exadev-eslint-config 2.21.1 → 2.22.0

package/README.md

@@ -289,7 +289,7 @@ Bundled into `exadevConfig()`'s default output the same way React/Next.js auto-d
 | `package-json-key-order` | ✓ | **Requires `package.json`'s keys to match `syncpack format`'s order.** See [Optional package.json key ordering](#optional-packagejson-key-ordering) — opt-in via `exadevConfig({ packageJsonKeyOrder: true })`, not part of `recommended`/`barrel`. A JSON-language rule (`@eslint/json`'s `json/json`), not a TSESLint one — needs no type information and doesn't apply to any `.ts`/`.js` file. |
 | `no-uphill-dependency` | | **Enforces a configured workspace's rank, rank-skip, slice and group-isolation boundaries** on every `package.json`'s declared dependencies. See [Workspace architecture](#workspace-architecture). Opt-in via `exadevConfig({ workspaceArchitecture })` or the standalone `workspaceArchitectureConfig()`, not part of `recommended`/`barrel`. A JSON-language rule, needs no type information. |
 | `no-dependency-cycle` | | **Disallows a workspace dependency that can reach back to the package declaring it.** A same-rank or same-slice dependency passes `no-uphill-dependency` while still forming a cycle, which this rule catches instead. See [Workspace architecture](#workspace-architecture). |
-| `package-name-mirrors-path` | | **Requires a workspace package's declared name to match the name its own path derives**, under the configured naming scope and separator. Itself opt-in within workspace architecture: a no-op unless the shared `naming` option is given. See [Workspace architecture](#workspace-architecture). |
+| `package-name-mirrors-path` | | **Requires a workspace package's declared name to match the name its own path derives**, under the configured naming scope and separator. A package that declares no name at all is reported too (it plainly cannot mirror its path when it names nothing). Itself opt-in within workspace architecture: a no-op unless the shared `naming` option is given. See [Workspace architecture](#workspace-architecture). |
 | `test-file-kind` | | **A test file's name must declare its own test kind.** A filename suffix immediately before `.test`/`.spec` (e.g. `foo.unit.test.ts`), one of a configurable `{ kinds }` set (default: `unit`, `integration`, `e2e`). A naming-discipline rule, not a content classifier — it checks only the filename, never what the file actually tests. Self-scoped to real test/spec files (`context.filename`), so it never misfires when applied unscoped and never relies on a consumer's own `files` config. Requires no type information. |
 
 ## Barrel policy
@@ -348,10 +348,10 @@ Both entry points need `@eslint/json` resolvable (`pnpm add -D @eslint/json`), t
 | Field | Meaning |
 | --- | --- |
 | `root` | The workspace root directory. Defaults to the nearest ancestor of the linted file that owns a `pnpm-workspace.yaml`. |
-| `packages` | Workspace package globs, matching pnpm's own `pnpm-workspace.yaml` glob support (`*`, `**`, `[...]` character classes, `{...}` brace expansion, `!`-prefixed excludes; a wildcard segment never matches a name starting with "."). Defaults to that file's own top-level `packages:` block sequence, quoted or bare. |
+| `packages` | Workspace package globs, matching pnpm's own `pnpm-workspace.yaml` glob support (`*`, `**`, `[...]` character classes, `{...}` brace expansion, `!`-prefixed excludes; a wildcard segment never matches a name starting with "."; a `./` prefix, a `.`/`..` segment, and a repeated slash normalise the same way `path.posix.normalize` would, so `./packages/*`, `packages//*` and `a/../packages/*` all select the same projects). Defaults to that file's own top-level `packages:` block sequence, quoted or bare. A positive pattern that currently matches no directory (an empty group awaiting its first member, say) resolves to no packages, the same as pnpm itself. |
 | `dependencyFields` | `package.json` fields read as a package's declared dependencies. Defaults to `['dependencies']`. |
-| `groups` | The workspace's own directory taxonomy: `{ name, path?, rank?, slice?, naming? }`. `path` defaults to `name` (a group rooted at a directory of the same name). |
-| `nameRanks` | The name-role rank model: `{ pattern, rank }[]`, a package's declared name checked against each `pattern` in order, first match wins, ahead of its own group's `rank`. Omit entirely for a pure group-rank model. |
+| `groups` | The workspace's own directory taxonomy: `{ name, path?, rank?, slice?, naming? }`. `path` defaults to `name` (a group rooted at a directory of the same name). A group's own `naming` (`'drop-group'` \| `'keep-group'` \| `'basename'`, default `'drop-group'`) selects which segments of a package's path (after the group's own root) `package-name-mirrors-path` expects its declared name to derive: `'drop-group'` keeps every remaining path segment; `'keep-group'` additionally keeps the group's own name ahead of them (only the group's own last path segment, when its `path` nests more than one directory deep, never every container segment above it, so `{ path: 'packages/test' }` expects `test-e2e` for `packages/test/e2e`, not `packages-test-e2e`); `'basename'` keeps only the path's own final segment, dropping every intermediate directory. The joined segments are prefixed with `naming.scope` (when given) and separated with `naming.separator` (default `-`). |
+| `nameRanks` | The name-role rank model: `{ pattern, rank }[]`, a package's declared name checked against each `pattern` in order, first match wins, ahead of its own group's `rank`. Omit entirely for a pure group-rank model. pnpm allows a workspace package to declare no `name` at all; such a package has nothing for a pattern to match, so `nameRanks` is skipped for it entirely and its rank falls straight through to its own group's `rank` or `defaultRank`. |
 | `defaultRank` | The rank a package gets when neither `nameRanks` nor its own group resolves one. |
 | `rankSkip` | `{ maxDistance, exemptRanks }`. A dependency more than `maxDistance` ranks below its dependant, and not itself one of `exemptRanks` (typically a foundational rank 0), is a `rankSkip` violation. Omitted entirely, that check never runs. |
 | `isolatedGroups` | `[groupName, groupName][]` pairs forbidden from depending on each other in either direction, on top of the rank/slice checks (for two groups that share a rank but must still stay separate). |

package/dist/index.cjs

@@ -309,7 +309,7 @@ function resolveJsonPlugin(value) {
 }
 //#endregion
 //#region package.json
-var version = "2.21.1";
+var version = "2.22.0";
 //#endregion
 //#region src/react.ts
 const JSX_FILE_PATTERNS = ["**/*.jsx", "**/*.tsx"];
@@ -826,7 +826,8 @@ const noControlFlow = {
 const realWorkspaceFs = {
 	existsSync: node_fs.existsSync,
 	readFileSync: (path) => (0, node_fs.readFileSync)(path, "utf8"),
-	readdirSync: (path) => (0, node_fs.readdirSync)(path, { withFileTypes: true })
+	readdirSync: (path) => (0, node_fs.readdirSync)(path, { withFileTypes: true }),
+	realpathSync: (path) => (0, node_fs.realpathSync)(path)
 };
 function listSubdirectories(fs, dir) {
 	if (!fs.existsSync(dir)) return [];
@@ -846,10 +847,22 @@ function requireChar$1(text, index) {
 	return char;
 }
 const REGEXP_SPECIAL_CHARS = /[.+^${}()|\]\\]/gu;
+const ESCAPE_ANY_REGEXP_CHAR = /[.*+?^${}()|[\]\\]/gu;
 function segmentToRegExp(segment) {
 	let source = "";
 	for (let index = 0; index < segment.length;) {
 		const char = requireChar$1(segment, index);
+		if (char === "\\") {
+			const next = segment[index + 1];
+			if (next === void 0) {
+				source += char.replace(ESCAPE_ANY_REGEXP_CHAR, "\\$&");
+				index += 1;
+				continue;
+			}
+			source += next.replace(ESCAPE_ANY_REGEXP_CHAR, "\\$&");
+			index += 2;
+			continue;
+		}
 		if (char === "*") {
 			source += ".*";
 			index += 1;
@@ -861,15 +874,17 @@ function segmentToRegExp(segment) {
 			continue;
 		}
 		if (char === "[") {
-			const closeIndex = segment.indexOf("]", index + 1);
+			let bodyStart = index + 1;
+			const marker = segment[bodyStart];
+			const negated = marker === "!" || marker === "^";
+			if (negated) bodyStart += 1;
+			const closeIndex = segment.indexOf("]", bodyStart + 1);
 			if (closeIndex === -1) {
 				source += "\\[";
 				index += 1;
 				continue;
 			}
-			const body = segment.slice(index + 1, closeIndex);
-			const negated = body.startsWith("!") || body.startsWith("^");
-			const classBody = (negated ? body.slice(1) : body).replace(/\\/gu, "\\\\");
+			const classBody = segment.slice(bodyStart, closeIndex).replace(/\\/gu, "\\\\").replace(/\]/gu, "\\]");
 			source += `[${negated ? "^" : ""}${classBody}]`;
 			index = closeIndex + 1;
 			continue;
@@ -883,7 +898,7 @@ function segmentRequestsDotMatch(segment) {
 	return segment.startsWith(".");
 }
 function listRealSubdirectories(fs, dir) {
-	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules");
+	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules" && name !== "bower_components");
 }
 function walkPattern(fs, root, segments, matchedSoFar) {
 	const [segment, ...rest] = segments;
@@ -944,12 +959,27 @@ function expandBraces(pattern) {
 	for (const alternative of alternatives) for (const expandedAlternative of expandBraces(alternative)) for (const expandedSuffix of expandBraces(suffix)) results.push(prefix + expandedAlternative + expandedSuffix);
 	return results;
 }
+function normalizeGlobSegments(segments) {
+	const normalized = [];
+	for (const segment of segments) {
+		if (segment === ".") continue;
+		if (segment === ".." && normalized.length > 0 && normalized[normalized.length - 1] !== "..") {
+			normalized.pop();
+			continue;
+		}
+		normalized.push(segment);
+	}
+	return normalized;
+}
 /**
 * Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this. Brace groups are expanded first (a pattern can hold more than one, and each expansion can itself match several directories), so the final result is the union of every expanded pattern's own matches, deduplicated.
