# TillDev

> TillDev is a suite of developer tools built by TillAfrica (Kampala, Uganda): TillPulse (observability), TillAuth (auth + sessions + SSO), TillShield (reactive + proactive security, includes the TillGate bot-challenge), TillCache (managed KV, queues, and pub/sub over one connection string), TillSecrets (an encrypted config store + dynamic secrets), TillArk (cross-vendor backup, disaster recovery & failover with restore-verification you can prove), and TillForge (sovereign, security-first code hosting — secrets refused at the push boundary, destructive pushes recoverable, native crash correlation). The defaults are the production defaults. No fake metrics, no paywalled MFA.

## Marketing

- [TillDev home](https://tilldev.dev/): The umbrella story — pieces of the same idea.
- [TillPulse](https://tilldev.dev/tillpulse): Observability for any project. Mobile, web, desktop.
- [TillAuth](https://tilldev.dev/tillauth): Auth + sessions + SSO. Passkeys, MFA, OAuth — first-class.
- [TillShield](https://tilldev.dev/tillshield): Reactive + proactive security — WAF rules, edge rules, threat intelligence, incidents. GA / shipped.
- [TillGate](https://tilldev.dev/tillgate): The human check — bot challenge with adaptive risk difficulty, memory-hard proof-of-work, and interaction scoring. Ships inside TillShield. GA.
- [TillCache](https://tilldev.dev/tillcache): Managed KV, durable queues, and pub/sub over one connection string. Redis-compatible SDKs, a pluggable backend per namespace (managed, Cloudflare Durable Objects, or your own Redis). GA / shipped.
- [TillSecrets](https://tilldev.dev/secrets): Encrypted config store + dynamic secrets. Versioned, envelope-encrypted config pulled in at boot; short-lived leased credentials (Postgres roles) that auto-revoke; vendor-agnostic sync; audited reads. GA / shipped.
- [TillArk](https://tilldev.dev/tillark): Cross-vendor backup, disaster recovery & failover. Scheduled deduplicated backups under GFS retention, cross-vendor anti-affinity, warm-standby failover, and sandboxed restore-verification you can prove. A control plane over proven engines (restic / WAL-G), not a new engine.
- [TillForge](https://tilldev.dev/tillforge): Sovereign, security-first code hosting. A leaked secret is refused at the push boundary (never lands); a destructive push is always recoverable; branch protection, PRs + reviews, issues, and native commit→crash correlation. Git over HTTPS + SSH from any editor; BYO-AI with governed egress.

## Documentation

- [Docs home](https://tilldev.dev/docs): Index of all product docs.
- [TillPulse docs](https://tilldev.dev/docs/tillpulse): SDKs, dashboard, alerts, source maps.
- [TillAuth docs](https://tilldev.dev/docs/tillauth): Quickstart, flows, OpenID Provider, SCIM provisioning, sessions, webhooks, audit log, SDKs, end-user API reference (OpenAPI), embedded account settings, Workers/edge verification.
- [TillShield docs](https://tilldev.dev/docs/tillshield): Signals, WAF + edge rules, incidents, inline enforcement, Workers inline WAF wiring.
- [TillGate docs](https://tilldev.dev/docs/tillgate): Human-check integration + server-side verify.
- [TillCache docs](https://tilldev.dev/docs/tillcache): KV, queues, pub/sub, backends, SDKs.
- [TillSecrets docs](https://tilldev.dev/docs/tillsecrets): Config, versioning, dynamic secrets, security model.
- [TillArk docs](https://tilldev.dev/docs/tillark): Sources, targets, policies, backups, failover, restore-verification, security.
- [TillForge docs](https://tilldev.dev/docs/tillforge): Repositories, access (tokens + SSH keys), branch protection + recovery, pull requests + reviews, code search, releases + builds, deployments, events + webhooks, CLI, security posture.
- [CLI](https://tilldev.dev/docs/tilldev/cli): The `tilldev` command-line tool for CI and scripting.
- [API reference](https://tilldev.dev/docs/api): Cross-product HTTP API.

## Operations

- [Status](https://tilldev.dev/status): Live 90-day uptime history + incident log for dashboard, ingest, storage, and search.
- [Changelog](https://tilldev.dev/changelog): Cross-product release notes.

