create-rindle 0.3.1 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rindle",
-  "version": "0.3.1",
+  "version": "0.4.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

package/templates/minimal/AGENTS.md

@@ -30,15 +30,21 @@ review:
    `CREATE INDEX`; every table a single primary key). **Never hand-edit
    `shared/schema.gen.ts`** — it is generated from the live daemon and
    overwritten on the next migration.
-2. **Predicted mutators are deterministic and replayable**
-   (`shared/app-def.ts`): no `Date.now()`, no `Math.random()`, no I/O — they
-   re-run on every rebase. Generate ids and timestamps at the callsite and pass
-   them in as args.
-3. **Every mutator has two halves under one name**: the client's *predicted*
-   mutator in `shared/app-def.ts` and the server's *authoritative* SQL twin in
-   `server/app-api.ts`. Add or change them together. Only `(name, args)` ever
-   crosses the wire — validate args hard on the server; `throw` to hard-reject
-   (the optimistic write snaps back on its own; write no rollback code).
+2. **Mutators are one isomorphic body, deterministic and replayable**
+   (`shared/app-def.ts`): a generator that `yield`s logical ops
+   (`yield tx.insert(...)`), paired with its zod arg schema via
+   `shared(args, gen)`. No `Date.now()`, no `Math.random()`, no I/O — the client
+   re-invokes the body on every rebase. Generate ids and timestamps at the
+   callsite and pass them in as args; the acting user is `ctx.user` (injected
+   per tier), never an arg.
+3. **The server drives the same body** — `sharedApiMutators` in
+   `server/app-api.ts` auto-wraps the whole registry (parse the untrusted wire
+   args through each mutator's `.args`, inject the authenticated principal,
+   render every op to SQL). Add an explicit entry ONLY for server-only
+   authority the client must not predict (a policy guard, a raw `tx.exec`
+   relational gate). Only `(name, args)` ever crosses the wire; `throw` to
+   hard-reject (the optimistic write snaps back on its own; write no rollback
+   code).
 4. **Remote subscriptions must be named.** Define queries with `defineQuery` in
    `src/components/*.queries.ts` and register them in `server/app-api.ts`. An
    ad-hoc `store.query.…` builder resolves **locally only** — it never opens a
@@ -58,10 +64,10 @@ review:
 | --- | --- |
 | `migrations/*.sql` | the real schema — the only place DDL lives |
 | `shared/schema.gen.ts` | **generated** table schema — do not edit |
-| `shared/app-def.ts` | the shared contract: relationships, query builder, predicted mutators |
+| `shared/app-def.ts` | the shared contract: relationships, query builder, isomorphic mutators |
 | `src/components/*.queries.ts` | named queries + fragments, co-located with their components |
 | `src/rindle-client.ts` | the one-call browser wire-up (`createRindleClient`) |
-| `server/app-api.ts` | the authority: `registerQueries` + authoritative SQL mutators + policy |
+| `server/app-api.ts` | the authority: `registerQueries` + `sharedApiMutators` + server-only policy |
 | `src/routes/api.rindle.*.tsx` | TanStack Start server routes exposing the authority over HTTP |
 | `server/dev.ts` | dev orchestration (`rindle up` + seed + Vite) |
 | `src/ssr.ts` | SSR preload of the same named queries for first paint |