 */
 function expandGlob(fs, root, pattern) {
 	const matches = /* @__PURE__ */ new Set();
-	for (const expandedPattern of expandBraces(pattern)) for (const match of walkPattern(fs, root, splitPathSegments(expandedPattern), [])) matches.add(match);
+	for (const expandedPattern of expandBraces(pattern)) {
+		const segments = normalizeGlobSegments(splitPathSegments(expandedPattern));
+		for (const match of walkPattern(fs, root, segments, [])) matches.add(match);
+	}
 	return [...matches];
 }
 /** Whether `pattern` is an exclude entry in pnpm-workspace.yaml's own glob list: a leading "!", never a trailing one. Exported so this exact asymmetry (as opposed to, say, "ends with '!'") is tested directly, independent of resolveWorkspacePackageDirs' own real-filesystem scenarios below. */
@@ -957,7 +987,7 @@ function isExcludePattern(pattern) {
 	return pattern.startsWith("!");
 }
 /**
-* Resolves pnpm-workspace.yaml's own package glob list (positive patterns plus "!"-prefixed excludes) against the real directory tree, returning every matching directory (relative to `root`) that also owns a real package.json. A glob match with no package.json of its own is silently not a package (an empty scaffold directory, a stray folder left behind by a rename), matching pnpm's own behaviour rather than treating it as a workspace member.
+* Resolves pnpm-workspace.yaml's own package glob list (positive patterns plus "!"-prefixed excludes) against the real directory tree, returning every matching directory (relative to `root`) that also owns a real package.json. A glob match with no package.json of its own is silently not a package (an empty scaffold directory, a stray folder left behind by a rename), and a positive pattern matching NO directory at all is silently empty too: pnpm itself accepts a "packages:" glob over a group that currently holds no member directories (a freshly scaffolded group, or one whose only real content so far is a README), so a workspace declaring a two-level nested glob over a "verticals" group before anything lives under it must lint exactly as it did before that glob was added, not abort every workspace-architecture rule with a startup error.
 */
 function resolveWorkspacePackageDirs(fs, root, patterns) {
 	const includePatterns = patterns.filter((pattern) => !isExcludePattern(pattern));
@@ -1065,6 +1095,23 @@ function readWorkspacePackages(yamlText) {
 	return items;
 }
 //#endregion
+//#region src/rules/workspace-errors.ts
+function assertIsError(error, context) {
+	if (!(error instanceof Error)) throw new Error(`Unreachable: ${context} threw a non-Error value.`);
+}
+/**
+* The exact context string readDeclaredManifest (workspace-graph.ts) passes to assertIsError when JSON.parse throws. Extracted into its own function, rather than inlined as a template literal at that call site, because assertIsError's own throw is unreachable there (JSON.parse never throws a non-Error value): a test exercising the real call path can never observe which context string was passed, so this function exists purely to let that exact string be asserted directly against a range of manifest paths, the same "Unreachable, tested directly" treatment this package gives requireChar/findDependencyEntry/findGroupSpec/last.
+*/
+function jsonParseContext(manifestPath) {
+	return `JSON.parse while parsing "${manifestPath}"`;
+}
+/**
+* The exact context string validateRankRulePatterns (workspace-options.ts) passes to assertIsError when the RegExp constructor throws, extracted for the same reason as jsonParseContext above: that call site's assertIsError throw is equally unreachable (the RegExp constructor never throws a non-Error value), so this function is what makes the string directly testable.
+*/
+function regExpConstructorContext(pattern) {
+	return `the RegExp constructor while compiling "nameRanks" pattern "${pattern}"`;
+}
+//#endregion
 //#region src/rules/workspace-options.ts
 const workspaceArchitectureOptionsSchema = {
 	type: "object",
@@ -1085,7 +1132,7 @@ const workspaceArchitectureOptionsSchema = {
 				properties: {
 					name: { type: "string" },
 					path: { type: "string" },
-					rank: { type: "number" },
+					rank: { type: "integer" },
 					slice: { oneOf: [{
 						type: "object",
 						properties: { segment: {
@@ -1119,20 +1166,23 @@ const workspaceArchitectureOptionsSchema = {
 				type: "object",
 				properties: {
 					pattern: { type: "string" },
-					rank: { type: "number" }
+					rank: { type: "integer" }
 				},
 				required: ["pattern", "rank"],
 				additionalProperties: false
 			}
 		},
-		defaultRank: { type: "number" },
+		defaultRank: { type: "integer" },
 		rankSkip: {
 			type: "object",
 			properties: {
-				maxDistance: { type: "number" },
+				maxDistance: {
+					type: "integer",
+					minimum: 0
+				},
 				exemptRanks: {
 					type: "array",
-					items: { type: "number" }
+					items: { type: "integer" }
 				}
 			},
 			required: ["maxDistance", "exemptRanks"],
@@ -1144,7 +1194,8 @@ const workspaceArchitectureOptionsSchema = {
 				type: "array",
 				items: { type: "string" },
 				minItems: 2,
-				maxItems: 2
+				maxItems: 2,
+				uniqueItems: true
 			}
 		},
 		naming: {
@@ -1195,9 +1246,12 @@ function asOptionalString(value) {
 	if (typeof value !== "string") fail();
 	return value;
 }
-function asOptionalNumber(value) {
+function isInteger(value) {
+	return Number.isInteger(value);
+}
+function asOptionalInteger(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "number") fail();
+	if (!isInteger(value)) fail();
 	return value;
 }
 function asOptionalStringArray(value) {
@@ -1224,7 +1278,7 @@ function isGroupSpec(value) {
 	if (typeof value["name"] !== "string") return false;
 	const { path, rank, slice, naming } = value;
 	if (path !== void 0 && typeof path !== "string") return false;
-	if (rank !== void 0 && typeof rank !== "number") return false;
+	if (rank !== void 0 && !isInteger(rank)) return false;
 	if (slice !== void 0 && !isSliceSpec(slice)) return false;
 	if (naming !== void 0 && !isNamingStrategy(naming)) return false;
 	return true;
@@ -1244,19 +1298,28 @@ function findDuplicateGroupName(groups) {
 	}
 }
 function isRankRule(value) {
-	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && typeof value["rank"] === "number";
+	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && isInteger(value["rank"]);
+}
+function validateRankRulePatterns(rankRules) {
+	for (const rule of rankRules) try {
+		new RegExp(rule.pattern, "u");
+	} catch (error) {
+		assertIsError(error, regExpConstructorContext(rule.pattern));
+		throw new Error(`@exadev/eslint-config: "nameRanks" pattern "${rule.pattern}" is not a valid regular expression: ${error.message}`, { cause: error });
+	}
 }
 function asOptionalRankRuleArray(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value) || !value.every(isRankRule)) fail();
+	validateRankRulePatterns(value);
 	return value;
 }
 function isRankSkipOptions(value) {
 	if (!isRecord$1(value)) return false;
 	if (!hasOnlyKeys(value, RANK_SKIP_KEYS)) return false;
-	if (typeof value["maxDistance"] !== "number") return false;
+	if (!isNonNegativeInteger(value["maxDistance"])) return false;
 	const { exemptRanks } = value;
-	return Array.isArray(exemptRanks) && exemptRanks.every((rank) => typeof rank === "number");
+	return Array.isArray(exemptRanks) && exemptRanks.every(isInteger);
 }
 function asOptionalRankSkip(value) {
 	if (value === void 0) return void 0;
@@ -1296,13 +1359,16 @@ function readWorkspaceArchitectureOptions(options) {
 	const packages = asOptionalStringArray(options["packages"]);
 	const dependencyFields = asOptionalStringArray(options["dependencyFields"]);
 	const nameRanks = asOptionalRankRuleArray(options["nameRanks"]);
-	const defaultRank = asOptionalNumber(options["defaultRank"]);
+	const defaultRank = asOptionalInteger(options["defaultRank"]);
 	const rankSkip = asOptionalRankSkip(options["rankSkip"]);
 	const isolatedGroups = asOptionalIsolatedGroups(options["isolatedGroups"]);
 	const naming = asOptionalNaming(options["naming"]);
 	if (isolatedGroups !== void 0) {
 		const groupNames = new Set(groups.map((group) => group.name));
-		for (const [first, second] of isolatedGroups) if (!groupNames.has(first) || !groupNames.has(second)) throw new Error(`@exadev/eslint-config: "isolatedGroups" names a group not declared in "groups" (["${first}", "${second}"]). Every isolatedGroups pair must name two of this workspace's own declared groups.`);
+		for (const [first, second] of isolatedGroups) {
+			if (!groupNames.has(first) || !groupNames.has(second)) throw new Error(`@exadev/eslint-config: "isolatedGroups" names a group not declared in "groups" (["${first}", "${second}"]). Every isolatedGroups pair must name two of this workspace's own declared groups.`);
