@cplieger/deadset-ts 8.0.0-dev.18 → 8.0.0-dev.19

package/dist/src/conformance-record.js

@@ -4,7 +4,7 @@ export const RECORD = {
     conformance: {
         corpusVersion: "6.0.0",
         result: "pass",
-        digest: "sha256:140f095d52fa8140de070f46d13a132b723c634ecf24a8b96e6a92c410c4b848",
+        digest: "sha256:e4af2b9bcd07fd745101bf3215cd21e9df1448bdc332a791f25d5676cf15c794",
     },
     gaps: [],
 };

package/dist/src/contract/contract.generated.js

@@ -1206,6 +1206,13 @@ export const EVIDENCE = [
             "DS1602",
         ],
     },
+    {
+        evidence: "unwritten-run-path",
+        rule: "confidence.35",
+        class: "possible",
+        languages: ["ts"],
+        codes: ["DS1601", "DS1602"],
+    },
     {
         evidence: "schema-operation-default",
         rule: "schemas.10",

package/dist/src/entries/conventions.js

@@ -9,7 +9,7 @@ import { lineOf } from "../component-files.js";
 import { CONVENTION_ROWS, } from "./convention-rows.js";
 import { documentStrings } from "./configuration-files.js";
 import { readCommands } from "../commands/read.js";
-import { nodeTestGlobs, } from "./test-runners.js";
+import { nodeTestGlobs } from "./test-runners.js";
 import { documentModule, membersNamed, staticModule, textsOf, valuesAt, } from "./static-module.js";
 import { ancestors, cannotStartPackageName, dirnamePath, joinPath, normalizePath, relativePath, resolvePath, } from "../paths.js";
 import { satisfies } from "../version-range.js";
@@ -520,11 +520,11 @@ function packageKeyUses(read, dir, manifest, keys) {
         text.startsWith(`${name}/`) ||
         (text.startsWith(`${name}:`) && text.length > name.length + 1)));
 }
-/** Every simple command of a manifest's `scripts`, as the command reader reads it in the manifest's directory. */
-function scriptCommands(manifest, dir) {
+/** What the command reader reads each of a manifest's `scripts` as, in the manifest's directory. */
+function scriptReadings(manifest, dir) {
     const scripts = isRecord(manifest) ? manifest["scripts"] : undefined;
     return isRecord(scripts)
-        ? Object.values(scripts).flatMap((text) => typeof text === "string" ? readCommands(text, dir).commands : [])
+        ? Object.values(scripts).flatMap((text) => typeof text === "string" ? [readCommands(text, dir)] : [])
         : [];
 }
 /**
@@ -543,6 +543,7 @@ export function readConventions(host, parse, manifests, disabled, rows = CONVENT
     const read = readFilesOnce(host, parse);
     for (const manifest of manifests) {
         const declared = readJSON(host, joinPath(manifest.dir, MANIFEST));
+        const scripts = scriptReadings(declared, manifest.dir);
         let input;
         const runnerInput = () => {
             input ??= {
@@ -558,7 +559,7 @@ export function readConventions(host, parse, manifests, disabled, rows = CONVENT
                     }
                     return undefined;
                 },
-                scripts: scriptCommands(declared, manifest.dir),
+                scripts: scripts.flatMap((one) => one.commands),
             };
             return input;
         };
@@ -659,7 +660,7 @@ export function readConventions(host, parse, manifests, disabled, rows = CONVENT
                 });
             }
         }
-        testGlobs.push(...nodeTestGlobs(runnerInput().scripts));
+        testGlobs.push(...nodeTestGlobs(scripts.flatMap((one) => one.tests)));
     }
     const unique = [...new Map(applied.map((one) => [JSON.stringify(one), one])).values()];
     unique.sort((a, b) => bytewise(a.name, b.name) ||

