Open source

What we give back

When we solve a problem that isn't specific to our business, we publish it. Eight packages across four registries — including JSON Compress, one wire format with six interoperable implementations, three of them published so far on npm, NuGet and pkg.go.dev — plus platforms, plugins and tools on GitHub under MIT, Apache 2.0 or AGPL 3.0. Commercial licensing is available for the AGPL products.

Open source npm · nuget · pypi · go · github
Packages 8 Platforms 5 Strapi plugins 7 Licences MIT · Apache 2.0 · AGPL 3.0
Published on npm, NuGet, PyPI & pkg.go.dev

Install and go

Eight packages across four registries. JSON Compress ships today on npm, NuGet and pkg.go.dev — three of the six implementations of one wire format that all write the same bytes; the PHP, Python and Rust ports build from the repository and are queued for release. Alongside them, pgrecon on PyPI under Apache 2.0 and four more on npm — among them two-factor sign-in for the Strapi admin panel, and a sync plugin carried on the official Strapi Marketplace — plus an agentless Strapi backup tool in development. All extracted from problems we hit doing the work.

pgreconoracle → postgresql
Migration assessment · v0.7.2

pgrecon

Migration reconnaissance for PostgreSQL. Oracle-to-PostgreSQL projects overrun because nobody measures the PL/SQL before committing to a date — pgrecon is the measurement. It parses your DDL and program units with a real grammar, applies 80 rules, reports every incompatibility with evidence and a remedy, turns the result into an effort estimate in person-days that shows its own arithmetic, and converts the schema it can prove into PostgreSQL DDL.

It never connects to your database. It generates a read-only SQL*Plus script your DBA reads and runs; analysis happens locally on the output files. That single design decision is why security teams approve it in minutes.

$ pip install pgrecon
Offline Analysis Grammar-based PL/SQL Parsing 80 Rules Severity & Remedies Effort Estimation JSON Export Oracle 9.2 → 23ai Python 3.11+ Apache 2.0

A sample Oracle dump ships in the repository, so you can go from clone to a first report in a few minutes without an Oracle instance.

JSON Compresslossless · still json
JSON compression · six languages · v1.0

JSON Compress

Lossless JSON compression that is still JSON. It writes every key name once instead of once per record, turns arrays of like-shaped objects into columns and rows, hoists out the columns whose value never changes, and de-duplicates the values that keep coming back. Record-shaped documents come out 45–75% smaller, and decompress hands back exactly what went in — key order included.

It began as an internal helper for moving large result sets between a database layer and a set of front ends, where the payloads were dominated by repeated field names. It kept being copied from project to project, so we wrote it properly, specified the wire format so it could be ported, and then ported it — six times, into JavaScript, .NET, Python, PHP, Go and Rust.

$ npm install @tech-style/json-compress
$ dotnet add package TechStyle.JsonCompress
$ go get github.com/eharain/JSON-Compress/go
6 Interoperable Implementations Key Catalogue Columnar Tables Constant & Dictionary Columns Value De-duplication Byte-perfect Round Trip Zero Dependencies npm · NuGet · pkg.go.dev TypeScript Types CLI Included Documented Wire Format MIT

The six implementations do not merely interoperate — they write the same bytes. Each is checked on every build against a shared corpus of 144 documents, in both directions: it must restore every envelope the reference encoder wrote, and write those same envelopes itself. JavaScript, .NET and Go are on their registries now; PHP, Python and Rust build from the repository while their releases are prepared. Java is planned against the same specification.

Keystoresecure-keystore-js
Node.js security · v1.1.0

Secure Keystore JS

A secure key-value store with two-layer encryption. A single user key unlocks a per-store master key, and that master key unlocks each value individually — so secrets sit encrypted on disk and are only decrypted, in memory, at the moment you ask for one.

It was built because credentials kept ending up in plaintext config files across our own services. It now backs credential storage in Strapi Content Sync Pro.

$ npm install secure-keystore-js
Two-layer Encryption AES-256-GCM Per-key Encryption Multiple Stores Import / Export CLI Tool MIT
Content Syncstrapi-content-sync-pro
Strapi v5 plugin · v1.3.0

Strapi Content Sync Pro On Strapi Marketplace

Copy, migrate and live-sync content, media and data between Strapi environments. It handles the awkward parts of moving a CMS between staging and production: relations that must land in order, media that shouldn't be re-uploaded, and fields that should never cross the boundary at all.

It is published on the official Strapi Marketplace, listed under Content, Data, Database & Migrations and Import & Export — so it installs and updates alongside the rest of a Strapi project's plugins.

Paired & Single-side Modes Bi-directional Sync Media Sync (HTTP & rsync) Field-level Policies On-demand · Scheduled · Live Large Dataset Pagination Dependency Analytics Bulk Transfer Pause / Resume / Cancel Persisted History Retention Controls Alerts & Logging API Tokens & HMAC-SHA256 AGPL 3.0 + Commercial
$ npm install strapi-content-sync-pro

Requires Strapi v5.0.0 or later and Node.js 20+. From v1.3.0 it is AGPL 3.0, with a commercial licence for closed-source or hosted use.

Two-Factorstrapi-admin-2fa-pro
Strapi v5 plugin · v0.6 on npm

Two-Factor Auth Pro for Strapi New

Strapi ships no second factor for its admin panel. This plugin adds one: TOTP codes from any authenticator app, asked for after the password, with Strapi's own login handler still issuing the session — so nothing about how Strapi signs people in is replaced, only guarded. The same second factor can protect website accounts on users-permissions, including sign-in through an SSO provider.

