@morriconeluca/eslint-plugin-faf 0.1.1 → 0.3.0

package/README.md

@@ -1,4 +1,4 @@
-# eslint-plugin-faf
+# @morriconeluca/eslint-plugin-faf
 
 An ESLint plugin to deterministically enforce the rules and constraints of the **[Fractal Architecture Framework (FAF)](https://github.com/morriconeluca/fractal-architecture-framework)**.
 
@@ -15,23 +15,32 @@ This plugin is designed for complex TypeScript/JavaScript codebases to ensure **
 
 ---
 
+## Companion Tooling
+
+`eslint-plugin-faf` does not detect dependency cycles. FAF requires the dependency graph to be a Directed Acyclic Graph, but enforcing that is intentionally left to dedicated tools, configured separately in your project:
+
+- [`eslint-plugin-import-x`](https://github.com/un-ts/eslint-plugin-import-x)'s `import-x/no-cycle` rule.
+- [`dependency-cruiser`](https://github.com/sverweij/dependency-cruiser), for cycle detection and other custom dependency fitness functions.
+
+---
+
 ## Installation
 
 Install the plugin along with its peer dependencies:
 
 ```bash
-npm install eslint-plugin-faf --save-dev
+npm install @morriconeluca/eslint-plugin-faf --save-dev
 # or
-yarn add eslint-plugin-faf --dev
+yarn add @morriconeluca/eslint-plugin-faf --dev
 # or
-pnpm add eslint-plugin-faf -D
+pnpm add @morriconeluca/eslint-plugin-faf -D
 ```
 
 ---
 
 ## Configuration
 
-`eslint-plugin-faf` is configured via the ESLint flat config file (`eslint.config.ts` or `eslint.config.js`). All architectural settings are loaded from the global `settings.faf` object.
+`@morriconeluca/eslint-plugin-faf` is configured via the ESLint flat config file (`eslint.config.ts` or `eslint.config.js`). All architectural settings are loaded from the global `settings.faf` object.
 
 ### 1. Integration in `eslint.config.ts`
 
@@ -40,7 +49,7 @@ For a clean setup, we recommend defining your FAF taxonomy settings in a separat
 Since FAF is an **all-or-nothing architectural system**, all rules must be active as blocking errors to prevent architectural drift. The canonical way to integrate it is by extending `fafPlugin.configs.recommended` (which pre-configures all rules as `"error"`) and injecting your settings:
 
 ```typescript
-import fafPlugin from 'eslint-plugin-faf';
+import fafPlugin from '@morriconeluca/eslint-plugin-faf';
 import fafSettings from './faf.config';
 
 export default [
@@ -213,8 +222,12 @@ export default {
           {
             // Subtree where intermediate folders are classified as organizational Layers,
             // and the terminal Fragment must contain a Master Node with the specified role (e.g. '.api.ts')
+            // and a name following the "<method>-<object>" pattern (e.g. 'get-todo')
             paths: ['src/_src@shared/_network/_apis'],
             role: 'api',
+            // Optional: restricts which HTTP methods are valid as the Fragment name prefix.
+            // Defaults to all standard HTTP methods (get, post, put, patch, delete, head, options, connect, trace).
+            httpMethods: ['get', 'post', 'put', 'patch', 'delete'],
           },
         ],
       },
@@ -264,8 +277,9 @@ Verifies folders, files, and roles comply with FAF taxonomy:
 
 - Enforces `kebab-case` naming for all folders and files in the logical domain.
 - Validates that internal Fragment files share their parent Fragment's name prefix (e.g. files in folder `button/` must be named `button.<role>.<ext>`).
-- Enforces role suffix validation on Fragment Nodes and Logical Nodes.
-- Assures route terminal Fragments contain the appropriate Master Node (e.g. a `.api.ts` file under `_apis`).
+- Enforces role suffix validation on Fragment Nodes and Logical Nodes, restricted to a single Role segment per file name.
+- Requires every Fragment to contain at least one Fragment Node (its Master Node), and forbids two Fragment Nodes from sharing the same Role.
