@cplieger/deadset-ts 8.0.0-dev.6 → 8.0.0-dev.7

package/dist/src/configuration-files.js

@@ -7,8 +7,12 @@
  * uses it and each relative one that names a source file of the program roots the file.
  */
 import { isCallExpression, isExportDeclaration, isIdentifier, isImportDeclaration, isNoSubstitutionTemplateLiteral, isStringLiteral, SyntaxKind, } from "@typescript/native/ast";
-import { dirnamePath, joinPath, relativePath, resolvePath } from "./paths.js";
-const MANIFEST = "package.json";
+import { ancestors, dirnamePath, joinPath, relativePath, resolvePath } from "./paths.js";
+import { bytewise } from "./text/compare.js";
+import { isRecord } from "./json-document.js";
+import { filesIn } from "./fs/tree.js";
+import { holdsManifest, inInstalledPackages, manifestAt, readJSON } from "./fs/manifest.js";
+import { shellWords } from "./text/shell.js";
 /** A configuration module's name, each form with the spelling a root reports it by. */
 const MODULE_FORMS = [
     { name: /^[\w-]+\.config\.(?:js|mjs|cjs|ts|mts|cts)$/u, form: "<stem>.config.<ext>" },
@@ -50,18 +54,14 @@ export const RESOLVED_EXTENSIONS = [
     ".mjs",
     ".cjs",
 ];
-/** The directory a package manager installs packages into, whose files are no project's own. */
-const MODULES_DIR = "node_modules";
 /** The file's name, the last segment of its path. */
 function basename(path) {
     return path.slice(path.lastIndexOf("/") + 1);
 }
 /** Whether one path is the project's own: below the target root and in no `node_modules`. */
 function isProjectPath(root, path) {
-    return relativePath(root, path)?.split("/").includes(MODULES_DIR) === false;
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
+    const below = relativePath(root, path);
+    return below !== undefined && !inInstalledPackages(below);
 }
 /** The form one file name is as a configuration module, or undefined where it is none. */
 export function configurationModuleForm(name) {
@@ -75,122 +75,13 @@ export function isConfigurationDocumentName(name) {
 const CONFIG_FLAGS = new Set(["--config", "-c"]);
 /** The extensions of a module a configuration flag may name. */
 const MODULE_EXTENSIONS = [".js", ".mjs", ".cjs", ".ts", ".mts", ".cts"];
-/** The characters that end a word outside quotes and separate nothing: blanks. */
-// Stryker disable next-line Regex: its \v to \V mutant is no valid escape under the u flag, so the whole module fails to parse
-const BLANK = /[ \t\r\f\v]/u;
-/** The characters that end a word outside quotes and begin an operator: newline included. */
-const OPERATOR = /[\n;&|()<>]/u;
-/** The characters a backslash escapes inside double quotes; before any other it stands for itself. */
-const DOUBLE_QUOTE_ESCAPES = new Set(["$", "`", '"', "\\"]);
-/**
- * The words of one command line, as POSIX token recognition reads quotes, backslashes,
- * line continuations, comments and operators. A word an expansion may change (an unquoted
- * `$`, backquote, glob character or leading `~`, or a `$` or backquote in double quotes)
- * is computed, and so is the rest of a line whose quote is never closed. A computed word
- * and each operator are undefined, so a flag's file is never read across them.
