@rindle/router 0.1.0-rc.5

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,44 @@
+# @rindle/router
+
+The **stateless read-routing control-plane proxy** (`designs/READ-ROUTER-DESIGN.md`). In a
+multi-follower replicator topology, a read lease is **follower-local** — the `leaseToken` minted by
+`materialize` is valid only on the follower that minted it, and the browser must open its
+subscription ws to that same follower. The router is the **placement authority** that puts both legs
+on one node.
+
+It is:
+
+- **Stateless.** Placement is one pure function — `route(key) = HRW(key, live())` (weighted
+  rendezvous hashing, tie-broken on follower id so replicas agree). No binding cache, no per-session
+  state, no pin state. Restart is free; run it active/active.
+- **Off the data plane.** It interposes on the control plane only — `materialize` / `query` route to
+  one follower and the output is stamped with that follower's public `wsEndpoint`. The browser opens
+  its ws **directly** to the follower.
+- **Reads only.** Writes never route through the router (`executeSqlTxn` / `migrate` / … reject as a
+  misconfiguration backstop). The api-server's `SplitDaemonClient` sends writes to the master.
+
+```ts
+import { RoutingReadClient, StaticFollowerRegistry, createRouterServer, createRouterPinClient } from "@rindle/router";
+
+const registry = new StaticFollowerRegistry([
+  { id: "f1", controlPlaneUrl: "http://f1.internal:7600", wsEndpoint: "wss://f1.example.com/ws" },
+  { id: "f2", controlPlaneUrl: "http://f2.internal:7600", wsEndpoint: "wss://f2.example.com/ws" },
+]);
+const router = new RoutingReadClient({ registry, daemonToken: process.env.DAEMON_TOKEN });
+await createRouterServer({ router, token: process.env.ROUTER_TOKEN, port: 7650 });
+```
+
+The api-server points its reads leg at the router (an ordinary `HttpRindleDaemonClient` to the
+router's URL) and its writes leg at the master, composed via `SplitDaemonClient`. The fleet pin
+fan-out (`assertPins`) is reached over the same hop via `createRouterPinClient`.
+
+## Exports
+
+- `route` / `hashUnit` — the pure HRW placement function.
+- `StaticFollowerRegistry` / `FollowerRegistry` / `Follower` — the membership view.
+- `RoutingReadClient` — the routing read-proxy (implements `RindleDaemonClient` for the read legs,
+  plus the explicit `assertPins` fleet fan-out).
+- `NoLiveFollowersError` — thrown when placement finds no live follower for a key (no node to
+  route the read leg to).
+- `createRouterServer` / `dispatchRouter` / `ROUTER_PATHS` — the HTTP front.
+- `createRouterPinClient` — the api-server's `pinFanout` over HTTP.

package/dist/hrw.d.ts

@@ -0,0 +1,15 @@
+/** Map a string to a stable unit float in the OPEN interval (0,1) — deterministic across runtimes
+ *  (FNV-1a 64-bit over UTF-8 bytes in exact BigInt, then folded to a 53-bit double mantissa). The
+ *  open interval matters: HRW needs `hashUnit ∈ (0,1)` so `-ln(hashUnit) > 0` (never 0 or ∞). */
+export declare function hashUnit(s: string): number;
+/** The minimum a follower must expose to be placed: a stable `id` and an optional `weight`
+ *  (load share ∝ weight; default 1; a weight ≤ 0 opts the follower out of placement). */
+export interface RoutableFollower {
+    id: string;
+    weight?: number;
+}
+/** Place `key` on exactly one of `followers` by weighted HRW. Returns `undefined` only when the set
+ *  is empty (or every follower has weight ≤ 0) — the caller turns that into a 503. Order-independent:
+ *  shuffling `followers` never changes the result (max score, then lexicographically-smallest `id`). */
+export declare function route<F extends RoutableFollower>(key: string, followers: readonly F[]): F | undefined;
+//# sourceMappingURL=hrw.d.ts.map

package/dist/hrw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrw.d.ts","sourceRoot":"","sources":["../src/hrw.ts"],"names":[],"mappings":"AASA;;iGAEiG;AACjG,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB1C;AAED;yFACyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;wGAEwG;AACxG,wBAAgB,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,SAAS,CAarG"}

package/dist/hrw.js

@@ -0,0 +1,48 @@
+// Weighted rendezvous hashing (HRW) — the router's one pure placement function
+// (READ-ROUTER-DESIGN.md §1.4, §2.2). `route(key, followers)` is a deterministic function of the
+// membership SET + key: HRW's logarithmic method gives each follower a score
+// `weight / -ln(hashUnit(key‖id))` and the max wins, tie-broken on `id` so the result is
+// INDEPENDENT of the followers' order (two router replicas over the same set agree). HRW's
+// minimal-disruption property is what bounds churn to ~1/N keys on a membership change.
+const encoder = new TextEncoder();
+/** Map a string to a stable unit float in the OPEN interval (0,1) — deterministic across runtimes
+ *  (FNV-1a 64-bit over UTF-8 bytes in exact BigInt, then folded to a 53-bit double mantissa). The
+ *  open interval matters: HRW needs `hashUnit ∈ (0,1)` so `-ln(hashUnit) > 0` (never 0 or ∞). */
+export function hashUnit(s) {
+    const bytes = encoder.encode(s);
+    const mask = 0xffffffffffffffffn;
+    let h = 0xcbf29ce484222325n; // FNV offset basis (64-bit)
+    for (let i = 0; i < bytes.length; i++) {
+        h ^= BigInt(bytes[i]);
+        h = (h * 0x100000001b3n) & mask; // FNV prime
+    }
+    // FNV's LOW bits are weakly mixed (a multiplicative hash barely diffuses high bits downward), so
+    // folding them straight to a mantissa biases placement. Run Murmur3's fmix64 avalanche first —
+    // afterward every bit depends on every input bit, so the low 53 are uniform.
+    h ^= h >> 33n;
+    h = (h * 0xff51afd7ed558ccdn) & mask;
+    h ^= h >> 33n;
+    h = (h * 0xc4ceb9fe1a85ec53n) & mask;
+    h ^= h >> 33n;
+    const bits = Number(h & ((1n << 53n) - 1n)); // 0 .. 2^53 - 1
+    return (bits + 0.5) / 2 ** 53; // strictly inside (0, 1)
+}
+/** Place `key` on exactly one of `followers` by weighted HRW. Returns `undefined` only when the set
+ *  is empty (or every follower has weight ≤ 0) — the caller turns that into a 503. Order-independent:
+ *  shuffling `followers` never changes the result (max score, then lexicographically-smallest `id`). */
+export function route(key, followers) {
+    let best;
+    let bestScore = -Infinity;
+    for (const f of followers) {
+        const weight = f.weight ?? 1;
+        if (weight <= 0)
+            continue;
+        const score = weight / -Math.log(hashUnit(`${key}\u0000${f.id}`));
+        if (score > bestScore || (score === bestScore && best !== undefined && f.id < best.id)) {
+            best = f;
+            bestScore = score;
+        }
+    }
+    return best;
+}
+//# sourceMappingURL=hrw.js.map

