create-rindle 0.7.2 → 0.7.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rindle",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",

package/templates/minimal/AGENTS.md

@@ -14,17 +14,14 @@ Rindle docs are served as raw markdown for LLMs: index at
 
 ## Commands
 
-- `pnpm dev` — the one command: `concurrently` runs two processes — **fleet**
-  (`rindle up` renders `rindle.ncl` and supervises the pair — the
-  `rindle-replicator` write-master + the `rindled` follower, prebuilt binaries
-  from `@rindle/cli`, no Rust toolchain) applies `migrations/*.sql` to the master
-  and regenerates `shared/schema.gen.ts` from the follower (re-running both on
-  every `migrations/` change), and **web** (`rindle exec -- vite dev` on :3000) receives bindings
-  derived from `rindle.ncl` and serves the app +
-  the `/api/rindle/*` server routes. Run either alone with `pnpm fleet` /
-  `pnpm dev:web`.
+- `pnpm dev` — the one lifecycle command: `rindle dev` evaluates `rindle.ncl`
+  once, supervises the `rindle-replicator` write-master + `rindled` follower +
+  fleet edge (prebuilt binaries from `@rindle/cli`, no Rust toolchain), waits for
+  them, applies `migrations/*.sql`, regenerates `shared/schema.gen.ts`, then runs
+  Vite on :3000 with `RINDLE_URL` + `RINDLE_DATABASE_TOKEN`. It watches migration
+  and follower-schema changes and tears down the whole process tree together.
 - `pnpm typecheck` — regenerates the route tree, then `tsc --noEmit`.
-- `pnpm migrate` — one-shot `rindle exec -- rindle migrate apply` against the write-master derived
+- `pnpm migrate` — one-shot `rindle migrate apply` against the unified ingress derived
   from `rindle.ncl` (the follower's `/migrate` is write-fenced). The dev loop already
   applies on boot + on every `migrations/` change.
 - `pnpm rindle:deploy` / `pnpm rindle:migrate:remote` — deploy the data tier to
@@ -60,9 +57,10 @@ review:
    `src/components/*.queries.ts` and register them in `server/app-api.ts`. An
    ad-hoc `store.query.…` builder resolves **locally only** — it never opens a
    server subscription.
-5. **Daemon tokens are server-only.** They gate the follower and write-master control planes and
-   must never reach the browser; the browser reaches only the lease-gated fleet edge. Local endpoint
-   bindings come from `rindle exec`; never copy topology ports into package scripts.
+5. **Database tokens are server-only.** `rindle dev` injects the one application connection as
+   `RINDLE_URL` + `RINDLE_DATABASE_TOKEN`; the bearer must never reach the browser. The browser
+   learns only the public WebSocket endpoint + placement ticket from its query-lease response.
+   Never copy topology ports into package scripts or add a browser config endpoint.
 6. **Subscribe to windows, not whole tables** — order + `limit`, and ratchet
    `limit` up for "load more". The engine keeps the window (and any `countAs`)
    exact as rows enter and leave.

package/templates/minimal/README.md

@@ -38,21 +38,21 @@ pnpm install
 pnpm dev
 ```
 
-`pnpm dev` runs two processes with [`concurrently`](https://www.npmjs.com/package/concurrently) —
-the standard TanStack Start dev shape:
-
-- **`fleet`** — `rindle up` renders `rindle.ncl` and supervises the whole pair (the
-  `rindle-replicator` write-master + the `rindled` follower — prebuilt binaries from `@rindle/cli`,
-  no Rust toolchain needed), applies the migrations to the master, and regenerates
-  `shared/schema.gen.ts` from the follower's schema — re-running both on every `migrations/*.sql`
-  change (`--watch`).
-- **`web`** — `rindle exec -- vite dev` on <http://localhost:3000>, which serves both the app and the
-  `/api/rindle/*` Start server routes. `rindle exec` derives the stable fleet-edge read/ws binding
-  and write-master binding from `rindle.ncl`; no endpoint is copied into the package scripts.