package/templates/minimal/README.md

@@ -11,8 +11,9 @@ Three tiers, same as the Rindle flagship examples:
 - **Browser** — a TanStack Start SPA whose data layer *is* Rindle. The wasm IVM engine runs
   in-process: reads resolve locally and instantly, writes apply optimistically and reconcile on
   confirmation. Views are co-located Relay-style fragments (`src/components/*.queries.ts`).
-- **API authority** (`server/app-api.ts`) — resolves named queries to ASTs, runs the authoritative SQL
-  mutators, and enforces policy: reads are public, writes require an identity, and a `"spam"` name/body
+- **API authority** (`server/app-api.ts`) — resolves named queries to ASTs, drives the **same
+  isomorphic mutators** the browser predicted (their logical ops rendered to SQL), and enforces
+  policy: reads are public, writes require an identity, and a `"spam"` name/body
   is rejected (you'll see the optimistic write snap back + a toast). It's host-agnostic: the browser
   reaches it through TanStack Start **server routes** (`src/routes/api.rindle.{query,read,mutate}.tsx`,
   via `server/rindle-http.ts`) that run in the same server as the app, and SSR calls the very same
@@ -60,10 +61,10 @@ of `vite build` and never ship to production.
 |---|---|
 | `migrations/*.sql` | the schema — **source of truth** |
 | `shared/schema.gen.ts` | generated `@rindle/client` schema (don't edit by hand) |
-| `shared/app-def.ts` | the contract root: schema re-export, relationships, mutators |
+| `shared/app-def.ts` | the contract root: schema re-export, relationships, isomorphic mutators |
 | `shared/auth.ts` | the identity seam (`AuthProvider`) |
 | `server/dev.ts` | one-command dev orchestrator |
-| `server/app-api.ts` | the authority: query resolution, SQL mutators, policy (host-agnostic) |
+| `server/app-api.ts` | the authority: query resolution, `sharedApiMutators`, policy (host-agnostic) |
 | `server/rindle-http.ts` | adapts the authority to a Web Request (the Start API routes call it) |
 | `src/routes/api.rindle.*.tsx` | the three API endpoints as Start server routes (the browser's API) |
 | `src/ssr.ts` | first-paint preload — calls the authority in-process |

package/templates/minimal/migrations/0001_init.sql

@@ -12,10 +12,10 @@
 -- declared BOOLEAN/BOOL → boolean(), JSON → json(). Column ORDER matters — the IVM engine reads it
 -- back with PRAGMA table_info. `IF NOT EXISTS` keeps re-runs safe.
 
-CREATE TABLE IF NOT EXISTS room (id TEXT, name TEXT, createdAt REAL, PRIMARY KEY (id));
+CREATE TABLE IF NOT EXISTS room (id TEXT NOT NULL, name TEXT NOT NULL, createdAt REAL NOT NULL, PRIMARY KEY (id));
 -- The room list orders newest-first.
 CREATE INDEX IF NOT EXISTS room_created ON room (createdAt DESC, id);
 
-CREATE TABLE IF NOT EXISTS message (id TEXT, roomId TEXT, author TEXT, body TEXT, createdAt REAL, PRIMARY KEY (id));
+CREATE TABLE IF NOT EXISTS message (id TEXT NOT NULL, roomId TEXT NOT NULL, author TEXT NOT NULL, body TEXT NOT NULL, createdAt REAL NOT NULL, PRIMARY KEY (id));
 -- Forward (a room's messages, oldest-first) AND the reverse the live count uses when a message changes.
 CREATE INDEX IF NOT EXISTS message_room ON message (roomId, createdAt, id);

package/templates/minimal/server/app-api.ts

@@ -1,19 +1,41 @@
 // The app authority, runtime-AGNOSTIC. The serverless-shaped tier's actual logic: it resolves named
-// queries to ASTs (the daemon mints opaque leases), runs the AUTHORITATIVE mutators into approved SQL,
-// enforces policy (identity required to write, a "spam" rejection demo), and talks to the daemon over
-// the private bearer-auth'd control plane.
+// queries to ASTs (the daemon mints opaque leases), drives the SAME isomorphic mutators the browser
+// predicted (shared/app-def.ts) with their ops rendered to approved SQL, enforces policy (identity
+// required to write, a "spam" rejection demo), and talks to the daemon over the private bearer-auth'd
+// control plane.
 //
 // It is deliberately free of any host: server/rindle-http.ts adapts it to a Web Request for the Start
 // API routes (src/routes/api.rindle.*.tsx) the browser calls, and the SSR loader (src/ssr.ts) calls the
 // SAME factory in-process. The only per-host inputs are the daemon's control-plane URL + token and the
 // AuthProvider.
 
-import { createRindleApiServer, defineApiMutators, registerQueries } from "@rindle/api-server";
-import type { ApiMutators, MutationContext, RindleApiServer, SqlMutationTx } from "@rindle/api-server";
+import {
+  createRindleApiServer,
+  defineApiMutators,
+  registerQueries,
+  runSharedMutation,
+  sharedApiMutators,
+} from "@rindle/api-server";
+import type {
+  ApiMutator,
+  ApiMutators,
+  MutationContext,
+  MutatorCtx,
+  RindleApiServer,
+  ServerMutationTx,
+  SharedMutatorWithArgs,
+} from "@rindle/api-server";
 import { HttpRindleDaemonClient } from "@rindle/daemon-client";
 import type { FetchLike } from "@rindle/daemon-client";
 
