create-rindle 0.4.4 → 0.6.3

package/index.mjs

@@ -116,8 +116,8 @@ async function main() {
       (opts.install ? "" : `    ${pm} install\n`) +
       `    ${run} dev\n\n` +
       `  The migrations in migrations/*.sql are the source of truth — \`${run} dev\` applies them,\n` +
-      `  generates shared/schema.gen.ts, boots the daemon + API + Vite, and seeds a little data.\n` +
-      `  Open two browser windows to watch writes sync live.\n\n`,
+      `  generates shared/schema.gen.ts, and boots the topology pair + Vite (app + /api/rindle routes).\n` +
+      `  Open two browser windows, create a room, and watch writes sync live.\n\n`,
   );
 }
 

package/lib/scaffold.mjs

@@ -18,7 +18,7 @@ export const PROJECT_NAME_TOKEN = "__PROJECT_NAME__";
 // future binary asset (an icon, say) is copied verbatim rather than corrupted by a string replace.
 const TEXT_EXT = new Set([
   ".ts", ".tsx", ".js", ".mjs", ".cjs", ".json", ".jsonc", ".css", ".html", ".sql", ".md", ".txt",
-  ".gitignore", ".npmrc", ".env",
+  ".ncl", ".gitignore", ".npmrc", ".env",
 ]);
 
 const isTextFile = (name) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rindle",
-  "version": "0.4.4",
+  "version": "0.6.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

package/templates/minimal/AGENTS.md

@@ -3,9 +3,10 @@
 Guidance for coding agents (and new humans). This is a **Rindle** app — an
 incremental-view-maintenance (IVM) engine keeps every registered query's result
 exact on each write instead of re-running it. Three tiers: a TanStack Start SPA
-running the wasm engine in-process, an API authority, and the `rindled` daemon
-that owns the SQLite data. The correctness contract everywhere is
-**view-after-write == fresh-query**.
+running the wasm engine in-process, an API authority, and the data tier — the one
+topology (design 214): a `rindle-replicator` write-master + a `rindled`
+read-follower (`followers = 1` = the colocated pair). The correctness contract
+everywhere is **view-after-write == fresh-query**.
 
 Rindle docs are served as raw markdown for LLMs: index at
 <https://rindle.sh/llms.txt>, the whole app track in one file at
@@ -13,12 +14,22 @@ Rindle docs are served as raw markdown for LLMs: index at
 
 ## Commands
 
-- `pnpm dev` — the only command you need: boots `rindled` (prebuilt binary from
-  `@rindle/cli`, no Rust toolchain), applies `migrations/*.sql`, regenerates
-  `shared/schema.gen.ts`, seeds, and starts Vite (the app + the `/api/rindle`
-  server routes). Re-applies/regenerates on every `migrations/` change.
+- `pnpm dev` — the one command: `concurrently` runs two processes — **fleet**
+  (`rindle up` renders `rindle.ncl` and supervises the pair — the
+  `rindle-replicator` write-master + the `rindled` follower, prebuilt binaries
+  from `@rindle/cli`, no Rust toolchain) applies `migrations/*.sql` to the master
+  and regenerates `shared/schema.gen.ts` from the follower (re-running both on
+  every `migrations/` change), and **web** (`rindle exec -- vite dev` on :3000) receives bindings
+  derived from `rindle.ncl` and serves the app +
+  the `/api/rindle/*` server routes. Run either alone with `pnpm fleet` /
+  `pnpm dev:web`.
 - `pnpm typecheck` — regenerates the route tree, then `tsc --noEmit`.
-- `pnpm migrate` / `pnpm seed` — one-shot apply / seed against the running daemon.
+- `pnpm migrate` — one-shot `rindle exec -- rindle migrate apply` against the write-master derived
+  from `rindle.ncl` (the follower's `/migrate` is write-fenced). The dev loop already
+  applies on boot + on every `migrations/` change.
+- `pnpm rindle:deploy` / `pnpm rindle:migrate:remote` — deploy the data tier to
+  Rindle Cloud (reads `rindle.ncl`, the same file `rindle up` runs locally; run
+  `rindle login` once first) and push `migrations/*.sql` to the deployed master.
 
 ## Rules that keep the app correct
 
@@ -49,9 +60,9 @@ review:
    `src/components/*.queries.ts` and register them in `server/app-api.ts`. An
    ad-hoc `store.query.…` builder resolves **locally only** — it never opens a
    server subscription.
-5. **The daemon token is server-only.** It gates the private control plane
-   (`:7600`) and must never reach the browser; the browser holds only the
-   lease-gated public WebSocket (`:7601`).
+5. **Daemon tokens are server-only.** They gate the follower and write-master control planes and
+   must never reach the browser; the browser reaches only the lease-gated fleet edge. Local endpoint
+   bindings come from `rindle exec`; never copy topology ports into package scripts.
 6. **Subscribe to windows, not whole tables** — order + `limit`, and ratchet
    `limit` up for "load more". The engine keeps the window (and any `countAs`)
    exact as rows enter and leave.
@@ -69,7 +80,7 @@ review:
 | `src/rindle-client.ts` | the one-call browser wire-up (`createRindleClient`) |
 | `server/app-api.ts` | the authority: `registerQueries` + `sharedApiMutators` + server-only policy |
 | `src/routes/api.rindle.*.tsx` | TanStack Start server routes exposing the authority over HTTP |
-| `server/dev.ts` | dev orchestration (`rindle up` + seed + Vite) |
+| `rindle.ncl` | the one topology (the colocated pair) — `rindle up` runs it locally, `rindle deploy` provisions it |
 | `src/ssr.ts` | SSR preload of the same named queries for first paint |
 
 ## Reading more

package/templates/minimal/README.md

@@ -18,7 +18,10 @@ Three tiers, same as the Rindle flagship examples:
   reaches it through TanStack Start **server routes** (`src/routes/api.rindle.{query,read,mutate}.tsx`,
   via `server/rindle-http.ts`) that run in the same server as the app, and SSR calls the very same
   factory **in-process** (no network hop).
-- **Daemon** (`rindled`) — owns the SQLite data + live IVM and streams normalized deltas to subscribers.
+- **Data tier** — the one topology (design 214): a `rindle-replicator` **write-master** plus a
+  `rindled` **read-follower** that owns the live IVM and streams normalized deltas to subscribers.
+  Writes land on the master; the follower serves reads. `followers = 1` is the *colocated pair* —
+  both processes on one box, the smallest shape.
 
