@cplieger/deadset-ts 8.0.0-dev.15 → 8.0.0-dev.16

package/src/commands/read.ts

@@ -1,8 +1,8 @@
 /**
  * The one reader of every command string the analysis reads. Layer 3, the holding rule
- * `roots.ts` applies through `text/named-files.ts`, reads all of the string's text whatever
- * the other two layers make of it; layer 1 parses the string and layer 2 reads each simple
- * command a tool's reader understands, and they only add the files and modules it runs.
+ * `roots/root-set.ts` applies through `text/named-files.ts`, reads all of the string's text
+ * whatever the other two layers make of it; layer 1 parses the string and layer 2 reads each
+ * simple command a tool's reader understands, and they only add the files and modules it runs.
  */
 
 import { joinPath, resolvePath } from "../paths.ts";
@@ -16,6 +16,7 @@ import {
   type Preload,
   type Reading,
 } from "./tools.ts";
+import { APPENDED_EXTENSIONS } from "../extensions.ts";
 
 /** One program a read command runs. */
 interface Run {
@@ -159,9 +160,6 @@ export function readCommands(text: string, dir: string | undefined): CommandRead
   };
 }
 
-/** The extensions a runtime or a loader tries after a path written without one. */
-const TRIED_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"] as const;
-
 /** One file a run loads, as written, and every absolute path it may be at. */
 interface Load {
   readonly written: string;
@@ -188,8 +186,8 @@ export function loadsOf(run: Run): readonly Load[] {
     written: one,
     paths: [
       path,
-      ...TRIED_EXTENSIONS.map((extension) => `${path}${extension}`),
-      ...TRIED_EXTENSIONS.map((extension) => joinPath(path, `index${extension}`)),
+      ...APPENDED_EXTENSIONS.map((extension) => `${path}${extension}`),
+      ...APPENDED_EXTENSIONS.map((extension) => joinPath(path, `index${extension}`)),
     ],
   }));
 }

package/src/conformance-record.ts

@@ -4,7 +4,7 @@ export const RECORD = {
   conformance: {
     corpusVersion: "6.0.0",
     result: "pass",
-    digest: "sha256:4a66f7f01b0f1a23cf843b77ef48d762f2dcf486153e665560f107f10b0ea838",
+    digest: "sha256:d8d2a417c5cb9b3829739424d9cfd3bd7b631231d8f420300656f6df86f5a6d1",
   },
   gaps: [],
 } as const;

package/src/consumers.ts

@@ -1,4 +1,6 @@
 import type { PartialConfig } from "./config.ts";
+import type { ParseFile } from "./entries/configuration-files.ts";
+import { runDirectories } from "./entries/run-directories.ts";
 import type { Host } from "./host.ts";
 import { inventory } from "./inventory/enumerate.ts";
 import { relativePath } from "./paths.ts";
@@ -18,6 +20,7 @@ export function consumerReferences<Brand>(
   targetRoot: string,
   consumer: ConsumerSide,
   config: PartialConfig,
+  parse: ParseFile,
 ): readonly Reference[] {
   const held = inventory(
     narrowedTo(project, (file) => relativePath(targetRoot, file.fileName) !== undefined),
@@ -27,6 +30,7 @@ export function consumerReferences<Brand>(
   const found = references(project, held, targetRoot, {
     testFiles: config.ts.test_files,
     consumer,
+    directories: runDirectories(host, consumer.root, parse),
   }).references;
   if (config.analysis.consumer_tests !== "production") {
     return found;

package/src/contract/config.generated.ts

@@ -291,7 +291,7 @@ export const SETTINGS: readonly SettingRow[] = [
     role: "setting",
     read: true,
     default: [
-      "**/*.test.{ts,tsx,mts,cts}",
+      "**/*.test.{ts,tsx,mts,cts,js,jsx,mjs,cjs}",
       "**/*.test-d.{ts,tsx,mts,cts}",
       "**/*.spec-d.{ts,tsx,mts,cts}",
       "**/*.spec.*",