package/dist/src/entries/test-runners.js

@@ -107,7 +107,7 @@ function parsed(words, table) {
         else if (table.flags.has(name)) {
             keep(name, equals < 0 ? "true" : word.slice(equals + 1));
         }
-        else if (!(table.assigned === true && equals > 0)) {
+        else {
             return undefined;
         }
     }
@@ -632,31 +632,6 @@ const AVA_CONFIG = ["ava.config.js", "ava.config.cjs", "ava.config.mjs"];
 export const AVA_6 = avaRunner(AVA_CONFIG, ["cjs", "mjs", "js"]);
 /** AVA 8, which reads no `ava.config.cjs` and defaults to no `.cjs` test. */
 export const AVA_8 = avaRunner(["ava.config.js", "ava.config.mjs"], ["mjs", "js"]);
-/**
- * The options of `node` (https://nodejs.org/api/cli.html) a test run writes: the ones that take
- * a value, the flags, and any long option whose value follows `=`.
- */
-const NODE_OPTIONS = {
-    valued: new Set([
-        ...["-r", "--require", "--import", "--loader", "--experimental-loader", "--env-file"],
-        ...["--env-file-if-exists", "--conditions", "-C", "--input-type", "--watch-path"],
-        ...["--test-reporter", "--test-reporter-destination", "--test-concurrency"],
-        ...["--test-name-pattern", "--test-skip-pattern", "--test-timeout", "--test-shard"],
-        ...["--test-coverage-include", "--test-coverage-exclude", "--test-coverage-branches"],
-        ...["--test-coverage-functions", "--test-coverage-lines", "--test-isolation"],
-        ...["--test-global-setup"],
-    ]),
-    flags: new Set([
-        ...["--test", "--test-only", "--watch", "--test-force-exit", "--test-update-snapshots"],
-        ...["--test-randomize", "--experimental-test-coverage", "--experimental-test-module-mocks"],
-        ...["--experimental-test-snapshots", "--experimental-strip-types", "--no-strip-types"],
-        ...["--no-experimental-strip-types", "--experimental-transform-types", "--enable-source-maps"],
-        ...["--experimental-vm-modules", "--experimental-detect-module", "--no-warnings"],
-        ...["--no-experimental-detect-module", "--experimental-require-module", "--trace-warnings"],
-        ...["--no-experimental-require-module", "--expose-gc", "--inspect", "--inspect-brk"],
-    ]),
-    assigned: true,
-};
 /** The patterns `node --test` runs with no operand (`doc/api/test.md`), the TypeScript ones where types are stripped. */
 function nodeTestDefaults(stripped) {
     const forms = ["**/*.test", "**/*-test", "**/*_test", "**/test-*", "**/test", "**/test/**/*"];
@@ -666,19 +641,10 @@ function nodeTestDefaults(stripped) {
     ];
 }
 /**
- * The files each `node --test` command of a manifest's scripts runs: its operands, each a glob
- * read in the command's directory, or the default patterns where it writes none. A command
- * holding a dynamic word or an option {@link NODE_OPTIONS} does not name runs no file here.
+ * The files each `node --test` run of a manifest's scripts runs, as the command reader reads
+ * it: its operands, each a glob read in the command's directory, or the default patterns where
+ * it writes none.
  */
-export function nodeTestGlobs(scripts) {
-    return scripts.flatMap((command) => {
-        const words = afterProgram(command, ["node"]);
-        const read = words === undefined ? undefined : parsed(words, NODE_OPTIONS);
-        if (!read?.values.has("--test")) {
-            return [];
-        }
-        const stripped = !read.values.has("--no-strip-types") && !read.values.has("--no-experimental-strip-types");
-        const patterns = read.operands.length > 0 ? read.operands : nodeTestDefaults(stripped);
-        return patterns.map((one) => belowGlob(command.dir, one));
-    });
+export function nodeTestGlobs(runs) {
+    return runs.flatMap((run) => (run.patterns.length > 0 ? run.patterns : nodeTestDefaults(run.stripped)).map((one) => belowGlob(run.dir, one)));
 }

