@cplieger/deadset-ts 7.2.0-dev.4 → 8.0.0-dev.10

package/src/dependencies.ts

@@ -8,15 +8,19 @@
  */
 
 import {
+  isArrayLiteralExpression,
   isCallExpression,
   isExportDeclaration,
+  isExpressionStatement,
   isExternalModuleReference,
   isIdentifier,
   isImportDeclaration,
   isImportEqualsDeclaration,
   isMetaProperty,
   isNamespaceExport,
+  isObjectLiteralExpression,
   isPropertyAccessExpression,
+  isPropertyAssignment,
   isShorthandPropertyAssignment,
   isStringLiteral,
   isNoSubstitutionTemplateLiteral,
@@ -25,29 +29,44 @@ import {
   type Node,
   type SourceFile,
 } from "@typescript/native/ast";
+import { automaticTypes, type AutomaticTypes } from "./automatic-types.ts";
 import {
   configurationFiles,
   declaredIn as declaredBeside,
   dependenciesNamed,
   moduleStrings,
+  outsideChain,
+  type OutsideModule,
   type ParseFile,
 } from "./configuration-files.ts";
 import type { FindingPosition } from "./finding.ts";
 import type { Host } from "./host.ts";
 import { nodeKey, packageScope, type Inventory } from "./inventory.ts";
-import { scriptTokens } from "./manifest.ts";
-import { dirnamePath, isAbsolutePath, joinPath, relativePath, resolvePath } from "./paths.ts";
+import {
+  ancestors,
+  dirnamePath,
+  isAbsolutePath,
+  joinPath,
+  relativePath,
+  resolvePath,
+} from "./paths.ts";
 import type { DependencySection, Module } from "./ref.ts";
 import { UNANSWERED } from "./query.ts";
 import type { Handle, ProjectView } from "./session.ts";
-import { sourceFilesOf } from "./source-files.ts";
-import { workflowTokens } from "./workflow-steps.ts";
+import { sourceFilesOf, type SourceFiles } from "./source-files.ts";
+import { manifestCommands } from "./manifest.ts";
+import { workflowCommands, workflowTokens } from "./workflow-steps.ts";
+import { bytewise } from "./text/compare.ts";
+import { isRecord } from "./json-document.ts";
+import { inInstalledPackages, INSTALLED_PACKAGES, MANIFEST, readDocument } from "./fs/manifest.ts";
+import { commandsOf, scriptTokens } from "./text/shell.ts";
 
-const MANIFEST = "package.json";
-const MODULES_DIR = "node_modules";
-const MODULES_SEGMENT = `/${MODULES_DIR}/`;
+const MODULES_SEGMENT = `/${INSTALLED_PACKAGES}/`;
 const TYPES_SCOPE = "@types/";
 