- */
-function shellWords(command) {
-    const words = [];
-    let word;
-    let computed = false;
-    const end = () => {
-        if (word !== undefined) {
-            words.push(computed ? undefined : word);
-        }
-        word = undefined;
-        computed = false;
-    };
-    for (let at = 0; at < command.length; at += 1) {
-        const char = command.charAt(at);
-        if (char === "\\" && command.charAt(at + 1) === "\n") {
-            at += 1;
-        }
-        else if (BLANK.test(char)) {
-            end();
-        }
-        else if (OPERATOR.test(char)) {
-            end();
-            words.push(undefined);
-        }
-        else if (char === "#" && word === undefined) {
-            const newline = command.indexOf("\n", at);
-            at = newline < 0 ? command.length : newline - 1;
-        }
-        else if (char === "\\") {
-            at += 1;
-            word = (word ?? "") + command.charAt(at);
-        }
-        else if (char === "'" || char === '"') {
-            const close = closingQuote(command, at);
-            if (close < 0) {
-                word ??= "";
-                computed = true;
-                break;
-            }
-            const quoted = char === "'"
-                ? { text: command.slice(at + 1, close), computed: false }
-                : doubleQuoted(command.slice(at + 1, close));
-            word = (word ?? "") + quoted.text;
-            computed ||= quoted.computed;
-            at = close;
-        }
-        else {
-            computed ||= /[$`*?[]/u.test(char) || (char === "~" && word === undefined);
-            word = (word ?? "") + char;
-        }
-    }
-    end();
-    return words;
-}
-/** The text between one pair of double quotes, unescaped, and whether an expansion may change it. */
-function doubleQuoted(inner) {
-    let text = "";
-    let computed = false;
-    for (let at = 0; at < inner.length; at += 1) {
-        const char = inner.charAt(at);
-        const next = inner.charAt(at + 1);
-        if (char === "\\" && next === "\n") {
-            at += 1;
-        }
-        else if (char === "\\" && DOUBLE_QUOTE_ESCAPES.has(next)) {
-            text += next;
-            at += 1;
-        }
-        else {
-            computed ||= char === "$" || char === "`";
-            text += char;
-        }
-    }
-    return { text, computed };
-}
-/** The index of the quote that closes the one at `open`, or -1 where none does. */
-function closingQuote(command, open) {
-    const quote = command.charAt(open);
-    for (let at = open + 1; at < command.length; at += 1) {
-        const char = command.charAt(at);
-        if (char === quote) {
-            return at;
-        }
-        if (quote === '"' && char === "\\") {
-            at += 1;
-        }
-    }
-    return -1;
-}
 /**
  * The files the scripts of the manifest in one directory name after a configuration flag,
  * `--config <file>`, `-c <file>` or `--config=<file>`, each a JSON file or a module below
  * the target root and in no `node_modules`.
  */
 function scriptConfigurations(host, root, dir) {
-    let scripts;
-    try {
-        const manifest = JSON.parse(host.readFile(joinPath(dir, MANIFEST)));
-        scripts = isRecord(manifest) ? manifest["scripts"] : undefined;
-    }
-    catch {
-        return [];
-    }
+    const scripts = manifestAt(host, dir)?.["scripts"];
     if (!isRecord(scripts)) {
         return [];
     }
@@ -217,15 +108,6 @@ function scriptConfigurations(host, root, dir) {
     }
     return found;
 }
-/** The decoded value of one JSON file, or undefined where it cannot be read or parsed. */
-function readDocument(host, path) {
-    try {
-        return JSON.parse(host.readFile(path));
-    }
-    catch {
-        return undefined;
-    }
-}
 /** Every string value one decoded JSON value holds at any depth. */
 export function documentStrings(value) {
     if (typeof value === "string") {
@@ -258,10 +140,10 @@ export function moduleStrings(file) {
 export function configurationFiles(host, targetRoot, files, parse) {
     const root = resolvePath(host.workingDirectory(), targetRoot);
     const manifests = new Map();
-    const holdsManifest = (dir) => {
+    const manifestHeld = (dir) => {
         let held = manifests.get(dir);
         if (held === undefined) {
-            held = host.kindOf(joinPath(dir, MANIFEST)) === "file";
+            held = holdsManifest(host, dir);
             manifests.set(dir, held);
         }
         return held;
@@ -271,30 +153,23 @@ export function configurationFiles(host, targetRoot, files, parse) {
     for (const file of files.byPath.values()) {
         const form = configurationModuleForm(basename(file.fileName));
         const fileDir = dirnamePath(file.fileName);
-        if (form !== undefined && holdsManifest(fileDir)) {