-import { createRoomArgs, normalizeBody, normalizeName, normalizeSubject, postMessageArgs } from "../shared/app-def.ts";
+import {
+  mutators as sharedMutators,
+  normalizeBody,
+  normalizeName,
+  normalizeSubject,
+  postMessageArgs,
+  schema,
+} from "../shared/app-def.ts";
 import type { Identity } from "../shared/auth.ts";
 import { roomsQuery } from "../src/components/RoomCard.queries.ts";
 import { roomDetailQuery } from "../src/components/RoomView.queries.ts";
@@ -26,23 +48,50 @@ export type User = Identity | undefined;
 // can't smuggle a garbage arg in.
 const apiQueries = registerQueries<User>([roomsQuery, roomDetailQuery]);
 
+// MUTATORS ARE ISOMORPHIC — defined once in shared/app-def.ts and auto-driven here by
+// `sharedApiMutators`: for each mutator it parses the untrusted wire args (the mutator's co-located
+// `.args` schema), injects the AUTHENTICATED principal as `ctx.user` (`sharedCtx` — never a client
+// arg), and drives the SAME body the client predicted, rendering every yielded op to SQL. A mutator
+// whose server run needs no authority beyond that triad needs no entry here at all.
+//
+// The ONLY explicit entries are server-only AUTHORITY the client must NOT predict, each OVERRIDING
+// its auto-wrapped default (spread first, override wins): the "spam" policy guard (so the demo's
+// rejection path stays exercised end to end) and postMessage's room-exists gate (relational SQL a
+// keyed op can't express — the raw `tx.exec` escape hatch).
+
+/** The `MutatorCtx` a shared body sees on the server: the AUTHENTICATED subject (throws if absent —
+ *  a business rejection). Never a client-supplied author. */
+function sharedCtx(ctx: MutationContext<User>): MutatorCtx {
+  return { user: requireUser(ctx.user).subject };
+}
+
+/** Layer a server-only arg policy onto a shared mutator (throw → hard reject), then drive the SAME
+ *  body the client predicts. */
+function withGuard<A>(gen: SharedMutatorWithArgs<A>, guard: (a: A) => void): ApiMutator<User, unknown> {
+  return (tx, raw, ctx) => {
+    const a = gen.args.parse(raw);
+    guard(a);
+    return runSharedMutation(gen, a, sharedCtx(ctx), tx);
+  };
+}
+
 const apiMutators = defineApiMutators<User, ApiMutators<User>>({
-  createRoom: (tx: SqlMutationTx, raw: unknown, ctx: MutationContext<User>) => {
-    const a = createRoomArgs.parse(raw);
-    requireUser(ctx.user);
-    const name = cleanName(a.name);
-    tx.exec("INSERT OR IGNORE INTO room (id, name, createdAt) VALUES (?, ?, ?)", [a.id, name, a.createdAt]);
-  },
-  postMessage: (tx: SqlMutationTx, raw: unknown, ctx: MutationContext<User>) => {
+  ...sharedApiMutators(sharedMutators, sharedCtx),
+
+  // (a) a server-only policy on the shared body: an empty or "spam" name throws BEFORE any write.
+  createRoom: withGuard(sharedMutators.createRoom, (a) => void cleanName(a.name)),
+
+  // (b) the raw-SQL escape hatch: insert only into a room that exists, so a racing client can't post
+  //     into a deleted room. The client predicts the plain shared insert and it snaps back if this
+  //     no-ops. `author` is the VERIFIED subject, never a wire arg.
+  postMessage: async (tx: ServerMutationTx, raw: unknown, ctx: MutationContext<User>) => {
     const a = postMessageArgs.parse(raw);
-    const who = requireUser(ctx.user);
+    const author = sharedCtx(ctx).user;
     const body = cleanBody(a.body);
-    // Insert only into a room that exists — a racing client can't post into a deleted room. `author`
-    // is the VERIFIED subject, never the wire arg.
     tx.exec(
       `INSERT INTO message (id, roomId, author, body, createdAt)
        SELECT ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM room WHERE id = ?)`,
-      [a.id, a.roomId, who.subject, body, a.createdAt, a.roomId],
+      [a.id, a.roomId, author, body, a.createdAt, a.roomId],
     );
   },
 });
@@ -67,6 +116,7 @@ export function createAppApi(opts: AppApiOptions): RindleApiServer<User> {
   });
   return createRindleApiServer<User>({
     daemon,
+    schema, // drives the dialect-SQL renderer for the shared mutators' logical ops
     queries: apiQueries,
     mutators: apiMutators,
     authorizeQuery: () => true, // public reads