+/** A script token naming a JavaScript file by a path no expansion changes. */
+const SCRIPT_FILE = /^[^$`{*?[~]+\.(?:js|mjs|cjs)$/u;
+
 /** The manifest sections a dependency is declared in, each by the selector its reference spells. */
 const SECTIONS: readonly (readonly [string, DependencySection])[] = [
   ["dependencies", "dependency"],
@@ -72,7 +91,7 @@ interface DeclaredDependency {
 export function configurationNeeds(packages: readonly string[]): ProjectNeeds {
   return {
     uses: new Map([[PROJECT_OWNER, new Set(packages)]]),
-    at: new Map([[ANYWHERE, new Set(packages)]]),
+    at: new Map([[ANYWHERE, new Map(packages.map((one) => [one, new Set([PROJECT_OWNER])]))]]),
     unanswered: [],
   };
 }
@@ -98,10 +117,12 @@ export interface ProjectNeeds {
   readonly uses: ReadonlyMap<string, ReadonlySet<string>>;
   /**
    * Per absolute path of the file a use is written in, the packages it names, which a
-   * dependency only a manifest at or above that file declares serves. The empty key holds
-   * the uses no one file holds, which every manifest's dependency of that name serves.
+   * dependency of the nearest manifest at or above that file declaring the name serves,
+   * each with the owners {@link uses} holds it by; an import whose bindings nothing in the
+   * file uses holds its package by none. The empty key holds the uses no one file holds,
+   * which every manifest's dependency of that name serves.
    */
-  readonly at: ReadonlyMap<string, ReadonlySet<string>>;
+  readonly at: ReadonlyMap<string, ReadonlyMap<string, ReadonlySet<string>>>;
   /**
    * The files writing a module specifier the checker left unanswered, each of which may
    * use any dependency a manifest at or above it declares.
@@ -134,25 +155,18 @@ export interface Dependencies {
    * written inside it, sorted bytewise; a candidate holding no last use has no entry.
    */
   readonly lastUses: ReadonlyMap<string, readonly string[]>;
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/** One JSON document's decoded value, or undefined where it cannot be read or parsed. */
-function readJSON(host: Host, path: string): { text: string; value: unknown } | undefined {
-  let text: string;
-  try {
-    text = host.readFile(path);
-  } catch {
-    return undefined;
-  }
-  try {
-    return { text, value: JSON.parse(text) };
-  } catch {
-    return undefined;
-  }
+  /**
+   * Per file, by its path below the target root, the declared dependencies whose every use
+   * in the target is written in it, sorted bytewise, which deleting the file removes.
+   */
+  readonly fileLastUses: ReadonlyMap<string, readonly string[]>;
+  /**
+   * The needed declared dependencies, by {@link declarationKey}, each with the owners
+   * {@link ProjectNeeds.uses} holds its uses by, sorted bytewise: none that a command runs,
+   * that an unanswered specifier may need, that an import none of whose bindings is used
+   * names, or that a dependency so needed names as a peer.
+   */
+  readonly heldBy: ReadonlyMap<string, readonly string[]>;
 }
 
 /**
@@ -202,6 +216,34 @@ function typePackages(name: string, programPackages: ReadonlySet<string>): reado
   return [typed, named];
 }
 