-
-You can run either alone: `pnpm fleet` / `pnpm dev:web`. Both processes bind to loopback and run
-without an auth token in dev; a real deployment sets tokens (`RINDLE_DAEMON_TOKEN` for reads,
-`RINDLE_REPLICATOR_TOKEN` for writes on the server) that never reach the browser.
+`pnpm dev` is one lifecycle command:
+
+```bash
+rindle dev --migrate --gen shared/schema.gen.ts -- vite dev --port 3000
+```
+
+It evaluates `rindle.ncl` once, supervises the write-master, follower, and stable fleet edge, waits
+for the read path to be ready, applies migrations, regenerates the schema, then starts Vite with the
+unified `RINDLE_URL` + `RINDLE_DATABASE_TOKEN` server bindings. Migration and follower-schema changes
+are watched automatically; Ctrl-C or an app exit tears the whole process tree down. The browser has
+no topology environment variable: its first query lease carries the public WebSocket endpoint and a
+fresh placement ticket, so the optimistic client opens the correctly pinned connection lazily.
+
+Normal development needs neither a second supervisor, a readiness probe, nor a topology-specific
+web command.
 
 Open two browser windows to watch writes sync live: create a room, post a message, and watch the
 room's count update on the home page with no polling. Try a room name or message containing "spam" to
@@ -77,10 +77,11 @@ future deploys re-attach to the same app. `followers = 1` provisions a backed-up
 follower (`replicated`, scales 1→N in place); raise it for more read replicas (`read-scaled`);
 `localRetention = true` provisions the one-box colocated pair (`colocated`, no streaming backup —
 no durability beyond the box). That deploys the **data tier**; the
-**web app** (this Vite/TanStack Start app) deploys to any Node host — point its `RINDLE_DAEMON_URL`
-(fleet-edge reads) + `RINDLE_REPLICATOR_URL` (writes) + their tokens (server) at the deployed data
-tier, and set `VITE_FLEET_WS` to the stable public fleet ws. These bindings are identical for one or
-many followers, and follower affinity is always enabled.
+**web app** (this Vite/TanStack Start app) deploys to any Node host — configure its server with the
+one fleet ingress (`RINDLE_URL`) and SQL bearer (`RINDLE_DATABASE_TOKEN`). Query leases derive the
+public WebSocket endpoint from that same URL, so there is no browser-side topology setting whether
+the deployment has one follower or many. Set the server-only `RINDLE_WS_URL` override only when a
+host exposes WebSocket ingress at a different origin.
 
 ## Devtools
 

package/templates/minimal/package.json

@@ -8,13 +8,11 @@
     "node": ">=22.18"
   },
   "scripts": {
-    "fleet": "rindle up --migrate --gen shared/schema.gen.ts --watch --dir migrations",
-    "dev:web": "rindle exec -- vite dev --port 3000",
-    "dev": "concurrently -k -n fleet,web -c blue,green \"pnpm fleet\" \"pnpm dev:web\"",
+    "dev": "rindle dev --migrate --gen shared/schema.gen.ts --dir migrations -- vite dev --port 3000",
     "generate-routes": "tsr generate",
     "build": "vite build",
     "preview": "vite preview",
-    "migrate": "rindle exec -- rindle migrate apply --dir migrations",
+    "migrate": "rindle migrate apply --dir migrations",
     "rindle:deploy": "rindle deploy",
     "rindle:migrate:remote": "rindle migrate apply --remote",
     "typecheck": "tsr generate && tsc --noEmit"
@@ -22,7 +20,6 @@
   "dependencies": {
     "@rindle/api-server": "latest",
     "@rindle/client": "latest",
-    "@rindle/daemon-client": "latest",
     "@rindle/optimistic": "latest",
     "@rindle/react": "latest",
     "@rindle/wasm": "latest",
@@ -39,7 +36,6 @@
     "@rindle/react-devtools": "latest",
     "@tanstack/router-cli": "^1.167.17",
     "@tanstack/router-plugin": "^1.168.18",
-    "concurrently": "^10.0.3",
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",

package/templates/minimal/rindle.ncl

