@tinvar/renderer 0.0.0-stage → 0.4.0

package/src/vite.js

@@ -0,0 +1,2416 @@
+// Which views contain a <Deferred> boundary, read from the renderer build.
+//
+// ADR 0009: "A page with no deferred boundaries cannot be talked into
+// minting" -- which holds only while PHP knows, before a page renders, which
+// pages have boundaries. Only the build knows that. A boundary is an ordinary
+// server component somewhere in a page's module graph -- in the page, in a
+// component it imports, in its layout -- and the graph exists whole only
+// while the bundler has it. So the rsc build writes it down: for every module
+// under the app's pages directory, the <Deferred> components reachable from
+// it. `tinvar build:fragments` joins that with the route registry, which says
+// which views each route renders, into the FragmentManifest PHP reads.
+//
+// Reachability is the bundler's, not a guess from file names: it follows the
+// imports the rsc environment actually resolved, so an alias, a package or a
+// re-export reaches the boundary the way the render will. A 'use client'
+// module is a client reference in that graph, its own imports gone -- which
+// is right, since a client component cannot render a server one.
+//
+// The component names are read from each module that imports Deferred, as
+// the literal its `component` names. Anything that cannot be read as one --
+// a computed name, Deferred passed around as a value, re-exported -- is
+// written as "*": the route defers, with any component. Unreadable widens;
+// it never narrows, because a route left out would have no minter, and its
+// boundaries would fail to render.
+//
+// The same walk over the same graph also writes down the query names each
+// view can call, and each deferred component -- see "The queries each view
+// may call" below. They go in the same file, so the two halves PHP joins
+// with the routes always come from one build.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, dirname, extname, relative, resolve, sep } from 'node:path';
+import { getPluginApi } from '@vitejs/plugin-rsc';
+import { parseAst } from 'vite';
+import { QUERIES_MODULE, QUERY_MAP, readQueryMap, UnreadableQuery } from './query-map.js';
+import {
+  MANIFEST_STYLES,
+  moduleOwnership,
+  partitionRules,
+  STYLES_MODULE,
+  styleXRenderer,
+  stylesModule,
+} from './panel-styles.js';
+
+// The build's other helper: one chunk per client component.
+export { clientChunkName, clientComponentChunks } from './client-chunks.js';
+// The profile the build was made for, recorded in it (ADR 0066).
+export { BuildProfileRefused, buildProfile, PROFILE_FILE, profileOf } from './build-profile.js';
+// Where the assets are loaded from, and each script's digest (ADR 0097).
+export {
+  ASSETS_FILE,
+  ASSETS_MODULE,
+  AssetOriginRefused,
+  assetOrigin,
+  assetOriginOf,
+  hintsOf,
+  integrityAskedOf,
+  integrityOf,
+  MANIFEST_INTEGRITY,
+  withStylesheetIntegrity,
+} from './asset-origin.js';
+// A panel's styles, in a sheet of its own (ADR 0109).
+export {
+  clientIdOf,
+  MANIFEST_STYLES,
+  moduleOwnership,
+  partitionRules,
+  STYLES_MODULE,
+  styleXRenderer,
+  stylesModule,
+} from './panel-styles.js';
+// And the check that no server component hands a client one a function.
+export { clientExports, functionProps, serializableProps, UnserializableProp } from './client-props.js';
+// What codegen writes about the queries, read here and by the lint.
+export { QUERY_MAP, readQueryMap, readQueryAuthorization, UnreadableQuery } from './query-map.js';
+
+/** Where the manifest goes, beside the rsc entry. */
+export const DEFERRED_MANIFEST = 'deferred.json';
+
+/** The specifier the app imports <Deferred> by. */
+export const DEFERRED_SPECIFIER = '@tinvar/react/deferred';
+
+/**
+ * The package root, which re-exports <Deferred> under `react-server` beside
+ * query(), nonce() and the rest -- so importing from it says nothing about
+ * boundaries until the import names Deferred.
+ */
+export const ROOT_SPECIFIER = '@tinvar/react';
+
+/** Any component: a boundary whose name the build could not read. */
+export const ANY_COMPONENT = '*';
+
+const SOURCE = /\.(?:[cm]?[jt]sx?)$/;
+
+/**
+ * The plugin. Only the rsc environment has the server component graph; the
+ * client and ssr builds are left alone.
+ *
+ * @param {{ pages?: string, fileName?: string, queryMap?: string }} [options] `pages` is the
+ *        directory whose modules are views, relative to the Vite root: a view
+ *        id is a module's path under it without the extension, which is how
+ *        `#[Page(view: 'shop/order')]` names `resources/pages/shop/order.tsx`.
+ *        `queryMap` is where `tinvar codegen` wrote which query each
+ *        `@queries/*` function calls, relative to the root.
+ */
+export function deferredBoundaries({
+  pages = 'resources/pages',
+  fileName = DEFERRED_MANIFEST,
+  queryMap = QUERY_MAP,
+} = {}) {
+  let root = process.cwd();
+
+  return {
+    name: 'tinvar:deferred-boundaries',
+    apply: 'build',
+    configResolved(config) {
+      root = config.root;
+    },
+    applyToEnvironment(environment) {
+      return environment.name === 'rsc';
+    },
+    async generateBundle() {
+      const pagesDir = resolve(root, pages);
+
+      /** @type {Map<string, string[]>} module id => the ids it imports */
+      const graph = new Map();
+      for (const id of this.getModuleIds()) {
+        const info = this.getModuleInfo(id);
+        // Dynamic imports too: a server component loaded lazily renders as
+        // surely as one imported at the top.
+        if (info) graph.set(id, [...info.importedIds, ...info.dynamicallyImportedIds]);
+      }
+
+      const resolveId = async (specifier, importer) => (await this.resolve(specifier, importer))?.id ?? null;
+      const users = await boundaryUsers(graph, pagesDir, resolveId);
+      // Throws, failing the build, for a call whose name cannot be read.
+      const callers = await queryUsers(graph, pagesDir, resolveId, readQueryMap(resolve(root, queryMap)));
+      const actions = await actionsOf(graph, callers.registry, pagesDir, resolveId);
+
+      this.emitFile({
+        type: 'asset',
+        fileName,
+        source:
+          JSON.stringify(
+            {
+              format: 1,
+              views: viewsOf(graph, users, pagesDir),
+              queries: queriesOfViews(graph, callers.calls, pagesDir),
+              componentQueries: queriesOfComponents(graph, callers.calls, callers.registry),
+              actions: actions.views,
+              componentActions: actions.components,
+            },
+            null,
+            2,
+          ) + '\n',
+      });
+    },
+  };
+}
+
+/**
+ * The modules that render a <Deferred> boundary, with the components each
+ * names: every module importing the Deferred module, or the package root
+ * that re-exports it, read from its own source. One reading for the build
+ * and for the dev server (dev-server.js), so a route may mint in dev
+ * exactly when it could from a build of the same source.
+ *
+ * The root's own entry module is no user: it re-exports Deferred, which
+ * reads as unreadable, and every view importing nonce() from the root would
+ * then have minted for any component.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids
+ * @param {string} pagesDir absolute; what the two specifiers resolve from
+ * @param {(specifier: string, importer: string) => Promise<string | null>} resolveId
+ *        as the rsc environment resolves, under `react-server`
+ * @returns {Promise<Map<string, string[]>>}
+ */
+export async function boundaryUsers(graph, pagesDir, resolveId) {
+  const importer = resolve(pagesDir, 'index.tsx');
+  const deferredId = await resolveId(DEFERRED_SPECIFIER, importer);
+  const rootId = await resolveId(ROOT_SPECIFIER, importer);
+
+  /** @type {Map<string, string[]>} */
+  const users = new Map();
+  if (deferredId === null) return users;
+
+  for (const [id, imports] of graph) {
+    if (id === rootId) continue;
+    if (!imports.includes(deferredId) && (rootId === null || !imports.includes(rootId))) continue;
+    const file = fileOf(id);
+    // A module another plugin made has no source of its own to read, so
+    // what it renders cannot be named: any component, rather than a failed
+    // build or a boundary left out.
+    if (id.startsWith('\0') || !existsSync(file)) {
+      users.set(id, [ANY_COMPONENT]);
+      continue;
+    }
+    const source = readFileSync(file, 'utf8');
+    const resolved = new Map();
+    for (const specifier of importSources(source, file)) {
+      resolved.set(specifier, await resolveId(specifier, id));
+    }
+    users.set(
+      id,
+      deferredComponents(
+        source,
+        file,
+        (specifier) => resolved.get(specifier) === deferredId,
+        (specifier) => rootId !== null && resolved.get(specifier) === rootId,
+      ),
+    );
+  }
+  return users;
+}
+
+/**
+ * Every view under the pages directory, with the components reachable from
+ * it, sorted; a view with none is listed with an empty list, so a reader can
+ * tell "no boundaries" from "not in this build".
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids
+ * @param {Map<string, string[]>} users module id => the components it names
+ * @param {string} pagesDir absolute
+ * @returns {Record<string, string[]>}
+ */
+export function viewsOf(graph, users, pagesDir) {
+  /** @type {Record<string, string[]>} */
+  const views = {};
+
+  for (const id of [...graph.keys()].sort()) {
+    const file = fileOf(id);
+    const under = relative(pagesDir, file);
+    if (id.startsWith('\0') || under.startsWith('..') || under.startsWith(sep) || !SOURCE.test(file))
+      continue;
+
+    const found = new Set();
+    const seen = new Set([id]);
+    const queue = [id];
+    while (queue.length > 0) {
+      const current = /** @type {string} */ (queue.shift());
+      for (const component of users.get(current) ?? []) found.add(component);
+      for (const next of graph.get(current) ?? []) {
+        if (!seen.has(next)) {
+          seen.add(next);
+          queue.push(next);
+        }
+      }
+    }
+
+    views[under.slice(0, -extname(under).length).split(sep).join('/')] = found.has(ANY_COMPONENT)
+      ? [ANY_COMPONENT]
+      : [...found].sort();
+  }
+
+  return views;
+}
+
+/**
+ * The specifiers a module imports or re-exports from, so the caller can
+ * resolve each and say which name the Deferred module.
+ *
+ * @param {string} source
+ * @param {string} file
+ * @returns {string[]}
+ */
+export function importSources(source, file) {
+  const sources = new Set();
+  walk(parse(source, file), (node) => {
+    if (
+      (node.type === 'ImportDeclaration' ||
+        node.type === 'ExportNamedDeclaration' ||
+        node.type === 'ExportAllDeclaration' ||
+        node.type === 'ImportExpression') &&
+      typeof node.source?.value === 'string'
+    ) {
+      sources.add(node.source.value);
+    }
+  });
+  return [...sources];
+}
+
+/**
+ * The components the <Deferred> boundaries in one module name.
+ *
+ * @param {string} source the module's own source, as written
+ * @param {string} file its path, which says how to parse it
+ * @param {(specifier: string) => boolean} isDeferred whether an import
+ *        specifier in this module names the Deferred module
+ * @param {(specifier: string) => boolean} [isRoot] whether one names the
+ *        package root, which exports Deferred among much else: an import
+ *        from it counts only where it binds Deferred, or the whole module
+ * @returns {string[]} sorted, or ["*"] when one cannot be read
+ */
+export function deferredComponents(source, file, isDeferred, isRoot = () => false) {
+  const program = parse(source, file);
+
+  // The names Deferred is bound to here: `import { Deferred }`, an alias, or
+  // a namespace whose `.Deferred` is the component.
+  const names = new Set();
+  const namespaces = new Set();
+  let unreadable = false;
+  // Whether the Deferred module itself is imported. Imported and used in no
+  // way this can follow is unreadable; the root imported for query() or
+  // nonce() alone is not a boundary at all.
