> ## Documentation Index > Fetch the complete documentation index at: https://docs.stackra.figentra.com/llms.txt > Use this file to discover all available pages before exploring further. # 0316 — Open-core distribution: readable community packages, minified Pro packages and private source maps > Accepted · 2026-10-24 ## Context Stackra is an open core. Community packages are the `@stackra/*` scope, MIT licensed ([0024](https://docs.stackra.figentra.com/adr/0024-mit-license-with-exclusions.md)), and publish to npmjs with provenance ([0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md)). Commercial packages are the `@stackra-pro/*` scope, sold under a commercial licence, and they reach customers from the private registry, with access gated at install ([0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md) decision 2, [0178](https://docs.stackra.figentra.com/adr/0178-licensing-keygen-licences-and-the-stackra-licensing-verifier.md)). The `@stackra-pro` scope began in [0074](https://docs.stackra.figentra.com/adr/0074-open-core-licensing.md). [0077](https://docs.stackra.figentra.com/adr/0077-open-core-free-and-pro-lists.md) settled its list, and [0202](https://docs.stackra.figentra.com/adr/0202-stackra-pro-is-developer-side-os-capability-is-free-code.md) now defines it. A Pro package that wraps HeroUI Pro stays bound by [0197](https://docs.stackra.figentra.com/adr/0197-heroui-pro-is-used-only-in-our-own-apps.md). Nothing so far says how much code each kind of artefact ships. The owner decided on 2026-10-24 that community code stays readable, that commercial code ships only in minified form, that app bundles are minified with their source maps kept private, and that logic worth protecting stays in services. ## Decision 1. **Community packages (`@stackra/*`).** They publish readable `dist`, `.d.ts` and source maps to npmjs, with provenance, as [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md) requires. A `@stackra/*` package that an ADR keeps private or restricted publishes as that ADR says ([0310](https://docs.stackra.figentra.com/adr/0310-stackra-ui-pro-private-heroui-pro-wrappers.md)), not to npmjs. 2. **Pro and commercial packages (`@stackra-pro/*`).** They ship minified `dist` and `.d.ts` only, with no source and no source maps. They come from Keygen Cloud, the private registry of [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md) decision 2, under a licence of [0178](https://docs.stackra.figentra.com/adr/0178-licensing-keygen-licences-and-the-stackra-licensing-verifier.md); [0202](https://docs.stackra.figentra.com/adr/0202-stackra-pro-is-developer-side-os-capability-is-free-code.md) defines what the scope holds. Their `package.json` lists no `src` in `files` and has no `@stackra/source` export condition, so every consumer, Vite and Vitest included, resolves `dist`. This amends [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md) decision 8 for the `@stackra-pro/*` scope alone; the condition and `src` stay for `@stackra/*`. Their source stays in the private Pro repository. 3. **Apps.** App bundles are minified. Their source maps are uploaded privately to Sentry ([0184](https://docs.stackra.figentra.com/adr/0184-telemetry-opentelemetry-otlp-slis-heartbeats-and-log-retention.md) decision 6) and are never published. Apps stay private and unlicensed ([0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md), amendment of 2026-10-21). 4. **Valuable logic stays in services.** Services are not published, so logic that must stay private runs in a service and not in a package or an app bundle. A feature whose logic lives in a service reaches the client through the generated client ([0260](https://docs.stackra.figentra.com/adr/0260-cross-service-calls-through-injected-clients-and-events.md)). 5. **Selective obfuscation.** It applies only to client-side Pro code. It does not apply to community packages, to services, or to app bundles, which are minified only. ## Consequences * Community code is readable by anyone on npm, and its source maps let a reader map `dist` back to the source. Its licence is unchanged ([0024](https://docs.stackra.figentra.com/adr/0024-mit-license-with-exclusions.md)). * Pro source never leaves the private repository, and a customer receives minified output only. * A feature that moves its logic into a service needs that service to run. It is no longer a library a client can run alone. ## Enforcement planned — the release job of [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md), decision 4 (`publint`, `attw` and a packed-tarball smoke test), asserts the shape of each tarball: a `@stackra/*` tarball carries its source maps, and a `@stackra-pro/*` tarball has no `src/` folder and no `.map` file. The Sentry upload of app source maps and the selective obfuscation of client-side Pro code have no check yet. ## Supersedes and sources Supersedes: none. Amends: [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md) (decision 8, for `@stackra-pro/*` only). Builds on: [0024](https://docs.stackra.figentra.com/adr/0024-mit-license-with-exclusions.md), [0074](https://docs.stackra.figentra.com/adr/0074-open-core-licensing.md) (the origin of the `@stackra-pro` scope, superseded by [0077](https://docs.stackra.figentra.com/adr/0077-open-core-free-and-pro-lists.md)), [0077](https://docs.stackra.figentra.com/adr/0077-open-core-free-and-pro-lists.md), [0177](https://docs.stackra.figentra.com/adr/0177-package-distribution-npmjs-and-keygen.md), [0197](https://docs.stackra.figentra.com/adr/0197-heroui-pro-is-used-only-in-our-own-apps.md) and [0202](https://docs.stackra.figentra.com/adr/0202-stackra-pro-is-developer-side-os-capability-is-free-code.md). Sources: owner decision of 2026-10-24 on source protection and distribution. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.