package/dist/hrw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrw.js","sourceRoot":"","sources":["../src/hrw.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,iGAAiG;AACjG,6EAA6E;AAC7E,yFAAyF;AACzF,2FAA2F;AAC3F,wFAAwF;AAExF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;iGAEiG;AACjG,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,4BAA4B;IACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,YAAY;IAC/C,CAAC;IACD,iGAAiG;IACjG,+FAA+F;IAC/F,6EAA6E;IAC7E,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACd,CAAC,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,IAAI,CAAC;IACrC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACd,CAAC,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,IAAI,CAAC;IACrC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB;IAC7D,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,yBAAyB;AAC1D,CAAC;AASD;;wGAEwG;AACxG,MAAM,UAAU,KAAK,CAA6B,GAAW,EAAE,SAAuB;IACpF,IAAI,IAAmB,CAAC;IACxB,IAAI,SAAS,GAAG,CAAC,QAAQ,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,IAAI,CAAC;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACvF,IAAI,GAAG,CAAC,CAAC;YACT,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,37 @@
+import type { MaterializeInput } from "@rindle/daemon-client";
+import type { RoutingReadClient } from "./router.ts";
+export declare const ROUTER_PATHS: {
+    readonly materialize: "/materialize";
+    readonly query: "/query";
+    readonly dematerialize: "/dematerialize";
+    readonly assertPins: "/assert-pins";
+};
+/** Dispatch one parsed request to the router (the runtime-agnostic core — drive it from any HTTP
+ *  shell). Throws `{ status: 404 }` for an unknown path; routing errors carry their own `status`
+ *  (e.g. {@link NoLiveFollowersError} → 503). */
+export declare function dispatchRouter(router: RoutingReadClient, path: string, body: unknown): Promise<unknown>;
+export interface RouterServerOptions {
+    router: RoutingReadClient;
+    /** Inbound bearer token the api-server must present. Omit to disable auth (dev/tests only). */
+    token?: string;
+    port?: number;
+}
+export interface RouterServer {
+    readonly port: number;
+    close(): Promise<void>;
+}
+/** Start the router's Node HTTP server. Resolves once listening (port resolved when `port: 0`). */
+export declare function createRouterServer(opts: RouterServerOptions): Promise<RouterServer>;
+/** The api-server's `pinFanout`: invokes the router's explicit fleet pin-assert over HTTP
+ *  (`POST /assert-pins`). Mirrors how the api-server reaches the router for reads, so a routed
+ *  deploy uses one `RINDLE_ROUTER_URL` (+ token) for both legs. */
+export interface RouterPinClient {
+    assertPins(pins: readonly MaterializeInput[]): Promise<void>;
+}
+export interface RouterPinClientOptions {
+    baseUrl: string;
+    token?: string;
+    fetch?: typeof fetch;
+}
+export declare function createRouterPinClient(opts: RouterPinClientOptions): RouterPinClient;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AAEX;;iDAEiD;AACjD,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvG;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyBnF;AAOD;;mEAEmE;AACnE,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,eAAe,CAgBnF"}