package/dist/src/entries/workflow-steps.js

@@ -1,10 +1,11 @@
 /**
  * The command strings beside a target root's packages: a CI workflow's `run:` steps, the git
- * hooks, the hook managers' commands and the makefile's recipe lines, each with the directory
- * it runs in. A workflow or hook manager file is read by `text/yaml.ts`, and one it does not
+ * hooks, the hook managers' commands and scripts and the makefile's recipe lines, each with the
+ * directory it runs in. A workflow or hook manager file is read by `text/yaml.ts`, and one it does not
  * read gives no command; each command is read by `commands/read.ts`.
  */
 import { pathsNamed, readCommands } from "../commands/read.js";
+import { PART } from "../commands/shell.js";
 import { isRecord } from "../json-document.js";
 import { joinPath, resolvePath } from "../paths.js";
 import { filesIn } from "../fs/tree.js";
@@ -14,14 +15,20 @@ const WORKFLOWS = ".github/workflows";
 const HOOK_DIRS = [".husky", ".githooks"];
 /** The key setting the directory a workflow step, or each step a `defaults.run` covers, runs in. */
 const WORKING_DIRECTORY = "working-directory";
-/**
- * The hook manager files, each with the key its commands are written under and the key of their
- * directory: lefthook's `root`, https://lefthook.dev/configuration/root/
- */
 const HOOK_MANAGERS = [
-    [".pre-commit-config.yaml", "entry", undefined],
-    ...["lefthook.yml", "lefthook.yaml", ".lefthook.yml"].map((name) => [name, "run", "root"]),
+    { name: ".pre-commit-config.yaml", key: "entry" },
+    ...["lefthook.yml", "lefthook.yaml", ".lefthook.yml"].map((name) => ({
+        name,
+        key: "run",
+        dirKey: "root",
+        scripts: true,
+    })),
 ];
+/**
+ * The directories lefthook searches for a hook's scripts after the file's `source_dir` and
+ * `source_dir_local`: https://github.com/evilmartians/lefthook/blob/master/internal/command/run.go
+ */
+const LEFTHOOK_DIRS = [".config/lefthook", ".config/lefthook-local"];
 /** The names GNU make reads a makefile under, in the order it tries them. */
 const MAKEFILES = ["GNUmakefile", "makefile", "Makefile"];
 function readText(host, path) {
@@ -73,7 +80,6 @@ function keyedCommands(text, root, key, dirKey) {
                     : written.includes("${{")
                         ? undefined
                         : resolvePath(root, written),
-                writtenDirectory: written,
             });
         }
         for (const value of Object.values(node)) {
@@ -83,6 +89,51 @@ function keyedCommands(text, root, key, dirKey) {
     visit(yamlDocument(text), undefined);
     return found;
 }
+/**
+ * The command lefthook runs for each script a lefthook file's hooks name, each key of a hook's
+ * `scripts` and each `script` of a job in its `jobs`, a group's among them, from each directory
+ * it searches: its `runner`, then the path `<dir>/<hook>/<name>` quoted as lefthook quotes it,
+ * run in the target root: https://lefthook.dev/configuration/Scripts/
+ */
+function lefthookScripts(text, root) {
+    const document = yamlDocument(text);
+    if (!isRecord(document)) {
+        return [];
+    }
+    const dirs = [
+        scalarText(document["source_dir"]) ?? ".lefthook/",
+        scalarText(document["source_dir_local"]) ?? ".lefthook-local/",
+        ...LEFTHOOK_DIRS,
+    ];
+    const found = [];
+    const add = (hook, name, runner) => {
+        for (const dir of dirs) {
+            const path = `'${joinPath(dir, hook, name).replaceAll("'", "'\\''")}'`;
+            found.push({
+                text: runner === undefined || runner.trim() === "" ? path : `${runner} ${path}`,
+                dir: root,
+            });
+        }
+    };
+    const jobs = (hook, list) => {
+        for (const job of Array.isArray(list) ? list : []) {
+            const script = isRecord(job) ? scalarText(job["script"]) : undefined;
+            if (isRecord(job) && script !== undefined) {
+                add(hook, script, scalarText(job["runner"]));
+            }
+            const group = isRecord(job) ? job["group"] : undefined;
+            jobs(hook, isRecord(group) ? group["jobs"] : undefined);
+        }
+    };
+    for (const [hook, value] of Object.entries(document)) {
+        const scripts = isRecord(value) ? value["scripts"] : undefined;
+        for (const [name, options] of Object.entries(isRecord(scripts) ? scripts : {})) {
+            add(hook, name, isRecord(options) ? scalarText(options["runner"]) : undefined);
+        }
+        jobs(hook, isRecord(value) ? value["jobs"] : undefined);
+    }
+    return found;
+}