+  let importsDeferred = false;
+
+  for (const node of program.body) {
+    const from = typeof node.source?.value === 'string' ? node.source.value : null;
+    const deferred = from !== null && isDeferred(from);
+    const root = from !== null && !deferred && isRoot(from);
+
+    if (node.type === 'ImportDeclaration' && (deferred || root)) {
+      if (deferred) importsDeferred = true;
+      for (const specifier of node.specifiers) {
+        if (specifier.type === 'ImportSpecifier' && importedName(specifier) === 'Deferred') {
+          names.add(specifier.local.name);
+        } else if (specifier.type === 'ImportNamespaceSpecifier') {
+          namespaces.add(specifier.local.name);
+        }
+      }
+    }
+    // Handed on to another module: whatever renders it there is not read
+    // here. From the root, only a re-export that can carry Deferred: all of
+    // it, a namespace of it, or Deferred by name.
+    if (
+      (node.type === 'ExportNamedDeclaration' || node.type === 'ExportAllDeclaration') &&
+      (deferred ||
+        (root &&
+          (node.type === 'ExportAllDeclaration' ||
+            node.specifiers.some(
+              (/** @type {any} */ specifier) =>
+                (specifier.local?.type === 'Identifier' ? specifier.local.name : specifier.local?.value) ===
+                'Deferred',
+            ))))
+    ) {
+      unreadable = true;
+    }
+  }
+
+  const found = new Set();
+  walk(program, (node, parent) => {
+    if (node.type === 'ImportDeclaration') return false;
+
+    if (
+      node.type === 'ImportExpression' &&
+      typeof node.source?.value === 'string' &&
+      (isDeferred(node.source.value) || isRoot(node.source.value))
+    ) {
+      unreadable = true;
+    }
+
+    if (node.type === 'JSXOpeningElement' && isDeferredElement(node.name, names, namespaces)) {
+      const name = componentName(node.attributes);
+      if (name === null) unreadable = true;
+      else found.add(name);
+      return undefined;
+    }
+
+    // Deferred as a value -- createElement(Deferred), an object of
+    // components, a re-export -- renders a boundary this cannot name. A
+    // namespace read for another of its names -- the root's `tinvar.nonce()`
+    // -- is not one.
+    if (
+      node.type === 'Identifier' &&
+      (names.has(node.name) || namespaces.has(node.name)) &&
+      !isPropertyKey(node, parent) &&
+      !(namespaces.has(node.name) && readsOtherName(node, parent))
+    ) {
+      unreadable = true;
+    }
+    return undefined;
+  });
+
+  // Imported, and used in no way this could follow.
+  if (importsDeferred && names.size === 0 && namespaces.size === 0 && found.size === 0) unreadable = true;
+
+  return unreadable ? [ANY_COMPONENT] : [...found].sort();
+}
+
+/** @param {{ imported: { type: string, name?: string, value?: string } }} specifier */
+function importedName(specifier) {
+  return specifier.imported.type === 'Identifier' ? specifier.imported.name : specifier.imported.value;
+}
+
+function isDeferredElement(name, names, namespaces) {
+  if (name.type === 'JSXIdentifier') return names.has(name.name);
+  return (
+    name.type === 'JSXMemberExpression' &&
+    name.object.type === 'JSXIdentifier' &&
+    namespaces.has(name.object.name) &&
+    name.property.name === 'Deferred'
+  );
+}
+
+/**
+ * The literal a boundary's `component` attribute names, or null when it is
+ * not one: an expression, a template with holes, a spread that might set it.
+ */
+function componentName(attributes) {
+  let name = null;
+  for (const attribute of attributes) {
+    if (attribute.type === 'JSXSpreadAttribute') return null;
+    if (attribute.name?.type !== 'JSXIdentifier' || attribute.name.name !== 'component') continue;
+
+    const value = attribute.value;
+    if (value?.type === 'Literal' && typeof value.value === 'string') {
+      name = value.value;
+    } else if (value?.type === 'JSXExpressionContainer') {
+      const expression = value.expression;
+      if (expression.type === 'Literal' && typeof expression.value === 'string') name = expression.value;
+      else if (expression.type === 'TemplateLiteral' && expression.expressions.length === 0) {
+        name = expression.quasis[0]?.value.cooked ?? null;
+      } else return null;
+    } else return null;
+  }
+  return name;
+}
+
+/** `ns.nonce`: a namespace read for a name, written out, that is not Deferred. */
+function readsOtherName(node, parent) {
+  return (
+    parent?.type === 'MemberExpression' &&
+    parent.object === node &&
+    !parent.computed &&
+    parent.property.type === 'Identifier' &&
+    parent.property.name !== 'Deferred'
+  );
+}
+
+/** `{ Deferred: x }` and `obj.Deferred` name a key, not the binding. */
+function isPropertyKey(node, parent) {
+  return (
+    (parent?.type === 'MemberExpression' && parent.property === node && !parent.computed) ||
+    (parent?.type === 'Property' && parent.key === node && !parent.computed && !parent.shorthand)
+  );
+}
+
+function parse(source, file) {
+  const extension = extname(file);
+  const lang = extension === '.tsx' ? 'tsx' : /^\.[cm]?ts$/.test(extension) ? 'ts' : 'jsx';
+  return parseAst(source, { lang }, file);
+}
+
+/** A module id as the file it was read from: no query, no hash. */
+function fileOf(id) {
+  return id.replace(/[?#].*$/, '');
+}
+
+/** Whether a module's file is a dependency's: anywhere under a node_modules directory. */
+function isDependency(file) {
+  return file.split(/[\\/]/).includes('node_modules');
+}
+
+/**
+ * Depth-first over every node; the visitor returns false to skip a subtree.
+ *
+ * @param {any} node
+ * @param {(node: any, parent: any) => boolean | undefined} visit
+ * @param {any} [parent]
+ */
+function walk(node, visit, parent = null) {
+  if (node === null || typeof node !== 'object') return;
+  if (Array.isArray(node)) {
+    for (const child of node) walk(child, visit, parent);
+    return;
+  }
+  if (typeof node.type !== 'string') return;
+  if (visit(node, parent) === false) return;
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end' || key === 'range' || key === 'loc') continue;
+    const child = node[key];
+    if (child !== null && typeof child === 'object') walk(child, visit, node);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// A panel's client code, in chunks of its own.
+//
+// tinvar-spec.md, "Panels and scope": a panel narrows what a request sees,
+// and the admin panel is staff's. Its pages' server components never leave
+// the server, but the 'use client' components they reach are shipped to the
+// browser -- and @vitejs/plugin-rsc groups every client reference a server
+// chunk reaches into one client chunk, so a customer's page loaded the code
+// of the admin panel's components with its own. Nothing in that code is a
+// secret, and every request it makes is held to the panel's guard; but it
+// maps out what staff can do, it grows every customer's download, and a
+// panel is meant to be a boundary.
+//
+// panelChunks() puts each client reference that only one panel's views reach
+// into a chunk named for that panel, through the RSC plugin's clientChunks
+// option. A reference any other view reaches -- the kit's buttons, the
+// router -- stays shared, which is right: the customer pages ship it anyway.
+// Then it checks what the bundler did with that: no chunk a page outside the
+// panel loads -- the entry and what it imports, the other groups and what
+// they import -- may hold a module only the panel's references reach. A
+// build that breaks that fails. What it found goes in `panels.json` beside
+// the rsc entry, which `tinvar build:fragments` holds to the routes' own
+// panels (PanelBundles), so the views named here and the panels PHP puts
+// the routes in cannot drift apart.
+
+/** Where the panel report goes, beside the rsc entry. */
+export const PANELS_MANIFEST = 'panels.json';
+
+/** A client-reference group's virtual module, as @vitejs/plugin-rsc names it. */
+const GROUP_PREFIX = '\0virtual:vite-rsc/client-references/group/';
+
+/**
+ * @param {{ panels?: Record<string, string>, pages?: string, fileName?: string, styles?: any }} [options]
+ *        `panels` maps each panel to the directory under `pages` its views are
+ *        in -- `{ admin: 'admin' }` puts `admin/orders` in the admin panel.
+ *        `styles`, the app's StyleX plugin, splits its rules into a sheet for
+ *        the pages outside every panel and one for each panel's
+ *        (panel-styles.js), which the document links through
+ *        `virtual:tinvar/styles`
+ * @returns {import('vite').Plugin & { clientChunks: (meta: { id: string }) => string | undefined }}
+ *          the plugin, whose `clientChunks` is handed to the RSC plugin
+ */
+export function panelChunks({
+  panels = {},
+  pages = 'resources/pages',
+  fileName = PANELS_MANIFEST,
+  styles,
+} = {}) {
+  for (const [panel, directory] of Object.entries(panels)) {
+    if (
+      !/^[a-z][a-z0-9-]*$/.test(panel) ||
+      typeof directory !== 'string' ||
+      directory === '' ||
+      directory.startsWith('/')
+    ) {
+      throw new Error(
+        `[tinvar] panelChunks(): '${panel}' needs a lowercase name and a directory under the pages.`,
+      );
+    }
+  }
+
+  let root = process.cwd();
+  /** @type {import('vite').ResolvedConfig | null} */
+  let resolved = null;
+  /** @type {Map<string, string>} a client reference's import id => its panel */
+  const owned = new Map();
+  /** @type {Record<string, string[]>} panel => its views, and its references by file */
+  const report = { views: {}, references: {} };
+
+  /** The StyleX side, when the app hands its plugin over: what the rsc build saw, and the sheets made. */
+  const split = {
+    /** @type {{ graph: Map<string, string[]>, references: Map<string, string>, entries: string[], views: Map<string, string> } | null} */
+    rsc: null,
+    /** @type {{ fileName: string, base: string } | null} the stylesheet StyleX appended to, and what it held before */
+    stylesheet: null,
+    /** @type {{ from: string, fileName: string, source: string } | null} that stylesheet with the shared rules alone, under a name of its own */
+    linked: null,
+    /** @type {{ panels: Record<string, string>, sources: Record<string, string>, owned: Record<string, number>, shared: string } | null} */
+    sheets: null,
+  };
+  const panelOfView = (/** @type {string} */ view) => {
+    for (const [panel, directory] of Object.entries(panels)) {
+      const prefix = directory.replace(/\/+$/, '');
+      if (view === prefix || view.startsWith(`${prefix}/`)) return panel;
+    }
+    return null;
+  };
+
+  return {
+    name: 'tinvar:panel-chunks',
+    configResolved(config) {
+      root = config.root;
+      resolved = config;
+    },
+    applyToEnvironment(environment) {
+      return environment.name === 'rsc' || environment.name === 'client';
+    },
+    clientChunks(meta) {
+      const panel = owned.get(meta.id);
+      return panel === undefined ? undefined : `panel-${panel}`;
+    },
+    resolveId(id) {
+      return id === STYLES_MODULE ? `\0${STYLES_MODULE}` : undefined;
+    },
+    load(id) {
+      if (id !== `\0${STYLES_MODULE}`) return undefined;
+      return stylesModule(
+        styles === undefined ? {} : panels,
+        styles !== undefined && resolved?.command === 'build',
+      );
+    },
+    generateBundle(_options, bundle) {
+      if (resolved?.command !== 'build') return;
+      if (this.environment.name === 'rsc') {
+        const manager = resolved === null ? undefined : getPluginApi(resolved)?.manager;
+        if (manager === undefined) {
+          throw new Error('[tinvar] panelChunks() needs @vitejs/plugin-rsc in the same config.');
+        }
+        /** @type {Map<string, string[]>} */
+        const graph = new Map();
+        for (const id of this.getModuleIds()) {
+          const info = this.getModuleInfo(id);
+          if (info) graph.set(id, [...info.importedIds, ...info.dynamicallyImportedIds]);
+        }
+        const references = new Map(
+          Object.entries(manager.clientReferenceMetaMap).map(([id, meta]) => [id, meta.importId]),
+        );
+        const entries = [...graph.keys()].filter((id) => this.getModuleInfo(id)?.isEntry === true);
+        if (styles !== undefined && !manager.isScanBuild) {
+          split.rsc = { graph, references, entries, views: viewIds(graph, resolve(root, pages)) };
+          // StyleX appended every rule to the stylesheet the document
+          // links. Once the client build has the rest of the graph, it
+          // holds the app's own CSS and the shared rules alone.