+			if (first === second) throw new Error(`@exadev/eslint-config: "isolatedGroups" pair ["${first}", "${second}"] names the same group twice. A group cannot be isolated from itself.`);
+		}
 	}
 	return {
 		...root !== void 0 && { root },
@@ -1344,15 +1410,15 @@ function findOwningGroup(relativeDir, groups) {
 	return best;
 }
 /**
-* The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
+* The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. `declaredName` is the package's own genuine `package.json` "name", never a directory-derived stand-in: pnpm allows a workspace package to declare no name at all, and such a package has nothing for a nameRanks pattern to match (the README states nameRanks checks "a package's declared name", not its directory), so a nameless package skips nameRanks entirely and falls straight through to its group's rank or defaultRank, the same as a package whose name simply matched no pattern. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
 */
 function deriveRank(declaredName, group, options) {
-	if (options.nameRanks !== void 0) {
+	if (declaredName !== void 0 && options.nameRanks !== void 0) {
 		for (const rule of options.nameRanks) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
 	}
 	if (group.rank !== void 0) return group.rank;
 	if (options.defaultRank !== void 0) return options.defaultRank;
-	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
+	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName ?? "(no declared name)"}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
 }
 /**
 * The slice value a 'segment' group derives directly from its own package's path: the Nth path segment counting from the group's own root, not from the workspace root, so a group's own internal restructure never shifts every other group's slice numbering.
@@ -1375,23 +1441,29 @@ function isRecord(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
-* Reads a candidate package directory's own package.json directly (plain JSON.parse, not momoa): this is data collection for the graph, not a file being linted, so no AST/location information is needed. No existsSync guard here: every relativeDir this is called with came from resolveWorkspacePackageDirs, which already only returns directories that own a real package.json, so its absence here would mean that guarantee broke, not a case to handle quietly. A manifest with no usable string "name" is treated the same way regardless: nothing this graph can identify a package by.
+* Reads a candidate package directory's own package.json directly (plain JSON.parse, not momoa): this is data collection for the graph, not a file being linted, so no AST/location information is needed. No existsSync guard here: every relativeDir this is called with came from resolveWorkspacePackageDirs, which already only returns directories that own a real package.json, so its absence here would mean that guarantee broke, not a case to handle quietly. A manifest that is not a usable JSON object at all (parses to an array, a string, null) returns undefined: nothing this graph can identify a package by, regardless of any "name" field. A manifest that IS a usable object but declares no "name" (or a non-string one) is different: pnpm allows a workspace package with no declared name at all, so its own `name` comes back as undefined rather than dropping the whole manifest, letting collectCandidates below key such a package by its directory instead of silently skipping it (and every dependency it declares along with it).
 *
 * Exported so `dependencyNames`' own exact contents (never a stray extra entry) can be asserted directly: buildWorkspaceGraph's own public output filters dependencyNamesByName down to workspace-internal names only, which would silently absorb an unexpected non-package entry before any graph-level test could ever see it.
 */
 function readDeclaredManifest(fs, absoluteDir, dependencyFields) {
 	const manifestPath = (0, node_path.join)(absoluteDir, "package.json");
-	const parsed = JSON.parse(fs.readFileSync(manifestPath));
+	const raw = fs.readFileSync(manifestPath);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		assertIsError(error, jsonParseContext(manifestPath));
+		throw new Error(`@exadev/eslint-config: could not parse "${manifestPath}" as JSON: ${error.message}`, { cause: error });
+	}
 	if (!isRecord(parsed)) return void 0;
 	const name = parsed["name"];
-	if (typeof name !== "string") return void 0;
 	const dependencyNames = [];
 	for (const field of dependencyFields) {
 		const value = parsed[field];
 		if (isRecord(value)) dependencyNames.push(...Object.keys(value));
 	}
 	return {
-		name,
+		name: typeof name === "string" ? name : void 0,
 		dependencyNames
 	};
 }
@@ -1408,6 +1480,16 @@ function resolveWorkspaceRoot(fs, filename, rootOption) {
 		dir = parent;
 	}
 }
+/**
+* The workspace-root-relative, forward-slash-joined directory the manifest at `filename` (context.filename, the file ESLint is currently linting) sits in: computed directly from the filesystem, never trusted from a declared "name" field. Every workspace-architecture rule uses this to confirm the manifest it is linting is genuinely the SAME package.json buildWorkspaceGraph resolved for whatever graph entry it is about to check, since a name is only ever unique within the graph's own build (buildWorkspaceGraph's own duplicate-name throw enforces that), never across a stale or duplicated copy of a manifest sitting elsewhere in the tree outside the workspace's own package globs (a build output directory that copies its source package's package.json verbatim, say). A rule that skipped this check would check that copy under the real package's own graph entry: reporting edges the real package never declared, or letting a single real violation double-report once per copy.
+*
+* Both `root` and `filename`'s own directory are resolved through `fs.realpathSync` before comparing: an explicit `root` option and ESLint's own `context.filename` can spell the identical real directory two different ways (a symlink anywhere on either path, a macOS /tmp vs /private/tmp cwd being the recurring real case), and a purely lexical `relative()` between the two spellings would compute a path nowhere near the graph entry's own relativeDir, silently making every workspace-architecture rule report nothing for a perfectly real, correctly-configured package. Comparing realpaths instead makes the two spellings agree while still catching a genuinely different directory (a stale or duplicated manifest copy) as genuinely different.
+*/
+function manifestRelativeDir(fs, root, filename) {
+	const realRoot = fs.realpathSync((0, node_path.resolve)(root));
+	const realManifestDir = fs.realpathSync((0, node_path.dirname)((0, node_path.resolve)(filename)));
+	return (0, node_path.relative)(realRoot, realManifestDir).split(node_path.sep).join("/");
+}
 function readPackagesFromYaml(fs, root) {
 	const yamlPath = (0, node_path.join)(root, "pnpm-workspace.yaml");
 	if (!fs.existsSync(yamlPath)) throw new Error(`@exadev/eslint-config: no "pnpm-workspace.yaml" found at workspace root "${root}", and no "packages" option was given.`);
@@ -1429,10 +1511,12 @@ function collectCandidates(fs, root, options) {
 		if (group === void 0) throw new Error(`@exadev/eslint-config: workspace package directory "${relativeDir}" (matched by the "packages" globs) is not covered by any configured group's own "path". Add a "groups" entry whose path prefixes it, or narrow "packages" to exclude it: an uncovered package would otherwise be silently skipped by every workspace-architecture check.`);
 		const manifest = readDeclaredManifest(fs, (0, node_path.join)(root, relativeDir), resolveDependencyFields(options));
 		if (manifest === void 0) continue;
+		const declaredName = manifest.name ?? relativeDir;
 		candidates.push({
 			relativeDir,
 			group,
-			declaredName: manifest.name,
+			declaredName,
+			name: manifest.name,
 			dependencyNames: manifest.dependencyNames
 		});
 	}
@@ -1451,7 +1535,8 @@ function collectKnownSlices(candidates) {
 function deriveSlice(candidate, knownSlices) {
 	const { slice } = candidate.group;
 	if (slice === void 0) return void 0;
-	return "segment" in slice ? sliceBySegment(candidate.relativeDir, candidate.group, slice.segment) : sliceByNamePrefix(candidate.declaredName, knownSlices);
+	if ("segment" in slice) return sliceBySegment(candidate.relativeDir, candidate.group, slice.segment);
+	return candidate.name === void 0 ? void 0 : sliceByNamePrefix(candidate.name, knownSlices);
 }
 /**
 * Builds the whole-workspace graph from scratch: every declared package's group/rank/slice, and every workspace-internal dependency edge. Scans the real tree once per call; getWorkspaceGraph below is the memoized entry point every rule actually calls.