 /** The path of each git hook script at `root`, every file in {@link HOOK_DIRS}. */
 function hookScripts(host, root) {
     return HOOK_DIRS.flatMap((dir) => filesIn(host, joinPath(root, dir), () => true).map((name) => joinPath(root, dir, name)));
@@ -91,10 +142,44 @@ function hookScripts(host, root) {
 function makefileAt(host, root) {
     return MAKEFILES.map((name) => joinPath(root, name)).find((candidate) => host.kindOf(candidate) === "file");
 }
+/**
+ * One recipe line as make hands it to the shell: each `$$` a `$`, and each reference to a
+ * variable or a function, which make expands first, a part only the run knows:
+ * https://www.gnu.org/software/make/manual/html_node/Reference.html
+ */
+function expandedByMake(line) {
+    let expanded = "";
+    for (let at = 0; at < line.length; at += 1) {
+        const char = line.charAt(at);
+        const next = line.charAt(at + 1);
+        if (char !== "$") {
+            expanded += char;
+        }
+        else if (next === "$") {
+            expanded += "$";
+            at += 1;
+        }
+        else {
+            let end = at + 1;
+            if (next === "(" || next === "{") {
+                const close = next === "(" ? ")" : "}";
+                for (let depth = 0; end < line.length; end += 1) {
+                    depth += line.charAt(end) === next ? 1 : line.charAt(end) === close ? -1 : 0;
+                    if (depth === 0) {
+                        break;
+                    }
+                }
+            }
+            expanded += PART;
+            at = Math.min(end, line.length);
+        }
+    }
+    return expanded;
+}
 /**
  * Each recipe line of the target root's makefile: a line that starts with a tab, joined with
- * the lines a trailing `\` continues it onto, less the `@`, `-` and `+` make reads before it.
- * Make runs each line in a shell of its own.
+ * the lines a trailing `\` continues it onto, less the `@`, `-` and `+` make reads before it,
+ * as make expands it. Make runs each line in a shell of its own.
  */
 function recipeLines(host, root) {
     const path = makefileAt(host, root);
@@ -104,16 +189,15 @@ function recipeLines(host, root) {
         .split(/\r?\n/u)
         .filter((line) => line.startsWith("\t"))
         .map((line) => ({
-        text: line.slice(1).replace(/^[@+-]+/u, ""),
+        text: expandedByMake(line.slice(1).replace(/^[@+-]+/u, "")),
         dir: root,
-        writtenDirectory: undefined,
     }));
 }
 /**
  * Every command the target root's workflow steps, git hooks, hook managers and makefile run:
  * the `run:` steps of the workflow files in `.github/workflows`, each file in `.husky` and
  * `.githooks` as one shell script, the `entry:` commands of `.pre-commit-config.yaml`, the
- * `run:` commands of a lefthook file and the makefile's recipe lines.
+ * `run:` commands and the scripts of a lefthook file and the makefile's recipe lines.
  */
 export function workflowCommands(host, targetRoot) {
     const root = resolvePath(host.workingDirectory(), targetRoot);
@@ -123,35 +207,125 @@ export function workflowCommands(host, targetRoot) {
         ...hookScripts(host, root).map((path) => ({
             text: readText(host, path) ?? "",
             dir: root,
-            writtenDirectory: undefined,
         })),
-        ...HOOK_MANAGERS.flatMap(([name, key, dirKey]) => keyedCommands(readText(host, joinPath(root, name)) ?? "", root, key, dirKey)),
+        ...HOOK_MANAGERS.flatMap(({ name, key, dirKey, scripts }) => {
+            const text = readText(host, joinPath(root, name)) ?? "";
+            return [
+                ...keyedCommands(text, root, key, dirKey),
+                ...(scripts === true ? lefthookScripts(text, root) : []),
+            ];
+        }),
         ...recipeLines(host, root),
     ];
 }
 /**
  * The whole text of each file {@link workflowCommands} reads a command from, each workflow file,
- * git hook, hook manager file and makefile at the target root. Layer 3 holds it whole, so a part
- * no command is read from, a comment included, or one the reading of the structure misses, still
- * holds every file it names.
+ * git hook, hook manager file and makefile at the target root, which the dependency rule reads.
  */
 export function commandFileTexts(host, targetRoot) {
+    return commandFiles(host, targetRoot).flatMap(({ path }) => readText(host, path) ?? []);
+}
+/** Each file {@link workflowCommands} reads a command from, with the key a YAML file writes its commands under. */
+function commandFiles(host, targetRoot) {
     const root = resolvePath(host.workingDirectory(), targetRoot);
     return [