package/dist/http.js

@@ -0,0 +1,86 @@
+// The router's HTTP front (READ-ROUTER-DESIGN.md §9) — it speaks the daemon control-plane read
+// surface so the api-server reaches it through an ordinary `HttpRindleDaemonClient`, plus the one
+// extra fleet route `/assert-pins`. The api-server's `RINDLE_ROUTER_URL` points here for the reads
+// leg; `RINDLE_MASTER_URL` points at the master for writes (the `SplitDaemonClient`, §2.1).
+//
+// `createRouterPinClient` is the counterpart the api-server's `pinFanout` uses to invoke the fleet
+// pin-assert over that same HTTP hop.
+import { createServer } from "node:http";
+export const ROUTER_PATHS = {
+    materialize: "/materialize",
+    query: "/query",
+    dematerialize: "/dematerialize",
+    assertPins: "/assert-pins",
+};
+/** Dispatch one parsed request to the router (the runtime-agnostic core — drive it from any HTTP
+ *  shell). Throws `{ status: 404 }` for an unknown path; routing errors carry their own `status`
+ *  (e.g. {@link NoLiveFollowersError} → 503). */
+export function dispatchRouter(router, path, body) {
+    // The body is untrusted JSON off the wire — cast through `unknown` to the control-plane input
+    // shapes (the followers' control plane validates the contents).
+    const msg = (body ?? {});
+    switch (path) {
+        case ROUTER_PATHS.materialize:
+            return router.materialize(msg);
+        case ROUTER_PATHS.query:
+            return router.query(msg);
+        case ROUTER_PATHS.dematerialize:
+            return router.dematerialize(msg);
+        case ROUTER_PATHS.assertPins:
+            return router.assertPins(msg.pins ?? []).then(() => ({ ok: true }));
+        default:
+            throw Object.assign(new Error(`read router: not found: ${path}`), { status: 404 });
+    }
+}
+/** Start the router's Node HTTP server. Resolves once listening (port resolved when `port: 0`). */
+export function createRouterServer(opts) {
+    const handle = async (req, res) => {
+        try {
+            if (req.method !== "POST")
+                return send(res, 405, { error: "method not allowed" });
+            if (opts.token && req.headers.authorization !== `Bearer ${opts.token}`) {
+                return send(res, 401, { error: "unauthorized" });
+            }
+            const chunks = [];
+            for await (const chunk of req)
+                chunks.push(chunk);
+            const body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+            const out = await dispatchRouter(opts.router, req.url ?? "", body);
+            send(res, 200, out ?? {});
+        }
+        catch (err) {
+            const status = err?.status ?? 500;
+            send(res, status, { error: String(err?.message ?? err) });
+        }
+    };
+    const server = createServer((req, res) => void handle(req, res));
+    return new Promise((resolve) => {
+        server.listen(opts.port ?? 0, () => {
+            const port = server.address().port;
+            resolve({ port, close: () => new Promise((r) => server.close(() => r())) });
+        });
+    });
+}
+function send(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+export function createRouterPinClient(opts) {
+    const base = opts.baseUrl.endsWith("/") ? opts.baseUrl.slice(0, -1) : opts.baseUrl;
+    const fetchImpl = opts.fetch ?? ((...args) => fetch(...args));
+    return {
+        async assertPins(pins) {
+            const res = await fetchImpl(`${base}${ROUTER_PATHS.assertPins}`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+                },
+                body: JSON.stringify({ pins }),
+            });
+            if (!res.ok)
+                throw new Error(`read router assert-pins failed: ${res.status} ${await res.text()}`);
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,4FAA4F;AAC5F,EAAE;AACF,mGAAmG;AACnG,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAOpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,cAAc;IAC3B,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,gBAAgB;IAC/B,UAAU,EAAE,cAAc;CAClB,CAAC;AAEX;;iDAEiD;AACjD,MAAM,UAAU,cAAc,CAAC,MAAyB,EAAE,IAAY,EAAE,IAAa;IACnF,8FAA8F;IAC9F,gEAAgE;IAChE,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACpD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW;YAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,GAAkC,CAAC,CAAC;QAChE,KAAK,YAAY,CAAC,KAAK;YACrB,OAAO,MAAM,CAAC,KAAK,CAAC,GAA2D,CAAC,CAAC;QACnF,KAAK,YAAY,CAAC,aAAa;YAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,GAAwD,CAAC,CAAC;QACxF,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,MAAM,CAAC,UAAU,CAAE,GAAG,CAAC,IAA2B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F;YACE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAcD,mGAAmG;AACnG,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QAChF,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAClF,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAI,GAA2B,EAAE,MAAM,IAAI,GAAG,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACpD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAeD,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACxF,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { hashUnit, route } from "./hrw.ts";
+export type { RoutableFollower } from "./hrw.ts";
+export { StaticFollowerRegistry } from "./registry.ts";
+export type { Follower, FollowerRegistry } from "./registry.ts";
+export { NoLiveFollowersError, RoutingReadClient } from "./router.ts";
+export type { FollowerClientFactory, RoutingReadClientOptions } from "./router.ts";
+export { ROUTER_PATHS, createRouterPinClient, createRouterServer, dispatchRouter } from "./http.ts";
+export type { RouterPinClient, RouterPinClientOptions, RouterServer, RouterServerOptions } from "./http.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+// @rindle/router — the stateless read-routing control-plane proxy (READ-ROUTER-DESIGN.md).
+// Placement is one pure function (`route = HRW(key, live())`); the router holds the follower
+// membership view and NO per-session / NO pin state. The api-server's `SplitDaemonClient` points
+// its reads leg here (writes go to the master); the browser↔follower ws data path stays direct.
+export { hashUnit, route } from "./hrw.js";
+export { StaticFollowerRegistry } from "./registry.js";
+export { NoLiveFollowersError, RoutingReadClient } from "./router.js";
+export { ROUTER_PATHS, createRouterPinClient, createRouterServer, dispatchRouter } from "./http.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,6FAA6F;AAC7F,iGAAiG;AACjG,gGAAgG;AAEhG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,38 @@
+import type { RoutableFollower } from "./hrw.ts";
+export interface Follower extends RoutableFollower {
+    /** Stable identity — the HRW input and the client-cache key. Survives restarts (same id ⇒ a key
+     *  still HRWs to it, so a reboot needs no re-placement, §3). */
+    id: string;
+    /** PRIVATE control-plane URL (router → follower `/materialize`, `/query`, `/dematerialize`).
+     *  Never exposed to the browser. */
+    controlPlaneUrl: string;
+    /** PUBLIC ws endpoint (`wss:443`) the browser opens its subscription to — the lease's
+     *  `wsEndpoint`. Browser-reachable; the only follower address that crosses a provider boundary. */
+    wsEndpoint: string;
+    /** Load share ∝ weight (default 1). A weight ≤ 0 opts the follower out of placement. */
+    weight?: number;
+    /** Routable when not explicitly false (the default). Set false to drain/quarantine — it drops
+     *  out of `live()` and its keys re-HRW elsewhere on their next lease. */
+    healthy?: boolean;
+}
+export interface FollowerRegistry {
+    /** The currently routable (healthy) followers. HRW runs over exactly this set, so the result is
+     *  a pure function of what `live()` returns at call time. */
+    live(): readonly Follower[];
+}
+/** A registry backed by an in-memory list — the dev/test source, and the substrate a health probe
+ *  or discovery loop drives via {@link set}/{@link setHealthy}. Copies entries on the way in so the
+ *  caller can't mutate the routed set behind the router's back. */
+export declare class StaticFollowerRegistry implements FollowerRegistry {
+    private followers;
+    constructor(followers?: readonly Follower[]);
+    live(): readonly Follower[];
+    /** The full routable set, healthy or not (for diagnostics / a health probe). */
+    all(): readonly Follower[];
+    /** Replace the whole membership set (a discovery refresh). */
+    set(followers: readonly Follower[]): void;
+    /** Mark one follower healthy/unhealthy — drops it from / restores it to `live()`. No-op for an
+     *  unknown id. */
+    setHealthy(id: string, healthy: boolean): void;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,MAAM,WAAW,QAAS,SAAQ,gBAAgB;IAChD;oEACgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX;wCACoC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB;uGACmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;6EACyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B;iEAC6D;IAC7D,IAAI,IAAI,SAAS,QAAQ,EAAE,CAAC;CAC7B;AAED;;mEAEmE;AACnE,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,SAAS,CAAa;gBAElB,SAAS,GAAE,SAAS,QAAQ,EAAO;IAI/C,IAAI,IAAI,SAAS,QAAQ,EAAE;IAI3B,gFAAgF;IAChF,GAAG,IAAI,SAAS,QAAQ,EAAE;IAI1B,8DAA8D;IAC9D,GAAG,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,GAAG,IAAI;IAIzC;sBACkB;IAClB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;CAI/C"}

package/dist/registry.js

@@ -0,0 +1,36 @@
+// The follower membership view (READ-ROUTER-DESIGN.md §2.2, §9). The router holds NO per-session
+// or pin state — the registry's `live()` set is the only input HRW routes over. "Unhealthy"
+// (unreachable / draining) ⇒ dropped from `live()`, which is what re-HRWs its sessions on their
+// next lease. A merely *lagging* follower stays in `live()` (it still serves reads).
+//
+// Source of the set: a static list (dev) → Fly 6PN `.internal` / orchestrator API (prod) → gossip
+// later — all behind this interface. Each entry carries TWO addresses: the PRIVATE control-plane
+// URL the router POSTs to, and the PUBLIC ws endpoint handed to the browser as `wsEndpoint`.
+/** A registry backed by an in-memory list — the dev/test source, and the substrate a health probe
+ *  or discovery loop drives via {@link set}/{@link setHealthy}. Copies entries on the way in so the
+ *  caller can't mutate the routed set behind the router's back. */
+export class StaticFollowerRegistry {
+    followers;
+    constructor(followers = []) {
+        this.followers = followers.map((f) => ({ ...f }));
+    }
+    live() {
+        return this.followers.filter((f) => f.healthy !== false);
+    }
+    /** The full routable set, healthy or not (for diagnostics / a health probe). */
+    all() {
+        return this.followers;
+    }
+    /** Replace the whole membership set (a discovery refresh). */
+    set(followers) {
+        this.followers = followers.map((f) => ({ ...f }));
+    }
+    /** Mark one follower healthy/unhealthy — drops it from / restores it to `live()`. No-op for an
+     *  unknown id. */
+    setHealthy(id, healthy) {
+        const f = this.followers.find((x) => x.id === id);
+        if (f)
+            f.healthy = healthy;
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,4FAA4F;AAC5F,gGAAgG;AAChG,qFAAqF;AACrF,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AA2B7F;;mEAEmE;AACnE,MAAM,OAAO,sBAAsB;IACzB,SAAS,CAAa;IAE9B,YAAY,YAAiC,EAAE;QAC7C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED,gFAAgF;IAChF,GAAG;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,8DAA8D;IAC9D,GAAG,CAAC,SAA8B;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;sBACkB;IAClB,UAAU,CAAC,EAAU,EAAE,OAAgB;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;IAC7B,CAAC;CACF"}