Administrators set the policy from Settings — optional, required, or required for chosen roles, with a grace period — and a coverage table shows who is actually protected rather than who was asked to be. Accounts that lose their phone are reset from the admin, and one button ends every other admin session at once.

$ npm install strapi-admin-2fa-pro
Admin Panel & Users-Permissions TOTP · RFC 6238 QR Enrolment 10 Hashed Recovery Codes Role-based Policy & Grace Period SSO Sign-in Gated Per-account Lockout AES-256-GCM Secrets Opt-in Hosted Account Pages AGPL 3.0 + Commercial

Requires Strapi v5 and Node.js 18+. It refuses to start if it cannot find the admin login route, rather than run and quietly protect nothing.

WebDAVupload provider
Strapi v5 provider · v1.0.2

Strapi Provider Upload WebDAV

A WebDAV upload provider for Strapi v5. Point the media library at any WebDAV-capable storage — a NAS, a shared host, a self-managed box — instead of an object-store bucket you'd rather not pay for or depend on.

$ npm install strapi-provider-upload-webdav
Strapi v5 WebDAV Self-hosted Storage Licence pending
Remote Backupstrapi-remote-backup-pro
Strapi backup & restore · v0.1.0

Strapi Remote Backup Pro In development

Back up and restore a Strapi instance remotely — without installing a plugin in it. Every other Strapi backup tool is a plugin, which means adding a dependency to a live CMS and redeploying it. This one authenticates against the same admin API the Strapi admin panel itself uses, so there is nothing to install, nothing to redeploy, and nothing running inside your production process.

The engine and its CLI work today: backing up a live Strapi v5 instance and restoring into another runs end to end, proved by a round-trip test against two live instances. The desktop app for Windows, macOS and Linux is designed and skeletoned but not yet implemented, and of the eight delivery destinations only the local one is wired up so far.

No Plugin Installed Strapi v5 Proved · v4 Written CLI Today · Desktop Next Content · Media · Schemas Relation-depth Restore Reviewable Restore Diff Local Destination Today S3 · Azure · Drive · SFTP Planned Retention · Scheduling with the App AES-256-GCM Archives Documented Format MIT
$ npx strapi-remote-backup-pro backup

Requires Node.js 20.11+ for the CLI. In development and not yet published to npm — the repository is public, the archive format is specified in full, and the project keeps a worksheet of what is measured to work rather than what is planned.

Open-source platforms

Not just utilities — whole products

Five of our platforms are open source in full, licence and all — and several pieces of the Rutba estate are published as repositories of their own.

SaaS

Rutba Suite

The next generation of our business software, sold as SaaS on rutba.io. Pieces of the estate are published in their own right — Rutba MTA, Rutba Media FileServer and Rutba Native Apps each have a public repository. The core engine, the app groups and the control plane are not published while we settle how the suite is licensed.

Actively developed

MIT

Rutba ERP

The first generation, and still maintained — 22 Next.js applications on a shared API covering point of sale, inventory, manufacturing, orders, marketplace, helpdesk, HR, payroll and accounting. MIT, and yours to run yourself.

Actively developed

AGPL

Rutba Office

A complete desktop office suite given away, in open beta — nine applications in one installer on sixteen engine packages: OOXML, a spreadsheet calculation engine, a .pptx renderer, a dependency-free PDF writer and a mail library that reads Outlook .pst and .ost in full, plus calendar and contacts engines. 922 engine tests, all passing. AGPL 3.0, with commercial licensing available.

Actively developed

AGPL

Rutba Media FileServer

A masters-only media origin with on-demand resizing and LRU caching — plus an optional digital asset platform: index, versions, collections, MFA, WebDAV and AI enrichment. AGPL 3.0, with commercial licensing available.

Actively developed

AGPL

Rutba MTA

Multi-tenant email relay middleware with reputation-based pacing, suppression management, bounce capture and signed webhooks. AGPL 3.0, with commercial licensing available.

Actively developed

APL

pgrecon

Oracle-to-PostgreSQL migration reconnaissance — a read-only extraction script, grammar-based PL/SQL parsing, 80 rules with evidence and remedies, an effort estimate in person-days, and a converter that emits PostgreSQL DDL for what it can prove. Apache 2.0.

Actively developed

Why we publish

Because the alternative is rewriting it

Every one of these packages started as internal code. A keystore because credentials were sitting in config files. A sync plugin because staging and production kept drifting. A media server because pre-generating six variants per image was costing more disk than the business justified. A migration assessor because every Oracle project we joined had already committed to a date before anyone read the PL/SQL. A remote backup tool because clients kept needing their Strapi instance backed up on hosting we had no deploy access to.

Publishing them costs us documentation time and gains us three things: the discipline of writing an interface someone else can use, the scrutiny of people who don't already know how it works, and the certainty that we can still use our own tools if our priorities change.

Small utilities get permissive licences — MIT, or Apache 2.0 where patent grants matter — because a restrictive licence on a keystore helps nobody. Whole products, and the Strapi plugins that are products in their own right, are AGPL 3.0 with a commercial licence beside it: free to use and study, paid for only by those who want to ship them closed or host them for others.

Using our packages?

  • Libraries free for commercial use under MIT / Apache 2.0
  • Commercial licences for the AGPL products and plugins
  • Issues and pull requests welcome on GitHub
  • Commercial support and custom work available
  • Happy to talk through an integration before you commit

Building on our work?

We'd genuinely like to hear about it — and we offer commercial support, integration and custom development around every package here.