exadev-eslint-config 2.21.0 → 2.21.1

package/README.md

@@ -348,7 +348,7 @@ Both entry points need `@eslint/json` resolvable (`pnpm add -D @eslint/json`), t
 | Field | Meaning |
 | --- | --- |
 | `root` | The workspace root directory. Defaults to the nearest ancestor of the linted file that owns a `pnpm-workspace.yaml`. |
-| `packages` | Workspace package globs (`pnpm-workspace.yaml` dialect: `*`, `**`, `!`-prefixed excludes). Defaults to that file's own top-level `packages:` block sequence. |
+| `packages` | Workspace package globs, matching pnpm's own `pnpm-workspace.yaml` glob support (`*`, `**`, `[...]` character classes, `{...}` brace expansion, `!`-prefixed excludes; a wildcard segment never matches a name starting with "."). Defaults to that file's own top-level `packages:` block sequence, quoted or bare. |
 | `dependencyFields` | `package.json` fields read as a package's declared dependencies. Defaults to `['dependencies']`. |
 | `groups` | The workspace's own directory taxonomy: `{ name, path?, rank?, slice?, naming? }`. `path` defaults to `name` (a group rooted at a directory of the same name). |
 | `nameRanks` | The name-role rank model: `{ pattern, rank }[]`, a package's declared name checked against each `pattern` in order, first match wins, ahead of its own group's `rank`. Omit entirely for a pure group-rank model. |
@@ -499,6 +499,7 @@ pnpm build
 - [Husky](https://github.com/typicode/husky) hooks: `pre-commit` runs [lint-staged](https://github.com/lint-staged/lint-staged#readme) (`eslint --fix` on staged `*.ts`), `commit-msg` runs commitlint, `pre-push` runs typecheck + test + build.
 - The CI release job sets `HUSKY=0` (commit-msg hook skips the automated release commit) and blanks `NPM_TOKEN`/`NODE_AUTH_TOKEN` explicitly so an inherited token can't win over [OIDC trusted publishing](https://docs.npmjs.com/trusted-publishers).
 - A consumer who already has `eslint-plugin-react`/`@next/eslint-plugin-next` resolvable for unrelated reasons (e.g. hoisted in a monorepo) and writes `.jsx`/`.tsx` files may see new rule activity the moment they upgrade to a version of this package that ships React/Next.js support — with zero action on their part. See the compatibility note under [Optional React and Next.js support](#optional-react-and-nextjs-support).
+- [Workspace architecture](#workspace-architecture)'s dependency graph is cached for the life of the process, keyed by workspace root plus the resolved options, with no invalidation of its own. A long-running ESLint process (an editor's language server, most notably) that renames a package or edits its declared dependencies after that root/options combination's first lint keeps serving the stale graph built before the edit, until the process restarts. Both prior local implementations this feature replaced (Novus hive's and the monorepo-template's own workspace rule sets) carried the identical limitation.
 
 ### Contributing
 

package/dist/index.cjs

@@ -309,7 +309,7 @@ function resolveJsonPlugin(value) {
 }
 //#endregion
 //#region package.json
-var version = "2.21.0";
+var version = "2.21.1";
 //#endregion
 //#region src/react.ts
 const JSX_FILE_PATTERNS = ["**/*.jsx", "**/*.tsx"];
@@ -839,9 +839,48 @@ function splitPathSegments(path) {
 }
 //#endregion
 //#region src/rules/workspace-glob.ts
+/** Reads `text[index]`, throwing rather than reading past the end: every call site in this file only ever derives `index` from a `for` loop whose own condition (`index < text.length`) already guarantees it in range, so an out-of-bounds read here would mean that loop's own invariant broke, not a case to handle quietly. Exported so this throw (unreachable through every real call site) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape workspace-yaml.ts's own `requireLine` establishes. */
+function requireChar$1(text, index) {
+	const char = text[index];
+	if (char === void 0) throw new Error(`Unreachable: index ${String(index)} is out of bounds for a string of length ${String(text.length)}.`);
+	return char;
+}
+const REGEXP_SPECIAL_CHARS = /[.+^${}()|\]\\]/gu;
 function segmentToRegExp(segment) {
-	const withWildcards = segment.replace(/[.+^${}()|[\]\\]/gu, "\\$&").replace(/\*/gu, ".*").replace(/\?/gu, ".");
-	return new RegExp(`^${withWildcards}$`, "u");
+	let source = "";
+	for (let index = 0; index < segment.length;) {
+		const char = requireChar$1(segment, index);
+		if (char === "*") {
+			source += ".*";
+			index += 1;
+			continue;
+		}
+		if (char === "?") {
+			source += ".";
+			index += 1;
+			continue;
+		}
+		if (char === "[") {
+			const closeIndex = segment.indexOf("]", index + 1);
+			if (closeIndex === -1) {
+				source += "\\[";
+				index += 1;
+				continue;
+			}
+			const body = segment.slice(index + 1, closeIndex);
+			const negated = body.startsWith("!") || body.startsWith("^");
+			const classBody = (negated ? body.slice(1) : body).replace(/\\/gu, "\\\\");
+			source += `[${negated ? "^" : ""}${classBody}]`;
+			index = closeIndex + 1;
+			continue;
+		}
+		source += char.replace(REGEXP_SPECIAL_CHARS, "\\$&");
+		index += 1;
+	}
+	return new RegExp(`^${source}$`, "u");
+}
+function segmentRequestsDotMatch(segment) {
+	return segment.startsWith(".");
 }
 function listRealSubdirectories(fs, dir) {
 	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules");
@@ -852,20 +891,66 @@ function walkPattern(fs, root, segments, matchedSoFar) {
 	const currentDir = (0, node_path.join)(root, ...matchedSoFar);
 	if (segment === "**") {
 		const results = walkPattern(fs, root, rest, matchedSoFar);
-		for (const child of listRealSubdirectories(fs, currentDir)) results.push(...walkPattern(fs, root, segments, [...matchedSoFar, child]));
+		for (const child of listRealSubdirectories(fs, currentDir).filter((name) => !name.startsWith("."))) results.push(...walkPattern(fs, root, segments, [...matchedSoFar, child]));
 		return results;
 	}
 	const pattern = segmentToRegExp(segment);
-	const candidates = listRealSubdirectories(fs, currentDir).filter((name) => pattern.test(name));
+	const allowDotMatch = segmentRequestsDotMatch(segment);
+	const candidates = listRealSubdirectories(fs, currentDir).filter((name) => (allowDotMatch || !name.startsWith(".")) && pattern.test(name));
 	const results = [];
 	for (const candidate of candidates) results.push(...walkPattern(fs, root, rest, [...matchedSoFar, candidate]));
 	return results;
 }
+function findMatchingBrace(pattern, openIndex) {
+	let depth = 0;
+	for (let index = openIndex; index < pattern.length; index += 1) {
+		const char = requireChar$1(pattern, index);
+		if (char === "{") depth += 1;
+		else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return -1;
+}
+function splitTopLevelAlternatives(text) {
+	const alternatives = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = requireChar$1(text, index);
+		if (char === "{") depth += 1;
+		else if (char === "}") depth -= 1;
+		else if (char === "," && depth === 0) {
+			alternatives.push(text.slice(start, index));
+			start = index + 1;
+		}
+	}
+	alternatives.push(text.slice(start));
+	return alternatives;
+}
+/**
+* Expands every "\{a,b\}" brace group in `pattern` into its own separate, fully concrete pattern (the cross product of every group's own alternatives, nested groups included), matching fast-glob's own brace expansion, pnpm's underlying glob engine. A pattern with no "\{" at all expands to itself, unchanged. Exported for direct testing of the expansion itself, independent of any real directory tree.