@@ -1464,7 +1549,7 @@ function buildWorkspaceGraph(fs, root, options) {
 	for (const candidate of candidates) {
 		const existing = packagesByName.get(candidate.declaredName);
 		if (existing !== void 0) throw new Error(`@exadev/eslint-config: two workspace packages both declare the name "${candidate.declaredName}" ("${existing.relativeDir}" and "${candidate.relativeDir}").`);
-		const rank = deriveRank(candidate.declaredName, candidate.group, options);
+		const rank = deriveRank(candidate.name, candidate.group, options);
 		const slice = deriveSlice(candidate, knownSlices);
 		packagesByName.set(candidate.declaredName, {
 			name: candidate.declaredName,
@@ -1600,12 +1685,12 @@ function last(array) {
 * The three per-group naming strategies' own segment selection, keyed by NamingStrategy's own three literal members rather than a chain of ternaries: `Record<NamingStrategy, ...>` requires every member to have its own entry, which is what makes 'drop-group' a genuine, independently-typed branch, not merely "whatever the ternary chain falls through to when nothing else matched". Stryker's own typescript checker rejects a mutant that replaces the `?? 'drop-group'` fallback with some other string, since indexing this record with a value outside NamingStrategy is a type error, caught before any test even runs.
 *
 * - **'drop-group'**: drop the group's own root path segments, keep what remains.
-* - **'keep-group'**: keep every segment of `relativeDir` as-is, including the group's own root segments (a test group whose packages are named "test-<feature>", mirroring the feature they test, needs its own "test" segment kept).
+* - **'keep-group'**: keep the group's OWN name (or, when its root path nests more than one segment deep, only that path's own last segment) ahead of `rest`, not every segment of `relativeDir` including whatever container directories sit above the group's own root: a group declared as `{ path: 'packages/test' }` derives "test-e2e" for `packages/test/e2e`, never "packages-test-e2e", the same way a group with no nested path at all already would. A test group whose packages are named "test-<feature>", mirroring the feature they test, needs its own "test" segment kept, just not any further container segment above it.
 * - **'basename'**: use only `relativeDir`'s own final segment, ignoring every intermediate directory, for a group whose intermediate structure exists purely for filesystem organisation and carries no naming intent of its own.
 */
 const NAME_SEGMENTS_BY_STRATEGY = {
 	basename: ({ segments }) => [last(segments)],
-	"keep-group": ({ segments }) => segments,
+	"keep-group": ({ rest, groupNameSegment }) => [groupNameSegment, ...rest],
 	"drop-group": ({ rest }) => rest
 };
 /**
@@ -1614,11 +1699,13 @@ const NAME_SEGMENTS_BY_STRATEGY = {
 function expectedPackageName(relativeDir, group, naming) {
 	const separator = naming.separator ?? "-";
 	const segments = splitPathSegments(relativeDir);
-	const groupPrefixLength = splitPathSegments(group.path ?? group.name).length;
-	const rest = segments.slice(groupPrefixLength);
+	const groupPathSegments = splitPathSegments(group.path ?? group.name);
+	const rest = segments.slice(groupPathSegments.length);
+	const groupNameSegment = last(groupPathSegments);
 	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"]({
 		segments,
-		rest
+		rest,
+		groupNameSegment
 	}).join(separator);
 	return naming.scope === void 0 ? joined : `${naming.scope}/${joined}`;
 }
@@ -1662,9 +1749,10 @@ function collectTopLevelDependencies(rootObject, dependencyFields) {
 /**
 * Reports a workspace dependency that can reach back to the declaring package: a cycle. This is NOT covered by no-uphill-dependency, and the distinction matters: that rule permits a same-rank (or, within a slice, a same-slice) dependency, so two packages at the same rank depending on each other passes it while still being a cycle. Turborepo does reject a cyclic task graph, but only once the whole graph is assembled, by which point a large refactor has already moved everything; reporting it at the manifest, where the edge is declared, names the two packages and the direction to reverse.
 *
-* Identifies "self" by this manifest's own DECLARED name (read via readDeclaredName), not a name derived from its directory: the hive original derived `ownName` from the package's path through its own expectedPackageName, so a package whose declared name did not yet match its path (itself a naming violation, but a distinct one from a cycle) was checked under the WRONG name here, silently missing or misattributing a real cycle. Reading the manifest's own name directly is also strictly simpler: cycle detection has no need of path-derived naming at all.
+* Identifies "self" by this manifest's own DECLARED name (read via readDeclaredName) when it has one, never a name derived by re-deriving what its path OUGHT to produce: the hive original derived `ownName` from the package's path through its own expectedPackageName, so a package whose declared name did not yet match its path (itself a naming violation, but a distinct one from a cycle) was checked under the WRONG name here, silently missing or misattributing a real cycle. A manifest with no declared name at all (pnpm allows this) falls back to its own directory instead, the same key buildWorkspaceGraph gives such a package in the graph (workspace-graph.ts), so its outgoing edges are still checked rather than silently dropped. Either way, the manifest actually being linted must also be confirmed as the graph entry's own file (see manifestRelativeDir below), not a stale or duplicated copy elsewhere in the tree sharing the same declared name.
 */
-function createNoDependencyCycleRule(loadGraph = loadWorkspaceGraph) {
+function createNoDependencyCycleRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -1682,18 +1770,20 @@ function createNoDependencyCycleRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				if (!graph.packagesByName.has(declared.name)) return;
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
+				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const dependencies = collectTopLevelDependencies(node, resolveDependencyFields(options));
 				for (const dependency of dependencies) {
 					if (!graph.packagesByName.has(dependency.name)) continue;
-					if (!dependencyPathExists(dependency.name, declared.name, graph.dependencyNamesByName)) continue;
+					if (!dependencyPathExists(dependency.name, self.name, graph.dependencyNamesByName)) continue;
 					context.report({
 						loc: dependency.node.loc,
 						messageId: "cycle",
 						data: {
-							from: declared.name,
+							from: self.name,
 							to: dependency.name
 						}
 					});
@@ -2376,7 +2466,8 @@ function findDependencyEntry(dependencies, name) {
 /**
 * Enforces the configured workspace's own rank, rank-skip, slice and group-isolation boundaries on every `package.json`'s declared dependencies (see workspace-checks.ts's checkDependencies for the exact rules, and the package README's "Workspace architecture" section for the option shape). A factory, not a plain object, so a test can inject a stubbed LoadWorkspaceGraphFn returning a fabricated graph directly, exercising this rule's own reporting logic (which violation, which message, which location) with zero real filesystem I/O, the same "injectable in tests, defaulted in production" shape createBarrelPolicyRule already establishes.
 */
-function createNoUphillDependencyRule(loadGraph = loadWorkspaceGraph) {
+function createNoUphillDependencyRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -2399,13 +2490,14 @@ function createNoUphillDependencyRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				const self = graph.packagesByName.get(declared.name);
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
 				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const dependencies = collectTopLevelDependencies(node, resolveDependencyFields(options));
 				const dependencyNames = [...new Set(dependencies.map((dependency) => dependency.name))];
-				const violations = checkDependencies(declared.name, self, dependencyNames, {
+				const violations = checkDependencies(self.name, self, dependencyNames, {
 					graph: graph.packagesByName,
 					...options.rankSkip !== void 0 && { rankSkip: options.rankSkip },
 					...options.isolatedGroups !== void 0 && { isolatedGroups: options.isolatedGroups }
@@ -2637,9 +2729,10 @@ function findGroupSpec(groups, groupName) {
 /**
 * Reports a workspace package whose declared name does not mirror its path, per its own group's naming strategy and the workspace's global scope/separator (see expectedPackageName in workspace-checks.ts for the exact derivation). Opt-in: entirely a no-op whenever the shared `naming` option is omitted, exactly as the option's own doc comment (workspace-options.ts) states, since a workspace with its own established naming convention this rule cannot express should not be forced to adopt one that fits.
 *
-* Deliberately not derived from `context.filename`'s own directory the way the hive original was: this rule instead looks its own package up in the already-built graph by its DECLARED name (the same self-identification every other workspace-architecture rule uses), which is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from.