+- Assures route terminal Fragments contain the appropriate Master Node (e.g. a `.api.ts` file under `_apis`) and that the Fragment name follows the `<method>-<object>` pattern (e.g. `get-todo`), with the HTTP method restricted to `routeHierarchies[].httpMethods` or, by default, all standard HTTP methods.
 - Enforces FAF logical domain containment rules:
   - Root Fragments can only reside directly in the Root Container or another Root Fragment.
   - Layers cannot reside inside Fragments.
@@ -289,7 +303,7 @@ Applies **Fragment Encapsulation**:
 
 Applies **Private Category Encapsulation**:
 
-- Restricts consumption of elements inside a Private Category (e.g. `_components/` nested inside a Fragment) to files within the parent Fragment or its sub-fragments.
+- Restricts consumption of elements inside a Private Category (e.g. `_components/` nested inside a Fragment) to the direct child Fragment Nodes of the owning Fragment/Root Fragment, and to sibling nodes within the same immediate sub-domain of the Private Category. Access does not extend to other sub-domains, nor to a Fractal Branch nested inside the Private Category (governed instead by its own encapsulation rule).
 
 ### 5. `faf/no-fractal-branch-leak`
 
@@ -304,7 +318,7 @@ Applies **Peer Isolation**:
 - Prevents sibling files and folders from importing each other unless an explicit hierarchy is configured:
   - **Inside a Fragment**: Flow is governed by the `roles` array order.
   - **Between folders**: Flow is governed by `localHorizontalHierarchies` or `globalHorizontalHierarchies`. If undefined, the linter falls back to mapped roles. Otherwise, peer isolation is strictly enforced.
-  - **Root Nodes**: Flow is governed by the defined index order in `rootFragments.rootNodes`.
+  - **Root Nodes**: Flow is governed exclusively by the defined index order in `rootFragments.rootNodes`. Root Nodes are exempt from the Role naming convention, so relationships between them never fall back to the `roles` scale: any relationship without a matching `rootNodes` entry is denied.
 
 ### 7. `faf/category-mutually-exclusive`
 

package/dist/main.cjs

@@ -39,8 +39,12 @@ module.exports = __toCommonJS(main_exports);
 // package.json
 var package_default = {
   name: "@morriconeluca/eslint-plugin-faf",
-  version: "0.1.1",
+  version: "0.3.0",
   description: "An ESLint plugin for FAF projects.",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/morriconeluca/eslint-plugin-faf.git"
+  },
   main: "./dist/main.cjs",
   module: "./dist/main.js",
   types: "./dist/main.d.ts",
@@ -52,7 +56,8 @@ var package_default = {
     }
   },
   publishConfig: {
-    access: "public"
+    access: "public",
+    provenance: true
   },
   imports: {
     "#_rules@shared/*": "./src/_rules/_rules@shared/*",
@@ -353,6 +358,9 @@ var rule = {
           if (catConfig) {
             const ext = import_path5.default.extname(fileName);
             const isAllowedAsset = catConfig.allowedExtensions?.includes(ext) ?? false;
+            if (!isAllowedAsset && catConfig.allowedExtensions && catConfig.allowedExtensions.length > 0) {
+              return;
+            }
             if (!catConfig.allowSingleFiles && !isAllowedAsset) {
               context.report({
                 message: `Category "${folderName}" cannot contain file nodes directly. File "${fileName}" must be encapsulated inside a Fragment.`,
@@ -472,6 +480,17 @@ function getProjectRoot() {
 
 // src/_rules/naming-conventions/naming-conventions.rule.ts
 var KEBAB_CASE_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var DEFAULT_HTTP_METHODS = [
+  "connect",
+  "delete",
+  "get",
+  "head",
+  "options",
+  "patch",
+  "post",
+  "put",
+  "trace"
+];
 var rule3 = {
   create(context) {
     return {
@@ -635,15 +654,6 @@ var rule3 = {
         if (parentType === "invalid-fragment") {
           return;
         }
-        if (fileName === "index.ts" || fileName === "index.js") {
-          if (parentType !== "fragment") {
