Add core TypeScript submodules: cron, retry, rate-limit, and crypto

[bradleyshep]

Description of Changes

Adds reusable scheduling, retry, rate-limit, and cryptographic helpers for SpacetimeDB TypeScript modules.

• Cron: calendar and interval jobs with typed arguments, time zones, and run history.
• Retry: scheduled attempts, exponential backoff, and attempt history.
• Rate-limit: fixed-window limits with configuration and administrative controls.
• Crypto: hashing, encoding, and webhook-signature helpers.
• Shared example UI/server support, package documentation, tests, and examples.
• Registers the packages in the pnpm workspace and existing lint/build commands. Adds a submodule CI job for type checks, tests, and builds.

This is the prerequisite branch for the remaining submodule groups. It is based on master commit 3653d2ed4.

Example screenshots

Existing example screenshots from #5823:

Cron

Rate Limit

API and ABI breaking changes

No existing SpacetimeDB API or ABI is changed. This adds new TypeScript package APIs that need review before merge.

Rollback safety impact

n/a. This adds opt-in TypeScript packages and examples; it does not change existing server storage formats.

Expected complexity level and risk

3/5

The packages are opt-in and do not change existing server behavior. Complexity is in scheduling, retry recovery, and cron's direct use of the internal spacetime:sys@2.0 host ABI. Review failure recovery and repeated execution for applications that use these packages.

Testing

Verified locally on bradley/submodules-core:

• Frozen-lockfile install for the root, SDK, and present submodule workspaces.
• Type checks for the added packages.
• Existing test scripts for the added packages and examples.
• Build scripts for the added packages and examples.
• Regenerate client bindings and verify no tracked changes.
• Lint and formatting checks for the added packages and examples.
• Verify workspace dependencies are present in this branch.
• Review the public APIs, documentation, and cron host-ABI dependency.
• Run local scheduling/recovery smoke tests against a running SpacetimeDB instance.

Commands used for this group:

pnpm -r -F "./spacetime-cron-ts/**" -F "./spacetime-retry-ts/**" -F "./spacetime-rate-limit-ts/**" -F "./spacetime-crypto-ts/**" -F "./spacetime-submodule-shared-ts/**" run typecheck
pnpm -r -F "./spacetime-cron-ts/**" -F "./spacetime-retry-ts/**" -F "./spacetime-rate-limit-ts/**" -F "./spacetime-crypto-ts/**" -F "./spacetime-submodule-shared-ts/**" run test
pnpm -r -F "./spacetime-cron-ts/**" -F "./spacetime-retry-ts/**" -F "./spacetime-rate-limit-ts/**" -F "./spacetime-crypto-ts/**" -F "./spacetime-submodule-shared-ts/**" run build
pnpm -r -F "./spacetime-cron-ts/**" -F "./spacetime-retry-ts/**" -F "./spacetime-rate-limit-ts/**" -F "./spacetime-crypto-ts/**" -F "./spacetime-submodule-shared-ts/**" run lint

The TypeScript SDK was built first. Live deployment and provider tests were not run during split validation. Existing workspace peer-dependency warnings remain.

[clockwork-tien]

There are places where we are using snake_case instead of camelCase, worth checking thoroughly to ensure consistency. I have also left additional comments inline.

[clockwork-tien]

I noticed a lot of the public surface is only public because the settings are passed in on every call instead of being encapsulated by the library. I would be interested to hear if there is reasoning behind this.

The example writes its own wrapper in consumer code to call the rate limiter which should be handled internally by the library. Here buildRateLimitKey is exported only so a caller can build the key, and scope is passed in twice. With the current design the caller has to build the argument, so the builder has to be exported.

function consumeAction(
  tx: Tx,
  scope: string,
  actorKey: string,
  limit: number,
  windowSeconds: number,
  cost = 1,
) {
  return rateLimit.consumeRateLimit(tx.as.rateLimit, {
    key: rateLimit.buildRateLimitKey(scope, actorKey),
    scope,
    limit,
    windowSeconds,
    cost,
  });
}

const result = consumeAction(tx, TAP_SCOPE, key, tapLimit, TAP_WINDOW_SECONDS);

Possible improvements, one way is a client(config) per package:

const tapLimiter = rateLimit.client({ scope: TAP_SCOPE, windowSeconds: TAP_WINDOW_SECONDS });

const result = tapLimiter.consume(tx.as.rateLimit, { key, limit: tapLimit });

A few more points:

• Worth exporting the error codes, seems there are quite a few of them, e.g. rate_limit.not_authorized, since renaming one breaks callers silently
• Worth having a setup function per package with consistent naming and signature, client(config) when the module loads and install(ctx) in init (resend.install rather than resend.installResend), instead of

spacetimeCron(sdk) + createCron(jobs, opts) // needs both
createRetrySubmodule(deps, handlers, auth?)
installRateLimit(ctx)   
installRateLimitState(ctx, opts?)
installResend(ctx)
installRetry(ctx)                  

[bradleyshep]

Changes since review

• Every package now uses client(config) for setup and install(ctx) in init. Cron replaces spacetimeCron + createCron. Retry handlers are registered after schema() and receive the host's typed context.
• Rate-limit policy lives only in the client, which exposes consume and peek. Configuring the same scope twice throws, and the last admin cannot be removed.
• Crypto verifiers return { ok, reason }. Each package exports its error codes as an errors object.
• Packages ship compiled dist on pack; the workspace still resolves to src. Emitting declarations required exporting a few type names from spacetimedb/server; there are no runtime changes to the SDK.

[JulienLavocat]

README LGTM now!

[cloutiertyler]

Except for the one comment, this LGTM