 ## SQL is the source of truth
 
@@ -35,16 +38,47 @@ pnpm install
 pnpm dev
 ```
 
-`pnpm dev` (`server/dev.ts`) is one command: it boots the daemon (`rindle up` supervising `rindled` —
-prebuilt binaries from `@rindle/cli`, no Rust toolchain needed), applies the migrations, regenerates
-`shared/schema.gen.ts`, starts Vite (which serves both the app and the `/api/rindle` route), and seeds
-a little data. Open two browser windows
-to watch writes sync live. Post a message and watch the room's count update on the home page. Try a
-room name or message containing "spam" to see the rejection path.
+`pnpm dev` runs two processes with [`concurrently`](https://www.npmjs.com/package/concurrently) —
+the standard TanStack Start dev shape:
 
-> Requires Node ≥ 22.18 (runs the `.ts` server files via Node's built-in type stripping). The TanStack
-> route tree (`src/routeTree.gen.ts`) is a generated artifact — `pnpm dev` and `pnpm generate-routes`
-> produce it; `pnpm typecheck` runs `tsr generate` first.
+- **`fleet`** — `rindle up` renders `rindle.ncl` and supervises the whole pair (the
+  `rindle-replicator` write-master + the `rindled` follower — prebuilt binaries from `@rindle/cli`,
+  no Rust toolchain needed), applies the migrations to the master, and regenerates
+  `shared/schema.gen.ts` from the follower's schema — re-running both on every `migrations/*.sql`
+  change (`--watch`).
+- **`web`** — `rindle exec -- vite dev` on <http://localhost:3000>, which serves both the app and the
+  `/api/rindle/*` Start server routes. `rindle exec` derives the stable fleet-edge read/ws binding
+  and write-master binding from `rindle.ncl`; no endpoint is copied into the package scripts.
+
+You can run either alone: `pnpm fleet` / `pnpm dev:web`. Both processes bind to loopback and run
+without an auth token in dev; a real deployment sets tokens (`RINDLE_DAEMON_TOKEN` for reads,
+`RINDLE_REPLICATOR_TOKEN` for writes on the server) that never reach the browser.
+
+Open two browser windows to watch writes sync live: create a room, post a message, and watch the
+room's count update on the home page with no polling. Try a room name or message containing "spam" to
+see the rejection path (the optimistic write snaps back + a toast).
+
+> Requires Node ≥ 22.18. The TanStack route tree (`src/routeTree.gen.ts`) is a generated artifact —
+> `pnpm dev` and `pnpm generate-routes` produce it; `pnpm typecheck` runs `tsr generate` first.
+
+## Deploy
+
+`rindle.ncl` describes the **one topology** — the same file `rindle up` runs locally. To run the
+**data tier** on Rindle Cloud:
+
+```bash
+rindle login                  # once — authenticate to Rindle Cloud
+pnpm rindle:deploy            # provision / re-attach the managed app (writes .rindle/cloud.json)
+pnpm rindle:migrate:remote    # push migrations/*.sql to the deployed write-master
+```
+
+`rindle deploy` reads `rindle.ncl` and records the binding in `.rindle/cloud.json` — commit it, so
+future deploys re-attach to the same app. `followers = 1` provisions the colocated pair
+(`single-backup`); raise it for read replicas (`read-scaled`). That deploys the **data tier**; the
+**web app** (this Vite/TanStack Start app) deploys to any Node host — point its `RINDLE_DAEMON_URL`
+(fleet-edge reads) + `RINDLE_REPLICATOR_URL` (writes) + their tokens (server) at the deployed data
+tier, and set `VITE_FLEET_WS` to the stable public fleet ws. These bindings are identical for one or
+many followers, and follower affinity is always enabled.
 
 ## Devtools
 
@@ -63,7 +97,7 @@ of `vite build` and never ship to production.
 | `shared/schema.gen.ts` | generated `@rindle/client` schema (don't edit by hand) |
 | `shared/app-def.ts` | the contract root: schema re-export, relationships, isomorphic mutators |
 | `shared/auth.ts` | the identity seam (`AuthProvider`) |
-| `server/dev.ts` | one-command dev orchestrator |
+| `rindle.ncl` | the one topology (the colocated pair) — `rindle up` runs it locally, `rindle deploy` provisions it |
 | `server/app-api.ts` | the authority: query resolution, `sharedApiMutators`, policy (host-agnostic) |
 | `server/rindle-http.ts` | adapts the authority to a Web Request (the Start API routes call it) |
 | `src/routes/api.rindle.*.tsx` | the three API endpoints as Start server routes (the browser's API) |

package/templates/minimal/_gitignore

@@ -5,3 +5,9 @@ dist
 *.db-*
 .DS_Store
 *.log
+
+# Rindle Cloud: ignore the rendered manifests, but COMMIT the binding (.rindle/cloud.json) so
+# `rindle deploy` re-attaches future deploys to the same managed app.
+/rindle.json
+/.rindle/*
+!/.rindle/cloud.json

package/templates/minimal/package.json

@@ -8,12 +8,16 @@
     "node": ">=22.18"
   },
   "scripts": {
-    "dev": "node server/dev.ts",
-    "migrate": "node server/migrate.ts",
+    "fleet": "rindle up --migrate --gen shared/schema.gen.ts --watch --dir migrations",
+    "dev:web": "rindle exec -- vite dev --port 3000",
+    "dev": "concurrently -k -n fleet,web -c blue,green \"pnpm fleet\" \"pnpm dev:web\"",
     "generate-routes": "tsr generate",
     "build": "vite build",
-    "typecheck": "tsr generate && tsc --noEmit",
-    "seed": "node server/seed.ts"
+    "preview": "vite preview",
+    "migrate": "rindle exec -- rindle migrate apply --dir migrations",
+    "rindle:deploy": "rindle deploy",
+    "rindle:migrate:remote": "rindle migrate apply --remote",
+    "typecheck": "tsr generate && tsc --noEmit"
   },
   "dependencies": {
     "@rindle/api-server": "latest",
@@ -26,6 +30,7 @@
     "@tanstack/react-start": "latest",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
+    "ulid": "^3.0.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -34,6 +39,7 @@
     "@rindle/react-devtools": "latest",
     "@tanstack/router-cli": "^1.167.17",
     "@tanstack/router-plugin": "^1.168.18",
+    "concurrently": "^10.0.3",
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",

package/templates/minimal/rindle.ncl

@@ -0,0 +1,27 @@
+# The Rindle topology for this app — the ONE topology (design 214): a `rindle-replicator`
+# write-master + one `rindled` read-follower. `followers = 1` is the colocated pair, the smallest
+# shape; raise it for more read replicas.
+#
+# A topology is a plain record of inputs; `rindle up` (local) and `rindle deploy` / `rindle render`
+# (cloud) merge it onto the topology library embedded in the `rindle` binary — nothing to import