+/**
+ * The strings the `extends` member of one compiler configuration file holds, read as the
+ * compiler reads the file, comments and trailing commas allowed; none where it cannot be read.
+ */
+function extendsOf(host: Host, path: string, parse: ParseFile): readonly string[] {
+  let text: string;
+  try {
+    text = host.readFile(path);
+  } catch {
+    return [];
+  }
+  const [statement] = parse(path, text).statements;
+  const document =
+    statement !== undefined && isExpressionStatement(statement) ? statement.expression : undefined;
+  if (document === undefined || !isObjectLiteralExpression(document)) {
+    return [];
+  }
+  const value = document.properties
+    .filter(isPropertyAssignment)
+    .findLast(
+      (property) => isLiteralText(property.name) && property.name.text === "extends",
+    )?.initializer;
+  const entries = value !== undefined && isArrayLiteralExpression(value) ? value.elements : [value];
+  return entries.flatMap((entry) =>
+    entry !== undefined && isLiteralText(entry) ? [entry.text] : [],
+  );
+}
+
 /**
  * The packages the compiler configuration of one project names: its type packages,
  * its JSX import source, the helper library it imports, its plugins, and every
@@ -212,6 +254,7 @@ function configurationPackages(
   configFile: string,
   options: Readonly<Record<string, unknown>>,
   programPackages: ReadonlySet<string>,
+  parse: ParseFile,
 ): Set<string> {
   const found = new Set<string>();
   const add = (name: unknown): void => {
@@ -248,12 +291,7 @@ function configurationPackages(
       continue;
     }
     seen.add(file);
-    const read = readJSON(host, file);
-    const extended = isRecord(read?.value) ? read.value["extends"] : undefined;
-    for (const entry of Array.isArray(extended) ? extended : [extended]) {
-      if (typeof entry !== "string") {
-        continue;
-      }
+    for (const entry of extendsOf(host, file, parse)) {
       if (entry.startsWith(".") || isAbsolutePath(entry)) {
         const local = resolvePath(dirnamePath(file), entry);
         pending.push(local.endsWith(".json") ? local : `${local}.json`);
@@ -318,7 +356,7 @@ export function projectNeeds<Brand>(
   held: Inventory,
   host: Host,
   targetRoot: string,
-  parse?: ParseFile,
+  parse: ParseFile,
 ): ProjectNeeds {
   const programPackages = new Set<string>();
   for (const name of project.program.getSourceFileNames()) {
@@ -327,18 +365,19 @@ export function projectNeeds<Brand>(
       programPackages.add(named);
     }
   }
-  const packages = configurationPackages(
-    host,
-    project.configFile,
-    project.program.getCompilerOptions() as Readonly<Record<string, unknown>>,
-    programPackages,
-  );
+  const options = project.program.getCompilerOptions() as Readonly<Record<string, unknown>>;
+  const packages = configurationPackages(host, project.configFile, options, programPackages, parse);
+  const automatic = automaticTypes(host, project.configFile, options, parse);
   const uses = new Map<string, Set<string>>();
-  const at = new Map<string, Set<string>>();
+  const at = new Map<string, Map<string, Set<string>>>();
   const use = (owners: readonly string[], named: Iterable<string>, path: string): void => {
     for (const one of named) {
-      at.set(path, (at.get(path) ?? new Set()).add(one));
+      const inFile = at.get(path) ?? new Map<string, Set<string>>();
+      at.set(path, inFile);
+      const holders = inFile.get(one) ?? new Set<string>();
+      inFile.set(one, holders);
       for (const owner of owners) {
+        holders.add(owner);
         let set = uses.get(owner);
         if (set === undefined) {
           set = new Set();
@@ -355,7 +394,7 @@ export function projectNeeds<Brand>(
     const inFile = (owners: readonly string[], named: Iterable<string>): void => {
       use(owners, named, file.fileName);
     };
-    if (fileNeeds(project, held, file, programPackages, inFile)) {
+    if (fileNeeds(project, held, file, { programPackages, automatic }, inFile)) {
       unanswered.push(file.fileName);
     }
   }
@@ -370,12 +409,8 @@ export function projectNeeds<Brand>(
     }
     return names;
   };
-  const configuration = configurationFiles(
-    host,
-    targetRoot,
-    sourceFilesOf(project, targetRoot),
-    parse,
-  );
+  const files = sourceFilesOf(project, targetRoot);
+  const configuration = configurationFiles(host, targetRoot, files, parse);
   for (const { file, manifestDir } of configuration.modules) {
     const names = declaredAt(joinPath(manifestDir, MANIFEST));
     for (const { node, text } of moduleStrings(file)) {
@@ -384,15 +419,22 @@ export function projectNeeds<Brand>(
   }
   for (const { strings, manifestDirs } of configuration.documents) {
     for (const manifestDir of manifestDirs) {
-      const names = declaredAt(joinPath(manifestDir, "package.json"));
+      const names = declaredAt(joinPath(manifestDir, MANIFEST));
       for (const text of strings) {
         use([PROJECT_OWNER], dependenciesNamed(text, names), joinPath(manifestDir, MANIFEST));
       }
     }
   }
-  for (const { file, manifestDirs } of configuration.outside) {
+  const ranFiles: readonly OutsideModule[] = outsideChain(
+    host,
+    targetRoot,
+    files,
+    parse,
+    scriptRunFiles(host, targetRoot, files),
+  );
+  for (const { file, manifestDirs } of [...configuration.outside, ...ranFiles]) {
     for (const manifestDir of manifestDirs) {
-      const names = declaredAt(joinPath(manifestDir, "package.json"));
+      const names = declaredAt(joinPath(manifestDir, MANIFEST));
       for (const { text } of moduleStrings(file)) {
         use([PROJECT_OWNER], dependenciesNamed(text, names), joinPath(manifestDir, MANIFEST));
       }
@@ -401,6 +443,56 @@ export function projectNeeds<Brand>(
   return { uses, at, unanswered };
 }
 