-            context.report({
-              message: `Access Nodes ("index.ts/index.js") are exclusive to Fragments. Found index file directly inside "${folderName}" (classified as ${parentType}).`,
-              node
-            });
-          }
-          return;
-        }
         const rfConfig = getRootFragmentConfig(relDir, config);
         if (rfConfig) {
           const flatRootNodes = rfConfig.rootNodes.flat();
@@ -659,11 +669,34 @@ var rule3 = {
             return;
           }
         }
+        if (fileName === "index.ts" || fileName === "index.js") {
+          if (parentType !== "fragment") {
+            context.report({
+              message: `Access Nodes ("index.ts/index.js") are exclusive to Fragments. Found index file directly inside "${folderName}" (classified as ${parentType}).`,
+              node
+            });
+          } else {
+            const contents = readDirCached(relDir);
+            const hasFragmentNode = contents.files.some(
+              (f) => f !== "index.ts" && f !== "index.js" && f !== "README.md" && f !== "package.json" && f !== "tsconfig.json"
+            );
+            if (!hasFragmentNode) {
+              context.report({
+                message: `Fragment "${folderName}" has no Master Node. Every Fragment must contain at least one Fragment Node establishing its Role.`,
+                node
+              });
+            }
+          }
+          return;
+        }
         if (fileName === "README.md" || fileName === "package.json" || fileName === "tsconfig.json") {
           return;
         }
         const role = getFileRole(fileName, config);
         const ext = import_path7.default.extname(fileName);
+        const allRoleNames = new Set(config.roles.flat());
+        const roleSegments = fileName.slice(0, fileName.length - ext.length).split(".").slice(1).filter((part) => allRoleNames.has(part));
+        const multiRoleMessage = `File "${fileName}" composes multiple Roles ("${roleSegments.join('", "')}") in its name. A Logical Node may declare only one Role; promote the detail that needs its own Role to an autonomous Sub-Fragment.`;
         if (parentType === "fragment") {
           const matchedRoute = config.routeHierarchies?.find(
             (rh) => rh.paths.some((rp) => relDir === rp || relDir.startsWith(rp + "/"))
@@ -677,6 +710,16 @@ var rule3 = {
                 node
               });
             }
+            const httpMethods = matchedRoute.httpMethods ?? DEFAULT_HTTP_METHODS;
+            const routeNameRegex = new RegExp(
+              `^(${httpMethods.join("|")})-[a-z0-9]+(-[a-z0-9]+)*$`
+            );
+            if (!routeNameRegex.test(folderName)) {
+              context.report({
+                message: `Route terminal Fragment "${folderName}" must follow the "<method>-<object>" pattern with a lowercase HTTP method (${httpMethods.join(", ")}).`,
+                node
+              });
+            }
           }
           let currentParent = import_path7.default.dirname(relDir).replace(/\\/g, "/");
           let categoryConfig = null;
@@ -715,6 +758,19 @@ var rule3 = {
               message: `File "${fileName}" inside Fragment "${folderName}" must have an explicit role suffix (e.g. "${folderName}.style${ext}").`,
               node
             });
+          } else if (roleSegments.length > 1) {
+            context.report({ message: multiRoleMessage, node });
+          } else {
+            const contents = readDirCached(relDir);
+            const duplicate = contents.files.find(
+              (f) => f !== fileName && f !== "index.ts" && f !== "index.js" && getFileRole(f, config) === role
+            );
+            if (duplicate) {
+              context.report({
+                message: `Fragment Node "${fileName}" shares Role "${role}" with sibling "${duplicate}". Each Fragment Node must have a unique Role within its Fragment.`,
+                node
+              });
+            }
           }
         }