+          split.stylesheet = appendedTo(bundle, styles.__stylexCollectCss?.() ?? '');
+        }
+        const reached = referencesByView(graph, references, resolve(root, pages));
+        const outside = referencesOutsideViews(graph, references, resolve(root, pages), entries);
+        const ownership = panelOwnership(reached, panels, outside);
+        owned.clear();
+        for (const [reference, panel] of ownership.references) owned.set(reference, panel);
+        report.views = ownership.views;
+        report.references = Object.fromEntries(
+          Object.keys(panels).map((panel) => [
+            panel,
+            [...ownership.references]
+              .filter(([, owner]) => owner === panel)
+              .map(([reference]) => relative(root, fileOf(reference)).split(sep).join('/'))
+              .sort(),
+          ]),
+        );
+        return;
+      }
+
+      if (this.environment.name !== 'client') return;
+      if (styles !== undefined && split.rsc !== null) {
+        split.sheets = emitSheets(this, split.rsc, styles, panels, panelOfView, root);
+        // The stylesheet every page links, again, with the shared rules
+        // alone and a name of its own: the RSC plugin still copies StyleX's,
+        // every rule under the name that has always meant them, and nothing
+        // links it once the manifest names this one instead (writeBundle).
+        if (split.stylesheet !== null) {
+          const source = withShared(split.stylesheet.base, split.sheets.shared);
+          const name = basename(split.stylesheet.fileName).replace(/-[\w-]{8}\.css$/, '.css');
+          const fileName = this.getFileName(this.emitFile({ type: 'asset', name, source }));
+          split.linked = { from: split.stylesheet.fileName, fileName, source };
+        }
+      }
+
+      // The client build: what the bundler made of the groups.
+      const chunks = Object.values(bundle)
+        .filter((output) => output.type === 'chunk')
+        .map((chunk) => ({
+          fileName: chunk.fileName,
+          isEntry: chunk.isEntry,
+          facadeModuleId: chunk.facadeModuleId,
+          moduleIds: chunk.moduleIds,
+          imports: chunk.imports,
+        }));
+      /** @type {Map<string, string[]>} */
+      const graph = new Map();
+      for (const id of this.getModuleIds()) {
+        const info = this.getModuleInfo(id);
+        if (info) graph.set(id, [...info.importedIds, ...info.dynamicallyImportedIds]);
+      }
+      const found = checkPanelChunks(chunks, graph, Object.keys(panels));
+      if (found.violations.length > 0) {
+        throw new Error(
+          `[tinvar] A panel's client code is loaded outside it:\n  ${found.violations.join('\n  ')}`,
+        );
+      }
+
+      const rscOut = resolve(root, resolved?.environments?.rsc?.build?.outDir ?? 'dist/rsc');
+      const target = resolve(rscOut, fileName);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(
+        target,
+        JSON.stringify(
+          {
+            format: 1,
+            panels: Object.fromEntries(
+              Object.keys(panels).map((panel) => [
+                panel,
+                {
+                  views: report.views[panel] ?? [],
+                  references: report.references[panel] ?? [],
+                  chunks: found.chunks[panel] ?? [],
+                  ...(split.sheets === null
+                    ? {}
+                    : {
+                        stylesheet: split.sheets.panels[panel] ?? null,
+                        ownRules: split.sheets.owned[panel] ?? 0,
+                      }),
+                },
+              ]),
+            ),
+            shared: found.shared,
+            ...(split.linked === null ? {} : { stylesheet: split.linked.fileName }),
+          },
+          null,
+          2,
+        ) + '\n',
+      );
+    },
+    writeBundle(options) {
+      if (resolved?.command !== 'build' || this.environment.name !== 'client' || split.sheets === null)
+        return;
+      const outDir = options.dir ?? this.environment.config.build.outDir;
+      // As written: nothing after this may have added to them -- StyleX
+      // appends what it compiled to a stylesheet it finds unless it already
+      // has, and a sheet it appended to is the whole of its rules again.
+      const sources = { ...split.sheets.sources };
+      if (split.linked !== null) sources[split.linked.fileName] = split.linked.source;
+      for (const [fileName, source] of Object.entries(sources)) {
+        if (readFileSync(resolve(outDir, fileName), 'utf8') !== source) {
+          throw new Error(
+            `[tinvar] panelChunks(): ${fileName} changed after it was written; its rules are not the panel's.`,
+          );
+        }
+      }
+      const manager = resolved === null ? undefined : getPluginApi(resolved)?.manager;
+      const manifest = manager?.buildAssetsManifest;
+      if (manifest === undefined) {
+        throw new Error(
+          '[tinvar] panelChunks(): the RSC plugin wrote no assets manifest to name the stylesheets in.',
+        );
+      }
+      manifest[MANIFEST_STYLES] = { panels: split.sheets.panels };
+      if (split.linked !== null) {
+        const base = this.environment.config.base ?? '/';
+        relink(manifest, `${base}${split.linked.from}`, `${base}${split.linked.fileName}`);
+      }
+    },
+  };
+}
+
+/**
+ * Each view's module, by its name: its path under the pages, without the
+ * extension.
+ *
+ * @param {Map<string, string[]>} graph
+ * @param {string} pagesDir absolute
+ * @returns {Map<string, string>}
+ */
+function viewIds(graph, pagesDir) {
+  /** @type {Map<string, string>} */
+  const views = new Map();
+  for (const id of [...graph.keys()].sort()) {
+    const file = fileOf(id);
+    const under = relative(pagesDir, file);
+    if (id.startsWith('\0') || under.startsWith('..') || under.startsWith(sep) || !SOURCE.test(file))
+      continue;
+    views.set(under.slice(0, -extname(under).length).split(sep).join('/'), id);
+  }
+  return views;
+}
+
+/**
+ * The rsc build's stylesheet StyleX appended its rules to, and what it held
+ * before them: the app's own CSS. A build where StyleX compiled rules and
+ * no stylesheet ends with them fails: the rules could not be split.
+ *
+ * @param {Record<string, any>} bundle
+ * @param {string} appended what StyleX's plugin collected
+ * @returns {{ fileName: string, base: string } | null}
+ */
+function appendedTo(bundle, appended) {
+  if (appended === '') return null;
+  const asset = Object.values(bundle).find(
+    (output) =>
+      output.type === 'asset' &&
+      output.fileName.endsWith('.css') &&
+      String(output.source).endsWith(`\n${appended}`),
+  );
+  if (asset === undefined) {
+    throw new Error(
+      "[tinvar] panelChunks(): no stylesheet ends with what StyleX compiled, so a panel's rules cannot be taken out of it.",
+    );
+  }
+  return { fileName: asset.fileName, base: String(asset.source).slice(0, -(appended.length + 1)) };
+}
+
+/**
+ * The stylesheet every page links, with the shared rules in place of every
+ * rule.
+ *
+ * @param {string} base the app's own CSS
+ * @param {string} shared the shared rules, rendered
+ */
+function withShared(base, shared) {
+  // Without Vite's marker of a stylesheet it made, which it takes out of
+  // every stylesheet as it writes it: what is written is what is checked.
+  const css = base.replaceAll('/*$vite$:1*/', '');
+  return shared === '' ? css : `${css}\n${shared}`;
+}
+
+/**
+ * Every stylesheet list in the RSC plugin's assets manifest with $to in
+ * $from's place: what loadCss() links, and what a client component's chunk
+ * preinits.
+ *
+ * @param {Record<string, any>} manifest
+ * @param {string} from
+ * @param {string} to
+ */
+function relink(manifest, from, to) {
+  const lists = [
+    ...Object.values(manifest.serverResources ?? {}),
+    ...Object.values(manifest.clientReferenceDeps ?? {}),
+    ...(manifest.clientEntryDeps === undefined ? [] : [manifest.clientEntryDeps]),
+  ];
+  for (const deps of lists) {
+    if (Array.isArray(deps?.css))
+      deps.css = deps.css.map((/** @type {unknown} */ url) => (url === from ? to : url));
+  }
+}
+
+/**
+ * Emits a StyleX sheet into the client build for each panel with rules of
+ * its own -- the shared rules and the panel's, whole -- and renders the
+ * shared rules for the stylesheet every page links.
+ *
+ * @param {any} context the client build's plugin context
+ * @param {{ graph: Map<string, string[]>, references: Map<string, string>, entries: string[], views: Map<string, string> }} rsc
+ * @param {any} styles the StyleX plugin
+ * @param {Record<string, string>} panels
+ * @param {(view: string) => string | null} panelOf
+ * @param {string} root
+ * @returns {{ shared: string, panels: Record<string, string>, sources: Record<string, string>, owned: Record<string, number> }}
+ *          the shared rules as CSS, and each panel's sheet by URL
+ */
+function emitSheets(context, rsc, styles, panels, panelOf, root) {
+  /** @type {Map<string, string[]>} */
+  const client = new Map();
+  const clientEntries = [];
+  for (const id of context.getModuleIds()) {
+    const info = context.getModuleInfo(id);
+    if (!info) continue;
+    client.set(id, [...info.importedIds, ...info.dynamicallyImportedIds]);
+    if (info.isEntry) clientEntries.push(id);
+  }
+
+  const store = styles.__stylexGetSharedStore?.();
+  if (!(store?.rulesById instanceof Map)) {
+    throw new Error(
+      "[tinvar] panelChunks(): `styles` is not StyleX's plugin, or not one this reads the rules of.",
+    );
+  }
+
+  const ownership = moduleOwnership({
+    rsc: rsc.graph,
+    client,
+    references: rsc.references,
+    views: rsc.views,
+    rscEntries: rsc.entries,
+    clientEntries,
+    panelOf,
+  });
+  const names = Object.keys(panels);
+  const parts = partitionRules(store.rulesById, ownership, names);
+  const render = styleXRenderer(root);
+  const base = context.environment.config.base ?? '/';
+
+  /** @type {Record<string, string>} */
+  const sources = {};
+  const emit = (/** @type {string} */ name, /** @type {string} */ source) => {
+    const fileName = context.getFileName(context.emitFile({ type: 'asset', name, source }));
+    sources[fileName] = source;
+    return `${base}${fileName}`;
+  };
+
+  const shared = render(parts.shared);
+  /** @type {Record<string, string>} */
+  const sheets = {};
+  for (const panel of names) {
+    if ((parts.owned[panel] ?? 0) > 0)
+      sheets[panel] = emit(`styles-${panel}.css`, render(parts.panels[panel] ?? []));
+  }
+
+  return { shared, panels: sheets, sources, owned: parts.owned };
+}
+
+/**
+ * Every view under the pages directory, with the client references its server
+ * graph reaches -- a reference is a leaf there: in the rsc environment a 'use
+ * client' module is a proxy, its own imports gone.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids (rsc)
+ * @param {Map<string, string>} references client reference module id => its import id
+ * @param {string} pagesDir absolute
+ * @returns {Map<string, Set<string>>} view => import ids
+ */
+export function referencesByView(graph, references, pagesDir) {
+  /** @type {Map<string, Set<string>>} */
+  const views = new Map();
+
+  for (const id of [...graph.keys()].sort()) {
+    const file = fileOf(id);
+    const under = relative(pagesDir, file);
+    if (id.startsWith('\0') || under.startsWith('..') || under.startsWith(sep) || !SOURCE.test(file))
+      continue;
+
+    const found = new Set();
+    const seen = new Set([id]);
+    const queue = [id];
+    while (queue.length > 0) {
+      const current = /** @type {string} */ (queue.shift());
+      const reference = references.get(current);
+      if (reference !== undefined) {
+        found.add(reference);
+        continue;
+      }
+      for (const next of graph.get(current) ?? []) {
+        if (!seen.has(next)) {
+          seen.add(next);
+          queue.push(next);
+        }
+      }
+    }
+
+    views.set(under.slice(0, -extname(under).length).split(sep).join('/'), found);
+  }
+
+  return views;
+}
+
+/**
+ * The client references the entries reach without going through a view: what
+ * the entry renders around every page -- a document shell, a root layout
+ * kept outside the pages, a deferred component's registry -- and so what any
+ * page may render, whichever views also reach it.