+/**
+ * The JavaScript files no program holds that a script of a manifest at or above one of the
+ * project's files runs, each with the directory of that manifest, and those a workflow
+ * step or git hook runs, with the target root's: a token naming such a file below the
+ * target root and in no `node_modules`, read against the manifest's directory.
+ */
+function scriptRunFiles(
+  host: Host,
+  targetRoot: string,
+  files: SourceFiles,
+): readonly { readonly path: string; readonly manifestDir: string }[] {
+  const root = resolvePath(host.workingDirectory(), targetRoot);
+  const dirs = new Set<string>([root]);
+  for (const name of files.byName.keys()) {
+    for (const dir of ancestors(dirnamePath(name), root)) {
+      if (dirs.has(dir)) {
+        break;
+      }
+      dirs.add(dir);
+    }
+  }
+  const tokens = new Map<string, ReadonlySet<string>>([
+    [root, new Set(workflowTokens(host, root))],
+  ]);
+  for (const dir of dirs) {
+    const read = readDocument(host, joinPath(dir, MANIFEST));
+    if (read !== undefined && isRecord(read.value)) {
+      const own = scriptTokensOf(read.value);
+      tokens.set(dir, dir === root ? new Set([...own, ...(tokens.get(root) ?? [])]) : own);
+    }
+  }
+  const found: { path: string; manifestDir: string }[] = [];
+  for (const [manifestDir, held] of tokens) {
+    for (const token of held) {
+      const path = SCRIPT_FILE.test(token) ? resolvePath(manifestDir, token) : undefined;
+      const below = path === undefined ? undefined : relativePath(root, path);
+      if (
+        path !== undefined &&
+        below !== undefined &&
+        !inInstalledPackages(below) &&
+        !files.byName.has(path) &&
+        host.kindOf(path) === "file"
+      ) {
+        found.push({ path, manifestDir });
+      }
+    }
+  }
+  return found;
+}
+
 /** The declarations of the inventory a use written at one node belongs to. */
 function ownersOf(file: SourceFile, held: Inventory, node: Node): readonly string[] {
   const parent = node.parent as Node | undefined;
@@ -425,12 +517,47 @@ function ownersOf(file: SourceFile, held: Inventory, node: Node): readonly strin
   return [PROJECT_OWNER];
 }
 
-/** Records the needs of one file, and answers whether a specifier of it went unanswered. */
+/**
+ * Whether one identifier stands for a value or type of the scope it is written in, rather
+ * than naming a member, a property or a label.
+ */
+function isScopeName(node: Identifier): boolean {
+  const parent = node.parent as Node | undefined;
+  if (parent === undefined || isShorthandPropertyAssignment(parent)) {
+    return true;
+  }
+  const named = parent as {
+    readonly name?: Node;
+    readonly right?: Node;
+    readonly propertyName?: Node;
+    readonly label?: Node;
+  };
+  return (
+    named.name !== node &&
+    (parent.kind !== SyntaxKind.QualifiedName || named.right !== node) &&
+    named.propertyName !== node &&
+    named.label !== node
+  );
+}
+
+/** What the packages a project's configuration brings in hold, which a file's needs are read against. */
+interface ProgramTypes {
+  /** The packages the program holds a file of. */
+  readonly programPackages: ReadonlySet<string>;
+  /** What the type packages a compiler would include automatically declare. */
+  readonly automatic: AutomaticTypes;
+}
+
+/**
+ * Records the needs of one file, and answers whether a specifier of it went unanswered. A
+ * module specifier or a name of the file's scope that resolves to nothing, and that an
+ * automatically included type package declares, uses that package.
+ */
 function fileNeeds<Brand>(
   project: ProjectView<Brand>,
   held: Inventory,
   file: SourceFile,
-  programPackages: ReadonlySet<string>,
+  { programPackages, automatic }: ProgramTypes,
   use: (owners: readonly string[], named: Iterable<string>) => void,
 ): boolean {
   const specifiers = [...file.imports, ...file.moduleAugmentations].filter(isLiteralText);
@@ -449,17 +576,22 @@ function fileNeeds<Brand>(
   }
   const names = new Set(bindings.map(({ node }) => node.text));
   const candidates: Identifier[] = [];
+  const globals: Identifier[] = [];
   const visit = (node: Node): void => {
-    if (isIdentifier(node) && names.has(node.text) && !bound.has(node)) {
-      candidates.push(node);
+    if (isIdentifier(node) && !bound.has(node)) {
+      if (names.has(node.text)) {
+        candidates.push(node);
+      } else if (automatic.globals.has(node.text) && isScopeName(node)) {
+        globals.push(node);
+      }
     }
     node.forEachChild(visit);
   };
-  if (names.size > 0) {
+  if (names.size > 0 || automatic.globals.size > 0) {
     visit(file);
   }
 