-        ...filesIn(host, joinPath(root, WORKFLOWS), (name) => /\.ya?ml$/u.test(name)).map((name) => joinPath(root, WORKFLOWS, name)),
-        ...hookScripts(host, root),
-        ...HOOK_MANAGERS.map(([name]) => joinPath(root, name)),
-        ...[makefileAt(host, root) ?? []].flat(),
-    ].flatMap((path) => readText(host, path) ?? []);
+        ...filesIn(host, joinPath(root, WORKFLOWS), (name) => /\.ya?ml$/u.test(name)).map((name) => ({
+            path: joinPath(root, WORKFLOWS, name),
+            key: "run",
+        })),
+        ...hookScripts(host, root).map((path) => ({ path, key: undefined })),
+        ...HOOK_MANAGERS.map(({ name, key }) => ({ path: joinPath(root, name), key })),
+        ...[makefileAt(host, root) ?? []].flat().map((path) => ({ path, key: undefined })),
+    ];
+}
+/**
+ * The filters of a workflow's `on` key, which name the files and refs whose change triggers it
+ * and run none: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore
+ */
+const TRIGGER_FILTERS = new Set([
+    "paths",
+    "paths-ignore",
+    "branches",
+    "branches-ignore",
+    "tags",
+    "tags-ignore",
+]);
+/**
+ * The values of one YAML file that are no command, each with its key: every scalar but one
+ * written under `key`, which is read as a command string, and one of a trigger filter. A file
+ * `yamlDocument` does not read is one value, its whole text. No key and no comment is a value.
+ */
+function yamlValues(text, key) {
+    const document = yamlDocument(text);
+    if (document === undefined) {
+        return [{ text, shell: false }];
+    }
+    const found = [];
+    // `trigger` is 1 for the value of the top-level `on`, a map of events, and 2 for an event's.
+    const visit = (node, under, trigger = 0) => {
+        if (Array.isArray(node)) {
+            for (const item of node) {
+                visit(item, under);
+            }
+        }
+        else if (isRecord(node)) {
+            for (const [name, value] of Object.entries(node)) {
+                const on = node === document && (name === "on" || name === "true");
+                if ((name !== key || scalarText(value) === undefined) &&
+                    !(trigger === 2 && TRIGGER_FILTERS.has(name))) {
+                    visit(value, name, on ? 1 : trigger === 1 ? 2 : 0);
+                }
+            }
+        }
+        else {
+            const value = scalarText(node);
+            if (value !== undefined) {
+                found.push({ text: value, shell: false, ...(under === undefined ? {} : { key: under }) });
+            }
+        }
+    };
+    visit(document, undefined);
+    return found;
+}
+/**
+ * The lines of a makefile that are no recipe line, joined with the lines a trailing `\`
+ * continues them onto, each without the comment a `#` make does not read as escaped starts.
+ */
+function makefileValues(text) {
+    return text
+        .replace(/\\\r?\n/gu, " ")
+        .split(/\r?\n/u)
+        .filter((line) => !line.startsWith("\t"))
+        .map((line) => line.replace(/(?<!\\)#.*$/u, ""))
+        .filter((line) => line.trim() !== "")
+        .map((line) => ({ text: line, shell: false }));
+}
+/**
+ * The texts layer 3 reads of the target root's command files: each command string, and each
+ * value of a workflow file, a hook manager file and the makefile that is no command.
+ */
+function heldTexts(host, targetRoot) {
+    const makefile = makefileAt(host, resolvePath(host.workingDirectory(), targetRoot));
+    return [
+        ...workflowCommands(host, targetRoot).map(({ text }) => ({ text, shell: true })),
+        ...commandFiles(host, targetRoot).flatMap(({ path, key }) => {
+            const text = readText(host, path);
+            return text === undefined
+                ? []
+                : key !== undefined
+                    ? yamlValues(text, key)
+                    : path === makefile
+                        ? makefileValues(text)
+                        : [];
+        }),
+    ];
 }
 /** Reads the target root's workflow steps, git hooks, hook managers and makefile. */
 export function readWorkflows(host, targetRoot) {
     return {
-        readings: workflowCommands(host, targetRoot).map(({ text, dir, writtenDirectory }) => {
-            const reading = readCommands(text, dir);
-            return { ...reading, held: [reading.held, writtenDirectory ?? ""].join("\n") };
-        }),
+        readings: workflowCommands(host, targetRoot).map(({ text, dir }) => readCommands(text, dir)),
         texts: commandFileTexts(host, targetRoot),
+        held: heldTexts(host, targetRoot),
     };
 }
 /**