+# or install. LOCAL dev reads THIS file: `rindle up` renders it and supervises the pair (see
+# package.json `dev` / `fleet`). The same file drives the cloud:
+#
+#   rindle login                  # once — authenticate to Rindle Cloud
+#   rindle deploy                 # provision / re-attach the managed app (writes .rindle/cloud.json)
+#   rindle migrate apply --remote # push migrations/*.sql to the deployed write-master
+#
+# `app` becomes the cloud display name and groups every component under one app in `rindle ps`.
+# `followers = 1` maps to the cloud `single-backup` rung (one box, both processes); `followers > 1`
+# maps to `read-scaled`.
+#
+# Every follower count renders a local fleet edge (the Fly-edge stand-in;
+# FOLLOWER-AFFINITY-DESIGN.md §10). `rindle exec` derives the app's read/write/ws bindings from this
+# file, so changing `followers = 1` to a wider fleet requires no application configuration change.
+# Set `RINDLE_DEV_CLIENT_REGION=A` to simulate a client region; the edge always mints an affinity
+# placement ticket, with a fleet of one resolving trivially to its only follower.
+{
+  profile = "replicated",
+  app = "__PROJECT_NAME__",
+  followers = 1,
+}

package/templates/minimal/server/app-api.ts

@@ -14,7 +14,9 @@ import {
   defineApiMutators,
   registerQueries,
   runSharedMutation,
+  scoped,
   sharedApiMutators,
+  SplitDaemonClient,
 } from "@rindle/api-server";
 import type {
   ApiMutator,
@@ -22,7 +24,6 @@ import type {
   MutationContext,
   MutatorCtx,
   RindleApiServer,
-  ServerMutationTx,
   SharedMutatorWithArgs,
 } from "@rindle/api-server";
 import { HttpRindleDaemonClient } from "@rindle/daemon-client";
@@ -55,9 +56,13 @@ const apiQueries = registerQueries<User>([roomsQuery, roomDetailQuery]);
 // whose server run needs no authority beyond that triad needs no entry here at all.
 //
 // The ONLY explicit entries are server-only AUTHORITY the client must NOT predict, each OVERRIDING
-// its auto-wrapped default (spread first, override wins): the "spam" policy guard (so the demo's
-// rejection path stays exercised end to end) and postMessage's room-exists gate (relational SQL a
-// keyed op can't express — the raw `tx.exec` escape hatch).
+// its auto-wrapped default (spread first, override wins):
+//   • createRoom — a `withGuard` arg policy: an empty or "spam" name hard-rejects BEFORE any write.
+//   • postMessage — a `scoped` mutator (work-outside-tx): it runs async MODERATION *outside* the
+//     transaction, then opens the ONE write via `scope.transact`, driving the SAME isomorphic body the
+//     browser predicted (its room-exists guard is a `tx.row` read — no raw SQL, and the client predicts
+//     it too). A scoped mutator lets server-only work that must NOT hold a DB write open (a moderation/
+//     LLM/anti-abuse call, a payment) run before — or after — the atomic write.
 
 /** The `MutatorCtx` a shared body sees on the server: the AUTHENTICATED subject (throws if absent —
  *  a business rejection). Never a client-supplied author. */
@@ -81,27 +86,42 @@ const apiMutators = defineApiMutators<User, ApiMutators<User>>({
   // (a) a server-only policy on the shared body: an empty or "spam" name throws BEFORE any write.
   createRoom: withGuard(sharedMutators.createRoom, (a) => void cleanName(a.name)),
 
-  // (b) the raw-SQL escape hatch: insert only into a room that exists, so a racing client can't post
-  //     into a deleted room. The client predicts the plain shared insert and it snaps back if this
-  //     no-ops. `author` is the VERIFIED subject, never a wire arg.
-  postMessage: async (tx: ServerMutationTx, raw: unknown, ctx: MutationContext<User>) => {
+  // (b) a SCOPED mutator (work-outside-tx): server-only code runs OUTSIDE the write transaction, then
+  //     ONE atomic write opens via `scope.transact`, then post-commit code may run.
+  postMessage: scoped<User, unknown>(async (scope, raw, ctx) => {
     const a = postMessageArgs.parse(raw);
-    const author = sharedCtx(ctx).user;
-    const body = cleanBody(a.body);
-    tx.exec(
-      `INSERT INTO message (id, roomId, author, body, createdAt)
-       SELECT ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM room WHERE id = ?)`,
-      [a.id, a.roomId, author, body, a.createdAt, a.roomId],
-    );
-  },
+
+    // OUTSIDE the transaction: moderation is an async, out-of-database call (a real app would reach an
+    // LLM or anti-abuse service) — the ONE thing here the client genuinely can't predict. A scoped
+    // mutator exists precisely so this does NOT hold a DB write open across the network round trip. A
+    // throw rejects the post before any write — the client's optimistic message snaps back. For a
+    // NON-idempotent external effect, key it on the stable `ctx.envelope.mid` so a retried envelope
+    // can't double-fire it.
+    await moderateBody(a.body);
+
+    // INSIDE the transaction: drive the SAME isomorphic body the browser predicted (shared/app-def.ts).
+    // Its room-exists guard is a `tx.row` READ (read-your-writes) — no raw SQL, no server-only insert —
+    // so the client predicts the same guard. This is the one atomic write; the daemon stamps `lmid`
+    // together with it. A throw inside the body would be a business rejection surfaced as
+    // `MutationRejected` (data rolls back, `lmid` still advances).
+    await scope.transact(sharedMutators.postMessage, a, sharedCtx(ctx));
+
+    // AFTER commit: fire post-commit effects here (a push notification, a webhook). They can't roll the
+    // write back, so keep them best-effort (wrap your own try/catch). None are needed for this demo.
+  }),
 });
 
 /** A bearer-auth'd daemon control-plane target. */
 export interface AppApiOptions {
-  /** The daemon control-plane base URL — bearer-auth'd. */
+  /** The follower/read daemon control-plane base URL — bearer-auth'd. */
   daemonUrl: string;
   /** The shared bearer token for {@link daemonUrl} (daemon ↔ this tier ONLY — never reaches the browser). */
   daemonToken: string;
+  /** The required write-master (`rindle-replicator`) control-plane base URL. Writes + mutation
+   *  sessions go here; reads stay on {@link daemonUrl}. */
+  replicatorUrl: string;
+  /** Bearer for {@link replicatorUrl}, if it gates its write plane. */
+  replicatorToken?: string;
   /** Override the daemon HTTP transport (defaults to global `fetch`). */
   fetch?: FetchLike;
 }
@@ -109,13 +129,20 @@ export interface AppApiOptions {