         if (parentType === "category") {
@@ -745,6 +801,8 @@ var rule3 = {
                   message: `Role "${role}" for file "${fileName}" does not match the expected Category role "${catConfig.role}".`,
                   node
                 });
+              } else if (roleSegments.length > 1) {
+                context.report({ message: multiRoleMessage, node });
               }
             } else {
               if (role && role !== catConfig.role) {
@@ -752,6 +810,8 @@ var rule3 = {
                   message: `Role "${role}" for asset "${fileName}" does not match the expected Category role "${catConfig.role}".`,
                   node
                 });
+              } else if (role && roleSegments.length > 1) {
+                context.report({ message: multiRoleMessage, node });
               }
             }
           }
@@ -821,6 +881,16 @@ function _resolveImportPath(importPath, currentFileRelative, settings) {
   }
   return finalizeResolvedPath(relResolved);
 }
+var SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([
+  "cjs",
+  "cts",
+  "js",
+  "jsx",
+  "mjs",
+  "mts",
+  "ts",
+  "tsx"
+]);
 function finalizeResolvedPath(relResolved) {
   const resolvedDir = import_path8.default.dirname(relResolved).replace(/\\/g, "/");
   const resolvedBase = import_path8.default.basename(relResolved);
@@ -834,9 +904,12 @@ function finalizeResolvedPath(relResolved) {
   const parentContents = readDirCached(resolvedDir);
   const exactMatch = parentContents.files.find((f) => f === resolvedBase);
   if (!exactMatch) {
-    const matchWithExt = parentContents.files.find(
+    const candidates = parentContents.files.filter(
       (f) => f.startsWith(resolvedBase + ".")
     );
+    const matchWithExt = candidates.find(
+      (f) => SCRIPT_EXTENSIONS.has(f.slice(resolvedBase.length + 1))
+    ) ?? candidates[0];
     if (matchWithExt) {
       return (resolvedDir === "." ? "" : resolvedDir + "/") + matchWithExt;
     }
@@ -905,7 +978,7 @@ var rule4 = {
       if (importedFolderType === "fragment") {
         const isAccessNode = importedFile === "index.ts" || importedFile === "index.js";
         if (!isAccessNode) {
-          const isInside = relPath === importedDir || relPath.startsWith(importedDir + "/");
+          const isInside = import_path9.default.dirname(relPath) === importedDir;
           if (!isInside) {
             context.report({
               message: `Direct import of Fragment internal file "${importedFile}" is forbidden. You must import through its Access Node (index file) in "${importedDir}".`,
@@ -940,43 +1013,56 @@ var rule4 = {
 var no_direct_fragment_import_rule_default = rule4;
 
 // src/_rules/no-fractal-branch-leak/no-fractal-branch-leak.rule.ts
-var import_path11 = __toESM(require("path"), 1);
+var import_path12 = __toESM(require("path"), 1);
 
-// src/_rules/_rules@shared/_utils/_systems/get-private-category-owner/get-private-category-owner.util.ts
+// src/_rules/_rules@shared/_utils/_primitives/get-fractal-branch-owner/get-fractal-branch-owner.util.ts
 var import_path10 = __toESM(require("path"), 1);
-function getPrivateCategoryOwner(relPath, config) {
+function getFractalBranchOwner(relPath) {
   let current = relPath;
   while (current && current !== "." && current !== "/") {
+    const folderName = import_path10.default.basename(current);
+    if (folderName.startsWith("_") && folderName.includes("@shared")) {
+      return import_path10.default.dirname(current).replace(/\\/g, "/");
+    }
     const parent = import_path10.default.dirname(current).replace(/\\/g, "/");
     if (parent === current) {
       break;
     }
-    const currentType = classifyFolder(current, config);
-    const parentType = classifyFolder(parent, config);
-    if (currentType === "category" && (parentType === "fragment" || parentType === "root-fragment")) {
-      return parent;
-    }
     current = parent;
   }
   return null;
 }
 
-// src/_rules/no-fractal-branch-leak/no-fractal-branch-leak.rule.ts