-  const asked = [...specifiers, ...bindings.map(({ node }) => node), ...candidates];
+  const asked = [...specifiers, ...bindings.map(({ node }) => node), ...candidates, ...globals];
   const handles: Handle<Brand>[] = asked.map((node) => project.handle(node));
   const resolved = project.symbolsAt(handles);
 
@@ -471,6 +603,9 @@ function fileNeeds<Brand>(
       named.add(byName);
     }
     const symbol = resolved[index];
+    if (symbol === undefined) {
+      automatic.modules.get(specifier.text)?.forEach((one) => named.add(one));
+    }
     for (const declaration of typeof symbol === "object" ? symbol.declarations : []) {
       const byPath = packageOfPath(declaration.path);
       if (byPath !== undefined) {
@@ -508,7 +643,7 @@ function fileNeeds<Brand>(
     let symbol = resolved[offset + index];
     const parent = node.parent as Node | undefined;
     if (parent !== undefined && isShorthandPropertyAssignment(parent) && parent.name === node) {
-      symbol = project.shorthandValueAt(project.handle(node));
+      symbol = project.shorthandValueAt(project.handle(parent));
     }
     const named =
       symbol === UNANSWERED || (unresolvedNames.has(node.text) && symbol === undefined)
@@ -521,6 +656,13 @@ function fileNeeds<Brand>(
       use(ownersOf(file, held, node), named);
     }
   });
+  const unresolvedAt = offset + candidates.length;
+  globals.forEach((node, index) => {
+    const symbol = resolved[unresolvedAt + index];
+    if (symbol === undefined || symbol === UNANSWERED) {
+      use(ownersOf(file, held, node), automatic.globals.get(node.text) ?? []);
+    }
+  });
 
   for (const reference of file.typeReferenceDirectives) {
     use(ownersOf(file, held, file), typePackages(reference.fileName, programPackages));
@@ -646,8 +788,8 @@ function lineAndColumn(text: string, offset: number): { line: number; column: nu
 
 /** The installed copy of one dependency, read where the package manager puts it for the target. */
 function installedOf(host: Host, root: string, name: string): InstalledDependency | undefined {
-  for (let dir = root; ; dir = dirnamePath(dir)) {
-    const read = readJSON(host, joinPath(dir, MODULES_DIR, name, MANIFEST));
+  for (const dir of ancestors(root)) {
+    const read = readDocument(host, joinPath(dir, INSTALLED_PACKAGES, name, MANIFEST));
     if (read !== undefined && isRecord(read.value)) {
       const bin = read.value["bin"];
       const peers = read.value["peerDependencies"];
@@ -664,10 +806,8 @@ function installedOf(host: Host, root: string, name: string): InstalledDependenc
               : [],
       };
     }
-    if (dirnamePath(dir) === dir) {
-      return undefined;
-    }
   }
+  return undefined;
 }
 
 /** Every dependency the manifest text at `path` declares, in the order the text writes them. */
@@ -720,6 +860,88 @@ function scriptTokensOf(manifest: Record<string, unknown>): ReadonlySet<string>
   return found;
 }
 