 /** Build the configured API server. Stateless: safe to construct per-request or once per process.
  *  Reads are PUBLIC; writes require a verified identity. */
 export function createAppApi(opts: AppApiOptions): RindleApiServer<User> {
-  const daemon = new HttpRindleDaemonClient({
+  const reads = new HttpRindleDaemonClient({
     baseUrl: opts.daemonUrl,
     headers: { authorization: `Bearer ${opts.daemonToken}` },
     fetch: opts.fetch,
   });
   return createRindleApiServer<User>({
-    daemon,
+    daemon: new SplitDaemonClient(
+      new HttpRindleDaemonClient({
+        baseUrl: opts.replicatorUrl,
+        headers: opts.replicatorToken ? { authorization: `Bearer ${opts.replicatorToken}` } : undefined,
+        fetch: opts.fetch,
+      }),
+      reads,
+    ),
     schema, // drives the dialect-SQL renderer for the shared mutators' logical ops
     queries: apiQueries,
     mutators: apiMutators,
@@ -128,10 +155,16 @@ export function createAppApi(opts: AppApiOptions): RindleApiServer<User> {
 export function resolveDaemon(
   env: Record<string, string | undefined>,
   defaults: { daemonUrl: string; daemonToken: string },
-): Pick<AppApiOptions, "daemonUrl" | "daemonToken"> {
+): Pick<AppApiOptions, "daemonUrl" | "daemonToken" | "replicatorUrl" | "replicatorToken"> {
+  const replicatorUrl = env.RINDLE_REPLICATOR_URL;
+  if (!replicatorUrl) {
+    throw new Error("RINDLE_REPLICATOR_URL is required: writes must target the replicator write-master");
+  }
   return {
     daemonUrl: env.RINDLE_DAEMON_URL ?? defaults.daemonUrl,
     daemonToken: env.RINDLE_DAEMON_TOKEN ?? defaults.daemonToken,
+    replicatorUrl,
+    replicatorToken: env.RINDLE_REPLICATOR_TOKEN,
   };
 }
 
@@ -152,11 +185,13 @@ function cleanName(name: string): string {
   return out;
 }
 
-function cleanBody(body: string): string {
-  const out = normalizeBody(body);
-  if (out.length === 0) throw new Error("a message can't be empty");
-  if (/\bspam\b/i.test(out)) throw new Error('the word "spam" is not allowed');
-  return out;
+/** Message moderation — a PLACEHOLDER for a real async, out-of-database check (an LLM / anti-abuse
+ *  service). It runs OUTSIDE the write transaction (see `postMessage`), the whole reason a scoped
+ *  mutator exists: you don't hold a DB write open across a network call. Here it just flags the "spam"
+ *  demo; throwing rejects the post before any write (server-only, so the client's optimistic message
+ *  snaps back). Empty/normalization is handled ISOMORPHICALLY in the shared body, so it's not here. */
+async function moderateBody(body: string): Promise<void> {
+  if (/\bspam\b/i.test(normalizeBody(body))) throw new Error('the word "spam" is not allowed');
 }
 
 function requireUser(user: User): Identity {

package/templates/minimal/shared/app-def.ts

@@ -82,9 +82,9 @@ export type PostMessageArgs = z.infer<typeof postMessageArgs>;
 // against the browser's wasm engine (the optimistic prediction) AND asynchronously against a live
 // transaction on the server, each op rendered to SQL. Deterministic + replayable: every value that
 // would otherwise come from the clock or a random source is passed in args (ids, timestamps) — the
-// client RE-INVOKES the body on every rebase. Normalization runs INSIDE the body, so both tiers
-// normalize identically; the server layers its own policy on top (identity required, a "spam"
-// rejection demo, the room-exists guard — server/app-api.ts).
+// client RE-INVOKES the body on every rebase. Normalization AND the room-exists guard (a `tx.row`
+// read) run INSIDE the body, so both tiers behave identically; the server layers only what it ALONE
+// can do on top (identity required, an async "spam" moderation rejection demo — server/app-api.ts).
 
 export const mutators = {
   createRoom: shared(createRoomArgs, function* (tx: IsoTx, a: CreateRoomArgs): MutationGen {
@@ -95,6 +95,12 @@ export const mutators = {
   postMessage: shared(postMessageArgs, function* (tx: IsoTx, a: PostMessageArgs, ctx: MutatorCtx): MutationGen {
     const body = normalizeBody(a.body);
     if (!body) return;
+    // The room-exists guard, ISOMORPHIC (no raw SQL): READ the room through the mutator so a message
+    // never lands in a room that doesn't exist. Read-your-writes on BOTH tiers — the browser's local
+    // engine for the optimistic prediction, the server's interactive transaction for the authoritative
+    // run — so the client predicts the SAME guard the server enforces, and a post into a deleted room
+    // snaps back.
+    if (!(yield tx.row("room", { id: a.roomId }))) return;
     yield tx.insert("message", {
       id: a.id,
       roomId: a.roomId,

package/templates/minimal/src/components/Composer.tsx

@@ -4,6 +4,7 @@
 
 import { useState } from "react";
 import type { FormEvent } from "react";
+import { ulid } from "ulid";
 
 import { app } from "../rindle-client.ts";
 
@@ -14,13 +15,13 @@ export function Composer({ roomId }: { roomId: string }) {
     e.preventDefault();
     const text = body.trim();
     if (!text) return;
-    const now = Date.now();
-    // The author is NOT an arg — it's the acting principal (ctx.user), injected by each tier.
+    // `ulid()` mints a k-sortable, time-ascending id at the callsite (stable across optimistic
+    // replays). The author is NOT an arg — it's the acting principal (ctx.user), injected per tier.
     app.mutate.postMessage({
-      id: `msg-${now}-${Math.random().toString(36).slice(2, 7)}`,
+      id: ulid(),
       roomId,
       body: text,
-      createdAt: now,
+      createdAt: Date.now(),
     });
     setBody("");
   }

package/templates/minimal/src/components/NewRoomForm.tsx

@@ -4,6 +4,7 @@
 
 import { useState } from "react";
 import type { FormEvent } from "react";
+import { ulid } from "ulid";
 
 import { app } from "../rindle-client.ts";
 
@@ -14,8 +15,9 @@ export function NewRoomForm() {
     e.preventDefault();
     const text = name.trim();
     if (!text) return;
-    const now = Date.now();
-    app.mutate.createRoom({ id: `room-${now}-${Math.random().toString(36).slice(2, 7)}`, name: text, createdAt: now });
+    // `ulid()` mints a k-sortable, time-ascending id (48-bit ms prefix + 80 random bits) at the
+    // callsite, so it's stable across the mutator's optimistic replays and orders chronologically.
+    app.mutate.createRoom({ id: ulid(), name: text, createdAt: Date.now() });