package/dist/router.d.ts

@@ -0,0 +1,45 @@
+import { type DematerializeInput, type DematerializeOutput, type MaterializeInput, type MaterializeOutput, type MigrateInput, type MigrateOutput, type MutationRejection, type MutationRejectionOutput, type QueryOnceInput, type QueryOnceOutput, type RindleDaemonClient, type RowChangeTxn, type RowChangeTxnOutput, type SqlTxn, type SqlTxnOutput } from "@rindle/daemon-client";
+import type { Follower, FollowerRegistry } from "./registry.ts";
+/** Build a control-plane client for one follower (the seam tests inject recording fakes through). */
+export type FollowerClientFactory = (follower: Follower) => RindleDaemonClient;
+export interface RoutingReadClientOptions {
+    registry: FollowerRegistry;
+    /** Build a control-plane client for a follower. Default: an {@link HttpRindleDaemonClient} to the
+     *  follower's `controlPlaneUrl` carrying a Bearer `daemonToken`. */
+    clientFor?: FollowerClientFactory;
+    /** Bearer token the router presents OUTBOUND to follower control planes (the existing
+     *  `DAEMON_TOKEN`). Used only by the default {@link clientFor}. */
+    daemonToken?: string;
+}
+/** Returned (rejected) when there is no follower to place a read on — the honest 503 surface
+ *  (§5/§8.1): while the live set is empty no new query can materialize. */
+export declare class NoLiveFollowersError extends Error {
+    readonly status = 503;
+    constructor();
+}
+export declare class RoutingReadClient implements RindleDaemonClient {
+    private readonly registry;
+    private readonly clientForFollower;
+    /** Memoized per-follower control-plane clients, keyed by id; rebuilt if a follower's
+     *  `controlPlaneUrl` changes (membership churn). Pure cache — no routing/pin state. */
+    private readonly clients;
+    constructor(opts: RoutingReadClientOptions);
+    materialize(input: MaterializeInput): Promise<MaterializeOutput>;
+    query(input: QueryOnceInput): Promise<QueryOnceOutput>;
+    /** Un-pin / drop by query identity — fans across ALL live followers, because a `materializationId`
+     *  is follower-local and unroutable and un-pin is by NAME (§4.2). `removed` is true if any
+     *  follower removed it. */
+    dematerialize(input: DematerializeInput): Promise<DematerializeOutput>;
+    /** Fan EACH already-resolved pin (authoritative AST + `pinned` policy) across ALL live followers.
+     *  Best-effort and stateless: the router sprays the currently-live set and remembers nothing — a
+     *  follower not live at push time catches up via the lazy floor (§4.1). Rejects if any
+     *  follower×pin call failed, so the api-server retries on its next trigger. */
+    assertPins(pins: readonly MaterializeInput[]): Promise<void>;
+    executeSqlTxn(_input: SqlTxn): Promise<SqlTxnOutput>;
+    rejectMutation(_input: MutationRejection): Promise<MutationRejectionOutput>;
+    applyRowChangeTxn(_input: RowChangeTxn): Promise<RowChangeTxnOutput>;
+    migrate(_input: MigrateInput): Promise<MigrateOutput>;
+    private place;
+    private clientOf;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhE,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,kBAAkB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;wEACoE;IACpE,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC;uEACmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;2EAC2E;AAC3E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,OAAO;;CAKvB;AAED,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwB;IAC1D;2FACuF;IACvF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkE;gBAE9E,IAAI,EAAE,wBAAwB;IAapC,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAMhE,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ5D;;+BAE2B;IACrB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAS5E;;;mFAG+E;IACzE,UAAU,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBlE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAGpD,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAG3E,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAGpE,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAMrD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,QAAQ;CAOjB"}