+        if (form !== undefined && manifestHeld(fileDir)) {
             modules.push({ file, form, manifestDir: fileDir });
         }
-        for (let dir = dirnamePath(file.fileName); relativePath(root, dir) !== undefined && !dirs.has(dir); dir = dirnamePath(dir)) {
+        for (const dir of ancestors(dirnamePath(file.fileName), root)) {
+            if (dirs.has(dir)) {
+                break;
+            }
             dirs.add(dir);
         }
     }
     const pending = [];
     const named = [];
-    for (const dir of [...dirs].sort()) {
-        if (!holdsManifest(dir)) {
+    for (const dir of [...dirs].sort(bytewise)) {
+        if (!manifestHeld(dir)) {
             continue;
         }
-        let names;
-        try {
-            names = host
-                .readDirectory(dir)
-                .filter((entry) => !entry.directory && isConfigurationDocumentName(entry.name))
-                .map((entry) => entry.name)
-                .sort();
-        }
-        catch {
-            names = [];
-        }
+        const names = filesIn(host, dir, isConfigurationDocumentName);
         pending.push(...names.map((name) => ({ path: joinPath(dir, name), manifestDir: dir })));
         for (const path of scriptConfigurations(host, root, dir)) {
             const held = files.byName.get(path);
@@ -318,7 +193,7 @@ export function configurationFiles(host, targetRoot, files, parse) {
             continue;
         }
         if (document === undefined) {
-            const value = readDocument(host, next.path);
+            const value = readJSON(host, next.path);
             if (value === undefined) {
                 unreadable.add(next.path);
                 continue;
@@ -343,7 +218,7 @@ export function configurationFiles(host, targetRoot, files, parse) {
         documents: [...documents.values()],
         outside: parse === undefined
             ? []
-            : outsideModules(host, root, [...dirs], files, holdsManifest, parse, named),
+            : outsideModules(host, root, [...dirs], files, manifestHeld, parse, named),
     };
 }
 /** The literal module specifier one `require(...)` or `import(...)` call names, if any. */
@@ -429,23 +304,13 @@ export function resolveRelativeSpecifier(host, dir, specifier) {
  * does not hold, and the project files below `root` they import by a relative specifier,
  * until no further file joins. A file that cannot be read is skipped.
  */
-function outsideModules(host, root, dirs, files, holdsManifest, parse, named) {
+function outsideModules(host, root, dirs, files, manifestHeld, parse, named) {
     const pending = [...named];
-    for (const dir of [...dirs].sort()) {
-        if (!holdsManifest(dir)) {
-            continue;
-        }
-        let names;
-        try {
-            names = host
-                .readDirectory(dir)
-                .filter((entry) => !entry.directory && configurationModuleForm(entry.name) !== undefined)
-                .map((entry) => entry.name)
-                .sort();
-        }
-        catch {
+    for (const dir of [...dirs].sort(bytewise)) {
+        if (!manifestHeld(dir)) {
             continue;
         }
+        const names = filesIn(host, dir, (name) => configurationModuleForm(name) !== undefined);
         pending.push(...names.map((name) => ({ path: joinPath(dir, name), manifestDir: dir })));
     }
     const found = new Map();
@@ -481,14 +346,8 @@ function outsideModules(host, root, dirs, files, holdsManifest, parse, named) {
 }
 /** Every dependency the manifest in one directory declares, or none where it holds none to read. */
 export function declaredIn(host, dir) {
-    let value;
-    try {
-        value = JSON.parse(host.readFile(joinPath(dir, MANIFEST)));
-    }
-    catch {
-        return [];
-    }
-    if (!isRecord(value)) {
+    const value = manifestAt(host, dir);
+    if (value === undefined) {
         return [];
     }
     const names = new Set();

package/dist/src/contract/contract.generated.js

@@ -19,6 +19,19 @@ export const FORMATS = [
     "sarif",
     "template",
 ];
+/** Each analyzed language's row: its analyzer, the names that mark it and the directories it skips. */
+export const LANGUAGE_ROWS = {
+    go: {
+        analyzer: "deadset-go",
+        markers: ["go.mod"],
+        skippedDirectories: ["node_modules", "testdata", "vendor", ".*", "_*"],
+    },
+    ts: {
+        analyzer: "deadset-ts",
+        markers: ["tsconfig*.json"],
+        skippedDirectories: ["node_modules", ".git"],
+    },
+};
 export const EXIT_CLEAN = 0;
 export const EXIT_FINDINGS = 1;
 export const EXIT_USAGE = 2;

package/dist/src/conventions.js

@@ -5,14 +5,19 @@
  * directory a configuration property moves read from the property's literal value.
  * No configuration file is run.
