE Testing
    # (whose composer.json genuinely requires the full runtime family, so it legitimately lists all 18
    # layers), firefly/cli's composer.json requires exactly the packages ManifestCacheWriter/CacheCommand/
    # ActuatorCliRenderer call into — so this ruleset lists ONLY those layers, deliberately OMITTING
    # Domain/Resilience/SchedulingPostgres (not required by packages/cli/composer.json, not called by any
    # writer/scanner). It is depended on by NONE. It does NOT depend on Testing (dev-only).
    Cli:
      - Kernel
      - Container
      - Config
      - Context
      - AutoConfigure
      - Validation
      - Web
      - Scheduling
      - Data
      - Eda
      - Messaging
      - Cqrs
      - Security
      - Actuator
      - Observability

    # Installer is the standalone global `firefly new` tool: symfony/console + symfony/process ONLY,
    # ZERO firefly runtime deps, so a global install never drags in the framework. Depends on nothing
    # layered; depended on by none.
    Installer: ~