Merge pull request #94 from CodeDeficient/claude/project-thread-36cl1x-deno-config-names

Read import maps from deno.<name>.json configs too

Author: CodeDeficient

CHANGELOG.md

@@ -17,7 +17,7 @@ All notable changes will be documented in this file.
 - A `customPatterns` entry whose `id` is a built-in rule id (`empty_catch`) or the id of another custom pattern is an invalid config. A shared id made `severityOverrides` and the exit code treat two rules as one.
 - A run fails (exit 1) on high and critical findings only. Medium findings such as `type_assertion` and `any_type_usage` are still reported but no longer fail a build; every clean repository tested (ky, express, hono, zod, date-fns, TanStack Query) exited 1 before. `--fail-on=<critical|high|medium|low>` sets the threshold.
 - A bundler config marks an import as an alias only when it quotes the whole name (`'@components'`, `'~/lib'`, webpack's `'@acme/ui$'`). A scoped name covers that package only: `'@acme/ui'` in a config or tsconfig `paths` does not cover `@acme/other`. A longer name that starts the same way (`'vite-plugin-pwa'` for `vite-plugin`) used to hide an undeclared or nonexistent package.
-- Names in a Deno import map (`imports` in `deno.json`/`deno.jsonc`, or the file its `importMap` names) are aliases, not npm packages. hono's Deno tests import `@std/assert` from JSR and got four critical `nonexistent_package` findings, so `--strict` failed a clean repository.
+- Names in a Deno import map (`imports` in `deno.json`, `deno.jsonc` or a `deno.<name>.json` passed with `--config`, or the file its `importMap` names) are aliases, not npm packages. hono's Deno tests import `@std/assert` from JSR and got four critical `nonexistent_package` findings, so `--strict` failed a clean repository.
 - `hallucinated_import` reports a relative or tsconfig `paths` import with no file behind it (`import { validate } from '../lib/validation'`). A file with any extension counts (`./Widget.vue`, `./styles.css?raw`). Paths into build output or generated code (`dist/`, `build/`, `out/`, `generated/`, dot-folders, SvelteKit `$types`) are skipped, since they are often absent from a checkout.
 - Benchmark and example folders (`bench/`, `benchmarks/`, `examples/`, `runtime-tests/`, `perf-measures/`) count as non-production code, like tests: rules for application code skip them and they are left out of finding density. zod's `packages/bench` produced 375 `production_console_log` findings and express's `examples/` 36.
 - `any_type_usage` skips the rest parameter and bare `any` return of a function type such as `type AnyFn = (...args: any[]) => any`. Parameters are contravariant, so `(...args: unknown[]) => unknown` does not accept `(x: string) => void` and there is no safer spelling.

imports.ts

@@ -316,15 +316,23 @@ class ResolutionIndex {
 
   /**
    * Keys of the Deno import maps from `dir` up to the filesystem root: the
-   * `imports` of deno.json/deno.jsonc and of the file its `importMap` names.
+   * `imports` of every deno config there (deno.json, deno.jsonc, deno.<name>.json)
+   * and of the file its `importMap` names.
    * They map names such as `@std/assert` to `jsr:` or URL modules, not npm.
    */
   private denoImportKeys(dir: string): string[] {
     const cached = this.denoKeys.get(dir);
     if (cached !== undefined) return cached;
     const parent = path.dirname(dir);
     const keys = parent === dir ? [] : [...this.denoImportKeys(parent)];
-    for (const name of ['deno.json', 'deno.jsonc']) {
+    let entries: string[] = [];
+    try {
+      entries = fs.readdirSync(dir);
+    } catch {
+      // Unreadable directory: no import map here.
+    }
+    // deno.json, deno.jsonc, and variants passed with --config (deno.react-jsx.json, deno.react.precompile.json).
+    for (const name of entries.filter(entry => /^deno(\.[\w-]+)*\.jsonc?$/.test(entry))) {
       const config = readJsoncObject(path.join(dir, name));
       if (config === undefined) continue;
       keys.push(...Object.keys(asObject(config.imports) ?? {}));

tests/rules.test.ts

@@ -675,10 +675,12 @@ test('checkImports: names from a Deno import map are not npm packages', async ()
     'package.json': JSON.stringify({ name: 'repo', private: true }),
     'runtime-tests/deno/deno.jsonc': '{\n  // JSR packages\n  "imports": { "@std/assert": "jsr:@std/assert@^1", "@std/path/": "jsr:/@std/path@^1/" },\n  "importMap": "./map.json"\n}\n',
     'runtime-tests/deno/map.json': JSON.stringify({ imports: { 'oak': 'https://deno.land/x/oak/mod.ts' } }),
+    'runtime-tests/deno-jsx/deno.react.precompile.json': JSON.stringify({ imports: { '@std/expect': 'jsr:@std/expect@^1' } }),
+    'runtime-tests/deno-jsx/b.test.tsx': "import { expect } from '@std/expect';\n",
     'runtime-tests/deno/a.test.ts': "import { assertEquals } from '@std/assert';\nimport { join } from '@std/path/posix';\nimport { Application } from 'oak';\nimport { x } from 'left-padx-utils-ai';\n"
   });
   try {
-    const findings = await checkImports([path.join(dir, 'runtime-tests/deno/a.test.ts')], dir, recording);
+    const findings = await checkImports([path.join(dir, 'runtime-tests/deno/a.test.ts'), path.join(dir, 'runtime-tests/deno-jsx/b.test.tsx')], dir, recording);
     assert.deepEqual(findings.map(f => [f.type, f.line]), [['nonexistent_package', 4]]);
     assert.deepEqual(lookups, ['left-padx-utils-ai']);
   } finally {