+* Self-identified by its DECLARED name (the same self-identification every other workspace-architecture rule uses), not derived from `context.filename`'s own directory the way the hive original was: this is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from. `context.filename`'s own directory is still consulted, but only afterwards, as a confirmation: it must equal the resolved graph entry's own relativeDir, or the manifest being linted is a stale or duplicated copy of a real package's package.json sitting somewhere else in the tree (a build output directory that copied it verbatim, say), not the genuine article this graph entry was built from.
 */
-function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
+function createPackageNameMirrorsPathRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -2650,7 +2743,10 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 				description: "Require a workspace package to declare the name its path derives, under the configured naming scope/separator.",
 				url: "https://github.com/ExaDev/eslint-config/blob/main/src/rules/package-name-mirrors-path.ts"
 			},
-			messages: { mismatch: "Package at \"{{dir}}\" declares \"{{actual}}\" but its path derives \"{{expected}}\"." }
+			messages: {
+				mismatch: "Package at \"{{dir}}\" declares \"{{actual}}\" but its path derives \"{{expected}}\".",
+				missingName: "Package at \"{{dir}}\" declares no name at all, but its path derives \"{{expected}}\"."
+			}
 		},
 		create(context) {
 			const options = readWorkspaceArchitectureOptions(context.options[0]);
@@ -2659,12 +2755,24 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				const self = graph.packagesByName.get(declared.name);
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
 				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const group = findGroupSpec(options.groups, self.group);
 				const expected = expectedPackageName(self.relativeDir, group, naming);
+				if (declared === void 0) {
+					context.report({
+						loc: node.loc,
+						messageId: "missingName",
+						data: {
+							dir: self.relativeDir,
+							expected
+						}
+					});
+					return;
+				}
 				if (expected === declared.name) return;
 				context.report({
 					loc: declared.node.loc,

package/dist/index.js

@@ -1,5 +1,5 @@
-import fs, { existsSync, readFileSync, readdirSync } from "node:fs";
-import path, { dirname, join, posix, resolve } from "node:path";
+import fs, { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import path, { dirname, join, posix, relative, resolve, sep } from "node:path";
 import jsdoc from "eslint-plugin-jsdoc";
 import tsdoc from "eslint-plugin-tsdoc";
 import jsonCanonical from "eslint-plugin-json-canonical";
@@ -275,7 +275,7 @@ function resolveJsonPlugin(value) {
 }
 //#endregion
 //#region package.json
-var version = "2.21.1";
+var version = "2.22.0";
 //#endregion
 //#region src/react.ts
 const JSX_FILE_PATTERNS = ["**/*.jsx", "**/*.tsx"];
@@ -792,7 +792,8 @@ const noControlFlow = {
 const realWorkspaceFs = {
 	existsSync,
 	readFileSync: (path) => readFileSync(path, "utf8"),
-	readdirSync: (path) => readdirSync(path, { withFileTypes: true })
+	readdirSync: (path) => readdirSync(path, { withFileTypes: true }),
+	realpathSync: (path) => realpathSync(path)
 };
 function listSubdirectories(fs, dir) {
 	if (!fs.existsSync(dir)) return [];
@@ -812,10 +813,22 @@ function requireChar$1(text, index) {
 	return char;
 }
 const REGEXP_SPECIAL_CHARS = /[.+^${}()|\]\\]/gu;
+const ESCAPE_ANY_REGEXP_CHAR = /[.*+?^${}()|[\]\\]/gu;
 function segmentToRegExp(segment) {
 	let source = "";
 	for (let index = 0; index < segment.length;) {
 		const char = requireChar$1(segment, index);
+		if (char === "\\") {
+			const next = segment[index + 1];
+			if (next === void 0) {
+				source += char.replace(ESCAPE_ANY_REGEXP_CHAR, "\\$&");
+				index += 1;
+				continue;
+			}
+			source += next.replace(ESCAPE_ANY_REGEXP_CHAR, "\\$&");
+			index += 2;
+			continue;
+		}
 		if (char === "*") {
 			source += ".*";
 			index += 1;
@@ -827,15 +840,17 @@ function segmentToRegExp(segment) {
 			continue;
 		}
 		if (char === "[") {
-			const closeIndex = segment.indexOf("]", index + 1);
+			let bodyStart = index + 1;
+			const marker = segment[bodyStart];
+			const negated = marker === "!" || marker === "^";
+			if (negated) bodyStart += 1;
+			const closeIndex = segment.indexOf("]", bodyStart + 1);
 			if (closeIndex === -1) {
 				source += "\\[";
 				index += 1;
 				continue;
 			}
-			const body = segment.slice(index + 1, closeIndex);
-			const negated = body.startsWith("!") || body.startsWith("^");
-			const classBody = (negated ? body.slice(1) : body).replace(/\\/gu, "\\\\");
+			const classBody = segment.slice(bodyStart, closeIndex).replace(/\\/gu, "\\\\").replace(/\]/gu, "\\]");
 			source += `[${negated ? "^" : ""}${classBody}]`;
 			index = closeIndex + 1;
 			continue;
@@ -849,7 +864,7 @@ function segmentRequestsDotMatch(segment) {
 	return segment.startsWith(".");
 }
 function listRealSubdirectories(fs, dir) {
-	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules");
+	return listSubdirectories(fs, dir).filter((name) => name !== "node_modules" && name !== "bower_components");
 }
 function walkPattern(fs, root, segments, matchedSoFar) {
 	const [segment, ...rest] = segments;
@@ -910,12 +925,27 @@ function expandBraces(pattern) {
 	for (const alternative of alternatives) for (const expandedAlternative of expandBraces(alternative)) for (const expandedSuffix of expandBraces(suffix)) results.push(prefix + expandedAlternative + expandedSuffix);
 	return results;
 }
+function normalizeGlobSegments(segments) {
+	const normalized = [];
+	for (const segment of segments) {
+		if (segment === ".") continue;
+		if (segment === ".." && normalized.length > 0 && normalized[normalized.length - 1] !== "..") {
+			normalized.pop();
+			continue;
+		}
+		normalized.push(segment);
+	}
+	return normalized;
+}
 /**
 * Expands one pnpm-workspace.yaml glob pattern against the real directory tree rooted at `root`, returning every matching directory as a path relative to `root` (forward-slash-joined, no leading "./"). A pattern with a leading "!" is not itself special here: negation is a list-level concern (see resolveWorkspacePackageDirs below), so a caller wanting an exclude pattern's own matches strips the "!" before calling this. Brace groups are expanded first (a pattern can hold more than one, and each expansion can itself match several directories), so the final result is the union of every expanded pattern's own matches, deduplicated.
 */
 function expandGlob(fs, root, pattern) {
 	const matches = /* @__PURE__ */ new Set();
-	for (const expandedPattern of expandBraces(pattern)) for (const match of walkPattern(fs, root, splitPathSegments(expandedPattern), [])) matches.add(match);
+	for (const expandedPattern of expandBraces(pattern)) {
+		const segments = normalizeGlobSegments(splitPathSegments(expandedPattern));
+		for (const match of walkPattern(fs, root, segments, [])) matches.add(match);
+	}
 	return [...matches];
 }
 /** Whether `pattern` is an exclude entry in pnpm-workspace.yaml's own glob list: a leading "!", never a trailing one. Exported so this exact asymmetry (as opposed to, say, "ends with '!'") is tested directly, independent of resolveWorkspacePackageDirs' own real-filesystem scenarios below. */
@@ -923,7 +953,7 @@ function isExcludePattern(pattern) {
 	return pattern.startsWith("!");
 }
 /**
-* Resolves pnpm-workspace.yaml's own package glob list (positive patterns plus "!"-prefixed excludes) against the real directory tree, returning every matching directory (relative to `root`) that also owns a real package.json. A glob match with no package.json of its own is silently not a package (an empty scaffold directory, a stray folder left behind by a rename), matching pnpm's own behaviour rather than treating it as a workspace member.
+* Resolves pnpm-workspace.yaml's own package glob list (positive patterns plus "!"-prefixed excludes) against the real directory tree, returning every matching directory (relative to `root`) that also owns a real package.json. A glob match with no package.json of its own is silently not a package (an empty scaffold directory, a stray folder left behind by a rename), and a positive pattern matching NO directory at all is silently empty too: pnpm itself accepts a "packages:" glob over a group that currently holds no member directories (a freshly scaffolded group, or one whose only real content so far is a README), so a workspace declaring a two-level nested glob over a "verticals" group before anything lives under it must lint exactly as it did before that glob was added, not abort every workspace-architecture rule with a startup error.