package/src/contract/contract.generated.ts

@@ -3,6 +3,7 @@
 export const CONTRACT_VERSION = "8.0.0";
 export const SCHEMA_VERSIONS = ["9.0.0"] as const;
 export const SCHEMA_VERSION = "9.0.0";
+export const FACTS_VERSION = "1.0.0";
 export const CORPUS_VERSION = "6.0.0";
 export const CODE_PREFIX = "DS";
 export const FAMILY_KEY_LENGTH = 4;
@@ -34,16 +35,19 @@ export const LANGUAGE_ROWS = {
     analyzer: "deadset-go",
     markers: ["go.mod"],
     skippedDirectories: ["node_modules", "testdata", "vendor", ".*", "_*"],
+    skippedFiles: ["_*", ".*"],
   },
   ts: {
     analyzer: "deadset-ts",
     markers: ["tsconfig*.json", "jsconfig*.json"],
     skippedDirectories: ["node_modules", ".git"],
+    skippedFiles: ["*.min.js", "*.min.cjs", "*.min.mjs"],
   },
   proto: {
     analyzer: "deadset-proto",
     markers: ["buf.yaml", "buf.work.yaml"],
     skippedDirectories: ["node_modules", "vendor", ".*"],
+    skippedFiles: [],
   },
 } as const satisfies Readonly<
   Partial<
@@ -53,6 +57,7 @@ export const LANGUAGE_ROWS = {
         readonly analyzer: string;
         readonly markers: readonly string[];
         readonly skippedDirectories: readonly string[];
+        readonly skippedFiles: readonly string[];
       }
     >
   >
@@ -494,9 +499,9 @@ export const KIND_ROWS = [
     languages: ["go", "ts"],
     subject: "dependency",
     holdsLive: false,
-    rule: "A directly declared dependency that no import in the target needs. On the Go side, a direct require whose module provides no package any target package or test variant imports. On the TypeScript side, a manifest dependency, development dependency or peer dependency the project's import closure does not need. A deletion finding whose fix would remove the last use of a dependency names that dependency. On the TypeScript side, a needed dependency whose every use is written inside declarations that are members of the run's dead components, or at the top level of a file reported under DS1602, that no command runs and that no needed dependency used otherwise names as a peer, is reported as well, dead only through that code: at the reachability class possible where one of those declarations belongs to a library's published API, and found under reachability alone where one of those declarations or files is, so at probable unless ts.roots_complete is true. A use the configuration makes, a use an unanswered specifier may make and an import none of whose bindings is used are uses by live code.",
+    rule: "A directly declared dependency that no import in the target needs. On the Go side, a direct require whose module provides no package any target package or test variant imports. On the TypeScript side, a manifest dependency, development dependency or peer dependency the project's import closure does not need. A deletion finding whose fix would remove the last use of a dependency names that dependency. On the TypeScript side, a needed dependency whose every use is written inside declarations that are members of the run's dead components, or at the top level of a file reported under DS1602, that no command runs and that no needed dependency used otherwise names as a peer, is reported as well, dead only through that code: at the reachability class possible where one of those declarations belongs to a library's published API, and found under reachability alone where one of those declarations or files is, so at probable unless ts.roots_complete is true. A use the configuration makes, a use an unanswered specifier or callee may make and an import none of whose bindings is used are uses by live code.",
     precondition:
-      "On the Go side the rule is the semantics of `go mod tidy -diff` exactly: a requirement marked indirect is never reported, because it exists to pin a transitive version and removing it changes the build list. On the TypeScript side the import closure is the files of the run's projects, and a call of `import.meta.resolve` or of `require.resolve` in them, whatever `require` names, whose first argument is a string literal or a template literal with no substitution needs each dependency an import of that specifier needs. A `@types/<name>` package in a type root of a compiler configuration that lists no `types`, a `node_modules/@types` directory at or above the configuration's directory or a `typeRoots` entry naming one, is needed by a use, in a file of that configuration, of a global name or an ambient module that one of the package's declaration files declares, which resolves to no declaration of the program: a compiler before version 6 includes every package of the type roots where `types` is not listed, and version 6 and later include none, so the program the analysis builds holds none of those declarations. A package's declaration files are the file its `types` or `typings` names, else its `index.d.ts`, and each file a `/// <reference path>` of one of them reaches inside the package. A global is a top-level declaration of such a file that is no module, or a declaration of a `declare global` block of one that is, and an ambient module is a `declare module` with a string name of a file that is no module. A name that names a member, a property or a label is no use of a global. Four more dependencies are needed: one whose command a script entry, a workflow step or a git hook runs, one that a string of a configuration file names, and one that a string names under a manifest key or a package key of an applied convention row, each as grammar/analysis/conventions.md states, and one that a needed dependency names as a peer, as stated below. A command no script entry, workflow step or git hook runs needs nothing. A declared dependency that the installed manifest of a needed declared dependency names in its peerDependencies is needed, and so on until no further dependency joins. A peer dependency is a package the needed dependency expects beside it at a version its manifest states, whether or not it imports the package, and the project's declaration is what keeps that package present at a version the project chooses, so removing the declaration can break the needed dependency where nothing the analysis reads imports the peer. A peer that peerDependenciesMeta marks optional is needed in the same way, because the needed dependency's manifest still