  */
-import { isArrayLiteralExpression, isAsExpression, isBinaryExpression, isCallExpression, isClassDeclaration, isComputedPropertyName, isExportAssignment, isExportDeclaration, isExpressionStatement, isFunctionDeclaration, isIdentifier, isImportDeclaration, isNamedExports, isNamespaceImport, isNoSubstitutionTemplateLiteral, isNonNullExpression, isNumericLiteral, isObjectBindingPattern, isObjectLiteralExpression, isParenthesizedExpression, isPropertyAccessExpression, isPropertyAssignment, isSatisfiesExpression, isShorthandPropertyAssignment, isSpreadAssignment, isStringLiteral, isVariableStatement, SyntaxKind, } from "@typescript/native/ast";
+import { isArrayLiteralExpression, isBinaryExpression, isCallExpression, isClassDeclaration, isComputedPropertyName, isExportAssignment, isExportDeclaration, isExpressionStatement, isFunctionDeclaration, isIdentifier, isImportDeclaration, isNamedExports, isNamespaceImport, isNoSubstitutionTemplateLiteral, isNumericLiteral, isObjectBindingPattern, isObjectLiteralExpression, isPropertyAccessExpression, isPropertyAssignment, isShorthandPropertyAssignment, isSpreadAssignment, isStringLiteral, isVariableStatement, SyntaxKind, } from "@typescript/native/ast";
 import { lineOf } from "./component-files.js";
 import { CONVENTION_ROWS, } from "./convention-rows.js";
 import { documentStrings } from "./configuration-files.js";
-import { globExpression } from "./glob.js";
-import { dirnamePath, joinPath, normalizePath, relativePath, resolvePath } from "./paths.js";
+import { ancestors, dirnamePath, joinPath, normalizePath, relativePath, resolvePath, } from "./paths.js";
 import { satisfies } from "./version-range.js";
-import { yamlDocument } from "./yaml-document.js";
+import { bytewise } from "./text/compare.js";
+import { isRecord } from "./json-document.js";
+import { unwrapped } from "./unwrap.js";
+import { filesIn } from "./fs/tree.js";
+import { INSTALLED_PACKAGES, MANIFEST, readJSON } from "./fs/manifest.js";
+import { globExpression } from "./text/glob.js";
+import { yamlDocument } from "./text/yaml.js";
 const JSON_EXTENSION = ".json";
 /**
  * A configuration file its tool reads as a YAML document, read as the JSON document it
@@ -29,17 +34,6 @@ const DEPENDENCY_SECTIONS = [
     "peerDependencies",
     "optionalDependencies",
 ];
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readJSON(host, path) {
-    try {
-        return JSON.parse(host.readFile(path));
-    }
-    catch {
-        return undefined;
-    }
-}
 function declares(manifest, name, sections = DEPENDENCY_SECTIONS) {
     if (!isRecord(manifest)) {
         return false;
@@ -55,32 +49,15 @@ function declares(manifest, name, sections = DEPENDENCY_SECTIONS) {
  * none, or `undefined` where no `node_modules` holds it.
  */
 function installedVersion(host, dir, name) {
-    for (let at = normalizePath(dir);; at = dirnamePath(at)) {
-        const path = joinPath(at, "node_modules", name, "package.json");
+    for (const at of ancestors(dir)) {
+        const path = joinPath(at, INSTALLED_PACKAGES, name, MANIFEST);
         if (host.kindOf(path) === "file") {
             const manifest = readJSON(host, path);
             const version = isRecord(manifest) ? manifest["version"] : undefined;
             return typeof version === "string" ? version : "";
         }
-        if (dirnamePath(at) === at) {
-            return undefined;
-        }
     }
-}
-/** Whether one node wraps an expression without changing its value. */
-function isWrapper(node) {
-    return (isParenthesizedExpression(node) ||
-        isAsExpression(node) ||
-        isSatisfiesExpression(node) ||
-        isNonNullExpression(node));
-}
-/** The expression a wrapper that changes no value holds. */
-function unwrapped(node) {
-    let at = node;
-    while (isWrapper(at)) {
-        at = at.expression;
-    }
-    return at;
+    return undefined;
 }
 /** The key one property is written with, where it is written as a name or as literal text. */
 function keyOf(property) {
@@ -569,17 +546,7 @@ function expand(template, resolved) {