package/templates/minimal/shared/app-def.ts

@@ -1,16 +1,17 @@
 // The shared CONTRACT root: the normalized schema, the relationships the views join back over, the
-// normalization helpers, the mutator arg schemas, and the client's PREDICTED mutators. Both tiers
-// import it — the browser for everything, the API server for the schema + normalization + the
-// AUTHORITATIVE mutator twins (server/app-api.ts) with the same names.
+// normalization helpers, and the ISOMORPHIC mutators — one generator body per mutator, driven by
+// BOTH tiers. The browser drives each body synchronously (the optimistic prediction); the API server
+// drives the SAME body inside an authoritative transaction, rendering its ops to SQL
+// (server/app-api.ts).
 //
 // This module is the leaf of the contract DAG: it depends on nothing app-internal. The named root
 // queries AND the per-component SELECTIONS they compose are co-located with their components in
 // `src/components/*.queries.ts` (Relay-style co-location). Keeping the schema here, free of those
 // imports, is what keeps that graph acyclic.
 
-import { defineRelationships, newQueryBuilder, rel } from "@rindle/client";
-import type { Row } from "@rindle/client";
-import type { ClientRegistry, MutationTx } from "@rindle/optimistic";
+import { defineRelationships, newQueryBuilder, rel, shared } from "@rindle/client";
+import type { IsoTx, MutationGen, MutatorCtx, Row } from "@rindle/client";
+import type { ClientRegistry } from "@rindle/optimistic";
 import { z } from "zod";
 
 // The schema is GENERATED from migrations/*.sql into ./schema.gen.ts by `rindle schema gen` — `pnpm
@@ -57,10 +58,11 @@ export function normalizeSubject(raw: string): string {
 
 // --------------------------------------------------------------------------- mutator args
 //
-// One zod schema per mutator. The SERVER parses the UNTRUSTED wire args through it (server/app-api.ts);
-// BOTH tiers derive the arg TYPE from it (`z.infer`). `author` rides the args for the CLIENT's
-// prediction only — the server ALWAYS overrides it with the authenticated identity, so it is
-// unspoofable for the authoritative write.
+// One zod schema per mutator, co-located with its body via `shared(args, gen)`. The SERVER parses the
+// UNTRUSTED wire args through it (server/app-api.ts); BOTH tiers derive the arg TYPE from it
+// (`z.infer`). NB: the AUTHOR is NOT an arg — it is the acting principal (`ctx.user`), injected by
+// each tier's driver (the client's local handle for the prediction; the server's AUTHENTICATED
+// identity for the authoritative run), so it is unspoofable over the wire.
 
 export const createRoomArgs = z.object({ id: z.string(), name: z.string(), createdAt: z.number() });
 export type CreateRoomArgs = z.infer<typeof createRoomArgs>;
@@ -69,32 +71,36 @@ export const postMessageArgs = z.object({
   id: z.string(),
   roomId: z.string(),
   body: z.string(),
-  author: z.string(),
   createdAt: z.number(),
 });
 export type PostMessageArgs = z.infer<typeof postMessageArgs>;
 
-// --------------------------------------------------------------------------- mutators (PREDICTED)
+// --------------------------------------------------------------------------- mutators (ISOMORPHIC)
 //
-// Deterministic + replayable: every value that would otherwise come from the clock or a random source
-// is passed in args (ids, timestamps). The SQL twins in server/app-api.ts enforce the authoritative
-// policy (identity required, a "spam" rejection demo).
+// ONE body per mutator, shared by both tiers. Each is a GENERATOR: it `yield`s logical write ops
+// (`yield tx.insert(...)`) instead of touching a database, so the SAME function runs synchronously
+// against the browser's wasm engine (the optimistic prediction) AND asynchronously against a live
+// transaction on the server, each op rendered to SQL. Deterministic + replayable: every value that
+// would otherwise come from the clock or a random source is passed in args (ids, timestamps) — the
+// client RE-INVOKES the body on every rebase. Normalization runs INSIDE the body, so both tiers
+// normalize identically; the server layers its own policy on top (identity required, a "spam"
+// rejection demo, the room-exists guard — server/app-api.ts).
 