package/dist/router.js

@@ -0,0 +1,118 @@
+// The stateless routing read-client (READ-ROUTER-DESIGN.md §2.1). From the api-server's view it IS
+// the read daemon — it implements `RindleDaemonClient` for the read legs (`materialize`, `query`)
+// and routes each to ONE follower by HRW, stamping that follower's public `wsEndpoint` onto the
+// output so the browser connects to the node holding its lease. It also exposes an EXPLICIT fleet
+// pin-assert (`assertPins`) that fans a pin across ALL live followers — distinct, on purpose, from a
+// per-viewer `materialize` (never inferred from `policy.kind`, §4). It holds NO per-session and NO
+// pin state: routing is a pure function of `(key, live())`, so a fresh instance routes identically.
+//
+// Writes NEVER route through the read router (§2.1): the write methods reject loudly as a
+// misconfiguration backstop — the api-server's `SplitDaemonClient` sends them to the master instead.
+import { HttpRindleDaemonClient, } from "@rindle/daemon-client";
+import { route } from "./hrw.js";
+/** Returned (rejected) when there is no follower to place a read on — the honest 503 surface
+ *  (§5/§8.1): while the live set is empty no new query can materialize. */
+export class NoLiveFollowersError extends Error {
+    status = 503;
+    constructor() {
+        super("read router: no live follower to place this query on");
+        this.name = "NoLiveFollowersError";
+    }
+}
+export class RoutingReadClient {
+    registry;
+    clientForFollower;
+    /** Memoized per-follower control-plane clients, keyed by id; rebuilt if a follower's
+     *  `controlPlaneUrl` changes (membership churn). Pure cache — no routing/pin state. */
+    clients = new Map();
+    constructor(opts) {
+        this.registry = opts.registry;
+        this.clientForFollower =
+            opts.clientFor ??
+                ((f) => new HttpRindleDaemonClient({
+                    baseUrl: f.controlPlaneUrl,
+                    headers: opts.daemonToken ? { authorization: `Bearer ${opts.daemonToken}` } : undefined,
+                }));
+    }
+    // --- the read legs: route to ONE follower, stamp its public ws endpoint -----------
+    async materialize(input) {
+        const f = this.place(routingKeyOf(input.subject, input.metadata));
+        const out = await this.clientOf(f).materialize(input);
+        return { ...out, wsEndpoint: f.wsEndpoint };
+    }
+    async query(input) {
+        // The api-server sets `visibilityKey = subject ?? routingKey`, so it IS the read's routing key
+        // (co-locating the SSR read with the browser's follow-up subscribe, §2.4).
+        const f = this.place(input.visibilityKey ?? "");
+        const out = await this.clientOf(f).query(input);
+        return { ...out, wsEndpoint: f.wsEndpoint };
+    }
+    /** Un-pin / drop by query identity — fans across ALL live followers, because a `materializationId`
+     *  is follower-local and unroutable and un-pin is by NAME (§4.2). `removed` is true if any
+     *  follower removed it. */
+    async dematerialize(input) {
+        const results = await Promise.allSettled(this.registry.live().map((f) => this.clientOf(f).dematerialize(input)));
+        return { removed: results.some((r) => r.status === "fulfilled" && r.value.removed) };
+    }
+    // --- the explicit fleet pin-assert (§4.2 push) ------------------------------------
+    /** Fan EACH already-resolved pin (authoritative AST + `pinned` policy) across ALL live followers.
+     *  Best-effort and stateless: the router sprays the currently-live set and remembers nothing — a
+     *  follower not live at push time catches up via the lazy floor (§4.1). Rejects if any
+     *  follower×pin call failed, so the api-server retries on its next trigger. */
+    async assertPins(pins) {
+        const live = this.registry.live();
+        const tasks = [];
+        for (const f of live) {
+            const client = this.clientOf(f);
+            for (const pin of pins)
+                tasks.push(client.materialize(pin));
+        }
+        const results = await Promise.allSettled(tasks);
+        const failures = results.filter((r) => r.status === "rejected");
+        if (failures.length) {
+            throw new Error(`read router: pin fan-out had ${failures.length}/${tasks.length} failures — ` +
+                failures.map((r) => String(r.reason?.message ?? r.reason)).join("; "));
+        }
+    }
+    // --- writes NEVER route through the read router (§2.1) -----------------------------
+    executeSqlTxn(_input) {
+        return Promise.reject(writeRejected("executeSqlTxn"));
+    }
+    rejectMutation(_input) {
+        return Promise.reject(writeRejected("rejectMutation"));
+    }
+    applyRowChangeTxn(_input) {
+        return Promise.reject(writeRejected("applyRowChangeTxn"));
+    }
+    migrate(_input) {
+        return Promise.reject(writeRejected("migrate"));
+    }
+    // --- internals --------------------------------------------------------------------
+    place(key) {
+        const f = route(key, this.registry.live());
+        if (!f)
+            throw new NoLiveFollowersError();
+        return f;
+    }
+    clientOf(f) {
+        const cached = this.clients.get(f.id);
+        if (cached && cached.url === f.controlPlaneUrl)
+            return cached.client;
+        const client = this.clientForFollower(f);
+        this.clients.set(f.id, { url: f.controlPlaneUrl, client });
+        return client;
+    }
+}
+/** The routing key: the authenticated `subject` first (co-locates a user's tabs/devices), else the
+ *  anonymous key the api-server forwarded on `metadata.routingKey` (cookie ?? clientId). A routing
+ *  HINT, not authorization (§1.5) — leases stay follower-local and subject-authorized regardless. */
+function routingKeyOf(subject, metadata) {
+    if (subject)
+        return subject;
+    const rk = metadata?.routingKey;
+    return typeof rk === "string" ? rk : "";
+}
+function writeRejected(op) {
+    return new Error(`read router: ${op} is a write — writes go to the master, never the router (READ-ROUTER-DESIGN.md §2.1)`);
+}
+//# sourceMappingURL=router.js.map

package/dist/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,kGAAkG;AAClG,gGAAgG;AAChG,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,EAAE;AACF,0FAA0F;AAC1F,qGAAqG;AAErG,OAAO,EACL,sBAAsB,GAgBvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAgBjC;2EAC2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAmB;IAC3B,iBAAiB,CAAwB;IAC1D;2FACuF;IACtE,OAAO,GAAG,IAAI,GAAG,EAAuD,CAAC;IAE1F,YAAY,IAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,iBAAiB;YACpB,IAAI,CAAC,SAAS;gBACd,CAAC,CAAC,CAAC,EAAE,EAAE,CACL,IAAI,sBAAsB,CAAC;oBACzB,OAAO,EAAE,CAAC,CAAC,eAAe;oBAC1B,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;iBACxF,CAAC,CAAC,CAAC;IACV,CAAC;IAED,qFAAqF;IAErF,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAqB;QAC/B,+FAA+F;QAC/F,2EAA2E;QAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED;;+BAE2B;IAC3B,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACvE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,qFAAqF;IAErF;;;mFAG+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAiC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChC,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,cAAc;gBAC3E,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAE,CAAC,CAAC,MAAgB,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sFAAsF;IAEtF,aAAa,CAAC,MAAc;QAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,cAAc,CAAC,MAAyB;QACtC,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,iBAAiB,CAAC,MAAoB;QACpC,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,MAAoB;QAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,qFAAqF;IAE7E,KAAK,CAAC,GAAW;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,QAAQ,CAAC,CAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,eAAe;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;qGAEqG;AACrG,SAAS,YAAY,CAAC,OAA2B,EAAE,QAA6C;IAC9F,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,QAAQ,EAAE,UAAU,CAAC;IAChC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,IAAI,KAAK,CACd,gBAAgB,EAAE,sFAAsF,CACzG,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@rindle/router",
+  "version": "0.1.0-rc.5",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rindle-sh/rindle.git",
+    "directory": "packages/router"
+  },
+  "type": "module",
+  "description": "Stateless read-routing control-plane proxy: HRW follower placement + explicit fleet pin fan-out (READ-ROUTER-DESIGN.md).",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "@rindle/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@rindle/daemon-client": "0.1.0-rc.5"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "tsc --noEmit && node --conditions=@rindle/source --test test/*.test.ts"
+  }
+}