     setName("");
   }
 

package/templates/minimal/src/rindle-client.ts

@@ -60,6 +60,11 @@ async function bootClientInner() {
     import("@rindle/wasm"),
   ]);
   await initWasm(wasmUrl);
+  // Every deployment exposes one stable fleet ws, including a fleet of one. `rindle exec` derives
+  // VITE_FLEET_WS from rindle.ncl, so increasing `followers` never changes app configuration.
+  // VITE_DAEMON_WS is a temporary direct-follower escape hatch for focused harnesses.
+  const directWs = import.meta.env.VITE_DAEMON_WS?.trim();
+  const fleetWs = import.meta.env.VITE_FLEET_WS?.trim() ?? "ws://127.0.0.1:7650";
   return createRindleClient({
     schema,
     mutators,
@@ -71,8 +76,8 @@ async function bootClientInner() {
       // Identity per request: the dev handle header. A real app sends a verified token instead.
       headers: (): Record<string, string> => ({ "x-rindle-user": currentHandle() }),
     },
-    // 7601 = the daemon's PUBLIC ws port (7600 is the HTTP control plane).
-    daemon: { wsUrl: import.meta.env.VITE_DAEMON_WS ?? "ws://127.0.0.1:7601" },
+    // Normal app traffic always enters through the fleet edge. Direct follower access is explicit.
+    daemon: directWs ? { wsUrl: directWs } : { wsUrl: fleetWs, affinity: true },
     dev: { resetOnMutationGap: import.meta.env.DEV },
     onRejected: (envelope, reason) => rejectionHandler(envelope, reason),
   });

package/templates/minimal/src/routes/__root.tsx

@@ -22,9 +22,18 @@ export const Route = createRootRoute({
       { charSet: "utf-8" },
       { name: "viewport", content: "width=device-width, initial-scale=1.0" },
       { title: "__PROJECT_NAME__" },
-      { name: "theme-color", content: "#0f1115" },
+      { name: "theme-color", content: "#f2eee7" },
+    ],
+    links: [
+      // Hanken Grotesk (UI) + DM Mono (counts, timestamps, labels). Swap for a self-hosted font to drop the CDN.
+      { rel: "preconnect", href: "https://fonts.googleapis.com" },
+      { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "anonymous" },
+      {
+        rel: "stylesheet",
+        href: "https://fonts.googleapis.com/css2?family=Hanken+Grotesk:wght@300;400;500;600;700;800&family=DM+Mono:ital,wght@0,300;0,400;0,500;1,400&display=swap",
+      },
+      { rel: "stylesheet", href: appCss },
     ],
-    links: [{ rel: "stylesheet", href: appCss }],
   }),
   shellComponent: RootDocument,
 });

package/templates/minimal/src/styles.css

@@ -1,13 +1,34 @@
+/* Starter styles — matched to the Rindle site (rindle.sh): a warm "paper" canvas with a fine
+   dot-grid, near-black ink, an orange accent, Hanken Grotesk for UI, and DM Mono for the technical
+   bits (live counts, timestamps, kicker labels). Rebrand by editing the tokens in :root. */
+
 :root {
-  --bg: #0f1115;
-  --panel: #171a21;
-  --panel-2: #1e222b;
-  --border: #2a2f3a;
-  --text: #e7e9ee;
-  --muted: #9aa3b2;
-  --accent: #6ea8fe;
-  --danger: #ff7b72;
-  color-scheme: dark;
+  /* surfaces */
+  --paper: #f2eee7;
+  --panel: #fcfaf5;
+  --white: #ffffff;
+
+  /* ink — text, strongest → faintest */
+  --ink: #171411;
+  --ink-d: #5f564b;
+  --ink-f: #746a5d;
+
+  /* hairlines + dot-grid */
+  --line: #d8cebc;
+  --line2: #c7baa3;
+  --dot: #d8d0bd;
+
+  /* accent */
+  --accent: #ff4d00;
+  --teal: #04756b;
+
+  --radius: 14px;
+
+  --font-sans: "Hanken Grotesk", ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  --font-mono: "DM Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+
+  color-scheme: light;
+  accent-color: var(--accent);
 }
 
 * {
@@ -16,10 +37,13 @@
 
 body {
   margin: 0;
-  background: var(--bg);
-  color: var(--text);
-  font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
-  line-height: 1.5;
+  color: var(--ink);
+  font-family: var(--font-sans);
+  line-height: 1.55;
+  background-color: var(--paper);
+  background-image: radial-gradient(var(--dot) 0.9px, transparent 0.9px);
+  background-size: 26px 26px;
+  -webkit-font-smoothing: antialiased;
 }
 
 a {
@@ -27,102 +51,163 @@ a {
   text-decoration: none;
 }
 
+/* ---- top bar ---- */
 .app-topbar {
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 0.85rem 1.25rem;
-  border-bottom: 1px solid var(--border);
+  gap: 1rem;
+  flex-wrap: wrap;
+  padding: 0.9rem 1.5rem;
+  border-bottom: 1px solid var(--line);
   background: var(--panel);
 }
-
 .app-wordmark {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.5rem;
   font-weight: 800;
+  font-size: 1.2rem;
   letter-spacing: -0.02em;
-  font-size: 1.15rem;
 }
 .app-wordmark span {
-  color: var(--accent);
+  font-family: var(--font-mono);
+  font-size: 0.6rem;
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: 0.14em;
+  color: var(--ink-d);
+  border: 1px solid var(--line2);
+  border-radius: 999px;
+  padding: 0.15em 0.6em;
 }
-
 .app-topbar-right {
   display: flex;
   align-items: center;
-  gap: 0.75rem;
+  gap: 0.85rem;
 }
 .app-whoami {
-  color: var(--muted);
-  font-size: 0.9rem;
+  font-size: 0.85rem;
+  color: var(--ink-d);
+}
+.app-whoami b {
+  color: var(--ink);
+  font-weight: 600;
 }
 
+/* ---- layout ---- */
 .app-main {
-  max-width: 720px;
+  max-width: 760px;
   margin: 0 auto;
-  padding: 1.5rem 1.25rem 4rem;
+  padding: 2.75rem 1.5rem 5rem;
+}
+.app-page-head {
+  margin-bottom: 1.5rem;
 }
-
 .app-eyebrow {
+  margin: 0 0 0.7rem;
+  font-family: var(--font-mono);
+  font-size: 0.7rem;
   text-transform: uppercase;
-  letter-spacing: 0.08em;
-  font-size: 0.72rem;
-  color: var(--muted);
-  margin: 0 0 0.15rem;
+  letter-spacing: 0.18em;
+  color: var(--accent);
 }
 .app-page-head h1 {
-  margin: 0 0 1rem;
-  font-size: 1.6rem;
+  margin: 0;
+  font-weight: 800;
+  letter-spacing: -0.025em;
+  line-height: 1.05;
+  font-size: clamp(1.8rem, 5vw, 2.6rem);
+  overflow-wrap: break-word;
 }
 
 .app-empty {
-  color: var(--muted);
+  color: var(--ink-d);
 }
 .app-link {
   color: var(--accent);
+  font-weight: 600;
 }
 .app-breadcrumb {
-  color: var(--muted);
-  font-size: 0.9rem;
-  margin-bottom: 0.5rem;
+  margin-bottom: 0.85rem;
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  color: var(--ink-f);
 }
 .app-breadcrumb a {
+  color: var(--ink-d);
+}
+.app-breadcrumb a:hover {
   color: var(--accent);
 }
 
+/* ---- buttons ---- */
 .app-btn {
+  font-family: var(--font-mono);
+  font-size: 0.8rem;
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: #1a0f06;
   background: var(--accent);
-  color: #0b1020;
-  border: none;