+*/
+function expandBraces(pattern) {
+	const openIndex = pattern.indexOf("{");
+	if (openIndex === -1) return [pattern];
+	const closeIndex = findMatchingBrace(pattern, openIndex);
+	if (closeIndex === -1) throw new Error(`@exadev/eslint-config: workspace glob pattern "${pattern}" has an unmatched "{" (brace expansion). Rewrite it, or pass the "packages" rule option explicitly to bypass this pattern.`);
+	const prefix = pattern.slice(0, openIndex);
+	const suffix = pattern.slice(closeIndex + 1);
+	const alternatives = splitTopLevelAlternatives(pattern.slice(openIndex + 1, closeIndex));
+	const results = [];
+	for (const alternative of alternatives) for (const expandedAlternative of expandBraces(alternative)) for (const expandedSuffix of expandBraces(suffix)) results.push(prefix + expandedAlternative + expandedSuffix);
+	return results;
+}
 /**
-* Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this.
+* Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this. Brace groups are expanded first (a pattern can hold more than one, and each expansion can itself match several directories), so the final result is the union of every expanded pattern's own matches, deduplicated.
 */
 function expandGlob(fs, root, pattern) {
-	return walkPattern(fs, root, splitPathSegments(pattern), []);
+	const matches = /* @__PURE__ */ new Set();
+	for (const expandedPattern of expandBraces(pattern)) for (const match of walkPattern(fs, root, splitPathSegments(expandedPattern), [])) matches.add(match);
+	return [...matches];
 }
 /** Whether `pattern` is an exclude entry in pnpm-workspace.yaml's own glob list: a leading "!", never a trailing one. Exported so this exact asymmetry (as opposed to, say, "ends with '!'") is tested directly, independent of resolveWorkspacePackageDirs' own real-filesystem scenarios below. */
 function isExcludePattern(pattern) {
@@ -885,7 +970,7 @@ function resolveWorkspacePackageDirs(fs, root, patterns) {
 }
 //#endregion
 //#region src/rules/workspace-yaml.ts
-const PACKAGES_KEY_PATTERN = /^packages:\s*(.*)$/u;
+const PACKAGES_KEY_PATTERN = /^(?:packages|"packages"|'packages'):\s*(.*)$/u;
 const SEQUENCE_ITEM_PATTERN = /^(\s*)-\s*(.*)$/u;
 /** Reads lines[index], throwing rather than silently returning undefined for an index this file only ever derives from Array.prototype.findIndex or a bounded for-loop, both of which already prove it in range. Exported so this throw (unreachable through either real call site below) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape package-json-key-order.ts's own `at()` helper establishes. */
 function requireLine(lines, index) {
@@ -905,9 +990,41 @@ function requireMatch(pattern, text) {
 	if (match === null) throw new Error(`Unreachable: /${pattern.source}/ was already confirmed to match "${text}".`);
 	return match;
 }
+/** Reads `text[index]`, throwing rather than reading past the end: both real call sites below derive `index` from a `for` loop whose own condition (`index < text.length`) already guarantees it in range, so an out-of-bounds read here would mean that loop's own invariant broke, not a case to handle quietly. A genuinely maybe-out-of-bounds neighbour check (this file's own "the character right before/after this one, if any" reads) stays a plain `charAt`, deliberately: those are never loop-bound-guaranteed and a missing neighbour is a real, legitimate outcome, not a bug. Exported for the same direct-test reason as requireLine above. */
+function requireChar(text, index) {
+	const char = text[index];
+	if (char === void 0) throw new Error(`Unreachable: index ${String(index)} is out of bounds for a string of length ${String(text.length)}.`);
+	return char;
+}
+/** Whether `value[index]` is a quote character, returning that exact character (not merely `true`) so a caller can go on to search for the SAME quote style's own matching close. Exported for direct testing of its own per-index decision, independent of commentSearchStart's own real-string scenarios below. */
+function quoteCharAt(value, index) {
+	const char = value.charAt(index);
+	return char === "'" || char === "\"" ? char : void 0;
+}
+function findMatchingQuoteEnd(value, openIndex, quote) {
+	for (let index = openIndex + 1; index < value.length; index += 1) {
+		if (requireChar(value, index) !== quote) continue;
+		if (quote === "'" && value.charAt(index + 1) === "'") {
+			index += 1;
+			continue;
+		}
+		return index;
+	}
+	return -1;
+}
+function commentSearchStart(value) {
+	const contentStart = value.length - value.trimStart().length;
+	const quote = quoteCharAt(value, contentStart);
+	if (quote === void 0) return 0;
+	const closeIndex = findMatchingQuoteEnd(value, contentStart, quote);
+	return closeIndex === -1 ? value.length : closeIndex + 1;
+}
 function stripComment(value) {
-	const hashIndex = value.indexOf("#");
-	return (hashIndex === -1 ? value : value.slice(0, hashIndex)).trimEnd();
+	for (let index = commentSearchStart(value); index < value.length; index += 1) {
+		if (requireChar(value, index) !== "#") continue;
+		if (index === 0 || value.charAt(index - 1) === " " || value.charAt(index - 1) === "	") return value.slice(0, index).trimEnd();
+	}
+	return value.trimEnd();
 }
 function isQuotedWith(value, quote) {
 	return value.length >= 2 && value.startsWith(quote) && value.endsWith(quote);
@@ -971,7 +1088,10 @@ const workspaceArchitectureOptionsSchema = {
 					rank: { type: "number" },
 					slice: { oneOf: [{
 						type: "object",
-						properties: { segment: { type: "number" } },
+						properties: { segment: {
+							type: "integer",
+							minimum: 0
+						} },
 						required: ["segment"],
 						additionalProperties: false
 					}, {
@@ -1085,10 +1205,15 @@ function asOptionalStringArray(value) {
 	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) fail();