names it as a package it works with, and a package manager may leave an optional peer out where the project does not declare it, so the project's declaration is what keeps it present for the needed dependency. A declared dependency that only dependencies nothing needs name as a peer is needed by nothing. A dependency of a manifest whose directory holds source only in configurations the run lists in configurations_not_built is reported at the reachability class possible, because the source that may import it was not analyzed. An installed manifest is the package's manifest in the nearest node_modules directory at or above the directory of the manifest that declares the dependency, and a dependency with none is decided by the import closure alone. On the TypeScript side, the dependencies judged are those of every manifest grammar/analysis/program.md says the analysis reads, a nested package's among them, each read against its own directory: a dependency is needed by a use written in a file at or below the directory of the manifest that declares it where no manifest between them declares a dependency of the same name, so a use below a nested manifest that declares the same dependency needs that nested manifest's declaration only, by a use no one file holds, and as a peer of a needed dependency of the same manifest or of a manifest below it. A dependency a nested package's manifest declares whose installed manifest the analysis cannot find is not judged, because no run requires a nested package to be installed and its commands and peers cannot be read, while a workspace member's and the target's own are judged as above.",
+      "On the Go side the rule is the semantics of `go mod tidy -diff` exactly: a requirement marked indirect is never reported, because it exists to pin a transitive version and removing it changes the build list. On the TypeScript side the import closure is the files of the run's projects, and a `require()` call as `roots.23` reads one, or a call of `import.meta.resolve`, of `require.resolve`, whatever `require` names, or of `resolve` on another name that is such a `require`, in them, whose first argument is a string literal or a template literal with no substitution needs each dependency an import of that specifier needs. A `@types/<name>` package in a type root of a compiler configuration that lists no `types`, a `node_modules/@types` directory at or above the configuration's directory or a `typeRoots` entry naming one, is needed by a use, in a file of that configuration, of a global name or an ambient module that one of the package's declaration files declares, which resolves to no declaration of the program: a compiler before version 6 includes every package of the type roots where `types` is not listed, and version 6 and later include none, so the program the analysis builds holds none of those declarations. A package's declaration files are the file its `types` or `typings` names, else its `index.d.ts`, and each file a `/// <reference path>` of one of them reaches inside the package. A global is a top-level declaration of such a file that is no module, or a declaration of a `declare global` block of one that is, and an ambient module is a `declare module` with a string name of a file that is no module. A name that names a member, a property or a label is no use of a global. Four more dependencies are needed: one whose command a script entry, a workflow step or a git hook runs, one that a string of a configuration file names, and one that a string names under a manifest key or a package key of an applied convention row, each as grammar/analysis/conventions.md states, and one that a needed dependency names as a peer, as stated below. A command no script entry, workflow step or git hook runs needs nothing. A declared dependency that the installed manifest of a needed declared dependency names in its peerDependencies is needed, and so on until no further dependency joins. A peer dependency is a package the needed dependency expects beside it at a version its manifest states, whether or not it imports the package, and the project's declaration is what keeps that package present at a version the project chooses, so removing the declaration can break the needed dependency where nothing the analysis reads imports the peer. A peer that peerDependenciesMeta marks optional is needed in the same way, because the needed dependency's manifest still names it as a package it works with, and a package manager may leave an optional peer out where the project does not declare it, so the project's declaration is what keeps it present for the needed dependency. A declared dependency that only dependencies nothing needs name as a peer is needed by nothing. A dependency of a manifest whose directory holds source only in configurations the run lists in configurations_not_built is reported at the reachability class possible, because the source that may import it was not analyzed. An installed manifest is the package's manifest in the nearest node_modules directory at or above the directory of the manifest that declares the dependency, and a dependency with none is decided by the import closure alone. On the TypeScript side, the dependencies judged are those of every manifest grammar/analysis/program.md says the analysis reads, a nested package's among them, each read against its own directory: a dependency is needed by a use written in a file at or below the directory of the manifest that declares it where no manifest between them declares a dependency of the same name, so a use below a nested manifest that declares the same dependency needs that nested manifest's declaration only, by a use no one file holds, and as a peer of a needed dependency of the same manifest or of a manifest below it. A dependency a nested package's manifest declares whose installed manifest the analysis cannot find is not judged, because no run requires a nested package to be installed and its commands and peers cannot be read, while a workspace member's and the target's own are judged as above.",
     details: { dependency_class: "required" },
     defaultEnabled: true,
     defaultSeverity: "deny",
@@ -769,6 +774,49 @@ export const SYMBOL_SUBJECTS = {
   edge: "record",
 } as const satisfies Readonly<Record<string, Subject>>;
 