 export const mutators = {
-  createRoom: (tx: MutationTx, a: CreateRoomArgs) => {
+  createRoom: shared(createRoomArgs, function* (tx: IsoTx, a: CreateRoomArgs): MutationGen {
     const name = normalizeName(a.name);
-    if (!name) return;
-    tx.insert("room", { id: a.id, name, createdAt: a.createdAt });
-  },
-  postMessage: (tx: MutationTx, a: PostMessageArgs) => {
+    if (!name) return; // a no-op prediction is fine; the server's guard hard-rejects
+    yield tx.insertIgnore("room", { id: a.id, name, createdAt: a.createdAt });
+  }),
+  postMessage: shared(postMessageArgs, function* (tx: IsoTx, a: PostMessageArgs, ctx: MutatorCtx): MutationGen {
     const body = normalizeBody(a.body);
     if (!body) return;
-    tx.insert("message", {
+    yield tx.insert("message", {
       id: a.id,
       roomId: a.roomId,
-      author: normalizeSubject(a.author),
+      author: normalizeSubject(ctx.user),
       body,
       createdAt: a.createdAt,
     });
-  },
+  }),
 } satisfies ClientRegistry;

package/templates/minimal/shared/schema.gen.ts

@@ -4,7 +4,8 @@
 // Column kinds come from your declared SQL types: TEXT maps to string(), INTEGER/REAL to
 // number(), and a column declared BOOLEAN/BOOL or JSON to boolean()/json(). The only thing the
 // SQL can't carry is a refinement *within* a kind — the element type of json<T>(), or a
-// string/number literal union — so re-apply those few annotations after each regen.
+// string/number literal union — declare those ONCE in a hand-written module with
+// refineTable(...) + refineSchema(...); they survive every regen of this file.
 
 import { createSchema, number, string, table } from "@rindle/client";
 

package/templates/minimal/src/RindleApp.tsx

@@ -1,47 +1,19 @@
-// The SSR→SPA store handoff. Provides the Rindle store to the tree via `@rindle/react`, swapping the
-// backend under `useQuery` without changing a single component:
-//
-//   - Server render + browser HYDRATION: a transport-less seed Store, hydrated from the SSR snapshot.
-//     `useQuery` reads its seed, so the server and the client's first render produce identical markup
-//     with NO engine on either side.
-//   - After hydration: the wasm IVM engine boots (client-only dynamic import, rindle-client.ts), its
-//     views are seeded from the same snapshot (so the swap shows the SSR rows with no flash), and the
-//     live `subscribe` reconciles — the page is now a live SPA.
+// The SSR→SPA store handoff. The handoff itself — seed the render from the SSR snapshot, boot the
+// wasm engine after hydration, swap the store under `useQuery` with no flash — lives in `<RindleSSR>`
+// (@rindle/react). This file just binds THIS app's `schema` + `bootClient` into it, so the route
+// tree keeps rendering `<RindleApp ssrState={…}>` unchanged.
 
-import { useEffect, useRef, useState } from "react";
 import type { ReactNode } from "react";
-import { Rindle } from "@rindle/react";
-import { OneShotBackend, Store, type DehydratedState } from "@rindle/client";
+import { RindleSSR } from "@rindle/react";
+import type { DehydratedState } from "@rindle/client";
 
 import { schema } from "../shared/app-def.ts";
 import { bootClient } from "./rindle-client.ts";
 
-type RindleClient = Awaited<ReturnType<typeof bootClient>>;
-
 export function RindleApp({ ssrState, children }: { ssrState: DehydratedState; children: ReactNode }) {
-  // Built ONCE from the first-render snapshot. Backs the server render AND the matching client
-  // hydration pass — same seeds in, same markup out.
-  const [seedStore] = useState(() => {
-    const store = new Store(schema, new OneShotBackend());
-    store.hydrate(ssrState);
-    return store;
-  });
-
-  // The live wasm store — booted only in the browser, only after hydration.
-  const [liveStore, setLiveStore] = useState<RindleClient["store"] | null>(null);
-  const ssrStateRef = useRef(ssrState);
-  ssrStateRef.current = ssrState;
-  useEffect(() => {
-    let alive = true;
-    void bootClient().then((app) => {
-      if (!alive) return;
-      app.store.hydrate(ssrStateRef.current); // seed the live views so the swap doesn't flash empty
-      setLiveStore(app.store);
-    });
-    return () => {
-      alive = false;
-    };
-  }, []);
-
-  return <Rindle store={liveStore ?? seedStore}>{children}</Rindle>;
+  return (
+    <RindleSSR schema={schema} ssrState={ssrState} boot={bootClient}>
+      {children}
+    </RindleSSR>
+  );
 }

package/templates/minimal/src/components/Composer.tsx

@@ -5,7 +5,7 @@
 import { useState } from "react";
 import type { FormEvent } from "react";
 