package/dist/src/findings/non-code-artifacts.js

@@ -130,8 +130,14 @@ function fileNeverImported(input) {
             : fileFinding(CODE.fileNeverImported, file, "no import reaches this file and no root names it or a declaration in it");
     });
 }
-/** The findings of the files family, `DS1600` to `DS1699`. */
-export const nonCodeArtifacts = (input) => [
-    ...fileNeverBuilt(input),
-    ...fileNeverImported(input),
-];
+/**
+ * The findings of the files family, `DS1600` to `DS1699`, each at the class `possible` in a
+ * package a command of which may run a file whose path no word of it writes, since that
+ * command may run the file (confidence.35).
+ */
+export const nonCodeArtifacts = (input) => {
+    const unwritten = [...(input.files.unwrittenRuns ?? [])];
+    return [...fileNeverBuilt(input), ...fileNeverImported(input)].map((finding) => unwritten.some((dir) => dir === "." || finding.position.path === dir || finding.position.path.startsWith(`${dir}/`))
+        ? { ...finding, reachabilityClass: "possible" }
+        : finding);
+};

package/dist/src/roots/manifest.js

@@ -27,8 +27,9 @@ function below(member, key) {
 }
 /**
  * The whole text of nodemon's configuration, the manifest's `nodemonConfig` member and the
- * `nodemon.json` beside it, by the member each is. Layer 3 holds it whole, because nodemon runs
- * commands from keys besides `exec`, `events` among them: https://github.com/remy/nodemon#config-files
+ * `nodemon.json` beside it, by the member each is. The dependency rule reads it whole, and
+ * layer 3 each of its values, because nodemon runs commands from keys besides `exec`, `events`
+ * among them: https://github.com/remy/nodemon#config-files
  */
 export function nodemonTexts(host, dir, manifest) {
     const member = manifest["nodemonConfig"];
@@ -44,6 +45,39 @@ export function nodemonTexts(host, dir, manifest) {
         ...(file === undefined ? [] : [{ member: "nodemon.json", text: file }]),
     ];
 }
+/**
+ * The texts layer 3 reads of one text of nodemon's configuration: each value of it but its
+ * `exec` command, which is read as a command string of its own, those under `events` read as
+ * command strings too, and the whole text where it does not parse. Its keys are never read.
+ */
+function nodemonValues(text) {
+    let config;
+    try {
+        config = JSON.parse(text);
+    }
+    catch {
+        return [{ text, shell: false }];
+    }
+    const found = [];
+    const visit = (value, shell) => {
+        if (Array.isArray(value) || isRecord(value)) {
+            for (const one of Object.values(value)) {
+                visit(one, shell);
+            }
+        }
+        else if (typeof value === "string" ||
+            typeof value === "number" ||
+            typeof value === "boolean") {
+            found.push({ text: String(value), shell });
+        }
+    };
+    for (const [key, value] of Object.entries(isRecord(config) ? config : { "": config })) {
+        if (key !== "exec" || typeof value !== "string") {
+            visit(value, key === "events");
+        }
+    }
+    return found;
+}
 /**
  * The command strings one manifest runs, each at the member it is written under: each of its
  * `scripts`, and the `exec` command of nodemon's configuration, in the manifest's `nodemonConfig`
@@ -141,10 +175,19 @@ export function readManifest(host, targetRoot) {
         for (const path of new Set(pathsNamed(readCommands(command, ".")).map((one) => one.path))) {
             found.push({ member, path, role: "script", published: false });
         }
-        found.push({ member, path: ".", role: "script", published: false, held: command });
+        found.push({
+            member,
+            path: ".",
+            role: "script",
+            published: false,
+            held: [{ text: command, shell: true, tested: member.startsWith("scripts[") }],
+        });
     }
     for (const { member, text } of nodemonTexts(host, targetRoot, manifest)) {
-        found.push({ member, path: ".", role: "script", published: false, held: text });
+        const held = nodemonValues(text);
+        if (held.length > 0) {
+            found.push({ member, path: ".", role: "script", published: false, held });
+        }
     }
     return {
         entries: found.map((entry) => ({