+export const REMEDIES = {
+  declaration: {
+    names: "a declaration",
+    suppressions: ["inline", "ignore", "baseline"],
+    remedy: "delete the symbol, or wire it up so the program uses it",
+  },
+  binding: {
+    names: "an import binding",
+    suppressions: ["inline", "ignore", "baseline"],
+    remedy: "delete the import, or use what it binds",
+  },
+  part: {
+    names: "a part of a declaration",
+    suppressions: ["inline", "ignore", "baseline"],
+    remedy: "remove the part, or use it",
+  },
+  file: {
+    names: "a file",
+    suppressions: [],
+    remedy:
+      "delete the file, name it as a root, or build it in a configuration of the build matrix",
+  },
+  dependency: {
+    names: "a dependency row",
+    suppressions: ["ignore", "baseline"],
+    remedy: "remove the dependency",
+  },
+  record: {
+    names: "a record of deadset's own configuration",
+    suppressions: [],
+    remedy: "correct or remove the record the finding names",
+  },
+} as const satisfies Readonly<
+  Record<
+    Subject,
+    {
+      readonly names: string;
+      readonly suppressions: readonly ("inline" | "ignore" | "baseline")[];
+      readonly remedy: string;
+    }
+  >
+>;
+
 export const EXEMPTION_CLASSES = [
   {
     class: "interface-satisfaction",
@@ -1283,6 +1331,93 @@ export const EVIDENCE = [
   },
 ] as const;
 
+/** The generators whose TypeScript output a generated file is matched against, in the document's order. */
+export const GENERATORS = [
+  {
+    id: "protoc-gen-es-2",
+    plugin: "protoc-gen-es",
+    header: "^// @generated by protoc-gen-es v2\\.",
+    versions: { min: "v2.10.0", max: "v2.16.0" },
+    cell: "exact",
+  },
+  {
+    id: "protoc-gen-es-2-fallback",
+    plugin: "protoc-gen-es",
+    header: "^// @generated by protoc-gen-es v2\\.",
+    cell: "fallback",
+  },
+  {
+    id: "protoc-gen-es-1",
+    plugin: "protoc-gen-es",
+    header: "^// @generated by protoc-gen-es v1\\.",
+    cell: "exact",
+  },
+  {
+    id: "protoc-gen-connect-es-1",
+    plugin: "protoc-gen-connect-es",
+    header: "^// @generated by protoc-gen-connect-es v1\\.",
+    cell: "exact",
+  },
+  {
+    id: "ts-proto-2-output-schema",
+    plugin: "ts-proto",
+    header: "^// Code generated by protoc-gen-ts_proto\\. DO NOT EDIT\\.$",
+    versions: { min: "v2.11.4", max: "v2.15.0" },
+    cell: "exact",
+  },
+  {
+    id: "ts-proto-2",
+    plugin: "ts-proto",
+    header: "^// Code generated by protoc-gen-ts_proto\\. DO NOT EDIT\\.$",
+    versions: { min: "v2.11.4", max: "v2.15.0" },
+    cell: "rpc-types-fallback",
+  },
+  {
+    id: "ts-proto-2-types",
+    plugin: "ts-proto",
+    header: "^// Code generated by protoc-gen-ts_proto\\. DO NOT EDIT\\.$",
+    versions: { min: "v2.11.4", max: "v2.15.0" },
+    cell: "fallback",
+  },
+  {
+    id: "ts-proto-2-fallback",
+    plugin: "ts-proto",
+    header: "^// Code generated by protoc-gen-ts_proto\\. DO NOT EDIT\\.$",
+    cell: "fallback",
+  },
+  {
+    id: "protoc-gen-js",
+    plugin: "protoc-gen-js",
+    header: "^// GENERATED CODE -- DO NOT EDIT!$",
+    cell: "fallback",
+  },
+  {
+    id: "protoc-gen-grpc-web",
+    plugin: "protoc-gen-grpc-web",
+    header: "^// Code generated by protoc-gen-grpc-web\\. DO NOT EDIT\\.$",
+    cell: "fallback",
+  },
+  {
+    id: "protobuf-ts",
+    plugin: "protobuf-ts",
+    header: "^// @generated by protobuf-ts ",
+    cell: "fallback",
+  },
+  { id: "ts-protoc-gen", plugin: "ts-protoc-gen", header: "^// package: ", cell: "fallback" },
+  {
+    id: "protoc-gen-es-unsupported",
+    plugin: "protoc-gen-es",
+    header: "^// @generated by protoc-gen-es v(?:0|[3-9]|[1-9][0-9]+)\\.",
+    cell: "unsupported",
+  },
+] as const satisfies readonly {
+  readonly id: string;
+  readonly plugin: string;
+  readonly header: string;
+  readonly versions?: { readonly min: string; readonly max: string };
+  readonly cell: string;
+}[];
+
 /** Each group of failure classes, and the text opening the line that names one of its failures. */
 export const FAILURE_PREFIXES = { setup: "setup failure: ", run: "run failure: " } as const;
 