-  border-radius: 8px;
-  padding: 0.5rem 0.9rem;
-  font-weight: 600;
+  border: 0;
+  border-radius: 10px;
+  padding: 0.7rem 1.1rem;
   cursor: pointer;
+  transition: box-shadow 0.15s ease, transform 0.06s ease;
+}
+.app-btn:hover:not(:disabled) {
+  box-shadow: 0 12px 30px -14px color-mix(in srgb, var(--accent) 70%, transparent);
+}
+.app-btn:active:not(:disabled) {
+  transform: translateY(1px);
 }
 .app-btn:disabled {
-  opacity: 0.5;
+  opacity: 0.45;
   cursor: not-allowed;
 }
 .app-btn-ghost {
+  color: var(--ink);
   background: transparent;
-  color: var(--text);
-  border: 1px solid var(--border);
+  border: 1px solid var(--line2);
+}
+.app-btn-ghost:hover:not(:disabled) {
+  background: var(--white);
+  border-color: var(--ink);
+  box-shadow: none;
 }
 
+/* ---- inputs ---- */
 input,
 textarea {
   width: 100%;
-  background: var(--panel-2);
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  color: var(--text);
-  padding: 0.55rem 0.7rem;
   font: inherit;
+  font-family: var(--font-sans);
+  color: var(--ink);
+  background: var(--white);
+  border: 1px solid var(--line);
+  border-radius: 10px;
+  padding: 0.6rem 0.8rem;
   resize: vertical;
 }
+input::placeholder,
+textarea::placeholder {
+  color: var(--ink-f);
+}
+input:focus,
+textarea:focus {
+  outline: none;
+  border-color: var(--ink);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--teal) 22%, transparent);
+}
 
+/* ---- new room ---- */
 .app-new-room {
   display: flex;
-  gap: 0.5rem;
-  margin-bottom: 1.25rem;
+  gap: 0.6rem;
+  margin-bottom: 1.75rem;
 }
 .app-new-room input {
   flex: 1;
@@ -131,90 +216,128 @@ textarea {
   white-space: nowrap;
 }
 
+/* ---- rooms ---- */
 .app-rooms {
   list-style: none;
   margin: 0;
   padding: 0;
   display: grid;
-  gap: 0.6rem;
+  gap: 0.7rem;
 }
 .app-room-link {
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 0.9rem 1rem;
+  gap: 1rem;
+  padding: 1rem 1.15rem;
   background: var(--panel);
-  border: 1px solid var(--border);
-  border-radius: 12px;
+  border: 1px solid var(--line);
+  border-radius: var(--radius);
+  transition: border-color 0.15s ease, box-shadow 0.15s ease, transform 0.1s ease;
 }
 .app-room-link:hover {
-  border-color: var(--accent);
+  border-color: var(--line2);
+  box-shadow: 0 14px 34px -22px rgba(40, 30, 10, 0.45);
+  transform: translateY(-1px);
 }
 .app-room-name {
-  font-weight: 600;
+  font-weight: 700;
+  font-size: 1.05rem;
+  letter-spacing: -0.01em;
+  overflow-wrap: anywhere;
 }
 .app-count {
   display: inline-flex;
   flex-direction: column;
-  align-items: flex-end;
-  font-weight: 700;
+  align-items: center;
+  min-width: 3rem;
+  padding: 0.3rem 0.6rem;
+  border: 1px solid var(--line2);
+  border-radius: 9px;
+  background: var(--white);
+  font-family: var(--font-mono);
   font-variant-numeric: tabular-nums;
+  color: var(--accent);
+  font-size: 1.05rem;
+  font-weight: 500;
+  line-height: 1.15;
 }
 .app-count small {
-  font-weight: 400;
-  font-size: 0.7rem;
-  color: var(--muted);
+  color: var(--ink-f);
+  font-size: 0.58rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
 }
 
+/* ---- messages ---- */
 .app-messages {
   display: grid;
-  gap: 0.6rem;
-  margin: 1rem 0;
+  gap: 0.65rem;
+  margin: 1.5rem 0;
 }
 .app-message {
   background: var(--panel);
-  border: 1px solid var(--border);
+  border: 1px solid var(--line);
   border-radius: 12px;
-  padding: 0.75rem 0.9rem;
+  padding: 0.85rem 1rem;
 }
 .app-message-head {
   display: flex;
   justify-content: space-between;
-  font-size: 0.8rem;
-  color: var(--muted);
-  margin-bottom: 0.25rem;
+  gap: 1rem;
+  margin-bottom: 0.3rem;
 }
 .app-message-author {
-  font-weight: 600;
-  color: var(--text);
+  font-weight: 700;
+  font-size: 0.92rem;
+  color: var(--ink);
+}
+.app-message-time {
+  font-family: var(--font-mono);
+  font-size: 0.72rem;
+  color: var(--ink-f);
 }
 .app-message-body {
   margin: 0;
   white-space: pre-wrap;
 }
 
+/* ---- composer ---- */
 .app-composer textarea {
-  margin-bottom: 0.5rem;
+  margin-bottom: 0.6rem;
 }
 .app-composer-actions {
   display: flex;
   justify-content: flex-end;
 }
 
+/* ---- toaster ---- */
 .app-toaster {
   position: fixed;
-  bottom: 1rem;
-  right: 1rem;
+  bottom: 1.25rem;
+  right: 1.25rem;
   display: grid;
-  gap: 0.5rem;
+  gap: 0.6rem;
   z-index: 50;
 }
 .app-toast {
-  background: var(--danger);
-  color: #1a0c0a;
-  padding: 0.6rem 0.9rem;
+  background: var(--ink);
+  color: var(--paper);
+  border-left: 4px solid var(--accent);
+  padding: 0.7rem 0.95rem 0.7rem 0.85rem;
   border-radius: 10px;
-  font-weight: 600;
+  font-size: 0.85rem;
+  font-weight: 500;
   max-width: 320px;
-  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.35);
+  box-shadow: 0 18px 40px -20px rgba(20, 15, 8, 0.6);
+}
+
+@media (max-width: 560px) {
+  .app-topbar {
+    flex-direction: column;
+    align-items: flex-start;
+  }
+  .app-new-room {
+    flex-direction: column;
+  }
 }

package/templates/minimal/vite-env.d.ts

@@ -6,8 +6,10 @@ declare module "rindle-wasm-bin?url" {
 }
 
 interface ImportMetaEnv {
-  /** The daemon's PUBLIC subscription ws (server/dev.ts injects it). */
+  /** Deprecated direct-follower test/debug escape hatch. Normal apps use VITE_FLEET_WS. */
   readonly VITE_DAEMON_WS?: string;
+  /** Stable fleet-edge PUBLIC ws, derived by `rindle exec` for one or many followers. */
+  readonly VITE_FLEET_WS?: string;
 }
 
 interface ImportMeta {

package/templates/minimal/vite.config.ts

@@ -4,6 +4,9 @@ import { dirname, resolve } from "node:path";
 import { tanstackStart } from "@tanstack/react-start/plugin/vite";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
+// Opt-in: TanStack's devtools panel (router/store inspectors). Uncomment the plugin below to enable it
+// — but KEEP `consolePiping: { enabled: false }` (see the plugins array). Needs `@tanstack/devtools-vite`.
+// import { devtools } from "@tanstack/devtools-vite";
 
 // The in-process wasm IVM engine ships prebuilt inside the @rindle/wasm package (pkg/rindle_bg.wasm).
 // Alias `rindle-wasm-bin?url` to that file so the client can `import url from "rindle-wasm-bin?url"`
@@ -23,7 +26,15 @@ export default defineConfig({
   // Keep the @rindle/* graph bundled through the SSR/prerender pass (the wasm engine itself is a
   // client-only dynamic import in src/rindle-client.ts, so it never loads in the shell pass).
   ssr: { noExternal: [/^@rindle\//] },