## TillPulse — quick links

- [Getting started](https://tilldev.dev/docs/tillpulse/getting-started): Five-minute install.
- [Dashboard tour](https://tilldev.dev/docs/tillpulse/dashboard): What every section does.
- [Environment variables](https://tilldev.dev/docs/tillpulse/environment): What to set in prod.
- [React Native SDK](https://tilldev.dev/docs/tillpulse/sdk/react-native): RN install + capture.
- [Flutter SDK](https://tilldev.dev/docs/tillpulse/sdk/flutter): Flutter install + capture.
- [Alerts](https://tilldev.dev/docs/tillpulse/alerts): Rule shape, delivery, runbooks.
- [Source maps](https://tilldev.dev/docs/tillpulse/source-maps): Server-side symbolication.

## TillAuth — quick links

- [Quickstart · React](https://tilldev.dev/docs/tillauth/quickstart): TillAuthProvider + useSignIn.
- [Concepts](https://tilldev.dev/docs/tillauth/concepts): Apps, users, sessions, identities.
- [Passkeys](https://tilldev.dev/docs/tillauth/passkeys): WebAuthn primary + 2FA.
- [MFA](https://tilldev.dev/docs/tillauth/mfa): TOTP + backup codes.
- [Magic links](https://tilldev.dev/docs/tillauth/magic-link): Passwordless email sign-in.
- [OAuth](https://tilldev.dev/docs/tillauth/oauth): Per-app Google + GitHub clients.
- [OIDC SSO](https://tilldev.dev/docs/tillauth/oidc): Enterprise SSO with domain gating.
- [OpenID Provider](https://tilldev.dev/docs/tillauth/provider): TillAuth AS the IdP — register OIDC clients, authorization-code + PKCE, hosted consent, per-realm issuers + keys.
- [Provisioning (SCIM 2.0)](https://tilldev.dev/docs/tillauth/provisioning): Automated user provisioning + instant deprovisioning — a SCIM deactivate revokes live sessions in seconds.
- [Sessions](https://tilldev.dev/docs/tillauth/sessions): List active sessions, revoke one, sign out everywhere else.
- [Webhooks](https://tilldev.dev/docs/tillauth/webhooks): HMAC-signed outbound events.
- [Audit log](https://tilldev.dev/docs/tillauth/audit-log): Action vocabulary, retention.
- [Custom domains](https://tilldev.dev/docs/tillauth/custom-domain): `auth.your-domain.com` setup.
- [API reference · OpenAPI](https://tilldev.dev/docs/tillauth/api): The end-user /v1 surface; machine-readable spec at https://auth.tilldev.dev/openapi.json.
- [Embedded account settings](https://tilldev.dev/docs/tillauth/embedded): Build password/passkey/2FA management into your own settings UI over the same /v1 API the hosted pages use.
- [Workers + edge runtimes](https://tilldev.dev/docs/tillauth/workers): Verify TillAuth sessions on Cloudflare Workers / Deno / Bun — @tillstack/auth-node is jose/Web-Crypto, edge-native, incl. a fetch-native cookie proxy.

## TillCache — quick links

- [Quickstart](https://tilldev.dev/docs/tillcache/quickstart): createClient + connection string.
- [Key-value](https://tilldev.dev/docs/tillcache/kv): set/get, TTLs, counters, hashes, sets.
- [Queues](https://tilldev.dev/docs/tillcache/queues): push/consume, idempotency, dead-letter.
- [Pub/sub](https://tilldev.dev/docs/tillcache/pubsub): publish, subscribe, wildcard topics, replay.
- [Backends](https://tilldev.dev/docs/tillcache/backends): managed, Durable Objects, or your own Redis.

## TillSecrets — quick links

- [Quickstart](https://tilldev.dev/docs/tillsecrets/quickstart): load() + the ts_… service token.
- [Config & versioning](https://tilldev.dev/docs/tillsecrets/config): set/pull/rollback, sync targets.
- [Dynamic secrets](https://tilldev.dev/docs/tillsecrets/dynamic): leased Postgres roles, auto-revoke.
- [Secretless broker](https://tilldev.dev/docs/tillsecrets/broker): use a secret without knowing it — secretref:// references, consent + destination allowlist, secrets exec, catalog actions.
- [How-to manual](https://tilldev.dev/docs/tillsecrets/manual): task recipes — read a value back, generate one in the vault, rotate a secret without downtime.
- [Security model](https://tilldev.dev/docs/tillsecrets/security): envelope encryption + audited reads.