+/**
+ * The runtime flags whose value is a module loaded before the entry, as `--flag value` or
+ * `--flag=value`: https://nodejs.org/api/cli.html#--importmodule,
+ * https://nodejs.org/api/cli.html#--experimental-loadermodule,
+ * https://nodejs.org/api/cli.html#-r---require-module
+ */
+const PRELOAD_FLAGS: ReadonlySet<string> = new Set([
+  "--experimental-loader",
+  "--import",
+  "--loader",
+  "--require",
+  "-r",
+]);
+
+/**
+ * The programs that pass a preload flag to the runtime they start: Node itself, and the
+ * runners that forward Node's flags or read the same `--require`:
+ * https://mochajs.org/#-require-module-r-module, https://tsx.is/node-enhancement,
+ * https://typestrong.org/ts-node/docs/options#require,
+ * https://github.com/remy/nodemon#running-non-node-scripts
+ */
+const PRELOADING_PROGRAMS: ReadonlySet<string> = new Set([
+  "mocha",
+  "node",
+  "nodemon",
+  "ts-node",
+  "tsx",
+]);
+
+/** The programs that run the command after them, and an environment assignment before it. */
+const LAUNCHERS: ReadonlySet<string> = new Set(["cross-env", "env", "npx"]);
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+
+/**
+ * The packages `scripts` preload by a runtime flag's bare module specifier, a flag
+ * counting only in a command whose program passes it to the runtime, and for Node only
+ * before the script it runs, whose own arguments come after it.
+ */
+function preloadsOf(scripts: readonly string[]): ReadonlySet<string> {
+  const found = new Set<string>();
+  for (const script of scripts) {
+    for (const command of commandsOf(script)) {
+      const tokens = scriptTokens(command);
+      let at = 0;
+      while (
+        at < tokens.length &&
+        (ASSIGNMENT.test(tokens[at] ?? "") || LAUNCHERS.has(tokens[at] ?? ""))
+      ) {
+        at += 1;
+      }
+      const path = tokens[at] ?? "";
+      const program = path.slice(path.lastIndexOf("/") + 1);
+      if (!PRELOADING_PROGRAMS.has(program)) {
+        continue;
+      }
+      for (at += 1; at < tokens.length; at += 1) {
+        const token = tokens[at] ?? "";
+        if (!token.startsWith("-")) {
+          if (program === "node") {
+            break;
+          }
+          continue;
+        }
+        const equals = token.indexOf("=");
+        const flag = equals < 0 ? token : token.slice(0, equals);
+        if (!PRELOAD_FLAGS.has(flag)) {
+          continue;
+        }
+        if (equals < 0) {
+          at += 1;
+        }
+        const value = equals < 0 ? tokens[at] : token.slice(equals + 1);
+        const name = value === undefined ? undefined : packageOfSpecifier(value);
+        if (name !== undefined) {
+          found.add(name);
+        }
+      }
+    }
+  }
+  return found;
+}
+
 /** Whether a path below the target root lies in the directory `dir` below it, `""` being the root. */
 function isInside(path: string, dir: string): boolean {
   return dir === "" || path.startsWith(`${dir}/`);
@@ -731,6 +953,22 @@ function manifestDir(dependency: DeclaredDependency): string {
   return dir === "." ? "" : dir;
 }
 