-function getFractalBranchOwner(relPath) {
+// src/_rules/_rules@shared/_utils/_primitives/get-immediate-sub-domain/get-immediate-sub-domain.util.ts
+function getImmediateSubDomain(relPath, privateCategoryPath) {
+  if (relPath !== privateCategoryPath && !relPath.startsWith(privateCategoryPath + "/")) {
+    return "";
+  }
+  const relative = relPath.substring(privateCategoryPath.length + 1);
+  const firstSegment = relative.split("/")[0];
+  return firstSegment ? privateCategoryPath + "/" + firstSegment : privateCategoryPath;
+}
+
+// src/_rules/_rules@shared/_utils/_systems/get-private-category-info/get-private-category-info.util.ts
+var import_path11 = __toESM(require("path"), 1);
+function getPrivateCategoryInfo(relPath, config) {
   let current = relPath;
   while (current && current !== "." && current !== "/") {
-    const folderName = import_path11.default.basename(current);
-    if (folderName.startsWith("_") && folderName.includes("@shared")) {
-      return import_path11.default.dirname(current).replace(/\\/g, "/");
-    }
     const parent = import_path11.default.dirname(current).replace(/\\/g, "/");
     if (parent === current) {
       break;
     }
+    const currentType = classifyFolder(current, config);
+    const parentType = classifyFolder(parent, config);
+    if (currentType === "category" && (parentType === "fragment" || parentType === "root-fragment")) {
+      return { owner: parent, privateCategoryPath: current };
+    }
     current = parent;
   }
   return null;
 }
+
+// src/_rules/no-fractal-branch-leak/no-fractal-branch-leak.rule.ts
 var rule5 = {
   create(context) {
     const absPath = context.filename;
@@ -998,22 +1084,33 @@ var rule5 = {
       if (!resolvedRelPath) {
         return;
       }
-      const importedDir = import_path11.default.dirname(resolvedRelPath);
-      const owner = getFractalBranchOwner(importedDir);
-      if (owner) {
-        const isDescendant = relPath === owner || relPath.startsWith(owner + "/");
+      const importedDir = import_path12.default.dirname(resolvedRelPath);
+      const fractalBranchOwner = getFractalBranchOwner(importedDir);
+      if (fractalBranchOwner) {
+        const isDescendant = relPath === fractalBranchOwner || relPath.startsWith(fractalBranchOwner + "/");
         if (!isDescendant) {
           context.report({
-            message: `Importing from Fractal Branch is forbidden. The imported resource is private to "${owner}" and its descendants.`,
+            message: `Importing from Fractal Branch is forbidden. The imported resource is private to "${fractalBranchOwner}" and its descendants.`,
             node
           });
         } else {
-          const privateOwner = getPrivateCategoryOwner(importedDir, config);
-          if (privateOwner) {
-            const isPrivateDescendant = relPath === privateOwner || relPath.startsWith(privateOwner + "/");
-            if (!isPrivateDescendant) {
+          const info = getPrivateCategoryInfo(importedDir, config);
+          if (info) {
+            const { owner, privateCategoryPath } = info;
+            const isPrivateDirectChild = import_path12.default.dirname(relPath) === owner;
+            const importerSubDomain = getImmediateSubDomain(
+              relPath,
+              privateCategoryPath
+            );
+            const importedSubDomain = getImmediateSubDomain(
+              resolvedRelPath,
+              privateCategoryPath
+            );
+            const isInsideSameSubDomain = importerSubDomain !== "" && importerSubDomain === importedSubDomain;
+            const isFractalBranchAllowed = fractalBranchOwner === privateCategoryPath || fractalBranchOwner.startsWith(privateCategoryPath + "/");
+            if (!isPrivateDirectChild && !isInsideSameSubDomain && !isFractalBranchAllowed) {
               context.report({
-                message: `Importing from Private Category is forbidden. The imported resource is private to "${privateOwner}".`,