-  // No `server.proxy`: /api/rindle/* is now a Start server route (src/routes/api/rindle/$.ts) served
-  // by this same dev server. The daemon ws is still connected to directly (ws://127.0.0.1:7601).
-  plugins: [tanstackStart(), react()],
+  // No `server.proxy`: /api/rindle/* are Start server routes (src/routes/api.rindle.*.tsx) served by
+  // this same dev server. Browser subscriptions enter through the fleet edge derived by `rindle exec`.
+  plugins: [
+    // If you add TanStack's devtools panel, DISABLE console piping. The piping cross-forwards console
+    // between the SSR server and the browser; a repeated log (a React warning, a Rindle fetch-retry)
+    // echoes back and forth and snowballs into a multi-GB HMR-websocket payload that OOM-kills
+    // `vite dev`. Disabling it keeps the panel + source injection, just not the console bridge.
+    // devtools({ consolePiping: { enabled: false } }),
+    tanstackStart(),
+    react(),
+  ],
 });

package/templates/minimal/server/dev.ts

@@ -1,148 +0,0 @@
-// One-command dev: boots the daemon (the Rust `rindled`, supervised by `rindle up`) and the Vite dev
-// server — which also serves the app's API as a Start server route — and tears them down together.
-//
-//   pnpm dev          # boots everything: daemon + migrations + schema gen + seed + Vite (+ API route)
-//
-// The DATABASE tier is one command: `rindle up --migrate --gen --watch` supervises `rindled` (respawn
-// on exit / migrate-at-bounce), applies the migrations/ DDL once it's ready, generates the
-// @rindle/client schema TS from the introspected result (shared/schema.gen.ts), and re-runs both on
-// every *.sql change. The schema is SQL-first: migrations/*.sql is the source of truth and
-// shared/schema.gen.ts is generated from it. Seeding is app code, so it stays here: once the schema is
-// live we run the idempotent seed. The rest is the web tier (Vite), which also serves the API route.
-//
-// The `rindle` + `rindled` binaries come from @rindle/cli (prebuilt, per-platform) — no Rust toolchain
-// needed. Working inside the Rindle monorepo? Set RINDLE_BIN_DIR=target/release (after a cargo build)
-// to use locally built binaries instead.
-
-import { spawn, type ChildProcess } from "node:child_process";
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { rindleBinaryPath, rindledBinaryPath } from "@rindle/cli";
-
-const here = fileURLToPath(new URL(".", import.meta.url));
-const appRoot = resolve(here, "..");
-
-const DAEMON_TOKEN = "dev-daemon-token";
-const DAEMON_URL = "http://127.0.0.1:7600"; // the daemon's control plane (httpPort below)
-const WS_URL = "ws://127.0.0.1:7601"; // rindled serves subscriptions on their own port
-
-const children: ChildProcess[] = []; // app tiers (seed) — share our process group
-let supervisor: ChildProcess | undefined; // `rindle up` — its own group; it owns the rindled child
-let shuttingDown = false;
-const stop = () => {
-  shuttingDown = true;
-  // `rindle up` runs detached in its own process group and owns `rindled`, so group-kill it to take
-  // both down; the app tiers share our group and are killed individually.
-  if (supervisor?.pid) {
-    try {
-      process.kill(-supervisor.pid, "SIGKILL");
-    } catch {
-      /* already gone */
-    }
-  }
-  for (const child of children) child.kill("SIGKILL");
-  process.exit(0);
-};
-process.on("SIGINT", stop);
-process.on("SIGTERM", stop);
-
-function node(script: string, env: NodeJS.ProcessEnv = {}): ChildProcess {
-  const child = spawn(process.execPath, [join(appRoot, script)], {
-    stdio: "inherit",
-    env: { ...process.env, RINDLE_DAEMON_TOKEN: DAEMON_TOKEN, ...env },
-  });
-  children.push(child);
-  return child;
-}
-
-// Poll the control plane until `rindle up --migrate` has applied the schema (tables appear) and the
-// daemon is serving — a real readiness gate that also rides through the migrate-at-bounce restart.
-async function waitForSchema(timeoutMs = 60_000): Promise<boolean> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try {
-      const res = await fetch(`${DAEMON_URL}/schema`, { headers: { authorization: `Bearer ${DAEMON_TOKEN}` } });
-      if (res.ok) {
-        const body = (await res.json()) as { tables?: unknown[] };
-        if (Array.isArray(body.tables) && body.tables.length > 0) return true;
-      }
-    } catch {
-      /* not up yet, or mid-bounce — retry */
-    }
-    await new Promise((r) => setTimeout(r, 300));
-  }
-  return false;
-}
-
-// Resolve the prebuilt binaries (from @rindle/cli, or RINDLE_BIN_DIR in the monorepo). They must be
-// co-located so `rindle up` finds `rindled` as a sibling — @rindle/cli ships them that way.
-const rindleBin = rindleBinaryPath();
-const rindledBin = rindledBinaryPath();
-
-// The daemon config `rindle up` runs against: loopback, the dev token, no `tables` (the schema is
-// applied from migrations/ on demand and introspected — never created at boot).
-const dataDir = join(appRoot, ".rindled");
-mkdirSync(dataDir, { recursive: true });
-const daemonJson = join(dataDir, "daemon.json");
-writeFileSync(
-  daemonJson,
-  JSON.stringify({
-    db: join(dataDir, "app.db"),
-    httpPort: 7600,
-    wsPort: 7601,
-    authToken: DAEMON_TOKEN,
-    nWorkers: 4,
-    tables: [],
-  }),
-);
-
-// The database tier, one command: supervise `rindled`, apply migrations/ on boot, regenerate the
-// client schema (`--gen` → shared/schema.gen.ts), and re-run both on every *.sql change (`--watch`).
-// Detached into its own process group so `stop()` can group-kill it together with the `rindled` child.
-const migrationsDir = join(appRoot, "migrations");
-const schemaGen = join(appRoot, "shared/schema.gen.ts"); // SQL-first: generated from migrations/*.sql
-supervisor = spawn(
-  rindleBin,
-  ["up", "--config", daemonJson, "--daemon-bin", rindledBin, "--migrate", "--gen", schemaGen, "--watch", "--dir", migrationsDir],
-  {
-    stdio: ["ignore", "inherit", "inherit"],
-    detached: true,
-    env: { ...process.env, RINDLE_DAEMON_TOKEN: DAEMON_TOKEN, RINDLE_DAEMON_URL: DAEMON_URL },
-  },
-);
-supervisor.on("exit", (code, signal) => {
-  if (shuttingDown) return;
-  console.error(`[dev] rindle up exited (code ${code}, signal ${signal}) — shutting down`);
-  stop();
-});
-
-// Wait until the schema is live (migrations applied, daemon re-introspected), then the API tier and