 	return value;
 }
+const SLICE_BY_SEGMENT_KEYS = ["segment"];
+const SLICE_BY_NAME_PREFIX_KEYS = ["namePrefix"];
+function isNonNegativeInteger(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
 function isSliceSpec(value) {
 	if (!isRecord$1(value)) return false;
-	if (typeof value["segment"] === "number") return true;
-	return value["namePrefix"] === true;
+	if ("segment" in value) return hasOnlyKeys(value, SLICE_BY_SEGMENT_KEYS) && isNonNegativeInteger(value["segment"]);
+	return hasOnlyKeys(value, SLICE_BY_NAME_PREFIX_KEYS) && value["namePrefix"] === true;
 }
 function isNamingStrategy(value) {
 	return value === "drop-group" || value === "keep-group" || value === "basename";
@@ -1108,6 +1233,16 @@ function asGroupSpecArray(value) {
 	if (!Array.isArray(value) || !value.every(isGroupSpec)) fail();
 	return value;
 }
+/**
+* The first group name declared more than once in `groups`, or undefined when every name is unique. Every one of this package's own by-name lookups (package-name-mirrors-path's own `options.groups.find`, isolatedGroups' own membership check just below, deriveRank's own `group.rank` read via findOwningGroup) assumes a group name identifies exactly one GroupSpec; a duplicate silently lets whichever entry `Array.prototype.find` happens to return first win, checking a package against the WRONG group's own path prefix or naming strategy without either group's author ever being told the name collided. Exported for direct testing independent of readWorkspaceArchitectureOptions' own full validation pipeline.
+*/
+function findDuplicateGroupName(groups) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const group of groups) {
+		if (seen.has(group.name)) return group.name;
+		seen.add(group.name);
+	}
+}
 function isRankRule(value) {
 	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && typeof value["rank"] === "number";
 }
@@ -1149,12 +1284,14 @@ function asOptionalNaming(value) {
 	return value;
 }
 /**
-* The runtime safety net behind workspaceArchitectureOptionsSchema above: ESLint's own schema validation does run whenever the config is used in a real lint (rejecting malformed rule options there too, the same division of labour barrel-policy.ts's readMode establishes for its own, much smaller options shape), but workspaceArchitectureConfig() (src/workspace-architecture.ts) builds its rule options by calling this reader on the caller's raw object BEFORE that validation ever inspects it, and previously reconstructed a whitelisted object that silently dropped any unknown or misspelled top-level key rather than rejecting it, leaving ESLint's own schema nothing left to catch. This reader now rejects an unknown key at every level it validates (top level, group, rankSkip, naming, nameRanks entries) itself, so a genuinely malformed options object still fails loudly and specifically here, whichever entry point it arrives through, rather than crashing later with a confusing TypeError deep inside graph construction or being silently ignored.
+* The runtime safety net behind workspaceArchitectureOptionsSchema above: ESLint's own schema validation does run whenever the config is used in a real lint (rejecting malformed rule options there too, the same division of labour barrel-policy.ts's readMode establishes for its own, much smaller options shape), but workspaceArchitectureConfig() (src/workspace-architecture.ts) builds its rule options by calling this reader on the caller's raw object BEFORE that validation ever inspects it, and previously reconstructed a whitelisted object that silently dropped any unknown or misspelled top-level key rather than rejecting it, leaving ESLint's own schema nothing left to catch. This reader now rejects an unknown key at every level it validates (top level, group, slice, rankSkip, naming, nameRanks entries) itself, so a genuinely malformed options object still fails loudly and specifically here, whichever entry point it arrives through, rather than crashing later with a confusing TypeError deep inside graph construction or being silently ignored.
 */
 function readWorkspaceArchitectureOptions(options) {
 	if (!isRecord$1(options)) fail();
 	if (!hasOnlyKeys(options, TOP_LEVEL_KEYS)) fail();
 	const groups = asGroupSpecArray(options["groups"]);
+	const duplicateGroupName = findDuplicateGroupName(groups);
+	if (duplicateGroupName !== void 0) throw new Error(`@exadev/eslint-config: "groups" declares more than one group named "${duplicateGroupName}". Every group name must be unique: package-name-mirrors-path and isolatedGroups both resolve a group by name, and a duplicate would silently pick whichever entry is declared first.`);
 	const root = asOptionalString(options["root"]);
 	const packages = asOptionalStringArray(options["packages"]);
 	const dependencyFields = asOptionalStringArray(options["dependencyFields"]);
@@ -1210,7 +1347,9 @@ function findOwningGroup(relativeDir, groups) {
 * The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
 */
 function deriveRank(declaredName, group, options) {
-	for (const rule of options.nameRanks ?? []) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
+	if (options.nameRanks !== void 0) {
+		for (const rule of options.nameRanks) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
+	}
 	if (group.rank !== void 0) return group.rank;
 	if (options.defaultRank !== void 0) return options.defaultRank;
 	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
@@ -1269,15 +1408,19 @@ function resolveWorkspaceRoot(fs, filename, rootOption) {
 		dir = parent;
 	}
 }
-/**
-* Resolves the workspace's own package glob patterns: the given `packages` option verbatim, or, when omitted, pnpm-workspace.yaml's own top-level "packages:" block sequence read from the resolved root.