@@ -2,10 +2,10 @@
 # write-master + one `rindled` read-follower. `followers = 1` is the colocated pair, the smallest
 # shape; raise it for more read replicas.
 #
-# A topology is a plain record of inputs; `rindle up` (local) and `rindle deploy` / `rindle render`
+# A topology is a plain record of inputs; `rindle dev` (local) and `rindle deploy` / `rindle render`
 # (cloud) merge it onto the topology library embedded in the `rindle` binary — nothing to import
-# or install. LOCAL dev reads THIS file: `rindle up` renders it and supervises the pair (see
-# package.json `dev` / `fleet`). The same file drives the cloud:
+# or install. LOCAL dev reads THIS file: `rindle dev` renders it and supervises the pair (see the
+# package.json `dev` script). The same file drives the cloud:
 #
 #   rindle login                  # once — authenticate to Rindle Cloud
 #   rindle deploy                 # provision / re-attach the managed app (writes .rindle/cloud.json)
@@ -17,8 +17,9 @@
 # maps to `colocated` (one box, both processes, no streaming backup).
 #
 # Every follower count renders a local fleet edge (the Fly-edge stand-in;
-# FOLLOWER-AFFINITY-DESIGN.md §10). `rindle exec` derives the app's read/write/ws bindings from this
-# file, so changing `followers = 1` to a wider fleet requires no application configuration change.
+# FOLLOWER-AFFINITY-DESIGN.md §10). `rindle dev` injects the server's unified connection from this
+# file; browser query leases carry the public ws endpoint + placement ticket. Changing
+# `followers = 1` to a wider fleet therefore requires no application configuration change.
 # Set `RINDLE_DEV_CLIENT_REGION=A` to simulate a client region; the edge always mints an affinity
 # placement ticket, with a fleet of one resolving trivially to its only follower.
 {

package/templates/minimal/server/app-api.ts

@@ -6,7 +6,7 @@
 //
 // It is deliberately free of any host: server/rindle-http.ts adapts it to a Web Request for the Start
 // API routes (src/routes/api.rindle.*.tsx) the browser calls, and the SSR loader (src/ssr.ts) calls the
-// SAME factory in-process. The only per-host inputs are the daemon's control-plane URL + token and the
+// SAME factory in-process. The only per-host inputs are the unified Rindle connection and the
 // AuthProvider.
 
 import {
@@ -16,7 +16,6 @@ import {
   runSharedMutation,
   scoped,
   sharedApiMutators,
-  SplitDaemonClient,
 } from "@rindle/api-server";
 import type {
   ApiMutator,
@@ -26,9 +25,6 @@ import type {
   RindleApiServer,
   SharedMutatorWithArgs,
 } from "@rindle/api-server";
-import { HttpRindleDaemonClient } from "@rindle/daemon-client";
-import type { FetchLike } from "@rindle/daemon-client";
-
 import {
   mutators as sharedMutators,
   normalizeBody,
@@ -111,38 +107,21 @@ const apiMutators = defineApiMutators<User, ApiMutators<User>>({
   }),
 });
 
-/** A bearer-auth'd daemon control-plane target. */
+/** The one application-facing Rindle connection. */
 export interface AppApiOptions {
-  /** The follower/read daemon control-plane base URL — bearer-auth'd. */
-  daemonUrl: string;
-  /** The shared bearer token for {@link daemonUrl} (daemon ↔ this tier ONLY — never reaches the browser). */
-  daemonToken: string;
-  /** The required write-master (`rindle-replicator`) control-plane base URL. Writes + mutation
-   *  sessions go here; reads stay on {@link daemonUrl}. */
-  replicatorUrl: string;
-  /** Bearer for {@link replicatorUrl}, if it gates its write plane. */
-  replicatorToken?: string;
-  /** Override the daemon HTTP transport (defaults to global `fetch`). */
-  fetch?: FetchLike;
+  /** The unified fleet ingress for reads, SQL writes, migrations, and subscriptions. */
+  url: string;
+  /** The server-only public SQL bearer. Never returned to the browser. */
+  token: string;
+  /** Optional distinct public WebSocket ingress; normally derived from {@link url}. */
+  wsUrl?: string;
 }
 
 /** Build the configured API server. Stateless: safe to construct per-request or once per process.