 */
 function resolveWorkspacePackageDirs(fs, root, patterns) {
 	const includePatterns = patterns.filter((pattern) => !isExcludePattern(pattern));
@@ -1031,6 +1061,23 @@ function readWorkspacePackages(yamlText) {
 	return items;
 }
 //#endregion
+//#region src/rules/workspace-errors.ts
+function assertIsError(error, context) {
+	if (!(error instanceof Error)) throw new Error(`Unreachable: ${context} threw a non-Error value.`);
+}
+/**
+* The exact context string readDeclaredManifest (workspace-graph.ts) passes to assertIsError when JSON.parse throws. Extracted into its own function, rather than inlined as a template literal at that call site, because assertIsError's own throw is unreachable there (JSON.parse never throws a non-Error value): a test exercising the real call path can never observe which context string was passed, so this function exists purely to let that exact string be asserted directly against a range of manifest paths, the same "Unreachable, tested directly" treatment this package gives requireChar/findDependencyEntry/findGroupSpec/last.
+*/
+function jsonParseContext(manifestPath) {
+	return `JSON.parse while parsing "${manifestPath}"`;
+}
+/**
+* The exact context string validateRankRulePatterns (workspace-options.ts) passes to assertIsError when the RegExp constructor throws, extracted for the same reason as jsonParseContext above: that call site's assertIsError throw is equally unreachable (the RegExp constructor never throws a non-Error value), so this function is what makes the string directly testable.
+*/
+function regExpConstructorContext(pattern) {
+	return `the RegExp constructor while compiling "nameRanks" pattern "${pattern}"`;
+}
+//#endregion
 //#region src/rules/workspace-options.ts
 const workspaceArchitectureOptionsSchema = {
 	type: "object",
@@ -1051,7 +1098,7 @@ const workspaceArchitectureOptionsSchema = {
 				properties: {
 					name: { type: "string" },
 					path: { type: "string" },
-					rank: { type: "number" },
+					rank: { type: "integer" },
 					slice: { oneOf: [{
 						type: "object",
 						properties: { segment: {
@@ -1085,20 +1132,23 @@ const workspaceArchitectureOptionsSchema = {
 				type: "object",
 				properties: {
 					pattern: { type: "string" },
-					rank: { type: "number" }
+					rank: { type: "integer" }
 				},
 				required: ["pattern", "rank"],
 				additionalProperties: false
 			}
 		},
-		defaultRank: { type: "number" },
+		defaultRank: { type: "integer" },
 		rankSkip: {
 			type: "object",
 			properties: {
-				maxDistance: { type: "number" },
+				maxDistance: {
+					type: "integer",
+					minimum: 0
+				},
 				exemptRanks: {
 					type: "array",
-					items: { type: "number" }
+					items: { type: "integer" }
 				}
 			},
 			required: ["maxDistance", "exemptRanks"],
@@ -1110,7 +1160,8 @@ const workspaceArchitectureOptionsSchema = {
 				type: "array",
 				items: { type: "string" },
 				minItems: 2,
-				maxItems: 2
+				maxItems: 2,
+				uniqueItems: true
 			}
 		},
 		naming: {
@@ -1161,9 +1212,12 @@ function asOptionalString(value) {
 	if (typeof value !== "string") fail();
 	return value;
 }
-function asOptionalNumber(value) {
+function isInteger(value) {
+	return Number.isInteger(value);
+}
+function asOptionalInteger(value) {
 	if (value === void 0) return void 0;
-	if (typeof value !== "number") fail();
+	if (!isInteger(value)) fail();
 	return value;
 }
 function asOptionalStringArray(value) {
@@ -1190,7 +1244,7 @@ function isGroupSpec(value) {
 	if (typeof value["name"] !== "string") return false;
 	const { path, rank, slice, naming } = value;
 	if (path !== void 0 && typeof path !== "string") return false;
-	if (rank !== void 0 && typeof rank !== "number") return false;
+	if (rank !== void 0 && !isInteger(rank)) return false;
 	if (slice !== void 0 && !isSliceSpec(slice)) return false;
 	if (naming !== void 0 && !isNamingStrategy(naming)) return false;
 	return true;
@@ -1210,19 +1264,28 @@ function findDuplicateGroupName(groups) {
 	}
 }
 function isRankRule(value) {
-	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && typeof value["rank"] === "number";
+	return isRecord$1(value) && hasOnlyKeys(value, RANK_RULE_KEYS) && typeof value["pattern"] === "string" && isInteger(value["rank"]);
+}
+function validateRankRulePatterns(rankRules) {
+	for (const rule of rankRules) try {
+		new RegExp(rule.pattern, "u");
+	} catch (error) {
+		assertIsError(error, regExpConstructorContext(rule.pattern));
+		throw new Error(`@exadev/eslint-config: "nameRanks" pattern "${rule.pattern}" is not a valid regular expression: ${error.message}`, { cause: error });
+	}
 }
 function asOptionalRankRuleArray(value) {
 	if (value === void 0) return void 0;
 	if (!Array.isArray(value) || !value.every(isRankRule)) fail();
+	validateRankRulePatterns(value);
 	return value;
 }
 function isRankSkipOptions(value) {
 	if (!isRecord$1(value)) return false;
 	if (!hasOnlyKeys(value, RANK_SKIP_KEYS)) return false;
-	if (typeof value["maxDistance"] !== "number") return false;
+	if (!isNonNegativeInteger(value["maxDistance"])) return false;
 	const { exemptRanks } = value;
-	return Array.isArray(exemptRanks) && exemptRanks.every((rank) => typeof rank === "number");
+	return Array.isArray(exemptRanks) && exemptRanks.every(isInteger);
 }
 function asOptionalRankSkip(value) {
 	if (value === void 0) return void 0;
@@ -1262,13 +1325,16 @@ function readWorkspaceArchitectureOptions(options) {
 	const packages = asOptionalStringArray(options["packages"]);
 	const dependencyFields = asOptionalStringArray(options["dependencyFields"]);
 	const nameRanks = asOptionalRankRuleArray(options["nameRanks"]);
-	const defaultRank = asOptionalNumber(options["defaultRank"]);
+	const defaultRank = asOptionalInteger(options["defaultRank"]);
 	const rankSkip = asOptionalRankSkip(options["rankSkip"]);
 	const isolatedGroups = asOptionalIsolatedGroups(options["isolatedGroups"]);
 	const naming = asOptionalNaming(options["naming"]);
 	if (isolatedGroups !== void 0) {
 		const groupNames = new Set(groups.map((group) => group.name));
-		for (const [first, second] of isolatedGroups) if (!groupNames.has(first) || !groupNames.has(second)) throw new Error(`@exadev/eslint-config: "isolatedGroups" names a group not declared in "groups" (["${first}", "${second}"]). Every isolatedGroups pair must name two of this workspace's own declared groups.`);
+		for (const [first, second] of isolatedGroups) {
+			if (!groupNames.has(first) || !groupNames.has(second)) throw new Error(`@exadev/eslint-config: "isolatedGroups" names a group not declared in "groups" (["${first}", "${second}"]). Every isolatedGroups pair must name two of this workspace's own declared groups.`);
+			if (first === second) throw new Error(`@exadev/eslint-config: "isolatedGroups" pair ["${first}", "${second}"] names the same group twice. A group cannot be isolated from itself.`);
+		}
 	}
 	return {
 		...root !== void 0 && { root },
@@ -1310,15 +1376,15 @@ function findOwningGroup(relativeDir, groups) {
 	return best;
 }
 /**
-* The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
+* The name-role model's own rank classification: nameRanks (first pattern match, checked in declaration order) takes priority over the package's structural group.rank, which itself takes priority over defaultRank. `declaredName` is the package's own genuine `package.json` "name", never a directory-derived stand-in: pnpm allows a workspace package to declare no name at all, and such a package has nothing for a nameRanks pattern to match (the README states nameRanks checks "a package's declared name", not its directory), so a nameless package skips nameRanks entirely and falls straight through to its group's rank or defaultRank, the same as a package whose name simply matched no pattern. Throws when none of the three resolves anything at all, since an unranked package is a genuine configuration gap, not a package this rule can silently skip (skipping it would silently stop checking every one of its dependency edges).
 */
 function deriveRank(declaredName, group, options) {
-	if (options.nameRanks !== void 0) {
+	if (declaredName !== void 0 && options.nameRanks !== void 0) {
 		for (const rule of options.nameRanks) if (new RegExp(rule.pattern, "u").test(declaredName)) return rule.rank;
 	}
 	if (group.rank !== void 0) return group.rank;
 	if (options.defaultRank !== void 0) return options.defaultRank;
-	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
+	throw new Error(`@exadev/eslint-config: no rank could be resolved for workspace package "${declaredName ?? "(no declared name)"}" (group "${group.name}"). Give the group a "rank", add a matching "nameRanks" pattern, or set "defaultRank".`);
 }
 /**
 * The slice value a 'segment' group derives directly from its own package's path: the Nth path segment counting from the group's own root, not from the workspace root, so a group's own internal restructure never shifts every other group's slice numbering.