+ *
+ * Left out, such a reference reached by one panel's views alone was taken to
+ * be that panel's, and went in its chunk: every customer's page rendering it
+ * then loaded the panel's chunk, and every panel component with it -- the
+ * check on the client bundle cannot see it, since the chunk is loaded on
+ * demand through the reference map, as any group is.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids (rsc)
+ * @param {Map<string, string>} references client reference module id => its import id
+ * @param {string} pagesDir absolute
+ * @param {string[]} entries the rsc build's entry module ids
+ * @returns {Set<string>} import ids
+ */
+export function referencesOutsideViews(graph, references, pagesDir, entries) {
+  const isView = (/** @type {string} */ id) => {
+    const file = fileOf(id);
+    const under = relative(pagesDir, file);
+    return !id.startsWith('\0') && !under.startsWith('..') && !under.startsWith(sep) && SOURCE.test(file);
+  };
+
+  const found = new Set();
+  const seen = new Set(entries);
+  const queue = [...entries];
+  while (queue.length > 0) {
+    const current = /** @type {string} */ (queue.shift());
+    const reference = references.get(current);
+    if (reference !== undefined) {
+      found.add(reference);
+      continue;
+    }
+    // A view's references are counted with its panel, by referencesByView().
+    if (isView(current)) continue;
+    for (const next of graph.get(current) ?? []) {
+      if (!seen.has(next)) {
+        seen.add(next);
+        queue.push(next);
+      }
+    }
+  }
+
+  return found;
+}
+
+/**
+ * Which panel each view is in, by its directory, and which client references
+ * belong to one panel: every view that reaches them is in it, and nothing
+ * outside the views does. A reference no view reaches -- one an entry imports
+ * itself -- is no panel's, and nor is one an entry reaches outside any view
+ * (referencesOutsideViews()), whatever views reach it besides.
+ *
+ * @param {Map<string, Set<string>>} reached view => import ids
+ * @param {Record<string, string>} panels panel => directory under the pages
+ * @param {Set<string>} [outside] import ids reached outside any view
+ * @returns {{ views: Record<string, string[]>, references: Map<string, string> }}
+ */
+export function panelOwnership(reached, panels, outside = new Set()) {
+  const panelOf = (/** @type {string} */ view) => {
+    for (const [panel, directory] of Object.entries(panels)) {
+      const prefix = directory.replace(/\/+$/, '');
+      if (view === prefix || view.startsWith(`${prefix}/`)) return panel;
+    }
+    return null;
+  };
+
+  /** @type {Record<string, string[]>} */
+  const views = Object.fromEntries(Object.keys(panels).map((panel) => [panel, []]));
+  /** @type {Map<string, Set<string | null>>} reference => the panels of the views reaching it */
+  const reachers = new Map();
+  for (const [view, references] of reached) {
+    const panel = panelOf(view);
+    if (panel !== null) views[panel]?.push(view);
+    for (const reference of references) {
+      if (!reachers.has(reference)) reachers.set(reference, new Set());
+      reachers.get(reference)?.add(panel);
+    }
+  }
+
+  /** @type {Map<string, string>} */
+  const references = new Map();
+  for (const [reference, owners] of reachers) {
+    const [only] = owners;
+    if (owners.size === 1 && typeof only === 'string' && !outside.has(reference))
+      references.set(reference, only);
+  }
+  for (const list of Object.values(views)) list.sort();
+
+  return { views, references };
+}
+
+/**
+ * Holds the client bundle to the panels: no chunk loaded outside a panel may
+ * hold a module only that panel's group reaches.
+ *
+ * Outside panel P is the entry chunk and every chunk it imports, and every
+ * other group's chunk -- shared, or another panel's -- and what those import.
+ * P's own modules are those its group's virtual module reaches in the client
+ * graph that neither the entry module nor any other group reaches: read from
+ * the graph, never from what the bundler put where, which is what is checked.
+ *
+ * @param {Array<{ fileName: string, isEntry: boolean, facadeModuleId: string | null, moduleIds: string[], imports: string[] }>} chunks
+ * @param {Map<string, string[]>} graph module id => imported ids (client)
+ * @param {string[]} panels
+ * @returns {{ violations: string[], chunks: Record<string, string[]>, shared: string[] }}
+ */
+export function checkPanelChunks(chunks, graph, panels) {
+  const byFile = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
+  const closure = (/** @type {string[]} */ files) => {
+    const seen = new Set();
+    const queue = [...files];
+    while (queue.length > 0) {
+      const file = /** @type {string} */ (queue.shift());
+      if (seen.has(file) || !byFile.has(file)) continue;
+      seen.add(file);
+      queue.push(...(byFile.get(file)?.imports ?? []));
+    }
+    return seen;
+  };
+  // Never into a group it did not start from: the client-reference map the
+  // entry imports loads every group on demand, which is not loading them.
+  const reach = (/** @type {string[]} */ ids) => {
+    const seen = new Set(ids);
+    const queue = [...ids];
+    while (queue.length > 0) {
+      const id = /** @type {string} */ (queue.shift());
+      for (const next of graph.get(id) ?? []) {
+        if (!seen.has(next) && !next.startsWith(GROUP_PREFIX)) {
+          seen.add(next);
+          queue.push(next);
+        }
+      }
+    }
+    return seen;
+  };
+
+  // The groups, from the graph: a group the bundler inlined into another
+  // chunk has no chunk of its own, and is checked all the same.
+  const groupIds = [...graph.keys()].filter((id) => id.startsWith(GROUP_PREFIX));
+  const chunkOf = (/** @type {string} */ id) => chunks.find((chunk) => chunk.moduleIds.includes(id));
+  const entries = chunks.filter((chunk) => chunk.isEntry);
+  const entryFiles = entries.map((chunk) => chunk.fileName);
+  const entryModules = entries.flatMap((chunk) =>
+    chunk.facadeModuleId === null ? [] : [chunk.facadeModuleId],
+  );
+
+  const violations = [];
+  /** @type {Record<string, string[]>} */
+  const owned = {};
+
+  for (const panel of panels) {
+    const groupId = `${GROUP_PREFIX}panel-${panel}`;
+    if (!graph.has(groupId)) {
+      owned[panel] = [];
+      continue;
+    }
+    const others = groupIds.filter((id) => id !== groupId);
+    const otherFiles = others.flatMap((id) => {
+      const found = chunkOf(id);
+      return found === undefined ? [] : [found.fileName];
+    });
+    const outsideFiles = closure([...entryFiles, ...otherFiles]);
+    const outsideModules = reach([...entryModules, ...others]);
+    const own = new Set([...reach([groupId])].filter((id) => !outsideModules.has(id)));
+
+    for (const file of [...outsideFiles].sort()) {
+      for (const id of byFile.get(file)?.moduleIds ?? []) {
+        if (own.has(id) && !id.startsWith('\0')) {
+          violations.push(`${fileOf(id)} (the ${panel} panel's) is in ${file}, which pages outside it load`);
+        }
+      }
+    }
+    const home = chunkOf(groupId);
+    owned[panel] =
+      home === undefined
+        ? []
+        : [...closure([home.fileName])].filter((file) => !outsideFiles.has(file)).sort();
+  }
+
+  const outsideAll = closure([
+    ...entryFiles,
+    ...groupIds
+      .filter((id) => !id.slice(GROUP_PREFIX.length).startsWith('panel-'))
+      .flatMap((id) => {
+        const found = chunkOf(id);
+        return found === undefined ? [] : [found.fileName];
+      }),
+  ]);
+
+  return { violations, chunks: owned, shared: [...outsideAll].sort() };
+}
+
+// ---------------------------------------------------------------------------
+// The queries each view may call.
+//
+// tinvar-spec.md, "Renderer hardening": "Per-route query allowlist. At build,
+// the server-component graph of each route gives the list of query names it
+// may call. PHP rejects any other name on that route's socket, so a
+// compromised dependency can't call queries the page never uses." A list kept
+// by hand drifts as the deferred routes did (ADR 0024): one that misses a
+// query fails its page, which is noticed; one that keeps a query the page has
+// stopped calling lets every render of the route call it, which is not.
+//
+// So deferredBoundaries() finds the calls too, over the same graph. A server
+// component calls a query through query() from @tinvar/react/server -- or the
+// root, which re-exports it under react-server -- or through a function
+// codegen typed in @queries/*, whose query `tinvar codegen` writes beside the
+// types (QUERY_MAP). Every module importing one of those is read with the
+// bundler's parser, and each call named by the literal it passes; a view may
+// call what every module reachable from it calls. A 'use client' module is a
+// client reference in this graph, its imports gone: a client component cannot
+// call query(), and whatever its source says is not counted.
+//
+// A deferred component is not reachable from its page: the page names it by a
+// string, and a fragment renders it from the rsc entry's registry, under the
+// allowlist of the route that minted its token. So the registry is read as
+// well, where the entry declares it with deferredRegistry(): each name, and
+// the module its component is imported from. The queries reachable from that
+// module are written beside the views', and PHP adds them to every route that
+// may mint for the component.
+//
+// Only the application's own modules are read: a dependency's are not, even
+// where the rsc build bundles them -- plugin-rsc bundles every package with a
+// React peer. The allowlist is there to hold a compromised dependency to
+// what the page calls; a dependency whose calls were read as the page's would
+// put on the list whatever names it wrote out, and be allowed them. So a
+// module under node_modules lists nothing and registers nothing, whatever it
+// imports. A query a dependency calls is refused at runtime unless the
+// application's own code calls it too, which is the side to fail on.
+//
+// What cannot be read fails the build. A boundary's unreadable name can widen
+// to "any component", since its route still renders only what the registry
+// holds; an unreadable query name has no such bound, and a route given every
+// query is the hole the allowlist exists to close. A name that is not written
+// out, query() handed on as a value or re-exported, a registry entry that is
+// not an imported component under a written name: each refuses the build,
+// naming the file. Scope is followed: a local binding that shadows query()
+// is not query() (scopedWalk()).
+
+/** The specifier server components import query() and deferredRegistry() by. */
+export const SERVER_SPECIFIER = '@tinvar/react/server';
+
+/** The call the rsc entry declares the components a <Deferred> may name with. */
+export const REGISTRY_FUNCTION = 'deferredRegistry';
+
+/** TypeScript's type-only syntax, inside which no value is read. */
+const TYPE_ONLY = new Set([
+  'TSTypeAnnotation',
+  'TSTypeReference',
+  'TSTypeQuery',
+  'TSTypeLiteral',
+  'TSImportType',
+  'TSTypeParameterInstantiation',
+  'TSTypeParameterDeclaration',
+  'TSTypeAliasDeclaration',
+  'TSInterfaceDeclaration',
+  'TSDeclareFunction',
+]);
+
+/** What wraps a value and leaves it the same value. */
+const SAME_VALUE = new Set([
+  'TSAsExpression',
+  'TSSatisfiesExpression',
+  'TSNonNullExpression',
+  'TSTypeAssertion',
+  'ParenthesizedExpression',
+]);
+
+/** The id a @queries/* module resolves to: one this plugin makes, with no file behind it. */
+export const QUERY_MODULE_PREFIX = '\0tinvar-queries:';
+
+/** What a function in a @queries/* module may be called: codegen writes identifiers. */
+const QUERY_FUNCTION = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+/**
+ * The @queries/* modules, made at build time.
+ *
+ * tinvar-spec.md: "Any server component can `await` data by calling a PHP
+ * `#[Query]` class through a generated TypeScript function." `tinvar
+ * codegen` types those functions (resources/types/modules.d.ts) and writes
+ * which query each calls (QUERY_MAP); this plugin is what makes them exist.
+ * Each module is made from the map alone: one function per entry, calling
+ * query() with the name codegen wrote -- the same query() a component could
+ * call itself, so the allowlist, the batching and the render context are
+ * the ones every call goes through.
+ *
+ * Its modules have no file, so the allowlist's reading (queryUsers()) never
+ * reads one as a caller of every query it holds: an import of `shipments`
+ * from '@queries/orders' puts orders.shipments on the importer's route and
+ * nothing else the module has.
