Skip to main content

​
Context

Stackra is an open core. Community packages are the @stackra/* scope, MIT licensed (0024), and publish to npmjs with provenance (0177). Commercial packages are the @stackra-pro/* scope, sold under a commercial licence, and they reach customers from the private registry, with access gated at install (0177 decision 2, 0178). The @stackra-pro scope began in 0074. 0077 settled its list, and 0202 now defines it. A Pro package that wraps HeroUI Pro stays bound by 0197. Nothing so far says how much code each kind of artefact ships. The owner decided on 2026-10-24 that community code stays readable, that commercial code ships only in minified form, that app bundles are minified with their source maps kept private, and that logic worth protecting stays in services.

​
Decision

  1. Community packages (@stackra/*). They publish readable dist, .d.ts and source maps to npmjs, with provenance, as 0177 requires. A @stackra/* package that an ADR keeps private or restricted publishes as that ADR says (0310), not to npmjs.
  2. Pro and commercial packages (@stackra-pro/*). They ship minified dist and .d.ts only, with no source and no source maps. They come from Keygen Cloud, the private registry of 0177 decision 2, under a licence of 0178; 0202 defines what the scope holds. Their package.json lists no src in files and has no @stackra/source export condition, so every consumer, Vite and Vitest included, resolves dist. This amends 0177 decision 8 for the @stackra-pro/* scope alone; the condition and src stay for @stackra/*. Their source stays in the private Pro repository.
  3. Apps. App bundles are minified. Their source maps are uploaded privately to Sentry (0184 decision 6) and are never published. Apps stay private and unlicensed (0177, amendment of 2026-10-21).
  4. Valuable logic stays in services. Services are not published, so logic that must stay private runs in a service and not in a package or an app bundle. A feature whose logic lives in a service reaches the client through the generated client (0260).
  5. Selective obfuscation. It applies only to client-side Pro code. It does not apply to community packages, to services, or to app bundles, which are minified only.

​
Consequences

  • Community code is readable by anyone on npm, and its source maps let a reader map dist back to the source. Its licence is unchanged (0024).
  • Pro source never leaves the private repository, and a customer receives minified output only.
  • A feature that moves its logic into a service needs that service to run. It is no longer a library a client can run alone.

​
Enforcement

planned — the release job of 0177, decision 4 (publint, attw and a packed-tarball smoke test), asserts the shape of each tarball: a @stackra/* tarball carries its source maps, and a @stackra-pro/* tarball has no src/ folder and no .map file. The Sentry upload of app source maps and the selective obfuscation of client-side Pro code have no check yet.

​
Supersedes and sources

Supersedes: none. Amends: 0177 (decision 8, for @stackra-pro/* only). Builds on: 0024, 0074 (the origin of the @stackra-pro scope, superseded by 0077), 0077, 0177, 0197 and 0202. Sources: owner decision of 2026-10-24 on source protection and distribution.