@@ -1341,23 +1407,29 @@ function isRecord(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
-* Reads a candidate package directory's own package.json directly (plain JSON.parse, not momoa): this is data collection for the graph, not a file being linted, so no AST/location information is needed. No existsSync guard here: every relativeDir this is called with came from resolveWorkspacePackageDirs, which already only returns directories that own a real package.json, so its absence here would mean that guarantee broke, not a case to handle quietly. A manifest with no usable string "name" is treated the same way regardless: nothing this graph can identify a package by.
+* Reads a candidate package directory's own package.json directly (plain JSON.parse, not momoa): this is data collection for the graph, not a file being linted, so no AST/location information is needed. No existsSync guard here: every relativeDir this is called with came from resolveWorkspacePackageDirs, which already only returns directories that own a real package.json, so its absence here would mean that guarantee broke, not a case to handle quietly. A manifest that is not a usable JSON object at all (parses to an array, a string, null) returns undefined: nothing this graph can identify a package by, regardless of any "name" field. A manifest that IS a usable object but declares no "name" (or a non-string one) is different: pnpm allows a workspace package with no declared name at all, so its own `name` comes back as undefined rather than dropping the whole manifest, letting collectCandidates below key such a package by its directory instead of silently skipping it (and every dependency it declares along with it).
 *
 * Exported so `dependencyNames`' own exact contents (never a stray extra entry) can be asserted directly: buildWorkspaceGraph's own public output filters dependencyNamesByName down to workspace-internal names only, which would silently absorb an unexpected non-package entry before any graph-level test could ever see it.
 */
 function readDeclaredManifest(fs, absoluteDir, dependencyFields) {
 	const manifestPath = join(absoluteDir, "package.json");
-	const parsed = JSON.parse(fs.readFileSync(manifestPath));
+	const raw = fs.readFileSync(manifestPath);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		assertIsError(error, jsonParseContext(manifestPath));
+		throw new Error(`@exadev/eslint-config: could not parse "${manifestPath}" as JSON: ${error.message}`, { cause: error });
+	}
 	if (!isRecord(parsed)) return void 0;
 	const name = parsed["name"];
-	if (typeof name !== "string") return void 0;
 	const dependencyNames = [];
 	for (const field of dependencyFields) {
 		const value = parsed[field];
 		if (isRecord(value)) dependencyNames.push(...Object.keys(value));
 	}
 	return {
-		name,
+		name: typeof name === "string" ? name : void 0,
 		dependencyNames
 	};
 }
@@ -1374,6 +1446,16 @@ function resolveWorkspaceRoot(fs, filename, rootOption) {
 		dir = parent;
 	}
 }
+/**
+* The workspace-root-relative, forward-slash-joined directory the manifest at `filename` (context.filename, the file ESLint is currently linting) sits in: computed directly from the filesystem, never trusted from a declared "name" field. Every workspace-architecture rule uses this to confirm the manifest it is linting is genuinely the SAME package.json buildWorkspaceGraph resolved for whatever graph entry it is about to check, since a name is only ever unique within the graph's own build (buildWorkspaceGraph's own duplicate-name throw enforces that), never across a stale or duplicated copy of a manifest sitting elsewhere in the tree outside the workspace's own package globs (a build output directory that copies its source package's package.json verbatim, say). A rule that skipped this check would check that copy under the real package's own graph entry: reporting edges the real package never declared, or letting a single real violation double-report once per copy.
+*
+* Both `root` and `filename`'s own directory are resolved through `fs.realpathSync` before comparing: an explicit `root` option and ESLint's own `context.filename` can spell the identical real directory two different ways (a symlink anywhere on either path, a macOS /tmp vs /private/tmp cwd being the recurring real case), and a purely lexical `relative()` between the two spellings would compute a path nowhere near the graph entry's own relativeDir, silently making every workspace-architecture rule report nothing for a perfectly real, correctly-configured package. Comparing realpaths instead makes the two spellings agree while still catching a genuinely different directory (a stale or duplicated manifest copy) as genuinely different.
+*/
+function manifestRelativeDir(fs, root, filename) {
+	const realRoot = fs.realpathSync(resolve(root));
+	const realManifestDir = fs.realpathSync(dirname(resolve(filename)));
+	return relative(realRoot, realManifestDir).split(sep).join("/");
+}
 function readPackagesFromYaml(fs, root) {
 	const yamlPath = join(root, "pnpm-workspace.yaml");
 	if (!fs.existsSync(yamlPath)) throw new Error(`@exadev/eslint-config: no "pnpm-workspace.yaml" found at workspace root "${root}", and no "packages" option was given.`);
@@ -1395,10 +1477,12 @@ function collectCandidates(fs, root, options) {
 		if (group === void 0) throw new Error(`@exadev/eslint-config: workspace package directory "${relativeDir}" (matched by the "packages" globs) is not covered by any configured group's own "path". Add a "groups" entry whose path prefixes it, or narrow "packages" to exclude it: an uncovered package would otherwise be silently skipped by every workspace-architecture check.`);
 		const manifest = readDeclaredManifest(fs, join(root, relativeDir), resolveDependencyFields(options));
 		if (manifest === void 0) continue;
+		const declaredName = manifest.name ?? relativeDir;
 		candidates.push({
 			relativeDir,
 			group,
-			declaredName: manifest.name,
+			declaredName,
+			name: manifest.name,
 			dependencyNames: manifest.dependencyNames
 		});
 	}
@@ -1417,7 +1501,8 @@ function collectKnownSlices(candidates) {
 function deriveSlice(candidate, knownSlices) {
 	const { slice } = candidate.group;
 	if (slice === void 0) return void 0;
-	return "segment" in slice ? sliceBySegment(candidate.relativeDir, candidate.group, slice.segment) : sliceByNamePrefix(candidate.declaredName, knownSlices);
+	if ("segment" in slice) return sliceBySegment(candidate.relativeDir, candidate.group, slice.segment);
+	return candidate.name === void 0 ? void 0 : sliceByNamePrefix(candidate.name, knownSlices);
 }
 /**
 * Builds the whole-workspace graph from scratch: every declared package's group/rank/slice, and every workspace-internal dependency edge. Scans the real tree once per call; getWorkspaceGraph below is the memoized entry point every rule actually calls.
@@ -1430,7 +1515,7 @@ function buildWorkspaceGraph(fs, root, options) {
 	for (const candidate of candidates) {
 		const existing = packagesByName.get(candidate.declaredName);
 		if (existing !== void 0) throw new Error(`@exadev/eslint-config: two workspace packages both declare the name "${candidate.declaredName}" ("${existing.relativeDir}" and "${candidate.relativeDir}").`);
-		const rank = deriveRank(candidate.declaredName, candidate.group, options);
+		const rank = deriveRank(candidate.name, candidate.group, options);
 		const slice = deriveSlice(candidate, knownSlices);
 		packagesByName.set(candidate.declaredName, {
 			name: candidate.declaredName,
@@ -1566,12 +1651,12 @@ function last(array) {
 * The three per-group naming strategies' own segment selection, keyed by NamingStrategy's own three literal members rather than a chain of ternaries: `Record<NamingStrategy, ...>` requires every member to have its own entry, which is what makes 'drop-group' a genuine, independently-typed branch, not merely "whatever the ternary chain falls through to when nothing else matched". Stryker's own typescript checker rejects a mutant that replaces the `?? 'drop-group'` fallback with some other string, since indexing this record with a value outside NamingStrategy is a type error, caught before any test even runs.
 *
 * - **'drop-group'**: drop the group's own root path segments, keep what remains.
-* - **'keep-group'**: keep every segment of `relativeDir` as-is, including the group's own root segments (a test group whose packages are named "test-<feature>", mirroring the feature they test, needs its own "test" segment kept).
+* - **'keep-group'**: keep the group's OWN name (or, when its root path nests more than one segment deep, only that path's own last segment) ahead of `rest`, not every segment of `relativeDir` including whatever container directories sit above the group's own root: a group declared as `{ path: 'packages/test' }` derives "test-e2e" for `packages/test/e2e`, never "packages-test-e2e", the same way a group with no nested path at all already would. A test group whose packages are named "test-<feature>", mirroring the feature they test, needs its own "test" segment kept, just not any further container segment above it.
 * - **'basename'**: use only `relativeDir`'s own final segment, ignoring every intermediate directory, for a group whose intermediate structure exists purely for filesystem organisation and carries no naming intent of its own.