+ *
+ * Only in the rsc environment. A query runs in a server component; a
+ * 'use client' module importing one is refused where it is built, rather
+ * than handing the browser a function that could never be answered. A
+ * module codegen has not written fails the build too.
+ *
+ * And it keeps the testing layer out (ADR 0061). Every application has this
+ * plugin -- its server components cannot call a query without it -- so it is
+ * where a graph reaching `@tinvar/react/testing`, or codegen's mocks and
+ * fakes that import it, fails: by the specifier, and by the marker the
+ * runtime carries, which a path around the specifier still loads. In every
+ * environment and in dev as well as the build: a mock answers for an action
+ * without running it, which is a page saying it did what it did not do.
+ *
+ * And `@tinvar/react/server` -- query(), shared(), the render context -- is
+ * server-only: "importing a query helper into a client file fails the
+ * build" (tinvar-spec.md, "Server and client components"). Bundled for the
+ * browser it built, with `node:async_hooks` stubbed out and a warning, into
+ * a module that fails when called. It is refused here outside the rsc
+ * environment instead, as a @queries/* module is. An application's own
+ * server-only modules say so with `import 'server-only'`, which the RSC
+ * plugin refuses outside the rsc environment by itself.
+ *
+ * @param {{ queryMap?: string }} [options] `queryMap` is where `tinvar codegen`
+ *        wrote it, relative to the Vite root
+ */
+export function queryFunctions({ queryMap = QUERY_MAP } = {}) {
+  let root = process.cwd();
+
+  return {
+    name: 'tinvar:query-functions',
+    enforce: 'pre',
+    configResolved(config) {
+      root = config.root;
+    },
+    resolveId(source, importer) {
+      if (TESTING_MODULE.test(source)) {
+        this.error(testingRefused(source, importer));
+      }
+      if (SERVER_MODULE.test(source) && this.environment?.name !== 'rsc') {
+        const from = importer ? ` (imported by ${fileOf(importer)})` : '';
+        this.error(
+          `[tinvar] ${source}${from} is server-only: it runs a server component's queries and render, ` +
+            `which the ${this.environment?.name ?? 'unknown'} environment cannot. A client component asks over HTTP, ` +
+            'with useHttp(), or is handed what it needs as props.',
+        );
+      }
+      if (!QUERIES_MODULE.test(source)) return null;
+      const from = importer ? ` (imported by ${fileOf(importer)})` : '';
+      if (this.environment?.name !== 'rsc') {
+        this.error(
+          `[tinvar] ${source}${from} is a query, which runs in a server component; ` +
+            `the ${this.environment?.name ?? 'unknown'} environment cannot call one. A client component asks over HTTP, with useHttp().`,
+        );
+      }
+      if (!Object.hasOwn(readQueryMap(resolve(root, queryMap)), source)) {
+        this.error(`[tinvar] ${source}${from} is not a module tinvar codegen has written; run it.`);
+      }
+      return QUERY_MODULE_PREFIX + source;
+    },
+    load(id) {
+      // A module loaded with a query -- `?url`, `?raw`, `?inline` -- is
+      // made into something else before the transform sees it: a URL, and
+      // the file copied into the output as an asset. So the file itself is
+      // read for the marker here, under whichever query it came.
+      if (!id.startsWith('\0') && /[?#]/.test(id)) {
+        const file = fileOf(id);
+        if (SOURCE.test(file) && existsSync(file) && readFileSync(file, 'utf8').includes(TESTING_MARKER)) {
+          this.error(testingRefused(file, null));
+        }
+      }
+      if (!id.startsWith(QUERY_MODULE_PREFIX)) return null;
+      const file = resolve(root, queryMap);
+      this.addWatchFile(file);
+      const module = id.slice(QUERY_MODULE_PREFIX.length);
+      const functions = readQueryMap(file)[module];
+      if (functions === undefined) {
+        this.error(`[tinvar] ${module} is no longer in ${file}; run tinvar codegen.`);
+      }
+      return queryModuleSource(functions);
+    },
+    transform(code, id) {
+      if (code.includes(TESTING_MARKER)) this.error(testingRefused(fileOf(id), null));
+      return null;
+    },
+  };
+}
+
+/** The server helpers' specifier, with a query or a hash or without. */
+const SERVER_MODULE = /^@tinvar\/react\/server(?:[?#]|$)/;
+
+/** The testing runtime's specifier, any path under it, and either with a query or a hash. */
+const TESTING_MODULE = /^@tinvar\/react\/testing(?:[/?#]|$)/;
+
+/** What the testing runtime exports as TESTING_RUNTIME, and so carries in its source. */
+const TESTING_MARKER = 'tinvar:' + 'testing-runtime';
+
+/** @param {string} what @param {string | null | undefined} importer */
+function testingRefused(what, importer) {
+  const from = importer ? ` (imported by ${fileOf(importer)})` : '';
+  return (
+    `[tinvar] ${what}${from} is the testing layer: mocks that answer for queries and actions ` +
+    'without running them. It loads only in a Vitest worker, and no Vite build or dev server may reach it.'
+  );
+}
+
+/**
+ * A @queries/* module's source: each function codegen listed, calling its
+ * query by the name codegen wrote. The names go in as string literals, and
+ * a function name must be an identifier, so nothing in the map becomes code.
+ *
+ * @param {Record<string, string>} functions function => query, from readQueryMap()
+ * @returns {string}
+ * @throws {UnreadableQuery} for a function name that is not an identifier
+ */
+export function queryModuleSource(functions) {
+  const lines = [`import { query } from ${JSON.stringify(SERVER_SPECIFIER)};`];
+  const exported = [];
+  for (const [index, name] of Object.keys(functions).sort().entries()) {
+    if (!QUERY_FUNCTION.test(name)) {
+      throw new UnreadableQuery(
+        `[tinvar] ${JSON.stringify(name)} is not a function name; run tinvar codegen.`,
+      );
+    }
+    lines.push(`const q${index} = (args = {}) => query(${JSON.stringify(functions[name])}, args);`);
+    exported.push(`q${index} as ${name}`);
+  }
+  lines.push(`export { ${exported.join(', ')} };`);
+  return lines.join('\n') + '\n';
+}
+
+/**
+ * The modules that call a query, with the names each calls, and the
+ * components the rsc entry registers for <Deferred>, each with its module --
+ * read from the source of every module importing query(), deferredRegistry()
+ * or a @queries/* function. One reading for the build and the dev server
+ * (dev-server.js), so a route may call in dev exactly what its build allows.
+ *
+ * A module another plugin made has no source to read, and its calls are not
+ * listed: PHP refuses them, which is the side to fail on. Nor is a
+ * dependency's, under node_modules, which is not the page's to allow (see
+ * above).
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids
+ * @param {string} pagesDir absolute; what the specifiers resolve from
+ * @param {(specifier: string, importer: string) => Promise<string | null>} resolveId
+ *        as the rsc environment resolves, under `react-server`
+ * @param {Record<string, Record<string, string>>} [queryMap] readQueryMap()'s
+ * @returns {Promise<{ calls: Map<string, string[]>, registry: Map<string, string> }>}
+ *          module id => the query names it calls; component => its module id
+ * @throws {UnreadableQuery}
+ */
+export async function queryUsers(graph, pagesDir, resolveId, queryMap = {}) {
+  const importer = resolve(pagesDir, 'index.tsx');
+  const serverId = await resolveId(SERVER_SPECIFIER, importer);
+  const rootId = await resolveId(ROOT_SPECIFIER, importer);
+  const watched = new Set([serverId, rootId].filter((id) => id !== null));
+  for (const module of Object.keys(queryMap)) {
+    const id = await resolveId(module, importer);
+    if (id !== null) watched.add(id);
+  }
+
+  /** @type {Map<string, string[]>} */
+  const calls = new Map();
+  /** @type {Map<string, string>} */
+  const registry = new Map();
+
+  for (const [id, imports] of graph) {
+    // Where query() is defined, and the root that re-exports it.
+    if (id === serverId || id === rootId) continue;
+    if (!imports.some((imported) => watched.has(imported))) continue;
+    const file = fileOf(id);
+    if (id.startsWith('\0') || isDependency(file) || !existsSync(file)) continue;
+
+    const source = readFileSync(file, 'utf8');
+    const resolved = new Map();
+    for (const specifier of importSources(source, file)) {
+      resolved.set(specifier, await resolveId(specifier, id));
+    }
+    const found = queryCalls(
+      source,
+      file,
+      (specifier) => {
+        const to = resolved.get(specifier) ?? null;
+        return to !== null && (to === serverId || to === rootId);
+      },
+      queryMap,
+    );
+    if (found.queries.length > 0) calls.set(id, found.queries);
+
+    for (const [component, specifier] of found.registry) {
+      const module = resolved.get(specifier) ?? null;
+      if (module === null) {
+        throw new UnreadableQuery(
+          `[tinvar] ${file} registers the deferred component '${component}' from '${specifier}', which does not resolve.`,
+        );
+      }
+      const before = registry.get(component);
+      if (before !== undefined && before !== module) {
+        throw new UnreadableQuery(
+          `[tinvar] The deferred component '${component}' is registered twice: from ${fileOf(before)} and from ${fileOf(module)}.`,
+        );
+      }
+      registry.set(component, module);
+    }
+  }
+
+  return { calls, registry };
+}
+
+/**
+ * Every view under the pages directory, with the query names reachable from
+ * it, sorted; a view that calls none is listed with an empty list, as
+ * viewsOf() lists one with no boundary.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids
+ * @param {Map<string, string[]>} calls module id => the names it calls
+ * @param {string} pagesDir absolute
+ * @returns {Record<string, string[]>}
+ */
+export function queriesOfViews(graph, calls, pagesDir) {
+  /** @type {Record<string, string[]>} */
+  const views = Object.create(null);
+  for (const id of [...graph.keys()].sort()) {
+    const view = viewOf(id, pagesDir);
+    if (view !== null) views[view] = callsReachable(graph, calls, id);
+  }
+  return views;
+}
+
+/**
+ * Every component the rsc entry registers for <Deferred>, with the query
+ * names reachable from its module, sorted.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids
+ * @param {Map<string, string[]>} calls module id => the names it calls
+ * @param {Map<string, string>} registry component => its module id
+ * @returns {Record<string, string[]>}
+ */
+export function queriesOfComponents(graph, calls, registry) {
+  /** @type {Record<string, string[]>} */
+  const components = Object.create(null);
+  for (const [component, id] of [...registry].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+    components[component] = callsReachable(graph, calls, id);
+  }
+  return components;
+}
+
+/**
+ * The queries one module calls, and the components a deferredRegistry() call
+ * in it registers.
+ *
+ * @param {string} source the module's own source, as written
+ * @param {string} file its path, which says how to parse it and names it in a refusal
+ * @param {(specifier: string) => boolean} isQuery whether an import specifier
+ *        here names the module query() comes from: @tinvar/react/server, or
+ *        the root
+ * @param {Record<string, Record<string, string>>} [queryMap] readQueryMap()'s
+ * @returns {{ queries: string[], registry: Array<[string, string]> }} the names,
+ *          sorted; each registered component with the specifier its module is
+ *          imported by here
+ * @throws {UnreadableQuery} naming the file and line of what cannot be read
+ */
+export function queryCalls(source, file, isQuery, queryMap = {}) {
+  const program = parse(source, file);
+
+  /** @type {(node: any, why: string) => never} */
+  const refuse = (node, why) => {
+    const line = typeof node?.start === 'number' ? source.slice(0, node.start).split('\n').length : 0;
+    throw new UnreadableQuery(`[tinvar] ${file}${line > 0 ? `:${line}` : ''} ${why}`);
+  };
+  /** @type {(node: any, module: string) => Record<string, string>} */
+  const functionsOf = (node, module) =>
+    Object.hasOwn(queryMap, module)
+      ? queryMap[module]
+      : refuse(
+          node,
+          `imports ${module}, which tinvar codegen has not written: run it, so the build knows which query each of its functions calls.`,
+        );
+  /** @type {(node: any, module: string, name: string) => string} */
+  const queryOf = (node, module, name) => {
+    const functions = functionsOf(node, module);
+    return Object.hasOwn(functions, name)
+      ? functions[name]
+      : refuse(node, `imports ${name}() from ${module}, which tinvar codegen did not write.`);
+  };
+
+  const found = new Set();
+  /** @type {Array<[string, string]>} */
+  const registry = [];
+  // The names query() and deferredRegistry() are bound to here, and the
+  // namespaces whose `.query` is query().