-*/
-function resolveWorkspacePackagePatterns(fs, root, packagesOption) {
-	if (packagesOption !== void 0) return packagesOption;
+function readPackagesFromYaml(fs, root) {
 	const yamlPath = (0, node_path.join)(root, "pnpm-workspace.yaml");
 	if (!fs.existsSync(yamlPath)) throw new Error(`@exadev/eslint-config: no "pnpm-workspace.yaml" found at workspace root "${root}", and no "packages" option was given.`);
 	return readWorkspacePackages(fs.readFileSync(yamlPath));
 }
+/**
+* Resolves the workspace's own package glob patterns: the given `packages` option verbatim, or, when omitted, pnpm-workspace.yaml's own top-level "packages:" block sequence read from the resolved root. Throws when that resolution comes back with genuinely zero patterns (an empty "packages" option array, or a "packages:" key with no key at all/an empty sequence and no override), since collectCandidates (below) would then scan nothing at all, quietly turning every workspace-architecture rule into a no-op that reports nothing rather than a real misconfiguration.
+*/
+function resolveWorkspacePackagePatterns(fs, root, packagesOption) {
+	const patterns = packagesOption ?? readPackagesFromYaml(fs, root);
+	if (patterns.length === 0) throw new Error(`@exadev/eslint-config: the resolved workspace "packages" glob list is empty (root "${root}"), which would make every workspace-architecture rule a silent no-op. Add a "packages:" block sequence to pnpm-workspace.yaml, or pass a non-empty "packages" rule option.`);
+	return patterns;
+}
 function collectCandidates(fs, root, options) {
 	const relativeDirs = resolveWorkspacePackageDirs(fs, root, resolveWorkspacePackagePatterns(fs, root, options.packages));
 	const candidates = [];
@@ -1360,6 +1503,7 @@ function loadWorkspaceGraph(filename, options) {
 //#endregion
 //#region src/rules/workspace-checks.ts
 function isIsolatedPair(groupA, groupB, isolatedGroups) {
+	if (isolatedGroups === void 0) return false;
 	return isolatedGroups.some(([first, second]) => first === groupA && second === groupB || first === groupB && second === groupA);
 }
 /**
@@ -1374,11 +1518,10 @@ function isIsolatedPair(groupA, groupB, isolatedGroups) {
 */
 function checkDependencies(selfName, self, dependencyNames, context) {
 	const violations = [];
-	const isolatedGroups = context.isolatedGroups ?? [];
 	for (const dependencyName of dependencyNames) {
 		const dependency = context.graph.get(dependencyName);
 		if (dependency === void 0) continue;
-		if (isIsolatedPair(self.group, dependency.group, isolatedGroups)) {
+		if (isIsolatedPair(self.group, dependency.group, context.isolatedGroups)) {
 			violations.push({
 				dependencyName,
 				messageId: "isolatedGroup",
@@ -1461,9 +1604,9 @@ function last(array) {
 * - **'basename'**: use only `relativeDir`'s own final segment, ignoring every intermediate directory, for a group whose intermediate structure exists purely for filesystem organisation and carries no naming intent of its own.
 */
 const NAME_SEGMENTS_BY_STRATEGY = {
-	basename: (segments) => [last(segments)],
-	"keep-group": (segments) => segments,
-	"drop-group": (_segments, rest) => rest
+	basename: ({ segments }) => [last(segments)],
+	"keep-group": ({ segments }) => segments,
+	"drop-group": ({ rest }) => rest
 };
 /**
 * The package name package-name-mirrors-path expects a package at `relativeDir` (workspace-root-relative, forward-slash-joined) to declare, given its own matched group and the workspace's global naming options. See NAME_SEGMENTS_BY_STRATEGY above for the three per-group strategies' own segment selection. The joined segments are prefixed with `naming.scope` (when given) and joined to it with "/"; segments themselves join with `naming.separator` (default "-").
@@ -1473,7 +1616,10 @@ function expectedPackageName(relativeDir, group, naming) {
 	const segments = splitPathSegments(relativeDir);
 	const groupPrefixLength = splitPathSegments(group.path ?? group.name).length;
 	const rest = segments.slice(groupPrefixLength);
-	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"](segments, rest).join(separator);
+	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"]({
+		segments,
+		rest
+	}).join(separator);
 	return naming.scope === void 0 ? joined : `${naming.scope}/${joined}`;
 }
 //#endregion
@@ -2481,6 +2627,14 @@ const packageJsonKeyOrder = {
 //#endregion
 //#region src/rules/package-name-mirrors-path.ts
 /**
+* The GroupSpec this rule's own resolved `groupName` always identifies, looked up by name in `groups`. A real `groupName` (`self.group` in the visitor below) is set only by buildWorkspaceGraph itself (workspace-graph.ts), directly from `candidate.group.name`, where `candidate.group` in turn only ever comes from `findOwningGroup(relativeDir, options.groups)`, one of that SAME `options.groups` array the visitor passes back in here as `groups`. So a real graph's group name is provably one of `groups`' own names whenever both come from the identical options object, which loadGraph(context.filename, options) and this lookup always do; failing to find it here means the graph was built from a different options object than the one now inspecting it, not a legitimate absence to skip past. Exported so this throw (unreachable through the real call site below) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape package-json-key-order.ts's own `at()` helper establishes.
