@{
    # ── Rules to suppress project-wide ──────────────────────────────────────────
    ExcludeRules = @(
        # All CI scripts use Write-Host for structured output captured by act_runner.
        # Write-Output would interleave with function return values and break callers.
        'PSAvoidUsingWriteHost'
    )

    # ── Rule-specific configuration ──────────────────────────────────────────────
    Rules = @{
        # Security: never eval arbitrary strings
        PSAvoidUsingInvokeExpression = @{
            Enable = $true
        }

        # All state-changing functions must support -WhatIf / ShouldProcess
        PSUseShouldProcessForStateChangingFunctions = @{
            Enable = $true
        }

        # Credentials must flow as [PSCredential], not plain strings
        PSUsePSCredentialType = @{
            Enable = $true
        }

        # No plain-text passwords in params or variables
        PSAvoidUsingPlainTextForPassword = @{
            Enable = $true
        }

        # ConvertTo-SecureString -AsPlainText only acceptable during template setup;
        # use Suppress comments there if needed.
        PSAvoidUsingConvertToSecureStringWithPlainText = @{
            Enable = $true
        }

        # No script-scope globals that bleed across module boundaries
        PSAvoidGlobalVars = @{
            Enable = $true
        }

        # Formatting — 4-space indentation, spaces (not tabs)
        PSUseConsistentIndentation = @{
            Enable              = $true
            IndentationSize     = 4
            PipelineIndentation = 'IncreaseIndentationForFirstPipeline'
            Kind                = 'space'
        }

        PSUseConsistentWhitespace = @{
            Enable                          = $true
            CheckInnerBrace                 = $true
            CheckOpenBrace                  = $true
            CheckOpenParen                  = $true
            CheckOperator                   = $true
            CheckPipe                       = $true
            CheckPipeForRedundantWhitespace = $true
            CheckSeparator                  = $true
            CheckParameter                  = $false
        }

        # Alignment is a style preference; disable to avoid false positives on
        # the deliberate column-aligned hashtable assignments used in this project.
        PSAlignAssignmentStatement = @{
            Enable = $false
        }
    }
}