@@ -1294,6 +1429,7 @@ export const FAILURE_CLASSES = {
   "workspace-member-without-source": "setup",
   "convention-not-literal": "setup",
   "no-program": "setup",
+  "unreadable-configuration": "setup",
   "unreadable-document": "setup",
   "missing-import-path": "setup",
   "binding-undecodable": "setup",

package/src/dependencies.ts

@@ -31,14 +31,14 @@ import {
 } from "@typescript/native/ast";
 import { automaticTypes, type AutomaticTypes } from "./automatic-types.ts";
 import {
-  configurationFiles,
   declaredIn as declaredBeside,
   dependenciesNamed,
   moduleStrings,
   outsideChain,
+  type ConfigurationFiles,
   type OutsideModule,
   type ParseFile,
-} from "./configuration-files.ts";
+} from "./entries/configuration-files.ts";
 import type { FindingPosition } from "./finding.ts";
 import type { Host } from "./host.ts";
 import { nodeKey, type Inventory } from "./inventory.ts";
@@ -55,8 +55,11 @@ import type { DependencySection, Module } from "./ref.ts";
 import { UNANSWERED } from "./query.ts";
 import type { Handle, ProjectView } from "./session.ts";
 import { sourceFilesOf, type SourceFiles } from "./source-files.ts";
-import { manifestCommands, nodemonTexts } from "./manifest.ts";
-import { commandFileTexts, workflowCommands } from "./workflow-steps.ts";
+import { manifestCommands, nodemonTexts } from "./roots/manifest.ts";
+import { writtenName } from "./platform-calls.ts";
+import { callsPlatform } from "./platform-symbols.ts";
+import { parenthesesRemoved } from "./unwrap.ts";
+import type { Workflows } from "./entries/workflow-steps.ts";
 import {
   pathsNamed,
   preloadedPackages,
@@ -355,8 +358,9 @@ function bindingsOf(node: Node | undefined): readonly Texted[] {
  * Every package one project needs, and which declaration each use is written in.
  * One local walk and one batched resolution per file: a use of an import binding is
  * an identifier resolving to the binding's own symbol, so a local declaration that
- * shadows the name is not one. A string of a configuration file uses each dependency
- * the manifest beside the file declares that it spells.
+ * shadows the name is not one. A string of a configuration file, as the entry sources
+ * read them in `configuration`, uses each dependency the manifest beside the file
+ * declares that it spells.
  */
 export function projectNeeds<Brand>(
   project: ProjectView<Brand>,
@@ -364,6 +368,8 @@ export function projectNeeds<Brand>(
   host: Host,
   targetRoot: string,
   parse: ParseFile,
+  configuration: ConfigurationFiles,
+  workflows: Workflows,
 ): ProjectNeeds {
   const programPackages = new Set<string>();
   for (const name of project.program.getSourceFileNames()) {
@@ -417,7 +423,6 @@ export function projectNeeds<Brand>(
     return names;
   };
   const files = sourceFilesOf(project, targetRoot);
-  const configuration = configurationFiles(host, targetRoot, files, parse);
   for (const { file, manifestDir } of configuration.modules) {
     const names = declaredAt(joinPath(manifestDir, MANIFEST));
     for (const { node, text } of moduleStrings(file)) {
@@ -437,7 +442,7 @@ export function projectNeeds<Brand>(
     targetRoot,
     files,
     parse,
-    scriptRunFiles(host, targetRoot, files),
+    scriptRunFiles(host, targetRoot, files, workflows),
   );
   for (const { file, manifestDirs } of [...configuration.outside, ...ranFiles]) {
     for (const manifestDir of manifestDirs) {
@@ -460,6 +465,7 @@ function scriptRunFiles(
   host: Host,
   targetRoot: string,
   files: SourceFiles,
+  workflows: Workflows,
 ): readonly { readonly path: string; readonly manifestDir: string }[] {
   const root = resolvePath(host.workingDirectory(), targetRoot);
   const dirs = new Set<string>([root]);
@@ -472,12 +478,7 @@ function scriptRunFiles(
     }
   }
   const named = new Map<string, readonly string[]>([
-    [
-      root,
-      workflowReadings(host, root)
-        .flatMap(pathsNamed)
-        .map((one) => one.path),
-    ],
+    [root, workflows.readings.flatMap(pathsNamed).map((one) => one.path)],
   ]);
   for (const dir of dirs) {
     const read = readDocument(host, joinPath(dir, MANIFEST));
@@ -522,20 +523,9 @@ function manifestUses(host: Host, dir: string, manifest: Record<string, unknown>
 }
 