 /** The configuration files in one directory that one glob names, by name. */
 function configurationFiles(host, dir, glob) {
     const expression = globExpression(glob);
-    let entries;
-    try {
-        entries = host.readDirectory(dir);
-    }
-    catch {
-        return [];
-    }
-    return entries
-        .filter((entry) => !entry.directory && expression.test(entry.name))
-        .map((entry) => entry.name)
-        .sort();
+    return filesIn(host, dir, (name) => expression.test(name));
 }
 function resolveMove(host, parse, dir, row, move, resolved) {
     const set = [];
@@ -667,7 +634,7 @@ function shortNameUses(host, parse, dir, manifest, readings) {
             }
         }
     }
-    return [...used].filter((name) => declared.has(name)).sort(compare);
+    return [...used].filter((name) => declared.has(name)).sort(bytewise);
 }
 /**
  * The package one value of a prefixed-name reading names, or none: ESLint's own naming,
@@ -718,7 +685,7 @@ function prefixedNameUses(host, parse, dir, manifest, readings) {
             }
         }
     }
-    return [...used].sort(compare);
+    return [...used].sort(bytewise);
 }
 /** The declared dependencies an applied row's helper settings use. */
 function helperUses(host, parse, dir, manifest, readings) {
@@ -775,13 +742,6 @@ function packageKeyUses(host, parse, dir, manifest, keys) {
         text.startsWith(`${name}/`) ||
         (text.startsWith(`${name}:`) && text.length > name.length + 1)));
 }
-/** Two strings ordered bytewise. */
-function compare(a, b) {
-    if (a === b) {
-        return 0;
-    }
-    return a < b ? -1 : 1;
-}
 /**
  * What the rows decide over the manifests the analysis reads. A row `disabled` names
  * is skipped before anything is read for it.
@@ -795,7 +755,7 @@ export function readConventions(host, parse, manifests, disabled, rows = CONVENT
     const selected = new Map();
     const testFiles = new Set();
     for (const manifest of manifests) {
-        const declared = readJSON(host, joinPath(manifest.dir, "package.json"));
+        const declared = readJSON(host, joinPath(manifest.dir, MANIFEST));
         const versions = new Map();
         const missing = new Set();
         for (const row of rows) {
@@ -893,15 +853,15 @@ export function readConventions(host, parse, manifests, disabled, rows = CONVENT
         }
     }
     const unique = [...new Map(applied.map((one) => [JSON.stringify(one), one])).values()];
-    unique.sort((a, b) => compare(a.name, b.name) ||
-        compare(a.manifest, b.manifest) ||
-        compare(JSON.stringify(a), JSON.stringify(b)));
+    unique.sort((a, b) => bytewise(a.name, b.name) ||
+        bytewise(a.manifest, b.manifest) ||
+        bytewise(JSON.stringify(a), JSON.stringify(b)));
     return {
         applied: unique,
         globs,
         generated,
         failures,
-        uses: [...uses].sort(compare),
+        uses: [...uses].sort(bytewise),
         selected,
         testFiles,
     };

package/dist/src/dependencies.js

@@ -10,14 +10,15 @@ import { isArrayLiteralExpression, isCallExpression, isExportDeclaration, isExpr
 import { automaticTypes } from "./automatic-types.js";
 import { configurationFiles, declaredIn as declaredBeside, dependenciesNamed, moduleStrings, outsideChain, } from "./configuration-files.js";
 import { nodeKey, packageScope } from "./inventory.js";
-import { scriptTokens } from "./manifest.js";
-import { dirnamePath, isAbsolutePath, joinPath, relativePath, resolvePath } from "./paths.js";
+import { ancestors, dirnamePath, isAbsolutePath, joinPath, relativePath, resolvePath, } from "./paths.js";
 import { UNANSWERED } from "./query.js";
 import { sourceFilesOf } from "./source-files.js";
 import { workflowCommands, workflowTokens } from "./workflow-steps.js";
-const MANIFEST = "package.json";
-const MODULES_DIR = "node_modules";
-const MODULES_SEGMENT = `/${MODULES_DIR}/`;
+import { bytewise } from "./text/compare.js";
+import { isRecord } from "./json-document.js";
+import { inInstalledPackages, INSTALLED_PACKAGES, MANIFEST, readDocument } from "./fs/manifest.js";
+import { commandsOf, scriptTokens } from "./text/shell.js";