+*/
+function findGroupSpec(groups, groupName) {
+	const group = groups.find((candidate) => candidate.name === groupName);
+	if (group === void 0) throw new Error(`Unreachable: the workspace graph resolved group "${groupName}", which is not among this same rule invocation's own "groups" option.`);
+	return group;
+}
+/**
 * Reports a workspace package whose declared name does not mirror its path, per its own group's naming strategy and the workspace's global scope/separator (see expectedPackageName in workspace-checks.ts for the exact derivation). Opt-in: entirely a no-op whenever the shared `naming` option is omitted, exactly as the option's own doc comment (workspace-options.ts) states, since a workspace with its own established naming convention this rule cannot express should not be forced to adopt one that fits.
 *
 * Deliberately not derived from `context.filename`'s own directory the way the hive original was: this rule instead looks its own package up in the already-built graph by its DECLARED name (the same self-identification every other workspace-architecture rule uses), which is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from.
@@ -2509,8 +2663,7 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 				if (declared === void 0) return;
 				const self = graph.packagesByName.get(declared.name);
 				if (self === void 0) return;
-				const group = options.groups.find((candidate) => candidate.name === self.group);
-				if (group === void 0) return;
+				const group = findGroupSpec(options.groups, self.group);
 				const expected = expectedPackageName(self.relativeDir, group, naming);
 				if (expected === declared.name) return;
 				context.report({

package/dist/index.js

@@ -275,7 +275,7 @@ function resolveJsonPlugin(value) {
 }
 //#endregion
 //#region package.json
-var version = "2.21.0";
+var version = "2.21.1";
 //#endregion
 //#region src/react.ts
 const JSX_FILE_PATTERNS = ["**/*.jsx", "**/*.tsx"];
@@ -805,9 +805,48 @@ function splitPathSegments(path) {
 }
 //#endregion
 //#region src/rules/workspace-glob.ts
+/** Reads `text[index]`, throwing rather than reading past the end: every call site in this file only ever derives `index` from a `for` loop whose own condition (`index < text.length`) already guarantees it in range, so an out-of-bounds read here would mean that loop's own invariant broke, not a case to handle quietly. Exported so this throw (unreachable through every real call site) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape workspace-yaml.ts's own `requireLine` establishes. */
+function requireChar$1(text, index) {
+	const char = text[index];
+	if (char === void 0) throw new Error(`Unreachable: index ${String(index)} is out of bounds for a string of length ${String(text.length)}.`);
+	return char;
+}
+const REGEXP_SPECIAL_CHARS = /[.+^${}()|\]\\]/gu;
 function segmentToRegExp(segment) {
-	const withWildcards = segment.replace(/[.+^${}()|[\]\\]/gu, "\\$&").replace(/\*/gu, ".*").replace(/\?/gu, ".");
-	return new RegExp(`^${withWildcards}$`, "u");
+	let source = "";
+	for (let index = 0; index < segment.length;) {
+		const char = requireChar$1(segment, index);
+		if (char === "*") {
+			source += ".*";
+			index += 1;
+			continue;
+		}
+		if (char === "?") {
+			source += ".";
+			index += 1;
+			continue;
+		}
+		if (char === "[") {
+			const closeIndex = segment.indexOf("]", index + 1);
+			if (closeIndex === -1) {
+				source += "\\[";
+				index += 1;
+				continue;
+			}
+			const body = segment.slice(index + 1, closeIndex);
+			const negated = body.startsWith("!") || body.startsWith("^");
+			const classBody = (negated ? body.slice(1) : body).replace(/\\/gu, "\\\\");
+			source += `[${negated ? "^" : ""}${classBody}]`;
+			index = closeIndex + 1;
+			continue;
+		}
+		source += char.replace(REGEXP_SPECIAL_CHARS, "\\$&");
+		index += 1;
+	}
+	return new RegExp(`^${source}$`, "u");
+}
+function segmentRequestsDotMatch(segment) {
+	return segment.startsWith(".");
 }
 function listRealSubdirectories(fs, dir) {
 	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules");
@@ -818,20 +857,66 @@ function walkPattern(fs, root, segments, matchedSoFar) {
 	const currentDir = join(root, ...matchedSoFar);
 	if (segment === "**") {
 		const results = walkPattern(fs, root, rest, matchedSoFar);
-		for (const child of listRealSubdirectories(fs, currentDir)) results.push(...walkPattern(fs, root, segments, [...matchedSoFar, child]));
+		for (const child of listRealSubdirectories(fs, currentDir).filter((name) => !name.startsWith("."))) results.push(...walkPattern(fs, root, segments, [...matchedSoFar, child]));
 		return results;
 	}
 	const pattern = segmentToRegExp(segment);
-	const candidates = listRealSubdirectories(fs, currentDir).filter((name) => pattern.test(name));
+	const allowDotMatch = segmentRequestsDotMatch(segment);
+	const candidates = listRealSubdirectories(fs, currentDir).filter((name) => (allowDotMatch || !name.startsWith(".")) && pattern.test(name));
 	const results = [];
 	for (const candidate of candidates) results.push(...walkPattern(fs, root, rest, [...matchedSoFar, candidate]));
 	return results;
 }
+function findMatchingBrace(pattern, openIndex) {
+	let depth = 0;
+	for (let index = openIndex; index < pattern.length; index += 1) {
+		const char = requireChar$1(pattern, index);
+		if (char === "{") depth += 1;
+		else if (char === "}") {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return -1;
+}
+function splitTopLevelAlternatives(text) {
+	const alternatives = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = requireChar$1(text, index);
+		if (char === "{") depth += 1;
+		else if (char === "}") depth -= 1;
+		else if (char === "," && depth === 0) {
+			alternatives.push(text.slice(start, index));
+			start = index + 1;
+		}
+	}
+	alternatives.push(text.slice(start));
+	return alternatives;
+}
+/**
+* Expands every "\{a,b\}" brace group in `pattern` into its own separate, fully concrete pattern (the cross product of every group's own alternatives, nested groups included), matching fast-glob's own brace expansion, pnpm's underlying glob engine. A pattern with no "\{" at all expands to itself, unchanged. Exported for direct testing of the expansion itself, independent of any real directory tree.
