Wouldn't it make sense to move the domain package to engine/internal?
When the go command sees an import of a package with internal in its path, it verifies that the package doing the import is within the tree rooted at the parent of the internal directory.