-import { app, currentHandle } from "../rindle-client.ts";
+import { app } from "../rindle-client.ts";
 
 export function Composer({ roomId }: { roomId: string }) {
   const [body, setBody] = useState("");
@@ -15,11 +15,11 @@ export function Composer({ roomId }: { roomId: string }) {
     const text = body.trim();
     if (!text) return;
     const now = Date.now();
+    // The author is NOT an arg — it's the acting principal (ctx.user), injected by each tier.
     app.mutate.postMessage({
       id: `msg-${now}-${Math.random().toString(36).slice(2, 7)}`,
       roomId,
       body: text,
-      author: currentHandle(),
       createdAt: now,
     });
     setBody("");

package/templates/minimal/src/rindle-client.ts

@@ -11,7 +11,7 @@ import type { MutationEnvelope } from "@rindle/client";
 
 import wasmUrl from "rindle-wasm-bin?url";
 
-import { mutators, schema } from "../shared/app-def.ts";
+import { mutators, normalizeSubject, schema } from "../shared/app-def.ts";
 
 // The precise client type — including the typed `mutate.*` surface — is INFERRED from the concrete
 // `createRindleClient({ schema, mutators, … })` call in `bootClientInner`.
@@ -63,6 +63,9 @@ async function bootClientInner() {
   return createRindleClient({
     schema,
     mutators,
+    // The acting principal a mutator sees as ctx.user — the prediction's author. The server injects
+    // its OWN verified identity for the authoritative run (server/app-api.ts sharedCtx).
+    user: () => normalizeSubject(currentHandle()),
     api: {
       url: "", // same-origin: /api/rindle/* is a Start server route on this same server
       // Identity per request: the dev handle header. A real app sends a verified token instead.
@@ -70,10 +73,7 @@ async function bootClientInner() {
     },
     // 7601 = the daemon's PUBLIC ws port (7600 is the HTTP control plane).
     daemon: { wsUrl: import.meta.env.VITE_DAEMON_WS ?? "ws://127.0.0.1:7601" },
-    // `dev.resetOnMutationGap` postdates the published @rindle/optimistic (0.2.0); the spread-cast
-    // keeps this scaffold typechecking against the registry package — older clients ignore the key,
-    // newer ones honor it. Inline the option (and drop the cast) once a release includes it.
-    ...({ dev: { resetOnMutationGap: import.meta.env.DEV } } as object),
+    dev: { resetOnMutationGap: import.meta.env.DEV },
     onRejected: (envelope, reason) => rejectionHandler(envelope, reason),
   });
 }

package/templates/minimal/src/ssr.ts

@@ -36,16 +36,11 @@ const readInProcess: OneShotQueryFn = async ({ name, args }): Promise<OneShotRes
 };
 
 /** Preload the given NAMED queries through the authority and return the dehydrated first-paint cache to
- *  embed in the HTML. Call from a route loader (server only). A failed read degrades to no seed for
- *  that query (the live engine fills it in after hydration) rather than breaking the whole page. */
+ *  embed in the HTML. Call from a route loader (server only). `preloadAll` degrades a failed read to no
+ *  seed for that query (the live engine fills it in after hydration) rather than breaking the whole page. */
 export async function preloadRindle(queries: Array<Query<any, any, any>>): Promise<DehydratedState> {
-  const server = createServerStore(schema, { query: readInProcess });
-  await Promise.all(
-    queries.map((query) =>
-      server.preload(query).catch((err) => {
-        console.error("[ssr] preload failed; rendering this query without its first-paint seed:", err instanceof Error ? err.message : err);
-      }),
-    ),
-  );
-  return server.dehydrate();
+  return createServerStore(schema, { query: readInProcess }).preloadAll(queries, {
+    onError: (_query, err) =>
+      console.error("[ssr] preload failed; rendering this query without its first-paint seed:", err instanceof Error ? err.message : err),
+  });
 }