-// the idempotent seed (a fresh DB shows an empty app until the seed lands; re-running is a no-op).
-if (!(await waitForSchema())) {
-  console.error("[dev] daemon did not come up with a schema in time — check migrations/");
-  if (supervisor.pid) {
-    try {
-      process.kill(-supervisor.pid, "SIGKILL");
-    } catch {
-      /* already gone */
-    }
-  }
-  process.exit(1);
-}
-node("server/seed.ts", { RINDLE_DAEMON_URL: DAEMON_URL });
-
-// The web tier: Vite programmatically. The app's API tier is a set of Start SERVER ROUTES
-// (src/routes/api.rindle.*.tsx) served by this same dev server — no proxy, no standalone API process.
-// Those routes AND the SSR loader read the daemon IN-PROCESS (in this Vite process), so point this
-// process's own env at the daemon control plane (URL + token); the client bundle gets the PUBLIC ws url.
-process.env.RINDLE_DAEMON_URL = DAEMON_URL;
-process.env.RINDLE_DAEMON_TOKEN = DAEMON_TOKEN;
-process.env.VITE_DAEMON_WS = WS_URL;
-const { createServer } = await import("vite");
-const vite = await createServer({ root: appRoot });
-await vite.listen();
-vite.printUrls();
-console.log("[dev] migrations + shared/schema.gen.ts auto-apply/regenerate on boot + on every migrations/ change.");
-console.log("[dev] open two browser windows to watch writes sync live.");

package/templates/minimal/server/migrate.ts

@@ -1,47 +0,0 @@
-// `pnpm migrate` — apply the schema migrations via the `rindle` CLI, then seed. The CLI is the real
-// operator tool (the prebuilt binary shipped by @rindle/cli); migrations are applied by
-// `rindle migrate apply`, NOT a TS library. Idempotent throughout: the daemon dedups migrations by
-// `id`, and the seed carries a durable idempotency key — re-running is a no-op.
-//
-//   pnpm migrate                       # apply (daemon self-restarts to re-introspect) → seed
-//   node server/migrate.ts --deploy    # CI/prod: apply only (caller seeds separately)
-
-import { spawnSync } from "node:child_process";
-import { join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { rindleBinaryPath } from "@rindle/cli";
-
-import { seed } from "./seed.ts";
-
-const appRoot = resolve(fileURLToPath(new URL(".", import.meta.url)), "..");
-const migrationsDir = join(appRoot, "migrations");
-
-const DAEMON_URL = process.env.RINDLE_DAEMON_URL ?? "http://127.0.0.1:7600";
-const DAEMON_TOKEN = process.env.RINDLE_DAEMON_TOKEN ?? "dev-daemon-token";
-const deploy = process.argv.includes("--deploy");
-
-function run(cmd: string, args: string[]): void {
-  const r = spawnSync(cmd, args, { stdio: "inherit" });
-  if (r.error) throw r.error;
-  if (r.status !== 0) throw new Error(`\`${cmd} ${args.join(" ")}\` exited with ${r.status ?? r.signal}`);
-}
-
-async function main(): Promise<void> {
-  const rindle = rindleBinaryPath();
-  // Apply pending *.sql through the daemon's /migrate. Idempotent (dedup by id), additive-DDL-linted,
-  // and it waits out a dev daemon's migrate-at-bounce self-restart.
-  run(rindle, ["migrate", "apply", "--dir", migrationsDir, "--url", DAEMON_URL, "--token", DAEMON_TOKEN]);
-
-  if (deploy) {
-    console.log("[migrate] --deploy: applied; the caller seeds next.");
-    return;
-  }
-  console.log("[migrate] seeding…");
-  await seed({ url: DAEMON_URL, token: DAEMON_TOKEN });
-}
-
-main().catch((err) => {
-  console.error(`[migrate] ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
-});

package/templates/minimal/server/seed.ts

@@ -1,70 +0,0 @@
-// Seed the daemon with a little starter data — a couple of rooms and some messages — pushed through
-// the private control plane as ONE foreign SqlTxn carrying an idempotency key: the file-backed daemon
-// (`rindled`) won't re-seed across restarts (the key is durable). Retries until the daemon answers, so
-// dev.ts can fire-and-forget it during startup.
-
-import { HttpRindleDaemonClient } from "@rindle/daemon-client";
-import type { SqlStatement, WireValue } from "@rindle/daemon-client";
-
-const DAEMON_URL = process.env.RINDLE_DAEMON_URL ?? "http://127.0.0.1:7600";
-const DAEMON_TOKEN = process.env.RINDLE_DAEMON_TOKEN ?? "dev-daemon-token";
-
-const ROOMS = [
-  { id: "room-welcome", name: "Welcome" },
-  { id: "room-random", name: "Random" },
-];
-
-const MESSAGES = [
-  { roomId: "room-welcome", author: "ada", body: "Welcome! This whole board is a Rindle app — the room counts are live incremental views." },
-  { roomId: "room-welcome", author: "grace", body: "Post a message and watch the count on the home page update with no polling." },
-  { roomId: "room-random", author: "alan", body: "Open two browser windows side by side to see writes sync." },
-];
-
-const at = (n: number): number => 1717000000000 + n * 60_000; // deterministic timestamps
-
-function valuesClause(rowCount: number, colCount: number): string {
-  const tuple = `(${Array(colCount).fill("?").join(", ")})`;
-  return Array(rowCount).fill(tuple).join(", ");
-}
-
-export function seedStatements(): SqlStatement[] {
-  const statements: SqlStatement[] = [];
-
-  statements.push({
-    sql: `INSERT INTO room (id, name, createdAt) VALUES ${valuesClause(ROOMS.length, 3)}`,
-    params: ROOMS.flatMap((r, i) => [r.id, r.name, at(i)]) as WireValue[],
-  });
-
-  statements.push({
-    sql: `INSERT INTO message (id, roomId, author, body, createdAt) VALUES ${valuesClause(MESSAGES.length, 5)}`,
-    params: MESSAGES.flatMap((m, i) => [`msg-${i}`, m.roomId, m.author, m.body, at(i + ROOMS.length)]) as WireValue[],
-  });
-
-  return statements;
-}
-
-export interface SeedOptions {
-  url?: string;
-  token?: string;
-}
-
-export async function seed({ url = DAEMON_URL, token = DAEMON_TOKEN }: SeedOptions = {}): Promise<void> {
-  const daemon = new HttpRindleDaemonClient({ baseUrl: url, headers: { authorization: `Bearer ${token}` } });
-  for (let attempt = 1; ; attempt++) {
-    try {
-      const out = await daemon.executeSqlTxn({ idempotencyKey: "seed-v1", statements: seedStatements() });
-      console.log(
-        out.applied
-          ? `[seed] seeded ${ROOMS.length} rooms + ${MESSAGES.length} messages (cv ${out.cv})`
-          : `[seed] already seeded (idempotency key absorbed the replay)`,
-      );
-      return;
-    } catch (err) {
-      if (attempt >= 20) throw err;
-      await new Promise((r) => setTimeout(r, 500)); // daemon still booting — retry
-    }
-  }
-}
-
-// Allow `node server/seed.ts` standalone.
-if (import.meta.url === `file://${process.argv[1]}`) await seed();