+const MODULES_SEGMENT = `/${INSTALLED_PACKAGES}/`;
 const TYPES_SCOPE = "@types/";
 /** A script token naming a JavaScript file by a path no expansion changes. */
 const SCRIPT_FILE = /^[^$`{*?[~]+\.(?:js|mjs|cjs)$/u;
@@ -39,25 +40,6 @@ export function configurationNeeds(packages) {
 }
 /** The key of {@link ProjectNeeds.at} for a use no file of the target governs. */
 const ANYWHERE = "";
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** One JSON document's decoded value, or undefined where it cannot be read or parsed. */
-function readJSON(host, path) {
-    let text;
-    try {
-        text = host.readFile(path);
-    }
-    catch {
-        return undefined;
-    }
-    try {
-        return { text, value: JSON.parse(text) };
-    }
-    catch {
-        return undefined;
-    }
-}
 /**
  * The package a bare module specifier names: its first segment, or its first two
  * where it starts with a scope. A relative, absolute or scheme-prefixed specifier and
@@ -280,7 +262,7 @@ export function projectNeeds(project, held, host, targetRoot, parse) {
     }
     for (const { strings, manifestDirs } of configuration.documents) {
         for (const manifestDir of manifestDirs) {
-            const names = declaredAt(joinPath(manifestDir, "package.json"));
+            const names = declaredAt(joinPath(manifestDir, MANIFEST));
             for (const text of strings) {
                 use([PROJECT_OWNER], dependenciesNamed(text, names), joinPath(manifestDir, MANIFEST));
             }
@@ -289,7 +271,7 @@ export function projectNeeds(project, held, host, targetRoot, parse) {
     const ranFiles = outsideChain(host, targetRoot, files, parse, scriptRunFiles(host, targetRoot, files));
     for (const { file, manifestDirs } of [...configuration.outside, ...ranFiles]) {
         for (const manifestDir of manifestDirs) {
-            const names = declaredAt(joinPath(manifestDir, "package.json"));
+            const names = declaredAt(joinPath(manifestDir, MANIFEST));
             for (const { text } of moduleStrings(file)) {
                 use([PROJECT_OWNER], dependenciesNamed(text, names), joinPath(manifestDir, MANIFEST));
             }
@@ -307,8 +289,8 @@ function scriptRunFiles(host, targetRoot, files) {
     const root = resolvePath(host.workingDirectory(), targetRoot);
     const dirs = new Set([root]);
     for (const name of files.byName.keys()) {
-        for (let dir = dirnamePath(name); !dirs.has(dir); dir = dirnamePath(dir)) {
-            if (relativePath(root, dir) === undefined) {
+        for (const dir of ancestors(dirnamePath(name), root)) {
+            if (dirs.has(dir)) {
                 break;
             }
             dirs.add(dir);
@@ -318,7 +300,7 @@ function scriptRunFiles(host, targetRoot, files) {
         [root, new Set(workflowTokens(host, root))],
     ]);
     for (const dir of dirs) {
-        const read = readJSON(host, joinPath(dir, MANIFEST));
+        const read = readDocument(host, joinPath(dir, MANIFEST));
         if (read !== undefined && isRecord(read.value)) {
             const own = scriptTokensOf(read.value);
             tokens.set(dir, dir === root ? new Set([...own, ...(tokens.get(root) ?? [])]) : own);
@@ -330,7 +312,8 @@ function scriptRunFiles(host, targetRoot, files) {
             const path = SCRIPT_FILE.test(token) ? resolvePath(manifestDir, token) : undefined;
             const below = path === undefined ? undefined : relativePath(root, path);
             if (path !== undefined &&
-                below?.split("/").includes(MODULES_DIR) === false &&
+                below !== undefined &&
+                !inInstalledPackages(below) &&
                 !files.byName.has(path) &&
                 host.kindOf(path) === "file") {
                 found.push({ path, manifestDir });
@@ -600,8 +583,8 @@ function lineAndColumn(text, offset) {
 }
 /** The installed copy of one dependency, read where the package manager puts it for the target. */
 function installedOf(host, root, name) {
-    for (let dir = root;; dir = dirnamePath(dir)) {