+                message: `Importing from Private Category is forbidden. The imported resource is private to "${owner}".`,
                 node
               });
             }
@@ -1046,7 +1143,7 @@ var rule5 = {
 var no_fractal_branch_leak_rule_default = rule5;
 
 // src/_rules/no-peer-dependency/no-peer-dependency.rule.ts
-var import_path12 = __toESM(require("path"), 1);
+var import_path13 = __toESM(require("path"), 1);
 
 // src/_rules/_rules@shared/_utils/_primitives/find-tree-config-including-excluded/find-tree-config-including-excluded.util.ts
 function findTreeConfigIncludingExcluded(relPath, settings) {
@@ -1124,7 +1221,7 @@ function resolveHorizontalHierarchy(lcaPath, subA, subB, config) {
 
 // src/_rules/no-peer-dependency/no-peer-dependency.rule.ts
 function getDirectoryRole(dirPath, config) {
-  const folderName = import_path12.default.basename(dirPath);
+  const folderName = import_path13.default.basename(dirPath);
   if (folderName.startsWith("_")) {
     return getRoleFromFolderName(folderName, config);
   }
@@ -1142,7 +1239,7 @@ function getRoleFromFolderName(name, config) {
   return catConfig ? catConfig.role ?? null : null;
 }
 function getRootNodeIndex(relPath, rfConfig, lcaPath) {
-  const relToLca = import_path12.default.relative(lcaPath, relPath).replace(/\\/g, "/");
+  const relToLca = import_path13.default.relative(lcaPath, relPath).replace(/\\/g, "/");
   for (let i = 0; i < rfConfig.rootNodes.length; i++) {
     const group = rfConfig.rootNodes[i];
     if (group && group.includes(relToLca)) {
@@ -1154,7 +1251,7 @@ function getRootNodeIndex(relPath, rfConfig, lcaPath) {
 function isInsidePrivateCategoryOfLca(relPathB, lcaPath, config) {
   let current = relPathB;
   while (current && current !== "." && current !== "/" && current !== lcaPath) {
-    const parent = import_path12.default.dirname(current).replace(/\\/g, "/");
+    const parent = import_path13.default.dirname(current).replace(/\\/g, "/");
     if (parent === current) {
       break;
     }
@@ -1179,7 +1276,7 @@ var rule6 = {
     if (!config) {
       return {};
     }
-    const currentDir = import_path12.default.dirname(relPath);
+    const currentDir = import_path13.default.dirname(relPath);
     const isCurrentFileExcluded = config.excludes?.some(
       (exc) => relPath === exc || relPath.startsWith(exc + "/")
     ) ?? false;
@@ -1212,10 +1309,10 @@ var rule6 = {
       if (isCurrentFileExcluded || isImportedFileExcluded) {
         return;
       }
-      const importedDir = import_path12.default.dirname(resolvedRelPath);
+      const importedDir = import_path13.default.dirname(resolvedRelPath);
       if (currentDir === importedDir) {
-        const fileA = import_path12.default.basename(relPath);
-        const fileB = import_path12.default.basename(resolvedRelPath);
+        const fileA = import_path13.default.basename(relPath);
+        const fileB = import_path13.default.basename(resolvedRelPath);
         const roleA = getFileRole(fileA, config);
         const roleB = getFileRole(fileB, config);
         if (roleA && roleB) {
@@ -1244,6 +1341,10 @@ var rule6 = {
         return;
       }
       if (subB === "" && classifyFolder(lca, config) === "fragment") {
+        context.report({
+          message: `Peer separation violation: "${subA}" cannot import directly from the root of Fragment "${lca}". A node nested inside a Private Category or Fractal Branch has no privileged access to its owning Fragment's other direct children; promote the shared resource to a Fractal Branch if the sharing need is genuine.`,
+          node
+        });
         return;
       }
       const rfConfig = getRootFragmentConfig(lca, config);
@@ -1253,13 +1354,22 @@ var rule6 = {
         if (idxRootA !== -1 && idxRootB !== -1) {
           if (idxRootB >= idxRootA) {
             context.report({
-              message: `Root Node import violation: "${import_path12.default.basename(relPath)}" cannot import from "${import_path12.default.basename(resolvedRelPath)}" under Root Fragment "${lca}".`,