+  const callees = new Set();
+  const registries = new Set();
+  const namespaces = new Set();
+  /** @type {Map<string, string>} each value imported by name, with the specifier it comes from */
+  const imported = new Map();
+
+  for (const node of program.body) {
+    const from = typeof node.source?.value === 'string' ? node.source.value : null;
+    if (from === null || node.importKind === 'type' || node.exportKind === 'type') continue;
+
+    if (node.type === 'ImportDeclaration') {
+      for (const specifier of node.specifiers) {
+        if (specifier.importKind === 'type') continue;
+        const namespace = specifier.type === 'ImportNamespaceSpecifier';
+        if (!namespace) imported.set(specifier.local.name, from);
+
+        if (isQuery(from)) {
+          if (namespace) namespaces.add(specifier.local.name);
+          else if (specifier.type === 'ImportSpecifier' && importedName(specifier) === 'query') {
+            callees.add(specifier.local.name);
+          } else if (specifier.type === 'ImportSpecifier' && importedName(specifier) === REGISTRY_FUNCTION) {
+            registries.add(specifier.local.name);
+          }
+        } else if (QUERIES_MODULE.test(from)) {
+          // Imported is enough: each function calls its one query, whatever
+          // the module then does with it.
+          if (namespace) for (const query of Object.values(functionsOf(node, from))) found.add(query);
+          else if (specifier.type === 'ImportSpecifier')
+            found.add(queryOf(node, from, importedName(specifier)));
+          else refuse(node, `imports a default from ${from}, which has none.`);
+        }
+      }
+    } else if (node.type === 'ExportAllDeclaration' || node.type === 'ExportNamedDeclaration') {
+      if (isQuery(from)) {
+        // Handed on, it is called elsewhere under a name this cannot follow.
+        if (
+          node.type === 'ExportAllDeclaration' ||
+          node.specifiers.some((/** @type {any} */ specifier) =>
+            ['query', REGISTRY_FUNCTION].includes(localName(specifier)),
+          )
+        ) {
+          refuse(
+            node,
+            `re-exports query() from ${from}, so the calls made through it cannot be listed. Import it where it is called.`,
+          );
+        }
+      } else if (QUERIES_MODULE.test(from)) {
+        if (node.type === 'ExportAllDeclaration') {
+          for (const query of Object.values(functionsOf(node, from))) found.add(query);
+        } else {
+          for (const specifier of node.specifiers) found.add(queryOf(node, from, localName(specifier)));
+        }
+      }
+    }
+  }
+
+  /** @type {(callee: any, name: string, scope: Scope | null) => boolean} */
+  const calls = (callee, name, scope) =>
+    (callee.type === 'Identifier' &&
+      (name === 'query' ? callees : registries).has(callee.name) &&
+      !shadowed(callee.name, scope)) ||
+    (callee.type === 'MemberExpression' &&
+      !callee.computed &&
+      callee.object.type === 'Identifier' &&
+      namespaces.has(callee.object.name) &&
+      !shadowed(callee.object.name, scope) &&
+      callee.property.type === 'Identifier' &&
+      callee.property.name === name);
+
+  /** @type {(node: any, parent: any, scope: Scope | null) => boolean | undefined} */
+  const visit = (node, parent, scope) => {
+    if (node.type === 'ImportDeclaration' || TYPE_ONLY.has(node.type)) return false;
+    if ((node.type === 'ExportNamedDeclaration' || node.type === 'ExportAllDeclaration') && node.source) {
+      return false;
+    }
+
+    if (node.type === 'ImportExpression' && typeof node.source?.value === 'string') {
+      const from = node.source.value;
+      if (isQuery(from))
+        refuse(node, `loads ${from} dynamically, so the calls made through it cannot be listed.`);
+      if (QUERIES_MODULE.test(from))
+        for (const query of Object.values(functionsOf(node, from))) found.add(query);
+    }
+
+    if (
+      node.type === 'CallExpression' &&
+      (calls(node.callee, 'query', scope) || calls(node.callee, REGISTRY_FUNCTION, scope))
+    ) {
+      if (calls(node.callee, 'query', scope)) found.add(queryName(node, refuse));
+      else registry.push(...registered(node, imported, refuse));
+      for (const argument of node.arguments) scopedWalk(argument, visit, node, scope);
+      return false;
+    }
+
+    if (
+      node.type === 'Identifier' &&
+      (callees.has(node.name) || registries.has(node.name) || namespaces.has(node.name)) &&
+      !shadowed(node.name, scope) &&
+      !isPropertyKey(node, parent) &&
+      !isMemberKey(node, parent) &&
+      !(namespaces.has(node.name) && readsOtherThanQuery(node, parent))
+    ) {
+      refuse(
+        node,
+        `uses ${node.name} other than by calling it, so the queries called through it cannot be listed. Call query() where it is imported, with the name written out.`,
+      );
+    }
+    return undefined;
+  };
+  scopedWalk(program, visit, null, null);
+
+  return { queries: [...found].sort(), registry };
+}
+
+// Which bindings a name means where it is written. A local binding that
+// shadows query() -- a parameter, a `const`, a function's own `var` --
+// is not query(), and a call of it puts nothing on the allowlist nor
+// refuses the build; the import is what every name not bound between it
+// and the module means. Read by ECMAScript's rules for a module, which is
+// strict code: `var` and a function's parameters hold for the whole
+// function, `let`, `const`, `class` and a function declaration for their
+// block, a catch's parameter for its clause. A binding the reader does not
+// see is a call it reads as query() -- the old reading, refusing more,
+// never listing less.
+
+/** @typedef {{ names: Set<string>, parent: Scope | null }} Scope */
+
+/**
+ * Depth-first as walk() is, with the scope each node is written in: the
+ * visitor is handed the innermost scope around the node, none at the
+ * module's top, where nothing can shadow an import.
+ *
+ * @param {any} node
+ * @param {(node: any, parent: any, scope: Scope | null) => boolean | undefined} visit
+ * @param {any} parent
+ * @param {Scope | null} scope
+ */
+function scopedWalk(node, visit, parent, scope) {
+  if (node === null || typeof node !== 'object') return;
+  if (Array.isArray(node)) {
+    for (const child of node) scopedWalk(child, visit, parent, scope);
+    return;
+  }
+  if (typeof node.type !== 'string') return;
+  if (visit(node, parent, scope) === false) return;
+  const inner = scopeOf(node, scope);
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end' || key === 'range' || key === 'loc') continue;
+    const child = node[key];
+    if (child !== null && typeof child === 'object') scopedWalk(child, visit, node, inner);
+  }
+}
+
+/**
+ * The scope a node opens for what is written inside it, or the one it is
+ * in where it opens none.
+ *
+ * @param {any} node
+ * @param {Scope | null} scope
+ * @returns {Scope | null}
+ */
+function scopeOf(node, scope) {
+  /** @type {Set<string>} */
+  const names = new Set();
+  switch (node.type) {
+    case 'FunctionDeclaration':
+    case 'FunctionExpression':
+    case 'ArrowFunctionExpression':
+      for (const param of node.params) bindingNames(param, names);
+      if (node.type === 'FunctionExpression' && node.id) names.add(node.id.name);
+      varNames(node.body, names);
+      if (node.body?.type === 'BlockStatement') lexicalNames(node.body.body, names);
+      break;
+    case 'BlockStatement':
+    case 'StaticBlock':
+      lexicalNames(node.body, names);
+      break;
+    case 'Program':
+      return scope;
+    case 'ForStatement':
+      if (node.init?.type === 'VariableDeclaration') lexicalNames([node.init], names);
+      break;
+    case 'ForInStatement':
+    case 'ForOfStatement':
+      if (node.left?.type === 'VariableDeclaration') lexicalNames([node.left], names);
+      break;
+    case 'SwitchStatement':
+      lexicalNames(
+        node.cases.flatMap((/** @type {any} */ c) => c.consequent),
+        names,
+      );
+      break;
+    case 'CatchClause':
+      if (node.param) bindingNames(node.param, names);
+      break;
+    case 'ClassDeclaration':
+    case 'ClassExpression':
+      if (node.id) names.add(node.id.name);
+      break;
+    default:
+      return scope;
+  }
+  return names.size === 0 ? scope : { names, parent: scope };
+}
+
+/** Whether a name is bound by a scope between where it is written and the module's top. */
+function shadowed(name, scope) {
+  for (let current = scope; current !== null; current = current.parent) {
+    if (current.names.has(name)) return true;
+  }
+  return false;
+}
+
+/** The names a parameter or a declaration's pattern binds. */
+function bindingNames(pattern, names) {
+  if (pattern === null || pattern === undefined) return;
+  switch (pattern.type) {
+    case 'Identifier':
+      names.add(pattern.name);
+      break;
+    case 'ObjectPattern':
+      for (const property of pattern.properties) {
+        bindingNames(property.type === 'RestElement' ? property.argument : property.value, names);
+      }
+      break;
+    case 'ArrayPattern':
+      for (const element of pattern.elements) bindingNames(element, names);
+      break;
+    case 'RestElement':
+      bindingNames(pattern.argument, names);
+      break;
+    case 'AssignmentPattern':
+      bindingNames(pattern.left, names);
+      break;
+    case 'TSParameterProperty':
+      bindingNames(pattern.parameter, names);
+      break;
+    default:
+      break;
+  }
+}
+
+/** A block's own `let`, `const`, `using`, `class` and function declarations. */
+function lexicalNames(statements, names) {
+  for (const statement of statements) {
+    const declaration =
+      statement.type === 'ExportNamedDeclaration' || statement.type === 'ExportDefaultDeclaration'
+        ? statement.declaration
+        : statement;
+    if (declaration?.type === 'VariableDeclaration' && declaration.kind !== 'var' && !declaration.declare) {
+      for (const declarator of declaration.declarations) bindingNames(declarator.id, names);
+    } else if (
+      (declaration?.type === 'FunctionDeclaration' || declaration?.type === 'ClassDeclaration') &&
+      declaration.id &&
+      !declaration.declare
+    ) {
+      names.add(declaration.id.name);
+    }
+  }
+}
+
+/** A function's `var`s, wherever in its body, not in a function inside it. */
+function varNames(node, names) {
+  if (node === null || typeof node !== 'object') return;
+  if (Array.isArray(node)) {
+    for (const child of node) varNames(child, names);
+    return;
+  }
+  if (typeof node.type !== 'string') return;
+  if (
+    node.type === 'FunctionDeclaration' ||
+    node.type === 'FunctionExpression' ||
+    node.type === 'ArrowFunctionExpression' ||
+    TYPE_ONLY.has(node.type)
+  ) {
+    return;
+  }
+  if (node.type === 'VariableDeclaration' && node.kind === 'var' && !node.declare) {
+    for (const declarator of node.declarations) bindingNames(declarator.id, names);
+  }
+  for (const key of Object.keys(node)) {
+    if (key === 'type' || key === 'start' || key === 'end' || key === 'range' || key === 'loc') continue;
+    const child = node[key];
+    if (child !== null && typeof child === 'object') varNames(child, names);
+  }
+}
+
+/**
+ * The name a query() call passes: a string written out, and nothing else.
+ *
+ * @param {any} call
+ * @param {(node: any, why: string) => never} refuse
+ * @returns {string}
+ */
+function queryName(call, refuse) {
+  const [first] = call.arguments;
+  if (first?.type === 'Literal' && typeof first.value === 'string' && first.value !== '') return first.value;
+  if (first?.type === 'TemplateLiteral' && first.expressions.length === 0) {
+    const cooked = first.quasis[0]?.value.cooked;
+    if (typeof cooked === 'string' && cooked !== '') return cooked;
+  }
+  return refuse(
+    call,
+    "calls query() with a name that is not a string literal, so the build cannot put it on its route's allowlist. Write the name out: query('orders.shipments', ...).",
+  );
+}
+
+/**
+ * What one deferredRegistry() call registers: an object written out, each
+ * key a name and each value a component imported from its own module.