+*/
+function expandBraces(pattern) {
+	const openIndex = pattern.indexOf("{");
+	if (openIndex === -1) return [pattern];
+	const closeIndex = findMatchingBrace(pattern, openIndex);
+	if (closeIndex === -1) throw new Error(`@exadev/eslint-config: workspace glob pattern "${pattern}" has an unmatched "{" (brace expansion). Rewrite it, or pass the "packages" rule option explicitly to bypass this pattern.`);
+	const prefix = pattern.slice(0, openIndex);
+	const suffix = pattern.slice(closeIndex + 1);
+	const alternatives = splitTopLevelAlternatives(pattern.slice(openIndex + 1, closeIndex));
+	const results = [];
+	for (const alternative of alternatives) for (const expandedAlternative of expandBraces(alternative)) for (const expandedSuffix of expandBraces(suffix)) results.push(prefix + expandedAlternative + expandedSuffix);
+	return results;
+}
 /**
-* Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this.
+* Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this. Brace groups are expanded first (a pattern can hold more than one, and each expansion can itself match several directories), so the final result is the union of every expanded pattern's own matches, deduplicated.
 */
 function expandGlob(fs, root, pattern) {
-	return walkPattern(fs, root, splitPathSegments(pattern), []);
+	const matches = /* @__PURE__ */ new Set();
+	for (const expandedPattern of expandBraces(pattern)) for (const match of walkPattern(fs, root, splitPathSegments(expandedPattern), [])) matches.add(match);
+	return [...matches];
 }
 /** Whether `pattern` is an exclude entry in pnpm-workspace.yaml's own glob list: a leading "!", never a trailing one. Exported so this exact asymmetry (as opposed to, say, "ends with '!'") is tested directly, independent of resolveWorkspacePackageDirs' own real-filesystem scenarios below. */
 function isExcludePattern(pattern) {
@@ -851,7 +936,7 @@ function resolveWorkspacePackageDirs(fs, root, patterns) {
 }
 //#endregion
 //#region src/rules/workspace-yaml.ts
-const PACKAGES_KEY_PATTERN = /^packages:\s*(.*)$/u;
+const PACKAGES_KEY_PATTERN = /^(?:packages|"packages"|'packages'):\s*(.*)$/u;
 const SEQUENCE_ITEM_PATTERN = /^(\s*)-\s*(.*)$/u;
 /** Reads lines[index], throwing rather than silently returning undefined for an index this file only ever derives from Array.prototype.findIndex or a bounded for-loop, both of which already prove it in range. Exported so this throw (unreachable through either real call site below) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape package-json-key-order.ts's own `at()` helper establishes. */
 function requireLine(lines, index) {
@@ -871,9 +956,41 @@ function requireMatch(pattern, text) {
 	if (match === null) throw new Error(`Unreachable: /${pattern.source}/ was already confirmed to match "${text}".`);
 	return match;
 }
+/** Reads `text[index]`, throwing rather than reading past the end: both real call sites below derive `index` from a `for` loop whose own condition (`index < text.length`) already guarantees it in range, so an out-of-bounds read here would mean that loop's own invariant broke, not a case to handle quietly. A genuinely maybe-out-of-bounds neighbour check (this file's own "the character right before/after this one, if any" reads) stays a plain `charAt`, deliberately: those are never loop-bound-guaranteed and a missing neighbour is a real, legitimate outcome, not a bug. Exported for the same direct-test reason as requireLine above. */
+function requireChar(text, index) {
+	const char = text[index];
+	if (char === void 0) throw new Error(`Unreachable: index ${String(index)} is out of bounds for a string of length ${String(text.length)}.`);
+	return char;
+}
+/** Whether `value[index]` is a quote character, returning that exact character (not merely `true`) so a caller can go on to search for the SAME quote style's own matching close. Exported for direct testing of its own per-index decision, independent of commentSearchStart's own real-string scenarios below. */
+function quoteCharAt(value, index) {
+	const char = value.charAt(index);
+	return char === "'" || char === "\"" ? char : void 0;
+}
+function findMatchingQuoteEnd(value, openIndex, quote) {
+	for (let index = openIndex + 1; index < value.length; index += 1) {
+		if (requireChar(value, index) !== quote) continue;
+		if (quote === "'" && value.charAt(index + 1) === "'") {
+			index += 1;
+			continue;
+		}
+		return index;
+	}
+	return -1;
+}
+function commentSearchStart(value) {
+	const contentStart = value.length - value.trimStart().length;
+	const quote = quoteCharAt(value, contentStart);
+	if (quote === void 0) return 0;
+	const closeIndex = findMatchingQuoteEnd(value, contentStart, quote);
+	return closeIndex === -1 ? value.length : closeIndex + 1;
+}
 function stripComment(value) {
-	const hashIndex = value.indexOf("#");
-	return (hashIndex === -1 ? value : value.slice(0, hashIndex)).trimEnd();
+	for (let index = commentSearchStart(value); index < value.length; index += 1) {
+		if (requireChar(value, index) !== "#") continue;
+		if (index === 0 || value.charAt(index - 1) === " " || value.charAt(index - 1) === "	") return value.slice(0, index).trimEnd();
+	}
+	return value.trimEnd();
 }
 function isQuotedWith(value, quote) {
 	return value.length >= 2 && value.startsWith(quote) && value.endsWith(quote);
@@ -937,7 +1054,10 @@ const workspaceArchitectureOptionsSchema = {
 					rank: { type: "number" },
 					slice: { oneOf: [{
 						type: "object",
-						properties: { segment: { type: "number" } },
+						properties: { segment: {
+							type: "integer",
+							minimum: 0
+						} },
 						required: ["segment"],
 						additionalProperties: false
 					}, {
@@ -1051,10 +1171,15 @@ function asOptionalStringArray(value) {
 	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) fail();
 	return value;
 }
+const SLICE_BY_SEGMENT_KEYS = ["segment"];
+const SLICE_BY_NAME_PREFIX_KEYS = ["namePrefix"];
+function isNonNegativeInteger(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
 function isSliceSpec(value) {
 	if (!isRecord$1(value)) return false;
-	if (typeof value["segment"] === "number") return true;
-	return value["namePrefix"] === true;
+	if ("segment" in value) return hasOnlyKeys(value, SLICE_BY_SEGMENT_KEYS) && isNonNegativeInteger(value["segment"]);
+	return hasOnlyKeys(value, SLICE_BY_NAME_PREFIX_KEYS) && value["namePrefix"] === true;
 }
 function isNamingStrategy(value) {
 	return value === "drop-group" || value === "keep-group" || value === "basename";
@@ -1074,6 +1199,16 @@ function asGroupSpecArray(value) {
 	if (!Array.isArray(value) || !value.every(isGroupSpec)) fail();
 	return value;
 }
+/**
+* The first group name declared more than once in `groups`, or undefined when every name is unique. Every one of this package's own by-name lookups (package-name-mirrors-path's own `options.groups.find`, isolatedGroups' own membership check just below, deriveRank's own `group.rank` read via findOwningGroup) assumes a group name identifies exactly one GroupSpec; a duplicate silently lets whichever entry `Array.prototype.find` happens to return first win, checking a package against the WRONG group's own path prefix or naming strategy without either group's author ever being told the name collided. Exported for direct testing independent of readWorkspaceArchitectureOptions' own full validation pipeline.