+              message: `Root Node import violation: "${import_path13.default.basename(relPath)}" cannot import from "${import_path13.default.basename(resolvedRelPath)}" under Root Fragment "${lca}".`,
               node
             });
           }
           return;
         }
       }
+      const isSubARootFragment = classifyFolder(import_path13.default.posix.join(lca, subA), config) === "root-fragment";
+      const isSubBRootFragment = classifyFolder(import_path13.default.posix.join(lca, subB), config) === "root-fragment";
+      if (isSubARootFragment || isSubBRootFragment) {
+        context.report({
+          message: `Root Node import violation: "${relPath}" cannot import from "${resolvedRelPath}" because no "rootNodes" relationship is configured under Root Fragment "${lca}". Relationships between Root Nodes must always be explicitly authorized by the architect.`,
+          node
+        });
+        return;
+      }
       const { allowed, defined: hasDefinedHierarchy } = resolveHorizontalHierarchy(lca, subA, subB, config);
       if (hasDefinedHierarchy) {
         if (!allowed) {
@@ -1269,8 +1379,8 @@ var rule6 = {
           });
         }
       } else {
-        const roleA = getDirectoryRole(import_path12.default.posix.join(lca, subA), config);
-        const roleB = getDirectoryRole(import_path12.default.posix.join(lca, subB), config);
+        const roleA = getDirectoryRole(import_path13.default.posix.join(lca, subA), config);
+        const roleB = getDirectoryRole(import_path13.default.posix.join(lca, subB), config);
         const idxA = roleA ? getRoleHierarchyIndex(roleA, config) : -1;
         const idxB = roleB ? getRoleHierarchyIndex(roleB, config) : -1;
         if (idxA !== -1 && idxB !== -1) {
@@ -1313,7 +1423,7 @@ var rule6 = {
 var no_peer_dependency_rule_default = rule6;
 
 // src/_rules/no-private-category-leak/no-private-category-leak.rule.ts
-var import_path13 = __toESM(require("path"), 1);
+var import_path14 = __toESM(require("path"), 1);
 var rule7 = {
   create(context) {
     const absPath = context.filename;
@@ -1335,11 +1445,32 @@ var rule7 = {
       if (!resolvedRelPath) {
         return;
       }
-      const importedDir = import_path13.default.dirname(resolvedRelPath);
-      const owner = getPrivateCategoryOwner(importedDir, config);
-      if (owner) {
-        const isDescendant = relPath === owner || relPath.startsWith(owner + "/");
-        if (!isDescendant) {
+      const importedDir = import_path14.default.dirname(resolvedRelPath);
+      const info = getPrivateCategoryInfo(importedDir, config);
+      if (info) {
+        const { owner, privateCategoryPath } = info;
+        let isFractalBranchInPrivateCategory = false;
+        let isFractalBranchAllowed = false;
+        const fbOwner = getFractalBranchOwner(importedDir);
+        if (fbOwner) {
+          const isFbInsidePrivateCategory = fbOwner === privateCategoryPath || fbOwner.startsWith(privateCategoryPath + "/");
+          if (isFbInsidePrivateCategory) {
+            isFractalBranchInPrivateCategory = true;
+            isFractalBranchAllowed = relPath === fbOwner || relPath.startsWith(fbOwner + "/");
+          }
+        }
+        const isDirectChild = import_path14.default.dirname(relPath) === owner;
+        const importerSubDomain = getImmediateSubDomain(
+          relPath,
+          privateCategoryPath
+        );
+        const importedSubDomain = getImmediateSubDomain(
+          resolvedRelPath,
+          privateCategoryPath
+        );
+        const isInsideSameSubDomain = importerSubDomain !== "" && importerSubDomain === importedSubDomain;
+        const isAllowed = isFractalBranchInPrivateCategory ? isFractalBranchAllowed : isDirectChild || isInsideSameSubDomain;
+        if (!isAllowed) {
           context.report({
             message: `Importing from Private Category is forbidden. The imported resource is private to "${owner}".`,
             node