+ *
+ * @param {any} call
+ * @param {Map<string, string>} imported each value imported by name here => its specifier
+ * @param {(node: any, why: string) => never} refuse
+ * @returns {Array<[string, string]>} component => the specifier its module is imported by
+ */
+function registered(call, imported, refuse) {
+  const [components] = call.arguments;
+  if (call.arguments.length !== 1 || components?.type !== 'ObjectExpression') {
+    return refuse(call, `calls ${REGISTRY_FUNCTION}() with something other than an object written out.`);
+  }
+
+  /** @type {Array<[string, string]>} */
+  const entries = [];
+  for (const property of components.properties) {
+    if (property.type !== 'Property' || property.computed || property.kind !== 'init' || property.method) {
+      refuse(property, 'registers a deferred component under a name the build cannot read.');
+    }
+    const name =
+      property.key.type === 'Identifier'
+        ? property.key.name
+        : property.key.type === 'Literal' && typeof property.key.value === 'string'
+          ? property.key.value
+          : refuse(property, 'registers a deferred component under a name the build cannot read.');
+
+    let value = property.value;
+    while (SAME_VALUE.has(value.type)) value = value.expression;
+    const from = value.type === 'Identifier' ? imported.get(value.name) : undefined;
+    if (from === undefined) {
+      refuse(
+        property,
+        `registers '${name}' as something other than a component imported from its own module, so the queries it calls cannot be listed.`,
+      );
+    }
+    entries.push([name, /** @type {string} */ (from)]);
+  }
+  return entries;
+}
+
+/** The name an export specifier takes from its source module. */
+function localName(specifier) {
+  return specifier.local?.type === 'Identifier' ? specifier.local.name : specifier.local?.value;
+}
+
+/** `class { query() {} }` names a member, not the binding. */
+function isMemberKey(node, parent) {
+  return (
+    (parent?.type === 'MethodDefinition' || parent?.type === 'PropertyDefinition') &&
+    parent.key === node &&
+    !parent.computed
+  );
+}
+
+/** `ns.nonce`: a namespace read for a name, written out, that is not query() or the registry. */
+function readsOtherThanQuery(node, parent) {
+  return (
+    parent?.type === 'MemberExpression' &&
+    parent.object === node &&
+    !parent.computed &&
+    parent.property.type === 'Identifier' &&
+    parent.property.name !== 'query' &&
+    parent.property.name !== REGISTRY_FUNCTION
+  );
+}
+
+// ---------------------------------------------------------------------------
+// The actions each view may call.
+//
+// tinvar-spec.md, "Defaults and build rules": "an action or query reachable
+// only from admin-panel pages with no panel binding fails the build." Over
+// /_action an action runs behind its own panel's stack, and one with no
+// panel runs behind none: an action written for the admin panel's pages and
+// left unbound answers anyone signed in. Which pages reach an action is a
+// question about source, so the build answers it, as it answers which
+// queries a page calls, and PHP refuses to boot where the answer is "only a
+// panel's" and the action names no panel (ADR 0095).
+//
+// An action is called from a client component, which the rsc graph holds as
+// a reference with its imports gone. So this walk is over source: from each
+// view, and each component the rsc entry registers for <Deferred>, through
+// every import of the application's own -- server and client modules alike
+// -- to each `@actions/*` module codegen writes, by the names imported from
+// it; and to each `action('name')` written out against
+// `@tinvar/react/action`. A namespace, a default or a dynamic import of an
+// actions module counts every action in it, which can only add callers.
+// Dependencies are not read: what they call is not the page's.
+
+/** A module codegen types an action class in: `@actions/RackActions`. */
+const ACTIONS_MODULE = /^@actions\/[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+/** The specifier `action()` itself is imported by. */
+export const ACTION_SPECIFIER = '@tinvar/react/action';
+
+/**
+ * Every view's actions, and every registered deferred component's, read over
+ * the application's source.
+ *
+ * @param {Map<string, string[]>} graph module id => imported ids, the rsc build's
+ * @param {Map<string, string>} registry component => its module id (queryUsers())
+ * @param {string} pagesDir absolute
+ * @param {(specifier: string, importer: string) => Promise<string | null>} resolveId
+ * @returns {Promise<{ views: Record<string, string[]>, components: Record<string, string[]> }>}
+ * @throws {UnreadableQuery} for an actions module whose actions cannot be read
+ */
+export async function actionsOf(graph, registry, pagesDir, resolveId) {
+  /** @type {Map<string, string[]>} module id => the ids its source imports */
+  const edges = new Map();
+  /** @type {Map<string, string[]>} module id => the actions it calls */
+  const calls = new Map();
+  /** @type {Map<string, Map<string, string>>} actions module id => export => action */
+  const modules = new Map();
+
+  const starts = [...[...graph.keys()].filter((id) => viewOf(id, pagesDir) !== null), ...registry.values()];
+  const queue = [...new Set(starts)];
+  const seen = new Set(queue);
+  while (queue.length > 0) {
+    const id = /** @type {string} */ (queue.shift());
+    const file = fileOf(id);
+    if (id.startsWith('\0') || isDependency(file) || !SOURCE.test(file) || !existsSync(file)) continue;
+
+    const source = readFileSync(file, 'utf8');
+    const program = parse(source, file);
+    const next = [];
+    const called = new Set(actionTargets(program, source, file));
+
+    for (const node of program.body) {
+      const from = typeof node.source?.value === 'string' ? node.source.value : null;
+      if (from === null) continue;
+      const to = await resolveId(from, id);
+
+      if (ACTIONS_MODULE.test(from)) {
+        if (to === null)
+          throw new UnreadableQuery(`[tinvar] ${file} imports ${from}, which does not resolve.`);
+        const exported = await actionsIn(modules, to);
+        const names =
+          node.type === 'ImportDeclaration' || node.type === 'ExportNamedDeclaration'
+            ? (node.specifiers ?? []).map((specifier) =>
+                specifier.type === 'ImportSpecifier'
+                  ? importedName(specifier)
+                  : specifier.type === 'ExportSpecifier'
+                    ? specifier.local.type === 'Identifier'
+                      ? specifier.local.name
+                      : specifier.local.value
+                    : null,
+              )
+            : [null];
+        for (const name of names) {
+          if (name === null) {
+            for (const action of exported.values()) called.add(action);
+          } else if (exported.has(name)) {
+            called.add(/** @type {string} */ (exported.get(name)));
+          }
+        }
+        continue;
+      }
+
+      if (to !== null) next.push(to);
+    }
+
+    walk(program, (node) => {
+      if (node.type === 'ImportExpression' && typeof node.source?.value === 'string') {
+        if (ACTIONS_MODULE.test(node.source.value)) called.add('*');
+      }
+      return undefined;
+    });
+    // A dynamic import of an actions module: every action in it, resolved
+    // as a static one is.
+    if (called.has('*')) {
+      called.delete('*');
+      for (const specifier of importSources(source, file)) {
+        if (!ACTIONS_MODULE.test(specifier)) continue;
+        const to = await resolveId(specifier, id);
+        if (to === null) continue;
+        for (const action of (await actionsIn(modules, to)).values()) called.add(action);
+      }
+    }
+    // Imports a dynamic import() names are followed too.
+    for (const specifier of importSources(source, file)) {
+      if (ACTIONS_MODULE.test(specifier)) continue;
+      const to = await resolveId(specifier, id);
+      if (to !== null) next.push(to);
+    }
+
+    edges.set(id, [...new Set(next)]);
+    if (called.size > 0) calls.set(id, [...called]);
+    for (const to of next) {
+      if (!seen.has(to)) {
+        seen.add(to);
+        queue.push(to);
+      }
+    }
+  }
+
+  /** @type {Record<string, string[]>} */
+  const views = Object.create(null);
+  for (const id of [...graph.keys()].sort()) {
+    const view = viewOf(id, pagesDir);
+    if (view !== null) views[view] = callsReachable(edges, calls, id);
+  }
+  /** @type {Record<string, string[]>} */
+  const components = Object.create(null);
+  for (const [component, id] of [...registry].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+    components[component] = callsReachable(edges, calls, id);
+  }
+  return { views, components };
+}
+
+/** The package whose entries hand out the APIs that take an action by name. */
+const REACT_PACKAGE = /^@tinvar\/react(?:\/[a-z-]+)?$/;
+
+/**
+ * What makes an action, or its address, from a name: its argument is the
+ * action's name and nothing else, so it must be written out.
+ */
+const NAMING_APIS = new Set(['action', 'actionUrl', 'actionName', 'optimisticPatch']);
+
+/** What takes an ActionTarget -- a reference, or a name -- first. */
+const TARGET_APIS = new Set(['useHttp']);
+
+/** The methods of what useForm() returns that take an ActionTarget first. */
+const FORM_METHODS = new Set(['submit', 'withPrecognition']);
+
+/** Every name of the package this reader follows. */
+const FOLLOWED = new Set([...NAMING_APIS, ...TARGET_APIS, 'useForm', 'Form']);
+
+/**
+ * The actions one module names by string. Every API that takes an
+ * ActionTarget counts one given as a literal, as `action('literal')` is
+ * counted: `<Form action="name">`, `useHttp('name')`, `useForm()`'s
+ * `submit('name')` and `withPrecognition('name')`, and `action()`,
+ * `actionUrl()`, `actionName()` and `optimisticPatch()`, under any alias or
+ * namespace. A reference -- an `@actions/*` import, or a prop holding one --
+ * is counted where it is imported.
+ *
+ * What the build cannot read refuses it, as the query reader does: a name
+ * made at run time, anything but a written-out name handed to action() and
+ * its kin, and any of these APIs re-exported or used other than by calling
+ * it. Guessing would be no safer than missing: an action is held to its
+ * panel when every page that calls it is in one, so a caller missed and a
+ * caller invented can each let an unbound action pass (ADR 0095).
+ *
+ * @param {any} program
+ * @param {string} source
+ * @param {string} file
+ * @returns {string[]} the names, sorted
+ * @throws {UnreadableQuery} naming the file and line of what it cannot read
+ */
+export function actionTargets(program, source, file) {
+  /** @type {(node: any, why: string) => never} */
+  const refuse = (node, why) => {
+    const line = typeof node?.start === 'number' ? source.slice(0, node.start).split('\n').length : 0;
+    throw new UnreadableQuery(`[tinvar] ${file}${line > 0 ? `:${line}` : ''} ${why}`);
+  };
+
+  /** @type {Map<string, string>} local name => the API it is */
+  const apis = new Map();
+  /** @type {Set<string>} the package's namespaces */
+  const namespaces = new Set();
+  /** @type {Set<string>} local names an @actions module's exports are bound to */
+  const references = new Set();
+  /** @type {Set<string>} @actions modules' namespaces */
+  const referenceSpaces = new Set();
+
+  for (const node of program.body) {
+    const from = typeof node.source?.value === 'string' ? node.source.value : null;
+    if (from === null) continue;
+    if (ACTIONS_MODULE.test(from) && node.type === 'ImportDeclaration') {
+      for (const specifier of node.specifiers) {
+        (specifier.type === 'ImportNamespaceSpecifier' ? referenceSpaces : references).add(
+          specifier.local.name,
+        );
+      }
+      continue;
+    }
+    if (!REACT_PACKAGE.test(from)) continue;
+    if (node.type === 'ImportDeclaration') {
+      if (node.importKind === 'type') continue;
+      for (const specifier of node.specifiers) {
+        if (specifier.importKind === 'type') continue;
+        if (specifier.type === 'ImportNamespaceSpecifier') namespaces.add(specifier.local.name);
+        else if (specifier.type === 'ImportSpecifier' && FOLLOWED.has(importedName(specifier))) {
+          apis.set(specifier.local.name, importedName(specifier));
+        }
+      }
+    } else if (node.exportKind !== 'type') {
+      // Handed on, it is used elsewhere under a name this cannot follow.