  *  Reads are PUBLIC; writes require a verified identity. */
 export function createAppApi(opts: AppApiOptions): RindleApiServer<User> {
-  const reads = new HttpRindleDaemonClient({
-    baseUrl: opts.daemonUrl,
-    headers: { authorization: `Bearer ${opts.daemonToken}` },
-    fetch: opts.fetch,
-  });
   return createRindleApiServer<User>({
-    daemon: new SplitDaemonClient(
-      new HttpRindleDaemonClient({
-        baseUrl: opts.replicatorUrl,
-        headers: opts.replicatorToken ? { authorization: `Bearer ${opts.replicatorToken}` } : undefined,
-        fetch: opts.fetch,
-      }),
-      reads,
-    ),
+    rindle: { url: opts.url, token: opts.token, wsUrl: opts.wsUrl },
     schema, // drives the dialect-SQL renderer for the shared mutators' logical ops
     queries: apiQueries,
     mutators: apiMutators,
@@ -151,21 +130,17 @@ export function createAppApi(opts: AppApiOptions): RindleApiServer<User> {
   });
 }
 
-/** Resolve the daemon wiring from an environment bag, shared by both host shells. */
-export function resolveDaemon(
-  env: Record<string, string | undefined>,
-  defaults: { daemonUrl: string; daemonToken: string },
-): Pick<AppApiOptions, "daemonUrl" | "daemonToken" | "replicatorUrl" | "replicatorToken"> {
-  const replicatorUrl = env.RINDLE_REPLICATOR_URL;
-  if (!replicatorUrl) {
-    throw new Error("RINDLE_REPLICATOR_URL is required: writes must target the replicator write-master");
+/** Resolve the one connection injected by `rindle dev` (or the production host). */
+export function resolveRindle(env: Record<string, string | undefined>): AppApiOptions {
+  const url = env.RINDLE_URL;
+  const token = env.RINDLE_DATABASE_TOKEN;
+  if (!url || !token) {
+    throw new Error(
+      "RINDLE_URL + RINDLE_DATABASE_TOKEN are required — start the app with `rindle dev -- …`",
+    );
   }
-  return {
-    daemonUrl: env.RINDLE_DAEMON_URL ?? defaults.daemonUrl,
-    daemonToken: env.RINDLE_DAEMON_TOKEN ?? defaults.daemonToken,
-    replicatorUrl,
-    replicatorToken: env.RINDLE_REPLICATOR_TOKEN,
-  };
+  const wsUrl = env.RINDLE_WS_URL;
+  return { url, token, ...(wsUrl ? { wsUrl } : {}) };
 }
 
 /** Map an error thrown out of the API server (or body parsing) to an HTTP status + message. */

package/templates/minimal/server/rindle-http.ts

@@ -6,7 +6,7 @@
 
 import type { ApiContext } from "@rindle/api-server";
 
-import { createAppApi, httpErrorOf, resolveDaemon } from "./app-api.ts";
+import { createAppApi, httpErrorOf, resolveRindle } from "./app-api.ts";
 import type { User } from "./app-api.ts";
 import { devAuth } from "./auth-dev.ts";
 
@@ -17,13 +17,12 @@ export type RindleRouteKind = "query" | "read" | "mutate";
  *  built per request (cheap), so this is safe in a fresh-per-request serverless host too. */
 export async function handleRindleJson(kind: RindleRouteKind, request: Request): Promise<Response> {
   try {
-    const daemon = resolveDaemon(process.env, {
-      daemonUrl: "http://127.0.0.1:7600",
-      daemonToken: "dev-daemon-token",
-    });
-    const api = createAppApi(daemon);
+    const api = createAppApi(resolveRindle(process.env));
     const body = await request.json().catch(() => ({}));
-    const context: ApiContext<User> = { user: (await devAuth.verify(request)) ?? undefined, request };
+    const context: ApiContext<User> = {
+      user: (await devAuth.verify(request)) ?? undefined,
+      request,
+    };
     const out =
       kind === "query"
         ? await api.handleQueryJson(body, context)

package/templates/minimal/src/rindle-client.ts

@@ -60,11 +60,6 @@ async function bootClientInner() {
     import("@rindle/wasm"),
   ]);
   await initWasm(wasmUrl);
-  // Every deployment exposes one stable fleet ws, including a fleet of one. `rindle exec` derives
-  // VITE_FLEET_WS from rindle.ncl, so increasing `followers` never changes app configuration.