+*/
+function findDuplicateGroupName(groups) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const group of groups) {
+		if (seen.has(group.name)) return group.name;
+		seen.add(group.name);
+	}
+}
 function isRankRule(value) {
 	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && typeof value["rank"] === "number";
 }
@@ -1115,12 +1250,14 @@ function asOptionalNaming(value) {
 	return value;
 }
 /**
-* The runtime safety net behind workspaceArchitectureOptionsSchema above: ESLint's own schema validation does run whenever the config is used in a real lint (rejecting malformed rule options there too, the same division of labour barrel-policy.ts's readMode establishes for its own, much smaller options shape), but workspaceArchitectureConfig() (src/workspace-architecture.ts) builds its rule options by calling this reader on the caller's raw object BEFORE that validation ever inspects it, and previously reconstructed a whitelisted object that silently dropped any unknown or misspelled top-level key rather than rejecting it, leaving ESLint's own schema nothing left to catch. This reader now rejects an unknown key at every level it validates (top level, group, rankSkip, naming, nameRanks entries) itself, so a genuinely malformed options object still fails loudly and specifically here, whichever entry point it arrives through, rather than crashing later with a confusing TypeError deep inside graph construction or being silently ignored.
+* The runtime safety net behind workspaceArchitectureOptionsSchema above: ESLint's own schema validation does run whenever the config is used in a real lint (rejecting malformed rule options there too, the same division of labour barrel-policy.ts's readMode establishes for its own, much smaller options shape), but workspaceArchitectureConfig() (src/workspace-architecture.ts) builds its rule options by calling this reader on the caller's raw object BEFORE that validation ever inspects it, and previously reconstructed a whitelisted object that silently dropped any unknown or misspelled top-level key rather than rejecting it, leaving ESLint's own schema nothing left to catch. This reader now rejects an unknown key at every level it validates (top level, group, slice, rankSkip, naming, nameRanks entries) itself, so a genuinely malformed options object still fails loudly and specifically here, whichever entry point it arrives through, rather than crashing later with a confusing TypeError deep inside graph construction or being silently ignored.
 */
 function readWorkspaceArchitectureOptions(options) {
 	if (!isRecord$1(options)) fail();
 	if (!hasOnlyKeys(options, TOP_LEVEL_KEYS)) fail();
 	const groups = asGroupSpecArray(options["groups"]);
+	const duplicateGroupName = findDuplicateGroupName(groups);
+	if (duplicateGroupName !== void 0) throw new Error(`@exadev/eslint-config: "groups" declares more than one group named "${duplicateGroupName}". Every group name must be unique: package-name-mirrors-path and isolatedGroups both resolve a group by name, and a duplicate would silently pick whichever entry is declared first.`);
 	const root = asOptionalString(options["root"]);
 	const packages = asOptionalStringArray(options["packages"]);
 	const dependencyFields = asOptionalStringArray(options["dependencyFields"]);
@@ -1176,7 +1313,9 @@ function findOwningGroup(relativeDir, groups) {
 * The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
 */
 function deriveRank(declaredName, group, options) {
-	for (const rule of options.nameRanks ?? []) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
+	if (options.nameRanks !== void 0) {
+		for (const rule of options.nameRanks) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
+	}
 	if (group.rank !== void 0) return group.rank;
 	if (options.defaultRank !== void 0) return options.defaultRank;
 	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
@@ -1235,15 +1374,19 @@ function resolveWorkspaceRoot(fs, filename, rootOption) {
 		dir = parent;
 	}
 }
-/**
-* Resolves the workspace's own package glob patterns: the given `packages` option verbatim, or, when omitted, pnpm-workspace.yaml's own top-level "packages:" block sequence read from the resolved root.
-*/
-function resolveWorkspacePackagePatterns(fs, root, packagesOption) {
-	if (packagesOption !== void 0) return packagesOption;
+function readPackagesFromYaml(fs, root) {
 	const yamlPath = join(root, "pnpm-workspace.yaml");
 	if (!fs.existsSync(yamlPath)) throw new Error(`@exadev/eslint-config: no "pnpm-workspace.yaml" found at workspace root "${root}", and no "packages" option was given.`);
 	return readWorkspacePackages(fs.readFileSync(yamlPath));
 }
+/**
+* Resolves the workspace's own package glob patterns: the given `packages` option verbatim, or, when omitted, pnpm-workspace.yaml's own top-level "packages:" block sequence read from the resolved root. Throws when that resolution comes back with genuinely zero patterns (an empty "packages" option array, or a "packages:" key with no key at all/an empty sequence and no override), since collectCandidates (below) would then scan nothing at all, quietly turning every workspace-architecture rule into a no-op that reports nothing rather than a real misconfiguration.