package/src/hrw.ts

@@ -0,0 +1,56 @@
+// Weighted rendezvous hashing (HRW) — the router's one pure placement function
+// (READ-ROUTER-DESIGN.md §1.4, §2.2). `route(key, followers)` is a deterministic function of the
+// membership SET + key: HRW's logarithmic method gives each follower a score
+// `weight / -ln(hashUnit(key‖id))` and the max wins, tie-broken on `id` so the result is
+// INDEPENDENT of the followers' order (two router replicas over the same set agree). HRW's
+// minimal-disruption property is what bounds churn to ~1/N keys on a membership change.
+
+const encoder = new TextEncoder();
+
+/** Map a string to a stable unit float in the OPEN interval (0,1) — deterministic across runtimes
+ *  (FNV-1a 64-bit over UTF-8 bytes in exact BigInt, then folded to a 53-bit double mantissa). The
+ *  open interval matters: HRW needs `hashUnit ∈ (0,1)` so `-ln(hashUnit) > 0` (never 0 or ∞). */
+export function hashUnit(s: string): number {
+  const bytes = encoder.encode(s);
+  const mask = 0xffffffffffffffffn;
+  let h = 0xcbf29ce484222325n; // FNV offset basis (64-bit)
+  for (let i = 0; i < bytes.length; i++) {
+    h ^= BigInt(bytes[i]);
+    h = (h * 0x100000001b3n) & mask; // FNV prime
+  }
+  // FNV's LOW bits are weakly mixed (a multiplicative hash barely diffuses high bits downward), so
+  // folding them straight to a mantissa biases placement. Run Murmur3's fmix64 avalanche first —
+  // afterward every bit depends on every input bit, so the low 53 are uniform.
+  h ^= h >> 33n;
+  h = (h * 0xff51afd7ed558ccdn) & mask;
+  h ^= h >> 33n;
+  h = (h * 0xc4ceb9fe1a85ec53n) & mask;
+  h ^= h >> 33n;
+  const bits = Number(h & ((1n << 53n) - 1n)); // 0 .. 2^53 - 1
+  return (bits + 0.5) / 2 ** 53; // strictly inside (0, 1)
+}
+
+/** The minimum a follower must expose to be placed: a stable `id` and an optional `weight`
+ *  (load share ∝ weight; default 1; a weight ≤ 0 opts the follower out of placement). */
+export interface RoutableFollower {
+  id: string;
+  weight?: number;
+}
+
+/** Place `key` on exactly one of `followers` by weighted HRW. Returns `undefined` only when the set
+ *  is empty (or every follower has weight ≤ 0) — the caller turns that into a 503. Order-independent:
+ *  shuffling `followers` never changes the result (max score, then lexicographically-smallest `id`). */
+export function route<F extends RoutableFollower>(key: string, followers: readonly F[]): F | undefined {
+  let best: F | undefined;
+  let bestScore = -Infinity;
+  for (const f of followers) {
+    const weight = f.weight ?? 1;
+    if (weight <= 0) continue;
+    const score = weight / -Math.log(hashUnit(`${key}\u0000${f.id}`));
+    if (score > bestScore || (score === bestScore && best !== undefined && f.id < best.id)) {
+      best = f;
+      bestScore = score;
+    }
+  }
+  return best;
+}

package/src/http.ts

@@ -0,0 +1,118 @@
+// The router's HTTP front (READ-ROUTER-DESIGN.md §9) — it speaks the daemon control-plane read
+// surface so the api-server reaches it through an ordinary `HttpRindleDaemonClient`, plus the one
+// extra fleet route `/assert-pins`. The api-server's `RINDLE_ROUTER_URL` points here for the reads
+// leg; `RINDLE_MASTER_URL` points at the master for writes (the `SplitDaemonClient`, §2.1).
+//
+// `createRouterPinClient` is the counterpart the api-server's `pinFanout` uses to invoke the fleet
+// pin-assert over that same HTTP hop.
+
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import type { AddressInfo } from "node:net";
+
+import type { MaterializeInput } from "@rindle/daemon-client";
+
+import type { RoutingReadClient } from "./router.ts";
+
+export const ROUTER_PATHS = {
+  materialize: "/materialize",
+  query: "/query",
+  dematerialize: "/dematerialize",
+  assertPins: "/assert-pins",
+} as const;
+
+/** Dispatch one parsed request to the router (the runtime-agnostic core — drive it from any HTTP
+ *  shell). Throws `{ status: 404 }` for an unknown path; routing errors carry their own `status`
+ *  (e.g. {@link NoLiveFollowersError} → 503). */
+export function dispatchRouter(router: RoutingReadClient, path: string, body: unknown): Promise<unknown> {
+  // The body is untrusted JSON off the wire — cast through `unknown` to the control-plane input
+  // shapes (the followers' control plane validates the contents).
+  const msg = (body ?? {}) as Record<string, unknown>;
+  switch (path) {
+    case ROUTER_PATHS.materialize:
+      return router.materialize(msg as unknown as MaterializeInput);
+    case ROUTER_PATHS.query:
+      return router.query(msg as unknown as Parameters<RoutingReadClient["query"]>[0]);
+    case ROUTER_PATHS.dematerialize:
+      return router.dematerialize(msg as Parameters<RoutingReadClient["dematerialize"]>[0]);
+    case ROUTER_PATHS.assertPins:
+      return router.assertPins((msg.pins as MaterializeInput[]) ?? []).then(() => ({ ok: true }));
+    default:
+      throw Object.assign(new Error(`read router: not found: ${path}`), { status: 404 });
+  }
+}
+
+export interface RouterServerOptions {
+  router: RoutingReadClient;
+  /** Inbound bearer token the api-server must present. Omit to disable auth (dev/tests only). */
+  token?: string;
+  port?: number;
+}
+
+export interface RouterServer {
+  readonly port: number;
+  close(): Promise<void>;
+}
+
+/** Start the router's Node HTTP server. Resolves once listening (port resolved when `port: 0`). */
+export function createRouterServer(opts: RouterServerOptions): Promise<RouterServer> {
+  const handle = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    try {
+      if (req.method !== "POST") return send(res, 405, { error: "method not allowed" });
+      if (opts.token && req.headers.authorization !== `Bearer ${opts.token}`) {
+        return send(res, 401, { error: "unauthorized" });
+      }
+      const chunks: Buffer[] = [];
+      for await (const chunk of req) chunks.push(chunk as Buffer);
+      const body = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+      const out = await dispatchRouter(opts.router, req.url ?? "", body);
+      send(res, 200, out ?? {});
+    } catch (err) {
+      const status = (err as { status?: number })?.status ?? 500;
+      send(res, status, { error: String((err as Error)?.message ?? err) });
+    }
+  };
+
+  const server = createServer((req, res) => void handle(req, res));
+  return new Promise((resolve) => {
+    server.listen(opts.port ?? 0, () => {
+      const port = (server.address() as AddressInfo).port;
+      resolve({ port, close: () => new Promise<void>((r) => server.close(() => r())) });
+    });
+  });
+}
+
+function send(res: ServerResponse, status: number, body: unknown): void {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+/** The api-server's `pinFanout`: invokes the router's explicit fleet pin-assert over HTTP
+ *  (`POST /assert-pins`). Mirrors how the api-server reaches the router for reads, so a routed
+ *  deploy uses one `RINDLE_ROUTER_URL` (+ token) for both legs. */
+export interface RouterPinClient {
+  assertPins(pins: readonly MaterializeInput[]): Promise<void>;
+}
+
+export interface RouterPinClientOptions {
+  baseUrl: string;
+  token?: string;
+  fetch?: typeof fetch;
+}
+
+export function createRouterPinClient(opts: RouterPinClientOptions): RouterPinClient {
+  const base = opts.baseUrl.endsWith("/") ? opts.baseUrl.slice(0, -1) : opts.baseUrl;
+  const fetchImpl = opts.fetch ?? ((...args: Parameters<typeof fetch>) => fetch(...args));
+  return {
+    async assertPins(pins) {
+      const res = await fetchImpl(`${base}${ROUTER_PATHS.assertPins}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+        },
+        body: JSON.stringify({ pins }),
+      });
+      if (!res.ok) throw new Error(`read router assert-pins failed: ${res.status} ${await res.text()}`);
+    },
+  };
+}