-        const read = readJSON(host, joinPath(dir, MODULES_DIR, name, MANIFEST));
+    for (const dir of ancestors(root)) {
+        const read = readDocument(host, joinPath(dir, INSTALLED_PACKAGES, name, MANIFEST));
         if (read !== undefined && isRecord(read.value)) {
             const bin = read.value["bin"];
             const peers = read.value["peerDependencies"];
@@ -617,10 +600,8 @@ function installedOf(host, root, name) {
                         : [],
             };
         }
-        if (dirnamePath(dir) === dir) {
-            return undefined;
-        }
     }
+    return undefined;
 }
 /** Every dependency the manifest text at `path` declares, in the order the text writes them. */
 function declaredIn(text, manifest, path, scope) {
@@ -694,8 +675,6 @@ const PRELOADING_PROGRAMS = new Set([
 /** The programs that run the command after them, and an environment assignment before it. */
 const LAUNCHERS = new Set(["cross-env", "env", "npx"]);
 const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/u;
-/** The commands one script string runs, split at the shell's list and pipeline operators. */
-const COMMAND_SEPARATORS = /&&|\|\||;|\||&/u;
 /**
  * The command strings one manifest runs: each of its `scripts`, and the `exec` command of
  * nodemon's configuration, in the manifest's `nodemonConfig` or the `nodemon.json` beside
@@ -704,7 +683,10 @@ const COMMAND_SEPARATORS = /&&|\|\||;|\||&/u;
  */
 function manifestCommands(host, dir, manifest) {
     const scripts = manifest["scripts"];
-    const nodemon = [manifest["nodemonConfig"], readJSON(host, joinPath(dir, "nodemon.json"))?.value];
+    const nodemon = [
+        manifest["nodemonConfig"],
+        readDocument(host, joinPath(dir, "nodemon.json"))?.value,
+    ];
     return [
         ...(isRecord(scripts) ? Object.values(scripts) : []),
         ...nodemon.map((config) => (isRecord(config) ? config["exec"] : undefined)),
@@ -718,7 +700,7 @@ function manifestCommands(host, dir, manifest) {
 function preloadsOf(scripts) {
     const found = new Set();
     for (const script of scripts) {
-        for (const command of script.split(COMMAND_SEPARATORS)) {
+        for (const command of commandsOf(script)) {
             const tokens = scriptTokens(command);
             let at = 0;
             while (at < tokens.length &&
@@ -833,7 +815,7 @@ export function dependenciesOf(host, targetRoot, perProject, candidates, members
     const peers = new Map();
     const uninstalledHere = new Set(nested);
     for (const [dir, path] of manifests) {
-        const read = readJSON(host, joinPath(dir, MANIFEST));
+        const read = readDocument(host, joinPath(dir, MANIFEST));
         if (read === undefined || !isRecord(read.value)) {
             continue;
         }
@@ -909,7 +891,7 @@ export function dependenciesOf(host, targetRoot, perProject, candidates, members
     const heldBy = new Map();
     for (const [key, held] of holders) {
         if (!live.has(key) && !ran.has(key)) {
-            heldBy.set(key, [...held].sort((a, b) => (a < b ? -1 : 1)));
+            heldBy.set(key, [...held].sort(bytewise));
         }
     }
     const users = new Map();
@@ -921,7 +903,7 @@ export function dependenciesOf(host, targetRoot, perProject, candidates, members
     for (const id of candidates) {
         const sole = [...(uses.get(id) ?? [])].filter((one) => users.get(one) === 1 && names.has(one));
         if (sole.length > 0) {
-            lastUses.set(id, sole.sort((a, b) => (a < b ? -1 : 1)));
+            lastUses.set(id, sole.sort(bytewise));
         }
     }
     const owners = new Map();
@@ -933,7 +915,7 @@ export function dependenciesOf(host, targetRoot, perProject, candidates, members
         }
     }
     const fileLastUses = new Map();
-    for (const [one, held] of [...owners].sort(([a], [b]) => (a < b ? -1 : 1))) {
+    for (const [one, held] of [...owners].sort(([a], [b]) => bytewise(a, b))) {
         const paths = new Set([...held].map((owner) => owner.replace(/:\d+:\d+$/u, "")));
         const [path] = paths;
         if (paths.size === 1 && path !== undefined && path !== PROJECT_OWNER) {