+*/
+function resolveWorkspacePackagePatterns(fs, root, packagesOption) {
+	const patterns = packagesOption ?? readPackagesFromYaml(fs, root);
+	if (patterns.length === 0) throw new Error(`@exadev/eslint-config: the resolved workspace "packages" glob list is empty (root "${root}"), which would make every workspace-architecture rule a silent no-op. Add a "packages:" block sequence to pnpm-workspace.yaml, or pass a non-empty "packages" rule option.`);
+	return patterns;
+}
 function collectCandidates(fs, root, options) {
 	const relativeDirs = resolveWorkspacePackageDirs(fs, root, resolveWorkspacePackagePatterns(fs, root, options.packages));
 	const candidates = [];
@@ -1326,6 +1469,7 @@ function loadWorkspaceGraph(filename, options) {
 //#endregion
 //#region src/rules/workspace-checks.ts
 function isIsolatedPair(groupA, groupB, isolatedGroups) {
+	if (isolatedGroups === void 0) return false;
 	return isolatedGroups.some(([first, second]) => first === groupA && second === groupB || first === groupB && second === groupA);
 }
 /**
@@ -1340,11 +1484,10 @@ function isIsolatedPair(groupA, groupB, isolatedGroups) {
 */
 function checkDependencies(selfName, self, dependencyNames, context) {
 	const violations = [];
-	const isolatedGroups = context.isolatedGroups ?? [];
 	for (const dependencyName of dependencyNames) {
 		const dependency = context.graph.get(dependencyName);
 		if (dependency === void 0) continue;
-		if (isIsolatedPair(self.group, dependency.group, isolatedGroups)) {
+		if (isIsolatedPair(self.group, dependency.group, context.isolatedGroups)) {
 			violations.push({
 				dependencyName,
 				messageId: "isolatedGroup",
@@ -1427,9 +1570,9 @@ function last(array) {
 * - **'basename'**: use only `relativeDir`'s own final segment, ignoring every intermediate directory, for a group whose intermediate structure exists purely for filesystem organisation and carries no naming intent of its own.
 */
 const NAME_SEGMENTS_BY_STRATEGY = {
-	basename: (segments) => [last(segments)],
-	"keep-group": (segments) => segments,
-	"drop-group": (_segments, rest) => rest
+	basename: ({ segments }) => [last(segments)],
+	"keep-group": ({ segments }) => segments,
+	"drop-group": ({ rest }) => rest
 };
 /**
 * The package name package-name-mirrors-path expects a package at `relativeDir` (workspace-root-relative, forward-slash-joined) to declare, given its own matched group and the workspace's global naming options. See NAME_SEGMENTS_BY_STRATEGY above for the three per-group strategies' own segment selection. The joined segments are prefixed with `naming.scope` (when given) and joined to it with "/"; segments themselves join with `naming.separator` (default "-").
@@ -1439,7 +1582,10 @@ function expectedPackageName(relativeDir, group, naming) {
 	const segments = splitPathSegments(relativeDir);
 	const groupPrefixLength = splitPathSegments(group.path ?? group.name).length;
 	const rest = segments.slice(groupPrefixLength);
-	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"](segments, rest).join(separator);
+	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"]({
+		segments,
+		rest
+	}).join(separator);
 	return naming.scope === void 0 ? joined : `${naming.scope}/${joined}`;
 }
 //#endregion
@@ -2447,6 +2593,14 @@ const packageJsonKeyOrder = {
 //#endregion
 //#region src/rules/package-name-mirrors-path.ts
 /**
+* The GroupSpec this rule's own resolved `groupName` always identifies, looked up by name in `groups`. A real `groupName` (`self.group` in the visitor below) is set only by buildWorkspaceGraph itself (workspace-graph.ts), directly from `candidate.group.name`, where `candidate.group` in turn only ever comes from `findOwningGroup(relativeDir, options.groups)`, one of that SAME `options.groups` array the visitor passes back in here as `groups`. So a real graph's group name is provably one of `groups`' own names whenever both come from the identical options object, which loadGraph(context.filename, options) and this lookup always do; failing to find it here means the graph was built from a different options object than the one now inspecting it, not a legitimate absence to skip past. Exported so this throw (unreachable through the real call site below) can be tested directly, the same "Unreachable, tested directly rather than trusted on a comment" shape package-json-key-order.ts's own `at()` helper establishes.
+*/
+function findGroupSpec(groups, groupName) {
+	const group = groups.find((candidate) => candidate.name === groupName);
+	if (group === void 0) throw new Error(`Unreachable: the workspace graph resolved group "${groupName}", which is not among this same rule invocation's own "groups" option.`);
+	return group;
+}
+/**
 * Reports a workspace package whose declared name does not mirror its path, per its own group's naming strategy and the workspace's global scope/separator (see expectedPackageName in workspace-checks.ts for the exact derivation). Opt-in: entirely a no-op whenever the shared `naming` option is omitted, exactly as the option's own doc comment (workspace-options.ts) states, since a workspace with its own established naming convention this rule cannot express should not be forced to adopt one that fits.
 *
 * Deliberately not derived from `context.filename`'s own directory the way the hive original was: this rule instead looks its own package up in the already-built graph by its DECLARED name (the same self-identification every other workspace-architecture rule uses), which is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from.
@@ -2475,8 +2629,7 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 				if (declared === void 0) return;
 				const self = graph.packagesByName.get(declared.name);
 				if (self === void 0) return;
-				const group = options.groups.find((candidate) => candidate.name === self.group);
-				if (group === void 0) return;
+				const group = findGroupSpec(options.groups, self.group);
 				const expected = expectedPackageName(self.relativeDir, group, naming);
 				if (expected === declared.name) return;
 				context.report({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "exadev-eslint-config",
   "description": "Shared custom ESLint rules and plugin for ExaDev projects",
-  "version": "2.21.0",
+  "version": "2.21.1",
   "dependencies": {
     "@eslint/js": "^10.0.1",
     "@typescript-eslint/utils": "8.67.0",