## TillArk — quick links

- [Quickstart](https://tilldev.dev/docs/tillark/quickstart): register a source + target, first backup.
- [Architecture](https://tilldev.dev/docs/tillark/architecture): control plane over restic / WAL-G; agent + dashboard.
- [Backups](https://tilldev.dev/docs/tillark/backups): policies, GFS retention, cross-vendor anti-affinity.
- [PII-scrubbed clones](https://tilldev.dev/docs/tillark/clones): restore to scratch, mask PII per column, prove it — safe data for staging/analytics.
- [Ransomware canary](https://tilldev.dev/docs/tillark/canary): signed on the way out, judged on the way in — two measurements moving together catch encryption early.
- [Failover](https://tilldev.dev/docs/tillark/failover): warm-standby replicas, promote, fail back.
- [Security model](https://tilldev.dev/docs/tillark/security): restore-verification, four-eyes, envelope encryption.
- [CLI](https://tilldev.dev/docs/tillark/cli): `tilldev ark` backups, verify, failover from CI.
- [Agent](https://tilldev.dev/docs/tillark/agent): the machine/agent front door (tark_ tokens).

## TillForge — quick links

- [Quickstart](https://tilldev.dev/docs/tillforge/quickstart): create a repo, mint a tfp_ token, push over HTTPS, watch a secret get rejected.
- [Repositories](https://tilldev.dev/docs/tillforge/repositories): clone over HTTPS + SSH, browse, the clone-URL shapes.
- [Access](https://tilldev.dev/docs/tillforge/access): tfp_ tokens, account SSH keys (enforced expiry), roles.
- [Branch protection](https://tilldev.dev/docs/tillforge/protection): reject-at-push, protected branches, one-click reflog recovery.
- [Pull requests](https://tilldev.dev/docs/tillforge/pull-requests): reviews, the merge gate, checks/status, CODEOWNERS.
- [Code search](https://tilldev.dev/docs/tillforge/search): literal, line-numbered search across a repo at any revision, CLI or Code tab.
- [Releases & builds](https://tilldev.dev/docs/tillforge/releases): tagged releases, generated changelog, a checksummed build per platform.
- [Deployments](https://tilldev.dev/docs/tillforge/deployments): preview before production, approval gate, commit-pinned crash correlation.
- [Events & webhooks](https://tilldev.dev/docs/tillforge/events): signed webhooks (HMAC-SHA256) for your pipeline; personal notifications for your work.
- [CLI](https://tilldev.dev/docs/tillforge/cli): `tilldev forge` repos, tokens, keys, pr, issue, policy, recover, search, release, deploy, webhook.
- [Security model](https://tilldev.dev/docs/tillforge/security): sovereignty, the push boundary, AI-egress governance, recoverability.

## SDKs

- [@tillstack/auth-react](https://tilldev.dev/docs/tillauth/sdk/react): React provider + hooks.
- [@tillstack/auth-node](https://tilldev.dev/docs/tillauth/sdk/node): JWT verifier + middleware + cookie-proxy.
- [@tillstack/react-native](https://tilldev.dev/docs/tillpulse/sdk/react-native): React Native observability SDK.
- [@tillstack/flutter](https://tilldev.dev/docs/tillpulse/sdk/flutter): Flutter observability SDK.
- [@tillstack/cache-node](https://tilldev.dev/docs/tillcache/quickstart): Node/Bun/Deno KV, queues, pub/sub client.
- [@tillstack/cache-edge](https://tilldev.dev/docs/tillcache/quickstart): Fetch-based cache client for edge runtimes.
- [@tillstack/cache-cloudflare](https://tilldev.dev/docs/tillcache/quickstart): Cloudflare Workers cache client.
- [@tillstack/secrets-node](https://tilldev.dev/docs/tillsecrets/quickstart): Node config loader + dynamic-secret leasing.
- [@tillstack/secrets-edge](https://tilldev.dev/docs/tillsecrets/quickstart): Fetch-based config client for edge runtimes.

## Legal

- [Privacy](https://tilldev.dev/privacy)
- [Terms](https://tilldev.dev/terms)
- [Security](https://tilldev.dev/security)
- [Data processing](https://tilldev.dev/dpa)
- [Acceptable use](https://tilldev.dev/acceptable-use)
- [Cookies](https://tilldev.dev/cookies)