+      const handed =
+        node.type === 'ExportAllDeclaration' ||
+        (node.specifiers ?? []).some((specifier) =>
+          FOLLOWED.has(specifier.local.type === 'Identifier' ? specifier.local.name : specifier.local.value),
+        );
+      if (handed) {
+        refuse(
+          node,
+          `re-exports from ${from} what takes an action by name, so the actions named through it cannot be listed. Import it where it is used.`,
+        );
+      }
+    }
+  }
+
+  /** The API a callee or an element's name is, or null. */
+  const apiOf = (/** @type {any} */ callee) => {
+    if (callee?.type === 'Identifier' || callee?.type === 'JSXIdentifier')
+      return apis.get(callee.name) ?? null;
+    if (
+      (callee?.type === 'MemberExpression' || callee?.type === 'JSXMemberExpression') &&
+      !callee.computed &&
+      (callee.object.type === 'Identifier' || callee.object.type === 'JSXIdentifier') &&
+      namespaces.has(callee.object.name) &&
+      FOLLOWED.has(callee.property.name)
+    ) {
+      return callee.property.name;
+    }
+    return null;
+  };
+
+  /** @type {Map<string, any>} what each name this module binds with an initializer is bound to */
+  const constants = new Map();
+  /** @type {Set<string>} names useForm()'s submit and withPrecognition are bound to */
+  const formMethods = new Set();
+  walk(program, (node) => {
+    if (node.type !== 'VariableDeclarator' || !node.init) return undefined;
+    if (node.id.type === 'Identifier') constants.set(node.id.name, node.init);
+    if (
+      node.id.type === 'ObjectPattern' &&
+      node.init.type === 'CallExpression' &&
+      apiOf(node.init.callee) === 'useForm'
+    ) {
+      for (const property of node.id.properties) {
+        const key = property.type === 'Property' && !property.computed ? property.key : null;
+        if (key?.type === 'Identifier' && FORM_METHODS.has(key.name)) {
+          if (property.value.type !== 'Identifier') {
+            refuse(property, `binds useForm()'s ${key.name} so the build cannot follow it.`);
+          }
+          formMethods.add(property.value.name);
+        }
+      }
+    }
+    return undefined;
+  });
+  const formsUsed = [...apis.values()].includes('useForm') || namespaces.size > 0;
+
+  /** @type {Set<string>} */
+  const found = new Set();
+  /** The string a node writes out -- a literal, or a template with no holes -- or undefined. */
+  const written = (/** @type {any} */ node) =>
+    node?.type === 'Literal' && typeof node.value === 'string'
+      ? node.value
+      : node?.type === 'TemplateLiteral' && node.expressions.length === 0
+        ? (node.quasis[0]?.value.cooked ?? undefined)
+        : undefined;
+  /** Whether a node makes a string at run time: a template with holes, a concatenation. */
+  const computed = (/** @type {any} */ node) =>
+    (node?.type === 'TemplateLiteral' && node.expressions.length > 0) ||
+    (node?.type === 'BinaryExpression' && node.operator === '+');
+
+  /**
+   * A name, as action() and its kin take one: written out, or a constant of
+   * this module that is; or a reference from an @actions module, counted by
+   * its import. Anything else -- a parameter, a prop, a name made at run
+   * time -- is refused.
+   */
+  const name = (/** @type {any} */ node, /** @type {string} */ api, seen = new Set()) => {
+    const text = written(node);
+    if (text !== undefined) {
+      found.add(text);
+      return;
+    }
+    if (node?.type === 'Identifier' && references.has(node.name)) return;
+    if (
+      node?.type === 'MemberExpression' &&
+      !node.computed &&
+      node.object.type === 'Identifier' &&
+      referenceSpaces.has(node.object.name)
+    ) {
+      return;
+    }
+    if (node?.type === 'Identifier' && constants.has(node.name) && !seen.has(node.name)) {
+      seen.add(node.name);
+      name(constants.get(node.name), api, seen);
+      return;
+    }
+    if (node?.type === 'ConditionalExpression') {
+      name(node.consequent, api, seen);
+      name(node.alternate, api, seen);
+      return;
+    }
+    refuse(
+      node,
+      `calls ${api}() with a name the build cannot read. Write the action's name out: ${api}('orders.place').`,
+    );
+  };
+
+  /**
+   * An ActionTarget: a name written out is counted; a reference, or a value
+   * holding one, is counted where it was made; a string made at run time,
+   * or a name given to an object's `action`, is read as action() reads one.
+   */
+  const target = (/** @type {any} */ node, /** @type {string} */ api, seen = new Set()) => {
+    if (node === undefined || node === null) return;
+    const text = written(node);
+    if (text !== undefined) {
+      found.add(text);
+      return;
+    }
+    if (computed(node)) {
+      refuse(
+        node,
+        `hands ${api} an action's name made at run time. Name it with an @actions import, or write its name out.`,
+      );
+    }
+    switch (node.type) {
+      case 'Identifier':
+        if (!references.has(node.name) && constants.has(node.name) && !seen.has(node.name)) {
+          seen.add(node.name);
+          target(constants.get(node.name), api, seen);
+        }
+        return;
+      case 'ConditionalExpression':
+        target(node.consequent, api, seen);
+        target(node.alternate, api, seen);
+        return;
+      case 'LogicalExpression':
+        target(node.left, api, seen);
+        target(node.right, api, seen);
+        return;
+      case 'TSAsExpression':
+      case 'TSSatisfiesExpression':
+      case 'TSNonNullExpression':
+      case 'ParenthesizedExpression':
+        target(node.expression, api, seen);
+        return;
+      case 'CallExpression':
+        // action('name') and its kin are read where they are called; any
+        // other call's result is a name or a reference no one can read here.
+        if (NAMING_APIS.has(apiOf(node.callee) ?? '')) return;
+        refuse(
+          node,
+          `hands ${api} what a call returns, which the build cannot read. Name the action with an @actions import, or write its name out.`,
+        );
+        return;
+      case 'ObjectExpression':
+        // `{ action: 'name' }`, an ActionTarget too.
+        for (const property of node.properties) {
+          if (property.type !== 'Property' || property.computed) {
+            refuse(property, `hands ${api} an object whose action the build cannot read.`);
+          }
+          if ((property.key.name ?? property.key.value) === 'action') name(property.value, api);
+        }
+        return;
+      default:
+        // A member, a call's result, a prop: a reference, or a value made
+        // from one, each counted where it came from.
+        return;
+    }
+  };
+
+  walk(program, (node, parent) => {
+    if (node.type === 'ImportDeclaration' || (node.type === 'ExportNamedDeclaration' && node.source))
+      return false;
+    if (node.type === 'CallExpression') {
+      const api = apiOf(node.callee);
+      if (api !== null && NAMING_APIS.has(api)) name(node.arguments[0], api);
+      else if (api !== null && TARGET_APIS.has(api)) target(node.arguments[0], `${api}()`);
+      else if (
+        node.arguments.length > 0 &&
+        node.callee.type === 'Identifier' &&
+        formMethods.has(node.callee.name)
+      ) {
+        target(node.arguments[0], `${node.callee.name}()`);
+      } else if (
+        node.arguments.length > 0 &&
+        formsUsed &&
+        node.callee.type === 'MemberExpression' &&
+        !node.callee.computed &&
+        node.callee.property.type === 'Identifier' &&
+        FORM_METHODS.has(node.callee.property.name)
+      ) {
+        target(node.arguments[0], `${node.callee.property.name}()`);
+      }
+      return undefined;
+    }
+    if (node.type === 'JSXOpeningElement' && apiOf(node.name) === 'Form') {
+      // A spread after the last action= may set the action itself; one
+      // before it is overridden by it.
+      let spread = null;
+      for (const attribute of node.attributes) {
+        if (attribute.type === 'JSXSpreadAttribute') {
+          spread = attribute;
+        } else if (attribute.name?.type === 'JSXIdentifier' && attribute.name.name === 'action') {
+          const value = attribute.value;
+          target(value?.type === 'JSXExpressionContainer' ? value.expression : value, '<Form action>');
+          spread = null;
+        }
+      }
+      if (spread !== null) {
+        refuse(
+          spread,
+          'spreads props into <Form> after its action=, so the action it posts to cannot be read. Put action= after the spread.',
+        );
+      }
+      return undefined;
+    }
+    // One of these APIs used other than by calling it, or drawing it: handed
+    // on, under a name this cannot follow.
+    const handed =
+      (node.type === 'Identifier' && apis.has(node.name) && !isPropertyKey(node, parent)) ||
+      (node.type === 'MemberExpression' && apiOf(node) !== null);
+    const used =
+      (parent?.type === 'CallExpression' && parent.callee === node) ||
+      (parent?.type === 'ChainExpression' && parent.expression === node) ||
+      (typeof parent?.type === 'string' &&
+        parent.type.startsWith('TS') &&
+        !/^TS(As|Satisfies|NonNull)Expression$/.test(parent.type));
+    if (handed && !used) {
+      refuse(
+        node,
+        `uses ${node.type === 'Identifier' ? node.name : apiOf(node)} other than by calling it, so the actions named through it cannot be listed. Call it where it is imported.`,
+      );
+    }
+    return node.type === 'MemberExpression' && apiOf(node) !== null ? false : undefined;
+  });
+
+  return [...found].sort();
+}
+
+/**
+ * The actions an `@actions/*` module codegen wrote exports, by export name:
+ * each `export const name = action<...>('class.method')`. Anything else in
+ * it means it is not codegen's, and nothing it exports can be named.
+ *
+ * @param {Map<string, Map<string, string>>} modules read so far, by id
+ * @param {string} id
+ * @returns {Promise<Map<string, string>>}
+ */
+async function actionsIn(modules, id) {
+  const known = modules.get(id);
+  if (known !== undefined) return known;
+
+  const file = fileOf(id);
+  if (!existsSync(file)) throw new UnreadableQuery(`[tinvar] ${file}, an actions module, cannot be read.`);
+  const program = parse(readFileSync(file, 'utf8'), file);
+  /** @type {Map<string, string>} */
+  const actions = new Map();
+  for (const node of program.body) {
+    if (node.type !== 'ExportNamedDeclaration' || node.declaration?.type !== 'VariableDeclaration') continue;
+    for (const declarator of node.declaration.declarations) {
+      const init = declarator.init;
+      const name = init?.type === 'CallExpression' ? init.arguments[0] : null;
+      if (
+        declarator.id.type !== 'Identifier' ||
+        init?.type !== 'CallExpression' ||
+        init.callee.type !== 'Identifier' ||
+        name?.type !== 'Literal' ||
+        typeof name.value !== 'string'
+      ) {
+        throw new UnreadableQuery(
+          `[tinvar] ${file} exports something that is not an action codegen wrote; run tinvar codegen to write it again.`,
+        );
+      }
+      actions.set(declarator.id.name, name.value);
+    }
+  }
+  modules.set(id, actions);
+  return actions;
+}
+
+/** A module's view id -- its path under the pages directory, without the extension -- or null. */
+function viewOf(id, pagesDir) {
+  const file = fileOf(id);
+  const under = relative(pagesDir, file);
+  if (id.startsWith('\0') || under.startsWith('..') || under.startsWith(sep) || !SOURCE.test(file))
+    return null;
+
+  return under.slice(0, -extname(under).length).split(sep).join('/');
+}
+
+/**
+ * The names called anywhere reachable from one module, itself included, sorted.
+ *
+ * @param {Map<string, string[]>} graph
+ * @param {Map<string, string[]>} calls
+ * @param {string} start
+ * @returns {string[]}
+ */
+function callsReachable(graph, calls, start) {
+  const found = new Set();
+  const seen = new Set([start]);
+  const queue = [start];
+  while (queue.length > 0) {
+    const current = /** @type {string} */ (queue.shift());
+    for (const name of calls.get(current) ?? []) found.add(name);
+    for (const next of graph.get(current) ?? []) {
+      if (!seen.has(next)) {
+        seen.add(next);
+        queue.push(next);
+      }
+    }
+  }
+  return [...found].sort();
+}