 /** What the target root's workflow steps, git hooks and recipes use, held with their files' whole text. */
-function workflowUses(host: Host, targetRoot: string): CommandUses {
-  const uses = usesOf(workflowReadings(host, targetRoot));
-  return { ...uses, held: [uses.held, ...commandFileTexts(host, targetRoot)].join("\n") };
-}
-
-/**
- * What the target root's workflow steps, git hooks, hook managers and recipes run, each held
- * with the directory the file writes for it.
- */
-function workflowReadings(host: Host, targetRoot: string): readonly CommandReading[] {
-  return workflowCommands(host, targetRoot).map(({ text, dir, writtenDirectory }) => {
-    const reading = readCommands(text, dir);
-    return { ...reading, held: [reading.held, writtenDirectory ?? ""].join("\n") };
-  });
+function workflowUses(workflows: Workflows): CommandUses {
+  const uses = usesOf(workflows.readings);
+  return { ...uses, held: [uses.held, ...workflows.texts].join("\n") };
 }
 
 /** What some command strings say about the packages they use. */
@@ -661,8 +651,16 @@ function fileNeeds<Brand>(
   if (names.size > 0 || automatic.globals.size > 0) {
     visit(file);
   }
+  const loads = runtimeLoads(file);
+  const callees = loads.flatMap((load) => load.callees);
 
-  const asked = [...specifiers, ...bindings.map(({ node }) => node), ...candidates, ...globals];
+  const asked = [
+    ...specifiers,
+    ...bindings.map(({ node }) => node),
+    ...candidates,
+    ...globals,
+    ...callees,
+  ];
   const handles: Handle<Brand>[] = asked.map((node) => project.handle(node));
   const resolved = project.symbolsAt(handles);
 
