Skip to content
Tinbox
Sign in

Source access and the public bundle

What is public, what a lifetime license adds, and how paid readable-source access is granted without adding runtime phone-home or feature gates.

Tinbox is built from one monorepo, but it is delivered through two public surfaces and one paid source surface. The public package is enough to self-host a real instance; the paid license adds the readable core source, direct support, and an early-access lane.

What is public

The public npm package (tinbox) is the production deployable:

  • tinbox/cf and the worker bundle that runs on Cloudflare.
  • tinbox CLI commands for init, setup, migrations, updates, and runtime API work.
  • tinbox/sdk for transactional sending and typed API access.
  • Templates, migrations, generated docs/search corpus, and built instance UI assets.

The public examples/plugin mirror is separate. It contains permissively licensed examples, skills, plugins, agentic tools, recipes, and public extension types. Use it when you want to extend Tinbox without depending on the private core source.

What a lifetime license adds

A lifetime license adds:

  • readable core source access for the worker, engine, API, UI, and platform apps;
  • direct support from the people building Tinbox;
  • an early-access lane for new releases;
  • the same license key used by deployed instances for the soft/offline license check.

The runtime license posture is intentionally soft. A deployed instance verifies the license key offline and shows a quiet funding reminder only in Settings when no key is configured. Tinbox does not phone home, count inboxes, disable features, or block your own deployment at runtime. The paid boundary is source delivery, not a kill switch.

How source access is granted

  1. Buy a lifetime license.
  2. Provide the GitHub account that should receive source access. If checkout did not collect it, reply to the purchase email with the account name.
  3. Fulfilment sends a read-only private-repository invitation when the source delivery integration is configured. Otherwise the sale enters the admin queue for the same invite to be sent manually.
  4. The license row is marked granted after GitHub accepts the invite request, leaving an audit trail and making retries idempotent.

Checkout metadata may already include tinbox_github_account, tinbox_github, or github_account; those fields are normalized onto the license row. Admin operators can later correct the GitHub account and stamp manual source access as granted.

What not to rely on

  • Do not treat public npm bundle contents as the readable source distribution. It is a built deployable.
  • Do not expect a runtime capability to unlock source code. Source access is a support/admin workflow tied to the paid license.
  • Do not put private source changes in the public examples mirror unless the change is intended to be permissively licensed.

See also