package/src/index.ts

@@ -0,0 +1,16 @@
+// @rindle/router — the stateless read-routing control-plane proxy (READ-ROUTER-DESIGN.md).
+// Placement is one pure function (`route = HRW(key, live())`); the router holds the follower
+// membership view and NO per-session / NO pin state. The api-server's `SplitDaemonClient` points
+// its reads leg here (writes go to the master); the browser↔follower ws data path stays direct.
+
+export { hashUnit, route } from "./hrw.ts";
+export type { RoutableFollower } from "./hrw.ts";
+
+export { StaticFollowerRegistry } from "./registry.ts";
+export type { Follower, FollowerRegistry } from "./registry.ts";
+
+export { NoLiveFollowersError, RoutingReadClient } from "./router.ts";
+export type { FollowerClientFactory, RoutingReadClientOptions } from "./router.ts";
+
+export { ROUTER_PATHS, createRouterPinClient, createRouterServer, dispatchRouter } from "./http.ts";
+export type { RouterPinClient, RouterPinClientOptions, RouterServer, RouterServerOptions } from "./http.ts";

package/src/registry.ts

@@ -0,0 +1,65 @@
+// The follower membership view (READ-ROUTER-DESIGN.md §2.2, §9). The router holds NO per-session
+// or pin state — the registry's `live()` set is the only input HRW routes over. "Unhealthy"
+// (unreachable / draining) ⇒ dropped from `live()`, which is what re-HRWs its sessions on their
+// next lease. A merely *lagging* follower stays in `live()` (it still serves reads).
+//
+// Source of the set: a static list (dev) → Fly 6PN `.internal` / orchestrator API (prod) → gossip
+// later — all behind this interface. Each entry carries TWO addresses: the PRIVATE control-plane
+// URL the router POSTs to, and the PUBLIC ws endpoint handed to the browser as `wsEndpoint`.
+
+import type { RoutableFollower } from "./hrw.ts";
+
+export interface Follower extends RoutableFollower {
+  /** Stable identity — the HRW input and the client-cache key. Survives restarts (same id ⇒ a key
+   *  still HRWs to it, so a reboot needs no re-placement, §3). */
+  id: string;
+  /** PRIVATE control-plane URL (router → follower `/materialize`, `/query`, `/dematerialize`).
+   *  Never exposed to the browser. */
+  controlPlaneUrl: string;
+  /** PUBLIC ws endpoint (`wss:443`) the browser opens its subscription to — the lease's
+   *  `wsEndpoint`. Browser-reachable; the only follower address that crosses a provider boundary. */
+  wsEndpoint: string;
+  /** Load share ∝ weight (default 1). A weight ≤ 0 opts the follower out of placement. */
+  weight?: number;
+  /** Routable when not explicitly false (the default). Set false to drain/quarantine — it drops
+   *  out of `live()` and its keys re-HRW elsewhere on their next lease. */
+  healthy?: boolean;
+}
+
+export interface FollowerRegistry {
+  /** The currently routable (healthy) followers. HRW runs over exactly this set, so the result is
+   *  a pure function of what `live()` returns at call time. */
+  live(): readonly Follower[];
+}
+
+/** A registry backed by an in-memory list — the dev/test source, and the substrate a health probe
+ *  or discovery loop drives via {@link set}/{@link setHealthy}. Copies entries on the way in so the
+ *  caller can't mutate the routed set behind the router's back. */
+export class StaticFollowerRegistry implements FollowerRegistry {
+  private followers: Follower[];
+
+  constructor(followers: readonly Follower[] = []) {
+    this.followers = followers.map((f) => ({ ...f }));
+  }
+
+  live(): readonly Follower[] {
+    return this.followers.filter((f) => f.healthy !== false);
+  }
+
+  /** The full routable set, healthy or not (for diagnostics / a health probe). */
+  all(): readonly Follower[] {
+    return this.followers;
+  }
+
+  /** Replace the whole membership set (a discovery refresh). */
+  set(followers: readonly Follower[]): void {
+    this.followers = followers.map((f) => ({ ...f }));
+  }
+
+  /** Mark one follower healthy/unhealthy — drops it from / restores it to `live()`. No-op for an
+   *  unknown id. */
+  setHealthy(id: string, healthy: boolean): void {
+    const f = this.followers.find((x) => x.id === id);
+    if (f) f.healthy = healthy;
+  }
+}