package/dist/src/roots/root-set.js

@@ -16,6 +16,7 @@ import { typeQueryAliases } from "../type-query-alias.js";
 import { bytewise } from "../text/compare.js";
 import { holdsManifest } from "../fs/manifest.js";
 import { globExpression } from "../text/glob.js";
+import { heldWords } from "../commands/held.js";
 import { spelledFiles } from "../text/named-files.js";
 import { extensionOf, OUTPUT_EXTENSIONS } from "../extensions.js";
 import { publishedAPI, releaseTagged } from "./published-reach.js";
@@ -159,11 +160,12 @@ export function matchRef(pattern, ref) {
     return matchGlob(Array.from(pattern), Array.from(ref));
 }
 /**
- * Per package, the own files its held texts name, as `spelledFiles` reads them, but those a
- * root enters with all they export: a command can use no more of such a file than the root
- * keeps live. A manifest's are its entries' held texts, and the target root's package has the
- * workflow steps, git hooks and makefile recipes beside its own, with the whole text of each
- * file they are read from.
+ * Per package, the own files the words of its held texts name, as `spelledFiles` reads them,
+ * but those a root enters with all they export: a command can use no more of such a file than
+ * the root keeps live. A manifest's are its entries' held texts, and the target root's package
+ * has the workflow steps, git hooks and makefile recipes beside its own, with the values of
+ * each file they are read from. A package is listed too where a word that may write the file
+ * a command runs writes no path text.
  */
 function scriptHolds(entries, files, entered, host, targetRoot, workflows) {
     const rooted = new Set(entered.filter((one) => one.exports && one.names === undefined).map((one) => one.file.fileName));
@@ -171,24 +173,20 @@ function scriptHolds(entries, files, entered, host, targetRoot, workflows) {
         .filter((file) => !rooted.has(file.fileName))
         .map((file) => ({ file, paths: [file.fileName, ...files.writtenAs(file)] }));
     const cwd = host.workingDirectory();
-    const commands = new Map([
-        [
-            resolvePath(cwd, targetRoot),
-            [...workflows.readings.map((reading) => reading.held), ...workflows.texts],
-        ],
-    ]);
+    const root = resolvePath(cwd, targetRoot);
+    const commands = new Map([[root, [...workflows.held]]]);
     for (const entry of entries) {
         if (entry.held !== undefined) {
             const dir = resolvePath(cwd, entry.dir);
-            commands.set(dir, [...(commands.get(dir) ?? []), entry.held]);
+            commands.set(dir, [...(commands.get(dir) ?? []), ...entry.held]);
         }
     }
     const held = [];
     for (const [dir, texts] of commands) {
-        const named = spelledFiles(texts.join("\n"), dir, spelled);
-        if (named.length > 0) {
-            const paths = named.map((file) => relativePath(targetRoot, file.fileName) ?? file.fileName);
-            held.push({ dir, files: paths });
+        const named = spelledFiles(heldWords(texts), dir, root, spelled);
+        if (named.files.length > 0 || named.unwritten) {
+            const paths = named.files.map((file) => relativePath(targetRoot, file.fileName) ?? file.fileName);
+            held.push({ dir, files: paths, unwritten: named.unwritten });
         }
     }
     return held;