@@ -738,35 +736,83 @@ function fileNeeds<Brand>(
   for (const reference of file.typeReferenceDirectives) {
     use(ownersOf(file, held, file), typePackages(reference.fileName, programPackages));
   }
-  for (const specifier of resolvedSpecifiers(file)) {
-    const named = packageOfSpecifier(specifier.text);
-    if (named !== undefined) {
+  // A callee the checker leaves unanswered may be a require, so its call holds the
+  // dependency it names by live code, as program.33 holds one.
+  const calleesAt = unresolvedAt + globals.length;
+  const decided = new Map<string, boolean>();
+  const requires = new Set<Identifier>();
+  const unansweredCallees = new Set<Identifier>();
+  callees.forEach((callee, index) => {
+    const symbol = resolved[calleesAt + index];
+    if (symbol === UNANSWERED) {
+      unansweredCallees.add(callee);
+      return;
+    }
+    // The decision reads the callee's symbol and its written name, and nothing else of it.
+    const key = symbol === undefined ? undefined : `${symbol.id}\u0000${callee.text}`;
+    const answer =
+      (key === undefined ? undefined : decided.get(key)) ??
+      callsPlatform(project, "require", callee, symbol, () => undefined);
+    if (key !== undefined) {
+      decided.set(key, answer);
+    }
+    if (answer) {
+      requires.add(callee);
+    }
+  });
+  for (const { specifier, named, callees: through } of loads) {
+    if (through.length === 0 || through.some((one) => requires.has(one))) {
       use(ownersOf(file, held, specifier), [named]);
+    } else if (through.some((one) => unansweredCallees.has(one))) {
+      use([PROJECT_OWNER], [named]);
     }
   }
   return resolved.slice(0, specifiers.length).includes(UNANSWERED);
 }
 
 /**
- * The literal specifiers one file asks the runtime to resolve, through `import.meta.resolve`
- * or `require.resolve`, each of which needs the package it names installed.
+ * A call of one file that may load or resolve a package at run time: the literal specifier
+ * naming it, and the names a `require` would be written with, of which one has to be a
+ * `require` for the call to need the package; none for a use where it stands.
  */
-function resolvedSpecifiers(file: SourceFile): readonly Texted[] {
-  const found: Texted[] = [];
-  if (!file.text.includes(".resolve(")) {
-    return found;
-  }
+interface RuntimeLoad {
+  readonly specifier: Texted;
+  readonly named: string;
+  readonly callees: readonly Identifier[];
+}
+
+/**
+ * The calls one file may load or resolve a package with at run time, each of whose first
+ * argument is literal text naming a package: a `require()` call, which the compiler lists among
+ * a file's imports only in a JavaScript file and only through the bare name; a `.resolve` of
+ * another name, which needs it where that name is a `require`; and `import.meta.resolve` or
+ * a `.resolve` of the name `require`, whatever it names, a use where it stands.
+ */
+function runtimeLoads(file: SourceFile): readonly RuntimeLoad[] {
+  const found: RuntimeLoad[] = [];
   const visit = (node: Node): void => {
-    if (isCallExpression(node) && isPropertyAccessExpression(node.expression)) {
-      const callee = node.expression;
+    if (isCallExpression(node)) {
       const [argument] = node.arguments;
-      const receiver = callee.expression;
-      const resolving =
-        callee.name.text === "resolve" &&
-        ((isMetaProperty(receiver) && receiver.name.text === "meta") ||
-          (isIdentifier(receiver) && receiver.text === "require"));
-      if (resolving && argument !== undefined && isLiteralText(argument)) {
-        found.push(argument);
+      if (argument !== undefined && isLiteralText(argument)) {
+        const named = packageOfSpecifier(argument.text);
+        const callee = parenthesesRemoved(node.expression);
+        const receiver =
+          isPropertyAccessExpression(callee) && callee.name.text === "resolve"
+            ? parenthesesRemoved(callee.expression)
+            : undefined;
+        const stands =
+          receiver !== undefined &&
+          ((isMetaProperty(receiver) && receiver.name.text === "meta") ||
+            (isIdentifier(receiver) && receiver.text === "require"));
+        const callees = stands
+          ? []
+          : [
+              writtenName(callee),
+              receiver === undefined ? undefined : writtenName(receiver),
+            ].filter((one) => one !== undefined);
+        if (named !== undefined && (stands || callees.length > 0)) {
+          found.push({ specifier: argument, named, callees });
+        }
       }
     }
     node.forEachChild(visit);
@@ -989,6 +1035,7 @@ function addNeededPeers(
 export function dependenciesOf(
   host: Host,
   targetRoot: string,
+  workflows: Workflows,
   perProject: readonly ProjectNeeds[],
   candidates: readonly string[],
   members: readonly string[] = [],
@@ -1011,7 +1058,7 @@ export function dependenciesOf(
       unbuilt.add(path);
     }
   }
-  const workflow = workflowUses(host, targetRoot);
+  const workflow = workflowUses(workflows);
   const declared: DeclaredDependency[] = [];
   const ran = new Set<string>();
   const peers = new Map<string, readonly string[]>();