package/src/router.ts

@@ -0,0 +1,169 @@
+// The stateless routing read-client (READ-ROUTER-DESIGN.md §2.1). From the api-server's view it IS
+// the read daemon — it implements `RindleDaemonClient` for the read legs (`materialize`, `query`)
+// and routes each to ONE follower by HRW, stamping that follower's public `wsEndpoint` onto the
+// output so the browser connects to the node holding its lease. It also exposes an EXPLICIT fleet
+// pin-assert (`assertPins`) that fans a pin across ALL live followers — distinct, on purpose, from a
+// per-viewer `materialize` (never inferred from `policy.kind`, §4). It holds NO per-session and NO
+// pin state: routing is a pure function of `(key, live())`, so a fresh instance routes identically.
+//
+// Writes NEVER route through the read router (§2.1): the write methods reject loudly as a
+// misconfiguration backstop — the api-server's `SplitDaemonClient` sends them to the master instead.
+
+import {
+  HttpRindleDaemonClient,
+  type DematerializeInput,
+  type DematerializeOutput,
+  type MaterializeInput,
+  type MaterializeOutput,
+  type MigrateInput,
+  type MigrateOutput,
+  type MutationRejection,
+  type MutationRejectionOutput,
+  type QueryOnceInput,
+  type QueryOnceOutput,
+  type RindleDaemonClient,
+  type RowChangeTxn,
+  type RowChangeTxnOutput,
+  type SqlTxn,
+  type SqlTxnOutput,
+} from "@rindle/daemon-client";
+
+import { route } from "./hrw.ts";
+import type { Follower, FollowerRegistry } from "./registry.ts";
+
+/** Build a control-plane client for one follower (the seam tests inject recording fakes through). */
+export type FollowerClientFactory = (follower: Follower) => RindleDaemonClient;
+
+export interface RoutingReadClientOptions {
+  registry: FollowerRegistry;
+  /** Build a control-plane client for a follower. Default: an {@link HttpRindleDaemonClient} to the
+   *  follower's `controlPlaneUrl` carrying a Bearer `daemonToken`. */
+  clientFor?: FollowerClientFactory;
+  /** Bearer token the router presents OUTBOUND to follower control planes (the existing
+   *  `DAEMON_TOKEN`). Used only by the default {@link clientFor}. */
+  daemonToken?: string;
+}
+
+/** Returned (rejected) when there is no follower to place a read on — the honest 503 surface
+ *  (§5/§8.1): while the live set is empty no new query can materialize. */
+export class NoLiveFollowersError extends Error {
+  readonly status = 503;
+  constructor() {
+    super("read router: no live follower to place this query on");
+    this.name = "NoLiveFollowersError";
+  }
+}
+
+export class RoutingReadClient implements RindleDaemonClient {
+  private readonly registry: FollowerRegistry;
+  private readonly clientForFollower: FollowerClientFactory;
+  /** Memoized per-follower control-plane clients, keyed by id; rebuilt if a follower's
+   *  `controlPlaneUrl` changes (membership churn). Pure cache — no routing/pin state. */
+  private readonly clients = new Map<string, { url: string; client: RindleDaemonClient }>();
+
+  constructor(opts: RoutingReadClientOptions) {
+    this.registry = opts.registry;
+    this.clientForFollower =
+      opts.clientFor ??
+      ((f) =>
+        new HttpRindleDaemonClient({
+          baseUrl: f.controlPlaneUrl,
+          headers: opts.daemonToken ? { authorization: `Bearer ${opts.daemonToken}` } : undefined,
+        }));
+  }
+
+  // --- the read legs: route to ONE follower, stamp its public ws endpoint -----------
+
+  async materialize(input: MaterializeInput): Promise<MaterializeOutput> {
+    const f = this.place(routingKeyOf(input.subject, input.metadata));
+    const out = await this.clientOf(f).materialize(input);
+    return { ...out, wsEndpoint: f.wsEndpoint };
+  }
+
+  async query(input: QueryOnceInput): Promise<QueryOnceOutput> {
+    // The api-server sets `visibilityKey = subject ?? routingKey`, so it IS the read's routing key
+    // (co-locating the SSR read with the browser's follow-up subscribe, §2.4).
+    const f = this.place(input.visibilityKey ?? "");
+    const out = await this.clientOf(f).query(input);
+    return { ...out, wsEndpoint: f.wsEndpoint };
+  }
+
+  /** Un-pin / drop by query identity — fans across ALL live followers, because a `materializationId`
+   *  is follower-local and unroutable and un-pin is by NAME (§4.2). `removed` is true if any
+   *  follower removed it. */
+  async dematerialize(input: DematerializeInput): Promise<DematerializeOutput> {
+    const results = await Promise.allSettled(
+      this.registry.live().map((f) => this.clientOf(f).dematerialize(input)),
+    );
+    return { removed: results.some((r) => r.status === "fulfilled" && r.value.removed) };
+  }
+
+  // --- the explicit fleet pin-assert (§4.2 push) ------------------------------------
+
+  /** Fan EACH already-resolved pin (authoritative AST + `pinned` policy) across ALL live followers.
+   *  Best-effort and stateless: the router sprays the currently-live set and remembers nothing — a
+   *  follower not live at push time catches up via the lazy floor (§4.1). Rejects if any
+   *  follower×pin call failed, so the api-server retries on its next trigger. */
+  async assertPins(pins: readonly MaterializeInput[]): Promise<void> {
+    const live = this.registry.live();
+    const tasks: Promise<unknown>[] = [];
+    for (const f of live) {
+      const client = this.clientOf(f);
+      for (const pin of pins) tasks.push(client.materialize(pin));
+    }
+    const results = await Promise.allSettled(tasks);
+    const failures = results.filter((r): r is PromiseRejectedResult => r.status === "rejected");
+    if (failures.length) {
+      throw new Error(
+        `read router: pin fan-out had ${failures.length}/${tasks.length} failures — ` +
+          failures.map((r) => String((r.reason as Error)?.message ?? r.reason)).join("; "),
+      );
+    }
+  }
+
+  // --- writes NEVER route through the read router (§2.1) -----------------------------
+
+  executeSqlTxn(_input: SqlTxn): Promise<SqlTxnOutput> {
+    return Promise.reject(writeRejected("executeSqlTxn"));
+  }
+  rejectMutation(_input: MutationRejection): Promise<MutationRejectionOutput> {
+    return Promise.reject(writeRejected("rejectMutation"));
+  }
+  applyRowChangeTxn(_input: RowChangeTxn): Promise<RowChangeTxnOutput> {
+    return Promise.reject(writeRejected("applyRowChangeTxn"));
+  }
+  migrate(_input: MigrateInput): Promise<MigrateOutput> {
+    return Promise.reject(writeRejected("migrate"));
+  }
+
+  // --- internals --------------------------------------------------------------------
+
+  private place(key: string): Follower {
+    const f = route(key, this.registry.live());
+    if (!f) throw new NoLiveFollowersError();
+    return f;
+  }
+
+  private clientOf(f: Follower): RindleDaemonClient {
+    const cached = this.clients.get(f.id);
+    if (cached && cached.url === f.controlPlaneUrl) return cached.client;
+    const client = this.clientForFollower(f);
+    this.clients.set(f.id, { url: f.controlPlaneUrl, client });
+    return client;
+  }
+}
+
+/** The routing key: the authenticated `subject` first (co-locates a user's tabs/devices), else the
+ *  anonymous key the api-server forwarded on `metadata.routingKey` (cookie ?? clientId). A routing
+ *  HINT, not authorization (§1.5) — leases stay follower-local and subject-authorized regardless. */
+function routingKeyOf(subject: string | undefined, metadata: Record<string, unknown> | undefined): string {
+  if (subject) return subject;
+  const rk = metadata?.routingKey;
+  return typeof rk === "string" ? rk : "";
+}
+
+function writeRejected(op: string): Error {
+  return new Error(
+    `read router: ${op} is a write — writes go to the master, never the router (READ-ROUTER-DESIGN.md §2.1)`,
+  );
+}