-  // VITE_DAEMON_WS is a temporary direct-follower escape hatch for focused harnesses.
-  const directWs = import.meta.env.VITE_DAEMON_WS?.trim();
-  const fleetWs = import.meta.env.VITE_FLEET_WS?.trim() ?? "ws://127.0.0.1:7650";
   return createRindleClient({
     schema,
     mutators,
@@ -74,10 +69,12 @@ async function bootClientInner() {
     api: {
       url: "", // same-origin: /api/rindle/* is a Start server route on this same server
       // Identity per request: the dev handle header. A real app sends a verified token instead.
-      headers: (): Record<string, string> => ({ "x-rindle-user": currentHandle() }),
+      headers: (): Record<string, string> => ({
+        "x-rindle-user": currentHandle(),
+      }),
     },
-    // Normal app traffic always enters through the fleet edge. Direct follower access is explicit.
-    daemon: directWs ? { wsUrl: directWs } : { wsUrl: fleetWs, affinity: true },
+    // No browser topology config: the first query lease returns the public WebSocket endpoint plus
+    // a fresh placement ticket, and the optimistic client opens the correctly pinned socket lazily.
     dev: { resetOnMutationGap: import.meta.env.DEV },
     onRejected: (envelope, reason) => rejectionHandler(envelope, reason),
   });

package/templates/minimal/src/ssr.ts

@@ -13,7 +13,7 @@
 import { createServerStore, type DehydratedState, type OneShotQueryFn, type OneShotResult, type Query } from "@rindle/client";
 import type { ApiContext } from "@rindle/api-server";
 
-import { createAppApi, resolveDaemon } from "../server/app-api.ts";
+import { createAppApi, resolveRindle } from "../server/app-api.ts";
 import type { User } from "../server/app-api.ts";
 import { schema } from "../shared/app-def.ts";
 
@@ -26,11 +26,7 @@ const SSR_USER: User = undefined;
  *  authority IN-PROCESS — the same path as the HTTP /api/rindle/read, minus the network round trip —
  *  and hand back the assembled current view. */
 const readInProcess: OneShotQueryFn = async ({ name, args }): Promise<OneShotResult> => {
-  const daemon = resolveDaemon(process.env, {
-    daemonUrl: "http://127.0.0.1:7600",
-    daemonToken: "dev-daemon-token",
-  });
-  const api = createAppApi(daemon);
+  const api = createAppApi(resolveRindle(process.env));
   const context: ApiContext<User> = { user: SSR_USER, request: undefined };
   return (await api.handleReadJson({ name, args }, context)) as OneShotResult;
 };

package/templates/minimal/vite-env.d.ts

@@ -4,14 +4,3 @@ declare module "rindle-wasm-bin?url" {
   const url: string;
   export default url;
 }
-
-interface ImportMetaEnv {
-  /** Deprecated direct-follower test/debug escape hatch. Normal apps use VITE_FLEET_WS. */
-  readonly VITE_DAEMON_WS?: string;
-  /** Stable fleet-edge PUBLIC ws, derived by `rindle exec` for one or many followers. */
-  readonly VITE_FLEET_WS?: string;
-}
-
-interface ImportMeta {
-  readonly env: ImportMetaEnv;
-}

package/templates/minimal/vite.config.ts

@@ -27,7 +27,7 @@ export default defineConfig({
   // client-only dynamic import in src/rindle-client.ts, so it never loads in the shell pass).
   ssr: { noExternal: [/^@rindle\//] },
   // No `server.proxy`: /api/rindle/* are Start server routes (src/routes/api.rindle.*.tsx) served by
-  // this same dev server. Browser subscriptions enter through the fleet edge derived by `rindle exec`.
+  // this same dev server. Browser subscriptions discover the fleet edge from their query lease.
   plugins: [
     // If you add TanStack's devtools panel, DISABLE console piping. The piping cross-forwards console
     // between the SSR server and the browser; a repeated log (a React warning, a Rindle fetch-retry)