 */
 const NAME_SEGMENTS_BY_STRATEGY = {
 	basename: ({ segments }) => [last(segments)],
-	"keep-group": ({ segments }) => segments,
+	"keep-group": ({ rest, groupNameSegment }) => [groupNameSegment, ...rest],
 	"drop-group": ({ rest }) => rest
 };
 /**
@@ -1580,11 +1665,13 @@ const NAME_SEGMENTS_BY_STRATEGY = {
 function expectedPackageName(relativeDir, group, naming) {
 	const separator = naming.separator ?? "-";
 	const segments = splitPathSegments(relativeDir);
-	const groupPrefixLength = splitPathSegments(group.path ?? group.name).length;
-	const rest = segments.slice(groupPrefixLength);
+	const groupPathSegments = splitPathSegments(group.path ?? group.name);
+	const rest = segments.slice(groupPathSegments.length);
+	const groupNameSegment = last(groupPathSegments);
 	const joined = NAME_SEGMENTS_BY_STRATEGY[group.naming ?? "drop-group"]({
 		segments,
-		rest
+		rest,
+		groupNameSegment
 	}).join(separator);
 	return naming.scope === void 0 ? joined : `${naming.scope}/${joined}`;
 }
@@ -1628,9 +1715,10 @@ function collectTopLevelDependencies(rootObject, dependencyFields) {
 /**
 * Reports a workspace dependency that can reach back to the declaring package: a cycle. This is NOT covered by no-uphill-dependency, and the distinction matters: that rule permits a same-rank (or, within a slice, a same-slice) dependency, so two packages at the same rank depending on each other passes it while still being a cycle. Turborepo does reject a cyclic task graph, but only once the whole graph is assembled, by which point a large refactor has already moved everything; reporting it at the manifest, where the edge is declared, names the two packages and the direction to reverse.
 *
-* Identifies "self" by this manifest's own DECLARED name (read via readDeclaredName), not a name derived from its directory: the hive original derived `ownName` from the package's path through its own expectedPackageName, so a package whose declared name did not yet match its path (itself a naming violation, but a distinct one from a cycle) was checked under the WRONG name here, silently missing or misattributing a real cycle. Reading the manifest's own name directly is also strictly simpler: cycle detection has no need of path-derived naming at all.
+* Identifies "self" by this manifest's own DECLARED name (read via readDeclaredName) when it has one, never a name derived by re-deriving what its path OUGHT to produce: the hive original derived `ownName` from the package's path through its own expectedPackageName, so a package whose declared name did not yet match its path (itself a naming violation, but a distinct one from a cycle) was checked under the WRONG name here, silently missing or misattributing a real cycle. A manifest with no declared name at all (pnpm allows this) falls back to its own directory instead, the same key buildWorkspaceGraph gives such a package in the graph (workspace-graph.ts), so its outgoing edges are still checked rather than silently dropped. Either way, the manifest actually being linted must also be confirmed as the graph entry's own file (see manifestRelativeDir below), not a stale or duplicated copy elsewhere in the tree sharing the same declared name.
 */
-function createNoDependencyCycleRule(loadGraph = loadWorkspaceGraph) {
+function createNoDependencyCycleRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -1648,18 +1736,20 @@ function createNoDependencyCycleRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				if (!graph.packagesByName.has(declared.name)) return;
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
+				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const dependencies = collectTopLevelDependencies(node, resolveDependencyFields(options));
 				for (const dependency of dependencies) {
 					if (!graph.packagesByName.has(dependency.name)) continue;
-					if (!dependencyPathExists(dependency.name, declared.name, graph.dependencyNamesByName)) continue;
+					if (!dependencyPathExists(dependency.name, self.name, graph.dependencyNamesByName)) continue;
 					context.report({
 						loc: dependency.node.loc,
 						messageId: "cycle",
 						data: {
-							from: declared.name,
+							from: self.name,
 							to: dependency.name
 						}
 					});
@@ -2342,7 +2432,8 @@ function findDependencyEntry(dependencies, name) {
 /**
 * Enforces the configured workspace's own rank, rank-skip, slice and group-isolation boundaries on every `package.json`'s declared dependencies (see workspace-checks.ts's checkDependencies for the exact rules, and the package README's "Workspace architecture" section for the option shape). A factory, not a plain object, so a test can inject a stubbed LoadWorkspaceGraphFn returning a fabricated graph directly, exercising this rule's own reporting logic (which violation, which message, which location) with zero real filesystem I/O, the same "injectable in tests, defaulted in production" shape createBarrelPolicyRule already establishes.
 */
-function createNoUphillDependencyRule(loadGraph = loadWorkspaceGraph) {
+function createNoUphillDependencyRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -2365,13 +2456,14 @@ function createNoUphillDependencyRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				const self = graph.packagesByName.get(declared.name);
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
 				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const dependencies = collectTopLevelDependencies(node, resolveDependencyFields(options));
 				const dependencyNames = [...new Set(dependencies.map((dependency) => dependency.name))];
-				const violations = checkDependencies(declared.name, self, dependencyNames, {
+				const violations = checkDependencies(self.name, self, dependencyNames, {
 					graph: graph.packagesByName,
 					...options.rankSkip !== void 0 && { rankSkip: options.rankSkip },
 					...options.isolatedGroups !== void 0 && { isolatedGroups: options.isolatedGroups }
@@ -2603,9 +2695,10 @@ function findGroupSpec(groups, groupName) {
 /**
 * Reports a workspace package whose declared name does not mirror its path, per its own group's naming strategy and the workspace's global scope/separator (see expectedPackageName in workspace-checks.ts for the exact derivation). Opt-in: entirely a no-op whenever the shared `naming` option is omitted, exactly as the option's own doc comment (workspace-options.ts) states, since a workspace with its own established naming convention this rule cannot express should not be forced to adopt one that fits.
 *
-* Deliberately not derived from `context.filename`'s own directory the way the hive original was: this rule instead looks its own package up in the already-built graph by its DECLARED name (the same self-identification every other workspace-architecture rule uses), which is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from.
+* Self-identified by its DECLARED name (the same self-identification every other workspace-architecture rule uses), not derived from `context.filename`'s own directory the way the hive original was: this is what lets `expectedPackageName` be checked against the graph's own recorded relativeDir/group rather than re-deriving them from a path assumed to equal the folder a file happens to be linted from. `context.filename`'s own directory is still consulted, but only afterwards, as a confirmation: it must equal the resolved graph entry's own relativeDir, or the manifest being linted is a stale or duplicated copy of a real package's package.json sitting somewhere else in the tree (a build output directory that copied it verbatim, say), not the genuine article this graph entry was built from.
 */
-function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
+function createPackageNameMirrorsPathRule(deps = {}) {
+	const { loadGraph = loadWorkspaceGraph, fs = realWorkspaceFs } = deps;
 	return {
 		meta: {
 			type: "problem",
@@ -2616,7 +2709,10 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 				description: "Require a workspace package to declare the name its path derives, under the configured naming scope/separator.",
 				url: "https://github.com/ExaDev/eslint-config/blob/main/src/rules/package-name-mirrors-path.ts"
 			},
-			messages: { mismatch: "Package at \"{{dir}}\" declares \"{{actual}}\" but its path derives \"{{expected}}\"." }
+			messages: {
+				mismatch: "Package at \"{{dir}}\" declares \"{{actual}}\" but its path derives \"{{expected}}\".",
+				missingName: "Package at \"{{dir}}\" declares no name at all, but its path derives \"{{expected}}\"."
+			}
 		},
 		create(context) {
 			const options = readWorkspaceArchitectureOptions(context.options[0]);
@@ -2625,12 +2721,24 @@ function createPackageNameMirrorsPathRule(loadGraph = loadWorkspaceGraph) {
 			const graph = loadGraph(context.filename, options);
 			return { Object(node, parent) {
 				if (parent?.type !== "Document") return;
+				const relativeDir = manifestRelativeDir(fs, graph.root, context.filename);
 				const declared = readDeclaredName(node);
-				if (declared === void 0) return;
-				const self = graph.packagesByName.get(declared.name);
+				const self = graph.packagesByName.get(declared?.name ?? relativeDir);
 				if (self === void 0) return;
+				if (self.relativeDir !== relativeDir) return;
 				const group = findGroupSpec(options.groups, self.group);
 				const expected = expectedPackageName(self.relativeDir, group, naming);
+				if (declared === void 0) {
+					context.report({
+						loc: node.loc,
+						messageId: "missingName",
+						data: {
+							dir: self.relativeDir,
+							expected
+						}
+					});
+					return;
+				}
 				if (expected === declared.name) return;
 				context.report({
 					loc: declared.node.loc,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "exadev-eslint-config",
   "description": "Shared custom ESLint rules and plugin for ExaDev projects",
-  "version": "2.21.1",
+  "version": "2.22.0",
   "dependencies": {
     "@eslint/js": "^10.0.1",
     "@typescript-eslint/utils": "8.67.0",