Skip to main content

​
Context

0074 introduced @stackra-pro/* under a commercial licence, gated at install, but left two things undecided: which packages are Pro, and where Pro source lives. The owner settled both in the package questionnaire. The rule for drawing the line is that basics are free, and enterprise and scale features are Pro. For notifications, the owner first put the SMS, WhatsApp and push drivers on the Pro list, then decided every channel is free.

​
Decision

  1. @stackra/* is MIT and free (0024).
  2. Pro packages use the @stackra-pro/* scope on npm.figentra.com under a commercial licence, each with its own LICENSE and a "license" field that names it. Access is gated at install by a scoped .npmrc and a per-customer registry token. No package checks a licence at runtime.
  3. Pro source lives in the private repository figentra/stackra-pro, never in this public repository.
  4. Pro plugs in behind free contracts. A Pro package is a driver, module or extension for a contract that a free package defines. A free package never imports a Pro package and works fully without one.
  5. Free security basics: Better Auth core, pool tenancy with row-level security, RBAC behind check(), personal access tokens, the entitlements gate interface with plan and limit contracts, a basic token bucket, and core consent and CSP.
  6. The notifications engine and every channel are free: email (Resend, SMTP), SMS, WhatsApp, push and in-app (0086).
  7. The Pro list:
  8. HeroUI Pro reaches Pro customers as decided in 0113, and no paid-licence code is committed here (0024 rule 4).
  9. Figentra’s own products (for example Academorix, which needs the scope tree from day one) consume Pro packages under an internal licence.

​
Consequences

  • Free contracts must be designed for the Pro drivers that will implement them, without the Pro code in view in this repository.
  • figentra/stackra-pro needs its own CI, release and registry publishing. It consumes released @stackra/* versions.
  • Open (carried from 0074): does npflared support per-customer scoped, revocable tokens.

​
Enforcement

Planned: tools/scripts/validate-repository.mjs fails any member here that depends on @stackra-pro/*, and fails a non-MIT licence on any member of this repository. The registry rejects publishing @stackra-pro/* without the commercial LICENSE. Nothing checks this today.

​
Supersedes and sources

Supersedes: 0074 (it restates 0074’s rules 1 to 3, 5 and 6, and settles the Pro list and the source location). Amends 0024 rule 1, as 0074 did. Sources: owner decisions in chat, 2026-10-19 (Round 7; Round 8 F14a, F14b, F14c, C1; Round 11 AI1, L2, L3, X5, X6, X9, X12, F3, CT1, WS2).