+/**
+ * The declarations of one name a use written at `below` needs: those of the nearest
+ * manifest at or above it that declares the name, or every one for a use no file holds.
+ */
+function nearestDeclaring(
+  declarations: readonly DeclaredDependency[],
+  below: string | undefined,
+): readonly DeclaredDependency[] {
+  if (below === undefined) {
+    return declarations;
+  }
+  const enclosing = declarations.filter((dependency) => isInside(below, manifestDir(dependency)));
+  const nearest = Math.max(-1, ...enclosing.map((dependency) => manifestDir(dependency).length));
+  return enclosing.filter((dependency) => manifestDir(dependency).length === nearest);
+}
+
 /**
  * Adds to `needed` each declared dependency that the installed manifest of a needed or
  * run declared dependency names as a peer, until no further one joins: the declaration of
@@ -799,22 +1037,29 @@ export function dependenciesOf(
     }
   }
   const workflow = new Set(workflowTokens(host, targetRoot));
+  const workflowPreloads = preloadsOf(workflowCommands(host, targetRoot));
   const declared: DeclaredDependency[] = [];
   const ran = new Set<string>();
   const peers = new Map<string, readonly string[]>();
   const uninstalledHere = new Set(nested);
   for (const [dir, path] of manifests) {
-    const read = readJSON(host, joinPath(dir, MANIFEST));
+    const read = readDocument(host, joinPath(dir, MANIFEST));
     if (read === undefined || !isRecord(read.value)) {
       continue;
     }
     const tokens = scriptTokensOf(read.value);
+    const preloads = preloadsOf(
+      manifestCommands(host, dir, read.value).map(({ command }) => command),
+    );
     for (const dependency of declaredIn(read.text, read.value, path, scopeOf(path))) {
       const found = installedOf(host, dir, dependency.name);
       if (found === undefined && uninstalledHere.has(dir)) {
         continue;
       }
       declared.push(dependency);
+      if (preloads.has(dependency.name) || workflowPreloads.has(dependency.name)) {
+        ran.add(declarationKey(dependency));
+      }
       if (found === undefined) {
         continue;
       }
@@ -829,6 +1074,8 @@ export function dependenciesOf(
   // A declaration several projects compile is one user, and a use any project makes is
   // a use, so the uses are merged by declaration before anything is counted.
   const needed = new Set<string>();
+  const live = new Set<string>();
+  const holders = new Map<string, Set<string>>();
   const byName = new Map<string, DeclaredDependency[]>();
   for (const dependency of declared) {
     byName.set(dependency.name, [...(byName.get(dependency.name) ?? []), dependency]);
@@ -841,7 +1088,10 @@ export function dependenciesOf(
     const unknownDeclared = declared.filter((dependency) =>
       unanswered.some((file) => isInside(file, manifestDir(dependency))),
     );
-    unknownDeclared.forEach((dependency) => needed.add(declarationKey(dependency)));
+    for (const dependency of unknownDeclared) {
+      needed.add(declarationKey(dependency));
+      live.add(declarationKey(dependency));
+    }
     const unknown = unknownDeclared.map((dependency) => dependency.name);
     const held = unknown.length === 0 ? [] : [[PROJECT_OWNER, new Set(unknown)] as const];
     for (const [id, used] of [...project.uses, ...held]) {
@@ -851,16 +1101,31 @@ export function dependenciesOf(
     }
     for (const [path, named] of project.at) {
       const below = path === ANYWHERE ? undefined : relativePath(root, path);
-      for (const one of named) {
-        for (const dependency of byName.get(one) ?? []) {
-          if (below === undefined || isInside(below, manifestDir(dependency))) {
-            needed.add(declarationKey(dependency));
+      for (const [one, owners] of named) {
+        // An import none of whose bindings is used is no evidence about the code using it.
+        const unheld = owners.size === 0;
+        for (const dependency of nearestDeclaring(byName.get(one) ?? [], below)) {
+          const key = declarationKey(dependency);
+          needed.add(key);
+          if (unheld) {
+            live.add(key);
+          } else {
+            const held = holders.get(key) ?? new Set<string>();
+            owners.forEach((owner) => held.add(owner));
+            holders.set(key, held);
           }
         }
       }
     }
   }
   addNeededPeers(declared, peers, needed, ran);
+  addNeededPeers(declared, peers, live, ran);
+  const heldBy = new Map<string, readonly string[]>();
+  for (const [key, held] of holders) {
+    if (!live.has(key) && !ran.has(key)) {
+      heldBy.set(key, [...held].sort(bytewise));
+    }
+  }
   const users = new Map<string, number>();
   for (const used of uses.values()) {
     used.forEach((one) => users.set(one, (users.get(one) ?? 0) + 1));
@@ -870,11 +1135,24 @@ export function dependenciesOf(
   for (const id of candidates) {
     const sole = [...(uses.get(id) ?? [])].filter((one) => users.get(one) === 1 && names.has(one));
     if (sole.length > 0) {
-      lastUses.set(
-        id,
-        sole.sort((a, b) => (a < b ? -1 : 1)),
-      );
+      lastUses.set(id, sole.sort(bytewise));
+    }
+  }
+  const owners = new Map<string, Set<string>>();
+  for (const [owner, used] of uses) {
+    for (const one of used) {
+      if (names.has(one)) {
+        owners.set(one, (owners.get(one) ?? new Set<string>()).add(owner));
+      }
+    }
+  }
+  const fileLastUses = new Map<string, string[]>();
+  for (const [one, held] of [...owners].sort(([a], [b]) => bytewise(a, b))) {
+    const paths = new Set([...held].map((owner) => owner.replace(/:\d+:\d+$/u, "")));
+    const [path] = paths;
+    if (paths.size === 1 && path !== undefined && path !== PROJECT_OWNER) {
+      fileLastUses.set(path, [...(fileLastUses.get(path) ?? []), one]);
     }
   }
-  return { declared, needed, ran, unbuilt, lastUses };
+  return { declared, needed, ran, unbuilt, lastUses, fileLastUses, heldBy };
 }